1"use strict";(self.webpackChunkk_3_s_docs=self.webpackChunkk_3_s_docs||[]).push([[6915],{23034:(e,r,s)=>{s.r(r),s.d(r,{assets:()=>c,contentTitle:()=>l,default:()=>u,frontMatter:()=>a,metadata:()=>t,toc:()=>o});const t=JSON.parse('{"id":"security/self-assessment-1.7","title":"CIS 1.7 Self Assessment Guide","description":"Overview","source":"@site/docs/security/self-assessment-1.7.md","sourceDirName":"security","slug":"/security/self-assessment-1.7","permalink":"/security/self-assessment-1.7","draft":false,"unlisted":false,"editUrl":"https://github.com/k3s-io/docs/edit/main/docs/security/self-assessment-1.7.md","tags":[],"version":"current","lastUpdatedAt":1789781277000,"frontMatter":{"title":"CIS 1.7 Self Assessment Guide"}}');var n=s(74848),i=s(28453);const a={title:"CIS 1.7 Self Assessment Guide"},l=void 0,c={},o=[{value:"Overview",id:"overview",level:2},{value:"Testing controls methodology",id:"testing-controls-methodology",level:3},{value:"1.1 Control Plane Node Configuration Files",id:"11-control-plane-node-configuration-files",level:2},{value:"1.1.1 Ensure that the API server pod specification file permissions are set to 600 or more restrictive (Automated)",id:"111-ensure-that-the-api-server-pod-specification-file-permissions-are-set-to-600-or-more-restrictive-automated",level:3},{value:"1.1.2 Ensure that the API server pod specification file ownership is set to root (Automated)",id:"112-ensure-that-the-api-server-pod-specification-file-ownership-is-set-to-root-automated",level:3},{value:"1.1.3 Ensure that the controller manager pod specification file permissions are set to 600 or more restrictive (Automated)",id:"113-ensure-that-the-controller-manager-pod-specification-file-permissions-are-set-to-600-or-more-restrictive-automated",level:3},{value:"1.1.4 Ensure that the controller manager pod specification file ownership is set to root (Automated)",id:"114-ensure-that-the-controller-manager-pod-specification-file-ownership-is-set-to-root-automated",level:3},{value:"1.1.5 Ensure that the scheduler pod specification file permissions are set to 600 or more restrictive (Automated)",id:"115-ensure-that-the-scheduler-pod-specification-file-permissions-are-set-to-600-or-more-restrictive-automated",level:3},{value:"1.1.6 Ensure that the scheduler pod specification file ownership is set to root (Automated)",id:"116-ensure-that-the-scheduler-pod-specification-file-ownership-is-set-to-root-automated",level:3},{value:"1.1.7 Ensure that the etcd pod specification file permissions are set to 600 or more restrictive (Automated)",id:"117-ensure-that-the-etcd-pod-specification-file-permissions-are-set-to-600-or-more-restrictive-automated",level:3},{value:"1.1.8 Ensure that the etcd pod specification file ownership is set to root (Automated)",id:"118-ensure-that-the-etcd-pod-specification-file-ownership-is-set-to-root-automated",level:3},{value:"1.1.9 Ensure that the Container Network Interface file permissions are set to 600 or more restrictive (Manual)",id:"119-ensure-that-the-container-network-interface-file-permissions-are-set-to-600-or-more-restrictive-manual",level:3},{value:"1.1.10 Ensure that the Container Network Interface file ownership is set to root (Automated)",id:"1110-ensure-that-the-container-network-interface-file-ownership-is-set-to-root-automated",level:3},{value:"1.1.11 Ensure that the etcd data directory permissions are set to 700 or more restrictive (Automated)",id:"1111-ensure-that-the-etcd-data-directory-permissions-are-set-to-700-or-more-restrictive-automated",level:3},{value:"1.1.12 Ensure that the etcd data directory ownership is set to etcd (Automated)",id:"1112-ensure-that-the-etcd-data-directory-ownership-is-set-to-etcd-automated",level:3},{value:"1.1.13 Ensure that the admin.conf file permissions are set to 600 or more restrictive (Automated)",id:"1113-ensure-that-the-adminconf-file-permissions-are-set-to-600-or-more-restrictive-automated",level:3},{value:"1.1.14 Ensure that the admin.conf file ownership is set to root (Automated)",id:"1114-ensure-that-the-adminconf-file-ownership-is-set-to-root-automated",level:3},{value:"1.1.15 Ensure that the scheduler.conf file permissions are set to 600 or more restrictive (Automated)",id:"1115-ensure-that-the-schedulerconf-file-permissions-are-set-to-600-or-more-restrictive-automated",level:3},{value:"1.1.16 Ensure that the scheduler.conf file ownership is set to root (Automated)",id:"1116-ensure-that-the-schedulerconf-file-ownership-is-set-to-root-automated",level:3},{value:"1.1.17 Ensure that the controller-manager.conf file permissions are set to 600 or more restrictive (Automated)",id:"1117-ensure-that-the-controller-managerconf-file-permissions-are-set-to-600-or-more-restrictive-automated",level:3},{value:"1.1.18 Ensure that the controller-manager.conf file ownership is set to root (Automated)",id:"1118-ensure-that-the-controller-managerconf-file-ownership-is-set-to-root-automated",level:3},{value:"1.1.19 Ensure that the Kubernetes PKI directory and file ownership is set to root (Automated)",id:"1119-ensure-that-the-kubernetes-pki-directory-and-file-ownership-is-set-to-root-automated",level:3},{value:"1.1.20 Ensure that the Kubernetes PKI certificate file permissions are set to 600 or more restrictive (Manual)",id:"1120-ensure-that-the-kubernetes-pki-certificate-file-permissions-are-set-to-600-or-more-restrictive-manual",level:3},{value:"1.1.21 Ensure that the Kubernetes PKI key file permissions are set to 600 (Automated)",id:"1121-ensure-that-the-kubernetes-pki-key-file-permissions-are-set-to-600-automated",level:3},{value:"1.2 API Server",id:"12-api-server",level:2},{value:"1.2.1 Ensure that the --anonymous-auth argument is set to false (Automated)",id:"121-ensure-that-the---anonymous-auth-argument-is-set-to-false-automated",level:3},{value:"1.2.2 Ensure that the --token-auth-file parameter is not set (Automated)",id:"122-ensure-that-the---token-auth-file-parameter-is-not-set-automated",level:3},{value:"1.2.3 Ensure that the --DenyServiceExternalIPs is not set (Automated)",id:"123-ensure-that-the---denyserviceexternalips-is-not-set-automated",level:3},{value:"1.2.4 Ensure that the --kubelet-client-certificate and --kubelet-client-key arguments are set as appropriate (Automated)",id:"124-ensure-that-the---kubelet-client-certificate-and---kubelet-client-key-arguments-are-set-as-appropriate-automated",level:3},{value:"1.2.5 Ensure that the --kubelet-certificate-authority argument is set as appropriate (Automated)",id:"125-ensure-that-the---kubelet-certificate-authority-argument-is-set-as-appropriate-automated",level:3},{value:"1.2.6 Ensure that the --authorization-mode argument is not set to AlwaysAllow (Automated)",id:"126-ensure-that-the---authorization-mode-argument-is-not-set-to-alwaysallow-automated",level:3},{value:"1.2.7 Ensure that the --authorization-mode argument includes Node (Automated)",id:"127-ensure-that-the---authorization-mode-argument-includes-node-automated",level:3},{value:"1.2.8 Ensure that the --authorization-mode argument includes RBAC (Automated)",id:"128-ensure-that-the---authorization-mode-argument-includes-rbac-automated",level:3}
1,{value:"1.2.9 Ensure that the admission control plugin EventRateLimit is set (Manual)",id:"129-ensure-that-the-admission-control-plugin-eventratelimit-is-set-manual",level:3},{value:"1.2.10 Ensure that the admission control plugin AlwaysAdmit is not set (Automated)",id:"1210-ensure-that-the-admission-control-plugin-alwaysadmit-is-not-set-automated",level:3},{value:"1.2.11 Ensure that the admission control plugin AlwaysPullImages is set (Manual)",id:"1211-ensure-that-the-admission-control-plugin-alwayspullimages-is-set-manual",level:3},{value:"1.2.12 Ensure that the admission control plugin SecurityContextDeny is set if PodSecurityPolicy is not used (Manual)",id:"1212-ensure-that-the-admission-control-plugin-securitycontextdeny-is-set-if-podsecuritypolicy-is-not-used-manual",level:3},{value:"1.2.13 Ensure that the admission control plugin ServiceAccount is set (Automated)",id:"1213-ensure-that-the-admission-control-plugin-serviceaccount-is-set-automated",level:3},{value:"1.2.14 Ensure that the admission control plugin NamespaceLifecycle is set (Automated)",id:"1214-ensure-that-the-admission-control-plugin-namespacelifecycle-is-set-automated",level:3},{value:"1.2.15 Ensure that the admission control plugin NodeRestriction is set (Automated)",id:"1215-ensure-that-the-admission-control-plugin-noderestriction-is-set-automated",level:3},{value:"1.2.16 Ensure that the --secure-port argument is not set to 0 - NoteThis recommendation is obsolete and will be deleted per the consensus process (Automated)",id:"1216-ensure-that-the---secure-port-argument-is-not-set-to-0---notethis-recommendation-is-obsolete-and-will-be-deleted-per-the-consensus-process-automated",level:3},{value:"1.2.17 Ensure that the --profiling argument is set to false (Automated)",id:"1217-ensure-that-the---profiling-argument-is-set-to-false-automated",level:3},{value:"1.2.18 Ensure that the --audit-log-path argument is set (Manual)",id:"1218-ensure-that-the---audit-log-path-argument-is-set-manual",level:3},{value:"1.2.19 Ensure that the --audit-log-maxage argument is set to 30 or as appropriate (Manual)",id:"1219-ensure-that-the---audit-log-maxage-argument-is-set-to-30-or-as-appropriate-manual",level:3},{value:"1.2.20 Ensure that the --audit-log-maxbackup argument is set to 10 or as appropriate (Manual)",id:"1220-ensure-that-the---audit-log-maxbackup-argument-is-set-to-10-or-as-appropriate-manual",level:3},{value:"1.2.21 Ensure that the --audit-log-maxsize argument is set to 100 or as appropriate (Manual)",id:"1221-ensure-that-the---audit-log-maxsize-argument-is-set-to-100-or-as-appropriate-manual",level:3},{value:"1.2.22 Ensure that the --request-timeout argument is set as appropriate (Manual)",id:"1222-ensure-that-the---request-timeout-argument-is-set-as-appropriate-manual",level:3},{value:"1.2.23 Ensure that the --service-account-lookup argument is set to true (Automated)",id:"1223-ensure-that-the---service-account-lookup-argument-is-set-to-true-automated",level:3},{value:"1.2.24 Ensure that the --service-account-key-file argument is set as appropriate (Automated)",id:"1224-ensure-that-the---service-account-key-file-argument-is-set-as-appropriate-automated",level:3},{value:"1.2.25 Ensure that the --etcd-certfile and --etcd-keyfile arguments are set as appropriate (Automated)",id:"1225-ensure-that-the---etcd-certfile-and---etcd-keyfile-arguments-are-set-as-appropriate-automated",level:3},{value:"1.2.26 Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate (Automated)",id:"1226-ensure-that-the---tls-cert-file-and---tls-private-key-file-arguments-are-set-as-appropriate-automated",level:3},{value:"1.2.27 Ensure that the --client-ca-file argument is set as appropriate (Automated)",id:"1227-ensure-that-the---client-ca-file-argument-is-set-as-appropriate-automated",level:3},{value:"1.2.28 Ensure that the --etcd-cafile argument is set as appropriate (Automated)",id:"1228-ensure-that-the---etcd-cafile-argument-is-set-as-appropriate-automated",level:3},{value:"1.2.29 Ensure that the --encryption-provider-config argument is set as appropriate (Manual)",id:"1229-ensure-that-the---e
1ncryption-provider-config-argument-is-set-as-appropriate-manual",level:3},{value:"1.2.30 Ensure that encryption providers are appropriately configured (Manual)",id:"1230-ensure-that-encryption-providers-are-appropriately-configured-manual",level:3},{value:"1.2.31 Ensure that the API Server only makes use of Strong Cryptographic Ciphers (Automated)",id:"1231-ensure-that-the-api-server-only-makes-use-of-strong-cryptographic-ciphers-automated",level:3},{value:"1.3 Controller Manager",id:"13-controller-manager",level:2},{value:"1.3.1 Ensure that the --terminated-pod-gc-threshold argument is set as appropriate (Manual)",id:"131-ensure-that-the---terminated-pod-gc-threshold-argument-is-set-as-appropriate-manual",level:3},{value:"1.3.2 Ensure that the --profiling argument is set to false (Automated)",id:"132-ensure-that-the---profiling-argument-is-set-to-false-automated",level:3},{value:"1.3.3 Ensure that the --use-service-account-credentials argument is set to true (Automated)",id:"133-ensure-that-the---use-service-account-credentials-argument-is-set-to-true-automated",level:3},{value:"1.3.4 Ensure that the --service-account-private-key-file argument is set as appropriate (Automated)",id:"134-ensure-that-the---service-account-private-key-file-argument-is-set-as-appropriate-automated",level:3},{value:"1.3.5 Ensure that the --root-ca-file argument is set as appropriate (Automated)",id:"135-ensure-that-the---root-ca-file-argument-is-set-as-appropriate-automated",level:3},{value:"1.3.6 Ensure that the RotateKubeletServerCertificate argument is set to true (Automated)",id:"136-ensure-that-the-rotatekubeletservercertificate-argument-is-set-to-true-automated",level:3},{value:"1.3.7 Ensure that the --bind-address argument is set to 127.0.0.1 (Automated)",id:"137-ensure-that-the---bind-address-argument-is-set-to-127001-automated",level:3},{value:"1.4 Scheduler",id:"14-scheduler",level:2},{value:"1.4.1 Ensure that the --profiling argument is set to false (Automated)",id:"141-ensure-that-the---profiling-argument-is-set-to-false-automated",level:3},{value:"1.4.2 Ensure that the --bind-address argument is set to 127.0.0.1 (Automated)",id:"142-ensure-that-the---bind-address-argument-is-set-to-127001-automated",level:3},{value:"2 Etcd Node Configuration",id:"2-etcd-node-configuration",level:2},{value:"2.1 Ensure that the --cert-file and --key-file arguments are set as appropriate (Automated)",id:"21-ensure-that-the---cert-file-and---key-file-arguments-are-set-as-appropriate-automated",level:3},{value:"2.2 Ensure that the --client-cert-auth argument is set to true (Automated)",id:"22-ensure-that-the---client-cert-auth-argument-is-set-to-true-automated",level:3},{value:"2.3 Ensure that the --auto-tls argument is not set to true (Automated)",id:"23-ensure-that-the---auto-tls-argument-is-not-set-to-true-automated",level:3},{value:"2.4 Ensure that the --peer-cert-file and --peer-key-file arguments are set as appropriate (Automated)",id:"24-ensure-that-the---peer-cert-file-and---peer-key-file-arguments-are-set-as-appropriate-automated",level:3},{value:"2.5 Ensure that the --peer-client-cert-auth argument is set to true (Automated)",id:"25-ensure-that-the---peer-client-cert-auth-argument-is-set-to-true-automated",level:3},{value:"2.6 Ensure that the --peer-auto-tls argument is not set to true (Automated)",id:"26-ensure-that-the---peer-auto-tls-argument-is-not-set-to-true-automated",level:3},{value:"2.7 Ensure that a unique Certificate Authority is used for etcd (Automated)",id:"27-ensure-that-a-unique-certificate-authority-is-used-for-etcd-automated",level:3},{value:"4.1 Worker Node Configuration Files",id:"41-worker-node-configuration-files",level:2},{value:"4.1.1 Ensure that the kubelet service file permissions are set to 600 or more restrictive (Automated)",id:"411-ensure-that-the-kubelet-service-file-permissions-are-set-to-600-or-more-restrictive-automated",level:3},{value:"4.1.2 Ensure that the kubelet service file ownership is set to root (Automated)",id:"412-ensure-that-the-kubelet-service-file-ownership-is-set-to-root-automated",level:3},{value:"4.1.3 If proxy kubeconfig file exists ensure permissions are set to 600 or more restrictive (Automated)",id:"413-if-proxy-kubeconfig-file-exists-ensure-permissions-are-set-to-600-or-more-restrictive-automated",level:3},{value:"4.1.4 If proxy kubeconfig file exists ensure ownership is set to root (Automated)",id:"414-if-proxy-kubeconfig-file-exists-ensure-ownership-is-set-to-root-automated",level:3},{value:"4.1.5 Ensure that the --kubeconfig kubelet.conf file permissions are set to 600 or more restrictive (Automated)",id:"415-ensure-that-the---kubeconfig-kubeletconf-file-permissions-are-set-to-600-or-more-restrictive-automated",level:3},{value:"4.1.6 Ensure that the --kubeconfig kubelet.conf file ownership is set to root (Automated)",id:"416-ensure-that-the---kubeconfig-kubeletconf-file-ownership-is-set-to-root-automated",level:3},{value:"4.1.7 Ensure that the certificate authorities file permissions are set to 600 or more restrictive (Automated)",id:"417-ensure-that-the-certificate-authorities-file-permissions-are-set-to-600-or-more-restrictive-automated",level:3},{value:"4.1.8 Ensure that the client certificate authorities file ownership is set to root (Automated)",id:"418-ensure-that-the-client-certificate-authorities-file-ownership-is-set-to-root-automated",level:3},{value:"4.1.9 Ensure that the kubelet --config configuration file has permissions set to 600 or more restrictive (Automated)",id:"419-ensure-that-the-kubelet---config-configuration-file-has-permissions-set-to-600-or-more-restrictive-automated",level:3},{value:"4.1.10 Ensure that the kubelet --config configuration file ownership is set to root (Automated)",id:"4110-ensure-that-the-kubelet---config-configuration-file-ownership-is-set-to-root-automated",level:3},{value:"4.2 Kubelet",id:"42-kubelet",level:2},{value:"4.2.1 Ensure that the --anonymous-auth argument is set to false (Automated)",id:"421-ensure-that-the---anonymous-auth-argument-is-set-to-false-automated",level:3},{value:"4.2.2 Ensure that the --authorization-mode argument is not set to AlwaysAllow (Automated)",id:"422-ensure-that-the---authorization-mode-argument-is-not-set-to-alwaysallow-automated",level:3},{value:"4.2.3 Ensure that the --client-ca-file argument is set as appropriate (Automated)",id:"423-ensure-that-the---client-ca-file-argument-is-set-as-appropriate-automated",level:3},{value:"4.2.4 Verify that the --read-only-port argument is set to 0 (Automated)",id:"424-verify-that-the---read-only-port-argument-is-set-to-0-automated",level:3},{value:"4.2.5 Ensure that the --streaming-connection-idle-timeout argument is not set to 0 (Manual)",id:"425-ensure-that-the---streaming-connection-idle-timeout-argument-is-not-set-to-0-manual",level:3},{value:"4.2.6 Ensure that the --make-iptables-util-chains argument is set to true (Automated)",id:"426-ensure-that-the---make-iptables-util-chains-argument-is-set-to-true-automated",level:3},{value:"4.2.7 Ensure that the --hostname-override argument is not set (Automated)",id:"427-ensure-that-the---hostname-override-argument-is-not-set-automated",level:3},{value:"4.2.8 Ensure that the eventRecordQPS argument is set to a level which ensures appropriate event capture (Manual)",id:"428-ensure-that-the-eventrecordqps-argument-is-set-to-a-level-which-ensures-appropriate-event-capture-manual",level:3},{value:"4.2.9 Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate (Automated)",id:"429-ensure-that-the---tls-cert-file-and---tls-private-key-file-arguments-are-set-as-appropriate-automated",level:3},{value:"4.2.10 Ensure that the --rotate-certificates argument is not set to false (Automated)",id:"4210-ensure-that-the---rotate-certificates-argument-is-not-set-to-false-automated",level:3},{value:"4.2.11 Verify that the RotateKubeletServerCertificate argument is set to true (Automated)",id:"4211-verify-that-the-rotatekubeletservercertificate-argument-is-set-to-true-automated",level:3},{value:"4.2.12 Ensure that the Kubelet only makes use of Strong Cryptographic Ciphers (Manual)",id:"4212-ensure-that-the-kubelet-only-makes-use-of-strong-cryptographic-ciphers-manual",level:3},{value:"4.2.13 Ensure that a limit is set on pod PIDs (Manual)",id:"4213-ensure-that-a-limit-is-set-on-pod-pids-manual",level:3},{value:"5.1 RBAC and Service Accounts",id:"51-rbac-and-service-accounts",level:2},{value:"5.1.1 Ensure that the cluster-admin role is only used where required (Manual)",id:"511-ensure-that-the-cluster-admin-role-is-only-used-where-required-manual",level:3},{value:"5.1.2 Minimize access to secrets (Manual)",id:"512-minimize-access-to-secrets-manual",level:3},{value:"5.1.3 Minimize wildcard use in Roles and ClusterRoles (Manual)",id:"513-minimize-wildcard-use-in-roles-and-clusterroles-manual",level:3},{value:"5.1.4 Minimize access to create pods (Manual)",id:"514-minimize-access-to-create-pods-manual",level:3},{value:"5.1.5 Ensure that default service accounts are not actively used. (Manual)",id:"515-ensure-that-default-service-accounts-are-not-actively-used-manual",level:3},{value:"5.1.6 Ensure that Service Account Tokens are only mounted where necessary (Manual)",id:"516-ensure-that-service-account-tokens-are-only-mounted-where-necessary-manual",level:3},{value:"5.1.7 Avoid use of system group (Manual)",id:"517-avoid-use-of-system-group-manual",level:3},{value:"5.1.8 Limit use of the Bind, Impersonate and Escalate permissions in the Kubernetes cluster (Manual)",id:"518-limit-use-of-the-bind-impersonate-and-escalate-permissions-in-the-kubernetes-cluster-manual",level:3},{value:"5.1.9 Minimize access to create persistent volumes (Manual)",id:"519-minimize-access-to-create-persistent-volumes-manual",level:3}
1,{value:"5.1.10 Minimize access to the proxy sub-resource of nodes (Manual)",id:"5110-minimize-access-to-the-proxy-sub-resource-of-nodes-manual",level:3},{value:"5.1.11 Minimize access to the approval sub-resource of certificatesigningrequests objects (Manual)",id:"5111-minimize-access-to-the-approval-sub-resource-of-certificatesigningrequests-objects-manual",level:3},{value:"5.1.12 Minimize access to webhook configuration objects (Manual)",id:"5112-minimize-access-to-webhook-configuration-objects-manual",level:3},{value:"5.1.13 Minimize access to the service account token creation (Manual)",id:"5113-minimize-access-to-the-service-account-token-creation-manual",level:3},{value:"5.2 Pod Security Standards",id:"52-pod-security-standards",level:2},{value:"5.2.1 Ensure that the cluster has at least one active policy control mechanism in place (Manual)",id:"521-ensure-that-the-cluster-has-at-least-one-active-policy-control-mechanism-in-place-manual",level:3},{value:"5.2.2 Minimize the admission of privileged containers (Manual)",id:"522-minimize-the-admission-of-privileged-containers-manual",level:3},{value:"5.2.3 Minimize the admission of containers wishing to share the host process ID namespace (Automated)",id:"523-minimize-the-admission-of-containers-wishing-to-share-the-host-process-id-namespace-automated",level:3},{value:"5.2.4 Minimize the admission of containers wishing to share the host IPC namespace (Automated)",id:"524-minimize-the-admission-of-containers-wishing-to-share-the-host-ipc-namespace-automated",level:3},{value:"5.2.5 Minimize the admission of containers wishing to share the host network namespace (Automated)",id:"525-minimize-the-admission-of-containers-wishing-to-share-the-host-network-namespace-automated",level:3},{value:"5.2.6 Minimize the admission of containers with allowPrivilegeEscalation (Automated)",id:"526-minimize-the-admission-of-containers-with-allowprivilegeescalation-automated",level:3},{value:"5.2.7 Minimize the admission of root containers (Automated)",id:"527-minimize-the-admission-of-root-containers-automated",level:3},{value:"5.2.8 Minimize the admission of containers with the NET_RAW capability (Automated)",id:"528-minimize-the-admission-of-containers-with-the-net_raw-capability-automated",level:3},{value:"5.2.9 Minimize the admission of containers with added capabilities (Automated)",id:"529-minimize-the-admission-of-containers-with-added-capabilities-automated",level:3},{value:"5.2.10 Minimize the admission of containers with capabilities assigned (Manual)",id:"5210-minimize-the-admission-of-containers-with-capabilities-assigned-manual",level:3}
1,{value:"5.2.11 Minimize the admission of Windows HostProcess containers (Manual)",id:"5211-minimize-the-admission-of-windows-hostprocess-containers-manual",level:3},{value:"5.2.12 Minimize the admission of HostPath volumes (Manual)",id:"5212-minimize-the-admission-of-hostpath-volumes-manual",level:3},{value:"5.2.13 Minimize the admission of containers which use HostPorts (Manual)",id:"5213-minimize-the-admission-of-containers-which-use-hostports-manual",level:3},{value:"5.3 Network Policies and CNI",id:"53-network-policies-and-cni",level:2},{value:"5.3.1 Ensure that the CNI in use supports NetworkPolicies (Manual)",id:"531-ensure-that-the-cni-in-use-supports-networkpolicies-manual",level:3},{value:"5.3.2 Ensure that all Namespaces have NetworkPolicies defined (Manual)",id:"532-ensure-that-all-namespaces-have-networkpolicies-defined-manual",level:3},{value:"5.4 Secrets Management",id:"54-secrets-management",level:2},{value:"5.4.1 Prefer using Secrets as files over Secrets as environment variables (Manual)",id:"541-prefer-using-secrets-as-files-over-secrets-as-environment-variables-manual",level:3},{value:"5.4.2 Consider external secret storage (Manual)",id:"542-consider-external-secret-storage-manual",level:3},{value:"5.5 Extensible Admission Control",id:"55-extensible-admission-control",level:2},{value:"5.5.1 Configure Image Provenance using ImagePolicyWebhook admission controller (Manual)",id:"551-configure-image-provenance-using-imagepolicywebhook-admission-controller-manual",level:3},{value:"5.7 General Policies",id:"57-general-policies",level:2},{value:"5.7.1 Create administrative boundaries between resources using namespaces (Manual)",id:"571-create-administrative-boundaries-between-resources-using-namespaces-manual",level:3},{value:"5.7.2 Ensure that the seccomp profile is set to docker/default in your Pod definitions (Manual)",id:"572-ensure-that-the-seccomp-profile-is-set-to-dockerdefault-in-your-pod-definitions-manual",level:3},{value:"5.7.3 Apply SecurityContext to your Pods and Containers (Manual)",id:"573-apply-securitycontext-to-your-pods-and-containers-manual",level:3},{value:"5.7.4 The default namespace should not be used (Manual)",id:"574-the-default-namespace-should-not-be-used-manual",level:3}];function d(e){const r={a:"a",admonition:"admonition",code:"code",h2:"h2",h3:"h3",li:"li",p:"p",pre:"pre",strong:"strong",ul:"ul",...(0,i.R)(),...e.components},{Details:s}=r;return s||function(e,r){throw new Error("Expected "+(r?"component":"object")+" `"+e+"` to be defined: you likely forgot to import, pass, or provide it.")}("Details",!0),(0,n.jsxs)(n.Fragment,{children:[(0,n.jsx)(r.h2,{id:"overview",children:"Overview"}),"\n",(0,n.jsxs)(r.p,{children:["This document is a companion to the ",(0,n.jsx)(r.a,{href:"/security/hardening-guide",children:"K3s security hardening guide"}),". The hardening guide provides prescriptive guidance for hardening a production installation of K3s, and this benchmark guide is meant to help you evaluate the level of security of the hardened cluster against each control in the CIS Kubernetes Benchmark. It is to be used by K3s operators, security teams, auditors, and decision-makers."]}),"\n",(0,n.jsxs)(r.p,{children:["This guide is specific to the ",(0,n.jsx)(r.strong,{children:"v1.25"})," release line of K3s and the ",(0,n.jsx)(r.strong,{children:"v1.7.1"})," release of the CIS Kubernetes Benchmark."]}),"\n",(0,n.jsxs)(r.p,{children:["For more information about each control, including detailed descriptions and remediations for failing tests, you can refer to the corresponding section of the CIS Kubernetes Benchmark v1.7.1. You can download the benchmark, after creating a free account, in ",(0,n.jsx)(r.a,{href:"https://www.cisecurity.org/benchmark/kubernetes",children:"Center for Internet Security (CIS)"}),"."]}),"\n",(0,n.jsx)(r.h3,{id:"testing-controls-methodology",children:"Testing controls methodology"}),"\n",(0,n.jsx)(r.p,{children:"Each control in the CIS Kubernetes Benchmark was evaluated against a K3s cluster that was configured according to the accompanying hardening guide."}),"\n",(0,n.jsx)(r.p,{children:"Where control audits differ from the original CIS benchmark, the audit commands specific to K3s are provided for testing."}),"\n",(0,n.jsx)(r.p,{children:"These are the possible results for each control:"}),"\n",(0,n.jsxs)(r.ul,{children:["\n",(0,n.jsxs)(r.li,{children:[(0,n.jsx)(r.strong,{children:"Pass"})," - The K3s cluster under test passed the audit outlined in the benchmark."]}),"\n",(0,n.jsxs)(r.li,{children:[(0,n.jsx)(r.strong,{children:"Not Applicable"})," - The control is not applicable to K3s because of how it is designed to operate. The remediation section will explain why this is so."]}),"\n",(0,n.jsxs)(r.li,{children:[(0,n.jsx)(r.strong,{children:"Warn"})," - The control is manual in the CIS benchmark and it depends on the cluster's use case or some other factor that must be determined by the cluster operator. These
1controls have been evaluated to ensure K3s does not prevent their implementation, but no further configuration or auditing of the cluster under test has been performed."]}),"\n"]}),"\n",(0,n.jsx)(r.p,{children:'This guide makes the assumption that K3s is running as a Systemd unit. Your installation may vary and will require you to adjust the "audit" commands to fit your scenario.'}),"\n",(0,n.jsx)(r.admonition,{type:"note",children:(0,n.jsxs)(r.p,{children:["Only ",(0,n.jsx)(r.code,{children:"scored"})," test, also know as ",(0,n.jsx)(r.code,{children:"automated"})," tests are covered in this guide."]})}),"\n",(0,n.jsx)(r.h2,{id:"11-control-plane-node-configuration-files",children:"1.1 Control Plane Node Configuration Files"}),"\n",(0,n.jsx)(r.h3,{id:"111-ensure-that-the-api-server-pod-specification-file-permissions-are-set-to-600-or-more-restrictive-automated",children:"1.1.1 Ensure that the API server pod specification file permissions are set to 600 or more restrictive (Automated)"}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," Not Applicable"]}),"\n",(0,n.jsx)(r.p,{children:(0,n.jsx)(r.strong,{children:"Rationale:"})}),"\n",(0,n.jsx)(r.p,{children:"By default, K3s embeds the api server within the k3s process. There is no API server pod specification file."}),"\n",(0,n.jsxs)(r.h3,{id:"112-ensure-that-the-api-server-pod-specification-file-ownership-is-set-to-root-automated",children:["1.1.2 Ensure that the API server pod specification file ownership is set to root",":root"," (Automated)"]}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," Not Applicable"]}),"\n",(0,n.jsx)(r.p,{children:(0,n.jsx)(r.strong,{children:"Rationale:"})}),"\n",(0,n.jsx)(r.p,{children:"By default, K3s embeds the api server within the k3s process. There is no API server pod specification file."}),"\n",(0,n.jsx)(r.h3,{id:"113-ensure-that-the-controller-manager-pod-specification-file-permissions-are-set-to-600-or-more-restrictive-automated",children:"1.1.3 Ensure that the controller manager pod specification file permissions are set to 600 or more restrictive (Automated)"}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," Not Applicable"]}),"\n",(0,n.jsx)(r.p,{children:(0,n.jsx)(r.strong,{children:"Rationale:"})}),"\n",(0,n.jsx)(r.p,{children:"By default, K3s embeds the controller manager within the k3s process. There is no controller manager pod specification file."}),"\n",(0,n.jsxs)(r.h3,{id:"114-ensure-that-the-controller-manager-pod-specification-file-ownership-is-set-to-root-automated",children:["1.1.4 Ensure that the controller manager pod specification file ownership is set to root",":root"," (Automated)"]}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," Not Applicable"]}),"\n",(0,n.jsx)(r.p,{children:(0,n.jsx)(r.strong,{children:"Rationale:"})}),"\n",(0,n.jsx)(r.p,{children:"By default, K3s embeds the controller manager within the k3s process. There is no controller manager pod specification file."}),"\n",(0,n.jsx)(r.h3,{id:"115-ensure-that-the-scheduler-pod-specification-file-permissions-are-set-to-600-or-more-restrictive-automated",children:"1.1.5 Ensure that the scheduler pod specification file permissions are set to 600 or more restrictive (Automated)"}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," Not Applicable"]}),"\n",(0,n.jsx)(r.p,{children:(0,n.jsx)(r.strong,{children:"Rationale:"})}),"\n",(0,n.jsx)(r.p,{children:"By default, K3s embeds the scheduler within the k3s process. There is no scheduler pod specification file."}),"\n",(0,n.jsxs)(r.h3,{id:"116-ensure-that-the-scheduler-pod-specification-file-ownership-is-set-to-root-automated",children:["1.1.6 Ensure that the scheduler pod specification file ownership is set to root",":root"," (Automated)"]}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," Not Applicable"]}),"\n",(0,n.jsx)(r.p,{children:(0,n.jsx)(r.strong,{children:"Rationale:"})}),"\n",(0,n.jsx)(r.p,{children:"By default, K3s embeds the scheduler within the k3s process. There is no scheduler pod specification file."}),"\n",(0,n.jsx)(r.h3,{id:"117-ensure-that-the-etcd-pod-specification-file-permissions-are-set-to-600-or-more-restrictive-automated",children:"1.1.7 Ensure that the etcd pod specification file permissions are set to 600 or more restrictive (Automated)"}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," Not Applicable"]}),"\n",(0,n.jsx)(r.p,{children:(0,n.jsx)(r.strong,{children:"Rationale:"})}),"\n",(0,n.jsx)(r.p,{children:"By default, K3s embeds etcd within the k3s process. There is no etcd pod specification file."}),"\n",(0,n.jsxs)(r.h3,{id:"118-ensure-that-the-etcd-pod-specification-file-ownership-is-set-to-root-automated",children:["1.1.8 Ensure that the etcd pod specification file ownership is set to root",":root"," (Automated)"]}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," Not Applicable"]}),"\n",(0,n.jsx)(r.p,{children:(0,n.jsx)(r.strong,{children:"Rationale:"})}),"\n",(0,n.jsx)(r.p,{children:"By default, K3s embeds etcd within the k3s process. There is no etcd pod specification file."}),"\n",(0,n.jsx)(r.h3,{id:"119-ensure-that-the-container-network-interface-file-permissions-are-set-to-600-or-more-restrictive-manual",children:"1.1.9 Ensure that the Container Network Interface file permissions are set to 600 or more restrictive (Manual)"}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Remediation:"}),"\nBy default, K3s sets the CNI file permissions to 644.\nNote that for many CNIs, a lock file is created with permissions 750. This is expected and can be ignored.\nIf you modify your CNI configuration, ensure that the permissions are set to 600.\nFor example, ",(0,n.jsx)(r.code,{children:"chmod 600 /var/lib/cni/networks/<filename>"})]}),"\n",(0,n.jsxs)(r.h3,{id:"1110-ensure-that-the-container-network-interface-file-ownership-is-set-to-root-automated",children:["1.1.10 Ensure that the Container Network Interface file ownership is set to root",":root"," (Automated)"]}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,n.jsx)(r.p,{children:(0,n.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-bash",children:"ps -ef | grep containerd | grep -- --cni-conf-dir | sed 's%.*cni-conf-dir[= ]\\([^ ]*\\).*%\\1%' | xargs -I{} find {} -mindepth 1 | xargs --no-run-if-empty stat -c %U:%G\nfind /var/lib/cni/networks -type f 2> /dev/null | xargs --no-run-if-empty stat -c %U:%G\n"})}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Expected Result:"})," 'root",":root","' is present"]}),"\n",(0,n.jsxs)(s,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Returned Value:"})}),(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-log",children:"root:root\nroot:root\nroot:root\nroot:root\nroot:root\nroot:root\nroot:root\n"})})]}),"\n",(0,n.jsxs)(s,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Remediation:"})}),(0,n.jsxs)(r.p,{children:["Run the below command (based on the file location on your system) on the control plane node.\nFor example,\n",(0,n.jsx)(r.code,{children:"chown root:root <path/to/cni/files>"})]})]}),"\n",(0,n.jsx)(r.h3,{id:"1111-ensure-that-the-etcd-data-directory-permissions-are-set-to-700-or-more-restrictive-automated",children:"1.1.11 Ensure that the etcd data directory permissions are set to 700 or more restrictive (Automated)"}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,n.jsx)(r.p,{children:(0,n.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-bash",children:'if [ "$(journalctl -u k3s | grep -m1 \'Managed etcd cluster\' | wc -l)" -gt 0 ]; then\n stat -c permissions=%a /var/lib/rancher/k3s/server/db/etcd\nelse\n echo "permissions=700"\nfi\n'})}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Expected Result:"})," permissions has permissions 700, expected 700 or more restrictive"]}),"\n",(0,n.jsxs)(s,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Returned Value:"})}),(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-log",children:"permissions=700\n"})})]}),"\n",(0,n.jsxs)(s,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Remediation:"})}),(0,n.jsxs)(r.p,{children:["On the etcd server node, get the etcd data directory, passed as an argument --data-dir,\nfrom the command 'ps -ef | grep etcd'.\nRun the below command (based on the etcd data directory found above). For example,\n",(0,n.jsx)(r.code,{children:"chmod 700 /var/lib/rancher/k3s/server/db/etcd"})]})]}),"\n",(0,n.jsxs)(r.h3,{id:"1112-ensure-that-the-etcd-data-directory-ownership-is-set-to-etcd-automated",children:["1.1.12 Ensure that the etcd data directory ownership is set to etcd",":etcd"," (Automated)"]}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," Not Applicable"]}),"\n",(0,n.jsx)(r.p,{children:(0,n.jsx)(r.strong,{children:"Rationale:"})}),"\n",(0,n.jsxs)(r.p,{children:["For K3s, etcd is embedded within the k3s process. There is no separate etcd process.\nTherefore the etcd data directory ownership is managed by the k3s process and should be root",":root","."]}),"\n",(0,n.jsx)(r.h3,{id:"1113-ensure-that-the-adminconf-file-permissions-are-set-to-600-or-more-restrictive-automated",children:"1.1.13 Ensure that the admin.conf file permissions are set to 600 or more restrictive (Automated)"}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,n.jsx)(r.p,{children:(0,n.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-bash",children:"/bin/sh -c 'if test -e /var/lib/rancher/k3s/server/cred/admin.kubeconfig; then stat -c permissions=%a /var/lib/rancher/k3s/server/cred/admin.kubeconfig; fi'\n"})}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Expected Result:"})," permissions has permissions 600, expected 600 or more restrictive"]}),"\n",(0,n.jsxs)(s,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Returned Value:"})}),(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-log",children:"permissions=600\n"})})]}),"\n",(0,n.jsxs)(s,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Remediation:"})}),(0,n.jsxs)(r.p,{children:["Run the below command (based on the file location on your system) on the control plane node.\nFor example, ",(0,n.jsx)(r.code,{children:"chmod 600 /var/lib/rancher/k3s/server/cred/admin.kubeconfig"})]})]}),"\n",(0,n.jsxs)(r.h3,{id:"1114-ensure-that-the-adminconf-file-ownership-is-set-to-root-automated",children:["1.1.14 Ensure that the admin.conf file ownership is set to root",":root"," (Automated)"]}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,n.jsx)(r.p,{children:(0,n.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-bash",children:"/bin/sh -c 'if test -e /var/lib/rancher/k3s/server/cred/admin.kubeconfig; then stat -c %U:%G /var/lib/rancher/k3s/server/cred/admin.kubeconfig; fi'\n"})}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Expected Result:"})," 'root",":root","' is equal to 'root",":root","'"]}),"\n",(0,n.jsxs)(s,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Returned Value:"})}),(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-log",children:"root:root\n"})})]}),"\n",(0,n.jsxs)(s,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Remediation:"})}),(0,n.jsxs)(r.p,{children:["Run the below command (based on the file location on your system) on the control plane node.\nFor example, ",(0,n.jsx)(r.code,{children:"chown root:root /var/lib/rancher/k3s/server/cred/admin.kubeconfig"})]})]}),"\n",(0,n.jsx)(r.h3,{id:"1115-ensure-that-the-schedulerconf-file-permissions-are-set-to-600-or-more-restrictive-automated",children:"1.1.15 Ensure that the scheduler.conf file permissions are set to 600 or more restrictive (Automated)"}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,n.jsx)(r.p,{children:(0,n.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-bash",children:"/bin/sh -c 'if test -e /var/lib/rancher/k3s/server/cred/scheduler.kubeconfig; then stat -c permissions=%a /var/lib/rancher/k3s/server/cred/scheduler.kubeconfig; fi'\n"})}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Expected Result:"})," permissions has permissions 600, expected 600 or more restrictive"]}),"\n",(0,n.jsxs)(s,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Returned Value:"})}),(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-log",children:"permissions=600\n"})})]}),"\n",(0,n.jsxs)(s,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Remediation:"})}),(0,n.jsxs)(r.p,{children:["Run the below command (based on the file location on your system) on the control plane node.\nFor example,\n",(0,n.jsx)(r.code,{children:"chmod 600 /var/lib/rancher/k3s/server/cred/scheduler.kubeconfig"})]})]}),"\n",(0,n.jsxs)(r.h3,{id:"1116-ensure-that-the-schedulerconf-file-ownership-is-set-to-root-automated",children:["1.1.16 Ensure that the scheduler.conf file ownership is set to root",":root"," (Automated)"]}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,n.jsx)(r.p,{children:(0,n.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-bash",children:"/bin/sh -c 'if test -e /var/lib/rancher/k3s/server/cred/scheduler.kubeconfig; then stat -c %U:%G /var/lib/rancher/k3s/server/cred/scheduler.kubeconfig; fi'\n"})}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Expected Result:"})," 'root",":root","' is present"]}),"\n",(0,n.jsxs)(s,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Returned Value:"})}),(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-log",children:"root:root\n"})})]}),"\n",(0,n.jsxs)(s,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Remediation:"})}),(0,n.jsxs)(r.p,{children:["Run the below command (based on the file location on your system) on the control plane node.\nFor example,\n",(0,n.jsx)(r.code,{children:"chown root:root /var/lib/rancher/k3s/server/cred/scheduler.kubeconfig"})]})]}),"\n",(0,n.jsx)(r.h3,{id:"1117-ensure-that-the-controller-managerconf-file-permissions-are-set-to-600-or-more-restrictive-automated",children:"1.1.17 Ensure that the controller-manager.conf file permissions are set to 600 or more restrictive (Automated)"}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,n.jsx)(r.p,{children:(0,n.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-bash",children:"/bin/sh -c 'if test -e /var/lib/rancher/k3s/server/cred/controller.kubeconfig; then stat -c permissions=%a /var/lib/rancher/k3s/server/cred/controller.kubeconfig; fi'\n"})}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Expected Result:"})," permissions has permissions 600, expected 600 or more restrictive"]}),"\n",(0,n.jsxs)(s,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Returned Value:"})}),(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-log",children:"permissions=600\n"})})]}),"\n",(0,n.jsxs)(s,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Remediation:"})}),(0,n.jsxs)(r.p,{children:["Run the below command (based on the file location on your system) on the control plane node.\nFor example,\n",(0,n.jsx)(r.code,{children:"chmod 600 /var/lib/rancher/k3s/server/cred/controller.kubeconfig"})]})]}),"\n",(0,n.jsxs)(r.h3,{id:"1118-ensure-that-the-controller-managerconf-file-ownership-is-set-to-root-automated",children:["1.1.18 Ensure that the controller-manager.conf file ownership is set to root",":root"," (Automated)"]}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," PA
1SS"]}),"\n",(0,n.jsx)(r.p,{children:(0,n.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-bash",children:"stat -c %U:%G /var/lib/rancher/k3s/server/cred/controller.kubeconfig\n"})}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Expected Result:"})," 'root",":root","' is equal to 'root",":root","'"]}),"\n",(0,n.jsxs)(s,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Returned Value:"})}),(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-log",children:"root:root\n"})})]}),"\n",(0,n.jsxs)(s,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Remediation:"})}),(0,n.jsxs)(r.p,{children:["Run the below command (based on the file location on your system) on the control plane node.\nFor example,\n",(0,n.jsx)(r.code,{children:"chown root:root /var/lib/rancher/k3s/server/cred/controller.kubeconfig"})]})]}),"\n",(0,n.jsxs)(r.h3,{id:"1119-ensure-that-the-kubernetes-pki-directory-and-file-ownership-is-set-to-root-automated",children:["1.1.19 Ensure that the Kubernetes PKI directory and file ownership is set to root",":root"," (Automated)"]}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,n.jsx)(r.p,{children:(0,n.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-bash",children:"stat -c %U:%G /var/lib/rancher/k3s/server/tls\n"})}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Expected Result:"})," 'root",":root","' is present"]}),"\n",(0,n.jsxs)(s,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Returned Value:"})}),(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-log",children:"root:root\n"})})]}),"\n",(0,n.jsxs)(s,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Remediation:"})}),(0,n.jsxs)(r.p,{children:["Run the below command (based on the file location on your system) on the control plane node.\nFor example,\n",(0,n.jsx)(r.code,{children:"chown -R root:root /var/lib/rancher/k3s/server/tls"})]})]}),"\n",(0,n.jsx)(r.h3,{id:"1120-ensure-that-the-kubernetes-pki-certificate-file-permissions-are-set-to-600-or-more-restrictive-manual",children:"1.1.20 Ensure that the Kubernetes PKI certificate file permissions are set to 600 or more restrictive (Manual)"}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Remediation:"}),"\nRun the below command (based on the file location on your system) on the master node.\nFor example,\n",(0,n.jsx)(r.code,{children:"chmod -R 600 /var/lib/rancher/k3s/server/tls/*.crt"})]}),"\n",(0,n.jsx)(r.h3,{id:"1121-ensure-that-the-kubernetes-pki-key-file-permissions-are-set-to-600-automated",children:"1.1.21 Ensure that the Kubernetes PKI key file permissions are set to 600 (Automated)"}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,n.jsx)(r.p,{children:(0,n.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-bash",children:"/bin/sh -c 'stat -c permissions=%a /var/lib/rancher/k3s/server/tls/*.key'\n"})}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Expected Result:"})," permissions has permissions 600, expected 600 or more restrictive"]}),"\n",(0,n.jsxs)(s,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Returned Value:"})}),(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-log",children:"permissions=600\npermissions=600\npermissions=600\npermissions=600\npermissions=600\npermissions=600\npermissions=600\npermissions=600\npermissions=600\npermissions=600\npermissions=600\npermissions=600\npermissions=600\npermissions=600\npermissions=600\npermissions=600\npermissions=600\n"})})]}),"\n",(0,n.jsxs)(s,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Remediation:"})}),(0,n.jsxs)(r.p,{children:["Run the below command (based on the file location on your system) on the master node.\nFor example,\n",(0,n.jsx)(r.code,{children:"chmod -R 600 /var/lib/rancher/k3s/server/tls/*.key"})]})]}),"\n",(0,n.jsx)(r.h2,{id:"12-api-server",children:"1.2 API Server"}),"\n",(0,n.jsx)(r.h3,{id:"121-ensure-that-the---anonymous-auth-argument-is-set-to-false-automated",children:"1.2.1 Ensure that the --anonymous-auth argument is set to false (Automated)"}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,n.jsx)(r.p,{children:(0,n.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'anonymous-auth'\n"})}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Expected Result:"})," '--anonymous-auth' is equal to 'false'"]}),"\n",(0,n.jsxs)(s,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Returned Value:"})}),(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-log",children:'Aug 09 19:01:28 server-0 k3s[2354]: time="2024-08-09T19:01:28Z" level=info msg="Running kube-apiserver --admission-control-config-file=/var/lib/rancher/k3s/server/psa.yaml --advertise-address=10.10.10.100 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})})]}),"\n",(0,n.jsxs)(s,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Remediation:"})}),(0,n.jsx)(r.p,{children:"By default, K3s sets the --anonymous-auth argument to false. If it is set to true,\nedit the K3s config file /etc/rancher/k3s/config.yaml and remove anything similar to below."}),(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{children:'kube-apiserver-arg:\n - "anonymous-auth=true"\n'})})]}),"\n",(0,n.jsx)(r.h3,{id:"122-ensure-that-the---token-auth-file-parameter-is-not-set-automated",children:"1.2.2 Ensure that the --token-auth-file parameter is not set (Automated)"}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,n.jsx)(r.p,{children:(0,n.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s | grep 'Running kube-apiserver' | tail -n1\n"})}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Expected Result:"})," '--token-auth-file' is not present"]}),"\n",(0,n.jsxs)(s,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Returned Value:"})}),(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-log",children:'Aug 09 19:01:28 server-0 k3s[2354]: time="2024-08-09T19:01:28Z" level=info msg="Running kube-apiserver --admission-control-config-file=/var/lib/rancher/k3s/server/psa.yaml --advertise-address=10.10.10.100 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})})]}),"\n",(0,n.jsxs)(s,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Remediation:"})}),(0,n.jsx)(r.p,{children:"Follow the documentation and configure alternate mechanisms for authentication.\nIf this check fails, edit the K3s config file /etc/rancher/k3s/config.yaml and remove anything similar to below."}),(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{children:'kube-apiserver-arg:\n - "token-auth-file=<path>"\n'})})]}),"\n",(0,n.jsx)(r.h3,{id:"123-ensure-that-the---denyserviceexternalips-is-not-set-automated",children:"1.2.3 Ensure that the --DenyServiceExternalIPs is not set (Automated)"}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,n.jsx)(r.p,{children:(0,n.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s | grep 'Running kube-apiserver' | tail -n1\n"})}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Expected Result:"})," '--enable-admission-plugins' does not have 'DenyServiceExternalIPs' OR '--enable-admission-plugins' is not present"]}),"\n",(0,n.jsxs)(s,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Returned Value:"})}),(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-log",children:'Aug 09 19:01:28 server-0 k3s[2354]: time="2024-08-09T19:01:28Z" level=info msg="Running kube-apiserver --admission-control-config-file=/var/lib/rancher/k3s/server/psa.yaml --advertise-address=10.10.10.100 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})})]}),"\n",(0,n.jsxs)(s,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Remediation:"})}),(0,n.jsx)(r.p,{children:"By default, K3s does not set DenyServiceExternalIPs.\
1nIf this check fails, edit the K3s config file /etc/rancher/k3s/config.yaml, remove any lines like below."}),(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{children:'kube-apiserver-arg:\n - "enable-admission-plugins=DenyServiceExternalIPs"\n'})})]}),"\n",(0,n.jsx)(r.h3,{id:"124-ensure-that-the---kubelet-client-certificate-and---kubelet-client-key-arguments-are-set-as-appropriate-automated",children:"1.2.4 Ensure that the --kubelet-client-certificate and --kubelet-client-key arguments are set as appropriate (Automated)"}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,n.jsx)(r.p,{children:(0,n.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'kubelet-certificate-authority'\n"})}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Expected Result:"})," '--kubelet-client-certificate' is present AND '--kubelet-client-key' is present"]}),"\n",(0,n.jsxs)(s,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Returned Value:"})}),(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-log",children:'Aug 09 19:01:28 server-0 k3s[2354]: time="2024-08-09T19:01:28Z" level=info msg="Running kube-apiserver --admission-control-config-file=/var/lib/rancher/k3s/server/psa.yaml --advertise-address=10.10.10.100 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})})]}),"\n",(0,n.jsxs)(s,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Remediation:"})}),(0,n.jsx)(r.p,{children:"By default, K3s automatically provides the kubelet client certificate and key.\nThey are generated and located at /var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt and /var/lib/rancher/k3s/server/tls/client-kube-apiserver.key\nIf for some reason you need to provide your own certificate and key, you can set the\nbelow parameters in the K3s config file /etc/rancher/k3s/config.yaml."}),(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{children:'kube-apiserver-arg:\n - "kubelet-client-certificate=<path/to/client-cert-file>"\n - "kubelet-client-key=<path/to/client-key-file>"\n'})})]}),"\n",(0,n.jsx)(r.h3,{id:"125-ensure-that-the---kubelet-certificate-authority-argument-is-set-as-appropriate-automated",children:"1.2.5 Ensure that the --kubelet-certificate-authority argument is set as appropriate (Automated)"}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,n.jsx)(r.p,{children:(0,n.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'kubelet-certificate-authority'\n"})}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Expected Result:"})," '--kubelet-certificate-authority' is present"]}),"\n",(0,n.jsxs)(s,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Returned Value:"})}),(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-log",children:'Aug 09 19:01:28 server-0 k3s[2354]: time="2024-08-09T19:01:28Z" level=info msg="Running kube-apiserver --admission-control-config-file=/var/lib/rancher/k3s/server/psa.yaml --advertise-address=10.10.10.100 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})})]}),"\n",(0,n.jsxs)(s,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Remediation:"})}),(0,n.jsx)(r.p,{children:"By default, K3s automatically provides the kubelet CA cert file, at /var/lib/rancher/k3s/server/tls/server-ca.crt.\nIf this check fails, edit the K3s config file /etc/rancher/k3s/config.yaml and remove any lines like below."}),(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{children:'kube-apiserver-arg:\n - "kubelet-certificate-authority=<path/to/ca-cert-file>"\n'})})]}),"\n",(0,n.jsx)(r.h3,{id:"126-ensure-that-the---authorization-mode-argument-is-not-set-to-alwaysallow-automated",children:"1.2.6 Ensure that the --authorization-mode argument is not set to AlwaysAllow (Automated)"}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,n.jsx)(r.p,{children:(0,n.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'authorization-mode'\n"})}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Expected Result:"})," '--authorization-mode' does not have 'AlwaysAllow'"]}),"\n",(0,n.jsxs)(s,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Returned Value:"})}),(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-log",children:'Aug 09 19:01:28 server-0 k3s[2354]: time="2024-08-09T19:01:28Z" level=info msg="Running kube-apiserver --admission-control-config-file=/var/lib/rancher/k3s/server/psa.yaml --advertise-address=10.10.10.100 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})})]}),"\n",(0,n.jsxs)(s,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Remediation:"})}),(0,n.jsx)(r.p,{children:"By default, K3s does not set the --authorization-mode to AlwaysAllow.\nIf this check fails, edit K3s config file /etc/rancher/k3s/config.yaml, remove any lines like below."}),(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{children:'kube-apiserver-arg:\n - "authorization-mode=AlwaysAllow"\n'})})]}),"\n",(0,n.jsx)(r.h3,{id:"127-ensure-that-the---authorization-mode-argument-includes-node-automated",children:"1.2.7 Ensure that the --authorization-mode argument includes Node (Automated)"}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,n.jsx)(r.p,{children:(0,n.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'authorization-mode'\n"})}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Expected Result:"})," '--authorization-mode' has 'Node'"]}),"\n",(0,n.jsxs)(s,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Returned Value:"})}),(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-log",children:'Aug 09 19:01:28 server-0 k3s[2354]: time="2024-08-09T19:01:28Z" level=info msg="Running kube-apiserver --admission-control-config-file=/var/lib/rancher/k3s/server/psa.yaml --advertise-address=10.10.10.100 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE
1_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})})]}),"\n",(0,n.jsxs)(s,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Remediation:"})}),(0,n.jsx)(r.p,{children:"By default, K3s sets the --authorization-mode to Node and RBAC.\nIf this check fails, edit the K3s config file /etc/rancher/k3s/config.yaml,\nensure that you are not overriding authorization-mode."})]}),"\n",(0,n.jsx)(r.h3,{id:"128-ensure-that-the---authorization-mode-argument-includes-rbac-automated",children:"1.2.8 Ensure that the --authorization-mode argument includes RBAC (Automated)"}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,n.jsx)(r.p,{children:(0,n.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'authorization-mode'\n"})}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Expected Result:"})," '--authorization-mode' has 'RBAC'"]}),"\n",(0,n.jsxs)(s,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Returned Value:"})}),(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-log",children:'Aug 09 19:01:28 server-0 k3s[2354]: time="2024-08-09T19:01:28Z" level=info msg="Running kube-apiserver --admission-control-config-file=/var/lib/rancher/k3s/server/psa.yaml --advertise-address=10.10.10.100 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})})]}),"\n",(0,n.jsxs)(s,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Remediation:"})}),(0,n.jsx)(r.p,{children:"By default, K3s sets the --authorization-mode to N
1ode and RBAC.\nIf this check fails, edit the K3s config file /etc/rancher/k3s/config.yaml,\nensure that you are not overriding authorization-mode."})]}),"\n",(0,n.jsx)(r.h3,{id:"129-ensure-that-the-admission-control-plugin-eventratelimit-is-set-manual",children:"1.2.9 Ensure that the admission control plugin EventRateLimit is set (Manual)"}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Remediation:"}),"\nFollow the Kubernetes documentation and set the desired limits in a configuration file.\nThen, edit the K3s config file /etc/rancher/k3s/config.yaml and set the below parameters."]}),"\n",(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{children:'kube-apiserver-arg:\n - "enable-admission-plugins=...,EventRateLimit,..."\n - "admission-control-config-file=<path/to/configuration/file>"\n'})}),"\n",(0,n.jsx)(r.h3,{id:"1210-ensure-that-the-admission-control-plugin-alwaysadmit-is-not-set-automated",children:"1.2.10 Ensure that the admission control plugin AlwaysAdmit is not set (Automated)"}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,n.jsx)(r.p,{children:(0,n.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'enable-admission-plugins'\n"})}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Expected Result:"})," '--enable-admission-plugins' does not have 'AlwaysAdmit' OR '--enable-admission-plugins' is not present"]}),"\n",(0,n.jsxs)(s,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Returned Value:"})}),(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-log",children:'Aug 09 19:01:28 server-0 k3s[2354]: time="2024-08-09T19:01:28Z" level=info msg="Running kube-apiserver --admission-control-config-file=/var/lib/rancher/k3s/server/psa.yaml --advertise-address=10.10.10.100 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})})]}),"\n",(0,n.jsxs)(s,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Remediation:"})}),(0,n.jsx)(r.p,{children:"By default, K3s does not set the --enable-admission-plugins to AlwaysAdm
1it.\nIf this check fails, edit K3s config file /etc/rancher/k3s/config.yaml, remove any lines like below."}),(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{children:'kube-apiserver-arg:\n - "enable-admission-plugins=AlwaysAdmit"\n'})})]}),"\n",(0,n.jsx)(r.h3,{id:"1211-ensure-that-the-admission-control-plugin-alwayspullimages-is-set-manual",children:"1.2.11 Ensure that the admission control plugin AlwaysPullImages is set (Manual)"}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Remediation:"}),'\nPermissive, per CIS guidelines,\n"This setting could impact offline or isolated clusters, which have images pre-loaded and\ndo not have access to a registry to pull in-use images. This setting is not appropriate for\nclusters which use this configuration."\nEdit the K3s config file /etc/rancher/k3s/config.yaml and set the below parameter.']}),"\n",(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{children:'kube-apiserver-arg:\n - "enable-admission-plugins=...,AlwaysPullImages,..."\n'})}),"\n",(0,n.jsx)(r.h3,{id:"1212-ensure-that-the-admission-control-plugin-securitycontextdeny-is-set-if-podsecuritypolicy-is-not-used-manual",children:"1.2.12 Ensure that the admission control plugin SecurityContextDeny is set if PodSecurityPolicy is not used (Manual)"}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," Not Applicable"]}),"\n",(0,n.jsx)(r.p,{children:(0,n.jsx)(r.strong,{children:"Rationale:"})}),"\n",(0,n.jsx)(r.p,{children:"Enabling Pod Security Policy is no longer supported on K3s v1.25+ and will cause applications to unexpectedly fail."}),"\n",(0,n.jsx)(r.h3,{id:"1213-ensure-that-the-admission-control-plugin-serviceaccount-is-set-automated",children:"1.2.13 Ensure that the admission control plugin ServiceAccount is set (Automated)"}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,n.jsx)(r.p,{children:(0,n.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s | grep 'Running kube-apiserver' | tail -n1\n"})}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Expected Result:"})," '--disable-admission-plugins' is present OR '--disable-admission-plugins' is not present"]}),"\n",(0,n.jsxs)(s,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Returned Value:"})}),(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-log",children:'Aug 09 19:01:28 server-0 k3s[2354]: time="2024-08-09T19:01:28Z" level=info msg="Running kube-apiserver --admission-control-config-file=/var/lib/rancher/k3s/server/psa.yaml --advertise-address=10.10.10.100 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})})]}),"\n",(0,n.jsxs)(s,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Remediation:"})}),(0,n.jsx)(r.p,{children:"By default, K3s does not set the --disable-admission-plugins to anything.\nFollow the documentation and create ServiceAccount objects as per your environment.\nIf this check fails, edit the K3s config file /etc/rancher/k3s/config.yaml and remove any lines like below."}),(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{children:'kube-apiserver-arg:\n - "disable-admission-plugins=ServiceAccount"\n'})})]}),"\n",(0,n.jsx)(r.h3,{id:"1214-ensure-that-the-admission-control-plugin-namespacelifecycle-is-set-automated",children:"1.2.14 Ensure that the admission control plugin NamespaceLifecycle is set (Automated)"}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,n.jsx)(r.p,{children:(0,n.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s | grep 'Running kube-apiserver' | tail -n1\n"})}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Expected Result:"})," '--disable-admission-plugins' is present OR '--disable-admission-plugins' is not present"]}),"\n",(0,n.jsxs)(s,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Returned Value:"})}),(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-log",children:'Aug 09 19:01:28 server-0 k3s[2354]: time="2024-08-09T19:01:28Z" level=info msg="Running kube-apiserver --admission-control-config-file=/var/lib/rancher/k3s/server/psa.yaml --advertise-address=10.10.10.100 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})})]}),"\n",(0,n.jsxs)(s,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Remediation:"})}),(0,n.jsx)(r.p,{children:"By default, K3s does not set the --disable-admission-plugins to anything.\nIf this check fails, edit the K3s config file /etc/rancher/k3s/config.yaml and remove any lines like below."}),(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{children:'kube-apiserver-arg:\n - "disable-admission-plugins=...,NamespaceLifecycle,..."\n'})})]}),"\n",(0,n.jsx)(r.h3,{id:"1215-ensure-that-the-admission-control-plugin-noderestriction-is-set-automated",children:"1.2.15 Ensure that the admission control plugin NodeRestriction is set
1(Automated)"}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,n.jsx)(r.p,{children:(0,n.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'enable-admission-plugins'\n"})}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Expected Result:"})," '--enable-admission-plugins' has 'NodeRestriction'"]}),"\n",(0,n.jsxs)(s,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Returned Value:"})}),(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-log",children:'Aug 09 19:01:28 server-0 k3s[2354]: time="2024-08-09T19:01:28Z" level=info msg="Running kube-apiserver --admission-control-config-file=/var/lib/rancher/k3s/server/psa.yaml --advertise-address=10.10.10.100 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})})]}),"\n",(0,n.jsxs)(s,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Remediation:"})}),(0,n.jsx)(r.p,{children:"By default, K3s sets the --enable-admission-plugins to NodeRestriction.\nIf using the K3s config file /etc/rancher/k3s/config.yaml, check that you are not overriding the admission plugins.\nIf you are, include NodeRestriction in the list."}),(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{children:'kube-apiserver-arg:\n - "enable-admission-plugins=...,NodeRestriction,..."\n'})})]}),"\n",(0,n.jsx)(r.h3,{id:"1216-ensure-that-the---secure-port-argument-is-not-set-to-0---notethis-recommendation-is-obsolete-and-will-be-deleted-per-the-consensus-process-automated",children:"1.2.16 Ensure that the --secure-port argument is not set to 0 - NoteThis recommendation is obsolete and will be deleted per the consensus process (Automated)"}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,n.jsx)(r.p,{children:(0,n.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'secure-port'\n"})}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Expected Result:"})," '--secure-port' is greater than 0 OR '--secure-port' is not present"]}),"\n",(0,n.jsxs)(s,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Returned Value:"})}),(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-log",children:'Aug 09 19:01:28 server-0 k3s[2354]: time="2024-08-09T19:01:28Z" level=info msg="Running kube-apiserver --admission-control-config-file=/var/lib/rancher/k3s/server/psa.yaml --advertise-address=10.10.10.100 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})})]}),"\n",(0,n.jsxs)(s,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Remediation:"})}),(0,n.jsx)(r.p,{children:"By default, K3s sets the secure port to 6444.\nIf this check fails, edit the K3s config file /etc/rancher/k3s/config.yaml and remove any lines like below."}),(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{children:'kube-apiserver-arg:\n - "secure-port=<PORT>"\n'})})]}),"\n",(0,n.jsx)(r.h3,{id:"1217-ensure-that-the---profiling-argument-is-set-to-false-automated",children:"1.2.17 Ensure that the --profiling argument is set to false (Automated)"}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,n.jsx)(r.p,{children:(0,n.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'profiling'\n"})}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Expected Result:"})," '--profiling' is equal to 'false'"]}),"\n",(0,n.jsxs)(s,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Returned Value:"})}),(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-log",children:'Aug 09 19:01:28 server-0 k3s[2354]: time="2024-08-09T19:01:28Z" level=info msg="Running kube-apiserver --admission-control-config-file=/var/lib/rancher/k3s/server/psa.yaml --advertise-address=10.10.10.100 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})})]}),"\n",(0,n.jsxs)(s,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Remediation:"})}),(0,n.jsx)(r.p,{children:"By default, K3s sets the --profiling argument to false.\nIf this check fails, edit the K3s config file /etc/rancher/k3s/config.yaml and remove any lines like below."}),(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{children:'kube-apiserver-arg:\n - "profiling=true"\n'})})]}),"\n",(0,n.jsx)(r.h3,{id:"1218-ensure-that-the---audit-log-path-argument-is-set-manual",children:"1.2.18 Ensure that the --audit-log-path argument is set (Manual)"}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,n.jsx)(r.p,{children:(0,n.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s | grep 'Running kube-apiserver' | tail -n1\n"})}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Expected Result:"})," '--audit-log-path' is present"]}),"\n",(0,n.jsxs)(s,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Returned Value:"})}),(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-log",children:'Aug 09 19:01:28 server-0 k3s[2354]: time="2024-08-09T19:01:28Z" level=info msg="Running kube-apiserver --admission-control-config-file=/var/lib/rancher/k3s/server/psa.yaml --advertise-address=10.10.10.100 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})})]}),"\n",(0,n.jsxs)(s,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Remediation:"})}),(0,n.jsx)(r.p,{children:"Edit the K3s config file /etc/rancher/k3s/config.yaml and set the audit-log-path parameter to a suitable path and\nfile where you would like audit logs to be written, for example,"}),(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{children:'kube-apiserver-arg:\n - "audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log"\n'})})]}),"\n",(0,n.jsx)(r.h3,{id:"1219-ensure-that-the---audit-log-maxage-argument-is-set-to-30-or-as-appropriate-manual",children:"1.2.19 Ensure
1that the --audit-log-maxage argument is set to 30 or as appropriate (Manual)"}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,n.jsx)(r.p,{children:(0,n.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s | grep 'Running kube-apiserver' | tail -n1\n"})}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Expected Result:"})," '--audit-log-maxage' is greater or equal to 30"]}),"\n",(0,n.jsxs)(s,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Returned Value:"})}),(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-log",children:'Aug 09 19:01:28 server-0 k3s[2354]: time="2024-08-09T19:01:28Z" level=info msg="Running kube-apiserver --admission-control-config-file=/var/lib/rancher/k3s/server/psa.yaml --advertise-address=10.10.10.100 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})})]}),"\n",(0,n.jsxs)(s,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Remediation:"})}),(0,n.jsx)(r.p,{children:"Edit the K3s config file /etc/rancher/k3s/config.yaml on the control plane node and\nset the audit-log-maxage parameter to 30 or as an appropriate number of days, for example,"}),(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{children:'kube-apiserver-arg:\n - "audit-log-maxage=30"\n'})})]}),"\n",(0,n.jsx)(r.h3,{id:"1220-ensure-that-the---audit-log-maxbackup-argument-is-set-to-10-or-as-appropriate-manual",children:"1.2.20 Ensure that the --audit-log-maxbackup argument is set to 10 or as appropriate (Manual)"}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,n.jsx)(r.p,{children:(0,n.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s | grep 'Running kube-apiserver' | tail -n1\n"})}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Expected Result:"})," '--audit-log-maxbackup' is greater or equal to 10"]}),"\n",(0,n.jsxs)(s,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Returned Value:"})}),(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-log",children:'Aug 09 19:01:28 server-0 k3s[2354]: time="2024-08-09T19:01:28Z" level=info msg="Running kube-apiserver --admission-control-config-file=/var/lib/rancher/k3s/server/psa.yaml --advertise-address=10.10.10.100 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})})]}),"\n",(0,n.jsxs)(s,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Remediation:"})}),(0,n.jsx)(r.p,{children:"Edit the K3s config file /etc/rancher/k3s/config.yaml on the control plane node and\nset the audit-log-maxbackup parameter to 10 or to an appropriate value. For example,"}),(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{children:'kube-apiserver-arg:\n - "audit-log-maxbackup=10"\n'})})]}),"\n",(0,n.jsx)(r.h3,{id:"1221-ensure-that-the---audit-log-maxsize-argument-is-set-to-100-or-as-appropriate-manual",children:"1.2.21 Ensure that the --audit-log-maxsize argument is set to 100 or as appropriate (Manual)"}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,n.jsx)(r.p,{children:(0,n.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s | grep 'Running kube-apiserver' | tail -n1\n"})}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Expected Result:"})," '--audit-log-maxsize' is greater or equal to 100"]}),"\n",(0,n.jsxs)(s,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Returned Value:"})}),(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-log",children:'Aug 09 19:01:28 server-0 k3s[2354]: time="2024-08-09T19:01:28Z" level=info msg="Running kube-apiserver --admission-control-config-file=/var/lib/rancher/k3s/server/psa.yaml --advertise-address=10.10.10.100 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})})]}),"\n",(0,n.jsxs)(s,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Remediation:"})}),(0,n.jsx)(r.p,{children:"Edit the K3s config file /etc/rancher/k3s/config.yaml on the control plane node and\nset the audit-log-maxsize parameter to an appropriate size in MB. For example,"}),(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{children:'kube-apiserver-arg:\n - "audit-log-maxsize=100"\n'})})]}),"\n",(0,n.jsx)(r.h3,{id:"1222-ensure-that-the---request-timeout-argument-is-set-as-appropriate-manual",children:"1.2.22 Ensure that the --request-timeout argument is set as appropriate (Manual)"}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Remediation:"}),'\nPermissive, per CIS guidelines,\n"it is recommended to set this limit as appropriate and change the default limit of 60 seconds only if needed".\nEdit the K3s config file /etc/rancher/k3s/config.yaml\nand set the below parameter if needed. For example,']}
1),"\n",(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{children:'kube-apiserver-arg:\n - "request-timeout=300s"\n'})}),"\n",(0,n.jsx)(r.h3,{id:"1223-ensure-that-the---service-account-lookup-argument-is-set-to-true-automated",children:"1.2.23 Ensure that the --service-account-lookup argument is set to true (Automated)"}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,n.jsx)(r.p,{children:(0,n.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s | grep 'Running kube-apiserver' | tail -n1\n"})}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Expected Result:"})," '--service-account-lookup' is not present OR '--service-account-lookup' is present"]}),"\n",(0,n.jsxs)(s,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Returned Value:"})}),(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-log",children:'Aug 09 19:01:28 server-0 k3s[2354]: time="2024-08-09T19:01:28Z" level=info msg="Running kube-apiserver --admission-control-config-file=/var/lib/rancher/k3s/server/psa.yaml --advertise-address=10.10.10.100 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})})]}),"\n",(0,n.jsxs)(s,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Remediation:"})}),(0,n.jsx)(r.p,{children:"By default, K3s does not set the --service-account-lookup argument.\nEdit the K3s config file /etc/rancher/k3s/config.yaml and set the service-account-lookup. For example,"}),(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{children:'kube-apiserver-arg:\n - "service-account-lookup=true"\n'})}),(0,n.jsx)(r.p,{children:"Alternatively, you can delete the service-account-lookup parameter from this file so\nthat the default takes effect."})]}),"\n",(0,n.jsx)(r.h3,{id:"1224-ensure-that-the---service-account-key-file-argument-is-set-as-appropriate-automated",children:"1.2.24 Ensure that the --service-account-key-file argument is set as appropriate (Automated)"}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,n.jsx)(r.p,{children:(0,n.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s | grep 'Running kube-apiserver' | tail -n1\n"})}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Expected Result:"})," '--service-account-key-file' is present"]}),"\n",(0,n.jsxs)(s,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Returned Value:"})}),(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-log",children:'Aug 09 19:01:28 server-0 k3s[2354]: time="2024-08-09T19:01:28Z" level=info msg="Running kube-apiserver --admission-control-config-file=/var/lib/rancher/k3s/server/psa.yaml --advertise-address=10.10.10.100 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})})]}),"\n",(0,n.jsxs)(s,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Remediation:"})}),(0,n.jsx)(r.p,{children:"K3s automatically generates and sets the service account key file.\nIt is located at /var/lib/rancher/k3s/server/tls/service.key.\nIf this check fails, edit K3s config file /etc/rancher/k3s/config.yaml and remove any lines like below."}),(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{children:'kube-apiserver-arg:\n - "service-account-key-file=<path>"\n'})})]}),"\n",(0,n.jsx)(r.h3,{id:"1225-ensure-that-the---etcd-certfile-and---etcd-keyfile-arguments-are-set-as-appropriate-automated",children:"1.2.25 Ensure that the --etcd-certfile and --etcd-keyfile arguments are set as appropriate (Automated)"}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,n.jsx)(r.p,{children:(0,n.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-bash",children:"if [ \"$(journalctl -u k3s | grep -m1 'Managed etcd cluster' | wc -l)\" -gt 0 ]; then\n journalctl -D /var/log/journal -u k3s | grep -m1 'Running kube-apiserver' | tail -n1\nelse\n echo \"--etcd-certfile AND --etcd-keyfile\"\nfi\n"})}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Expected Result:"})," '--etcd-certfile' is present AND '--etcd-keyfile' is present"]}),"\n",(0,n.jsxs)(s,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Returned Value:"})}),(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-log",children:'Aug 09 19:01:28 server-0 k3s[2354]: time="2024-08-09T19:01:28Z" level=info msg="Running kube-apiserver --admission-control-config-file=/var/lib/rancher/k3s/server/psa.yaml --advertise-address=10.10.10.100 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})})]}),"\n",(0,n.jsxs)(s,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Remediation:"})}),(0,n.jsx)(r.p,{children:"K3s automatically generates and sets the etcd certificate and key files.\nThey are located at /var/lib/rancher/k3s/server/tls/etcd/client.crt and /var/lib/rancher/k3s/server/tls/etcd/client.key.\nIf this check fails, edit the K3s config file /etc/rancher/k3s/config.yaml and remove any lines like below."}),(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{children:'kube-apiserver-arg:\n - "etcd-certfile=<path>"\n - "etcd-keyfile=<path>"\n'})})]}),"\n",(0,n.jsx)(r.h3,{id:"1226-ensure-that-the---tls-cert-file-and---tls-private-key-file-arguments-are-set-as-appropriate-automated",children:"1.2.26 Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate (Automated)"}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,n.jsx)(r.p,{children:(0,n.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-bash",children:"journalctl -D /var/log/journal -u k3s | grep -A1 'Running kube-apiserver' | tail -n2\n"})}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Expected Result:"})," '--tls-cert-file' is present AND '--tls-private-key-file' is present"]}),"\n",(0,n.jsxs)(s,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Returned Value:"})}),(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-log",children:'Aug 09 19:01:28 server-0 k3s[2354]: time="2024-08-09T19:01:28Z" level=info msg="Running kube-apiserver --admission-control-config-file=/var/lib/rancher/k3s/server/psa.yaml --advertise-address=10.10.10.100 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS
1_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\nAug 09 19:01:28 server-0 k3s[2354]: time="2024-08-09T19:01:28Z" level=info msg="Running kube-scheduler --authentication-kubeconfig=/var/lib/rancher/k3s/server/cred/scheduler.kubeconfig --authorization-kubeconfig=/var/lib/rancher/k3s/server/cred/scheduler.kubeconfig --bind-address=127.0.0.1 --kubeconfig=/var/lib/rancher/k3s/server/cred/scheduler.kubeconfig --profiling=false --secure-port=10259"\n'})})]}),"\n",(0,n.jsxs)(s,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Remediation:"})}),(0,n.jsx)(r.p,{children:"By default, K3s automatically generates and provides the TLS certificate and private key for the apiserver.\nThey are generated and located at /var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt and /var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key\nIf this check fails, edit the K3s config file /etc/rancher/k3s/config.yaml and remove any lines like below."}),(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{children:'kube-apiserver-arg:\n - "tls-cert-file=<path>"\n - "tls-private-key-file=<path>"\n'})})]}),"\n",(0,n.jsx)(r.h3,{id:"1227-ensure-that-the---client-ca-file-argument-is-set-as-appropriate-automated",children:"1.2.27 Ensure that the --client-ca-file argument is set as appropriate (Automated)"}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,n.jsx)(r.p,{children:(0,n.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'client-ca-file'\n"})}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Expected Result:"})," '--client-ca-file' is present"]}),"\n",(0,n.jsxs)(s,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Returned Value:"})}),(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-log",children:'Aug 09 19:01:28 server-0 k3s[2354]: time="2024-08-09T19:01:28Z" level=info msg="Running kube-apiserver --admission-control-config-file=/var/lib/rancher/k3s/server/psa.yaml --advertise-address=10.10.10.100 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})})]}),"\n",(0,n.jsxs)(s,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Remediation:"})}),(0,n.jsx)(r.p,{children:"By default, K3s automatically provides the client certificate authority file.\nIt is generated and located at /var/lib/rancher/k3s/server/tls/client-ca.crt.\nIf this check fails, edit the K3s config file /etc/rancher/k3s/config.yaml and remove any lines like below."}),(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{children:'kube-apiserver-arg:\n - "client-ca-file=<path>"\n'})})]}),"\n",(0,n.jsx)(r.h3,{id:"1228-ensure-that-the---etcd-cafile-argument-is-set-as-appropriate-automated",children:"1.2.28 Ensure that the --etcd-cafile argument is set as appropriate (Automated)"}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,n.jsx)(r.p,{children:(0,n.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'etcd-cafile'\n"})}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Expected Result:"})," '--etcd-cafile' is present"]}),"\n",(0,n.jsxs)(s,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Returned Value:"})}),(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-log",children:'Aug 09 19:01:28 server-0 k3s[2354]: time="2024-08-09T19:01:28Z" level=info msg="Running kube-apiserver --admission-control-config-file=/var/lib/rancher/k3s/server/psa.yaml --advertise-address=10.10.10.100 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})})]}),"\n",(0,n.jsxs)(s,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Remediation:"})}),(0,n.jsx)(r.p,{children:"By default, K3s automatically provides the etcd certificate authority file.\nIt is generated and located at /var/lib/rancher/k3s/server/tls/client-ca.crt.\nIf this check fails, edit the K3s config file /etc/rancher/k3s/config.yaml and remove any lines like below."}),(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{children:'kube-apiserver-arg:\n - "etcd-cafile=<path>"\n'})})]}
1),"\n",(0,n.jsx)(r.h3,{id:"1229-ensure-that-the---encryption-provider-config-argument-is-set-as-appropriate-manual",children:"1.2.29 Ensure that the --encryption-provider-config argument is set as appropriate (Manual)"}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,n.jsx)(r.p,{children:(0,n.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'encryption-provider-config'\n"})}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Expected Result:"})," '--encryption-provider-config' is present"]}),"\n",(0,n.jsxs)(s,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Returned Value:"})}),(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-log",children:'Aug 09 19:01:28 server-0 k3s[2354]: time="2024-08-09T19:01:28Z" level=info msg="Running kube-apiserver --admission-control-config-file=/var/lib/rancher/k3s/server/psa.yaml --advertise-address=10.10.10.100 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})})]}),"\n",(0,n.jsxs)(s,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Remediation:"})}),(0,n.jsx)(r.p,{children:"K3s can be configured to use encryption providers to encrypt secrets at rest.\nEdit the K3s config file /etc/rancher/k3s/config.yaml on the control plane node and set the below parameter.\nsecrets-encryption: true\nSecrets encryption can then be managed with the k3s secrets-encrypt command line tool.\nIf needed, you can find the generated encryption config at /var/lib/rancher/k3s/server/cred/encryption-config.json."})]}),"\n",(0,n.jsx)(r.h3,{id:"1230-ensure-that-encryption-providers-are-appropriately-configured-manual",children:"1.2.30 Ensure that encryption providers are appropriately configured (
1Manual)"}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,n.jsx)(r.p,{children:(0,n.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-bash",children:"ENCRYPTION_PROVIDER_CONFIG=$(journalctl -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep -- --encryption-provider-config | sed 's%.*encryption-provider-config[= ]\\([^ ]*\\).*%\\1%')\nif test -e $ENCRYPTION_PROVIDER_CONFIG; then grep -o 'providers\\\"\\:\\[.*\\]' $ENCRYPTION_PROVIDER_CONFIG | grep -o \"[A-Za-z]*\" | head -2 | tail -1 | sed 's/^/provider=/'; fi\n"})}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Expected Result:"})," 'provider' contains valid elements from 'aescbc,kms,secretbox'"]}),"\n",(0,n.jsxs)(s,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Returned Value:"})}),(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-log",children:"provider=aescbc\n"})})]}),"\n",(0,n.jsxs)(s,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Remediation:"})}),(0,n.jsx)(r.p,{children:"K3s can be configured to use encryption providers to encrypt secrets at rest. K3s will utilize the aescbc provider.\nEdit the K3s config file /etc/rancher/k3s/config.yaml on the control plane node and set the below parameter.\nsecrets-encryption: true\nSecrets encryption can then be managed with the k3s secrets-encrypt command line tool.\nIf needed, you can find the generated encryption config at /var/lib/rancher/k3s/server/cred/encryption-config.json"})]}),"\n",(0,n.jsx)(r.h3,{id:"1231-ensure-that-the-api-server-only-makes-use-of-strong-cryptographic-ciphers-automated",children:"1.2.31 Ensure that the API Server only makes use of Strong Cryptographic Ciphers (Automated)"}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,n.jsx)(r.p,{children:(0,n.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-bash",children:"journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'tls-cipher-suites'\n"})}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Expected Result:"})," '--tls-cipher-suites' contains valid elements from 'TLS_AES_128_GCM_SHA256,TLS_AES_256_GCM_SHA384,TLS_CHACHA20_POLY1305_SHA256,TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256,TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256,TLS_RSA_WITH_3DES_EDE_CBC_SHA,TLS_RSA_WITH_AES_128_CBC_SHA,TLS_RSA_WITH_AES_128_GCM_SHA256,TLS_RSA_WITH_AES_256_CBC_SHA,TLS_RSA_WITH_AES_256_GCM_SHA384'"]}),"\n",(0,n.jsxs)(s,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Returned Value:"})}),(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-log",children:'Aug 09 19:01:28 server-0 k3s[2354]: time="2024-08-09T19:01:28Z" level=info msg="Running kube-apiserver --admission-control-config-file=/var/lib/rancher/k3s/server/psa.yaml --advertise-address=10.10.10.100 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})})]}),"\n",(0,n.jsxs)(s,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Remediation:"})}),(0,n.jsxs)(r.p,{children:["By default, the K3s kube-apiserver complies with this test. Changes to these values may cause regression, therefore ensure that all apiserver clients support the new TLS configuration before applying it in production deployments.\nIf a custom TLS configuration is required, consider also creating a custom version of this rule that aligns with your requirements.\nIf this check fails, remove any custom configuration around ",(0,n.jsx)(r.code,{children:"tls-cipher-suites"})," or update the /etc/rancher/k3s/config.yaml file to match the default by adding the following:"]}),(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{children:'kube-apiserver-arg:\n - "tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305"\n'})})]}),"\n",(0,n.jsx)(r.h2,{id:"13-controller-manager",children:"1.3 Controller Manager"}),"\n",(0,n.jsx)(r.h3,{id:"131-ensure-that-the---terminated-pod-gc-threshold-argument-is-set-as-appropriate-manual",children:"1.3.1 Ensure that the --terminated-pod-gc-threshold argument is set as appropriate (Manual)"}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,n.jsx)(r.p,{children:(0,n.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s | grep 'Running kube-controller-manager' | tail -n1 | grep 'terminated-pod-gc-threshold'\n"})}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Expected Result:"})," '--terminated-pod-gc-threshold' is present"]}),"\n",(0,n.jsxs)(s,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Returned Value:"})}),(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-log",children:'Aug 09 19:01:28 server-0 k3s[2354]: time="2024-08-09T19:01:28Z" level=info msg="Running kube-controller-manager --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/k3s/server/tls/client-ca.nochain.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/k3s/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/k3s/server/tls/client-ca.nochain.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/k3s/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/k3s/server/tls/server-ca.nochain.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/k3s/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/k3s/server/tls/server-ca.nochain.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/k3s/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,tokencleaner,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/k3s/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --terminated-pod-gc-threshold=10 --use-service-account-credentials=true"\n'})})]}),"\n",(0,n.jsxs)(s,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Remediation:"})}),(0,n.jsx)(r.p,{children:"Edit the K3s config file /etc/rancher/k3s/config.yaml on the control plane node\nand set the --terminated-pod-gc-threshold to an appropriate threshold,"}),(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{children:'kube-controller-manager-arg:\n - "terminated-pod-gc-threshold=10"\n'})})]}),"\n",(0,n.jsx)(r.h3,{id:"132-ensure-that-the---profiling-argument-is-set-to-false-automated",children:"1.3.2 Ensure that the --profiling argument is set to false (Automated)"}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,n.jsx)(r.p,{children:(0,n.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s | grep 'Running kube-controller-manager' | tail -n1 | grep 'profiling'\n"})}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Expected Result:"})," '--profiling' is equal to 'false'"]}),"\n",(0,n.jsxs)(s,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Returned Value:"})}),(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-log",children:'Aug 09 19:01:28 server-0 k3s[2354]: time="2024-08-09T19:01:28Z" level=info msg="Running kube-controller-manager --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/k3s/server/tls/client-ca.nochain.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/k3s/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/k3s/server/tls/client-ca.nochain.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/k3s/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/k3s/server/tls/server-ca.nochain.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/k3s/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/k3s/server/tls/server-ca.nochain.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/k3s/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,tokencleaner,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/k3s/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --terminated-pod-gc-threshold=10 --use-service-account-credentials=true"\n'})})]}),"\n",(0,n.jsxs)(s,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Remediation:"})}),(0,n.jsx)(r.p,{children:"By default, K3s sets the --profiling argument to false.\nIf this check fails, edit the K3s config file /etc/rancher/k3s/config.yaml and remove any lines like below."}),(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{children:'kube-controller-manager-arg:\n - "profiling=true"\n'})})]}),"\n",(0,n.jsx)(r.h3,{id:"133-ensure-that-the---use-service-account-credentials-argument-is-set-to-true-automated",children:"1.3.3 Ensure that the --use-service-account-credentials argument is set to true (Automated)"}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,n.jsx)(r.p,{children:(0,n.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s | grep 'Running kube-controller-manager' | tail -n1 | grep 'use-service-account-credentials'\n"})}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Expected Result:"})," '--use-service-account-credentials' is not equal to 'false'"]}),"\n",(0,n.jsxs)(s,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Returned Value:"})}),(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-log",children:'Aug 09 19:01:28 server-0 k3s[2354]: time="2024-08-09T19:01:28Z" level=info msg="Running kube-controller-manager --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/k3s/server/tls/client-ca.nochain.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/k3s/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/k3s/server/tls/client-ca.nochain.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/k3s/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/k3s/server/tls/server-ca.nochain.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/k3s/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/k3s/server/tls/server-ca.nochain.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/k3s/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,tokencleaner,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/k3s/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --terminated-pod-gc-threshold=10 --use-service-account-credentials=true"\n'})})]}),"\n",(0,n.jsxs)(s,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Remediation:"})}),(0,n.jsx)(r.p,{children:"By default, K3s sets the --use-service-account-credentials argument to true.\nIf this check fails, edit the K3s config file /etc/rancher/k3s/config.yaml and remove any lines like below."}),(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{children:'kube-controller-manager-arg:\n - "use-service-account-credentials=false"\n'})})]}),"\n",(0,n.jsx)(r.h3,{id:"134-ensure-that-the---service-account-private-key-file-argument-is-set-as-appropriate-automated",children:"1.3.4 Ensure that the --service-account-private-key-file argument is set as appropriate (Automated)"}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,n.jsx)(r.p,{children:(0,n.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"languag
1e-bash",children:"journalctl -u k3s | grep 'Running kube-controller-manager' | tail -n1 | grep 'service-account-private-key-file'\n"})}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Expected Result:"})," '--service-account-private-key-file' is present"]}),"\n",(0,n.jsxs)(s,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Returned Value:"})}),(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-log",children:'Aug 09 19:01:28 server-0 k3s[2354]: time="2024-08-09T19:01:28Z" level=info msg="Running kube-controller-manager --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/k3s/server/tls/client-ca.nochain.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/k3s/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/k3s/server/tls/client-ca.nochain.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/k3s/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/k3s/server/tls/server-ca.nochain.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/k3s/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/k3s/server/tls/server-ca.nochain.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/k3s/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,tokencleaner,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/k3s/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --terminated-pod-gc-threshold=10 --use-service-account-credentials=true"\n'})})]}),"\n",(0,n.jsxs)(s,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Remediation:"})}),(0,n.jsx)(r.p,{children:"By default, K3s automatically provides the service account private key file.\nIt is generated and located at /var/lib/rancher/k3s/server/tls/service.current.key.\nIf this check fails, edit the K3s config file /etc/rancher/k3s/config.yaml and remove any lines like below."}),(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{children:'kube-controller-manager-arg:\n - "service-account-private-key-file=<path>"\n'})})]}),"\n",(0,n.jsx)(r.h3,{id:"135-ensure-that-the---root-ca-file-argument-is-set-as-appropriate-automated",children:"1.3.5 Ensure that the --root-ca-file argument is set as appropriate (Automated)"}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,n.jsx)(r.p,{children:(0,n.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s | grep 'Running kube-controller-manager' | tail -n1 | grep 'root-ca-file'\n"})}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Expected Result:"})," '--root-ca-file' is present"]}),"\n",(0,n.jsxs)(s,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Returned Value:"})}),(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-log",children:'Aug 09 19:01:28 server-0 k3s[2354]: time="2024-08-09T19:01:28Z" level=info msg="Running kube-controller-manager --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/k3s/server/tls/client-ca.nochain.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/k3s/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/k3s/server/tls/client-ca.nochain.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/k3s/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/k3s/server/tls/server-ca.nochain.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/k3s/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/k3s/server/tls/server-ca.nochain.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/k3s/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,tokencleaner,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/k3s/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --terminated-pod-gc-threshold=10 --use-service-account-credentials=true"\n'})})]}),"\n",(0,n.jsxs)(s,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Remediation:"})}),(0,n.jsx)(r.p,{children:"By default, K3s automatically provides the root CA file.\nIt is generated and located at /var/lib/rancher/k3s/server/tls/server-ca.crt.\nIf this check fails, edit the K3s config file /etc/rancher/k3s/config.yaml and remove any lines like below."}),(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{children:'kube-controller-manager-arg:\n - "root-ca-file=<path>"\n'})})]}),"\n",(0,n.jsx)(r.h3,{id:"136-ensure-that-the-rotatekubeletservercertificate-argument-is-set-to-true-automated",children:"1.3.6 Ensure that the RotateKubeletServerCertificate argument is set to true (Automated)"}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,n.jsx)(r.p,{children:(0,n.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s | grep 'Running kube-controller-manager' | tail -n1\n"})}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Expected Result:"})," '--feature-gates' does not have 'RotateKubeletServerCertificate=false' OR '--feature-gates' is not present"]}),"\n",(0,n.jsxs)(s,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Returned Value:"})}),(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-log",children:'Aug 09 19:01:28 server-0 k3s[2354]: time="2024-08-09T19:01:28Z" level=info msg="Running kube-controller-manager --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/k3s/server/tls/client-ca.nochain.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/k3s/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/k3s/server/tls/client-ca.nochain.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/k3s/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/k3s/server/tls/server-ca.nochain.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/k3s/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/k3s/server/tls/server-ca.nochain.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/k3s/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,tokencleaner,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/k3s/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --terminated-pod-gc-threshold=10 --use-service-account-credentials=true"\n'})})]}),"\n",(0,n.jsxs)(s,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Remediation:"})}),(0,n.jsx)(r.p,{children:"By default, K3s does not set the RotateKubeletServerCertificate feature gate.\nIf you have enabled this feature gate, you should remove it.\nIf this check fails, edit the K3s config file /etc/rancher/k3s/config.yaml, remove any lines like below."}),(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{children:'kube-controller-manager-arg:\n - "feature-gate=RotateKubeletServerCertificate"\n'})})]}),"\n",(0,n.jsx)(r.h3,{id:"137-ensure-that-the---bind-address-argument-is-set-to-127001-automated",children:"1.3.7 Ensure that the --bind-address argument is set to 127.0.0.1 (Automated)"}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,n.jsx)(r.p,{children:(0,n.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-bash",children:"/bin/ps -ef | grep containerd | grep -v grep\n"})}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Expected Result:"})," '--bind-address' is present OR '--bind-address' is not present"]}),"\n",(0,n.jsxs)(s,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Returned Value:"})}),(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-log",children:"root 2372 2354 4 19:01 ? 00:00:05 containerd -c /var/lib/rancher/k3s/agent/etc/containerd/config.toml -a /run/k3s/containerd/containerd.sock --state /run/k3s/containerd --root /var/lib/rancher/k3s/agent/containerd\nroot 3128 1 0 19:01 ? 00:00:00 /var/lib/rancher/k3s/data/0f1a87835be3817408b496b439fddb9ea54cab4298db472792bb1b1cbdc210bc/bin/containerd-shim-runc-v2 -namespace k8s.io -id 878d74b0d77d904ec40cd1db71956f2edeb68ab420227a5a42e6d25f249a140a -address /run/k3s/containerd/containerd.sock\nroot 3239 1 0 19:01 ? 00:00:00 /var/lib/rancher/k3s/data/0f1a87835be3817408b496b439fddb9ea54cab4298db472792bb1b1cbdc210bc/bin/containerd-shim-runc-v2 -namespace k8s.io -id d00cc363af40aee36210e396597e4c02712ae99535be21d204849dc33a22af88 -address /run/k3s/containerd/containerd.sock\nroot 3293 1 0 19:01 ? 00:00:00 /var/lib/rancher/k3s/data/0f1a87835be3817408b496b439fddb9ea54cab4298db472792bb1b1cbdc210bc/bin/containerd-shim-runc-v2 -namespace k8s.io -id 5df076fa9547c555a2231b9a9a7cbb44021eaa1ab68c9b59b13da960697143f6 -address /run/k3s/containerd/containerd.sock\nroot 4557 1 0 19:02 ? 00:00:00 /var/lib/rancher/k3s/data/0f1a87835be3817408b496b439fddb9ea54cab4298db472792bb1b1cbdc210bc/bin/containerd-shim-runc-v2 -namespace k8s.io -id f6483b71bcb7ea23356003921a7d90cf638b8f9e473728f3b28dc67163e0fa2d -address /run/k3s/containerd/containerd.sock\nroot 4644 1 0 19:02 ? 00:00:00 /var/lib/rancher/k3s/data/0f1a87835be3817408b496b439fddb9ea54cab4298db472792bb1b1cbdc210bc/bin/containerd-shim-runc-v2 -namespace k8s.io -id 4d8ceb2620c4e0501a49dc9192fc56d035e76bc79a2c6072fee8619730006233 -address /run/k3s/containerd/containerd.sock\n"})})]}),"\n",(0,n.jsxs)(s,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Remediation:"})}),(0,n.jsx)(r.p,{children:"By default, K3s sets the --bind-address argument to 127.0.0.1\nIf this check fails, edit the K3s config file /etc/rancher/k3s/config.yaml and remove any lines like below."}),(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{children:'kube-controller-manager-arg:\n - "bind-address=<IP>"\n'})})]}),"\n",(0,n.jsx)(r.h2,{id:"14-scheduler",children:"1.4 Scheduler"}),"\n",(0,n.jsx)(r.h3,{id:"141-ensure-that-the---profiling-argument-is-set-to-false-automated",children:"1.4.1 Ensure that the --profiling argument is set to false (Automated)"}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,n.jsx)(r.p,{children:(0,n.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-bash",children:"journalctl -D /var/log/journal -u k3s | grep 'Running kube-scheduler' | tail -n1\n"})}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Expected Result:"})," '--profiling' is equal to 'false'"]}),"\n",(0,n.jsxs)(s,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Returned Value:"})}),(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-log",children:'Aug 09 19:01:28 server-0 k3s[2354]: time="2024-08-09T19:01:28Z" level=info msg="Running kube-scheduler --authentication-kubeconfig=/var/lib/rancher/k3s/server/cred/scheduler.kubeconfig --authorization-kubeconfig=/var/lib/rancher/k3s/server/cred/scheduler.kubeconfig --bind-address=127.0.0.1 --kubeconfig=/var/lib/rancher/k3s/server/cred/scheduler.kubeconfig --profiling=false --secure-port=10259"\n'})})]}),"\n",(0,n.jsxs)(s,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Remediation:"})}),(0,n.jsx)(r.p,{children:"By default, K3s sets the --profiling argument to false.\nIf this check fails, edit the K3s config file /etc/rancher/k3s/config.yaml and remove any lines like below."}),(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{children:'kube-scheduler-arg:\n - "profiling=true"\n'})})]}),"\n",(0,n.jsx)(r.h3,{id:"142-ensure-that-the---bind-address-argument-is-set-to-127001-automated",children:"1.4.2 Ensure that the --bind-address argument is set to 127.0.0.1 (Automated)"}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,n.jsx)(r.p,{children:(0,n.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s | grep 'Running kube-scheduler' | tail -n1 | grep 'bind-address'\n"})}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Expected Result:"})," '--bind-address' is equal to '127.0.0.1' OR '--bind-address' is not present"]}),"\n",(0,n.jsxs)(s,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Returned Value:"})}),(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-log",children:'Aug 09 19:01:28 server-0 k3s[2354]: time="2024-08-09T19:01:28Z" level=info msg="Running kube-scheduler --authentication-kubeconfig=/var/lib/rancher/k3s/server/cred/scheduler.kubeconfig --authorization-kubeconfig=/var/lib/rancher/k3s/server/cred/scheduler.kubeconfig --bind-address=127.0.0.1 --kubeconfig=/var/lib/rancher/k3s/server/cred/scheduler.kubeconfig --profiling=false --secure-port=10259"\n'})})]}),"\n",(0,n.jsxs)(s,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Remediation:"})}),(0,n.jsx)(r.p,{children:"By default, K3s sets the --bind-address argument to 127.0.0.1\nIf this check fails, edit the K3s config file /etc/rancher/k3s/config.yaml and remove any lines like below."}),(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{children:'kube-scheduler-arg:\n - "bind-address=<IP>"\n'})})]}),"\n",(0,n.jsx)(r.h2,{id:"2-etcd-node-configuration",children:"2 Etcd Node Configuration"}),"\n",(0,n.jsx)(r.h3,{id:"21-ensure-that-the---cert-file-and---key-file-arguments-are-set-as-appropriate-automated",children:"2.1 Ensure that the --cert-file and --key-file arguments are set as appropriate (Automated)"}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,n.jsx)(r.p,{children:(0,n.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-bash"})}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Expected Result:"})," '.client-transport-security.cert-file' is equal to '/var/lib/rancher/k3s/server/tls/etcd/server-client.crt' AND '.client-transport-security.key-file' is equal to '/var/lib/rancher/k3s/server/tls/etcd/server-client.key'"]}),"\n",(0,n.jsxs)(s,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Returned Value:"})}),(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-log",children:"advertise-client-urls: https://10.10.10.100:2379\nclient-transport-security:\n cert-file: /var/lib/rancher/k3s/server/tls/etcd/server-client.crt\n client-cert-auth: true\n key-file: /var/lib/rancher/k3s/server/tls/etcd/server-client.key\n trusted-ca-file: /var/lib/rancher/k3s/server/tls/etcd/server-ca.crt\ndata-dir: /var/lib/ranch
1er/k3s/server/db/etcd\nelection-timeout: 5000\nexperimental-initial-corrupt-check: true\nheartbeat-interval: 500\ninitial-advertise-peer-urls: https://10.10.10.100:2380\ninitial-cluster: server-0-4a89bd20=https://10.10.10.100:2380\ninitial-cluster-state: new\nlisten-client-http-urls: https://127.0.0.1:2382\nlisten-client-urls: https://127.0.0.1:2379,https://10.10.10.100:2379\nlisten-metrics-urls: http://127.0.0.1:2381\nlisten-peer-urls: https://127.0.0.1:2380,https://10.10.10.100:2380\nlog-outputs:\n- stderr\nlogger: zap\nname: server-0-4a89bd20\npeer-transport-security:\n cert-file: /var/lib/rancher/k3s/server/tls/etcd/peer-server-client.crt\n client-cert-auth: true\n key-file: /var/lib/rancher/k3s/server/tls/etcd/peer-server-client.key\n trusted-ca-file: /var/lib/rancher/k3s/server/tls/etcd/peer-ca.crt\nsnapshot-count: 10000\n"})})]}),"\n",(0,n.jsxs)(s,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Remediation:"})}),(0,n.jsx)(r.p,{children:"If running on with sqlite or a external DB, etcd checks are Not Applicable.\nWhen running with embedded-etcd, K3s generates cert and key files for etcd.\nThese are located in /var/lib/rancher/k3s/server/tls/etcd/.\nIf this check fails, ensure that the configuration file /var/lib/rancher/k3s/server/db/etcd/config\nhas not been modified to use custom cert and key files."})]}),"\n",(0,n.jsx)(r.h3,{id:"22-ensure-that-the---client-cert-auth-argument-is-set-to-true-automated",children:"2.2 Ensure that the --client-cert-auth argument is set to true (Automated)"}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,n.jsx)(r.p,{children:(0,n.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-bash"})}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Expected Result:"})," '.client-transport-security.client-cert-auth' is equal to 'true'"]}),"\n",(0,n.jsxs)(s,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Returned Value:"})}),(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-log",children:"advertise-client-urls: https://10.10.10.100:2379\nclient-transport-security:\n cert-file: /var/lib/rancher/k3s/server/tls/etcd/server-client.crt\n client-cert-auth: true\n key-file: /var/lib/rancher/k3s/server/tls/etcd/server-client.key\n trusted-ca-file: /var/lib/rancher/k3s/server/tls/etcd/server-ca.crt\ndata-dir: /var/lib/rancher/k3s/server/db/etcd\nelection-timeout: 5000\nexperimental-initial-corrupt-check: true\nheartbeat-interval: 500\ninitial-advertise-peer-urls: https://10.10.10.100:2380\ninitial-cluster: server-0-4a89bd20=https://10.10.10.100:2380\ninitial-cluster-state: new\nlisten-client-http-urls: https://127.0.0.1:2382\nlisten-client-urls: https://127.0.0.1:2379,https://10.10.10.100:2379\nlisten-metrics-urls: http://127.0.0.1:2381\nlisten-peer-urls: https://127.0.0.1:2380,https://10.10.10.100:2380\nlog-outputs:\n- stderr\nlogger: zap\nname: server-0-4a89bd20\npeer-transport-security:\n cert-file: /var/lib/rancher/k3s/server/tls/etcd/peer-server-client.crt\n client-cert-auth: true\n key-file: /var/lib/rancher/k3s/server/tls/etcd/peer-server-client.key\n trusted-ca-file: /var/lib/rancher/k3s/server/tls/etcd/peer-ca.crt\nsnapshot-count: 10000\n"})})]}),"\n",(0,n.jsxs)(s,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Remediation:"})}),(0,n.jsx)(r.p,{children:"If running on with sqlite or a external DB, etcd checks are Not Applicable.\nWhen running with embedded-etcd, K3s sets the --client-cert-auth parameter to true.\nIf this check fails, ensure that the configuration file /var/lib/rancher/k3s/server/db/etcd/config\nhas not been modified to disable client certificate authentication."})]}),"\n",(0,n.jsx)(r.h3,{id:"23-ensure-that-the---auto-tls-argument-is-not-set-to-true-automated",children:"2.3 Ensure that the --auto-tls argument is not set to true (Automated)"}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,n.jsx)(r.p,{children:(0,n.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-bash"})}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Expected Result:"})," '.client-transport-security.auto-tls' is present OR '.client-transport-security.auto-tls' is not present"]}),"\n",(0,n.jsxs)(s,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Returned Value:"})}),(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-log",children:"advertise-client-urls: https://10.10.10.100:2379\nclient-transport-security:\n cert-file: /var/lib/rancher/k3s/server/tls/etcd/server-client.crt\n client-cert-auth: true\n key-file: /var/lib/rancher/k3s/server/tls/etcd/server-client.key\n trusted-ca-file: /var/lib/rancher/k3s/server/tls/etcd/server-ca.crt\ndata-dir: /var/lib/rancher/k3s/server/db/etcd\nelection-timeout: 5000\nexperimental-initial-corrupt-check: true\nheartbeat-interval: 500\ninitial-advertise-peer-urls: https://10.10.10.100:2380\ninitial-cluster: server-0-4a89bd20=https://10.10.10.100:2380\ninitial-cluster-state: new\nlisten-client-http-urls: https://127.0.0.1:2382\nlisten-client-urls: https://127.0.0.1:2379,https://10.10.10.100:2379\nlisten-metrics-urls: http://127.0.0.1:2381\nlisten-peer-urls: https://127.0.0.1:2380,https://10.10.10.100:2380\nlog-outputs:\n- stderr\nlogger: zap\nname: server-0-4a89bd20\npeer-transport-security:\n cert-file: /var/lib/rancher/k3s/server/tls/etcd/peer-server-client.crt\n client-cert-auth: true\n key-file: /var/lib/rancher/k3s/server/tls/etcd/peer-server-client.key\n trusted-ca-file: /var/lib/rancher/k3s/server/tls/etcd/peer-ca.crt\nsnapshot-count: 10000\n"})})]}),"\n",(0,n.jsxs)(s,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Remediation:"})}),(0,n.jsx)(r.p,{children:"If running on with sqlite or a external DB, etcd checks are Not Applicable.\nWhen running with embedded-etcd, K3s does not set the --auto-tls parameter.\nIf this check fails, edit the etcd pod specification file /var/lib/rancher/k3s/server/db/etcd/config on the master\nnode and either remove the --auto-tls parameter or set it to false.\nclient-transport-security:\nauto-tls: false"})]}),"\n",(0,n.jsx)(r.h3,{id:"24-ensure-that-the---peer-cert-file-and---peer-key-file-arguments-are-set-as-appropriate-automated",children:"2.4 Ensure that the --peer-cert-file and --peer-key-file arguments are set as appropriate (Automated)"}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,n.jsx)(r.p,{children:(0,n.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-bash"})}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Expected Result:"})," '.peer-transport-security.cert-file' is equal to '/var/lib/rancher/k3s/server/tls/etcd/peer-server-client.crt' AND '.peer-transport-security.key-file' is equal to '/var/lib/rancher/k3s/server/tls/etcd/peer-server-client.key'"]}),"\n",(0,n.jsxs)(s,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Returned Value:"})}),(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-log",children:"advertise-client-urls: https://10.10.10.100:2379\nclient-transport-security:\n cert-file: /var/lib/rancher/k3s/server/tls/etcd/server-client.crt\n client-cert-auth: true\n key-file: /var/lib/rancher/k3s/server/tls/etcd/server-client.key\n trusted-ca-file: /var/lib/rancher/k3s/server/tls/etcd/server-ca.crt\ndata-dir: /var/lib/rancher/k3s/server/db/etcd\nelection-timeout: 5000\nexperimental-initial-corrupt-check: true\nheartbeat-interval: 500\ninitial-advertise-peer-urls: https://10.10.10.100:2380\ninitial-cluster: server-0-4a89bd20=https://10.10.10.100:2380\ninitial-cluster-state: new\nlisten-client-http-urls: https://127.0.0.1:2382\nlisten-client-urls: https://127.0.0.1:2379,https://10.10.10.100:2379\nlisten-metrics-urls: http://127.0.0.1:2381\nlisten-peer-urls: https://127.0.0.1:2380,https://10.10.10.100:2380\nlog-outputs:\n- stderr\nlogger: zap\nname: server-0-4a89bd20\npeer-transport-security:\n cert-file: /var/lib/rancher/k3s/server/tls/etcd/peer-server-client.crt\n client-cert-auth: true\n key-file: /var/lib/rancher/k3s/server/tls/etcd/peer-server-client.key\n trusted-ca-file: /var/lib/rancher/k3s/server/tls/etcd/peer-ca.crt\nsnapshot-count: 10000\n"})})]}),"\n",(0,n.jsxs)(s,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Remediation:"})}),(0,n.jsx)(r.p,{children:"If running on with sqlite or a external DB, etcd checks are Not Applicable.\nWhen running with embedded-etcd, K3s generates peer cert and key files for etcd.\nThese are located in /var/lib/rancher/k3s/server/tls/etcd/.\nIf this check fails, ensure that the configuration file /var/lib/rancher/k3s/server/db/etcd/config\nhas not been modified to use custom peer cert and key files."})]}),"\n",(0,n.jsx)(r.h3,{id:"25-ensure-that-the---peer-client-cert-auth-argument-is-set-to-true-automated",children:"2.5 Ensure that the --peer-client-cert-auth argument is set to true (Automated)"}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,n.jsx)(r.p,{children:(0,n.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-bash"})}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Expected Result:"})," '.peer-transport-security.client-cert-auth' is equal to 'true'"]}),"\n",(0,n.jsxs)(s,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Returned Value:"})}),(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-log",children:"advertise-client-urls: https://10.10.10.100:2379\nclient-transport-security:\n cert-file: /var/lib/rancher/k3s/server/tls/etcd/server-client.crt\n client-cert-auth: true\n key-file: /var/lib/rancher/k3s/server/tls/etcd/server-client.key\n trusted-ca-file: /var/lib/rancher/k3s/server/tls/etcd/server-ca.crt\ndata-dir: /var/lib/rancher/k3s/server/db/etcd\nelection-timeout: 5000\nexperimental-initial-corrupt-check: true\nheartbeat-interval: 500\ninitial-advertise-peer-urls: https://10.10.10.100:2380\ninitial-cluster: server-0-4a89bd20=https://10.10.10.100:2380\ninitial-cluster-state: new\nlisten-client-http-urls: https://127.0.0.1:2382\nlisten-client-urls: https://127.0.0.1:2379,https://10.10.10.100:2379\nlisten-metrics-urls: http://127.0.0.1:2381\nlisten-peer-urls: https://127.0.0.1:2380,https://10.10.10.100:2380\nlog-outputs:\n- stderr\nlogger: zap\nname: server-0-4a89bd20\npeer-transport-security:\n cert-file: /var/lib/rancher/k3s/server/tls/etcd/peer-server-client.crt\n client-cert-auth: true\n key-file: /var/lib/rancher/k3s/server/tls/etcd/peer-server-client.key\n trusted-ca-file: /var/lib/rancher/k3s/server/tls/etcd/peer-ca.crt\nsnapshot-count: 10000\n"})})]}),"\n",(0,n.jsxs)(s,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Remediation:"})}),(0,n.jsx)(r.p,{children:"If running on with sqlite or a external DB, etcd checks are Not Applicable.\nWhen running with embedded-etcd, K3s sets the --peer-cert-auth parameter to true.\nIf this check fails, ensure that the configuration file /var/lib/rancher/k3s/server/db/etcd/config\nhas not been modified to disable peer client certificate authentication."})]}),"\n",(0,n.jsx)(r.h3,{id:"26-ensure-that-the---peer-auto-tls-argument-is-not-set-to-true-automated",children:"2.6 Ensure that the --peer-auto-tls argument is not set to true (Automated)"}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,n.jsx)(r.p,{children:(0,n.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-bash"})}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Expected Result:"})," '.peer-transport-security.auto-tls' is present OR '.peer-transport-security.auto-tls' is not present"]}),"\n",(0,n.jsxs)(s,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Returned Value:"})}),(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-log",children:"advertise-client-urls: https://10.10.10.100:2379\nclient-transport-security:\n cert-file: /var/lib/rancher/k3s/server/tls/etcd/server-client.crt\n client-cert-auth: true\n key-file: /var/lib/rancher/k3s/server/tls/etcd/server-client.key\n trusted-ca-file: /var/lib/rancher/k3s/server/tls/etcd/server-ca.crt\ndata-dir: /var/lib/rancher/k3s/server/db/etcd\nelection-timeout: 5000\nexperimental-initial-corrupt-check: true\nheartbeat-interval: 500\ninitial-advertise-peer-urls: https://10.10.10.100:2380\ninitial-cluster: server-0-4a89bd20=https://10.10.10.100:2380\ninitial-cluster-state: new\nlisten-client-http-urls: https://127.0.0.1:2382\nlisten-client-urls: https://127.0.0.1:2379,https://10.10.10.100:2379\nlisten-metrics-urls: http://127.0.0.1:2381\nlisten-peer-urls: https://127.0.0.1:2380,https://10.10.10.100:2380\nlog-outputs:\n- stderr\nlogger: zap\nname: server-0-4a89bd20\npeer-transport-security:\n cert-file: /var/lib/rancher/k3s/server/tls/etcd/peer-server-client.crt\n client-cert-auth: true\n key-file: /var/lib/rancher/k3s/server/tls/etcd/peer-server-client.key\n trusted-ca-file: /var/lib/rancher/k3s/server/tls/etcd/peer-ca.crt\nsnapshot-count: 10000\n"})})]}),"\n",(0,n.jsxs)(s,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Remediation:"})}),(0,n.jsx)(r.p,{children:"If running on with sqlite or a external DB, etcd checks are Not Applicable.\nWhen running with embedded-etcd, K3s does not set the --peer-auto-tls parameter.\nIf this check fails, edit the etcd pod specification file /var/lib/rancher/k3s/server/db/etcd/config on the master\nnode and either remove the --peer-auto-tls parameter or set it to false.\npeer-transport-security:\nauto-tls: false"})]}
1),"\n",(0,n.jsx)(r.h3,{id:"27-ensure-that-a-unique-certificate-authority-is-used-for-etcd-automated",children:"2.7 Ensure that a unique Certificate Authority is used for etcd (Automated)"}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,n.jsx)(r.p,{children:(0,n.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-bash"})}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Expected Result:"})," '.peer-transport-security.trusted-ca-file' is equal to '/var/lib/rancher/k3s/server/tls/etcd/peer-ca.crt'"]}),"\n",(0,n.jsxs)(s,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Returned Value:"})}),(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-log",children:"advertise-client-urls: https://10.10.10.100:2379\nclient-transport-security:\n cert-file: /var/lib/rancher/k3s/server/tls/etcd/server-client.crt\n client-cert-auth: true\n key-file: /var/lib/rancher/k3s/server/tls/etcd/server-client.key\n trusted-ca-file: /var/lib/rancher/k3s/server/tls/etcd/server-ca.crt\ndata-dir: /var/lib/rancher/k3s/server/db/etcd\nelection-timeout: 5000\nexperimental-initial-corrupt-check: true\nheartbeat-interval: 500\ninitial-advertise-peer-urls: https://10.10.10.100:2380\ninitial-cluster: server-0-4a89bd20=https://10.10.10.100:2380\ninitial-cluster-state: new\nlisten-client-http-urls: https://127.0.0.1:2382\nlisten-client-urls: https://127.0.0.1:2379,https://10.10.10.100:2379\nlisten-metrics-urls: http://127.0.0.1:2381\nlisten-peer-urls: https://127.0.0.1:2380,https://10.10.10.100:2380\nlog-outputs:\n- stderr\nlogger: zap\nname: server-0-4a89bd20\npeer-transport-security:\n cert-file: /var/lib/rancher/k3s/server/tls/etcd/peer-server-client.crt\n client-cert-auth: true\n key-file: /var/lib/rancher/k3s/server/tls/etcd/peer-server-client.key\n trusted-ca-file: /var/lib/rancher/k3s/server/tls/etcd/peer-ca.crt\nsnapshot-count: 10000\n"})})]}),"\n",(0,n.jsxs)(s,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Remediation:"})}),(0,n.jsx)(r.p,{children:"If running on with sqlite or a external DB, etcd checks are Not Applicable.\nWhen running with embedded-etcd, K3s generates a unique certificate authority for etcd.\nThis is located at /var/lib/rancher/k3s/server/tls/etcd/peer-ca.crt.\nIf this check fails, ensure that the configuration file /var/lib/rancher/k3s/server/db/etcd/config\nhas not been modified to use a shared certificate authority."})]}),"\n",(0,n.jsx)(r.h2,{id:"41-worker-node-configuration-files",children:"4.1 Worker Node Configuration Files"}),"\n",(0,n.jsx)(r.h3,{id:"411-ensure-that-the-kubelet-service-file-permissions-are-set-to-600-or-more-restrictive-automated",children:"4.1.1 Ensure that the kubelet service file permissions are set to 600 or more restrictive (Automated)"}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," Not Applicable"]}),"\n",(0,n.jsx)(r.p,{children:(0,n.jsx)(r.strong,{children:"Rationale:"})}),"\n",(0,n.jsx)(r.p,{children:"The kubelet is embedded in the k3s process. There is no kubelet service file, all configuration is passed in as arguments at runtime."}),"\n",(0,n.jsxs)(r.h3,{id:"412-ensure-that-the-kubelet-service-file-ownership-is-set-to-root-automated",children:["4.1.2 Ensure that the kubelet service file ownership is set to root",":root"," (Automated)"]}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," Not Applicable"]}),"\n",(0,n.jsx)(r.p,{children:(0,n.jsx)(r.strong,{children:"Rationale:"})}),"\n",(0,n.jsx)(r.p,{children:"The kubelet is embedded in the k3s process. There is no kubelet service file, all configuration is passed in as arguments at runtime."}),"\n",(0,n.jsx)(r.p,{children:"All configuration is passed in as arguments at container run time."}),"\n",(0,n.jsx)(r.h3,{id:"413-if-proxy-kubeconfig-file-exists-ensure-permissions-are-set-to-600-or-more-restrictive-automated",children:"4.1.3 If proxy kubeconfig file exists ensure permissions are set to 600 or more restrictive (Automated)"}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,n.jsx)(r.p,{children:(0,n.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-bash",children:"/bin/sh -c 'if test -e /var/lib/rancher/k3s/agent/kubeproxy.kubeconfig; then stat -c permissions=%a /var/lib/rancher/k3s/agent/kubeproxy.kubeconfig;
1 fi' \n"})}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Expected Result:"})," permissions has permissions 600, expected 600 or more restrictive"]}),"\n",(0,n.jsxs)(s,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Returned Value:"})}),(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-log",children:"permissions=600\n"})})]}),"\n",(0,n.jsxs)(s,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Remediation:"})}),(0,n.jsxs)(r.p,{children:["Run the below command (based on the file location on your system) on the each worker node.\nFor example,\n",(0,n.jsx)(r.code,{children:"chmod 600 /var/lib/rancher/k3s/agent/kubeproxy.kubeconfig"})]})]}),"\n",(0,n.jsxs)(r.h3,{id:"414-if-proxy-kubeconfig-file-exists-ensure-ownership-is-set-to-root-automated",children:["4.1.4 If proxy kubeconfig file exists ensure ownership is set to root",":root"," (Automated)"]}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,n.jsx)(r.p,{children:(0,n.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-bash",children:"/bin/sh -c 'if test -e /var/lib/rancher/k3s/agent/kubeproxy.kubeconfig; then stat -c %U:%G /var/lib/rancher/k3s/agent/kubeproxy.kubeconfig;
1 fi' \n"})}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Expected Result:"})," 'root",":root","' is present"]}),"\n",(0,n.jsxs)(s,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Returned Value:"})}),(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-log",children:"root:root\n"})})]}),"\n",(0,n.jsxs)(s,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Remediation:"})}),(0,n.jsxs)(r.p,{children:["Run the below command (based on the file location on your system) on the each worker node.\nFor example, ",(0,n.jsx)(r.code,{children:"chown root:root /var/lib/rancher/k3s/agent/kubeproxy.kubeconfig"})]})]}),"\n",(0,n.jsx)(r.h3,{id:"415-ensure-that-the---kubeconfig-kubeletconf-file-permissions-are-set-to-600-or-more-restrictive-automated",children:"4.1.5 Ensure that the --kubeconfig kubelet.conf file permissions are set to 600 or more restrictive (Automated)"}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,n.jsx)(r.p,{children:(0,n.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-bash",children:"/bin/sh -c 'if test -e /var/lib/rancher/k3s/agent/kubelet.kubeconfig; then stat -c permissions=%a /var/lib/rancher/k3s/agent/kubelet.kubeconfig;
1 fi' \n"})}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Expected Result:"})," permissions has permissions 600, expected 600 or more restrictive"]}),"\n",(0,n.jsxs)(s,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Returned Value:"})}),(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-log",children:"permissions=600\n"})})]}),"\n",(0,n.jsxs)(s,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Remediation:"})}),(0,n.jsxs)(r.p,{children:["Run the below command (based on the file location on your system) on the each worker node.\nFor example,\n",(0,n.jsx)(r.code,{children:"chmod 600 /var/lib/rancher/k3s/agent/kubelet.kubeconfig"})]})]}),"\n",(0,n.jsxs)(r.h3,{id:"416-ensure-that-the---kubeconfig-kubeletconf-file-ownership-is-set-to-root-automated",children:["4.1.6 Ensure that the --kubeconfig kubelet.conf file ownership is set to root",":root"," (Automated)"]}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,n.jsx)(r.p,{children:(0,n.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-bash",children:"stat -c %U:%G /var/lib/rancher/k3s/agent/kubelet.kubeconfig\n"})}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Expected Result:"})," 'root",":root","' is present"]}),"\n",(0,n.jsxs)(s,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Returned Value:"})}),(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-log",children:"root:root\n"})})]}),"\n",(0,n.jsxs)(s,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Remediation:"})}),(0,n.jsxs)(r.p,{children:["Run the below command (based on the file location on your system) on the each worker node.\nFor example,\n",(0,n.jsx)(r.code,{children:"chown root:root /var/lib/rancher/k3s/agent/kubelet.kubeconfig"})]})]}),"\n",(0,n.jsx)(r.h3,{id:"417-ensure-that-the-certificate-authorities-file-permissions-are-set-to-600-or-more-restrictive-automated",children:"4.1.7 Ensure that the certificate authorities file permissions are set to 600 or more restrictive (Automated)"}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,n.jsx)(r.p,{children:(0,n.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-bash",children:"stat -c permissions=%a /var/lib/rancher/k3s/agent/client-ca.crt\n"})}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Expected Result:"})," permissions has permissions 600, expected 600 or more restrictive"]}),"\n",(0,n.jsxs)(s,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Returned Value:"})}),(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-log",children:"permissions=600\n"})})]}),"\n",(0,n.jsxs)(s,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Remediation:"})}),(0,n.jsxs)(r.p,{children:["Run the following command to modify the file permissions of the\n--client-ca-file ",(0,n.jsx)(r.code,{children:"chmod 600 /var/lib/rancher/k3s/agent/client-ca.crt"})]})]}),"\n",(0,n.jsxs)(r.h3,{id:"418-ensure-that-the-client-certificate-authorities-file-ownership-is-set-to-root-automated",children:["4.1.8 Ensure that the client certificate authorities file ownership is set to root",":root"," (Automated)"]}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,n.jsx)(r.p,{children:(0,n.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-bash",children:"stat -c %U:%G /var/lib/rancher/k3s/agent/client-ca.crt\n"})}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Expected Result:"})," 'root",":root","' is equal to 'root",":root","'"]}),"\n",(0,n.jsxs)(s,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Returned Value:"})}),(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-log",children:"root:root\n"})})]}),"\n",(0,n.jsxs)(s,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Remediation:"})}),(0,n.jsxs)(r.p,{children:["Run the following command to modify the ownership of the --client-ca-file.\n",(0,n.jsx)(r.code,{children:"chown root:root /var/lib/rancher/k3s/agent/client-ca.crt"})]})]}),"\n",(0,n.jsx)(r.h3,{id:"419-ensure-that-the-kubelet---config-configuration-file-has-permissions-set-to-600-or-more-restrictive-automated",children:"4.1.9 Ensure that the kubelet --config configuration file has permissions set to 600 or more restrictive (Automated)"}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," Not Applicable"]}),"\n",(0,n.jsx)(r.p,{children:(0,n.jsx)(r.strong,{children:"Rationale:"})}),"\n",(0,n.jsx)(r.p,{children:"The kubelet is embedded in the k3s process. There is no kubelet config file, all configuration is passed in as arguments at runtime."}),"\n",(0,n.jsxs)(r.h3,{id:"4110-ensure-that-the-kubelet---config-configuration-file-ownership-is-set-to-root-automated",children:["4.1.10 Ensure that the kubelet --config configuration file ownership is set to root",":root"," (Automated)"]}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," Not Applicable"]}),"\n",(0,n.jsx)(r.p,{children:(0,n.jsx)(r.strong,{children:"Rationale:"})}),"\n",(0,n.jsx)(r.p,{children:"The kubelet is embedded in the k3s process. There is no kubelet config file, all configuration is passed in as arguments at runtime."}),"\n",(0,n.jsx)(r.h2,{id:"42-kubelet",children:"4.2 Kubelet"}),"\n",(0,n.jsx)(r.h3,{id:"421-ensure-that-the---anonymous-auth-argument-is-set-to-false-automated",children:"4.2.1 Ensure that the --anonymous-auth argument is set to false (Automated)"}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,n.jsx)(r.p,{children:(0,n.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-bash",children:'/bin/sh -c \'if test $(journalctl -D /var/log/journal -u k3s | grep "Running kube-apiserver" | wc -l) -gt 0; then journalctl -D /var/log/journal -u k3s | grep "Running kube-apiserver" | tail -n1 | grep "anonymous-auth" | grep -v grep; else echo "--anonymous-auth=false"; fi\' \n'})}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Expected Result:"})," '--anonymous-auth' is equal to 'false'"]}),"\n",(0,n.jsxs)(s,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Returned Value:"})}),(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-log",children:'Aug 09 19:01:28 server-0 k3s[2354]: time="2024-08-09T19:01:28Z" level=info msg="Running kube-apiserver --admission-control-config-file=/var/lib/rancher/k3s/server/psa.yaml --advertise-address=10.10.10.100 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})})]}),"\n",(0,n.jsxs)(s,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Remediation:"})}),(0,n.jsx)(r.p,{children:"By default, K3s sets the --anonymous-auth to fal
1se. If you have set this to a different value, you\nshould set it back to false. If using the K3s config file /etc/rancher/k3s/config.yaml, remove any lines similar to below."}),(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{children:'kubelet-arg:\n - "anonymous-auth=true"\n'})}),(0,n.jsx)(r.p,{children:'If using the command line, edit the K3s service file and remove the below argument.\n--kubelet-arg="anonymous-auth=true"\nBased on your system, restart the k3s service. For example,\nsystemctl daemon-reload\nsystemctl restart k3s.service'})]}),"\n",(0,n.jsx)(r.h3,{id:"422-ensure-that-the---authorization-mode-argument-is-not-set-to-alwaysallow-automated",children:"4.2.2 Ensure that the --authorization-mode argument is not set to AlwaysAllow (Automated)"}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,n.jsx)(r.p,{children:(0,n.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-bash",children:'/bin/sh -c \'if test $(journalctl -D /var/log/journal -u k3s | grep "Running kube-apiserver" | wc -l) -gt 0; then journalctl -D /var/log/journal -u k3s | grep "Running kube-apiserver" | tail -n1 | grep "authorization-mode"; else echo "--authorization-mode=Webhook"; fi\' \n'})}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Expected Result:"})," '--authorization-mode' does not have 'AlwaysAllow'"]}),"\n",(0,n.jsxs)(s,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Returned Value:"})}),(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-log",children:'Aug 09 19:01:28 server-0 k3s[2354]: time="2024-08-09T19:01:28Z" level=info msg="Running kube-apiserver --admission-control-config-file=/var/lib/rancher/k3s/server/psa.yaml --advertise-address=10.10.10.100 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})})]}),"\n",(0,n.jsxs)(s,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Remediation:"})}),(0,n.jsx)(r.p,{children:"By default, K3s does not set the --authorization-mode to AlwaysAllow.\nIf using the K3s config file /etc/rancher/k3s/config.yaml, remove any lines similar to below."}),(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{children:'kubelet-arg:\n - "authorization-mode=AlwaysAllow"\n'})}),(0,n.jsx)(r.p,{children:'If using the command line, edit the K3s service file and remove the below argument.\n--kubelet-arg="authorization-mode=AlwaysAllow"\nBased on your system, restart the k3s service. For example,\nsystemctl daemon-reload\nsystemctl restart k3s.service'})]}),"\n",(0,n.jsx)(r.h3,{id:"423-ensure-that-the---client-ca-file-argument-is-set-as-appropriate-automated",children:"4.2.3 Ensure that the --client-ca-file argument is set as appropriate (Automated)"}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,n.jsx)(r.p,{children:(0,n.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-bash",children:'/bin/sh -c \'if test $(journalctl -D /var/log/journal -u k3s | grep "Running kube-apiserver" | wc -l) -gt 0; then journalctl -D /var/log/journal -u k3s | grep "Running kube-apiserver" | tail -n1 | grep "client-ca-file"; else echo "--client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt"; fi\' \n'})}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Expected Result:"})," '--client-ca-file' is present"]}),"\n",(0,n.jsxs)(s,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Returned Value:"})}),(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-log",children:'Aug 09 19:01:28 server-0 k3s[2354]: time="2024-08-09T19:01:28Z" level=info msg="Running kube-apiserver --admission-control-config-file=/var/lib/rancher/k3s/server/psa.yaml --advertise-address=10.10.10.100 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})})]}),"\n",(0,n.jsxs)(s,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Remediation:"})}),(0,n.jsx)(r.p,{children:"By default, K3s automatically provides the client ca certificate for the Kubelet.\nIt is generated and located at /var/lib/rancher/k3s/agent/client-ca.crt"})]}),"\n",(0,n.jsx)(r.h3,{id:"424-verify-that-the---read-only-port-argument-is-set-to-0-automated",children:"4.2.4 Verify that the --read-only-port argument is set to 0 (Automated)"}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,n.jsx)(r.p,{children:(0,n.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s -u k3s-agent | grep 'Running kubelet' | tail -n1\n"})}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Expected Result:"})," '--read-only-port' is equal to '0' OR '--read-only-port' is not present"]}),"\n",(0,n.jsxs)(s,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Returned Value:"})}),(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-log",children:'Aug 09 19:01:30 server-0 k3s[2354]: time="2024-08-09T19:01:30Z" level=info msg="Running kubelet --address=0.0.0.0 --allowed-unsafe-sysctls=net.ipv4.ip_forward,net.ipv6.conf.all.forwarding --anonymous-auth=false --authentication-token-webhook=true --authorization-mode=Webhook --cgroup-driver=systemd --client-ca-file=/var/lib/rancher/k3s/agent/client-ca.crt --cloud-provider=external --cluster-dns=10.43.0.10 --cluster-domain=cluster.local --container-runtime-endpoint=unix:///run/k3s/containerd/containerd.sock --containerd=/run/k3s/containerd/containerd.sock --event-qps=0 --eviction-hard=imagefs.available<5%,nodefs.available<5% --eviction-minimum-reclaim=imagefs.available=10%,nodefs.available=10% --fail-swap-on=false --healthz-bind-address=127.0.0.1 --hostname-override=server-0 --kubeconfig=/var/lib/rancher/k3s/agent/kubelet.kubeconfig --make-iptables-util-chains=true --node-ip=10.10.10.100 --node-labels= --pod-infra-container-image=rancher/mirrored-pause:3.6 --pod-manifest-path=/var/lib/rancher/k3s/agent/pod-manifests --protect-kernel-defaults=true --read-only-port=0 --resolv-conf=/run/systemd/resolve/resolv.conf --serialize-image-pulls=false --streaming-connection-idle-timeout=5m --tls-cert-file=/var/lib/rancher/k3s/agent/serving-kubelet.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/agent/serving-kubelet.key"\n'})})]}),"\n",(0,n.jsxs)(s,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Remediation:"})}),(0,n.jsx)(r.p,{children:"By default, K3s sets the --read-only-port to 0. If you have set this to a different value, you\nshould set it back to 0. If using the K3s config file /etc/rancher/k3s/config.yaml, remove any lines similar to below."}),(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{children:'kubelet-arg:\n - "read-only-port=XXXX"\n'})}),(0,n.jsx)(r.p,{children:'If using the command line, edit the K3s service file and remove the below argument.\n--kubelet-arg="read-only-port=XXXX"\nBased on your system, restart the k3s service. For example,\nsystemctl daemon-reload\nsystemctl restart k3s.service'})]}),"\n",(0,n.jsx)(r.h3,{id:"425-ensure-that-the---streaming-connection-idle-timeout-argument-is-not-set-to-0-manual",children:"4.2.5 Ensure that the --streaming-connection-idle-timeout argument is not set to 0 (Manual)"}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,n.jsx)(r.p,{children:(0,n.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s -u k3s-agent | grep 'Running kubelet' | tail -n1\n"})}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Expected Result:"})," '--streaming-connection-idle-timeout' is not equal to '0' OR '--streaming-connection-idle-timeout' is not present"]}),"\n",(0,n.jsxs)(s,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Returned Value:"})}),(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-log",children:'Aug 09 19:01:30 server-0 k3s[2354]: time="2024-08-09T19:01:30Z" level=info msg="Running kubelet --address=0.0.0.0 --allowed-unsafe-sysctls=net.ipv4.ip_forward,net.ipv6.conf.all.forwarding --anonymous-auth=false --authentication-token-webhook=true --authorization-mode=Webhook --cgroup-driver=systemd --client-ca-file=/var/lib/rancher/k3s/agent/client-ca.crt --cloud-provider=external --cluster-dns=10.43.0.10 --cluster-domain=cluster.local --container-runtime-endpoint=unix:///run/k3s/containerd/containerd.sock --containerd=/run/k3s/containerd/containerd.sock --event-qps=0 --eviction-hard=imagefs.available<5%,nodefs.available<5% --eviction-minimum-reclaim=imagefs.available=10%,nodefs.available=10% --fail-swap-on=false --healthz-bind-address=127.0.0.1 --hostname-override=server-0 --kubeconfig=/var/lib/rancher/k3s/agent/kubelet.kubeconfig --make-iptables-util-chains=true --node-ip=10.10.10.100 --node-labels= --pod-infra-container-image=rancher/mirrored-pause:3.6 --pod-manifest-path=/var/lib/rancher/k3s/agent/pod-manifests --protect-kernel-defaults=true --read-only-port=0 --resolv-conf=/run/systemd/resolve/resolv.conf --serialize-image-pulls=false --streaming-connection-idle-timeout=5m --tls-cert-file=/var/lib/rancher/k3s/agent/serving-kubelet.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/agent/serving-kubelet.key"\n'})})]}),"\n",(0,n.jsxs)(s,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Remediation:"})}),(0,n.jsx)(r.p,{children:"If using the K3s config file /etc/rancher/k3s/config.yaml, set the following parameter to an appropriate value."}),(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{children:'kubelet-arg:\n - "streaming-connection-idle-timeout=5m"\n'})}),(0,n.jsx)(r.p,{children:'If using the command line, run K3s with --kubelet-arg="streaming-connection-idle-timeout=5m".\nBased on your system, restart the k3s service. For example,\nsystemctl restart k3s.service'})]}),"\n",(0,n.jsx)(r.h3,{id:"426-ensure-that-the---make-iptables-util-chains-argument-is-set-to-true-automated",children:"4.2.6 Ensure that the --make-iptables-util-chains argument is set to true (Automated)"}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,n.jsx)(r.p,{children:(0,n.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s -u k3s-agent | grep 'Running kubelet' | tail -n1\n"})}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Expected Result:"})," '--make-iptables-util-chains' is equal to 'true' OR '--make-iptables-util-chains' is not present"]}),"\n",(0,n.jsxs)(s,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Returned Value:"})}),(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-log",children:'Aug 09 19:01:30 server-0 k3s[2
1354]: time="2024-08-09T19:01:30Z" level=info msg="Running kubelet --address=0.0.0.0 --allowed-unsafe-sysctls=net.ipv4.ip_forward,net.ipv6.conf.all.forwarding --anonymous-auth=false --authentication-token-webhook=true --authorization-mode=Webhook --cgroup-driver=systemd --client-ca-file=/var/lib/rancher/k3s/agent/client-ca.crt --cloud-provider=external --cluster-dns=10.43.0.10 --cluster-domain=cluster.local --container-runtime-endpoint=unix:///run/k3s/containerd/containerd.sock --containerd=/run/k3s/containerd/containerd.sock --event-qps=0 --eviction-hard=imagefs.available<5%,nodefs.available<5% --eviction-minimum-reclaim=imagefs.available=10%,nodefs.available=10% --fail-swap-on=false --healthz-bind-address=127.0.0.1 --hostname-override=server-0 --kubeconfig=/var/lib/rancher/k3s/agent/kubelet.kubeconfig --make-iptables-util-chains=true --node-ip=10.10.10.100 --node-labels= --pod-infra-container-image=rancher/mirrored-pause:3.6 --pod-manifest-path=/var/lib/rancher/k3s/agent/pod-manifests --protect-kernel-defaults=true --read-only-port=0 --resolv-conf=/run/systemd/resolve/resolv.conf --serialize-image-pulls=false --streaming-connection-idle-timeout=5m --tls-cert-file=/var/lib/rancher/k3s/agent/serving-kubelet.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/agent/serving-kubelet.key"\n'})})]}),"\n",(0,n.jsxs)(s,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Remediation:"})}),(0,n.jsx)(r.p,{children:"If using the K3s config file /etc/rancher/k3s/config.yaml, set the following parameter."}),(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{children:'kubelet-arg:\n - "make-iptables-util-chains=true"\n'})}),(0,n.jsx)(r.p,{children:'If using the command line, run K3s with --kubelet-arg="make-iptables-util-chains=true".\nBased on your system, restart the k3s service. For example,\nsystemctl restart k3s.service'})]}),"\n",(0,n.jsx)(r.h3,{id:"427-ensure-that-the---hostname-override-argument-is-not-set-automated",children:"4.2.7 Ensure that the --hostname-override argument is not set (Automated)"}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," Not Applicable"]}),"\n",(0,n.jsx)(r.p,{children:(0,n.jsx)(r.strong,{children:"Rationale:"})}),"\n",(0,n.jsx)(r.p,{children:"By default, K3s does set the --hostname-override argument. Per CIS guidelines, this is to comply\nwith cloud providers that require this flag to ensure that hostname matches node names."}),"\n",(0,n.jsx)(r.h3,{id:"428-ensure-that-the-eventrecordqps-argument-is-set-to-a-level-which-ensures-appropriate-event-capture-manual",children:"4.2.8 Ensure that the eventRecordQPS argument is set to a level which ensures appropriate event capture (Manual)"}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,n.jsx)(r.p,{children:(0,n.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s -u k3s-agent | grep 'Running kubelet' | tail -n1\n"})}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Expected Result:"})," '--event-qps' is greater or equal to 0 OR '--event-qps' is not present"]}),"\n",(0,n.jsxs)(s,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Returned Value:"})}),(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-log",children:'Aug 09 19:01:30 server-0 k3s[2354]: time="2024-08-09T19:01:30Z" level=info msg="Running kubelet --address=0.0.0.0 --allowed-unsafe-sysctls=net.ipv4.ip_forward,net.ipv6.conf.all.forwarding --anonymous-auth=false --authentication-token-webhook=true --authorization-mode=Webhook --cgroup-driver=systemd --client-ca-file=/var/lib/rancher/k3s/agent/client-ca.crt --cloud-provider=external --cluster-dns=10.43.0.10 --cluster-domain=cluster.local --container-runtime-endpoint=unix:///run/k3s/containerd/containerd.sock --containerd=/run/k3s/containerd/containerd.sock --event-qps=0 --eviction-hard=imagefs.available<5%,nodefs.available<5% --eviction-minimum-reclaim=imagefs.available=10%,nodefs.available=10% --fail-swap-on=false --healthz-bind-address=127.0.0.1 --hostname-override=server-0 --kubeconfig=/var/lib/rancher/k3s/agent/kubelet.kubeconfig --make-iptables-util-chains=true --node-ip=10.10.10.100 --node-labels= --pod-infra-container-image=rancher/mirrored-pause:3.6 --pod-manifest-path=/var/lib/rancher/k3s/agent/pod-manifests --protect-kernel-defaults=true --read-only-port=0 --resolv-conf=/run/systemd/resolve/resolv.conf --serialize-image-pulls=false --streaming-connection-idle-timeout=5m --tls-cert-file=/var/lib/rancher/k3s/agent/serving-kubelet.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/agent/serving-kubelet.key"\n'})})]}),"\n",(0,n.jsxs)(s,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Remediation:"})}),(0,n.jsx)(r.p,{children:"By default, K3s sets the event-qps to 0. Should you wish to change this,\nIf using the K3s config file /etc/rancher/k3s/config.yaml, set the following parameter to an appropriate value."}),(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{children:'kubelet-arg:\n - "event-qps=<value>"\n'})}),(0,n.jsx)(r.p,{children:'If using the command line, run K3s with --kubelet-arg="event-qps=<value>".\nBased on your system, restart the k3s service. For example,\nsystemctl restart k3s.service'})]}),"\n",(0,n.jsx)(r.h3,{id:"429-ensure-that-the---tls-cert-file-and---tls-private-key-file-arguments-are-set-as-appropriate-automated",children:"4.2.9 Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate (Automated)"}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,n.jsx)(r.p,{children:(0,n.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s -u k3s-agent | grep 'Running kubelet' | tail -n1\n"})}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Expected Result:"})," '--tls-cert-file' is present AND '--tls-private-key-file' is present"]}),"\n",(0,n.jsxs)(s,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Returned Value:"})}),(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-log",children:'Aug 09 19:01:30 server-0 k3s[2354]: time="2024-08-09T19:01:30Z" level=info msg="Running kubelet --address=0.0.0.0 --allowed-unsafe-sysctls=net.ipv4.ip_forward,net.ipv6.conf.all.forwarding --anonymous-auth=false --authentication-token-webhook=true --authorization-mode=Webhook --cgroup-driver=systemd --client-ca-file=/var/lib/rancher/k3s/agent/client-ca.crt --cloud-provider=external --cluster-dns=10.43.0.10 --cluster-domain=cluster.local --container-runtime-endpoint=unix:///run/k3s/containerd/containerd.sock --containerd=/run/k3s/containerd/containerd.sock --event-qps=0 --eviction-hard=imagefs.available<5%,nodefs.available<5% --eviction-minimum-reclaim=imagefs.available=10%,nodefs.available=10% --fail-swap-on=false --healthz-bind-address=127.0.0.1 --hostname-override=server-0 --kubeconfig=/var/lib/rancher/k3s/agent/kubelet.kubeconfig --make-iptables-util-chains=true --node-ip=10.10.10.100 --node-labels= --pod-infra-container-image=rancher/mirrored-pause:3.6 --pod-manifest-path=/var/lib/rancher/k3s/agent/pod-manifests --protect-kernel-defaults=true --read-only-port=0 --resolv-conf=/run/systemd/resolve/resolv.conf --serialize-image-pulls=false --streaming-connection-idle-timeout=5m --tls-cert-file=/var/lib/rancher/k3s/agent/serving-kubelet.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/agent/serving-kubelet.key"\n'})})]}),"\n",(0,n.jsxs)(s,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Remediation:"})}),(0,n.jsx)(r.p,{children:"By default, K3s automatically provides the TLS certificate and private key for the Kubelet.\nThey are generated and located at /var/lib/rancher/k3s/agent/serving-kubelet.crt and /var/lib/rancher/k3s/agent/serving-kubelet.key\nIf for some reason you need to provide your own certificate and key, you can set the\nthe below parameters in the K3s config file /etc/rancher/k3s/config.yaml."}),(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{children:'kubelet-arg:\n - "tls-cert-file=<path/to/tls-cert-file>"\n - "tls-private-key-file=<path/to/tls-private-key-file>"\n'})})]}),"\n",(0,n.jsx)(r.h3,{id:"4210-ensure-that-the---rotate-certificates-argument-is-not-set-to-false-automated",children:"4.2.10 Ensure that the --rotate-certificates argument is not set to false (Automated)"}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,n.jsx)(r.p,{children:(0,n.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s -u k3s-agent | grep 'Running kubelet' | tail -n1\n"})}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Expected Result:"})," '--rotate-certificates' is present OR '--rotate-certificates' is not present"]}),"\n",(0,n.jsxs)(s,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Returned Value:"})}),(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-log",children:'Aug 09 19:01:30 server-0 k3s[2354]: time="2024-08-09T19:01:30Z" level=info msg="Running kubelet --address=0.0.0.0 --allowed-unsafe-sysctls=net.ipv4.ip_forward,net.ipv6.conf.all.forwarding --anonymous-auth=false --authentication-token-webhook=true --authorization-mode=Webhook --cgroup-driver=systemd --client-ca-file=/var/lib/rancher/k3s/agent/client-ca.crt --cloud-provider=external --cluster-dns=10.43.0.10 --cluster-domain=cluster.local --container-runtime-endpoint=unix:///run/k3s/containerd/containerd.sock --containerd=/run/k3s/containerd/containerd.sock --event-qps=0 --eviction-hard=imagefs.available<5%,nodefs.available<5% --eviction-minimum-reclaim=imagefs.available=10%,nodefs.available=10% --fail-swap-on=false --healthz-bind-address=127.0.0.1 --hostname-override=server-0 --kubeconfig=/var/lib/rancher/k3s/agent/kubelet.kubeconfig --make-iptables-util-chains=true --node-ip=10.10.10.100 --node-labels= --pod-infra-container-image=rancher/mirrored-pause:3.6 --pod-manifest-path=/var/lib/rancher/k3s/agent/pod-manifests --protect-kernel-defaults=true --read-only-port=0 --resolv-conf=/run/systemd/resolve/resolv.conf --serialize-image-pulls=false --streaming-connection-idle-timeout=5m --tls-cert-file=/var/lib/rancher/k3s/agent/serving-kubelet.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/agent/serving-kubelet.key"\n'})})]}),"\n",(0,n.jsxs)(s,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Remediation:"})}),(0,n.jsxs)(r.p,{children:["By default, K3s does not set the --rotate-certificates argument. If you have set this flag with a value of ",(0,n.jsx)(r.code,{children:"false"}),", you should either set it to ",(0,n.jsx)(r.code,{children:"true"}),' or completely remove the flag.\nIf using the K3s config file /etc/rancher/k3s/config.yaml, remove any rotate-certificates parameter.\nIf using the command line, remove the K3s flag --kubelet-arg="rotate-certificates".\nBased on your system, restart the k3s service. For example,\nsystemctl restart k3s.service']})]}),"\n",(0,n.jsx)(r.h3,{id:"4211-verify-that-the-rotatekubeletservercertificate-argument-is-set-to-true-automated",children:"4.2.11 Verify that the RotateKubeletServerCertificate argument is set to true (Automated)"}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,n.jsx)(r.p,{children:(0,n.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s -u k3s-agent | grep 'Running kubelet' | tail -n1\n"})}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Expected Result:"})," 'RotateKubeletServerCertificate' is present OR 'RotateKubeletServerCertificate' is not present"]}),"\n",(0,n.jsxs)(s,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Returned Value:"})}),(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-log",children:'Aug 09 19:01:30 server-0 k3s[2354]: time="2024-08-09T19:01:30Z" level=info msg="Running kubelet --address=0.0.0.0 --allowed-unsafe-sysctls=net.ipv4.ip_forward,net.ipv6.conf.all.forwarding --anonymous-auth=false --authentication-token-webhook=true --authorization-mode=Webhook --cgroup-driver=systemd --client-ca-file=/var/lib/rancher/k3s/agent/client-ca.crt --cloud-provider=external --cluster-dns=10.43.0.10 --cluster-domain=cluster.local --container-runtime-endpoint=unix:///run/k3s/containerd/containerd.sock --containerd=/run/k3s/containerd/containerd.sock --event-qps=0 --eviction-hard=imagefs.available<5%,nodefs.available<5% --eviction-minimum-reclaim=imagefs.available=10%,nodefs.available=10% --fail-swap-on=false --healthz-bind-address=127.0.0.1 --hostname-override=server-0 --kubeconfig=/var/lib/rancher/k3s/agent/kubelet.kubeconfig --make-iptables-util-chains=true --node-ip=10.10.10.100 --node-labels= --pod-infra-container-image=rancher/mirrored-pause:3.6 --pod-manifest-path=/var/lib/rancher/k3s/agent/pod-manifests --protect-kernel-defaults=true --read-only-port=0 --resolv-conf=/run/systemd/resolve/resolv.conf --serialize-image-pulls=false --streaming-connection-idle-timeout=5m --tls-cert-file=/var/lib/rancher/k3s/agent/serving-kubelet.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/agent/serving-kubelet.key"\n'})})]}),"\n",(0,n.jsxs)(s,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Remediation:"})}),(0,n.jsx)(r.p,{children:'By default, K3s does not set the RotateKubeletServerCertificate feature gate.\nIf you have enabled this feature gate, you should remove it.\nIf using the K3s config file /etc/rancher/k3s/config.yaml, remove any feature-gate=RotateKubeletServerCertificate parameter.\nIf using the command line, remove the K3s flag --kubelet-arg="feature-gate=RotateKubeletServerCertificate".\nBased on your system, restart the k3s service. For example,\nsystemctl restart k3s.service'})]}),"\n",(0,n.jsx)(r.h3,{id:"4212-ensure-that-the-kubelet-only-makes-use-of-strong-cryptographic-ciphers-manual",children:"4.2.12 Ensure that the Kubelet only makes use of Strong Cryptographic Ciphers (Manual)"}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,n.jsx)(r.p,{children:(0,n.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s -u k3s-agent | grep 'Running kubelet' | tail -n1\n"})}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Expected Result:"})," '--tls-cipher-suites' contains valid elements from 'TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256'"]}),"\n",(0,n.jsxs)(s,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Returned Value:"})}),(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-log",children:'Aug 09 19:01:30 server-0 k3s[2354]: t
1ime="2024-08-09T19:01:30Z" level=info msg="Running kubelet --address=0.0.0.0 --allowed-unsafe-sysctls=net.ipv4.ip_forward,net.ipv6.conf.all.forwarding --anonymous-auth=false --authentication-token-webhook=true --authorization-mode=Webhook --cgroup-driver=systemd --client-ca-file=/var/lib/rancher/k3s/agent/client-ca.crt --cloud-provider=external --cluster-dns=10.43.0.10 --cluster-domain=cluster.local --container-runtime-endpoint=unix:///run/k3s/containerd/containerd.sock --containerd=/run/k3s/containerd/containerd.sock --event-qps=0 --eviction-hard=imagefs.available<5%,nodefs.available<5% --eviction-minimum-reclaim=imagefs.available=10%,nodefs.available=10% --fail-swap-on=false --healthz-bind-address=127.0.0.1 --hostname-override=server-0 --kubeconfig=/var/lib/rancher/k3s/agent/kubelet.kubeconfig --make-iptables-util-chains=true --node-ip=10.10.10.100 --node-labels= --pod-infra-container-image=rancher/mirrored-pause:3.6 --pod-manifest-path=/var/lib/rancher/k3s/agent/pod-manifests --protect-kernel-defaults=true --read-only-port=0 --resolv-conf=/run/systemd/resolve/resolv.conf --serialize-image-pulls=false --streaming-connection-idle-timeout=5m --tls-cert-file=/var/lib/rancher/k3s/agent/serving-kubelet.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/agent/serving-kubelet.key"\n'})})]}),"\n",(0,n.jsxs)(s,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Remediation:"})}),(0,n.jsxs)(r.p,{children:["If using a K3s config file /etc/rancher/k3s/config.yaml, edit the file to set ",(0,n.jsx)(r.code,{children:"TLSCipherSuites"})," to"]}),(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{children:'kubelet-arg:\n - "tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305"\n'})}),(0,n.jsx)(r.p,{children:'or to a subset of these values.\nIf using the command line, add the K3s flag --kubelet-arg="tls-cipher-suites=<same values as above>"\nBased on your system, restart the k3s service. For example,\nsystemctl restart k3s.service'})]}),"\n",(0,n.jsx)(r.h3,{id:"4213-ensure-that-a-limit-is-set-on-pod-pids-manual",children:"4.2.13 Ensure that a limit is set on pod PIDs (Manual)"}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Remediation:"}),"\nDecide on an appropriate level for this parameter and set it,\nIf using a K3s config file /etc/rancher/k3s/config.yaml, edit the file to set ",(0,n.jsx)(r.code,{children:"podPidsLimit"})," to"]}),"\n",(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{children:'kubelet-arg:\n - "pod-max-pids=<value>"\n'})}),"\n",(0,n.jsx)(r.h2,{id:"51-rbac-and-service-accounts",children:"5.
11 RBAC and Service Accounts"}),"\n",(0,n.jsx)(r.h3,{id:"511-ensure-that-the-cluster-admin-role-is-only-used-where-required-manual",children:"5.1.1 Ensure that the cluster-admin role is only used where required (Manual)"}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Remediation:"}),"\nIdentify all clusterrolebindings to the cluster-admin role. Check if they are used and\nif they need this role or if they could use a role with fewer privileges.\nWhere possible, first bind users to a lower privileged role and then remove the\nclusterrolebinding to the cluster-admin role :\nkubectl delete clusterrolebinding [name]"]}),"\n",(0,n.jsx)(r.h3,{id:"512-minimize-access-to-secrets-manual",children:"5.1.2 Minimize access to secrets (Manual)"}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Remediation:"}),"\nWhere possible, remove get, list and watch access to Secret objects in the cluster."]}),"\n",(0,n.jsx)(r.h3,{id:"513-minimize-wildcard-use-in-roles-and-clusterroles-manual",children:"5.
11.3 Minimize wildcard use in Roles and ClusterRoles (Manual)"}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Remediation:"}),"\nWhere possible replace any use of wildcards in clusterroles and roles with specific\nobjects or actions."]}),"\n",(0,n.jsx)(r.h3,{id:"514-minimize-access-to-create-pods-manual",children:"5.1.4 Minimize access to create pods (Manual)"}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Remediation:"}),"\nWhere possible, remove create access to pod objects in the cluster."]}),"\n",(0,n.jsx)(r.h3,{id:"515-ensure-that-default-service-accounts-are-not-actively-used-manual",children:"5.1.5 Ensure that default service accounts are not actively used. (Manual)"}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Remediation:"}),"\nCreate explicit service accounts wherever a Kubernetes workload requires specific access\nto the Kubernetes API server.\nModify the configuration of each default service account to include this value\nautomountServiceAccountToken: false"]}),"\n",(0,n.jsx)(r.h3,{id:"516-ensure-that-service-account-tokens-are-only-mounted-where-necessary-manual",children:"5.
11.6 Ensure that Service Account Tokens are only mounted where necessary (Manual)"}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Remediation:"}),"\nModify the definition of pods and service accounts which do not need to mount service\naccount tokens to disable it."]}),"\n",(0,n.jsxs)(r.h3,{id:"517-avoid-use-of-system-group-manual",children:["5.1.7 Avoid use of system",":masters"," group (Manual)"]}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Remediation:"}),"\nRemove the system",":masters"," group from all users in the cluster."]}),"\n",(0,n.jsx)(r.h3,{id:"518-limit-use-of-the-bind-impersonate-and-escalate-permissions-in-the-kubernetes-cluster-manual",children:"5.1.8 Limit use of the Bind, Impersonate and Escalate permissions in the Kubernetes cluster (Manual)"}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Remediation:"}),"\nWhere possible, remove the impersonate, bind and escalate rights from subjects."]}),"\n",(0,n.jsx)(r.h3,{id:"519-minimize-access-to-create-persistent-volumes-manual",children:"5.
11.9 Minimize access to create persistent volumes (Manual)"}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Remediation:"}),"\nWhere possible, remove create access to PersistentVolume objects in the cluster."]}),"\n",(0,n.jsx)(r.h3,{id:"5110-minimize-access-to-the-proxy-sub-resource-of-nodes-manual",children:"5.1.10 Minimize access to the proxy sub-resource of nodes (Manual)"}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Remediation:"}),"\nWhere possible, remove access to the proxy sub-resource of node objects."]}),"\n",(0,n.jsx)(r.h3,{id:"5111-minimize-access-to-the-approval-sub-resource-of-certificatesigningrequests-objects-manual",children:"5.1.11 Minimize access to the approval sub-resource of certificatesigningrequests objects (Manual)"}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Remediation:"}),"\nWhere possible, remove access to the approval sub-resource of certificatesigningrequest objects."]}),"\n",(0,n.jsx)(r.h3,{id:"5112-minimize-access-to-webhook-configuration-objects-manual",children:"5.
11.12 Minimize access to webhook configuration objects (Manual)"}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Remediation:"}),"\nWhere possible, remove access to the validatingwebhookconfigurations or mutatingwebhookconfigurations objects"]}),"\n",(0,n.jsx)(r.h3,{id:"5113-minimize-access-to-the-service-account-token-creation-manual",children:"5.1.13 Minimize access to the service account token creation (Manual)"}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Remediation:"}),"\nWhere possible, remove access to the token sub-resource of serviceaccount objects."]}),"\n",(0,n.jsx)(r.h2,{id:"52-pod-security-standards",children:"5.2 Pod Security Standards"}),"\n",(0,n.jsx)(r.h3,{id:"521-ensure-that-the-cluster-has-at-least-one-active-policy-control-mechanism-in-place-manual",children:"5.2.1 Ensure that the cluster has at least one active policy control mechanism in place (Manual)"}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Remediation:"}),"\nEnsure that either Pod Security Admission or an external policy control system is in place\nfor every namespace which contains user workloads."]}),"\n",(0,n.jsx)(r.h3,{id:"522-minimize-the-admission-of-privileged-containers-manual",children:"5.2.2 Minimize the admission of privileged containers (Manual)"}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Remediation:"}),"\nAdd policies to each namespace in the cluster which has user workloads to restrict the\nadmission of privileged containers."]}),"\n",(0,n.jsx)(r.h3,{id:"523-minimize-the-admission-of-containers-wishing-to-share-the-host-process-id-namespace-automated",children:"5.2.3 Minimize the admission of containers wishing to share the host process ID namespace (Automated)"}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Remediation:"}),"\nAdd policies to each namespace in the cluster which has user workloads to restrict the\nadmission of ",(0,n.jsx)(r.code,{children:"hostPID"})," containers."]}),"\n",(0,n.jsx)(r.h3,{id:"524-minimize-the-admission-of-containers-wishing-to-share-the-host-ipc-namespace-automated",children:"5.2.4 Minimize the admission of containers wishing to share the host IPC namespace (Automated)"}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Remediation:"}),"\nAdd policies to each namespace in the cluster which has user workloads to restrict the\nadmission of ",(0,n.jsx)(r.code,{children:"hostIPC"})," containers."]}),"\n",(0,n.jsx)(r.h3,{id:"525-minimize-the-admission-of-containers-wishing-to-share-the-host-network-namespace-automated",children:"5.2.5 Minimize the admission of containers wishing to share the host network namespace (Automated)"}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Remediation:"}),"\nAdd policies to each namespace in the cluster which has user workloads to restrict the\nadmission of ",(0,n.jsx)(r.code,{children:"hostNetwork"})," containers."]}),"\n",(0,n.jsx)(r.h3,{id:"526-minimize-the-admission-of-containers-with-allowprivilegeescalation-automated",children:"5.2.6 Minimize the admission of containers with allowPrivilegeEscalation (Automated)"}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Remediation:"}),"\nAdd policies to each namespace in the cluster which has user workloads to restrict the\nadmission of containers with ",(0,n.jsx)(r.code,{children:".spec.allowPrivilegeEscalation"})," set to ",(0,n.jsx)(r.code,{children:"true"}),"."]}),"\n",(0,n.jsx)(r.h3,{id:"527-minimize-the-admission-of-root-containers-automated",children:"5.2.7 Minimize the admission of root containers (Automated)"}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Remediation:"}),"\nCreate a policy for each namespace in the cluster, ensuring that either ",(0,n.jsx)(r.code,{children:"MustRunAsNonRoot"}),"\nor ",(0,n.jsx)(r.code,{children:"MustRunAs"})," with the range of UIDs not including 0, is set."]}),"\n",(0,n.jsx)(r.h3,{id:"528-minimize-the-admission-of-containers-with-the-net_raw-capability-automated",children:"5.2.8 Minimize the admission of containers with the NET_RAW capability (Automated)"}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Remediation:"}),"\nAdd policies to each namespace in the cluster which has user workloads to restrict the\nadmission of containers with the ",(0,n.jsx)(r.code,{children:"NET_RAW"})," capability."]}),"\n",(0,n.jsx)(r.h3,{id:"529-minimize-the-admission-of-containers-with-added-capabilities-automated",children:"5.2.9 Minimize the admission of containers with added capabilities (Automated)"}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Remediation:"}),"\nEnsure that ",(0,n.jsx)(r.code,{children:"allowedCapabilities"})," is not present in policies for the cluster unless\nit is set to an empty array."]}),"\n",(0,n.jsx)(r.h3,{id:"5210-minimize-the-admission-of-containers-with-capabilities-assigned-manual",children:"5.2.10 Minim
1ize the admission of containers with capabilities assigned (Manual)"}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Remediation:"}),"\nReview the use of capabilities in applications running on your cluster. Where a namespace\ncontains applications which do not require any Linux capabities to operate consider adding\na PSP which forbids the admission of containers which do not drop all capabilities."]}),"\n",(0,n.jsx)(r.h3,{id:"5211-minimize-the-admission-of-windows-hostprocess-containers-manual",children:"5.2.11 Minimize the admission of Windows HostProcess containers (Manual)"}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Remediation:"}),"\nAdd policies to each namespace in the cluster which has user workloads to restrict the\nadmission of containers that have ",(0,n.jsx)(r.code,{children:".securityContext.windowsOptions.hostProcess"})," set to ",(0,n.jsx)(r.code,{children:"true"}),"."]}),"\n",(0,n.jsx)(r.h3,{id:"5212-minimize-the-admission-of-hostpath-volumes-manual",children:"5.2.12 Minimize the admission of HostPath volumes (Manual)"}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Remediation:"}),"\nAdd policies to each namespace in the cluster which has user workloads to restrict the\nadmission of containers with ",(0,n.jsx)(r.code,{children:"hostPath"})," volumes."]}),"\n",(0,n.jsx)(r.h3,{id:"5213-minimize-the-admission-of-containers-which-use-hostports-manual",children:"5.2.13 Minimize the admission of containers which use HostPorts (Manual)"}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Remediation:"}),"\nAdd policies to each namespace in the cluster which has user workloads to restrict the\nadmission of containers which use ",(0,n.jsx)(r.code,{children:"hostPort"})," sections."]}),"\n",(0,n.jsx)(r.h2,{id:"53-network-policies-and-cni",children:"5.3 Network Policies and CNI"}),"\n",(0,n.jsx)(r.h3,{id:"531-ensure-that-the-cni-in-use-supports-networkpolicies-manual",children:"5.3.1 Ensure that the CNI in use supports NetworkPolicies (Manual)"}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Remediation:"}),"\nIf the CNI plugin in use does not support network policies, consideration should be given to\nmaking use of a different plugin, or finding an alternate mechanism for restricting traffic\nin the Kubernetes cluster."]}),"\n",(0,n.jsx)(r.h3,{id:"532-ensure-that-all-namespaces-have-networkpolicies-defined-manual",children:"5.3.2 Ensure that all Namespaces have NetworkPolicies defined (Manual)"}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Remediation:"}),"\nFollow the documentation and create NetworkPolicy objects as you need them."]}),"\n",(0,n.jsx)(r.h2,{id:"54-secrets-management",children:"5.4 Secrets Management"}),"\n",(0,n.jsx)(r.h3,{id:"541-prefer-using-secrets-as-files-over-secrets-as-environment-variables-manual",children:"5.4.1 Prefer using Secrets as files over Secrets as environment variables (Manual)"}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Remediation:"}),"\nIf possible, rewrite application code to read Secrets from mounted secret files, rather than\nfrom environment variables."]}),"\n",(0,n.jsx)(r.h3,{id:"542-consider-external-secret-storage-manual",children:"5.4.2 Consider external secret storage (Manual)"}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Remediation:"}),"\nRefer to the Secrets management options offered by your cloud provider or a third-party\nsecrets management solution."]}),"\n",(0,n.jsx)(r.h2,{id:"55-extensible-admission-control",children:"5.5 Extensible Admission Control"}),"\n",(0,n.jsx)(r.h3,{id:"551-configure-image-provenance-using-imagepolicywebhook-admission-controller-manual",children:"5.5.1 Configure Image Provenance using ImagePolicyWebhook admission controller (Manual)"}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Remediation:"}),"\nFollow the Kubernetes documentation and setup image provenance."]}),"\n",(0,n.jsx)(r.h2,{id:"57-general-policies",children:"5.7 General Policies"}),"\n",(0,n.jsx)(r.h3,{id:"571-create-administrative-boundaries-between-resources-using-namespaces-manual",children:"5.7.1 Create administrative boundaries between resources using namespaces (Manual)"}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Remediation:"}),"\nFollow the documentation and create namespaces for objects in your deployment as you need\nthem."]}),"\n",(0,n.jsx)(r.h3,{id:"572-ensure-that-the-seccomp-profile-is-set-to-dockerdefault-in-your-pod-definitions-manual",children:"5.7.2 Ensure that the seccomp profile is set to docker/default in your Pod definitions (Manual)"}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Remediation:"}),"\nUse ",(0,n.jsx)(r.code,{children:"securityContext"})," to enable the docker/default seccomp profile in your pod definitions.\nAn example is as below:\nsecurityContext:\nseccompProfile:\ntype: RuntimeDefault"]}),"\n",(0,n.jsx)(r.h3,{id:"573-apply-securitycontext-to-your-pods-and-containers-manual",children:"5.7.3 Apply SecurityContext to your Pods and Containers (Manual)"}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Remediation:"}),"\nFollow the Kubernetes documentation and apply SecurityContexts to your Pods. For a\nsuggested list of SecurityContexts, you may refer to the CIS Security Benchmark for Docker\nContainers."]}),"\n",(0,n.jsx)(r.h3,{id:"574-the-default-namespace-should-not-be-used-manual",children:"5.7.4 The default namespace should not be used (Manual)"}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Remediation:"}),"\nEnsure that namespaces are created to allow for appropriate segregation of Kubernetes\nresources and that all new resources are created in a specific namespace."]})]})}function u(e={}){const{wrapper:r}={...(0,i.R)(),...e.components};return r?(0,n.jsx)(r,{...e,children:(0,n.jsx)(d,{...e})}):d(e)}},28453:(e,r,s)=>{s.d(r,{R:()=>a,x:()=>l});var t=s(96540);const n={},i=t.createContext(n);function a(e){const r=t.useContext(i);return t.useMemo((function(){return"function"==typeof e?e(r):{...r,...e}}),[r,e])}function l(e){let r;return r=e.disableParentContext?"function"==typeof e.components?e.components(n):e.components||n:a(e.components),t.createElement(i.Provider,{value:r},e.children)}}}]);
Line numbers count LF bytes from the start of the resource, as the search results do. Vendor segments are library code the classifier recognised; they are stored but not indexed. Bytes are shown as Latin1 characters, one per byte.