1"use strict";(globalThis.webpackChunkrke_2_docs=globalThis.webpackChunkrke_2_docs||[]).push([[7287],{9734(e,r,t){t.r(r),t.d(r,{assets:()=>c,contentTitle:()=>l,default:()=>u,frontMatter:()=>a,metadata:()=>s,toc:()=>o});const s=JSON.parse('{"id":"security/cis_self_assessment112","title":"CIS 1.12 Self-Assessment Guide","description":"Overview","source":"@site/docs/security/cis_self_assessment112.md","sourceDirName":"security","slug":"/security/cis_self_assessment112","permalink":"/security/cis_self_assessment112","draft":false,"unlisted":false,"editUrl":"https://github.com/rancher/rke2-docs/edit/main/docs/security/cis_self_assessment112.md","tags":[],"version":"current","lastUpdatedAt":1789979055000,"frontMatter":{"title":"CIS 1.12 Self-Assessment Guide"},"sidebar":"mySidebar","previous":{"title":"CIS Hardening Guide","permalink":"/security/hardening_guide"},"next":{"title":"CIS 1.11 Self-Assessment Guide","permalink":"/security/cis_self_assessment111"}}');var n=t(4848),i=t(8453);const a={title:"CIS 1.12 Self-Assessment Guide"},l=void 0,c={},o=[{value:"Overview",id:"overview",level:2},{value:"Testing controls methodology",id:"testing-controls-methodology",level:3},{value:"1 Control Plane Security Configuration",id:"1-control-plane-security-configuration",level:2},{value:"1.1 Control Plane Node Configuration Files",id:"11-control-plane-node-configuration-files",level:3},{value:"1.1.1 Ensure that the API server pod specification file permissions are set to 600 or more restrictive (Automated)",id:"111-ensure-that-the-api-server-pod-specification-file-permissions-are-set-to-600-or-more-restrictive-automated",level:4},{value:"1.1.2 Ensure that the API server pod specification file ownership is set to root (Automated)",id:"112-ensure-that-the-api-server-pod-specification-file-ownership-is-set-to-root-automated",level:4},{value:"1.1.3 Ensure that the controller manager pod specification file permissions are set to 600 or more restrictive (Automated)",id:"113-ensure-that-the-controller-manager-pod-specification-file-permissions-are-set-to-600-or-more-restrictive-automated",level:4},{value:"1.1.4 Ensure that the controller manager pod specification file ownership is set to root (Automated)",id:"114-ensure-that-the-controller-manager-pod-specification-file-ownership-is-set-to-root-automated",level:4},{value:"1.1.5 Ensure that the scheduler pod specification file permissions are set to 600 or more restrictive (Automated)",id:"115-ensure-that-the-scheduler-pod-specification-file-permissions-are-set-to-600-or-more-restrictive-automated",level:4},{value:"1.1.6 Ensure that the scheduler pod specification file ownership is set to root (Automated)",id:"116-ensure-that-the-scheduler-pod-specification-file-ownership-is-set-to-root-automated",level:4},{value:"1.1.7 Ensure that the etcd pod specification file permissions are set to 600 or more restrictive (Manual)",id:"117-ensure-that-the-etcd-pod-specification-file-permissions-are-set-to-600-or-more-restrictive-manual",level:4},{value:"1.1.8 Ensure that the etcd pod specification file ownership is set to root (Manual)",id:"118-ensure-that-the-etcd-pod-specification-file-ownership-is-set-to-root-manual",level:4},{value:"1.1.9 Ensure that the Container Network Interface file permissions are set to 600 or more restrictive (Manual)",id:"119-ensure-that-the-container-network-interface-file-permissions-are-set-to-600-or-more-restrictive-manual",level:4},{value:"1.1.10 Ensure that the Container Network Interface file ownership is set to root (Manual)",id:"1110-ensure-that-the-container-network-interface-file-ownership-is-set-to-root-manual",level:4},{value:"1.1.11 Ensure that the etcd data directory permissions are set to 700 or more restrictive (Manual)",id:"1111-ensure-that-the-etcd-data-directory-permissions-are-set-to-700-or-more-restrictive-manual",level:4},{value:"1.1.12 Ensure that the etcd data directory ownership is set to etcd (Manual)",id:"1112-ensure-that-the-etcd-data-directory-ownership-is-set-to-etcd-manual",level:4},{value:"1.1.13 Ensure that the admin.conf file permissions are set to 600 or more restrictive (Automated)",id:"1113-ensure-that-the-adminconf-file-permissions-are-set-to-600-or-more-restrictive-automated",level:4},{value:"1.1.14 Ensure that the admin.conf file ownership is set to root (Automated)",id:"1114-ensure-that-the-adminconf-file-ownership-is-set-to-root-automated",level:4},{value:"1.1.15 Ensure that the scheduler.conf file permissions are set to 600 or more restrictive (Automated)",id:"1115-ensure-that-the-schedulerconf-file-permissions-are-set-to-600-or-more-restrictive-automated",level:4},{value:"1.1.16 Ensure that the scheduler.conf file ownership is set to root (Automated)",id:"1116-ensure-that-the-schedulerconf-file-ownership-is-set-to-root-automated",level:4},{value:"1.1.17 Ensure that the controller-manager.conf file permissions are set to 600 or more restrictive (Automated)",id:"1117-ensure-that-the-controller-managerconf-file-permissions-are-set-to-600-or-more-restrictive-automated",level:4},{value:"1.1.18 Ensure that the controller-manager.conf file ownership is set to root (Automated)",id:"1118-ensure-that-the-controller-managerconf-file-ownership-is-set-to-root-automated",level:4},{value:"1.1.19 Ensure that the Kubernetes PKI directory and file ownership is set to root (Automated)",id:"1119-ensure-that-the-kubernetes-pki-directory-and-file-ownership-is-set-to-root-automated",level:4},{value:"1.1.20 Ensure that the Kubernetes PKI certificate file permissions are set to 644 or more restrictive (Automated)",id:"1120-ensure-that-the-kubernetes-pki-certificate-file-permissions-are-set-to-644-or-more-restrictive-automated",level:4},{value:"1.1.21 Ensure that the Kubernetes PKI key file permissions are set to 600 (Automated)",id:"1121-ensure-that-the-kubernetes-pki-key-file-permissions-are-set-to-600-automated",level:4},{value:"1.2 API Server",id:"12-api-server",level:3},{value:"1.2.1 Ensure that the --anonymous-auth argument is set to false (Automated)",id:"121-ensure-that-the---anonymous-auth-argument-is-set-to-false-automated",level:4},{value:"1.2.2 Ensure that the --token-auth-file parameter is not set (Automated)",id:"122-ensure-that-the---token-auth-file-parameter-is-not-set-automated",level:4}
1,{value:"1.2.3 Ensure that the --DenyServiceExternalIPs is set (Manual)",id:"123-ensure-that-the---denyserviceexternalips-is-set-manual",level:4},{value:"1.2.4 Ensure that the --kubelet-client-certificate and --kubelet-client-key arguments are set as appropriate (Automated)",id:"124-ensure-that-the---kubelet-client-certificate-and---kubelet-client-key-arguments-are-set-as-appropriate-automated",level:4},{value:"1.2.5 Ensure that the --kubelet-certificate-authority argument is set as appropriate (Automated)",id:"125-ensure-that-the---kubelet-certificate-authority-argument-is-set-as-appropriate-automated",level:4},{value:"1.2.6 Ensure that the --authorization-mode argument is not set to AlwaysAllow (Automated)",id:"126-ensure-that-the---authorization-mode-argument-is-not-set-to-alwaysallow-automated",level:4},{value:"1.2.7 Ensure that the --authorization-mode argument includes Node (Automated)",id:"127-ensure-that-the---authorization-mode-argument-includes-node-automated",level:4},{value:"1.2.8 Ensure that the --authorization-mode argument includes RBAC (Automated)",id:"128-ensure-that-the---authorization-mode-argument-includes-rbac-automated",level:4},{value:"1.2.9 Ensure that the admission control plugin EventRateLimit is set (Manual)",id:"129-ensure-that-the-admission-control-plugin-eventratelimit-is-set-manual",level:4},{value:"1.2.10 Ensure that the admission control plugin AlwaysAdmit is not set (Automated)",id:"1210-ensure-that-the-admission-control-plugin-alwaysadmit-is-not-set-automated",level:4},{value:"1.2.11 Ensure that the admission control plugin AlwaysPullImages is set (Manual)",id:"1211-ensure-that-the-admission-control-plugin-alwayspullimages-is-set-manual",level:4},{value:"1.2.12 Ensure that the admission control plugin ServiceAccount is set (Automated)",id:"1212-ensure-that-the-admission-control-plugin-serviceaccount-is-set-automated",level:4},{value:"1.2.13 Ensure that the admission control plugin NamespaceLifecycle is set (Automated)",id:"1213-ensure-that-the-admission-control-plugin-namespacelifecycle-is-set-automated",level:4},{value:"1.2.14 Ensure that the admission control plugin NodeRestriction is set (Automated)",id:"1214-ensure-that-the-admission-control-plugin-noderestriction-is-set-automated",level:4},{value:"1.2.15 Ensure that the --profiling argument is set to false (Automated)",id:"1215-ensure-that-the---profiling-argument-is-set-to-false-automated",level:4},{value:"1.2.16 Ensure that the --audit-log-path argument is set (Automated)",id:"1216-ensure-that-the---audit-log-path-argument-is-set-automated",level:4},{value:"1.2.17 Ensure that the --audit-log-maxage argument is set to 30 or as appropriate (Automated)",id:"1217-ensure-that-the---audit-log-maxage-argument-is-set-to-30-or-as-appropriate-automated",level:4},{value:"1.2.18 Ensure that the --audit-log-maxbackup argument is set to 10 or as appropriate (Automated)",id:"1218-ensure-that-the---audit-log-maxbackup-argument-is-set-to-10-or-as-appropriate-automated",level:4},{value:"1.2.19 Ensure that the --audit-log-maxsize argument is set to 100 or as appropriate (Automated)",id:"1219-ensure-that-the---audit-log-maxsize-argument-is-set-to-100-or-as-appropriate-automated",level:4},{value:"1.2.20 Ensure that the --request-timeout argument is set as appropriate (Automated)",id:"1220-ensure-that-the---request-timeout-argument-is-set-as-appropriate-automated",level:4},{value:"1.2.21 Ensure that the --service-account-lookup argument is set to true (Automated)",id:"1221-ensure-that-the---service-account-lookup-argument-is-set-to-true-automated",level:4},{value:"1.2.22 Ensure that the --service-account-key-file argument is set as appropriate (Automated)",id:"1222-ensure-that-the---service-account-key-file-argument-is-set-as-appropriate-automated",level:4},{value:"1.2.23 Ensure that the --etcd-certfile and --etcd-keyfile arguments are set as appropriate (Automated)",id:"1223-ensure-that-the---etcd-certfile-and---etcd-keyfile-arguments-are-set-as-appropriate-automated",level:4},{value:"1.2.24 Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate (Automated)",id:"1224-ensure-that-the---tls-cert-file-and---tls-private-key-file-arguments-are-set-as-appropriate-automated",level:4},{value:"1.2.25 Ensure that the --client-ca-file argument is set as appropriate (Automated)",id:"1225-ensure-that-the---client-ca-file-argument-is-set-as-appropriate-automated",level:4},{value:"1.2.26 Ensure that the --etcd-cafile argument is set as appropriate (Automated)",id:"1226-ensure-that-the---etcd-cafile-argument-is-set-as-appropriate-automated",level:4},{value:"1.2.27 Ensure that the --encryption-provider-config argument is set as appropriate (Automated)",id:"1227-ensure-that-the---e
1ncryption-provider-config-argument-is-set-as-appropriate-automated",level:4},{value:"1.2.28 Ensure that encryption providers are appropriately configured (Automated)",id:"1228-ensure-that-encryption-providers-are-appropriately-configured-automated",level:4},{value:"1.2.29 Ensure that the API Server only makes use of Strong Cryptographic Ciphers (Automated)",id:"1229-ensure-that-the-api-server-only-makes-use-of-strong-cryptographic-ciphers-automated",level:4},{value:"1.2.30 Ensure that the --service-account-extend-token-expiration parameter is set to false (Automated)",id:"1230-ensure-that-the---service-account-extend-token-expiration-parameter-is-set-to-false-automated",level:4},{value:"1.3 Controller Manager",id:"13-controller-manager",level:3},{value:"1.3.1 Ensure that the --terminated-pod-gc-threshold argument is set as appropriate (Manual)",id:"131-ensure-that-the---terminated-pod-gc-threshold-argument-is-set-as-appropriate-manual",level:4},{value:"1.3.2 Ensure that the --profiling argument is set to false (Automated)",id:"132-ensure-that-the---profiling-argument-is-set-to-false-automated",level:4},{value:"1.3.3 Ensure that the --use-service-account-credentials argument is set to true (Automated)",id:"133-ensure-that-the---use-service-account-credentials-argument-is-set-to-true-automated",level:4},{value:"1.3.4 Ensure that the --service-account-private-key-file argument is set as appropriate (Automated)",id:"134-ensure-that-the---service-account-private-key-file-argument-is-set-as-appropriate-automated",level:4},{value:"1.3.5 Ensure that the --root-ca-file argument is set as appropriate (Automated)",id:"135-ensure-that-the---root-ca-file-argument-is-set-as-appropriate-automated",level:4},{value:"1.3.6 Ensure that the RotateKubeletServerCertificate argument is set to true (Automated)",id:"136-ensure-that-the-rotatekubeletservercertificate-argument-is-set-to-true-automated",level:4},{value:"1.3.7 Ensure that the --bind-address argument is set to 127.0.0.1 (Automated)",id:"137-ensure-that-the---bind-address-argument-is-set-to-127001-automated",level:4},{value:"1.4 Scheduler",id:"14-scheduler",level:3},{value:"1.4.1 Ensure that the --profiling argument is set to false (Automated)",id:"141-ensure-that-the---profiling-argument-is-set-to-false-automated",level:4},{value:"1.4.2 Ensure that the --bind-address argument is set to 127.0.0.1 (Automated)",id:"142-ensure-that-the---bind-address-argument-is-set-to-127001-automated",level:4},{value:"2 Etcd Node Configuration",id:"2-etcd-node-configuration",level:2},{value:"2 Etcd Node Configuration",id:"2-etcd-node-configuration-1",level:3},{value:"2.1 Ensure that the --cert-file and --key-file arguments are set as appropriate (Automated)",id:"21-ensure-that-the---cert-file-and---key-file-arguments-are-set-as-appropriate-automated",level:4},{value:"2.2 Ensure that the --client-cert-auth argument is set to true (Automated)",id:"22-ensure-that-the---client-cert-auth-argument-is-set-to-true-automated",level:4},{value:"2.3 Ensure that the --auto-tls argument is not set to true (Automated)",id:"23-ensure-that-the---auto-tls-argument-is-not-set-to-true-automated",level:4},{value:"2.4 Ensure that the --peer-cert-file and --peer-key-file arguments are set as appropriate (Automated)",id:"24-ensure-that-the---peer-cert-file-and---peer-key-file-arguments-are-set-as-appropriate-automated",level:4},{value:"2.5 Ensure that the --peer-client-cert-auth argument is set to true (Automated)",id:"25-ensure-that-the---peer-client-cert-auth-argument-is-set-to-true-automated",level:4},{value:"2.6 Ensure that the --peer-auto-tls argument is not set to true (Automated)",id:"26-ensure-that-the---peer-auto-tls-argument-is-not-set-to-true-automated",level:4},{value:"2.7 Ensure that a unique Certificate Authority is used for etcd (Automated)",id:"27-ensure-that-a-unique-certificate-authority-is-used-for-etcd-automated",level:4},{value:"3 Control Plane Configuration",id:"3-control-plane-configuration",level:2},{value:"3.1 Authentication and Authorization",id:"31-authentication-and-authorization",level:3},{value:"3.1.1 Client certificate authentication should not be used for users (Manual)",id:"311-client-certificate-authentication-should-not-be-used-for-users-manual",level:4},{value:"3.1.2 Service account token authentication should not be used for users (Manual)",id:"312-service-account-token-authentication-should-not-be-used-for-users-manual",level:4},{value:"3.1.3 Bootstrap token authentication should not be used for users (Manual)",id:"313-bootstrap-token-authentication-should-not-be-used-for-users-manual",level:4},{value:"3.2 Logging",id:"32-logging",level:3},{value:"3.2.1 Ensure that a minimal audit policy is created (Automated)",id:"321-ensure-that-a-minimal-audit-policy-is-created-automated",level:4},{value:"3.2.2 Ensure that the audit policy covers key security concerns (Manual)",id:"322-ensure-that-the-audit-policy-covers-key-security-concerns-manual",level:4},{value:"4 Worker Node Security Configuration",id:"4-worker-node
1-security-configuration",level:2},{value:"4.1 Worker Node Configuration Files",id:"41-worker-node-configuration-files",level:3},{value:"4.1.1 Ensure that the kubelet service file permissions are set to 600 or more restrictive (Automated)",id:"411-ensure-that-the-kubelet-service-file-permissions-are-set-to-600-or-more-restrictive-automated",level:4},{value:"4.1.2 Ensure that the kubelet service file ownership is set to root (Automated)",id:"412-ensure-that-the-kubelet-service-file-ownership-is-set-to-root-automated",level:4},{value:"4.1.3 If proxy kubeconfig file exists ensure permissions are set to 600 or more restrictive (Automated)",id:"413-if-proxy-kubeconfig-file-exists-ensure-permissions-are-set-to-600-or-more-restrictive-automated",level:4},{value:"4.1.4 If proxy kubeconfig file exists ensure ownership is set to root (Automated)",id:"414-if-proxy-kubeconfig-file-exists-ensure-ownership-is-set-to-root-automated",level:4},{value:"4.1.5 Ensure that the --kubeconfig kubelet.conf file permissions are set to 600 or more restrictive (Automated)",id:"415-ensure-that-the---kubeconfig-kubeletconf-file-permissions-are-set-to-600-or-more-restrictive-automated",level:4},{value:"4.1.6 Ensure that the --kubeconfig kubelet.conf file ownership is set to root (Automated)",id:"416-ensure-that-the---kubeconfig-kubeletconf-file-ownership-is-set-to-root-automated",level:4},{value:"4.1.7 Ensure that the certificate authorities file permissions are set to 600 or more restrictive (Automated)",id:"417-ensure-that-the-certificate-authorities-file-permissions-are-set-to-600-or-more-restrictive-automated",level:4},{value:"4.1.8 Ensure that the client certificate authorities file ownership is set to root (Automated)",id:"418-ensure-that-the-client-certificate-authorities-file-ownership-is-set-to-root-automated",level:4},{value:"4.1.9 If the kubelet config.yaml configuration file is being used validate permissions set to 600 or more restrictive (Automated)",id:"419-if-the-kubelet-configyaml-configuration-file-is-being-used-validate-permissions-set-to-600-or-more-restrictive-automated",level:4},{value:"4.1.10 If the kubelet config.yaml configuration file is being used validate file ownership is set to root (Automated)",id:"4110-if-the-kubelet-configyaml-configuration-file-is-being-used-validate-file-ownership-is-set-to-root-automated",level:4},{value:"4.2 Kubelet",id:"42-kubelet",level:3},{value:"4.2.1 Ensure that the --anonymous-auth argument is set to false (Automated)",id:"421-ensure-that-the---anonymous-auth-argument-is-set-to-false-automated",level:4},{value:"4.2.2 Ensure that the --authorization-mode argument is not set to AlwaysAllow (Automated)",id:"422-ensure-that-the---authorization-mode-argument-is-not-set-to-alwaysallow-automated",level:4},{value:"4.2.3 Ensure that the --client-ca-file argument is set as appropriate (Automated)",id:"423-ensure-that-the---client-ca-file-argument-is-set-as-appropriate-automated",level:4},{value:"4.2.4 Verify that if defined, the --read-only-port argument is set to 0 (Automated)",id:"424-verify-that-if-defined-the---read-only-port-argument-is-set-to-0-automated",level:4},{value:"4.2.5 Ensure that the --streaming-connection-idle-timeout argument is not set to 0 (Manual)",id:"425-ensure-that-the---streaming-connection-idle-timeout-argument-is-not-set-to-0-manual",level:4},{value:"4.2.6 Ensure that the --make-iptables-util-chains argument is set to true (Automated)",id:"426-ensure-that-the---make-iptables-util-chains-argument-is-set-to-true-automated",level:4},{value:"4.2.7 Ensure that the --hostname-override argument is not set (Automated)",id:"427-ensure-that-the---hostname-override-argument-is-not-set-automated",level:4},{value:"4.2.8 Ensure that the eventRecordQPS argument is set to a level which ensures appropriate event capture (Manual)",id:"428-ensure-that-the-eventrecordqps-argument-is-set-to-a-level-which-ensures-appropriate-event-capture-manual",level:4},{value:"4.2.9 Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate (Automated)",id:"429-ensure-that-the---tls-cert-file-and---tls-private-key-file-arguments-are-set-as-appropriate-automated",level:4},{value:"4.2.10 Ensure that the --rotate-certificates argument is not set to false (Automated)",id:"4210-ensure-that-the---rotate-certificates-argument-is-not-set-to-false-automated",level:4},{value:"4.2.11 Verify that the RotateKubeletServerCertificate argument is set to true (Automated)",id:"4211-verify-that-the-rotatekubeletservercertificate-argument-is-set-to-true-automated",level:4},{value:"4.2.12 Ensure that the Kubelet only makes use of Strong Cryptographic Ciphers (Manual)",id:"4212-ensure-that-the-kubelet-only-makes-use-of-strong-cryptographic-ciphers-manual",level:4},{value:"4.2.13 Ensure that a limit is set on pod PIDs (Manual)",id:"4213-ensure-that-a-limit-is-set-on-pod-pids-manual",level:4},{value:"4.2.14 Ensure that the --seccomp-default parameter is set to true (Manual)",id:"4214-ensure-that-the---seccomp-default-parameter-is-set-to-true-manual",level:4},{value:"4.3 kube-proxy",id:"43-kube-proxy",level:3},{value:"4.3.1 Ensure that the kube-proxy metrics service is bound to localhost (Automated)",id:"431-ensure-that-the-kube-proxy-metrics-service-is-bound-to-localhost-automated",level:4},{value:"5 Kubernetes Policies",id:"5-kubernetes-policies",level:2},{value:"5.1 RBAC and Service Accounts",id:"51-rbac-and-service-accounts",level:3},{value:"5.1.1 Ensure that the cluster-admin role is only used where required (Manual)",id:"511-ensure-that-the-cluster-admin-role-is-only-used-where-required-manual",level:4},{value:"5.1.2 Minimize access to secrets (Manual)",id:"512-minimize-access-to-secrets-manual",level:4},{value:"5.1.3 Minimize wildcard use in Roles and ClusterRoles (Manual)",id:"513-minimize-wildcard-use-in-roles-and-clusterroles-manual",level:4},{value:"5.1.4 Minimize access to create pods (Manual)",id:"514-minimize-access-to-create-pods-manual",level:4},{value:"5.1.5 Ensure that default service accounts are not actively used. (Manual)",id:"515-ensure-that-default-service-accounts-are-not-actively-used-manual",level:4},{value:"5.1.6 Ensure that Service Account Tokens are only mounted where necessary (Manual)",id:"516-ensure-that-service-account-tokens-are-only-mounted-where-necessary-manual",level:4},{value:"5.1.7 Avoid use of system group (Manual)",id:"517-avoid-use-of-system-group-manual",level:4},{value:"5.1.8 Limit use of the Bind, Impersonate and Escalate permissions in the Kubernetes cluster (Manual)",id:"518-limit-use-of-the-bind-impersonate-and-escalate-permissions-in-the-kubernetes-cluster-manual",level:4},{value:"5.1.9 Minimize access to create persistent volumes (Manual)",id:"519-minimize-access-to-create-persistent-volumes-manual",level:4}
1,{value:"5.1.10 Minimize access to the proxy sub-resource of nodes (Manual)",id:"5110-minimize-access-to-the-proxy-sub-resource-of-nodes-manual",level:4},{value:"5.1.11 Minimize access to the approval sub-resource of certificatesigningrequests objects (Manual)",id:"5111-minimize-access-to-the-approval-sub-resource-of-certificatesigningrequests-objects-manual",level:4},{value:"5.1.12 Minimize access to webhook configuration objects (Manual)",id:"5112-minimize-access-to-webhook-configuration-objects-manual",level:4},{value:"5.1.13 Minimize access to the service account token creation (Manual)",id:"5113-minimize-access-to-the-service-account-token-creation-manual",level:4},{value:"5.2 Pod Security Standards",id:"52-pod-security-standards",level:3},{value:"5.2.1 Ensure that the cluster has at least one active policy control mechanism in place (Manual)",id:"521-ensure-that-the-cluster-has-at-least-one-active-policy-control-mechanism-in-place-manual",level:4},{value:"5.2.2 Minimize the admission of privileged containers (Manual)",id:"522-minimize-the-admission-of-privileged-containers-manual",level:4},{value:"5.2.3 Minimize the admission of containers wishing to share the host process ID namespace (Manual)",id:"523-minimize-the-admission-of-containers-wishing-to-share-the-host-process-id-namespace-manual",level:4},{value:"5.2.4 Minimize the admission of containers wishing to share the host IPC namespace (Manual)",id:"524-minimize-the-admission-of-containers-wishing-to-share-the-host-ipc-namespace-manual",level:4},{value:"5.2.5 Minimize the admission of containers wishing to share the host network namespace (Manual)",id:"525-minimize-the-admission-of-containers-wishing-to-share-the-host-network-namespace-manual",level:4},{value:"5.2.6 Minimize the admission of containers with allowPrivilegeEscalation (Manual)",id:"526-minimize-the-admission-of-containers-with-allowprivilegeescalation-manual",level:4},{value:"5.2.7 Minimize the admission of root containers (Manual)",id:"527-minimize-the-admission-of-root-containers-manual",level:4},{value:"5.2.8 Minimize the admission of containers with the NET_RAW capability (Manual)",id:"528-minimize-the-admission-of-containers-with-the-net_raw-capability-manual",level:4},{value:"5.2.9 Minimize the admission of containers with capabilities assigned (Manual)",id:"529-minimize-the-admission-of-containers-with-capabilities-assigned-manual",level:4},{value:"5.2.10 Minimize the admission of Windows HostProcess containers (Manual)",id:"5210-minimize-the-admission-of-windows-hostprocess-containers-manual",level:4}
1,{value:"5.2.11 Minimize the admission of HostPath volumes (Manual)",id:"5211-minimize-the-admission-of-hostpath-volumes-manual",level:4},{value:"5.2.12 Minimize the admission of containers which use HostPorts (Manual)",id:"5212-minimize-the-admission-of-containers-which-use-hostports-manual",level:4},{value:"5.3 Network Policies and CNI",id:"53-network-policies-and-cni",level:3},{value:"5.3.1 Ensure that the CNI in use supports NetworkPolicies (Manual)",id:"531-ensure-that-the-cni-in-use-supports-networkpolicies-manual",level:4},{value:"5.3.2 Ensure that all Namespaces have NetworkPolicies defined (Manual)",id:"532-ensure-that-all-namespaces-have-networkpolicies-defined-manual",level:4},{value:"5.4 Secrets Management",id:"54-secrets-management",level:3},{value:"5.4.1 Prefer using Secrets as files over Secrets as environment variables (Manual)",id:"541-prefer-using-secrets-as-files-over-secrets-as-environment-variables-manual",level:4},{value:"5.4.2 Consider external secret storage (Manual)",id:"542-consider-external-secret-storage-manual",level:4},{value:"5.5 Extensible Admission Control",id:"55-extensible-admission-control",level:3},{value:"5.5.1 Configure Image Provenance using ImagePolicyWebhook admission controller (Manual)",id:"551-configure-image-provenance-using-imagepolicywebhook-admission-controller-manual",level:4},{value:"5.6 General Policies",id:"56-general-policies",level:3},{value:"5.6.1 Create administrative boundaries between resources using namespaces (Manual)",id:"561-create-administrative-boundaries-between-resources-using-namespaces-manual",level:4},{value:"5.6.2 Ensure that the seccomp profile is set to docker/default in your Pod definitions (Manual)",id:"562-ensure-that-the-seccomp-profile-is-set-to-dockerdefault-in-your-pod-definitions-manual",level:4},{value:"5.6.3 Apply SecurityContext to your Pods and Containers (Manual)",id:"563-apply-securitycontext-to-your-pods-and-containers-manual",level:4},{value:"5.6.4 The default namespace should not be used (Manual)",id:"564-the-default-namespace-should-not-be-used-manual",level:4}];function d(e){const r={a:"a",code:"code",h2:"h2",h3:"h3",h4:"h4",li:"li",p:"p",pre:"pre",strong:"strong",ul:"ul",...(0,i.R)(),...e.components},{Details:t}=r;return t||function(e,r){throw new Error("Expected "+(r?"component":"object")+" `"+e+"` to be defined: you likely forgot to import, pass, or provide it.")}("Details",!0),(0,n.jsxs)(n.Fragment,{children:[(0,n.jsx)(r.h2,{id:"overview",children:"Overview"}),"\n",(0,n.jsx)(r.p,{children:"This document is a companion to the RKE2 security hardening guide. The hardening guide provides prescriptive guidance for hardening a production installation of RKE2, and this benchmark guide is meant to help you evaluate the level of security of the hardened cluster against each control in the CIS Kubernetes benchmark. It is to be used by RKE2 operators, security teams, auditors, and decision makers."}),"\n",(0,n.jsxs)(r.p,{children:["This guide is specific to the ",(0,n.jsx)(r.strong,{children:"v1.33-1.36"})," release line of RKE2 and the ",(0,n.jsx)(r.strong,{children:"v1.12"})," release of the CIS Kubernetes Benchmark."]}),"\n",(0,n.jsxs)(r.p,{children:["For more information about each control, including detailed rationales and descriptions checks, you can refer to the corresponding section of the CIS Kubernetes Benchmark v1.8. You can download the benchmark, after creating a free account, in ",(0,n.jsx)(r.a,{href:"https://www.cisecurity.org/benchmark/kubernetes/",children:"Center for Internet Security (CIS)"}),"."]}),"\n",(0,n.jsx)(r.h3,{id:"testing-controls-methodology",children:"Testing controls methodology"}),"\n",(0,n.jsx)(r.p,{children:"Each control in the CIS Kubernetes Benchmark was evaluated against a RKE2 cluster that was configured according to the accompanying hardening guide."}),"\n",(0,n.jsx)(r.p,{children:"These are the possible results for each control:"}),"\n",(0,n.jsxs)(r.ul,{children:["\n",(0,n.jsxs)(r.li,{children:[(0,n.jsx)(r.strong,{children:"PASS"})," - The control is automated (scored: true). The RKE2 cluster under test passed the audit outlined in the benchmark."]}),"\n",(0,n.jsxs)(r.li,{children:[(0,n.jsx)(r.strong,{children:"Not Applicable"})," - The control is not applicable (type: skip) to RKE2 because of how it is designed to operate. The rationale section will explain why this is so."]}),"\n",(0,n.jsxs)(r.li,{children:[(0,n.jsx)(r.strong,{children:"WARN"})," - The control is manual (scored: false) in the CIS benchmark and depends on the manual operator intervention. The remediation section will provide guidance on how to achieve a PASS result."]}),"\n"]}),"\n",(0,n.jsx)(r.h2,{id:"1-control-plane-security-configuration",children:"1 Control Plane Security Configuration"}),"\n",(0,n.jsx)(r.h3,{id:"11-control-plane-node-configuration-files",children:"1.1 Control Plane Node Configuration Files"}),"\n",(0,n.jsx)(r.h4,{id:"111-ensure-that-the-api-server-pod-specification-file-permissions-are-set-to-600-or-more-restrictive-automated",children:"1.1.1 Ensure that the API server pod specification file permissions are set to 600 or more restrictive (Automated)"}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,n.jsx)(r.p,{children:(0,n.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-bash",children:"stat -c permissions=%a /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml\n"})}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Expected Result:"})," permissions has permissions 600, expected 600 or more restrictive"]}),"\n",(0,n.jsxs)(t,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Returned Value:"})}),(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-console",children:"permissions=600\n"})})]}),"\n",(0,n.jsxs)(t,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Remediation:"})}),(0,n.jsxs)(r.p,{children:["Run the below command (based on the file location on your system) on the\ncontrol plane node.\nFor example, ",(0,n.jsx)(r.code,{children:"chmod 600 /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml"})]})]}),"\n",(0,n.jsxs)(r.h4,{id:"112-ensure-that-the-api-server-pod-specification-file-ownership-is-set-to-root-automated",children:["1.1.2 Ensure that the API server pod specification file ownership is set to root",":root"," (Automated)"]}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,n.jsx)(r.p,{children:(0,n.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-bash",children:"/bin/sh -c 'if test -e /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml; then stat -c %U:%G /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml; fi'\n"})}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Expected Result:"})," 'root",":root","' is equal to 'root",":root","'"]}),"\n",(0,n.jsxs)(t,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Returned Value:"})}),(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-console",children:"root:root\n"})})]}),"\n",(0,n.jsxs)(t,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Remediation:"})}),(0,n.jsxs)(r.p,{children:["Run the below command (based on the file location on your system) on the control plane node.\nFor example, ",(0,n.jsx)(r.code,{children:"chown root:root /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml"})]})]}),"\n",(0,n.jsx)(r.h4,{id:"113-ensure-that-the-controller-manager-pod-specification-file-permissions-are-set-to-600-or-more-restrictive-automated",children:"1.1.3 Ensure that the controller manager pod specification file permissions are set to 600 or more restrictive (Automated)"}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,n.jsx)(r.p,{children:(0,n.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-bash",children:"/bin/sh -c 'if test -e /var/lib/rancher/rke2/agent/pod-manifests/kube-controller-manager.yaml; then stat -c permissions=%a /var/lib/rancher/rke2/agent/pod-manifests/kube-controller-manager.yaml; fi'\n"})}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Expected Result:"})," permissions has permissions 600, expected 600 or more restrictive"]}),"\n",(0,n.jsxs)(t,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Returned Value:"})}),(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-console",children:"permissions=600\n"})})]}),"\n",(0,n.jsxs)(t,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Remediation:"})}),(0,n.jsxs)(r.p,{children:["Run the below command (based on the file location on your system) on the control plane node.\nFor example, ",(0,n.jsx)(r.code,{children:"chmod 600 /var/lib/rancher/rke2/agent/pod-manifests/kube-controller-manager.yaml"})]})]}),"\n",(0,n.jsxs)(r.h4,{id:"114-ensure-that-the-controller-manager-pod-specification-file-ownership-is-set-to-root-automated",children:["1.1.4 Ensure that the controller manager pod specification file ownership is set to root",":root"," (Automated)"]}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,n.jsx)(r.p,{children:(0,n.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-bash",children:"/bin/sh -c 'if test -e /var/lib/rancher/rke2/agent/pod-manifests/kube-controller-manager.yaml; then stat -c %U:%G /var/lib/rancher/rke2/agent/pod-manifests/kube-controller-manager.yaml; fi'\n"})}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Expected Result:"})," 'root",":root","' is equal to 'root",":root","'"]}),"\n",(0,n.jsxs)(t,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Returned Value:"})}),(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-console",children:"root:root\n"})})]}),"\n",(0,n.jsxs)(t,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Remediation:"})}),(0,n.jsxs)(r.p,{children:["Run the below command (based on the file location on your system) on the control plane node.\nFor example, ",(0,n.jsx)(r.code,{children:"chown root:root /var/lib/rancher/rke2/agent/pod-manifests/kube-controller-manager.yaml"})]})]}),"\n",(0,n.jsx)(r.h4,{id:"115-ensure-that-the-scheduler-pod-specification-file-permissions-are-set-to-600-or-more-restrictive-automated",children:"1.1.5 Ensure that the scheduler pod specification file permissions are set to 600 or more restrictive (Automated)"}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,n.jsx)(r.p,{children:(0,n.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-bash",children:"/bin/sh -c 'if test -e /var/lib/rancher/rke2/agent/pod-manifests/kube-scheduler.yaml; then stat -c permissions=%a /var/lib/rancher/rke2/agent/pod-manifests/kube-scheduler.yaml; fi'\n"})}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Expected Result:"})," permissions has permissions 600, expected 600 or more restrictive"]}),"\n",(0,n.jsxs)(t,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Returned Value:"})}),(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-console",children:"permissions=600\n"})})]}),"\n",(0,n.jsxs)(t,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Remediation:"})}),(0,n.jsxs)(r.p,{children:["Run the below command (based on the file location on your system) on the control plane node.\nFor example, ",(0,n.jsx)(r.code,{children:"chmod 600 /var/lib/rancher/rke2/agent/pod-manifests/kube-scheduler.yaml"})]})]}),"\n",(0,n.jsxs)(r.h4,{id:"116-ensure-that-the-scheduler-pod-specification-file-ownership-is-set-to-root-automated",children:["1.1.6 Ensure that the scheduler pod specification file ownership is set to root",":root"," (Automated)"]}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,n.jsx)(r.p,{children:(0,n.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-bash",children:"/bin/sh -c 'if test -e /var/lib/rancher/rke2/agent/pod-manifests/kube-scheduler.yaml; then stat -c %U:%G /var/lib/rancher/rke2/agent/pod-manifests/kube-scheduler.yaml; fi'\n"})}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Expected Result:"})," 'root",":root","' is present"]}),"\n",(0,n.jsxs)(t,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Returned Value:"})}),(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-console",children:"root:root\n"})})]}),"\n",(0,n.jsxs)(t,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Remediation:"})}),(0,n.jsxs)(r.p,{children:["Run the below command (based on the file location on your system) on the control plane node.\nFor example, ",(0,n.jsx)(r.code,{children:"chown root:root /var/lib/rancher/rke2/agent/pod-manifests/kube-scheduler.yaml"})]})]}),"\n",(0,n.jsx)(r.h4,{id:"117-ensure-that-the-etcd-pod-specification-file-permissions-are-set-to-600-or-more-restrictive-manual",children:"1.1.7 Ensure that the etcd pod specification file permissions are set to 600 or more restrictive (Manual)"}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,n.jsx)(r.p,{children:(0,n.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-bash",children:"/bin/sh -c 'if test -e /var/lib/rancher/rke2/agent/pod-manifests/etcd.yaml; then stat -c permissions=%a /var/lib/rancher/rke2/agent/pod-manifests/etcd.yaml; fi'\n"})}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Expected Result:"})," permissions has permissions 600, expected 600 or more restrictive"]}),"\n",(0,n.jsxs)(t,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Returned Value:"})}),(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-console",children:"permissions=600\n"})})]}),"\n",(0,n.jsxs)(t,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Remediation:"})}),(0,n.jsxs)(r.p,{children:["If running master only with no etcd role, this check is Not applicable.\nIf c
1ontrolplane and etcd roles are present on the same nodes but this check is warn then\nRun the below command (based on the file location on your system) on the control plane node.\nFor example,\n",(0,n.jsx)(r.code,{children:"chmod 600 /var/lib/rancher/rke2/agent/pod-manifests/etcd.yaml"})]})]}),"\n",(0,n.jsxs)(r.h4,{id:"118-ensure-that-the-etcd-pod-specification-file-ownership-is-set-to-root-manual",children:["1.1.8 Ensure that the etcd pod specification file ownership is set to root",":root"," (Manual)"]}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,n.jsx)(r.p,{children:(0,n.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-bash",children:"/bin/sh -c 'if test -e /var/lib/rancher/rke2/agent/pod-manifests/etcd.yaml; then stat -c %U:%G /var/lib/rancher/rke2/agent/pod-manifests/etcd.yaml; fi'\n"})}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Expected Result:"})," 'root",":root","' is equal to 'root",":root","'"]}),"\n",(0,n.jsxs)(t,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Returned Value:"})}),(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-console",children:"root:root\n"})})]}),"\n",(0,n.jsxs)(t,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Remediation:"})}),(0,n.jsxs)(r.p,{children:["If running master only with no etcd role, this check is Not applicable.\nIf controlplane and etcd roles are present on the same nodes but this check is warn then\nRun the below command (based on the file location on your system) on the control plane node.\nFor example,\n",(0,n.jsx)(r.code,{children:"chown root:root /var/lib/rancher/rke2/agent/pod-manifests/etcd.yaml"})]})]}),"\n",(0,n.jsx)(r.h4,{id:"119-ensure-that-the-container-network-interface-file-permissions-are-set-to-600-or-more-restrictive-manual",children:"1.1.9 Ensure that the Container Network Interface file permissions are set to 600 or more restrictive (Manual)"}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Remediation:"}),"\nNote that for many CNIs, a lock file is created with permissions 750. This is expected and can be ignored.\nRun the below command (based on the file location on your system) on the control plane node.\nFor example, ",(0,n.jsx)(r.code,{children:"chmod 600 /var/lib/cni/networks/<filename> and chmod 600 /etc/cni/net.d/<filename>"})]}),"\n",(0,n.jsxs)(r.h4,{id:"1110-ensure-that-the-container-network-interface-file-ownership-is-set-to-root-manual",children:["1.1.10 Ensure that the Container Network Interface file ownership is set to root",":root"," (Manual)"]}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,n.jsx)(r.p,{children:(0,n.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-bash",children:"ps -fC ${kubeletbin:-kubelet} | grep -- --cni-conf-dir || echo \"/etc/cni/net.d\" | sed 's%.*cni-conf-dir[= ]\\([^ ]*\\).*%\\1%' | xargs -I{} find {} -mindepth 1 | xargs --no-run-if-empty stat -c %U:%G\nfind /var/lib/cni/networks -type f 2> /dev/null | xargs --no-run-if-empty stat -c %U:%G\n"})}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Expected Result:"})," 'root",":root","' is present"]}),"\n",(0,n.jsxs)(t,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Returned Value:"})}),(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-console",children:"root:root\nroot:root\nroot:root\nroot:root\nroot:root\nroot:root\nroot:root\nroot:root\nroot:root\nroot:root\n"})})]}),"\n",(0,n.jsxs)(t,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Remediation:"})}),(0,n.jsxs)(r.p,{children:["Run the below command (based on the file location on your system) on the control plane node.\nFor example,\n",(0,n.jsx)(r.code,{children:"chown root:root <path/to/cni/files>"})]})]}),"\n",(0,n.jsx)(r.h4,{id:"1111-ensure-that-the-etcd-data-directory-permissions-are-set-to-700-or-more-restrictive-manual",children:"1.1.11 Ensure that the etcd data directory permissions are set to 700 or more restrictive (Manual)"}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,n.jsx)(r.p,{children:(0,n.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-bash",children:"stat -c permissions=%a /var/lib/rancher/rke2/server/db/etcd\n"})}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Expected Result:"})," permissions has permissions 700, expected 700 or more restrictive"]}),"\n",(0,n.jsxs)(t,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Returned Value:"})}),(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-console",children:"permissions=700\n"})})]}),"\n",(0,n.jsxs)(t,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Remediation:"})}),(0,n.jsxs)(r.p,{children:["If running master only with no etcd role, this check is Not applicable.\nIf c
1ontrolplane and etcd roles are present on the same nodes but this check is warn then\nOn the etcd server node, get the etcd data directory, passed as an argument --data-dir,\nfrom the command 'ps -ef | grep etcd'.\nRun the below command (based on the etcd data directory found above). For example,\n",(0,n.jsx)(r.code,{children:"chmod 700 /var/lib/rancher/rke2/server/db/etcd"})]})]}),"\n",(0,n.jsxs)(r.h4,{id:"1112-ensure-that-the-etcd-data-directory-ownership-is-set-to-etcd-manual",children:["1.1.12 Ensure that the etcd data directory ownership is set to etcd",":etcd"," (Manual)"]}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,n.jsx)(r.p,{children:(0,n.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-bash",children:"stat -c %U:%G /var/lib/rancher/rke2/server/db/etcd\n"})}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Expected Result:"})," 'etcd",":etcd","' is present"]}),"\n",(0,n.jsxs)(t,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Returned Value:"})}),(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-console",children:"etcd:etcd\n"})})]}),"\n",(0,n.jsxs)(t,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Remediation:"})}),(0,n.jsxs)(r.p,{children:["If running master only with no etcd role, this check is Not applicable.\nIf controlplane and etcd roles are present on the same nodes but this check is warn then\nOn the etcd server node, get the etcd data directory, passed as an argument --data-dir,\nfrom the command 'ps -ef | grep etcd'.\nRun the below command (based on the etcd data directory found above).\nFor example, ",(0,n.jsx)(r.code,{children:"chown etcd:etcd /var/lib/rancher/rke2/server/db/etcd"})]})]}),"\n",(0,n.jsx)(r.h4,{id:"1113-ensure-that-the-adminconf-file-permissions-are-set-to-600-or-more-restrictive-automated",children:"1.1.13 Ensure that the admin.conf file permissions are set to 600 or more restrictive (Automated)"}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,n.jsx)(r.p,{children:(0,n.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-bash",children:"stat -c permissions=%a /var/lib/rancher/rke2/server/cred/admin.kubeconfig\n"})}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Expected Result:"})," permissions has permissions 600, expected 600 or more restrictive"]}),"\n",(0,n.jsxs)(t,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Returned Value:"})}),(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-console",children:"permissions=600\n"})})]}),"\n",(0,n.jsxs)(t,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Remediation:"})}),(0,n.jsxs)(r.p,{children:["Run the below command (based on the file location on your system) on the control plane node.\nFor example, ",(0,n.jsx)(r.code,{children:"chmod 600 /var/lib/rancher/rke2/server/cred/admin.kubeconfig"})]})]}),"\n",(0,n.jsxs)(r.h4,{id:"1114-ensure-that-the-adminconf-file-ownership-is-set-to-root-automated",children:["1.1.14 Ensure that the admin.conf file ownership is set to root",":root"," (Automated)"]}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,n.jsx)(r.p,{children:(0,n.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-bash",children:"stat -c %U:%G /var/lib/rancher/rke2/server/cred/admin.kubeconfig\n"})}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Expected Result:"})," 'root",":root","' is equal to 'root",":root","'"]}),"\n",(0,n.jsxs)(t,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Returned Value:"})}),(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-console",children:"root:root\n"})})]}),"\n",(0,n.jsxs)(t,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Remediation:"})}),(0,n.jsxs)(r.p,{children:["Run the below command (based on the file location on your system) on the control plane node.\nFor example, ",(0,n.jsx)(r.code,{children:"chown root:root /var/lib/rancher/rke2/server/cred/admin.kubeconfig"})]})]}),"\n",(0,n.jsx)(r.h4,{id:"1115-ensure-that-the-schedulerconf-file-permissions-are-set-to-600-or-more-restrictive-automated",children:"1.1.15 Ensure that the scheduler.conf file permissions are set to 600 or more restrictive (Automated)"}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,n.jsx)(r.p,{children:(0,n.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-bash",children:"/bin/sh -c 'if test -e /var/lib/rancher/rke2/server/cred/scheduler.kubeconfig; then stat -c permissions=%a /var/lib/rancher/rke2/server/cred/scheduler.kubeconfig; fi'\n"})}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Expected Result:"})," permissions has permissions 600, expected 600 or more restrictive"]}),"\n",(0,n.jsxs)(t,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Returned Value:"})}),(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-console",children:"permissions=600\n"})})]}),"\n",(0,n.jsxs)(t,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Remediation:"})}),(0,n.jsxs)(r.p,{children:["Run the below command (based on the file location on your system) on the control plane node.\nFor example,\n",(0,n.jsx)(r.code,{children:"chmod 600 /var/lib/rancher/rke2/server/cred/scheduler.kubeconfig"})]})]}),"\n",(0,n.jsxs)(r.h4,{id:"1116-ensure-that-the-schedulerconf-file-ownership-is-set-to-root-automated",children:["1.1.16 Ensure that the scheduler.conf file ownership is set to root",":root"," (Automated)"]}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,n.jsx)(r.p,{children:(0,n.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-bash",children:"stat -c %U:%G /var/lib/rancher/rke2/server/cred/scheduler.kubeconfig\n"})}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Expected Result:"})," 'root",":root","' is equal to 'root",":root","'"]}),"\n",(0,n.jsxs)(t,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Returned Value:"})}),(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-console",children:"root:root\n"})})]}),"\n",(0,n.jsxs)(t,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Remediation:"})}),(0,n.jsxs)(r.p,{children:["Run the below command (based on the file location on your system) on the control plane node.\nFor example,\n",(0,n.jsx)(r.code,{children:"chown root:root /var/lib/rancher/rke2/server/cred/scheduler.kubeconfig"})]})]}),"\n",(0,n.jsx)(r.h4,{id:"1117-ensure-that-the-controller-managerconf-file-permissions-are-set-to-600-or-more-restrictive-automated",children:"1.1.17 Ensure that the controller-manager.conf file permissions are set to 600 or more restrictive (Automated)"}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,n.jsx)(r.p,{children:(0,n.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-bash",children:"/bin/sh -c 'if test -e /var/lib/rancher/rke2/server/cred/controller.kubeconfig; then stat -c permissions=%a /var/lib/rancher/rke2/server/cred/controller.kubeconfig; fi'\n"})}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Expected Result:"})," permissions has permissions 600, expected 600 or more restrictive"]}),"\n",(0,n.jsxs)(t,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Returned Value:"})}),(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-console",children:"permissions=600\n"})})]}),"\n",(0,n.jsxs)(t,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Remediation:"})}),(0,n.jsxs)(r.p,{children:["Run the below command (based on the file location on your system) on the control plane node.\nFor example,\n",(0,n.jsx)(r.code,{children:"chmod 600 /var/lib/rancher/rke2/server/cred/controller.kubeconfig"})]})]}),"\n",(0,n.jsxs)(r.h4,{id:"1118-ensure-that-the-controller-managerconf-file-ownership-is-set-to-root-automated",children:["1.1.18 Ensure that the controller-manager.conf file ownership is set to root",":root"," (Automated)"]}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,n.jsx)(r.p,{children:(0,n.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-bash",children:"stat -c %U:%G /var/lib/rancher/rke2/server/cred/controller.kubeconfig\n"})}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Expected Result:"})," 'root",":root","' is equal to 'root",":root","'"]}),"\n",(0,n.jsxs)(t,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Returned Value:"})}),(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-console",children:"root:root\n"})})]}),"\n",(0,n.jsxs)(t,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Remediation:"})}),(0,n.jsxs)(r.p,{children:["Run the below command (based on the file location on your system) on the control plane node.\nFor example,\n",(0,n.jsx)(r.code,{children:"chown root:root /var/lib/rancher/rke2/server/cred/controller.kubeconfig"})]})]}),"\n",(0,n.jsxs)(r.h4,{id:"1119-ensure-that-the-kubernetes-pki-directory-and-file-ownership-is-set-to-root-automated",children:["1.1.19 Ensure that the Kubernetes PKI directory and file ownership is set to root",":root"," (Automated)"]}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,n.jsx)(r.p,{children:(0,n.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-bash",children:"stat -c %U:%G /var/lib/rancher/rke2/server/tls\n"})}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Expected Result:"})," 'root",":root","' is equal to 'root",":root","'"]}),"\n",(0,n.jsxs)(t,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Returned Value:"})}),(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-console",children:"root:root\n"})})]}),"\n",(0,n.jsxs)(t,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Remediation:"})}),(0,n.jsxs)(r.p,{children:["Run the below command (based on the file location on your system) on the control plane node.\nFor example,\n",(0,n.jsx)(r.code,{children:"chown -R root:root /var/lib/rancher/rke2/server/tls"})]})]}),"\n",(0,n.jsx)(r.h4,{id:"1120-ensure-that-the-kubernetes-pki-certificate-file-permissions-are-set-to-644-or-more-restrictive-automated",children:"1.1.20 Ensure that the Kubernetes PKI certificate file permissions are set to 644 or more restrictive (Automated)"}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,n.jsx)(r.p,{children:(0,n.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-bash",children:"stat -c permissions=%a /var/lib/rancher/rke2/server/tls/*.crt\n"})}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Expected Result:"})," permissions has permissions 644, expected 644 or more restrictive"]}),"\n",(0,n.jsxs)(t,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Returned Value:"})}),(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-console",children:"permissions=644\npermissions=644\npermissions=644\npermissions=644\npermissions=644\npermissions=644\npermissions=644\npermissions=644\npermissions=644\npermissions=644\npermissions=644\npermissions=644\npermissions=644\n"})})]}),"\n",(0,n.jsxs)(t,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Remediation:"})}),(0,n.jsxs)(r.p,{children:["Run the below command (based on the file location on your system) on the control plane node.\nFor example,\n",(0,n.jsx)(r.code,{children:"chmod -R 644 /var/lib/rancher/rke2/server/tls/*.crt"}),"\nBy default, RKE2 sets PKI certificate file permissions to 644, more restrictive permissions such as 600 are supported."]})]}),"\n",(0,n.jsx)(r.h4,{id:"1121-ensure-that-the-kubernetes-pki-key-file-permissions-are-set-to-600-automated",children:"1.1.21 Ensure that the Kubernetes PKI key file permissions are set to 600 (Automated)"}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,n.jsx)(r.p,{children:(0,n.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-bash",children:"stat -c permissions=%a /var/lib/rancher/rke2/server/tls/*.key\n"})}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Expected Result:"})," permissions has permissions 600, expected 600 or more restrictive"]}),"\n",(0,n.jsxs)(t,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Returned Value:"})}),(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-console",children:"permissions=600\npermissions=600\npermissions=600\npermissions=600\npermissions=600\npermissions=600\npermissions=600\npermissions=600\npermissions=600\npermissions=600\npermissions=600\npermissions=600\npermissions=600\npermissions=600\npermissions=600\npermissions=600\npermissions=600\n"})})]}),"\n",(0,n.jsxs)(t,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Remediation:"})}),(0,n.jsxs)(r.p,{children:["Run the below command (based on the file location on your system) on the control plane node.\nFor example,\n",(0,n.jsx)(r.code,{children:"chmod -R 600 /var/lib/rancher/rke2/server/tls/*.key"})]})]}),"\n",(0,n.jsx)(r.h3,{id:"12-api-server",children:"1.2 API Server"}),"\n",(0,n.jsx)(r.h4,{id:"121-ensure-that-the---anonymous-auth-argument-is-set-to-false-automated",children:"1.2.1 Ensure that the --anonymous-auth argument is set to false (Automated)"}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,n.jsx)(r.p,{children:(0,n.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-bash",children:"/bin/ps -fC kube-apiserver\n"})}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Expected Result:"})," '--anonymous-auth' is equal to 'false'"]}),"\n",(0,n.jsxs)(t,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Returned Value:"})}),(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-console",children:"UID PID PPID C STIME TTY TIME CMD\nroot 2618 2570 15 22:56 ? 00:00:07 kube-apiserver --admission-control-config-file=/etc/rancher/rke2/rke2-pss.yaml --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --service-account-extend-token-expiration=false --advertise-address=10.10.10.100 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --encryption-provider-config-automatic-reload=true --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-a
1llowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key\n"})})]}),"\n",(0,n.jsxs)(t,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Remediation:"})}),(0,n.jsx)(r.p,{children:"By default, RKE2 sets the --anonymous-auth argument to false.\nIf this check fails, edit the RKE2 config file /etc/rancher/rke2/config.yaml and remove anything similar to below."}),(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{children:'kube-apiserver-arg:\n - "anonymous-auth=true"\n'})})]}),"\n",(0,n.jsx)(r.h4,{id:"122-ensure-that-the---token-auth-file-parameter-is-not-set-automated",children:"1.2.2 Ensure that the --token-auth-file parameter is not set (Automated)"}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,n.jsx)(r.p,{children:(0,n.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-bash",children:"/bin/ps -fC kube-apiserver\n"})}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Expected Result:"})," '--token-auth-file' is not present"]}),"\n",(0,n.jsxs)(t,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Returned Value:"})}),(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-console",children:"UID PID PPID C STIME TTY TIME CMD\nroot 2618 2570 15 22:56 ? 00:00:07 kube-apiserver --admission-control-config-file=/etc/rancher/rke2/rke2-pss.yaml --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --service-account-extend-token-expiration=false --advertise-address=10.10.10.100 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --encryption-provider-config-automatic-reload=true --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key\n"})})]}),"\n",(0,n.jsxs)(t,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Remediation:"})}),(0,n.jsx)(r.p,{children:"Follow the documentation and configure alternate mechanisms for authentication.\nIf this check fails, edit the RKE2 config file /etc/rancher/rke2/config.yaml and remove anything similar to below."}),(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{children:'kube-apiserver-arg:\n - "token-auth-file=<path>"\n'})})]}),"\n",(0,n.jsx)(r.h4,{id:"123-ensure-that-the---denyserviceexternalips-is-set-manual",children:"1.2.3 Ensure that the --DenyServiceExternalIPs is set
1(Manual)"}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Remediation:"}),"\nBy default, RKE2 does not set DenyServiceExternalIPs.\nTo enable this flag, edit the RKE2 config file /etc/rancher/rke2/config.yaml like below."]}),"\n",(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{children:'kube-apiserver-arg:\n - "enable-admission-plugins=DenyServiceExternalIPs"\n'})}),"\n",(0,n.jsx)(r.h4,{id:"124-ensure-that-the---kubelet-client-certificate-and---kubelet-client-key-arguments-are-set-as-appropriate-automated",children:"1.2.4 Ensure that the --kubelet-client-certificate and --kubelet-client-key arguments are set as appropriate (Automated)"}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,n.jsx)(r.p,{children:(0,n.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-bash",children:"/bin/ps -fC kube-apiserver\n"})}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Expected Result:"})," '--kubelet-client-certificate' is present AND '--kubelet-client-key' is present"]}),"\n",(0,n.jsxs)(t,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Returned Value:"})}),(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-console",children:"UID PID PPID C STIME TTY TIME CMD\nroot 2618 2570 15 22:56 ? 00:00:07 kube-apiserver --admission-control-config-file=/etc/rancher/rke2/rke2-pss.yaml --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --service-account-extend-token-expiration=false --advertise-address=10.10.10.100 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --encryption-provider-config-automatic-reload=true --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key\n"})})]}),"\n",(0,n.jsxs)(t,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Remediation:"})}),(0,n.jsx)(r.p,{children:"By default, RKE2 automatically provides the kubelet client certificate and key.\nThey are generated and located at /var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt and /var/lib/rancher/rke2/server/tls/client-kube-apiserver.key\nIf for some reason you need to provide your own certificate and key, you can set the\nbelow parameters in the RKE2 config file /etc/rancher/rke2/config.yaml."}),(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{children:'kube-apiserver-arg:\n - "kubelet-client-certificate=<path/to/client-cert-file>"\n - "kubelet-client-key=<path/to/client-key-file>"\n'})})]}),"\n",(0,n.jsx)(r.h4,{id:"125-ensure-that-the---kubelet-certificate-authority-argument-is-set-as-appropriate-automated",children:"1.2.5 Ensure that the --kubelet-certificate-authority argument is set as appropriate (Automated)"}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,n.jsx)(r.p,{children:(0,n.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-bash",children:"/bin/ps -fC kube-apiserver\n"})}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Expected Result:"})," '--kubelet-certificate-authority' is present"]}),"\n",(0,n.jsxs)(t,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Returned Value:"})}),(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-console",children:"UID PID PPID C STIME TTY TIME CMD\nroot 2618 2570 15 22:56 ? 00:00:07 kube-apiserver --admission-control-config-file=/etc/rancher/rke2/rke2-pss.yaml --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --service-account-extend-token-expiration=false --advertise-address=10.10.10.100 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --encryption-provider-config-automatic-reload=true --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key\n"})})]}),"\n",(0,n.jsxs)(t,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Remediation:"})}),(0,n.jsx)(r.p,{children:"By default, RKE2 automatically provides the kubelet CA cert file, at /var/lib/rancher/rke2/server/tls/server-ca.crt.\nIf for some reason you need to provide your own ca certificate, look at using the rke2 certificate command line tool.\nIf this check fails, edit the RKE2 config file /etc/rancher/rke2/config.yaml and remove any lines like below."}),(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{children:'kube-apiserver-arg:\n - "kubelet-certificate-authority=<path/to/ca-cert-file>"\n'})})]}),"\n",(0,n.jsx)(r.h4,{id:"126-ensure-that-the---authorization-mode-argument-is-not-set-to-alwaysallow-automated",children:"1.2.6 Ensure that the --authorization-mode argument is not set to AlwaysAllow (Automated)"}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,n.jsx)(r.p,{children:(0,n.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-bash",children:"/bin/ps -fC kube-apiserver\n"})}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Expected Result:"})," '--authorization-mode' does not have 'AlwaysAllow'"]}),"\n",(0,n.jsxs)(t,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Returned Value:"})}),(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-console",children:"UID PID PPID C STIME TTY TIME CMD\nroot 2618 2570 15 22:56 ? 00:00:07 kube-apiserver --admission-control-config-file=/etc/rancher/rke2/rke2-pss.yaml --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --service-account-extend-token-expiration=false --advertise-address=10.10.10.100 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --encryption-provider-config-automatic-reload=true --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key\n"})})]}),"\n",(0,n.jsxs)(t,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Remediation:"})}),(0,n.jsx)(r.p,{children:"By default, RKE2 does not set the --authorization-mode to AlwaysAllow.\nIf this check fails, edit RKE2 config file /etc/rancher/rke2/config.yaml, remove any lines like below."}),(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{children:'kube-apiserver-arg:\n - "authorization-mode=AlwaysAllow"\n'})})]}),"\n",(0,n.jsx)(r.h4,{id:"127-ensure-that-the---authorization-mode-argument-includes-node-automated",children:"1.2.7 Ensure that the --authorization-mode argument includes Node (Automated)"}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,n.jsx)(r.p,{children:(0,n.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-bash",children:"/bin/ps -fC kube-apiserver\n"})}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Expected Result:"})," '--authorization-mode' has 'Node'"]}),"\n",(0,n.jsxs)(t,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Returned Value:"})}),(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-console",children:"UID PID PPID C STIME TTY TIME CMD\nroot 2618 2570 15 22:56 ? 00:00:07 kube-apiserver --admission-control-config-file=/etc/rancher/rke2/rke2-pss.yaml --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --service-account-extend-token-expiration=false --advertise-address=10.10.10.100 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --encryption-provider-config-automatic-reload=true --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --serv
1ice-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key\n"})})]}),"\n",(0,n.jsxs)(t,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Remediation:"})}),(0,n.jsx)(r.p,{children:"By default, RKE2 sets the --authorization-mode to Node and RBAC.\nIf this check fails, edit the RKE2 config file /etc/rancher/rke2/config.yaml,\nensure that you are not overriding authorization-mode."})]}),"\n",(0,n.jsx)(r.h4,{id:"128-ensure-that-the---authorization-mode-argument-includes-rbac-automated",children:"1.2.8 Ensure that the --authorization-mode argument includes RBAC (Automated)"}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,n.jsx)(r.p,{children:(0,n.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-bash",children:"/bin/ps -fC kube-apiserver\n"})}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Expected Result:"})," '--authorization-mode' has 'RBAC'"]}),"\n",(0,n.jsxs)(t,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Returned Value:"})}),(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-console",children:"UID PID PPID C STIME TTY TIME CMD\nroot 2618 2570 15 22:56 ? 00:00:07 kube-apiserver --admission-control-config-file=/etc/rancher/rke2/rke2-pss.yaml --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --service-account-extend-token-expiration=false --advertise-address=10.10.10.100 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --encryption-provider-config-automatic-reload=true --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key\n"})})]}),"\n",(0,n.jsxs)(t,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Remediation:"})}),(0,n.jsx)(r.p,{children:"By default, RKE2 sets the --authorization-mode to N
1ode and RBAC.\nIf this check fails, edit the RKE2 config file /etc/rancher/rke2/config.yaml,\nensure that you are not overriding authorization-mode."})]}),"\n",(0,n.jsx)(r.h4,{id:"129-ensure-that-the-admission-control-plugin-eventratelimit-is-set-manual",children:"1.2.9 Ensure that the admission control plugin EventRateLimit is set (Manual)"}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Remediation:"}),"\nFollow the Kubernetes documentation and set the desired limits in a configuration file.\nThen, edit the RKE2 config file /etc/rancher/rke2/config.yaml and set the below parameters."]}),"\n",(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{children:'kube-apiserver-arg:\n - "enable-admission-plugins=...,EventRateLimit,..."\n - "admission-control-config-file=<path/to/configuration/file>"\n'})}),"\n",(0,n.jsx)(r.h4,{id:"1210-ensure-that-the-admission-control-plugin-alwaysadmit-is-not-set-automated",children:"1.2.10 Ensure that the admission control plugin AlwaysAdmit is not set (Automated)"}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,n.jsx)(r.p,{children:(0,n.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-bash",children:"/bin/ps -fC kube-apiserver\n"})}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Expected Result:"})," '--enable-admission-plugins' does not have 'AlwaysAdmit' OR '--enable-admission-plugins' is not present"]}),"\n",(0,n.jsxs)(t,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Returned Value:"})}),(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-console",children:"UID PID PPID C STIME TTY TIME CMD\nroot 2618 2570 15 22:56 ? 00:00:07 kube-apiserver --admission-control-config-file=/etc/rancher/rke2/rke2-pss.yaml --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --service-account-extend-token-expiration=false --advertise-address=10.10.10.100 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --encryption-provider-config-automatic-reload=true --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key\n"})})]}),"\n",(0,n.jsxs)(t,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Remediation:"})}),(0,n.jsx)(r.p,{children:"By default, RKE2 does not set the --enable-admission-plugins to AlwaysAdm
1it.\nIf this check fails, edit RKE2 config file /etc/rancher/rke2/config.yaml, remove any lines like below."}),(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{children:'kube-apiserver-arg:\n - "enable-admission-plugins=AlwaysAdmit"\n'})})]}),"\n",(0,n.jsx)(r.h4,{id:"1211-ensure-that-the-admission-control-plugin-alwayspullimages-is-set-manual",children:"1.2.11 Ensure that the admission control plugin AlwaysPullImages is set (Manual)"}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Remediation:"}),'\nPermissive, per CIS guidelines,\n"This setting could impact offline or isolated clusters, which have images pre-loaded and\ndo not have access to a registry to pull in-use images. This setting is not appropriate for\nclusters which use this configuration."\nEdit the RKE2 config file /etc/rancher/rke2/config.yaml on the control plane node and set the --enable-admission-plugins parameter to include\nAlwaysPullImages.\nkube-apiserver-arg:\n"enable-admission-plugins=...,AlwaysPullImages,..."']}),"\n",(0,n.jsx)(r.h4,{id:"1212-ensure-that-the-admission-control-plugin-serviceaccount-is-set-automated",children:"1.2.12 Ensure that the admission control plugin ServiceAccount is set (Automated)"}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,n.jsx)(r.p,{children:(0,n.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-bash",children:"/bin/ps -fC kube-apiserver\n"})}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Expected Result:"})," '--disable-admission-plugins' is present OR '--disable-admission-plugins' is not present"]}),"\n",(0,n.jsxs)(t,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Returned Value:"})}),(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-console",children:"UID PID PPID C STIME TTY TIME CMD\nroot 2618 2570 15 22:56 ? 00:00:07 kube-apiserver --admission-control-config-file=/etc/rancher/rke2/rke2-pss.yaml --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --service-account-extend-token-expiration=false --advertise-address=10.10.10.100 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --encryption-provider-config-automatic-reload=true --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key\n"})})]}),"\n",(0,n.jsxs)(t,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Remediation:"})}),(0,n.jsx)(r.p,{children:"By default, RKE2 does not set the --disable-admission-plugins to anything.\nFollow the documentation and create ServiceAccount objects as per your environment.\nIf this check fails, edit the RKE2 config file /etc/rancher/rke2/config.yaml and remove any lines like below."}),(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{children:'kube-apiserver-arg:\n - "disable-admission-plugins=ServiceAccount"\n'})})]}),"\n",(0,n.jsx)(r.h4,{id:"1213-ensure-that-the-admission-control-plugin-namespacelifecycle-is-set-automated",children:"1.2.13 Ensure that the admission control plugin NamespaceLifecycle is set (Automated)"}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,n.jsx)(r.p,{children:(0,n.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-bash",children:"/bin/ps -fC kube-apiserver\n"})}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Expected Result:"})," '--disable-admission-plugins' is present OR '--disable-admission-plugins' is not present"]}),"\n",(0,n.jsxs)(t,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Returned Value:"})}),(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-console",children:"UID PID PPID C STIME TTY TIME CMD\nroot 2618 2570 15 22:56 ? 00:00:07 kube-apiserver --admission-control-config-file=/etc/rancher/rke2/rke2-pss.yaml --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --service-account-extend-token-expiration=false --advertise-address=10.10.10.100 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --encryption-provider-config-automatic-reload=true --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key\n"})})]}),"\n",(0,n.jsxs)(t,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Remediation:"})}),(0,n.jsx)(r.p,{children:"By default, RKE2 does not set the --disable-admission-plugins to anything.\nIf this check fails, edit the RKE2 config file /etc/rancher/rke2/config.yaml and remove any lines like below."}),(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{children:'kube-apiserver-arg:\n - "disable-admission-plugins=...,NamespaceLifecycle,..."\n'})})]}),"\n",(0,n.jsx)(r.h4,{id:"1214-ensure-that-the-admission-control-plugin-noderestriction-is-set-automated",children:"1.2.14 Ensure that the admission control plugin NodeRestriction is set
1(Automated)"}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,n.jsx)(r.p,{children:(0,n.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-bash",children:"/bin/ps -fC kube-apiserver\n"})}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Expected Result:"})," '--enable-admission-plugins' has 'NodeRestriction'"]}),"\n",(0,n.jsxs)(t,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Returned Value:"})}),(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-console",children:"UID PID PPID C STIME TTY TIME CMD\nroot 2618 2570 15 22:56 ? 00:00:07 kube-apiserver --admission-control-config-file=/etc/rancher/rke2/rke2-pss.yaml --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --service-account-extend-token-expiration=false --advertise-address=10.10.10.100 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --encryption-provider-config-automatic-reload=true --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key\n"})})]}),"\n",(0,n.jsxs)(t,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Remediation:"})}),(0,n.jsx)(r.p,{children:"By default, RKE2 sets the --enable-admission-plugins to NodeRestriction.\nCheck the RKE2 config file /etc/rancher/rke2/config.yaml, and ensure that you are not overriding the admission plugins.\nIf you are, include NodeRestriction in the list."}),(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{children:'kube-apiserver-arg:\n - "enable-admission-plugins=...,NodeRestriction,..."\n'})})]}),"\n",(0,n.jsx)(r.h4,{id:"1215-ensure-that-the---profiling-argument-is-set-to-false-automated",children:"1.2.15 Ensure that the --profiling argument is set to false (Automated)"}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,n.jsx)(r.p,{children:(0,n.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-bash",children:"/bin/ps -fC kube-apiserver\n"})}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Expected Result:"})," '--profiling' is equal to 'false'"]}),"\n",(0,n.jsxs)(t,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Returned Value:"})}),(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-console",children:"UID PID PPID C STIME TTY TIME CMD\nroot 2618 2570 15 22:56 ? 00:00:07 kube-apiserver --admission-control-config-file=/etc/rancher/rke2/rke2-pss.yaml --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --service-account-extend-token-expiration=false --advertise-address=10.10.10.100 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --encryption-provider-config-automatic-reload=true --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key\n"})})]}),"\n",(0,n.jsxs)(t,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Remediation:"})}),(0,n.jsx)(r.p,{children:"By default, RKE2 sets the --profiling argument to false.\nIf this check fails, edit the RKE2 config file /etc/rancher/rke2/config.yaml and remove any lines like below."}),(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{children:'kube-apiserver-arg:\n - "profiling=true"\n'})})]}),"\n",(0,n.jsx)(r.h4,{id:"1216-ensure-that-the---audit-log-path-argument-is-set-automated",children:"1.2.16 Ensure that the --audit-log-path argument is set (Automated)"}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,n.jsx)(r.p,{children:(0,n.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-bash",children:"/bin/ps -fC kube-apiserver\n"})}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Expected Result:"})," '--audit-log-path' is present"]}),"\n",(0,n.jsxs)(t,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Returned Value:"})}),(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-console",children:"UID PID PPID C STIME TTY TIME CMD\nroot 2618 2570 15 22:56 ? 00:00:07 kube-apiserver --admission-control-config-file=/etc/rancher/rke2/rke2-pss.yaml --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --service-account-extend-token-expiration=false --advertise-address=10.10.10.100 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --encryption-provider-config-automatic-reload=true --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key\n"})})]}),"\n",(0,n.jsxs)(t,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Remediation:"})}),(0,n.jsx)(r.p,{children:"By default, RKE2 sets the --audit-log-path argument to /var/lib/rancher/rke2/server/logs/audit.log\nIf you want to change this, edit the RKE2 config file /etc/rancher/rke2/config.yaml\non the control plane node and set the --audit-log-path parameter to a suitable path and\nfile where you would like audit logs to be written, for example,"}),(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{children:'kube-apiserver-arg:\n - "audit-log-path=/var/log/rke2/audit.log"\n'})})]}),"\n",(0,n.jsx)(r.h4,{id:"1217-ensure-that-the---audit-log-maxage-argument-is-set-to-30-or-as-appropriate-automated",children:"1.2.17 Ensure that the --audit-log-maxage argument is set to 30 or as appropriate (Automated)"}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,n.jsx)(r.p,{children:(0,n.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-bash",children:"/bin/ps -fC kube-apiserver\n"})}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Expected Result:"})," '--audit-log-maxage' is greater or equal to 30"]}),"\n",(0,n.jsxs)(t,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Returned Value:"})}),(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-console",children:"UID PID PPID C STIME TTY TIME CMD\nroot 2618 2570 15 22:56 ? 00:00:07 kube-apiserver --admission-control-config-file=/etc/rancher/rke2/rke2-pss.yaml --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --service-account-extend-token-expiration=false --advertise-address=10.10.10.100 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --encryption-provider-config-automatic-reload=true --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key\n"})})]}),"\n",(0,n.jsxs)(t,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Remediation:"})}),(0,n.jsx)(r.p,{children:"By default, RKE2 sets the --audit-log-maxage argument to 30 days.\nIf you want to change this, edit the RKE2 config file /etc/rancher/rke2/config.yaml\non the control plane node and set the --audit-log-maxage parameter to an appropriate number of days, for example,"}),(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{children:'kube-apiserver-arg:\n - "audit-log
1-maxage=40"\n'})})]}),"\n",(0,n.jsx)(r.h4,{id:"1218-ensure-that-the---audit-log-maxbackup-argument-is-set-to-10-or-as-appropriate-automated",children:"1.2.18 Ensure that the --audit-log-maxbackup argument is set to 10 or as appropriate (Automated)"}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,n.jsx)(r.p,{children:(0,n.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-bash",children:"/bin/ps -fC kube-apiserver\n"})}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Expected Result:"})," '--audit-log-maxbackup' is greater or equal to 10"]}),"\n",(0,n.jsxs)(t,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Returned Value:"})}),(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-console",children:"UID PID PPID C STIME TTY TIME CMD\nroot 2618 2570 15 22:56 ? 00:00:07 kube-apiserver --admission-control-config-file=/etc/rancher/rke2/rke2-pss.yaml --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --service-account-extend-token-expiration=false --advertise-address=10.10.10.100 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --encryption-provider-config-automatic-reload=true --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key\n"})})]}),"\n",(0,n.jsxs)(t,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Remediation:"})}),(0,n.jsx)(r.p,{children:"By default, RKE2 sets the --audit-log-maxbackup argument to 10.\nIf you want to change this, edit the RKE2 config file /etc/rancher/rke2/config.yaml\non the control plane node and set the --audit-log-maxbackup parameter to an appropriate value.\nFor example,"}),(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{children:'kube-apiserver-arg:\n - "audit-log-maxbackup=15"\n'})})]}),"\n",(0,n.jsx)(r.h4,{id:"1219-ensure-that-the---audit-log-maxsize-argument-is-set-to-100-or-as-appropriate-automated",children:"1.2.19 Ensure that the --audit-log-maxsize argument is set to 100 or as appropriate (Automated)"}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,n.jsx)(r.p,{children:(0,n.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-bash",children:"/bin/ps -fC kube-apiserver\n"})}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Expected Result:"})," '--audit-log-maxsize' is greater or equal to 100"]}),"\n",(0,n.jsxs)(t,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Returned Value:"})}),(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-console",children:"UID PID PPID C STIME TTY TIME CMD\nroot 2618 2570 15 22:56 ? 00:00:07 kube-apiserver --admission-control-config-file=/etc/rancher/rke2/rke2-pss.yaml --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --service-account-extend-token-expiration=false --advertise-address=10.10.10.100 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --encryption-provider-config-automatic-reload=true --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key\n"})})]}),"\n",(0,n.jsxs)(t,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Remediation:"})}),(0,n.jsx)(r.p,{children:"By default, RKE2 sets the --audit-log-maxsize argument to 100 MB.\nIf you want to change this, edit the RKE2 config file /etc/rancher/rke2/config.yaml\non the control plane node and set the --audit-log-maxsize parameter to an appropriate size in MB.\nFor example,"}),(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{children:'kube-apiserver-arg:\n - "audit-log-maxsize=150"\n'})})]}),"\n",(0,n.jsx)(r.h4,{id:"1220-ensure-that-the---request-timeout-argument-is-set-as-appropriate-automated",children:"1.2.20 Ensure that the --request-timeout argument is set as appropriate (Automated)"}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,n.jsx)(r.p,{children:(0,n.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-bash",children:"/bin/ps -fC kube-apiserver\n"})}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Expected Result:"})," '--request-timeout' is not present OR '--request-timeout' is present"]}),"\n",(0,n.jsxs)(t,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Returned Value:"})}),(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-console",children:"UID PID PPID C STIME TTY TIME CMD\nroot 2618 2570 15 22:56 ? 00:00:07 kube-apiserver --admission-control-config-file=/etc/rancher/rke2/rke2-pss.yaml --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --service-account-extend-token-expiration=false --advertise-address=10.10.10.100 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --encryption-provider-config-automatic-reload=true --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key\n"})})]}),"\n",(0,n.jsxs)(t,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Remediation:"})}),(0,n.jsx)(r.p,{children:'Permissive, per CIS guidelines,\n"it is recommended to set this limit as appropriate and change the default limit of 60 seconds only if needed".\nEdit the RKE2 config file /etc/rancher/rke2/config.yaml\nand set the below parameter if needed. For example,'}),(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{children:'kube-apiserver-arg:\n - "request-timeout=300s"\n'})})]}),"\n",(0,n.jsx)(r.h4,{id:"1221-ensure-that-the---service-account-lookup-argument-is-set-to-true-automated",children:"1.2.21 Ensure that the --service-account-lookup argument is set to true (Automated)"}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,n.jsx)(r.p,{children:(0,n.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-bash",children:"/bin/ps -fC kube-apiserver\n"})}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Expected Result:"})," '--service-account-lookup' is not present OR '--service-account-lookup' is present"]}),"\n",(0,n.jsxs)(t,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Returned Value:"})}),(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-console",children:"UID PID PPID C STIME TTY TIME CMD\nroot 2618 2570 15 22:56 ? 00:00:07 kube-apiserver --admission-control-config-file=/etc/rancher/rke2/rke2-pss.yaml --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --service-account-extend-token-expiration=false --advertise-address=10.10.10.100 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --encryption-provider-config-automatic-reload=true --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key\n"})})]}),"\n",(0,n.jsxs)(t,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Remediation:"})}),(0,n.jsx
1)(r.p,{children:"By default, RKE2 does not set the --service-account-lookup argument.\nEdit the RKE2 config file /etc/rancher/rke2/config.yaml and set the service-account-lookup. For example,"}),(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{children:'kube-apiserver-arg:\n - "service-account-lookup=true"\n'})}),(0,n.jsx)(r.p,{children:"Alternatively, you can delete the service-account-lookup parameter from this file so\nthat the default takes effect."})]}),"\n",(0,n.jsx)(r.h4,{id:"1222-ensure-that-the---service-account-key-file-argument-is-set-as-appropriate-automated",children:"1.2.22 Ensure that the --service-account-key-file argument is set as appropriate (Automated)"}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,n.jsx)(r.p,{children:(0,n.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-bash",children:"/bin/ps -fC kube-apiserver\n"})}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Expected Result:"})," '--service-account-key-file' is present"]}),"\n",(0,n.jsxs)(t,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Returned Value:"})}),(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-console",children:"UID PID PPID C STIME TTY TIME CMD\nroot 2618 2570 15 22:56 ? 00:00:07 kube-apiserver --admission-control-config-file=/etc/rancher/rke2/rke2-pss.yaml --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --service-account-extend-token-expiration=false --advertise-address=10.10.10.100 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --encryption-provider-config-automatic-reload=true --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key\n"})})]}),"\n",(0,n.jsxs)(t,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Remediation:"})}),(0,n.jsx)(r.p,{children:"RKE2 automatically generates and sets the service account key file.\nIt is located at /var/lib/rancher/rke2/server/tls/service.key.\nIf this check fails, edit RKE2 config file /etc/rancher/rke2/config.yaml and remove any lines like below."}),(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{children:'kube-apiserver-arg:\n - "service-account-key-file=<path>"\n'})})]}),"\n",(0,n.jsx)(r.h4,{id:"1223-ensure-that-the---etcd-certfile-and---etcd-keyfile-arguments-are-set-as-appropriate-automated",children:"1.2.23 Ensure that the --etcd-certfile and --etcd-keyfile arguments are set as appropriate (Automated)"}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,n.jsx)(r.p,{children:(0,n.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-bash",children:"/bin/ps -fC kube-apiserver\n"})}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Expected Result:"})," '--etcd-certfile' is present AND '--etcd-keyfile' is present"]}),"\n",(0,n.jsxs)(t,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Returned Value:"})}),(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-console",children:"UID PID PPID C STIME TTY TIME CMD\nroot 2618 2570 15 22:56 ? 00:00:07 kube-apiserver --admission-control-config-file=/etc/rancher/rke2/rke2-pss.yaml --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --service-account-extend-token-expiration=false --advertise-address=10.10.10.100 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --encryption-provider-config-automatic-reload=true --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key\n"})})]}),"\n",(0,n.jsxs)(t,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Remediation:"})}),(0,n.jsx)(r.p,{children:"RKE2 automatically generates and sets the etcd certificate and key files.\nThey are located at /var/lib/rancher/rke2/server/tls/etcd/client.crt and /var/lib/rancher/rke2/server/tls/etcd/client.key.\nIf this check fails, edit the RKE2 config file /etc/rancher/rke2/config.yaml and remove any lines like below."}),(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{children:'kube-apiserver-arg:\n - "etcd-certfile=<path>"\n - "etcd-keyfile=<path>"\n'})})]}),"\n",(0,n.jsx)(r.h4,{id:"1224-ensure-that-the---tls-cert-file-and---tls-private-key-file-arguments-are-set-as-appropriate-automated",children:"1.2.24 Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate (Automated)"}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,n.jsx)(r.p,{children:(0,n.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-bash",children:"/bin/ps -fC kube-apiserver\n"})}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Expected Result:"})," '--tls-cert-file' is present AND '--tls-private-key-file' is present"]}),"\n",(0,n.jsxs)(t,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Returned Value:"})}),(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-console",children:"UID PID PPID C STIME TTY TIME CMD\nroot 2618 2570 15 22:56 ? 00:00:07 kube-apiserver --admission-control-config-file=/etc/rancher/rke2/rke2-pss.yaml --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --service-account-extend-token-expiration=false --advertise-address=10.10.10.100 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --encryption-provider-config-automatic-reload=true --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key\n"})})]}),"\n",(0,n.jsxs)(t,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Remediation:"})}),(0,n.jsx)(r.p,{children:"By default, RKE2 automatically generates and provides the TLS certificate and private key for the apiserver.\nThey are generated and located at /var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt and /var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key\nIf this check fails, edit the RKE2 config file /etc/rancher/rke2/config.yaml and remove any lines like below."}),(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{children:'kube-apiserver-arg:\n - "tls-cert-file=<path>"\n - "tls-private-key-file=<path>"\n'})})]}),"\n",(0,n.jsx)(r.h4,{id:"1225-ensure-that-the---client-ca-file-argument-is-set-as-appropriate-automated",children:"1.2.25 Ensure that the --client-ca-file argument is set as appropriate (Automated)"}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,n.jsx)(r.p,{children:(0,n.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-bash",children:"/bin/ps -fC kube-apiserver\n"})}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Expected Result:"})," '--client-ca-file' is present"]}),"\n",(0,n.jsxs)(t,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Returned Value:"})}),(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-console",children:"UID PID PPID C STIME TTY TIME CMD\nroot 2618 2570 15 22:56 ? 00:00:07 kube-apiserver --admission-control-config-file=/etc/rancher/rke2/rke2-pss.yaml --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --service-account-extend-token-expiration=false --advertise-address=10.10.10.100 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --encryption-provider-config-automatic-reload=true --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/s
1erver/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key\n"})})]}),"\n",(0,n.jsxs)(t,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Remediation:"})}),(0,n.jsx)(r.p,{children:"By default, RKE2 automatically provides the client certificate authority file.\nIt is generated and located at /var/lib/rancher/rke2/server/tls/client-ca.crt.\nIf for some reason you need to provide your own ca certificate, look at using the rke2 certificate command line tool.\nIf this check fails, edit the RKE2 config file /etc/rancher/rke2/config.yaml and remove any lines like below."}),(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{children:'kube-apiserver-arg:\n - "client-ca-file=<path>"\n'})})]}),"\n",(0,n.jsx)(r.h4,{id:"1226-ensure-that-the---etcd-cafile-argument-is-set-as-appropriate-automated",children:"1.2.26 Ensure that the --etcd-cafile argument is set as appropriate (Automated)"}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,n.jsx)(r.p,{children:(0,n.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-bash",children:"/bin/ps -fC kube-apiserver\n"})}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Expected Result:"})," '--etcd-cafile' is present"]}),"\n",(0,n.jsxs)(t,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Returned Value:"})}),(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-console",children:"UID PID PPID C STIME TTY TIME CMD\nroot 2618 2570 15 22:56 ? 00:00:07 kube-apiserver --admission-control-config-file=/etc/rancher/rke2/rke2-pss.yaml --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --service-account-extend-token-expiration=false --advertise-address=10.10.10.100 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --encryption-provider-config-automatic-reload=true --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key\n"})})]}),"\n",(0,n.jsxs)(t,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Remediation:"})}),(0,n.jsx)(r.p,{children:"By default, RKE2 automatically provides the etcd certificate authority file.\nIt is generated and located at /var/lib/rancher/rke2/server/tls/client-ca.crt.\nIf for some reason you need to provide your own ca certificate, look at using the rke2 certificate command line tool.\nIf this check fails, edit the RKE2 config file /etc/rancher/rke2/config.yaml and remove any lines like below."}),(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{children:'kube-apiserver-arg:\n - "etcd-cafile=<path>"\n'})})]}
1),"\n",(0,n.jsx)(r.h4,{id:"1227-ensure-that-the---encryption-provider-config-argument-is-set-as-appropriate-automated",children:"1.2.27 Ensure that the --encryption-provider-config argument is set as appropriate (Automated)"}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,n.jsx)(r.p,{children:(0,n.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-bash",children:"/bin/ps -fC kube-apiserver\n"})}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Expected Result:"})," '--encryption-provider-config' is present"]}),"\n",(0,n.jsxs)(t,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Returned Value:"})}),(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-console",children:"UID PID PPID C STIME TTY TIME CMD\nroot 2618 2570 15 22:56 ? 00:00:07 kube-apiserver --admission-control-config-file=/etc/rancher/rke2/rke2-pss.yaml --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --service-account-extend-token-expiration=false --advertise-address=10.10.10.100 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --encryption-provider-config-automatic-reload=true --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key\n"})})]}),"\n",(0,n.jsxs)(t,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Remediation:"})}),(0,n.jsx)(r.p,{children:"RKE2 always is configured to encrypt secrets.\nSecrets encryption is managed with the rke2 secrets-encrypt command line tool.\nIf needed, you can find the generated encryption config at /var/lib/rancher/rke2/server/cred/encryption-config.json"})]}),"\n",(0,n.jsx)(r.h4,{id:"1228-ensure-that-encryption-providers-are-appropriately-configured-automated",children:"1.2.28 Ensure that encryption providers are appropriately configured (Automated)"}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,n.jsx)(r.p,{children:(0,n.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-bash",children:"ENCRYPTION_PROVIDER_CONFIG=$(ps -ef | grep kube-apiserver | grep -- --encryption-provider-config | sed 's%.*encryption-provider-config[= ]\\([^ ]*\\).*%\\1%')\nif test -e $ENCRYPTION_PROVIDER_CONFIG; then grep -o 'providers\\\"\\:\\[.*\\]' $ENCRYPTION_PROVIDER_CONFIG | grep -o \"[A-Za-z]*\" | head -2 | tail -1 | sed 's/^/provider=/'; fi\n"})}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Expected Result:"})," 'provider' contains valid elements from 'aescbc,kms,secretbox'"]}),"\n",(0,n.jsxs)(t,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Returned Value:"})}),(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-console",children:"provider=aescbc\n"})})]}),"\n",(0,n.jsxs)(t,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Remediation:"})}),(0,n.jsx)(r.p,{children:"RKE2 always is configured to use the aescbc encryption provider to encrypt secrets.\nSecrets encryption is managed with the rke2 secrets-encrypt command line tool.\nIf needed, you can find the generated encryption config at /var/lib/rancher/rke2/server/cred/encryption-config.json"})]}),"\n",(0,n.jsx)(r.h4,{id:"1229-ensure-that-the-api-server-only-makes-use-of-strong-cryptographic-ciphers-automated",children:"1.2.29 Ensure that the API Server only makes use of Strong Cryptographic Ciphers (Automated)"}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,n.jsx)(r.p,{children:(0,n.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-bash",children:"/bin/ps -fC kube-apiserver\n"})}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Expected Result:"})," '--tls-cipher-suites' contains valid elements from 'TLS_AES_128_GCM_SHA256,TLS_AES_256_GCM_SHA384,TLS_CHACHA20_POLY1305_SHA256,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256,TLS_RSA_WITH_AES_128_GCM_SHA256,TLS_RSA_WITH_AES_256_GCM_SHA384'"]}),"\n",(0,n.jsxs)(t,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Returned Value:"})}),(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-console",children:"UID PID PPID C STIME TTY TIME CMD\nroot 2618 2570 15 22:56 ? 00:00:07 kube-apiserver --admission-control-config-file=/etc/rancher/rke2/rke2-pss.yaml --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --service-account-extend-token-expiration=false --advertise-address=10.10.10.100 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --encryption-provider-config-automatic-reload=true --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key\n"})})]}),"\n",(0,n.jsxs)(t,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Remediation:"})}),(0,n.jsxs)(r.p,{children:["By default, the RKE2 kube-apiserver complies with this test. Changes to these values may cause regression, therefore ensure that all apiserver clients support the new TLS configuration before applying it in production deployments.\nIf a custom TLS configuration is required, consider also creating a custom version of this rule that aligns with your requirements.\nIf this check fails, remove any custom configuration around ",(0,n.jsx)(r.code,{children:"tls-cipher-suites"})," or update the /etc/rancher/rke2/config.yaml file to match the default by adding the following:\nkube-apiserver-arg:"]}),(0,n.jsxs)(r.ul,{children:["\n",(0,n.jsx)(r.li,{children:'"tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305"'}),"\n"]})]}),"\n",(0,n.jsx)(r.h4,{id:"1230-ensure-that-the---service-account-extend-token-expiration-parameter-is-set-to-false-automated",children:"1.2.30 Ensure that the --service-account-extend-token-expiration parameter is set to false (Automated)"}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,n.jsx)(r.p,{children:(0,n.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-bash",children:"/bin/ps -fC kube-apiserver\n"})}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Expected Result:"})," '--service-account-extend-token-expiration' is equal to 'false'"]}),"\n",(0,n.jsxs)(t,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Returned Value:"})}),(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-console",children:"UID PID PPID C STIME TTY TIME CMD\nroot 2618 2570 15 22:56 ? 00:00:07 kube-apiserver --admission-control-config-file=/etc/rancher/rke2/rke2-pss.yaml --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --service-account-extend-token-expiration=false --advertise-address=10.10.10.100 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --encryption-provider-config-automatic-reload=true --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key\n"})})]}),"\n",(0,n.jsxs)(t,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Remediation:"})}),(0,n.jsx)(r.p,{children:"Edit the RKE2 config file /etc/rancher/rke2/config.yaml and set the --service-account-extend-token-expiration parameter to false before reloading rke2, as below:\nkube-apiserver-arg:"}),(0,n.jsxs)(r.ul,{children:["\n",(0,n.jsx)(r.li,{children:'"service-account-extend-token-expiration=false"\nBy default, this parameter is set to true.'}),"\n"]})]}),"\n",(0,n.jsx)(r.h3,{id:"13-controller-manager",children:"1.3 Controller Manager"}),"\n",(0,n.jsx)(r.h4,{id:"131-ensure-that-the---terminated-pod-gc-threshold-argument-is-set-as-appropriate-manual",children:"1.3.1 Ensure that the --terminated-pod-gc-threshold argument is set as appropriate (Manual)"}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,n.jsx)(r.p,{children:(0,n.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-bash",children:"/bin/ps -fC kube-controller-manager\n"})}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Expected Result:"})," '--terminated-pod-gc-threshold' is present"]}),"\n",(0,n.jsxs)(t,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Returned Value:"})}),(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-console",children:"UID PID PPID C STIME TTY TIME CMD\nroot 2743 2649 2 22:56 ? 00:00:01 kube-controller-manager --permit-port-sharing=true --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --b
1ind-address=127.0.0.1 --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,tokencleaner,-service,-route,-cloud-node-lifecycle --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --tls-cert-file=/var/lib/rancher/rke2/server/tls/kube-controller-manager/kube-controller-manager.crt --tls-private-key-file=/var/lib/rancher/rke2/server/tls/kube-controller-manager/kube-controller-manager.key --use-service-account-credentials=true\n"})})]}),"\n",(0,n.jsxs)(t,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Remediation:"})}),(0,n.jsx)(r.p,{children:"By default, RKE2 sets a terminated-pod-gc-threshold of 1000.\nIf you need to change this value, edit the RKE2 config file /etc/rancher/rke2/config.yaml on the control plane node\nand set the --terminated-pod-gc-threshold to an appropriate threshold,"}),(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{children:'kube-controller-manager-arg:\n - "terminated-pod-gc-threshold=10"\n'})})]}),"\n",(0,n.jsx)(r.h4,{id:"132-ensure-that-the---profiling-argument-is-set-to-false-automated",children:"1.3.2 Ensure that the --profiling argument is set to false (Automated)"}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,n.jsx)(r.p,{children:(0,n.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-bash",children:"/bin/ps -fC kube-controller-manager\n"})}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Expected Result:"})," '--profiling' is equal to 'false'"]}),"\n",(0,n.jsxs)(t,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Returned Value:"})}),(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-console",children:"UID PID PPID C STIME TTY TIME CMD\nroot 2743 2649 2 22:56 ? 00:00:01 kube-controller-manager --permit-port-sharing=true --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,tokencleaner,-service,-route,-cloud-node-lifecycle --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --tls-cert-file=/var/lib/rancher/rke2/server/tls/kube-controller-manager/kube-controller-manager.crt --tls-private-key-file=/var/lib/rancher/rke2/server/tls/kube-controller-manager/kube-controller-manager.key --use-service-account-credentials=true\n"})})]}),"\n",(0,n.jsxs)(t,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Remediation:"})}),(0,n.jsx)(r.p,{children:"By default, RKE2 sets the --profiling argument to false.\nIf this check fails, edit the RKE2 config file /etc/rancher/rke2/config.yaml and remove any lines like below."}),(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{children:'kube-controller-manager-arg:\n - "profiling=true"\n'})})]}),"\n",(0,n.jsx)(r.h4,{id:"133-ensure-that-the---use-service-account-credentials-argument-is-set-to-true-automated",children:"1.3.3 Ensure that the --use-service-account-credentials argument is set to true (Automated)"}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,n.jsx)(r.p,{children:(0,n.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-bash",children:"/bin/ps -fC kube-controller-manager\n"})}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Expected Result:"})," '--use-service-account-credentials' is not equal to 'false'"]}),"\n",(0,n.jsxs)(t,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Returned Value:"})}),(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-console",children:"UID PID PPID C STIME TTY TIME CMD\nroot 2743 2649 2 22:56 ? 00:00:01 kube-controller-manager --permit-port-sharing=true --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,tokencleaner,-service,-route,-cloud-node-lifecycle --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --tls-cert-file=/var/lib/rancher/rke2/server/tls/kube-controller-manager/kube-controller-manager.crt --tls-private-key-file=/var/lib/rancher/rke2/server/tls/kube-controller-manager/kube-controller-manager.key --use-service-account-credentials=true\n"})})]}),"\n",(0,n.jsxs)(t,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Remediation:"})}),(0,n.jsx)(r.p,{children:"By default, RKE2 sets the --use-service-account-credentials argument to true.\nIf this check fails, edit the RKE2 config file /etc/rancher/rke2/config.yaml and remove any lines like below."}),(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{children:'kube-controller-manager-arg:\n - "use-service-account-credentials=false"\n'})})]}),"\n",(0,n.jsx)(r.h4,{id:"134-ensure-that-the---service-account-private-key-file-argument-is-set-as-appropriate-automated",children:"1.3.4 Ensure that the --service-account-private-key-file argument is set as appropriate (Automated)"}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,n.jsx)(r.p,{children:(0,n.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-bash",children:"/bin/ps -fC kube-controller-manager\n"})}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Expected Result:"})," '--service-account-private-key-file' is present"]}),"\n",(0,n.jsxs)(t,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Returned Value:"})}),(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-console",children:"UID PID PPID C STIME TTY TIME CMD\nroot 2743 2649 2 22:56 ? 00:00:01 kube-controller-manager --permit-port-sharing=true --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,tokencleaner,-service,-route,-cloud-node-lifecycle --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --tls-cert-file=/var/lib/rancher/rke2/server/tls/kube-controller-manager/kube-controller-manager.crt --tls-private-key-file=/var/lib/rancher/rke2/server/tls/kube-controller-manager/kube-controller-manager.key --use-service-account-credentials=true\n"})})]}),"\n",(0,n.jsxs)(t,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Remediation:"})}),(0,n.jsx)(r.p,{children:"By default, RKE2 automatically provides the service account private key file.\nIt is generated and located at /var/lib/rancher/rke2/server/tls/service.current.key.\nIf this check fails, edit the RKE2 config file /etc/rancher/rke2/config.yaml and remove any lines like below."}),(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{children:'kube-controller-manager-arg:\n - "service-account-private-key-file=<path>"\n'})})]}),"\n",(0,n.jsx)(r.h4,{id:"135-ensure-that-the---root-ca-file-argument-is-set-as-appropriate-automated",children:"1.3.5 Ensure that the --root-ca-file argument is set as appropriate (Automated)"}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,n.jsx)(r.p,{children:(0,n.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-bash",children:"/bin/ps -fC kube-controller-manager\n"})}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Expected Result:"})," '--root-ca-file' is present"]}),"\n",(0,n.jsxs)(t,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Returned Value:"})}),(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-console",children:"UID PID PPID C STIME TTY TIME CMD\nroot 2743 2649 2 22:56 ? 00:00:01 kube-controller-manager --permit-port-sharing=true --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,tokencleaner,-service,-route,-cloud-node-lifecycle --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --tls-cert-file=/var/lib/rancher/rke2/server/tls/kube-controller-manager/kube-controller-manager.crt --tls-private-key-file=/var/lib/rancher/rke2/server/tls/kube-controller-manager/kube-controller-manager.key --use-service-account-credentials=true\n"})})]}),"\n",(0,n.jsxs)(t,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Remediation:"})}),(0,n.jsx)(r.p,{children:"By default, RKE2 automatically provides the root CA file.\nIt is generated and located at /var/lib/rancher/rke2/server/tls/server-ca.crt.\nIf for some reason you need to provide your own ca certificate, look at using the rke2 certificate command line tool.\nIf this check fails, edit the RKE2 config file /etc/rancher/rke2/config.yaml and remove any lines like below."}),(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{children:'kube-controller-manager-arg:\n - "root-ca-file=<path>"\n'})})]}),"\n",(0,n.jsx)(r.h4,{id:"136-ensure-that-the-rotatekubeletservercertificate-argument-is-set-to-true-automated",children:"1.3.6 Ensure that the RotateKubeletServerCertificate argument is set to true (Automated)"}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,n.jsx)(r.p,{children:(0,n.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-bash",children:"/bin/ps -fC kube-controller-manager\n"})}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Expected Result:"})," '--feature-gates' is present OR '--feature-gates' is not present"]}),"\n",(0,n.jsxs)(t,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Returned Value:"})}),(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-console",children:"UID PID PPID C STIME TTY TIME CMD\nroot 2743 2649 2 22:56 ? 00:00:01 kube-controller-manager --permit-port-sharing=true --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kube-apiserver-client-key-file=/v
1ar/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,tokencleaner,-service,-route,-cloud-node-lifecycle --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --tls-cert-file=/var/lib/rancher/rke2/server/tls/kube-controller-manager/kube-controller-manager.crt --tls-private-key-file=/var/lib/rancher/rke2/server/tls/kube-controller-manager/kube-controller-manager.key --use-service-account-credentials=true\n"})})]}),"\n",(0,n.jsxs)(t,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Remediation:"})}),(0,n.jsx)(r.p,{children:"By default, RKE2 does not set the RotateKubeletServerCertificate feature gate.\nIf you have enabled this feature gate, you should remove it.\nIf this check fails, edit the RKE2 config file /etc/rancher/rke2/config.yaml, remove any lines like below."}),(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{children:'kube-controller-manager-arg:\n - "feature-gate=RotateKubeletServerCertificate"\n'})})]}),"\n",(0,n.jsx)(r.h4,{id:"137-ensure-that-the---bind-address-argument-is-set-to-127001-automated",children:"1.3.7 Ensure that the --bind-address argument is set to 127.0.0.1 (Automated)"}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,n.jsx)(r.p,{children:(0,n.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-bash",children:"/bin/ps -fC kube-controller-manager\n"})}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Expected Result:"})," '--bind-address' is equal to '127.0.0.1' OR '--bind-address' is not present"]}),"\n",(0,n.jsxs)(t,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Returned Value:"})}),(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-console",children:"UID PID PPID C STIME TTY TIME CMD\nroot 2743 2649 2 22:56 ? 00:00:01 kube-controller-manager --permit-port-sharing=true --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,tokencleaner,-service,-route,-cloud-node-lifecycle --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --tls-cert-file=/var/lib/rancher/rke2/server/tls/kube-controller-manager/kube-controller-manager.crt --tls-private-key-file=/var/lib/rancher/rke2/server/tls/kube-controller-manager/kube-controller-manager.key --use-service-account-credentials=true\n"})})]}),"\n",(0,n.jsxs)(t,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Remediation:"})}),(0,n.jsx)(r.p,{children:"By default, RKE2 sets the --bind-address argument to 127.0.0.1\nIf this check fails, edit the RKE2 config file /etc/rancher/rke2/config.yaml and remove any lines like below."}),(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{children:'kube-controller-manager-arg:\n - "bind-address=<IP>"\n'})})]}),"\n",(0,n.jsx)(r.h3,{id:"14-scheduler",children:"1.4 Scheduler"}),"\n",(0,n.jsx)(r.h4,{id:"141-ensure-that-the---profiling-argument-is-set-to-false-automated",children:"1.4.1 Ensure that the --profiling argument is set to false (Automated)"}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,n.jsx)(r.p,{children:(0,n.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-bash",children:"/bin/ps -fC kube-scheduler\n"})}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Expected Result:"})," '--profiling' is equal to 'false'"]}),"\n",(0,n.jsxs)(t,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Returned Value:"})}),(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-console",children:"UID PID PPID C STIME TTY TIME CMD\nroot 2763 2674 1 22:56 ? 00:00:00 kube-scheduler --permit-port-sharing=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/scheduler.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/scheduler.kubeconfig --bind-address=127.0.0.1 --kubeconfig=/var/lib/rancher/rke2/server/cred/scheduler.kubeconfig --profiling=false --secure-port=10259 --tls-cert-file=/var/lib/rancher/rke2/server/tls/kube-scheduler/kube-scheduler.crt --tls-private-key-file=/var/lib/rancher/rke2/server/tls/kube-scheduler/kube-scheduler.ke
1y\n"})})]}),"\n",(0,n.jsxs)(t,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Remediation:"})}),(0,n.jsx)(r.p,{children:"By default, RKE2 sets the --profiling argument to false.\nIf this check fails, edit the RKE2 config file /etc/rancher/rke2/config.yaml and remove any lines like below."}),(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{children:'kube-scheduler-arg:\n - "profiling=true"\n'})})]}),"\n",(0,n.jsx)(r.h4,{id:"142-ensure-that-the---bind-address-argument-is-set-to-127001-automated",children:"1.4.2 Ensure that the --bind-address argument is set to 127.0.0.1 (Automated)"}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,n.jsx)(r.p,{children:(0,n.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-bash",children:"/bin/ps -fC kube-scheduler\n"})}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Expected Result:"})," '--bind-address' is equal to '127.0.0.1' OR '--bind-address' is not present"]}),"\n",(0,n.jsxs)(t,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Returned Value:"})}),(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-console",children:"UID PID PPID C STIME TTY TIME CMD\nroot 2763 2674 1 22:56 ? 00:00:00 kube-scheduler --permit-port-sharing=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/scheduler.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/scheduler.kubeconfig --bind-address=127.0.0.1 --kubeconfig=/var/lib/rancher/rke2/server/cred/scheduler.kubeconfig --profiling=false --secure-port=10259 --tls-cert-file=/var/lib/rancher/rke2/server/tls/kube-scheduler/kube-scheduler.crt --tls-private-key-file=/var/lib/rancher/rke2/server/tls/kube-scheduler/kube-scheduler.key\n"})})]}),"\n",(0,n.jsxs)(t,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Remediation:"})}),(0,n.jsx)(r.p,{children:"By default, RKE2 sets the --bind-address argument to 127.0.0.1\nIf this check fails, edit the RKE2 config file /etc/rancher/rke2/config.yaml and remove any lines like below."}),(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{children:'kube-scheduler-arg:\n - "bind-address=<IP>"\n'})})]}),"\n",(0,n.jsx)(r.h2,{id:"2-etcd-node-configuration",children:"2 Etcd Node Configuration"}),"\n",(0,n.jsx)(r.h3,{id:"2-etcd-node-configuration-1",children:"2 Etcd Node Configuration"}),"\n",(0,n.jsx)(r.h4,{id:"21-ensure-that-the---cert-file-and---key-file-arguments-are-set-as-appropriate-automated",children:"2.1 Ensure that the --cert-file and --key-file arguments are set as appropriate (Automated)"}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,n.jsx)(r.p,{children:(0,n.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-bash",children:"cat /var/lib/rancher/rke2/server/db/etcd/config\n"})}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Expected Result:"})," '.client-transport-security.cert-file' is equal to '/var/lib/rancher/rke2/server/tls/etcd/server-client.crt' AND '.client-transport-security.key-file' is equal to '/var/lib/rancher/rke2/server/tls/etcd/server-client.key'"]}),"\n",(0,n.jsxs)(t,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Returned Value:"})}),(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-console",children:"advertise-client-urls: https://10.10.10.100:2379\nclient-transport-security:\n cert-file: /var/lib/rancher/rke2/server/tls/etcd/server-client.crt\n client-cert-auth: true\n key-file: /var/lib/rancher/rke2/server/tls/etcd/server-client.key\n trusted-ca-file: /var/lib/rancher/rke2/server/tls/etcd/server-ca.crt\ndata-dir: /var/lib/rancher/rke2/server/db/etcd\nelection-timeout: 5000\nexperimental-initial-corrupt-check: true\nexperimental-watch-progress-notify-interval: 5000000000\nheartbeat-interval: 500\ninitial-advertise-peer-urls: https://10.10.10.100:2380\ninitial-cluster: server-0-a61e699a=https://10.10.10.100:2380\ninitial-cluster-state: new\nlisten-client-http-urls: https://127.0.0.1:2382\nlisten-client-urls: https://127.0.0.1:2379,https://10.10.10.100:2379\nlisten-metrics-urls: http://127.0.0.1:2381\nlisten-peer-urls: https://127.0.0.1:2380,https://10.10.10.100:2380\nlog-outputs:\n- stderr\nlogger: zap\nname: server-0-a61e699a\npeer-transport-security:\n cert-file: /var/lib/rancher/rke2/server/tls/etcd/peer-server-client.crt\n client-cert-auth: true\n key-file: /var/lib/rancher/rke2/server/tls/etcd/peer-server-client.key\n trusted-ca-file: /var/lib/rancher/rke2/server/tls/etcd/peer-ca.crt\nsnapshot-count: 10000\nsocket-options:\n reuse-address: true\n reuse-port: true\n"})})]}),"\n",(0,n.jsxs)(t,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Remediation:"})}),(0,n.jsx)(r.p,{children:"By default, RKE2 generates cert and key files for etcd.\nThese are located in /var/lib/rancher/rke2/server/tls/etcd/.\nIf this check fails, ensure that the configuration file /var/lib/rancher/rke2/server/db/etcd/config\nhas not been modified to use custom cert and key files."})]}),"\n",(0,n.jsx)(r.h4,{id:"22-ensure-that-the---client-cert-auth-argument-is-set-to-true-automated",children:"2.2 Ensure that the --client-cert-auth argument is set to true (Automated)"}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,n.jsx)(r.p,{children:(0,n.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-bash",children:"cat /var/lib/rancher/rke2/server/db/etcd/config\n"})}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Expected Result:"})," 'ETCD_CLIENT_CERT_AUTH' is present OR '.client-transport-security.client-cert-auth' is equal to 'true'"]}),"\n",(0,n.jsxs)(t,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Returned Value:"})}),(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-console",children:"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\nHOSTNAME=server-0\nETCD_UNSUPPORTED_ARCH=\nFILE_HASH=559cb026ffd87f20b619a57cf1b4114f5cf3caaa15201b1c4310a26c4a145a8b\nNO_PROXY=.svc,.cluster.local,10.42.0.0/16,10.43.0.0/16\nHOME=/\n"})})]}),"\n",(0,n.jsxs)(t,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Remediation:"})}),(0,n.jsx)(r.p,{children:"By default, RKE2 sets the --client-cert-auth parameter to true.\nIf this check fails, ensure that the configuration file /var/lib/rancher/rke2/server/db/etcd/config\nhas not been modified to disable client certificate authentication."})]}),"\n",(0,n.jsx)(r.h4,{id:"23-ensure-that-the---auto-tls-argument-is-not-set-to-true-automated",children:"2.3 Ensure that the --auto-tls argument is not set to true (Automated)"}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,n.jsx)(r.p,{children:(0,n.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-bash",children:"cat /var/lib/rancher/rke2/server/db/etcd/config\n"})}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Expected Result:"})," 'ETCD_AUTO_TLS' is not present OR 'ETCD_AUTO_TLS' is present OR '.client-transport-security.auto-tls' is present"]}),"\n",(0,n.jsxs)(t,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Returned Value:"})}),(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-console",children:"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\nHOSTNAME=server-0\nETCD_UNSUPPORTED_ARCH=\nFILE_HASH=559cb026ffd87f20b619a57cf1b4114f5cf3caaa15201b1c4310a26c4a145a8b\nNO_PROXY=.svc,.cluster.local,10.42.0.0/16,10.43.0.0/16\nHOME=/\n"})})]}),"\n",(0,n.jsxs)(t,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Remediation:"})}),(0,n.jsx)(r.p,{children:"By default, RKE2 does not set the --auto-tls parameter.\nIf this check fails, edit the etcd pod specification file /var/lib/rancher/rke2/server/db/etcd/config on the master\nnode and either remove the --auto-tls parameter or set it to false.\nclient-transport-security:\nauto-tls: false"})]}),"\n",(0,n.jsx)(r.h4,{id:"24-ensure-that-the---peer-cert-file-and---peer-key-file-arguments-are-set-as-appropriate-automated",children:"2.4 Ensure that the --peer-cert-file and --peer-key-file arguments are set as appropriate (Automated)"}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,n.jsx)(r.p,{children:(0,n.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-bash",children:"cat /var/lib/rancher/rke2/server/db/etcd/config\n"})}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Expected Result:"})," '.peer-transport-security.cert-file' is equal to '/var/lib/rancher/rke2/server/tls/etcd/peer-server-client.crt' AND '.peer-transport-security.key-file' is equal to '/var/lib/rancher/rke2/server/tls/etcd/peer-server-client.key'"]}),"\n",(0,n.jsxs)(t,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Returned Value:"})}),(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-console",children:"advertise-client-urls: https://10.10.10.100:2379\nclient-transport-security:\n cert-file: /var/lib/rancher/rke2/server/tls/etcd/server-client.crt\n client-cert-auth: true\n key-file: /var/lib/rancher/rke2/server/tls/etcd/server-client.key\n trusted-ca-file: /var/lib/rancher/rke2/server/tls/etcd/server-ca.crt\ndata-dir: /var/lib/rancher/rke2/server/db/etcd\nelection-timeout: 5000\nexperimental-initial-corrupt-check: true\nexperimental-watch-progress-notify-interval: 5000000000\nheartbeat-interval: 500\ninitial-advertise-peer-urls: https://10.10.10.100:2380\ninitial-cluster: server-0-a61e699a=https://10.10.10.100:2380\ninitial-cluster-state: new\nlisten-client-http-urls: https://127.0.0.1:2382\nlisten-client-urls: https://127.0.0.1:2379,https://10.10.10.100:2379\nlisten-metrics-urls: http://127.0.0.1:2381\nlisten-peer-urls: https://127.0.0.1:2380,https://10.10.10.100:2380\nlog-outputs:\n- stderr\nlogger: zap\nname: server-0-a61e699a\npeer-transport-security:\n cert-file: /var/lib/rancher/rke2/server/tls/etcd/peer-server-client.crt\n client-cert-auth: true\n key-file: /var/lib/rancher/rke2/server/tls/etcd/peer-server-client.key\n trusted-ca-file: /var/lib/rancher/rke2/server/tls/etcd/peer-ca.crt\nsnapshot-count: 10000\nsocket-options:\n reuse-address: true\n reuse-port: true\n"})})]}),"\n",(0,n.jsxs)(t,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Remediation:"})}),(0,n.jsx)(r.p,{children:"By default, RKE2 generates peer cert and key files for etcd.\nThese are located in /var/lib/rancher/rke2/server/tls/etcd/.\nIf this check fails, ensure that the configuration file /var/lib/rancher/rke2/server/db/etcd/config\nhas not been modified to use custom peer cert and key files."})]}),"\n",(0,n.jsx)(r.h4,{id:"25-ensure-that-the---peer-client-cert-auth-argument-is-set-to-true-automated",children:"2.5 Ensure that the --peer-client-cert-auth argument is set to true (Automated)"}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,n.jsx)(r.p,{children:(0,n.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-bash",children:"cat /var/lib/rancher/rke2/server/db/etcd/config\n"})}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Expected Result:"})," 'ETCD_PEER_CLIENT_CERT_AUTH' is present OR '.peer-transport-security.client-cert-auth' is equal to 'true'"]}),"\n",(0,n.jsxs)(t,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Returned Value:"})}),(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-console",children:"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\nHOSTNAME=server-0\nETCD_UNSUPPORTED_ARCH=\nFILE_HASH=559cb026ffd87f20b619a57cf1b4114f5cf3caaa15201b1c4310a26c4a145a8b\nNO_PROXY=.svc,.cluster.local,10.42.0.0/16,10.43.0.0/16\nHOME=/\n"})})]}),"\n",(0,n.jsxs)(t,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Remediation:"})}),(0,n.jsx)(r.p,{children:"By default, RKE2 sets the --peer-cert-auth parameter to true.\nIf this check fails, ensure that the configuration file /var/lib/rancher/rke2/server/db/etcd/config\nhas not been modified to disable peer client certificate authentication."})]}),"\n",(0,n.jsx)(r.h4,{id:"26-ensure-that-the---peer-auto-tls-argument-is-not-set-to-true-automated",children:"2.6 Ensure that the --peer-auto-tls argument is not set to true (Automated)"}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,n.jsx)(r.p,{children:(0,n.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-bash",children:"cat /var/lib/rancher/rke2/server/db/etcd/config\n"})}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Expected Result:"})," 'ETCD_PEER_AUTO_TLS' is not present OR 'ETCD_PEER_AUTO_TLS' is present OR '.peer-transport-security.auto-tls' is present"]}),"\n",(0,n.jsxs)(t,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Returned Value:"})}),(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-console",children:"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\nHOSTNAME=server-0\nETCD_UNSUPPORTED_ARCH=\nFILE_HASH=559cb026ffd87f20b619a57cf1b4114f5cf3caaa15201b1c4310a26c4a145a8b\nNO_PROXY=.svc,.cluster.local,10.42.0.0/16,10.43.0.0/16\nHOME=/\n"})})]}),"\n",(0,n.jsxs)(t,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Remediation:"})}),(0,n.jsx)(r.p,{children:"By default, RKE2 does not set the --peer-auto-tls parameter.\nIf this check fails, edit the etcd pod specification file /var/lib/rancher/rke2/server/db/etcd/config on the master\nnode and either remove the --peer-auto-tls parameter or set it to false.\npeer-transport-security:\nauto-tls: false"})]}
1),"\n",(0,n.jsx)(r.h4,{id:"27-ensure-that-a-unique-certificate-authority-is-used-for-etcd-automated",children:"2.7 Ensure that a unique Certificate Authority is used for etcd (Automated)"}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,n.jsx)(r.p,{children:(0,n.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-bash",children:"cat /var/lib/rancher/rke2/server/db/etcd/config\n"})}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Expected Result:"})," 'ETCD_TRUSTED_CA_FILE' is present OR '.peer-transport-security.trusted-ca-file' is equal to '/var/lib/rancher/rke2/server/tls/etcd/peer-ca.crt'"]}),"\n",(0,n.jsxs)(t,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Returned Value:"})}),(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-console",children:"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\nHOSTNAME=server-0\nETCD_UNSUPPORTED_ARCH=\nFILE_HASH=559cb026ffd87f20b619a57cf1b4114f5cf3caaa15201b1c4310a26c4a145a8b\nNO_PROXY=.svc,.cluster.local,10.42.0.0/16,10.43.0.0/16\nHOME=/\n"})})]}),"\n",(0,n.jsxs)(t,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Remediation:"})}),(0,n.jsx)(r.p,{children:"By default, RKE2 generates a unique certificate authority for etcd.\nThis is located at /var/lib/rancher/rke2/server/tls/etcd/peer-ca.crt.\nIf this check fails, ensure that the configuration file /var/lib/rancher/rke2/server/db/etcd/config\nhas not been modified to use a shared certificate authority."})]}),"\n",(0,n.jsx)(r.h2,{id:"3-control-plane-configuration",children:"3 Control Plane Configuration"}),"\n",(0,n.jsx)(r.h3,{id:"31-authentication-and-authorization",children:"3.1 Authentication and Authorization"}),"\n",(0,n.jsx)(r.h4,{id:"311-client-certificate-authentication-should-not-be-used-for-users-manual",children:"3.1.1 Client certificate authentication should not be used for users (Manual)"}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Remediation:"}),"\nAlternative mechanisms provided by Kubernetes such as the use of OIDC should be\nimplemented in place of client certificates."]}),"\n",(0,n.jsx)(r.h4,{id:"312-service-account-token-authentication-should-not-be-used-for-users-manual",children:"3.1.2 Service account token authentication should not be used for users (Manual)"}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Remediation:"}),"\nAlternative mechanisms provided by Kubernetes such as the use of OIDC should be implemented\nin place of service account tokens."]}),"\n",(0,n.jsx)(r.h4,{id:"313-bootstrap-token-authentication-should-not-be-used-for-users-manual",children:"3.1.3 Bootstrap token authentication should not be used for users (Manual)"}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Remediation:"}),"\nAlternative mechanisms provided by Kubernetes such as the use of OIDC should be implemented\nin place of bootstrap tokens."]}),"\n",(0,n.jsx)(r.h3,{id:"32-logging",children:"3.2 Logging"}),"\n",(0,n.jsx)(r.h4,{id:"321-ensure-that-a-minimal-audit-policy-is-created-automated",children:"3.2.1 Ensure that a minimal audit policy is created (Automated)"}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,n.jsx)(r.p,{children:(0,n.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-bash",children:"/bin/ps -ef | grep kube-apiserver | grep -v grep\n"})}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Expected Result:"})," '--audit-policy-file' is present"]}),"\n",(0,n.jsxs)(t,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Returned Value:"})}),(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-console",children:"root 2618 2570 15 22:56 ? 00:00:06 kube-apiserver --admission-control-config-file=/etc/rancher/rke2/rke2-pss.yaml --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --service-account-extend-token-expiration=false --advertise-address=10.10.10.100 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --encryption-provider-config-automatic-reload=true --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key\nroot 2743 2649 2 22:56 ? 00:00:01 kube-controller-manager --permit-port-sharing=true --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,tokencleaner,-service,-route,-cloud-node-lifecycle --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --tls-cert-file=/var/lib/rancher/rke2/server/tls/kube-controller-manager/kube-controller-manager.crt --tls-private-key-file=/var/lib/rancher/rke2/server/tls/kube-controller-manager/kube-controller-manager.key --use-service-account-credentials=true\nroot 6175 2570 14 22:57 ? 00:00:00 kubectl get --server=https://localhost:6443/ --client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --raw=/readyz\n"})})]}),"\n",(0,n.jsxs)(t,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Remediation:"})}),(0,n.jsx)(r.p,{children:"Create an audit policy file for your cluster."})]}),"\n",(0,n.jsx)(r.h4,{id:"322-ensure-that-the-audit-policy-covers-key-security-concerns-manual",children:"3.2.2 Ensure that the audit policy covers key security concerns (Manual)"}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Remediation:"}),"\nReview the audit policy provided for the cluster and ensure that it covers\nat least the following areas,"]}),"\n",(0,n.jsxs)(r.ul,{children:["\n",(0,n.jsx)(r.li,{children:"Access to Secrets managed by the cluster. Care should be taken to only\nlog Metadata for requests to Secrets, ConfigMaps, and TokenReviews, in\norder to avoid risk of logging sensitive data."}),"\n",(0,n.jsx)(r.li,{children:"Modification of Pod and Deployment objects."}),"\n",(0,n.jsxs)(r.li,{children:["Use of ",(0,n.jsx)(r.code,{children:"pods/exec"}),", ",(0,n.jsx)(r.code,{children:"pods/portforward"}),", ",(0,n.jsx)(r.code,{children:"pods/proxy"})," and ",(0,n.jsx)(r.code,{children:"services/proxy"}),".\nFor most requests, minimally logging at the Metadata level is recommended\n(the most basic level of logging)."]}),"\n"]}
1),"\n",(0,n.jsx)(r.h2,{id:"4-worker-node-security-configuration",children:"4 Worker Node Security Configuration"}),"\n",(0,n.jsx)(r.h3,{id:"41-worker-node-configuration-files",children:"4.1 Worker Node Configuration Files"}),"\n",(0,n.jsx)(r.h4,{id:"411-ensure-that-the-kubelet-service-file-permissions-are-set-to-600-or-more-restrictive-automated",children:"4.1.1 Ensure that the kubelet service file permissions are set to 600 or more restrictive (Automated)"}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," Not Applicable"]}),"\n",(0,n.jsx)(r.p,{children:(0,n.jsx)(r.strong,{children:"Rationale:"})}),"\n",(0,n.jsx)(r.p,{children:"The kubelet is managed by the RKE2 process. There is no kubelet service file, all configuration is passed in as arguments at runtime."}),"\n",(0,n.jsxs)(r.h4,{id:"412-ensure-that-the-kubelet-service-file-ownership-is-set-to-root-automated",children:["4.1.2 Ensure that the kubelet service file ownership is set to root",":root"," (Automated)"]}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," Not Applicable"]}),"\n",(0,n.jsx)(r.p,{children:(0,n.jsx)(r.strong,{children:"Rationale:"})}),"\n",(0,n.jsx)(r.p,{children:"The kubelet is managed by the RKE2 process. There is no kubelet service file, all configuration is passed in as arguments at runtime."}),"\n",(0,n.jsx)(r.h4,{id:"413-if-proxy-kubeconfig-file-exists-ensure-permissions-are-set-to-600-or-more-restrictive-automated",children:"4.1.3 If proxy kubeconfig file exists ensure permissions are set to 600 or more restrictive (Automated)"}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,n.jsx)(r.p,{children:(0,n.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-bash",children:"/bin/sh -c 'if test -e /var/lib/rancher/rke2/agent/kubeproxy.kubeconfig; then stat -c permissions=%a /var/lib/rancher/rke2/agent/kubeproxy.kubeconfig;
1 fi' \n"})}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Expected Result:"})," permissions has permissions 600, expected 600 or more restrictive"]}),"\n",(0,n.jsxs)(t,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Returned Value:"})}),(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-console",children:"permissions=600\n"})})]}),"\n",(0,n.jsxs)(t,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Remediation:"})}),(0,n.jsxs)(r.p,{children:["Run the below command (based on the file location on your system) on the each worker node.\nFor example,\n",(0,n.jsx)(r.code,{children:"chmod 600 /var/lib/rancher/rke2/agent/kubeproxy.kubeconfig"})]})]}),"\n",(0,n.jsxs)(r.h4,{id:"414-if-proxy-kubeconfig-file-exists-ensure-ownership-is-set-to-root-automated",children:["4.1.4 If proxy kubeconfig file exists ensure ownership is set to root",":root"," (Automated)"]}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,n.jsx)(r.p,{children:(0,n.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-bash",children:"/bin/sh -c 'if test -e /var/lib/rancher/rke2/agent/kubeproxy.kubeconfig; then stat -c %U:%G /var/lib/rancher/rke2/agent/kubeproxy.kubeconfig;
1 fi' \n"})}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Expected Result:"})," 'root",":root","' is present"]}),"\n",(0,n.jsxs)(t,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Returned Value:"})}),(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-console",children:"root:root\n"})})]}),"\n",(0,n.jsxs)(t,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Remediation:"})}),(0,n.jsxs)(r.p,{children:["Run the below command (based on the file location on your system) on the each worker node.\nFor example, ",(0,n.jsx)(r.code,{children:"chown root:root /var/lib/rancher/rke2/agent/kubeproxy.kubeconfig"})]})]}),"\n",(0,n.jsx)(r.h4,{id:"415-ensure-that-the---kubeconfig-kubeletconf-file-permissions-are-set-to-600-or-more-restrictive-automated",children:"4.1.5 Ensure that the --kubeconfig kubelet.conf file permissions are set to 600 or more restrictive (Automated)"}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,n.jsx)(r.p,{children:(0,n.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-bash",children:"/bin/sh -c 'if test -e /var/lib/rancher/rke2/agent/kubelet.kubeconfig; then stat -c permissions=%a /var/lib/rancher/rke2/agent/kubelet.kubeconfig;
1 fi' \n"})}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Expected Result:"})," permissions has permissions 600, expected 600 or more restrictive"]}),"\n",(0,n.jsxs)(t,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Returned Value:"})}),(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-console",children:"permissions=600\n"})})]}),"\n",(0,n.jsxs)(t,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Remediation:"})}),(0,n.jsxs)(r.p,{children:["Run the below command (based on the file location on your system) on the each worker node.\nFor example,\n",(0,n.jsx)(r.code,{children:"chmod 600 /var/lib/rancher/rke2/agent/kubelet.kubeconfig"})]})]}),"\n",(0,n.jsxs)(r.h4,{id:"416-ensure-that-the---kubeconfig-kubeletconf-file-ownership-is-set-to-root-automated",children:["4.1.6 Ensure that the --kubeconfig kubelet.conf file ownership is set to root",":root"," (Automated)"]}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,n.jsx)(r.p,{children:(0,n.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-bash",children:"/bin/sh -c 'if test -e /var/lib/rancher/rke2/agent/kubelet.kubeconfig; then stat -c %U:%G /var/lib/rancher/rke2/agent/kubelet.kubeconfig;
1 fi' \n"})}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Expected Result:"})," 'root",":root","' is equal to 'root",":root","'"]}),"\n",(0,n.jsxs)(t,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Returned Value:"})}),(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-console",children:"root:root\n"})})]}),"\n",(0,n.jsxs)(t,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Remediation:"})}),(0,n.jsxs)(r.p,{children:["Run the below command (based on the file location on your system) on the each worker node.\nFor example,\n",(0,n.jsx)(r.code,{children:"chown root:root /var/lib/rancher/rke2/agent/kubelet.kubeconfig"})]})]}),"\n",(0,n.jsx)(r.h4,{id:"417-ensure-that-the-certificate-authorities-file-permissions-are-set-to-600-or-more-restrictive-automated",children:"4.1.7 Ensure that the certificate authorities file permissions are set to 600 or more restrictive (Automated)"}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,n.jsx)(r.p,{children:(0,n.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-bash",children:"/bin/sh -c 'if test -e /var/lib/rancher/rke2/agent/client-ca.crt; then stat -c permissions=%a /var/lib/rancher/rke2/agent/client-ca.crt; fi' \n"})}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Expected Result:"})," permissions has permissions 600, expected 600 or more restrictive"]}),"\n",(0,n.jsxs)(t,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Returned Value:"})}),(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-console",children:"permissions=600\n"})})]}),"\n",(0,n.jsxs)(t,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Remediation:"})}),(0,n.jsxs)(r.p,{children:["Run the below command (based on the file location on your system) on the each worker node.\nFor example,\n",(0,n.jsx)(r.code,{children:"chmod 600 /var/lib/rancher/rke2/agent/client-ca.crt"})]})]}),"\n",(0,n.jsxs)(r.h4,{id:"418-ensure-that-the-client-certificate-authorities-file-ownership-is-set-to-root-automated",children:["4.1.8 Ensure that the client certificate authorities file ownership is set to root",":root"," (Automated)"]}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,n.jsx)(r.p,{children:(0,n.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-bash",children:"/bin/sh -c 'if test -e /var/lib/rancher/rke2/agent/client-ca.crt; then stat -c %U:%G /var/lib/rancher/rke2/agent/client-ca.crt; fi' \n"})}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Expected Result:"})," 'root",":root","' is equal to 'root",":root","'"]}),"\n",(0,n.jsxs)(t,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Returned Value:"})}),(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-console",children:"root:root\n"})})]}),"\n",(0,n.jsxs)(t,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Remediation:"})}),(0,n.jsxs)(r.p,{children:["Run the following command to modify the ownership of the --client-ca-file.\n",(0,n.jsx)(r.code,{children:"chown root:root /var/lib/rancher/rke2/agent/client-ca.crt"})]})]}),"\n",(0,n.jsx)(r.h4,{id:"419-if-the-kubelet-configyaml-configuration-file-is-being-used-validate-permissions-set-to-600-or-more-restrictive-automated",children:"4.1.9 If the kubelet config.yaml configuration file is being used validate permissions set to 600 or more restrictive (Automated)"}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," Not Applicable"]}),"\n",(0,n.jsx)(r.p,{children:(0,n.jsx)(r.strong,{children:"Rationale:"})}),"\n",(0,n.jsx)(r.p,{children:"The kubelet is managed by the RKE2 process. There is no kubelet config file, all configuration is passed in as arguments at runtime."}),"\n",(0,n.jsxs)(r.h4,{id:"4110-if-the-kubelet-configyaml-configuration-file-is-being-used-validate-file-ownership-is-set-to-root-automated",children:["4.1.10 If the kubelet config.yaml configuration file is being used validate file ownership is set to root",":root"," (Automated)"]}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," Not Applicable"]}),"\n",(0,n.jsx)(r.p,{children:(0,n.jsx)(r.strong,{children:"Rationale:"})}),"\n",(0,n.jsx)(r.p,{children:"The kubelet is managed by the RKE2 process. There is no kubelet config file, all configuration is passed in as arguments at runtime."}),"\n",(0,n.jsx)(r.h3,{id:"42-kubelet",children:"4.2 Kubelet"}),"\n",(0,n.jsx)(r.h4,{id:"421-ensure-that-the---anonymous-auth-argument-is-set-to-false-automated",children:"4.2.1 Ensure that the --anonymous-auth argument is set to false (Automated)"}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,n.jsx)(r.p,{children:(0,n.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-bash",children:"/bin/cat /var/lib/rancher/rke2/agent/etc/kubelet.conf.d/00-rke2-defaults.conf\n"})}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Expected Result:"})," '.authentication.anonymous.enabled' is equal to 'false'"]}),"\n",(0,n.jsxs)(t,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Returned Value:"})}),(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-console",children:'address: 0.0.0.0\napiVersion: kubelet.config.k8s.io/v1beta1\nauthentication:\n anonymous:\n enabled: false\n webhook:\n cacheTTL: 2m0s\n enabled: true\n x509:\n clientCAFile: /var/lib/rancher/rke2/agent/client-ca.crt\nauthorization:\n mode: Webhook\n webhook:\n cacheAuthorizedTTL: 5m0s\n cacheUnauthorizedTTL: 30s\ncgroupDriver: systemd\nclusterDNS:\n- 10.43.0.10\nclusterDomain: cluster.local\ncontainerRuntimeEndpoint: unix:///run/k3s/containerd/containerd.sock\ncpuManagerReconcilePeriod: 10s\ncrashLoopBackOff: {}\nevictionHard:\n imagefs.available: 5%\n nodefs.available: 5%\nevictionMinimumReclaim:\n imagefs.available: 10%\n nodefs.available: 10%\nevictionPressureTransitionPeriod: 5m0s\nfailSwapOn: false\nfileCheckFrequency: 20s\nhealthzBindAddress: 127.0.0.1\nhttpCheckFrequency: 20s\nimageMaximumGCAge: 0s\nimageMinimumGCAge: 2m0s\nkind: KubeletConfiguration\nlogging:\n flushFrequency: 5s\n format: text\n options:\n json:\n infoBufferSize: "0"\n text:\n infoBufferSize: "0"\n verbosity: 0\nmemorySwap: {}\nnodeStatusReportFrequency: 5m0s\nnodeStatusUpdateFrequency: 10s\nprotectKernelDefaults: true\nresolvConf: /run/systemd/resolve/resolv.conf\nruntimeRequestTimeout: 2m0s\nserializeImagePulls: false\nshutdownGracePeriod: 0s\nshutdownGracePeriodCriticalPods: 0s\nstaticPodPath: /var/lib/rancher/rke2/agent/pod-manifests\nstreamingConnectionIdleTimeout: 4h0m0s\nsyncFrequency: 1m0s\ntlsCertFile: /var/lib/rancher/rke2/agent/serving-kubelet.crt\ntlsPrivateKeyFile: /var/lib/rancher/rke2/agent/serving-kubelet.key\nvolumeStatsAggPeriod: 1m0s\n'})})]}),"\n",(0,n.jsxs)(t,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Remediation:"})}),(0,n.jsx)(r.p,{children:"By default, RKE2 sets the --anonymous-auth to fal
1se.\nIf this check fails, edit the RKE2 config file /etc/rancher/rke2/config.yaml, remove any lines similar to below."}),(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{children:'kubelet-arg:\n - "anonymous-auth=true"\n'})}),(0,n.jsx)(r.p,{children:"Based on your system, restart the RKE2 service. For example,\nsystemctl restart rke2-server.service"})]}),"\n",(0,n.jsx)(r.h4,{id:"422-ensure-that-the---authorization-mode-argument-is-not-set-to-alwaysallow-automated",children:"4.2.2 Ensure that the --authorization-mode argument is not set to AlwaysAllow (Automated)"}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,n.jsx)(r.p,{children:(0,n.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-bash",children:"/bin/cat /var/lib/rancher/rke2/agent/etc/kubelet.conf.d/00-rke2-defaults.conf\n"})}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Expected Result:"})," '.authorization.mode' does not have 'AlwaysAllow'"]}),"\n",(0,n.jsxs)(t,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Returned Value:"})}),(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-console",children:'address: 0.0.0.0\napiVersion: kubelet.config.k8s.io/v1beta1\nauthentication:\n anonymous:\n enabled: false\n webhook:\n cacheTTL: 2m0s\n enabled: true\n x509:\n clientCAFile: /var/lib/rancher/rke2/agent/client-ca.crt\nauthorization:\n mode: Webhook\n webhook:\n cacheAuthorizedTTL: 5m0s\n cacheUnauthorizedTTL: 30s\ncgroupDriver: systemd\nclusterDNS:\n- 10.43.0.10\nclusterDomain: cluster.local\ncontainerRuntimeEndpoint: unix:///run/k3s/containerd/containerd.sock\ncpuManagerReconcilePeriod: 10s\ncrashLoopBackOff: {}\nevictionHard:\n imagefs.available: 5%\n nodefs.available: 5%\nevictionMinimumReclaim:\n imagefs.available: 10%\n nodefs.available: 10%\nevictionPressureTransitionPeriod: 5m0s\nfailSwapOn: false\nfileCheckFrequency: 20s\nhealthzBindAddress: 127.0.0.1\nhttpCheckFrequency: 20s\nimageMaximumGCAge: 0s\nimageMinimumGCAge: 2m0s\nkind: KubeletConfiguration\nlogging:\n flushFrequency: 5s\n format: text\n options:\n json:\n infoBufferSize: "0"\n text:\n infoBufferSize: "0"\n verbosity: 0\nmemorySwap: {}\nnodeStatusReportFrequency: 5m0s\nnodeStatusUpdateFrequency: 10s\nprotectKernelDefaults: true\nresolvConf: /run/systemd/resolve/resolv.conf\nruntimeRequestTimeout: 2m0s\nserializeImagePulls: false\nshutdownGracePeriod: 0s\nshutdownGracePeriodCriticalPods: 0s\nstaticPodPath: /var/lib/rancher/rke2/agent/pod-manifests\nstreamingConnectionIdleTimeout: 4h0m0s\nsyncFrequency: 1m0s\ntlsCertFile: /var/lib/rancher/rke2/agent/serving-kubelet.crt\ntlsPrivateKeyFile: /var/lib/rancher/rke2/agent/serving-kubelet.key\nvolumeStatsAggPeriod: 1m0s\n'})})]}),"\n",(0,n.jsxs)(t,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Remediation:"})}),(0,n.jsx)(r.p,{children:"By default, RKE2 does not set the --authorization-mode to AlwaysAllow.\nIf this check fails, edit the RKE2 config file /etc/rancher/rke2/config.yaml, remove any lines similar to below."}),(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{children:'kubelet-arg:\n - "authorization-mode=AlwaysAllow"\n'})}),(0,n.jsx)(r.p,{children:"Based on your system, restart the RKE2 service. For example,\nsystemctl restart rke2-server.service"})]}),"\n",(0,n.jsx)(r.h4,{id:"423-ensure-that-the---client-ca-file-argument-is-set-as-appropriate-automated",children:"4.2.3 Ensure that the --client-ca-file argument is set as appropriate (Automated)"}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,n.jsx)(r.p,{children:(0,n.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-bash",children:"/bin/cat /var/lib/rancher/rke2/agent/etc/kubelet.conf.d/00-rke2-defaults.conf\n"})}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Expected Result:"})," '.authentication.x509.clientCAFile' is present"]}),"\n",(0,n.jsxs)(t,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Returned Value:"})}),(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-console",children:'address: 0.0.0.0\napiVersion: kubelet.config.k8s.io/v1beta1\nauthentication:\n anonymous:\n enabled: false\n webhook:\n cacheTTL: 2m0s\n enabled: true\n x509:\n clientCAFile: /var/lib/rancher/rke2/agent/client-ca.crt\nauthorization:\n mode: Webhook\n webhook:\n cacheAuthorizedTTL: 5m0s\n cacheUnauthorizedTTL: 30s\ncgroupDriver: systemd\nclusterDNS:\n- 10.43.0.10\nclusterDomain: cluster.local\ncontainerRuntimeEndpoint: unix:///run/k3s/containerd/containerd.sock\ncpuManagerReconcilePeriod: 10s\ncrashLoopBackOff: {}\nevictionHard:\n imagefs.available: 5%\n nodefs.available: 5%\nevictionMinimumReclaim:\n imagefs.available: 10%\n nodefs.available: 10%\nevictionPressureTransitionPeriod: 5m0s\nfailSwapOn: false\nfileCheckFrequency: 20s\nhealthzBindAddress: 127.0.0.1\nhttpCheckFrequency: 20s\nimageMaximumGCAge: 0s\nimageMinimumGCAge: 2m0s\nkind: KubeletConfiguration\nlogging:\n flushFrequency: 5s\n format: text\n options:\n json:\n infoBufferSize: "0"\n text:\n infoBufferSize: "0"\n verbosity: 0\nmemorySwap: {}\nnodeStatusReportFrequency: 5m0s\nnodeStatusUpdateFrequency: 10s\nprotectKernelDefaults: true\nresolvConf: /run/systemd/resolve/resolv.conf\nruntimeRequestTimeout: 2m0s\nserializeImagePulls: false\nshutdownGracePeriod: 0s\nshutdownGracePeriodCriticalPods: 0s\nstaticPodPath: /var/lib/rancher/rke2/agent/pod-manifests\nstreamingConnectionIdleTimeout: 4h0m0s\nsyncFrequency: 1m0s\ntlsCertFile: /var/lib/rancher/rke2/agent/serving-kubelet.crt\ntlsPrivateKeyFile: /var/lib/rancher/rke2/agent/serving-kubelet.key\nvolumeStatsAggPeriod: 1m0s\n'})})]}),"\n",(0,n.jsxs)(t,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Remediation:"})}),(0,n.jsx)(r.p,{children:"By default, RKE2 automatically provides the client ca certificate for the Kubelet.\nIt is generated and located at /var/lib/rancher/rke2/agent/client-ca.crt"})]}),"\n",(0,n.jsx)(r.h4,{id:"424-verify-that-if-defined-the---read-only-port-argument-is-set-to-0-automated",children:"4.2.4 Verify that if defined, the --read-only-port argument is set to 0 (Automated)"}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,n.jsx)(r.p,{children:(0,n.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-bash",children:"/bin/cat /var/lib/rancher/rke2/agent/etc/kubelet.conf.d/00-rke2-defaults.conf\n"})}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Expected Result:"})," '--read-only-port' is equal to '0' OR '--read-only-port' is not present"]}),"\n",(0,n.jsxs)(t,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Returned Value:"})}),(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-console",children:"UID PID PPID C STIME TTY TIME CMD\nroot 2363 2313 3 22:56 ? 00:00:01 kubelet --volume-plugin-dir=/var/lib/kubelet/volumeplugins --file-check-frequency=5s --sync-frequency=30s --cloud-provider=external --config-dir=/var/lib/rancher/rke2/agent/etc/kubelet.conf.d --containerd=/run/k3s/containerd/containerd.sock --hostname-override=server-0 --kubeconfig=/var/lib/rancher/rke2/agent/kubelet.kubeconfig --node-ip=10.10.10.100 --node-labels= --read-only-port=0\n"})})]}),"\n",(0,n.jsxs)(t,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Remediation:"})}),(0,n.jsx)(r.p,{children:"By default, RKE2 sets the --read-only-port to 0. If you have set this to a different value, you\nshould set it back to 0. Edit the RKE2 config file /etc/rancher/rke2/config.yaml, remove any lines similar to below."}),(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{children:'kubelet-arg:\n - "read-only-port=XXXX"\n'})}),(0,n.jsx)(r.p,{children:"Based on your system, restart the RKE2 service. For example,\nsystemctl restart rke2-server.service"})]}),"\n",(0,n.jsx)(r.h4,{id:"425-ensure-that-the---streaming-connection-idle-timeout-argument-is-not-set-to-0-manual",children:"4.2.5 Ensure that the --streaming-connection-idle-timeout argument is not set to 0 (Manual)"}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,n.jsx)(r.p,{children:(0,n.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-bash",children:"/bin/cat /var/lib/rancher/rke2/agent/etc/kubelet.conf.d/00-rke2-defaults.conf\n"})}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Expected Result:"})," '.streamingConnectionIdleTimeout' is not equal to '0' OR '.streamingConnectionIdleTimeout' is not present"]}),"\n",(0,n.jsxs)(t,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Returned Value:"})}),(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-console",children:'address: 0.0.0.0\napiVersion: kubelet.config.k8s.io/v1beta1\nauthentication:\n anonymous:\n enabled: false\n webhook:\n cacheTTL: 2m0s\n enabled: true\n x509:\n clientCAFile: /var/lib/rancher/rke2/agent/client-ca.crt\nauthorization:\n mode: Webhook\n webhook:\n cacheAuthorizedTTL: 5m0s\n cacheUnauthorizedTTL: 30s\ncgroupDriver: systemd\nclusterDNS:\n- 10.43.0.10\nclusterDomain: cluster.local\ncontainerRuntimeEndpoint: unix:///run/k3s/containerd/containerd.sock\ncpuManagerReconcilePeriod: 10s\ncrashLoopBackOff: {}\nevictionHard:\n imagefs.available: 5%\n nodefs.available: 5%\nevictionMinimumReclaim:\n imagefs.available: 10%\n nodefs.available: 10%\nevictionPressureTransitionPeriod: 5m0s\nfailSwapOn: false\nfileCheckFrequency: 20s\nhealthzBindAddress: 127.0.0.1\nhttpCheckFrequency: 20s\nimageMaximumGCAge: 0s\nimageMinimumGCAge: 2m0s\nkind: KubeletConfiguration\nlogging:\n flushFrequency: 5s\n format: text\n options:\n json:\n infoBufferSize: "0"\n text:\n infoBufferSize: "0"\n verbosity: 0\nmemorySwap: {}\nnodeStatusReportFrequency: 5m0s\nnodeStatusUpdateFrequency: 10s\nprotectKernelDefaults: true\nresolvConf: /run/systemd/resolve/resolv.conf\nruntimeRequestTimeout: 2m0s\nserializeImagePulls: false\nshutdownGracePeriod: 0s\nshutdownGracePeriodCriticalPods: 0s\nstaticPodPath: /var/lib/rancher/rke2/agent/pod-manifests\nstreamingConnectionIdleTimeout: 4h0m0s\nsyncFrequency: 1m0s\ntlsCertFile: /var/lib/rancher/rke2/agent/serving-kubelet.crt\ntlsPrivateKeyFile: /var/lib/rancher/rke2/agent/serving-kubelet.key\nvolumeStatsAggPeriod: 1m0s\n'})})]}),"\n",(0,n.jsxs)(t,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Remediation:"})}),(0,n.jsx)(r.p,{children:"Edit the RKE2 config file /etc/rancher/rke2/config.yaml, set the following parameter to an appropriate value."}),(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{children:'kubelet-arg:\n - "streaming-connection-idle-timeout=5m"\n'})}),(0,n.jsx)(r.p,{children:"Based on your system, restart the RKE2 service. For example,\nsystemctl restart rke2-server.service"})]}),"\n",(0,n.jsx)(r.h4,{id:"426-ensure-that-the---make-iptables-util-chains-argument-is-set-to-true-automated",children:"4.2.6 Ensure that the --make-iptables-util-chains argument is set to true (Automated)"}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,n.jsx)(r.p,{children:(0,n.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-bash",children:"/bin/cat /var/lib/rancher/rke2/agent/etc/kubelet.conf.d/00-rke2-defaults.conf\n"})}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Expected Result:"})," '.makeIPTablesUtilChains' is present OR '.makeIPTablesUtilChains' is not present"]}),"\n",(0,n.jsxs)(t,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Returned Value:"})}),(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-console",children:'address: 0.0.0.0\napiVersion: kubelet.config.k8s.io/v1beta1\nauthentication:\n anonymous:\n enabled: false\n webhook:\n cacheTTL: 2m0s\n enabled: true\n x509:\n clientCAFile: /var/lib/rancher/rke2/agent/client-ca.crt\nauthorization:\n mode: Webhook\n webhook:\n cacheAuthorizedTTL: 5m0s\n cacheUnauthorizedTTL: 30s\ncgroupDriver: systemd\nclusterDNS:\n- 10.43.0.10\nclusterDomain: cluster.local\ncontainerRuntimeEndpoint: unix:///run/k3s/containerd/containerd.sock\ncpuManagerReconcilePeriod: 10s\ncrashLoopBackOff: {}\nevictionHard:\n imagefs.available: 5%\n nodefs.available: 5%\nevictionMinimumReclaim:\n imagefs.available: 10%\n nodefs.available: 10%\nevictionPressureTransitionPeriod: 5m0s\nfailSwapOn: false\nfileCheckFrequency: 20s\nhealthzBindAddress: 127.0.0.1\nhttpCheckFrequency: 20s\nimageMaximumGCAge: 0s\nimageMinimumGCAge: 2m0s\nkind: KubeletConfiguration\nlogging:\n flushFrequency: 5s\n format: text\n options:\n json:\n infoBufferSize: "0"\n text:\n infoBufferSize: "0"\n verbosity: 0\nmemorySwap: {}\nnodeStatusReportFrequency: 5m0s\nnodeStatusUpdateFrequency: 10s\nprotectKernelDefaults: true\nresolvConf: /run/systemd/resolve/resolv.conf\nruntimeRequestTimeout: 2m0s\nserializeImagePulls: false\nshutdownGracePeriod: 0s\nshutdownGracePeriodCriticalPods: 0s\nstaticPodPath: /var/lib/rancher/rke2/agent/pod-manifests\nstreamingConnectionIdleTimeout: 4h0m0s\nsyncFrequency: 1m0s\ntlsCertFile: /var/lib/rancher/rke2/agent/serving-kubelet.crt\ntlsPrivateKeyFile: /var/lib/rancher/rke2/agent/serving-kubelet.key\nvolumeStatsAggPeriod: 1m0s\n'})})]}),"\n",(0,n.jsxs)(t,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Remediation:"})}),(0,n.jsx)(r.p,{children:"Edit the RKE2 config file /etc/rancher/rke2/config.yaml, set the following parameter."}),(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{children:'kubelet-arg:\n - "make-iptables-util-chains=true"\n'})}),(0,n.jsx)(r.p,{children:"Or, remove the --make-iptables-util-chains argument to let RKE2 use the default value.\nBased on your system, restart the RKE2 service. For example,\nsystemctl restart rke2-server.service"})]}),"\n",(0,n.jsx)(r.h4,{id:"427-ensure-that-the---hostname-override-argument-is-not-set-automated",children:"4.2.7 Ensure that the --hostname-override argument is not set (Automated)"}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," Not Applicable"]}),"\n",(0,n.jsx)(r.p,{children:(0,n.jsx)(r.strong,{children:"Rationale:"})}),"\n",(0,n.jsx)(r.p,{children:"By default, RKE2 does set the --hostname-override argument. Per CIS guidelines, this is to comply\nwith cloud providers that require this flag to ensure that hostname matches node names."}),"\n",(0,n.jsx)(r.h4,{id:"428-ensure-that-the-eventrecordqps-argument-is-set-to-a-level-which-ensures-appropriate-event-capture-manual",children:"4.2.8 Ensure that the eventRecordQPS argument is set to a level which ensures appropriate event capture (Manual)"}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,n.jsx)(r.p,{children:(0,n.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-bash",children:"/bin/cat /var/lib/rancher/rke2/agent/etc/kubelet.conf.d/00-rke2-defaults.conf\n"})}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Expected Result:"})," '.eventRecordQPS' is present OR '.eventRecordQPS' is not present"]}),"\n",(0,n.jsxs)(t,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Returned Value:"})}),(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-console",children:'address: 0.0.0.0\napiVersion: kubelet.config.k8s.io/v1beta1\nauthentication:\n anonymous:\n enabled: false\n webhook:\n cacheTTL: 2m0s\n enabled: true\n x509:\n clientCAFile: /var/lib/rancher/rke2/agent/client-ca.crt\nauthorization:\n mode: Webhook\n webhook:\n cacheAuthorizedTTL: 5m0s\n cacheUnauthorizedTTL: 30s\ncgroupDriver: systemd\nclusterDNS:\n- 10.43.0.10\nclusterDomain: cluster.local\ncontainerRuntimeEndpoint: unix:///run/k3s/containerd/containerd.sock\ncpuManagerReconcilePeriod: 10s\ncrashLoopBackOff: {}\nevictionHard:\n imagefs.available: 5%\n nodefs.available: 5%\nevictionMinimumReclaim:\n imagefs.available: 10%\n nodefs.available: 10%\nevictionPressureTransitionPeriod: 5m0s\nfailS
1wapOn: false\nfileCheckFrequency: 20s\nhealthzBindAddress: 127.0.0.1\nhttpCheckFrequency: 20s\nimageMaximumGCAge: 0s\nimageMinimumGCAge: 2m0s\nkind: KubeletConfiguration\nlogging:\n flushFrequency: 5s\n format: text\n options:\n json:\n infoBufferSize: "0"\n text:\n infoBufferSize: "0"\n verbosity: 0\nmemorySwap: {}\nnodeStatusReportFrequency: 5m0s\nnodeStatusUpdateFrequency: 10s\nprotectKernelDefaults: true\nresolvConf: /run/systemd/resolve/resolv.conf\nruntimeRequestTimeout: 2m0s\nserializeImagePulls: false\nshutdownGracePeriod: 0s\nshutdownGracePeriodCriticalPods: 0s\nstaticPodPath: /var/lib/rancher/rke2/agent/pod-manifests\nstreamingConnectionIdleTimeout: 4h0m0s\nsyncFrequency: 1m0s\ntlsCertFile: /var/lib/rancher/rke2/agent/serving-kubelet.crt\ntlsPrivateKeyFile: /var/lib/rancher/rke2/agent/serving-kubelet.key\nvolumeStatsAggPeriod: 1m0s\n'})})]}),"\n",(0,n.jsxs)(t,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Remediation:"})}),(0,n.jsx)(r.p,{children:"Edit the RKE2 config file /etc/rancher/rke2/config.yaml, set the following parameter to an appropriate value."}),(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{children:'kubelet-arg:\n - "event-qps=<value>"\n'})}),(0,n.jsx)(r.p,{children:"Based on your system, restart the RKE2 service. For example,\nsystemctl restart rke2-server.service"})]}),"\n",(0,n.jsx)(r.h4,{id:"429-ensure-that-the---tls-cert-file-and---tls-private-key-file-arguments-are-set-as-appropriate-automated",children:"4.2.9 Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate (Automated)"}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,n.jsx)(r.p,{children:(0,n.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-bash",children:"/bin/cat /var/lib/rancher/rke2/agent/etc/kubelet.conf.d/00-rke2-defaults.conf\n"})}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Expected Result:"})," '.tlsCertFile' is present AND '.tlsPrivateKeyFile' is present"]}),"\n",(0,n.jsxs)(t,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Returned Value:"})}),(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-console",children:'address: 0.0.0.0\napiVersion: kubelet.config.k8s.io/v1beta1\nauthentication:\n anonymous:\n enabled: false\n webhook:\n cacheTTL: 2m0s\n enabled: true\n x509:\n clientCAFile: /var/lib/rancher/rke2/agent/client-ca.crt\nauthorization:\n mode: Webhook\n webhook:\n cacheAuthorizedTTL: 5m0s\n cacheUnauthorizedTTL: 30s\ncgroupDriver: systemd\nclusterDNS:\n- 10.43.0.10\nclusterDomain: cluster.local\ncontainerRuntimeEndpoint: unix:///run/k3s/containerd/containerd.sock\ncpuManagerReconcilePeriod: 10s\ncrashLoopBackOff: {}\nevictionHard:\n imagefs.available: 5%\n nodefs.available: 5%\nevictionMinimumReclaim:\n imagefs.available: 10%\n nodefs.available: 10%\nevictionPressureTransitionPeriod: 5m0s\nfailSwapOn: false\nfileCheckFrequency: 20s\nhealthzBindAddress: 127.0.0.1\nhttpCheckFrequency: 20s\nimageMaximumGCAge: 0s\nimageMinimumGCAge: 2m0s\nkind: KubeletConfiguration\nlogging:\n flushFrequency: 5s\n format: text\n options:\n json:\n infoBufferSize: "0"\n text:\n infoBufferSize: "0"\n verbosity: 0\nmemorySwap: {}\nnodeStatusReportFrequency: 5m0s\nnodeStatusUpdateFrequency: 10s\nprotectKernelDefaults: true\nresolvConf: /run/systemd/resolve/resolv.conf\nruntimeRequestTimeout: 2m0s\nserializeImagePulls: false\nshutdownGracePeriod: 0s\nshutdownGracePeriodCriticalPods: 0s\nstaticPodPath: /var/lib/rancher/rke2/agent/pod-manifests\nstreamingConnectionIdleTimeout: 4h0m0s\nsyncFrequency: 1m0s\ntlsCertFile: /var/lib/rancher/rke2/agent/serving-kubelet.crt\ntlsPrivateKeyFile: /var/lib/rancher/rke2/agent/serving-kubelet.key\nvolumeStatsAggPeriod: 1m0s\n'})})]}),"\n",(0,n.jsxs)(t,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Remediation:"})}),(0,n.jsx)(r.p,{children:"By default, RKE2 automatically provides the TLS certificate and private key for the Kubelet.\nThey are generated and located at /var/lib/rancher/rke2/agent/serving-kubelet.crt and /var/lib/rancher/rke2/agent/serving-kubelet.key\nIf this check fails, edit the RKE2 config file /etc/rancher/rke2/config.yaml and remove any lines similar to below."}),(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{children:'kubelet-arg:\n - "tls-cert-file=<path/to/tls-cert-file>"\n - "tls-private-key-file=<path/to/tls-private-key-file>"\n'})})]}),"\n",(0,n.jsx)(r.h4,{id:"4210-ensure-that-the---rotate-certificates-argument-is-not-set-to-false-automated",children:"4.2.10 Ensure that the --rotate-certificates argument is not set to false (Automated)"}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,n.jsx)(r.p,{children:(0,n.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-bash",children:"/bin/cat /var/lib/rancher/rke2/agent/etc/kubelet.conf.d/00-rke2-defaults.conf\n"})}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Expected Result:"})," '.rotateCertificates' is present OR '.rotateCertificates' is not present"]}),"\n",(0,n.jsxs)(t,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Returned Value:"})}),(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-console",children:'address: 0.0.0.0\napiVersion: kubelet.config.k8s.io/v1beta1\nauthentication:\n anonymous:\n enabled: false\n webhook:\n cacheTTL: 2m0s\n enabled: true\n x509:\n clientCAFile: /var/lib/rancher/rke2/agent/client-ca.crt\nauthorization:\n mode: Webhook\n webhook:\n cacheAuthorizedTTL: 5m0s\n cacheUnauthorizedTTL: 30s\ncgroupDriver: systemd\nclusterDNS:\n- 10.43.0.10\nclusterDomain: cluster.local\ncontainerRuntimeEndpoint: unix:///run/k3s/containerd/containerd.sock\ncpuManagerReconcilePeriod: 10s\ncrashLoopBackOff: {}\nevictionHard:\n imagefs.available: 5%\n nodefs.available: 5%\nevictionMinimumReclaim:\n imagefs.available: 10%\n nodefs.available: 10%\nevictionPressureTransitionPeriod: 5m0s\nfailSwapOn: false\nfileCheckFrequency: 20s\nhealthzBindAddress: 127.0.0.1\nhttpCheckFrequency: 20s\nimageMaximumGCAge: 0s\nimageMinimumGCAge: 2m0s\nkind: KubeletConfiguration\nlogging:\n flushFrequency: 5s\n format: text\n options:\n json:\n infoBufferSize: "0"\n text:\n infoBufferSize: "0"\n verbosity: 0\nmemorySwap: {}\nnodeStatusReportFrequency: 5m0s\nnodeStatusUpdateFrequency: 10s\nprotectKernelDefaults: true\nresolvConf: /run/systemd/resolve/resolv.conf\nruntimeRequestTimeout: 2m0s\nserializeImagePulls: false\nshutdownGracePeriod: 0s\nshutdownGracePeriodCriticalPods: 0s\nstaticPodPath: /var/lib/rancher/rke2/agent/pod-manifests\nstreamingConnectionIdleTimeout: 4h0m0s\nsyncFrequency: 1m0s\ntlsCertFile: /var/lib/rancher/rke2/agent/serving-kubelet.crt\ntlsPrivateKeyFile: /var/lib/rancher/rke2/agent/serving-kubelet.key\nvolumeStatsAggPeriod: 1m0s\n'})})]}),"\n",(0,n.jsxs)(t,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Remediation:"})}),(0,n.jsx)(r.p,{children:"By default, RKE2 does not set the --rotate-certificates argument.\nIf this check fails, edit the RKE2 config file /etc/rancher/rke2/config.yaml, remove any rotate-certificates parameter.\nBased on your system, restart the RKE2 service. For example,\nsystemctl restart rke2-server.service"})]}),"\n",(0,n.jsx)(r.h4,{id:"4211-verify-that-the-rotatekubeletservercertificate-argument-is-set-to-true-automated",children:"4.2.11 Verify that the RotateKubeletServerCertificate argument is set to true (Automated)"}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,n.jsx)(r.p,{children:(0,n.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-bash",children:"/bin/cat /var/lib/rancher/rke2/agent/etc/kubelet.conf.d/00-rke2-defaults.conf\n"})}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Expected Result:"})," '.featureGates.RotateKubeletServerCertificate' is present OR '.featureGates.RotateKubeletServerCertificate' is not present"]}),"\n",(0,n.jsxs)(t,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Returned Value:"})}),(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-console",children:'address: 0.0.0.0\napiVersion: kubelet.config.k8s.io/v1beta1\nauthentication:\n anonymous:\n enabled: false\n webhook:\n cacheTTL: 2m0s\n enabled: true\n x509:\n clientCAFile: /var/lib/rancher/rke2/agent/client-ca.crt\nauthorization:\n mode: Webhook\n webhook:\n cacheAuthorizedTTL: 5m0s\n cacheUnauthorizedTTL: 30s\ncgroupDriver: systemd\nclusterDNS:\n- 10.43.0.10\nclusterDomain: cluster.local\ncontainerRuntimeEndpoint: unix:///run/k3s/containerd/containerd.sock\ncpuManagerReconcilePeriod: 10s\ncrashLoopBackOff: {}\nevictionHard:\n imagefs.available: 5%\n nodefs.available: 5%\nevictionMinimumReclaim:\n imagefs.available: 10%\n nodefs.available: 10%\nevictionPressureTransitionPeriod: 5m0s\nfailSwapOn: false\nfileCheckFrequency: 20s\nhealthzBindAddress: 127.0.0.1\nhttpCheckFrequency: 20s\nimageMaximumGCAge: 0s\nimageMinimumGCAge: 2m0s\nkind: KubeletConfiguration\nlogging:\n flushFrequency: 5s\n format: text\n options:\n json:\n infoBufferSize: "0"\n text:\n infoBufferSize: "0"\n verbosity: 0\nmemorySwap: {}\nnodeStatusReportFrequency: 5m0s\nnodeStatusUpdateFrequency: 10s\nprotectKernelDefaults: true\nresolvConf: /run/systemd/resolve/resolv.conf\nruntimeRequestTimeout: 2m0s\nserializeImagePulls: false\nshutdownGracePeriod: 0s\nshutdownGracePeriodCriticalPods: 0s\nstaticPodPath: /var/lib/rancher/rke2/agent/pod-manifests\nstreamingConnectionIdleTimeout: 4h0m0s\nsyncFrequency: 1m0s\ntlsCertFile: /var/lib/rancher/rke2/agent/serving-kubelet.crt\ntlsPrivateKeyFile: /var/lib/rancher/rke2/agent/serving-kubelet.key\nvolumeStatsAggPeriod: 1m0s\n'})})]}),"\n",(0,n.jsxs)(t,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Remediation:"})}),(0,n.jsx)(r.p,{children:"By default, RKE2 does not set the RotateKubeletServerCertificate feature gate.\nIf this check fails, edit the RKE2 config file /etc/rancher/rke2/config.yaml, remove any RotateKubeletServerCertificate parameter.\nBased on your system, restart the RKE2 service. For example,\nsystemctl restart rke2-server.service"})]}),"\n",(0,n.jsx)(r.h4,{id:"4212-ensure-that-the-kubelet-only-makes-use-of-strong-cryptographic-ciphers-manual",children:"4.2.12 Ensure that the Kubelet only makes use of Strong Cryptographic Ciphers (Manual)"}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Remediation:"}),"\nEdit the RKE2 config file /etc/rancher/rke2/config.yaml,"]}),"\n",(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{children:'kubelet-arg:\n - "tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305"\n'})}),"\n",(0,n.jsx)(r.p,{children:"or to a subset of these values.\
1nBased on your system, restart the RKE2 service. For example,\nsystemctl restart rke2-server.service"}),"\n",(0,n.jsx)(r.h4,{id:"4213-ensure-that-a-limit-is-set-on-pod-pids-manual",children:"4.2.13 Ensure that a limit is set on pod PIDs (Manual)"}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Remediation:"}),"\nEdit the RKE2 config file /etc/rancher/rke2/config.yaml, set the following parameter to an appropriate value."]}),"\n",(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{children:'kubelet-arg:\n - "pod-max-pids=<value>"\n'})}),"\n",(0,n.jsx)(r.p,{children:"Based on your system, restart the RKE2 service. For example,\nsystemctl restart rke2-server.service"}),"\n",(0,n.jsx)(r.h4,{id:"4214-ensure-that-the---seccomp-default-parameter-is-set-to-true-manual",children:"4.2.14 Ensure that the --seccomp-default parameter is set to true (Manual)"}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Remediation:"}),"\nIf enabled, the kubelet will use the RuntimeDefault seccomp profile by default, which is defined by the container runtime, instead of using the Unconfined (seccomp disabled) mode (default).\nIf using a RKE2 config file /etc/rancher/rke2/config.yaml, edit the file to set ",(0,n.jsx)(r.code,{children:"seccomp-default"})," to\nkubelet-arg:"]}),"\n",(0,n.jsxs)(r.ul,{children:["\n",(0,n.jsx)(r.li,{children:'"seccomp-default=true"'}),"\n"]}),"\n",(0,n.jsx)(r.h3,{id:"43-kube-proxy",children:"4.3 kube-proxy"}),"\n",(0,n.jsx)(r.h4,{id:"431-ensure-that-the-kube-proxy-metrics-service-is-bound-to-localhost-automated",children:"4.3.1 Ensure that the kube-proxy metrics service is bound to localhost (Automated)"}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,n.jsx)(r.p,{children:(0,n.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-bash",children:"/bin/sh -c 'if test -e /etc/kubernetes/addons/kube-proxy-daemonset.yaml; then cat /etc/kubernetes/addons/kube-proxy-daemonset.yaml; fi'\n"})}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Expected Result:"})," '--metrics-bind-address' is present OR '--metrics-bind-address' is not present"]}),"\n",(0,n.jsxs)(t,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Returned Value:"})}),(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-console",children:"UID PID PPID C STIME TTY TIME CMD\nroot 2501 2410 0 22:56 ? 00:00:00 kube-proxy --cluster-cidr=10.42.0.0/16 --conntrack-max-per-core=0 --conntrack-tcp-timeout-close-wait=0s --conntrack-tcp-timeout-established=0s --healthz-bind-address=127.0.0.1 --hostname-override=server-0 --kubeconfig=/var/lib/rancher/rke2/agent/kubeproxy.kubeconfig --proxy-mode=iptables\n"})})]}),"\n",(0,n.jsxs)(t,{children:[(0,n.jsx)("summary",{children:(0,n.jsx)("b",{children:"Remediation:"})}),(0,n.jsx)(r.p,{children:"Modify or remove any values which bind the metrics service to a non-localhost address.\nThe default value is 127.0.0.1:10249."})]}),"\n",(0,n.jsx)(r.h2,{id:"5-kubernetes-policies",children:"5 Kubernetes Policies"}),"\n",(0,n.jsx)(r.h3,{id:"51-rbac-and-service-accounts",children:"5.
11 RBAC and Service Accounts"}),"\n",(0,n.jsx)(r.h4,{id:"511-ensure-that-the-cluster-admin-role-is-only-used-where-required-manual",children:"5.1.1 Ensure that the cluster-admin role is only used where required (Manual)"}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Remediation:"}),"\nIdentify all clusterrolebindings to the cluster-admin role. Check if they are used and\nif they need this role or if they could use a role with fewer privileges. RKE2 gives exceptions\nto the helm-kube-system-rke2-* clusterrolebindings which handles the installation of all rke2 managed components.\nWhere possible, first bind users to a lower privileged role and then remove the\nclusterrolebinding to the cluster-admin role:"]}),"\n",(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{children:"kubectl delete clusterrolebinding [name]\n"})}),"\n",(0,n.jsx)(r.h4,{id:"512-minimize-access-to-secrets-manual",children:"5.1.2 Minimize access to secrets (Manual)"}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Remediation:"}),"\nWhere possible, remove get, list and watch access to Secret objects in the cluster."]}),"\n",(0,n.jsx)(r.h4,{id:"513-minimize-wildcard-use-in-roles-and-clusterroles-manual",children:"5.
11.3 Minimize wildcard use in Roles and ClusterRoles (Manual)"}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Remediation:"}),"\nWhere possible replace any use of wildcards in clusterroles and roles with specific objects or actions.\nRKE2 gives exceptions for following cluster roles, which are required for regular operations:"]}),"\n",(0,n.jsxs)(r.ul,{children:["\n",(0,n.jsx)(r.li,{children:"rke2-cloud-controller-manager, local-path-provisioner-role, cluster-admin"}),"\n",(0,n.jsxs)(r.li,{children:["system",":kube-controller-manager",", system",":kubelet-api-admin",", system:controller",":namespace-controller",","]}),"\n",(0,n.jsxs)(r.li,{children:["system:controller",":disruption-controller",", system:controller",":generic-garbage-collector",","]}),"\n",(0,n.jsxs)(r.li,{children:["system:controller",":horizontal-pod-autoscaler",", system:controller",":resourcequota-controller"]}),"\n"]}),"\n",(0,n.jsx)(r.h4,{id:"514-minimize-access-to-create-pods-manual",children:"5.
11.4 Minimize access to create pods (Manual)"}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Remediation:"}),"\nWhere possible, remove create access to pod objects in the cluster."]}),"\n",(0,n.jsx)(r.h4,{id:"515-ensure-that-default-service-accounts-are-not-actively-used-manual",children:"5.1.5 Ensure that default service accounts are not actively used. (Manual)"}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Remediation:"}),"\nCreate explicit service accounts wherever a Kubernetes workload requires specific access\nto the Kubernetes API server.\nModify the configuration of each default service account to include this value\nautomountServiceAccountToken: false\nOr using kubectl:"]}),"\n",(0,n.jsx)(r.pre,{children:(0,n.jsx)(r.code,{className:"language-bash",children:"kubectl patch serviceaccount --namespace <NAMESPACE>lt;NAMESPACE<NAMESPACE>gt; default --patch '{\"automountServiceAccountToken\": false}'\n"})}),"\n",(0,n.jsx)(r.h4,{id:"516-ensure-that-service-account-tokens-are-only-mounted-where-necessary-manual",children:"5.
11.6 Ensure that Service Account Tokens are only mounted where necessary (Manual)"}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Remediation:"}),"\nModify the definition of ServiceAccounts and Pods which do not need to mount service\naccount tokens to disable it, with ",(0,n.jsx)(r.code,{children:"automountServiceAccountToken: false"}),".\nRKE2 gives exceptions to the ServiceAccounts in kube-system namespace, as these are expected contact the apiserver.\nWhen in cis mode, RKE2 disables the automountServiceAccountToken for namespaces:"]}),"\n",(0,n.jsxs)(r.ul,{children:["\n",(0,n.jsxs)(r.li,{children:["kube-public, default, kube-node-lease\nIf both the ServiceAccount and the Pod's .spec specify a value for automountServiceAccountToken, the Pod spec takes precedence.\nCondition: Pod is_compliant to true when","\n",(0,n.jsxs)(r.ul,{children:["\n",(0,n.jsx)(r.li,{children:"ServiceAccount is automountServiceAccountToken: false and Pod is automountServiceAccountToken: false or notset"}),"\n",(0,n.jsx)(r.li,{children:"ServiceAccount is automountServiceAccountToken: true/notset and Pod is automountServiceAccountToken: false"}),"\n"]}),"\n"]}),"\n"]}),"\n",(0,n.jsxs)(r.h4,{id:"517-avoid-use-of-system-group-manual",children:["5.1.7 Avoid use of system",":masters"," group (Manual)"]}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Remediation:"}),"\nRemove the system",":masters"," group from all users in the cluster."]}),"\n",(0,n.jsx)(r.h4,{id:"518-limit-use-of-the-bind-impersonate-and-escalate-permissions-in-the-kubernetes-cluster-manual",children:"5.
11.8 Limit use of the Bind, Impersonate and Escalate permissions in the Kubernetes cluster (Manual)"}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Remediation:"}),"\nWhere possible, remove the impersonate, bind and escalate rights from subjects."]}),"\n",(0,n.jsx)(r.h4,{id:"519-minimize-access-to-create-persistent-volumes-manual",children:"5.1.9 Minimize access to create persistent volumes (Manual)"}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Remediation:"}),"\nWhere possible, remove create access to PersistentVolume objects in the cluster."]}),"\n",(0,n.jsx)(r.h4,{id:"5110-minimize-access-to-the-proxy-sub-resource-of-nodes-manual",children:"5.1.10 Minimize access to the proxy sub-resource of nodes (Manual)"}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Remediation:"}),"\nWhere possible, remove access to the proxy sub-resource of node objects."]}),"\n",(0,n.jsx)(r.h4,{id:"5111-minimize-access-to-the-approval-sub-resource-of-certificatesigningrequests-objects-manual",children:"5.
11.11 Minimize access to the approval sub-resource of certificatesigningrequests objects (Manual)"}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Remediation:"}),"\nWhere possible, remove access to the approval sub-resource of certificatesigningrequests objects."]}),"\n",(0,n.jsx)(r.h4,{id:"5112-minimize-access-to-webhook-configuration-objects-manual",children:"5.1.12 Minimize access to webhook configuration objects (Manual)"}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Remediation:"}),"\nWhere possible, remove access to the validatingwebhookconfigurations or mutatingwebhookconfigurations objects"]}),"\n",(0,n.jsx)(r.h4,{id:"5113-minimize-access-to-the-service-account-token-creation-manual",children:"5.1.13 Minimize access to the service account token creation (Manual)"}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Remediation:"}),"\nWhere possible, remove access to the token sub-resource of serviceaccount objects."]}),"\n",(0,n.jsx)(r.h3,{id:"52-pod-security-standards",children:"5.2 Pod Security Standards"}),"\n",(0,n.jsx)(r.h4,{id:"521-ensure-that-the-cluster-has-at-least-one-active-policy-control-mechanism-in-place-manual",children:"5.2.1 Ensure that the cluster has at least one active policy control mechanism in place (Manual)"}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Remediation:"}),"\nEnsure that either Pod Security Admission or an external policy control system is in place\nfor every namespace which contains user workloads."]}),"\n",(0,n.jsx)(r.h4,{id:"522-minimize-the-admission-of-privileged-containers-manual",children:"5.2.2 Minimize the admission of privileged containers (Manual)"}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Remediation:"}),"\nAdd policies to each namespace in the cluster which has user workloads to restrict the\nadmission of privileged containers.\nRKE2 gives exceptions to the following pods, which are required for regular operations:"]}),"\n",(0,n.jsxs)(r.ul,{children:["\n",(0,n.jsxs)(r.li,{children:["kube-flannel, calico-node, kube-proxy\nAudit: the audit list all pods' containers to retrieve their .securityContext.privileged value.\nCondition: is_compliant is false if container's ",(0,n.jsx)(r.code,{children:".securityContext.privileged"})," is set to ",(0,n.jsx)(r.code,{children:"true"}),".\nDefault: by default, there are no restrictions on the creation of privileged containers."]}),"\n"]}),"\n",(0,n.jsx)(r.h4,{id:"523-minimize-the-admission-of-containers-wishing-to-share-the-host-process-id-namespace-manual",children:"5.2.3 Minimize the admission of containers wishing to share the host process ID namespace (Manual)"}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Remediation:"}),"\nAdd policies to each namespace in the cluster which has user workloads to restrict the\nadmission of ",(0,n.jsx)(r.code,{children:"hostPID"})," containers.\nAudit: the audit retrieves each Pod' spec.hostPID.\nCondition: is_compliant is false if Pod's spec.hostPID is set to ",(0,n.jsx)(r.code,{children:"true"}),".\nDefault: by default, there are no restrictions on the creation of hostPID containers."]}),"\n",(0,n.jsx)(r.h4,{id:"524-minimize-the-admission-of-containers-wishing-to-share-the-host-ipc-namespace-manual",children:"5.2.4 Minimize the admission of containers wishing to share the host IPC namespace (Manual)"}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Remediation:"}),"\nAdd policies to each namespace in the cluster which has user workloads to restrict the\nadmission of ",(0,n.jsx)(r.code,{children:"hostIPC"})," containers.\nAudit: the audit retrieves each Pod' spec.IPC.\nCondition: is_compliant is false if Pod's spec.hostIPC is set to ",(0,n.jsx)(r.code,{children:"true"}),".\nDefault: by default, there are no restrictions on the creation of hostIPC containers."]}),"\n",(0,n.jsx)(r.h4,{id:"525-minimize-the-admission-of-containers-wishing-to-share-the-host-network-namespace-manual",children:"5.2.5 Minimize the admission of containers wishing to share the host network namespace (Manual)"}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Remediation:"}),"\nAdd policies to each namespace in the cluster which has user workloads to restrict the\nadmission of ",(0,n.jsx)(r.code,{children:"hostNetwork"})," containers.\nRKE2 gives exceptions to the following pods in the kube-system namespace, which are required for regular operations:"]}),"\n",(0,n.jsxs)(r.ul,{children:["\n",(0,n.jsx)(r.li,{children:"cloud-controller-manager, etcd, rke2-canal, rke2-coredns, kube-apiserver,"}),"\n",(0,n.jsxs)(r.li,{children:["kube-scheduler, kube-proxy, kube-controller-manager\nAudit: the audit retrieves each Pod' spec.hostNetwork.\nCondition: is_compliant is false if Pod's spec.hostNetwork is set to ",(0,n.jsx)(r.code,{children:"true"}),".\nDefault: by default, there are no restrictions on the creation of hostNetwork containers."]}),"\n"]}),"\n",(0,n.jsx)(r.h4,{id:"526-minimize-the-admission-of-containers-with-allowprivilegeescalation-manual",children:"5.2.6 Minimize the admission of containers with allowPrivilegeEscalation (Manual)"}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Remediation:"}),"\nAdd policies to each namespace in the cluster which has user workloads to restrict the\nadmission of containers with ",(0,n.jsx)(r.code,{children:".securityContext.allowPrivilegeEscalation"})," set to ",(0,n.jsx)(r.code,{children:"true"}),".\nAudit: the audit retrieves each Pod's container(s) ",(0,n.jsx)(r.code,{children:".securityContext.allowPrivilegeEscalation"}),".\nCondition: is_compliant is false if container's ",(0,n.jsx)(r.code,{children:".securityContext.allowPrivilegeEscalation"})," is set to ",(0,n.jsx)(r.code,{children:"true"}),".\nDefault: If notset, privilege escalation is allowed (default to true). However if PSP/PSA is used with a ",(0,n.jsx)(r.code,{children:"restricted"})," profile,\nprivilege escalation is explicitly disallowed unless configured otherwise."]}),"\n",(0,n.jsx)(r.h4,{id:"527-minimize-the-admission-of-root-containers-manual",children:"5.2.7 Minimize the admission of root containers (Manual)"}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Remediation:"}),"\nCreate a policy for each namespace in the cluster, ensuring that either ",(0,n.jsx)(r.code,{children:"MustRunAsNonRoot"}),"\nor ",(0,n.jsx)(r.code,{children:"MustRunAs"})," with the range of UIDs not including 0, is set."]}),"\n",(0,n.jsx)(r.h4,{id:"528-minimize-the-admission-of-containers-with-the-net_raw-capability-manual",children:"5.2.8 Minimize the admission of containers with the NET_RAW capability (Manual)"}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Remediation:"}),"\nAdd policies to each namespace in the cluster which has user workloads to restrict the\nadmission of containers with the ",(0,n.jsx)(r.code,{children:"NET_RAW"})," capability."]}),"\n",(0,n.jsx)(r.h4,{id:"529-minimize-the-admission-of-containers-with-capabilities-assigned-manual",children:"5.2.9 Minimize the admission of containers with capabilities assigned (Manual)"}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Remediation:"}),"\nReview the use of capabilities in applications running on your cluster. Where a namespace\ncontains applications which do not require any Linux capabilities to operate consider\nadding a policy which forbids the admission of containers which do not drop all capabilities."]}),"\n",(0,n.jsx)(r.h4,{id:"5210-minimize-the-admission-of-windows-hostprocess-containers-manual",children:"5.2.10 Minim
1ize the admission of Windows HostProcess containers (Manual)"}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Remediation:"}),"\nAdd policies to each namespace in the cluster which has user workloads to restrict the\nadmission of containers that have ",(0,n.jsx)(r.code,{children:".securityContext.windowsOptions.hostProcess"})," set to ",(0,n.jsx)(r.code,{children:"true"}),"."]}),"\n",(0,n.jsx)(r.h4,{id:"5211-minimize-the-admission-of-hostpath-volumes-manual",children:"5.2.11 Minimize the admission of HostPath volumes (Manual)"}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Remediation:"}),"\nAdd policies to each namespace in the cluster which has user workloads to restrict the\nadmission of containers with ",(0,n.jsx)(r.code,{children:"hostPath"})," volumes."]}),"\n",(0,n.jsx)(r.h4,{id:"5212-minimize-the-admission-of-containers-which-use-hostports-manual",children:"5.2.12 Minimize the admission of containers which use HostPorts (Manual)"}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Remediation:"}),"\nAdd policies to each namespace in the cluster which has user workloads to restrict the\nadmission of containers which use ",(0,n.jsx)(r.code,{children:"hostPort"})," sections."]}),"\n",(0,n.jsx)(r.h3,{id:"53-network-policies-and-cni",children:"5.3 Network Policies and CNI"}),"\n",(0,n.jsx)(r.h4,{id:"531-ensure-that-the-cni-in-use-supports-networkpolicies-manual",children:"5.3.1 Ensure that the CNI in use supports NetworkPolicies (Manual)"}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Remediation:"}),"\nIf the CNI plugin in use does not support network policies, consideration should be given to\nmaking use of a different plugin, or finding an alternate mechanism for restricting traffic\nin the Kubernetes cluster."]}),"\n",(0,n.jsx)(r.h4,{id:"532-ensure-that-all-namespaces-have-networkpolicies-defined-manual",children:"5.3.2 Ensure that all Namespaces have NetworkPolicies defined (Manual)"}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Remediation:"}),"\nFollow the documentation and create NetworkPolicy objects as you need them."]}),"\n",(0,n.jsx)(r.h3,{id:"54-secrets-management",children:"5.4 Secrets Management"}),"\n",(0,n.jsx)(r.h4,{id:"541-prefer-using-secrets-as-files-over-secrets-as-environment-variables-manual",children:"5.4.1 Prefer using Secrets as files over Secrets as environment variables (Manual)"}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Remediation:"}),"\nIf possible, rewrite application code to read Secrets from mounted secret files, rather than\nfrom environment variables."]}),"\n",(0,n.jsx)(r.h4,{id:"542-consider-external-secret-storage-manual",children:"5.4.2 Consider external secret storage (Manual)"}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Remediation:"}),"\nRefer to the Secrets management options offered by your cloud provider or a third-party\nsecrets management solution."]}),"\n",(0,n.jsx)(r.h3,{id:"55-extensible-admission-control",children:"5.5 Extensible Admission Control"}),"\n",(0,n.jsx)(r.h4,{id:"551-configure-image-provenance-using-imagepolicywebhook-admission-controller-manual",children:"5.5.1 Configure Image Provenance using ImagePolicyWebhook admission controller (Manual)"}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Remediation:"}),"\nFollow the Kubernetes documentation and setup image provenance."]}),"\n",(0,n.jsx)(r.h3,{id:"56-general-policies",children:"5.6 General Policies"}),"\n",(0,n.jsx)(r.h4,{id:"561-create-administrative-boundaries-between-resources-using-namespaces-manual",children:"5.6.1 Create administrative boundaries between resources using namespaces (Manual)"}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Remediation:"}),"\nFollow the documentation and create namespaces for objects in your deployment as you need\nthem."]}),"\n",(0,n.jsx)(r.h4,{id:"562-ensure-that-the-seccomp-profile-is-set-to-dockerdefault-in-your-pod-definitions-manual",children:"5.6.2 Ensure that the seccomp profile is set to docker/default in your Pod definitions (Manual)"}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Remediation:"}),"\nUse ",(0,n.jsx)(r.code,{children:"securityContext"})," to enable the docker/default seccomp profile in your pod definitions.\nAn example is as below:\nsecurityContext:\nseccompProfile:\ntype: RuntimeDefault"]}
1),"\n",(0,n.jsx)(r.h4,{id:"563-apply-securitycontext-to-your-pods-and-containers-manual",children:"5.6.3 Apply SecurityContext to your Pods and Containers (Manual)"}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Remediation:"}),"\nFollow the Kubernetes documentation and apply SecurityContexts to your Pods. For a\nsuggested list of SecurityContexts, you may refer to the CIS Security Benchmark for Docker\nContainers."]}),"\n",(0,n.jsx)(r.h4,{id:"564-the-default-namespace-should-not-be-used-manual",children:"5.6.4 The default namespace should not be used (Manual)"}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.strong,{children:"Remediation:"}),"\nEnsure that namespaces are created to allow for appropriate segregation of Kubernetes\nresources and that all new resources are created in a specific namespace."]})]})}function u(e={}){const{wrapper:r}={...(0,i.R)(),...e.components};return r?(0,n.jsx)(r,{...e,children:(0,n.jsx)(d,{...e})}):d(e)}},8453(e,r,t){t.d(r,{R:()=>a,x:()=>l});var s=t(6540);const n={},i=s.createContext(n);function a(e){const r=s.useContext(i);return s.useMemo((function(){return"function"==typeof e?e(r):{...r,...e}}),[r,e])}function l(e){let r;return r=e.disableParentContext?"function"==typeof e.components?e.components(n):e.components||n:a(e.components),s.createElement(i.Provider,{value:r},e.children)}}}]);
Line numbers count LF bytes from the start of the resource, as the search results do. Vendor segments are library code the classifier recognised; they are stored but not indexed. Bytes are shown as Latin1 characters, one per byte.