From 66f7fd75b99fe5bb5ad036229b3a8e0fd3b1b098 Mon Sep 17 00:00:00 2001 From: Derek Nola Date: Fri, 9 Aug 2024 13:57:41 -0700 Subject: [PATCH] Overhaul RKE2 1.XX Checks (#231) * Fix spacing in rke2-cis-1.8 Signed-off-by: Derek Nola * Correct audits and remediation for RKE2 1.X checks Signed-off-by: Derek Nola * Remove duplicate etcd master checks Signed-off-by: Derek Nola * Fix typos Signed-off-by: Derek Nola * Change K3s 1.1.9 check to scored Signed-off-by: Derek Nola --------- Signed-off-by: Derek Nola --- package/cfg/k3s-cis-1.24-hardened/master.yaml | 2 +- .../cfg/k3s-cis-1.24-permissive/master.yaml | 2 +- package/cfg/k3s-cis-1.7-hardened/master.yaml | 2 +- .../cfg/k3s-cis-1.7-permissive/master.yaml | 2 +- package/cfg/k3s-cis-1.8-hardened/master.yaml | 2 +- .../cfg/k3s-cis-1.8-permissive/master.yaml | 2 +- .../cfg/rke2-cis-1.23-hardened/policies.yaml | 4 +- .../rke2-cis-1.23-permissive/policies.yaml | 4 +- package/cfg/rke2-cis-1.24-hardened/etcd.yaml | 65 --- .../cfg/rke2-cis-1.24-hardened/master.yaml | 382 +++++++------- .../cfg/rke2-cis-1.24-hardened/policies.yaml | 4 +- .../cfg/rke2-cis-1.24-permissive/etcd.yaml | 66 --- .../cfg/rke2-cis-1.24-permissive/master.yaml | 402 ++++++++------- .../rke2-cis-1.24-permissive/policies.yaml | 4 +- package/cfg/rke2-cis-1.7-hardened/etcd.yaml | 66 --- package/cfg/rke2-cis-1.7-hardened/master.yaml | 400 ++++++++------- .../cfg/rke2-cis-1.7-hardened/policies.yaml | 4 +- package/cfg/rke2-cis-1.7-permissive/etcd.yaml | 66 --- .../cfg/rke2-cis-1.7-permissive/master.yaml | 387 +++++++------- .../cfg/rke2-cis-1.7-permissive/policies.yaml | 4 +- package/cfg/rke2-cis-1.8-hardened/config.yaml | 2 + .../rke2-cis-1.8-hardened/controlplane.yaml | 4 + package/cfg/rke2-cis-1.8-hardened/etcd.yaml | 69 +-- package/cfg/rke2-cis-1.8-hardened/master.yaml | 470 ++++++++++------- package/cfg/rke2-cis-1.8-hardened/node.yaml | 22 + .../cfg/rke2-cis-1.8-hardened/policies.yaml | 38 +- .../cfg/rke2-cis-1.8-permissive/config.yaml | 2 + .../rke2-cis-1.8-permissive/controlplane.yaml | 4 + package/cfg/rke2-cis-1.8-permissive/etcd.yaml | 68 +-- .../cfg/rke2-cis-1.8-permissive/master.yaml | 480 +++++++++++------- package/cfg/rke2-cis-1.8-permissive/node.yaml | 22 + .../cfg/rke2-cis-1.8-permissive/policies.yaml | 38 +- 32 files changed, 1596 insertions(+), 1493 deletions(-) diff --git a/package/cfg/k3s-cis-1.24-hardened/master.yaml b/package/cfg/k3s-cis-1.24-hardened/master.yaml index 4b03b2bb..cd3be1ab 100644 --- a/package/cfg/k3s-cis-1.24-hardened/master.yaml +++ b/package/cfg/k3s-cis-1.24-hardened/master.yaml @@ -131,7 +131,7 @@ groups: Note that for many CNIs, a lock file is created with permissions 750. This is expected and can be ignored. If you modify your CNI configuration, ensure that the permissions are set to 600. For example, chmod 600 /var/lib/cni/networks/ - scored: false + scored: true - id: 1.1.10 text: "Ensure that the Container Network Interface file ownership is set to root:root (Manual)" diff --git a/package/cfg/k3s-cis-1.24-permissive/master.yaml b/package/cfg/k3s-cis-1.24-permissive/master.yaml index 36b0b4a1..2179c195 100644 --- a/package/cfg/k3s-cis-1.24-permissive/master.yaml +++ b/package/cfg/k3s-cis-1.24-permissive/master.yaml @@ -131,7 +131,7 @@ groups: Note that for many CNIs, a lock file is created with permissions 750. This is expected and can be ignored. If you modify your CNI configuration, ensure that the permissions are set to 600. For example, chmod 600 /var/lib/cni/networks/ - scored: false + scored: true - id: 1.1.10 text: "Ensure that the Container Network Interface file ownership is set to root:root (Automated)" diff --git a/package/cfg/k3s-cis-1.7-hardened/master.yaml b/package/cfg/k3s-cis-1.7-hardened/master.yaml index 12984601..819026d3 100644 --- a/package/cfg/k3s-cis-1.7-hardened/master.yaml +++ b/package/cfg/k3s-cis-1.7-hardened/master.yaml @@ -133,7 +133,7 @@ groups: Note that for many CNIs, a lock file is created with permissions 750. This is expected and can be ignored. If you modify your CNI configuration, ensure that the permissions are set to 600. For example, chmod 600 /var/lib/cni/networks/ - scored: false + scored: true - id: 1.1.10 text: "Ensure that the Container Network Interface file ownership is set to root:root (Manual)" diff --git a/package/cfg/k3s-cis-1.7-permissive/master.yaml b/package/cfg/k3s-cis-1.7-permissive/master.yaml index 820b022a..74a5efb1 100644 --- a/package/cfg/k3s-cis-1.7-permissive/master.yaml +++ b/package/cfg/k3s-cis-1.7-permissive/master.yaml @@ -133,7 +133,7 @@ groups: Note that for many CNIs, a lock file is created with permissions 750. This is expected and can be ignored. If you modify your CNI configuration, ensure that the permissions are set to 600. For example, chmod 600 /var/lib/cni/networks/ - scored: false + scored: true - id: 1.1.10 text: "Ensure that the Container Network Interface file ownership is set to root:root (Manual)" diff --git a/package/cfg/k3s-cis-1.8-hardened/master.yaml b/package/cfg/k3s-cis-1.8-hardened/master.yaml index 4d2b3f45..875e28cb 100644 --- a/package/cfg/k3s-cis-1.8-hardened/master.yaml +++ b/package/cfg/k3s-cis-1.8-hardened/master.yaml @@ -133,7 +133,7 @@ groups: Note that for many CNIs, a lock file is created with permissions 750. This is expected and can be ignored. If you modify your CNI configuration, ensure that the permissions are set to 600. For example, chmod 600 /var/lib/cni/networks/ - scored: false + scored: true - id: 1.1.10 text: "Ensure that the Container Network Interface file ownership is set to root:root (Manual)" diff --git a/package/cfg/k3s-cis-1.8-permissive/master.yaml b/package/cfg/k3s-cis-1.8-permissive/master.yaml index 07bccf0c..fd9900a7 100644 --- a/package/cfg/k3s-cis-1.8-permissive/master.yaml +++ b/package/cfg/k3s-cis-1.8-permissive/master.yaml @@ -133,7 +133,7 @@ groups: Note that for many CNIs, a lock file is created with permissions 750. This is expected and can be ignored. If you modify your CNI configuration, ensure that the permissions are set to 600. For example, chmod 600 /var/lib/cni/networks/ - scored: false + scored: true - id: 1.1.10 text: "Ensure that the Container Network Interface file ownership is set to root:root (Manual)" diff --git a/package/cfg/rke2-cis-1.23-hardened/policies.yaml b/package/cfg/rke2-cis-1.23-hardened/policies.yaml index 3ff92c2c..f0aaa161 100644 --- a/package/cfg/rke2-cis-1.23-hardened/policies.yaml +++ b/package/cfg/rke2-cis-1.23-hardened/policies.yaml @@ -208,8 +208,8 @@ groups: text: "Minimize the admission of containers with capabilities assigned (Manual)" type: "manual" remediation: | - Review the use of capabilites in applications running on your cluster. Where a namespace - contains applicaions which do not require any Linux capabities to operate consider adding + Review the use of capabilities in applications running on your cluster. Where a namespace + contains applications which do not require any Linux capabities to operate consider adding a PSP which forbids the admission of containers which do not drop all capabilities. scored: false diff --git a/package/cfg/rke2-cis-1.23-permissive/policies.yaml b/package/cfg/rke2-cis-1.23-permissive/policies.yaml index 92216e4a..4616ff72 100644 --- a/package/cfg/rke2-cis-1.23-permissive/policies.yaml +++ b/package/cfg/rke2-cis-1.23-permissive/policies.yaml @@ -152,8 +152,8 @@ groups: text: "Minimize the admission of containers with capabilities assigned (Manual)" type: "manual" remediation: | - Review the use of capabilites in applications running on your cluster. Where a namespace - contains applicaions which do not require any Linux capabities to operate consider adding + Review the use of capabilities in applications running on your cluster. Where a namespace + contains applications which do not require any Linux capabities to operate consider adding a PSP which forbids the admission of containers which do not drop all capabilities. scored: false diff --git a/package/cfg/rke2-cis-1.24-hardened/etcd.yaml b/package/cfg/rke2-cis-1.24-hardened/etcd.yaml index c6a84d72..7c845db7 100644 --- a/package/cfg/rke2-cis-1.24-hardened/etcd.yaml +++ b/package/cfg/rke2-cis-1.24-hardened/etcd.yaml @@ -5,71 +5,6 @@ id: 2 text: "Etcd Node Configuration" type: "etcd" groups: - - id: 1.1 - text: "Master Node Configuration Files" - checks: - - id: 1.1.7 - text: "Ensure that the etcd pod specification file permissions are set to 644 or more restrictive (Automated)" - audit: "/bin/sh -c 'if test -e $etcdconf; then stat -c permissions=%a $etcdconf; fi'" - tests: - test_items: - - flag: "644" - compare: - op: eq - value: "644" - set: true - remediation: | - Run the below command (based on the file location on your system) on the control plane node. - For example, - chmod 644 $etcdconf - scored: true - - - id: 1.1.8 - text: "Ensure that the etcd pod specification file ownership is set to root:root (Automated)" - audit: "/bin/sh -c 'if test -e $etcdconf; then stat -c %U:%G $etcdconf; fi'" - tests: - test_items: - - flag: "root:root" - compare: - op: eq - value: "root:root" - set: true - remediation: | - Run the below command (based on the file location on your system) on the control plane node. - For example, - chown root:root $etcdconf - scored: true - - - id: 1.1.11 - text: "Ensure that the etcd data directory permissions are set to 700 or more restrictive (Automated)" - audit: "stat -c permissions=%a $etcddatadir" - tests: - test_items: - - flag: "permissions" - compare: - op: bitmask - value: "700" - remediation: | - On the etcd server node, get the etcd data directory, passed as an argument --data-dir, - from the command 'ps -ef | grep etcd'. - Run the below command (based on the etcd data directory found above). For example, - chmod 700 $etcddatadir - scored: true - - - id: 1.1.12 - text: "Ensure that the etcd data directory ownership is set to etcd:etcd (Automated)" - audit: "stat -c %U:%G $etcddatadir" - tests: - test_items: - - flag: "etcd:etcd" - set: true - remediation: | - On the etcd server node, get the etcd data directory, passed as an argument --data-dir, - from the command 'ps -ef | grep etcd'. - Run the below command (based on the etcd data directory found above). - For example, chown etcd:etcd /var/lib/etcd - scored: true - - id: 2 text: "Etcd Node Configuration" checks: diff --git a/package/cfg/rke2-cis-1.24-hardened/master.yaml b/package/cfg/rke2-cis-1.24-hardened/master.yaml index df593d85..30025a57 100644 --- a/package/cfg/rke2-cis-1.24-hardened/master.yaml +++ b/package/cfg/rke2-cis-1.24-hardened/master.yaml @@ -41,12 +41,12 @@ groups: - id: 1.1.3 text: "Ensure that the controller manager pod specification file permissions are set to 600 or more restrictive (Automated)" - audit: "/bin/sh -c 'if test -e $controllermanagerconf; then stat -c %a $controllermanagerconf; fi'" + audit: "/bin/sh -c 'if test -e $controllermanagerconf; then stat -c permissions=%a $controllermanagerconf; fi'" tests: test_items: - - flag: "600" + - flag: "permissions" compare: - op: eq + op: bitmask value: "600" set: true remediation: | @@ -140,12 +140,13 @@ groups: op: bitmask value: "600" remediation: | + Note that for many CNIs, a lock file is created with permissions 750. This is expected and can be ignored. Run the below command (based on the file location on your system) on the control plane node. - For example, chmod 600 + For example, chmod 600 /var/lib/cni/networks/ and chmod 600 /etc/cni/net.d/ scored: false - id: 1.1.10 - text: "Ensure that the Container Network Interface file ownership is set to root:root (Manual)" + text: "Ensure that the Container Network Interface file ownership is set to root:root (Automated)" audit: | ps -fC ${kubeletbin:-kubelet} | grep -- --cni-conf-dir || echo "/etc/cni/net.d" | sed 's%.*cni-conf-dir[= ]\([^ ]*\).*%\1%' | xargs -I{} find {} -mindepth 1 | xargs --no-run-if-empty stat -c %U:%G find /var/lib/cni/networks -type f 2> /dev/null | xargs --no-run-if-empty stat -c %U:%G @@ -248,7 +249,7 @@ groups: remediation: | Run the below command (based on the file location on your system) on the control plane node. For example, - chown root:root /var/lib/rancher/rke2/server/cred/controller.kubeconfig + chown root:root $controllermanagerkubeconfig scored: true - id: 1.1.19 @@ -286,7 +287,7 @@ groups: scored: false - id: 1.1.21 - text: "Ensure that the Kubernetes PKI key file permissions are set to 600 (Manual)" + text: "Ensure that the Kubernetes PKI key file permissions are set to 600 (Automated)" audit: "stat -c permissions=%a /var/lib/rancher/rke2/server/tls/*.key" use_multiple_values: true tests: @@ -306,7 +307,7 @@ groups: checks: - id: 1.2.1 text: "Ensure that the --anonymous-auth argument is set to false (Manual)" - audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep" + audit: "/bin/ps -fC $apiserverbin" tests: test_items: - flag: "--anonymous-auth" @@ -314,27 +315,29 @@ groups: op: eq value: false remediation: | - Edit the API server pod specification file $apiserverconf - on the control plane node and set the below parameter. - --anonymous-auth=false + By default, RKE2 sets the --anonymous-auth argument to false. + If this check fails, edit the RKE2 config file /etc/rancher/rke2/config.yaml and remove anything similar to below. + kube-apiserver-arg: + - "anonymous-auth=true" scored: false - id: 1.2.2 text: "Ensure that the --token-auth-file parameter is not set (Automated)" - audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep" + audit: "/bin/ps -fC $apiserverbin" tests: test_items: - flag: "--token-auth-file" set: false remediation: | - Follow the documentation and configure alternate mechanisms for authentication. Then, - edit the API server pod specification file $apiserverconf - on the control plane node and remove the --token-auth-file= parameter. + Follow the documentation and configure alternate mechanisms for authentication. + If this check fails, edit the RKE2 config file /etc/rancher/rke2/config.yaml and remove anything similar to below. + kube-apiserver-arg: + - "token-auth-file=" scored: true - id: 1.2.3 text: "Ensure that the --DenyServiceExternalIPs is not set (Automated)" - audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep" + audit: "/bin/ps -fC $apiserverbin" tests: bin_op: or test_items: @@ -346,14 +349,15 @@ groups: - flag: "--enable-admission-plugins" set: false remediation: | - Edit the API server pod specification file $apiserverconf - on the control plane node and remove the `DenyServiceExternalIPs` - from enabled admission plugins. + By default, RKE2 does not set DenyServiceExternalIPs. + If this check fails, edit the RKE2 config file /etc/rancher/rke2/config.yaml, remove any lines like below. + kube-apiserver-arg: + - "enable-admission-plugins=DenyServiceExternalIPs" scored: true - id: 1.2.4 text: "Ensure that the --kubelet-https argument is set to true (Automated)" - audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep" + audit: "/bin/ps -fC $apiserverbin" tests: bin_op: or test_items: @@ -370,7 +374,7 @@ groups: - id: 1.2.5 text: "Ensure that the --kubelet-client-certificate and --kubelet-client-key arguments are set as appropriate (Automated)" - audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep" + audit: "/bin/ps -fC $apiserverbin" tests: bin_op: and test_items: @@ -379,32 +383,32 @@ groups: - flag: "--kubelet-client-key" set: true remediation: | - Follow the Kubernetes documentation and set up the TLS connection between the - apiserver and kubelets. Then, edit API server pod specification file - $apiserverconf on the control plane node and set the - kubelet client certificate and key parameters as below. - --kubelet-client-certificate= - --kubelet-client-key= + By default, RKE2 automatically provides the kubelet client certificate and key. + They are generated and located at /var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt and /var/lib/rancher/rke2/server/tls/client-kube-apiserver.key + If for some reason you need to provide your own certificate and key, you can set the + below parameters in the RKE2 config file /etc/rancher/rke2/config.yaml. + kube-apiserver-arg: + - "kubelet-client-certificate=" + - "kubelet-client-key=" scored: true - id: 1.2.6 text: "Ensure that the --kubelet-certificate-authority argument is set as appropriate (Automated)" - audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep" + audit: "/bin/ps -fC $apiserverbin" tests: test_items: - flag: "--kubelet-certificate-authority" set: true remediation: | - Follow the Kubernetes documentation and setup the TLS connection between - the apiserver and kubelets. Then, edit the API server pod specification file - $apiserverconf on the control plane node and set the - --kubelet-certificate-authority parameter to the path to the cert file for the certificate authority. - --kubelet-certificate-authority= + By default, RKE2 automatically provides the kubelet CA cert file, at /var/lib/rancher/rke2/server/tls/server-ca.crt. + If this check fails, edit the RKE2 config file /etc/rancher/rke2/config.yaml and remove any lines like below. + kube-apiserver-arg: + - "kubelet-certificate-authority=" scored: true - id: 1.2.7 text: "Ensure that the --authorization-mode argument is not set to AlwaysAllow (Automated)" - audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep" + audit: "/bin/ps -fC $apiserverbin" tests: test_items: - flag: "--authorization-mode" @@ -413,15 +417,15 @@ groups: value: "AlwaysAllow" set: true remediation: | - Edit the API server pod specification file $apiserverconf - on the control plane node and set the --authorization-mode parameter to values other than AlwaysAllow. - One such example could be as below. - --authorization-mode=RBAC + By default, RKE2 does not set the --authorization-mode to AlwaysAllow. + If this check fails, edit RKE2 config file /etc/rancher/rke2/config.yaml, remove any lines like below. + kube-apiserver-arg: + - "authorization-mode=AlwaysAllow" scored: true - id: 1.2.8 text: "Ensure that the --authorization-mode argument includes Node (Automated)" - audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep" + audit: "/bin/ps -fC $apiserverbin" tests: test_items: - flag: "--authorization-mode" @@ -430,14 +434,14 @@ groups: value: "Node" set: true remediation: | - Edit the API server pod specification file $apiserverconf - on the control plane node and set the --authorization-mode parameter to a value that includes Node. - --authorization-mode=Node,RBAC + By default, RKE2 sets the --authorization-mode to Node and RBAC. + If this check fails, edit the RKE2 config file /etc/rancher/rke2/config.yaml, + ensure that you are not overriding authorization-mode. scored: true - id: 1.2.9 text: "Ensure that the --authorization-mode argument includes RBAC (Automated)" - audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep" + audit: "/bin/ps -fC $apiserverbin" tests: test_items: - flag: "--authorization-mode" @@ -446,14 +450,14 @@ groups: value: "RBAC" set: true remediation: | - Edit the API server pod specification file $apiserverconf - on the control plane node and set the --authorization-mode parameter to a value that includes RBAC, - for example `--authorization-mode=Node,RBAC`. + By default, RKE2 sets the --authorization-mode to Node and RBAC. + If this check fails, edit the RKE2 config file /etc/rancher/rke2/config.yaml, + ensure that you are not overriding authorization-mode. scored: true - id: 1.2.10 text: "Ensure that the admission control plugin EventRateLimit is set (Manual)" - audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep" + audit: "/bin/ps -fC $apiserverbin" tests: test_items: - flag: "--enable-admission-plugins" @@ -462,15 +466,15 @@ groups: value: "EventRateLimit" remediation: | Follow the Kubernetes documentation and set the desired limits in a configuration file. - Then, edit the API server pod specification file $apiserverconf - and set the below parameters. - --enable-admission-plugins=...,EventRateLimit,... - --admission-control-config-file= + Then, edit the RKE2 config file /etc/rancher/rke2/config.yaml and set the below parameters. + kube-apiserver-arg: + - "enable-admission-plugins=...,EventRateLimit,..." + - "admission-control-config-file=" scored: false - id: 1.2.11 text: "Ensure that the admission control plugin AlwaysAdmit is not set (Automated)" - audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep" + audit: "/bin/ps -fC $apiserverbin" tests: bin_op: or test_items: @@ -482,14 +486,15 @@ groups: - flag: "--enable-admission-plugins" set: false remediation: | - Edit the API server pod specification file $apiserverconf - on the control plane node and either remove the --enable-admission-plugins parameter, or set it to a - value that does not include AlwaysAdmit. + By default, RKE2 does not set the --enable-admission-plugins to AlwaysAdmit. + If this check fails, edit RKE2 config file /etc/rancher/rke2/config.yaml, remove any lines like below. + kube-apiserver-arg: + - "enable-admission-plugins=AlwaysAdmit" scored: true - id: 1.2.12 text: "Ensure that the admission control plugin AlwaysPullImages is set (Manual)" - audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep" + audit: "/bin/ps -fC $apiserverbin" tests: test_items: - flag: "--enable-admission-plugins" @@ -497,7 +502,11 @@ groups: op: has value: "AlwaysPullImages" remediation: | - Edit the API server pod specification file $apiserverconf + Permissive, per CIS guidelines, + "This setting could impact offline or isolated clusters, which have images pre-loaded and + do not have access to a registry to pull in-use images. This setting is not appropriate for + clusters which use this configuration." + Edit the RKE2 config file /etc/rancher/rke2/config.yaml on the control plane node and set the --enable-admission-plugins parameter to include AlwaysPullImages. --enable-admission-plugins=...,AlwaysPullImages,... @@ -505,7 +514,7 @@ groups: - id: 1.2.13 text: "Ensure that the admission control plugin SecurityContextDeny is set if PodSecurityPolicy is not used (Manual)" - audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep" + audit: "/bin/ps -fC $apiserverbin" tests: bin_op: or test_items: @@ -526,7 +535,7 @@ groups: - id: 1.2.14 text: "Ensure that the admission control plugin ServiceAccount is set (Automated)" - audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep" + audit: "/bin/ps -fC $apiserverbin" tests: bin_op: or test_items: @@ -537,15 +546,16 @@ groups: - flag: "--disable-admission-plugins" set: false remediation: | + By default, RKE2 does not set the --disable-admission-plugins to anything. Follow the documentation and create ServiceAccount objects as per your environment. - Then, edit the API server pod specification file $apiserverconf - on the control plane node and ensure that the --disable-admission-plugins parameter is set to a - value that does not include ServiceAccount. + If this check fails, edit the RKE2 config file /etc/rancher/rke2/config.yaml and remove any lines like below. + kube-apiserver-arg: + - "disable-admission-plugins=ServiceAccount" scored: true - id: 1.2.15 text: "Ensure that the admission control plugin NamespaceLifecycle is set (Automated)" - audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep" + audit: "/bin/ps -fC $apiserverbin" tests: bin_op: or test_items: @@ -556,14 +566,15 @@ groups: - flag: "--disable-admission-plugins" set: false remediation: | - Edit the API server pod specification file $apiserverconf - on the control plane node and set the --disable-admission-plugins parameter to - ensure it does not include NamespaceLifecycle. + By default, RKE2 does not set the --disable-admission-plugins to anything. + If this check fails, edit the RKE2 config file /etc/rancher/rke2/config.yaml and remove any lines like below. + kube-apiserver-arg: + - "disable-admission-plugins=...,NamespaceLifecycle,..." scored: true - id: 1.2.16 text: "Ensure that the admission control plugin NodeRestriction is set (Automated)" - audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep" + audit: "/bin/ps -fC $apiserverbin" tests: test_items: - flag: "--enable-admission-plugins" @@ -572,16 +583,16 @@ groups: value: "NodeRestriction" set: true remediation: | - Follow the Kubernetes documentation and configure NodeRestriction plug-in on kubelets. - Then, edit the API server pod specification file $apiserverconf - on the control plane node and set the --enable-admission-plugins parameter to a - value that includes NodeRestriction. - --enable-admission-plugins=...,NodeRestriction,... + By default, RKE2 sets the --enable-admission-plugins to NodeRestriction. + Check the RKE2 config file /etc/rancher/rke2/config.yaml, and ensure that you are not overriding the admission plugins. + If you are, include NodeRestriction in the list. + kube-apiserver-arg: + - "enable-admission-plugins=...,NodeRestriction,..." scored: true - id: 1.2.17 text: "Ensure that the --secure-port argument is not set to 0 (Automated)" - audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep" + audit: "/bin/ps -fC $apiserverbin" tests: bin_op: or test_items: @@ -600,7 +611,7 @@ groups: - id: 1.2.18 text: "Ensure that the --profiling argument is set to false (Automated)" - audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep" + audit: "/bin/ps -fC $apiserverbin" tests: test_items: - flag: "--profiling" @@ -609,28 +620,31 @@ groups: value: false set: true remediation: | - Edit the API server pod specification file $apiserverconf - on the control plane node and set the below parameter. - --profiling=false + By default, RKE2 sets the --profiling argument to false. + If this check fails, edit the RKE2 config file /etc/rancher/rke2/config.yaml and remove any lines like below. + kube-apiserver-arg: + - "profiling=true" scored: true - id: 1.2.19 text: "Ensure that the --audit-log-path argument is set (Automated)" - audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep" + audit: "/bin/ps -fC $apiserverbin" tests: test_items: - flag: "--audit-log-path" set: true remediation: | - Edit the API server pod specification file $apiserverconf + By default, RKE2 sets the --audit-log-path argument to /var/lib/rancher/rke2/server/logs/audit.log + If you want to change this, edit the RKE2 config file /etc/rancher/rke2/config.yaml on the control plane node and set the --audit-log-path parameter to a suitable path and file where you would like audit logs to be written, for example, - --audit-log-path=/var/log/apiserver/audit.log + kube-apiserver-arg: + - "audit-log-path=/var/log/rke2/audit.log" scored: true - id: 1.2.20 text: "Ensure that the --audit-log-maxage argument is set to 30 or as appropriate (Automated)" - audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep" + audit: "/bin/ps -fC $apiserverbin" tests: test_items: - flag: "--audit-log-maxage" @@ -639,15 +653,16 @@ groups: value: 30 set: true remediation: | - Edit the API server pod specification file $apiserverconf - on the control plane node and set the --audit-log-maxage parameter to 30 - or as an appropriate number of days, for example, - --audit-log-maxage=30 + By default, RKE2 sets the --audit-log-maxage argument to 30 days. + If you want to change this, edit the RKE2 config file /etc/rancher/rke2/config.yaml + on the control plane node and set the --audit-log-maxage parameter to an appropriate number of days, for example, + kube-apiserver-arg: + - "audit-log-maxage=40" scored: true - id: 1.2.21 text: "Ensure that the --audit-log-maxbackup argument is set to 10 or as appropriate (Automated)" - audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep" + audit: "/bin/ps -fC $apiserverbin" tests: test_items: - flag: "--audit-log-maxbackup" @@ -656,15 +671,17 @@ groups: value: 10 set: true remediation: | - Edit the API server pod specification file $apiserverconf - on the control plane node and set the --audit-log-maxbackup parameter to 10 or to an appropriate - value. For example, - --audit-log-maxbackup=10 + By default, RKE2 sets the --audit-log-maxbackup argument to 10. + If you want to change this, edit the RKE2 config file /etc/rancher/rke2/config.yaml + on the control plane node and set the --audit-log-maxbackup parameter to an appropriate value. + For example, + kube-apiserver-arg: + - "audit-log-maxbackup=15" scored: true - id: 1.2.22 text: "Ensure that the --audit-log-maxsize argument is set to 100 or as appropriate (Automated)" - audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep" + audit: "/bin/ps -fC $apiserverbin" tests: test_items: - flag: "--audit-log-maxsize" @@ -673,14 +690,17 @@ groups: value: 100 set: true remediation: | - Edit the API server pod specification file $apiserverconf + By default, RKE2 sets the --audit-log-maxsize argument to 100 MB. + If you want to change this, edit the RKE2 config file /etc/rancher/rke2/config.yaml on the control plane node and set the --audit-log-maxsize parameter to an appropriate size in MB. - For example, to set it as 100 MB, --audit-log-maxsize=100 + For example, + kube-apiserver-arg: + - "audit-log-maxsize=150" scored: true - id: 1.2.23 text: "Ensure that the --request-timeout argument is set as appropriate (Automated)" - audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep" + audit: "/bin/ps -fC $apiserverbin" tests: bin_op: or test_items: @@ -688,14 +708,17 @@ groups: set: false - flag: "--request-timeout" remediation: | - Edit the API server pod specification file $apiserverconf - and set the below parameter as appropriate and if needed. - For example, --request-timeout=300s + Permissive, per CIS guidelines, + "it is recommended to set this limit as appropriate and change the default limit of 60 seconds only if needed". + Edit the RKE2 config file /etc/rancher/rke2/config.yaml + and set the below parameter if needed. For example, + kube-apiserver-arg: + - "request-timeout=300s" scored: true - id: 1.2.24 text: "Ensure that the --service-account-lookup argument is set to true (Automated)" - audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep" + audit: "/bin/ps -fC $apiserverbin" tests: bin_op: or test_items: @@ -706,30 +729,32 @@ groups: op: eq value: true remediation: | - Edit the API server pod specification file $apiserverconf - on the control plane node and set the below parameter. - --service-account-lookup=true - Alternatively, you can delete the --service-account-lookup parameter from this file so + By default, RKE2 does not set the --service-account-lookup argument. + Edit the RKE2 config file /etc/rancher/rke2/config.yaml and set the service-account-lookup. For example, + kube-apiserver-arg: + - "service-account-lookup=true" + Alternatively, you can delete the service-account-lookup parameter from this file so that the default takes effect. scored: true - id: 1.2.25 text: "Ensure that the --service-account-key-file argument is set as appropriate (Automated)" - audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep" + audit: "/bin/ps -fC $apiserverbin" tests: test_items: - flag: "--service-account-key-file" set: true remediation: | - Edit the API server pod specification file $apiserverconf - on the control plane node and set the --service-account-key-file parameter - to the public key file for service accounts. For example, - --service-account-key-file= + RKE2 automatically generates and sets the service account key file. + It is located at /var/lib/rancher/rke2/server/tls/service.key. + If this check fails, edit RKE2 config file /etc/rancher/rke2/config.yaml and remove any lines like below. + kube-apiserver-arg: + - "service-account-key-file=" scored: true - id: 1.2.26 text: "Ensure that the --etcd-certfile and --etcd-keyfile arguments are set as appropriate (Automated)" - audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep" + audit: "/bin/ps -fC $apiserverbin" tests: bin_op: and test_items: @@ -738,16 +763,17 @@ groups: - flag: "--etcd-keyfile" set: true remediation: | - Follow the Kubernetes documentation and set up the TLS connection between the apiserver and etcd. - Then, edit the API server pod specification file $apiserverconf - on the control plane node and set the etcd certificate and key file parameters. - --etcd-certfile= - --etcd-keyfile= + RKE2 automatically generates and sets the etcd certificate and key files. + They are located at /var/lib/rancher/rke2/server/tls/etcd/client.crt and /var/lib/rancher/rke2/server/tls/etcd/client.key. + If this check fails, edit the RKE2 config file /etc/rancher/rke2/config.yaml and remove any lines like below. + kube-apiserver-arg: + - "etcd-certfile=" + - "etcd-keyfile=" scored: true - id: 1.2.27 text: "Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate (Automated)" - audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep" + audit: "/bin/ps -fC $apiserverbin" tests: bin_op: and test_items: @@ -756,53 +782,57 @@ groups: - flag: "--tls-private-key-file" set: true remediation: | - Follow the Kubernetes documentation and set up the TLS connection on the apiserver. - Then, edit the API server pod specification file $apiserverconf - on the control plane node and set the TLS certificate and private key file parameters. - --tls-cert-file= - --tls-private-key-file= + By default, RKE2 automatically generates and provides the TLS certificate and private key for the apiserver. + They are generated and located at /var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt and /var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key + If this check fails, edit the RKE2 config file /etc/rancher/rke2/config.yaml and remove any lines like below. + kube-apiserver-arg: + - "tls-cert-file=" + - "tls-private-key-file=" scored: true - id: 1.2.28 text: "Ensure that the --client-ca-file argument is set as appropriate (Automated)" - audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep" + audit: "/bin/ps -fC $apiserverbin" tests: test_items: - flag: "--client-ca-file" set: true remediation: | - Follow the Kubernetes documentation and set up the TLS connection on the apiserver. - Then, edit the API server pod specification file $apiserverconf - on the control plane node and set the client certificate authority file. - --client-ca-file= + By default, RKE2 automatically provides the client certificate authority file. + It is generated and located at /var/lib/rancher/rke2/server/tls/client-ca.crt. + If for some reason you need to provide your own ca certificate, look at using the rke2 certificate command line tool. + If this check fails, edit the RKE2 config file /etc/rancher/rke2/config.yaml and remove any lines like below. + kube-apiserver-arg: + - "client-ca-file=" scored: true - id: 1.2.29 text: "Ensure that the --etcd-cafile argument is set as appropriate (Automated)" - audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep" + audit: "/bin/ps -fC $apiserverbin" tests: test_items: - flag: "--etcd-cafile" set: true remediation: | - Follow the Kubernetes documentation and set up the TLS connection between the apiserver and etcd. - Then, edit the API server pod specification file $apiserverconf - on the control plane node and set the etcd certificate authority file parameter. - --etcd-cafile= + By default, RKE2 automatically provides the etcd certificate authority file. + It is generated and located at /var/lib/rancher/rke2/server/tls/client-ca.crt. + If for some reason you need to provide your own ca certificate, look at using the rke2 certificate command line tool. + If this check fails, edit the RKE2 config file /etc/rancher/rke2/config.yaml and remove any lines like below. + kube-apiserver-arg: + - "etcd-cafile=" scored: true - id: 1.2.30 text: "Ensure that the --encryption-provider-config argument is set as appropriate (Automated)" - audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep" + audit: "/bin/ps -fC $apiserverbin" tests: test_items: - flag: "--encryption-provider-config" set: true remediation: | - Follow the Kubernetes documentation and configure a EncryptionConfig file. - Then, edit the API server pod specification file $apiserverconf - on the control plane node and set the --encryption-provider-config parameter to the path of that file. - For example, --encryption-provider-config= + RKE2 always is configured to encrypt secrets. + Secrets encryption is managed with the rke2 secrets-encrypt command line tool. + If needed, you can find the generated encryption config at /var/lib/rancher/rke2/server/cred/encryption-config.json scored: true - id: 1.2.33 @@ -813,13 +843,14 @@ groups: - flag: "0" set: true remediation: | - Follow the Kubernetes documentation and configure a EncryptionConfig file. - In this file, choose aescbc, kms or secretbox as the encryption provider. + RKE2 always is configured to use the aescbc encryption provider to encrypt secrets. + Secrets encryption is managed with the rke2 secrets-encrypt command line tool. + If needed, you can find the generated encryption config at /var/lib/rancher/rke2/server/cred/encryption-config.json scored: true - id: 1.2.32 text: "Ensure that the API Server only makes use of Strong Cryptographic Ciphers (Automated)" - audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep" + audit: "/bin/ps -fC $apiserverbin" tests: test_items: - flag: "--tls-cipher-suites" @@ -839,20 +870,22 @@ groups: checks: - id: 1.3.1 text: "Ensure that the --terminated-pod-gc-threshold argument is set as appropriate (Manual)" - audit: "/bin/ps -ef | grep $controllermanagerbin | grep -v grep" + audit: "/bin/ps -fC $controllermanagerbin" tests: test_items: - flag: "--terminated-pod-gc-threshold" set: true remediation: | - Edit the Controller Manager pod specification file $controllermanagerconf - on the control plane node and set the --terminated-pod-gc-threshold to an appropriate threshold, - for example, --terminated-pod-gc-threshold=10 + By default, RKE2 sets a terminated-pod-gc-threshold of 1000. + If you need to change this value, edit the RKE2 config file /etc/rancher/rke2/config.yaml on the control plane node + and set the --terminated-pod-gc-threshold to an appropriate threshold, + kube-controller-manager-arg: + - "terminated-pod-gc-threshold=10" scored: true - id: 1.3.2 text: "Ensure that the --profiling argument is set to false (Automated)" - audit: "/bin/ps -ef | grep $controllermanagerbin | grep -v grep" + audit: "/bin/ps -fC $controllermanagerbin" tests: test_items: - flag: "--profiling" @@ -861,14 +894,15 @@ groups: value: false set: true remediation: | - Edit the Controller Manager pod specification file $controllermanagerconf - on the control plane node and set the below parameter. - --profiling=false + By default, RKE2 sets the --profiling argument to false. + If this check fails, edit the RKE2 config file /etc/rancher/rke2/config.yaml and remove any lines like below. + kube-controller-manager-arg: + - "profiling=true" scored: true - id: 1.3.3 text: "Ensure that the --use-service-account-credentials argument is set to true (Automated)" - audit: "/bin/ps -ef | grep $controllermanagerbin | grep -v grep" + audit: "/bin/ps -fC $controllermanagerbin" tests: test_items: - flag: "--use-service-account-credentials" @@ -877,41 +911,45 @@ groups: value: false set: true remediation: | - Edit the Controller Manager pod specification file $controllermanagerconf - on the control plane node to set the below parameter. - --use-service-account-credentials=true + By default, RKE2 sets the --use-service-account-credentials argument to true. + If this check fails, edit the RKE2 config file /etc/rancher/rke2/config.yaml and remove any lines like below. + kube-controller-manager-arg: + - "use-service-account-credentials=false" scored: true - id: 1.3.4 text: "Ensure that the --service-account-private-key-file argument is set as appropriate (Automated)" - audit: "/bin/ps -ef | grep $controllermanagerbin | grep -v grep" + audit: "/bin/ps -fC $controllermanagerbin" tests: test_items: - flag: "--service-account-private-key-file" set: true remediation: | - Edit the Controller Manager pod specification file $controllermanagerconf - on the control plane node and set the --service-account-private-key-file parameter - to the private key file for service accounts. - --service-account-private-key-file= + By default, RKE2 automatically provides the service account private key file. + It is generated and located at /var/lib/rancher/rke2/server/tls/service.current.key. + If this check fails, edit the RKE2 config file /etc/rancher/rke2/config.yaml and remove any lines like below. + kube-controller-manager-arg: + - "service-account-private-key-file=" scored: true - id: 1.3.5 text: "Ensure that the --root-ca-file argument is set as appropriate (Automated)" - audit: "/bin/ps -ef | grep $controllermanagerbin | grep -v grep" + audit: "/bin/ps -fC $controllermanagerbin" tests: test_items: - flag: "--root-ca-file" set: true remediation: | - Edit the Controller Manager pod specification file $controllermanagerconf - on the control plane node and set the --root-ca-file parameter to the certificate bundle file`. - --root-ca-file= + By default, RKE2 automatically provides the root CA file. + It is generated and located at /var/lib/rancher/rke2/server/tls/server-ca.crt. + If this check fails, edit the RKE2 config file /etc/rancher/rke2/config.yaml and remove any lines like below. + kube-controller-manager-arg: + - "root-ca-file=" scored: true - id: 1.3.6 text: "Ensure that the RotateKubeletServerCertificate argument is set to true (Automated)" - audit: "/bin/ps -ef | grep $controllermanagerbin | grep -v grep" + audit: "/bin/ps -fC $controllermanagerbin" tests: bin_op: or test_items: @@ -927,11 +965,10 @@ groups: on the control plane node and set the --feature-gates parameter to include RotateKubeletServerCertificate=true. --feature-gates=RotateKubeletServerCertificate=true scored: true - type: skip - id: 1.3.7 text: "Ensure that the --bind-address argument is set to 127.0.0.1 (Automated)" - audit: "/bin/ps -ef | grep $controllermanagerbin | grep -v grep" + audit: "/bin/ps -fC $controllermanagerbin" tests: bin_op: or test_items: @@ -943,8 +980,10 @@ groups: - flag: "--bind-address" set: false remediation: | - Edit the Controller Manager pod specification file $controllermanagerconf - on the control plane node and ensure the correct value for the --bind-address parameter + By default, RKE2 sets the --bind-address argument to 127.0.0.1 + If this check fails, edit the RKE2 config file /etc/rancher/rke2/config.yaml and remove any lines like below. + kube-controller-manager-arg: + - "bind-address=" scored: true - id: 1.4 @@ -952,7 +991,7 @@ groups: checks: - id: 1.4.1 text: "Ensure that the --profiling argument is set to false (Automated)" - audit: "/bin/ps -ef | grep $schedulerbin | grep -v grep" + audit: "/bin/ps -fC $schedulerbin" tests: test_items: - flag: "--profiling" @@ -961,14 +1000,15 @@ groups: value: false set: true remediation: | - Edit the Scheduler pod specification file $schedulerconf file - on the control plane node and set the below parameter. - --profiling=false + By default, RKE2 sets the --profiling argument to false. + If this check fails, edit the RKE2 config file /etc/rancher/rke2/config.yaml and remove any lines like below. + kube-scheduler-arg: + - "profiling=true" scored: true - id: 1.4.2 text: "Ensure that the --bind-address argument is set to 127.0.0.1 (Automated)" - audit: "/bin/ps -ef | grep $schedulerbin | grep -v grep" + audit: "/bin/ps -fC $schedulerbin" tests: bin_op: or test_items: @@ -980,6 +1020,8 @@ groups: - flag: "--bind-address" set: false remediation: | - Edit the Scheduler pod specification file $schedulerconf - on the control plane node and ensure the correct value for the --bind-address parameter + By default, RKE2 sets the --bind-address argument to 127.0.0.1 + If this check fails, edit the RKE2 config file /etc/rancher/rke2/config.yaml and remove any lines like below. + kube-scheduler-arg: + - "bind-address=" scored: true diff --git a/package/cfg/rke2-cis-1.24-hardened/policies.yaml b/package/cfg/rke2-cis-1.24-hardened/policies.yaml index 72a533f9..abbb84d0 100644 --- a/package/cfg/rke2-cis-1.24-hardened/policies.yaml +++ b/package/cfg/rke2-cis-1.24-hardened/policies.yaml @@ -208,8 +208,8 @@ groups: text: "Minimize the admission of containers with capabilities assigned (Manual)" type: "manual" remediation: | - Review the use of capabilites in applications running on your cluster. Where a namespace - contains applicaions which do not require any Linux capabities to operate consider adding + Review the use of capabilities in applications running on your cluster. Where a namespace + contains applications which do not require any Linux capabities to operate consider adding a PSP which forbids the admission of containers which do not drop all capabilities. scored: false diff --git a/package/cfg/rke2-cis-1.24-permissive/etcd.yaml b/package/cfg/rke2-cis-1.24-permissive/etcd.yaml index 5ceb924e..996b7102 100644 --- a/package/cfg/rke2-cis-1.24-permissive/etcd.yaml +++ b/package/cfg/rke2-cis-1.24-permissive/etcd.yaml @@ -5,72 +5,6 @@ id: 2 text: "Etcd Node Configuration" type: "etcd" groups: - - id: 1.1 - text: "Master Node Configuration Files" - checks: - - id: 1.1.7 - text: "Ensure that the etcd pod specification file permissions are set to 644 or more restrictive (Automated)" - audit: "/bin/sh -c 'if test -e $etcdconf; then find $etcdconf -name '*etcd*' | xargs stat -c permissions=%a; fi'" - use_multiple_values: true - tests: - test_items: - - flag: "permissions" - compare: - op: bitmask - value: "644" - remediation: | - Run the below command (based on the file location on your system) on the control plane node. - For example, - chmod 644 $etcdconf - scored: true - - - id: 1.1.8 - text: "Ensure that the etcd pod specification file ownership is set to root:root (Automated)" - audit: "/bin/sh -c 'if test -e $etcdconf; then stat -c %U:%G $etcdconf; fi'" - tests: - test_items: - - flag: "root:root" - compare: - op: eq - value: "root:root" - set: true - remediation: | - Run the below command (based on the file location on your system) on the control plane node. - For example, - chown root:root $etcdconf - scored: true - - - id: 1.1.11 - text: "Ensure that the etcd data directory permissions are set to 700 or more restrictive (Automated)" - audit: "stat -c permissions=%a $etcddatadir" - tests: - test_items: - - flag: "permissions" - compare: - op: bitmask - value: "700" - set: true - remediation: | - On the etcd server node, get the etcd data directory, passed as an argument --data-dir, - from the command 'ps -ef | grep etcd'. - Run the below command (based on the etcd data directory found above). For example, - chmod 700 $etcddatadir - scored: true - - - id: 1.1.12 - text: "Ensure that the etcd data directory ownership is set to etcd:etcd (Automated)" - type: "skip" - audit: "stat -c %U:%G $etcddatadir" - tests: - test_items: - - flag: "etcd:etcd" - remediation: | - On the etcd server node, get the etcd data directory, passed as an argument --data-dir, - from the command 'ps -ef | grep etcd'. - Run the below command (based on the etcd data directory found above). - For example, chown etcd:etcd /var/lib/etcd - scored: true - - id: 2 text: "Etcd Node Configuration" checks: diff --git a/package/cfg/rke2-cis-1.24-permissive/master.yaml b/package/cfg/rke2-cis-1.24-permissive/master.yaml index 8728e698..3fc9c4c4 100644 --- a/package/cfg/rke2-cis-1.24-permissive/master.yaml +++ b/package/cfg/rke2-cis-1.24-permissive/master.yaml @@ -44,9 +44,9 @@ groups: audit: "/bin/sh -c 'if test -e $controllermanagerconf; then stat -c permissions=%a $controllermanagerconf; fi'" tests: test_items: - - flag: "644" + - flag: "permissions" compare: - op: eq + op: bitmask value: "600" set: true remediation: | @@ -74,9 +74,9 @@ groups: audit: "/bin/sh -c 'if test -e $schedulerconf; then stat -c permissions=%a $schedulerconf; fi'" tests: test_items: - - flag: "600" + - flag: "permissions" compare: - op: eq + op: bitmask value: "600" set: true remediation: | @@ -140,12 +140,13 @@ groups: op: bitmask value: "600" remediation: | + Note that for many CNIs, a lock file is created with permissions 750. This is expected and can be ignored. Run the below command (based on the file location on your system) on the control plane node. - For example, chmod 600 + For example, chmod 600 /var/lib/cni/networks/ and chmod 600 /etc/cni/net.d/ scored: false - id: 1.1.10 - text: "Ensure that the Container Network Interface file ownership is set to root:root (Manual)" + text: "Ensure that the Container Network Interface file ownership is set to root:root (Automated)" audit: | ps -fC ${kubeletbin:-kubelet} | grep -- --cni-conf-dir || echo "/etc/cni/net.d" | sed 's%.*cni-conf-dir[= ]\([^ ]*\).*%\1%' | xargs -I{} find {} -mindepth 1 | xargs --no-run-if-empty stat -c %U:%G find /var/lib/cni/networks -type f 2> /dev/null | xargs --no-run-if-empty stat -c %U:%G @@ -194,9 +195,9 @@ groups: audit: "stat -c %a $schedulerkubeconfig" tests: test_items: - - flag: "600" + - flag: "permissions" compare: - op: eq + op: bitmask value: "600" set: true remediation: | @@ -226,9 +227,9 @@ groups: audit: "stat -c %a $controllermanagerkubeconfig" tests: test_items: - - flag: "600" + - flag: "permissions" compare: - op: eq + op: bitmask value: "600" set: true remediation: | @@ -250,7 +251,7 @@ groups: remediation: | Run the below command (based on the file location on your system) on the control plane node. For example, - chown root:root /var/lib/rancher/rke2/server/cred/controller.kubeconfig + chown root:root $controllermanagerkubeconfig scored: true - id: 1.1.19 @@ -288,7 +289,7 @@ groups: scored: false - id: 1.1.21 - text: "Ensure that the Kubernetes PKI key file permissions are set to 600 (Manual)" + text: "Ensure that the Kubernetes PKI key file permissions are set to 600 (Automated)" audit: "stat -c permissions=%a /var/lib/rancher/rke2/server/tls/*.key" use_multiple_values: true tests: @@ -309,7 +310,7 @@ groups: checks: - id: 1.2.1 text: "Ensure that the --anonymous-auth argument is set to false (Manual)" - audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep" + audit: "/bin/ps -fC $apiserverbin" type: manual tests: test_items: @@ -318,27 +319,29 @@ groups: op: eq value: false remediation: | - Edit the API server pod specification file $apiserverconf - on the control plane node and set the below parameter. - --anonymous-auth=false + By default, RKE2 sets the --anonymous-auth argument to false. + If this check fails, edit the RKE2 config file /etc/rancher/rke2/config.yaml and remove anything similar to below. + kube-apiserver-arg: + - "anonymous-auth=true" scored: false - id: 1.2.2 text: "Ensure that the --token-auth-file parameter is not set (Automated)" - audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep" + audit: "/bin/ps -fC $apiserverbin" tests: test_items: - flag: "--token-auth-file" set: false remediation: | - Follow the documentation and configure alternate mechanisms for authentication. Then, - edit the API server pod specification file $apiserverconf - on the control plane node and remove the --token-auth-file= parameter. + Follow the documentation and configure alternate mechanisms for authentication. + If this check fails, edit the RKE2 config file /etc/rancher/rke2/config.yaml and remove anything similar to below. + kube-apiserver-arg: + - "token-auth-file=" scored: true - id: 1.2.3 text: "Ensure that the --DenyServiceExternalIPs is not set (Automated)" - audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep" + audit: "/bin/ps -fC $apiserverbin" tests: bin_op: or test_items: @@ -350,14 +353,15 @@ groups: - flag: "--enable-admission-plugins" set: false remediation: | - Edit the API server pod specification file $apiserverconf - on the control plane node and remove the `DenyServiceExternalIPs` - from enabled admission plugins. + By default, RKE2 does not set DenyServiceExternalIPs. + If this check fails, edit the RKE2 config file /etc/rancher/rke2/config.yaml, remove any lines like below. + kube-apiserver-arg: + - "enable-admission-plugins=DenyServiceExternalIPs" scored: true - id: 1.2.4 text: "Ensure that the --kubelet-https argument is set to true (Automated)" - audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep" + audit: "/bin/ps -fC $apiserverbin" tests: bin_op: or test_items: @@ -374,7 +378,7 @@ groups: - id: 1.2.5 text: "Ensure that the --kubelet-client-certificate and --kubelet-client-key arguments are set as appropriate (Automated)" - audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep" + audit: "/bin/ps -fC $apiserverbin" tests: bin_op: and test_items: @@ -383,32 +387,32 @@ groups: - flag: "--kubelet-client-key" set: true remediation: | - Follow the Kubernetes documentation and set up the TLS connection between the - apiserver and kubelets. Then, edit API server pod specification file - $apiserverconf on the control plane node and set the - kubelet client certificate and key parameters as below. - --kubelet-client-certificate= - --kubelet-client-key= + By default, RKE2 automatically provides the kubelet client certificate and key. + They are generated and located at /var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt and /var/lib/rancher/rke2/server/tls/client-kube-apiserver.key + If for some reason you need to provide your own certificate and key, you can set the + below parameters in the RKE2 config file /etc/rancher/rke2/config.yaml. + kube-apiserver-arg: + - "kubelet-client-certificate=" + - "kubelet-client-key=" scored: true - id: 1.2.6 text: "Ensure that the --kubelet-certificate-authority argument is set as appropriate (Automated)" - audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep" + audit: "/bin/ps -fC $apiserverbin" tests: test_items: - flag: "--kubelet-certificate-authority" set: true remediation: | - Follow the Kubernetes documentation and setup the TLS connection between - the apiserver and kubelets. Then, edit the API server pod specification file - $apiserverconf on the control plane node and set the - --kubelet-certificate-authority parameter to the path to the cert file for the certificate authority. - --kubelet-certificate-authority= + By default, RKE2 automatically provides the kubelet CA cert file, at /var/lib/rancher/rke2/server/tls/server-ca.crt. + If this check fails, edit the RKE2 config file /etc/rancher/rke2/config.yaml and remove any lines like below. + kube-apiserver-arg: + - "kubelet-certificate-authority=" scored: true - id: 1.2.7 text: "Ensure that the --authorization-mode argument is not set to AlwaysAllow (Automated)" - audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep" + audit: "/bin/ps -fC $apiserverbin" tests: test_items: - flag: "--authorization-mode" @@ -417,15 +421,15 @@ groups: value: "AlwaysAllow" set: true remediation: | - Edit the API server pod specification file $apiserverconf - on the control plane node and set the --authorization-mode parameter to values other than AlwaysAllow. - One such example could be as below. - --authorization-mode=RBAC + By default, RKE2 does not set the --authorization-mode to AlwaysAllow. + If this check fails, edit RKE2 config file /etc/rancher/rke2/config.yaml, remove any lines like below. + kube-apiserver-arg: + - "authorization-mode=AlwaysAllow" scored: true - id: 1.2.8 text: "Ensure that the --authorization-mode argument includes Node (Automated)" - audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep" + audit: "/bin/ps -fC $apiserverbin" tests: test_items: - flag: "--authorization-mode" @@ -434,14 +438,14 @@ groups: value: "Node" set: true remediation: | - Edit the API server pod specification file $apiserverconf - on the control plane node and set the --authorization-mode parameter to a value that includes Node. - --authorization-mode=Node,RBAC + By default, RKE2 sets the --authorization-mode to Node and RBAC. + If this check fails, edit the RKE2 config file /etc/rancher/rke2/config.yaml, + ensure that you are not overriding authorization-mode. scored: true - id: 1.2.9 text: "Ensure that the --authorization-mode argument includes RBAC (Automated)" - audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep" + audit: "/bin/ps -fC $apiserverbin" tests: test_items: - flag: "--authorization-mode" @@ -450,14 +454,14 @@ groups: value: "RBAC" set: true remediation: | - Edit the API server pod specification file $apiserverconf - on the control plane node and set the --authorization-mode parameter to a value that includes RBAC, - for example `--authorization-mode=Node,RBAC`. + By default, RKE2 sets the --authorization-mode to Node and RBAC. + If this check fails, edit the RKE2 config file /etc/rancher/rke2/config.yaml, + ensure that you are not overriding authorization-mode. scored: true - id: 1.2.10 text: "Ensure that the admission control plugin EventRateLimit is set (Manual)" - audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep" + audit: "/bin/ps -fC $apiserverbin" tests: test_items: - flag: "--enable-admission-plugins" @@ -467,15 +471,15 @@ groups: set: true remediation: | Follow the Kubernetes documentation and set the desired limits in a configuration file. - Then, edit the API server pod specification file $apiserverconf - and set the below parameters. - --enable-admission-plugins=...,EventRateLimit,... - --admission-control-config-file= + Then, edit the RKE2 config file /etc/rancher/rke2/config.yaml and set the below parameters. + kube-apiserver-arg: + - "enable-admission-plugins=...,EventRateLimit,..." + - "admission-control-config-file=" scored: false - id: 1.2.11 text: "Ensure that the admission control plugin AlwaysAdmit is not set (Automated)" - audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep" + audit: "/bin/ps -fC $apiserverbin" tests: bin_op: or test_items: @@ -487,14 +491,15 @@ groups: - flag: "--enable-admission-plugins" set: false remediation: | - Edit the API server pod specification file $apiserverconf - on the control plane node and either remove the --enable-admission-plugins parameter, or set it to a - value that does not include AlwaysAdmit. + By default, RKE2 does not set the --enable-admission-plugins to AlwaysAdmit. + If this check fails, edit RKE2 config file /etc/rancher/rke2/config.yaml, remove any lines like below. + kube-apiserver-arg: + - "enable-admission-plugins=AlwaysAdmit" scored: true - id: 1.2.12 text: "Ensure that the admission control plugin AlwaysPullImages is set (Manual)" - audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep" + audit: "/bin/ps -fC $apiserverbin" tests: test_items: - flag: "--enable-admission-plugins" @@ -503,7 +508,11 @@ groups: value: "AlwaysPullImages" set: true remediation: | - Edit the API server pod specification file $apiserverconf + Permissive, per CIS guidelines, + "This setting could impact offline or isolated clusters, which have images pre-loaded and + do not have access to a registry to pull in-use images. This setting is not appropriate for + clusters which use this configuration." + Edit the RKE2 config file /etc/rancher/rke2/config.yaml on the control plane node and set the --enable-admission-plugins parameter to include AlwaysPullImages. --enable-admission-plugins=...,AlwaysPullImages,... @@ -511,7 +520,7 @@ groups: - id: 1.2.13 text: "Ensure that the admission control plugin SecurityContextDeny is set if PodSecurityPolicy is not used (Manual)" - audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep" + audit: "/bin/ps -fC $apiserverbin" tests: bin_op: or test_items: @@ -534,7 +543,7 @@ groups: - id: 1.2.14 text: "Ensure that the admission control plugin ServiceAccount is set (Automated)" - audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep" + audit: "/bin/ps -fC $apiserverbin" tests: bin_op: or test_items: @@ -545,15 +554,16 @@ groups: - flag: "--disable-admission-plugins" set: false remediation: | + By default, RKE2 does not set the --disable-admission-plugins to anything. Follow the documentation and create ServiceAccount objects as per your environment. - Then, edit the API server pod specification file $apiserverconf - on the control plane node and ensure that the --disable-admission-plugins parameter is set to a - value that does not include ServiceAccount. + If this check fails, edit the RKE2 config file /etc/rancher/rke2/config.yaml and remove any lines like below. + kube-apiserver-arg: + - "disable-admission-plugins=ServiceAccount" scored: true - id: 1.2.15 text: "Ensure that the admission control plugin NamespaceLifecycle is set (Automated)" - audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep" + audit: "/bin/ps -fC $apiserverbin" tests: bin_op: or test_items: @@ -564,14 +574,15 @@ groups: - flag: "--disable-admission-plugins" set: false remediation: | - Edit the API server pod specification file $apiserverconf - on the control plane node and set the --disable-admission-plugins parameter to - ensure it does not include NamespaceLifecycle. + By default, RKE2 does not set the --disable-admission-plugins to anything. + If this check fails, edit the RKE2 config file /etc/rancher/rke2/config.yaml and remove any lines like below. + kube-apiserver-arg: + - "disable-admission-plugins=...,NamespaceLifecycle,..." scored: true - id: 1.2.16 text: "Ensure that the admission control plugin NodeRestriction is set (Automated)" - audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep" + audit: "/bin/ps -fC $apiserverbin" tests: test_items: - flag: "--enable-admission-plugins" @@ -580,16 +591,16 @@ groups: value: "NodeRestriction" set: true remediation: | - Follow the Kubernetes documentation and configure NodeRestriction plug-in on kubelets. - Then, edit the API server pod specification file $apiserverconf - on the control plane node and set the --enable-admission-plugins parameter to a - value that includes NodeRestriction. - --enable-admission-plugins=...,NodeRestriction,... + By default, RKE2 sets the --enable-admission-plugins to NodeRestriction. + Check the RKE2 config file /etc/rancher/rke2/config.yaml, and ensure that you are not overriding the admission plugins. + If you are, include NodeRestriction in the list. + kube-apiserver-arg: + - "enable-admission-plugins=...,NodeRestriction,..." scored: true - id: 1.2.17 text: "Ensure that the --secure-port argument is not set to 0 (Automated)" - audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep" + audit: "/bin/ps -fC $apiserverbin" tests: bin_op: or test_items: @@ -608,7 +619,7 @@ groups: - id: 1.2.18 text: "Ensure that the --profiling argument is set to false (Automated)" - audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep" + audit: "/bin/ps -fC $apiserverbin" tests: test_items: - flag: "--profiling" @@ -617,29 +628,32 @@ groups: value: false set: true remediation: | - Edit the API server pod specification file $apiserverconf - on the control plane node and set the below parameter. - --profiling=false + By default, RKE2 sets the --profiling argument to false. + If this check fails, edit the RKE2 config file /etc/rancher/rke2/config.yaml and remove any lines like below. + kube-apiserver-arg: + - "profiling=true" scored: true - id: 1.2.19 text: "Ensure that the --audit-log-path argument is set (Automated)" - audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep" + audit: "/bin/ps -fC $apiserverbin" type: "skip" tests: test_items: - flag: "--audit-log-path" set: true remediation: | - Edit the API server pod specification file $apiserverconf + By default, RKE2 sets the --audit-log-path argument to /var/lib/rancher/rke2/server/logs/audit.log + If you want to change this, edit the RKE2 config file /etc/rancher/rke2/config.yaml on the control plane node and set the --audit-log-path parameter to a suitable path and file where you would like audit logs to be written, for example, - --audit-log-path=/var/log/apiserver/audit.log + kube-apiserver-arg: + - "audit-log-path=/var/log/rke2/audit.log" scored: true - id: 1.2.20 text: "Ensure that the --audit-log-maxage argument is set to 30 or as appropriate (Automated)" - audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep" + audit: "/bin/ps -fC $apiserverbin" type: "skip" tests: test_items: @@ -649,15 +663,16 @@ groups: value: 30 set: true remediation: | - Edit the API server pod specification file $apiserverconf - on the control plane node and set the --audit-log-maxage parameter to 30 - or as an appropriate number of days, for example, - --audit-log-maxage=30 + By default, RKE2 sets the --audit-log-maxage argument to 30 days. + If you want to change this, edit the RKE2 config file /etc/rancher/rke2/config.yaml + on the control plane node and set the --audit-log-maxage parameter to an appropriate number of days, for example, + kube-apiserver-arg: + - "audit-log-maxage=40" scored: true - id: 1.2.21 text: "Ensure that the --audit-log-maxbackup argument is set to 10 or as appropriate (Automated)" - audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep" + audit: "/bin/ps -fC $apiserverbin" type: "skip" tests: test_items: @@ -667,15 +682,17 @@ groups: value: 10 set: true remediation: | - Edit the API server pod specification file $apiserverconf - on the control plane node and set the --audit-log-maxbackup parameter to 10 or to an appropriate - value. For example, - --audit-log-maxbackup=10 + By default, RKE2 sets the --audit-log-maxbackup argument to 10. + If you want to change this, edit the RKE2 config file /etc/rancher/rke2/config.yaml + on the control plane node and set the --audit-log-maxbackup parameter to an appropriate value. + For example, + kube-apiserver-arg: + - "audit-log-maxbackup=15" scored: true - id: 1.2.22 text: "Ensure that the --audit-log-maxsize argument is set to 100 or as appropriate (Automated)" - audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep" + audit: "/bin/ps -fC $apiserverbin" type: "skip" tests: test_items: @@ -685,14 +702,17 @@ groups: value: 100 set: true remediation: | - Edit the API server pod specification file $apiserverconf + By default, RKE2 sets the --audit-log-maxsize argument to 100 MB. + If you want to change this, edit the RKE2 config file /etc/rancher/rke2/config.yaml on the control plane node and set the --audit-log-maxsize parameter to an appropriate size in MB. - For example, to set it as 100 MB, --audit-log-maxsize=100 + For example, + kube-apiserver-arg: + - "audit-log-maxsize=150" scored: true - id: 1.2.23 text: "Ensure that the --request-timeout argument is set as appropriate (Automated)" - audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep" + audit: "/bin/ps -fC $apiserverbin" tests: bin_op: or test_items: @@ -700,14 +720,17 @@ groups: set: false - flag: "--request-timeout" remediation: | - Edit the API server pod specification file $apiserverconf - and set the below parameter as appropriate and if needed. - For example, --request-timeout=300s + Permissive, per CIS guidelines, + "it is recommended to set this limit as appropriate and change the default limit of 60 seconds only if needed". + Edit the RKE2 config file /etc/rancher/rke2/config.yaml + and set the below parameter if needed. For example, + kube-apiserver-arg: + - "request-timeout=300s" scored: true - id: 1.2.24 text: "Ensure that the --service-account-lookup argument is set to true (Automated)" - audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep" + audit: "/bin/ps -fC $apiserverbin" tests: bin_op: or test_items: @@ -718,30 +741,32 @@ groups: op: eq value: true remediation: | - Edit the API server pod specification file $apiserverconf - on the control plane node and set the below parameter. - --service-account-lookup=true - Alternatively, you can delete the --service-account-lookup parameter from this file so + By default, RKE2 does not set the --service-account-lookup argument. + Edit the RKE2 config file /etc/rancher/rke2/config.yaml and set the service-account-lookup. For example, + kube-apiserver-arg: + - "service-account-lookup=true" + Alternatively, you can delete the service-account-lookup parameter from this file so that the default takes effect. scored: true - id: 1.2.25 text: "Ensure that the --service-account-key-file argument is set as appropriate (Automated)" - audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep" + audit: "/bin/ps -fC $apiserverbin" tests: test_items: - flag: "--service-account-key-file" set: true remediation: | - Edit the API server pod specification file $apiserverconf - on the control plane node and set the --service-account-key-file parameter - to the public key file for service accounts. For example, - --service-account-key-file= + RKE2 automatically generates and sets the service account key file. + It is located at /var/lib/rancher/rke2/server/tls/service.key. + If this check fails, edit RKE2 config file /etc/rancher/rke2/config.yaml and remove any lines like below. + kube-apiserver-arg: + - "service-account-key-file=" scored: true - id: 1.2.26 text: "Ensure that the --etcd-certfile and --etcd-keyfile arguments are set as appropriate (Automated)" - audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep" + audit: "/bin/ps -fC $apiserverbin" tests: bin_op: and test_items: @@ -750,16 +775,17 @@ groups: - flag: "--etcd-keyfile" set: true remediation: | - Follow the Kubernetes documentation and set up the TLS connection between the apiserver and etcd. - Then, edit the API server pod specification file $apiserverconf - on the control plane node and set the etcd certificate and key file parameters. - --etcd-certfile= - --etcd-keyfile= + RKE2 automatically generates and sets the etcd certificate and key files. + They are located at /var/lib/rancher/rke2/server/tls/etcd/client.crt and /var/lib/rancher/rke2/server/tls/etcd/client.key. + If this check fails, edit the RKE2 config file /etc/rancher/rke2/config.yaml and remove any lines like below. + kube-apiserver-arg: + - "etcd-certfile=" + - "etcd-keyfile=" scored: true - id: 1.2.27 text: "Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate (Automated)" - audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep" + audit: "/bin/ps -fC $apiserverbin" tests: bin_op: and test_items: @@ -768,60 +794,64 @@ groups: - flag: "--tls-private-key-file" set: true remediation: | - Follow the Kubernetes documentation and set up the TLS connection on the apiserver. - Then, edit the API server pod specification file $apiserverconf - on the control plane node and set the TLS certificate and private key file parameters. - --tls-cert-file= - --tls-private-key-file= + By default, RKE2 automatically generates and provides the TLS certificate and private key for the apiserver. + They are generated and located at /var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt and /var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key + If this check fails, edit the RKE2 config file /etc/rancher/rke2/config.yaml and remove any lines like below. + kube-apiserver-arg: + - "tls-cert-file=" + - "tls-private-key-file=" scored: true - id: 1.2.28 text: "Ensure that the --client-ca-file argument is set as appropriate (Automated)" - audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep" + audit: "/bin/ps -fC $apiserverbin" tests: test_items: - flag: "--client-ca-file" set: true remediation: | - Follow the Kubernetes documentation and set up the TLS connection on the apiserver. - Then, edit the API server pod specification file $apiserverconf - on the control plane node and set the client certificate authority file. - --client-ca-file= + By default, RKE2 automatically provides the client certificate authority file. + It is generated and located at /var/lib/rancher/rke2/server/tls/client-ca.crt. + If for some reason you need to provide your own ca certificate, look at using the rke2 certificate command line tool. + If this check fails, edit the RKE2 config file /etc/rancher/rke2/config.yaml and remove any lines like below. + kube-apiserver-arg: + - "client-ca-file=" scored: true - id: 1.2.29 text: "Ensure that the --etcd-cafile argument is set as appropriate (Automated)" - audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep" + audit: "/bin/ps -fC $apiserverbin" tests: test_items: - flag: "--etcd-cafile" set: true remediation: | - Follow the Kubernetes documentation and set up the TLS connection between the apiserver and etcd. - Then, edit the API server pod specification file $apiserverconf - on the control plane node and set the etcd certificate authority file parameter. - --etcd-cafile= + By default, RKE2 automatically provides the etcd certificate authority file. + It is generated and located at /var/lib/rancher/rke2/server/tls/client-ca.crt. + If for some reason you need to provide your own ca certificate, look at using the rke2 certificate command line tool. + If this check fails, edit the RKE2 config file /etc/rancher/rke2/config.yaml and remove any lines like below. + kube-apiserver-arg: + - "etcd-cafile=" scored: true - id: 1.2.30 - text: "Ensure that the --encryption-provider-config argument is set as appropriate (Manual)" - audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep" + text: "Ensure that the --encryption-provider-config argument is set as appropriate (Automated)" + audit: "/bin/ps -fC $apiserverbin" tests: test_items: - flag: "--encryption-provider-config" remediation: | - Follow the Kubernetes documentation and configure a EncryptionConfig file. - Then, edit the API server pod specification file $apiserverconf - on the control plane node and set the --encryption-provider-config parameter to the path of that file. - For example, --encryption-provider-config= - scored: false + RKE2 always is configured to encrypt secrets. + Secrets encryption is managed with the rke2 secrets-encrypt command line tool. + If needed, you can find the generated encryption config at /var/lib/rancher/rke2/server/cred/encryption-config.json + scored: true - id: 1.2.31 - text: "Ensure that encryption providers are appropriately configured (Manual)" + text: "Ensure that encryption providers are appropriately configured (Automated)" type: "skip" audit: | ENCRYPTION_PROVIDER_CONFIG=$(ps -ef | grep $apiserverbin | grep -- --encryption-provider-config | sed 's%.*encryption-provider-config[= ]\([^ ]*\).*%\1%') - if test -e $ENCRYPTION_PROVIDER_CONFIG; then grep -A1 'providers:' $ENCRYPTION_PROVIDER_CONFIG | tail -n1 | grep -o "[A-Za-z]*" | sed 's/^/provider=/'; fi + if test -e $ENCRYPTION_PROVIDER_CONFIG; then grep -o 'providers\"\:\[.*\]' $ENCRYPTION_PROVIDER_CONFIG | grep -o "[A-Za-z]*" | head -2 | tail -1 | sed 's/^/provider=/'; fi tests: test_items: - flag: "provider" @@ -829,13 +859,14 @@ groups: op: valid_elements value: "aescbc,kms,secretbox" remediation: | - Follow the Kubernetes documentation and configure a EncryptionConfig file. - In this file, choose aescbc, kms or secretbox as the encryption provider. - scored: false + RKE2 always is configured to use the aescbc encryption provider to encrypt secrets. + Secrets encryption is managed with the rke2 secrets-encrypt command line tool. + If needed, you can find the generated encryption config at /var/lib/rancher/rke2/server/cred/encryption-config.json + scored: true - id: 1.2.32 text: "Ensure that the API Server only makes use of Strong Cryptographic Ciphers (Automated)" - audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep" + audit: "/bin/ps -fC $apiserverbin" tests: test_items: - flag: "--tls-cipher-suites" @@ -855,19 +886,21 @@ groups: checks: - id: 1.3.1 text: "Ensure that the --terminated-pod-gc-threshold argument is set as appropriate (Manual)" - audit: "/bin/ps -ef | grep $controllermanagerbin | grep -v grep" + audit: "/bin/ps -fC $controllermanagerbin" tests: test_items: - flag: "--terminated-pod-gc-threshold" remediation: | - Edit the Controller Manager pod specification file $controllermanagerconf - on the control plane node and set the --terminated-pod-gc-threshold to an appropriate threshold, - for example, --terminated-pod-gc-threshold=10 + By default, RKE2 sets a terminated-pod-gc-threshold of 1000. + If you need to change this value, edit the RKE2 config file /etc/rancher/rke2/config.yaml on the control plane node + and set the --terminated-pod-gc-threshold to an appropriate threshold, + kube-controller-manager-arg: + - "terminated-pod-gc-threshold=10" scored: false - id: 1.3.2 text: "Ensure that the --profiling argument is set to false (Automated)" - audit: "/bin/ps -ef | grep $controllermanagerbin | grep -v grep" + audit: "/bin/ps -fC $controllermanagerbin" tests: test_items: - flag: "--profiling" @@ -876,14 +909,15 @@ groups: value: false set: true remediation: | - Edit the Controller Manager pod specification file $controllermanagerconf - on the control plane node and set the below parameter. - --profiling=false + By default, RKE2 sets the --profiling argument to false. + If this check fails, edit the RKE2 config file /etc/rancher/rke2/config.yaml and remove any lines like below. + kube-controller-manager-arg: + - "profiling=true" scored: true - id: 1.3.3 text: "Ensure that the --use-service-account-credentials argument is set to true (Automated)" - audit: "/bin/ps -ef | grep $controllermanagerbin | grep -v grep" + audit: "/bin/ps -fC $controllermanagerbin" tests: test_items: - flag: "--use-service-account-credentials" @@ -892,41 +926,45 @@ groups: value: false set: true remediation: | - Edit the Controller Manager pod specification file $controllermanagerconf - on the control plane node to set the below parameter. - --use-service-account-credentials=true + By default, RKE2 sets the --use-service-account-credentials argument to true. + If this check fails, edit the RKE2 config file /etc/rancher/rke2/config.yaml and remove any lines like below. + kube-controller-manager-arg: + - "use-service-account-credentials=false" scored: true - id: 1.3.4 text: "Ensure that the --service-account-private-key-file argument is set as appropriate (Automated)" - audit: "/bin/ps -ef | grep $controllermanagerbin | grep -v grep" + audit: "/bin/ps -fC $controllermanagerbin" tests: test_items: - flag: "--service-account-private-key-file" set: true remediation: | - Edit the Controller Manager pod specification file $controllermanagerconf - on the control plane node and set the --service-account-private-key-file parameter - to the private key file for service accounts. - --service-account-private-key-file= + By default, RKE2 automatically provides the service account private key file. + It is generated and located at /var/lib/rancher/rke2/server/tls/service.current.key. + If this check fails, edit the RKE2 config file /etc/rancher/rke2/config.yaml and remove any lines like below. + kube-controller-manager-arg: + - "service-account-private-key-file=" scored: true - id: 1.3.5 text: "Ensure that the --root-ca-file argument is set as appropriate (Automated)" - audit: "/bin/ps -ef | grep $controllermanagerbin | grep -v grep" + audit: "/bin/ps -fC $controllermanagerbin" tests: test_items: - flag: "--root-ca-file" set: true remediation: | - Edit the Controller Manager pod specification file $controllermanagerconf - on the control plane node and set the --root-ca-file parameter to the certificate bundle file`. - --root-ca-file= + By default, RKE2 automatically provides the root CA file. + It is generated and located at /var/lib/rancher/rke2/server/tls/server-ca.crt. + If this check fails, edit the RKE2 config file /etc/rancher/rke2/config.yaml and remove any lines like below. + kube-controller-manager-arg: + - "root-ca-file=" scored: true - id: 1.3.6 text: "Ensure that the RotateKubeletServerCertificate argument is set to true (Automated)" - audit: "/bin/ps -ef | grep $controllermanagerbin | grep -v grep" + audit: "/bin/ps -fC $controllermanagerbin" tests: bin_op: or test_items: @@ -942,11 +980,10 @@ groups: on the control plane node and set the --feature-gates parameter to include RotateKubeletServerCertificate=true. --feature-gates=RotateKubeletServerCertificate=true scored: true - type: skip - id: 1.3.7 text: "Ensure that the --bind-address argument is set to 127.0.0.1 (Automated)" - audit: "/bin/ps -ef | grep $controllermanagerbin | grep -v grep" + audit: "/bin/ps -fC $controllermanagerbin" tests: bin_op: or test_items: @@ -958,8 +995,10 @@ groups: - flag: "--bind-address" set: false remediation: | - Edit the Controller Manager pod specification file $controllermanagerconf - on the control plane node and ensure the correct value for the --bind-address parameter + By default, RKE2 sets the --bind-address argument to 127.0.0.1 + If this check fails, edit the RKE2 config file /etc/rancher/rke2/config.yaml and remove any lines like below. + kube-controller-manager-arg: + - "bind-address=" scored: true - id: 1.4 @@ -967,7 +1006,7 @@ groups: checks: - id: 1.4.1 text: "Ensure that the --profiling argument is set to false (Automated)" - audit: "/bin/ps -ef | grep $schedulerbin | grep -v grep" + audit: "/bin/ps -fC $schedulerbin" tests: test_items: - flag: "--profiling" @@ -976,14 +1015,15 @@ groups: value: false set: true remediation: | - Edit the Scheduler pod specification file $schedulerconf file - on the control plane node and set the below parameter. - --profiling=false + By default, RKE2 sets the --profiling argument to false. + If this check fails, edit the RKE2 config file /etc/rancher/rke2/config.yaml and remove any lines like below. + kube-scheduler-arg: + - "profiling=true" scored: true - id: 1.4.2 text: "Ensure that the --bind-address argument is set to 127.0.0.1 (Automated)" - audit: "/bin/ps -ef | grep $schedulerbin | grep -v grep" + audit: "/bin/ps -fC $schedulerbin" tests: bin_op: or test_items: @@ -995,6 +1035,8 @@ groups: - flag: "--bind-address" set: false remediation: | - Edit the Scheduler pod specification file $schedulerconf - on the control plane node and ensure the correct value for the --bind-address parameter + By default, RKE2 sets the --bind-address argument to 127.0.0.1 + If this check fails, edit the RKE2 config file /etc/rancher/rke2/config.yaml and remove any lines like below. + kube-scheduler-arg: + - "bind-address=" scored: true diff --git a/package/cfg/rke2-cis-1.24-permissive/policies.yaml b/package/cfg/rke2-cis-1.24-permissive/policies.yaml index da96d2bc..e63c9908 100644 --- a/package/cfg/rke2-cis-1.24-permissive/policies.yaml +++ b/package/cfg/rke2-cis-1.24-permissive/policies.yaml @@ -152,8 +152,8 @@ groups: text: "Minimize the admission of containers with capabilities assigned (Manual)" type: "manual" remediation: | - Review the use of capabilites in applications running on your cluster. Where a namespace - contains applicaions which do not require any Linux capabities to operate consider adding + Review the use of capabilities in applications running on your cluster. Where a namespace + contains applications which do not require any Linux capabities to operate consider adding a PSP which forbids the admission of containers which do not drop all capabilities. scored: false diff --git a/package/cfg/rke2-cis-1.7-hardened/etcd.yaml b/package/cfg/rke2-cis-1.7-hardened/etcd.yaml index a7324740..de4edd9a 100644 --- a/package/cfg/rke2-cis-1.7-hardened/etcd.yaml +++ b/package/cfg/rke2-cis-1.7-hardened/etcd.yaml @@ -5,72 +5,6 @@ id: 2 text: "Etcd Node Configuration" type: "etcd" groups: - - id: 1.1 - text: "Master Node Configuration Files" - checks: - - id: 1.1.7 - text: "Ensure that the etcd pod specification file permissions are set to 600 or more restrictive (Automated)" - audit: "/bin/sh -c 'if test -e $etcdconf; then find $etcdconf -name '*etcd*' | xargs stat -c permissions=%a; fi'" - use_multiple_values: true - tests: - test_items: - - flag: "permissions" - compare: - op: bitmask - value: "600" - remediation: | - Run the below command (based on the file location on your system) on the control plane node. - For example, - chmod 600 $etcdconf - scored: true - - - id: 1.1.8 - text: "Ensure that the etcd pod specification file ownership is set to root:root (Automated)" - audit: "/bin/sh -c 'if test -e $etcdconf; then stat -c %U:%G $etcdconf; fi'" - tests: - test_items: - - flag: "root:root" - compare: - op: eq - value: "root:root" - set: true - remediation: | - Run the below command (based on the file location on your system) on the control plane node. - For example, - chown root:root $etcdconf - scored: true - - - id: 1.1.11 - text: "Ensure that the etcd data directory permissions are set to 700 or more restrictive (Automated)" - audit: "stat -c permissions=%a $etcddatadir" - tests: - test_items: - - flag: "permissions" - compare: - op: bitmask - value: "700" - set: true - remediation: | - On the etcd server node, get the etcd data directory, passed as an argument --data-dir, - from the command 'ps -ef | grep etcd'. - Run the below command (based on the etcd data directory found above). For example, - chmod 700 $etcddatadir - scored: true - - - id: 1.1.12 - text: "Ensure that the etcd data directory ownership is set to etcd:etcd (Automated)" - type: "skip" - audit: "stat -c %U:%G $etcddatadir" - tests: - test_items: - - flag: "etcd:etcd" - remediation: | - On the etcd server node, get the etcd data directory, passed as an argument --data-dir, - from the command 'ps -ef | grep etcd'. - Run the below command (based on the etcd data directory found above). - For example, chown etcd:etcd /var/lib/etcd - scored: true - - id: 2 text: "Etcd Node Configuration" checks: diff --git a/package/cfg/rke2-cis-1.7-hardened/master.yaml b/package/cfg/rke2-cis-1.7-hardened/master.yaml index c7e02886..c15bb8af 100644 --- a/package/cfg/rke2-cis-1.7-hardened/master.yaml +++ b/package/cfg/rke2-cis-1.7-hardened/master.yaml @@ -140,12 +140,13 @@ groups: op: bitmask value: "600" remediation: | + Note that for many CNIs, a lock file is created with permissions 750. This is expected and can be ignored. Run the below command (based on the file location on your system) on the control plane node. - For example, chmod 600 + For example, chmod 600 /var/lib/cni/networks/ and chmod 600 /etc/cni/net.d/ scored: false - id: 1.1.10 - text: "Ensure that the Container Network Interface file ownership is set to root:root (Manual)" + text: "Ensure that the Container Network Interface file ownership is set to root:root (Automated)" audit: | ps -fC ${kubeletbin:-kubelet} | grep -- --cni-conf-dir || echo "/etc/cni/net.d" | sed 's%.*cni-conf-dir[= ]\([^ ]*\).*%\1%' | xargs -I{} find {} -mindepth 1 | xargs --no-run-if-empty stat -c %U:%G find /var/lib/cni/networks -type f 2> /dev/null | xargs --no-run-if-empty stat -c %U:%G @@ -194,9 +195,9 @@ groups: audit: "/bin/sh -c 'if test -e $schedulerkubeconfig; then stat -c permissions=%a $schedulerkubeconfig; fi'" tests: test_items: - - flag: "600" + - flag: "permissions" compare: - op: eq + op: bitmask value: "600" set: true remediation: | @@ -226,9 +227,9 @@ groups: audit: "/bin/sh -c 'if test -e $controllermanagerkubeconfig; then stat -c permissions=%a $controllermanagerkubeconfig; fi'" tests: test_items: - - flag: "600" + - flag: "permissions" compare: - op: eq + op: bitmask value: "600" set: true remediation: | @@ -250,7 +251,7 @@ groups: remediation: | Run the below command (based on the file location on your system) on the control plane node. For example, - chown root:root /var/lib/rancher/rke2/server/cred/controller.kubeconfig + chown root:root $controllermanagerkubeconfig scored: true - id: 1.1.19 @@ -288,7 +289,7 @@ groups: scored: false - id: 1.1.21 - text: "Ensure that the Kubernetes PKI key file permissions are set to 600 (Manual)" + text: "Ensure that the Kubernetes PKI key file permissions are set to 600 (Automated)" audit: "stat -c permissions=%a /var/lib/rancher/rke2/server/tls/*.key" use_multiple_values: true tests: @@ -309,7 +310,7 @@ groups: checks: - id: 1.2.1 text: "Ensure that the --anonymous-auth argument is set to false (Manual)" - audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep" + audit: "/bin/ps -fC $apiserverbin" type: manual tests: test_items: @@ -318,27 +319,29 @@ groups: op: eq value: false remediation: | - Edit the API server pod specification file $apiserverconf - on the control plane node and set the below parameter. - --anonymous-auth=false + By default, RKE2 sets the --anonymous-auth argument to false. + If this check fails, edit the RKE2 config file /etc/rancher/rke2/config.yaml and remove anything similar to below. + kube-apiserver-arg: + - "anonymous-auth=true" scored: false - id: 1.2.2 text: "Ensure that the --token-auth-file parameter is not set (Automated)" - audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep" + audit: "/bin/ps -fC $apiserverbin" tests: test_items: - flag: "--token-auth-file" set: false remediation: | - Follow the documentation and configure alternate mechanisms for authentication. Then, - edit the API server pod specification file $apiserverconf - on the control plane node and remove the --token-auth-file= parameter. + Follow the documentation and configure alternate mechanisms for authentication. + If this check fails, edit the RKE2 config file /etc/rancher/rke2/config.yaml and remove anything similar to below. + kube-apiserver-arg: + - "token-auth-file=" scored: true - id: 1.2.3 text: "Ensure that the --DenyServiceExternalIPs is not set (Automated)" - audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep" + audit: "/bin/ps -fC $apiserverbin" tests: bin_op: or test_items: @@ -350,14 +353,15 @@ groups: - flag: "--enable-admission-plugins" set: false remediation: | - Edit the API server pod specification file $apiserverconf - on the control plane node and remove the `DenyServiceExternalIPs` - from enabled admission plugins. + By default, RKE2 does not set DenyServiceExternalIPs. + If this check fails, edit the RKE2 config file /etc/rancher/rke2/config.yaml, remove any lines like below. + kube-apiserver-arg: + - "enable-admission-plugins=DenyServiceExternalIPs" scored: true - id: 1.2.4 text: "Ensure that the --kubelet-client-certificate and --kubelet-client-key arguments are set as appropriate (Automated)" - audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep" + audit: "/bin/ps -fC $apiserverbin" tests: bin_op: and test_items: @@ -366,32 +370,32 @@ groups: - flag: "--kubelet-client-key" set: true remediation: | - Follow the Kubernetes documentation and set up the TLS connection between the - apiserver and kubelets. Then, edit API server pod specification file - $apiserverconf on the control plane node and set the - kubelet client certificate and key parameters as below. - --kubelet-client-certificate= - --kubelet-client-key= + By default, RKE2 automatically provides the kubelet client certificate and key. + They are generated and located at /var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt and /var/lib/rancher/rke2/server/tls/client-kube-apiserver.key + If for some reason you need to provide your own certificate and key, you can set the + below parameters in the RKE2 config file /etc/rancher/rke2/config.yaml. + kube-apiserver-arg: + - "kubelet-client-certificate=" + - "kubelet-client-key=" scored: true - id: 1.2.5 text: "Ensure that the --kubelet-certificate-authority argument is set as appropriate (Automated)" - audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep" + audit: "/bin/ps -fC $apiserverbin" tests: test_items: - flag: "--kubelet-certificate-authority" set: true remediation: | - Follow the Kubernetes documentation and setup the TLS connection between - the apiserver and kubelets. Then, edit the API server pod specification file - $apiserverconf on the control plane node and set the - --kubelet-certificate-authority parameter to the path to the cert file for the certificate authority. - --kubelet-certificate-authority= + By default, RKE2 automatically provides the kubelet CA cert file, at /var/lib/rancher/rke2/server/tls/server-ca.crt. + If this check fails, edit the RKE2 config file /etc/rancher/rke2/config.yaml and remove any lines like below. + kube-apiserver-arg: + - "kubelet-certificate-authority=" scored: true - id: 1.2.6 text: "Ensure that the --authorization-mode argument is not set to AlwaysAllow (Automated)" - audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep" + audit: "/bin/ps -fC $apiserverbin" tests: test_items: - flag: "--authorization-mode" @@ -400,15 +404,15 @@ groups: value: "AlwaysAllow" set: true remediation: | - Edit the API server pod specification file $apiserverconf - on the control plane node and set the --authorization-mode parameter to values other than AlwaysAllow. - One such example could be as below. - --authorization-mode=RBAC + By default, RKE2 does not set the --authorization-mode to AlwaysAllow. + If this check fails, edit RKE2 config file /etc/rancher/rke2/config.yaml, remove any lines like below. + kube-apiserver-arg: + - "authorization-mode=AlwaysAllow" scored: true - id: 1.2.7 text: "Ensure that the --authorization-mode argument includes Node (Automated)" - audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep" + audit: "/bin/ps -fC $apiserverbin" tests: test_items: - flag: "--authorization-mode" @@ -417,14 +421,14 @@ groups: value: "Node" set: true remediation: | - Edit the API server pod specification file $apiserverconf - on the control plane node and set the --authorization-mode parameter to a value that includes Node. - --authorization-mode=Node,RBAC + By default, RKE2 sets the --authorization-mode to Node and RBAC. + If this check fails, edit the RKE2 config file /etc/rancher/rke2/config.yaml, + ensure that you are not overriding authorization-mode. scored: true - id: 1.2.8 text: "Ensure that the --authorization-mode argument includes RBAC (Automated)" - audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep" + audit: "/bin/ps -fC $apiserverbin" tests: test_items: - flag: "--authorization-mode" @@ -433,14 +437,14 @@ groups: value: "RBAC" set: true remediation: | - Edit the API server pod specification file $apiserverconf - on the control plane node and set the --authorization-mode parameter to a value that includes RBAC, - for example `--authorization-mode=Node,RBAC`. + By default, RKE2 sets the --authorization-mode to Node and RBAC. + If this check fails, edit the RKE2 config file /etc/rancher/rke2/config.yaml, + ensure that you are not overriding authorization-mode. scored: true - id: 1.2.9 text: "Ensure that the admission control plugin EventRateLimit is set (Manual)" - audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep" + audit: "/bin/ps -fC $apiserverbin" tests: test_items: - flag: "--enable-admission-plugins" @@ -450,15 +454,15 @@ groups: set: true remediation: | Follow the Kubernetes documentation and set the desired limits in a configuration file. - Then, edit the API server pod specification file $apiserverconf - and set the below parameters. - --enable-admission-plugins=...,EventRateLimit,... - --admission-control-config-file= + Then, edit the RKE2 config file /etc/rancher/rke2/config.yaml and set the below parameters. + kube-apiserver-arg: + - "enable-admission-plugins=...,EventRateLimit,..." + - "admission-control-config-file=" scored: false - id: 1.2.10 text: "Ensure that the admission control plugin AlwaysAdmit is not set (Automated)" - audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep" + audit: "/bin/ps -fC $apiserverbin" tests: bin_op: or test_items: @@ -470,14 +474,15 @@ groups: - flag: "--enable-admission-plugins" set: false remediation: | - Edit the API server pod specification file $apiserverconf - on the control plane node and either remove the --enable-admission-plugins parameter, or set it to a - value that does not include AlwaysAdmit. + By default, RKE2 does not set the --enable-admission-plugins to AlwaysAdmit. + If this check fails, edit RKE2 config file /etc/rancher/rke2/config.yaml, remove any lines like below. + kube-apiserver-arg: + - "enable-admission-plugins=AlwaysAdmit" scored: true - id: 1.2.11 text: "Ensure that the admission control plugin AlwaysPullImages is set (Manual)" - audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep" + audit: "/bin/ps -fC $apiserverbin" tests: test_items: - flag: "--enable-admission-plugins" @@ -486,7 +491,11 @@ groups: value: "AlwaysPullImages" set: true remediation: | - Edit the API server pod specification file $apiserverconf + Permissive, per CIS guidelines, + "This setting could impact offline or isolated clusters, which have images pre-loaded and + do not have access to a registry to pull in-use images. This setting is not appropriate for + clusters which use this configuration." + Edit the RKE2 config file /etc/rancher/rke2/config.yaml on the control plane node and set the --enable-admission-plugins parameter to include AlwaysPullImages. --enable-admission-plugins=...,AlwaysPullImages,... @@ -494,7 +503,8 @@ groups: - id: 1.2.12 text: "Ensure that the admission control plugin SecurityContextDeny is set if PodSecurityPolicy is not used (Manual)" - audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep" + audit: "/bin/ps -fC $apiserverbin" + type: "skip" tests: bin_op: or test_items: @@ -509,15 +519,13 @@ groups: value: "PodSecurityPolicy" set: true remediation: | - Edit the API server pod specification file $apiserverconf - on the control plane node and set the --enable-admission-plugins parameter to include - SecurityContextDeny, unless PodSecurityPolicy is already in place. - --enable-admission-plugins=...,SecurityContextDeny,... + Not Applicable. + Enabling Pod Security Policy is no longer supported on RKE2 v1.25+ and will cause applications to unexpectedly fail. scored: false - id: 1.2.13 text: "Ensure that the admission control plugin ServiceAccount is set (Automated)" - audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep" + audit: "/bin/ps -fC $apiserverbin" tests: bin_op: or test_items: @@ -528,15 +536,16 @@ groups: - flag: "--disable-admission-plugins" set: false remediation: | + By default, RKE2 does not set the --disable-admission-plugins to anything. Follow the documentation and create ServiceAccount objects as per your environment. - Then, edit the API server pod specification file $apiserverconf - on the control plane node and ensure that the --disable-admission-plugins parameter is set to a - value that does not include ServiceAccount. + If this check fails, edit the RKE2 config file /etc/rancher/rke2/config.yaml and remove any lines like below. + kube-apiserver-arg: + - "disable-admission-plugins=ServiceAccount" scored: true - id: 1.2.14 text: "Ensure that the admission control plugin NamespaceLifecycle is set (Automated)" - audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep" + audit: "/bin/ps -fC $apiserverbin" tests: bin_op: or test_items: @@ -547,14 +556,15 @@ groups: - flag: "--disable-admission-plugins" set: false remediation: | - Edit the API server pod specification file $apiserverconf - on the control plane node and set the --disable-admission-plugins parameter to - ensure it does not include NamespaceLifecycle. + By default, RKE2 does not set the --disable-admission-plugins to anything. + If this check fails, edit the RKE2 config file /etc/rancher/rke2/config.yaml and remove any lines like below. + kube-apiserver-arg: + - "disable-admission-plugins=...,NamespaceLifecycle,..." scored: true - id: 1.2.15 text: "Ensure that the admission control plugin NodeRestriction is set (Automated)" - audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep" + audit: "/bin/ps -fC $apiserverbin" tests: test_items: - flag: "--enable-admission-plugins" @@ -563,16 +573,16 @@ groups: value: "NodeRestriction" set: true remediation: | - Follow the Kubernetes documentation and configure NodeRestriction plug-in on kubelets. - Then, edit the API server pod specification file $apiserverconf - on the control plane node and set the --enable-admission-plugins parameter to a - value that includes NodeRestriction. - --enable-admission-plugins=...,NodeRestriction,... + By default, RKE2 sets the --enable-admission-plugins to NodeRestriction. + Check the RKE2 config file /etc/rancher/rke2/config.yaml, and ensure that you are not overriding the admission plugins. + If you are, include NodeRestriction in the list. + kube-apiserver-arg: + - "enable-admission-plugins=...,NodeRestriction,..." scored: true - id: 1.2.16 text: "Ensure that the --secure-port argument is not set to 0 - NoteThis recommendation is obsolete and will be deleted per the consensus process (Automated)" - audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep" + audit: "/bin/ps -fC $apiserverbin" tests: bin_op: or test_items: @@ -591,7 +601,7 @@ groups: - id: 1.2.17 text: "Ensure that the --profiling argument is set to false (Automated)" - audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep" + audit: "/bin/ps -fC $apiserverbin" tests: test_items: - flag: "--profiling" @@ -600,28 +610,31 @@ groups: value: false set: true remediation: | - Edit the API server pod specification file $apiserverconf - on the control plane node and set the below parameter. - --profiling=false + By default, RKE2 sets the --profiling argument to false. + If this check fails, edit the RKE2 config file /etc/rancher/rke2/config.yaml and remove any lines like below. + kube-apiserver-arg: + - "profiling=true" scored: true - id: 1.2.18 text: "Ensure that the --audit-log-path argument is set (Automated)" - audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep" + audit: "/bin/ps -fC $apiserverbin" tests: test_items: - flag: "--audit-log-path" set: true remediation: | - Edit the API server pod specification file $apiserverconf + By default, RKE2 sets the --audit-log-path argument to /var/lib/rancher/rke2/server/logs/audit.log + If you want to change this, edit the RKE2 config file /etc/rancher/rke2/config.yaml on the control plane node and set the --audit-log-path parameter to a suitable path and file where you would like audit logs to be written, for example, - --audit-log-path=/var/log/apiserver/audit.log + kube-apiserver-arg: + - "audit-log-path=/var/log/rke2/audit.log" scored: true - id: 1.2.19 text: "Ensure that the --audit-log-maxage argument is set to 30 or as appropriate (Automated)" - audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep" + audit: "/bin/ps -fC $apiserverbin" tests: test_items: - flag: "--audit-log-maxage" @@ -630,15 +643,16 @@ groups: value: 30 set: true remediation: | - Edit the API server pod specification file $apiserverconf - on the control plane node and set the --audit-log-maxage parameter to 30 - or as an appropriate number of days, for example, - --audit-log-maxage=30 + By default, RKE2 sets the --audit-log-maxage argument to 30 days. + If you want to change this, edit the RKE2 config file /etc/rancher/rke2/config.yaml + on the control plane node and set the --audit-log-maxage parameter to an appropriate number of days, for example, + kube-apiserver-arg: + - "audit-log-maxage=40" scored: true - id: 1.2.20 text: "Ensure that the --audit-log-maxbackup argument is set to 10 or as appropriate (Automated)" - audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep" + audit: "/bin/ps -fC $apiserverbin" tests: test_items: - flag: "--audit-log-maxbackup" @@ -647,16 +661,17 @@ groups: value: 10 set: true remediation: | - Edit the API server pod specification file $apiserverconf - on the control plane node and set the --audit-log-maxbackup parameter to 10 or to an appropriate - value. For example, - --audit-log-maxbackup=10 + By default, RKE2 sets the --audit-log-maxbackup argument to 10. + If you want to change this, edit the RKE2 config file /etc/rancher/rke2/config.yaml + on the control plane node and set the --audit-log-maxbackup parameter to an appropriate value. + For example, + kube-apiserver-arg: + - "audit-log-maxbackup=15" scored: true - id: 1.2.21 text: "Ensure that the --audit-log-maxsize argument is set to 100 or as appropriate (Automated)" - type: "skip" - audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep" + audit: "/bin/ps -fC $apiserverbin" tests: test_items: - flag: "--audit-log-maxsize" @@ -665,14 +680,17 @@ groups: value: 100 set: true remediation: | - Edit the API server pod specification file $apiserverconf + By default, RKE2 sets the --audit-log-maxsize argument to 100 MB. + If you want to change this, edit the RKE2 config file /etc/rancher/rke2/config.yaml on the control plane node and set the --audit-log-maxsize parameter to an appropriate size in MB. - For example, to set it as 100 MB, --audit-log-maxsize=100 + For example, + kube-apiserver-arg: + - "audit-log-maxsize=150" scored: true - id: 1.2.22 text: "Ensure that the --request-timeout argument is set as appropriate (Automated)" - audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep" + audit: "/bin/ps -fC $apiserverbin" tests: bin_op: or test_items: @@ -680,14 +698,17 @@ groups: set: false - flag: "--request-timeout" remediation: | - Edit the API server pod specification file $apiserverconf - and set the below parameter as appropriate and if needed. - For example, --request-timeout=300s + Permissive, per CIS guidelines, + "it is recommended to set this limit as appropriate and change the default limit of 60 seconds only if needed". + Edit the RKE2 config file /etc/rancher/rke2/config.yaml + and set the below parameter if needed. For example, + kube-apiserver-arg: + - "request-timeout=300s" scored: true - id: 1.2.23 text: "Ensure that the --service-account-lookup argument is set to true (Automated)" - audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep" + audit: "/bin/ps -fC $apiserverbin" tests: bin_op: or test_items: @@ -698,30 +719,32 @@ groups: op: eq value: true remediation: | - Edit the API server pod specification file $apiserverconf - on the control plane node and set the below parameter. - --service-account-lookup=true - Alternatively, you can delete the --service-account-lookup parameter from this file so + By default, RKE2 does not set the --service-account-lookup argument. + Edit the RKE2 config file /etc/rancher/rke2/config.yaml and set the service-account-lookup. For example, + kube-apiserver-arg: + - "service-account-lookup=true" + Alternatively, you can delete the service-account-lookup parameter from this file so that the default takes effect. scored: true - id: 1.2.24 text: "Ensure that the --service-account-key-file argument is set as appropriate (Automated)" - audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep" + audit: "/bin/ps -fC $apiserverbin" tests: test_items: - flag: "--service-account-key-file" set: true remediation: | - Edit the API server pod specification file $apiserverconf - on the control plane node and set the --service-account-key-file parameter - to the public key file for service accounts. For example, - --service-account-key-file= + RKE2 automatically generates and sets the service account key file. + It is located at /var/lib/rancher/rke2/server/tls/service.key. + If this check fails, edit RKE2 config file /etc/rancher/rke2/config.yaml and remove any lines like below. + kube-apiserver-arg: + - "service-account-key-file=" scored: true - id: 1.2.25 text: "Ensure that the --etcd-certfile and --etcd-keyfile arguments are set as appropriate (Automated)" - audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep" + audit: "/bin/ps -fC $apiserverbin" tests: bin_op: and test_items: @@ -730,16 +753,17 @@ groups: - flag: "--etcd-keyfile" set: true remediation: | - Follow the Kubernetes documentation and set up the TLS connection between the apiserver and etcd. - Then, edit the API server pod specification file $apiserverconf - on the control plane node and set the etcd certificate and key file parameters. - --etcd-certfile= - --etcd-keyfile= + RKE2 automatically generates and sets the etcd certificate and key files. + They are located at /var/lib/rancher/rke2/server/tls/etcd/client.crt and /var/lib/rancher/rke2/server/tls/etcd/client.key. + If this check fails, edit the RKE2 config file /etc/rancher/rke2/config.yaml and remove any lines like below. + kube-apiserver-arg: + - "etcd-certfile=" + - "etcd-keyfile=" scored: true - id: 1.2.26 text: "Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate (Automated)" - audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep" + audit: "/bin/ps -fC $apiserverbin" tests: bin_op: and test_items: @@ -748,59 +772,63 @@ groups: - flag: "--tls-private-key-file" set: true remediation: | - Follow the Kubernetes documentation and set up the TLS connection on the apiserver. - Then, edit the API server pod specification file $apiserverconf - on the control plane node and set the TLS certificate and private key file parameters. - --tls-cert-file= - --tls-private-key-file= + By default, RKE2 automatically generates and provides the TLS certificate and private key for the apiserver. + They are generated and located at /var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt and /var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key + If this check fails, edit the RKE2 config file /etc/rancher/rke2/config.yaml and remove any lines like below. + kube-apiserver-arg: + - "tls-cert-file=" + - "tls-private-key-file=" scored: true - id: 1.2.27 text: "Ensure that the --client-ca-file argument is set as appropriate (Automated)" - audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep" + audit: "/bin/ps -fC $apiserverbin" tests: test_items: - flag: "--client-ca-file" set: true remediation: | - Follow the Kubernetes documentation and set up the TLS connection on the apiserver. - Then, edit the API server pod specification file $apiserverconf - on the control plane node and set the client certificate authority file. - --client-ca-file= + By default, RKE2 automatically provides the client certificate authority file. + It is generated and located at /var/lib/rancher/rke2/server/tls/client-ca.crt. + If for some reason you need to provide your own ca certificate, look at using the rke2 certificate command line tool. + If this check fails, edit the RKE2 config file /etc/rancher/rke2/config.yaml and remove any lines like below. + kube-apiserver-arg: + - "client-ca-file=" scored: true - id: 1.2.28 text: "Ensure that the --etcd-cafile argument is set as appropriate (Automated)" - audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep" + audit: "/bin/ps -fC $apiserverbin" tests: test_items: - flag: "--etcd-cafile" set: true remediation: | - Follow the Kubernetes documentation and set up the TLS connection between the apiserver and etcd. - Then, edit the API server pod specification file $apiserverconf - on the control plane node and set the etcd certificate authority file parameter. - --etcd-cafile= + By default, RKE2 automatically provides the etcd certificate authority file. + It is generated and located at /var/lib/rancher/rke2/server/tls/client-ca.crt. + If for some reason you need to provide your own ca certificate, look at using the rke2 certificate command line tool. + If this check fails, edit the RKE2 config file /etc/rancher/rke2/config.yaml and remove any lines like below. + kube-apiserver-arg: + - "etcd-cafile=" scored: true - id: 1.2.29 - text: "Ensure that the --encryption-provider-config argument is set as appropriate (Manual)" - audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep" + text: "Ensure that the --encryption-provider-config argument is set as appropriate (Automated)" + audit: "/bin/ps -fC $apiserverbin" tests: test_items: - flag: "--encryption-provider-config" remediation: | - Follow the Kubernetes documentation and configure a EncryptionConfig file. - Then, edit the API server pod specification file $apiserverconf - on the control plane node and set the --encryption-provider-config parameter to the path of that file. - For example, --encryption-provider-config= - scored: false + RKE2 always is configured to encrypt secrets. + Secrets encryption is managed with the rke2 secrets-encrypt command line tool. + If needed, you can find the generated encryption config at /var/lib/rancher/rke2/server/cred/encryption-config.json + scored: true - id: 1.2.30 - text: "Ensure that encryption providers are appropriately configured (Manual)" + text: "Ensure that encryption providers are appropriately configured (Automated)" audit: | ENCRYPTION_PROVIDER_CONFIG=$(ps -ef | grep $apiserverbin | grep -- --encryption-provider-config | sed 's%.*encryption-provider-config[= ]\([^ ]*\).*%\1%') - if test -e $ENCRYPTION_PROVIDER_CONFIG; then grep -A1 'providers:' $ENCRYPTION_PROVIDER_CONFIG | tail -n1 | grep -o "[A-Za-z]*" | sed 's/^/provider=/'; fi + if test -e $ENCRYPTION_PROVIDER_CONFIG; then grep -o 'providers\"\:\[.*\]' $ENCRYPTION_PROVIDER_CONFIG | grep -o "[A-Za-z]*" | head -2 | tail -1 | sed 's/^/provider=/'; fi tests: test_items: - flag: "provider" @@ -808,13 +836,14 @@ groups: op: valid_elements value: "aescbc,kms,secretbox" remediation: | - Follow the Kubernetes documentation and configure a EncryptionConfig file. - In this file, choose aescbc, kms or secretbox as the encryption provider. - scored: false + RKE2 always is configured to use the aescbc encryption provider to encrypt secrets. + Secrets encryption is managed with the rke2 secrets-encrypt command line tool. + If needed, you can find the generated encryption config at /var/lib/rancher/rke2/server/cred/encryption-config.json + scored: true - id: 1.2.31 text: "Ensure that the API Server only makes use of Strong Cryptographic Ciphers (Automated)" - audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep" + audit: "/bin/ps -fC $apiserverbin" tests: test_items: - flag: "--tls-cipher-suites" @@ -834,19 +863,21 @@ groups: checks: - id: 1.3.1 text: "Ensure that the --terminated-pod-gc-threshold argument is set as appropriate (Manual)" - audit: "/bin/ps -ef | grep $controllermanagerbin | grep -v grep" + audit: "/bin/ps -fC $controllermanagerbin" tests: test_items: - flag: "--terminated-pod-gc-threshold" remediation: | - Edit the Controller Manager pod specification file $controllermanagerconf - on the control plane node and set the --terminated-pod-gc-threshold to an appropriate threshold, - for example, --terminated-pod-gc-threshold=10 + By default, RKE2 sets a terminated-pod-gc-threshold of 1000. + If you need to change this value, edit the RKE2 config file /etc/rancher/rke2/config.yaml on the control plane node + and set the --terminated-pod-gc-threshold to an appropriate threshold, + kube-controller-manager-arg: + - "terminated-pod-gc-threshold=10" scored: false - id: 1.3.2 text: "Ensure that the --profiling argument is set to false (Automated)" - audit: "/bin/ps -ef | grep $controllermanagerbin | grep -v grep" + audit: "/bin/ps -fC $controllermanagerbin" tests: test_items: - flag: "--profiling" @@ -855,14 +886,15 @@ groups: value: false set: true remediation: | - Edit the Controller Manager pod specification file $controllermanagerconf - on the control plane node and set the below parameter. - --profiling=false + By default, RKE2 sets the --profiling argument to false. + If this check fails, edit the RKE2 config file /etc/rancher/rke2/config.yaml and remove any lines like below. + kube-controller-manager-arg: + - "profiling=true" scored: true - id: 1.3.3 text: "Ensure that the --use-service-account-credentials argument is set to true (Automated)" - audit: "/bin/ps -ef | grep $controllermanagerbin | grep -v grep" + audit: "/bin/ps -fC $controllermanagerbin" tests: test_items: - flag: "--use-service-account-credentials" @@ -871,41 +903,45 @@ groups: value: false set: true remediation: | - Edit the Controller Manager pod specification file $controllermanagerconf - on the control plane node to set the below parameter. - --use-service-account-credentials=true + By default, RKE2 sets the --use-service-account-credentials argument to true. + If this check fails, edit the RKE2 config file /etc/rancher/rke2/config.yaml and remove any lines like below. + kube-controller-manager-arg: + - "use-service-account-credentials=false" scored: true - id: 1.3.4 text: "Ensure that the --service-account-private-key-file argument is set as appropriate (Automated)" - audit: "/bin/ps -ef | grep $controllermanagerbin | grep -v grep" + audit: "/bin/ps -fC $controllermanagerbin" tests: test_items: - flag: "--service-account-private-key-file" set: true remediation: | - Edit the Controller Manager pod specification file $controllermanagerconf - on the control plane node and set the --service-account-private-key-file parameter - to the private key file for service accounts. - --service-account-private-key-file= + By default, RKE2 automatically provides the service account private key file. + It is generated and located at /var/lib/rancher/rke2/server/tls/service.current.key. + If this check fails, edit the RKE2 config file /etc/rancher/rke2/config.yaml and remove any lines like below. + kube-controller-manager-arg: + - "service-account-private-key-file=" scored: true - id: 1.3.5 text: "Ensure that the --root-ca-file argument is set as appropriate (Automated)" - audit: "/bin/ps -ef | grep $controllermanagerbin | grep -v grep" + audit: "/bin/ps -fC $controllermanagerbin" tests: test_items: - flag: "--root-ca-file" set: true remediation: | - Edit the Controller Manager pod specification file $controllermanagerconf - on the control plane node and set the --root-ca-file parameter to the certificate bundle file`. - --root-ca-file= + By default, RKE2 automatically provides the root CA file. + It is generated and located at /var/lib/rancher/rke2/server/tls/server-ca.crt. + If this check fails, edit the RKE2 config file /etc/rancher/rke2/config.yaml and remove any lines like below. + kube-controller-manager-arg: + - "root-ca-file=" scored: true - id: 1.3.6 text: "Ensure that the RotateKubeletServerCertificate argument is set to true (Automated)" - audit: "/bin/ps -ef | grep $controllermanagerbin | grep -v grep" + audit: "/bin/ps -fC $controllermanagerbin" tests: bin_op: or test_items: @@ -921,11 +957,10 @@ groups: on the control plane node and set the --feature-gates parameter to include RotateKubeletServerCertificate=true. --feature-gates=RotateKubeletServerCertificate=true scored: true - type: skip - id: 1.3.7 text: "Ensure that the --bind-address argument is set to 127.0.0.1 (Automated)" - audit: "/bin/ps -ef | grep $controllermanagerbin | grep -v grep" + audit: "/bin/ps -fC $controllermanagerbin" tests: bin_op: or test_items: @@ -937,8 +972,10 @@ groups: - flag: "--bind-address" set: false remediation: | - Edit the Controller Manager pod specification file $controllermanagerconf - on the control plane node and ensure the correct value for the --bind-address parameter + By default, RKE2 sets the --bind-address argument to 127.0.0.1 + If this check fails, edit the RKE2 config file /etc/rancher/rke2/config.yaml and remove any lines like below. + kube-controller-manager-arg: + - "bind-address=" scored: true - id: 1.4 @@ -946,7 +983,7 @@ groups: checks: - id: 1.4.1 text: "Ensure that the --profiling argument is set to false (Automated)" - audit: "/bin/ps -ef | grep $schedulerbin | grep -v grep" + audit: "/bin/ps -fC $schedulerbin" tests: test_items: - flag: "--profiling" @@ -955,14 +992,15 @@ groups: value: false set: true remediation: | - Edit the Scheduler pod specification file $schedulerconf file - on the control plane node and set the below parameter. - --profiling=false + By default, RKE2 sets the --profiling argument to false. + If this check fails, edit the RKE2 config file /etc/rancher/rke2/config.yaml and remove any lines like below. + kube-scheduler-arg: + - "profiling=true" scored: true - id: 1.4.2 text: "Ensure that the --bind-address argument is set to 127.0.0.1 (Automated)" - audit: "/bin/ps -ef | grep $schedulerbin | grep -v grep" + audit: "/bin/ps -fC $schedulerbin" tests: bin_op: or test_items: @@ -974,6 +1012,8 @@ groups: - flag: "--bind-address" set: false remediation: | - Edit the Scheduler pod specification file $schedulerconf - on the control plane node and ensure the correct value for the --bind-address parameter + By default, RKE2 sets the --bind-address argument to 127.0.0.1 + If this check fails, edit the RKE2 config file /etc/rancher/rke2/config.yaml and remove any lines like below. + kube-scheduler-arg: + - "bind-address=" scored: true diff --git a/package/cfg/rke2-cis-1.7-hardened/policies.yaml b/package/cfg/rke2-cis-1.7-hardened/policies.yaml index ebfc2340..c900bec0 100644 --- a/package/cfg/rke2-cis-1.7-hardened/policies.yaml +++ b/package/cfg/rke2-cis-1.7-hardened/policies.yaml @@ -187,8 +187,8 @@ groups: text: "Minimize the admission of containers with capabilities assigned (Manual)" type: "manual" remediation: | - Review the use of capabilites in applications running on your cluster. Where a namespace - contains applicaions which do not require any Linux capabities to operate consider adding + Review the use of capabilities in applications running on your cluster. Where a namespace + contains applications which do not require any Linux capabities to operate consider adding a PSP which forbids the admission of containers which do not drop all capabilities. scored: false diff --git a/package/cfg/rke2-cis-1.7-permissive/etcd.yaml b/package/cfg/rke2-cis-1.7-permissive/etcd.yaml index a7324740..de4edd9a 100644 --- a/package/cfg/rke2-cis-1.7-permissive/etcd.yaml +++ b/package/cfg/rke2-cis-1.7-permissive/etcd.yaml @@ -5,72 +5,6 @@ id: 2 text: "Etcd Node Configuration" type: "etcd" groups: - - id: 1.1 - text: "Master Node Configuration Files" - checks: - - id: 1.1.7 - text: "Ensure that the etcd pod specification file permissions are set to 600 or more restrictive (Automated)" - audit: "/bin/sh -c 'if test -e $etcdconf; then find $etcdconf -name '*etcd*' | xargs stat -c permissions=%a; fi'" - use_multiple_values: true - tests: - test_items: - - flag: "permissions" - compare: - op: bitmask - value: "600" - remediation: | - Run the below command (based on the file location on your system) on the control plane node. - For example, - chmod 600 $etcdconf - scored: true - - - id: 1.1.8 - text: "Ensure that the etcd pod specification file ownership is set to root:root (Automated)" - audit: "/bin/sh -c 'if test -e $etcdconf; then stat -c %U:%G $etcdconf; fi'" - tests: - test_items: - - flag: "root:root" - compare: - op: eq - value: "root:root" - set: true - remediation: | - Run the below command (based on the file location on your system) on the control plane node. - For example, - chown root:root $etcdconf - scored: true - - - id: 1.1.11 - text: "Ensure that the etcd data directory permissions are set to 700 or more restrictive (Automated)" - audit: "stat -c permissions=%a $etcddatadir" - tests: - test_items: - - flag: "permissions" - compare: - op: bitmask - value: "700" - set: true - remediation: | - On the etcd server node, get the etcd data directory, passed as an argument --data-dir, - from the command 'ps -ef | grep etcd'. - Run the below command (based on the etcd data directory found above). For example, - chmod 700 $etcddatadir - scored: true - - - id: 1.1.12 - text: "Ensure that the etcd data directory ownership is set to etcd:etcd (Automated)" - type: "skip" - audit: "stat -c %U:%G $etcddatadir" - tests: - test_items: - - flag: "etcd:etcd" - remediation: | - On the etcd server node, get the etcd data directory, passed as an argument --data-dir, - from the command 'ps -ef | grep etcd'. - Run the below command (based on the etcd data directory found above). - For example, chown etcd:etcd /var/lib/etcd - scored: true - - id: 2 text: "Etcd Node Configuration" checks: diff --git a/package/cfg/rke2-cis-1.7-permissive/master.yaml b/package/cfg/rke2-cis-1.7-permissive/master.yaml index 70a37af0..a0aa9246 100644 --- a/package/cfg/rke2-cis-1.7-permissive/master.yaml +++ b/package/cfg/rke2-cis-1.7-permissive/master.yaml @@ -140,12 +140,13 @@ groups: op: bitmask value: "600" remediation: | + Note that for many CNIs, a lock file is created with permissions 750. This is expected and can be ignored. Run the below command (based on the file location on your system) on the control plane node. - For example, chmod 600 + For example, chmod 600 /var/lib/cni/networks/ and chmod 600 /etc/cni/net.d/ scored: false - id: 1.1.10 - text: "Ensure that the Container Network Interface file ownership is set to root:root (Manual)" + text: "Ensure that the Container Network Interface file ownership is set to root:root (Automated)" audit: | ps -fC ${kubeletbin:-kubelet} | grep -- --cni-conf-dir || echo "/etc/cni/net.d" | sed 's%.*cni-conf-dir[= ]\([^ ]*\).*%\1%' | xargs -I{} find {} -mindepth 1 | xargs --no-run-if-empty stat -c %U:%G find /var/lib/cni/networks -type f 2> /dev/null | xargs --no-run-if-empty stat -c %U:%G @@ -194,9 +195,9 @@ groups: audit: "/bin/sh -c 'if test -e $schedulerkubeconfig; then stat -c permissions=%a $schedulerkubeconfig; fi'" tests: test_items: - - flag: "600" + - flag: "permissions" compare: - op: eq + op: bitmask value: "600" set: true remediation: | @@ -226,9 +227,9 @@ groups: audit: "/bin/sh -c 'if test -e $controllermanagerkubeconfig; then stat -c permissions=%a $controllermanagerkubeconfig; fi'" tests: test_items: - - flag: "600" + - flag: "permissions" compare: - op: eq + op: bitmask value: "600" set: true remediation: | @@ -250,7 +251,7 @@ groups: remediation: | Run the below command (based on the file location on your system) on the control plane node. For example, - chown root:root /var/lib/rancher/rke2/server/cred/controller.kubeconfig + chown root:root $controllermanagerkubeconfig scored: true - id: 1.1.19 @@ -288,7 +289,7 @@ groups: scored: false - id: 1.1.21 - text: "Ensure that the Kubernetes PKI key file permissions are set to 600 (Manual)" + text: "Ensure that the Kubernetes PKI key file permissions are set to 600 (Automated)" audit: "stat -c permissions=%a /var/lib/rancher/rke2/server/tls/*.key" use_multiple_values: true tests: @@ -309,7 +310,7 @@ groups: checks: - id: 1.2.1 text: "Ensure that the --anonymous-auth argument is set to false (Manual)" - audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep" + audit: "/bin/ps -fC $apiserverbin" type: manual tests: test_items: @@ -318,27 +319,29 @@ groups: op: eq value: false remediation: | - Edit the API server pod specification file $apiserverconf - on the control plane node and set the below parameter. - --anonymous-auth=false + By default, RKE2 sets the --anonymous-auth argument to false. + If this check fails, edit the RKE2 config file /etc/rancher/rke2/config.yaml and remove anything similar to below. + kube-apiserver-arg: + - "anonymous-auth=true" scored: false - id: 1.2.2 text: "Ensure that the --token-auth-file parameter is not set (Automated)" - audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep" + audit: "/bin/ps -fC $apiserverbin" tests: test_items: - flag: "--token-auth-file" set: false remediation: | - Follow the documentation and configure alternate mechanisms for authentication. Then, - edit the API server pod specification file $apiserverconf - on the control plane node and remove the --token-auth-file= parameter. + Follow the documentation and configure alternate mechanisms for authentication. + If this check fails, edit the RKE2 config file /etc/rancher/rke2/config.yaml and remove anything similar to below. + kube-apiserver-arg: + - "token-auth-file=" scored: true - id: 1.2.3 text: "Ensure that the --DenyServiceExternalIPs is not set (Automated)" - audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep" + audit: "/bin/ps -fC $apiserverbin" tests: bin_op: or test_items: @@ -350,14 +353,15 @@ groups: - flag: "--enable-admission-plugins" set: false remediation: | - Edit the API server pod specification file $apiserverconf - on the control plane node and remove the `DenyServiceExternalIPs` - from enabled admission plugins. + By default, RKE2 does not set DenyServiceExternalIPs. + If this check fails, edit the RKE2 config file /etc/rancher/rke2/config.yaml, remove any lines like below. + kube-apiserver-arg: + - "enable-admission-plugins=DenyServiceExternalIPs" scored: true - id: 1.2.4 text: "Ensure that the --kubelet-client-certificate and --kubelet-client-key arguments are set as appropriate (Automated)" - audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep" + audit: "/bin/ps -fC $apiserverbin" tests: bin_op: and test_items: @@ -366,32 +370,32 @@ groups: - flag: "--kubelet-client-key" set: true remediation: | - Follow the Kubernetes documentation and set up the TLS connection between the - apiserver and kubelets. Then, edit API server pod specification file - $apiserverconf on the control plane node and set the - kubelet client certificate and key parameters as below. - --kubelet-client-certificate= - --kubelet-client-key= + By default, RKE2 automatically provides the kubelet client certificate and key. + They are generated and located at /var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt and /var/lib/rancher/rke2/server/tls/client-kube-apiserver.key + If for some reason you need to provide your own certificate and key, you can set the + below parameters in the RKE2 config file /etc/rancher/rke2/config.yaml. + kube-apiserver-arg: + - "kubelet-client-certificate=" + - "kubelet-client-key=" scored: true - id: 1.2.5 text: "Ensure that the --kubelet-certificate-authority argument is set as appropriate (Automated)" - audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep" + audit: "/bin/ps -fC $apiserverbin" tests: test_items: - flag: "--kubelet-certificate-authority" set: true remediation: | - Follow the Kubernetes documentation and setup the TLS connection between - the apiserver and kubelets. Then, edit the API server pod specification file - $apiserverconf on the control plane node and set the - --kubelet-certificate-authority parameter to the path to the cert file for the certificate authority. - --kubelet-certificate-authority= + By default, RKE2 automatically provides the kubelet CA cert file, at /var/lib/rancher/rke2/server/tls/server-ca.crt. + If this check fails, edit the RKE2 config file /etc/rancher/rke2/config.yaml and remove any lines like below. + kube-apiserver-arg: + - "kubelet-certificate-authority=" scored: true - id: 1.2.6 text: "Ensure that the --authorization-mode argument is not set to AlwaysAllow (Automated)" - audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep" + audit: "/bin/ps -fC $apiserverbin" tests: test_items: - flag: "--authorization-mode" @@ -400,15 +404,15 @@ groups: value: "AlwaysAllow" set: true remediation: | - Edit the API server pod specification file $apiserverconf - on the control plane node and set the --authorization-mode parameter to values other than AlwaysAllow. - One such example could be as below. - --authorization-mode=RBAC + By default, RKE2 does not set the --authorization-mode to AlwaysAllow. + If this check fails, edit RKE2 config file /etc/rancher/rke2/config.yaml, remove any lines like below. + kube-apiserver-arg: + - "authorization-mode=AlwaysAllow" scored: true - id: 1.2.7 text: "Ensure that the --authorization-mode argument includes Node (Automated)" - audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep" + audit: "/bin/ps -fC $apiserverbin" tests: test_items: - flag: "--authorization-mode" @@ -417,14 +421,14 @@ groups: value: "Node" set: true remediation: | - Edit the API server pod specification file $apiserverconf - on the control plane node and set the --authorization-mode parameter to a value that includes Node. - --authorization-mode=Node,RBAC + By default, RKE2 sets the --authorization-mode to Node and RBAC. + If this check fails, edit the RKE2 config file /etc/rancher/rke2/config.yaml, + ensure that you are not overriding authorization-mode. scored: true - id: 1.2.8 text: "Ensure that the --authorization-mode argument includes RBAC (Automated)" - audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep" + audit: "/bin/ps -fC $apiserverbin" tests: test_items: - flag: "--authorization-mode" @@ -433,14 +437,14 @@ groups: value: "RBAC" set: true remediation: | - Edit the API server pod specification file $apiserverconf - on the control plane node and set the --authorization-mode parameter to a value that includes RBAC, - for example `--authorization-mode=Node,RBAC`. + By default, RKE2 sets the --authorization-mode to Node and RBAC. + If this check fails, edit the RKE2 config file /etc/rancher/rke2/config.yaml, + ensure that you are not overriding authorization-mode. scored: true - id: 1.2.9 text: "Ensure that the admission control plugin EventRateLimit is set (Manual)" - audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep" + audit: "/bin/ps -fC $apiserverbin" tests: test_items: - flag: "--enable-admission-plugins" @@ -450,15 +454,15 @@ groups: set: true remediation: | Follow the Kubernetes documentation and set the desired limits in a configuration file. - Then, edit the API server pod specification file $apiserverconf - and set the below parameters. - --enable-admission-plugins=...,EventRateLimit,... - --admission-control-config-file= + Then, edit the RKE2 config file /etc/rancher/rke2/config.yaml and set the below parameters. + kube-apiserver-arg: + - "enable-admission-plugins=...,EventRateLimit,..." + - "admission-control-config-file=" scored: false - id: 1.2.10 text: "Ensure that the admission control plugin AlwaysAdmit is not set (Automated)" - audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep" + audit: "/bin/ps -fC $apiserverbin" tests: bin_op: or test_items: @@ -470,14 +474,15 @@ groups: - flag: "--enable-admission-plugins" set: false remediation: | - Edit the API server pod specification file $apiserverconf - on the control plane node and either remove the --enable-admission-plugins parameter, or set it to a - value that does not include AlwaysAdmit. + By default, RKE2 does not set the --enable-admission-plugins to AlwaysAdmit. + If this check fails, edit RKE2 config file /etc/rancher/rke2/config.yaml, remove any lines like below. + kube-apiserver-arg: + - "enable-admission-plugins=AlwaysAdmit" scored: true - id: 1.2.11 text: "Ensure that the admission control plugin AlwaysPullImages is set (Manual)" - audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep" + audit: "/bin/ps -fC $apiserverbin" tests: test_items: - flag: "--enable-admission-plugins" @@ -486,7 +491,11 @@ groups: value: "AlwaysPullImages" set: true remediation: | - Edit the API server pod specification file $apiserverconf + Permissive, per CIS guidelines, + "This setting could impact offline or isolated clusters, which have images pre-loaded and + do not have access to a registry to pull in-use images. This setting is not appropriate for + clusters which use this configuration." + Edit the RKE2 config file /etc/rancher/rke2/config.yaml on the control plane node and set the --enable-admission-plugins parameter to include AlwaysPullImages. --enable-admission-plugins=...,AlwaysPullImages,... @@ -494,7 +503,8 @@ groups: - id: 1.2.12 text: "Ensure that the admission control plugin SecurityContextDeny is set if PodSecurityPolicy is not used (Manual)" - audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep" + audit: "/bin/ps -fC $apiserverbin" + type: "skip" tests: bin_op: or test_items: @@ -509,15 +519,13 @@ groups: value: "PodSecurityPolicy" set: true remediation: | - Edit the API server pod specification file $apiserverconf - on the control plane node and set the --enable-admission-plugins parameter to include - SecurityContextDeny, unless PodSecurityPolicy is already in place. - --enable-admission-plugins=...,SecurityContextDeny,... + Not Applicable. + Enabling Pod Security Policy is no longer supported on RKE2 v1.25+ and will cause applications to unexpectedly fail. scored: false - id: 1.2.13 text: "Ensure that the admission control plugin ServiceAccount is set (Automated)" - audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep" + audit: "/bin/ps -fC $apiserverbin" tests: bin_op: or test_items: @@ -528,15 +536,16 @@ groups: - flag: "--disable-admission-plugins" set: false remediation: | + By default, RKE2 does not set the --disable-admission-plugins to anything. Follow the documentation and create ServiceAccount objects as per your environment. - Then, edit the API server pod specification file $apiserverconf - on the control plane node and ensure that the --disable-admission-plugins parameter is set to a - value that does not include ServiceAccount. + If this check fails, edit the RKE2 config file /etc/rancher/rke2/config.yaml and remove any lines like below. + kube-apiserver-arg: + - "disable-admission-plugins=ServiceAccount" scored: true - id: 1.2.14 text: "Ensure that the admission control plugin NamespaceLifecycle is set (Automated)" - audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep" + audit: "/bin/ps -fC $apiserverbin" tests: bin_op: or test_items: @@ -547,14 +556,15 @@ groups: - flag: "--disable-admission-plugins" set: false remediation: | - Edit the API server pod specification file $apiserverconf - on the control plane node and set the --disable-admission-plugins parameter to - ensure it does not include NamespaceLifecycle. + By default, RKE2 does not set the --disable-admission-plugins to anything. + If this check fails, edit the RKE2 config file /etc/rancher/rke2/config.yaml and remove any lines like below. + kube-apiserver-arg: + - "disable-admission-plugins=...,NamespaceLifecycle,..." scored: true - id: 1.2.15 text: "Ensure that the admission control plugin NodeRestriction is set (Automated)" - audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep" + audit: "/bin/ps -fC $apiserverbin" tests: test_items: - flag: "--enable-admission-plugins" @@ -563,16 +573,16 @@ groups: value: "NodeRestriction" set: true remediation: | - Follow the Kubernetes documentation and configure NodeRestriction plug-in on kubelets. - Then, edit the API server pod specification file $apiserverconf - on the control plane node and set the --enable-admission-plugins parameter to a - value that includes NodeRestriction. - --enable-admission-plugins=...,NodeRestriction,... + By default, RKE2 sets the --enable-admission-plugins to NodeRestriction. + Check the RKE2 config file /etc/rancher/rke2/config.yaml, and ensure that you are not overriding the admission plugins. + If you are, include NodeRestriction in the list. + kube-apiserver-arg: + - "enable-admission-plugins=...,NodeRestriction,..." scored: true - id: 1.2.16 text: "Ensure that the --secure-port argument is not set to 0 - NoteThis recommendation is obsolete and will be deleted per the consensus process (Automated)" - audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep" + audit: "/bin/ps -fC $apiserverbin" tests: bin_op: or test_items: @@ -591,7 +601,7 @@ groups: - id: 1.2.17 text: "Ensure that the --profiling argument is set to false (Automated)" - audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep" + audit: "/bin/ps -fC $apiserverbin" tests: test_items: - flag: "--profiling" @@ -600,31 +610,34 @@ groups: value: false set: true remediation: | - Edit the API server pod specification file $apiserverconf - on the control plane node and set the below parameter. - --profiling=false + By default, RKE2 sets the --profiling argument to false. + If this check fails, edit the RKE2 config file /etc/rancher/rke2/config.yaml and remove any lines like below. + kube-apiserver-arg: + - "profiling=true" scored: true - id: 1.2.18 text: "Ensure that the --audit-log-path argument is set (Automated)" type: "skip" - audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep" + audit: "/bin/ps -fC $apiserverbin" tests: test_items: - flag: "--audit-log-path" set: true remediation: | - Edit the API server pod specification file $apiserverconf + By default, RKE2 sets the --audit-log-path argument to /var/lib/rancher/rke2/server/logs/audit.log + If you want to change this, edit the RKE2 config file /etc/rancher/rke2/config.yaml on the control plane node and set the --audit-log-path parameter to a suitable path and file where you would like audit logs to be written, for example, - --audit-log-path=/var/log/apiserver/audit.log + kube-apiserver-arg: + - "audit-log-path=/var/log/rke2/audit.log" Permissive. scored: true - id: 1.2.19 text: "Ensure that the --audit-log-maxage argument is set to 30 or as appropriate (Automated)" type: "skip" - audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep" + audit: "/bin/ps -fC $apiserverbin" tests: test_items: - flag: "--audit-log-maxage" @@ -633,17 +646,18 @@ groups: value: 30 set: true remediation: | - Edit the API server pod specification file $apiserverconf - on the control plane node and set the --audit-log-maxage parameter to 30 - or as an appropriate number of days, for example, - --audit-log-maxage=30 + By default, RKE2 sets the --audit-log-maxage argument to 30 days. + If you want to change this, edit the RKE2 config file /etc/rancher/rke2/config.yaml + on the control plane node and set the --audit-log-maxage parameter to an appropriate number of days, for example, + kube-apiserver-arg: + - "audit-log-maxage=40" Permissive. scored: true - id: 1.2.20 text: "Ensure that the --audit-log-maxbackup argument is set to 10 or as appropriate (Automated)" type: "skip" - audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep" + audit: "/bin/ps -fC $apiserverbin" tests: test_items: - flag: "--audit-log-maxbackup" @@ -652,17 +666,19 @@ groups: value: 10 set: true remediation: | - Edit the API server pod specification file $apiserverconf - on the control plane node and set the --audit-log-maxbackup parameter to 10 or to an appropriate - value. For example, - --audit-log-maxbackup=10 + By default, RKE2 sets the --audit-log-maxbackup argument to 10. + If you want to change this, edit the RKE2 config file /etc/rancher/rke2/config.yaml + on the control plane node and set the --audit-log-maxbackup parameter to an appropriate value. + For example, + kube-apiserver-arg: + - "audit-log-maxbackup=15" Permissive. scored: true - id: 1.2.21 text: "Ensure that the --audit-log-maxsize argument is set to 100 or as appropriate (Automated)" type: "skip" - audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep" + audit: "/bin/ps -fC $apiserverbin" tests: test_items: - flag: "--audit-log-maxsize" @@ -671,14 +687,17 @@ groups: value: 100 set: true remediation: | - Edit the API server pod specification file $apiserverconf + By default, RKE2 sets the --audit-log-maxsize argument to 100 MB. + If you want to change this, edit the RKE2 config file /etc/rancher/rke2/config.yaml on the control plane node and set the --audit-log-maxsize parameter to an appropriate size in MB. - For example, to set it as 100 MB, --audit-log-maxsize=100 + For example, + kube-apiserver-arg: + - "audit-log-maxsize=150" scored: true - id: 1.2.22 text: "Ensure that the --request-timeout argument is set as appropriate (Automated)" - audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep" + audit: "/bin/ps -fC $apiserverbin" tests: bin_op: or test_items: @@ -686,14 +705,17 @@ groups: set: false - flag: "--request-timeout" remediation: | - Edit the API server pod specification file $apiserverconf - and set the below parameter as appropriate and if needed. - For example, --request-timeout=300s + Permissive, per CIS guidelines, + "it is recommended to set this limit as appropriate and change the default limit of 60 seconds only if needed". + Edit the RKE2 config file /etc/rancher/rke2/config.yaml + and set the below parameter if needed. For example, + kube-apiserver-arg: + - "request-timeout=300s" scored: true - id: 1.2.23 text: "Ensure that the --service-account-lookup argument is set to true (Automated)" - audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep" + audit: "/bin/ps -fC $apiserverbin" tests: bin_op: or test_items: @@ -704,30 +726,32 @@ groups: op: eq value: true remediation: | - Edit the API server pod specification file $apiserverconf - on the control plane node and set the below parameter. - --service-account-lookup=true - Alternatively, you can delete the --service-account-lookup parameter from this file so + By default, RKE2 does not set the --service-account-lookup argument. + Edit the RKE2 config file /etc/rancher/rke2/config.yaml and set the service-account-lookup. For example, + kube-apiserver-arg: + - "service-account-lookup=true" + Alternatively, you can delete the service-account-lookup parameter from this file so that the default takes effect. scored: true - id: 1.2.24 text: "Ensure that the --service-account-key-file argument is set as appropriate (Automated)" - audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep" + audit: "/bin/ps -fC $apiserverbin" tests: test_items: - flag: "--service-account-key-file" set: true remediation: | - Edit the API server pod specification file $apiserverconf - on the control plane node and set the --service-account-key-file parameter - to the public key file for service accounts. For example, - --service-account-key-file= + RKE2 automatically generates and sets the service account key file. + It is located at /var/lib/rancher/rke2/server/tls/service.key. + If this check fails, edit RKE2 config file /etc/rancher/rke2/config.yaml and remove any lines like below. + kube-apiserver-arg: + - "service-account-key-file=" scored: true - id: 1.2.25 text: "Ensure that the --etcd-certfile and --etcd-keyfile arguments are set as appropriate (Automated)" - audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep" + audit: "/bin/ps -fC $apiserverbin" tests: bin_op: and test_items: @@ -736,16 +760,17 @@ groups: - flag: "--etcd-keyfile" set: true remediation: | - Follow the Kubernetes documentation and set up the TLS connection between the apiserver and etcd. - Then, edit the API server pod specification file $apiserverconf - on the control plane node and set the etcd certificate and key file parameters. - --etcd-certfile= - --etcd-keyfile= + RKE2 automatically generates and sets the etcd certificate and key files. + They are located at /var/lib/rancher/rke2/server/tls/etcd/client.crt and /var/lib/rancher/rke2/server/tls/etcd/client.key. + If this check fails, edit the RKE2 config file /etc/rancher/rke2/config.yaml and remove any lines like below. + kube-apiserver-arg: + - "etcd-certfile=" + - "etcd-keyfile=" scored: true - id: 1.2.26 text: "Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate (Automated)" - audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep" + audit: "/bin/ps -fC $apiserverbin" tests: bin_op: and test_items: @@ -754,60 +779,64 @@ groups: - flag: "--tls-private-key-file" set: true remediation: | - Follow the Kubernetes documentation and set up the TLS connection on the apiserver. - Then, edit the API server pod specification file $apiserverconf - on the control plane node and set the TLS certificate and private key file parameters. - --tls-cert-file= - --tls-private-key-file= + By default, RKE2 automatically generates and provides the TLS certificate and private key for the apiserver. + They are generated and located at /var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt and /var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key + If this check fails, edit the RKE2 config file /etc/rancher/rke2/config.yaml and remove any lines like below. + kube-apiserver-arg: + - "tls-cert-file=" + - "tls-private-key-file=" scored: true - id: 1.2.27 text: "Ensure that the --client-ca-file argument is set as appropriate (Automated)" - audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep" + audit: "/bin/ps -fC $apiserverbin" tests: test_items: - flag: "--client-ca-file" set: true remediation: | - Follow the Kubernetes documentation and set up the TLS connection on the apiserver. - Then, edit the API server pod specification file $apiserverconf - on the control plane node and set the client certificate authority file. - --client-ca-file= + By default, RKE2 automatically provides the client certificate authority file. + It is generated and located at /var/lib/rancher/rke2/server/tls/client-ca.crt. + If for some reason you need to provide your own ca certificate, look at using the rke2 certificate command line tool. + If this check fails, edit the RKE2 config file /etc/rancher/rke2/config.yaml and remove any lines like below. + kube-apiserver-arg: + - "client-ca-file=" scored: true - id: 1.2.28 text: "Ensure that the --etcd-cafile argument is set as appropriate (Automated)" - audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep" + audit: "/bin/ps -fC $apiserverbin" tests: test_items: - flag: "--etcd-cafile" set: true remediation: | - Follow the Kubernetes documentation and set up the TLS connection between the apiserver and etcd. - Then, edit the API server pod specification file $apiserverconf - on the control plane node and set the etcd certificate authority file parameter. - --etcd-cafile= + By default, RKE2 automatically provides the etcd certificate authority file. + It is generated and located at /var/lib/rancher/rke2/server/tls/client-ca.crt. + If for some reason you need to provide your own ca certificate, look at using the rke2 certificate command line tool. + If this check fails, edit the RKE2 config file /etc/rancher/rke2/config.yaml and remove any lines like below. + kube-apiserver-arg: + - "etcd-cafile=" scored: true - id: 1.2.29 - text: "Ensure that the --encryption-provider-config argument is set as appropriate (Manual)" - audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep" + text: "Ensure that the --encryption-provider-config argument is set as appropriate (Automated)" + audit: "/bin/ps -fC $apiserverbin" tests: test_items: - flag: "--encryption-provider-config" remediation: | - Follow the Kubernetes documentation and configure a EncryptionConfig file. - Then, edit the API server pod specification file $apiserverconf - on the control plane node and set the --encryption-provider-config parameter to the path of that file. - For example, --encryption-provider-config= - scored: false + RKE2 always is configured to encrypt secrets. + Secrets encryption is managed with the rke2 secrets-encrypt command line tool. + If needed, you can find the generated encryption config at /var/lib/rancher/rke2/server/cred/encryption-config.json + scored: true - id: 1.2.30 - text: "Ensure that encryption providers are appropriately configured (Manual)" + text: "Ensure that encryption providers are appropriately configured (Automated)" type: "skip" audit: | ENCRYPTION_PROVIDER_CONFIG=$(ps -ef | grep $apiserverbin | grep -- --encryption-provider-config | sed 's%.*encryption-provider-config[= ]\([^ ]*\).*%\1%') - if test -e $ENCRYPTION_PROVIDER_CONFIG; then grep -A1 'providers:' $ENCRYPTION_PROVIDER_CONFIG | tail -n1 | grep -o "[A-Za-z]*" | sed 's/^/provider=/'; fi + if test -e $ENCRYPTION_PROVIDER_CONFIG; then grep -o 'providers\"\:\[.*\]' $ENCRYPTION_PROVIDER_CONFIG | grep -o "[A-Za-z]*" | head -2 | tail -1 | sed 's/^/provider=/'; fi tests: test_items: - flag: "provider" @@ -815,14 +844,14 @@ groups: op: valid_elements value: "aescbc,kms,secretbox" remediation: | - Follow the Kubernetes documentation and configure a EncryptionConfig file. - In this file, choose aescbc, kms or secretbox as the encryption provider. - Permissive. - scored: false + RKE2 always is configured to use the aescbc encryption provider to encrypt secrets. + Secrets encryption is managed with the rke2 secrets-encrypt command line tool. + If needed, you can find the generated encryption config at /var/lib/rancher/rke2/server/cred/encryption-config.json + scored: true - id: 1.2.31 text: "Ensure that the API Server only makes use of Strong Cryptographic Ciphers (Automated)" - audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep" + audit: "/bin/ps -fC $apiserverbin" tests: test_items: - flag: "--tls-cipher-suites" @@ -842,19 +871,21 @@ groups: checks: - id: 1.3.1 text: "Ensure that the --terminated-pod-gc-threshold argument is set as appropriate (Manual)" - audit: "/bin/ps -ef | grep $controllermanagerbin | grep -v grep" + audit: "/bin/ps -fC $controllermanagerbin" tests: test_items: - flag: "--terminated-pod-gc-threshold" remediation: | - Edit the Controller Manager pod specification file $controllermanagerconf - on the control plane node and set the --terminated-pod-gc-threshold to an appropriate threshold, - for example, --terminated-pod-gc-threshold=10 + By default, RKE2 sets a terminated-pod-gc-threshold of 1000. + If you need to change this value, edit the RKE2 config file /etc/rancher/rke2/config.yaml on the control plane node + and set the --terminated-pod-gc-threshold to an appropriate threshold, + kube-controller-manager-arg: + - "terminated-pod-gc-threshold=10" scored: false - id: 1.3.2 text: "Ensure that the --profiling argument is set to false (Automated)" - audit: "/bin/ps -ef | grep $controllermanagerbin | grep -v grep" + audit: "/bin/ps -fC $controllermanagerbin" tests: test_items: - flag: "--profiling" @@ -863,14 +894,15 @@ groups: value: false set: true remediation: | - Edit the Controller Manager pod specification file $controllermanagerconf - on the control plane node and set the below parameter. - --profiling=false + By default, RKE2 sets the --profiling argument to false. + If this check fails, edit the RKE2 config file /etc/rancher/rke2/config.yaml and remove any lines like below. + kube-controller-manager-arg: + - "profiling=true" scored: true - id: 1.3.3 text: "Ensure that the --use-service-account-credentials argument is set to true (Automated)" - audit: "/bin/ps -ef | grep $controllermanagerbin | grep -v grep" + audit: "/bin/ps -fC $controllermanagerbin" tests: test_items: - flag: "--use-service-account-credentials" @@ -879,41 +911,45 @@ groups: value: false set: true remediation: | - Edit the Controller Manager pod specification file $controllermanagerconf - on the control plane node to set the below parameter. - --use-service-account-credentials=true + By default, RKE2 sets the --use-service-account-credentials argument to true. + If this check fails, edit the RKE2 config file /etc/rancher/rke2/config.yaml and remove any lines like below. + kube-controller-manager-arg: + - "use-service-account-credentials=false" scored: true - id: 1.3.4 text: "Ensure that the --service-account-private-key-file argument is set as appropriate (Automated)" - audit: "/bin/ps -ef | grep $controllermanagerbin | grep -v grep" + audit: "/bin/ps -fC $controllermanagerbin" tests: test_items: - flag: "--service-account-private-key-file" set: true remediation: | - Edit the Controller Manager pod specification file $controllermanagerconf - on the control plane node and set the --service-account-private-key-file parameter - to the private key file for service accounts. - --service-account-private-key-file= + By default, RKE2 automatically provides the service account private key file. + It is generated and located at /var/lib/rancher/rke2/server/tls/service.current.key. + If this check fails, edit the RKE2 config file /etc/rancher/rke2/config.yaml and remove any lines like below. + kube-controller-manager-arg: + - "service-account-private-key-file=" scored: true - id: 1.3.5 text: "Ensure that the --root-ca-file argument is set as appropriate (Automated)" - audit: "/bin/ps -ef | grep $controllermanagerbin | grep -v grep" + audit: "/bin/ps -fC $controllermanagerbin" tests: test_items: - flag: "--root-ca-file" set: true remediation: | - Edit the Controller Manager pod specification file $controllermanagerconf - on the control plane node and set the --root-ca-file parameter to the certificate bundle file`. - --root-ca-file= + By default, RKE2 automatically provides the root CA file. + It is generated and located at /var/lib/rancher/rke2/server/tls/server-ca.crt. + If this check fails, edit the RKE2 config file /etc/rancher/rke2/config.yaml and remove any lines like below. + kube-controller-manager-arg: + - "root-ca-file=" scored: true - id: 1.3.6 text: "Ensure that the RotateKubeletServerCertificate argument is set to true (Automated)" - audit: "/bin/ps -ef | grep $controllermanagerbin | grep -v grep" + audit: "/bin/ps -fC $controllermanagerbin" tests: bin_op: or test_items: @@ -929,11 +965,10 @@ groups: on the control plane node and set the --feature-gates parameter to include RotateKubeletServerCertificate=true. --feature-gates=RotateKubeletServerCertificate=true scored: true - type: skip - id: 1.3.7 text: "Ensure that the --bind-address argument is set to 127.0.0.1 (Automated)" - audit: "/bin/ps -ef | grep $controllermanagerbin | grep -v grep" + audit: "/bin/ps -fC $controllermanagerbin" tests: bin_op: or test_items: @@ -945,8 +980,10 @@ groups: - flag: "--bind-address" set: false remediation: | - Edit the Controller Manager pod specification file $controllermanagerconf - on the control plane node and ensure the correct value for the --bind-address parameter + By default, RKE2 sets the --bind-address argument to 127.0.0.1 + If this check fails, edit the RKE2 config file /etc/rancher/rke2/config.yaml and remove any lines like below. + kube-controller-manager-arg: + - "bind-address=" scored: true - id: 1.4 @@ -954,7 +991,7 @@ groups: checks: - id: 1.4.1 text: "Ensure that the --profiling argument is set to false (Automated)" - audit: "/bin/ps -ef | grep $schedulerbin | grep -v grep" + audit: "/bin/ps -fC $schedulerbin" tests: test_items: - flag: "--profiling" @@ -970,7 +1007,7 @@ groups: - id: 1.4.2 text: "Ensure that the --bind-address argument is set to 127.0.0.1 (Automated)" - audit: "/bin/ps -ef | grep $schedulerbin | grep -v grep" + audit: "/bin/ps -fC $schedulerbin" tests: bin_op: or test_items: diff --git a/package/cfg/rke2-cis-1.7-permissive/policies.yaml b/package/cfg/rke2-cis-1.7-permissive/policies.yaml index ebfc2340..c900bec0 100644 --- a/package/cfg/rke2-cis-1.7-permissive/policies.yaml +++ b/package/cfg/rke2-cis-1.7-permissive/policies.yaml @@ -187,8 +187,8 @@ groups: text: "Minimize the admission of containers with capabilities assigned (Manual)" type: "manual" remediation: | - Review the use of capabilites in applications running on your cluster. Where a namespace - contains applicaions which do not require any Linux capabities to operate consider adding + Review the use of capabilities in applications running on your cluster. Where a namespace + contains applications which do not require any Linux capabities to operate consider adding a PSP which forbids the admission of containers which do not drop all capabilities. scored: false diff --git a/package/cfg/rke2-cis-1.8-hardened/config.yaml b/package/cfg/rke2-cis-1.8-hardened/config.yaml index 18b04cf3..a20b9b52 100644 --- a/package/cfg/rke2-cis-1.8-hardened/config.yaml +++ b/package/cfg/rke2-cis-1.8-hardened/config.yaml @@ -38,6 +38,7 @@ master: datadirs: - /var/lib/rancher/rke2/server/db/etcd defaultconf: /var/lib/rancher/rke2/agent/pod-manifests/etcd.yaml + node: components: - kubelet @@ -49,6 +50,7 @@ node: defaultcafile: /var/lib/rancher/rke2/agent/client-ca.crt proxy: defaultkubeconfig: /var/lib/rancher/rke2/agent/kubeproxy.kubeconfig + policies: components: - policies diff --git a/package/cfg/rke2-cis-1.8-hardened/controlplane.yaml b/package/cfg/rke2-cis-1.8-hardened/controlplane.yaml index c8f21259..61801ffb 100644 --- a/package/cfg/rke2-cis-1.8-hardened/controlplane.yaml +++ b/package/cfg/rke2-cis-1.8-hardened/controlplane.yaml @@ -15,6 +15,7 @@ groups: Alternative mechanisms provided by Kubernetes such as the use of OIDC should be implemented in place of client certificates. scored: false + - id: 3.1.2 text: "Service account token authentication should not be used for users (Manual)" type: "manual" @@ -22,6 +23,7 @@ groups: Alternative mechanisms provided by Kubernetes such as the use of OIDC should be implemented in place of service account tokens. scored: false + - id: 3.1.3 text: "Bootstrap token authentication should not be used for users (Manual)" type: "manual" @@ -29,6 +31,7 @@ groups: Alternative mechanisms provided by Kubernetes such as the use of OIDC should be implemented in place of bootstrap tokens. scored: false + - id: 3.2 text: "Logging" checks: @@ -42,6 +45,7 @@ groups: remediation: | Create an audit policy file for your cluster. scored: true + - id: 3.2.2 text: "Ensure that the audit policy covers key security concerns (Manual)" type: "manual" diff --git a/package/cfg/rke2-cis-1.8-hardened/etcd.yaml b/package/cfg/rke2-cis-1.8-hardened/etcd.yaml index a0ebffd8..22221c97 100644 --- a/package/cfg/rke2-cis-1.8-hardened/etcd.yaml +++ b/package/cfg/rke2-cis-1.8-hardened/etcd.yaml @@ -5,71 +5,10 @@ id: 2 text: "Etcd Node Configuration" type: "etcd" groups: - - id: 1.1 - text: "Master Node Configuration Files" - checks: - - id: 1.1.7 - text: "Ensure that the etcd pod specification file permissions are set to 600 or more restrictive (Automated)" - audit: "/bin/sh -c 'if test -e $etcdconf; then find $etcdconf -name '*etcd*' | xargs stat -c permissions=%a; fi'" - use_multiple_values: true - tests: - test_items: - - flag: "permissions" - compare: - op: bitmask - value: "600" - remediation: | - Run the below command (based on the file location on your system) on the control plane node. - For example, - chmod 600 $etcdconf - scored: true - - id: 1.1.8 - text: "Ensure that the etcd pod specification file ownership is set to root:root (Automated)" - audit: "/bin/sh -c 'if test -e $etcdconf; then stat -c %U:%G $etcdconf; fi'" - tests: - test_items: - - flag: "root:root" - compare: - op: eq - value: "root:root" - set: true - remediation: | - Run the below command (based on the file location on your system) on the control plane node. - For example, - chown root:root $etcdconf - scored: true - - id: 1.1.11 - text: "Ensure that the etcd data directory permissions are set to 700 or more restrictive (Automated)" - audit: "stat -c permissions=%a $etcddatadir" - tests: - test_items: - - flag: "permissions" - compare: - op: bitmask - value: "700" - set: true - remediation: | - On the etcd server node, get the etcd data directory, passed as an argument --data-dir, - from the command 'ps -ef | grep etcd'. - Run the below command (based on the etcd data directory found above). For example, - chmod 700 $etcddatadir - scored: true - - id: 1.1.12 - text: "Ensure that the etcd data directory ownership is set to etcd:etcd (Automated)" - type: "skip" - audit: "stat -c %U:%G $etcddatadir" - tests: - test_items: - - flag: "etcd:etcd" - remediation: | - On the etcd server node, get the etcd data directory, passed as an argument --data-dir, - from the command 'ps -ef | grep etcd'. - Run the below command (based on the etcd data directory found above). - For example, chown etcd:etcd /var/lib/etcd - scored: true - id: 2 text: "Etcd Node Configuration" checks: + - id: 2.1 text: "Ensure that the --cert-file and --key-file arguments are set as appropriate (Automated)" type: "skip" @@ -89,6 +28,7 @@ groups: --key-file= Not Applicable. scored: true + - id: 2.2 text: "Ensure that the --client-cert-auth argument is set to true (Automated)" type: "skip" @@ -106,6 +46,7 @@ groups: --client-cert-auth="true" Not Applicable. scored: true + - id: 2.3 text: "Ensure that the --auto-tls argument is not set to true (Automated)" audit: "/bin/ps -ef | /bin/grep $etcdbin | /bin/grep -v grep" @@ -125,6 +66,7 @@ groups: node and either remove the --auto-tls parameter or set it to false. --auto-tls=false scored: true + - id: 2.4 text: "Ensure that the --peer-cert-file and --peer-key-file arguments are set as appropriate (Automated)" type: "skip" @@ -147,6 +89,7 @@ groups: --peer-key-file= Not Applicable. scored: true + - id: 2.5 text: "Ensure that the --peer-client-cert-auth argument is set to true (Automated)" type: "skip" @@ -165,6 +108,7 @@ groups: --peer-client-cert-auth=true Not Applicable. scored: true + - id: 2.6 text: "Ensure that the --peer-auto-tls argument is not set to true (Automated)" audit: "/bin/ps -ef | /bin/grep $etcdbin | /bin/grep -v grep" @@ -185,6 +129,7 @@ groups: node and either remove the --peer-auto-tls parameter or set it to false. --peer-auto-tls=false scored: true + - id: 2.7 text: "Ensure that a unique Certificate Authority is used for etcd (Automated)" audit: "/bin/ps -ef | /bin/grep $etcdbin | /bin/grep -v grep" diff --git a/package/cfg/rke2-cis-1.8-hardened/master.yaml b/package/cfg/rke2-cis-1.8-hardened/master.yaml index 3d2a6ee3..f4911e89 100644 --- a/package/cfg/rke2-cis-1.8-hardened/master.yaml +++ b/package/cfg/rke2-cis-1.8-hardened/master.yaml @@ -23,6 +23,7 @@ groups: control plane node. For example, chmod 600 $apiserverconf scored: true + - id: 1.1.2 text: "Ensure that the API server pod specification file ownership is set to root:root (Automated)" audit: "/bin/sh -c 'if test -e $apiserverconf; then stat -c %U:%G $apiserverconf; fi'" @@ -37,6 +38,7 @@ groups: Run the below command (based on the file location on your system) on the control plane node. For example, chown root:root $apiserverconf scored: true + - id: 1.1.3 text: "Ensure that the controller manager pod specification file permissions are set to 600 or more restrictive (Automated)" audit: "/bin/sh -c 'if test -e $controllermanagerconf; then stat -c permissions=%a $controllermanagerconf; fi'" @@ -51,6 +53,7 @@ groups: Run the below command (based on the file location on your system) on the control plane node. For example, chmod 600 $controllermanagerconf scored: true + - id: 1.1.4 text: "Ensure that the controller manager pod specification file ownership is set to root:root (Automated)" audit: "/bin/sh -c 'if test -e $controllermanagerconf; then stat -c %U:%G $controllermanagerconf; fi'" @@ -65,6 +68,7 @@ groups: Run the below command (based on the file location on your system) on the control plane node. For example, chown root:root $controllermanagerconf scored: true + - id: 1.1.5 text: "Ensure that the scheduler pod specification file permissions are set to 600 or more restrictive (Automated)" audit: "/bin/sh -c 'if test -e $schedulerconf; then stat -c permissions=%a $schedulerconf; fi'" @@ -79,6 +83,7 @@ groups: Run the below command (based on the file location on your system) on the control plane node. For example, chmod 600 $schedulerconf scored: true + - id: 1.1.6 text: "Ensure that the scheduler pod specification file ownership is set to root:root (Automated)" audit: "/bin/sh -c 'if test -e $schedulerconf; then stat -c %U:%G $schedulerconf; fi'" @@ -90,6 +95,7 @@ groups: Run the below command (based on the file location on your system) on the control plane node. For example, chown root:root $schedulerconf scored: true + - id: 1.1.7 text: "Ensure that the etcd pod specification file permissions are set to 600 or more restrictive (Automated)" audit: "/bin/sh -c 'if test -e $etcdconf; then stat -c permissions=%a $etcdconf; fi'" @@ -104,6 +110,7 @@ groups: For example, chmod 600 $etcdconf scored: true + - id: 1.1.8 text: "Ensure that the etcd pod specification file ownership is set to root:root (Automated)" audit: "/bin/sh -c 'if test -e $etcdconf; then stat -c %U:%G $etcdconf; fi'" @@ -119,6 +126,7 @@ groups: For example, chown root:root $etcdconf scored: true + - id: 1.1.9 text: "Ensure that the Container Network Interface file permissions are set to 600 or more restrictive (Manual)" audit: | @@ -132,11 +140,13 @@ groups: op: bitmask value: "600" remediation: | + Note that for many CNIs, a lock file is created with permissions 750. This is expected and can be ignored. Run the below command (based on the file location on your system) on the control plane node. - For example, chmod 600 + For example, chmod 600 /var/lib/cni/networks/ and chmod 600 /etc/cni/net.d/ scored: false + - id: 1.1.10 - text: "Ensure that the Container Network Interface file ownership is set to root:root (Manual)" + text: "Ensure that the Container Network Interface file ownership is set to root:root (Automated)" audit: | ps -fC ${kubeletbin:-kubelet} | grep -- --cni-conf-dir || echo "/etc/cni/net.d" | sed 's%.*cni-conf-dir[= ]\([^ ]*\).*%\1%' | xargs -I{} find {} -mindepth 1 | xargs --no-run-if-empty stat -c %U:%G find /var/lib/cni/networks -type f 2> /dev/null | xargs --no-run-if-empty stat -c %U:%G @@ -149,6 +159,7 @@ groups: For example, chown root:root scored: false + - id: 1.1.13 text: "Ensure that the admin.conf file permissions are set to 600 or more restrictive (Automated)" audit: "stat -c permissions=%a /var/lib/rancher/rke2/server/cred/admin.kubeconfig" @@ -163,6 +174,7 @@ groups: Run the below command (based on the file location on your system) on the control plane node. For example, chmod 600 /var/lib/rancher/rke2/server/cred/admin.kubeconfig scored: true + - id: 1.1.14 text: "Ensure that the admin.conf file ownership is set to root:root (Automated)" audit: "stat -c %U:%G /var/lib/rancher/rke2/server/cred/admin.kubeconfig" @@ -175,16 +187,17 @@ groups: set: true remediation: | Run the below command (based on the file location on your system) on the control plane node. - For example, chown root:root /etc/kubernetes/admin.conf + For example, chown root:root /var/lib/rancher/rke2/server/cred/admin.kubeconfig scored: true + - id: 1.1.15 text: "Ensure that the scheduler.conf file permissions are set to 600 or more restrictive (Automated)" audit: "/bin/sh -c 'if test -e $schedulerkubeconfig; then stat -c permissions=%a $schedulerkubeconfig; fi'" tests: test_items: - - flag: "600" + - flag: "permissions" compare: - op: eq + op: bitmask value: "600" set: true remediation: | @@ -192,6 +205,7 @@ groups: For example, chmod 600 $schedulerkubeconfig scored: true + - id: 1.1.16 text: "Ensure that the scheduler.conf file ownership is set to root:root (Automated)" audit: "stat -c %U:%G $schedulerkubeconfig" @@ -207,14 +221,15 @@ groups: For example, chown root:root $schedulerkubeconfig scored: true + - id: 1.1.17 text: "Ensure that the controller-manager.conf file permissions are set to 600 or more restrictive (Automated)" audit: "/bin/sh -c 'if test -e $controllermanagerkubeconfig; then stat -c permissions=%a $controllermanagerkubeconfig; fi'" tests: test_items: - - flag: "600" + - flag: "permissions" compare: - op: eq + op: bitmask value: "600" set: true remediation: | @@ -222,6 +237,7 @@ groups: For example, chmod 600 $controllermanagerkubeconfig scored: true + - id: 1.1.18 text: "Ensure that the controller-manager.conf file ownership is set to root:root (Automated)" audit: "stat -c %U:%G $controllermanagerkubeconfig" @@ -235,8 +251,9 @@ groups: remediation: | Run the below command (based on the file location on your system) on the control plane node. For example, - chown root:root /var/lib/rancher/rke2/server/cred/controller.kubeconfig + chown root:root $controllermanagerkubeconfig scored: true + - id: 1.1.19 text: "Ensure that the Kubernetes PKI directory and file ownership is set to root:root (Automated)" audit: "stat -c %U:%G /var/lib/rancher/rke2/server/tls" @@ -253,6 +270,7 @@ groups: For example, chown -R root:root /var/lib/rancher/rke2/server/tls scored: true + - id: 1.1.20 text: "Ensure that the Kubernetes PKI certificate file permissions are set to 600 or more restrictive (Manual)" audit: "stat -c permissions=%a /var/lib/rancher/rke2/server/tls/*.crt" @@ -269,8 +287,9 @@ groups: For example, chmod -R 600 /var/lib/rancher/rke2/server/tls/*.crt scored: false + - id: 1.1.21 - text: "Ensure that the Kubernetes PKI key file permissions are set to 600 (Manual)" + text: "Ensure that the Kubernetes PKI key file permissions are set to 600 (Automated)" audit: "stat -c permissions=%a /var/lib/rancher/rke2/server/tls/*.key" use_multiple_values: true tests: @@ -285,13 +304,13 @@ groups: For example, chmod -R 600 /var/lib/rancher/rke2/server/tls/*.key scored: false + - id: 1.2 text: "API Server" checks: - id: 1.2.1 - text: "Ensure that the --anonymous-auth argument is set to false (Manual)" - audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep" - type: manual + text: "Ensure that the --anonymous-auth argument is set to false (Automated)" + audit: "/bin/ps -fC $apiserverbin" tests: test_items: - flag: "--anonymous-auth" @@ -299,25 +318,29 @@ groups: op: eq value: false remediation: | - Edit the API server pod specification file $apiserverconf - on the control plane node and set the below parameter. - --anonymous-auth=false + By default, RKE2 sets the --anonymous-auth argument to false. + If this check fails, edit the RKE2 config file /etc/rancher/rke2/config.yaml and remove anything similar to below. + kube-apiserver-arg: + - "anonymous-auth=true" scored: false + - id: 1.2.2 text: "Ensure that the --token-auth-file parameter is not set (Automated)" - audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep" + audit: "/bin/ps -fC $apiserverbin" tests: test_items: - flag: "--token-auth-file" set: false remediation: | - Follow the documentation and configure alternate mechanisms for authentication. Then, - edit the API server pod specification file $apiserverconf - on the control plane node and remove the --token-auth-file= parameter. + Follow the documentation and configure alternate mechanisms for authentication. + If this check fails, edit the RKE2 config file /etc/rancher/rke2/config.yaml and remove anything similar to below. + kube-apiserver-arg: + - "token-auth-file=" scored: true + - id: 1.2.3 text: "Ensure that the --DenyServiceExternalIPs is not set (Automated)" - audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep" + audit: "/bin/ps -fC $apiserverbin" tests: bin_op: or test_items: @@ -329,13 +352,15 @@ groups: - flag: "--enable-admission-plugins" set: false remediation: | - Edit the API server pod specification file $apiserverconf - on the control plane node and remove the `DenyServiceExternalIPs` - from enabled admission plugins. + By default, RKE2 does not set DenyServiceExternalIPs. + If this check fails, edit the RKE2 config file /etc/rancher/rke2/config.yaml, remove any lines like below. + kube-apiserver-arg: + - "enable-admission-plugins=DenyServiceExternalIPs" scored: true + - id: 1.2.4 text: "Ensure that the --kubelet-client-certificate and --kubelet-client-key arguments are set as appropriate (Automated)" - audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep" + audit: "/bin/ps -fC $apiserverbin" tests: bin_op: and test_items: @@ -344,30 +369,33 @@ groups: - flag: "--kubelet-client-key" set: true remediation: | - Follow the Kubernetes documentation and set up the TLS connection between the - apiserver and kubelets. Then, edit API server pod specification file - $apiserverconf on the control plane node and set the - kubelet client certificate and key parameters as below. - --kubelet-client-certificate= - --kubelet-client-key= + By default, RKE2 automatically provides the kubelet client certificate and key. + They are generated and located at /var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt and /var/lib/rancher/rke2/server/tls/client-kube-apiserver.key + If for some reason you need to provide your own certificate and key, you can set the + below parameters in the RKE2 config file /etc/rancher/rke2/config.yaml. + kube-apiserver-arg: + - "kubelet-client-certificate=" + - "kubelet-client-key=" scored: true + - id: 1.2.5 text: "Ensure that the --kubelet-certificate-authority argument is set as appropriate (Automated)" - audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep" + audit: "/bin/ps -fC $apiserverbin" tests: test_items: - flag: "--kubelet-certificate-authority" set: true remediation: | - Follow the Kubernetes documentation and setup the TLS connection between - the apiserver and kubelets. Then, edit the API server pod specification file - $apiserverconf on the control plane node and set the - --kubelet-certificate-authority parameter to the path to the cert file for the certificate authority. - --kubelet-certificate-authority= + By default, RKE2 automatically provides the kubelet CA cert file, at /var/lib/rancher/rke2/server/tls/server-ca.crt. + If for some reason you need to provide your own ca certificate, look at using the rke2 certificate command line tool. + If this check fails, edit the RKE2 config file /etc/rancher/rke2/config.yaml and remove any lines like below. + kube-apiserver-arg: + - "kubelet-certificate-authority=" scored: true + - id: 1.2.6 text: "Ensure that the --authorization-mode argument is not set to AlwaysAllow (Automated)" - audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep" + audit: "/bin/ps -fC $apiserverbin" tests: test_items: - flag: "--authorization-mode" @@ -376,14 +404,15 @@ groups: value: "AlwaysAllow" set: true remediation: | - Edit the API server pod specification file $apiserverconf - on the control plane node and set the --authorization-mode parameter to values other than AlwaysAllow. - One such example could be as below. - --authorization-mode=RBAC + By default, RKE2 does not set the --authorization-mode to AlwaysAllow. + If this check fails, edit RKE2 config file /etc/rancher/rke2/config.yaml, remove any lines like below. + kube-apiserver-arg: + - "authorization-mode=AlwaysAllow" scored: true + - id: 1.2.7 text: "Ensure that the --authorization-mode argument includes Node (Automated)" - audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep" + audit: "/bin/ps -fC $apiserverbin" tests: test_items: - flag: "--authorization-mode" @@ -392,13 +421,14 @@ groups: value: "Node" set: true remediation: | - Edit the API server pod specification file $apiserverconf - on the control plane node and set the --authorization-mode parameter to a value that includes Node. - --authorization-mode=Node,RBAC + By default, RKE2 sets the --authorization-mode to Node and RBAC. + If this check fails, edit the RKE2 config file /etc/rancher/rke2/config.yaml, + ensure that you are not overriding authorization-mode. scored: true + - id: 1.2.8 text: "Ensure that the --authorization-mode argument includes RBAC (Automated)" - audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep" + audit: "/bin/ps -fC $apiserverbin" tests: test_items: - flag: "--authorization-mode" @@ -407,13 +437,14 @@ groups: value: "RBAC" set: true remediation: | - Edit the API server pod specification file $apiserverconf - on the control plane node and set the --authorization-mode parameter to a value that includes RBAC, - for example `--authorization-mode=Node,RBAC`. + By default, RKE2 sets the --authorization-mode to Node and RBAC. + If this check fails, edit the RKE2 config file /etc/rancher/rke2/config.yaml, + ensure that you are not overriding authorization-mode. scored: true + - id: 1.2.9 text: "Ensure that the admission control plugin EventRateLimit is set (Manual)" - audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep" + audit: "/bin/ps -fC $apiserverbin" tests: test_items: - flag: "--enable-admission-plugins" @@ -423,14 +454,15 @@ groups: set: true remediation: | Follow the Kubernetes documentation and set the desired limits in a configuration file. - Then, edit the API server pod specification file $apiserverconf - and set the below parameters. - --enable-admission-plugins=...,EventRateLimit,... - --admission-control-config-file= + Then, edit the RKE2 config file /etc/rancher/rke2/config.yaml and set the below parameters. + kube-apiserver-arg: + - "enable-admission-plugins=...,EventRateLimit,..." + - "admission-control-config-file=" scored: false + - id: 1.2.10 text: "Ensure that the admission control plugin AlwaysAdmit is not set (Automated)" - audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep" + audit: "/bin/ps -fC $apiserverbin" tests: bin_op: or test_items: @@ -442,13 +474,15 @@ groups: - flag: "--enable-admission-plugins" set: false remediation: | - Edit the API server pod specification file $apiserverconf - on the control plane node and either remove the --enable-admission-plugins parameter, or set it to a - value that does not include AlwaysAdmit. + By default, RKE2 does not set the --enable-admission-plugins to AlwaysAdmit. + If this check fails, edit RKE2 config file /etc/rancher/rke2/config.yaml, remove any lines like below. + kube-apiserver-arg: + - "enable-admission-plugins=AlwaysAdmit" scored: true + - id: 1.2.11 text: "Ensure that the admission control plugin AlwaysPullImages is set (Manual)" - audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep" + audit: "/bin/ps -fC $apiserverbin" tests: test_items: - flag: "--enable-admission-plugins" @@ -457,14 +491,20 @@ groups: value: "AlwaysPullImages" set: true remediation: | - Edit the API server pod specification file $apiserverconf + Permissive, per CIS guidelines, + "This setting could impact offline or isolated clusters, which have images pre-loaded and + do not have access to a registry to pull in-use images. This setting is not appropriate for + clusters which use this configuration." + Edit the RKE2 config file /etc/rancher/rke2/config.yaml on the control plane node and set the --enable-admission-plugins parameter to include AlwaysPullImages. --enable-admission-plugins=...,AlwaysPullImages,... scored: false + - id: 1.2.12 text: "Ensure that the admission control plugin SecurityContextDeny is set if PodSecurityPolicy is not used (Manual)" - audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep" + audit: "/bin/ps -fC $apiserverbin" + type: "skip" tests: bin_op: or test_items: @@ -479,14 +519,13 @@ groups: value: "PodSecurityPolicy" set: true remediation: | - Edit the API server pod specification file $apiserverconf - on the control plane node and set the --enable-admission-plugins parameter to include - SecurityContextDeny, unless PodSecurityPolicy is already in place. - --enable-admission-plugins=...,SecurityContextDeny,... + Not Applicable. + Enabling Pod Security Policy is no longer supported on RKE2 v1.25+ and will cause applications to unexpectedly fail. scored: false + - id: 1.2.13 text: "Ensure that the admission control plugin ServiceAccount is set (Automated)" - audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep" + audit: "/bin/ps -fC $apiserverbin" tests: bin_op: or test_items: @@ -497,14 +536,16 @@ groups: - flag: "--disable-admission-plugins" set: false remediation: | + By default, RKE2 does not set the --disable-admission-plugins to anything. Follow the documentation and create ServiceAccount objects as per your environment. - Then, edit the API server pod specification file $apiserverconf - on the control plane node and ensure that the --disable-admission-plugins parameter is set to a - value that does not include ServiceAccount. + If this check fails, edit the RKE2 config file /etc/rancher/rke2/config.yaml and remove any lines like below. + kube-apiserver-arg: + - "disable-admission-plugins=ServiceAccount" scored: true + - id: 1.2.14 text: "Ensure that the admission control plugin NamespaceLifecycle is set (Automated)" - audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep" + audit: "/bin/ps -fC $apiserverbin" tests: bin_op: or test_items: @@ -515,13 +556,15 @@ groups: - flag: "--disable-admission-plugins" set: false remediation: | - Edit the API server pod specification file $apiserverconf - on the control plane node and set the --disable-admission-plugins parameter to - ensure it does not include NamespaceLifecycle. + By default, RKE2 does not set the --disable-admission-plugins to anything. + If this check fails, edit the RKE2 config file /etc/rancher/rke2/config.yaml and remove any lines like below. + kube-apiserver-arg: + - "disable-admission-plugins=...,NamespaceLifecycle,..." scored: true + - id: 1.2.15 text: "Ensure that the admission control plugin NodeRestriction is set (Automated)" - audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep" + audit: "/bin/ps -fC $apiserverbin" tests: test_items: - flag: "--enable-admission-plugins" @@ -530,15 +573,16 @@ groups: value: "NodeRestriction" set: true remediation: | - Follow the Kubernetes documentation and configure NodeRestriction plug-in on kubelets. - Then, edit the API server pod specification file $apiserverconf - on the control plane node and set the --enable-admission-plugins parameter to a - value that includes NodeRestriction. - --enable-admission-plugins=...,NodeRestriction,... + By default, RKE2 sets the --enable-admission-plugins to NodeRestriction. + Check the RKE2 config file /etc/rancher/rke2/config.yaml, and ensure that you are not overriding the admission plugins. + If you are, include NodeRestriction in the list. + kube-apiserver-arg: + - "enable-admission-plugins=...,NodeRestriction,..." scored: true + - id: 1.2.16 text: "Ensure that the --profiling argument is set to false (Automated)" - audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep" + audit: "/bin/ps -fC $apiserverbin" tests: test_items: - flag: "--profiling" @@ -547,26 +591,31 @@ groups: value: false set: true remediation: | - Edit the API server pod specification file $apiserverconf - on the control plane node and set the below parameter. - --profiling=false + By default, RKE2 sets the --profiling argument to false. + If this check fails, edit the RKE2 config file /etc/rancher/rke2/config.yaml and remove any lines like below. + kube-apiserver-arg: + - "profiling=true" scored: true + - id: 1.2.17 text: "Ensure that the --audit-log-path argument is set (Automated)" - audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep" + audit: "/bin/ps -fC $apiserverbin" tests: test_items: - flag: "--audit-log-path" set: true remediation: | - Edit the API server pod specification file $apiserverconf + By default, RKE2 sets the --audit-log-path argument to /var/lib/rancher/rke2/server/logs/audit.log + If you want to change this, edit the RKE2 config file /etc/rancher/rke2/config.yaml on the control plane node and set the --audit-log-path parameter to a suitable path and file where you would like audit logs to be written, for example, - --audit-log-path=/var/log/apiserver/audit.log + kube-apiserver-arg: + - "audit-log-path=/var/log/rke2/audit.log" scored: true + - id: 1.2.18 text: "Ensure that the --audit-log-maxage argument is set to 30 or as appropriate (Automated)" - audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep" + audit: "/bin/ps -fC $apiserverbin" tests: test_items: - flag: "--audit-log-maxage" @@ -575,14 +624,16 @@ groups: value: 30 set: true remediation: | - Edit the API server pod specification file $apiserverconf - on the control plane node and set the --audit-log-maxage parameter to 30 - or as an appropriate number of days, for example, - --audit-log-maxage=30 + By default, RKE2 sets the --audit-log-maxage argument to 30 days. + If you want to change this, edit the RKE2 config file /etc/rancher/rke2/config.yaml + on the control plane node and set the --audit-log-maxage parameter to an appropriate number of days, for example, + kube-apiserver-arg: + - "audit-log-maxage=40" scored: true + - id: 1.2.19 text: "Ensure that the --audit-log-maxbackup argument is set to 10 or as appropriate (Automated)" - audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep" + audit: "/bin/ps -fC $apiserverbin" tests: test_items: - flag: "--audit-log-maxbackup" @@ -591,15 +642,17 @@ groups: value: 10 set: true remediation: | - Edit the API server pod specification file $apiserverconf - on the control plane node and set the --audit-log-maxbackup parameter to 10 or to an appropriate - value. For example, - --audit-log-maxbackup=10 + By default, RKE2 sets the --audit-log-maxbackup argument to 10. + If you want to change this, edit the RKE2 config file /etc/rancher/rke2/config.yaml + on the control plane node and set the --audit-log-maxbackup parameter to an appropriate value. + For example, + kube-apiserver-arg: + - "audit-log-maxbackup=15" scored: true + - id: 1.2.20 text: "Ensure that the --audit-log-maxsize argument is set to 100 or as appropriate (Automated)" - type: "skip" - audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep" + audit: "/bin/ps -fC $apiserverbin" tests: test_items: - flag: "--audit-log-maxsize" @@ -608,13 +661,17 @@ groups: value: 100 set: true remediation: | - Edit the API server pod specification file $apiserverconf + By default, RKE2 sets the --audit-log-maxsize argument to 100 MB. + If you want to change this, edit the RKE2 config file /etc/rancher/rke2/config.yaml on the control plane node and set the --audit-log-maxsize parameter to an appropriate size in MB. - For example, to set it as 100 MB, --audit-log-maxsize=100 + For example, + kube-apiserver-arg: + - "audit-log-maxsize=150" scored: true + - id: 1.2.21 text: "Ensure that the --request-timeout argument is set as appropriate (Automated)" - audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep" + audit: "/bin/ps -fC $apiserverbin" tests: bin_op: or test_items: @@ -622,13 +679,17 @@ groups: set: false - flag: "--request-timeout" remediation: | - Edit the API server pod specification file $apiserverconf - and set the below parameter as appropriate and if needed. - For example, --request-timeout=300s + Permissive, per CIS guidelines, + "it is recommended to set this limit as appropriate and change the default limit of 60 seconds only if needed". + Edit the RKE2 config file /etc/rancher/rke2/config.yaml + and set the below parameter if needed. For example, + kube-apiserver-arg: + - "request-timeout=300s" scored: true + - id: 1.2.22 text: "Ensure that the --service-account-lookup argument is set to true (Automated)" - audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep" + audit: "/bin/ps -fC $apiserverbin" tests: bin_op: or test_items: @@ -639,28 +700,32 @@ groups: op: eq value: true remediation: | - Edit the API server pod specification file $apiserverconf - on the control plane node and set the below parameter. - --service-account-lookup=true - Alternatively, you can delete the --service-account-lookup parameter from this file so + By default, RKE2 does not set the --service-account-lookup argument. + Edit the RKE2 config file /etc/rancher/rke2/config.yaml and set the service-account-lookup. For example, + kube-apiserver-arg: + - "service-account-lookup=true" + Alternatively, you can delete the service-account-lookup parameter from this file so that the default takes effect. scored: true + - id: 1.2.23 text: "Ensure that the --service-account-key-file argument is set as appropriate (Automated)" - audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep" + audit: "/bin/ps -fC $apiserverbin" tests: test_items: - flag: "--service-account-key-file" set: true remediation: | - Edit the API server pod specification file $apiserverconf - on the control plane node and set the --service-account-key-file parameter - to the public key file for service accounts. For example, - --service-account-key-file= + RKE2 automatically generates and sets the service account key file. + It is located at /var/lib/rancher/rke2/server/tls/service.key. + If this check fails, edit RKE2 config file /etc/rancher/rke2/config.yaml and remove any lines like below. + kube-apiserver-arg: + - "service-account-key-file=" scored: true + - id: 1.2.24 text: "Ensure that the --etcd-certfile and --etcd-keyfile arguments are set as appropriate (Automated)" - audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep" + audit: "/bin/ps -fC $apiserverbin" tests: bin_op: and test_items: @@ -669,15 +734,17 @@ groups: - flag: "--etcd-keyfile" set: true remediation: | - Follow the Kubernetes documentation and set up the TLS connection between the apiserver and etcd. - Then, edit the API server pod specification file $apiserverconf - on the control plane node and set the etcd certificate and key file parameters. - --etcd-certfile= - --etcd-keyfile= + RKE2 automatically generates and sets the etcd certificate and key files. + They are located at /var/lib/rancher/rke2/server/tls/etcd/client.crt and /var/lib/rancher/rke2/server/tls/etcd/client.key. + If this check fails, edit the RKE2 config file /etc/rancher/rke2/config.yaml and remove any lines like below. + kube-apiserver-arg: + - "etcd-certfile=" + - "etcd-keyfile=" scored: true + - id: 1.2.25 text: "Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate (Automated)" - audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep" + audit: "/bin/ps -fC $apiserverbin" tests: bin_op: and test_items: @@ -686,55 +753,63 @@ groups: - flag: "--tls-private-key-file" set: true remediation: | - Follow the Kubernetes documentation and set up the TLS connection on the apiserver. - Then, edit the API server pod specification file $apiserverconf - on the control plane node and set the TLS certificate and private key file parameters. - --tls-cert-file= - --tls-private-key-file= + By default, RKE2 automatically generates and provides the TLS certificate and private key for the apiserver. + They are generated and located at /var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt and /var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key + If this check fails, edit the RKE2 config file /etc/rancher/rke2/config.yaml and remove any lines like below. + kube-apiserver-arg: + - "tls-cert-file=" + - "tls-private-key-file=" scored: true + - id: 1.2.26 text: "Ensure that the --client-ca-file argument is set as appropriate (Automated)" - audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep" + audit: "/bin/ps -fC $apiserverbin" tests: test_items: - flag: "--client-ca-file" set: true remediation: | - Follow the Kubernetes documentation and set up the TLS connection on the apiserver. - Then, edit the API server pod specification file $apiserverconf - on the control plane node and set the client certificate authority file. - --client-ca-file= + By default, RKE2 automatically provides the client certificate authority file. + It is generated and located at /var/lib/rancher/rke2/server/tls/client-ca.crt. + If for some reason you need to provide your own ca certificate, look at using the rke2 certificate command line tool. + If this check fails, edit the RKE2 config file /etc/rancher/rke2/config.yaml and remove any lines like below. + kube-apiserver-arg: + - "client-ca-file=" scored: true + - id: 1.2.27 text: "Ensure that the --etcd-cafile argument is set as appropriate (Automated)" - audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep" + audit: "/bin/ps -fC $apiserverbin" tests: test_items: - flag: "--etcd-cafile" set: true remediation: | - Follow the Kubernetes documentation and set up the TLS connection between the apiserver and etcd. - Then, edit the API server pod specification file $apiserverconf - on the control plane node and set the etcd certificate authority file parameter. - --etcd-cafile= + By default, RKE2 automatically provides the etcd certificate authority file. + It is generated and located at /var/lib/rancher/rke2/server/tls/client-ca.crt. + If for some reason you need to provide your own ca certificate, look at using the rke2 certificate command line tool. + If this check fails, edit the RKE2 config file /etc/rancher/rke2/config.yaml and remove any lines like below. + kube-apiserver-arg: + - "etcd-cafile=" scored: true + - id: 1.2.28 - text: "Ensure that the --encryption-provider-config argument is set as appropriate (Manual)" - audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep" + text: "Ensure that the --encryption-provider-config argument is set as appropriate (Automated)" + audit: "/bin/ps -fC $apiserverbin" tests: test_items: - flag: "--encryption-provider-config" remediation: | - Follow the Kubernetes documentation and configure a EncryptionConfig file. - Then, edit the API server pod specification file $apiserverconf - on the control plane node and set the --encryption-provider-config parameter to the path of that file. - For example, --encryption-provider-config= - scored: false + RKE2 always is configured to encrypt secrets. + Secrets encryption is managed with the rke2 secrets-encrypt command line tool. + If needed, you can find the generated encryption config at /var/lib/rancher/rke2/server/cred/encryption-config.json + scored: true + - id: 1.2.29 - text: "Ensure that encryption providers are appropriately configured (Manual)" + text: "Ensure that encryption providers are appropriately configured (Automated)" audit: | ENCRYPTION_PROVIDER_CONFIG=$(ps -ef | grep $apiserverbin | grep -- --encryption-provider-config | sed 's%.*encryption-provider-config[= ]\([^ ]*\).*%\1%') - if test -e $ENCRYPTION_PROVIDER_CONFIG; then grep -A1 'providers:' $ENCRYPTION_PROVIDER_CONFIG | tail -n1 | grep -o "[A-Za-z]*" | sed 's/^/provider=/'; fi + if test -e $ENCRYPTION_PROVIDER_CONFIG; then grep -o 'providers\"\:\[.*\]' $ENCRYPTION_PROVIDER_CONFIG | grep -o "[A-Za-z]*" | head -2 | tail -1 | sed 's/^/provider=/'; fi tests: test_items: - flag: "provider" @@ -742,12 +817,14 @@ groups: op: valid_elements value: "aescbc,kms,secretbox" remediation: | - Follow the Kubernetes documentation and configure a EncryptionConfig file. - In this file, choose aescbc, kms or secretbox as the encryption provider. - scored: false + RKE2 always is configured to use the aescbc encryption provider to encrypt secrets. + Secrets encryption is managed with the rke2 secrets-encrypt command line tool. + If needed, you can find the generated encryption config at /var/lib/rancher/rke2/server/cred/encryption-config.json + scored: true + - id: 1.2.30 text: "Ensure that the API Server only makes use of Strong Cryptographic Ciphers (Automated)" - audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep" + audit: "/bin/ps -fC $apiserverbin" tests: test_items: - flag: "--tls-cipher-suites" @@ -761,23 +838,27 @@ groups: kube-apiserver-arg: - "tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305" scored: true + - id: 1.3 text: "Controller Manager" checks: - id: 1.3.1 text: "Ensure that the --terminated-pod-gc-threshold argument is set as appropriate (Manual)" - audit: "/bin/ps -ef | grep $controllermanagerbin | grep -v grep" + audit: "/bin/ps -fC $controllermanagerbin" tests: test_items: - flag: "--terminated-pod-gc-threshold" remediation: | - Edit the Controller Manager pod specification file $controllermanagerconf - on the control plane node and set the --terminated-pod-gc-threshold to an appropriate threshold, - for example, --terminated-pod-gc-threshold=10 + By default, RKE2 sets a terminated-pod-gc-threshold of 1000. + If you need to change this value, edit the RKE2 config file /etc/rancher/rke2/config.yaml on the control plane node + and set the --terminated-pod-gc-threshold to an appropriate threshold, + kube-controller-manager-arg: + - "terminated-pod-gc-threshold=10" scored: false + - id: 1.3.2 text: "Ensure that the --profiling argument is set to false (Automated)" - audit: "/bin/ps -ef | grep $controllermanagerbin | grep -v grep" + audit: "/bin/ps -fC $controllermanagerbin" tests: test_items: - flag: "--profiling" @@ -786,13 +867,15 @@ groups: value: false set: true remediation: | - Edit the Controller Manager pod specification file $controllermanagerconf - on the control plane node and set the below parameter. - --profiling=false + By default, RKE2 sets the --profiling argument to false. + If this check fails, edit the RKE2 config file /etc/rancher/rke2/config.yaml and remove any lines like below. + kube-controller-manager-arg: + - "profiling=true" scored: true + - id: 1.3.3 text: "Ensure that the --use-service-account-credentials argument is set to true (Automated)" - audit: "/bin/ps -ef | grep $controllermanagerbin | grep -v grep" + audit: "/bin/ps -fC $controllermanagerbin" tests: test_items: - flag: "--use-service-account-credentials" @@ -801,38 +884,46 @@ groups: value: false set: true remediation: | - Edit the Controller Manager pod specification file $controllermanagerconf - on the control plane node to set the below parameter. - --use-service-account-credentials=true + By default, RKE2 sets the --use-service-account-credentials argument to true. + If this check fails, edit the RKE2 config file /etc/rancher/rke2/config.yaml and remove any lines like below. + kube-controller-manager-arg: + - "use-service-account-credentials=false" scored: true + - id: 1.3.4 text: "Ensure that the --service-account-private-key-file argument is set as appropriate (Automated)" - audit: "/bin/ps -ef | grep $controllermanagerbin | grep -v grep" + audit: "/bin/ps -fC $controllermanagerbin" tests: test_items: - flag: "--service-account-private-key-file" set: true remediation: | - Edit the Controller Manager pod specification file $controllermanagerconf - on the control plane node and set the --service-account-private-key-file parameter - to the private key file for service accounts. - --service-account-private-key-file= + By default, RKE2 automatically provides the service account private key file. + It is generated and located at /var/lib/rancher/rke2/server/tls/service.current.key. + If this check fails, edit the RKE2 config file /etc/rancher/rke2/config.yaml and remove any lines like below. + kube-controller-manager-arg: + - "service-account-private-key-file=" scored: true + - id: 1.3.5 text: "Ensure that the --root-ca-file argument is set as appropriate (Automated)" - audit: "/bin/ps -ef | grep $controllermanagerbin | grep -v grep" + audit: "/bin/ps -fC $controllermanagerbin" tests: test_items: - flag: "--root-ca-file" set: true remediation: | - Edit the Controller Manager pod specification file $controllermanagerconf - on the control plane node and set the --root-ca-file parameter to the certificate bundle file`. - --root-ca-file= + By default, RKE2 automatically provides the root CA file. + It is generated and located at /var/lib/rancher/rke2/server/tls/server-ca.crt. + If for some reason you need to provide your own ca certificate, look at using the rke2 certificate command line tool. + If this check fails, edit the RKE2 config file /etc/rancher/rke2/config.yaml and remove any lines like below. + kube-controller-manager-arg: + - "root-ca-file=" scored: true + - id: 1.3.6 text: "Ensure that the RotateKubeletServerCertificate argument is set to true (Automated)" - audit: "/bin/ps -ef | grep $controllermanagerbin | grep -v grep" + audit: "/bin/ps -fC $controllermanagerbin" tests: bin_op: or test_items: @@ -844,14 +935,16 @@ groups: - flag: "--feature-gates" set: false remediation: | - Edit the Controller Manager pod specification file $controllermanagerconf - on the control plane node and set the --feature-gates parameter to include RotateKubeletServerCertificate=true. - --feature-gates=RotateKubeletServerCertificate=true + By default, RKE2 does not set the RotateKubeletServerCertificate feature gate. + If you have enabled this feature gate, you should remove it. + If this check fails, edit the RKE2 config file /etc/rancher/rke2/config.yaml, remove any lines like below. + kube-controller-manager-arg: + - "feature-gate=RotateKubeletServerCertificate" scored: true - type: skip + - id: 1.3.7 text: "Ensure that the --bind-address argument is set to 127.0.0.1 (Automated)" - audit: "/bin/ps -ef | grep $controllermanagerbin | grep -v grep" + audit: "/bin/ps -fC $controllermanagerbin" tests: bin_op: or test_items: @@ -863,15 +956,18 @@ groups: - flag: "--bind-address" set: false remediation: | - Edit the Controller Manager pod specification file $controllermanagerconf - on the control plane node and ensure the correct value for the --bind-address parameter + By default, RKE2 sets the --bind-address argument to 127.0.0.1 + If this check fails, edit the RKE2 config file /etc/rancher/rke2/config.yaml and remove any lines like below. + kube-controller-manager-arg: + - "bind-address=" scored: true + - id: 1.4 text: "Scheduler" checks: - id: 1.4.1 text: "Ensure that the --profiling argument is set to false (Automated)" - audit: "/bin/ps -ef | grep $schedulerbin | grep -v grep" + audit: "/bin/ps -fC $schedulerbin" tests: test_items: - flag: "--profiling" @@ -880,13 +976,15 @@ groups: value: false set: true remediation: | - Edit the Scheduler pod specification file $schedulerconf file - on the control plane node and set the below parameter. - --profiling=false + By default, RKE2 sets the --profiling argument to false. + If this check fails, edit the RKE2 config file /etc/rancher/rke2/config.yaml and remove any lines like below. + kube-scheduler-arg: + - "profiling=true" scored: true + - id: 1.4.2 text: "Ensure that the --bind-address argument is set to 127.0.0.1 (Automated)" - audit: "/bin/ps -ef | grep $schedulerbin | grep -v grep" + audit: "/bin/ps -fC $schedulerbin" tests: bin_op: or test_items: @@ -898,6 +996,8 @@ groups: - flag: "--bind-address" set: false remediation: | - Edit the Scheduler pod specification file $schedulerconf - on the control plane node and ensure the correct value for the --bind-address parameter + By default, RKE2 sets the --bind-address argument to 127.0.0.1 + If this check fails, edit the RKE2 config file /etc/rancher/rke2/config.yaml and remove any lines like below. + kube-scheduler-arg: + - "bind-address=" scored: true diff --git a/package/cfg/rke2-cis-1.8-hardened/node.yaml b/package/cfg/rke2-cis-1.8-hardened/node.yaml index 022dcd1e..6c5f7932 100644 --- a/package/cfg/rke2-cis-1.8-hardened/node.yaml +++ b/package/cfg/rke2-cis-1.8-hardened/node.yaml @@ -23,6 +23,7 @@ groups: For example, chmod 600 $kubeletsvc Not Applicable. scored: true + - id: 4.1.2 text: "Ensure that the kubelet service file ownership is set to root:root (Automated)" audit: '/bin/sh -c "if test -e $kubeletsvc; then stat -c %U:%G $kubeletsvc; else echo \"File not found\"; fi"' @@ -37,6 +38,7 @@ groups: chown root:root $kubeletsvc Not applicable. scored: true + - id: 4.1.3 text: "If proxy kubeconfig file exists ensure permissions are set to 600 or more restrictive (Manual)" audit: '/bin/sh -c ''if test -e $proxykubeconfig; then stat -c permissions=%a $proxykubeconfig; fi'' ' @@ -52,6 +54,7 @@ groups: For example, chmod 600 $proxykubeconfig scored: false + - id: 4.1.4 text: "If proxy kubeconfig file exists ensure ownership is set to root:root (Manual)" audit: '/bin/sh -c ''if test -e $proxykubeconfig; then stat -c %U:%G $proxykubeconfig; fi'' ' @@ -63,6 +66,7 @@ groups: Run the below command (based on the file location on your system) on the each worker node. For example, chown root:root $proxykubeconfig scored: false + - id: 4.1.5 text: "Ensure that the --kubeconfig kubelet.conf file permissions are set to 600 or more restrictive (Automated)" audit: '/bin/sh -c ''if test -e $kubeletkubeconfig; then stat -c permissions=%a $kubeletkubeconfig; fi'' ' @@ -78,6 +82,7 @@ groups: For example, chmod 600 $kubeletkubeconfig scored: true + - id: 4.1.6 text: "Ensure that the --kubeconfig kubelet.conf file ownership is set to root:root (Automated)" audit: '/bin/sh -c ''if test -e $kubeletkubeconfig; then stat -c %U:%G $kubeletkubeconfig; fi'' ' @@ -93,6 +98,7 @@ groups: For example, chown root:root $kubeletkubeconfig scored: true + - id: 4.1.7 text: "Ensure that the certificate authorities file permissions are set to 600 or more restrictive (Manual)" audit: "check_cafile_permissions.sh" @@ -107,6 +113,7 @@ groups: Run the following command to modify the file permissions of the --client-ca-file chmod 600 scored: false + - id: 4.1.8 text: "Ensure that the client certificate authorities file ownership is set to root:root (Manual)" audit: "check_cafile_ownership.sh" @@ -120,6 +127,7 @@ groups: Run the following command to modify the ownership of the --client-ca-file. chown root:root scored: false + - id: 4.1.9 text: "If the kubelet config.yaml configuration file is being used validate permissions set to 600 or more restrictive (Automated)" audit: '/bin/sh -c ''if test -e $kubeletconf; then stat -c permissions=%a $kubeletconf; fi'' ' @@ -134,6 +142,7 @@ groups: Run the following command (using the config file location identified in the Audit step) chmod 600 $kubeletconf scored: true + - id: 4.1.10 text: "If the kubelet config.yaml configuration file is being used validate file ownership is set to root:root (Automated)" audit: '/bin/sh -c ''if test -e $kubeletconf; then stat -c %U:%G $kubeletconf; fi'' ' @@ -145,6 +154,7 @@ groups: Run the following command (using the config file location identified in the Audit step) chown root:root $kubeletconf scored: true + - id: 4.2 text: "Kubelet" checks: @@ -170,6 +180,7 @@ groups: systemctl daemon-reload systemctl restart kubelet.service scored: true + - id: 4.2.2 text: "Ensure that the --authorization-mode argument is not set to AlwaysAllow (Automated)" audit: "/bin/ps -fC $kubeletbin" @@ -191,6 +202,7 @@ groups: systemctl daemon-reload systemctl restart kubelet.service scored: true + - id: 4.2.3 text: "Ensure that the --client-ca-file argument is set as appropriate (Automated)" audit: "/bin/ps -fC $kubeletbin" @@ -210,6 +222,7 @@ groups: systemctl daemon-reload systemctl restart kubelet.service scored: true + - id: 4.2.4 text: "Verify that the --read-only-port argument is set to 0 (Manual)" audit: "/bin/ps -fC $kubeletbin" @@ -235,6 +248,7 @@ groups: systemctl daemon-reload systemctl restart kubelet.service scored: false + - id: 4.2.5 text: "Ensure that the --streaming-connection-idle-timeout argument is not set to 0 (Manual)" audit: "/bin/ps -fC $kubeletbin" @@ -261,6 +275,7 @@ groups: systemctl daemon-reload systemctl restart kubelet.service scored: false + - id: 4.2.6 text: "Ensure that the --make-iptables-util-chains argument is set to true (Automated)" audit: "/bin/ps -fC $kubeletbin" @@ -286,6 +301,7 @@ groups: systemctl daemon-reload systemctl restart kubelet.service scored: true + - id: 4.2.7 text: "Ensure that the --hostname-override argument is not set (Manual)" # This is one of those properties that can only be set as a command line argument. @@ -306,6 +322,7 @@ groups: systemctl restart kubelet.service Not Applicable. scored: false + - id: 4.2.8 text: "Ensure that the eventRecordQPS argument is set to a level which ensures appropriate event capture (Manual)" audit: "/bin/ps -fC $kubeletbin" @@ -330,6 +347,7 @@ groups: systemctl daemon-reload systemctl restart kubelet.service scored: false + - id: 4.2.9 text: "Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate (Manual)" audit: "/bin/ps -fC $kubeletbin" @@ -353,6 +371,7 @@ groups: systemctl daemon-reload systemctl restart kubelet.service scored: false + - id: 4.2.10 text: "Ensure that the --rotate-certificates argument is not set to false (Automated)" audit: "/bin/ps -fC $kubeletbin" @@ -379,6 +398,7 @@ groups: systemctl daemon-reload systemctl restart kubelet.service scored: true + - id: 4.2.11 text: "Verify that the RotateKubeletServerCertificate argument is set to true (Manual)" audit: "/bin/ps -fC $kubeletbin" @@ -402,6 +422,7 @@ groups: systemctl daemon-reload systemctl restart kubelet.service scored: false + - id: 4.2.12 text: "Ensure that the Kubelet only makes use of Strong Cryptographic Ciphers (Manual)" audit: "/bin/ps -fC $kubeletbin" @@ -425,6 +446,7 @@ groups: systemctl daemon-reload systemctl restart kubelet.service scored: false + - id: 4.2.13 text: "Ensure that a limit is set on pod PIDs (Manual)" audit: "/bin/ps -fC $kubeletbin" diff --git a/package/cfg/rke2-cis-1.8-hardened/policies.yaml b/package/cfg/rke2-cis-1.8-hardened/policies.yaml index 37f3b6a9..b7c55a58 100644 --- a/package/cfg/rke2-cis-1.8-hardened/policies.yaml +++ b/package/cfg/rke2-cis-1.8-hardened/policies.yaml @@ -18,12 +18,14 @@ groups: clusterrolebinding to the cluster-admin role : kubectl delete clusterrolebinding [name] scored: false + - id: 5.1.2 text: "Minimize access to secrets (Manual)" type: "manual" remediation: | Where possible, remove get, list and watch access to Secret objects in the cluster. scored: false + - id: 5.1.3 text: "Minimize wildcard use in Roles and ClusterRoles (Manual)" type: "manual" @@ -31,12 +33,14 @@ groups: Where possible replace any use of wildcards in clusterroles and roles with specific objects or actions. scored: false + - id: 5.1.4 text: "Minimize access to create pods (Manual)" type: "manual" remediation: | Where possible, remove create access to pod objects in the cluster. scored: false + - id: 5.1.5 text: "Ensure that default service accounts are not actively used. (Manual)" type: "manual" @@ -46,6 +50,7 @@ groups: Modify the configuration of each default service account to include this value automountServiceAccountToken: false scored: false + - id: 5.1.6 text: "Ensure that Service Account Tokens are only mounted where necessary (Manual)" type: "manual" @@ -53,48 +58,56 @@ groups: Modify the definition of pods and service accounts which do not need to mount service account tokens to disable it. scored: false + - id: 5.1.7 text: "Avoid use of system:masters group (Manual)" type: "manual" remediation: | Remove the system:masters group from all users in the cluster. scored: false + - id: 5.1.8 text: "Limit use of the Bind, Impersonate and Escalate permissions in the Kubernetes cluster (Manual)" type: "manual" remediation: | Where possible, remove the impersonate, bind and escalate rights from subjects. scored: false + - id: 5.1.9 text: "Minimize access to create persistent volumes (Manual)" type: "manual" remediation: | Where possible, remove create access to PersistentVolume objects in the cluster. scored: false + - id: 5.1.10 text: "Minimize access to the proxy sub-resource of nodes (Manual)" type: "manual" remediation: | Where possible, remove access to the proxy sub-resource of node objects. scored: false + - id: 5.1.11 text: "Minimize access to the approval sub-resource of certificatesigningrequests objects (Manual)" type: "manual" remediation: | Where possible, remove access to the approval sub-resource of certificatesigningrequest objects. scored: false + - id: 5.1.12 text: "Minimize access to webhook configuration objects (Manual)" type: "manual" remediation: | Where possible, remove access to the validatingwebhookconfigurations or mutatingwebhookconfigurations objects scored: false + - id: 5.1.13 text: "Minimize access to the service account token creation (Manual)" type: "manual" remediation: | Where possible, remove access to the token sub-resource of serviceaccount objects. scored: false + - id: 5.2 text: "Pod Security Standards" checks: @@ -105,6 +118,7 @@ groups: Ensure that either Pod Security Admission or an external policy control system is in place for every namespace which contains user workloads. scored: false + - id: 5.2.2 text: "Minimize the admission of privileged containers (Manual)" type: "manual" @@ -112,6 +126,7 @@ groups: Add policies to each namespace in the cluster which has user workloads to restrict the admission of privileged containers. scored: false + - id: 5.2.3 text: "Minimize the admission of containers wishing to share the host process ID namespace (Manual)" type: "manual" @@ -119,6 +134,7 @@ groups: Add policies to each namespace in the cluster which has user workloads to restrict the admission of `hostPID` containers. scored: false + - id: 5.2.4 text: "Minimize the admission of containers wishing to share the host IPC namespace (Manual)" type: "manual" @@ -126,6 +142,7 @@ groups: Add policies to each namespace in the cluster which has user workloads to restrict the admission of `hostIPC` containers. scored: false + - id: 5.2.5 text: "Minimize the admission of containers wishing to share the host network namespace (Manual)" type: "manual" @@ -133,6 +150,7 @@ groups: Add policies to each namespace in the cluster which has user workloads to restrict the admission of `hostNetwork` containers. scored: false + - id: 5.2.6 text: "Minimize the admission of containers with allowPrivilegeEscalation (Manual)" type: "manual" @@ -140,6 +158,7 @@ groups: Add policies to each namespace in the cluster which has user workloads to restrict the admission of containers with `.spec.allowPrivilegeEscalation` set to `true`. scored: false + - id: 5.2.7 text: "Minimize the admission of root containers (Manual)" type: "manual" @@ -147,6 +166,7 @@ groups: Create a policy for each namespace in the cluster, ensuring that either `MustRunAsNonRoot` or `MustRunAs` with the range of UIDs not including 0, is set. scored: false + - id: 5.2.8 text: "Minimize the admission of containers with the NET_RAW capability (Manual)" type: "manual" @@ -154,6 +174,7 @@ groups: Add policies to each namespace in the cluster which has user workloads to restrict the admission of containers with the `NET_RAW` capability. scored: false + - id: 5.2.9 text: "Minimize the admission of containers with added capabilities (Automated)" type: "manual" @@ -161,14 +182,16 @@ groups: Ensure that `allowedCapabilities` is not present in policies for the cluster unless it is set to an empty array. scored: false + - id: 5.2.10 text: "Minimize the admission of containers with capabilities assigned (Manual)" type: "manual" remediation: | - Review the use of capabilites in applications running on your cluster. Where a namespace - contains applicaions which do not require any Linux capabities to operate consider adding + Review the use of capabilities in applications running on your cluster. Where a namespace + contains applications which do not require any Linux capabities to operate consider adding a PSP which forbids the admission of containers which do not drop all capabilities. scored: false + - id: 5.2.11 text: "Minimize the admission of Windows HostProcess containers (Manual)" type: "manual" @@ -176,6 +199,7 @@ groups: Add policies to each namespace in the cluster which has user workloads to restrict the admission of containers that have `.securityContext.windowsOptions.hostProcess` set to `true`. scored: false + - id: 5.2.12 text: "Minimize the admission of HostPath volumes (Manual)" type: "manual" @@ -183,6 +207,7 @@ groups: Add policies to each namespace in the cluster which has user workloads to restrict the admission of containers with `hostPath` volumes. scored: false + - id: 5.2.13 text: "Minimize the admission of containers which use HostPorts (Manual)" type: "manual" @@ -190,6 +215,7 @@ groups: Add policies to each namespace in the cluster which has user workloads to restrict the admission of containers which use `hostPort` sections. scored: false + - id: 5.3 text: "Network Policies and CNI" checks: @@ -201,12 +227,14 @@ groups: making use of a different plugin, or finding an alternate mechanism for restricting traffic in the Kubernetes cluster. scored: false + - id: 5.3.2 text: "Ensure that all Namespaces have NetworkPolicies defined (Manual)" type: "manual" remediation: | Follow the documentation and create NetworkPolicy objects as you need them. scored: false + - id: 5.4 text: "Secrets Management" checks: @@ -217,6 +245,7 @@ groups: If possible, rewrite application code to read Secrets from mounted secret files, rather than from environment variables. scored: false + - id: 5.4.2 text: "Consider external secret storage (Manual)" type: "manual" @@ -224,6 +253,7 @@ groups: Refer to the Secrets management options offered by your cloud provider or a third-party secrets management solution. scored: false + - id: 5.5 text: "Extensible Admission Control" checks: @@ -233,6 +263,7 @@ groups: remediation: | Follow the Kubernetes documentation and setup image provenance. scored: false + - id: 5.7 text: "General Policies" checks: @@ -243,6 +274,7 @@ groups: Follow the documentation and create namespaces for objects in your deployment as you need them. scored: false + - id: 5.7.2 text: "Ensure that the seccomp profile is set to docker/default in your Pod definitions (Manual)" type: "manual" @@ -253,6 +285,7 @@ groups: seccompProfile: type: RuntimeDefault scored: false + - id: 5.7.3 text: "Apply SecurityContext to your Pods and Containers (Manual)" type: "manual" @@ -261,6 +294,7 @@ groups: suggested list of SecurityContexts, you may refer to the CIS Security Benchmark for Docker Containers. scored: false + - id: 5.7.4 text: "The default namespace should not be used (Manual)" type: "manual" diff --git a/package/cfg/rke2-cis-1.8-permissive/config.yaml b/package/cfg/rke2-cis-1.8-permissive/config.yaml index ca771a01..5500a1a1 100644 --- a/package/cfg/rke2-cis-1.8-permissive/config.yaml +++ b/package/cfg/rke2-cis-1.8-permissive/config.yaml @@ -38,6 +38,7 @@ master: datadirs: - /var/lib/rancher/rke2/server/db/etcd defaultconf: /var/lib/rancher/rke2/agent/pod-manifests/etcd.yaml + node: components: - kubelet @@ -49,6 +50,7 @@ node: defaultcafile: /var/lib/rancher/rke2/agent/client-ca.crt proxy: defaultkubeconfig: /var/lib/rancher/rke2/agent/kubeproxy.kubeconfig + policies: components: - policies diff --git a/package/cfg/rke2-cis-1.8-permissive/controlplane.yaml b/package/cfg/rke2-cis-1.8-permissive/controlplane.yaml index d9cad3d1..ef3c3f9a 100644 --- a/package/cfg/rke2-cis-1.8-permissive/controlplane.yaml +++ b/package/cfg/rke2-cis-1.8-permissive/controlplane.yaml @@ -15,6 +15,7 @@ groups: Alternative mechanisms provided by Kubernetes such as the use of OIDC should be implemented in place of client certificates. scored: false + - id: 3.1.2 text: "Service account token authentication should not be used for users (Manual)" type: "manual" @@ -22,6 +23,7 @@ groups: Alternative mechanisms provided by Kubernetes such as the use of OIDC should be implemented in place of service account tokens. scored: false + - id: 3.1.3 text: "Bootstrap token authentication should not be used for users (Manual)" type: "manual" @@ -29,6 +31,7 @@ groups: Alternative mechanisms provided by Kubernetes such as the use of OIDC should be implemented in place of bootstrap tokens. scored: false + - id: 3.2 text: "Logging" checks: @@ -44,6 +47,7 @@ groups: Create an audit policy file for your cluster. Permissive. scored: true + - id: 3.2.2 text: "Ensure that the audit policy covers key security concerns (Manual)" type: "manual" diff --git a/package/cfg/rke2-cis-1.8-permissive/etcd.yaml b/package/cfg/rke2-cis-1.8-permissive/etcd.yaml index a0ebffd8..7590141b 100644 --- a/package/cfg/rke2-cis-1.8-permissive/etcd.yaml +++ b/package/cfg/rke2-cis-1.8-permissive/etcd.yaml @@ -5,68 +5,6 @@ id: 2 text: "Etcd Node Configuration" type: "etcd" groups: - - id: 1.1 - text: "Master Node Configuration Files" - checks: - - id: 1.1.7 - text: "Ensure that the etcd pod specification file permissions are set to 600 or more restrictive (Automated)" - audit: "/bin/sh -c 'if test -e $etcdconf; then find $etcdconf -name '*etcd*' | xargs stat -c permissions=%a; fi'" - use_multiple_values: true - tests: - test_items: - - flag: "permissions" - compare: - op: bitmask - value: "600" - remediation: | - Run the below command (based on the file location on your system) on the control plane node. - For example, - chmod 600 $etcdconf - scored: true - - id: 1.1.8 - text: "Ensure that the etcd pod specification file ownership is set to root:root (Automated)" - audit: "/bin/sh -c 'if test -e $etcdconf; then stat -c %U:%G $etcdconf; fi'" - tests: - test_items: - - flag: "root:root" - compare: - op: eq - value: "root:root" - set: true - remediation: | - Run the below command (based on the file location on your system) on the control plane node. - For example, - chown root:root $etcdconf - scored: true - - id: 1.1.11 - text: "Ensure that the etcd data directory permissions are set to 700 or more restrictive (Automated)" - audit: "stat -c permissions=%a $etcddatadir" - tests: - test_items: - - flag: "permissions" - compare: - op: bitmask - value: "700" - set: true - remediation: | - On the etcd server node, get the etcd data directory, passed as an argument --data-dir, - from the command 'ps -ef | grep etcd'. - Run the below command (based on the etcd data directory found above). For example, - chmod 700 $etcddatadir - scored: true - - id: 1.1.12 - text: "Ensure that the etcd data directory ownership is set to etcd:etcd (Automated)" - type: "skip" - audit: "stat -c %U:%G $etcddatadir" - tests: - test_items: - - flag: "etcd:etcd" - remediation: | - On the etcd server node, get the etcd data directory, passed as an argument --data-dir, - from the command 'ps -ef | grep etcd'. - Run the below command (based on the etcd data directory found above). - For example, chown etcd:etcd /var/lib/etcd - scored: true - id: 2 text: "Etcd Node Configuration" checks: @@ -89,6 +27,7 @@ groups: --key-file= Not Applicable. scored: true + - id: 2.2 text: "Ensure that the --client-cert-auth argument is set to true (Automated)" type: "skip" @@ -106,6 +45,7 @@ groups: --client-cert-auth="true" Not Applicable. scored: true + - id: 2.3 text: "Ensure that the --auto-tls argument is not set to true (Automated)" audit: "/bin/ps -ef | /bin/grep $etcdbin | /bin/grep -v grep" @@ -125,6 +65,7 @@ groups: node and either remove the --auto-tls parameter or set it to false. --auto-tls=false scored: true + - id: 2.4 text: "Ensure that the --peer-cert-file and --peer-key-file arguments are set as appropriate (Automated)" type: "skip" @@ -147,6 +88,7 @@ groups: --peer-key-file= Not Applicable. scored: true + - id: 2.5 text: "Ensure that the --peer-client-cert-auth argument is set to true (Automated)" type: "skip" @@ -165,6 +107,7 @@ groups: --peer-client-cert-auth=true Not Applicable. scored: true + - id: 2.6 text: "Ensure that the --peer-auto-tls argument is not set to true (Automated)" audit: "/bin/ps -ef | /bin/grep $etcdbin | /bin/grep -v grep" @@ -185,6 +128,7 @@ groups: node and either remove the --peer-auto-tls parameter or set it to false. --peer-auto-tls=false scored: true + - id: 2.7 text: "Ensure that a unique Certificate Authority is used for etcd (Automated)" audit: "/bin/ps -ef | /bin/grep $etcdbin | /bin/grep -v grep" diff --git a/package/cfg/rke2-cis-1.8-permissive/master.yaml b/package/cfg/rke2-cis-1.8-permissive/master.yaml index f2aa40c0..06eb2d71 100644 --- a/package/cfg/rke2-cis-1.8-permissive/master.yaml +++ b/package/cfg/rke2-cis-1.8-permissive/master.yaml @@ -22,7 +22,8 @@ groups: Run the below command (based on the file location on your system) on the control plane node. For example, chmod 600 $apiserverconf - scored: true + scored: false + - id: 1.1.2 text: "Ensure that the API server pod specification file ownership is set to root:root (Automated)" audit: "/bin/sh -c 'if test -e $apiserverconf; then stat -c %U:%G $apiserverconf; fi'" @@ -37,6 +38,7 @@ groups: Run the below command (based on the file location on your system) on the control plane node. For example, chown root:root $apiserverconf scored: true + - id: 1.1.3 text: "Ensure that the controller manager pod specification file permissions are set to 600 or more restrictive (Automated)" audit: "/bin/sh -c 'if test -e $controllermanagerconf; then stat -c permissions=%a $controllermanagerconf; fi'" @@ -50,7 +52,8 @@ groups: remediation: | Run the below command (based on the file location on your system) on the control plane node. For example, chmod 600 $controllermanagerconf - scored: true + scored: false + - id: 1.1.4 text: "Ensure that the controller manager pod specification file ownership is set to root:root (Automated)" audit: "/bin/sh -c 'if test -e $controllermanagerconf; then stat -c %U:%G $controllermanagerconf; fi'" @@ -65,6 +68,7 @@ groups: Run the below command (based on the file location on your system) on the control plane node. For example, chown root:root $controllermanagerconf scored: true + - id: 1.1.5 text: "Ensure that the scheduler pod specification file permissions are set to 600 or more restrictive (Automated)" audit: "/bin/sh -c 'if test -e $schedulerconf; then stat -c permissions=%a $schedulerconf; fi'" @@ -78,7 +82,8 @@ groups: remediation: | Run the below command (based on the file location on your system) on the control plane node. For example, chmod 600 $schedulerconf - scored: true + scored: false + - id: 1.1.6 text: "Ensure that the scheduler pod specification file ownership is set to root:root (Automated)" audit: "/bin/sh -c 'if test -e $schedulerconf; then stat -c %U:%G $schedulerconf; fi'" @@ -90,6 +95,7 @@ groups: Run the below command (based on the file location on your system) on the control plane node. For example, chown root:root $schedulerconf scored: true + - id: 1.1.7 text: "Ensure that the etcd pod specification file permissions are set to 600 or more restrictive (Automated)" audit: "/bin/sh -c 'if test -e $etcdconf; then stat -c permissions=%a $etcdconf; fi'" @@ -103,7 +109,8 @@ groups: Run the below command (based on the file location on your system) on the control plane node. For example, chmod 600 $etcdconf - scored: true + scored: false + - id: 1.1.8 text: "Ensure that the etcd pod specification file ownership is set to root:root (Automated)" audit: "/bin/sh -c 'if test -e $etcdconf; then stat -c %U:%G $etcdconf; fi'" @@ -119,6 +126,7 @@ groups: For example, chown root:root $etcdconf scored: true + - id: 1.1.9 text: "Ensure that the Container Network Interface file permissions are set to 600 or more restrictive (Manual)" audit: | @@ -132,11 +140,13 @@ groups: op: bitmask value: "600" remediation: | + Note that for many CNIs, a lock file is created with permissions 750. This is expected and can be ignored. Run the below command (based on the file location on your system) on the control plane node. - For example, chmod 600 + For example, chmod 600 /var/lib/cni/networks/ and chmod 600 /etc/cni/net.d/ scored: false + - id: 1.1.10 - text: "Ensure that the Container Network Interface file ownership is set to root:root (Manual)" + text: "Ensure that the Container Network Interface file ownership is set to root:root (Automated)" audit: | ps -fC ${kubeletbin:-kubelet} | grep -- --cni-conf-dir || echo "/etc/cni/net.d" | sed 's%.*cni-conf-dir[= ]\([^ ]*\).*%\1%' | xargs -I{} find {} -mindepth 1 | xargs --no-run-if-empty stat -c %U:%G find /var/lib/cni/networks -type f 2> /dev/null | xargs --no-run-if-empty stat -c %U:%G @@ -149,6 +159,7 @@ groups: For example, chown root:root scored: false + - id: 1.1.13 text: "Ensure that the admin.conf file permissions are set to 600 or more restrictive (Automated)" audit: "stat -c permissions=%a /var/lib/rancher/rke2/server/cred/admin.kubeconfig" @@ -163,6 +174,7 @@ groups: Run the below command (based on the file location on your system) on the control plane node. For example, chmod 600 /var/lib/rancher/rke2/server/cred/admin.kubeconfig scored: true + - id: 1.1.14 text: "Ensure that the admin.conf file ownership is set to root:root (Automated)" audit: "stat -c %U:%G /var/lib/rancher/rke2/server/cred/admin.kubeconfig" @@ -177,14 +189,15 @@ groups: Run the below command (based on the file location on your system) on the control plane node. For example, chown root:root /etc/kubernetes/admin.conf scored: true + - id: 1.1.15 text: "Ensure that the scheduler.conf file permissions are set to 600 or more restrictive (Automated)" audit: "/bin/sh -c 'if test -e $schedulerkubeconfig; then stat -c permissions=%a $schedulerkubeconfig; fi'" tests: test_items: - - flag: "600" + - flag: "permissions" compare: - op: eq + op: bitmask value: "600" set: true remediation: | @@ -192,6 +205,7 @@ groups: For example, chmod 600 $schedulerkubeconfig scored: true + - id: 1.1.16 text: "Ensure that the scheduler.conf file ownership is set to root:root (Automated)" audit: "stat -c %U:%G $schedulerkubeconfig" @@ -207,14 +221,15 @@ groups: For example, chown root:root $schedulerkubeconfig scored: true + - id: 1.1.17 text: "Ensure that the controller-manager.conf file permissions are set to 600 or more restrictive (Automated)" audit: "/bin/sh -c 'if test -e $controllermanagerkubeconfig; then stat -c permissions=%a $controllermanagerkubeconfig; fi'" tests: test_items: - - flag: "600" + - flag: "permissions" compare: - op: eq + op: bitmask value: "600" set: true remediation: | @@ -222,6 +237,7 @@ groups: For example, chmod 600 $controllermanagerkubeconfig scored: true + - id: 1.1.18 text: "Ensure that the controller-manager.conf file ownership is set to root:root (Automated)" audit: "stat -c %U:%G $controllermanagerkubeconfig" @@ -235,8 +251,9 @@ groups: remediation: | Run the below command (based on the file location on your system) on the control plane node. For example, - chown root:root /var/lib/rancher/rke2/server/cred/controller.kubeconfig + chown root:root $controllermanagerkubeconfig scored: true + - id: 1.1.19 text: "Ensure that the Kubernetes PKI directory and file ownership is set to root:root (Automated)" audit: "stat -c %U:%G /var/lib/rancher/rke2/server/tls" @@ -253,6 +270,7 @@ groups: For example, chown -R root:root /var/lib/rancher/rke2/server/tls scored: true + - id: 1.1.20 text: "Ensure that the Kubernetes PKI certificate file permissions are set to 600 or more restrictive (Manual)" audit: "stat -c permissions=%a /var/lib/rancher/rke2/server/tls/*.crt" @@ -269,8 +287,9 @@ groups: For example, chmod -R 600 /var/lib/rancher/rke2/server/tls/*.crt scored: false + - id: 1.1.21 - text: "Ensure that the Kubernetes PKI key file permissions are set to 600 (Manual)" + text: "Ensure that the Kubernetes PKI key file permissions are set to 600 (Automated)" audit: "stat -c permissions=%a /var/lib/rancher/rke2/server/tls/*.key" use_multiple_values: true tests: @@ -285,12 +304,13 @@ groups: For example, chmod -R 600 /var/lib/rancher/rke2/server/tls/*.key scored: false + - id: 1.2 text: "API Server" checks: - id: 1.2.1 text: "Ensure that the --anonymous-auth argument is set to false (Manual)" - audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep" + audit: "/bin/ps -fC $apiserverbin" type: manual tests: test_items: @@ -299,25 +319,29 @@ groups: op: eq value: false remediation: | - Edit the API server pod specification file $apiserverconf - on the control plane node and set the below parameter. - --anonymous-auth=false + By default, RKE2 sets the --anonymous-auth argument to false. + If this check fails, edit the RKE2 config file /etc/rancher/rke2/config.yaml and remove anything similar to below. + kube-apiserver-arg: + - "anonymous-auth=true" scored: false + - id: 1.2.2 text: "Ensure that the --token-auth-file parameter is not set (Automated)" - audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep" + audit: "/bin/ps -fC $apiserverbin" tests: test_items: - flag: "--token-auth-file" set: false remediation: | - Follow the documentation and configure alternate mechanisms for authentication. Then, - edit the API server pod specification file $apiserverconf - on the control plane node and remove the --token-auth-file= parameter. + Follow the documentation and configure alternate mechanisms for authentication. + If this check fails, edit the RKE2 config file /etc/rancher/rke2/config.yaml and remove anything similar to below. + kube-apiserver-arg: + - "token-auth-file=" scored: true + - id: 1.2.3 text: "Ensure that the --DenyServiceExternalIPs is not set (Automated)" - audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep" + audit: "/bin/ps -fC $apiserverbin" tests: bin_op: or test_items: @@ -329,13 +353,15 @@ groups: - flag: "--enable-admission-plugins" set: false remediation: | - Edit the API server pod specification file $apiserverconf - on the control plane node and remove the `DenyServiceExternalIPs` - from enabled admission plugins. + By default, RKE2 does not set DenyServiceExternalIPs. + If this check fails, edit the RKE2 config file /etc/rancher/rke2/config.yaml, remove any lines like below. + kube-apiserver-arg: + - "enable-admission-plugins=DenyServiceExternalIPs" scored: true + - id: 1.2.4 text: "Ensure that the --kubelet-client-certificate and --kubelet-client-key arguments are set as appropriate (Automated)" - audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep" + audit: "/bin/ps -fC $apiserverbin" tests: bin_op: and test_items: @@ -344,30 +370,33 @@ groups: - flag: "--kubelet-client-key" set: true remediation: | - Follow the Kubernetes documentation and set up the TLS connection between the - apiserver and kubelets. Then, edit API server pod specification file - $apiserverconf on the control plane node and set the - kubelet client certificate and key parameters as below. - --kubelet-client-certificate= - --kubelet-client-key= + By default, RKE2 automatically provides the kubelet client certificate and key. + They are generated and located at /var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt and /var/lib/rancher/rke2/server/tls/client-kube-apiserver.key + If for some reason you need to provide your own certificate and key, you can set the + below parameters in the RKE2 config file /etc/rancher/rke2/config.yaml. + kube-apiserver-arg: + - "kubelet-client-certificate=" + - "kubelet-client-key=" scored: true + - id: 1.2.5 text: "Ensure that the --kubelet-certificate-authority argument is set as appropriate (Automated)" - audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep" + audit: "/bin/ps -fC $apiserverbin" tests: test_items: - flag: "--kubelet-certificate-authority" set: true remediation: | - Follow the Kubernetes documentation and setup the TLS connection between - the apiserver and kubelets. Then, edit the API server pod specification file - $apiserverconf on the control plane node and set the - --kubelet-certificate-authority parameter to the path to the cert file for the certificate authority. - --kubelet-certificate-authority= + By default, RKE2 automatically provides the kubelet CA cert file, at /var/lib/rancher/rke2/server/tls/server-ca.crt. + If for some reason you need to provide your own ca certificate, look at using the rke2 certificate command line tool. + If this check fails, edit the RKE2 config file /etc/rancher/rke2/config.yaml and remove any lines like below. + kube-apiserver-arg: + - "kubelet-certificate-authority=" scored: true + - id: 1.2.6 text: "Ensure that the --authorization-mode argument is not set to AlwaysAllow (Automated)" - audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep" + audit: "/bin/ps -fC $apiserverbin" tests: test_items: - flag: "--authorization-mode" @@ -376,14 +405,15 @@ groups: value: "AlwaysAllow" set: true remediation: | - Edit the API server pod specification file $apiserverconf - on the control plane node and set the --authorization-mode parameter to values other than AlwaysAllow. - One such example could be as below. - --authorization-mode=RBAC + By default, RKE2 does not set the --authorization-mode to AlwaysAllow. + If this check fails, edit RKE2 config file /etc/rancher/rke2/config.yaml, remove any lines like below. + kube-apiserver-arg: + - "authorization-mode=AlwaysAllow" scored: true + - id: 1.2.7 text: "Ensure that the --authorization-mode argument includes Node (Automated)" - audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep" + audit: "/bin/ps -fC $apiserverbin" tests: test_items: - flag: "--authorization-mode" @@ -392,13 +422,14 @@ groups: value: "Node" set: true remediation: | - Edit the API server pod specification file $apiserverconf - on the control plane node and set the --authorization-mode parameter to a value that includes Node. - --authorization-mode=Node,RBAC + By default, RKE2 sets the --authorization-mode to Node and RBAC. + If this check fails, edit the RKE2 config file /etc/rancher/rke2/config.yaml, + ensure that you are not overriding authorization-mode. scored: true + - id: 1.2.8 text: "Ensure that the --authorization-mode argument includes RBAC (Automated)" - audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep" + audit: "/bin/ps -fC $apiserverbin" tests: test_items: - flag: "--authorization-mode" @@ -407,13 +438,14 @@ groups: value: "RBAC" set: true remediation: | - Edit the API server pod specification file $apiserverconf - on the control plane node and set the --authorization-mode parameter to a value that includes RBAC, - for example `--authorization-mode=Node,RBAC`. + By default, RKE2 sets the --authorization-mode to Node and RBAC. + If this check fails, edit the RKE2 config file /etc/rancher/rke2/config.yaml, + ensure that you are not overriding authorization-mode. scored: true + - id: 1.2.9 text: "Ensure that the admission control plugin EventRateLimit is set (Manual)" - audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep" + audit: "/bin/ps -fC $apiserverbin" tests: test_items: - flag: "--enable-admission-plugins" @@ -423,14 +455,15 @@ groups: set: true remediation: | Follow the Kubernetes documentation and set the desired limits in a configuration file. - Then, edit the API server pod specification file $apiserverconf - and set the below parameters. - --enable-admission-plugins=...,EventRateLimit,... - --admission-control-config-file= + Then, edit the RKE2 config file /etc/rancher/rke2/config.yaml and set the below parameters. + kube-apiserver-arg: + - "enable-admission-plugins=...,EventRateLimit,..." + - "admission-control-config-file=" scored: false + - id: 1.2.10 text: "Ensure that the admission control plugin AlwaysAdmit is not set (Automated)" - audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep" + audit: "/bin/ps -fC $apiserverbin" tests: bin_op: or test_items: @@ -442,13 +475,15 @@ groups: - flag: "--enable-admission-plugins" set: false remediation: | - Edit the API server pod specification file $apiserverconf - on the control plane node and either remove the --enable-admission-plugins parameter, or set it to a - value that does not include AlwaysAdmit. + By default, RKE2 does not set the --enable-admission-plugins to AlwaysAdmit. + If this check fails, edit RKE2 config file /etc/rancher/rke2/config.yaml, remove any lines like below. + kube-apiserver-arg: + - "enable-admission-plugins=AlwaysAdmit" scored: true + - id: 1.2.11 text: "Ensure that the admission control plugin AlwaysPullImages is set (Manual)" - audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep" + audit: "/bin/ps -fC $apiserverbin" tests: test_items: - flag: "--enable-admission-plugins" @@ -457,14 +492,20 @@ groups: value: "AlwaysPullImages" set: true remediation: | - Edit the API server pod specification file $apiserverconf + Permissive, per CIS guidelines, + "This setting could impact offline or isolated clusters, which have images pre-loaded and + do not have access to a registry to pull in-use images. This setting is not appropriate for + clusters which use this configuration." + Edit the RKE2 config file /etc/rancher/rke2/config.yaml on the control plane node and set the --enable-admission-plugins parameter to include AlwaysPullImages. --enable-admission-plugins=...,AlwaysPullImages,... scored: false + - id: 1.2.12 text: "Ensure that the admission control plugin SecurityContextDeny is set if PodSecurityPolicy is not used (Manual)" - audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep" + audit: "/bin/ps -fC $apiserverbin" + type: "skip" tests: bin_op: or test_items: @@ -479,14 +520,13 @@ groups: value: "PodSecurityPolicy" set: true remediation: | - Edit the API server pod specification file $apiserverconf - on the control plane node and set the --enable-admission-plugins parameter to include - SecurityContextDeny, unless PodSecurityPolicy is already in place. - --enable-admission-plugins=...,SecurityContextDeny,... + Not Applicable. + Enabling Pod Security Policy is no longer supported on RKE2 v1.25+ and will cause applications to unexpectedly fail. scored: false + - id: 1.2.13 text: "Ensure that the admission control plugin ServiceAccount is set (Automated)" - audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep" + audit: "/bin/ps -fC $apiserverbin" tests: bin_op: or test_items: @@ -497,14 +537,16 @@ groups: - flag: "--disable-admission-plugins" set: false remediation: | + By default, RKE2 does not set the --disable-admission-plugins to anything. Follow the documentation and create ServiceAccount objects as per your environment. - Then, edit the API server pod specification file $apiserverconf - on the control plane node and ensure that the --disable-admission-plugins parameter is set to a - value that does not include ServiceAccount. + If this check fails, edit the RKE2 config file /etc/rancher/rke2/config.yaml and remove any lines like below. + kube-apiserver-arg: + - "disable-admission-plugins=ServiceAccount" scored: true + - id: 1.2.14 text: "Ensure that the admission control plugin NamespaceLifecycle is set (Automated)" - audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep" + audit: "/bin/ps -fC $apiserverbin" tests: bin_op: or test_items: @@ -515,13 +557,15 @@ groups: - flag: "--disable-admission-plugins" set: false remediation: | - Edit the API server pod specification file $apiserverconf - on the control plane node and set the --disable-admission-plugins parameter to - ensure it does not include NamespaceLifecycle. + By default, RKE2 does not set the --disable-admission-plugins to anything. + If this check fails, edit the RKE2 config file /etc/rancher/rke2/config.yaml and remove any lines like below. + kube-apiserver-arg: + - "disable-admission-plugins=...,NamespaceLifecycle,..." scored: true + - id: 1.2.15 text: "Ensure that the admission control plugin NodeRestriction is set (Automated)" - audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep" + audit: "/bin/ps -fC $apiserverbin" tests: test_items: - flag: "--enable-admission-plugins" @@ -530,15 +574,16 @@ groups: value: "NodeRestriction" set: true remediation: | - Follow the Kubernetes documentation and configure NodeRestriction plug-in on kubelets. - Then, edit the API server pod specification file $apiserverconf - on the control plane node and set the --enable-admission-plugins parameter to a - value that includes NodeRestriction. - --enable-admission-plugins=...,NodeRestriction,... + By default, RKE2 sets the --enable-admission-plugins to NodeRestriction. + Check the RKE2 config file /etc/rancher/rke2/config.yaml, and ensure that you are not overriding the admission plugins. + If you are, include NodeRestriction in the list. + kube-apiserver-arg: + - "enable-admission-plugins=...,NodeRestriction,..." scored: true + - id: 1.2.16 text: "Ensure that the --profiling argument is set to false (Automated)" - audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep" + audit: "/bin/ps -fC $apiserverbin" tests: test_items: - flag: "--profiling" @@ -547,29 +592,31 @@ groups: value: false set: true remediation: | - Edit the API server pod specification file $apiserverconf - on the control plane node and set the below parameter. - --profiling=false + By default, RKE2 sets the --profiling argument to false. + If this check fails, edit the RKE2 config file /etc/rancher/rke2/config.yaml and remove any lines like below. + kube-apiserver-arg: + - "profiling=true" scored: true + - id: 1.2.17 text: "Ensure that the --audit-log-path argument is set (Automated)" - type: "skip" - audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep" + audit: "/bin/ps -fC $apiserverbin" tests: test_items: - flag: "--audit-log-path" set: true remediation: | - Edit the API server pod specification file $apiserverconf + By default, RKE2 sets the --audit-log-path argument to /var/lib/rancher/rke2/server/logs/audit.log + If you want to change this, edit the RKE2 config file /etc/rancher/rke2/config.yaml on the control plane node and set the --audit-log-path parameter to a suitable path and file where you would like audit logs to be written, for example, - --audit-log-path=/var/log/apiserver/audit.log - Permissive. - scored: true + kube-apiserver-arg: + - "audit-log-path=/var/log/rke2/audit.log" + scored: false + - id: 1.2.18 text: "Ensure that the --audit-log-maxage argument is set to 30 or as appropriate (Automated)" - type: "skip" - audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep" + audit: "/bin/ps -fC $apiserverbin" tests: test_items: - flag: "--audit-log-maxage" @@ -578,16 +625,16 @@ groups: value: 30 set: true remediation: | - Edit the API server pod specification file $apiserverconf - on the control plane node and set the --audit-log-maxage parameter to 30 - or as an appropriate number of days, for example, - --audit-log-maxage=30 - Permissive. - scored: true + By default, RKE2 sets the --audit-log-maxage argument to 30 days. + If you want to change this, edit the RKE2 config file /etc/rancher/rke2/config.yaml + on the control plane node and set the --audit-log-maxage parameter to an appropriate number of days, for example, + kube-apiserver-arg: + - "audit-log-maxage=40" + scored: false + - id: 1.2.19 text: "Ensure that the --audit-log-maxbackup argument is set to 10 or as appropriate (Automated)" - type: "skip" - audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep" + audit: "/bin/ps -fC $apiserverbin" tests: test_items: - flag: "--audit-log-maxbackup" @@ -596,16 +643,17 @@ groups: value: 10 set: true remediation: | - Edit the API server pod specification file $apiserverconf - on the control plane node and set the --audit-log-maxbackup parameter to 10 or to an appropriate - value. For example, - --audit-log-maxbackup=10 - Permissive. - scored: true + By default, RKE2 sets the --audit-log-maxbackup argument to 10. + If you want to change this, edit the RKE2 config file /etc/rancher/rke2/config.yaml + on the control plane node and set the --audit-log-maxbackup parameter to an appropriate value. + For example, + kube-apiserver-arg: + - "audit-log-maxbackup=15" + scored: false + - id: 1.2.20 text: "Ensure that the --audit-log-maxsize argument is set to 100 or as appropriate (Automated)" - type: "skip" - audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep" + audit: "/bin/ps -fC $apiserverbin" tests: test_items: - flag: "--audit-log-maxsize" @@ -614,13 +662,17 @@ groups: value: 100 set: true remediation: | - Edit the API server pod specification file $apiserverconf + By default, RKE2 sets the --audit-log-maxsize argument to 100 MB. + If you want to change this, edit the RKE2 config file /etc/rancher/rke2/config.yaml on the control plane node and set the --audit-log-maxsize parameter to an appropriate size in MB. - For example, to set it as 100 MB, --audit-log-maxsize=100 - scored: true + For example, + kube-apiserver-arg: + - "audit-log-maxsize=150" + scored: false + - id: 1.2.21 text: "Ensure that the --request-timeout argument is set as appropriate (Automated)" - audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep" + audit: "/bin/ps -fC $apiserverbin" tests: bin_op: or test_items: @@ -628,13 +680,17 @@ groups: set: false - flag: "--request-timeout" remediation: | - Edit the API server pod specification file $apiserverconf - and set the below parameter as appropriate and if needed. - For example, --request-timeout=300s + Permissive, per CIS guidelines, + "it is recommended to set this limit as appropriate and change the default limit of 60 seconds only if needed". + Edit the RKE2 config file /etc/rancher/rke2/config.yaml + and set the below parameter if needed. For example, + kube-apiserver-arg: + - "request-timeout=300s" scored: true + - id: 1.2.22 text: "Ensure that the --service-account-lookup argument is set to true (Automated)" - audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep" + audit: "/bin/ps -fC $apiserverbin" tests: bin_op: or test_items: @@ -645,28 +701,32 @@ groups: op: eq value: true remediation: | - Edit the API server pod specification file $apiserverconf - on the control plane node and set the below parameter. - --service-account-lookup=true - Alternatively, you can delete the --service-account-lookup parameter from this file so + By default, RKE2 does not set the --service-account-lookup argument. + Edit the RKE2 config file /etc/rancher/rke2/config.yaml and set the service-account-lookup. For example, + kube-apiserver-arg: + - "service-account-lookup=true" + Alternatively, you can delete the service-account-lookup parameter from this file so that the default takes effect. scored: true + - id: 1.2.23 text: "Ensure that the --service-account-key-file argument is set as appropriate (Automated)" - audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep" + audit: "/bin/ps -fC $apiserverbin" tests: test_items: - flag: "--service-account-key-file" set: true remediation: | - Edit the API server pod specification file $apiserverconf - on the control plane node and set the --service-account-key-file parameter - to the public key file for service accounts. For example, - --service-account-key-file= + RKE2 automatically generates and sets the service account key file. + It is located at /var/lib/rancher/rke2/server/tls/service.key. + If this check fails, edit RKE2 config file /etc/rancher/rke2/config.yaml and remove any lines like below. + kube-apiserver-arg: + - "service-account-key-file=" scored: true + - id: 1.2.24 text: "Ensure that the --etcd-certfile and --etcd-keyfile arguments are set as appropriate (Automated)" - audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep" + audit: "/bin/ps -fC $apiserverbin" tests: bin_op: and test_items: @@ -675,15 +735,17 @@ groups: - flag: "--etcd-keyfile" set: true remediation: | - Follow the Kubernetes documentation and set up the TLS connection between the apiserver and etcd. - Then, edit the API server pod specification file $apiserverconf - on the control plane node and set the etcd certificate and key file parameters. - --etcd-certfile= - --etcd-keyfile= + RKE2 automatically generates and sets the etcd certificate and key files. + They are located at /var/lib/rancher/rke2/server/tls/etcd/client.crt and /var/lib/rancher/rke2/server/tls/etcd/client.key. + If this check fails, edit the RKE2 config file /etc/rancher/rke2/config.yaml and remove any lines like below. + kube-apiserver-arg: + - "etcd-certfile=" + - "etcd-keyfile=" scored: true + - id: 1.2.25 text: "Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate (Automated)" - audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep" + audit: "/bin/ps -fC $apiserverbin" tests: bin_op: and test_items: @@ -692,56 +754,64 @@ groups: - flag: "--tls-private-key-file" set: true remediation: | - Follow the Kubernetes documentation and set up the TLS connection on the apiserver. - Then, edit the API server pod specification file $apiserverconf - on the control plane node and set the TLS certificate and private key file parameters. - --tls-cert-file= - --tls-private-key-file= + By default, RKE2 automatically generates and provides the TLS certificate and private key for the apiserver. + They are generated and located at /var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt and /var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key + If this check fails, edit the RKE2 config file /etc/rancher/rke2/config.yaml and remove any lines like below. + kube-apiserver-arg: + - "tls-cert-file=" + - "tls-private-key-file=" scored: true + - id: 1.2.26 text: "Ensure that the --client-ca-file argument is set as appropriate (Automated)" - audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep" + audit: "/bin/ps -fC $apiserverbin" tests: test_items: - flag: "--client-ca-file" set: true remediation: | - Follow the Kubernetes documentation and set up the TLS connection on the apiserver. - Then, edit the API server pod specification file $apiserverconf - on the control plane node and set the client certificate authority file. - --client-ca-file= + By default, RKE2 automatically provides the client certificate authority file. + It is generated and located at /var/lib/rancher/rke2/server/tls/client-ca.crt. + If for some reason you need to provide your own ca certificate, look at using the rke2 certificate command line tool. + If this check fails, edit the RKE2 config file /etc/rancher/rke2/config.yaml and remove any lines like below. + kube-apiserver-arg: + - "client-ca-file=" scored: true + - id: 1.2.27 text: "Ensure that the --etcd-cafile argument is set as appropriate (Automated)" - audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep" + audit: "/bin/ps -fC $apiserverbin" tests: test_items: - flag: "--etcd-cafile" set: true remediation: | - Follow the Kubernetes documentation and set up the TLS connection between the apiserver and etcd. - Then, edit the API server pod specification file $apiserverconf - on the control plane node and set the etcd certificate authority file parameter. - --etcd-cafile= + By default, RKE2 automatically provides the etcd certificate authority file. + It is generated and located at /var/lib/rancher/rke2/server/tls/client-ca.crt. + If for some reason you need to provide your own ca certificate, look at using the rke2 certificate command line tool. + If this check fails, edit the RKE2 config file /etc/rancher/rke2/config.yaml and remove any lines like below. + kube-apiserver-arg: + - "etcd-cafile=" scored: true + - id: 1.2.28 - text: "Ensure that the --encryption-provider-config argument is set as appropriate (Manual)" - audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep" + text: "Ensure that the --encryption-provider-config argument is set as appropriate (Automated)" + audit: "/bin/ps -fC $apiserverbin" tests: test_items: - flag: "--encryption-provider-config" remediation: | - Follow the Kubernetes documentation and configure a EncryptionConfig file. - Then, edit the API server pod specification file $apiserverconf - on the control plane node and set the --encryption-provider-config parameter to the path of that file. - For example, --encryption-provider-config= - scored: false + RKE2 always is configured to encrypt secrets. + Secrets encryption is managed with the rke2 secrets-encrypt command line tool. + If needed, you can find the generated encryption config at /var/lib/rancher/rke2/server/cred/encryption-config.json + scored: true + - id: 1.2.29 - text: "Ensure that encryption providers are appropriately configured (Manual)" + text: "Ensure that encryption providers are appropriately configured (Automated)" type: "skip" audit: | ENCRYPTION_PROVIDER_CONFIG=$(ps -ef | grep $apiserverbin | grep -- --encryption-provider-config | sed 's%.*encryption-provider-config[= ]\([^ ]*\).*%\1%') - if test -e $ENCRYPTION_PROVIDER_CONFIG; then grep -A1 'providers:' $ENCRYPTION_PROVIDER_CONFIG | tail -n1 | grep -o "[A-Za-z]*" | sed 's/^/provider=/'; fi + if test -e $ENCRYPTION_PROVIDER_CONFIG; then grep -o 'providers\"\:\[.*\]' $ENCRYPTION_PROVIDER_CONFIG | grep -o "[A-Za-z]*" | head -2 | tail -1 | sed 's/^/provider=/'; fi tests: test_items: - flag: "provider" @@ -749,13 +819,14 @@ groups: op: valid_elements value: "aescbc,kms,secretbox" remediation: | - Follow the Kubernetes documentation and configure a EncryptionConfig file. - In this file, choose aescbc, kms or secretbox as the encryption provider. - Permissive. - scored: false + RKE2 always is configured to use the aescbc encryption provider to encrypt secrets. + Secrets encryption is managed with the rke2 secrets-encrypt command line tool. + If needed, you can find the generated encryption config at /var/lib/rancher/rke2/server/cred/encryption-config.json + scored: true + - id: 1.2.30 text: "Ensure that the API Server only makes use of Strong Cryptographic Ciphers (Automated)" - audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep" + audit: "/bin/ps -fC $apiserverbin" tests: test_items: - flag: "--tls-cipher-suites" @@ -769,23 +840,27 @@ groups: kube-apiserver-arg: - "tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305" scored: true + - id: 1.3 text: "Controller Manager" checks: - id: 1.3.1 text: "Ensure that the --terminated-pod-gc-threshold argument is set as appropriate (Manual)" - audit: "/bin/ps -ef | grep $controllermanagerbin | grep -v grep" + audit: "/bin/ps -fC $controllermanagerbin" tests: test_items: - flag: "--terminated-pod-gc-threshold" remediation: | - Edit the Controller Manager pod specification file $controllermanagerconf - on the control plane node and set the --terminated-pod-gc-threshold to an appropriate threshold, - for example, --terminated-pod-gc-threshold=10 + By default, RKE2 sets a terminated-pod-gc-threshold of 1000. + If you need to change this value, edit the RKE2 config file /etc/rancher/rke2/config.yaml on the control plane node + and set the --terminated-pod-gc-threshold to an appropriate threshold, + kube-controller-manager-arg: + - "terminated-pod-gc-threshold=10" scored: false + - id: 1.3.2 text: "Ensure that the --profiling argument is set to false (Automated)" - audit: "/bin/ps -ef | grep $controllermanagerbin | grep -v grep" + audit: "/bin/ps -fC $controllermanagerbin" tests: test_items: - flag: "--profiling" @@ -794,13 +869,15 @@ groups: value: false set: true remediation: | - Edit the Controller Manager pod specification file $controllermanagerconf - on the control plane node and set the below parameter. - --profiling=false + By default, RKE2 sets the --profiling argument to false. + If this check fails, edit the RKE2 config file /etc/rancher/rke2/config.yaml and remove any lines like below. + kube-controller-manager-arg: + - "profiling=true" scored: true + - id: 1.3.3 text: "Ensure that the --use-service-account-credentials argument is set to true (Automated)" - audit: "/bin/ps -ef | grep $controllermanagerbin | grep -v grep" + audit: "/bin/ps -fC $controllermanagerbin" tests: test_items: - flag: "--use-service-account-credentials" @@ -809,38 +886,46 @@ groups: value: false set: true remediation: | - Edit the Controller Manager pod specification file $controllermanagerconf - on the control plane node to set the below parameter. - --use-service-account-credentials=true + By default, RKE2 sets the --use-service-account-credentials argument to true. + If this check fails, edit the RKE2 config file /etc/rancher/rke2/config.yaml and remove any lines like below. + kube-controller-manager-arg: + - "use-service-account-credentials=false" scored: true + - id: 1.3.4 text: "Ensure that the --service-account-private-key-file argument is set as appropriate (Automated)" - audit: "/bin/ps -ef | grep $controllermanagerbin | grep -v grep" + audit: "/bin/ps -fC $controllermanagerbin" tests: test_items: - flag: "--service-account-private-key-file" set: true remediation: | - Edit the Controller Manager pod specification file $controllermanagerconf - on the control plane node and set the --service-account-private-key-file parameter - to the private key file for service accounts. - --service-account-private-key-file= + By default, RKE2 automatically provides the service account private key file. + It is generated and located at /var/lib/rancher/rke2/server/tls/service.current.key. + If this check fails, edit the RKE2 config file /etc/rancher/rke2/config.yaml and remove any lines like below. + kube-controller-manager-arg: + - "service-account-private-key-file=" scored: true + - id: 1.3.5 text: "Ensure that the --root-ca-file argument is set as appropriate (Automated)" - audit: "/bin/ps -ef | grep $controllermanagerbin | grep -v grep" + audit: "/bin/ps -fC $controllermanagerbin" tests: test_items: - flag: "--root-ca-file" set: true remediation: | - Edit the Controller Manager pod specification file $controllermanagerconf - on the control plane node and set the --root-ca-file parameter to the certificate bundle file`. - --root-ca-file= + By default, RKE2 automatically provides the root CA file. + It is generated and located at /var/lib/rancher/rke2/server/tls/server-ca.crt. + If for some reason you need to provide your own ca certificate, look at using the rke2 certificate command line tool. + If this check fails, edit the RKE2 config file /etc/rancher/rke2/config.yaml and remove any lines like below. + kube-controller-manager-arg: + - "root-ca-file=" scored: true + - id: 1.3.6 text: "Ensure that the RotateKubeletServerCertificate argument is set to true (Automated)" - audit: "/bin/ps -ef | grep $controllermanagerbin | grep -v grep" + audit: "/bin/ps -fC $controllermanagerbin" tests: bin_op: or test_items: @@ -856,10 +941,10 @@ groups: on the control plane node and set the --feature-gates parameter to include RotateKubeletServerCertificate=true. --feature-gates=RotateKubeletServerCertificate=true scored: true - type: skip + - id: 1.3.7 text: "Ensure that the --bind-address argument is set to 127.0.0.1 (Automated)" - audit: "/bin/ps -ef | grep $controllermanagerbin | grep -v grep" + audit: "/bin/ps -fC $controllermanagerbin" tests: bin_op: or test_items: @@ -871,15 +956,18 @@ groups: - flag: "--bind-address" set: false remediation: | - Edit the Controller Manager pod specification file $controllermanagerconf - on the control plane node and ensure the correct value for the --bind-address parameter + By default, RKE2 sets the --bind-address argument to 127.0.0.1 + If this check fails, edit the RKE2 config file /etc/rancher/rke2/config.yaml and remove any lines like below. + kube-controller-manager-arg: + - "bind-address=" scored: true + - id: 1.4 text: "Scheduler" checks: - id: 1.4.1 text: "Ensure that the --profiling argument is set to false (Automated)" - audit: "/bin/ps -ef | grep $schedulerbin | grep -v grep" + audit: "/bin/ps -fC $schedulerbin" tests: test_items: - flag: "--profiling" @@ -888,13 +976,15 @@ groups: value: false set: true remediation: | - Edit the Scheduler pod specification file $schedulerconf file - on the control plane node and set the below parameter. - --profiling=false + By default, RKE2 sets the --profiling argument to false. + If this check fails, edit the RKE2 config file /etc/rancher/rke2/config.yaml and remove any lines like below. + kube-scheduler-arg: + - "profiling=true" scored: true + - id: 1.4.2 text: "Ensure that the --bind-address argument is set to 127.0.0.1 (Automated)" - audit: "/bin/ps -ef | grep $schedulerbin | grep -v grep" + audit: "/bin/ps -fC $schedulerbin" tests: bin_op: or test_items: @@ -906,6 +996,8 @@ groups: - flag: "--bind-address" set: false remediation: | - Edit the Scheduler pod specification file $schedulerconf - on the control plane node and ensure the correct value for the --bind-address parameter + By default, RKE2 sets the --bind-address argument to 127.0.0.1 + If this check fails, edit the RKE2 config file /etc/rancher/rke2/config.yaml and remove any lines like below. + kube-scheduler-arg: + - "bind-address=" scored: true diff --git a/package/cfg/rke2-cis-1.8-permissive/node.yaml b/package/cfg/rke2-cis-1.8-permissive/node.yaml index 022dcd1e..6c5f7932 100644 --- a/package/cfg/rke2-cis-1.8-permissive/node.yaml +++ b/package/cfg/rke2-cis-1.8-permissive/node.yaml @@ -23,6 +23,7 @@ groups: For example, chmod 600 $kubeletsvc Not Applicable. scored: true + - id: 4.1.2 text: "Ensure that the kubelet service file ownership is set to root:root (Automated)" audit: '/bin/sh -c "if test -e $kubeletsvc; then stat -c %U:%G $kubeletsvc; else echo \"File not found\"; fi"' @@ -37,6 +38,7 @@ groups: chown root:root $kubeletsvc Not applicable. scored: true + - id: 4.1.3 text: "If proxy kubeconfig file exists ensure permissions are set to 600 or more restrictive (Manual)" audit: '/bin/sh -c ''if test -e $proxykubeconfig; then stat -c permissions=%a $proxykubeconfig; fi'' ' @@ -52,6 +54,7 @@ groups: For example, chmod 600 $proxykubeconfig scored: false + - id: 4.1.4 text: "If proxy kubeconfig file exists ensure ownership is set to root:root (Manual)" audit: '/bin/sh -c ''if test -e $proxykubeconfig; then stat -c %U:%G $proxykubeconfig; fi'' ' @@ -63,6 +66,7 @@ groups: Run the below command (based on the file location on your system) on the each worker node. For example, chown root:root $proxykubeconfig scored: false + - id: 4.1.5 text: "Ensure that the --kubeconfig kubelet.conf file permissions are set to 600 or more restrictive (Automated)" audit: '/bin/sh -c ''if test -e $kubeletkubeconfig; then stat -c permissions=%a $kubeletkubeconfig; fi'' ' @@ -78,6 +82,7 @@ groups: For example, chmod 600 $kubeletkubeconfig scored: true + - id: 4.1.6 text: "Ensure that the --kubeconfig kubelet.conf file ownership is set to root:root (Automated)" audit: '/bin/sh -c ''if test -e $kubeletkubeconfig; then stat -c %U:%G $kubeletkubeconfig; fi'' ' @@ -93,6 +98,7 @@ groups: For example, chown root:root $kubeletkubeconfig scored: true + - id: 4.1.7 text: "Ensure that the certificate authorities file permissions are set to 600 or more restrictive (Manual)" audit: "check_cafile_permissions.sh" @@ -107,6 +113,7 @@ groups: Run the following command to modify the file permissions of the --client-ca-file chmod 600 scored: false + - id: 4.1.8 text: "Ensure that the client certificate authorities file ownership is set to root:root (Manual)" audit: "check_cafile_ownership.sh" @@ -120,6 +127,7 @@ groups: Run the following command to modify the ownership of the --client-ca-file. chown root:root scored: false + - id: 4.1.9 text: "If the kubelet config.yaml configuration file is being used validate permissions set to 600 or more restrictive (Automated)" audit: '/bin/sh -c ''if test -e $kubeletconf; then stat -c permissions=%a $kubeletconf; fi'' ' @@ -134,6 +142,7 @@ groups: Run the following command (using the config file location identified in the Audit step) chmod 600 $kubeletconf scored: true + - id: 4.1.10 text: "If the kubelet config.yaml configuration file is being used validate file ownership is set to root:root (Automated)" audit: '/bin/sh -c ''if test -e $kubeletconf; then stat -c %U:%G $kubeletconf; fi'' ' @@ -145,6 +154,7 @@ groups: Run the following command (using the config file location identified in the Audit step) chown root:root $kubeletconf scored: true + - id: 4.2 text: "Kubelet" checks: @@ -170,6 +180,7 @@ groups: systemctl daemon-reload systemctl restart kubelet.service scored: true + - id: 4.2.2 text: "Ensure that the --authorization-mode argument is not set to AlwaysAllow (Automated)" audit: "/bin/ps -fC $kubeletbin" @@ -191,6 +202,7 @@ groups: systemctl daemon-reload systemctl restart kubelet.service scored: true + - id: 4.2.3 text: "Ensure that the --client-ca-file argument is set as appropriate (Automated)" audit: "/bin/ps -fC $kubeletbin" @@ -210,6 +222,7 @@ groups: systemctl daemon-reload systemctl restart kubelet.service scored: true + - id: 4.2.4 text: "Verify that the --read-only-port argument is set to 0 (Manual)" audit: "/bin/ps -fC $kubeletbin" @@ -235,6 +248,7 @@ groups: systemctl daemon-reload systemctl restart kubelet.service scored: false + - id: 4.2.5 text: "Ensure that the --streaming-connection-idle-timeout argument is not set to 0 (Manual)" audit: "/bin/ps -fC $kubeletbin" @@ -261,6 +275,7 @@ groups: systemctl daemon-reload systemctl restart kubelet.service scored: false + - id: 4.2.6 text: "Ensure that the --make-iptables-util-chains argument is set to true (Automated)" audit: "/bin/ps -fC $kubeletbin" @@ -286,6 +301,7 @@ groups: systemctl daemon-reload systemctl restart kubelet.service scored: true + - id: 4.2.7 text: "Ensure that the --hostname-override argument is not set (Manual)" # This is one of those properties that can only be set as a command line argument. @@ -306,6 +322,7 @@ groups: systemctl restart kubelet.service Not Applicable. scored: false + - id: 4.2.8 text: "Ensure that the eventRecordQPS argument is set to a level which ensures appropriate event capture (Manual)" audit: "/bin/ps -fC $kubeletbin" @@ -330,6 +347,7 @@ groups: systemctl daemon-reload systemctl restart kubelet.service scored: false + - id: 4.2.9 text: "Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate (Manual)" audit: "/bin/ps -fC $kubeletbin" @@ -353,6 +371,7 @@ groups: systemctl daemon-reload systemctl restart kubelet.service scored: false + - id: 4.2.10 text: "Ensure that the --rotate-certificates argument is not set to false (Automated)" audit: "/bin/ps -fC $kubeletbin" @@ -379,6 +398,7 @@ groups: systemctl daemon-reload systemctl restart kubelet.service scored: true + - id: 4.2.11 text: "Verify that the RotateKubeletServerCertificate argument is set to true (Manual)" audit: "/bin/ps -fC $kubeletbin" @@ -402,6 +422,7 @@ groups: systemctl daemon-reload systemctl restart kubelet.service scored: false + - id: 4.2.12 text: "Ensure that the Kubelet only makes use of Strong Cryptographic Ciphers (Manual)" audit: "/bin/ps -fC $kubeletbin" @@ -425,6 +446,7 @@ groups: systemctl daemon-reload systemctl restart kubelet.service scored: false + - id: 4.2.13 text: "Ensure that a limit is set on pod PIDs (Manual)" audit: "/bin/ps -fC $kubeletbin" diff --git a/package/cfg/rke2-cis-1.8-permissive/policies.yaml b/package/cfg/rke2-cis-1.8-permissive/policies.yaml index 37f3b6a9..b7c55a58 100644 --- a/package/cfg/rke2-cis-1.8-permissive/policies.yaml +++ b/package/cfg/rke2-cis-1.8-permissive/policies.yaml @@ -18,12 +18,14 @@ groups: clusterrolebinding to the cluster-admin role : kubectl delete clusterrolebinding [name] scored: false + - id: 5.1.2 text: "Minimize access to secrets (Manual)" type: "manual" remediation: | Where possible, remove get, list and watch access to Secret objects in the cluster. scored: false + - id: 5.1.3 text: "Minimize wildcard use in Roles and ClusterRoles (Manual)" type: "manual" @@ -31,12 +33,14 @@ groups: Where possible replace any use of wildcards in clusterroles and roles with specific objects or actions. scored: false + - id: 5.1.4 text: "Minimize access to create pods (Manual)" type: "manual" remediation: | Where possible, remove create access to pod objects in the cluster. scored: false + - id: 5.1.5 text: "Ensure that default service accounts are not actively used. (Manual)" type: "manual" @@ -46,6 +50,7 @@ groups: Modify the configuration of each default service account to include this value automountServiceAccountToken: false scored: false + - id: 5.1.6 text: "Ensure that Service Account Tokens are only mounted where necessary (Manual)" type: "manual" @@ -53,48 +58,56 @@ groups: Modify the definition of pods and service accounts which do not need to mount service account tokens to disable it. scored: false + - id: 5.1.7 text: "Avoid use of system:masters group (Manual)" type: "manual" remediation: | Remove the system:masters group from all users in the cluster. scored: false + - id: 5.1.8 text: "Limit use of the Bind, Impersonate and Escalate permissions in the Kubernetes cluster (Manual)" type: "manual" remediation: | Where possible, remove the impersonate, bind and escalate rights from subjects. scored: false + - id: 5.1.9 text: "Minimize access to create persistent volumes (Manual)" type: "manual" remediation: | Where possible, remove create access to PersistentVolume objects in the cluster. scored: false + - id: 5.1.10 text: "Minimize access to the proxy sub-resource of nodes (Manual)" type: "manual" remediation: | Where possible, remove access to the proxy sub-resource of node objects. scored: false + - id: 5.1.11 text: "Minimize access to the approval sub-resource of certificatesigningrequests objects (Manual)" type: "manual" remediation: | Where possible, remove access to the approval sub-resource of certificatesigningrequest objects. scored: false + - id: 5.1.12 text: "Minimize access to webhook configuration objects (Manual)" type: "manual" remediation: | Where possible, remove access to the validatingwebhookconfigurations or mutatingwebhookconfigurations objects scored: false + - id: 5.1.13 text: "Minimize access to the service account token creation (Manual)" type: "manual" remediation: | Where possible, remove access to the token sub-resource of serviceaccount objects. scored: false + - id: 5.2 text: "Pod Security Standards" checks: @@ -105,6 +118,7 @@ groups: Ensure that either Pod Security Admission or an external policy control system is in place for every namespace which contains user workloads. scored: false + - id: 5.2.2 text: "Minimize the admission of privileged containers (Manual)" type: "manual" @@ -112,6 +126,7 @@ groups: Add policies to each namespace in the cluster which has user workloads to restrict the admission of privileged containers. scored: false + - id: 5.2.3 text: "Minimize the admission of containers wishing to share the host process ID namespace (Manual)" type: "manual" @@ -119,6 +134,7 @@ groups: Add policies to each namespace in the cluster which has user workloads to restrict the admission of `hostPID` containers. scored: false + - id: 5.2.4 text: "Minimize the admission of containers wishing to share the host IPC namespace (Manual)" type: "manual" @@ -126,6 +142,7 @@ groups: Add policies to each namespace in the cluster which has user workloads to restrict the admission of `hostIPC` containers. scored: false + - id: 5.2.5 text: "Minimize the admission of containers wishing to share the host network namespace (Manual)" type: "manual" @@ -133,6 +150,7 @@ groups: Add policies to each namespace in the cluster which has user workloads to restrict the admission of `hostNetwork` containers. scored: false + - id: 5.2.6 text: "Minimize the admission of containers with allowPrivilegeEscalation (Manual)" type: "manual" @@ -140,6 +158,7 @@ groups: Add policies to each namespace in the cluster which has user workloads to restrict the admission of containers with `.spec.allowPrivilegeEscalation` set to `true`. scored: false + - id: 5.2.7 text: "Minimize the admission of root containers (Manual)" type: "manual" @@ -147,6 +166,7 @@ groups: Create a policy for each namespace in the cluster, ensuring that either `MustRunAsNonRoot` or `MustRunAs` with the range of UIDs not including 0, is set. scored: false + - id: 5.2.8 text: "Minimize the admission of containers with the NET_RAW capability (Manual)" type: "manual" @@ -154,6 +174,7 @@ groups: Add policies to each namespace in the cluster which has user workloads to restrict the admission of containers with the `NET_RAW` capability. scored: false + - id: 5.2.9 text: "Minimize the admission of containers with added capabilities (Automated)" type: "manual" @@ -161,14 +182,16 @@ groups: Ensure that `allowedCapabilities` is not present in policies for the cluster unless it is set to an empty array. scored: false + - id: 5.2.10 text: "Minimize the admission of containers with capabilities assigned (Manual)" type: "manual" remediation: | - Review the use of capabilites in applications running on your cluster. Where a namespace - contains applicaions which do not require any Linux capabities to operate consider adding + Review the use of capabilities in applications running on your cluster. Where a namespace + contains applications which do not require any Linux capabities to operate consider adding a PSP which forbids the admission of containers which do not drop all capabilities. scored: false + - id: 5.2.11 text: "Minimize the admission of Windows HostProcess containers (Manual)" type: "manual" @@ -176,6 +199,7 @@ groups: Add policies to each namespace in the cluster which has user workloads to restrict the admission of containers that have `.securityContext.windowsOptions.hostProcess` set to `true`. scored: false + - id: 5.2.12 text: "Minimize the admission of HostPath volumes (Manual)" type: "manual" @@ -183,6 +207,7 @@ groups: Add policies to each namespace in the cluster which has user workloads to restrict the admission of containers with `hostPath` volumes. scored: false + - id: 5.2.13 text: "Minimize the admission of containers which use HostPorts (Manual)" type: "manual" @@ -190,6 +215,7 @@ groups: Add policies to each namespace in the cluster which has user workloads to restrict the admission of containers which use `hostPort` sections. scored: false + - id: 5.3 text: "Network Policies and CNI" checks: @@ -201,12 +227,14 @@ groups: making use of a different plugin, or finding an alternate mechanism for restricting traffic in the Kubernetes cluster. scored: false + - id: 5.3.2 text: "Ensure that all Namespaces have NetworkPolicies defined (Manual)" type: "manual" remediation: | Follow the documentation and create NetworkPolicy objects as you need them. scored: false + - id: 5.4 text: "Secrets Management" checks: @@ -217,6 +245,7 @@ groups: If possible, rewrite application code to read Secrets from mounted secret files, rather than from environment variables. scored: false + - id: 5.4.2 text: "Consider external secret storage (Manual)" type: "manual" @@ -224,6 +253,7 @@ groups: Refer to the Secrets management options offered by your cloud provider or a third-party secrets management solution. scored: false + - id: 5.5 text: "Extensible Admission Control" checks: @@ -233,6 +263,7 @@ groups: remediation: | Follow the Kubernetes documentation and setup image provenance. scored: false + - id: 5.7 text: "General Policies" checks: @@ -243,6 +274,7 @@ groups: Follow the documentation and create namespaces for objects in your deployment as you need them. scored: false + - id: 5.7.2 text: "Ensure that the seccomp profile is set to docker/default in your Pod definitions (Manual)" type: "manual" @@ -253,6 +285,7 @@ groups: seccompProfile: type: RuntimeDefault scored: false + - id: 5.7.3 text: "Apply SecurityContext to your Pods and Containers (Manual)" type: "manual" @@ -261,6 +294,7 @@ groups: suggested list of SecurityContexts, you may refer to the CIS Security Benchmark for Docker Containers. scored: false + - id: 5.7.4 text: "The default namespace should not be used (Manual)" type: "manual"