kube-bench/cfg/cis-1.6-k3s/controlplane.yaml

---
controls:
version: "cis-1.6-k3s"
id: 3
text: "Control Plane Configuration"
type: "controlplane"
groups:
  - id: 3.1
    text: "Authentication and Authorization"
    checks:
      - id: 3.1.1
        text: "Client certificate authentication should not be used for users (Manual)"
        type: "manual"
        remediation: |
          Alternative mechanisms provided by Kubernetes such as the use of OIDC should be
          implemented in place of client certificates.
        scored: false

  - id: 3.2
    text: "Logging"
    checks:
      - id: 3.2.1
        text: "Ensure that a minimal audit policy is created (Automated)"
        audit: journalctl -u k3s | grep "Running kube-apiserver" | tail -n1 | grep "audit-policy-file"
        tests:
          test_items:
            - flag: "--audit-policy-file"
              set: true
        remediation: |
          Create an audit policy file for your cluster and pass it to k3s.
          e.g. --kube-apiserver-arg='audit-log-path=/var/lib/rancher/k3s/server/logs/audit-log'
        scored: true

      - id: 3.2.2
        text: "Ensure that the audit policy covers key security concerns (Manual)"
        type: "manual"
        remediation: |
          Consider modification of the audit policy in use on the cluster to include these items, at a
          minimum.
        scored: false
feat(cis-1.6-k3s): Add support to CIS-1.6 for k3s distribution (#1261) * feat(cis-1.6-k3s): Add support to CIS-1.6 for k3s distribution * update(docs): change platforms and architectrue document; update(review): code review for cfg/cis-1.6-k3s; * update(docs): recover sheet style * fix(yaml-lint): CI/CD YAML Error * fix: Correct the problem of command and file/directory/log not found scene * fix(yaml-lint): CI/CD YAML Error 2022-09-15 11:26:15 +00:00			`---`
			`controls:`
			`version: "cis-1.6-k3s"`
			`id: 3`
			`text: "Control Plane Configuration"`
			`type: "controlplane"`
			`groups:`
			`- id: 3.1`
			`text: "Authentication and Authorization"`
			`checks:`
			`- id: 3.1.1`
			`text: "Client certificate authentication should not be used for users (Manual)"`
			`type: "manual"`
			`remediation: \|`
			`Alternative mechanisms provided by Kubernetes such as the use of OIDC should be`
			`implemented in place of client certificates.`
			`scored: false`

			`- id: 3.2`
			`text: "Logging"`
			`checks:`
			`- id: 3.2.1`
			`text: "Ensure that a minimal audit policy is created (Automated)"`
			`audit: journalctl -u k3s \| grep "Running kube-apiserver" \| tail -n1 \| grep "audit-policy-file"`
			`tests:`
			`test_items:`
			`- flag: "--audit-policy-file"`
			`set: true`
			`remediation: \|`
			`Create an audit policy file for your cluster and pass it to k3s.`
			`e.g. --kube-apiserver-arg='audit-log-path=/var/lib/rancher/k3s/server/logs/audit-log'`
			`scored: true`

			`- id: 3.2.2`
			`text: "Ensure that the audit policy covers key security concerns (Manual)"`
			`type: "manual"`
			`remediation: \|`
			`Consider modification of the audit policy in use on the cluster to include these items, at a`
			`minimum.`
			`scored: false`