arno/kube-bench
1
0
Fork 0
mirror of https://github.com/aquasecurity/kube-bench.git synced 2024-11-22 16:18:07 +00:00
Code Issues Releases Wiki Activity

FIXING RKE2-CIS-1.24 CHECKS

Browse Source 
In this change we are making 2 changes:
1. Seom CIS-1.24 checks(1.3.6 , 4.2.12 are not relevant for RKE clusters). So we will skip them.
2. SomeCIS-1.24 tests(1.1.10,1.1.20) are manual checks yet they don't have the type correctly set causing KB to run them with all automated tests.
This commit is contained in:
Saurabh Misra 2024-09-19 12:44:55 +05:30
parent 5a3fd1d896
commit ba6cb26582
2 changed files with 4 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
cfg/rke2-cis-1.24/master.yaml
View File

@ -159,6 +159,7 @@ groups:
For example, For example,
chown root:root <path/to/cni/files> chown root:root <path/to/cni/files>
scored: false scored: false
type: manual
- id: 1.1.11 - id: 1.1.11
text: "Ensure that the etcd data directory permissions are set to 700 or more restrictive (Automated)" text: "Ensure that the etcd data directory permissions are set to 700 or more restrictive (Automated)"
@ -318,6 +319,7 @@ groups:
For example, For example,
chmod -R 600 /var/lib/rancher/rke2/server/tls/*.crt chmod -R 600 /var/lib/rancher/rke2/server/tls/*.crt
scored: false scored: false
type: manual
- id: 1.1.21 - id: 1.1.21
text: "Ensure that the Kubernetes PKI key file permissions are set to 600 (Manual)" text: "Ensure that the Kubernetes PKI key file permissions are set to 600 (Manual)"
@ -335,6 +337,7 @@ groups:
For example, For example,
chmod -R 600 /var/lib/rancher/rke2/server/tls/*.key chmod -R 600 /var/lib/rancher/rke2/server/tls/*.key
scored: false scored: false
type: manual
- id: 1.2 - id: 1.2
text: "API Server" text: "API Server"
@ -979,7 +982,6 @@ groups:
Edit the Controller Manager pod specification file $controllermanagerconf Edit the Controller Manager pod specification file $controllermanagerconf
on the control plane node and set the --feature-gates parameter to include RotateKubeletServerCertificate=true. on the control plane node and set the --feature-gates parameter to include RotateKubeletServerCertificate=true.
--feature-gates=RotateKubeletServerCertificate=true --feature-gates=RotateKubeletServerCertificate=true
scored: true
type: skip type: skip
- id: 1.3.7 - id: 1.3.7

1
cfg/rke2-cis-1.24/node.yaml
View File

@ -432,6 +432,7 @@ groups:
- flag: RotateKubeletServerCertificate - flag: RotateKubeletServerCertificate
path: '{.featureGates.RotateKubeletServerCertificate}' path: '{.featureGates.RotateKubeletServerCertificate}'
set: false set: false
type: manual
remediation: | remediation: |
Edit the kubelet service file $kubeletsvc Edit the kubelet service file $kubeletsvc
on each worker node and set the below parameter in KUBELET_CERTIFICATE_ARGS variable. on each worker node and set the below parameter in KUBELET_CERTIFICATE_ARGS variable.