---
controls:
version: "cis-1.24"
id: 4
text: "Worker Node Security Configuration"
type: "node"
groups:
  - id: 4.1
    text: "Worker Node Configuration Files"
    checks:
      - id: 4.1.1
        text: "Ensure that the kubelet service file permissions are set to 600 (Automated)"
        audit: '/bin/sh -c "if test -e $kubeletsvc; then stat -c permissions=%a $kubeletsvc; fi" '
        tests:
          test_items:
            - flag: "permissions"
              compare:
                op: bitmask
                value: "600"
        remediation: |
          Run the following command on each worker node.


          `chmod 600 $kubeletsvc`
        scored: true

      - id: 4.1.2
        text: "Ensure that the kubelet service file ownership is set to root:root (Automated)"
        audit: '/bin/sh -c "if test -e $kubeletsvc; then stat -c %U:%G $kubeletsvc; else echo \"File not found\"; fi"'
        tests:
          bin_op: or
          test_items:
            - flag: root:root
            - flag: "File not found"
        remediation: |
            Run the following command on each worker node.


            `chown root:root $kubeletsvc`
        scored: true

      - id: 4.1.3
        text: "If proxy kubeconfig file exists ensure permissions are set to 600 (Manual)"
        audit: '/bin/sh -c "if test -e $proxykubeconfig; then stat -c permissions=%a $proxykubeconfig; fi" '
        tests:
          bin_op: or
          test_items:
            - flag: "permissions"
              set: true
              compare:
                op: bitmask
                value: "600"
        remediation: |
          Run the following command on each worker node.


          `chmod 600 $proxykubeconfig`
        scored: false

      - id: 4.1.4
        text: "If proxy kubeconfig file exists ensure ownership is set to root:root (Manual)"
        audit: '/bin/sh -c "if test -e $proxykubeconfig; then stat -c %U:%G $proxykubeconfig; fi" '
        tests:
          bin_op: or
          test_items:
            - flag: root:root
        remediation: |
          Run the following command on each worker node.


          `chown root:root $proxykubeconfig`
        scored: false

      - id: 4.1.5
        text: "Ensure that the --kubeconfig kubelet.conf file permissions are set to 600 (Automated)"
        audit: '/bin/sh -c "if test -e $kubeletkubeconfig; then stat -c permissions=%a $kubeletkubeconfig; fi" '
        tests:
          test_items:
            - flag: "permissions"
              compare:
                op: bitmask
                value: "600"
        remediation: |
          Run the following command on each worker node.


          `chmod 600 $kubeletkubeconfig`
        scored: true

      - id: 4.1.6
        text: "Ensure that the --kubeconfig kubelet.conf file ownership is set to root:root (Automated)"
        audit: '/bin/sh -c "if test -e $kubeletkubeconfig; then stat -c %U:%G $kubeletkubeconfig; fi" '
        tests:
          test_items:
            - flag: root:root
        remediation: |
          Run the following command on each worker node.


          `chown root:root $kubeletkubeconfig`
        scored: true

      - id: 4.1.7
        text: "Ensure that the certificate authorities file permissions are set to 600 (Manual)"
        audit: |
          CAFILE=$(ps -ef | grep kubelet | grep -v apiserver | grep -- --client-ca-file= | awk -F '--client-ca-file=' '{print $2}' | awk '{print $1}' | uniq)
          if test -z $CAFILE; then CAFILE=$kubeletcafile; fi
          if test -e $CAFILE; then stat -c permissions=%a $CAFILE; fi
        tests:
          test_items:
            - flag: "permissions"
              compare:
                op: bitmask
                value: "600"
        remediation: |
          Run the following command to modify the file permissions of the
          --client-ca-file.

          `chmod 600 /etc/kubernetes/pki/client-ca.crt`
        scored: false

      - id: 4.1.8
        text: "Ensure that the client certificate authorities file ownership is set to root:root (Manual)"
        audit: |
          CAFILE=$(ps -ef | grep kubelet | grep -v apiserver | grep -- --client-ca-file= | awk -F '--client-ca-file=' '{print $2}' | awk '{print $1}' | uniq)
          if test -z $CAFILE; then CAFILE=$kubeletcafile; fi
          if test -e $CAFILE; then stat -c %U:%G $CAFILE; fi
        tests:
          test_items:
            - flag: root:root
              compare:
                op: eq
                value: root:root
        remediation: |
          Run the following command to modify the ownership of the --client-ca-file.

          `chown root:root /etc/kubernetes/pki/client-ca.crt`
        scored: false

      - id: 4.1.9
        text: "If the kubelet config.yaml configuration file is being used validate permissions set to 600 (Manual)"
        audit: '/bin/sh -c "if test -e $kubeletconf; then stat -c permissions=%a $kubeletconf; fi" '
        tests:
          test_items:
            - flag: "permissions"
              compare:
                op: bitmask
                value: "600"
        remediation: |
          Run the following command (using the config file location identified in the Audit step)


          `chmod 600 $kubeletconf`
        scored: false

      - id: 4.1.10
        text: "If the kubelet config.yaml configuration file is being used validate file ownership is set to root:root (Manual)"
        audit: '/bin/sh -c "if test -e $kubeletconf; then stat -c %U:%G $kubeletconf; fi" '
        tests:
          test_items:
            - flag: root:root
        remediation: |
          Run the following command (using the config file location identified in the Audit step)


          `chown root:root $kubeletconf`
        scored: false

  - id: 4.2
    text: "Kubelet"
    checks:
      - id: 4.2.1
        text: "Ensure that the --anonymous-auth argument is set to false (Automated)"
        audit: "/bin/cat $kubeletconf"
        tests:
          test_items:
            - flag: "--anonymous-auth"
              compare:
                op: eq
                value: false
        remediation: |
          Edit the kubelet configuration file
          $kubeletconf on each worker node and set the following argument.

          `--anonymous-auth=false`

          Restart the kubelet service.

          `snap restart k8s.kubelet`
        scored: true

      - id: 4.2.2
        text: "Ensure that the --authorization-mode argument is not set to AlwaysAllow (Automated)"
        audit: "/bin/cat $kubeletconf"
        audit_config: "/bin/cat $kubeletconf"
        tests:
          test_items:
            - flag: --authorization-mode
              path: '{.authorization.mode}'
              compare:
                op: nothave
                value: AlwaysAllow
        remediation: |
          Edit the kubelet configuration file
          $kubeletconf on each worker node and set the following argument.

          `--authorization-mode=Webhook`

          Restart the kubelet service:

          `snap restart k8s.kubelet`
        scored: true

      - id: 4.2.3
        text: "Ensure that the --client-ca-file argument is set as appropriate (Automated)"
        audit: "/bin/cat $kubeletconf"
        audit_config: "/bin/cat $kubeletconf"
        tests:
          test_items:
            - flag: --client-ca-file
              path: '{.authentication.x509.clientCAFile}'
        remediation: |
          Edit the kubelet configuration file
          $kubeletconf on each worker node and set the following argument.

          `--client-ca-file=/etc/kubernetes/pki/client-ca.crt`

          Restart the kubelet service:

          `snap restart k8s.kubelet`
        scored: true

      - id: 4.2.4
        text: "Verify that the --read-only-port argument is set to 0 (Manual)"
        audit: "/bin/cat $kubeletconf"
        audit_config: "/bin/cat $kubeletconf"
        tests:
          bin_op: or
          test_items:
            - flag: "--read-only-port"
              path: '{.readOnlyPort}'
              compare:
                op: eq
                value: 0
            - flag: "--read-only-port"
              path: '{.readOnlyPort}'
              set: false
        remediation: |
          Edit the kubelet configuration file
          $kubeletconf on each worker node and set the following argument.

          `--read-only-port=0`

          Restart the kubelet service:

          `snap restart k8s.kubelet`
        scored: false

      - id: 4.2.5
        text: "Ensure that the --streaming-connection-idle-timeout argument is not set to 0 (Manual)"
        audit: "/bin/cat $kubeletconf"
        audit_config: "/bin/cat $kubeletconf"
        tests:
          test_items:
            - flag: --streaming-connection-idle-timeout
              path: '{.streamingConnectionIdleTimeout}'
              compare:
                op: noteq
                value: 0
            - flag: --streaming-connection-idle-timeout
              path: '{.streamingConnectionIdleTimeout}'
              set: false
          bin_op: or
        remediation: |
          Edit the kubelet configuration file
          $kubeletconf on each worker node and set the following argument.

          `--streaming-connection-idle-timeout=5m`

          Restart the kubelet service:

          `snap restart k8s.kubelet`
        scored: false

      - id: 4.2.6
        text: "Ensure that the --protect-kernel-defaults argument is set to true (Automated)"
        audit: "/bin/cat $kubeletconf"
        audit_config: "/bin/cat $kubeletconf"
        tests:
          test_items:
            - flag: --protect-kernel-defaults
              path: '{.protectKernelDefaults}'
              compare:
                op: eq
                value: true
        remediation: |
          Edit the kubelet configuration file
          $kubeletconf on each worker node and set the following argument:

          `--protect-kernel-defaults=true`

          Restart the kubelet service:

          `snap restart k8s.kubelet`
        scored: true

      - id: 4.2.7
        text: "Ensure that the --make-iptables-util-chains argument is set to true (Automated)"
        audit: "/bin/cat $kubeletconf"
        audit_config: "/bin/cat $kubeletconf"
        tests:
          test_items:
            - flag: --make-iptables-util-chains
              path: '{.makeIPTablesUtilChains}'
              compare:
                op: eq
                value: true
            - flag: --make-iptables-util-chains
              path: '{.makeIPTablesUtilChains}'
              set: false
          bin_op: or
        remediation: |
          Edit the kubelet configuration file
          $kubeletconf on each worker node and
          set the following argument:

          `--make-iptables-util-chains=true`

          Restart the kubelet service.

          For example: `snap restart k8s.kubelet`
        scored: true

      - id: 4.2.8
        text: "Ensure that the --hostname-override argument is not set (Manual)"
        # This is one of those properties that can only be set as a command line argument.
        # To check if the property is set as expected, we need to parse the kubelet command
        # instead reading the Kubelet Configuration file.
        audit: "/bin/cat $kubeletconf"
        tests:
          test_items:
            - flag: --hostname-override
              set: false
        remediation: |
          Edit the kubelet configuration file $kubeletconf
          on each worker node and remove the --hostname-override argument.

          Restart the kubelet service.

          `snap restart k8s.kubelet`
        scored: false

      - id: 4.2.9
        text: "Ensure that the --event-qps argument is set to a level which ensures appropriate event capture (Manual)"
        audit: "/bin/cat $kubeletconf"
        audit_config: "/bin/cat $kubeletconf"
        tests:
          test_items:
            - flag: --event-qps
              path: '{.eventRecordQPS}'
              compare:
                op: gte
                value: 0
            - flag: --event-qps
              path: '{.eventRecordQPS}'
              set: false
          bin_op: or
        remediation: |
          Edit the kubelet configuration file $kubeletconf on each worker node and
          set the --event-qps parameter as appropriate.

          Restart the kubelet service.

          `snap restart k8s.kubelet`
        scored: false

      - id: 4.2.10
        text: "Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate (Manual)"
        audit: "/bin/cat $kubeletconf"
        audit_config: "/bin/cat $kubeletconf"
        tests:
          test_items:
            - flag: --tls-cert-file
              path: '{.tlsCertFile}'
            - flag: --tls-private-key-file
              path: '{.tlsPrivateKeyFile}'
        remediation: |
          Edit the kubelet configuration file $kubeletconf on each worker node and
          set the following arguments:

          ```
          --tls-private-key-file=<path/to/private-key-file>
          --tls-cert-file=<path/to/tls-certificate-file>
          ```

          Restart the kubelet service.

          `snap restart k8s.kubelet`
        scored: false

      - id: 4.2.11
        text: "Ensure that the --rotate-certificates argument is not set to false (Automated)"
        audit: "/bin/cat $kubeletconf"
        audit_config: "/bin/cat $kubeletconf"
        tests:
          test_items:
            - flag: --rotate-certificates
              path: '{.rotateCertificates}'
              compare:
                op: eq
                value: true
            - flag: --rotate-certificates
              path: '{.rotateCertificates}'
              set: false
          bin_op: or
        remediation: |
          Edit the kubelet configuration file $kubeletconf on each worker node and
          remove the --rotate-certificates=false argument.

          Restart the kubelet service.

          `snap restart k8s.kubelet`
        scored: true

      - id: 4.2.12
        text: "Verify that the RotateKubeletServerCertificate argument is set to true (Manual)"
        audit: "/bin/cat $kubeletconf"
        audit_config: "/bin/cat $kubeletconf"
        tests:
          bin_op: or
          test_items:
            - flag: RotateKubeletServerCertificate
              path: '{.featureGates.RotateKubeletServerCertificate}'
              compare:
                op: nothave
                value: false
            - flag: RotateKubeletServerCertificate
              path: '{.featureGates.RotateKubeletServerCertificate}'
              set: false
        remediation: |
          Edit the kubelet configuration file $kubeletconf on each worker node and
          set the argument --feature-gates=RotateKubeletServerCertificate=true
          on each worker node.

          Restart the kubelet service.

          `snap restart k8s.kubelet`
        scored: false

      - id: 4.2.13
        text: "Ensure that the Kubelet only makes use of Strong Cryptographic Ciphers (Manual)"
        audit: "/bin/cat $kubeletconf"
        audit_config: "/bin/cat $kubeletconf"
        tests:
          test_items:
            - flag: --tls-cipher-suites
              path: '{range .tlsCipherSuites[:]}{}{","}{end}'
              compare:
                op: valid_elements
                value: TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256
        remediation: |
          Edit the kubelet configuration file $kubeletconf on each worker node and
          set the --tls-cipher-suites parameter as follows, or to a subset of these values.

          ```
          --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256
          ```

          Restart the kubelet service.

          `snap restart k8s.kubelet`
        scored: false