---
controls:
version: "cis-1.6-k3s"
id: 3
text: "Control Plane Configuration"
type: "controlplane"
groups:
  - id: 3.1
    text: "Authentication and Authorization"
    checks:
      - id: 3.1.1
        text: "Client certificate authentication should not be used for users (Manual)"
        type: "manual"
        remediation: |
          Alternative mechanisms provided by Kubernetes such as the use of OIDC should be
          implemented in place of client certificates.
        scored: false

  - id: 3.2
    text: "Logging"
    checks:
      - id: 3.2.1
        text: "Ensure that a minimal audit policy is created (Automated)"
        audit: journalctl -u k3s | grep "Running kube-apiserver" | tail -n1 | grep "audit-policy-file"
        tests:
          test_items:
            - flag: "--audit-policy-file"
              set: true
        remediation: |
          Create an audit policy file for your cluster and pass it to k3s.
          e.g. --kube-apiserver-arg='audit-log-path=/var/lib/rancher/k3s/server/logs/audit-log'
        scored: true

      - id: 3.2.2
        text: "Ensure that the audit policy covers key security concerns (Manual)"
        type: "manual"
        remediation: |
          Consider modification of the audit policy in use on the cluster to include these items, at a
          minimum.
        scored: false