You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
68 lines
4.2 KiB
68 lines
4.2 KiB
---
|
|
controls:
|
|
version: "tkgi-1.2.53"
|
|
id: 3
|
|
text: "Control Plane Configuration"
|
|
type: "controlplane"
|
|
groups:
|
|
- id: 3.1
|
|
text: "Authentication and Authorization"
|
|
checks:
|
|
- id: 3.1.1
|
|
text: "Client certificate authentication should not be used for users"
|
|
audit: ps -ef | grep kube-apiserver | grep -- "--oidc-issuer-url="
|
|
type: "manual"
|
|
remediation: |
|
|
Alternative mechanisms provided by Kubernetes such as the use of OIDC should be
|
|
implemented in place of client certificates.
|
|
Exception
|
|
This setting is site-specific. It can be set in the "Configure created clusters to use UAA as the OIDC provider."
|
|
section of the "UAA"
|
|
scored: false
|
|
|
|
- id: 3.2
|
|
text: "Logging"
|
|
checks:
|
|
- id: 3.2.1
|
|
text: "Ensure that a minimal audit policy is created"
|
|
audit: ps -ef | grep kube-apiserver | grep -v tini | grep -- "--audit-policy-file="
|
|
tests:
|
|
test_items:
|
|
- flag: "--audit-policy-file"
|
|
remediation: |
|
|
Create an audit policy file for your cluster.
|
|
scored: true
|
|
|
|
- id: 3.2.2
|
|
text: "Ensure that the audit policy covers key security concerns"
|
|
audit: |
|
|
diff /var/vcap/jobs/kube-apiserver/config/audit_policy.yml \ <(echo "--- apiVersion: audit.k8s.io/v1beta1 kind:
|
|
Policy rules: - level: None resources: - group: '' resources: - endpoints - services - services/status users: -
|
|
system:kube-proxy verbs: - watch - level: None resources: - group: '' resources: - nodes - nodes/status users: -
|
|
kubelet verbs: - get - level: None resources: - group: '' resources: - nodes - nodes/status userGroups: -
|
|
system:nodes verbs: - get - level: None namespaces: - kube-system resources: - group: '' resources: -
|
|
endpoints users: - system:kube-controller-manager - system:kube-scheduler - system:serviceaccount:kube-
|
|
system:endpoint-controller verbs: - get - update - level: None resources: - group: '' resources: - namespaces -
|
|
namespaces/status - namespaces/finalize users: - system:apiserver verbs: - get - level: None resources: -
|
|
group: metrics.k8s.io users: - system:kube-controller-manager verbs: - get - list - level: None
|
|
nonResourceURLs: - \"/healthz*\" - \"/version\" - \"/swagger*\" - level: None resources: - group: '' resources: -
|
|
events - level: Request omitStages: - RequestReceived resources: - group: '' resources: - nodes/status -
|
|
pods/status userGroups: - system:nodes verbs: - update - patch - level: Request omitStages: -
|
|
RequestReceived users: - system:serviceaccount:kube-system:namespace-controller verbs: - deletecollection -
|
|
level: Metadata omitStages: - RequestReceived resources: - group: '' resources: - secrets - configmaps - group:
|
|
authentication.k8s.io resources: - tokenreviews - level: Request omitStages: - RequestReceived resources: -
|
|
group: '' - group: admissionregistration.k8s.io - group: apiextensions.k8s.io - group: apiregistration.k8s.io -
|
|
group: apps - group: authentication.k8s.io - group: authorization.k8s.io - group: autoscaling - group: batch -
|
|
group: certificates.k8s.io - group: extensions - group: metrics.k8s.io - group: networking.k8s.io - group: policy -
|
|
group: rbac.authorization.k8s.io - group: settings.k8s.io - group: storage.k8s.io verbs: - get - list - watch - level:
|
|
RequestResponse omitStages: - RequestReceived resources: - group: '' - group: admissionregistration.k8s.io -
|
|
group: apiextensions.k8s.io - group: apiregistration.k8s.io - group: apps - group: authentication.k8s.io - group:
|
|
authorization.k8s.io - group: autoscaling - group: batch - group: certificates.k8s.io - group: extensions - group:
|
|
metrics.k8s.io - group: networking.k8s.io - group: policy - group: rbac.authorization.k8s.io - group:
|
|
settings.k8s.io - group: storage.k8s.io - level: Metadata omitStages: - RequestReceived ")
|
|
type: "manual"
|
|
remediation: |
|
|
Consider modification of the audit policy in use on the cluster to include these items, at a
|
|
minimum.
|
|
scored: false
|