Ensure that the –basic-auth-file argument is not set
Details Do not use basic authentication. Rationale: Basic authentication uses plaintext credentials for authentication. Currently, the basic authentication credentials last...
- Home
- Security Hardening
- CIS Kubernetes 1.8 Benchmark V1.2.0 L1
CIS Kubernetes 1.8 Benchmark V1.2.0 L1
Ensure that the –client-ca-file argument is set as appropriate
Details Setup TLS connection on the API server. Rationale: API server communication contains sensitive parameters that should remain encrypted in...Ensure that the encryption provider is set to aescbc
Details Use ‘aescbc’ encryption provider. Rationale: ‘aescbc’ is currently the strongest encryption provider, It should be preferred over other providers....Ensure that the -etcd-cafile argument is set as appropriate
Details etcd should be configured to make use of TLS encryption for client connections. Rationale: etcd is a highly-available key...Ensure that the -etcd-certfile and -etcd-keyfile arguments are set as appropriate – etcd-certfile
Details etcd should be configured to make use of TLS encryption for client connections. Rationale: etcd is a highly-available key...Ensure that the -etcd-certfile and -etcd-keyfile arguments are set as appropriate – etcd-keyfile
Details etcd should be configured to make use of TLS encryption for client connections. Rationale: etcd is a highly-available key...Ensure that the –experimental-encryption-provider-config argument is set as appropriate
Details Encrypt etcd key-value store. Rationale: etcd is a highly available key-value store used by Kubernetes deployments for persistent storage...Ensure that the –insecure-allow-any-token argument is not set
Details Do not allow any insecure tokens Rationale: Accepting insecure tokens would allow any token without actually authenticating anything. User...Ensure that the –insecure-bind-address argument is not set
Details Do not bind to non-loopback insecure addresses. Rationale: If you bind the apiserver to an insecure address, basically anyone...Ensure that the –insecure-port argument is set to 0
Details Do not bind to insecure port. Rationale: Setting up the apiserver to serve on an insecure port would allow...