Ensure that the –kubelet-certificate-authority argument is set as appropriate
Details Verify kubelet’s certificate before establishing connection. Rationale: The connections from the apiserver to the kubelet are used for fetching...
- Home
- Security Hardening
- CIS Kubernetes 1.8 Benchmark V1.2.0 L1
CIS Kubernetes 1.8 Benchmark V1.2.0 L1
Ensure that the –kubelet-client-certificate and –kubelet-client-key arguments are set as appropriate – kubelet-client-certificate
Details Enable certificate based kubelet authentication. Rationale: The apiserver, by default, does not authenticate itself to the kubelet’s HTTPS endpoints....Ensure that the –kubelet-client-certificate and –kubelet-client-key arguments are set as appropriate – kubelet-client-key
Details Enable certificate based kubelet authentication. Rationale: The apiserver, by default, does not authenticate itself to the kubelet’s HTTPS endpoints....Ensure that the –kubelet-https argument is set to true
Details Use https for kubelet connections. Rationale: Connections from apiserver to kubelets could potentially carry sensitive data such as secrets...Ensure that the –profiling argument is set to false
Details Disable profiling, if not needed. Rationale: Profiling allows for the identification of specific performance bottlenecks. It generates a significant...Ensure that the –profiling argument is set to false
Details Disable profiling, if not needed. Rationale: Profiling allows for the identification of specific performance bottlenecks. It generates a significant...Ensure that the –profiling argument is set to false
Details Disable profiling, if not needed. Rationale: Profiling allows for the identification of specific performance bottlenecks. It generates a significant...Ensure that the –repair-malformed-updates argument is set to false
Details Disable fixing of malformed updates. Rationale: The API sServer will potentially attempt to fix the update requests to pass...Ensure that the –request-timeout argument is set as appropriate
Details Set global request timeout for API server requests as appropriate. Rationale: Setting global request timeout allows extending the API...Ensure that the –root-ca-file argument is set as appropriate
Details Allow pods to verify the API server’s serving certificate before establishing connections. Rationale: Processes running within pods that need...