Home
Security Hardening
CIS Kubernetes 1.8 Benchmark V1.2.0 L1

CIS Kubernetes 1.8 Benchmark V1.2.0 L1

Ensure that the RotateKubeletServerCertificate argument is set to true
Details Enable kubelet server certificate rotation on controller-manager. Rationale: ‘RotateKubeletServerCertificate’ causes the kubelet to both request a serving certificate after...
Ensure that the –secure-port argument is not set to 0
Details Do not disable the secure port. Rationale: The secure port is used to serve https with authentication and authorization....
Ensure that the –service-account-key-file argument is set as appropriate
Details Explicitly set a service account public key file for service accounts on the apiserver. Rationale: By default, if no...
Ensure that the –service-account-lookup argument is set to true
Details Validate service account before validating token. Rationale: By default, the apiserver only verifies that the authentication token is valid....
Ensure that the –service-account-private-key-file argument is set as appropriate
Details Explicitly set a service account private key file for service accounts on the controller manager. Rationale: To ensure that...
Ensure that the –terminated-pod-gc-threshold argument is set as appropriate
Details Activate garbage collector on pod termination, as appropriate. Rationale: Garbage collection is important to ensure sufficient resource availability and...
Ensure that the –tls-cert-file and –tls-private-key-file arguments are set as appropriate – tls-private-key-file
Details Setup TLS connection on the API server. Rationale: API server communication contains sensitive parameters that should remain encrypted in...
Ensure that the –token-auth-file parameter is not set
Details Do not use token based authentication. Rationale: The token-based authentication utilizes static tokens to authenticate requests to the apiserver....
Ensure that the –tls-cert-file and –tls-private-key-file arguments are set as appropriate – tls-cert-file
Details Setup TLS connection on the API server. Rationale: API server communication contains sensitive parameters that should remain encrypted in...
Ensure that the –use-service-account-credentials argument is set to true
Details Use individual service account credentials for each controller. Rationale: The controller manager creates a service account per controller in...

CIS Kubernetes 1.8 Benchmark V1.2.0 L1

Ensure that the RotateKubeletServerCertificate argument is set to true

Ensure that the –secure-port argument is not set to 0

Ensure that the –service-account-key-file argument is set as appropriate

Ensure that the –service-account-lookup argument is set to true

Ensure that the –service-account-private-key-file argument is set as appropriate

Ensure that the –terminated-pod-gc-threshold argument is set as appropriate

Ensure that the –tls-cert-file and –tls-private-key-file arguments are set as appropriate – tls-private-key-file

Ensure that the –token-auth-file parameter is not set

Ensure that the –tls-cert-file and –tls-private-key-file arguments are set as appropriate – tls-cert-file

Ensure that the –use-service-account-credentials argument is set to true