If proxy kubeconfig file exists ensure ownership is set to root:root
Details If kube-proxy is running, ensure that the file ownership of its kubeconfig file is set to root:root. Rationale: The...
- Home
- Security Hardening
- CIS Kubernetes Benchmark V1.6.1 L1 Worker
CIS Kubernetes Benchmark V1.6.1 L1 Worker
If proxy kubeconfig file exists ensure permissions are set to 644 or more restrictive
Details If kube-proxy is running, and if it is using a file-based kubeconfig file, ensure that the proxy kubeconfig file...Minimize wildcard use in Roles and ClusterRoles – clusterroles
Details Kubernetes Roles and ClusterRoles provide access to resources based on sets of objects and actions that can be taken...Minimize wildcard use in Roles and ClusterRoles – roles
Details Kubernetes Roles and ClusterRoles provide access to resources based on sets of objects and actions that can be taken...Verify that the –read-only-port argument is set to 0
Details Disable the read-only port. Rationale: The Kubelet process provides a read-only API in addition to the main Kubelet API....Verify that the RotateKubeletServerCertificate argument is set to true
Details Enable kubelet server certificate rotation. Rationale: RotateKubeletServerCertificate causes the kubelet to both request a serving certificate after bootstrapping its...