Ensure that the etcd data directory permissions are set to 700 or more restrictive
Details Ensure that the etcd data directory has permissions of 700 or more restrictive. Rationale: etcd is a highly-available key-value...
- Home
- Security Hardening
- CIS Kubernetes V1.20 Benchmark V1.0.0 L1 Master
CIS Kubernetes V1.20 Benchmark V1.0.0 L1 Master
Ensure that the etcd pod specification file ownership is set to root:root
Details Ensure that the /etc/kubernetes/manifests/etcd.yaml file ownership is set to root:root. Rationale: The etcd pod specification file /etc/kubernetes/manifests/etcd.yaml controls various...Ensure that the –insecure-bind-address argument is not set
Details Do not bind the insecure API service. Rationale: If you bind the apiserver to an insecure address, basically anyone...Ensure that the –insecure-port argument is set to 0
Details Do not bind to insecure port. Rationale: Setting up the apiserver to serve on an insecure port would allow...Ensure that the –kubelet-certificate-authority argument is set as appropriate
Details Verify kubelet’s certificate before establishing connection. Rationale: The connections from the apiserver to the kubelet are used for fetching...Ensure that the –kubelet-client-certificate and –kubelet-client-key arguments are set as appropriate – certificate
Details Enable certificate based kubelet authentication. Rationale: The apiserver, by default, does not authenticate itself to the kubelet’s HTTPS endpoints....Ensure that the –kubelet-client-certificate and –kubelet-client-key arguments are set as appropriate – key
Details Enable certificate based kubelet authentication. Rationale: The apiserver, by default, does not authenticate itself to the kubelet’s HTTPS endpoints....Ensure that the –kubelet-https argument is set to true
Details Use https for kubelet connections. Rationale: Connections from apiserver to kubelets could potentially carry sensitive data such as secrets...Ensure that the Kubernetes PKI certificate file permissions are set to 644 or more restrictive
Details Ensure that Kubernetes PKI certificate files have permissions of 644 or more restrictive. Rationale: Kubernetes makes use of a...Ensure that the Kubernetes PKI directory and file ownership is set to root:root
Details Ensure that the Kubernetes PKI directory and file ownership is set to root:root. Rationale: Kubernetes makes use of a...