CIS_Kubernetes_v1.20_v1.0.0_Level_1_Worker.audit from CIS Kubernetes v1.20 Benchmark v1.0.0
Details NOTE: Nessus has provided the target output to assist in reviewing the benchmark to ensure target compliance. Supportive Information...
- Home
- Security Hardening
- CIS Kubernetes V1.20 Benchmark V1.0.0 L1 Worker
CIS Kubernetes V1.20 Benchmark V1.0.0 L1 Worker
Ensure that the –anonymous-auth argument is set to false
Details Disable anonymous requests to the Kubelet server. Rationale: When enabled, requests that are not rejected by other configured authentication...Ensure that the –authorization-mode argument is not set to AlwaysAllow
Details Do not allow all requests. Enable explicit authorization. Rationale: Kubelets, by default, allow all authenticated requests (even anonymous ones)...Ensure that the certificate authorities file permissions are set to 644 or more restrictive
Details Ensure that the certificate authorities file has permissions of 644 or more restrictive. Rationale: The certificate authorities file controls...Ensure that the –client-ca-file argument is set as appropriate
Details Enable Kubelet authentication using certificates. Rationale: The connections from the apiserver to the kubelet are used for fetching logs...Ensure that the client certificate authorities file ownership is set to root:root
Details Ensure that the certificate authorities file ownership is set to root:root. Rationale: The certificate authorities file controls the authorities...Ensure that the –hostname-override argument is not set
Details Do not override node hostnames. Rationale: Overriding hostnames could potentially break TLS setup between the kubelet and the apiserver....Ensure that the –kubeconfig kubelet.conf file ownership is set to root:root
Details Ensure that the kubelet.conf file ownership is set to root:root. Rationale: The kubelet.conf file is the kubeconfig file for...Ensure that the –kubeconfig kubelet.conf file permissions are set to 644 or more restrictive
Details Ensure that the kubelet.conf file has permissions of 644 or more restrictive. Rationale: The kubelet.conf file is the kubeconfig...Ensure that the kubelet –config configuration file has permissions set to 644 or more restrictive
Details Ensure that if the kubelet refers to a configuration file with the –config argument, that file has permissions of...