Ensure that the kubelet –config configuration file ownership is set to root:root
Details Ensure that if the kubelet refers to a configuration file with the –config argument, that file is owned by...
- Home
- Security Hardening
- CIS Kubernetes V1.20 Benchmark V1.0.0 L1 Worker
CIS Kubernetes V1.20 Benchmark V1.0.0 L1 Worker
Ensure that the Kubelet only makes use of Strong Cryptographic Ciphers
Details Ensure that the Kubelet is configured to only use strong cryptographic ciphers. Rationale: TLS ciphers have had a number...Ensure that the kubelet service file ownership is set to root:root
Details Ensure that the kubelet service file ownership is set to root:root. Rationale: The kubelet service file controls various parameters...Ensure that the kubelet service file permissions are set to 644 or more restrictive
Details Ensure that the kubelet service file has permissions of 644 or more restrictive. Rationale: The kubelet service file controls...Ensure that the –make-iptables-util-chains argument is set to true
Details Allow Kubelet to manage iptables. Rationale: Kubelets can automatically manage the required changes to iptables based on how you...Ensure that the –protect-kernel-defaults argument is set to true
Details Protect tuned kernel parameters from overriding kubelet default kernel parameter values. Rationale: Kernel parameters are usually tuned and hardened...Ensure that the –rotate-certificates argument is not set to false
Details Enable kubelet client certificate rotation. Rationale: The –rotate-certificates setting causes the kubelet to rotate its client certificates by creating...Ensure that the –streaming-connection-idle-timeout argument is not set to 0
Details Do not disable timeouts on streaming connections. Rationale: Setting idle timeouts ensures that you are protected against Denial-of-Service attacks,...Ensure that the –tls-cert-file and –tls-private-key-file arguments are set as appropriate – cert
Details Setup TLS connection on the Kubelets. Rationale: The connections from the apiserver to the kubelet are used for fetching...Ensure that the –tls-cert-file and –tls-private-key-file arguments are set as appropriate – key
Details Setup TLS connection on the Kubelets. Rationale: The connections from the apiserver to the kubelet are used for fetching...