Skip to content

Commit dc963f5

Browse files
ktsakalozosktsakalozos
committed
Canonical K8s configuration
1 parent d8fc376 commit dc963f5

File tree

7 files changed

+1928
-0
lines changed

7 files changed

+1928
-0
lines changed

‎cfg/ck8s-cis-1.24/config.yaml‎

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
---
2+
## Version-specific settings that override the values in cfg/config.yaml
3+
master:
4+
apiserver:
5+
confs:
6+
- /var/snap/k8s/common/args/kube-apiserver
7+
bins:
8+
- kube-apiserver
9+
scheduler:
10+
confs:
11+
- /var/snap/k8s/common/args/kube-scheduler
12+
kubeconfig:
13+
- /etc/kubernetes/scheduler.conf
14+
bins:
15+
- kube-scheduler
16+
controllermanager:
17+
confs:
18+
- /var/snap/k8s/common/args/kube-controller-manager
19+
bins:
20+
- kube-controller-manager
21+
kubeconfig:
22+
- /etc/kubernetes/controller.conf
23+
etcd:
24+
confs:
25+
- /var/snap/k8s/common/args/k8s-dqlite
26+
bins:
27+
- k8s-dqlite
28+
29+
etcd:
30+
components:
31+
- etcd
32+
33+
etcd:
34+
bins:
35+
- "k8s-dqlite"
36+
confs:
37+
- /var/snap/microk8s/common/args/k8s-dqlite
38+
defaultconf: /var/snap/microk8s/common/args/k8s-dqlite
39+
defaultdatadir: /var/snap/k8s/common/var/lib/k8s-dqlite
40+
41+
node:
42+
kubelet:
43+
cafile:
44+
- "/etc/kubernetes/pki/client-ca.crt"
45+
svc:
46+
- "/etc/systemd/system/snap.k8s.kubelet.service"
47+
bins:
48+
- "bin/kubelet"
49+
confs:
50+
- "/var/snap/k8s/common/args/kubelet"
51+
kubeconfig:
52+
- "/etc/kubernetes/kubelet.conf"
53+
proxy:
54+
confs:
55+
- /var/snap/k8s/common/args/kube-proxy
56+
kubeconfig:
57+
- /etc/kubernetes/proxy.conf
58+
svc:
59+
- "/etc/systemd/system/snap.k8s.kube-proxy.service"
60+
61+
controlplane:
62+
apiserver:
63+
confs:
64+
- /var/snap/k8s/common/args/kube-apiserver

‎cfg/ck8s-cis-1.24/controlplane.yaml‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
---
2+
controls:
3+
version: "cis-1.24"
4+
id: 3
5+
text: "Control Plane Configuration"
6+
type: "controlplane"
7+
groups:
8+
- id: 3.1
9+
text: "Authentication and Authorization"
10+
checks:
11+
- id: 3.1.1
12+
text: "Client certificate authentication should not be used for users (Manual)"
13+
type: "manual"
14+
remediation: |
15+
Alternative mechanisms provided by Kubernetes such as the use of OIDC should be
16+
implemented in place of client certificates.
17+
scored: false
18+
19+
- id: 3.2
20+
text: "Logging"
21+
checks:
22+
- id: 3.2.1
23+
text: "Ensure that a minimal audit policy is created (Manual)"
24+
audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep"
25+
tests:
26+
test_items:
27+
- flag: "--audit-policy-file"
28+
set: true
29+
remediation: |
30+
Create an audit policy file for your cluster.
31+
scored: false
32+
33+
- id: 3.2.2
34+
text: "Ensure that the audit policy covers key security concerns (Manual)"
35+
type: "manual"
36+
remediation: |
37+
Review the audit policy provided for the cluster and ensure that it covers
38+
at least the following areas,
39+
40+
- Access to Secrets managed by the cluster. Care should be taken to only
41+
log Metadata for requests to Secrets, ConfigMaps, and TokenReviews, in
42+
order to avoid risk of logging sensitive data.
43+
- Modification of Pod and Deployment objects.
44+
- Use of `pods/exec`, `pods/portforward`, `pods/proxy` and `services/proxy`.
45+
46+
For most requests, minimally logging at the Metadata level is recommended
47+
(the most basic level of logging).
48+
scored: false

‎cfg/ck8s-cis-1.24/etcd.yaml‎

Lines changed: 93 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,93 @@
1+
---
2+
controls:
3+
version: "cis-1.24"
4+
id: 2
5+
text: "Datastore Node Configuration"
6+
type: "etcd"
7+
groups:
8+
- id: 2
9+
text: "Datastore Node Configuration"
10+
checks:
11+
- id: 2.1
12+
text: "Ensure that the --cert-file and --key-file arguments are set as appropriate (Automated)"
13+
tests:
14+
test_items:
15+
- flag: "--not-applicable"
16+
set: false
17+
remediation: |
18+
Not applicable. Canonical K8s uses dqlite and the communication to this service is done through a
19+
local socket (/var/snap/k8s/common/var/lib/k8s-dqlite/k8s-dqlite.sock) accessible to users with root permissions.
20+
scored: true
21+
22+
- id: 2.2
23+
text: "Ensure that the --client-cert-auth argument is set to true (Automated)"
24+
tests:
25+
test_items:
26+
- flag: "--not-applicable"
27+
set: false
28+
remediation: |
29+
Not applicable. Canonical K8s uses dqlite and the communication to this service is done through a
30+
local socket (/var/snap/k8s/common/var/lib/k8s-dqlite/k8s-dqlite.sock) accessible to users with root permissions.
31+
scored: true
32+
33+
- id: 2.3
34+
text: "Ensure that the --auto-tls argument is not set to true (Automated)"
35+
tests:
36+
test_items:
37+
- flag: "--not-applicable"
38+
set: false
39+
remediation: |
40+
Not applicable. Canonical K8s uses dqlite and the communication to this service is done through a
41+
local socket (/var/snap/k8s/common/var/lib/k8s-dqlite/k8s-dqlite.sock) accessible to users with root permissions.
42+
scored: true
43+
44+
- id: 2.4
45+
text: "Ensure that the --peer-cert-file and --peer-key-file arguments are set as appropriate (Automated)"
46+
audit: "if test -e /var/snap/k8s/common/var/lib/k8s-dqlite/cluster.crt && test -e /var/snap/k8s/common/var/lib/k8s-dqlite/cluster.key; then echo 'certs-found'; fi"
47+
tests:
48+
test_items:
49+
- flag: "certs-found"
50+
remediation: |
51+
The certificate pair for dqlite and tls peer communication is
52+
/var/snap/k8s/common/var/lib/k8s-dqlite/cluster.crt and
53+
/var/snap/k8s/common/var/lib/k8s-dqlite/cluster.key.
54+
scored: true
55+
56+
- id: 2.5
57+
text: "Ensure that the --peer-client-cert-auth argument is set to true (Automated)"
58+
audit: "/bin/cat $etcdconf | /bin/grep enable-tls || true; echo $?"
59+
tests:
60+
bin_op: or
61+
test_items:
62+
- flag: "--enable-tls"
63+
compare:
64+
op: eq
65+
value: true
66+
- flag: "--enable-tls"
67+
set: false
68+
remediation: |
69+
Dqlite peer communication uses TLS unless the --enable-tls is set to false in
70+
/var/snap/k8s/common/args/k8s-dqlite.
71+
scored: true
72+
73+
- id: 2.6
74+
text: "Ensure that the --peer-auto-tls argument is not set to true (Automated)"
75+
tests:
76+
test_items:
77+
- flag: "--not-applicable"
78+
set: false
79+
remediation: |
80+
Not applicable. Canonical K8s uses dqlite and tls peer communication uses the certificates
81+
created upon the snap creation.
82+
scored: false
83+
84+
- id: 2.7
85+
text: "Ensure that a unique Certificate Authority is used for the datastore (Manual)"
86+
tests:
87+
test_items:
88+
- flag: "--not-applicable"
89+
set: false
90+
remediation: |
91+
Not applicable. Canonical K8s uses dqlite and tls peer communication uses certificates
92+
created upon cluster setup.
93+
scored: true

0 commit comments

Comments
 (0)