CIS Kubernetes Benchmark
129 articles
- Ensure that the API Server Pod Specification File Permissions Are Set to 600 or More Restrictive
- Ensure that the API server pod specification file ownership is set to root:root
- Ensure that the controller manager pod specification file permissions are set to 600 or more restrictive
- Ensure that the controller manager pod specification file ownership is set to root:root
- Ensure that the scheduler pod specification file permissions are set to 600 or more restrictive
- Ensure that the scheduler pod specification file ownership is set to root:root
- Ensure that the etcd pod specification file permissions are set to 600 or more restrictive
- Ensure that the etcd pod specification file ownership is set to root:root
- Ensure that the Container Network Interface (CNI) file permissions are set to 600 or more restrictive
- Ensure that the Container Network Interface (CNI) file ownership is set to root:root
- Ensure that the etcd data directory permissions are set to 700 or more restrictive
- Ensure that the etcd data directory ownership is set to etcd:etcd
- Ensure that the default administrative credential file permissions are set to 600
- Ensure that the default administrative credential file ownership is set to root:root
- Ensure that the scheduler.conf file permissions are set to 600 or more restrictive
- Ensure that the scheduler.conf file ownership is set to root:root
- Ensure that the controller-manager.conf file permissions are set to 600 or more restrictive
- Ensure that the controller-manager.conf file ownership is set to root:root
- Ensure that the Kubernetes PKI directory and file ownership is set to root:root
- Ensure that the Kubernetes PKI certificate file permissions are set to 600 or more restrictive
- Ensure that the --audit-log-maxsize argument is set to 100 or as appropriate
- Ensure that the --audit-log-maxbackup argument is set to 10 or as appropriate
- Ensure that the --audit-log-maxage argument is set to 30 or as appropriate
- Ensure that the --audit-log-path argument is set
- Ensure that the --profiling argument is set to false
- Ensure that the admission control plugin NodeRestriction is set
- Ensure that the admission control plugin NamespaceLifecycle is set
- Ensure that the admission control plugin ServiceAccount is set
- Ensure that the admission control plugin AlwaysPullImages is set
- Ensure that the admission control plugin AlwaysAdmit is not set
- Ensure that the admission control plugin EventRateLimit is set
- Ensure that the --authorization-mode argument includes RBAC
- Ensure that the --authorization-mode argument includes Node
- Ensure that the --authorization-mode argument is not set to AlwaysAllow
- Ensure that the --kubelet-certificate-authority argument is set as appropriate
- Ensure that the --kubelet-client-certificate and --kubelet-client-key arguments are set as appropriate
- Ensure that the DenyServiceExternalIPs is set
- Ensure that the --token-auth-file parameter is not set
- Ensure that the --anonymous-auth argument is set to false
- Ensure that the Kubernetes PKI key file permissions are set to 600
- Ensure that the --cert-file and --key-file arguments are set as appropriate
- Ensure that the --bind-address argument is set to 127.0.0.1
- Ensure that the --profiling argument is set to false
- Ensure that the --bind-address argument is set to 127.0.0.1
- Ensure that the RotateKubeletServerCertificate argument is set to true
- Ensure that the --root-ca-file argument is set as appropriate
- Ensure that the --service-account-private-key-file argument is set as appropriate
- Ensure that the --use-service-account-credentials argument is set to true
- Ensure that the --profiling argument is set to false
- Ensure that the --terminated-pod-gc-threshold argument is set as appropriate
- Ensure that the API Server only makes use of Strong Cryptographic Ciphers
- Ensure that encryption providers are appropriately configured
- Ensure that the --encryption-provider-config argument is set as appropriate
- Ensure that the --etcd-cafile argument is set as appropriate
- Ensure that the --client-ca-file argument is set as appropriate
- Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate
- Ensure that the --etcd-certfile and --etcd-keyfile arguments are set as appropriate
- Ensure that the --service-account-key-file argument is set as appropriate
- Ensure that the --service-account-lookup argument is set to true
- Ensure that the --request-timeout argument is set as appropriate
- If the kubelet config.yaml configuration file is being used, validate permissions set to 600 or more restrictive
- Ensure that the client certificate authorities file ownership is set to root:root
- Ensure that the seccomp profile is set to docker/default in your pod definitions
- The default namespace should not be used
- Apply Security Context to Your Pods and Containers
- Ensure that the certificate authorities file permissions are set to 600 or more restrictive
- Create administrative boundaries between resources using namespaces
- Ensure that the --kubeconfig kubelet.conf file ownership is set to root:root
- Configure Image Provenance using ImagePolicyWebhook admission controller (Manual)
- Ensure that the --kubeconfig kubelet.conf file permissions are set to 600 or more restrictive
- Consider external secret storage
- If proxy kubeconfig file exists, ensure ownership is set to root:root
- Prefer using secrets as files over secrets as environment variables
- Ensure that all Namespaces have Network Policies defined
- If proxy kubeconfig file exists, ensure permissions are set to 600 or more restrictive
- Ensure that the CNI in use supports Network Policies
- Ensure that the kubelet service file ownership is set to root:root
- Minimize the admission of containers which use HostPorts
- Ensure that the kubelet service file permissions are set to 600 or more restrictive
- Ensure that the audit policy covers key security concerns
- Minimize the admission of HostPath volumes
- Ensure that a minimal audit policy is created
- Minimize the admission of Windows HostProcess Containers
- Bootstrap token authentication should not be used for users
- Service account token authentication should not be used for users
- Minimize the admission of containers with capabilities assigned
- Client certificate authentication should not be used for users
- Ensure that a unique Certificate Authority is used for etcd
- Ensure that the --peer-auto-tls argument is not set to true
- Ensure that the --peer-client-cert-auth argument is set to true
- Ensure that the --peer-cert-file and --peer-key-file arguments are set as appropriate
- Ensure that the --auto-tls argument is not set to true
- Ensure that the --client-cert-auth argument is set to true
- Minimize the admission of containers with the NET_RAW capability
- Minimize the admission of root containers
- Minimize the admission of containers with allowPrivilegeEscalation
- Minimize the admission of containers wishing to share the host network namespace
- Ensure that the --authorization-mode argument is not set to AlwaysAllow
- Minimize the admission of containers wishing to share the host IPC namespace
- Ensure that the --client-ca-file argument is set as appropriate
- Minimize the admission of containers wishing to share the host process ID namespace
- Verify that the --read-only-port argument is set to 0
- Minimize the admission of privileged containers
- Ensure that the --streaming-connection-idle-timeout argument is not set to 0
- Ensure that the --make-iptables-util-chains argument is set to true
- Ensure that the cluster has at least one active policy control mechanism in place
- Ensure that the --hostname-override argument is not set
- Minimize access to the service account token creation
- Minimize access to webhook configuration object
- Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate
- Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate
- Ensure that the --rotate-certificates argument is not set to false
- Verify that the RotateKubeletServerCertificate argument is set to true
- Ensure that the Kubelet only makes use of Strong Cryptographic Ciphers
- Ensure that a limit is set on pod PIDs
- Ensure that the kube-proxy metrics service is bound to localhost
- Ensure that the cluster-admin role is only used where required
- Minimize access to secrets
- Minimize wildcard use in Roles and ClusterRoles
- Minimize access to the approval sub-resource of certificatesigningrequests objects
- Minimize access to create pods
- Minimize access to the proxy sub-resource of nodes
- Ensure that the --anonymous-auth argument is set to false
- If the kubelet config.yaml configuration file is being used, validate file ownership is set to root:root
- Minimize access to create persistent volumes
- Limit use of the Bind, Impersonate and Escalate permissions in the Kubernetes cluster
- Ensure that default service accounts are not actively used
- Avoid use of system:masters group
- Ensure that Service Account Tokens are only mounted where necessary