# ------------------------------------------------------------------------------ # Kubernetes CIS benchmark # # NeuVector, Inc. (c) 2020- # # NeuVector delivers an application and network intelligent container security # solution that automatically adapts to protect running containers. Don’t let # security concerns slow down your CI/CD processes. # ------------------------------------------------------------------------------ [INFO] 1 - Control Plane Components [INFO] 1.1 - Master Node Configuration Files [INFO][Level 1][Manual] 1.1.1 - Ensure that the API server pod specification file permissions are set to 644 or more restrictive (Manual) [INFO] * File not found [INFO][Level 1][Manual] 1.1.2 - Ensure that the API server pod specification file ownership is set to root:root (Manual) [INFO][Level 1][Manual] 1.1.3 - Ensure that the controller manager pod specification file permissions are set to 644 or more restrictive (Manual) [INFO] * File not found [INFO][Level 1][Manual] 1.1.4 - Ensure that the controller manager pod specification file ownership is set to root:root (Manual) [INFO][Level 1][Manual] 1.1.5 - Ensure that the scheduler pod specification file permissions are set to 644 or more restrictive (Manual) [INFO] * File not found [INFO][Level 1][Manual] 1.1.6 - Ensure that the scheduler pod specification file ownership is set to root:root (Manual) [INFO][Level 1][Manual] 1.1.7 - Ensure that the etcd pod specification file permissions are set to 644 or more restrictive (Manual) [INFO] * File not found [INFO][Level 1][Manual] 1.1.8 - Ensure that the etcd pod specification file ownership is set to root:root (Manual) [PASS][Level 1][Manual] 1.1.9 - Ensure that the Container Network Interface file permissions are set to 644 or more restrictive (Manual) [PASS][Level 1][Manual] 1.1.10 - Ensure that the Container Network Interface file ownership is set to root:root (Manual) [INFO][Level 1][Manual] 1.1.11 - Ensure that the etcd data directory permissions are set to 700 or more restrictive (Manual) [INFO][Level 1][Manual] 1.1.12 - Ensure that the etcd data directory ownership is set to root:root (Manual) [INFO][Level 1][Manual] 1.1.13 - Ensure that the admin.conf file permissions are set to 644 or more restrictive (Manual) [INFO] * File not found [INFO][Level 1][Manual] 1.1.14 - Ensure that the admin.conf file ownership is set to root:root (Manual) find: <<<.Replace_configPrefix_path>>>/etc/kubernetes/static-pod-resources: No such file or directory [WARN][Level 1][Manual] 1.1.15 - Ensure that the scheduler.conf file permissions are set to 644 or more restrictive (Manual) find: <<<.Replace_configPrefix_path>>>/etc/kubernetes/static-pod-resources: No such file or directory [WARN][Level 1][Manual] 1.1.16 - Ensure that the scheduler.conf file ownership is set to root:root (Manual) find: <<<.Replace_configPrefix_path>>>/etc/kubernetes/static-pod-resources: No such file or directory [WARN][Level 1][Manual] 1.1.17 - Ensure that the controller-manager.conf file permissions are set to 644 or more restrictive (Manual) find: <<<.Replace_configPrefix_path>>>/etc/kubernetes/static-pod-resources: No such file or directory [WARN][Level 1][Manual] 1.1.18 - Ensure that the controller-manager.conf file ownership is set to root:root (Manual) [WARN][Level 1][Manual] 1.1.19 - Ensure that the Kubernetes PKI directory and file ownership is set to root:root (Manual) [WARN] <<<.Replace_configPrefix_path>>>/etc/kubernetes/static-pod-certs doesn't exist. [WARN][Level 1][Manual] 1.1.20 - Ensure that the Kubernetes PKI certificate file permissions are set to 644 or more restrictive (Manual) [WARN] <<<.Replace_configPrefix_path>>>/etc/kubernetes/static-pod-certs doesn't exist. [WARN][Level 1][Manual] 1.1.21 - Ensure that the Kubernetes PKI key file permissions are set to 600 (Manual) [WARN] <<<.Replace_configPrefix_path>>>/etc/kubernetes/static-pod-certs doesn't exist. [INFO] 1.2 - API Server [WARN][Level 1][Manual] 1.2.1 - Ensure that anonymous requests are authorized (Manual) [WARN][Level 1][Manual] 1.2.2 - Ensure that the --basic-auth-file argument is not set (Manual) [WARN][Level 1][Manual] 1.2.3 - Ensure that the --token-auth-file parameter is not set (Manual) [WARN][Level 1][Manual] 1.2.4 - Use https for kubelet connections (Manual) [WARN][Level 1][Manual] 1.2.5 - Ensure that the kubelet uses certificates to authenticate (Manual) [WARN][Level 1][Manual] 1.2.6 - Verify that the kubelet certificate authority is set as appropriate (Manual) [WARN][Level 1][Manual] 1.2.7 - Ensure that the --authorization-mode argument is not set to AlwaysAllow (Manual) [WARN][Level 1][Manual] 1.2.8 - Verify that the Node authorizer is enabled (Manual) [WARN][Level 1][Manual] 1.2.9 - Verify that RBAC is enabled (Manual) [PASS][Level 1][Manual] 1.2.10 - Ensure that the APIPriorityAndFairness feature gate is enabled (Manual) [PASS][Level 1][Manual] 1.2.11 - Ensure that the admission control plugin AlwaysAdmit is not set (Manual) [PASS][Level 1][Manual] 1.2.12 - Ensure that the admission control plugin AlwaysPullImages is set (Manual) [WARN][Level 1][Manual] 1.2.13 - Ensure that the admission control plugin SecurityContextDeny is not set (Manual) [PASS][Level 1][Manual] 1.2.14 - Ensure that the admission control plugin ServiceAccount is set (Manual) [PASS][Level 1][Manual] 1.2.15 - Ensure that the admission control plugin NamespaceLifecycle is set (Manual) [WARN][Level 1][Manual] 1.2.16 - Ensure that the admission control plugin SecurityContextConstraint is set (Manual) [PASS][Level 1][Manual] 1.2.17 - Ensure that the admission control plugin NodeRestriction is set (Manual) [WARN][Level 1][Manual] 1.2.18 - Ensure that the --insecure-bind-address argument is not set (Manual) [WARN][Level 1][Manual] 1.2.19 - Ensure that the --insecure-port argument is set to 0 (Manual) [WARN][Level 1][Manual] 1.2.20 - Ensure that the --secure-port argument is not set to 0 (Manual) [WARN][Level 1][Manual] 1.2.21 - Ensure that the healthz endpoint is protected by RBAC (Manual) [WARN][Level 1][Manual] 1.2.22 - Ensure that the --audit-log-path argument is set (Manual) [WARN][Level 1][Manual] 1.2.23 - Ensure that the audit logs are forwarded off the cluster for retention (Manual) [WARN][Level 1][Manual] 1.2.24 - Ensure that the maximumRetainedFiles argument is set to 10 or as appropriate (Manual) [WARN][Level 1][Manual] 1.2.25 - Ensure that the maximumFileSizeMegabytes argument is set to 100 or as appropriate (Manual) sh: bad number [WARN][Level 1][Manual] 1.2.26 - Ensure that the --request-timeout argument is set as appropriate (Manual) [INFO][Level 1][Manual] 1.2.27 - Ensure that the --service-account-lookup argument is set to true (Manual) OpenShift denies access for any OAuth Access token that does not exist in its etcd data store. OpenShift does not use the service-account-lookup flag. [WARN][Level 1][Manual] 1.2.28 - Ensure that the --service-account-key-file argument is set as appropriate (Manual) [WARN][Level 1][Manual] 1.2.29 - Ensure that the --etcd-certfile and --etcd-keyfile arguments are set as appropriate (Manual) [WARN][Level 1][Manual] 1.2.30 - Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate (Manual) [WARN][Level 1][Manual] 1.2.31 - Ensure that the --client-ca-file argument is set as appropriate (Manual) [WARN][Level 1][Manual] 1.2.32 - Ensure that the --etcd-cafile argument is set as appropriate (Manual) [WARN][Level 1][Manual] 1.2.33 - Ensure that the --encryption-provider-config argument is set as appropriate (Manual) [WARN][Level 1][Manual] 1.2.34 - Ensure that encryption providers are appropriately configured (Manual) [WARN][Level 1][Manual] 1.2.35 - Ensure that the API Server only makes use of Strong Cryptographic Ciphers (Manual) [INFO] 1.3 - Controller Manager [INFO][Level 1][Manual] 1.3.1 - Ensure that garbage collection is configured as appropriate (Manual) [INFO] Garbage collection is important to ensure sufficient resource availability and avoiding degraded performance and availability. In the worst case, the system might crash or just be unusable for a long period of time. The current setting for garbage collection is 12,500 terminated pods which might be too high for your system to sustain. Based on your system resources and tests, choose an appropriate threshold value to activate garbage collection. [INFO][Level 1][Manual] 1.3.2 - Ensure that controller manager healthz endpoints are protected by RBAC (Manual) [INFO] Profiling allows for the identification of specific performance bottlenecks. It generates a significant amount of program data that could potentially be exploited to uncover system and program details. If you are not experiencing any bottlenecks and do not need the profiler for troubleshooting purposes, it is recommended to turn it off to reduce the potential attack surface. [WARN][Level 1][Manual] 1.3.3 - Ensure that the --use-service-account-credentials argument is set to true (Manual) [WARN][Level 1][Manual] 1.3.4 - Ensure that the --service-account-private-key-file argument is set as appropriate (Manual) [WARN][Level 1][Manual] 1.3.5 - Ensure that the --root-ca-file argument is set as appropriate (Manual) [WARN][Level 2][Manual] 1.3.6 - Ensure that the RotateKubeletServerCertificate argument is set to true (Manual) [WARN][Level 1][Manual] 1.3.7 - Ensure that the --bind-address argument is set to 127.0.0.1 (Manual) [INFO] 1.4 - Scheduler [INFO][Level 1][Manual] 1.4.1 - Ensure that the healthz endpoints for the scheduler are protected by RBAC (Manual) [INFO] Disable profiling, if not needed. [PASS][Level 1][Manual] 1.4.2 - Verify that the scheduler API service is protected by authentication and authorization (Manual) grep: <<<.Replace_configPrefix_path>>>/etc/kubernetes/manifests/etcd-pod.yaml: No such file or directory grep: <<<.Replace_configPrefix_path>>>/etc/kubernetes/manifests/etcd-pod.yaml: No such file or directory [WARN][Level 1][Manual] 2.1 - Ensure that the --cert-file and --key-file arguments are set as appropriate (Manual) grep: <<<.Replace_configPrefix_path>>>/etc/kubernetes/manifests/etcd-pod.yaml: No such file or directory [WARN][Level 2][Manual] 2.2 - Ensure that the --client-cert-auth argument is set to true (Manual) grep: <<<.Replace_configPrefix_path>>>/etc/kubernetes/manifests/etcd-pod.yaml: No such file or directory [PASS][Level 1][Manual] 2.3 - Ensure that the --auto-tls argument is not set to true (Manual) grep: <<<.Replace_configPrefix_path>>>/etc/kubernetes/manifests/etcd-pod.yaml: No such file or directory grep: <<<.Replace_configPrefix_path>>>/etc/kubernetes/manifests/etcd-pod.yaml: No such file or directory [WARN][Level 1][Manual] 2.4 - Ensure that the --peer-cert-file and --peer-key-file arguments are set as appropriate (Manual) grep: <<<.Replace_configPrefix_path>>>/etc/kubernetes/manifests/etcd-pod.yaml: No such file or directory [WARN][Level 1][Manual] 2.5 - Ensure that the --peer-client-cert-auth argument is set to true (Manual) grep: <<<.Replace_configPrefix_path>>>/etc/kubernetes/manifests/etcd-pod.yaml: No such file or directory [PASS][Level 2][Manual] 2.6 - Ensure that the --peer-auto-tls argument is not set to true (Manual) grep: <<<.Replace_configPrefix_path>>>/etc/kubernetes/manifests/etcd-pod.yaml: No such file or directory grep: <<<.Replace_configPrefix_path>>>/etc/kubernetes/manifests/etcd-pod.yaml: No such file or directory [WARN][Level 2][Manual] 2.7 - Ensure that a unique Certificate Authority is used for etcd (Manual) [INFO] 3 - Control Plane Configuration [INFO] 3.1 - Authentication and Authorization find: <<<.Replace_configPrefix_path>>>/etc/kubernetes/static-pod-resources: No such file or directory [WARN][Level 2][Manual] 3.1.1 - Client certificate authentication should not be used for users (Manual) [INFO] 3.2 - Logging [WARN][Level 1][Manual] 3.2.1 - Ensure that a minimal audit policy is created (Manual) [WARN][Level 2][Manual] 3.2.2 - Ensure that the audit policy covers key security concerns (Manual) [INFO] 5 - Policies [INFO] 5.1 - RBAC and Service Accounts /usr/local/bin/kube_master_ocp_4_5.tmpl: line 1218: kubectl: not found [INFO][Level 1][Manual] 5.1.1 - Ensure that the cluster-admin role is only used where required (Manual) /usr/local/bin/kube_master_ocp_4_5.tmpl: line 1225: kubectl: not found [INFO][Level 1][Manual] 5.1.2 - Minimize access to secrets (Manual) [INFO][Level 1][Manual] 5.1.3 - Minimize wildcard use in Roles and ClusterRoles (Manual) /usr/local/bin/kube_master_ocp_4_5.tmpl: line 1235: kubectl: not found [INFO][Level 1][Manual] 5.1.4 - Minimize access to create pods (Manual) [INFO] check_5_1_5 [INFO] The default service account should not be used to ensure that rights granted to applications can be more easily audited and reviewed. [INFO][Level 1][Manual] 5.1.6 - Ensure that Service Account Tokens are only mounted where necessary (Manual) [INFO] Service accounts tokens should not be mounted in pods except where the workload running in the pod explicitly needs to communicate with the API server [INFO] 5.2 - Pod Security Policies [INFO][Level 1][Manual] 5.2.1 - Minimize the admission of privileged containers (Manual) [INFO] Do not generally permit containers to be run with the securityContext.privileged flag set to true. [INFO][Level 1][Manual] 5.2.2 - Minimize the admission of containers wishing to share the host process ID namespace (Manual) [INFO] Do not generally permit containers to be run with the hostPID flag set to true. [INFO][Level 1][Manual] 5.2.3 - Minimize the admission of containers wishing to share the host IPC namespace (Manual) [INFO] Do not generally permit containers to be run with the hostIPC flag set to true. [INFO][Level 1][Manual] 5.2.4 - Minimize the admission of containers wishing to share the host network namespace (Manual) [INFO] Do not generally permit containers to be run with the hostNetwork flag set to true. [INFO][Level 1][Manual] 5.2.5 - Minimize the admission of containers with allowPrivilegeEscalation (Manual) [INFO] Do not generally permit containers to be run with the allowPrivilegeEscalation flag set to true. [INFO][Level 2][Manual] 5.2.6 - Minimize the admission of root containers (Manual) [INFO] Do not generally permit containers to be run as the root user. [INFO][Level 1][Manual] 5.2.7 - Minimize the admission of containers with the NET_RAW capability (Manual) [INFO] Do not generally permit containers with the potentially dangerous NET_RAW capability. [INFO][Level 1][Manual] 5.2.8 - Minimize the admission of containers with added capabilities (Manual) [INFO] Do not generally permit containers with capabilities assigned beyond the default set. [INFO][Level 2][Manual] 5.2.9 - Minimize the admission of containers with capabilities assigned (Manual) [INFO] Do not generally permit containers with capabilities [INFO] 5.3 - Network Policies and CNI [INFO][Level 1][Manual] 5.3.1 - Ensure that the CNI in use supports Network Policies (Manual) [INFO] There are a variety of CNI plugins available for Kubernetes. If the CNI in use does not support Network Policies it may not be possible to effectively restrict traffic in the cluster. [INFO][Level 2][Manual] 5.3.2 - Ensure that all Namespaces have Network Policies defined (Manual) [INFO] Use network policies to isolate traffic in your cluster network. [INFO] 5.4 - Secrets Management [INFO][Level 1][Manual] 5.4.1 - Prefer using secrets as files over secrets as environment variables (Manual) [INFO] Kubernetes supports mounting secrets as data volumes or as environment variables. Minimize the use of environment variable secrets. [INFO][Level 2][Manual] 5.4.2 - Consider external secret storage (Manual) [INFO] Consider the use of an external secrets storage and management system, instead of using Kubernetes Secrets directly, if you have more complex secret management needs. Ensure the solution requires authentication to access secrets, has auditing of access to and use of secrets, and encrypts secrets. Some solutions also make it easier to rotate secrets. [INFO] 5.5 - Extensible Admission Control [INFO][Level 2][Manual] 5.5.1 - Configure Image Provenance using image controller configuration parameters (Manual) [INFO] Configure Image Provenance for your deployment. [INFO] 5.6 - General Policies [INFO][Level 1][Manual] 5.6.1 - Create administrative boundaries between resources using namespaces (Manual) [INFO] Use namespaces to isolate your Kubernetes objects. [INFO][Level 2][Manual] 5.6.2 - Ensure that the seccomp profile is set to docker/default in your pod definitions (Manual) [INFO] Enable default seccomp profile in your pod definitions. [INFO][Level 2][Manual] 5.6.3 - Apply Security Context to Your Pods and Containers (Manual) [INFO] A security context defines the operating system security settings (uid, gid, capabilities, SELinux role, etc..) applied to a container. When designing your containers and pods, make sure that you configure the security context for your pods, containers, and volumes. A security context is a property defined in the deployment yaml. It controls the security parameters that will be assigned to the pod/container/volume. There are two levels of security context: pod level security context, and container level security context. [INFO][Level 2][Manual] 5.6.4 - The default namespace should not be used (Manual) [INFO] Resources in a Kubernetes cluster should be segregated by namespace, to allow for security controls to be applied at that level and to make it easier to manage resources.