/usr/local/bin/kube_worker_ocp_4_5.tmpl

# ------------------------------------------------------------------------------
# Kubernetes CIS benchmark
#
# NeuVector, Inc. (c) 2020-
#
# NeuVector delivers an application and network intelligent container security
# solution that automatically adapts to protect running containers. Don’t let
# security concerns slow down your CI/CD processes.
# ------------------------------------------------------------------------------

[INFO] 4.1 - Worker Node Configuration Files
[INFO][Level 1][Automated] 4.1.1  - Ensure that the kubelet service file permissions are set to 644 or more restrictive (Automated)
[INFO]      * The kubelet service file not found
[INFO][Level 1][Automated] 4.1.2  - Ensure that the kubelet service file ownership is set to root:root (Automated)
[INFO][Level 1][Manual] 4.1.3  - If proxy kubeconfig file exists ensure permissions are set to 644 or more restrictive (Manual)
[INFO][Level 1][Manual] 4.1.4  - If proxy kubeconfig file exists ensure ownership is set to root:root (Manual)
[INFO][Level 1][Manual] 4.1.5  - Ensure that the kubelet.conf file permissions are set to 644 or more restrictive (Manual)
[INFO]      * File not found
[INFO][Level 1][Manual] 4.1.6  - Ensure that the --kubeconfig kubelet.conf file ownership is set to root:root (Manual)
[INFO][Level 1][Automated] 4.1.7  - Ensure that the certificate authorities file permissions are set to 644 or more restrictive (Automated)
[INFO]      * File not found
[INFO][Level 1][Automated] 4.1.8  - Ensure that the client certificate authorities file ownership is set to root:root (Automated)
[INFO][Level 1][Automated] 4.1.9  - Ensure that the kubelet --config configuration file has permissions set to 644 or more restrictive (Automated)
[INFO]      * File not found
[INFO][Level 1][Automated] 4.1.10  - Ensure that the kubelet configuration file ownership is set to root:root (Automated)
[INFO] 4.2 - Kubelet
grep: <<<.Replace_configPrefix_path>>>/etc/kubernetes/kubelet.conf: No such file or directory
grep: <<<.Replace_configPrefix_path>>>/etc/kubernetes/kubelet.conf: No such file or directory
[WARN][Level 1][Automated] 4.2.1  - Ensure that the anonymous-auth argument is set to false (Automated)
grep: <<<.Replace_configPrefix_path>>>/etc/kubernetes/kubelet.conf: No such file or directory
[PASS][Level 1][Automated] 4.2.2  - Ensure that the --authorization-mode argument is not set to AlwaysAllow (Automated)
grep: <<<.Replace_configPrefix_path>>>/etc/kubernetes/kubelet.conf: No such file or directory
[WARN][Level 1][Automated] 4.2.3  - Ensure that the --client-ca-file argument is set as appropriate (Automated)
grep: <<<.Replace_configPrefix_path>>>/etc/kubernetes/kubelet.conf: No such file or directory
[PASS][Level 1][Automated] 4.2.4  - Verify that the read only port is not used or is set to 0 (Automated)
grep: <<<.Replace_configPrefix_path>>>/etc/kubernetes/kubelet.conf: No such file or directory
[PASS][Level 1][Automated] 4.2.5  - Ensure that the --streaming-connection-idle-timeout argument is not set to 0 (Automated)
grep: <<<.Replace_configPrefix_path>>>/etc/kubernetes/kubelet.conf: No such file or directory
[PASS][Level 1][Automated] 4.2.5  - Ensure that the --streaming-connection-idle-timeout argument is not set to 0 (Automated)
grep: <<<.Replace_configPrefix_path>>>/etc/kubernetes/kubelet.conf: No such file or directory
[PASS][Level 1][Manual] 4.2.7  - Ensure that the --make-iptables-util-chains argument is set to true (Manual)
grep: <<<.Replace_configPrefix_path>>>/etc/kubernetes/kubelet.conf: No such file or directory
[PASS][Level 1][Manual] 4.2.7  - Ensure that the --make-iptables-util-chains argument is set to true (Manual)
grep: <<<.Replace_configPrefix_path>>>/etc/kubernetes/kubelet.conf: No such file or directory
[WARN][Level 2][Automated] 4.2.9  - Ensure that the kubeAPIQPS [--event-qps] argument is set to 0 or a level which ensures appropriate event capture (Automated)
grep: <<<.Replace_configPrefix_path>>>/etc/kubernetes/kubelet.conf: No such file or directory
grep: <<<.Replace_configPrefix_path>>>/etc/kubernetes/kubelet.conf: No such file or directory
[PASS][Level 1][Automated] 4.2.10  - Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate (Automated)
grep: <<<.Replace_configPrefix_path>>>/etc/kubernetes/kubelet.conf: No such file or directory
grep: <<<.Replace_configPrefix_path>>>/etc/kubernetes/kubelet.conf: No such file or directory
[WARN][Level 1][Manual] 4.2.11  - Ensure that the --rotate-certificates argument is not set to false (Manual)
grep: <<<.Replace_configPrefix_path>>>/etc/kubernetes/kubelet.conf: No such file or directory
grep: <<<.Replace_configPrefix_path>>>/etc/kubernetes/kubelet.conf: No such file or directory
[WARN][Level 1][Manual] 4.2.12  - Verify that the RotateKubeletServerCertificate argument is set to true (Manual)
[INFO][Level 1][Manual] 4.2.13  - Ensure that the Kubelet only makes use of Strong Cryptographic Ciphers (Manual)
[INFO] TLS ciphers have had a number of known vulnerabilities and weaknesses, which can reduce the protection provided by them. By default Kubernetes supports a number of TLS ciphersuites including some that have security concerns, weakening the protection provided.