CIS.xlsx

	A	B	C	D	E
1	1	Control Plane Components
2	1.1	Master Node Config Files
3		File		Permision	Ownership
4		/etc/kubernetes/manifests/kube-apiserver.yaml		644	root:root
5		/etc/kubernetes/manifests/kube-controller-manager.yaml		644	root:root
6		/etc/kubernetes/manifests/kube-scheduler.yaml		644	root:root
7		/etc/kubernetes/manifests/etcd.yaml		644	root:root
8		<path/to/cni/files>		644	root:root
9		/etc/kubernetes/admin.conf		644	root:root
10		/etc/kubernetes/scheduler.conf		644	root:root
11		/etc/kubernetes/controller-manager.conf		644	root:root
12		/etc/kubernetes/pki/			root:root
13		/etc/kubernetes/pki/*.crt		644	root:root
14		/etc/kubernetes/pki/*.key		600	root:root
15		/var/lib/etcd		700	etcd:etcd
16	1.2	API Server
17		ps -ef \| grep kube-apiserver
18		Flags	Default	Value	Presence
19		--anonymous-auth	TRUE	FALSE
20		--basic-auth-file	absent		absent
21		--token-auth-file	absent		absent
22		--kubelet-https	TRUE	TRUE	absent
23		--kubelet-client-certificate	Not Set	<path/to/client-certificate-file>
24		--kubelet-client-key	Not Set	<path/to/client-key-file>
25		--kubelet-certificate-authority	Not Set	<ca string>
26		--authorization-mode	NOT 'AlwaysAllow'	NOT 'AlwaysAllow'
27		--authorization-mode	Not enabled	...,RBAC,Node,...
28		--enable-admission-plugins		...,EventRateLimit,AlwaysPullImages, SecurityContextDeny \|\| PodSecurityPolicy,NodeRestriction......
29		--disable-admission-plugins		…,ServiceAccount, NamespaceLifecycle, AlwaysAdmit
30		--insecure-bind-address	absent		absent
31		--insecure-port	8080	0
32		--secure-port	6443	1 to 65535
33		--profiling	TRUE	FALSE
34		--audit-log-path	Disable	/var/log/apiserver/audit.log with maxage, maxsize, and maxbackup Parameters
35		--audit-log-maxage	Disable	Minimum 30 (days)
36		--audit-log-maxbackup	Disable	Minimum 10 (files)
37		--audit-log-maxsize	Disable	100 (MB) or appropriate
38		--request-timeout	60 s	Set appropriate. 300s
39		--service-account-lookup	TRUE	TRUE
40		--service-account-key-file	absent	Public Key file for SA. Private key to controller manager
41		--etcd-certfile	Not Set	Appropriate
42		--etcd-keyfile	Not Set	Appropriate
43		--tls-cert-file	Not Set	Appropriate. Do not use self-signed certificate
44		--tls-private-key-file	Not Set	Appropriate
45		--client-ca-file	Not Set	Appropriate
46		--etcd-cafile	Not Set	Appropriate
47		--encryption-provider-config	Not Set	EncryptionConfig file
48		EncryptionConfig file	NA	aesgcb, aescbc, kms OR secretbox. Specify provider with EncryptionConfiguration Kind
49		--tls-cipher-suites	Wide Range	TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM _SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM _SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM _SHA384
50		--tls-min-version		> 1.2
51		--feature-gates to AdvancedAuditing=TRUE
52	1.3	Contoller Manager
53		ps -ef \| grep kube-controller-manager
54		Flags	Default	Value	Presence
55		--terminated-pod-gc-threshold	12500 (pods)	set appropriate
56		--profiling	TRUE	FALSE
57		--use-service-account-credentials	FALSE	TRUE
58		--service-account-private-key-file	Not Set	Appropriate
59		--root-ca-file	Not Set	Appropriate
60		RotateKubeletServerCertificate	TRUE	TRUE
61		--bind-address	0.0.0.0	127.0.0.1
62
63	1.4	Schedular
64		ps -ef \| grep kube-scheduler
65		Flags	Default	Value
66		--profiling	TRUE	FALSE
67		--bind-address	0.0.0.0	127.0.0.1
68
69	2	etcd
70		ps -ef \| grep etcd
71		Flags	Default	Value
72		--cert-file	not set	Appropriate
73		--key-file	not set	Appropriate
74		--client-cert-auth	FALSE	TRUE
75		--auto-tls	FALSE	FALSE
76		--peer-client-file	Not Set	Appropriate
77		--peer-key-file	Not Set	Appropriate
78		--peer-client-cert-auth	FALSE	TRUE
79		--peer-auto-tls	FALSE	FALSE
80		--trusted-ca-file	Not Set	Different from --client-ca-file for API Server
81
82	3	Control Plane Configuration
83	3.1	Authentication and Authorization
84			Default	Value
85		Client certificate authentication should not be used for users	enabled	disable
86	3.2	Logging
87		ps -ef \| grep kube-apiserver
88		Flags	Default	Value
89		--audit-policy-file		Appropriate
90		Ensure that the audit policy covers key security concerns	do not log
91
92	4	Worker Node
93	4.1	Worker Node Configuration Files	Permision	Ownership
94		kubelet_service_config	644	root:root	/etc/systemd/system/kubelet.service.d/10-kubeadm.conf
95		kubelet_config	644	root:root	/etc/kubernetes/kubelet.conf
96		kubelet_config_yaml	644	root:root	/var/lib/kubelet/config.yaml
97		ps -ef \| grep kube-proxy	644	root:root	kubeconfig file
98		ps -ef \| grep kubelet	644	root:root	--client-ca-file
99	4.2	Kubelet
100		ps -ef \| grep kubelet \| grep config		Kubelet config file: JSON or YAML