Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

chore: update cis docs to meet 1.8 benchmarks #1039

Merged
merged 2 commits into from
Sep 25, 2024
Merged

chore: update cis docs to meet 1.8 benchmarks #1039

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
55cc1bb
chore: update cis docs to meet 1.8 benchmarks
emosbaugh Sep 25, 2024
40ac105
docs edit
paigecalvert Sep 25, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
27 changes: 19 additions & 8 deletions src/markdown-pages/install-with-kurl/cis-compliance.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,7 @@ linktitle: "CIS Compliance"
title: "CIS Compliance"
isAlpha: false
---
You can configure the kURL installer to be Center for Internet Security (CIS) compliant. Opt-in to this feature by setting the `kurl.cisCompliance` field to `true` in the kURL specification. For information about known limitations, see [Known Limitations](#known-limitations). For more information about CIS security compliance for Kubernetes, see the [CIS benchmark information](https://www.cisecurity.org/benchmark/kubernetes).
You can configure the kURL installer to be Center for Internet Security (CIS) compliant for CIS 1.8 or earlier. Opt-in to this feature by setting the `kurl.cisCompliance` field to `true` in the kURL specification. For information about known limitations, see [Known Limitations](#known-limitations). For more information about CIS security compliance for Kubernetes, see the [CIS benchmark information](https://www.cisecurity.org/benchmark/kubernetes).
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

^ @emosbaugh changed "versions up to 1.8" to "1.8 or earlier", but lmk if that's not the right interpretation for what this was supposed to say


When you set `cisCompliance` is set to `true`, the following settings are changed from the default settings:

Expand Down Expand Up @@ -62,15 +62,26 @@ spec:

* The [EKCO add-on](/docs/add-ons/ekco) v0.19.0 and later is required to use this feature.
* This feature works with the [Kubernetes (kubeadm) add-on](https://kurl.sh/docs/add-ons/kubernetes) only.
* To meet CIS compliance, admin.conf permissions are changed from the default `root:sudo 440` to `root:root 400`.
* To meet CIS compliance, admin.conf and super-admin.conf permissions are changed from the default `root:sudo 440` to `root:root 400` and `root:root 600` respectively.
* Kubelet no longer attempts to change kernel parameters at runtime. Using kernel parameters other than those expected by Kubernetes can block kubelet from initializing and causes the installation to fail.
* This feature has been tested with kURL upgrades, however we strongly recommend testing this with your development environments prior to upgrading production.
* The following failure was identified in kURL testing with `kube-bench` v0.6.8 and is believed to be due to the etcd user not being listed in /etc/passwd mounted from the host:
```bash
[FAIL] 1.1.12 Ensure that the etcd data directory ownership is set to etcd:etcd (Automated)
```
* **Note:** This check only fails when `kube-bench` is deployed as a Kubernetes job running on a control plane node.
* For more information about the etcd data directory ownership check failure issue, see [this issue in GitHub](https://github.com/aquasecurity/kube-bench/issues/1221).

## Running kube-bench

Below are instructions for running the CIS 1.8 Kubernetes Benchmark checks for Kubernetes versions 1.26 through 1.31 using kube-bench.

Download the kube-bench binary:

```bash
curl -LO https://github.com/aquasecurity/kube-bench/releases/download/v0.8.0/kube-bench_0.8.0_linux_amd64.tar.gz
tar xzvf kube-bench_0.8.0_linux_amd64.tar.gz
```

Run kube-bench:

```bash
sudo KUBECONFIG=/etc/kubernetes/admin.conf ./kube-bench run --config-dir=./cfg --benchmark cis-1.8
```

## AWS Amazon Linux 2 (AL2) Considerations
The kernel defaults of this Amazon Machine Image (AMI) are not set properly for CIS compliance. CIS compliance does not allow Kubernetes to change kernel settings itself. You must change the kernel defaults to the following settings before installing with kURL:
Expand Down