Vulnerabilities
Misconfiguration
Runtime Security
Compliance
Compliance > Kubernetes > CIS 1.24 > Control Plane Security Configuration >

API Server

N/A
Source
Kube Bench
ID
1.2
Version
cis-1.24

1.2 API Server

1.2.1 Ensure that the –anonymous-auth argument is set to false (Manual)

Edit the API server pod specification file $apiserverconf on the control plane node and set the below parameter. –anonymous-auth=false

1.2.2 Ensure that the –token-auth-file parameter is not set (Automated)

Follow the documentation and configure alternate mechanisms for authentication. Then, edit the API server pod specification file $apiserverconf on the control plane node and remove the –token-auth-file= parameter.

1.2.3 Ensure that the –DenyServiceExternalIPs is not set (Automated)

Edit the API server pod specification file $apiserverconf on the control plane node and remove the DenyServiceExternalIPs from enabled admission plugins.

1.2.4 Ensure that the –kubelet-client-certificate and –kubelet-client-key arguments are set as appropriate (Automated)

Follow the Kubernetes documentation and set up the TLS connection between the apiserver and kubelets. Then, edit API server pod specification file $apiserverconf on the control plane node and set the kubelet client certificate and key parameters as below. –kubelet-client-certificate=<path/to/client-certificate-file> –kubelet-client-key=<path/to/client-key-file>

1.2.5 Ensure that the –kubelet-certificate-authority argument is set as appropriate (Automated)

Follow the Kubernetes documentation and setup the TLS connection between the apiserver and kubelets. Then, edit the API server pod specification file $apiserverconf on the control plane node and set the –kubelet-certificate-authority parameter to the path to the cert file for the certificate authority. –kubelet-certificate-authority=

1.2.6 Ensure that the –authorization-mode argument is not set to AlwaysAllow (Automated)

Edit the API server pod specification file $apiserverconf on the control plane node and set the –authorization-mode parameter to values other than AlwaysAllow. One such example could be as below. –authorization-mode=RBAC

1.2.7 Ensure that the –authorization-mode argument includes Node (Automated)

Edit the API server pod specification file $apiserverconf on the control plane node and set the –authorization-mode parameter to a value that includes Node. –authorization-mode=Node,RBAC

1.2.8 Ensure that the –authorization-mode argument includes RBAC (Automated)

Edit the API server pod specification file $apiserverconf on the control plane node and set the –authorization-mode parameter to a value that includes RBAC, for example --authorization-mode=Node,RBAC.

1.2.9 Ensure that the admission control plugin EventRateLimit is set (Manual)

Follow the Kubernetes documentation and set the desired limits in a configuration file. Then, edit the API server pod specification file $apiserverconf and set the below parameters. –enable-admission-plugins=…,EventRateLimit,… –admission-control-config-file=<path/to/configuration/file>

1.2.10 Ensure that the admission control plugin AlwaysAdmit is not set (Automated)

Edit the API server pod specification file $apiserverconf on the control plane node and either remove the –enable-admission-plugins parameter, or set it to a value that does not include AlwaysAdmit.

1.2.11 Ensure that the admission control plugin AlwaysPullImages is set (Manual)

Edit the API server pod specification file $apiserverconf on the control plane node and set the –enable-admission-plugins parameter to include AlwaysPullImages. –enable-admission-plugins=…,AlwaysPullImages,…

1.2.12 Ensure that the admission control plugin SecurityContextDeny is set if PodSecurityPolicy is not used (Manual)

Edit the API server pod specification file $apiserverconf on the control plane node and set the –enable-admission-plugins parameter to include SecurityContextDeny, unless PodSecurityPolicy is already in place. –enable-admission-plugins=…,SecurityContextDeny,…

1.2.13 Ensure that the admission control plugin ServiceAccount is set (Automated)

Follow the documentation and create ServiceAccount objects as per your environment. Then, edit the API server pod specification file $apiserverconf on the control plane node and ensure that the –disable-admission-plugins parameter is set to a value that does not include ServiceAccount.

1.2.14 Ensure that the admission control plugin NamespaceLifecycle is set (Automated)

Edit the API server pod specification file $apiserverconf on the control plane node and set the –disable-admission-plugins parameter to ensure it does not include NamespaceLifecycle.

1.2.15 Ensure that the admission control plugin NodeRestriction is set (Automated)

Follow the Kubernetes documentation and configure NodeRestriction plug-in on kubelets. Then, edit the API server pod specification file $apiserverconf on the control plane node and set the –enable-admission-plugins parameter to a value that includes NodeRestriction. –enable-admission-plugins=…,NodeRestriction,…

1.2.16 Ensure that the –secure-port argument is not set to 0 (Automated)

Edit the API server pod specification file $apiserverconf on the control plane node and either remove the –secure-port parameter or set it to a different (non-zero) desired port.

1.2.17 Ensure that the –profiling argument is set to false (Automated)

Edit the API server pod specification file $apiserverconf on the control plane node and set the below parameter. –profiling=false

1.2.18 Ensure that the –audit-log-path argument is set (Automated)

Edit the API server pod specification file $apiserverconf on the control plane node and set the –audit-log-path parameter to a suitable path and file where you would like audit logs to be written, for example, –audit-log-path=/var/log/apiserver/audit.log

1.2.19 Ensure that the –audit-log-maxage argument is set to 30 or as appropriate (Automated)

Edit the API server pod specification file $apiserverconf on the control plane node and set the –audit-log-maxage parameter to 30 or as an appropriate number of days, for example, –audit-log-maxage=30

1.2.20 Ensure that the –audit-log-maxbackup argument is set to 10 or as appropriate (Automated)

Edit the API server pod specification file $apiserverconf on the control plane node and set the –audit-log-maxbackup parameter to 10 or to an appropriate value. For example, –audit-log-maxbackup=10

1.2.21 Ensure that the –audit-log-maxsize argument is set to 100 or as appropriate (Automated)

Edit the API server pod specification file $apiserverconf on the control plane node and set the –audit-log-maxsize parameter to an appropriate size in MB. For example, to set it as 100 MB, –audit-log-maxsize=100

1.2.22 Ensure that the –request-timeout argument is set as appropriate (Manual)

Edit the API server pod specification file $apiserverconf and set the below parameter as appropriate and if needed. For example, –request-timeout=300s

1.2.23 Ensure that the –service-account-lookup argument is set to true (Automated)

Edit the API server pod specification file $apiserverconf on the control plane node and set the below parameter. –service-account-lookup=true Alternatively, you can delete the –service-account-lookup parameter from this file so that the default takes effect.

1.2.24 Ensure that the –service-account-key-file argument is set as appropriate (Automated)

Edit the API server pod specification file $apiserverconf on the control plane node and set the –service-account-key-file parameter to the public key file for service accounts. For example, –service-account-key-file=

1.2.25 Ensure that the –etcd-certfile and –etcd-keyfile arguments are set as appropriate (Automated)

Follow the Kubernetes documentation and set up the TLS connection between the apiserver and etcd. Then, edit the API server pod specification file $apiserverconf on the control plane node and set the etcd certificate and key file parameters. –etcd-certfile=<path/to/client-certificate-file> –etcd-keyfile=<path/to/client-key-file>

1.2.26 Ensure that the –tls-cert-file and –tls-private-key-file arguments are set as appropriate (Automated)

Follow the Kubernetes documentation and set up the TLS connection on the apiserver. Then, edit the API server pod specification file $apiserverconf on the control plane node and set the TLS certificate and private key file parameters. –tls-cert-file=<path/to/tls-certificate-file> –tls-private-key-file=<path/to/tls-key-file>

1.2.27 Ensure that the –client-ca-file argument is set as appropriate (Automated)

Follow the Kubernetes documentation and set up the TLS connection on the apiserver. Then, edit the API server pod specification file $apiserverconf on the control plane node and set the client certificate authority file. –client-ca-file=<path/to/client-ca-file>

1.2.28 Ensure that the –etcd-cafile argument is set as appropriate (Automated)

Follow the Kubernetes documentation and set up the TLS connection between the apiserver and etcd. Then, edit the API server pod specification file $apiserverconf on the control plane node and set the etcd certificate authority file parameter. –etcd-cafile=<path/to/ca-file>

1.2.29 Ensure that the –encryption-provider-config argument is set as appropriate (Manual)

Follow the Kubernetes documentation and configure a EncryptionConfig file. Then, edit the API server pod specification file $apiserverconf on the control plane node and set the –encryption-provider-config parameter to the path of that file. For example, –encryption-provider-config=</path/to/EncryptionConfig/File>

1.2.30 Ensure that encryption providers are appropriately configured (Manual)

Follow the Kubernetes documentation and configure a EncryptionConfig file. In this file, choose aescbc, kms or secretbox as the encryption provider.

1.2.31 Ensure that the API Server only makes use of Strong Cryptographic Ciphers (Manual)

Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml on the control plane node and set the below parameter. –tls-cipher-suites=TLS_AES_128_GCM_SHA256,TLS_AES_256_GCM_SHA384,TLS_CHACHA20_POLY1305_SHA256, TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384, TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256, TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305, TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256,TLS_RSA_WITH_3DES_EDE_CBC_SHA,TLS_RSA_WITH_AES_128_CBC_SHA, TLS_RSA_WITH_AES_128_GCM_SHA256,TLS_RSA_WITH_AES_256_CBC_SHA,TLS_RSA_WITH_AES_256_GCM_SHA384

Aqua Security is the largest pure-play cloud native security company, providing customers the freedom to innovate and run their businesses with minimal friction. The Aqua Cloud Native Security Platform provides prevention, detection, and response automation across the entire application lifecycle to secure the build, secure cloud infrastructure and secure running workloads wherever they are deployed.
Copyright © 2023 Aqua Security Software Ltd.   Privacy Policy | Terms of Use