N/A
Source
Kube Bench
ID
1.3
Version
cis-1.5

1.3 Controller Manager

1.3.1 Ensure that the –terminated-pod-gc-threshold argument is set as appropriate (Not Scored)

Edit the Controller Manager pod specification file $controllermanagerconf on the master node and set the –terminated-pod-gc-threshold to an appropriate threshold, for example: –terminated-pod-gc-threshold=10

1.3.2 Ensure that the –profiling argument is set to false (Scored)

Edit the Controller Manager pod specification file $controllermanagerconf on the master node and set the below parameter. –profiling=false

1.3.3 Ensure that the –use-service-account-credentials argument is set to true (Scored)

Edit the Controller Manager pod specification file $controllermanagerconf on the master node to set the below parameter. –use-service-account-credentials=true

1.3.4 Ensure that the –service-account-private-key-file argument is set as appropriate (Scored)

Edit the Controller Manager pod specification file $controllermanagerconf on the master node and set the –service-account-private-key-file parameter to the private key file for service accounts. –service-account-private-key-file=

1.3.5 Ensure that the –root-ca-file argument is set as appropriate (Scored)

Edit the Controller Manager pod specification file $controllermanagerconf on the master node and set the –root-ca-file parameter to the certificate bundle file`. –root-ca-file=<path/to/file>

1.3.6 Ensure that the RotateKubeletServerCertificate argument is set to true (Scored)

Edit the Controller Manager pod specification file $controllermanagerconf on the master node and set the –feature-gates parameter to include RotateKubeletServerCertificate=true. –feature-gates=RotateKubeletServerCertificate=true

1.3.7 Ensure that the –bind-address argument is set to 127.0.0.1 (Scored)

Edit the Controller Manager pod specification file $controllermanagerconf on the master node and ensure the correct value for the –bind-address parameter