Vulnerabilities
Misconfiguration
Runtime Security
Compliance
Compliance > Kubernetes > CIS - Rke CIS 1.23 > Worker Node Security Configuration >

Kubelet

N/A
Source
Kube Bench
ID
4.2
Version
rke-cis-1.23

4.2 Kubelet

4.2.1 Ensure that the –anonymous-auth argument is set to false (Automated)

If using a Kubelet config file, edit the file to set authentication: anonymous: enabled to false. If using executable arguments, edit the kubelet service file $kubeletsvc on each worker node and set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable. --anonymous-auth=false Based on your system, restart the kubelet service. For example, systemctl daemon-reload systemctl restart kubelet.service

4.2.2 Ensure that the –authorization-mode argument is not set to AlwaysAllow (Automated)

If using a Kubelet config file, edit the file to set authorization.mode to Webhook. If using executable arguments, edit the kubelet service file $kubeletsvc on each worker node and set the below parameter in KUBELET_AUTHZ_ARGS variable. –authorization-mode=Webhook Based on your system, restart the kubelet service. For example, systemctl daemon-reload systemctl restart kubelet.service

4.2.3 Ensure that the –client-ca-file argument is set as appropriate (Automated)

If using a Kubelet config file, edit the file to set authentication.x509.clientCAFile to the location of the client CA file. If using command line arguments, edit the kubelet service file $kubeletsvc on each worker node and set the below parameter in KUBELET_AUTHZ_ARGS variable. –client-ca-file=<path/to/client-ca-file> Based on your system, restart the kubelet service. For example, systemctl daemon-reload systemctl restart kubelet.service

4.2.4 Ensure that the –read-only-port argument is set to 0 (Automated)

If using a Kubelet config file, edit the file to set readOnlyPort to 0. If using command line arguments, edit the kubelet service file $kubeletsvc on each worker node and set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable. –read-only-port=0 Based on your system, restart the kubelet service. For example, systemctl daemon-reload systemctl restart kubelet.service

4.2.5 Ensure that the –streaming-connection-idle-timeout argument is not set to 0 (Automated)

If using a Kubelet config file, edit the file to set streamingConnectionIdleTimeout to a value other than 0. If using command line arguments, edit the kubelet service file $kubeletsvc on each worker node and set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable. –streaming-connection-idle-timeout=5m Based on your system, restart the kubelet service. For example, systemctl daemon-reload systemctl restart kubelet.service

4.2.6 Ensure that the –protect-kernel-defaults argument is set to true (Automated)

If using a Kubelet config file, edit the file to set protectKernelDefaults to true. If using command line arguments, edit the kubelet service file $kubeletsvc on each worker node and set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable. –protect-kernel-defaults=true Based on your system, restart the kubelet service. For example: systemctl daemon-reload systemctl restart kubelet.service System level configurations are required prior to provisioning the cluster in order for this argument to be set to true.

4.2.7 Ensure that the –make-iptables-util-chains argument is set to true (Automated)

If using a Kubelet config file, edit the file to set makeIPTablesUtilChains to true. If using command line arguments, edit the kubelet service file $kubeletsvc on each worker node and remove the –make-iptables-util-chains argument from the KUBELET_SYSTEM_PODS_ARGS variable. Based on your system, restart the kubelet service. For example: systemctl daemon-reload systemctl restart kubelet.service

4.2.8 Ensure that the –hostname-override argument is not set (Manual)

Edit the kubelet service file $kubeletsvc on each worker node and remove the –hostname-override argument from the KUBELET_SYSTEM_PODS_ARGS variable. Based on your system, restart the kubelet service. For example, systemctl daemon-reload systemctl restart kubelet.service Clusters provisioned by RKE set the –hostname-override to avoid any hostname configuration errors

4.2.9 Ensure that the –event-qps argument is set to 0 or a level which ensures appropriate event capture (Automated)

If using a Kubelet config file, edit the file to set eventRecordQPS to an appropriate level. If using command line arguments, edit the kubelet service file $kubeletsvc on each worker node and set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable. Based on your system, restart the kubelet service. For example, systemctl daemon-reload systemctl restart kubelet.service

4.2.10 Ensure that the –tls-cert-file and –tls-private-key-file arguments are set as appropriate (Manual)

If using a Kubelet config file, edit the file to set tlsCertFile to the location of the certificate file to use to identify this Kubelet, and tlsPrivateKeyFile to the location of the corresponding private key file. If using command line arguments, edit the kubelet service file $kubeletsvc on each worker node and set the below parameters in KUBELET_CERTIFICATE_ARGS variable. –tls-cert-file=<path/to/tls-certificate-file> –tls-private-key-file=<path/to/tls-key-file> Based on your system, restart the kubelet service. For example, systemctl daemon-reload systemctl restart kubelet.service When generating serving certificates, functionality could break in conjunction with hostname overrides which are required for certain cloud providers.

4.2.11 Ensure that the –rotate-certificates argument is not set to false (Automated)

If using a Kubelet config file, edit the file to add the line rotateCertificates to true or remove it altogether to use the default value. If using command line arguments, edit the kubelet service file $kubeletsvc on each worker node and remove –rotate-certificates=false argument from the KUBELET_CERTIFICATE_ARGS variable. Based on your system, restart the kubelet service. For example, systemctl daemon-reload systemctl restart kubelet.service

4.2.12 Verify that the RotateKubeletServerCertificate argument is set to true (Manual)

Edit the kubelet service file $kubeletsvc on each worker node and set the below parameter in KUBELET_CERTIFICATE_ARGS variable. –feature-gates=RotateKubeletServerCertificate=true Based on your system, restart the kubelet service. For example: systemctl daemon-reload systemctl restart kubelet.service Clusters provisioned by RKE handles certificate rotation directly through RKE.

4.2.13 Ensure that the Kubelet only makes use of Strong Cryptographic Ciphers (Automated)

If using a Kubelet config file, edit the file to set TLSCipherSuites to TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 or to a subset of these values. If using executable arguments, edit the kubelet service file $kubeletsvc on each worker node and set the –tls-cipher-suites parameter as follows, or to a subset of these values. –tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 Based on your system, restart the kubelet service. For example: systemctl daemon-reload systemctl restart kubelet.service

Aqua Security is the largest pure-play cloud native security company, providing customers the freedom to innovate and run their businesses with minimal friction. The Aqua Cloud Native Security Platform provides prevention, detection, and response automation across the entire application lifecycle to secure the build, secure cloud infrastructure and secure running workloads wherever they are deployed.
Copyright © 2024 Aqua Security Software Ltd.   Privacy Policy | Terms of Use