CIS Kubernetes Benchmark v1.9.0

stat -c %a /etc/kubernetes/manifests/kube-apiserver.yaml 

chmod 600 /etc/kubernetes/manifests/kube-apiserver.yaml 

stat -c %U:%G /etc/kubernetes/manifests/kube-apiserver.yaml 

chown root:root /etc/kubernetes/manifests/kube-apiserver.yaml 

stat -c %a /etc/kubernetes/manifests/kube-controller-manager.yaml 

chmod 600 /etc/kubernetes/manifests/kube-controller-manager.yaml 

stat -c %U:%G /etc/kubernetes/manifests/kube-controller-manager.yaml 

chown root:root /etc/kubernetes/manifests/kube-controller-manager.yaml 

stat -c %a /etc/kubernetes/manifests/kube-scheduler.yaml 

chmod 600 /etc/kubernetes/manifests/kube-scheduler.yaml 

stat -c %U:%G /etc/kubernetes/manifests/kube-scheduler.yaml 

chown root:root /etc/kubernetes/manifests/kube-scheduler.yaml 

stat -c %a /etc/kubernetes/manifests/etcd.yaml 

chmod 600 /etc/kubernetes/manifests/etcd.yaml 

stat -c %U:%G /etc/kubernetes/manifests/etcd.yaml 

chown root:root /etc/kubernetes/manifests/etcd.yaml 

stat -c %a <path/to/cni/files>

chmod 600 <path/to/cni/files> 

stat -c %U:%G <path/to/cni/files>

chown root:root <path/to/cni/files>

ps -ef | grep etcd 

stat -c %a /var/lib/etcd 

ps -ef | grep etcd 

chmod 700 /var/lib/etcd 

ps -ef | grep etcd 

stat -c %U:%G /var/lib/etcd 

ps -ef | grep etcd 

chown etcd:etcd /var/lib/etcd 

stat -c %a /etc/kubernetes/admin.conf 

stat -c %a /etc/kubernetes/super-admin.conf 

chmod 600 /etc/kubernetes/admin.conf 

chmod 600 /etc/kubernetes/super-admin.conf 

stat -c %U:%G /etc/kubernetes/admin.conf 

stat -c %a /etc/kubernetes/super-admin.conf 

chown root:root /etc/kubernetes/admin.conf 

chown root:root /etc/kubernetes/super-admin.conf 

stat -c %a /etc/kubernetes/scheduler.conf 

chmod 600 /etc/kubernetes/scheduler.conf 

stat -c %U:%G /etc/kubernetes/scheduler.conf 

chown root:root /etc/kubernetes/scheduler.conf 

stat -c %a /etc/kubernetes/controller-manager.conf 

chmod 600 /etc/kubernetes/controller-manager.conf 

stat -c %U:%G /etc/kubernetes/controller-manager.conf 

chown root:root /etc/kubernetes/controller-manager.conf 

ls -laR /etc/kubernetes/pki/ 

chown -R root:root /etc/kubernetes/pki/ 

stat -c '%a' /etc/kubernetes/pki/*.crt 

ls -l /etc/kubernetes/pki/*.crt 

chmod -R 600 /etc/kubernetes/pki/*.crt 

stat -c '%a' /etc/kubernetes/pki/*.key 

ls -l /etc/kubernetes/pki/*.key 

chmod -R 600 /etc/kubernetes/pki/*.key 

ps -ef | grep kube-apiserver 

--anonymous-auth=false 

ps -ef | grep kube-apiserver 

ps -ef | grep kube-apiserver 

ps -ef | grep kube-apiserver 

--kubelet-client-certificate= 
--kubelet-client-key= 

ps -ef | grep kube-apiserver 

--kubelet-certificate-authority=<ca-string> 

ps -ef | grep kube-apiserver 

--authorization-mode=RBAC 

ps -ef | grep kube-apiserver 

--authorization-mode=Node,RBAC 

ps -ef | grep kube-apiserver 

--authorization-mode=Node,RBAC 

ps -ef | grep kube-apiserver 

--enable-admission-plugins=...,EventRateLimit,... 
--admission-control-config-file= 

ps -ef | grep kube-apiserver 

ps -ef | grep kube-apiserver 

--enable-admission-plugins=...,AlwaysPullImages,... 

ps -ef | grep kube-apiserver 

ps -ef | grep kube-apiserver 

ps -ef | grep kube-apiserver 

--enable-admission-plugins=...,NodeRestriction,... 

ps -ef | grep kube-apiserver 

--profiling=false 

ps -ef | grep kube-apiserver 

--audit-log-path=/var/log/apiserver/audit.log 

ps -ef | grep kube-apiserver 

--audit-log-maxage=30 

ps -ef | grep kube-apiserver 

--audit-log-maxbackup=10 

ps -ef | grep kube-apiserver 

--audit-log-maxsize=100 

ps -ef | grep kube-apiserver 

--request-timeout=300s 

ps -ef | grep kube-apiserver 

--service-account-lookup=true 

ps -ef | grep kube-apiserver 

--service-account-key-file=<filename> 

ps -ef | grep kube-apiserver 

--etcd-certfile= 
--etcd-keyfile= 

ps -ef | grep kube-apiserver 

--tls-cert-file=<path/to/tls-certificate-file>
--tls-private-key-file=<path/to/tls-key-file>

ps -ef | grep kube-apiserver 

--client-ca-file=<path/to/client-ca-file>

ps -ef | grep kube-apiserver 

--etcd-cafile= 

ps -ef | grep kube-apiserver 

--encryption-provider-config= 

ps -ef | grep kube-apiserver 

ps -ef | grep kube-apiserver 

--tls-cipher--
suites=TLS_AES_128_GCM_SHA256,TLS_AES_256_GCM_SHA384,TLS_CHACHA20_POLY1305_SH A256,TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SH A256,TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SH A384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_CHACHA20_POL Y1305_SHA256,TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_C BC_SHA,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_CBC_S HA,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 ,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256,TLS_RSA_WITH_3DES_EDE_CBC_SHA,TL S_RSA_WITH_AES_128_CBC_SHA,TLS_RSA_WITH_AES_128_GCM_SHA256,TLS_RSA_WITH_AES_2 56_CBC_SHA, TLS_RSA_WITH_AES_256_GCM_SHA384. 

ps -ef | grep kube-controller-manager 

--terminated-pod-gc-threshold=10 

ps -ef | grep kube-controller-manager 

--profiling=false 

ps -ef | grep kube-controller-manager 

--use-service-account-credentials=true 

ps -ef | grep kube-controller-manager 

--service-account-private-key-file= 

ps -ef | grep kube-controller-manager 

--root-ca-file=<path/to/file>

ps -ef | grep kube-controller-manager 

--feature-gates=RotateKubeletServerCertificate=true 

ps -ef | grep kube-controller-manager 

ps -ef | grep kube-scheduler 

--profiling=false 

ps -ef | grep kube-scheduler 

ps -ef | grep etcd 

--cert-file= 
--key-file= 

ps -ef | grep etcd 

--client-cert-auth="true" 

ps -ef | grep etcd 

--auto-tls=false 

ps -ef | grep etcd 

--peer-client-file=
--peer-key-file= 

ps -ef | grep etcd 

--peer-client-cert-auth=true 

ps -ef | grep etcd 

--peer-auto-tls=false 

ps -ef | grep etcd 

ps -ef | grep apiserver 

--trusted-ca-file=</path/to/ca-file> 

ps -ef | grep kube-apiserver 

• Modification of pod and deployment objects. 
• Use of pods/exec, pods/portforward, pods/proxy and services/proxy. 

export 
kubelet_service_config=/etc/systemd/system/kubelet.service.d/kubeadm.conf 

stat -c %a /etc/systemd/system/kubelet.service.d/10-kubeadm.conf 

chmod 600 /etc/systemd/system/kubelet.service.d/kubeadm.conf 

export 
kubelet_service_config=/etc/systemd/system/kubelet.service.d/kubeadm.conf 

stat -c %U:%G /etc/systemd/system/kubelet.service.d/10-kubeadm.conf 

chown root:root /etc/systemd/system/kubelet.service.d/kubeadm.conf 

ps -ef | grep kube-proxy 

stat -c %a <path><filename> 

chmod 600 <proxy kubeconfig file> 

ps -ef | grep kube-proxy 

stat -c %U:%G <path><filename>  

chown root:root <proxy kubeconfig file>  

export kubelet_config=/etc/kubernetes/kubelet.conf 

stat -c %a /etc/kubernetes/kubelet.conf 

chmod 600 /etc/kubernetes/kubelet.conf 

export kubelet_config=/etc/kubernetes/kubelet.conf 

stat -c %U:%G /etc/kubernetes/kubelet.conf 

chown root:root /etc/kubernetes/kubelet.conf 

ps -ef | grep kubelet 

stat -c %a <filename> 

chmod 600 <filename>

ps -ef | grep kubelet 

stat -c %U:%G <filename>

chown root:root <filename> 

export kubelet_config_yaml=/var/lib/kubelet/config.yaml 

stat -c %a /var/lib/kubelet/config.yaml 

chmod 600 /var/lib/kubelet/config.yaml 

export kubelet_config_yaml=/var/lib/kubelet/config.yaml 

stat -c %aU %G /var/lib/kubelet/config.yaml 
```Verify that the ownership is set to `root:root`. 

chown root:root /etc/kubernetes/kubelet.conf 

ps -ef | grep kubelet 

--anonymous-auth=false 

systemctl daemon-reload 
systemctl restart kubelet.service 

ps -ef | grep kubelet 

--authorization-mode=Webhook 

systemctl daemon-reload systemctl restart kubelet.service 

ps -ef | grep kubelet 

--client-ca-file=<path/to/client-ca-file>

systemctl daemon-reload 
systemctl restart kubelet.service 

ps -ef | grep kubelet 

--read-only-port=0 

systemctl daemon-reload 
systemctl restart kubelet.service 

ps -ef | grep kubelet 

--streaming-connection-idle-timeout=5m 

systemctl daemon-reload 
systemctl restart kubelet.service 

ps -ef | grep kubelet 

systemctl daemon-reload 
systemctl restart kubelet.service 

ps -ef | grep kubelet 

systemctl daemon-reload 
systemctl restart kubelet.service 

sudo grep "eventRecordQPS" /etc/systemd/system/kubelet.service.d/10- kubeadm.conf 

systemctl daemon-reload 
systemctl restart kubelet.service 

ps -ef | grep kubelet 

systemctl daemon-reload 
systemctl restart kubelet.service 

ps -ef | grep kubelet 

systemctl daemon-reload 
systemctl restart kubelet.service 

ps -ef | grep kubelet 

--feature-gates=RotateKubeletServerCertificate=true 

systemctl daemon-reload 
systemctl restart kubelet.service 

• TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 
• TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
• TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305
• TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
• TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305
• TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
• TLS_RSA_WITH_AES_256_GCM_SHA384 
• TLS_RSA_WITH_AES_128_GCM_SHA256 

ps -ef | grep kubelet 

--tls-cipher-
suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM _SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM _SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM _SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 

systemctl daemon-reload 
systemctl restart kubelet.service 

ps -ef | grep -i kube-proxy 

kubectl get clusterrolebindings -o=custom-
columns=NAME:.metadata.name,ROLE:.roleRef.name,SUBJECT:.subjects[*].name 

kubectl delete clusterrolebinding [name] 

CLUSTERROLEBINDING SUBJECT TYPE SA-NAMESPACE cluster-admin system:masters Group system:controller:clusterrole-aggregation-controller clusterroleaggregation-controller ServiceAccount kube-system system:controller:expand-controller expand-controller ServiceAccount kube-system system:controller:generic-garbage-collector generic-garbagecollector ServiceAccount kube-system system:controller:namespace-controller namespace-controller ServiceAccount kube-system system:controller:persistent-volume-binder persistent-volumebinder ServiceAccount kube-system system:kube-controller-manager system:kube-controllermanager User  

kubectl get roles --all-namespaces -o yaml 

kubectl get clusterroles -o yaml 

CLUSTERROLEBINDING SUBJECT TYPE SA-NAMESPACE cluster-admin system:masters Group system:controller:clusterrole-aggregation-controller clusterroleaggregation-controller ServiceAccount kube-system system:controller:daemon-set-controller daemon-set-controller ServiceAccount kube-system system:controller:job-controller job-controller ServiceAccount kube-system system:controller:persistent-volume-binder persistent-volumebinder ServiceAccount kube-system system:controller:replicaset-controller replicaset-controller ServiceAccount kube-system system:controller:replication-controller replication-controller ServiceAccount kube-system system:controller:statefulset-controller statefulset-controller ServiceAccount kube-system 

automountServiceAccountToken: false 

automountServiceAccountToken: false 

Run the following command: get pods -A -o=jsonpath=$'{range .items[*]}{@.metadata.name}: 
{@..securityContext}\n{end}' 

kubectl get all -o jsonpath='{range .items[?(@..secretKeyRef)]} {.kind} {.metadata.name} {"\n"}{end}' -A 

kubectl get namespaces 

1. default - The default namespace for objects with no other namespace 
2. kube-system - The namespace for objects created by the Kubernetes system 
3. kube-node-lease - Namespace used for node heartbeats 
4. kube-public - Namespace used for public information in a cluster

securityContext: 
  seccompProfile: 
    type: RuntimeDefault 

securityContext: 
  seccompProfile: 
    type: RuntimeDefault 

kubectl get $(kubectl api-resources --verbs=list --namespaced=true -o name | paste -sd, -) --ignore-not-found -n default