CIS Benchmark v1.5

    CIS Benchmark v1.5 Not Applicable Tests

    NumberDescriptionReason for being not applicable
    1.1.1Ensure that the API server pod specification file permissions are set to 644 or more restrictive (Scored)Clusters provisioned by RKE doesn’t require or maintain a configuration file for kube-apiserver. All configuration is passed in as arguments at container run time.
    1.1.2Ensure that the API server pod specification file ownership is set to root:root (Scored)Clusters provisioned by RKE doesn’t require or maintain a configuration file for kube-apiserver. All configuration is passed in as arguments at container run time.
    1.1.3Ensure that the controller manager pod specification file permissions are set to 644 or more restrictive (Scored)Clusters provisioned by RKE doesn’t require or maintain a configuration file for controller-manager. All configuration is passed in as arguments at container run time.
    1.1.4Ensure that the controller manager pod specification file ownership is set to root:root (Scored)Clusters provisioned by RKE doesn’t require or maintain a configuration file for controller-manager. All configuration is passed in as arguments at container run time.
    1.1.5Ensure that the scheduler pod specification file permissions are set to 644 or more restrictive (Scored)Clusters provisioned by RKE doesn’t require or maintain a configuration file for scheduler. All configuration is passed in as arguments at container run time.
    1.1.6Ensure that the scheduler pod specification file ownership is set to root:root (Scored)Clusters provisioned by RKE doesn’t require or maintain a configuration file for scheduler. All configuration is passed in as arguments at container run time.
    1.1.7Ensure that the etcd pod specification file permissions are set to 644 or more restrictive (Scored)Clusters provisioned by RKE doesn’t require or maintain a configuration file for etcd. All configuration is passed in as arguments at container run time.
    1.1.8Ensure that the etcd pod specification file ownership is set to root:root (Scored)Clusters provisioned by RKE doesn’t require or maintain a configuration file for etcd. All configuration is passed in as arguments at container run time.
    1.1.13Ensure that the admin.conf file permissions are set to 644 or more restrictive (Scored)Clusters provisioned by RKE does not store the kubernetes default kubeconfig credentials file on the nodes.
    1.1.14Ensure that the admin.conf file ownership is set to root:root (Scored)Clusters provisioned by RKE does not store the kubernetes default kubeconfig credentials file on the nodes.
    1.1.15Ensure that the scheduler.conf file permissions are set to 644 or more restrictive (Scored)Clusters provisioned by RKE doesn’t require or maintain a configuration file for scheduler. All configuration is passed in as arguments at container run time.
    1.1.16Ensure that the scheduler.conf file ownership is set to root:root (Scored)Clusters provisioned by RKE doesn’t require or maintain a configuration file for scheduler. All configuration is passed in as arguments at container run time.
    1.1.17Ensure that the controller-manager.conf file permissions are set to 644 or more restrictive (Scored)Clusters provisioned by RKE doesn’t require or maintain a configuration file for controller-manager. All configuration is passed in as arguments at container run time.
    1.1.18Ensure that the controller-manager.conf file ownership is set to root:root (Scored)Clusters provisioned by RKE doesn’t require or maintain a configuration file for controller-manager. All configuration is passed in as arguments at container run time.
    1.3.6Ensure that the RotateKubeletServerCertificate argument is set to true (Scored)Clusters provisioned by RKE handles certificate rotation directly through RKE.
    4.1.1Ensure that the kubelet service file permissions are set to 644 or more restrictive (Scored)Clusters provisioned by RKE doesn’t require or maintain a configuration file for the kubelet service. All configuration is passed in as arguments at container run time.
    4.1.2Ensure that the kubelet service file ownership is set to root:root (Scored)Clusters provisioned by RKE doesn’t require or maintain a configuration file for the kubelet service. All configuration is passed in as arguments at container run time.
    4.1.9Ensure that the kubelet configuration file has permissions set to 644 or more restrictive (Scored)Clusters provisioned by RKE doesn’t require or maintain a configuration file for the kubelet. All configuration is passed in as arguments at container run time.
    4.1.10Ensure that the kubelet configuration file ownership is set to root:root (Scored)Clusters provisioned by RKE doesn’t require or maintain a configuration file for the kubelet. All configuration is passed in as arguments at container run time.
    4.2.12Ensure that the RotateKubeletServerCertificate argument is set to true (Scored)Clusters provisioned by RKE handles certificate rotation directly through RKE.