利用Kube-Bench对Kubernetes进行安全检测
利用Kube-Bench对Kubernetes进行安全检测1. 工具介绍
Kube-Bench是一个开源的Go语言工具，用于主动化查抄Kubernetes集群是否符合CIS Kubernetes基准。这些基准包括一系列关于Kubernetes配置和部署安全性的发起和最佳实践。
Kube-Bench实验了一系列针对Kubernetes组件（如kube-apiserver、etcd、kube-scheduler、kube-controller-manager等）的测试，来查抄它们是否按照CIS基准的推荐进行了配置。测试效果会被分类为PASS、FAIL或WARN，以清楚明白地显示哪些地方必要改进。
Kube-Bench是在运行时查抄Kubernetes环境的工具，它并不会修改系统。你可以定期运行kube-bench来审计你的Kubernetes环境，确保其保持在最佳的安全状态。
官方仓库：https://github.com/aquasecurity/kube-bench
2. CIS Kubernetes Benchmark支持
在Kubernetes环境中，CIS Kubernetes基准就是一套针对Kubernetes的安全配置最佳实践。例如，CIS Kubernetes基准会涵盖如何配置kubelet，如何限制API服务器上的权限等内容。
进入CIS（Center for Internet Security）官网可以下载Kubernetes Benchmark文件。
Kubernetes Benchmark、kube-bench config和Kubernetes配套关系如下：
SourceKubernetes Benchmarkkube-bench configKubernetes versionsCIS1.5.1cis-1.51.15CIS1.6.0cis-1.61.16-1.18CIS1.20cis-1.201.19-1.21CIS1.23cis-1.231.22-1.23CIS1.24cis-1.241.24CIS1.7cis-1.71.25CIS1.8cis-1.81.26CISGKE 1.0.0gke-1.0GKECISGKE 1.2.0gke-1.2.0GKECISEKS 1.0.1eks-1.0.1EKSCISEKS 1.1.0eks-1.1.0EKSCISEKS 1.2.0eks-1.2.0EKSCISACK 1.0.0ack-1.0ACKCISAKS 1.0.0aks-1.0AKSRHELRedHat OpenShift hardening guiderh-0.7OCP 3.10-3.11CISOCP4 1.1.0rh-1.0OCP 4.1-CIS1.6.0-k3scis-1.6-k3sk3s v1.16-v1.24DISAKubernetes Ver 1, Rel 6eks-stig-kubernetes-v1r6EKSCISTKGI 1.2.53tkgi-1.2.53vmwareCIS1.7.0-rkerke-cis-1.7rke v1.25-v1.27CIS1.7.0-rke2rke2-cis-1.6rke2 v1.25-v1.27CIS1.7.0-k3sk3s-cis-1.7k3s v1.25-v1.27 最新信息请访问 CIS Kubernetes Benchmark support 查看。
默认配置下，Kube-Bench将根据目标设备上运行的Kubernete版原来确定要运行的测试集。
3. 工具安装
3.1 二进制安装
下载地点：https://github.com/aquasecurity/kube-bench/releases
# wget https://github.com/aquasecurity/kube-bench/releases/download/v0.7.3/kube-bench_0.7.3_linux_amd64.tar.gz
# mkdir /opt/kube-bench
# 将二进制文件解压到创建的目录
# tar xf kube-bench_0.7.3_linux_amd64.tar.gz -C /opt/kube-bench/
# 查看文件内容
# cd /opt/kube-bench/
# ls
cfgkube-bench
# ls cfg/
ack-1.0 cis-1.24 cis-1.6-k3seks-1.0.1 gke-1.0 k3s-cis-1.7 rke2-cis-1.24rke-cis-1.7
aks-1.0 cis-1.24-microk8scis-1.7 eks-1.1.0 gke-1.2.0 rh-0.7 rke2-cis-1.7 tkgi-1.2.53
cis-1.20cis-1.5 cis-1.8 eks-1.2.0 k3s-cis-1.23rh-1.0 rke-cis-1.23
cis-1.23cis-1.6 config.yamleks-stig-kubernetes-v1r6k3s-cis-1.24rke2-cis-1.23rke-cis-1.24
# cd cis-1.8/
# 各个组件yaml文件记录了需要检测的详细信息
# ls
config.yamlcontrolplane.yamletcd.yamlmaster.yamlnode.yamlpolicies.yaml
cfg/config.yaml包含了相关测试组件配置、配置文件路径、K8S版本和CIS标准映射等。如果k8s的某些配置文件自定义到了非默认的目次，修改config.yaml里的相应目次就行。
# cat cfg/config.yaml
---
## Controls Files.
# These are YAML files that hold all the details for running checks.
#
## Uncomment to use different control file paths.
# masterControls: ./cfg/master.yaml
# nodeControls: ./cfg/node.yaml
master:
components:
- apiserver
- scheduler
- controllermanager
- etcd
- flanneld
# kubernetes is a component to cover the config file /etc/kubernetes/config that is referred to in the benchmark
- kubernetes
- kubelet
kubernetes:
defaultconf: /etc/kubernetes/config
apiserver:
bins:
- "kube-apiserver"
- "hyperkube apiserver"
- "hyperkube kube-apiserver"
- "apiserver"
- "openshift start master api"
- "hypershift openshift-kube-apiserver"
confs:
- /etc/kubernetes/manifests/kube-apiserver.yaml
- /etc/kubernetes/manifests/kube-apiserver.yml
- /etc/kubernetes/manifests/kube-apiserver.manifest
- /var/snap/kube-apiserver/current/args
- /var/snap/microk8s/current/args/kube-apiserver
- /etc/origin/master/master-config.yaml
- /etc/kubernetes/manifests/talos-kube-apiserver.yaml
- /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml
defaultconf: /etc/kubernetes/manifests/kube-apiserver.yaml
scheduler:
bins:
- "kube-scheduler"
...
node:
components:
- kubelet
- proxy
# kubernetes is a component to cover the config file /etc/kubernetes/config that is referred to in the benchmark
- kubernetes
kubernetes:
defaultconf: "/etc/kubernetes/config"
kubelet:
cafile:
- "/etc/kubernetes/pki/ca.crt"
- "/etc/kubernetes/certs/ca.crt"
- "/etc/kubernetes/cert/ca.pem"
- "/var/snap/microk8s/current/certs/ca.crt"
- "/var/lib/rancher/rke2/agent/server.crt"
- "/var/lib/rancher/rke2/agent/client-ca.crt"
- "/var/lib/rancher/k3s/agent/client-ca.crt"
...
etcd:
components:
- etcd
etcd:
bins:
- "etcd"
datadirs:
- /var/lib/etcd/default.etcd
- /var/lib/etcd/data.etcd
confs:
- /etc/kubernetes/manifests/etcd.yaml
- /etc/kubernetes/manifests/etcd.yml
...
controlplane:
components:
- apiserver
apiserver:
bins:
- "kube-apiserver"
- "hyperkube apiserver"
- "hyperkube kube-apiserver"
- "apiserver"
policies:
components: []
managedservices:
components: []
version_mapping:
"1.15": "cis-1.5"
"1.16": "cis-1.6"
...
target_mapping:
"cis-1.5":
- "master"
- "node"
- "controlplane"
- "etcd"
- "policies"
...
3.2 源码安装
工具利用go语言开发，实验如下步骤进行源码安装：
# 安装go
yum install go
# 配置go国内镜像源
go env -w GO111MODULE=on
go env -w GOPROXY=https://goproxy.cn,direct
go install github.com/aquasecurity/kube-bench@latest
#安装成功后位于当前用户的go目录下
/root/go/bin
./kube-bench --help
# Run all checks
./kube-bench
4. 运行kube-bench检测
kube-bench支持etcd组件、master节点、node节点等检测。命令运行语法：
./kube-bench --config-dir <配置目次> --config <配置文件> run --targets=<必要检测的组件>
本文测试的K8S环境如下：
# CPU架构
# lscpu | grep 架构
架构： x86_64
# K8S集群信息，master节点同时也承担worker节点的角色
# kubectl get nodes
NAME STATUS ROLES AGE VERSION
master1 Ready control-plane,master 44d v1.27.6
master2 Ready control-plane,master 44d v1.27.6
master3 Ready control-plane,master 44d v1.27.6
# K8S版本为1.27.6
# kubectl version
WARNING: This version information is deprecated and will be replaced with the output from kubectl version --short.Use --output=yaml|json to get the full version.
Client Version: version.Info{Major:"1", Minor:"27", GitVersion:"v1.27.6", GitCommit:"741c8db18a52787d734cbe4795f0b4ad860906d6", GitTreeState:"clean", BuildDate:"2023-09-13T09:21:34Z", GoVersion:"go1.20.8", Compiler:"gc", Platform:"linux/amd64"}
Kustomize Version: v5.0.1
Server Version: version.Info{Major:"1", Minor:"27", GitVersion:"v1.27.6", GitCommit:"741c8db18a52787d734cbe4795f0b4ad860906d6", GitTreeState:"clean", BuildDate:"2023-09-13T09:14:09Z", GoVersion:"go1.20.8", Compiler:"gc", Platform:"linux/amd64"}
# 操作系统为openEuler
# cat /etc/openEuler-latest
openeulerversion=openEuler-22.03-LTS
compiletime=2022-03-30-16-23-56
gccversion=10.3.1-10.oe2203
kernelversion=5.10.0-60.18.0.50.oe2203
openjdkversion=1.8.0.312.b07-11.oe2203
4.1 kube-bench检测etcd组件
# ./kube-bench --config-dir ./cfg/ --config ./cfg/config.yaml run --targets=etcd
2 Etcd Node Configuration
2 Etcd Node Configuration
2.1 Ensure that the --cert-file and --key-file arguments are set as appropriate (Automated)
2.2 Ensure that the --client-cert-auth argument is set to true (Automated)
2.3 Ensure that the --auto-tls argument is not set to true (Automated)
2.4 Ensure that the --peer-cert-file and --peer-key-file arguments are set as appropriate (Automated)
2.5 Ensure that the --peer-client-cert-auth argument is set to true (Automated)
2.6 Ensure that the --peer-auto-tls argument is not set to true (Automated)
2.7 Ensure that a unique Certificate Authority is used for etcd (Manual)
== Remediations etcd ==
2.1 Follow the etcd service documentation and configure TLS encryption.
Then, edit the etcd pod specification file /etc/kubernetes/manifests/etcd.yaml
on the master node and set the below parameters.
--cert-file=</path/to/ca-file>
--key-file=</path/to/key-file>
2.2 Edit the etcd pod specification file /etc/kubernetes/manifests/etcd.yaml on the master
node and set the below parameter.
--client-cert-auth="true"
2.4 Follow the etcd service documentation and configure peer TLS encryption as appropriate
for your etcd cluster.
Then, edit the etcd pod specification file /etc/kubernetes/manifests/etcd.yaml on the
master node and set the below parameters.
--peer-client-file=</path/to/peer-cert-file>
--peer-key-file=</path/to/peer-key-file>
2.5 Edit the etcd pod specification file /etc/kubernetes/manifests/etcd.yaml on the master
node and set the below parameter.
--peer-client-cert-auth=true
2.7
Follow the etcd documentation and create a dedicated certificate authority setup for the
etcd service.
Then, edit the etcd pod specification file /etc/kubernetes/manifests/etcd.yaml on the
master node and set the below parameter.
--trusted-ca-file=</path/to/ca-file>
== Summary etcd ==
2 checks PASS
4 checks FAIL
1 checks WARN
0 checks INFO
== Summary total ==
2 checks PASS
4 checks FAIL
1 checks WARN
0 checks INFO
根据汇总效果，检测出4个Fail，1个Warn，打印效果给出了相应的具体问题说明和解决方法。
4.2 kube-bench检测master节点
# ./kube-bench --config-dir ./cfg/ --config ./cfg/config.yaml run --targets=master
1 Control Plane Security Configuration
1.1 Control Plane Node Configuration Files
1.1.1 Ensure that the API server pod specification file permissions are set to 600 or more restrictive (Automated)
1.1.2 Ensure that the API server pod specification file ownership is set to root:root (Automated)
1.1.3 Ensure that the controller manager pod specification file permissions are set to 600 or more restrictive (Automated)
1.1.4 Ensure that the controller manager pod specification file ownership is set to root:root (Automated)
1.1.5 Ensure that the scheduler pod specification file permissions are set to 600 or more restrictive (Automated)
1.1.6 Ensure that the scheduler pod specification file ownership is set to root:root (Automated)
1.1.7 Ensure that the etcd pod specification file permissions are set to 600 or more restrictive (Automated)
1.1.8 Ensure that the etcd pod specification file ownership is set to root:root (Automated)
1.1.9 Ensure that the Container Network Interface file permissions are set to 600 or more restrictive (Manual)
1.1.10 Ensure that the Container Network Interface file ownership is set to root:root (Manual)
1.1.11 Ensure that the etcd data directory permissions are set to 700 or more restrictive (Automated)
1.1.12 Ensure that the etcd data directory ownership is set to etcd:etcd (Automated)
1.1.13 Ensure that the admin.conf file permissions are set to 600 or more restrictive (Automated)
1.1.14 Ensure that the admin.conf file ownership is set to root:root (Automated)
1.1.15 Ensure that the scheduler.conf file permissions are set to 600 or more restrictive (Automated)
1.1.16 Ensure that the scheduler.conf file ownership is set to root:root (Automated)
1.1.17 Ensure that the controller-manager.conf file permissions are set to 600 or more restrictive (Automated)
1.1.18 Ensure that the controller-manager.conf file ownership is set to root:root (Automated)
1.1.19 Ensure that the Kubernetes PKI directory and file ownership is set to root:root (Automated)
1.1.20 Ensure that the Kubernetes PKI certificate file permissions are set to 600 or more restrictive (Manual)
1.1.21 Ensure that the Kubernetes PKI key file permissions are set to 600 (Manual)
1.2 API Server
1.2.1 Ensure that the --anonymous-auth argument is set to false (Manual)
1.2.2 Ensure that the --token-auth-file parameter is not set (Automated)
1.2.3 Ensure that the --DenyServiceExternalIPs is set (Manual)
1.2.4 Ensure that the --kubelet-client-certificate and --kubelet-client-key arguments are set as appropriate (Automated)
1.2.5 Ensure that the --kubelet-certificate-authority argument is set as appropriate (Automated)
1.2.6 Ensure that the --authorization-mode argument is not set to AlwaysAllow (Automated)
1.2.7 Ensure that the --authorization-mode argument includes Node (Automated)
1.2.8 Ensure that the --authorization-mode argument includes RBAC (Automated)
1.2.9 Ensure that the admission control plugin EventRateLimit is set (Manual)
1.2.10 Ensure that the admission control plugin AlwaysAdmit is not set (Automated)
1.2.11 Ensure that the admission control plugin AlwaysPullImages is set (Manual)
1.2.12 Ensure that the admission control plugin SecurityContextDeny is set if PodSecurityPolicy is not used (Manual)
1.2.13 Ensure that the admission control plugin ServiceAccount is set (Automated)
1.2.14 Ensure that the admission control plugin NamespaceLifecycle is set (Automated)
1.2.15 Ensure that the admission control plugin NodeRestriction is set (Automated)
1.2.16 Ensure that the --profiling argument is set to false (Automated)
1.2.17 Ensure that the --audit-log-path argument is set (Automated)
1.2.18 Ensure that the --audit-log-maxage argument is set to 30 or as appropriate (Automated)
1.2.19 Ensure that the --audit-log-maxbackup argument is set to 10 or as appropriate (Automated)
1.2.20 Ensure that the --audit-log-maxsize argument is set to 100 or as appropriate (Automated)
1.2.21 Ensure that the --request-timeout argument is set as appropriate (Manual)
1.2.22 Ensure that the --service-account-lookup argument is set to true (Automated)
1.2.23 Ensure that the --service-account-key-file argument is set as appropriate (Automated)
1.2.24 Ensure that the --etcd-certfile and --etcd-keyfile arguments are set as appropriate (Automated)
1.2.25 Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate (Automated)
1.2.26 Ensure that the --client-ca-file argument is set as appropriate (Automated)
1.2.27 Ensure that the --etcd-cafile argument is set as appropriate (Automated)
1.2.28 Ensure that the --encryption-provider-config argument is set as appropriate (Manual)
1.2.29 Ensure that encryption providers are appropriately configured (Manual)
1.2.30 Ensure that the API Server only makes use of Strong Cryptographic Ciphers (Manual)
1.3 Controller Manager
1.3.1 Ensure that the --terminated-pod-gc-threshold argument is set as appropriate (Manual)
1.3.2 Ensure that the --profiling argument is set to false (Automated)
1.3.3 Ensure that the --use-service-account-credentials argument is set to true (Automated)
1.3.4 Ensure that the --service-account-private-key-file argument is set as appropriate (Automated)
1.3.5 Ensure that the --root-ca-file argument is set as appropriate (Automated)
1.3.6 Ensure that the RotateKubeletServerCertificate argument is set to true (Automated)
1.3.7 Ensure that the --bind-address argument is set to 127.0.0.1 (Automated)
1.4 Scheduler
1.4.1 Ensure that the --profiling argument is set to false (Automated)
1.4.2 Ensure that the --bind-address argument is set to 127.0.0.1 (Automated)
== Remediations master ==
1.1.7 Run the below command (based on the file location on your system) on the control plane node.
For example,
chmod 600 /etc/kubernetes/manifests/etcd.yaml
1.1.8 Run the below command (based on the file location on your system) on the control plane node.
For example,
chown root:root /etc/kubernetes/manifests/etcd.yaml
1.1.9 Run the below command (based on the file location on your system) on the control plane node.
For example, chmod 600 <path/to/cni/files>
1.1.10 Run the below command (based on the file location on your system) on the control plane node.
For example,
chown root:root <path/to/cni/files>
1.1.12 On the etcd server node, get the etcd data directory, passed as an argument --data-dir,
from the command 'ps -ef | grep etcd'.
Run the below command (based on the etcd data directory found above).
For example, chown etcd:etcd /var/lib/etcd
1.1.13 Run the below command (based on the file location on your system) on the control plane node.
For example, chmod 600 /etc/kubernetes/admin.conf
1.1.15 Run the below command (based on the file location on your system) on the control plane node.
For example,
chmod 600 /etc/kubernetes/scheduler.conf
1.1.17 Run the below command (based on the file location on your system) on the control plane node.
For example,
chmod 600 /etc/kubernetes/controller-manager.conf
1.1.20 Run the below command (based on the file location on your system) on the control plane node.
For example,
chmod -R 600 /etc/kubernetes/pki/*.crt
1.1.21 Run the below command (based on the file location on your system) on the control plane node.
For example,
chmod -R 600 /etc/kubernetes/pki/*.key
1.2.1 Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml
on the control plane node and set the below parameter.
--anonymous-auth=false
1.2.3 Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml
on the control plane node and remove the `DenyServiceExternalIPs`
from enabled admission plugins.
1.2.5 Follow the Kubernetes documentation and setup the TLS connection between
the apiserver and kubelets. Then, edit the API server pod specification file
/etc/kubernetes/manifests/kube-apiserver.yaml on the control plane node and set the
--kubelet-certificate-authority parameter to the path to the cert file for the certificate authority.
--kubelet-certificate-authority=<ca-string>
1.2.9 Follow the Kubernetes documentation and set the desired limits in a configuration file.
Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml
and set the below parameters.
--enable-admission-plugins=...,EventRateLimit,...
--admission-control-config-file=<path/to/configuration/file>
1.2.11 Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml
on the control plane node and set the --enable-admission-plugins parameter to include
AlwaysPullImages.
--enable-admission-plugins=...,AlwaysPullImages,...
1.2.12 Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml
on the control plane node and set the --enable-admission-plugins parameter to include
SecurityContextDeny, unless PodSecurityPolicy is already in place.
--enable-admission-plugins=...,SecurityContextDeny,...
1.2.16 Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml
on the control plane node and set the below parameter.
--profiling=false
1.2.17 Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml
on the control plane node and set the --audit-log-path parameter to a suitable path and
file where you would like audit logs to be written, for example,
--audit-log-path=/var/log/apiserver/audit.log
1.2.18 Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml
on the control plane node and set the --audit-log-maxage parameter to 30
or as an appropriate number of days, for example,
--audit-log-maxage=30
1.2.19 Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml
on the control plane node and set the --audit-log-maxbackup parameter to 10 or to an appropriate
value. For example,
--audit-log-maxbackup=10
1.2.20 Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml
on the control plane node and set the --audit-log-maxsize parameter to an appropriate size in MB.
For example, to set it as 100 MB, --audit-log-maxsize=100
1.2.21 Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml
and set the below parameter as appropriate and if needed.
For example, --request-timeout=300s
1.2.28 Follow the Kubernetes documentation and configure a EncryptionConfig file.
Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml
on the control plane node and set the --encryption-provider-config parameter to the path of that file.
For example, --encryption-provider-config=</path/to/EncryptionConfig/File>
1.2.29 Follow the Kubernetes documentation and configure a EncryptionConfig file.
In this file, choose aescbc, kms or secretbox as the encryption provider.
1.3.1 Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml
on the control plane node and set the --terminated-pod-gc-threshold to an appropriate threshold,
for example, --terminated-pod-gc-threshold=10
1.3.2 Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml
on the control plane node and set the below parameter.
--profiling=false
1.4.1 Edit the Scheduler pod specification file /etc/kubernetes/manifests/kube-scheduler.yaml file
on the control plane node and set the below parameter.
--profiling=false
== Summary master ==
33 checks PASS
14 checks FAIL
13 checks WARN
0 checks INFO
== Summary total ==
33 checks PASS
14 checks FAIL
13 checks WARN
0 checks INFO
检测到14个Fail，可以根据给出的修补方案进行修改。
4.3 kube-bench检测worker节点
# ./kube-bench --config-dir ./cfg/ --config ./cfg/config.yaml run --targets=node
4 Worker Node Security Configuration
4.1 Worker Node Configuration Files
4.1.1 Ensure that the kubelet service file permissions are set to 600 or more restrictive (Automated)
4.1.2 Ensure that the kubelet service file ownership is set to root:root (Automated)
4.1.3 If proxy kubeconfig file exists ensure permissions are set to 600 or more restrictive (Manual)
4.1.4 If proxy kubeconfig file exists ensure ownership is set to root:root (Manual)
4.1.5 Ensure that the --kubeconfig kubelet.conf file permissions are set to 600 or more restrictive (Automated)
4.1.6 Ensure that the --kubeconfig kubelet.conf file ownership is set to root:root (Automated)
4.1.7 Ensure that the certificate authorities file permissions are set to 600 or more restrictive (Manual)
4.1.8 Ensure that the client certificate authorities file ownership is set to root:root (Manual)
4.1.9 If the kubelet config.yaml configuration file is being used validate permissions set to 600 or more restrictive (Automated)
4.1.10 If the kubelet config.yaml configuration file is being used validate file ownership is set to root:root (Automated)
4.2 Kubelet
4.2.1 Ensure that the --anonymous-auth argument is set to false (Automated)
4.2.2 Ensure that the --authorization-mode argument is not set to AlwaysAllow (Automated)
4.2.3 Ensure that the --client-ca-file argument is set as appropriate (Automated)
4.2.4 Verify that the --read-only-port argument is set to 0 (Manual)
4.2.5 Ensure that the --streaming-connection-idle-timeout argument is not set to 0 (Manual)
4.2.6 Ensure that the --make-iptables-util-chains argument is set to true (Automated)
4.2.7 Ensure that the --hostname-override argument is not set (Manual)
4.2.8 Ensure that the eventRecordQPS argument is set to a level which ensures appropriate event capture (Manual)
4.2.9 Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate (Manual)
4.2.10 Ensure that the --rotate-certificates argument is not set to false (Automated)
4.2.11 Verify that the RotateKubeletServerCertificate argument is set to true (Manual)
4.2.12 Ensure that the Kubelet only makes use of Strong Cryptographic Ciphers (Manual)
4.2.13 Ensure that a limit is set on pod PIDs (Manual)
== Remediations node ==
4.1.1 Run the below command (based on the file location on your system) on the each worker node.
For example, chmod 600 /etc/systemd/system/kubelet.service.d/10-kubeadm.conf
4.1.3 Run the below command (based on the file location on your system) on the each worker node.
For example,
chmod 600 /etc/kubernetes/proxy.conf
4.1.4 Run the below command (based on the file location on your system) on the each worker node.
For example, chown root:root /etc/kubernetes/proxy.conf
4.1.7 Run the following command to modify the file permissions of the
--client-ca-file chmod 600 <filename>
4.1.9 Run the following command (using the config file location identified in the Audit step)
chmod 600 /var/lib/kubelet/config.yaml
4.2.9 If using a Kubelet config file, edit the file to set `tlsCertFile` to the location
of the certificate file to use to identify this Kubelet, and `tlsPrivateKeyFile`
to the location of the corresponding private key file.
If using command line arguments, edit the kubelet service file
/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and
set the below parameters in KUBELET_CERTIFICATE_ARGS variable.
--tls-cert-file=<path/to/tls-certificate-file>
--tls-private-key-file=<path/to/tls-key-file>
Based on your system, restart the kubelet service. For example,
systemctl daemon-reload
systemctl restart kubelet.service
4.2.12 If using a Kubelet config file, edit the file to set `TLSCipherSuites` to
TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256
or to a subset of these values.
If using executable arguments, edit the kubelet service file
/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and
set the --tls-cipher-suites parameter as follows, or to a subset of these values.
--tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256
Based on your system, restart the kubelet service. For example:
systemctl daemon-reload
systemctl restart kubelet.service
4.2.13 Decide on an appropriate level for this parameter and set it,
either via the --pod-max-pids command line parameter or the PodPidsLimit configuration file setting.
== Summary node ==
15 checks PASS
2 checks FAIL
6 checks WARN
0 checks INFO
== Summary total ==
15 checks PASS
2 checks FAIL
6 checks WARN
0 checks INFO
检测到2个Fail，可以根据给出的修补方案进行修改。
4.4 实验全部检测
# 不加targets执行全部检测
# ./kube-bench --config-dir ./cfg/ --config ./cfg/config.yaml run
4.5 手动设置不安全的参数进行检测
可以手动构造不安全的设置，利用工具进行检测：
[*] 构造etcd不安全设置，将/etc/kubernetes/manifests/etcd.yaml文件里的client-cert-auth=true改为client-cert-auth=false。
[*] 构造kube-apiserver不安全设置，将/etc/kubernetes/manifests/kube-apiserver.yaml文件里的authorization-mode授权模式改为AlwaysAllow。
修改后重启kubelet使配置见效，然后利用kube-bench检测是否能检测到，具体操作查看文末的参考资料。
5. 总结
kube-bench是一款强大的工具，它可以资助我们发现哪些Kubernetes配置没有遵循CIS的最佳实践，从而改正这些问题，加强我们的Kubernetes集群的安全性。虽然kube-bench不能捕获全部可能的安全问题，但它至少可以资助我们消除最常见的一些安全毛病。
6. 问题记录
[*]Centos7.9 K8S 环境下面运行kube-bench遇到glibc配套问题，必要更新系统的glibc版本到2.32，由于更新glibc可能造成系统不稳固，改换了系统进行测试。
# ./kube-bench --config-dir `pwd`/cfg --config `pwd`/cfg/config.yaml run --targets=etcd
./kube-bench: /lib64/libc.so.6: version `GLIBC_2.32' not found (required by ./kube-bench)
./kube-bench: /lib64/libc.so.6: version `GLIBC_2.34' not found (required by ./kube-bench)
7. 参考资料
https://www.cnblogs.com/renshengdezheli/p/17640119.html
免责声明：如果侵犯了您的权益，请联系站长，我们会及时删除侵权内容，谢谢合作！更多信息从访问主页：qidao123.com:ToB企服之家，中国第一个企服评测及商务社交产业平台。
页:
[1]