Closed cwrx777 closed 2 weeks ago
Audit RotateKubelet feature) Look at the upstream docs, once we pass it off to Kubelet we have no control over it. https://kubernetes.io/docs/tasks/tls/certificate-rotation/
1.1.13) This is an error, it seems to be a legacy bug in the CIS scans for K3s when they originally were copied over from RKE1. That test is applicable and we already pass it. I will update the docs and scans. Here is the current results on v1.28.11+k3s1
root@server-0:/home/vagrant# /bin/sh -c 'if test -e /var/lib/rancher/k3s/server/cred/admin.kubeconfig; then stat -c permissions=%a /var/lib/rancher/k3s/server/cred/admin.kubeconfig; fi'
permissions=600
4.1.9 / 4.1.10)
You should look at the audit
section of the docs pages, that shows you the actual command being run on the system to check for each of these tests. In this case it is /var/lib/rancher/k3s/agent/kubelet.kubeconfig
4.2.5-4.2.12) Something appears wrong with the audit and all theses test in the docs. There are discrepancies between cis1.8 and cis-1.7 that are incorrect. I know that we some pass these, I will go back and edit and ensure that the cis scans and docs are correctly displaying the results.
4.2.13) This is a manual change you will have to perform. What limit you set is your choice. You can set this in the K3s config file with:
#/etc/rancher/k3s/config.yaml
kubelet-arg:
- "pod-max-pids=XXX"
Related issue: Previous conversation in k3s-io/k3s#10458
Hi @dereknola Thank you for answering my questions. I have additoinal questions.
how do I audit that
RotateKubeletServerCertificate
feature is enabled?Additional questions:
Not Applicable
? isn't it just changing the file permission to 600?My worker node is run using the following
config.yaml
:k3s-agent.service
:kubelet --config configuration file
refer tokubelet.kubeconfig
?/var/lib/rancher/k3s/agent/kubelet.kubeconfig
kubelet.kubeconfig
:pod-pids
supposed to be set? I dont see that this is set in the kubelet CLI arguments.