(Automated) 1.1.12 Ensure that the etcd data directory ownership is set to etcd:etcd (Automated) 1.1.19 Ensure that the Kubernetes PKI directory and file ownership is set to root:root (Automated) 1.1.20 Ensure to 644 or more restrictive (Automated) 1.1.2 Ensure that the API server pod specification file ownership is set to root:root (Automated) 1.1.3 Ensure that the controller manager pod specification file or more restrictive (Automated) 1.1.4 Ensure that the controller manager pod specification file ownership is set to root:root (Automated) 1.1.5 Ensure that the scheduler pod specification file permissions

in as arguments at container run time. 1.1.2 Ensure that the API server pod specification file ownership is set to root:root (Scored) Result: Not Applicable Remediation: RKE doesn’t require or maintain Self-Assessment Guide - v2.4 6 1.1.4 Ensure that the controller manager pod specification file ownership is set to root:root (Scored) Result: Not Applicable Remediation: RKE doesn’t require or maintain in as arguments at container run time. 1.1.6 Ensure that the scheduler pod specification file ownership is set to root:root (Scored) Result: Not Applicable Remediation: RKE doesn’t require or maintain

in as arguments at container run time. 1.1.2 Ensure that the API server pod specification file ownership is set to root:root (Scored) Result: Not Applicable Remediation: RKE doesn’t require or maintain Self-Assessment Guide - Rancher v2.5 6 1.1.4 Ensure that the controller manager pod specification file ownership is set to root:root (Scored) Result: Not Applicable Remediation: RKE doesn’t require or maintain in as arguments at container run time. 1.1.6 Ensure that the scheduler pod specification file ownership is set to root:root (Scored) Result: Not Applicable Remediation: RKE doesn’t require or maintain

permissions are set to 700 or more-restrictive (Scored) 1.4.12 - Ensure that the etcd data directory ownership is set to etcd:etcd (Scored) 2.1.8 - Ensure that the --hostname-override argument is not set cannot be used on the cluster, as it can interact poorly with certain Pod Security Policies Several system services (such as nginx-ingress ) utilize SecurityContext to switch users and assign capabilities option to map the audit log to the host filesystem. Audit logs should be collected and shipped off-system to guarantee their integrity. Audit docker inspect kube-apiserver | jq -e '.[0].Args[] | match

. . . . 50 3.3.3 “Description” tab . . . . . . . . . . . . . . . . . . . . . . . . . . 50 3.4 System settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51 3.4.1 “Motherboard” tab Advanced configuration for Windows guests . . . . . . . . . . . . . . . . 164 9.4.1 Automated Windows system preparation . . . . . . . . . . . . . 164 9.5 CPU hot-plugging . . . . . . . . . . . . . . . . . . . . . . . . 195 12.2.1 Guest shows IDE/SATA errors for file-based images on slow host file system . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 195 12.2.2 Responding to guest IDE/SATA

42 3.3.3 “Description” tab . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42 3.4 System settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43 3.4.1 “Motherboard” configuration for Windows guests . . . . . . . . . . . . . . . . . . . . 138 9.3.1 Automated Windows system preparation . . . . . . . . . . . . . . . . . 138 9.4 Advanced configuration for Linux and Solaris . . . . . . . . 168 12.2.1 Guest shows IDE/SATA errors for file-based images on slow host file system . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 168 12.2.2 Responding to guest

42 3.3.3 “Description” tab . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42 3.4 System settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43 3.4.1 “Motherboard” configuration for Windows guests . . . . . . . . . . . . . . . . . . . . 138 9.3.1 Automated Windows system preparation . . . . . . . . . . . . . . . . . 138 9.4 Advanced configuration for Linux and Solaris . . . . . . . . 167 12.2.1 Guest shows IDE/SATA errors for file-based images on slow host file system . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 167 12.2.2 Responding to guest

42 3.3.3 “Description” tab . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42 3.4 System settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43 3.4.1 “Motherboard” configuration for Windows guests . . . . . . . . . . . . . . . . . . . . 138 9.3.1 Automated Windows system preparation . . . . . . . . . . . . . . . . . 138 9.4 CPU hot-plugging . . . . . . . . . . . . . . . . . . . . 166 12.2.1 Guest shows IDE/SATA errors for file-based images on slow host file system . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 166 12.2.2 Responding to guest

41 3.3.3 “Description” tab . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41 3.4 System settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41 3.4.1 “Motherboard” configuration for Windows guests . . . . . . . . . . . . . . . . . . . . 133 9.3.1 Automated Windows system preparation . . . . . . . . . . . . . . . . . 133 9.4 CPU hot-plugging . . . . . . . . . . . . . . . . . . . . 163 12.2.1 Guest shows IDE/SATA errors for file-based images on slow host file system . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 163 12.2.2 Responding to guest

45 3.3.3 “Description” tab . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 45 3.4 System settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 46 3.4.1 “Motherboard” configuration for Windows guests . . . . . . . . . . . . . . . . . . . . 145 9.3.1 Automated Windows system preparation . . . . . . . . . . . . . . . . . 145 9.4 Advanced configuration for Linux and Solaris . . . . . . . . 180 12.2.1 Guest shows IDE/SATA errors for file-based images on slow host file system . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 180 12.2.2 Responding to guest