command (based on the etcd data directory found above). For example, chmod 700 /var/lib/etcd Audit: stat -c %a /node/var/lib/etcd Expected Result: '700' is equal to '700' Returned Value: 700 1.1 Run the below command (based on the etcd data directory found above). For example, chown etcd:etcd /var/lib/etcd A system service account is required for etcd data directory ownership. Refer to Rancher's hardening guide for more details on how to configure this ownership. Audit: stat -c %U:%G /node/var/lib/etcd CIS 1.6 Benchmark - Self-Assessment Guide - Rancher v2.5.4 10 Expected Result: 'etcd:etcd'

kube-apiserver | jq -e '.[0].Args[] | match("--audit-log-path=/var/log/kube-audit/audit-log.json").string' Returned Value: --audit-log-log=/var/log/kube-audit/audit-log.json Result: Pass 1.1.16 - Ensure check. Audit ( /var/lib/cni/networks/k8s-pod-network ) Note This may return a lockfile. Permissions on this file do not need to be as restrictive as the CNI files. stat -c "%n - %a" /var/lib/cni/netw Returned Value: /var/lib/cni/networks/k8s-pod-network/10.42.0.2 - 644 /var/lib/cni/networks/k8s-pod-network/10.42.0.3 - 644 /var/lib/cni/networks/k8s-pod-network/last_reserved_ip.0 - 644 /var/lib/cni/netw

etcd Run the below command (based on the etcd data directory found above). For example, chmod 700 /var/lib/etcd Audit Script: 1.1.11.sh #!/bin/bash -e etcd_bin=${1} test_dir=$(ps -ef | grep ${etcd_bin} Run the below command (based on the etcd data directory found above). For example, chown etcd:etcd /var/lib/etcd Audit Script: 1.1.12.sh #!/bin/bash -e etcd_bin=${1} test_dir=$(ps -ef | grep ${etcd_bin} suitable path and file where you would like audit logs to be written, for example: --audit-log-path=/var/log/apiserver/audit.log Audit: /bin/ps -ef | grep kube-apiserver | grep -v grep Expected result:

etcd Run the below command (based on the etcd data directory found above). For example, chmod 700 /var/lib/etcd Audit Script: 1.1.11.sh #!/bin/bash -e etcd_bin=${1} test_dir=$(ps -ef | grep ${etcd_bin} Run the below command (based on the etcd data directory found above). For example, chown etcd:etcd /var/lib/etcd Audit Script: 1.1.12.sh #!/bin/bash -e etcd_bin=${1} test_dir=$(ps -ef | grep ${etcd_bin} suitable path and file where you would like audit logs to be written, for example: --audit-log-path=/var/log/apiserver/audit.log Audit: /bin/ps -ef | grep kube-apiserver | grep -v grep Expected result:

e d on t h e e t c d d at a d i r e c t or y f ou n d ab ov e ) . F or e x am p l e , stat -c %a /var/lib/etcd Ve r i f y t h at t h e p e r m i s s i on s ar e 700 or m or e r e s t r i c t i v e . on t h e e t c d d at a d i r e c t or y f ou n d ab ov e ) . F or e x am p l e , stat -c %U:%G /var/lib/etcd Ve r i f y t h at t h e ow n e r s h i p i s s e t t o etcd:etcd. R e m e d i at i on • • O n t h e e t c d s e r v e r n od e ( s ) ad d t h e etcd u s e r : useradd -c "Etcd user" -d /var/lib/etcd etcd R e c or d t h e u i d /gi d : id etcd • Ad d t h e f ol l ow i n g t o t h e R K

ncryption.yaml --admission-control-config-file=/etc/kubernetes/admission.yaml --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxage=5 --audit-log-maxbackup=5 Rancher_Hardening_Guide es/audit.yaml In the volume section of the output ensure the bind mount is present: /var/log/kube-audit:/var/log/kube-audit Remediation In the RKE cluster.yml add the following directives to the yaml admission-control-config-file: "/etc/kubernetes/admission.yaml" audit-log-path: "/var/log/kube-audit/audit-log.json" audit-log-maxage: "5" audit-log-maxbackup: "5"

node $ sudo mkdir -p /var/lib/rancher/rke2/server/manifests $ cd /var/lib/rancher/rke2/server/manifests Then create the le rancher-vsphere-cpi-config.yaml in the directory. /var/lib/rancher/rke2/server/manifests In the same directory, the le rancher-vsphere-csi-config.yaml will be created. $ cat < /var/lib/rancher/rke2/server/manifests/rancher-vsphere-csi-config.yaml apiVersion: helm.cattle.io/v1 kind:

bernetes:1.7.1-4 env: - name: KUBERNETES_CA_CERTIFICATE_FILE value: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt - name: NAMESPACE valueFrom: volumeMounts: - mountPath: "/var/run/docker.sock" name: dockersock volumes: - hostPath: path: "/var/run/docker.sock" name: "dockersock"

your default path. For convenience, Rancher provides the kubectl binary at the location shown. cp /var/lib/rancher/rke2/bin/kubectl /usr/local/bin 6. Show the status of the pods. kubectl get pods -A -o is the IP address of the server (control plane) node. The server_node_token is the token found in /var/lib/rancher/rke2/server/node-token on the server node. 3. Install, enable, and start the rke2-agent

# # Cluster Config # default_pod_security_policy_template_id: restricted docker_root_dir: /var/lib/docker enable_cluster_alerting: false enable_cluster_monitoring: false enable_network_policy: