CIS 1.11 自我评估指南

概述

本文档是 RKE2 安全强化指南的补充。安全强化指南为 RKE2 生产环境的安装加固提供了具体指导，而本基准指南旨在帮助您依据 CIS Kubernetes 基准中的每项控制评估加固集群的安全级别。它供 RKE2 操作员、安全团队、审计员和决策者使用。

本指南专用于 RKE2 的 v1.29-1.34 版本线以及 CIS Kubernetes 基准的 v1.11 版本。

关于每项控制的更多信息，包括详细的理由和检查描述，您可以参考 CIS Kubernetes 基准 v1.8 的相应章节。您可以在互联网安全中心 (CIS) 创建免费账户后下载基准。

测试控制方法

CIS Kubernetes 基准中的每项控制均是在根据附带的安全强化指南配置的 RKE2 集群上进行评估的。

每项控制的可能结果如下：

PASS - 该控制已自动化（得分：真）。被测试的 RKE2 集群通过了基准中概述的审计。
不适用 - 由于 RKE2 的设计方式，该控制不适用（类型：跳过）。理由部分将解释原因。
WARN - 在 CIS 基准中，该控制为手动（得分：假），并依赖于手动操作员干预。补救部分将提供如何达到通过结果的指导。

1 控制平面安全配置。

1.1 控制平面节点配置文件

1.1.1 确保 API 服务器 pod 规范文件的权限设置为 600 或更严格（自动化）

*结果：*PASS

Audit:

stat -c permissions=%a /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml

预期结果： 权限为 600，预期为 600 或更严格

返回值：

permissions=600

修正：

请在控制平面节点上运行以下命令（依据您系统上的文件位置）。例如，chmod 600 /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml

1.1.2 确保 API 服务器 pod 规范文件的所有权设置为 root:root（自动化）

*结果：*PASS

Audit:

/bin/sh -c 'if test -e /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml; then stat -c %U:%G /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml; fi'

预期结果： 'root:root' 等于 'root:root'

返回值：

root:root

修正：

在控制平面节点上运行以下命令（根据您系统上的文件位置）。例如，chown root:root /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml

1.1.3 确保控制器管理器 pod 规范文件的权限设置为 600 或更严格（自动化）

*结果：*PASS

Audit:

/bin/sh -c 'if test -e /var/lib/rancher/rke2/agent/pod-manifests/kube-controller-manager.yaml; then stat -c permissions=%a /var/lib/rancher/rke2/agent/pod-manifests/kube-controller-manager.yaml; fi'

预期结果： 权限为 600，预期为 600 或更严格

返回值：

permissions=600

修正：

在控制平面节点上运行以下命令（根据您系统上的文件位置）。例如，chmod 600 /var/lib/rancher/rke2/agent/pod-manifests/kube-controller-manager.yaml

1.1.4 确保控制器管理器 pod 规范文件的所有权设置为 root:root（自动化）

*结果：*PASS

Audit:

/bin/sh -c 'if test -e /var/lib/rancher/rke2/agent/pod-manifests/kube-controller-manager.yaml; then stat -c %U:%G /var/lib/rancher/rke2/agent/pod-manifests/kube-controller-manager.yaml; fi'

预期结果： 'root:root' 等于 'root:root'

返回值：

root:root

修正：

在控制平面节点上运行以下命令（根据您系统上的文件位置）。例如，chown root:root /var/lib/rancher/rke2/agent/pod-manifests/kube-controller-manager.yaml

1.1.5 确保调度程序 pod 规范文件的权限设置为 600 或更严格（自动化）

*结果：*PASS

Audit:

/bin/sh -c 'if test -e /var/lib/rancher/rke2/agent/pod-manifests/kube-scheduler.yaml; then stat -c permissions=%a /var/lib/rancher/rke2/agent/pod-manifests/kube-scheduler.yaml; fi'

预期结果： 权限为 600，预期为 600 或更严格

返回值：

permissions=600

修正：

在控制平面节点上运行以下命令（根据您系统上的文件位置）。例如，chmod 600 /var/lib/rancher/rke2/agent/pod-manifests/kube-scheduler.yaml

1.1.6 确保调度程序 pod 规范文件的所有权设置为 root:root（自动化）

*结果：*PASS

Audit:

/bin/sh -c 'if test -e /var/lib/rancher/rke2/agent/pod-manifests/kube-scheduler.yaml; then stat -c %U:%G /var/lib/rancher/rke2/agent/pod-manifests/kube-scheduler.yaml; fi'

预期结果： 'root:root' 存在

返回值：

root:root

修正：

在控制平面节点上运行以下命令（根据您系统上的文件位置）。例如，chown root:root /var/lib/rancher/rke2/agent/pod-manifests/kube-scheduler.yaml

1.1.7 确保 etcd pod 规范文件的权限设置为 600 或更严格（手动）。

*结果：*PASS

Audit:

/bin/sh -c 'if test -e /var/lib/rancher/rke2/agent/pod-manifests/etcd.yaml; then stat -c permissions=%a /var/lib/rancher/rke2/agent/pod-manifests/etcd.yaml; fi'

预期结果： 权限为 600，预期为 600 或更严格

返回值：

permissions=600

修正：

如果仅运行主节点而没有 etcd 角色，则此检查不适用。如果控制平面和 etcd 角色存在于同一节点上，但此检查为警告，则请在控制平面节点上运行以下命令（依据您系统上的文件位置）。例如，chmod 600 /var/lib/rancher/rke2/agent/pod-manifests/etcd.yaml

1.1.8 确保 etcd pod 规范文件的所有权设置为 root:root（手动）

*结果：*PASS

Audit:

/bin/sh -c 'if test -e /var/lib/rancher/rke2/agent/pod-manifests/etcd.yaml; then stat -c %U:%G /var/lib/rancher/rke2/agent/pod-manifests/etcd.yaml; fi'

预期结果： 'root:root' 等于 'root:root'

返回值：

root:root

修正：

如果仅运行主节点而没有 etcd 角色，则此检查不适用。如果控制平面和 etcd 角色存在于同一节点上，但此检查为警告，则请在控制平面节点上运行以下命令（依据您系统上的文件位置）。例如，chown root:root /var/lib/rancher/rke2/agent/pod-manifests/etcd.yaml

1.1.9 确保容器网络接口文件的权限设置为 600 或更严格（手动）

*结果：*警告

修正： 请注意，对于许多 CNI，会创建一个权限为 750 的锁定文件。这是预期的，可以忽略。在控制平面节点上运行以下命令（根据您系统上的文件位置）。例如，chmod 600 /var/lib/cni/networks/<filename> and chmod 600 /etc/cni/net.d/<filename>

1.1.10 确保容器网络接口文件的所有权设置为 root:root（手动）

*结果：*PASS

Audit:

ps -fC ${kubeletbin:-kubelet} | grep -- --cni-conf-dir || echo "/etc/cni/net.d" | sed 's%.*cni-conf-dir[= ]\([^ ]*\).*%\1%' | xargs -I{} find {} -mindepth 1 | xargs --no-run-if-empty stat -c %U:%G
find /var/lib/cni/networks -type f 2> /dev/null | xargs --no-run-if-empty stat -c %U:%G

预期结果： 'root:root' 存在

返回值：

root:root
root:root
root:root
root:root
root:root
root:root
root:root
root:root
root:root

修正：

在控制平面节点上运行以下命令（根据您系统上的文件位置）。例如，chown root:root <path/to/cni/files>

1.1.11 确保 etcd 目录的权限设置为 700 或更严格（手动）

*结果：*PASS

Audit:

stat -c permissions=%a /var/lib/rancher/rke2/server/db/etcd

预期结果： 权限为 700，预期为 700 或更严格

返回值：

permissions=700

修正：

如果仅运行主节点而没有 etcd 角色，则此检查不适用。如果控制平面和 etcd 角色在同一节点上，但此检查为警告，则在 etcd 服务器节点上，获取 etcd 数据目录，作为参数 --data-dir，从命令 'ps -ef | grep etcd' 中获取。运行以下命令（根据上面找到的 etcd 数据目录）。例如，chmod 700 /var/lib/rancher/rke2/server/db/etcd

1.1.12 确保 etcd 数据目录的所有权设置为 etcd:etcd（手动）

*结果：*PASS

Audit:

stat -c %U:%G /var/lib/rancher/rke2/server/db/etcd

预期结果: 'etcd:etcd' 存在

返回值：

etcd:etcd

修正：

如果控制平面和 etcd 角色在同一节点上，但此检查为警告，则在控制平面节点上运行以下命令（根据您系统上的文件位置）。如果控制平面和 etcd 角色在同一节点上，但此检查为警告，则在 etcd 服务器节点上，获取 etcd 数据目录，作为参数 --data-dir，从命令 'ps -ef | grep etcd' 中获取。运行以下命令（根据上面找到的 etcd 数据目录）。例如，chown etcd:etcd /var/lib/rancher/rke2/server/db/etcd

1.1.13 确保 admin.conf 文件的权限设置为 600 或更严格（自动化）

*结果：*PASS

Audit:

stat -c permissions=%a /var/lib/rancher/rke2/server/cred/admin.kubeconfig

预期结果： 权限为 600，预期为 600 或更严格

返回值：

permissions=600

修正：

在控制平面节点上运行以下命令（根据您系统上的文件位置）。例如，chmod 600 /var/lib/rancher/rke2/server/cred/admin.kubeconfig

1.1.14 确保 admin.conf 文件的所有权设置为 root:root（自动化）

*结果：*PASS

Audit:

stat -c %U:%G /var/lib/rancher/rke2/server/cred/admin.kubeconfig

预期结果： 'root:root' 等于 'root:root'

返回值：

root:root

修正：

在控制平面节点上运行以下命令（根据您系统上的文件位置）。例如，chown root:root /var/lib/rancher/rke2/server/cred/admin.kubeconfig

1.1.15 确保 scheduler.conf 文件的权限设置为 600 或更严格（自动化）

*结果：*PASS

Audit:

/bin/sh -c 'if test -e /var/lib/rancher/rke2/server/cred/scheduler.kubeconfig; then stat -c permissions=%a /var/lib/rancher/rke2/server/cred/scheduler.kubeconfig; fi'

预期结果： 权限为 600，预期为 600 或更严格

返回值：

permissions=600

修正：

在控制平面节点上运行以下命令（根据您系统上的文件位置）。例如，chmod 600 /var/lib/rancher/rke2/server/cred/scheduler.kubeconfig

1.1.16 确保 scheduler.conf 文件的所有权设置为 root:root（自动化）

*结果：*PASS

Audit:

stat -c %U:%G /var/lib/rancher/rke2/server/cred/scheduler.kubeconfig

预期结果： 'root:root' 等于 'root:root'

返回值：

root:root

修正：

在控制平面节点上运行以下命令（根据您系统上的文件位置）。例如，chown root:root /var/lib/rancher/rke2/server/cred/scheduler.kubeconfig

1.1.17 确保 controller-manager.conf 文件的权限设置为 600 或更严格（自动化）

*结果：*PASS

Audit:

/bin/sh -c 'if test -e /var/lib/rancher/rke2/server/cred/controller.kubeconfig; then stat -c permissions=%a /var/lib/rancher/rke2/server/cred/controller.kubeconfig; fi'

预期结果： 权限为 600，预期为 600 或更严格

返回值：

permissions=600

修正：

在控制平面节点上运行以下命令（根据您系统上的文件位置）。例如，chmod 600 /var/lib/rancher/rke2/server/cred/controller.kubeconfig

1.1.18 确保 controller-manager.conf 文件的所有权设置为 root:root（自动化）

*结果：*PASS

Audit:

stat -c %U:%G /var/lib/rancher/rke2/server/cred/controller.kubeconfig

预期结果： 'root:root' 等于 'root:root'

返回值：

root:root

修正：

在控制平面节点上运行以下命令（根据您系统上的文件位置）。例如，chown root:root /var/lib/rancher/rke2/server/cred/controller.kubeconfig

1.1.19 确保 Kubernetes PKI 目录和文件的所有权设置为 root:root（自动化）

*结果：*PASS

Audit:

stat -c %U:%G /var/lib/rancher/rke2/server/tls

预期结果： 'root:root' 等于 'root:root'

返回值：

root:root

修正：

在控制平面节点上运行以下命令（根据您系统上的文件位置）。例如，chown -R root:root /var/lib/rancher/rke2/server/tls

1.1.20 确保 Kubernetes PKI 证书文件的权限设置为 644 或更严格（自动化）

*结果：*PASS

Audit:

stat -c permissions=%a /var/lib/rancher/rke2/server/tls/*.crt

预期结果： 权限为 644，预期为 644 或更严格

返回值：

permissions=644
permissions=644
permissions=644
permissions=644
permissions=644
permissions=644
permissions=644
permissions=644
permissions=644
permissions=644
permissions=644
permissions=644
permissions=644

修正：

在控制平面节点上运行以下命令（根据您系统上的文件位置）。例如，chmod -R 644 /var/lib/rancher/rke2/server/tls/*.crt 默认情况下，RKE2 将 PKI 证书文件的权限设置为 644，支持更严格的权限，例如 600。

1.1.21 确保 Kubernetes PKI 密钥文件的权限设置为 600（自动化）

*结果：*PASS

Audit:

stat -c permissions=%a /var/lib/rancher/rke2/server/tls/*.key

预期结果： 权限为 600，预期为 600 或更严格

返回值：

permissions=600
permissions=600
permissions=600
permissions=600
permissions=600
permissions=600
permissions=600
permissions=600
permissions=600
permissions=600
permissions=600
permissions=600
permissions=600
permissions=600
permissions=600
permissions=600
permissions=600

修正：

在控制平面节点上运行以下命令（根据您系统上的文件位置）。例如，chmod -R 600 /var/lib/rancher/rke2/server/tls/*.key

1.2 API 服务器

1.2.1 确保 --anonymous-auth 参数设置为 false（自动化）

*结果：*PASS

Audit:

/bin/ps -fC kube-apiserver

预期结果： '--anonymous-auth' 等于 'false'

返回值：

UID          PID    PPID  C STIME TTY          TIME CMD
root       18280   17706  5 16:15 ?        00:00:16 kube-apiserver --admission-control-config-file=/etc/rancher/rke2/rke2-pss.yaml --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --advertise-address=10.10.10.100 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --encryption-provider-config-automatic-reload=true --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-extend-token-expiration=false --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key

修正：

默认情况下，RKE2 将 --anonymous-auth 参数设置为 false。如果此检查失败，请编辑 RKE2 配置文件 /etc/rancher/rke2/config.yaml 并去除类似以下内容。

kube-apiserver-arg:
  - "anonymous-auth=true"

1.2.2 确保 --token-auth-file 参数未设置（自动化）

*结果：*PASS

Audit:

/bin/ps -fC kube-apiserver

预期结果： '--token-auth-file' 不存在

返回值：

UID          PID    PPID  C STIME TTY          TIME CMD
root       18280   17706  5 16:15 ?        00:00:16 kube-apiserver --admission-control-config-file=/etc/rancher/rke2/rke2-pss.yaml --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --advertise-address=10.10.10.100 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --encryption-provider-config-automatic-reload=true --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-extend-token-expiration=false --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key

修正：

请遵循文档并配置替代的身份验证机制。如果此检查失败，请编辑 RKE2 配置文件 /etc/rancher/rke2/config.yaml 并去除类似以下内容。

kube-apiserver-arg:
  - "token-auth-file=<path>"

1.2.3 确保 --DenyServiceExternalIPs 已设置（手动）

*结果：*警告

修正： 默认情况下，RKE2 不会设置 DenyServiceExternalIPs。要启用此标志，请编辑 RKE2 配置文件 /etc/rancher/rke2/config.yaml，如下所示。

kube-apiserver-arg:
  - "enable-admission-plugins=DenyServiceExternalIPs"

1.2.4 确保 --kubelet-client-certificate 和 --kubelet-client-key 参数设置正确（自动化）

*结果：*PASS

Audit:

/bin/ps -fC kube-apiserver

预期结果： '--kubelet-client-certificate' 存在且 '--kubelet-client-key' 存在

返回值：

UID          PID    PPID  C STIME TTY          TIME CMD
root       18280   17706  5 16:15 ?        00:00:16 kube-apiserver --admission-control-config-file=/etc/rancher/rke2/rke2-pss.yaml --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --advertise-address=10.10.10.100 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --encryption-provider-config-automatic-reload=true --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-extend-token-expiration=false --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key

修正：

默认情况下，RKE2 自动提供 kubelet 客户端证书和密钥。它们在 /var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt 和 /var/lib/rancher/rke2/server/tls/client-kube-apiserver.key 生成并存放。如果出于某种原因需要提供自己的证书和密钥，可以在 RKE2 配置文件 /etc/rancher/rke2/config.yaml 中设置以下参数。

kube-apiserver-arg:
  - "kubelet-client-certificate=<path/to/client-cert-file>"
  - "kubelet-client-key=<path/to/client-key-file>"

1.2.5 确保 --kubelet-certificate-authority 参数设置正确（自动化）

*结果：*PASS

Audit:

/bin/ps -fC kube-apiserver

预期结果： '--kubelet-certificate-authority' 存在

返回值：

UID          PID    PPID  C STIME TTY          TIME CMD
root       18280   17706  5 16:15 ?        00:00:16 kube-apiserver --admission-control-config-file=/etc/rancher/rke2/rke2-pss.yaml --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --advertise-address=10.10.10.100 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --encryption-provider-config-automatic-reload=true --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-extend-token-expiration=false --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key

修正：

默认情况下，RKE2 自动提供 kubelet CA 证书文件，位于 /var/lib/rancher/rke2/server/tls/server-ca.crt。如果出于某种原因需要提供自己的 CA 证书，请考虑使用 rke2 证书命令行工具。如果此检查失败，请编辑 RKE2 配置文件 /etc/rancher/rke2/config.yaml 并去除以下类似的行。

kube-apiserver-arg:
  - "kubelet-certificate-authority=<path/to/ca-cert-file>"

1.2.6 确保 --authorization-mode 参数未设置为 AlwaysAllow（自动化）

*结果：*PASS

Audit:

/bin/ps -fC kube-apiserver

预期结果： '--authorization-mode' 不包含 'AlwaysAllow'

返回值：

UID          PID    PPID  C STIME TTY          TIME CMD
root       18280   17706  5 16:15 ?        00:00:16 kube-apiserver --admission-control-config-file=/etc/rancher/rke2/rke2-pss.yaml --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --advertise-address=10.10.10.100 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --encryption-provider-config-automatic-reload=true --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-extend-token-expiration=false --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key

修正：

默认情况下，RKE2 不会将 --authorization-mode 设置为 AlwaysAllow。如果此检查失败，请编辑 RKE2 配置文件 /etc/rancher/rke2/config.yaml，去除以下类似的行。

kube-apiserver-arg:
  - "authorization-mode=AlwaysAllow"

1.2.7 确保 --authorization-mode 参数包含 Node（自动化）

*结果：*PASS

Audit:

/bin/ps -fC kube-apiserver

预期结果： '--authorization-mode' 包含 'Node'

返回值：

UID          PID    PPID  C STIME TTY          TIME CMD
root       18280   17706  5 16:15 ?        00:00:16 kube-apiserver --admission-control-config-file=/etc/rancher/rke2/rke2-pss.yaml --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --advertise-address=10.10.10.100 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --encryption-provider-config-automatic-reload=true --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-extend-token-expiration=false --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key

修正：

默认情况下，RKE2 将 --authorization-mode 设置为 Node 和 RBAC。如果此检查失败，请编辑 RKE2 配置文件 /etc/rancher/rke2/config.yaml，确保没有覆盖 authorization-mode。

1.2.8 确保 --authorization-mode 参数包含 RBAC（自动化）

*结果：*PASS

Audit:

/bin/ps -fC kube-apiserver

预期结果： '--authorization-mode' 包含 'RBAC'

返回值：

UID          PID    PPID  C STIME TTY          TIME CMD
root       18280   17706  5 16:15 ?        00:00:16 kube-apiserver --admission-control-config-file=/etc/rancher/rke2/rke2-pss.yaml --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --advertise-address=10.10.10.100 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --encryption-provider-config-automatic-reload=true --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-extend-token-expiration=false --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key

修正：

默认情况下，RKE2 将 --authorization-mode 设置为 Node 和 RBAC。如果此检查失败，请编辑 RKE2 配置文件 /etc/rancher/rke2/config.yaml，确保没有覆盖 authorization-mode。

1.2.9 确保 admission control 插件 EventRateLimit 已设置（手动）

*结果：*警告

修正： 请遵循 Kubernetes 文档，并在配置文件中设置所需的限制。然后，编辑 RKE2 配置文件 /etc/rancher/rke2/config.yaml 并设置以下参数。

kube-apiserver-arg:
  - "enable-admission-plugins=...,EventRateLimit,..."
  - "admission-control-config-file=<path/to/configuration/file>"

1.2.10 确保 admission control 插件 AlwaysAdmit 未设置（自动）

*结果：*PASS

Audit:

/bin/ps -fC kube-apiserver

预期结果： '--enable-admission-plugins' 不包含 'AlwaysAdmit' 或者 '--enable-admission-plugins' 不存在

返回值：

UID          PID    PPID  C STIME TTY          TIME CMD
root       18280   17706  5 16:15 ?        00:00:16 kube-apiserver --admission-control-config-file=/etc/rancher/rke2/rke2-pss.yaml --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --advertise-address=10.10.10.100 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --encryption-provider-config-automatic-reload=true --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-extend-token-expiration=false --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key

修正：

默认情况下，RKE2 不将 --enable-admission-plugins 设置为 AlwaysAdmit。如果此检查失败，请编辑 RKE2 配置文件 /etc/rancher/rke2/config.yaml，去除以下类似的行。

kube-apiserver-arg:
  - "enable-admission-plugins=AlwaysAdmit"

1.2.11 确保 admission control 插件 AlwaysPullImages 已设置（手动）

*结果：*警告

修正： 根据 CIS 指南，宽松的设置，"此设置可能会影响离线或隔离的集群，这些集群已经预加载了镜像，并且没有访问注册表以拉取正在使用的镜像。"此设置不适合使用此配置的集群。" 在控制平面节点上编辑 RKE2 配置文件 /etc/rancher/rke2/config.yaml，并将 --enable-admission-plugins 参数设置为包含 AlwaysPullImages。--enable-admission-plugins=…,AlwaysPullImages,…

1.2.12 确保设置 admission control 插件 ServiceAccount（自动化）

*结果：*PASS

Audit:

/bin/ps -fC kube-apiserver

预期结果： '--disable-admission-plugins' 存在或 '--disable-admission-plugins' 不存在

返回值：

UID          PID    PPID  C STIME TTY          TIME CMD
root       18280   17706  5 16:15 ?        00:00:16 kube-apiserver --admission-control-config-file=/etc/rancher/rke2/rke2-pss.yaml --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --advertise-address=10.10.10.100 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --encryption-provider-config-automatic-reload=true --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-extend-token-expiration=false --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key

修正：

默认情况下，RKE2 不将 --disable-admission-plugins 设置为任何值。请遵循文档并根据您的环境创建 ServiceAccount 对象。如果此检查失败，请编辑 RKE2 配置文件 /etc/rancher/rke2/config.yaml 并去除以下类似的行。

kube-apiserver-arg:
  - "disable-admission-plugins=ServiceAccount"

1.2.13 确保设置 admission control 插件 NamespaceLifecycle（自动化）

*结果：*PASS

Audit:

/bin/ps -fC kube-apiserver

预期结果： '--disable-admission-plugins' 存在或 '--disable-admission-plugins' 不存在

返回值：

UID          PID    PPID  C STIME TTY          TIME CMD
root       18280   17706  5 16:15 ?        00:00:16 kube-apiserver --admission-control-config-file=/etc/rancher/rke2/rke2-pss.yaml --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --advertise-address=10.10.10.100 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --encryption-provider-config-automatic-reload=true --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-extend-token-expiration=false --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key

修正：

默认情况下，RKE2 不将 --disable-admission-plugins 设置为任何值。如果此检查失败，请编辑 RKE2 配置文件 /etc/rancher/rke2/config.yaml 并去除以下类似的行。

kube-apiserver-arg:
  - "disable-admission-plugins=...,NamespaceLifecycle,..."

1.2.14 确保设置 admission control 插件 NodeRestriction（自动化）

*结果：*PASS

Audit:

/bin/ps -fC kube-apiserver

预期结果： '--enable-admission-plugins' 包含 'NodeRestriction'

返回值:

UID          PID    PPID  C STIME TTY          TIME CMD
root       18280   17706  5 16:15 ?        00:00:16 kube-apiserver --admission-control-config-file=/etc/rancher/rke2/rke2-pss.yaml --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --advertise-address=10.10.10.100 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --encryption-provider-config-automatic-reload=true --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-extend-token-expiration=false --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key

修正：

默认情况下，RKE2 将 --enable-admission-plugins 设置为 NodeRestriction。检查 RKE2 配置文件 /etc/rancher/rke2/config.yaml，并确保您没有覆盖 admission 插件。如果是，请在列表中包含 NodeRestriction。

kube-apiserver-arg:
  - "enable-admission-plugins=...,NodeRestriction,..."

1.2.15 确保 --profiling 参数设置为 false（自动化）

*结果：*PASS

Audit:

/bin/ps -fC kube-apiserver

预期结果: '--profiling' 等于 'false'

返回值:

UID          PID    PPID  C STIME TTY          TIME CMD
root       18280   17706  5 16:15 ?        00:00:16 kube-apiserver --admission-control-config-file=/etc/rancher/rke2/rke2-pss.yaml --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --advertise-address=10.10.10.100 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --encryption-provider-config-automatic-reload=true --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-extend-token-expiration=false --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key

修正：

默认情况下，RKE2 将 --profiling 参数设置为 false。如果此检查失败，请编辑 RKE2 配置文件 /etc/rancher/rke2/config.yaml 并去除以下类似的行。

kube-apiserver-arg:
  - "profiling=true"

1.2.16 确保 --audit-log-path 参数已设置（自动化）

*结果：*PASS

Audit:

/bin/ps -fC kube-apiserver

预期结果: '--audit-log-path' 存在

返回值:

UID          PID    PPID  C STIME TTY          TIME CMD
root       18280   17706  5 16:15 ?        00:00:16 kube-apiserver --admission-control-config-file=/etc/rancher/rke2/rke2-pss.yaml --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --advertise-address=10.10.10.100 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --encryption-provider-config-automatic-reload=true --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-extend-token-expiration=false --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key

修正：

默认情况下，RKE2 将 --audit-log-path 参数设置为 /var/lib/rancher/rke2/server/logs/audit.log。如果您想更改此设置，请在控制平面节点上编辑 RKE2 配置文件 /etc/rancher/rke2/config.yaml，并将 --audit-log-path 参数设置为适当的路径和文件，以便将审计日志写入，例如，

kube-apiserver-arg:
  - "audit-log-path=/var/log/rke2/audit.log"

1.2.17 确保 --audit-log-maxage 参数设置为 30 或适当的值（自动化）

*结果：*PASS

Audit:

/bin/ps -fC kube-apiserver

预期结果: '--audit-log-maxage' 大于或等于 30

返回值:

UID          PID    PPID  C STIME TTY          TIME CMD
root       18280   17706  5 16:15 ?        00:00:16 kube-apiserver --admission-control-config-file=/etc/rancher/rke2/rke2-pss.yaml --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --advertise-address=10.10.10.100 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --encryption-provider-config-automatic-reload=true --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-extend-token-expiration=false --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key

修正：

默认情况下，RKE2 将 --audit-log-maxage 参数设置为 30 天。如果您想更改此设置，请在控制平面节点上编辑 RKE2 配置文件 /etc/rancher/rke2/config.yaml，并将 --audit-log-maxage 参数设置为适当的天数，例如，

kube-apiserver-arg:
  - "audit-log-maxage=40"

1.2.18 确保 --audit-log-maxbackup 参数设置为 10 或适当的值（自动化）

*结果：*PASS

Audit:

/bin/ps -fC kube-apiserver

预期结果: '--audit-log-maxbackup' 大于或等于 10

返回值:

UID          PID    PPID  C STIME TTY          TIME CMD
root       18280   17706  5 16:15 ?        00:00:16 kube-apiserver --admission-control-config-file=/etc/rancher/rke2/rke2-pss.yaml --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --advertise-address=10.10.10.100 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --encryption-provider-config-automatic-reload=true --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-extend-token-expiration=false --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key

修正：

默认情况下，RKE2 将 --audit-log-maxbackup 参数设置为 10。如果您想更改此设置，请在控制平面节点上编辑 RKE2 配置文件 /etc/rancher/rke2/config.yaml，并将 --audit-log-maxbackup 参数设置为适当的值。例如，

kube-apiserver-arg:
  - "audit-log-maxbackup=15"

1.2.19 确保 --audit-log-maxsize 参数设置为 100 或适当的值（自动化）

*结果：*PASS

Audit:

/bin/ps -fC kube-apiserver

预期结果: '--audit-log-maxsize' 大于或等于 100

返回值:

UID          PID    PPID  C STIME TTY          TIME CMD
root       18280   17706  5 16:15 ?        00:00:16 kube-apiserver --admission-control-config-file=/etc/rancher/rke2/rke2-pss.yaml --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --advertise-address=10.10.10.100 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --encryption-provider-config-automatic-reload=true --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-extend-token-expiration=false --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key

修正：

默认情况下，RKE2 将 --audit-log-maxsize 参数设置为 100 MB。如果您想更改此设置，请在控制平面节点上编辑 RKE2 配置文件 /etc/rancher/rke2/config.yaml，并将 --audit-log-maxsize 参数设置为合适的大小（以 MB 为单位）。例如，

kube-apiserver-arg:
  - "audit-log-maxsize=150"

1.2.20 确保 --request-timeout 参数设置得当（自动化）

*结果：*PASS

Audit:

/bin/ps -fC kube-apiserver

预期结果: '--request-timeout' 不存在或 '--request-timeout' 存在

返回值：

UID          PID    PPID  C STIME TTY          TIME CMD
root       18280   17706  5 16:15 ?        00:00:16 kube-apiserver --admission-control-config-file=/etc/rancher/rke2/rke2-pss.yaml --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --advertise-address=10.10.10.100 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --encryption-provider-config-automatic-reload=true --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-extend-token-expiration=false --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key

修正：

根据CIS指南，建议适当设置此限制，仅在必要时更改默认限制60秒。编辑 RKE2 配置文件 /etc/rancher/rke2/config.yaml，并在需要时设置以下参数。例如，

kube-apiserver-arg:
  - "request-timeout=300s"

1.2.21 确保 --service-account-lookup 参数设置为 true（自动）

*结果：*PASS

Audit:

/bin/ps -fC kube-apiserver

预期结果： '--service-account-lookup' 不存在或者 '--service-account-lookup' 存在

返回值：

UID          PID    PPID  C STIME TTY          TIME CMD
root       18280   17706  5 16:15 ?        00:00:16 kube-apiserver --admission-control-config-file=/etc/rancher/rke2/rke2-pss.yaml --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --advertise-address=10.10.10.100 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --encryption-provider-config-automatic-reload=true --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-extend-token-expiration=false --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key

修正：

默认情况下，RKE2 不设置 --service-account-lookup 参数。编辑 RKE2 配置文件 /etc/rancher/rke2/config.yaml 并设置 service-account-lookup。例如，

kube-apiserver-arg:
  - "service-account-lookup=true"

或者，您可以从此文件中删除 service-account-lookup 参数，以便默认设置生效。

1.2.22 确保 --service-account-key-file 参数设置正确（自动）

*结果：*PASS

Audit:

/bin/ps -fC kube-apiserver

预期结果： '--service-account-key-file' 存在

返回值：

UID          PID    PPID  C STIME TTY          TIME CMD
root       18280   17706  5 16:15 ?        00:00:16 kube-apiserver --admission-control-config-file=/etc/rancher/rke2/rke2-pss.yaml --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --advertise-address=10.10.10.100 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --encryption-provider-config-automatic-reload=true --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-extend-token-expiration=false --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key

修正：

RKE2 会自动生成并设置服务账户密钥文件。它位于 /var/lib/rancher/rke2/server/tls/service.key。如果此检查失败，请编辑 RKE2 配置文件 /etc/rancher/rke2/config.yaml 并去除以下类似的行。

kube-apiserver-arg:
  - "service-account-key-file=<path>"

1.2.23 确保 --etcd-certfile 和 --etcd-keyfile 参数设置正确（自动化）

*结果：*PASS

Audit:

/bin/ps -fC kube-apiserver

预期结果： '--etcd-certfile' 存在且 '--etcd-keyfile' 存在

返回值：

UID          PID    PPID  C STIME TTY          TIME CMD
root       18280   17706  5 16:15 ?        00:00:16 kube-apiserver --admission-control-config-file=/etc/rancher/rke2/rke2-pss.yaml --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --advertise-address=10.10.10.100 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --encryption-provider-config-automatic-reload=true --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-extend-token-expiration=false --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key

修正：

RKE2 会自动生成并设置 etcd 证书和密钥文件。它们位于 /var/lib/rancher/rke2/server/tls/etcd/client.crt 和 /var/lib/rancher/rke2/server/tls/etcd/client.key。如果此检查失败，请编辑 RKE2 配置文件 /etc/rancher/rke2/config.yaml 并去除以下类似的行。

kube-apiserver-arg:
  - "etcd-certfile=<path>"
  - "etcd-keyfile=<path>"

1.2.24 确保 --tls-cert-file 和 --tls-private-key-file 参数设置正确（自动化）

*结果：*PASS

Audit:

/bin/ps -fC kube-apiserver

预期结果： '--tls-cert-file' 存在并且 '--tls-private-key-file' 存在

返回值:

UID          PID    PPID  C STIME TTY          TIME CMD
root       18280   17706  5 16:15 ?        00:00:16 kube-apiserver --admission-control-config-file=/etc/rancher/rke2/rke2-pss.yaml --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --advertise-address=10.10.10.100 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --encryption-provider-config-automatic-reload=true --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-extend-token-expiration=false --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key

修正：

默认情况下，RKE2 会自动生成并提供 apiserver 的 TLS 证书和私钥。它们已生成并位于 /var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt 和 /var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key。如果此检查失败，请编辑 RKE2 配置文件 /etc/rancher/rke2/config.yaml 并去除以下类似的行。

kube-apiserver-arg:
  - "tls-cert-file=<path>"
  - "tls-private-key-file=<path>"

1.2.25 确保 --client-ca-file 参数设置正确（自动化）

*结果：*PASS

Audit:

/bin/ps -fC kube-apiserver

预期结果： '--client-ca-file' 存在

返回值：

UID          PID    PPID  C STIME TTY          TIME CMD
root       18280   17706  5 16:15 ?        00:00:16 kube-apiserver --admission-control-config-file=/etc/rancher/rke2/rke2-pss.yaml --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --advertise-address=10.10.10.100 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --encryption-provider-config-automatic-reload=true --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-extend-token-expiration=false --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key

修正：

默认情况下，RKE2 自动提供客户端证书颁发机构文件。它已生成并位于 /var/lib/rancher/rke2/server/tls/client-ca.crt。如果出于某种原因需要提供自己的 CA 证书，请考虑使用 rke2 证书命令行工具。如果此检查失败，请编辑 RKE2 配置文件 /etc/rancher/rke2/config.yaml 并去除以下类似的行。

kube-apiserver-arg:
  - "client-ca-file=<path>"

1.2.26 确保 --etcd-cafile 参数设置正确（自动化）

*结果：*PASS

Audit:

/bin/ps -fC kube-apiserver

预期结果: '--etcd-cafile' 存在

返回值:

UID          PID    PPID  C STIME TTY          TIME CMD
root       18280   17706  5 16:15 ?        00:00:16 kube-apiserver --admission-control-config-file=/etc/rancher/rke2/rke2-pss.yaml --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --advertise-address=10.10.10.100 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --encryption-provider-config-automatic-reload=true --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-extend-token-expiration=false --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key

修正：

默认情况下，RKE2 自动提供 etcd 证书颁发机构文件。它已生成并位于 /var/lib/rancher/rke2/server/tls/client-ca.crt。如果出于某种原因需要提供自己的 CA 证书，请考虑使用 rke2 证书命令行工具。如果此检查失败，请编辑 RKE2 配置文件 /etc/rancher/rke2/config.yaml 并去除以下类似的行。

kube-apiserver-arg:
  - "etcd-cafile=<path>"

1.2.27 确保 --encryption-provider-config 参数设置正确（自动）

*结果：*PASS

Audit:

/bin/ps -fC kube-apiserver

预期结果: '--encryption-provider-config' 存在

返回值:

UID          PID    PPID  C STIME TTY          TIME CMD
root       18280   17706  5 16:15 ?        00:00:16 kube-apiserver --admission-control-config-file=/etc/rancher/rke2/rke2-pss.yaml --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --advertise-address=10.10.10.100 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --encryption-provider-config-automatic-reload=true --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-extend-token-expiration=false --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key

修正：

RKE2 始终配置为加密密文。密文加密通过 rke2 secrets-encrypt 命令行工具进行管理。如有需要，您可以在 /var/lib/rancher/rke2/server/cred/encryption-config.json 找到生成的加密配置。

1.2.28 确保加密提供程序配置正确（自动）

*结果：*PASS

Audit:

ENCRYPTION_PROVIDER_CONFIG=$(ps -ef | grep kube-apiserver | grep -- --encryption-provider-config | sed 's%.*encryption-provider-config[= ]\([^ ]*\).*%\1%')
if test -e $ENCRYPTION_PROVIDER_CONFIG; then grep -o 'providers\"\:\[.*\]' $ENCRYPTION_PROVIDER_CONFIG | grep -o "[A-Za-z]*" | head -2 | tail -1  | sed 's/^/provider=/'; fi

预期结果: 'provider' 包含来自 'aescbc,kms,secretbox' 的有效元素

返回值:

provider=aescbc

修正：

RKE2 始终配置为使用 aescbc 加密提供程序来加密密文。密文加密通过 rke2 secrets-encrypt 命令行工具进行管理。如有需要，您可以在 /var/lib/rancher/rke2/server/cred/encryption-config.json 找到生成的加密配置。

1.2.29 确保 API 服务器仅使用强加密密码（自动）

*结果：*PASS

Audit:

/bin/ps -fC kube-apiserver

预期结果: '--tls-cipher-suites' 包含来自 'TLS_AES_128_GCM_SHA256,TLS_AES_256_GCM_SHA384,TLS_CHACHA20_POLY1305_SHA256,TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256,TLS_RSA_WITH_AES_128_GCM_SHA256,TLS_RSA_WITH_AES_256_GCM_SHA384' 的有效元素

返回值：

UID          PID    PPID  C STIME TTY          TIME CMD
root       18280   17706  5 16:15 ?        00:00:16 kube-apiserver --admission-control-config-file=/etc/rancher/rke2/rke2-pss.yaml --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --advertise-address=10.10.10.100 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --encryption-provider-config-automatic-reload=true --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-extend-token-expiration=false --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key

修正：

默认情况下，RKE2 kube-apiserver 符合此测试。更改这些值可能会导致回归，因此在生产部署中应用之前，请确保所有 apiserver 客户端支持新的 TLS 配置。如果需要自定义 TLS 配置，请考虑创建与您的要求相符的此规则的自定义版本。如果此检查失败，请删除与 tls-cipher-suites 相关的任何自定义配置，或通过添加以下内容更新 /etc/rancher/rke2/config.yaml 文件以匹配默认值：
kube-apiserver-arg:

"tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305"

1.2.30 确保—service-account-extend-token-expiration参数设置为false（自动）

*结果：*PASS

Audit:

/bin/ps -fC kube-apiserver

预期结果: '--service-account-extend-token-expiration' 等于 'false'

返回值:

UID          PID    PPID  C STIME TTY          TIME CMD
root       18280   17706  5 16:15 ?        00:00:16 kube-apiserver --admission-control-config-file=/etc/rancher/rke2/rke2-pss.yaml --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --advertise-address=10.10.10.100 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --encryption-provider-config-automatic-reload=true --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-extend-token-expiration=false --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key

修正：

编辑 RKE2 配置文件 /etc/rancher/rke2/config.yaml，并在重新加载 rke2 之前将 --service-account-extend-token-expiration 参数设置为 false，如下所示：
kube-apiserver-arg:

"service-account-extend-token-expiration=false"
默认情况下，此参数设置为 true.

1.3 控制器管理器

1.3.1 确保 --terminated-pod-gc-threshold 参数设置适当（手动）

*结果：*PASS

Audit:

/bin/ps -fC kube-controller-manager

预期结果： '--terminated-pod-gc-threshold' 存在

返回值：

UID          PID    PPID  C STIME TTY          TIME CMD
root       18380    2666  1 16:15 ?        00:00:04 kube-controller-manager --permit-port-sharing=true --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,tokencleaner,-service,-route,-cloud-node-lifecycle --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --tls-cert-file=/var/lib/rancher/rke2/server/tls/kube-controller-manager/kube-controller-manager.crt --tls-private-key-file=/var/lib/rancher/rke2/server/tls/kube-controller-manager/kube-controller-manager.key --use-service-account-credentials=true

修正：

默认情况下，RKE2 设置 terminated-pod-gc-threshold 为 1000。如果您需要更改此值，请在控制平面节点上编辑 RKE2 配置文件 /etc/rancher/rke2/config.yaml，并将 --terminated-pod-gc-threshold 设置为适当的阈值，

kube-controller-manager-arg:
  - "terminated-pod-gc-threshold=10"

1.3.2 确保 --profiling 参数设置为 false（自动化）

*结果：*PASS

Audit:

/bin/ps -fC kube-controller-manager

预期结果: '--profiling' 等于 'false'

返回值:

UID          PID    PPID  C STIME TTY          TIME CMD
root       18380    2666  1 16:15 ?        00:00:04 kube-controller-manager --permit-port-sharing=true --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,tokencleaner,-service,-route,-cloud-node-lifecycle --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --tls-cert-file=/var/lib/rancher/rke2/server/tls/kube-controller-manager/kube-controller-manager.crt --tls-private-key-file=/var/lib/rancher/rke2/server/tls/kube-controller-manager/kube-controller-manager.key --use-service-account-credentials=true

修正：

默认情况下，RKE2 将 --profiling 参数设置为 false。如果此检查失败，请编辑 RKE2 配置文件 /etc/rancher/rke2/config.yaml 并删除以下类似的行。

kube-controller-manager-arg:
  - "profiling=true"

1.3.3 确保 --use-service-account-credentials 参数设置为 true（自动）

*结果：*PASS

Audit:

/bin/ps -fC kube-controller-manager

预期结果： '--use-service-account-credentials' 不等于 'false'

返回值：

UID          PID    PPID  C STIME TTY          TIME CMD
root       18380    2666  1 16:15 ?        00:00:04 kube-controller-manager --permit-port-sharing=true --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,tokencleaner,-service,-route,-cloud-node-lifecycle --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --tls-cert-file=/var/lib/rancher/rke2/server/tls/kube-controller-manager/kube-controller-manager.crt --tls-private-key-file=/var/lib/rancher/rke2/server/tls/kube-controller-manager/kube-controller-manager.key --use-service-account-credentials=true

修正：

默认情况下，RKE2 将 --use-service-account-credentials 参数设置为 true。如果此检查失败，请编辑 RKE2 配置文件 /etc/rancher/rke2/config.yaml 并删除以下类似的行。

kube-controller-manager-arg:
  - "use-service-account-credentials=false"

1.3.4 确保 --service-account-private-key-file 参数设置适当（自动）

*结果：*PASS

Audit:

/bin/ps -fC kube-controller-manager

预期结果： '--service-account-private-key-file' 存在

返回值：

UID          PID    PPID  C STIME TTY          TIME CMD
root       18380    2666  1 16:15 ?        00:00:04 kube-controller-manager --permit-port-sharing=true --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,tokencleaner,-service,-route,-cloud-node-lifecycle --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --tls-cert-file=/var/lib/rancher/rke2/server/tls/kube-controller-manager/kube-controller-manager.crt --tls-private-key-file=/var/lib/rancher/rke2/server/tls/kube-controller-manager/kube-controller-manager.key --use-service-account-credentials=true

修正：

默认情况下，RKE2 自动提供服务帐户私钥文件。它是在 /var/lib/rancher/rke2/server/tls/service.current.key 生成并存放的。如果此检查失败，请编辑 RKE2 配置文件 /etc/rancher/rke2/config.yaml 并删除以下类似的行。

kube-controller-manager-arg:
  - "service-account-private-key-file=<path>"

1.3.5 确保 --root-ca-file 参数设置正确（自动化）

*结果：*PASS

Audit:

/bin/ps -fC kube-controller-manager

预期结果: '--root-ca-file' 存在

返回值:

UID          PID    PPID  C STIME TTY          TIME CMD
root       18380    2666  1 16:15 ?        00:00:04 kube-controller-manager --permit-port-sharing=true --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,tokencleaner,-service,-route,-cloud-node-lifecycle --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --tls-cert-file=/var/lib/rancher/rke2/server/tls/kube-controller-manager/kube-controller-manager.crt --tls-private-key-file=/var/lib/rancher/rke2/server/tls/kube-controller-manager/kube-controller-manager.key --use-service-account-credentials=true

修正：

默认情况下，RKE2 自动提供根 CA 文件。它在 /var/lib/rancher/rke2/server/tls/server-ca.crt 生成并存放。如果出于某种原因您需要提供自己的 CA 证书，请考虑使用 rke2 证书命令行工具。如果此检查失败，请编辑 RKE2 配置文件 /etc/rancher/rke2/config.yaml 并删除以下类似的行。

kube-controller-manager-arg:
  - "root-ca-file=<path>"

1.3.6 确保 RotateKubeletServerCertificate 参数设置为 true（自动化）

*结果：*PASS

Audit:

/bin/ps -fC kube-controller-manager

预期结果: '--feature-gates' 存在或者 '--feature-gates' 不存在

返回值:

UID          PID    PPID  C STIME TTY          TIME CMD
root       18380    2666  1 16:15 ?        00:00:04 kube-controller-manager --permit-port-sharing=true --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,tokencleaner,-service,-route,-cloud-node-lifecycle --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --tls-cert-file=/var/lib/rancher/rke2/server/tls/kube-controller-manager/kube-controller-manager.crt --tls-private-key-file=/var/lib/rancher/rke2/server/tls/kube-controller-manager/kube-controller-manager.key --use-service-account-credentials=true

修正：

默认情况下，RKE2 不会设置 RotateKubeletServerCertificate 功能开关。如果您启用了此功能开关，您应该将其去除。如果此检查失败，请编辑 RKE2 配置文件 /etc/rancher/rke2/config.yaml，删除以下类似的行。

kube-controller-manager-arg:
  - "feature-gate=RotateKubeletServerCertificate"

1.3.7 确保 --bind-address 参数设置为 127.0.0.1（自动化）

*结果：*PASS

Audit:

/bin/ps -fC kube-controller-manager

预期结果: '--bind-address' 等于 '127.0.0.1' 或者 '--bind-address' 不存在

返回值:

UID          PID    PPID  C STIME TTY          TIME CMD
root       18380    2666  1 16:15 ?        00:00:04 kube-controller-manager --permit-port-sharing=true --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,tokencleaner,-service,-route,-cloud-node-lifecycle --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --tls-cert-file=/var/lib/rancher/rke2/server/tls/kube-controller-manager/kube-controller-manager.crt --tls-private-key-file=/var/lib/rancher/rke2/server/tls/kube-controller-manager/kube-controller-manager.key --use-service-account-credentials=true

修正：

默认情况下，RKE2 将 --bind-address 参数设置为 127.0.0.1。如果此检查失败，请编辑 RKE2 配置文件 /etc/rancher/rke2/config.yaml，并删除以下类似的行。

kube-controller-manager-arg:
  - "bind-address=<IP>"

1.4 调度程序

1.4.1 确保 --profiling 参数设置为 false（自动化）

*结果：*PASS

Audit:

/bin/ps -fC kube-scheduler

预期结果: '--profiling' 等于 'false'

返回值:

UID          PID    PPID  C STIME TTY          TIME CMD
root       18054    2705  0 16:15 ?        00:00:01 kube-scheduler --permit-port-sharing=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/scheduler.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/scheduler.kubeconfig --bind-address=127.0.0.1 --kubeconfig=/var/lib/rancher/rke2/server/cred/scheduler.kubeconfig --profiling=false --secure-port=10259 --tls-cert-file=/var/lib/rancher/rke2/server/tls/kube-scheduler/kube-scheduler.crt --tls-private-key-file=/var/lib/rancher/rke2/server/tls/kube-scheduler/kube-scheduler.key

修正：

默认情况下，RKE2 将 --profiling 参数设置为 false。如果此检查失败，请编辑 RKE2 配置文件 /etc/rancher/rke2/config.yaml 并删除以下类似的行。

kube-scheduler-arg:
  - "profiling=true"

1.4.2 确保 --bind-address 参数设置为 127.0.0.1（自动化）

*结果：*PASS

Audit:

/bin/ps -fC kube-scheduler

预期结果: '--bind-address' 等于 '127.0.0.1' 或者 '--bind-address' 不存在

返回值:

UID          PID    PPID  C STIME TTY          TIME CMD
root       18054    2705  0 16:15 ?        00:00:01 kube-scheduler --permit-port-sharing=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/scheduler.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/scheduler.kubeconfig --bind-address=127.0.0.1 --kubeconfig=/var/lib/rancher/rke2/server/cred/scheduler.kubeconfig --profiling=false --secure-port=10259 --tls-cert-file=/var/lib/rancher/rke2/server/tls/kube-scheduler/kube-scheduler.crt --tls-private-key-file=/var/lib/rancher/rke2/server/tls/kube-scheduler/kube-scheduler.key

修正：

默认情况下，RKE2 将 --bind-address 参数设置为 127.0.0.1。如果此检查失败，请编辑 RKE2 配置文件 /etc/rancher/rke2/config.yaml，并删除以下类似的行。

kube-scheduler-arg:
  - "bind-address=<IP>"

2 Etcd 节点配置

2.1 确保 --cert-file 和 --key-file 参数设置正确（自动化）

*结果：*PASS

Audit:

cat /var/lib/rancher/rke2/server/db/etcd/config

预期结果： '.client-transport-security.cert-file' 等于 '/var/lib/rancher/rke2/server/tls/etcd/server-client.crt' 且 '.client-transport-security.key-file' 等于 '/var/lib/rancher/rke2/server/tls/etcd/server-client.key'

返回值：

advertise-client-urls: https://10.10.10.100:2379
client-transport-security:
  cert-file: /var/lib/rancher/rke2/server/tls/etcd/server-client.crt
  client-cert-auth: true
  key-file: /var/lib/rancher/rke2/server/tls/etcd/server-client.key
  trusted-ca-file: /var/lib/rancher/rke2/server/tls/etcd/server-ca.crt
data-dir: /var/lib/rancher/rke2/server/db/etcd
election-timeout: 5000
experimental-initial-corrupt-check: true
experimental-watch-progress-notify-interval: 5000000000
heartbeat-interval: 500
initial-advertise-peer-urls: https://10.10.10.100:2380
initial-cluster: server-0-d66375b4=https://10.10.10.100:2380
initial-cluster-state: new
listen-client-http-urls: https://127.0.0.1:2382
listen-client-urls: https://127.0.0.1:2379,https://10.10.10.100:2379
listen-metrics-urls: http://127.0.0.1:2381
listen-peer-urls: https://127.0.0.1:2380,https://10.10.10.100:2380
log-outputs:
- stderr
logger: zap
name: server-0-d66375b4
peer-transport-security:
  cert-file: /var/lib/rancher/rke2/server/tls/etcd/peer-server-client.crt
  client-cert-auth: true
  key-file: /var/lib/rancher/rke2/server/tls/etcd/peer-server-client.key
  trusted-ca-file: /var/lib/rancher/rke2/server/tls/etcd/peer-ca.crt
snapshot-count: 10000
socket-options:
  reuse-address: true
  reuse-port: true

修正：

默认情况下，RKE2 为 etcd 生成证书和密钥文件。这些文件位于 /var/lib/rancher/rke2/server/tls/etcd/。如果此检查失败，请确保配置文件 /var/lib/rancher/rke2/server/db/etcd/config 未被修改为使用自定义证书和密钥文件。

2.2 确保 --client-cert-auth 参数设置为 true（自动化）

*结果：*PASS

Audit:

cat /var/lib/rancher/rke2/server/db/etcd/config

预期结果：'ETCD_CLIENT_CERT_AUTH' 存在或 '.client-transport-security.client-cert-auth' 等于 'true'

返回值：

PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
HOSTNAME=server-0
ETCD_UNSUPPORTED_ARCH=
FILE_HASH=e37e99a1db555b43d54d98f8bd294bd808aed0b4791c9d1d94b05bcc783e66d6
NO_PROXY=.svc,.cluster.local,10.42.0.0/16,10.43.0.0/16
HOME=/

修正：

默认情况下，RKE2 将 --client-cert-auth 参数设置为 true。如果此检查失败，请确保配置文件 /var/lib/rancher/rke2/server/db/etcd/config 未被修改为禁用客户端证书认证。

2.3 确保 --auto-tls 参数未设置为 true（自动化）

*结果：*PASS

Audit:

cat /var/lib/rancher/rke2/server/db/etcd/config

预期结果：'ETCD_AUTO_TLS' 不存在或 'ETCD_AUTO_TLS' 存在或 '.client-transport-security.auto-tls' 存在

返回值：

PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
HOSTNAME=server-0
ETCD_UNSUPPORTED_ARCH=
FILE_HASH=e37e99a1db555b43d54d98f8bd294bd808aed0b4791c9d1d94b05bcc783e66d6
NO_PROXY=.svc,.cluster.local,10.42.0.0/16,10.43.0.0/16
HOME=/

修正：

默认情况下，RKE2 不设置 --auto-tls 参数。如果此检查失败，请在主节点上编辑 etcd pod 规格文件 /var/lib/rancher/rke2/server/db/etcd/config，去除 --auto-tls 参数或将其设置为 false。client-transport-security: auto-tls: false

2.4 确保 --peer-cert-file 和 --peer-key-file 参数设置正确（自动化）

*结果：*PASS

Audit:

cat /var/lib/rancher/rke2/server/db/etcd/config

预期结果： '.peer-transport-security.cert-file' 等于 '/var/lib/rancher/rke2/server/tls/etcd/peer-server-client.crt' 且 '.peer-transport-security.key-file' 等于 '/var/lib/rancher/rke2/server/tls/etcd/peer-server-client.key'

返回值：

advertise-client-urls: https://10.10.10.100:2379
client-transport-security:
  cert-file: /var/lib/rancher/rke2/server/tls/etcd/server-client.crt
  client-cert-auth: true
  key-file: /var/lib/rancher/rke2/server/tls/etcd/server-client.key
  trusted-ca-file: /var/lib/rancher/rke2/server/tls/etcd/server-ca.crt
data-dir: /var/lib/rancher/rke2/server/db/etcd
election-timeout: 5000
experimental-initial-corrupt-check: true
experimental-watch-progress-notify-interval: 5000000000
heartbeat-interval: 500
initial-advertise-peer-urls: https://10.10.10.100:2380
initial-cluster: server-0-d66375b4=https://10.10.10.100:2380
initial-cluster-state: new
listen-client-http-urls: https://127.0.0.1:2382
listen-client-urls: https://127.0.0.1:2379,https://10.10.10.100:2379
listen-metrics-urls: http://127.0.0.1:2381
listen-peer-urls: https://127.0.0.1:2380,https://10.10.10.100:2380
log-outputs:
- stderr
logger: zap
name: server-0-d66375b4
peer-transport-security:
  cert-file: /var/lib/rancher/rke2/server/tls/etcd/peer-server-client.crt
  client-cert-auth: true
  key-file: /var/lib/rancher/rke2/server/tls/etcd/peer-server-client.key
  trusted-ca-file: /var/lib/rancher/rke2/server/tls/etcd/peer-ca.crt
snapshot-count: 10000
socket-options:
  reuse-address: true
  reuse-port: true

修正：

默认情况下，RKE2 为 etcd 生成对等证书和密钥文件。这些文件位于 /var/lib/rancher/rke2/server/tls/etcd/。如果此检查失败，请确保配置文件 /var/lib/rancher/rke2/server/db/etcd/config 未被修改为使用自定义对等证书和密钥文件。

2.5 确保 --peer-client-cert-auth 参数设置为 true（自动化）

*结果：*PASS

Audit:

cat /var/lib/rancher/rke2/server/db/etcd/config

预期结果：'ETCD_PEER_CLIENT_CERT_AUTH' 存在或 '.peer-transport-security.client-cert-auth' 等于 'true'

返回值：

PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
HOSTNAME=server-0
ETCD_UNSUPPORTED_ARCH=
FILE_HASH=e37e99a1db555b43d54d98f8bd294bd808aed0b4791c9d1d94b05bcc783e66d6
NO_PROXY=.svc,.cluster.local,10.42.0.0/16,10.43.0.0/16
HOME=/

修正：

默认情况下，RKE2 将 --peer-cert-auth 参数设置为 true。如果此检查失败，请确保配置文件 /var/lib/rancher/rke2/server/db/etcd/config 未被修改为禁用对等客户端证书认证。

2.6 确保 --peer-auto-tls 参数未设置为 true（自动化）

*结果：*PASS

Audit:

cat /var/lib/rancher/rke2/server/db/etcd/config

预期结果：'ETCD_PEER_AUTO_TLS' 不存在或 'ETCD_PEER_AUTO_TLS' 存在或 '.peer-transport-security.auto-tls' 存在

返回值：

PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
HOSTNAME=server-0
ETCD_UNSUPPORTED_ARCH=
FILE_HASH=e37e99a1db555b43d54d98f8bd294bd808aed0b4791c9d1d94b05bcc783e66d6
NO_PROXY=.svc,.cluster.local,10.42.0.0/16,10.43.0.0/16
HOME=/

修正：

默认情况下，RKE2 不设置 --peer-auto-tls 参数。如果此检查失败，请在主节点上编辑 etcd pod 规格文件 /var/lib/rancher/rke2/server/db/etcd/config，去除 --peer-auto-tls 参数或将其设置为 false。peer-transport-security: auto-tls: false

2.7 确保为 etcd 使用唯一的证书颁发机构（自动化）

*结果：*PASS

Audit:

cat /var/lib/rancher/rke2/server/db/etcd/config

预期结果：'ETCD_TRUSTED_CA_FILE' 存在或 '.peer-transport-security.trusted-ca-file' 等于 '/var/lib/rancher/rke2/server/tls/etcd/peer-ca.crt'

返回值：

PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
HOSTNAME=server-0
ETCD_UNSUPPORTED_ARCH=
FILE_HASH=e37e99a1db555b43d54d98f8bd294bd808aed0b4791c9d1d94b05bcc783e66d6
NO_PROXY=.svc,.cluster.local,10.42.0.0/16,10.43.0.0/16
HOME=/

修正：

默认情况下，RKE2 为 etcd 生成一个唯一的证书颁发机构。该文件位于 /var/lib/rancher/rke2/server/tls/etcd/peer-ca.crt。如果此检查失败，请确保配置文件/var/lib/rancher/rke2/server/db/etcd/config 未被修改为使用共享的证书颁发机构。

3 控制平面配置

3.1 身份验证和授权

3.1.1 不应为用户使用客户端证书认证（手动）

*结果：*警告

修正： Kubernetes 提供的替代机制，如使用 OIDC，应替代客户端证书。

3.1.2 服务账户令牌认证不应用于用户（手动）

*结果：*警告

修正： 应实施 Kubernetes 提供的替代机制，例如使用 OIDC，来替代服务账户令牌。

3.1.3 启动令牌认证不应用于用户（手动）

*结果：*警告

修正： 应实施 Kubernetes 提供的替代机制，例如使用 OIDC，来替代启动令牌。

3.2 日志记录

3.2.1 确保创建最小审计策略（自动化）

*结果：*PASS

Audit:

/bin/ps -ef | grep kube-apiserver | grep -v grep

预期结果： '--审计策略文件' 存在

返回值：

root       18280   17706  5 16:15 ?        00:00:16 kube-apiserver --admission-control-config-file=/etc/rancher/rke2/rke2-pss.yaml --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --advertise-address=10.10.10.100 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --encryption-provider-config-automatic-reload=true --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-extend-token-expiration=false --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key
root       18380    2666  1 16:15 ?        00:00:04 kube-controller-manager --permit-port-sharing=true --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,tokencleaner,-service,-route,-cloud-node-lifecycle --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --tls-cert-file=/var/lib/rancher/rke2/server/tls/kube-controller-manager/kube-controller-manager.crt --tls-private-key-file=/var/lib/rancher/rke2/server/tls/kube-controller-manager/kube-controller-manager.key --use-service-account-credentials=true

修正：

为您的集群创建审计策略文件。

3.2.2 确保审计策略涵盖关键安全问题（手动）

*结果：*警告

修正： 审查为集群提供的审计策略，并确保它至少涵盖以下领域，

对集群管理的机密的访问。应谨慎处理，仅记录对机密、配置映射和令牌审查的请求的元数据，以避免记录敏感数据的风险。
对 Pod 和部署对象的修改。
使用 pods/exec、pods/portforward、pods/proxy 和 services/proxy。对于大多数请求，建议至少在元数据级别进行日志记录（最基本的日志记录级别）。

4 工作节点安全配置

4.1 工作节点配置文件

4.1.1 确保 kubelet 服务文件权限设置为 600 或更严格（自动化）

*结果：*不适用

说明：

kubelet 由 RKE2 进程管理。没有 kubelet 服务文件，所有配置在运行时作为参数传递。

4.1.2 确保 kubelet 服务文件的所有权设置为 root:root（自动化）

*结果：*不适用

说明：

kubelet 由 RKE2 进程管理。没有 kubelet 服务文件，所有配置在运行时作为参数传递。

4.1.3 如果代理 kubeconfig 文件存在，请确保权限设置为 600 或更严格（自动）

*结果：*PASS

Audit:

/bin/sh -c 'if test -e /var/lib/rancher/rke2/agent/kubeproxy.kubeconfig; then stat -c permissions=%a /var/lib/rancher/rke2/agent/kubeproxy.kubeconfig; fi'

预期结果： 权限为 600，预期为 600 或更严格

返回值：

permissions=600

修正：

在每个工作节点上运行以下命令（根据您系统上的文件位置）。例如，chmod 600 /var/lib/rancher/rke2/agent/kubeproxy.kubeconfig

4.1.4 如果代理 kubeconfig 文件存在，请确保所有权设置为 root:root（自动化）

*结果：*PASS

Audit:

/bin/sh -c 'if test -e /var/lib/rancher/rke2/agent/kubeproxy.kubeconfig; then stat -c %U:%G /var/lib/rancher/rke2/agent/kubeproxy.kubeconfig; fi'

预期结果： 'root:root' 存在

返回值：

root:root

修正：

在每个工作节点上运行以下命令（根据您系统上的文件位置）。例如，chown root:root /var/lib/rancher/rke2/agent/kubeproxy.kubeconfig

4.1.5 确保 --kubeconfig kubelet.conf 文件权限设置为 600 或更严格（自动化）

*结果：*PASS

Audit:

/bin/sh -c 'if test -e /var/lib/rancher/rke2/agent/kubelet.kubeconfig; then stat -c permissions=%a /var/lib/rancher/rke2/agent/kubelet.kubeconfig; fi'

预期结果： 权限为 600，预期为 600 或更严格

返回值：

permissions=600

修正：

在每个工作节点上运行以下命令（根据您系统上的文件位置）。例如，chmod 600 /var/lib/rancher/rke2/agent/kubelet.kubeconfig

4.1.6 确保 --kubeconfig kubelet.conf 文件所有权设置为 root:root（自动化）

*结果：*PASS

Audit:

/bin/sh -c 'if test -e /var/lib/rancher/rke2/agent/kubelet.kubeconfig; then stat -c %U:%G /var/lib/rancher/rke2/agent/kubelet.kubeconfig; fi'

预期结果： 'root:root' 等于 'root:root'

返回值：

root:root

修正：

在每个工作节点上运行以下命令（根据您系统上的文件位置）。例如，chown root:root /var/lib/rancher/rke2/agent/kubelet.kubeconfig

4.1.7 确保证书颁发机构文件权限设置为 600 或更严格（自动化）

*结果：*PASS

Audit:

/bin/sh -c 'if test -e /var/lib/rancher/rke2/agent/client-ca.crt; then stat -c permissions=%a /var/lib/rancher/rke2/agent/client-ca.crt; fi'

预期结果： 权限为 600，预期为 600 或更严格

返回值：

permissions=600

修正：

在每个工作节点上运行以下命令（根据您系统上的文件位置）。例如，chmod 600 /var/lib/rancher/rke2/agent/client-ca.crt

4.1.8 确保客户端证书颁发机构文件的所有权设置为 root:root（自动化）

*结果：*PASS

Audit:

/bin/sh -c 'if test -e /var/lib/rancher/rke2/agent/client-ca.crt; then stat -c %U:%G /var/lib/rancher/rke2/agent/client-ca.crt; fi'

预期结果： 'root:root' 等于 'root:root'

返回值：

root:root

修正：

运行以下命令以修改 --client-ca-file 的所有权。chown root:root /var/lib/rancher/rke2/agent/client-ca.crt

4.1.9 如果正在使用 kubelet config.yaml 配置文件，请验证权限设置为 600 或更严格（自动化）

*结果：*不适用

说明：

kubelet 由 RKE2 进程管理。没有 kubelet 配置文件，所有配置在运行时作为参数传递。

4.1.10 如果正在使用 kubelet config.yaml 配置文件，请验证文件所有权设置为 root:root（自动化）

*结果：*不适用

说明：

kubelet 由 RKE2 进程管理。没有 kubelet 配置文件，所有配置在运行时作为参数传递。

4.2 Kubelet

4.2.1 确保 --anonymous-auth 参数设置为 false（自动化）

*结果：*PASS

Audit:

/bin/cat /var/lib/rancher/rke2/agent/etc/kubelet.conf.d/00-rke2-defaults.conf

预期结果： '.authentication.anonymous.enabled' 等于 'false'

返回值：

address: 0.0.0.0
apiVersion: kubelet.config.k8s.io/v1beta1
authentication:
  anonymous:
    enabled: false
  webhook:
    cacheTTL: 2m0s
    enabled: true
  x509:
    clientCAFile: /var/lib/rancher/rke2/agent/client-ca.crt
authorization:
  mode: Webhook
  webhook:
    cacheAuthorizedTTL: 5m0s
    cacheUnauthorizedTTL: 30s
cgroupDriver: systemd
clusterDNS:
- 10.43.0.10
clusterDomain: cluster.local
containerRuntimeEndpoint: unix:///run/k3s/containerd/containerd.sock
cpuManagerReconcilePeriod: 10s
crashLoopBackOff: {}
evictionHard:
  imagefs.available: 5%
  nodefs.available: 5%
evictionMinimumReclaim:
  imagefs.available: 10%
  nodefs.available: 10%
evictionPressureTransitionPeriod: 5m0s
failSwapOn: false
fileCheckFrequency: 20s
healthzBindAddress: 127.0.0.1
httpCheckFrequency: 20s
imageMaximumGCAge: 0s
imageMinimumGCAge: 2m0s
kind: KubeletConfiguration
logging:
  flushFrequency: 5s
  format: text
  options:
    json:
      infoBufferSize: "0"
    text:
      infoBufferSize: "0"
  verbosity: 0
memorySwap: {}
nodeStatusReportFrequency: 5m0s
nodeStatusUpdateFrequency: 10s
protectKernelDefaults: true
resolvConf: /run/systemd/resolve/resolv.conf
runtimeRequestTimeout: 2m0s
serializeImagePulls: false
shutdownGracePeriod: 0s
shutdownGracePeriodCriticalPods: 0s
staticPodPath: /var/lib/rancher/rke2/agent/pod-manifests
streamingConnectionIdleTimeout: 4h0m0s
syncFrequency: 1m0s
tlsCertFile: /var/lib/rancher/rke2/agent/serving-kubelet.crt
tlsPrivateKeyFile: /var/lib/rancher/rke2/agent/serving-kubelet.key
volumeStatsAggPeriod: 1m0s

修正：

默认情况下，RKE2 将 --anonymous-auth 设置为 false。如果此检查失败，请编辑 RKE2 配置文件 /etc/rancher/rke2/config.yaml，删除任何类似于以下内容的行。

kubelet-arg:
  - "anonymous-auth=true"

根据您的系统，重启 RKE2 服务。例如，systemctl restart rke2-server.service

4.2.2 确保 --authorization-mode 参数未设置为 AlwaysAllow（自动化）

*结果：*PASS

Audit:

/bin/cat /var/lib/rancher/rke2/agent/etc/kubelet.conf.d/00-rke2-defaults.conf

预期结果： '.authorization.mode' 不包含 'AlwaysAllow'

返回值：

address: 0.0.0.0
apiVersion: kubelet.config.k8s.io/v1beta1
authentication:
  anonymous:
    enabled: false
  webhook:
    cacheTTL: 2m0s
    enabled: true
  x509:
    clientCAFile: /var/lib/rancher/rke2/agent/client-ca.crt
authorization:
  mode: Webhook
  webhook:
    cacheAuthorizedTTL: 5m0s
    cacheUnauthorizedTTL: 30s
cgroupDriver: systemd
clusterDNS:
- 10.43.0.10
clusterDomain: cluster.local
containerRuntimeEndpoint: unix:///run/k3s/containerd/containerd.sock
cpuManagerReconcilePeriod: 10s
crashLoopBackOff: {}
evictionHard:
  imagefs.available: 5%
  nodefs.available: 5%
evictionMinimumReclaim:
  imagefs.available: 10%
  nodefs.available: 10%
evictionPressureTransitionPeriod: 5m0s
failSwapOn: false
fileCheckFrequency: 20s
healthzBindAddress: 127.0.0.1
httpCheckFrequency: 20s
imageMaximumGCAge: 0s
imageMinimumGCAge: 2m0s
kind: KubeletConfiguration
logging:
  flushFrequency: 5s
  format: text
  options:
    json:
      infoBufferSize: "0"
    text:
      infoBufferSize: "0"
  verbosity: 0
memorySwap: {}
nodeStatusReportFrequency: 5m0s
nodeStatusUpdateFrequency: 10s
protectKernelDefaults: true
resolvConf: /run/systemd/resolve/resolv.conf
runtimeRequestTimeout: 2m0s
serializeImagePulls: false
shutdownGracePeriod: 0s
shutdownGracePeriodCriticalPods: 0s
staticPodPath: /var/lib/rancher/rke2/agent/pod-manifests
streamingConnectionIdleTimeout: 4h0m0s
syncFrequency: 1m0s
tlsCertFile: /var/lib/rancher/rke2/agent/serving-kubelet.crt
tlsPrivateKeyFile: /var/lib/rancher/rke2/agent/serving-kubelet.key
volumeStatsAggPeriod: 1m0s

修正：

默认情况下，RKE2 不会将 --authorization-mode 设置为 AlwaysAllow。如果此检查失败，请编辑 RKE2 配置文件 /etc/rancher/rke2/config.yaml，去除任何类似于以下内容的行。

kubelet-arg:
  - "authorization-mode=AlwaysAllow"

根据您的系统，重启 RKE2 服务。例如，systemctl restart rke2-server.service

4.2.3 确保 --client-ca-file 参数设置为适当值（自动化）

*结果：*PASS

Audit:

/bin/cat /var/lib/rancher/rke2/agent/etc/kubelet.conf.d/00-rke2-defaults.conf

预期结果： '.authentication.x509.clientCAFile' 存在

返回值：

address: 0.0.0.0
apiVersion: kubelet.config.k8s.io/v1beta1
authentication:
  anonymous:
    enabled: false
  webhook:
    cacheTTL: 2m0s
    enabled: true
  x509:
    clientCAFile: /var/lib/rancher/rke2/agent/client-ca.crt
authorization:
  mode: Webhook
  webhook:
    cacheAuthorizedTTL: 5m0s
    cacheUnauthorizedTTL: 30s
cgroupDriver: systemd
clusterDNS:
- 10.43.0.10
clusterDomain: cluster.local
containerRuntimeEndpoint: unix:///run/k3s/containerd/containerd.sock
cpuManagerReconcilePeriod: 10s
crashLoopBackOff: {}
evictionHard:
  imagefs.available: 5%
  nodefs.available: 5%
evictionMinimumReclaim:
  imagefs.available: 10%
  nodefs.available: 10%
evictionPressureTransitionPeriod: 5m0s
failSwapOn: false
fileCheckFrequency: 20s
healthzBindAddress: 127.0.0.1
httpCheckFrequency: 20s
imageMaximumGCAge: 0s
imageMinimumGCAge: 2m0s
kind: KubeletConfiguration
logging:
  flushFrequency: 5s
  format: text
  options:
    json:
      infoBufferSize: "0"
    text:
      infoBufferSize: "0"
  verbosity: 0
memorySwap: {}
nodeStatusReportFrequency: 5m0s
nodeStatusUpdateFrequency: 10s
protectKernelDefaults: true
resolvConf: /run/systemd/resolve/resolv.conf
runtimeRequestTimeout: 2m0s
serializeImagePulls: false
shutdownGracePeriod: 0s
shutdownGracePeriodCriticalPods: 0s
staticPodPath: /var/lib/rancher/rke2/agent/pod-manifests
streamingConnectionIdleTimeout: 4h0m0s
syncFrequency: 1m0s
tlsCertFile: /var/lib/rancher/rke2/agent/serving-kubelet.crt
tlsPrivateKeyFile: /var/lib/rancher/rke2/agent/serving-kubelet.key
volumeStatsAggPeriod: 1m0s

修正：

默认情况下，RKE2 会自动为 Kubelet 提供客户端 CA 证书。它是在 /var/lib/rancher/rke2/agent/client-ca.crt 生成并存放的。

4.2.4 验证如果定义了 --read-only-port 参数，则其设置为 0（自动化）

*结果：*PASS

Audit:

/bin/cat /var/lib/rancher/rke2/agent/etc/kubelet.conf.d/00-rke2-defaults.conf

预期结果： '--read-only-port' 等于 '0' 或 '--read-only-port' 不存在

返回值：

UID          PID    PPID  C STIME TTY          TIME CMD
root       17649   17422  2 16:15 ?        00:00:08 kubelet --volume-plugin-dir=/var/lib/kubelet/volumeplugins --file-check-frequency=5s --sync-frequency=30s --cloud-provider=external --config-dir=/var/lib/rancher/rke2/agent/etc/kubelet.conf.d --containerd=/run/k3s/containerd/containerd.sock --hostname-override=server-0 --kubeconfig=/var/lib/rancher/rke2/agent/kubelet.kubeconfig --node-ip=10.10.10.100 --node-labels= --read-only-port=0

修正：

默认情况下，RKE2 将 --read-only-port 设置为 0。如果您将此设置为其他值，您应该将其恢复为 0。编辑 RKE2 配置文件 /etc/rancher/rke2/config.yaml，去除任何类似于以下内容的行。

kubelet-arg:
  - "read-only-port=XXXX"

根据您的系统，重启 RKE2 服务。例如，systemctl restart rke2-server.service

4.2.5 确保 --streaming-connection-idle-timeout 参数未设置为 0（手动）

*结果：*PASS

Audit:

/bin/cat /var/lib/rancher/rke2/agent/etc/kubelet.conf.d/00-rke2-defaults.conf

预期结果： '.streamingConnectionIdleTimeout' 不等于 '0' 或 '.streamingConnectionIdleTimeout' 不存在

返回值：

address: 0.0.0.0
apiVersion: kubelet.config.k8s.io/v1beta1
authentication:
  anonymous:
    enabled: false
  webhook:
    cacheTTL: 2m0s
    enabled: true
  x509:
    clientCAFile: /var/lib/rancher/rke2/agent/client-ca.crt
authorization:
  mode: Webhook
  webhook:
    cacheAuthorizedTTL: 5m0s
    cacheUnauthorizedTTL: 30s
cgroupDriver: systemd
clusterDNS:
- 10.43.0.10
clusterDomain: cluster.local
containerRuntimeEndpoint: unix:///run/k3s/containerd/containerd.sock
cpuManagerReconcilePeriod: 10s
crashLoopBackOff: {}
evictionHard:
  imagefs.available: 5%
  nodefs.available: 5%
evictionMinimumReclaim:
  imagefs.available: 10%
  nodefs.available: 10%
evictionPressureTransitionPeriod: 5m0s
failSwapOn: false
fileCheckFrequency: 20s
healthzBindAddress: 127.0.0.1
httpCheckFrequency: 20s
imageMaximumGCAge: 0s
imageMinimumGCAge: 2m0s
kind: KubeletConfiguration
logging:
  flushFrequency: 5s
  format: text
  options:
    json:
      infoBufferSize: "0"
    text:
      infoBufferSize: "0"
  verbosity: 0
memorySwap: {}
nodeStatusReportFrequency: 5m0s
nodeStatusUpdateFrequency: 10s
protectKernelDefaults: true
resolvConf: /run/systemd/resolve/resolv.conf
runtimeRequestTimeout: 2m0s
serializeImagePulls: false
shutdownGracePeriod: 0s
shutdownGracePeriodCriticalPods: 0s
staticPodPath: /var/lib/rancher/rke2/agent/pod-manifests
streamingConnectionIdleTimeout: 4h0m0s
syncFrequency: 1m0s
tlsCertFile: /var/lib/rancher/rke2/agent/serving-kubelet.crt
tlsPrivateKeyFile: /var/lib/rancher/rke2/agent/serving-kubelet.key
volumeStatsAggPeriod: 1m0s

修正：

编辑 RKE2 配置文件 /etc/rancher/rke2/config.yaml，将以下参数设置为适当的值。

kubelet-arg:
  - "streaming-connection-idle-timeout=5m"

根据您的系统，重启 RKE2 服务。例如，systemctl restart rke2-server.service

4.2.6 确保 --make-iptables-util-chains 参数设置为 true（自动化）

*结果：*PASS

Audit:

/bin/cat /var/lib/rancher/rke2/agent/etc/kubelet.conf.d/00-rke2-defaults.conf

预期结果： '.makeIPTablesUtilChains' 存在或 '.makeIPTablesUtilChains' 不存在

返回值：

address: 0.0.0.0
apiVersion: kubelet.config.k8s.io/v1beta1
authentication:
  anonymous:
    enabled: false
  webhook:
    cacheTTL: 2m0s
    enabled: true
  x509:
    clientCAFile: /var/lib/rancher/rke2/agent/client-ca.crt
authorization:
  mode: Webhook
  webhook:
    cacheAuthorizedTTL: 5m0s
    cacheUnauthorizedTTL: 30s
cgroupDriver: systemd
clusterDNS:
- 10.43.0.10
clusterDomain: cluster.local
containerRuntimeEndpoint: unix:///run/k3s/containerd/containerd.sock
cpuManagerReconcilePeriod: 10s
crashLoopBackOff: {}
evictionHard:
  imagefs.available: 5%
  nodefs.available: 5%
evictionMinimumReclaim:
  imagefs.available: 10%
  nodefs.available: 10%
evictionPressureTransitionPeriod: 5m0s
failSwapOn: false
fileCheckFrequency: 20s
healthzBindAddress: 127.0.0.1
httpCheckFrequency: 20s
imageMaximumGCAge: 0s
imageMinimumGCAge: 2m0s
kind: KubeletConfiguration
logging:
  flushFrequency: 5s
  format: text
  options:
    json:
      infoBufferSize: "0"
    text:
      infoBufferSize: "0"
  verbosity: 0
memorySwap: {}
nodeStatusReportFrequency: 5m0s
nodeStatusUpdateFrequency: 10s
protectKernelDefaults: true
resolvConf: /run/systemd/resolve/resolv.conf
runtimeRequestTimeout: 2m0s
serializeImagePulls: false
shutdownGracePeriod: 0s
shutdownGracePeriodCriticalPods: 0s
staticPodPath: /var/lib/rancher/rke2/agent/pod-manifests
streamingConnectionIdleTimeout: 4h0m0s
syncFrequency: 1m0s
tlsCertFile: /var/lib/rancher/rke2/agent/serving-kubelet.crt
tlsPrivateKeyFile: /var/lib/rancher/rke2/agent/serving-kubelet.key
volumeStatsAggPeriod: 1m0s

修正：

编辑 RKE2 配置文件 /etc/rancher/rke2/config.yaml，设置以下参数。

kubelet-arg:
  - "make-iptables-util-chains=true"

或者，去除 --make-iptables-util-chains 参数，让 RKE2 使用默认值。根据您的系统，重启 RKE2 服务。例如，systemctl restart rke2-server.service

4.2.7 确保未设置 --hostname-override 参数（自动化）

*结果：*不适用

说明：

默认情况下，RKE2 会设置 --hostname-override 参数。根据 CIS 指南，这是为了遵守要求此标志的云服务提供商，以确保主机名与节点名称匹配。

4.2.8 确保 eventRecordQPS 参数设置为确保适当事件捕获的级别（手动）

*结果：*PASS

Audit:

/bin/cat /var/lib/rancher/rke2/agent/etc/kubelet.conf.d/00-rke2-defaults.conf

预期结果： '.eventRecordQPS' 存在或 '.eventRecordQPS' 不存在

返回值：

address: 0.0.0.0
apiVersion: kubelet.config.k8s.io/v1beta1
authentication:
  anonymous:
    enabled: false
  webhook:
    cacheTTL: 2m0s
    enabled: true
  x509:
    clientCAFile: /var/lib/rancher/rke2/agent/client-ca.crt
authorization:
  mode: Webhook
  webhook:
    cacheAuthorizedTTL: 5m0s
    cacheUnauthorizedTTL: 30s
cgroupDriver: systemd
clusterDNS:
- 10.43.0.10
clusterDomain: cluster.local
containerRuntimeEndpoint: unix:///run/k3s/containerd/containerd.sock
cpuManagerReconcilePeriod: 10s
crashLoopBackOff: {}
evictionHard:
  imagefs.available: 5%
  nodefs.available: 5%
evictionMinimumReclaim:
  imagefs.available: 10%
  nodefs.available: 10%
evictionPressureTransitionPeriod: 5m0s
failSwapOn: false
fileCheckFrequency: 20s
healthzBindAddress: 127.0.0.1
httpCheckFrequency: 20s
imageMaximumGCAge: 0s
imageMinimumGCAge: 2m0s
kind: KubeletConfiguration
logging:
  flushFrequency: 5s
  format: text
  options:
    json:
      infoBufferSize: "0"
    text:
      infoBufferSize: "0"
  verbosity: 0
memorySwap: {}
nodeStatusReportFrequency: 5m0s
nodeStatusUpdateFrequency: 10s
protectKernelDefaults: true
resolvConf: /run/systemd/resolve/resolv.conf
runtimeRequestTimeout: 2m0s
serializeImagePulls: false
shutdownGracePeriod: 0s
shutdownGracePeriodCriticalPods: 0s
staticPodPath: /var/lib/rancher/rke2/agent/pod-manifests
streamingConnectionIdleTimeout: 4h0m0s
syncFrequency: 1m0s
tlsCertFile: /var/lib/rancher/rke2/agent/serving-kubelet.crt
tlsPrivateKeyFile: /var/lib/rancher/rke2/agent/serving-kubelet.key
volumeStatsAggPeriod: 1m0s

修正：

编辑 RKE2 配置文件 /etc/rancher/rke2/config.yaml，将以下参数设置为适当的值。

kubelet-arg:
  - "event-qps=<value>"

根据您的系统，重启 RKE2 服务。例如，systemctl restart rke2-server.service

4.2.9 确保 --tls-cert-file 和 --tls-private-key-file 参数设置为适当值（自动化）

*结果：*PASS

Audit:

/bin/cat /var/lib/rancher/rke2/agent/etc/kubelet.conf.d/00-rke2-defaults.conf

预期结果： '.tlsCertFile' 存在且 '.tlsPrivateKeyFile' 存在

返回值：

address: 0.0.0.0
apiVersion: kubelet.config.k8s.io/v1beta1
authentication:
  anonymous:
    enabled: false
  webhook:
    cacheTTL: 2m0s
    enabled: true
  x509:
    clientCAFile: /var/lib/rancher/rke2/agent/client-ca.crt
authorization:
  mode: Webhook
  webhook:
    cacheAuthorizedTTL: 5m0s
    cacheUnauthorizedTTL: 30s
cgroupDriver: systemd
clusterDNS:
- 10.43.0.10
clusterDomain: cluster.local
containerRuntimeEndpoint: unix:///run/k3s/containerd/containerd.sock
cpuManagerReconcilePeriod: 10s
crashLoopBackOff: {}
evictionHard:
  imagefs.available: 5%
  nodefs.available: 5%
evictionMinimumReclaim:
  imagefs.available: 10%
  nodefs.available: 10%
evictionPressureTransitionPeriod: 5m0s
failSwapOn: false
fileCheckFrequency: 20s
healthzBindAddress: 127.0.0.1
httpCheckFrequency: 20s
imageMaximumGCAge: 0s
imageMinimumGCAge: 2m0s
kind: KubeletConfiguration
logging:
  flushFrequency: 5s
  format: text
  options:
    json:
      infoBufferSize: "0"
    text:
      infoBufferSize: "0"
  verbosity: 0
memorySwap: {}
nodeStatusReportFrequency: 5m0s
nodeStatusUpdateFrequency: 10s
protectKernelDefaults: true
resolvConf: /run/systemd/resolve/resolv.conf
runtimeRequestTimeout: 2m0s
serializeImagePulls: false
shutdownGracePeriod: 0s
shutdownGracePeriodCriticalPods: 0s
staticPodPath: /var/lib/rancher/rke2/agent/pod-manifests
streamingConnectionIdleTimeout: 4h0m0s
syncFrequency: 1m0s
tlsCertFile: /var/lib/rancher/rke2/agent/serving-kubelet.crt
tlsPrivateKeyFile: /var/lib/rancher/rke2/agent/serving-kubelet.key
volumeStatsAggPeriod: 1m0s

修正：

默认情况下，RKE2 会自动提供 Kubelet 的 TLS 证书和私钥。它们被生成并位于 /var/lib/rancher/rke2/agent/serving-kubelet.crt 和 /var/lib/rancher/rke2/agent/serving-kubelet.key。如果此检查失败，请编辑 RKE2 配置文件 /etc/rancher/rke2/config.yaml，并去除任何类似于以下内容的行。

kubelet-arg:
  - "tls-cert-file=<path/to/tls-cert-file>"
  - "tls-private-key-file=<path/to/tls-private-key-file>"

4.2.10 确保 --rotate-certificates 参数未设置为 false（自动化）

*结果：*PASS

Audit:

/bin/cat /var/lib/rancher/rke2/agent/etc/kubelet.conf.d/00-rke2-defaults.conf

预期结果: '.rotateCertificates' 存在或 '.rotateCertificates' 不存在

返回值:

address: 0.0.0.0
apiVersion: kubelet.config.k8s.io/v1beta1
authentication:
  anonymous:
    enabled: false
  webhook:
    cacheTTL: 2m0s
    enabled: true
  x509:
    clientCAFile: /var/lib/rancher/rke2/agent/client-ca.crt
authorization:
  mode: Webhook
  webhook:
    cacheAuthorizedTTL: 5m0s
    cacheUnauthorizedTTL: 30s
cgroupDriver: systemd
clusterDNS:
- 10.43.0.10
clusterDomain: cluster.local
containerRuntimeEndpoint: unix:///run/k3s/containerd/containerd.sock
cpuManagerReconcilePeriod: 10s
crashLoopBackOff: {}
evictionHard:
  imagefs.available: 5%
  nodefs.available: 5%
evictionMinimumReclaim:
  imagefs.available: 10%
  nodefs.available: 10%
evictionPressureTransitionPeriod: 5m0s
failSwapOn: false
fileCheckFrequency: 20s
healthzBindAddress: 127.0.0.1
httpCheckFrequency: 20s
imageMaximumGCAge: 0s
imageMinimumGCAge: 2m0s
kind: KubeletConfiguration
logging:
  flushFrequency: 5s
  format: text
  options:
    json:
      infoBufferSize: "0"
    text:
      infoBufferSize: "0"
  verbosity: 0
memorySwap: {}
nodeStatusReportFrequency: 5m0s
nodeStatusUpdateFrequency: 10s
protectKernelDefaults: true
resolvConf: /run/systemd/resolve/resolv.conf
runtimeRequestTimeout: 2m0s
serializeImagePulls: false
shutdownGracePeriod: 0s
shutdownGracePeriodCriticalPods: 0s
staticPodPath: /var/lib/rancher/rke2/agent/pod-manifests
streamingConnectionIdleTimeout: 4h0m0s
syncFrequency: 1m0s
tlsCertFile: /var/lib/rancher/rke2/agent/serving-kubelet.crt
tlsPrivateKeyFile: /var/lib/rancher/rke2/agent/serving-kubelet.key
volumeStatsAggPeriod: 1m0s

修正：

默认情况下，RKE2 不会设置 --rotate-certificates 参数。如果此检查失败，请编辑 RKE2 配置文件 /etc/rancher/rke2/config.yaml，去除任何 rotate-certificates 参数。根据您的系统，重启 RKE2 服务。例如，systemctl restart rke2-server.service

4.2.11 验证 RotateKubeletServerCertificate 参数是否设置为 true（自动化）

*结果：*PASS

Audit:

/bin/cat /var/lib/rancher/rke2/agent/etc/kubelet.conf.d/00-rke2-defaults.conf

预期结果: '.featureGates.RotateKubeletServerCertificate' 存在或 '.featureGates.RotateKubeletServerCertificate' 不存在

返回值:

address: 0.0.0.0
apiVersion: kubelet.config.k8s.io/v1beta1
authentication:
  anonymous:
    enabled: false
  webhook:
    cacheTTL: 2m0s
    enabled: true
  x509:
    clientCAFile: /var/lib/rancher/rke2/agent/client-ca.crt
authorization:
  mode: Webhook
  webhook:
    cacheAuthorizedTTL: 5m0s
    cacheUnauthorizedTTL: 30s
cgroupDriver: systemd
clusterDNS:
- 10.43.0.10
clusterDomain: cluster.local
containerRuntimeEndpoint: unix:///run/k3s/containerd/containerd.sock
cpuManagerReconcilePeriod: 10s
crashLoopBackOff: {}
evictionHard:
  imagefs.available: 5%
  nodefs.available: 5%
evictionMinimumReclaim:
  imagefs.available: 10%
  nodefs.available: 10%
evictionPressureTransitionPeriod: 5m0s
failSwapOn: false
fileCheckFrequency: 20s
healthzBindAddress: 127.0.0.1
httpCheckFrequency: 20s
imageMaximumGCAge: 0s
imageMinimumGCAge: 2m0s
kind: KubeletConfiguration
logging:
  flushFrequency: 5s
  format: text
  options:
    json:
      infoBufferSize: "0"
    text:
      infoBufferSize: "0"
  verbosity: 0
memorySwap: {}
nodeStatusReportFrequency: 5m0s
nodeStatusUpdateFrequency: 10s
protectKernelDefaults: true
resolvConf: /run/systemd/resolve/resolv.conf
runtimeRequestTimeout: 2m0s
serializeImagePulls: false
shutdownGracePeriod: 0s
shutdownGracePeriodCriticalPods: 0s
staticPodPath: /var/lib/rancher/rke2/agent/pod-manifests
streamingConnectionIdleTimeout: 4h0m0s
syncFrequency: 1m0s
tlsCertFile: /var/lib/rancher/rke2/agent/serving-kubelet.crt
tlsPrivateKeyFile: /var/lib/rancher/rke2/agent/serving-kubelet.key
volumeStatsAggPeriod: 1m0s

修正：

默认情况下，RKE2 不会设置 RotateKubeletServerCertificate 功能开关。如果此检查失败，请编辑 RKE2 配置文件 /etc/rancher/rke2/config.yaml，去除任何 RotateKubeletServerCertificate 参数。根据您的系统，重启 RKE2 服务。例如，systemctl restart rke2-server.service

4.2.12 确保 Kubelet 仅使用强加密套件（手动）

*结果：*警告

修正： 编辑 RKE2 配置文件 /etc/rancher/rke2/config.yaml，

kubelet-arg:
  - "tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305"

或这些值的子集。根据您的系统，重启 RKE2 服务。例如，systemctl restart rke2-server.service

4.2.13 确保对 pod PIDs 设置了限制（手动）

*结果：*警告

修正： 编辑 RKE2 配置文件 /etc/rancher/rke2/config.yaml，将以下参数设置为适当的值。

kubelet-arg:
  - "pod-max-pids=<value>"

根据您的系统，重启 RKE2 服务。例如，systemctl restart rke2-server.service

4.2.14 确保 --seccomp-default 参数设置为 true（手动）

*结果：*警告

修正: 如果启用，kubelet 将默认使用 RuntimeDefault seccomp 配置文件，该配置文件由容器运行时定义，而不是使用 Unconfined（禁用 seccomp）模式（默认）。如果使用 RKE2 配置文件 /etc/rancher/rke2/config.yaml，请编辑该文件以将 seccomp-default 设置为 kubelet-arg:

"seccomp-default=true"

4.3 kube-proxy

4.3.1 确保 kube-proxy 指标服务绑定到 localhost（自动化）

*结果：*PASS

Audit:

/bin/sh -c 'if test -e /etc/kubernetes/addons/kube-proxy-daemonset.yaml; then cat /etc/kubernetes/addons/kube-proxy-daemonset.yaml; fi'

预期结果： '--metrics-bind-address' 存在或者 '--metrics-bind-address' 不存在

返回值:

UID          PID    PPID  C STIME TTY          TIME CMD
root       19921   19868  0 16:17 ?        00:00:00 kube-proxy --cluster-cidr=10.42.0.0/16 --conntrack-max-per-core=0 --conntrack-tcp-timeout-close-wait=0s --conntrack-tcp-timeout-established=0s --healthz-bind-address=127.0.0.1 --hostname-override=server-0 --kubeconfig=/var/lib/rancher/rke2/agent/kubeproxy.kubeconfig --proxy-mode=iptables

修正:

修改或删除任何将指标服务绑定到非 localhost 地址的值。默认值为 127.0.0.1:10249。

5 个 Kubernetes 策略

5.1 RBAC 和服务账户

5.1.1 确保 cluster-admin 角色仅在需要时使用（手动）

*结果：*PASS

Audit:

kubectl get clusterrolebindings -o=custom-columns=ROLE:.roleRef.name,NAME:.metadata.name,SUBJECT:.subjects[*].name --no-headers |  grep cluster-admin

预期结果： 'cluster-admin' 被正则表达式 'cluster-admin' 匹配

helm-kube-system-rke2-.*'

返回值：

cluster-admin                                                   cluster-admin                                                   system:masters
cluster-admin                                                   helm-kube-system-rke2-canal                                     helm-rke2-canal
cluster-admin                                                   helm-kube-system-rke2-coredns                                   helm-rke2-coredns
cluster-admin                                                   helm-kube-system-rke2-ingress-nginx                             helm-rke2-ingress-nginx
cluster-admin                                                   helm-kube-system-rke2-metrics-server                            helm-rke2-metrics-server
cluster-admin                                                   helm-kube-system-rke2-runtimeclasses                            helm-rke2-runtimeclasses
cluster-admin                                                   helm-kube-system-rke2-snapshot-controller                       helm-rke2-snapshot-controller
cluster-admin                                                   helm-kube-system-rke2-snapshot-controller-crd                   helm-rke2-snapshot-controller-crd

修正:

识别所有与 cluster-admin 角色相关的 clusterrolebindings。检查它们是否被使用，以及它们是否需要此角色，或者是否可以使用具有更少权限的角色。RKE2 对 helm-kube-system-rke2-* clusterrolebindings 给予例外，这些角色绑定处理所有 rke2 管理组件的安装。在可能的情况下，首先将用户绑定到权限较低的角色，然后移除与 cluster-admin 角色的 clusterrolebinding：

kubectl delete clusterrolebinding [name]

5.1.2 最小化对机密的访问（手动）

*结果：*警告

修正： 在可能的情况下，去除对集群中 Secret 对象的获取、列出和监视访问。

5.1.3 最小化角色和集群角色中的通配符使用（手动）

*结果：*PASS

Audit:

# Check Roles
kubectl get roles --all-namespaces -o custom-columns=ROLE_NAMESPACE:.metadata.namespace,ROLE_NAME:.metadata.name --no-headers | while read -r role_namespace role_name
do
  role_rules=$(kubectl get role -n "${role_namespace}" "${role_name}" -o=json | jq -c '.rules')
  if echo "${role_rules}" | grep -q "\[\"\*\"\]"; then
    printf "**role_name: %-50s  role_namespace: %-25s role_rules: %s is_compliant: false\n" "${role_name}" "${role_namespace}" "${role_rules}"
  else
    printf "**role_name: %-50s role_namespace: %-25s is_compliant: true\n" "${role_name}" "${role_namespace}"
  fi;
done

cr_whitelist="cluster-admin rke2-cloud-controller-manager local-path-provisioner-role"
cr_whitelist="$cr_whitelist system:kube-controller-manager system:kubelet-api-admin system:controller:namespace-controller"
cr_whitelist="$cr_whitelist system:controller:disruption-controller system:controller:generic-garbage-collector"
cr_whitelist="$cr_whitelist system:controller:horizontal-pod-autoscaler system:controller:resourcequota-controller"
# Check ClusterRoles
kubectl get clusterroles -o custom-columns=CLUSTERROLE_NAME:.metadata.name --no-headers | while read -r clusterrole_name
do
  clusterrole_rules=$(kubectl get clusterrole "${clusterrole_name}" -o=json | jq -c '.rules')
  if echo "${cr_whitelist}" | grep -q "${clusterrole_name}"; then
    printf "**clusterrole_name: %-50s is_whitelist: true  is_compliant: true\n" "${clusterrole_name}"
  elif echo "${clusterrole_rules}" | grep -q "\[\"\*\"\]"; then
    echo "**clusterrole_name: ${clusterrole_name} clusterrole_rules: ${clusterrole_rules} is_compliant: false"
  else
    printf "**clusterrole_name: %-50s is_whitelist: false is_compliant: true\n" "${clusterrole_name}"
  fi;
done

预期结果: 'is_compliant' 等于 'true'

返回值:

**role_name: system:controller:bootstrap-signer                 role_namespace: kube-public               is_compliant: true
**role_name: extension-apiserver-authentication-reader          role_namespace: kube-system               is_compliant: true
**role_name: rke2-ingress-nginx                                 role_namespace: kube-system               is_compliant: true
**role_name: rke2-snapshot-controller                           role_namespace: kube-system               is_compliant: true
**role_name: system::leader-locking-kube-controller-manager     role_namespace: kube-system               is_compliant: true
**role_name: system::leader-locking-kube-scheduler              role_namespace: kube-system               is_compliant: true
**role_name: system:controller:bootstrap-signer                 role_namespace: kube-system               is_compliant: true
**role_name: system:controller:cloud-provider                   role_namespace: kube-system               is_compliant: true
**role_name: system:controller:token-cleaner                    role_namespace: kube-system               is_compliant: true
**clusterrole_name: admin                                              is_whitelist: true  is_compliant: true
**clusterrole_name: calico-node                                        is_whitelist: false is_compliant: true
**clusterrole_name: cluster-admin                                      is_whitelist: true  is_compliant: true
**clusterrole_name: edit                                               is_whitelist: false is_compliant: true
**clusterrole_name: flannel                                            is_whitelist: false is_compliant: true
**clusterrole_name: rke2-cloud-controller-manager                      is_whitelist: true  is_compliant: true
**clusterrole_name: rke2-coredns-rke2-coredns                          is_whitelist: false is_compliant: true
**clusterrole_name: rke2-coredns-rke2-coredns-autoscaler               is_whitelist: false is_compliant: true
**clusterrole_name: rke2-ingress-nginx                                 is_whitelist: false is_compliant: true
**clusterrole_name: rke2-snapshot-controller                           is_whitelist: false is_compliant: true
**clusterrole_name: system:aggregate-to-admin                          is_whitelist: false is_compliant: true
**clusterrole_name: system:aggregate-to-edit                           is_whitelist: false is_compliant: true
**clusterrole_name: system:aggregate-to-view                           is_whitelist: false is_compliant: true
**clusterrole_name: system:auth-delegator                              is_whitelist: false is_compliant: true
**clusterrole_name: system:basic-user                                  is_whitelist: false is_compliant: true
**clusterrole_name: system:certificates.k8s.io:certificatesigningrequests:nodeclient is_whitelist: false is_compliant: true
**clusterrole_name: system:certificates.k8s.io:certificatesigningrequests:selfnodeclient is_whitelist: false is_compliant: true
**clusterrole_name: system:certificates.k8s.io:kube-apiserver-client-approver is_whitelist: false is_compliant: true
**clusterrole_name: system:certificates.k8s.io:kube-apiserver-client-kubelet-approver is_whitelist: false is_compliant: true
**clusterrole_name: system:certificates.k8s.io:kubelet-serving-approver is_whitelist: false is_compliant: true
**clusterrole_name: system:certificates.k8s.io:legacy-unknown-approver is_whitelist: false is_compliant: true
**clusterrole_name: system:controller:attachdetach-controller          is_whitelist: false is_compliant: true
**clusterrole_name: system:controller:certificate-controller           is_whitelist: false is_compliant: true
**clusterrole_name: system:controller:clusterrole-aggregation-controller is_whitelist: false is_compliant: true
**clusterrole_name: system:controller:cronjob-controller               is_whitelist: false is_compliant: true
**clusterrole_name: system:controller:daemon-set-controller            is_whitelist: false is_compliant: true
**clusterrole_name: system:controller:deployment-controller            is_whitelist: false is_compliant: true
**clusterrole_name: system:controller:disruption-controller            is_whitelist: true  is_compliant: true
**clusterrole_name: system:controller:endpoint-controller              is_whitelist: false is_compliant: true
**clusterrole_name: system:controller:endpointslice-controller         is_whitelist: false is_compliant: true
**clusterrole_name: system:controller:endpointslicemirroring-controller is_whitelist: false is_compliant: true
**clusterrole_name: system:controller:ephemeral-volume-controller      is_whitelist: false is_compliant: true
**clusterrole_name: system:controller:expand-controller                is_whitelist: false is_compliant: true
**clusterrole_name: system:controller:generic-garbage-collector        is_whitelist: true  is_compliant: true
**clusterrole_name: system:controller:horizontal-pod-autoscaler        is_whitelist: true  is_compliant: true
**clusterrole_name: system:controller:job-controller                   is_whitelist: false is_compliant: true
**clusterrole_name: system:controller:legacy-service-account-token-cleaner is_whitelist: false is_compliant: true
**clusterrole_name: system:controller:namespace-controller             is_whitelist: true  is_compliant: true
**clusterrole_name: system:controller:node-controller                  is_whitelist: false is_compliant: true
**clusterrole_name: system:controller:persistent-volume-binder         is_whitelist: false is_compliant: true
**clusterrole_name: system:controller:pod-garbage-collector            is_whitelist: false is_compliant: true
**clusterrole_name: system:controller:pv-protection-controller         is_whitelist: false is_compliant: true
**clusterrole_name: system:controller:pvc-protection-controller        is_whitelist: false is_compliant: true
**clusterrole_name: system:controller:replicaset-controller            is_whitelist: false is_compliant: true
**clusterrole_name: system:controller:replication-controller           is_whitelist: false is_compliant: true
**clusterrole_name: system:controller:resourcequota-controller         is_whitelist: true  is_compliant: true
**clusterrole_name: system:controller:root-ca-cert-publisher           is_whitelist: false is_compliant: true
**clusterrole_name: system:controller:route-controller                 is_whitelist: false is_compliant: true
**clusterrole_name: system:controller:service-account-controller       is_whitelist: false is_compliant: true
**clusterrole_name: system:controller:service-controller               is_whitelist: false is_compliant: true
**clusterrole_name: system:controller:statefulset-controller           is_whitelist: false is_compliant: true
**clusterrole_name: system:controller:ttl-after-finished-controller    is_whitelist: false is_compliant: true
**clusterrole_name: system:controller:ttl-controller                   is_whitelist: false is_compliant: true
**clusterrole_name: system:controller:validatingadmissionpolicy-status-controller is_whitelist: false is_compliant: true
**clusterrole_name: system:discovery                                   is_whitelist: false is_compliant: true
**clusterrole_name: system:heapster                                    is_whitelist: false is_compliant: true
**clusterrole_name: system:kube-aggregator                             is_whitelist: false is_compliant: true
**clusterrole_name: system:kube-controller-manager                     is_whitelist: true  is_compliant: true
**clusterrole_name: system:kube-dns                                    is_whitelist: false is_compliant: true
**clusterrole_name: system:kube-proxy                                  is_whitelist: false is_compliant: true
**clusterrole_name: system:kube-scheduler                              is_whitelist: false is_compliant: true
**clusterrole_name: system:kubelet-api-admin                           is_whitelist: true  is_compliant: true
**clusterrole_name: system:monitoring                                  is_whitelist: false is_compliant: true
**clusterrole_name: system:node                                        is_whitelist: false is_compliant: true
**clusterrole_name: system:node-bootstrapper                           is_whitelist: false is_compliant: true
**clusterrole_name: system:node-problem-detector                       is_whitelist: false is_compliant: true
**clusterrole_name: system:node-proxier                                is_whitelist: false is_compliant: true
**clusterrole_name: system:persistent-volume-provisioner               is_whitelist: false is_compliant: true
**clusterrole_name: system:public-info-viewer                          is_whitelist: false is_compliant: true
**clusterrole_name: system:rke2-controller                             is_whitelist: false is_compliant: true
**clusterrole_name: system:rke2-metrics-server                         is_whitelist: false is_compliant: true
**clusterrole_name: system:rke2-metrics-server-aggregated-reader       is_whitelist: false is_compliant: true
**clusterrole_name: system:service-account-issuer-discovery            is_whitelist: false is_compliant: true
**clusterrole_name: system:volume-scheduler                            is_whitelist: false is_compliant: true
**clusterrole_name: view                                               is_whitelist: false is_compliant: true

修正:

在可能的情况下，将集群角色和角色中的任何通配符使用替换为特定对象或操作。 RKE2 对以下集群角色给予例外，这些角色是常规操作所必需的：

rke2-cloud-controller-manager, local-path-provisioner-role, cluster-admin
system:kube-controller-manager, system:kubelet-api-admin, system:controller:namespace-controller,
system:controller:disruption-controller, system:controller:generic-garbage-collector,
system:controller:horizontal-pod-autoscaler, system:controller:resourcequota-controller

5.1.4 最小化对创建 Pod 的访问（手动）

*结果：*PASS

Audit:

echo "canCreatePodsAsSystemAuthenticated: $(kubectl auth can-i create pods --all-namespaces --as=system:authenticated)"

预期结果： 'canCreatePodsAsSystemAuthenticated' 等于 'no'

返回值:

canCreatePodsAsSystemAuthenticated: no

修正:

在可能的情况下，去除对集群中 Pod 对象的创建访问。

5.1.5 确保默认服务账户未被积极使用。（手动）

*结果：*PASS

Audit:

kubectl get serviceaccounts --all-namespaces --field-selector metadata.name=default \
-o custom-columns=N:.metadata.namespace,SA:.metadata.name,ASA:.automountServiceAccountToken --no-headers \
| while read -r namespace serviceaccount automountserviceaccounttoken
do
  if [ "${automountserviceaccounttoken}" = "<none>" ]; then
    automountserviceaccounttoken="notset"
  fi
  if [ "${namespace}" != "kube-system" ] && [ "${automountserviceaccounttoken}" != "false" ]; then
    printf "**namespace: %-20s service_account: %-10s automountServiceAccountToken: %-6s is_compliant: false\n" "${namespace}" "${serviceaccount}" "${automountserviceaccounttoken}"
  else
    printf "**namespace: %-20s service_account: %-10s automountServiceAccountToken: %-6s is_compliant: true\n" "${namespace}" "${serviceaccount}" "${automountserviceaccounttoken}"
  fi
done

预期结果: 'is_compliant' 等于 'true'

返回值:

**namespace: default              service_account: default    automountServiceAccountToken: false  is_compliant: true
**namespace: kube-node-lease      service_account: default    automountServiceAccountToken: false  is_compliant: true
**namespace: kube-public          service_account: default    automountServiceAccountToken: false  is_compliant: true
**namespace: kube-system          service_account: default    automountServiceAccountToken: false  is_compliant: true

修正:

在 Kubernetes 工作负载需要特定访问 Kubernetes API 服务器的地方创建显式服务账户。修改每个默认服务帐户的配置以包含此值 automountServiceAccountToken: false 或使用 kubectl:

kubectl patch serviceaccount --namespace <NAMESPACE>lt;NAMESPACE<NAMESPACE>gt; default --patch '{"automountServiceAccountToken": false}'

5.1.6 确保服务帐户令牌仅在必要时挂载（手动）

*结果：*PASS

Audit:

kubectl get pods --all-namespaces -o custom-columns=POD_NAMESPACE:.metadata.namespace,POD_NAME:.metadata.name,POD_SERVICE_ACCOUNT:.spec.serviceAccount,POD_IS_AUTOMOUNTSERVICEACCOUNTTOKEN:.spec.automountServiceAccountToken --no-headers | while read -r pod_namespace pod_name pod_service_account pod_is_automountserviceaccounttoken
do
  # Skip pods with no service account
  if [ "${pod_service_account}" = "<none>" ]; then
    continue
  fi
  # Retrieve automountServiceAccountToken's value for ServiceAccount and Pod, set to notset if null or <none>.
  svacc_is_automountserviceaccounttoken=$(kubectl get serviceaccount -n "${pod_namespace}" "${pod_service_account}" -o json | jq -r '.automountServiceAccountToken' | sed -e 's/<none>/notset/g' -e 's/null/notset/g')
  pod_is_automountserviceaccounttoken=$(echo "${pod_is_automountserviceaccounttoken}" | sed -e 's/<none>/notset/g' -e 's/null/notset/g')
  if [ "${svacc_is_automountserviceaccounttoken}" = "false" ] && ( [ "${pod_is_automountserviceaccounttoken}" = "false" ] || [ "${pod_is_automountserviceaccounttoken}" = "notset" ] ); then
    is_compliant="true"
  elif [ "${svacc_is_automountserviceaccounttoken}" = "true" ] && [ "${pod_is_automountserviceaccounttoken}" = "false" ]; then
    is_compliant="true"
  else
    is_compliant="false"
  fi
  # Whitelist kube-system namespace as these pods are expected to contact the apiserver
  if [ "${pod_namespace}" = "kube-system" ]; then
    is_compliant="true"
  fi
  echo "**namespace: ${pod_namespace} pod_name: ${pod_name} service_account: ${pod_service_account} pod_is_automountserviceaccounttoken: ${pod_is_automountserviceaccounttoken} svacc_is_automountServiceAccountToken: ${svacc_is_automountserviceaccounttoken} is_compliant: ${is_compliant}"
done

预期结果: 'is_compliant' 等于 'true'

返回值:

**namespace: kube-system pod_name: helm-install-rke2-canal-789dp service_account: helm-rke2-canal pod_is_automountserviceaccounttoken: notset svacc_is_automountServiceAccountToken: true is_compliant: true
**namespace: kube-system pod_name: helm-install-rke2-coredns-c8whl service_account: helm-rke2-coredns pod_is_automountserviceaccounttoken: notset svacc_is_automountServiceAccountToken: true is_compliant: true
**namespace: kube-system pod_name: helm-install-rke2-ingress-nginx-gqtvn service_account: helm-rke2-ingress-nginx pod_is_automountserviceaccounttoken: notset svacc_is_automountServiceAccountToken: true is_compliant: true
**namespace: kube-system pod_name: helm-install-rke2-metrics-server-7jckf service_account: helm-rke2-metrics-server pod_is_automountserviceaccounttoken: notset svacc_is_automountServiceAccountToken: true is_compliant: true
**namespace: kube-system pod_name: helm-install-rke2-runtimeclasses-2zdbw service_account: helm-rke2-runtimeclasses pod_is_automountserviceaccounttoken: notset svacc_is_automountServiceAccountToken: true is_compliant: true
**namespace: kube-system pod_name: helm-install-rke2-snapshot-controller-crd-9njtl service_account: helm-rke2-snapshot-controller-crd pod_is_automountserviceaccounttoken: notset svacc_is_automountServiceAccountToken: true is_compliant: true
**namespace: kube-system pod_name: helm-install-rke2-snapshot-controller-rm764 service_account: helm-rke2-snapshot-controller pod_is_automountserviceaccounttoken: notset svacc_is_automountServiceAccountToken: true is_compliant: true
**namespace: kube-system pod_name: rke2-canal-bqn2x service_account: canal pod_is_automountserviceaccounttoken: notset svacc_is_automountServiceAccountToken: notset is_compliant: true
**namespace: kube-system pod_name: rke2-coredns-rke2-coredns-6464f98784-7mc2x service_account: coredns pod_is_automountserviceaccounttoken: notset svacc_is_automountServiceAccountToken: notset is_compliant: true
**namespace: kube-system pod_name: rke2-coredns-rke2-coredns-autoscaler-67bb49dff-lks69 service_account: rke2-coredns-rke2-coredns-autoscaler pod_is_automountserviceaccounttoken: notset svacc_is_automountServiceAccountToken: notset is_compliant: true
**namespace: kube-system pod_name: rke2-ingress-nginx-controller-2pjn6 service_account: rke2-ingress-nginx pod_is_automountserviceaccounttoken: notset svacc_is_automountServiceAccountToken: true is_compliant: true
**namespace: kube-system pod_name: rke2-metrics-server-75d485c65b-djgst service_account: rke2-metrics-server pod_is_automountserviceaccounttoken: notset svacc_is_automountServiceAccountToken: notset is_compliant: true
**namespace: kube-system pod_name: rke2-snapshot-controller-696989ffdd-ctddn service_account: rke2-snapshot-controller pod_is_automountserviceaccounttoken: notset svacc_is_automountServiceAccountToken: notset is_compliant: true

修正:

修改不需要挂载服务账户令牌的 ServiceAccounts 和 Pods 的定义，以禁用它，使用 automountServiceAccountToken: false。 RKE2 对 kube-system 命名空间中的 ServiceAccounts 给予例外，因为这些是预期与 apiserver 联系的。在 cis 模式下，RKE2 禁用命名空间的 automountServiceAccountToken：

kube-public, default, kube-node-lease。如果 ServiceAccount 和 Pod 的 .spec 都指定了 automountServiceAccountToken 的值，则 Pod 的 spec 优先。条件：当 Pod 的 is_compliant 为 true 时
- 服务账户的 automountServiceAccountToken: false 且 Pod 的 automountServiceAccountToken: false 或未设置
- 服务账户的 automountServiceAccountToken: true/未设置且 Pod 的 automountServiceAccountToken: false

5.1.7 避免使用 system:masters 组（手动）

*结果：*警告

修正: 从集群中的所有用户中去除 system:masters 组。

5.1.8 限制在 Kubernetes 集群中使用 Bind、Impersonate 和 Escalate 权限（手动）

*结果：*警告

修正: 在可能的情况下，从主体中去除 impersonate、bind 和 escalate 权利。

5.1.9 最小化对创建持久卷的访问（手动）

*结果：*警告

修正: 在可能的情况下，去除对集群中 PersistentVolume 对象的创建访问。

5.1.10 最小化对节点的代理子资源的访问（手动）

*结果：*警告

修正: 在可能的情况下，去除对节点对象的代理子资源的访问权限。

5.1.11 最小化对证书签名请求对象的审批子资源的访问权限（手动）

*结果：*警告

修正: 在可能的情况下，去除对证书签名请求对象的审批子资源的访问权限。

5.1.12 最小化对 webhook 配置对象的访问权限（手动）

*结果：*警告

修正: 在可能的情况下，去除对验证网络钩子配置或变更网络钩子配置对象的访问权限。

5.1.13 最小化对服务账户令牌创建的访问权限（手动）

*结果：*警告

修正: 在可能的情况下，去除对服务账户对象的令牌子资源的访问权限。

5.2 Pod 安全标准

5.2.1 确保集群中至少有一个活动的策略控制机制（手动）

*结果：*警告

修正: 确保每个包含用户工作负载的名称空间中都有 Pod 安全准入或外部策略控制系统。

5.2.2 最小化特权容器的准入（手动）

*结果：*PASS

Audit:

whitelist="kube-flannel calico-node kube-proxy"
kubectl get pods --all-namespaces -o custom-columns=POD_NAME:.metadata.name,POD_NAMESPACE:.metadata.namespace --no-headers | while read -r pod_name pod_namespace
do
  # Retrieve container(s) for each Pod.
  kubectl get pod "${pod_name}" --namespace "${pod_namespace}" -o json | jq -c '.spec.containers[]' | while read -r container
  do
    # Retrieve container's name.
    container_name=$(echo ${container} | jq -r '.name')
    # Retrieve container's .securityContext.privileged value.
    container_privileged=$(echo ${container} | jq -r '.securityContext.privileged' | sed -e 's/null/notset/g')
    # Check if container name is in whitelist.
    if echo "${whitelist}" | grep -q "${container_name}"; then
      echo "***pod_name: ${pod_name} container_name: ${container_name} pod_namespace: ${pod_namespace} is_container_privileged: ${container_privileged} is_whitelist: true is_compliant: true"
    elif [ "${container_privileged}" = "false" ] || [ "${container_privileged}" = "notset" ] ; then
      echo "***pod_name: ${pod_name} container_name: ${container_name} pod_namespace: ${pod_namespace} is_container_privileged: ${container_privileged} is_compliant: true"
    else
      echo "***pod_name: ${pod_name} container_name: ${container_name} pod_namespace: ${pod_namespace} is_container_privileged: ${container_privileged} is_compliant: false"
    fi
  done
done

预期结果: 'is_compliant' 等于 'true'

返回值:

***pod_name: cloud-controller-manager-server-0 container_name: cloud-controller-manager pod_namespace: kube-system is_container_privileged: false is_compliant: true
***pod_name: etcd-server-0 container_name: etcd pod_namespace: kube-system is_container_privileged: false is_compliant: true
***pod_name: helm-install-rke2-canal-789dp container_name: helm pod_namespace: kube-system is_container_privileged: notset is_compliant: true
***pod_name: helm-install-rke2-coredns-c8whl container_name: helm pod_namespace: kube-system is_container_privileged: notset is_compliant: true
***pod_name: helm-install-rke2-ingress-nginx-gqtvn container_name: helm pod_namespace: kube-system is_container_privileged: notset is_compliant: true
***pod_name: helm-install-rke2-metrics-server-7jckf container_name: helm pod_namespace: kube-system is_container_privileged: notset is_compliant: true
***pod_name: helm-install-rke2-runtimeclasses-2zdbw container_name: helm pod_namespace: kube-system is_container_privileged: notset is_compliant: true
***pod_name: helm-install-rke2-snapshot-controller-crd-9njtl container_name: helm pod_namespace: kube-system is_container_privileged: notset is_compliant: true
***pod_name: helm-install-rke2-snapshot-controller-rm764 container_name: helm pod_namespace: kube-system is_container_privileged: notset is_compliant: true
***pod_name: kube-apiserver-server-0 container_name: kube-apiserver pod_namespace: kube-system is_container_privileged: false is_compliant: true
***pod_name: kube-controller-manager-server-0 container_name: kube-controller-manager pod_namespace: kube-system is_container_privileged: false is_compliant: true
***pod_name: kube-proxy-server-0 container_name: kube-proxy pod_namespace: kube-system is_container_privileged: true is_whitelist: true is_compliant: true
***pod_name: kube-scheduler-server-0 container_name: kube-scheduler pod_namespace: kube-system is_container_privileged: false is_compliant: true
***pod_name: rke2-canal-bqn2x container_name: calico-node pod_namespace: kube-system is_container_privileged: true is_whitelist: true is_compliant: true
***pod_name: rke2-canal-bqn2x container_name: kube-flannel pod_namespace: kube-system is_container_privileged: true is_whitelist: true is_compliant: true
***pod_name: rke2-coredns-rke2-coredns-6464f98784-7mc2x container_name: coredns pod_namespace: kube-system is_container_privileged: notset is_compliant: true
***pod_name: rke2-coredns-rke2-coredns-autoscaler-67bb49dff-lks69 container_name: autoscaler pod_namespace: kube-system is_container_privileged: notset is_compliant: true
***pod_name: rke2-ingress-nginx-controller-2pjn6 container_name: rke2-ingress-nginx-controller pod_namespace: kube-system is_container_privileged: notset is_compliant: true
***pod_name: rke2-metrics-server-75d485c65b-djgst container_name: metrics-server pod_namespace: kube-system is_container_privileged: notset is_compliant: true
***pod_name: rke2-snapshot-controller-696989ffdd-ctddn container_name: rke2-snapshot-controller pod_namespace: kube-system is_container_privileged: notset is_compliant: true

修正:

为集群中每个包含用户工作负载的名称空间添加策略，以限制特权容器的准入。 RKE2 对以下 Pod 给予例外，这些 Pod 是正常操作所需的：

kube-flannel，calico-node，kube-proxy 审计：审计列出所有 Pod 的容器以获取它们的 .securityContext.privileged 值。条件：如果容器的 .securityContext.privileged 设置为 true，则 is_compliant 为 false。默认：默认情况下，对特权容器的创建没有限制。

5.2.3 最小化希望共享主机进程 ID 命名空间的容器的准入（手动）

*结果：*PASS

Audit:

kubectl get pods --all-namespaces -o custom-columns=POD_NAME:.metadata.name,POD_NAMESPACE:.metadata.namespace --no-headers | while read -r pod_name pod_namespace
do
  # Retrieve spec.hostPID for each pod.
  pod_hostpid=$(kubectl get pod "${pod_name}" --namespace "${pod_namespace}" -o jsonpath='{.spec.hostPID}' 2>/dev/null)
  if [ -z "${pod_hostpid}" ]; then
    pod_hostpid="false"
    echo "***pod_name: ${pod_name} pod_namespace: ${pod_namespace} is_pod_hostpid: ${pod_hostpid} is_compliant: true"
  else
    echo "***pod_name: ${pod_name} pod_namespace: ${pod_namespace} is_pod_hostpid: ${pod_hostpid} is_compliant: false"
  fi
done

预期结果: 'is_compliant' 等于 'true'

返回值:

***pod_name: cloud-controller-manager-server-0 pod_namespace: kube-system is_pod_hostpid: false is_compliant: true
***pod_name: etcd-server-0 pod_namespace: kube-system is_pod_hostpid: false is_compliant: true
***pod_name: helm-install-rke2-canal-789dp pod_namespace: kube-system is_pod_hostpid: false is_compliant: true
***pod_name: helm-install-rke2-coredns-c8whl pod_namespace: kube-system is_pod_hostpid: false is_compliant: true
***pod_name: helm-install-rke2-ingress-nginx-gqtvn pod_namespace: kube-system is_pod_hostpid: false is_compliant: true
***pod_name: helm-install-rke2-metrics-server-7jckf pod_namespace: kube-system is_pod_hostpid: false is_compliant: true
***pod_name: helm-install-rke2-runtimeclasses-2zdbw pod_namespace: kube-system is_pod_hostpid: false is_compliant: true
***pod_name: helm-install-rke2-snapshot-controller-crd-9njtl pod_namespace: kube-system is_pod_hostpid: false is_compliant: true
***pod_name: helm-install-rke2-snapshot-controller-rm764 pod_namespace: kube-system is_pod_hostpid: false is_compliant: true
***pod_name: kube-apiserver-server-0 pod_namespace: kube-system is_pod_hostpid: false is_compliant: true
***pod_name: kube-controller-manager-server-0 pod_namespace: kube-system is_pod_hostpid: false is_compliant: true
***pod_name: kube-proxy-server-0 pod_namespace: kube-system is_pod_hostpid: false is_compliant: true
***pod_name: kube-scheduler-server-0 pod_namespace: kube-system is_pod_hostpid: false is_compliant: true
***pod_name: rke2-canal-bqn2x pod_namespace: kube-system is_pod_hostpid: false is_compliant: true
***pod_name: rke2-coredns-rke2-coredns-6464f98784-7mc2x pod_namespace: kube-system is_pod_hostpid: false is_compliant: true
***pod_name: rke2-coredns-rke2-coredns-autoscaler-67bb49dff-lks69 pod_namespace: kube-system is_pod_hostpid: false is_compliant: true
***pod_name: rke2-ingress-nginx-controller-2pjn6 pod_namespace: kube-system is_pod_hostpid: false is_compliant: true
***pod_name: rke2-metrics-server-75d485c65b-djgst pod_namespace: kube-system is_pod_hostpid: false is_compliant: true
***pod_name: rke2-snapshot-controller-696989ffdd-ctddn pod_namespace: kube-system is_pod_hostpid: false is_compliant: true

修正:

为集群中每个包含用户工作负载的名称空间添加策略，以限制 hostPID 容器的准入。审计：审计获取每个 Pod 的 spec.hostPID。条件：如果 Pod 的 spec.hostPID 设置为 true，则 is_compliant 为 false。默认：默认情况下，对 hostPID 容器的创建没有限制。

5.2.4 最小化希望共享主机 IPC 命名空间的容器的准入（手动）

*结果：*PASS

Audit:

kubectl get pods --all-namespaces -o custom-columns=POD_NAME:.metadata.name,POD_NAMESPACE:.metadata.namespace --no-headers | while read -r pod_name pod_namespace
do
  # Retrieve spec.hostIPC for each pod.
  pod_hostipc=$(kubectl get pod "${pod_name}" --namespace "${pod_namespace}" -o jsonpath='{.spec.hostIPC}' 2>/dev/null)
  if [ -z "${pod_hostipc}" ]; then
    pod_hostipc="false"
    echo "***pod_name: ${pod_name} pod_namespace: ${pod_namespace} is_pod_hostipc: ${pod_hostipc} is_compliant: true"
  else
    echo "***pod_name: ${pod_name} pod_namespace: ${pod_namespace} is_pod_hostipc: ${pod_hostipc} is_compliant: false"
  fi
done

预期结果: 'is_compliant' 等于 'true'

返回值:

***pod_name: cloud-controller-manager-server-0 pod_namespace: kube-system is_pod_hostipc: false is_compliant: true
***pod_name: etcd-server-0 pod_namespace: kube-system is_pod_hostipc: false is_compliant: true
***pod_name: helm-install-rke2-canal-789dp pod_namespace: kube-system is_pod_hostipc: false is_compliant: true
***pod_name: helm-install-rke2-coredns-c8whl pod_namespace: kube-system is_pod_hostipc: false is_compliant: true
***pod_name: helm-install-rke2-ingress-nginx-gqtvn pod_namespace: kube-system is_pod_hostipc: false is_compliant: true
***pod_name: helm-install-rke2-metrics-server-7jckf pod_namespace: kube-system is_pod_hostipc: false is_compliant: true
***pod_name: helm-install-rke2-runtimeclasses-2zdbw pod_namespace: kube-system is_pod_hostipc: false is_compliant: true
***pod_name: helm-install-rke2-snapshot-controller-crd-9njtl pod_namespace: kube-system is_pod_hostipc: false is_compliant: true
***pod_name: helm-install-rke2-snapshot-controller-rm764 pod_namespace: kube-system is_pod_hostipc: false is_compliant: true
***pod_name: kube-apiserver-server-0 pod_namespace: kube-system is_pod_hostipc: false is_compliant: true
***pod_name: kube-controller-manager-server-0 pod_namespace: kube-system is_pod_hostipc: false is_compliant: true
***pod_name: kube-proxy-server-0 pod_namespace: kube-system is_pod_hostipc: false is_compliant: true
***pod_name: kube-scheduler-server-0 pod_namespace: kube-system is_pod_hostipc: false is_compliant: true
***pod_name: rke2-canal-bqn2x pod_namespace: kube-system is_pod_hostipc: false is_compliant: true
***pod_name: rke2-coredns-rke2-coredns-6464f98784-7mc2x pod_namespace: kube-system is_pod_hostipc: false is_compliant: true
***pod_name: rke2-coredns-rke2-coredns-autoscaler-67bb49dff-lks69 pod_namespace: kube-system is_pod_hostipc: false is_compliant: true
***pod_name: rke2-ingress-nginx-controller-2pjn6 pod_namespace: kube-system is_pod_hostipc: false is_compliant: true
***pod_name: rke2-metrics-server-75d485c65b-djgst pod_namespace: kube-system is_pod_hostipc: false is_compliant: true
***pod_name: rke2-snapshot-controller-696989ffdd-ctddn pod_namespace: kube-system is_pod_hostipc: false is_compliant: true

修正:

为集群中每个包含用户工作负载的名称空间添加策略，以限制 hostIPC 容器的准入。审计：审计获取每个 Pod 的 spec.IPC。条件：如果 Pod 的 spec.hostIPC 设置为 true，则 is_compliant 为 false。默认：默认情况下，对 hostIPC 容器的创建没有限制。

5.2.5 最小化希望共享主机网络名称空间的容器的准入（手动）

*结果：*PASS

Audit:

whitelist="cloud-controller-manager etcd rke2-canal rke2-coredns kube-apiserver kube-scheduler kube-proxy kube-controller-manager"
is_in_whitelist() {
  for entry in $whitelist; do
    case "${pod_name}" in
      *"${entry}"*)
        return 0
        ;;
    esac
  done
  return 1
}
kubectl get pods --all-namespaces -o custom-columns=POD_NAME:.metadata.name,POD_NAMESPACE:.metadata.namespace --no-headers | while read -r pod_name pod_namespace
do
  # Retrieve spec.hostNetwork for each pod.
  pod_hostnetwork=$(kubectl get pod "${pod_name}" --namespace "${pod_namespace}" -o jsonpath='{.spec.hostNetwork}' 2>/dev/null)
  echo "${whitelist}" | grep -q "${pod_name}"
  if [ "${pod_namespace}" = 'kube-system' ] && is_in_whitelist; then
    echo "***pod_name: ${pod_name} pod_namespace: ${pod_namespace} is_pod_hostnetwork: ${pod_hostnetwork} is_whitelist: true is_compliant: true"
  elif [ -z "${pod_hostnetwork}" ]; then
    pod_hostnetwork="false"
    echo "***pod_name: ${pod_name} pod_namespace: ${pod_namespace} is_pod_hostnetwork: ${pod_hostnetwork} is_compliant: true"
  else
    echo "***pod_name: ${pod_name} pod_namespace: ${pod_namespace} is_pod_hostnetwork: ${pod_hostnetwork} is_compliant: false"
  fi
done

预期结果: 'is_compliant' 等于 'true'

返回值:

***pod_name: cloud-controller-manager-server-0 pod_namespace: kube-system is_pod_hostnetwork: true is_whitelist: true is_compliant: true
***pod_name: etcd-server-0 pod_namespace: kube-system is_pod_hostnetwork: true is_whitelist: true is_compliant: true
***pod_name: helm-install-rke2-canal-789dp pod_namespace: kube-system is_pod_hostnetwork: true is_whitelist: true is_compliant: true
***pod_name: helm-install-rke2-coredns-c8whl pod_namespace: kube-system is_pod_hostnetwork: true is_whitelist: true is_compliant: true
***pod_name: helm-install-rke2-ingress-nginx-gqtvn pod_namespace: kube-system is_pod_hostnetwork: false is_compliant: true
***pod_name: helm-install-rke2-metrics-server-7jckf pod_namespace: kube-system is_pod_hostnetwork: false is_compliant: true
***pod_name: helm-install-rke2-runtimeclasses-2zdbw pod_namespace: kube-system is_pod_hostnetwork: false is_compliant: true
***pod_name: helm-install-rke2-snapshot-controller-crd-9njtl pod_namespace: kube-system is_pod_hostnetwork: false is_compliant: true
***pod_name: helm-install-rke2-snapshot-controller-rm764 pod_namespace: kube-system is_pod_hostnetwork: false is_compliant: true
***pod_name: kube-apiserver-server-0 pod_namespace: kube-system is_pod_hostnetwork: true is_whitelist: true is_compliant: true
***pod_name: kube-controller-manager-server-0 pod_namespace: kube-system is_pod_hostnetwork: true is_whitelist: true is_compliant: true
***pod_name: kube-proxy-server-0 pod_namespace: kube-system is_pod_hostnetwork: true is_whitelist: true is_compliant: true
***pod_name: kube-scheduler-server-0 pod_namespace: kube-system is_pod_hostnetwork: true is_whitelist: true is_compliant: true
***pod_name: rke2-canal-bqn2x pod_namespace: kube-system is_pod_hostnetwork: true is_whitelist: true is_compliant: true
***pod_name: rke2-coredns-rke2-coredns-6464f98784-7mc2x pod_namespace: kube-system is_pod_hostnetwork:  is_whitelist: true is_compliant: true
***pod_name: rke2-coredns-rke2-coredns-autoscaler-67bb49dff-lks69 pod_namespace: kube-system is_pod_hostnetwork:  is_whitelist: true is_compliant: true
***pod_name: rke2-ingress-nginx-controller-2pjn6 pod_namespace: kube-system is_pod_hostnetwork: false is_compliant: true
***pod_name: rke2-metrics-server-75d485c65b-djgst pod_namespace: kube-system is_pod_hostnetwork: false is_compliant: true
***pod_name: rke2-snapshot-controller-696989ffdd-ctddn pod_namespace: kube-system is_pod_hostnetwork: false is_compliant: true

修正:

为集群中每个包含用户工作负载的名称空间添加策略，以限制 hostNetwork 容器的准入。 RKE2 对 kube-system 名称空间中的以下 Pod 给予例外，这些 Pod 是正常操作所需的：

cloud-controller-manager，etcd，rke2-canal，rke2-coredns，kube-apiserver，
kube-scheduler，kube-proxy，kube-controller-manager 审计：审计获取每个 Pod 的 spec.hostNetwork。条件：如果 Pod 的 spec.hostNetwork 设置为 true，则 is_compliant 为 false。默认：默认情况下，创建 hostNetwork 容器没有限制。

5.2.6 最小化允许特权提升的容器的准入（手动）

*结果：*PASS

Audit:

kubectl get pods --all-namespaces -o custom-columns=POD_NAME:.metadata.name,POD_NAMESPACE:.metadata.namespace --no-headers | while read -r pod_name pod_namespace
do
  # Retrieve container(s) for each Pod.
  kubectl get pod "${pod_name}" --namespace "${pod_namespace}" -o json | jq -c '.spec.containers[]' | while read -r container
  do
    # Retrieve container's name
    container_name=$(echo ${container} | jq -r '.name')
    # Retrieve container's .securityContext.allowPrivilegeEscalation
    container_allowprivesc=$(echo ${container} | jq -r '.securityContext.allowPrivilegeEscalation' | sed -e 's/null/notset/g')
    if [ "${container_allowprivesc}" = "false" ] || [ "${container_allowprivesc}" = "notset" ]; then
      echo "***pod_name: ${pod_name} container_name: ${container_name} pod_namespace: ${pod_namespace} is_container_allowprivesc: ${container_allowprivesc} is_compliant: true"
    else
      echo "***pod_name: ${pod_name} container_name: ${container_name} pod_namespace: ${pod_namespace} is_container_allowprivesc: ${container_allowprivesc} is_compliant: false"
    fi
  done
done

预期结果: 'is_compliant' 等于 'true'

返回值:

***pod_name: cloud-controller-manager-server-0 container_name: cloud-controller-manager pod_namespace: kube-system is_container_allowprivesc: notset is_compliant: true
***pod_name: etcd-server-0 container_name: etcd pod_namespace: kube-system is_container_allowprivesc: notset is_compliant: true
***pod_name: helm-install-rke2-canal-789dp container_name: helm pod_namespace: kube-system is_container_allowprivesc: false is_compliant: true
***pod_name: helm-install-rke2-coredns-c8whl container_name: helm pod_namespace: kube-system is_container_allowprivesc: false is_compliant: true
***pod_name: helm-install-rke2-ingress-nginx-gqtvn container_name: helm pod_namespace: kube-system is_container_allowprivesc: false is_compliant: true
***pod_name: helm-install-rke2-metrics-server-7jckf container_name: helm pod_namespace: kube-system is_container_allowprivesc: false is_compliant: true
***pod_name: helm-install-rke2-runtimeclasses-2zdbw container_name: helm pod_namespace: kube-system is_container_allowprivesc: false is_compliant: true
***pod_name: helm-install-rke2-snapshot-controller-crd-9njtl container_name: helm pod_namespace: kube-system is_container_allowprivesc: false is_compliant: true
***pod_name: helm-install-rke2-snapshot-controller-rm764 container_name: helm pod_namespace: kube-system is_container_allowprivesc: false is_compliant: true
***pod_name: kube-apiserver-server-0 container_name: kube-apiserver pod_namespace: kube-system is_container_allowprivesc: notset is_compliant: true
***pod_name: kube-controller-manager-server-0 container_name: kube-controller-manager pod_namespace: kube-system is_container_allowprivesc: notset is_compliant: true
***pod_name: kube-proxy-server-0 container_name: kube-proxy pod_namespace: kube-system is_container_allowprivesc: notset is_compliant: true
***pod_name: kube-scheduler-server-0 container_name: kube-scheduler pod_namespace: kube-system is_container_allowprivesc: notset is_compliant: true
***pod_name: rke2-canal-bqn2x container_name: calico-node pod_namespace: kube-system is_container_allowprivesc: notset is_compliant: true
***pod_name: rke2-canal-bqn2x container_name: kube-flannel pod_namespace: kube-system is_container_allowprivesc: notset is_compliant: true
***pod_name: rke2-coredns-rke2-coredns-6464f98784-7mc2x container_name: coredns pod_namespace: kube-system is_container_allowprivesc: false is_compliant: true
***pod_name: rke2-coredns-rke2-coredns-autoscaler-67bb49dff-lks69 container_name: autoscaler pod_namespace: kube-system is_container_allowprivesc: notset is_compliant: true
***pod_name: rke2-ingress-nginx-controller-2pjn6 container_name: rke2-ingress-nginx-controller pod_namespace: kube-system is_container_allowprivesc: false is_compliant: true
***pod_name: rke2-metrics-server-75d485c65b-djgst container_name: metrics-server pod_namespace: kube-system is_container_allowprivesc: false is_compliant: true
***pod_name: rke2-snapshot-controller-696989ffdd-ctddn container_name: rke2-snapshot-controller pod_namespace: kube-system is_container_allowprivesc: notset is_compliant: true

修正:

为集群中每个包含用户工作负载的名称空间添加策略，以限制允许特权提升的容器的准入，其中 .securityContext.allowPrivilegeEscalation 设置为 true。审计：审计检索每个 Pod 的容器 .securityContext.allowPrivilegeEscalation。条件：如果容器的 .securityContext.allowPrivilegeEscalation 设置为 true，则 is_compliant 为 false。默认值：如果未设置，则允许特权提升（默认为 true）。但是，如果使用带有 restricted 控制文件的 PSP/PSA，则特权提升被明确禁止，除非另行配置。

5.2.7 最小化 root 容器的准入（手动）

*结果：*警告

修正: 为集群中每个名称空间创建一个策略，确保 MustRunAsNonRoot 或 MustRunAs 的 UID 范围不包括 0。

5.2.8 最小化具有 NET_RAW 能力的容器的接纳（手动）

*结果：*警告

修正: 为集群中具有用户工作负载的每个名称空间添加策略，以限制具有 NET_RAW 能力的容器的接纳。

5.2.9 最小化具有附加能力的容器的接纳（手动）

*结果：*PASS

Audit:

whitelist="rke2-ingress-nginx-controller coredns"
kubectl get pods --all-namespaces -o custom-columns=POD_NAME:.metadata.name,POD_NAMESPACE:.metadata.namespace --no-headers | while read -r pod_name pod_namespace
do
  # Retrieve container(s) for each Pod.
  kubectl get pod "${pod_name}" --namespace "${pod_namespace}" -o json | jq -c '.spec.containers[]' | while read -r container
  do
    # Retrieve container's name
    container_name=$(echo ${container} | jq -r '.name')
    # Retrieve container's added capabilities
    container_caps_add=$(echo ${container} | jq -r '.securityContext.capabilities.add' | sed -e 's/null/notset/g')
    # Set is_compliant to true by default.
    is_compliant=true
    is_whitelist=false
    caps_list=""
    if [ "${container_caps_add}" != "notset" ]; then
      # Loop through all caps and append caps_list, then set is_compliant to false.
      for cap in $(echo "${container_caps_add}" | jq -r '.[]'); do
        caps_list="${caps_list}${cap},"
        is_compliant=false
      done
      # Remove trailing comma for the last list member.
      caps_list=${caps_list%,}
    fi
    # Remove newline from container_caps_add for final output.
    container_caps_add=$(echo "${container_caps_add}" | tr -d '\n')
    if [ "${pod_namespace}" = "kube-system" ] && echo "${whitelist}" | grep -q "${container_name}"; then
      echo "***pod_name: ${pod_name} container_name: ${container_name} pod_namespace: ${pod_namespace} container_caps_add: ${container_caps_add} is_whitelist: true is_compliant: true"
    elif [ "${is_compliant}" = true ]; then
      echo "***pod_name: ${pod_name} container_name: ${container_name} pod_namespace: ${pod_namespace} container_caps_add: ${container_caps_add} is_compliant: true"
    else
      echo "***pod_name: ${pod_name} container_name: ${container_name} pod_namespace: ${pod_namespace} container_caps_add: ${caps_list} is_compliant: false"
    fi
  done
done

预期结果: 'is_compliant' 等于 'true'

返回值:

***pod_name: cloud-controller-manager-server-0 container_name: cloud-controller-manager pod_namespace: kube-system container_caps_add: notset is_compliant: true
***pod_name: etcd-server-0 container_name: etcd pod_namespace: kube-system container_caps_add: notset is_compliant: true
***pod_name: helm-install-rke2-canal-789dp container_name: helm pod_namespace: kube-system container_caps_add: notset is_compliant: true
***pod_name: helm-install-rke2-coredns-c8whl container_name: helm pod_namespace: kube-system container_caps_add: notset is_compliant: true
***pod_name: helm-install-rke2-ingress-nginx-gqtvn container_name: helm pod_namespace: kube-system container_caps_add: notset is_compliant: true
***pod_name: helm-install-rke2-metrics-server-7jckf container_name: helm pod_namespace: kube-system container_caps_add: notset is_compliant: true
***pod_name: helm-install-rke2-runtimeclasses-2zdbw container_name: helm pod_namespace: kube-system container_caps_add: notset is_compliant: true
***pod_name: helm-install-rke2-snapshot-controller-crd-9njtl container_name: helm pod_namespace: kube-system container_caps_add: notset is_compliant: true
***pod_name: helm-install-rke2-snapshot-controller-rm764 container_name: helm pod_namespace: kube-system container_caps_add: notset is_compliant: true
***pod_name: kube-apiserver-server-0 container_name: kube-apiserver pod_namespace: kube-system container_caps_add: notset is_compliant: true
***pod_name: kube-controller-manager-server-0 container_name: kube-controller-manager pod_namespace: kube-system container_caps_add: notset is_compliant: true
***pod_name: kube-proxy-server-0 container_name: kube-proxy pod_namespace: kube-system container_caps_add: notset is_compliant: true
***pod_name: kube-scheduler-server-0 container_name: kube-scheduler pod_namespace: kube-system container_caps_add: notset is_compliant: true
***pod_name: rke2-canal-bqn2x container_name: calico-node pod_namespace: kube-system container_caps_add: notset is_compliant: true
***pod_name: rke2-canal-bqn2x container_name: kube-flannel pod_namespace: kube-system container_caps_add: notset is_compliant: true
***pod_name: rke2-coredns-rke2-coredns-6464f98784-7mc2x container_name: coredns pod_namespace: kube-system container_caps_add: [  "NET_BIND_SERVICE"] is_whitelist: true is_compliant: true
***pod_name: rke2-coredns-rke2-coredns-autoscaler-67bb49dff-lks69 container_name: autoscaler pod_namespace: kube-system container_caps_add: notset is_compliant: true
***pod_name: rke2-ingress-nginx-controller-2pjn6 container_name: rke2-ingress-nginx-controller pod_namespace: kube-system container_caps_add: [  "NET_BIND_SERVICE"] is_whitelist: true is_compliant: true
***pod_name: rke2-metrics-server-75d485c65b-djgst container_name: metrics-server pod_namespace: kube-system container_caps_add: notset is_compliant: true
***pod_name: rke2-snapshot-controller-696989ffdd-ctddn container_name: rke2-snapshot-controller pod_namespace: kube-system container_caps_add: notset is_compliant: true

修正:

确保集群的策略中不包含 allowedCapabilities，除非将其设置为空数组。 RKE2 对 kube-system 名称空间中的以下 Pod 给予例外，这些 Pod 是正常操作所需的：

rke2-ingress-ngninx-controller，coredns 审计：审计获取每个 Pod 中容器已添加的能力。条件：如果给定容器添加了附加能力，则 is_compliant 为 false。默认值：容器以容器运行时分配的默认能力集运行。

5.2.10 最小化具有分配能力的容器的准入（手动）

*结果：*警告

修正: 审查在您的集群上运行的应用程序中能力的使用。如果一个名称空间中的应用程序不需要任何 Linux 能力来运行，请考虑添加一个 PSP，禁止未丢弃所有能力的容器的准入。

5.2.11 最小化 Windows HostProcess 容器的准入（手动）

*结果：*警告

修正: 为集群中具有用户工作负载的每个名称空间添加策略，以限制具有 .securityContext.windowsOptions.hostProcess 设置为 true 的容器的准入。

5.2.12 最小化 HostPath 卷的准入（手动）

*结果：*警告

修正: 为集群中具有用户工作负载的每个名称空间添加策略，以限制具有 hostPath 卷的容器的准入。

5.2.13 最小化使用 HostPorts 的容器的准入（手动）

*结果：*警告

修正: 为集群中具有用户工作负载的每个名称空间添加策略，以限制使用 hostPort 部分的容器的准入。

5.3 网络策略和 CNI

5.3.1 确保所使用的 CNI 支持网络策略（手动）

*结果：*警告

修正: 如果所使用的 CNI 插件不支持网络策略，则应考虑使用其他插件，或寻找替代机制来限制 Kubernetes 集群中的流量。

5.3.2 确保所有名称空间都定义了网络策略（手动）

*结果：*警告

修正: 按照文档创建所需的 NetworkPolicy 对象。

5.4 秘密管理

5.4.1 优先使用文件形式的 Secrets 而不是环境变量形式的 Secrets（手动）

*结果：*警告

修正: 如果可能，重写应用程序代码以从挂载的秘密文件中读取秘密，而不是从环境变量中读取。

5.4.2 考虑外部秘密存储（手动）

*结果：*警告

修正: 参考您的云服务提供商或第三方秘密管理解决方案提供的秘密管理选项。

5.5 可扩展的准入控制

5.5.1 使用 ImagePolicyWebhook 准入控制器配置图像溯源（手动）

*结果：*警告

修正: 遵循 Kubernetes 文档并设置图像溯源。

5.6 一般策略

5.6.1 使用名称空间在资源之间创建管理边界（手动）

*结果：*警告

修正: 按照文档的要求，根据需要为您的部署创建对象的名称空间。

5.6.2 确保在您的 Pod 定义中将 seccomp 控制文件设置为 docker/default（手动）

*结果：*警告

修正: 使用`securityContext`在您的Pod定义中启用docker/default seccomp控制文件。示例如下：
securityContext:
seccompProfile:
type:RuntimeDefault

5.6.3 将 SecurityContext 应用到您的 Pods 和容器（手动）

*结果：*警告

修正: 遵循Kubernetes文档并将SecurityContexts应用于您的Pods。有关建议的 SecurityContexts 列表，您可以参考 CIS Docker 容器安全基准。

5.6.4 不应使用默认名称空间（手动）

*结果：*警告

修正: 确保创建名称空间以允许适当的Kubernetes资源隔离，并且所有新资源都在特定名称空间中创建。

CIS 1.11 自我评估指南

概述

测试控制方法

1 控制平面安全配置。

1.1 控制平面节点配置文件

1.1.1 确保 API 服务器 pod 规范文件的权限设置为 600 或更严格（自动化）

1.1.2 确保 API 服务器 pod 规范文件的所有权设置为 root:root（自动化）

1.1.3 确保控制器管理器 pod 规范文件的权限设置为 600 或更严格（自动化）

1.1.4 确保控制器管理器 pod 规范文件的所有权设置为 root:root（自动化）

1.1.5 确保调度程序 pod 规范文件的权限设置为 600 或更严格（自动化）

1.1.6 确保调度程序 pod 规范文件的所有权设置为 root:root（自动化）

1.1.7 确保 etcd pod 规范文件的权限设置为 600 或更严格（手动）。

1.1.8 确保 etcd pod 规范文件的所有权设置为 root:root（手动）

1.1.9 确保容器网络接口文件的权限设置为 600 或更严格（手动）

1.1.10 确保容器网络接口文件的所有权设置为 root:root（手动）

1.1.11 确保 etcd 目录的权限设置为 700 或更严格（手动）

1.1.12 确保 etcd 数据目录的所有权设置为 etcd:etcd（手动）

1.1.13 确保 admin.conf 文件的权限设置为 600 或更严格（自动化）

1.1.14 确保 admin.conf 文件的所有权设置为 root:root（自动化）

1.1.15 确保 scheduler.conf 文件的权限设置为 600 或更严格（自动化）

1.1.16 确保 scheduler.conf 文件的所有权设置为 root:root（自动化）

1.1.17 确保 controller-manager.conf 文件的权限设置为 600 或更严格（自动化）

1.1.18 确保 controller-manager.conf 文件的所有权设置为 root:root（自动化）

1.1.19 确保 Kubernetes PKI 目录和文件的所有权设置为 root:root（自动化）

1.1.20 确保 Kubernetes PKI 证书文件的权限设置为 644 或更严格（自动化）

1.1.21 确保 Kubernetes PKI 密钥文件的权限设置为 600（自动化）

1.2 API 服务器

1.2.1 确保 --anonymous-auth 参数设置为 false（自动化）

1.2.2 确保 --token-auth-file 参数未设置（自动化）

1.2.3 确保 --DenyServiceExternalIPs 已设置（手动）

1.2.4 确保 --kubelet-client-certificate 和 --kubelet-client-key 参数设置正确（自动化）

1.2.5 确保 --kubelet-certificate-authority 参数设置正确（自动化）

1.2.6 确保 --authorization-mode 参数未设置为 AlwaysAllow（自动化）

1.2.7 确保 --authorization-mode 参数包含 Node（自动化）

1.2.8 确保 --authorization-mode 参数包含 RBAC（自动化）

1.2.9 确保 admission control 插件 EventRateLimit 已设置（手动）

1.2.10 确保 admission control 插件 AlwaysAdmit 未设置（自动）

1.2.11 确保 admission control 插件 AlwaysPullImages 已设置（手动）

1.2.12 确保设置 admission control 插件 ServiceAccount（自动化）

1.2.13 确保设置 admission control 插件 NamespaceLifecycle（自动化）

1.2.14 确保设置 admission control 插件 NodeRestriction（自动化）

1.2.15 确保 --profiling 参数设置为 false（自动化）

1.2.16 确保 --audit-log-path 参数已设置（自动化）

1.2.17 确保 --audit-log-maxage 参数设置为 30 或适当的值（自动化）

1.2.18 确保 --audit-log-maxbackup 参数设置为 10 或适当的值（自动化）

1.2.19 确保 --audit-log-maxsize 参数设置为 100 或适当的值（自动化）

1.2.20 确保 --request-timeout 参数设置得当（自动化）

1.2.21 确保 --service-account-lookup 参数设置为 true（自动）

1.2.22 确保 --service-account-key-file 参数设置正确（自动）

1.2.23 确保 --etcd-certfile 和 --etcd-keyfile 参数设置正确（自动化）

1.2.24 确保 --tls-cert-file 和 --tls-private-key-file 参数设置正确（自动化）

1.2.25 确保 --client-ca-file 参数设置正确（自动化）

1.2.26 确保 --etcd-cafile 参数设置正确（自动化）

1.2.27 确保 --encryption-provider-config 参数设置正确（自动）

1.2.28 确保加密提供程序配置正确（自动）

1.2.29 确保 API 服务器仅使用强加密密码（自动）

1.2.30 确保—​service-account-extend-token-expiration参数设置为false（自动）

1.3 控制器管理器

1.3.1 确保 --terminated-pod-gc-threshold 参数设置适当（手动）

1.3.2 确保 --profiling 参数设置为 false（自动化）

1.3.3 确保 --use-service-account-credentials 参数设置为 true（自动）

1.3.4 确保 --service-account-private-key-file 参数设置适当（自动）

1.3.5 确保 --root-ca-file 参数设置正确（自动化）

1.3.6 确保 RotateKubeletServerCertificate 参数设置为 true（自动化）

1.3.7 确保 --bind-address 参数设置为 127.0.0.1（自动化）

1.4 调度程序

1.4.1 确保 --profiling 参数设置为 false（自动化）

1.4.2 确保 --bind-address 参数设置为 127.0.0.1（自动化）

2 Etcd 节点配置

2 Etcd 节点配置

2.1 确保 --cert-file 和 --key-file 参数设置正确（自动化）

2.2 确保 --client-cert-auth 参数设置为 true（自动化）

2.3 确保 --auto-tls 参数未设置为 true（自动化）

2.4 确保 --peer-cert-file 和 --peer-key-file 参数设置正确（自动化）

2.5 确保 --peer-client-cert-auth 参数设置为 true（自动化）

2.6 确保 --peer-auto-tls 参数未设置为 true（自动化）

2.7 确保为 etcd 使用唯一的证书颁发机构（自动化）

3 控制平面配置

3.1 身份验证和授权

3.1.1 不应为用户使用客户端证书认证（手动）

1.2.30 确保—service-account-extend-token-expiration参数设置为false（自动）