github.com/khulnasoft-lab/kube-bench@v0.2.1-0.20240330183753-9df52345ae58/cfg/rke-cis-1.24/etcd.yaml (about)

     1  ---
     2  controls:
     3  version: "rke-cis-1.24"
     4  id: 2
     5  text: "Etcd Node Configuration"
     6  type: "etcd"
     7  groups:
     8    - id: 2
     9      text: "Etcd Node Configuration"
    10      checks:
    11        - id: 2.1
    12          text: "Ensure that the --cert-file and --key-file arguments are set as appropriate (Automated)"
    13          audit: "/bin/ps -ef | /bin/grep $etcdbin | /bin/grep -v grep"
    14          tests:
    15            bin_op: and
    16            test_items:
    17              - flag: "--cert-file"
    18                env: "ETCD_CERT_FILE"
    19                set: true
    20              - flag: "--key-file"
    21                env: "ETCD_KEY_FILE"
    22                set: true
    23          remediation: |
    24            Follow the etcd service documentation and configure TLS encryption.
    25            Then, edit the etcd pod specification file /etc/kubernetes/manifests/etcd.yaml
    26            on the master node and set the below parameters.
    27            --cert-file=</path/to/ca-file>
    28            --key-file=</path/to/key-file>
    29          scored: true
    30  
    31        - id: 2.2
    32          text: "Ensure that the --client-cert-auth argument is set to true (Automated)"
    33          audit: "/bin/ps -ef | /bin/grep $etcdbin | /bin/grep -v grep"
    34          tests:
    35            bin_op: or
    36            test_items:
    37              - flag: "--client-cert-auth"
    38                set: true
    39              - flag: "--client-cert-auth"
    40                env: "ETCD_CLIENT_CERT_AUTH"
    41                compare:
    42                  op: eq
    43                  value: true
    44                set: true
    45          remediation: |
    46            Edit the etcd pod specification file $etcdconf on the master
    47            node and set the below parameter.
    48            --client-cert-auth="true"
    49          scored: true
    50  
    51        - id: 2.3
    52          text: "Ensure that the --auto-tls argument is not set to true (Automated)"
    53          audit: "/bin/ps -ef | /bin/grep $etcdbin | /bin/grep -v grep"
    54          tests:
    55            bin_op: or
    56            test_items:
    57              - flag: "--auto-tls"
    58                env: "ETCD_AUTO_TLS"
    59                set: false
    60              - flag: "--auto-tls"
    61                env: "ETCD_AUTO_TLS"
    62                compare:
    63                  op: eq
    64                  value: false
    65          remediation: |
    66            Edit the etcd pod specification file $etcdconf on the master
    67            node and either remove the --auto-tls parameter or set it to false.
    68              --auto-tls=false
    69          scored: true
    70  
    71        - id: 2.4
    72          text: "Ensure that the --peer-cert-file and --peer-key-file arguments are
    73          set as appropriate (Automated)"
    74          audit: "/bin/ps -ef | /bin/grep $etcdbin | /bin/grep -v grep"
    75          tests:
    76            bin_op: and
    77            test_items:
    78              - flag: "--peer-cert-file"
    79                env: "ETCD_PEER_CERT_FILE"
    80                set: true
    81              - flag: "--peer-key-file"
    82                env: "ETCD_PEER_KEY_FILE"
    83                set: true
    84          remediation: |
    85            Follow the etcd service documentation and configure peer TLS encryption as appropriate
    86            for your etcd cluster.
    87            Then, edit the etcd pod specification file $etcdconf on the
    88            master node and set the below parameters.
    89            --peer-client-file=</path/to/peer-cert-file>
    90            --peer-key-file=</path/to/peer-key-file>
    91          scored: true
    92  
    93        - id: 2.5
    94          text: "Ensure that the --peer-client-cert-auth argument is set to true (Automated)"
    95          audit: "/bin/ps -ef | /bin/grep $etcdbin | /bin/grep -v grep"
    96          tests:
    97            bin_op: or
    98            test_items:
    99              - flag: "--peer-client-cert-auth"
   100                set: true
   101              - flag: "--peer-client-cert-auth"
   102                env: "ETCD_PEER_CLIENT_CERT_AUTH"
   103                compare:
   104                  op: eq
   105                  value: true
   106                set: true
   107          remediation: |
   108            Edit the etcd pod specification file $etcdconf on the master
   109            node and set the below parameter.
   110            --peer-client-cert-auth=true
   111          scored: true
   112  
   113        - id: 2.6
   114          text: "Ensure that the --peer-auto-tls argument is not set to true (Automated)"
   115          audit: "/bin/ps -ef | /bin/grep $etcdbin | /bin/grep -v grep"
   116          tests:
   117            bin_op: or
   118            test_items:
   119              - flag: "--peer-auto-tls"
   120                env: "ETCD_PEER_AUTO_TLS"
   121                set: false
   122              - flag: "--peer-auto-tls"
   123                env: "ETCD_PEER_AUTO_TLS"
   124                compare:
   125                  op: eq
   126                  value: false
   127                set: false
   128          remediation: |
   129            Edit the etcd pod specification file $etcdconf on the master
   130            node and either remove the --peer-auto-tls parameter or set it to false.
   131            --peer-auto-tls=false
   132          scored: true
   133  
   134        - id: 2.7
   135          text: "Ensure that a unique Certificate Authority is used for etcd (Automated)"
   136          audit: "/bin/ps -ef | /bin/grep $etcdbin | /bin/grep -v grep"
   137          tests:
   138            test_items:
   139              - flag: "--trusted-ca-file"
   140                env: "ETCD_TRUSTED_CA_FILE"
   141                set: true
   142          remediation: |
   143            [Manual test]
   144            Follow the etcd documentation and create a dedicated certificate authority setup for the
   145            etcd service.
   146            Then, edit the etcd pod specification file $etcdconf on the
   147            master node and set the below parameter.
   148            --trusted-ca-file=</path/to/ca-file>
   149          scored: true