Ensure that the kubeconfig file permissions are set to 644 or more restrictive

MediaNivel 1Automatizadagke

Descripción

If kubelet is running, and if it is configured by a kubeconfig file, ensure that the proxy kubeconfig file has permissions of 644 or more restrictive. Runs on each GKE node (path from the kubelet argument).

Cómo se verifica

Método de auditoría: Comando de shell

shell

set -f
psarg() { ps -eo args 2>/dev/null | grep -E "^([^ ]*/)?$1( |\$)" | head -n 1 | awk -v k="--$2" '{for(i=1;i<=NF;i++){if($i==k&&i<NF)v=$(i+1); else if(index($i,k"=")==1)v=substr($i,length(k)+2)}} END{if(v!="")print v}'; }
p0=$(psarg kubelet kubeconfig)
f=""; for x in ${p0:-} /var/lib/kubelet/kubeconfig; do if [ -e "$x" ]; then f=$x; break; fi; done
[ -n "$f" ] || exit 1
p=$(stat -Lc %a "$f") || exit 1
if [ $((0$p & 0133)) -eq 0 ]; then echo compliant; else echo "noncompliant: $f mode $p"; fi

Salida esperada: compliant

Cómo se corrige

Método de corrección: Guía o parche de infraestructura

Run the below command (based on the file location on your system) on the each worker node. For example, chmod 644 <kubeconfig file>

Propiedades

Sistemas operativos: Cualquiera
Etiquetas: gkeworker-nodefile-permissions
Referencia: CIS Google Kubernetes Engine (GKE) Benchmark v2.0.0 - 3.1.1 Ensure that the kubeconfig file permissions are set to 644 or more restrictive

Verificar este host

Ejecute esto en un equipo que tenga permiso para auditar. El escaneo es de solo lectura.

shell

tmaegis scan --target gke