TMA-KUBERNETES-4.2.2

Ensure that the --authorization-mode argument is not set to AlwaysAllow

KritičnaNivo 1Automatskakubernetes

Opis

Do not allow all requests. Enable explicit authorization. Runs on each node: a kubelet command-line flag takes precedence over the config file named by --config (default /var/lib/kubelet/config.yaml), otherwise the kubelet default applies.

Kako se proverava

Metod provere: Komanda ljuske

shell

set -f
psarg() { ps -eo args 2>/dev/null | grep -E "^([^ ]*/)?$1( |\$)" | head -n 1 | awk -v k="--$2" '{for(i=1;i<=NF;i++){if($i==k&&i<NF)v=$(i+1); else if(index($i,k"=")==1)v=substr($i,length(k)+2)}} END{if(v!="")print v}'; }
cfg=$(psarg kubelet config); cfg=${cfg:-${kubelet_config_yaml:-/var/lib/kubelet/config.yaml}}
y() { [ -r "$cfg" ] || return 0; awk -v want="$1" '{sub(/\r$/,"")} /^[ \t]*(#|$)/{next} /^[ \t]*-/{next} {match($0,/^ */); ind=RLENGTH; line=substr($0,ind+1); c=index(line,":"); if(c==0)next; k=substr(line,1,c-1); gsub(/"/,"",k); val=substr(line,c+1); sub(/^[ \t]+/,"",val); sub(/[ \t]+#.*$/,"",val); sub(/[ \t]+$/,"",val); gsub(/"/,"",val); while(n>0 && ind<=ids[n]) n--; n++; ids[n]=ind; keys[n]=k; p=keys[1]; for(i=2;i<=n;i++) p=p "." keys[i]; if(p==want && val!=""){print val; exit}}' "$cfg"; }
v=$(psarg kubelet authorization-mode); [ -n "$v" ] || v=$(y authorization.mode); v=${v:-AlwaysAllow}
if [ "$v" != "AlwaysAllow" ]; then echo compliant; else echo "noncompliant: authorization.mode=$v"; fi

Očekivani izlaz: compliant

Kako se ispravlja

Metod ispravke: Smernica ili zakrpa infrastrukture

If using a Kubelet config file, edit the file to set authorization: mode to Webhook. If using executable arguments, edit the kubelet service file /etc/kubernetes/kubelet.conf on each worker node and set the below parameter in KUBELET_AUTHZ_ARGS variable. --authorization-mode=Webhook Based on your system, restart the kubelet service. For example: systemctl daemon-reload systemctl restart kubelet.service

Svojstva

Operativni sistemi: Bilo koji
Oznake: kubernetesworker-node
Referenca: CIS Kubernetes Benchmark v2.1.0 - 4.2.2 Ensure that the --authorization-mode argument is not set to AlwaysAllow

Proverite ovaj računar

Pokrenite ovo na računaru za koji imate dozvolu za proveru. Skeniranje radi u režimu samo za čitanje.

shell

tmaegis scan --target kubernetes