/kube- apiserver.pem --authorization-mode=Node,RBAC --audit-log- maxsize=100 --audit-log-format=json --requestheader-allowed- names=kube-apiserver-proxy-client --cloud-provider= --etcd- prefix=/registry _256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --audit- log-path=/var/log/kube-audit/audit-log.json --audit-log- maxbackup=10 --etcd-certfile=/etc/kubernetes/ssl/kube- node.pem --service-account- /kube- apiserver.pem --authorization-mode=Node,RBAC --audit-log- maxsize=100 --audit-log-format=json --requestheader-allowed- names=kube-apiserver-proxy-client --cloud-provider= --etcd- prefix=/registry

failed" exit 1 fi accounts="$(kubectl --kubeconfig=${KUBECONFIG} get serviceaccounts -A -o json | jq -r '.items[] | select(.metadata.name=="default") | select((.automountServiceAccountToken Self-Assessment Guide - v2.4 49 fi default_binding="$(kubectl get rolebindings,clusterrolebindings -A -o json | jq -r '.items[] | select(.subjects[].kind=="ServiceAccount" and .subjects[].name=="default" hostPID field is omitted or set to false. Audit: kubectl --kubeconfig=/root/.kube/config get psp -o json | jq .items[] | jq -r 'select((.spec.hostPID == null) or CIS Benchmark Rancher Self-Assessment

failed" exit 1 fi accounts="$(kubectl --kubeconfig=${KUBECONFIG} get serviceaccounts -A -o json | jq -r '.items[] | select(.metadata.name=="default") | select((.automountServiceAccountToken Guide - Rancher v2.5 49 fi default_binding="$(kubectl get rolebindings,clusterrolebindings -A -o json | jq -r '.items[] | select(.subjects[].kind=="ServiceAccount" and .subjects[].name=="default" Benchmark - Self-Assessment Guide - Rancher v2.5 50 kubectl --kubeconfig=/root/.kube/config get psp -o json | jq .items[] | jq -r 'select((.spec.hostPID == null) or (.spec.hostPID == false))' | jq .metadata

log/kube-audit/audit-log.json --audit-log-maxage=5 --audit-log-maxbackup=5 Rancher_Hardening_Guide.md 11/30/2018 10 / 24 --audit-log-maxsize=100 --audit-log-format=json --audit-policy-file=/etc/kubernetes/audit audit-log-path: "/var/log/kube-audit/audit-log.json" audit-log-maxage: "5" audit-log-maxbackup: "5" audit-log-maxsize: "100" audit-log-format: "json" audit-policy-file: /etc/kubernetes/audit audit-log-path: "/var/log/kube-audit/audit-log.json" audit-log-maxage: "5" audit-log-maxbackup: "5" audit-log-maxsize: "100" audit-log-format: "json" audit-policy-file: /etc/kubernetes/audit

yaml --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-format=json --audit-policy-file=/etc/kubernetes/audit-policy.yaml yaml --audit-log-path=/var/log/kube-audit/audit-log.json --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-format=json --audit-policy-file=/etc/kubernetes/audit-policy.yaml

information in a single command for debugging). If the detail option is used, the output is displayed in JSON format. kubectl contrailstatus configdump Lists the resources and their quantities. kubectl contrailstatus when prompted. Once you've logged in, your credentials are automatically stored in ~/.docker/config.json. (If you installed docker using snap, then the credentials are stored in the ~/snap/docker directory Encode your credentials in base64 and store the resulting string. ENCODED_CREDS=$(base64 -w 0 config.json) Take a look at the encoded credentials. echo $ENCODED_CREDS 4. Replace the credentials placeholder

the script has execute permissions. #!/bin/bash -e for namespace in $(kubectl get namespaces -A -o json | jq -r '.items[].metadata.name'); do kubectl patch serviceaccount default -n ${namespace} -p the script has execute permissions. #!/bin/bash -e for namespace in $(kubectl get namespaces -A -o json | jq -r '.items[].metadata.name'); do kubectl apply -f default-allow-all.yaml -n ${namespace}

the script has execute permissions. #!/bin/bash -e for namespace in $(kubectl get namespaces -A -o json | jq -r '.items[].metadata.name'); do kubectl patch serviceaccount default -n ${namespace} -p permissions. Hardening Guide v2.4 6 #!/bin/bash -e for namespace in $(kubectl get namespaces -A -o json | jq -r '.items[].metadata.name'); do kubectl apply -f default-allow-all.yaml -n ${namespace}

Args[] | match("--audit-log-path=/var/log/kube-audit/audit-log.json").string' Returned Value: --audit-log-log=/var/log/kube-audit/audit-log.json Result: Pass 1.1.16 - Ensure that the --audit-log-maxage

system types, volume name prefix, and controller count, for the installation. 6. Create a config.json for driver configuration. This file contains information like the PowerFlex system IP details and