inspect kube-apiserver | jq -e '.[0].Args[] | match("--basic-auth-file=.*").string' Returned Value: null Result: Pass 1.1.3 - Ensure that the --insecure-allow-any-token argument is not set (Scored) kube-apiserver | jq -e '.[0].Args[] | match("--insecure-allow-any-token").string' Returned Value: null Result: Pass 1.1.4 - Ensure that the --kubelet-https argument is set to true (Scored) Audit inspect kube-apiserver | jq -e '.[0].Args[] | match("--kubelet-https=false").string' Returned Value: null Result: Pass 1.1.5 - Ensure that the --insecure-bind-address argument is not set (Scored) Notes

5.1.5.sh #!/bin/bash export KUBECONFIG=${KUBECONFIG:-/root/.kube/config} kubectl version > /dev/null if [ $? -ne 0 ]; then echo "fail: kubectl failed" exit 1 fi accounts="$(kubectl --kubeconfig=${KUBECONFIG} jq -r '.items[] | select(.metadata.name=="default") | select((.automountServiceAccountToken == null) or (.automountServiceAccountToken == true)) | "fail \ (.metadata.name) \(.metadata.namespace)"')" --kubeconfig=/root/.kube/config get psp -o json | jq .items[] | jq -r 'select((.spec.hostPID == null) or CIS Benchmark Rancher Self-Assessment Guide - v2.4 50 (.spec.hostPID == false))' | jq .metadata

5.1.5.sh #!/bin/bash export KUBECONFIG=${KUBECONFIG:-/root/.kube/config} kubectl version > /dev/null if [ $? -ne 0 ]; then echo "fail: kubectl failed" exit 1 fi accounts="$(kubectl --kubeconfig=${KUBECONFIG} jq -r '.items[] | select(.metadata.name=="default") | select((.automountServiceAccountToken == null) or (.automountServiceAccountToken == true)) | "fail \ (.metadata.name) \(.metadata.namespace)"')" --kubeconfig=/root/.kube/config get psp -o json | jq .items[] | jq -r 'select((.spec.hostPID == null) or (.spec.hostPID == false))' | jq .metadata.name | wc -l | xargs -I {} echo '--count={}' Expected

| jq -r '.items[] | select(.metadata.name=="default") | select((.automountServiceAccountToken == null) or CIS 1.6 Benchmark - Self-Assessment Guide - Rancher v2.5.4 119 (.automountServiceAccountToken or set to false. Audit: kubectl get psp -o json | jq .items[] | jq -r 'select((.spec.h ostPID == null) or (.spec.hostPID == false))' | jq .metadata.n ame | wc -l | xargs -I {} echo '--count={}' Expected or set to false. Audit: kubectl get psp -o json | jq .items[] | jq -r 'select((.spec.h ostIPC == null) or (.spec.hostIPC == false))' | jq .metadata.n ame | wc -l | xargs -I {} echo '--count={}' Expected

options: {} mtu: 0 node_selector: {} authentication: strategy: "" sans: [] webhook: null addons: | --- apiVersion: v1 kind: Namespace metadata: name: ingress-nginx --- provider: "" options: {} node_selector: {} restore: restore: false snapshot_name: "" dns: null Reference Hardened RKE Template configuration The reference RKE Template provides the configuration

options: {} mtu: 0 node_selector: {} authentication: strategy: "" sans: [] webhook: null addons: | Hardening Guide v2.4 8 --- apiVersion: v1 kind: Namespace metadata: provider: "" options: {} node_selector: {} restore: restore: false snapshot_name: "" dns: null Reference Hardened RKE Template configuration The reference RKE Template provides the configuration

certificate from the domain $ openssl s_client -showcerts -connect ${DOMAIN}:${PORT} null 2>/dev/null|openssl x509 - outform PEM >ca.crt # Copy the certificate to the appropriate directories $