/bin/sh -c 'if test -e /etc/kubernetes/manifests/kube- apiserver.yaml; then stat -c permissions=%a /etc/kubernetes/ manifests/kube-apiserver.yaml; fi' 1.1.2 Ensure that the API server pod specification file /bin/sh -c 'if test -e /etc/kubernetes/manifests/kube- apiserver.yaml; then stat -c %U:%G /etc/kubernetes/manifests/ kube-apiserver.yaml; fi' CIS 1.6 Benchmark - Self-Assessment Guide - Rancher v2.5.4 -e /etc/kubernetes/manifests/kube- controller-manager.yaml; then stat -c permissions=%a /etc/ kubernetes/manifests/kube-controller-manager.yaml; fi' 1.1.4 Ensure that the controller manager pod specification

need ● Declarations are yaml files which are easily stored and managed in git OpenShift GitOps Principles ● Separate application source code (Java/.Net/etc) from manifests (yaml) ● Deployment manifests manifests are standard k8s manifests ● Avoid duplication of yaml across environments ● Manifests should be applied with standard Openshift and k8s tooling Day 2 operations : All changes triggered from Git Kubernetes deployment tools including: ○ Helm ○ Kustomize ○ Ksonnet/Jsonnet ○ Directories of yaml ● It is not a CI tool What is an Argo CD Application? apiVersion: argoproj.io/v1alpha1 kind: Application

├── etcdcluster.crd.yaml │ └── etcdoperator.clusterserviceversion.yaml │ └── secret.yaml │ └── configmap.yaml └── metadata └── annotations.yaml └── dependencies.yaml OpenShift Container 会删除并重新创建它。 2.2.1.2. 注解 注解 捆绑包还在其 /metadata 文件夹中包含 annotations.yaml 文件。此文件定义了更高级别的聚合数据，以 帮助描述有关如何将捆绑包添加到捆绑包索引中的格式和软件包信息： annotations.yaml 示例 示例 Operator 捆绑包的介质类型或格式。registry+v1 格式表示它包含 CSV 及其关联的 Kubernetes 应该订阅到的默认频道。 注意 注意 如果出现不匹配的情况，则以 annotations.yaml 文件为准，因为依赖这些注解的集群 Operator Registry 只能访问此文件。 2.2.1.3. 依 依赖项 Operator 的依赖项列在捆绑包的 metadata/ 目录中的 dependencies.yaml 文件中。此文件是可选的，目 前仅用于指明 Operator-version 依赖项。

authentication. Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml on the master node and remove the --basic-auth-file= parameter. Audit: CIS Benchmark authentication. Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml on the master node and remove the --token-auth-file= parameter. Audit: /bin/ps -ef | Remediation: Edit the API server pod specification file /etc/kubernetes/ manifests/kube-apiserver.yaml on the master node and remove the --kubelet-https parameter. Audit: /bin/ps -ef | grep kube-apiserver

. 71 7.2.5. Working with YAML . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 71 Mapping YAML to Properties . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 71 Directly Loading YAML . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 406 12.2.5. Use YAML for External Properties . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

. 72 7.2.5. Working with YAML . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 72 Mapping YAML to Properties . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 72 Directly Loading YAML . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 407 12.2.5. Use YAML for External Properties . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

. 72 7.2.5. Working with YAML . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 72 Mapping YAML to Properties . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 72 Directly Loading YAML . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 406 12.2.5. Use YAML for External Properties . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

. 72 7.2.5. Working with YAML . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 72 Mapping YAML to Properties . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 72 Directly Loading YAML . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 406 12.2.5. Use YAML for External Properties . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

authentication. Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml on the master node and remove the --basic-auth-file= parameter. Audit: CIS 1.5 Benchmark authentication. Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml on the master node and remove the --token-auth-file= parameter. Audit: /bin/ps -ef | Remediation: Edit the API server pod specification file /etc/kubernetes/ manifests/kube-apiserver.yaml on the master node and remove the --kubelet-https parameter. Audit: /bin/ps -ef | grep kube-apiserver

. 71 7.2.5. Working with YAML . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 72 Mapping YAML to Properties . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 72 Directly Loading YAML . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 409 17.2.5. Use YAML for External Properties . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .