ING RKE2-CIS-1.24 CHECKS #1685

sm171190 · 2024-09-19T07:26:12Z

In this change we are making 2 changes:

adding the check Type as manual for some manual checks for which the type was missing or incorrect - RKe2-cis-1.24 -(1.1.10,1.1.20,1.1.21)
Some checks are being skipped(1.3.6,4.2.12)as they are not applicable for an RKE2 cluster
checks 1.3.6 and 4.2.12 check whether the cluster has been configured with the flags to rotate TLS certificates. However, RKE Internally handles certificate rotation : Rotate certificates for RKE2 provisioned clusters rancher/dashboard#4485

CLAassistant · 2024-09-19T07:26:21Z

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.

Saurabh Misra seems not to be a GitHub user. You need a GitHub account to be able to sign the CLA. If you have already a GitHub account, please add the email address used for this commit to your account.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

afdesk · 2024-09-19T08:36:46Z

Hi guys!
give me an hour to review it.
I have some notes.
thanks!

afdesk

@sm171190
I left some comments. Please feel free to correct me. thanks

afdesk · 2024-09-19T08:41:13Z

cfg/rke2-cis-1.24/master.yaml

@@ -318,6 +319,7 @@ groups:
          For example,
          chmod -R 600 /var/lib/rancher/rke2/server/tls/*.crt
        scored: false
+        type: manual


it seems this check (1.1.20) is automated by the docs.
and text field contains a mistake.

@afdesk I was referring to https://docs.rke2.io/security/cis_self_assessment124#1110-ensure-that-the-container-network-interface-file-ownership-is-set-to-root-manual. Here 1.1.10,1.1.20 and 1.1.21 are mentioned as manual
Would you like me to revert the change?

in this doc: 1.1.20 is manual: https://docs.rke2.io/security/cis_self_assessment124#1120-ensure-that-the-kubernetes-pki-certificate-file-permissions-are-set-to-600-or-more-restrictive-manual

but 1.1.21 is automated... https://docs.rke2.io/security/cis_self_assessment124#1121-ensure-that-the-kubernetes-pki-key-file-permissions-are-set-to-600-automated

I'd like to clarify the correct source at first.

afdesk · 2024-09-19T08:43:36Z

cfg/rke2-cis-1.24/master.yaml

@@ -159,6 +159,7 @@ groups:
          For example,
          chown root:root <path/to/cni/files>
        scored: false
+        type: manual


it's a bit strange. because the same test for RKE1 is automated.
and audit shows commands for check...

but it doesn't matter

Ref: https://docs.rke2.io/security/cis_self_assessment124#1110-ensure-that-the-container-network-interface-file-ownership-is-set-to-root-manual

cfg/rke2-cis-1.24/node.yaml

afdesk · 2024-09-19T09:01:27Z

cfg/rke2-cis-1.24/node.yaml

@@ -432,14 +432,14 @@ groups:
            - flag: RotateKubeletServerCertificate
              path: '{.featureGates.RotateKubeletServerCertificate}'
              set: false
+        type: skip


I can see that check 1.3.6 isn't applicable for RKE2: the docs

but 4.2.12 is manual check and should pass: 4.2.12 Verify that the RotateKubeletServerCertificate argument is set to true (Manual)

maybe we shouldn't skip it?

4.2.12 is automated here too https://docs.rke2.io/security/cis_self_assessment124#4212-verify-that-the-rotatekubeletservercertificate-argument-is-set-to-true-automated

and 1.3.6 is automated here...
https://docs.rke2.io/security/cis_self_assessment124#136-ensure-that-the-rotatekubeletservercertificate-argument-is-set-to-true-automated

afdesk · 2024-09-19T09:08:43Z

@sm171190 could you sign CLA for tests?

In this change we are making 2 changes: 1. Seom CIS-1.24 checks(1.3.6 , 4.2.12 are not relevant for RKE clusters). So we will skip them. 2. SomeCIS-1.24 tests(1.1.10,1.1.20) are manual checks yet they don't have the type correctly set causing KB to run them with all automated tests.

sm171190 · 2024-09-19T11:07:18Z

@sm171190 I left some comments. Please feel free to correct me. thanks
@afdesk Can you please the PR now? Thanks

afdesk

@sm171190 I'd like your point about this diffs?
what is the reason of these updates? thanks!

afdesk · 2024-09-19T11:20:50Z

cfg/rke2-cis-1.24/master.yaml

@@ -335,6 +337,7 @@ groups:
          For example,
          chmod -R 600 /var/lib/rancher/rke2/server/tls/*.key
        scored: false
+        type: manual


based on docs.rke2.io, 1.1.21 is automated: https://docs.rke2.io/security/cis_self_assessment124#1121-ensure-that-the-kubernetes-pki-key-file-permissions-are-set-to-600-automated

Do you think we should ignore it?

afdesk · 2024-09-19T11:21:59Z

cfg/rke2-cis-1.24/node.yaml

@@ -432,6 +432,7 @@ groups:
            - flag: RotateKubeletServerCertificate
              path: '{.featureGates.RotateKubeletServerCertificate}'
              set: false
+        type: manual


4.2.12 is automated too: https://docs.rke2.io/security/cis_self_assessment124#4212-verify-that-the-rotatekubeletservercertificate-argument-is-set-to-true-automated

afdesk · 2024-09-19T11:24:08Z

and tests can't be passed without CLA

afdesk · 2024-09-19T11:30:43Z

also it makes sense to update the PR description, and add a link to the docs there.
for future.

afdesk · 2024-09-19T11:34:55Z

just note
@sm171190 you're right, we should keep https://docs.rke2.io/,
because https://ranchermanager.docs.rancher.com/ looks old:

Last updated on Oct 12, 2023

sm171190 mentioned this pull request Sep 19, 2024

FIXING RKE CIS CHECKS #1679

Closed

itaysk requested a review from afdesk September 19, 2024 08:07

afdesk requested changes Sep 19, 2024

View reviewed changes

sm171190 force-pushed the sa-fixing-rke-cis-1.24-checks branch from 278639e to 5805d20 Compare September 19, 2024 10:40

sm171190 force-pushed the sa-fixing-rke-cis-1.24-checks branch from 5805d20 to ba6cb26 Compare September 19, 2024 11:00

afdesk self-requested a review September 19, 2024 11:14

afdesk requested changes Sep 19, 2024

View reviewed changes

sm171190 closed this by deleting the head repository Sep 19, 2024

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

ING RKE2-CIS-1.24 CHECKS #1685

ING RKE2-CIS-1.24 CHECKS #1685

sm171190 commented Sep 19, 2024 •

edited

Loading

CLAassistant commented Sep 19, 2024

afdesk commented Sep 19, 2024

afdesk left a comment

afdesk Sep 19, 2024

sm171190 Sep 19, 2024

afdesk Sep 19, 2024

afdesk Sep 19, 2024

afdesk Sep 19, 2024

sm171190 Sep 19, 2024

afdesk Sep 19, 2024

afdesk Sep 19, 2024

afdesk Sep 19, 2024

afdesk commented Sep 19, 2024

sm171190 commented Sep 19, 2024

afdesk left a comment

afdesk Sep 19, 2024

afdesk Sep 19, 2024

afdesk commented Sep 19, 2024

afdesk commented Sep 19, 2024

afdesk commented Sep 19, 2024

ING RKE2-CIS-1.24 CHECKS #1685

ING RKE2-CIS-1.24 CHECKS #1685

Conversation

sm171190 commented Sep 19, 2024 • edited Loading

CLAassistant commented Sep 19, 2024

afdesk commented Sep 19, 2024

afdesk left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

afdesk commented Sep 19, 2024

sm171190 commented Sep 19, 2024

afdesk left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

afdesk commented Sep 19, 2024

afdesk commented Sep 19, 2024

afdesk commented Sep 19, 2024

sm171190 commented Sep 19, 2024 •

edited

Loading