CIS Kubernetes Benchmark

This document introduces the CIS Kubernetes Benchmark, explains how to audit your compliance with the benchmark, and explains what Google Distributed Cloud configures when you cannot implement a recommendation yourself.

About the CIS Benchmarks

The Center for Internet Security (CIS) releases benchmarks for best practice security recommendations. The CIS Kubernetes Benchmark provides a set of recommendations for configuring Kubernetes to support a strong security posture. The Benchmark is tied to a specific Kubernetes release. The CIS Kubernetes Benchmark is written for the open source Kubernetes distribution and intended to be as universally applicable across distributions as possible.

Access the benchmark

The CIS Kubernetes Benchmark is available on the CIS website.

Recommendation levels

The following table describes the recommendation levels in the CIS Kubernetes Benchmark.

LevelDescription
Level 1

Recommendations intend to:

  • be practical and prudent;
  • provide a clear security benefit; and
  • not inhibit the utility of the technology beyond acceptable means.

    • Level 2

    Extends the Level 1 profile.

    Recommendations exhibit one or more of the following characteristics:

  • are intended for environments or use cases where security is paramount;
  • acts as defense in depth measure; or
  • may negatively inhibit the utility or performance of the technology.

    • Assessment status

    An assessment status is included for every recommendation. The assessment status indicates whether the given recommendation can be automated or requires manual steps to implement. Both statuses are equally important and are determined and supported as defined in the following tables:

    1.31

    Versions

    This section refers to the following versions:

    Anthos versionKubernetes versionCIS Kubernetes Benchmark version
    1.311.31.5v0.10.4

    Status of Google Distributed Cloud admin cluster

    #RecommendationLevelStatus
    1Control Plane Security Configuration
    1.1Control Plane Node Configuration Files
    1.1.1Ensure that the API server pod specification file permissions are set to 600 or more restrictive (Automated)L1Equivalent Control
    1.1.2Ensure that the API server pod specification file ownership is set to root:root (Automated)L1Pass
    1.1.3Ensure that the controller manager pod specification file permissions are set to 600 or more restrictive (Automated)L1Equivalent Control
    1.1.4Ensure that the controller manager pod specification file ownership is set to root:root (Automated)L1Pass
    1.1.5Ensure that the scheduler pod specification file permissions are set to 600 or more restrictive (Automated)L1Equivalent Control
    1.1.6Ensure that the scheduler pod specification file ownership is set to root:root (Automated)L1Pass
    1.1.7Ensure that the etcd pod specification file permissions are set to 600 or more restrictive (Automated)L1Equivalent Control
    1.1.8Ensure that the etcd pod specification file ownership is set to root:root (Automated)L1Pass
    1.1.9Ensure that the Container Network Interface file permissions are set to 600 or more restrictive (Manual)L1Pass
    1.1.10Ensure that the Container Network Interface file ownership is set to root:root (Manual)L1Pass
    1.1.11Ensure that the etcd data directory permissions are set to 700 or more restrictive (Automated)L1Pass
    1.1.12Ensure that the etcd data directory ownership is set to etcd:etcd (Automated)L1Equivalent Control
    1.1.13Ensure that the default administrative credential file permissions are set to 600 (Automated)L1Fail
    1.1.14Ensure that the default administrative credential file ownership is set to root:root (Automated)L1Fail
    1.1.15Ensure that the scheduler.conf file permissions are set to 600 or more restrictive (Automated)L1Pass
    1.1.16Ensure that the scheduler.conf file ownership is set to root:root (Automated)L1Equivalent Control
    1.1.17Ensure that the controller-manager.conf file permissions are set to 600 or more restrictive (Automated)L1Pass
    1.1.18Ensure that the controller-manager.conf file ownership is set to root:root (Automated)L1Equivalent Control
    1.1.19Ensure that the Kubernetes PKI directory and file ownership is set to root:root (Automated)L1Pass
    1.1.20Ensure that the Kubernetes PKI certificate file permissions are set to 600 or more restrictive (Manual)L1Pass
    1.1.21Ensure that the Kubernetes PKI key file permissions are set to 600 (Manual)L1Pass
    1.2API Server
    1.2.1Ensure that the --anonymous-auth argument is set to false (Manual)L1Pass
    1.2.2Ensure that the --token-auth-file parameter is not set (Automated)L1Pass
    1.2.3Ensure that the --DenyServiceExternalIPs is set (Manual)L1Warn
    1.2.4Ensure that the --kubelet-client-certificate and --kubelet-client-key arguments are set as appropriate (Automated)L1Pass
    1.2.5Ensure that the --kubelet-certificate-authority argument is set as appropriate (Automated)L1Pass
    1.2.6Ensure that the --authorization-mode argument is not set to AlwaysAllow (Automated)L1Pass
    1.2.7Ensure that the --authorization-mode argument includes Node (Automated)L1Pass
    1.2.8Ensure that the --authorization-mode argument includes RBAC (Automated)L1Pass
    1.2.9Ensure that the admission control plugin EventRateLimit is set (Manual)L1Warn
    1.2.10Ensure that the admission control plugin AlwaysAdmit is not set (Automated)L1Pass
    1.2.11Ensure that the admission control plugin AlwaysPullImages is set (Manual)L1Depends On Environment
    1.2.12Ensure that the admission control plugin ServiceAccount is set (Automated)L1Pass
    1.2.13Ensure that the admission control plugin NamespaceLifecycle is set (Automated)L1Pass
    1.2.14Ensure that the admission control plugin NodeRestriction is set (Automated)L1Pass
    1.2.15Ensure that the --profiling argument is set to false (Automated)L1Pass
    1.2.16Ensure that the --audit-log-path argument is set (Automated)L1Pass
    1.2.17Ensure that the --audit-log-maxage argument is set to 30 or as appropriate (Automated)L1Equivalent Control
    1.2.18Ensure that the --audit-log-maxbackup argument is set to 10 or as appropriate (Automated)L1Equivalent Control
    1.2.19Ensure that the --audit-log-maxsize argument is set to 100 or as appropriate (Automated)L1Pass
    1.2.20Ensure that the --request-timeout argument is set as appropriate (Manual)L1Pass
    1.2.21Ensure that the --service-account-lookup argument is set to true (Automated)L1Pass
    1.2.22Ensure that the --service-account-key-file argument is set as appropriate (Automated)L1Pass
    1.2.23Ensure that the --etcd-certfile and --etcd-keyfile arguments are set as appropriate (Automated)L1Pass
    1.2.24Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate (Automated)L1Pass
    1.2.25Ensure that the --client-ca-file argument is set as appropriate (Automated)L1Pass
    1.2.26Ensure that the --etcd-cafile argument is set as appropriate (Automated)L1Pass
    1.2.27Ensure that the --encryption-provider-config argument is set as appropriate (Manual)L1Pass
    1.2.28Ensure that encryption providers are appropriately configured (Manual)L1Pass
    1.2.29Ensure that the API Server only makes use of Strong Cryptographic Ciphers (Manual)L1Warn
    1.3Controller Manager
    1.3.1Ensure that the --terminated-pod-gc-threshold argument is set as appropriate (Manual)L1Pass
    1.3.2Ensure that the --profiling argument is set to false (Automated)L1Pass
    1.3.3Ensure that the --use-service-account-credentials argument is set to true (Automated)L1Pass
    1.3.4Ensure that the --service-account-private-key-file argument is set as appropriate (Automated)L1Pass
    1.3.5Ensure that the --root-ca-file argument is set as appropriate (Automated)L1Pass
    1.3.6Ensure that the RotateKubeletServerCertificate argument is set to true (Automated)L2Pass
    1.3.7Ensure that the --bind-address argument is set to 127.0.0.1 (Automated)L1Fail
    1.4Scheduler
    1.4.1Ensure that the --profiling argument is set to false (Automated)L1Pass
    1.4.2Ensure that the --bind-address argument is set to 127.0.0.1 (Automated)L1Fail
    2Etcd Node Configuration
    2Etcd Node Configuration
    2.1Ensure that the --cert-file and --key-file arguments are set as appropriate (Automated)L1Pass
    2.2Ensure that the --client-cert-auth argument is set to true (Automated)L1Pass
    2.3Ensure that the --auto-tls argument is not set to true (Automated)L1Pass
    2.4Ensure that the --peer-cert-file and --peer-key-file arguments are set as appropriate (Automated)L1Pass
    2.5Ensure that the --peer-client-cert-auth argument is set to true (Automated)L1Pass
    2.6Ensure that the --peer-auto-tls argument is not set to true (Automated)L1Pass
    2.7Ensure that a unique Certificate Authority is used for etcd (Manual)L2Pass
    3Control Plane Configuration
    3.1Authentication and Authorization
    3.1.1Client certificate authentication should not be used for users (Manual)L2Pass
    3.1.2Service account token authentication should not be used for users (Manual)L1Warn
    3.1.3Bootstrap token authentication should not be used for users (Manual)L1Warn
    3.2Logging
    3.2.1Ensure that a minimal audit policy is created (Manual)L1Pass
    3.2.2Ensure that the audit policy covers key security concerns (Manual)L2Equivalent Control

    Descriptions of Failures and Equivalent Controls for Google Distributed Cloud admin cluster

    #RecommendationLevelStatusValueJustification
    1.1.1Ensure that the API server pod specification file permissions are set to 600 or more restrictive (Automated)L1Equivalent ControlN/AIn kubeception mode, user cluster's API server pod specification is stored in etcd.
    1.1.3Ensure that the controller manager pod specification file permissions are set to 600 or more restrictive (Automated)L1Equivalent ControlN/AIn kubeception mode, user cluster's controller manager pod specification is stored in etcd.
    1.1.5Ensure that the scheduler pod specification file permissions are set to 600 or more restrictive (Automated)L1Equivalent ControlN/AIn kubeception mode, user cluster's scheduler pod specification is stored in etcd.
    1.1.7Ensure that the etcd pod specification file permissions are set to 600 or more restrictive (Automated)L1Equivalent ControlN/AIn kubeception mode, user cluster's etcd specification is stored in admin cluster's etcd.
    1.1.12Ensure that the etcd data directory ownership is set to etcd:etcd (Automated)L1Equivalent Control2001:2001The etcd container runs as 2001 and the etcd data directory is owned by 2001:2001.
    1.1.13Ensure that the default administrative credential file permissions are set to 600 (Automated)L1Fail
    1.1.14Ensure that the default administrative credential file ownership is set to root:root (Automated)L1Fail
    1.1.16Ensure that the scheduler.conf file ownership is set to root:root (Automated)L1Equivalent Control2000:2000The kube-scheduler container runs as 2000 and this file is owned by 2000:2000.
    1.1.18Ensure that the controller-manager.conf file ownership is set to root:root (Automated)L1Equivalent Control2002:2002The controller-manager container runs as 2002 and this file is owned by 2002:2002.
    1.2.3Ensure that the --DenyServiceExternalIPs is set (Manual)L1Warn
    1.2.9Ensure that the admission control plugin EventRateLimit is set (Manual)L1Warnnot setGDC software-only for VMware does not support the Event Rate Limit admission controller as it is a Kubernetes Alpha feature.
    1.2.11Ensure that the admission control plugin AlwaysPullImages is set (Manual)L1Depends On Environmentnot setThe AlwaysPullImages admission controller provides some protection for private registry images in noncooperative multitenant clusters, at the cost of making container registries a single-point-of-failure for creating new Pods across the entire cluster. Google Distributed Cloud does not enable the AlwaysPullImages admission controller, which leaves it up to cluster admins to implement admission policy to make this tradeoff for themselves.
    1.2.17Ensure that the --audit-log-maxage argument is set to 30 or as appropriate (Automated)L1Equivalent Controlnot setGoogle Distributed Cloud captures audit logs but does not use these flags for auditing. See Google Distributed Cloud Audit policy for more details.
    1.2.18Ensure that the --audit-log-maxbackup argument is set to 10 or as appropriate (Automated)L1Equivalent Controlnot setGoogle Distributed Cloud captures audit logs but does not use these flags for auditing. See Google Distributed Cloud Audit policy for more details.
    1.2.29Ensure that the API Server only makes use of Strong Cryptographic Ciphers (Manual)L1Warn
    1.3.7Ensure that the --bind-address argument is set to 127.0.0.1 (Automated)L1Fail
    1.4.2Ensure that the --bind-address argument is set to 127.0.0.1 (Automated)L1Fail
    3.1.2Service account token authentication should not be used for users (Manual)L1Warn
    3.1.3Bootstrap token authentication should not be used for users (Manual)L1Warn
    3.2.2Ensure that the audit policy covers key security concerns (Manual)L2Equivalent Controlnot setGoogle Distributed Cloud captures audit logs but does not use these flags for auditing. See Google Distributed Cloud Audit policy for more details.

    Status of Google Distributed Cloud user cluster

    #RecommendationLevelStatus
    1Control Plane Security Configuration
    1.1Control Plane Node Configuration Files
    1.1.1Ensure that the API server pod specification file permissions are set to 600 or more restrictive (Automated)L1Equivalent Control
    1.1.2Ensure that the API server pod specification file ownership is set to root:root (Automated)L1Pass
    1.1.3Ensure that the controller manager pod specification file permissions are set to 600 or more restrictive (Automated)L1Equivalent Control
    1.1.4Ensure that the controller manager pod specification file ownership is set to root:root (Automated)L1Pass
    1.1.5Ensure that the scheduler pod specification file permissions are set to 600 or more restrictive (Automated)L1Equivalent Control
    1.1.6Ensure that the scheduler pod specification file ownership is set to root:root (Automated)L1Pass
    1.1.7Ensure that the etcd pod specification file permissions are set to 600 or more restrictive (Automated)L1Equivalent Control
    1.1.8Ensure that the etcd pod specification file ownership is set to root:root (Automated)L1Pass
    1.1.9Ensure that the Container Network Interface file permissions are set to 600 or more restrictive (Manual)L1Pass
    1.1.10Ensure that the Container Network Interface file ownership is set to root:root (Manual)L1Pass
    1.1.11Ensure that the etcd data directory permissions are set to 700 or more restrictive (Automated)L1Pass
    1.1.12Ensure that the etcd data directory ownership is set to etcd:etcd (Automated)L1Equivalent Control
    1.1.13Ensure that the default administrative credential file permissions are set to 600 (Automated)L1Fail
    1.1.14Ensure that the default administrative credential file ownership is set to root:root (Automated)L1Fail
    1.1.15Ensure that the scheduler.conf file permissions are set to 600 or more restrictive (Automated)L1Pass
    1.1.16Ensure that the scheduler.conf file ownership is set to root:root (Automated)L1Equivalent Control
    1.1.17Ensure that the controller-manager.conf file permissions are set to 600 or more restrictive (Automated)L1Pass
    1.1.18Ensure that the controller-manager.conf file ownership is set to root:root (Automated)L1Equivalent Control
    1.1.19Ensure that the Kubernetes PKI directory and file ownership is set to root:root (Automated)L1Pass
    1.1.20Ensure that the Kubernetes PKI certificate file permissions are set to 600 or more restrictive (Manual)L1Pass
    1.1.21Ensure that the Kubernetes PKI key file permissions are set to 600 (Manual)L1Pass
    1.2API Server
    1.2.1Ensure that the --anonymous-auth argument is set to false (Manual)L1Pass
    1.2.2Ensure that the --token-auth-file parameter is not set (Automated)L1Pass
    1.2.3Ensure that the --DenyServiceExternalIPs is set (Manual)L1Warn
    1.2.4Ensure that the --kubelet-client-certificate and --kubelet-client-key arguments are set as appropriate (Automated)L1Pass
    1.2.5Ensure that the --kubelet-certificate-authority argument is set as appropriate (Automated)L1Pass
    1.2.6Ensure that the --authorization-mode argument is not set to AlwaysAllow (Automated)L1Pass
    1.2.7Ensure that the --authorization-mode argument includes Node (Automated)L1Pass
    1.2.8Ensure that the --authorization-mode argument includes RBAC (Automated)L1Pass
    1.2.9Ensure that the admission control plugin EventRateLimit is set (Manual)L1Warn
    1.2.10Ensure that the admission control plugin AlwaysAdmit is not set (Automated)L1Pass
    1.2.11Ensure that the admission control plugin AlwaysPullImages is set (Manual)L1Depends On Environment
    1.2.12Ensure that the admission control plugin ServiceAccount is set (Automated)L1Pass
    1.2.13Ensure that the admission control plugin NamespaceLifecycle is set (Automated)L1Pass
    1.2.14Ensure that the admission control plugin NodeRestriction is set (Automated)L1Pass
    1.2.15Ensure that the --profiling argument is set to false (Automated)L1Pass
    1.2.16Ensure that the --audit-log-path argument is set (Automated)L1Pass
    1.2.17Ensure that the --audit-log-maxage argument is set to 30 or as appropriate (Automated)L1Equivalent Control
    1.2.18Ensure that the --audit-log-maxbackup argument is set to 10 or as appropriate (Automated)L1Equivalent Control
    1.2.19Ensure that the --audit-log-maxsize argument is set to 100 or as appropriate (Automated)L1Pass
    1.2.20Ensure that the --request-timeout argument is set as appropriate (Manual)L1Pass
    1.2.21Ensure that the --service-account-lookup argument is set to true (Automated)L1Pass
    1.2.22Ensure that the --service-account-key-file argument is set as appropriate (Automated)L1Pass
    1.2.23Ensure that the --etcd-certfile and --etcd-keyfile arguments are set as appropriate (Automated)L1Pass
    1.2.24Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate (Automated)L1Pass
    1.2.25Ensure that the --client-ca-file argument is set as appropriate (Automated)L1Pass
    1.2.26Ensure that the --etcd-cafile argument is set as appropriate (Automated)L1Pass
    1.2.27Ensure that the --encryption-provider-config argument is set as appropriate (Manual)L1Pass
    1.2.28Ensure that encryption providers are appropriately configured (Manual)L1Pass
    1.2.29Ensure that the API Server only makes use of Strong Cryptographic Ciphers (Manual)L1Warn
    1.3Controller Manager
    1.3.1Ensure that the --terminated-pod-gc-threshold argument is set as appropriate (Manual)L1Pass
    1.3.2Ensure that the --profiling argument is set to false (Automated)L1Pass
    1.3.3Ensure that the --use-service-account-credentials argument is set to true (Automated)L1Pass
    1.3.4Ensure that the --service-account-private-key-file argument is set as appropriate (Automated)L1Pass
    1.3.5Ensure that the --root-ca-file argument is set as appropriate (Automated)L1Pass
    1.3.6Ensure that the RotateKubeletServerCertificate argument is set to true (Automated)L2Pass
    1.3.7Ensure that the --bind-address argument is set to 127.0.0.1 (Automated)L1Fail
    1.4Scheduler
    1.4.1Ensure that the --profiling argument is set to false (Automated)L1Pass
    1.4.2Ensure that the --bind-address argument is set to 127.0.0.1 (Automated)L1Fail
    2Etcd Node Configuration
    2Etcd Node Configuration
    2.1Ensure that the --cert-file and --key-file arguments are set as appropriate (Automated)L1Pass
    2.2Ensure that the --client-cert-auth argument is set to true (Automated)L1Pass
    2.3Ensure that the --auto-tls argument is not set to true (Automated)L1Pass
    2.4Ensure that the --peer-cert-file and --peer-key-file arguments are set as appropriate (Automated)L1Pass
    2.5Ensure that the --peer-client-cert-auth argument is set to true (Automated)L1Pass
    2.6Ensure that the --peer-auto-tls argument is not set to true (Automated)L1Pass
    2.7Ensure that a unique Certificate Authority is used for etcd (Manual)L2Pass
    3Control Plane Configuration
    3.1Authentication and Authorization
    3.1.1Client certificate authentication should not be used for users (Manual)L2Pass
    3.1.2Service account token authentication should not be used for users (Manual)L1Warn
    3.1.3Bootstrap token authentication should not be used for users (Manual)L1Warn
    3.2Logging
    3.2.1Ensure that a minimal audit policy is created (Manual)L1Pass
    3.2.2Ensure that the audit policy covers key security concerns (Manual)L2Equivalent Control
    4Worker Node Security Configuration
    4.1Worker Node Configuration Files
    4.1.1Ensure that the kubelet service file permissions are set to 600 or more restrictive (Automated)L1Fail
    4.1.2Ensure that the kubelet service file ownership is set to root:root (Automated)L1Pass
    4.1.3If proxy kubeconfig file exists ensure permissions are set to 600 or more restrictive (Manual)L1Warn
    4.1.4If proxy kubeconfig file exists ensure ownership is set to root:root (Manual)L1Warn
    4.1.5Ensure that the --kubeconfig kubelet.conf file permissions are set to 600 or more restrictive (Automated)L1Pass
    4.1.6Ensure that the --kubeconfig kubelet.conf file ownership is set to root:root (Automated)L1Pass
    4.1.7Ensure that the certificate authorities file permissions are set to 600 or more restrictive (Manual)L1Pass
    4.1.8Ensure that the client certificate authorities file ownership is set to root:root (Manual)L1Pass
    4.1.9If the kubelet config.yaml configuration file is being used validate permissions set to 600 or more restrictive (Automated)L1Fail
    4.1.10If the kubelet config.yaml configuration file is being used validate file ownership is set to root:root (Automated)L1Pass
    4.2Kubelet
    4.2.1Ensure that the --anonymous-auth argument is set to false (Automated)L1Pass
    4.2.2Ensure that the --authorization-mode argument is not set to AlwaysAllow (Automated)L1Pass
    4.2.3Ensure that the --client-ca-file argument is set as appropriate (Automated)L1Pass
    4.2.4Verify that the --read-only-port argument is set to 0 (Manual)L1Pass
    4.2.5Ensure that the ---connection-idle-timeout argument is not set to 0 (Manual)L1Pass
    4.2.6Ensure that the --make-iptables-util-chains argument is set to true (Automated)L1Pass
    4.2.7Ensure that the --hostname-override argument is not set (Manual)L1Pass
    4.2.8Ensure that the eventRecordQPS argument is set to a level which ensures appropriate event capture (Manual)L1Pass
    4.2.9Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate (Manual)L2Equivalent Control
    4.2.10Ensure that the --rotate-certificates argument is not set to false (Automated)L1Pass
    4.2.11Verify that the RotateKubeletServerCertificate argument is set to true (Manual)L1Pass
    4.2.12Ensure that the Kubelet only makes use of Strong Cryptographic Ciphers (Manual)L1Pass
    4.2.13Ensure that a limit is set on pod PIDs (Manual)L1Pass
    4.3kube-proxy
    4.3.1Ensure that the kube-proxy metrics service is bound to localhost (Automated)L1Fail

    Descriptions of Failures and Equivalent Controls for Google Distributed Cloud user cluster

    #RecommendationLevelStatusValueJustification
    1.1.1Ensure that the API server pod specification file permissions are set to 600 or more restrictive (Automated)L1Equivalent ControlN/AIn kubeception mode, user cluster's API server pod specification is stored in etcd.
    1.1.3Ensure that the controller manager pod specification file permissions are set to 600 or more restrictive (Automated)L1Equivalent ControlN/AIn kubeception mode, user cluster's controller manager pod specification is stored in etcd.
    1.1.5Ensure that the scheduler pod specification file permissions are set to 600 or more restrictive (Automated)L1Equivalent ControlN/AIn kubeception mode, user cluster's scheduler pod specification is stored in etcd.
    1.1.7Ensure that the etcd pod specification file permissions are set to 600 or more restrictive (Automated)L1Equivalent ControlN/AIn kubeception mode, user cluster's etcd specification is stored in admin cluster's etcd.
    1.1.12Ensure that the etcd data directory ownership is set to etcd:etcd (Automated)L1Equivalent Control2001:2001The etcd container runs as 2001 and the etcd data directory is owned by 2001:2001.
    1.1.13Ensure that the default administrative credential file permissions are set to 600 (Automated)L1Fail
    1.1.14Ensure that the default administrative credential file ownership is set to root:root (Automated)L1Fail
    1.1.16Ensure that the scheduler.conf file ownership is set to root:root (Automated)L1Equivalent Control2000:2000The kube-scheduler container runs as 2000 and this file is owned by 2000:2000.
    1.1.18Ensure that the controller-manager.conf file ownership is set to root:root (Automated)L1Equivalent Control2002:2002The controller-manager container runs as 2002 and this file is owned by 2002:2002.
    1.2.3Ensure that the --DenyServiceExternalIPs is set (Manual)L1Warn
    1.2.9Ensure that the admission control plugin EventRateLimit is set (Manual)L1Warnnot setGDC software-only for VMware does not support the Event Rate Limit admission controller as it is a Kubernetes Alpha feature.
    1.2.11Ensure that the admission control plugin AlwaysPullImages is set (Manual)L1Depends On Environmentnot setThe AlwaysPullImages admission controller provides some protection for private registry images in noncooperative multitenant clusters, at the cost of making container registries a single-point-of-failure for creating new Pods across the entire cluster. Google Distributed Cloud does not enable the AlwaysPullImages admission controller, which leaves it up to cluster admins to implement admission policy to make this tradeoff for themselves.
    1.2.17Ensure that the --audit-log-maxage argument is set to 30 or as appropriate (Automated)L1Equivalent Controlnot setGoogle Distributed Cloud captures audit logs but does not use these flags for auditing. See Google Distributed Cloud Audit policy for more details.
    1.2.18Ensure that the --audit-log-maxbackup argument is set to 10 or as appropriate (Automated)L1Equivalent Controlnot setGoogle Distributed Cloud captures audit logs but does not use these flags for auditing. See Google Distributed Cloud Audit policy for more details.
    1.2.29Ensure that the API Server only makes use of Strong Cryptographic Ciphers (Manual)L1Warn
    1.3.7Ensure that the --bind-address argument is set to 127.0.0.1 (Automated)L1Fail
    1.4.2Ensure that the --bind-address argument is set to 127.0.0.1 (Automated)L1Fail
    3.1.2Service account token authentication should not be used for users (Manual)L1Warn
    3.1.3Bootstrap token authentication should not be used for users (Manual)L1Warn
    3.2.2Ensure that the audit policy covers key security concerns (Manual)L2Equivalent Controlnot setGoogle Distributed Cloud captures audit logs but does not use these flags for auditing. See Google Distributed Cloud Audit policy for more details.
    4.1.1Ensure that the kubelet service file permissions are set to 600 or more restrictive (Automated)L1Fail
    4.1.3If proxy kubeconfig file exists ensure permissions are set to 600 or more restrictive (Manual)L1Warn
    4.1.4If proxy kubeconfig file exists ensure ownership is set to root:root (Manual)L1Warn
    4.1.9If the kubelet config.yaml configuration file is being used validate permissions set to 600 or more restrictive (Automated)L1Fail
    4.2.9Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate (Manual)L2Equivalent Controlnot setGoogle Distributed Cloud manages kubelet server TLS using the --rotate-server-certificates flag.
    4.3.1Ensure that the kube-proxy metrics service is bound to localhost (Automated)L1Fail

    1.30

    Versions

    This section refers to the following versions:

    Anthos versionKubernetes versionCIS Kubernetes Benchmark version
    1.301.30.9v0.10.4

    Status of Google Distributed Cloud admin cluster

    #RecommendationLevelStatus
    1Control Plane Security Configuration
    1.1Control Plane Node Configuration Files
    1.1.1Ensure that the API server pod specification file permissions are set to 600 or more restrictive (Automated)L1Equivalent Control
    1.1.2Ensure that the API server pod specification file ownership is set to root:root (Automated)L1Pass
    1.1.3Ensure that the controller manager pod specification file permissions are set to 600 or more restrictive (Automated)L1Equivalent Control
    1.1.4Ensure that the controller manager pod specification file ownership is set to root:root (Automated)L1Pass
    1.1.5Ensure that the scheduler pod specification file permissions are set to 600 or more restrictive (Automated)L1Equivalent Control
    1.1.6Ensure that the scheduler pod specification file ownership is set to root:root (Automated)L1Pass
    1.1.7Ensure that the etcd pod specification file permissions are set to 600 or more restrictive (Automated)L1Equivalent Control
    1.1.8Ensure that the etcd pod specification file ownership is set to root:root (Automated)L1Pass
    1.1.9Ensure that the Container Network Interface file permissions are set to 600 or more restrictive (Manual)L1Pass
    1.1.10Ensure that the Container Network Interface file ownership is set to root:root (Manual)L1Pass
    1.1.11Ensure that the etcd data directory permissions are set to 700 or more restrictive (Automated)L1Pass
    1.1.12Ensure that the etcd data directory ownership is set to etcd:etcd (Automated)L1Equivalent Control
    1.1.13Ensure that the default administrative credential file permissions are set to 600 (Automated)L1Fail
    1.1.14Ensure that the default administrative credential file ownership is set to root:root (Automated)L1Fail
    1.1.15Ensure that the scheduler.conf file permissions are set to 600 or more restrictive (Automated)L1Pass
    1.1.16Ensure that the scheduler.conf file ownership is set to root:root (Automated)L1Equivalent Control
    1.1.17Ensure that the controller-manager.conf file permissions are set to 600 or more restrictive (Automated)L1Pass
    1.1.18Ensure that the controller-manager.conf file ownership is set to root:root (Automated)L1Equivalent Control
    1.1.19Ensure that the Kubernetes PKI directory and file ownership is set to root:root (Automated)L1Pass
    1.1.20Ensure that the Kubernetes PKI certificate file permissions are set to 600 or more restrictive (Manual)L1Pass
    1.1.21Ensure that the Kubernetes PKI key file permissions are set to 600 (Manual)L1Pass
    1.2API Server
    1.2.1Ensure that the --anonymous-auth argument is set to false (Manual)L1Pass
    1.2.2Ensure that the --token-auth-file parameter is not set (Automated)L1Pass
    1.2.3Ensure that the --DenyServiceExternalIPs is set (Manual)L1Warn
    1.2.4Ensure that the --kubelet-client-certificate and --kubelet-client-key arguments are set as appropriate (Automated)L1Pass
    1.2.5Ensure that the --kubelet-certificate-authority argument is set as appropriate (Automated)L1Pass
    1.2.6Ensure that the --authorization-mode argument is not set to AlwaysAllow (Automated)L1Pass
    1.2.7Ensure that the --authorization-mode argument includes Node (Automated)L1Pass
    1.2.8Ensure that the --authorization-mode argument includes RBAC (Automated)L1Pass
    1.2.9Ensure that the admission control plugin EventRateLimit is set (Manual)L1Warn
    1.2.10Ensure that the admission control plugin AlwaysAdmit is not set (Automated)L1Pass
    1.2.11Ensure that the admission control plugin AlwaysPullImages is set (Manual)L1Depends On Environment
    1.2.12Ensure that the admission control plugin ServiceAccount is set (Automated)L1Pass
    1.2.13Ensure that the admission control plugin NamespaceLifecycle is set (Automated)L1Pass
    1.2.14Ensure that the admission control plugin NodeRestriction is set (Automated)L1Pass
    1.2.15Ensure that the --profiling argument is set to false (Automated)L1Pass
    1.2.16Ensure that the --audit-log-path argument is set (Automated)L1Pass
    1.2.17Ensure that the --audit-log-maxage argument is set to 30 or as appropriate (Automated)L1Equivalent Control
    1.2.18Ensure that the --audit-log-maxbackup argument is set to 10 or as appropriate (Automated)L1Equivalent Control
    1.2.19Ensure that the --audit-log-maxsize argument is set to 100 or as appropriate (Automated)L1Pass
    1.2.20Ensure that the --request-timeout argument is set as appropriate (Manual)L1Pass
    1.2.21Ensure that the --service-account-lookup argument is set to true (Automated)L1Pass
    1.2.22Ensure that the --service-account-key-file argument is set as appropriate (Automated)L1Pass
    1.2.23Ensure that the --etcd-certfile and --etcd-keyfile arguments are set as appropriate (Automated)L1Pass
    1.2.24Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate (Automated)L1Pass
    1.2.25Ensure that the --client-ca-file argument is set as appropriate (Automated)L1Pass
    1.2.26Ensure that the --etcd-cafile argument is set as appropriate (Automated)L1Pass
    1.2.27Ensure that the --encryption-provider-config argument is set as appropriate (Manual)L1Pass
    1.2.28Ensure that encryption providers are appropriately configured (Manual)L1Pass
    1.2.29Ensure that the API Server only makes use of Strong Cryptographic Ciphers (Manual)L1Warn
    1.3Controller Manager
    1.3.1Ensure that the --terminated-pod-gc-threshold argument is set as appropriate (Manual)L1Pass
    1.3.2Ensure that the --profiling argument is set to false (Automated)L1Pass
    1.3.3Ensure that the --use-service-account-credentials argument is set to true (Automated)L1Pass
    1.3.4Ensure that the --service-account-private-key-file argument is set as appropriate (Automated)L1Pass
    1.3.5Ensure that the --root-ca-file argument is set as appropriate (Automated)L1Pass
    1.3.6Ensure that the RotateKubeletServerCertificate argument is set to true (Automated)L2Pass
    1.3.7Ensure that the --bind-address argument is set to 127.0.0.1 (Automated)L1Fail
    1.4Scheduler
    1.4.1Ensure that the --profiling argument is set to false (Automated)L1Pass
    1.4.2Ensure that the --bind-address argument is set to 127.0.0.1 (Automated)L1Fail
    2Etcd Node Configuration
    2Etcd Node Configuration
    2.1Ensure that the --cert-file and --key-file arguments are set as appropriate (Automated)L1Pass
    2.2Ensure that the --client-cert-auth argument is set to true (Automated)L1Pass
    2.3Ensure that the --auto-tls argument is not set to true (Automated)L1Pass
    2.4Ensure that the --peer-cert-file and --peer-key-file arguments are set as appropriate (Automated)L1Pass
    2.5Ensure that the --peer-client-cert-auth argument is set to true (Automated)L1Pass
    2.6Ensure that the --peer-auto-tls argument is not set to true (Automated)L1Pass
    2.7Ensure that a unique Certificate Authority is used for etcd (Manual)L2Pass
    3Control Plane Configuration
    3.1Authentication and Authorization
    3.1.1Client certificate authentication should not be used for users (Manual)L2Pass
    3.1.2Service account token authentication should not be used for users (Manual)L1Warn
    3.1.3Bootstrap token authentication should not be used for users (Manual)L1Warn
    3.2Logging
    3.2.1Ensure that a minimal audit policy is created (Manual)L1Pass
    3.2.2Ensure that the audit policy covers key security concerns (Manual)L2Equivalent Control

    Descriptions of Failures and Equivalent Controls for Google Distributed Cloud admin cluster

    #RecommendationLevelStatusValueJustification
    1.1.1Ensure that the API server pod specification file permissions are set to 600 or more restrictive (Automated)L1Equivalent ControlN/AIn kubeception mode, user cluster's API server pod specification is stored in etcd.
    1.1.3Ensure that the controller manager pod specification file permissions are set to 600 or more restrictive (Automated)L1Equivalent ControlN/AIn kubeception mode, user cluster's controller manager pod specification is stored in etcd.
    1.1.5Ensure that the scheduler pod specification file permissions are set to 600 or more restrictive (Automated)L1Equivalent ControlN/AIn kubeception mode, user cluster's scheduler pod specification is stored in etcd.
    1.1.7Ensure that the etcd pod specification file permissions are set to 600 or more restrictive (Automated)L1Equivalent ControlN/AIn kubeception mode, user cluster's etcd specification is stored in admin cluster's etcd.
    1.1.12Ensure that the etcd data directory ownership is set to etcd:etcd (Automated)L1Equivalent Control2001:2001The etcd container runs as 2001 and the etcd data directory is owned by 2001:2001.
    1.1.13Ensure that the default administrative credential file permissions are set to 600 (Automated)L1Fail
    1.1.14Ensure that the default administrative credential file ownership is set to root:root (Automated)L1Fail
    1.1.16Ensure that the scheduler.conf file ownership is set to root:root (Automated)L1Equivalent Control2000:2000The kube-scheduler container runs as 2000 and this file is owned by 2000:2000.
    1.1.18Ensure that the controller-manager.conf file ownership is set to root:root (Automated)L1Equivalent Control2002:2002The controller-manager container runs as 2002 and this file is owned by 2002:2002.
    1.2.3Ensure that the --DenyServiceExternalIPs is set (Manual)L1Warn
    1.2.9Ensure that the admission control plugin EventRateLimit is set (Manual)L1Warnnot setGDC software-only for VMware does not support the Event Rate Limit admission controller as it is a Kubernetes Alpha feature.
    1.2.11Ensure that the admission control plugin AlwaysPullImages is set (Manual)L1Depends On Environmentnot setThe AlwaysPullImages admission controller provides some protection for private registry images in noncooperative multitenant clusters, at the cost of making container registries a single-point-of-failure for creating new Pods across the entire cluster. Google Distributed Cloud does not enable the AlwaysPullImages admission controller, which leaves it up to cluster admins to implement admission policy to make this tradeoff for themselves.
    1.2.17Ensure that the --audit-log-maxage argument is set to 30 or as appropriate (Automated)L1Equivalent Controlnot setGoogle Distributed Cloud captures audit logs but does not use these flags for auditing. See Google Distributed Cloud Audit policy for more details.
    1.2.18Ensure that the --audit-log-maxbackup argument is set to 10 or as appropriate (Automated)L1Equivalent Controlnot setGoogle Distributed Cloud captures audit logs but does not use these flags for auditing. See Google Distributed Cloud Audit policy for more details.
    1.2.29Ensure that the API Server only makes use of Strong Cryptographic Ciphers (Manual)L1Warn
    1.3.7Ensure that the --bind-address argument is set to 127.0.0.1 (Automated)L1Fail
    1.4.2Ensure that the --bind-address argument is set to 127.0.0.1 (Automated)L1Fail
    3.1.2Service account token authentication should not be used for users (Manual)L1Warn
    3.1.3Bootstrap token authentication should not be used for users (Manual)L1Warn
    3.2.2Ensure that the audit policy covers key security concerns (Manual)L2Equivalent Controlnot setGoogle Distributed Cloud captures audit logs but does not use these flags for auditing. See Google Distributed Cloud Audit policy for more details.

    Status of Google Distributed Cloud user cluster

    #RecommendationLevelStatus
    1Control Plane Security Configuration
    1.1Control Plane Node Configuration Files
    1.1.1Ensure that the API server pod specification file permissions are set to 600 or more restrictive (Automated)L1Equivalent Control
    1.1.2Ensure that the API server pod specification file ownership is set to root:root (Automated)L1Pass
    1.1.3Ensure that the controller manager pod specification file permissions are set to 600 or more restrictive (Automated)L1Equivalent Control
    1.1.4Ensure that the controller manager pod specification file ownership is set to root:root (Automated)L1Pass
    1.1.5Ensure that the scheduler pod specification file permissions are set to 600 or more restrictive (Automated)L1Equivalent Control
    1.1.6Ensure that the scheduler pod specification file ownership is set to root:root (Automated)L1Pass
    1.1.7Ensure that the etcd pod specification file permissions are set to 600 or more restrictive (Automated)L1Equivalent Control
    1.1.8Ensure that the etcd pod specification file ownership is set to root:root (Automated)L1Pass
    1.1.9Ensure that the Container Network Interface file permissions are set to 600 or more restrictive (Manual)L1Pass
    1.1.10Ensure that the Container Network Interface file ownership is set to root:root (Manual)L1Pass
    1.1.11Ensure that the etcd data directory permissions are set to 700 or more restrictive (Automated)L1Pass
    1.1.12Ensure that the etcd data directory ownership is set to etcd:etcd (Automated)L1Equivalent Control
    1.1.13Ensure that the default administrative credential file permissions are set to 600 (Automated)L1Fail
    1.1.14Ensure that the default administrative credential file ownership is set to root:root (Automated)L1Fail
    1.1.15Ensure that the scheduler.conf file permissions are set to 600 or more restrictive (Automated)L1Pass
    1.1.16Ensure that the scheduler.conf file ownership is set to root:root (Automated)L1Equivalent Control
    1.1.17Ensure that the controller-manager.conf file permissions are set to 600 or more restrictive (Automated)L1Pass
    1.1.18Ensure that the controller-manager.conf file ownership is set to root:root (Automated)L1Equivalent Control
    1.1.19Ensure that the Kubernetes PKI directory and file ownership is set to root:root (Automated)L1Pass
    1.1.20Ensure that the Kubernetes PKI certificate file permissions are set to 600 or more restrictive (Manual)L1Pass
    1.1.21Ensure that the Kubernetes PKI key file permissions are set to 600 (Manual)L1Pass
    1.2API Server
    1.2.1Ensure that the --anonymous-auth argument is set to false (Manual)L1Pass
    1.2.2Ensure that the --token-auth-file parameter is not set (Automated)L1Pass
    1.2.3Ensure that the --DenyServiceExternalIPs is set (Manual)L1Warn
    1.2.4Ensure that the --kubelet-client-certificate and --kubelet-client-key arguments are set as appropriate (Automated)L1Pass
    1.2.5Ensure that the --kubelet-certificate-authority argument is set as appropriate (Automated)L1Pass
    1.2.6Ensure that the --authorization-mode argument is not set to AlwaysAllow (Automated)L1Pass
    1.2.7Ensure that the --authorization-mode argument includes Node (Automated)L1Pass
    1.2.8Ensure that the --authorization-mode argument includes RBAC (Automated)L1Pass
    1.2.9Ensure that the admission control plugin EventRateLimit is set (Manual)L1Warn
    1.2.10Ensure that the admission control plugin AlwaysAdmit is not set (Automated)L1Pass
    1.2.11Ensure that the admission control plugin AlwaysPullImages is set (Manual)L1Depends On Environment
    1.2.12Ensure that the admission control plugin ServiceAccount is set (Automated)L1Pass
    1.2.13Ensure that the admission control plugin NamespaceLifecycle is set (Automated)L1Pass
    1.2.14Ensure that the admission control plugin NodeRestriction is set (Automated)L1Pass
    1.2.15Ensure that the --profiling argument is set to false (Automated)L1Pass
    1.2.16Ensure that the --audit-log-path argument is set (Automated)L1Pass
    1.2.17Ensure that the --audit-log-maxage argument is set to 30 or as appropriate (Automated)L1Equivalent Control
    1.2.18Ensure that the --audit-log-maxbackup argument is set to 10 or as appropriate (Automated)L1Equivalent Control
    1.2.19Ensure that the --audit-log-maxsize argument is set to 100 or as appropriate (Automated)L1Pass
    1.2.20Ensure that the --request-timeout argument is set as appropriate (Manual)L1Pass
    1.2.21Ensure that the --service-account-lookup argument is set to true (Automated)L1Pass
    1.2.22Ensure that the --service-account-key-file argument is set as appropriate (Automated)L1Pass
    1.2.23Ensure that the --etcd-certfile and --etcd-keyfile arguments are set as appropriate (Automated)L1Pass
    1.2.24Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate (Automated)L1Pass
    1.2.25Ensure that the --client-ca-file argument is set as appropriate (Automated)L1Pass
    1.2.26Ensure that the --etcd-cafile argument is set as appropriate (Automated)L1Pass
    1.2.27Ensure that the --encryption-provider-config argument is set as appropriate (Manual)L1Pass
    1.2.28Ensure that encryption providers are appropriately configured (Manual)L1Pass
    1.2.29Ensure that the API Server only makes use of Strong Cryptographic Ciphers (Manual)L1Warn
    1.3Controller Manager
    1.3.1Ensure that the --terminated-pod-gc-threshold argument is set as appropriate (Manual)L1Pass
    1.3.2Ensure that the --profiling argument is set to false (Automated)L1Pass
    1.3.3Ensure that the --use-service-account-credentials argument is set to true (Automated)L1Pass
    1.3.4Ensure that the --service-account-private-key-file argument is set as appropriate (Automated)L1Pass
    1.3.5Ensure that the --root-ca-file argument is set as appropriate (Automated)L1Pass
    1.3.6Ensure that the RotateKubeletServerCertificate argument is set to true (Automated)L2Pass
    1.3.7Ensure that the --bind-address argument is set to 127.0.0.1 (Automated)L1Fail
    1.4Scheduler
    1.4.1Ensure that the --profiling argument is set to false (Automated)L1Pass
    1.4.2Ensure that the --bind-address argument is set to 127.0.0.1 (Automated)L1Fail
    2Etcd Node Configuration
    2Etcd Node Configuration
    2.1Ensure that the --cert-file and --key-file arguments are set as appropriate (Automated)L1Pass
    2.2Ensure that the --client-cert-auth argument is set to true (Automated)L1Pass
    2.3Ensure that the --auto-tls argument is not set to true (Automated)L1Pass
    2.4Ensure that the --peer-cert-file and --peer-key-file arguments are set as appropriate (Automated)L1Pass
    2.5Ensure that the --peer-client-cert-auth argument is set to true (Automated)L1Pass
    2.6Ensure that the --peer-auto-tls argument is not set to true (Automated)L1Pass
    2.7Ensure that a unique Certificate Authority is used for etcd (Manual)L2Pass
    3Control Plane Configuration
    3.1Authentication and Authorization
    3.1.1Client certificate authentication should not be used for users (Manual)L2Pass
    3.1.2Service account token authentication should not be used for users (Manual)L1Warn
    3.1.3Bootstrap token authentication should not be used for users (Manual)L1Warn
    3.2Logging
    3.2.1Ensure that a minimal audit policy is created (Manual)L1Pass
    3.2.2Ensure that the audit policy covers key security concerns (Manual)L2Equivalent Control
    4Worker Node Security Configuration
    4.1Worker Node Configuration Files
    4.1.1Ensure that the kubelet service file permissions are set to 600 or more restrictive (Automated)L1Fail
    4.1.2Ensure that the kubelet service file ownership is set to root:root (Automated)L1Pass
    4.1.3If proxy kubeconfig file exists ensure permissions are set to 600 or more restrictive (Manual)L1Warn
    4.1.4If proxy kubeconfig file exists ensure ownership is set to root:root (Manual)L1Warn
    4.1.5Ensure that the --kubeconfig kubelet.conf file permissions are set to 600 or more restrictive (Automated)L1Pass
    4.1.6Ensure that the --kubeconfig kubelet.conf file ownership is set to root:root (Automated)L1Pass
    4.1.7Ensure that the certificate authorities file permissions are set to 600 or more restrictive (Manual)L1Pass
    4.1.8Ensure that the client certificate authorities file ownership is set to root:root (Manual)L1Pass
    4.1.9If the kubelet config.yaml configuration file is being used validate permissions set to 600 or more restrictive (Automated)L1Fail
    4.1.10If the kubelet config.yaml configuration file is being used validate file ownership is set to root:root (Automated)L1Pass
    4.2Kubelet
    4.2.1Ensure that the --anonymous-auth argument is set to false (Automated)L1Pass
    4.2.2Ensure that the --authorization-mode argument is not set to AlwaysAllow (Automated)L1Pass
    4.2.3Ensure that the --client-ca-file argument is set as appropriate (Automated)L1Pass
    4.2.4Verify that the --read-only-port argument is set to 0 (Manual)L1Pass
    4.2.5Ensure that the ---connection-idle-timeout argument is not set to 0 (Manual)L1Pass
    4.2.6Ensure that the --make-iptables-util-chains argument is set to true (Automated)L1Pass
    4.2.7Ensure that the --hostname-override argument is not set (Manual)L1Pass
    4.2.8Ensure that the eventRecordQPS argument is set to a level which ensures appropriate event capture (Manual)L1Pass
    4.2.9Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate (Manual)L2Equivalent Control
    4.2.10Ensure that the --rotate-certificates argument is not set to false (Automated)L1Pass
    4.2.11Verify that the RotateKubeletServerCertificate argument is set to true (Manual)L1Pass
    4.2.12Ensure that the Kubelet only makes use of Strong Cryptographic Ciphers (Manual)L1Pass
    4.2.13Ensure that a limit is set on pod PIDs (Manual)L1Pass
    4.3kube-proxy
    4.3.1Ensure that the kube-proxy metrics service is bound to localhost (Automated)L1Fail

    Descriptions of Failures and Equivalent Controls for Google Distributed Cloud user cluster

    #RecommendationLevelStatusValueJustification
    1.1.1Ensure that the API server pod specification file permissions are set to 600 or more restrictive (Automated)L1Equivalent ControlN/AIn kubeception mode, user cluster's API server pod specification is stored in etcd.
    1.1.3Ensure that the controller manager pod specification file permissions are set to 600 or more restrictive (Automated)L1Equivalent ControlN/AIn kubeception mode, user cluster's controller manager pod specification is stored in etcd.
    1.1.5Ensure that the scheduler pod specification file permissions are set to 600 or more restrictive (Automated)L1Equivalent ControlN/AIn kubeception mode, user cluster's scheduler pod specification is stored in etcd.
    1.1.7Ensure that the etcd pod specification file permissions are set to 600 or more restrictive (Automated)L1Equivalent ControlN/AIn kubeception mode, user cluster's etcd specification is stored in admin cluster's etcd.
    1.1.12Ensure that the etcd data directory ownership is set to etcd:etcd (Automated)L1Equivalent Control2001:2001The etcd container runs as 2001 and the etcd data directory is owned by 2001:2001.
    1.1.13Ensure that the default administrative credential file permissions are set to 600 (Automated)L1Fail
    1.1.14Ensure that the default administrative credential file ownership is set to root:root (Automated)L1Fail
    1.1.16Ensure that the scheduler.conf file ownership is set to root:root (Automated)L1Equivalent Control2000:2000The kube-scheduler container runs as 2000 and this file is owned by 2000:2000.
    1.1.18Ensure that the controller-manager.conf file ownership is set to root:root (Automated)L1Equivalent Control2002:2002The controller-manager container runs as 2002 and this file is owned by 2002:2002.
    1.2.3Ensure that the --DenyServiceExternalIPs is set (Manual)L1Warn
    1.2.9Ensure that the admission control plugin EventRateLimit is set (Manual)L1Warnnot setGDC software-only for VMware does not support the Event Rate Limit admission controller as it is a Kubernetes Alpha feature.
    1.2.11Ensure that the admission control plugin AlwaysPullImages is set (Manual)L1Depends On Environmentnot setThe AlwaysPullImages admission controller provides some protection for private registry images in noncooperative multitenant clusters, at the cost of making container registries a single-point-of-failure for creating new Pods across the entire cluster. Google Distributed Cloud does not enable the AlwaysPullImages admission controller, which leaves it up to cluster admins to implement admission policy to make this tradeoff for themselves.
    1.2.17Ensure that the --audit-log-maxage argument is set to 30 or as appropriate (Automated)L1Equivalent Controlnot setGoogle Distributed Cloud captures audit logs but does not use these flags for auditing. See Google Distributed Cloud Audit policy for more details.
    1.2.18Ensure that the --audit-log-maxbackup argument is set to 10 or as appropriate (Automated)L1Equivalent Controlnot setGoogle Distributed Cloud captures audit logs but does not use these flags for auditing. See Google Distributed Cloud Audit policy for more details.
    1.2.29Ensure that the API Server only makes use of Strong Cryptographic Ciphers (Manual)L1Warn
    1.3.7Ensure that the --bind-address argument is set to 127.0.0.1 (Automated)L1Fail
    1.4.2Ensure that the --bind-address argument is set to 127.0.0.1 (Automated)L1Fail
    3.1.2Service account token authentication should not be used for users (Manual)L1Warn
    3.1.3Bootstrap token authentication should not be used for users (Manual)L1Warn
    3.2.2Ensure that the audit policy covers key security concerns (Manual)L2Equivalent Controlnot setGoogle Distributed Cloud captures audit logs but does not use these flags for auditing. See Google Distributed Cloud Audit policy for more details.
    4.1.1Ensure that the kubelet service file permissions are set to 600 or more restrictive (Automated)L1Fail
    4.1.3If proxy kubeconfig file exists ensure permissions are set to 600 or more restrictive (Manual)L1Warn
    4.1.4If proxy kubeconfig file exists ensure ownership is set to root:root (Manual)L1Warn
    4.1.9If the kubelet config.yaml configuration file is being used validate permissions set to 600 or more restrictive (Automated)L1Fail
    4.2.9Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate (Manual)L2Equivalent Controlnot setGoogle Distributed Cloud manages kubelet server TLS using the --rotate-server-certificates flag.
    4.3.1Ensure that the kube-proxy metrics service is bound to localhost (Automated)L1Fail

    1.29

    Versions

    This section refers to the following versions:

    Anthos versionKubernetes versionCIS Kubernetes Benchmark version
    1.291.29.41.9

    Status of Google Distributed Cloud admin cluster

    #RecommendationLevelStatus
    1Control Plane Security Configuration
    1.1Control Plane Node Configuration Files
    1.1.1Ensure that the API server pod specification file permissions are set to 600 or more restrictive (Automated)L1Equivalent Control
    1.1.2Ensure that the API server pod specification file ownership is set to root:root (Automated)L1Pass
    1.1.3Ensure that the controller manager pod specification file permissions are set to 600 or more restrictive (Automated)L1Equivalent Control
    1.1.4Ensure that the controller manager pod specification file ownership is set to root:root (Automated)L1Pass
    1.1.5Ensure that the scheduler pod specification file permissions are set to 600 or more restrictive (Automated)L1Equivalent Control
    1.1.6Ensure that the scheduler pod specification file ownership is set to root:root (Automated)L1Pass
    1.1.7Ensure that the etcd pod specification file permissions are set to 600 or more restrictive (Automated)L1Equivalent Control
    1.1.8Ensure that the etcd pod specification file ownership is set to root:root (Automated)L1Pass
    1.1.9Ensure that the Container Network Interface file permissions are set to 600 or more restrictive (Manual)L1Pass
    1.1.10Ensure that the Container Network Interface file ownership is set to root:root (Manual)L1Pass
    1.1.11Ensure that the etcd data directory permissions are set to 700 or more restrictive (Automated)L1Pass
    1.1.12Ensure that the etcd data directory ownership is set to etcd:etcd (Automated)L1Equivalent Control
    1.1.13Ensure that the admin.conf file permissions are set to 600 or more restrictive (Automated)L1Pass
    1.1.14Ensure that the admin.conf file ownership is set to root:root (Automated)L1Pass
    1.1.15Ensure that the scheduler.conf file permissions are set to 600 or more restrictive (Automated)L1Pass
    1.1.16Ensure that the scheduler.conf file ownership is set to root:root (Automated)L1Equivalent Control
    1.1.17Ensure that the controller-manager.conf file permissions are set to 600 or more restrictive (Automated)L1Pass
    1.1.18Ensure that the controller-manager.conf file ownership is set to root:root (Automated)L1Equivalent Control
    1.1.19Ensure that the Kubernetes PKI directory and file ownership is set to root:root (Automated)L1Pass
    1.1.20Ensure that the Kubernetes PKI certificate file permissions are set to 600 or more restrictive (Manual)L1Pass
    1.1.21Ensure that the Kubernetes PKI key file permissions are set to 600 (Manual)L1Pass
    1.2API Server
    1.2.1Ensure that the --anonymous-auth argument is set to false (Manual)L1Pass
    1.2.2Ensure that the --token-auth-file parameter is not set (Automated)L1Pass
    1.2.3Ensure that the --DenyServiceExternalIPs is set (Manual)L1Warn
    1.2.4Ensure that the --kubelet-client-certificate and --kubelet-client-key arguments are set as appropriate (Automated)L1Pass
    1.2.5Ensure that the --kubelet-certificate-authority argument is set as appropriate (Automated)L1Pass
    1.2.6Ensure that the --authorization-mode argument is not set to AlwaysAllow (Automated)L1Pass
    1.2.7Ensure that the --authorization-mode argument includes Node (Automated)L1Pass
    1.2.8Ensure that the --authorization-mode argument includes RBAC (Automated)L1Pass
    1.2.9Ensure that the admission control plugin EventRateLimit is set (Manual)L1Warn
    1.2.10Ensure that the admission control plugin AlwaysAdmit is not set (Automated)L1Pass
    1.2.11Ensure that the admission control plugin AlwaysPullImages is set (Manual)L1Depends On Environment
    1.2.12Ensure that the admission control plugin SecurityContextDeny is set if PodSecurityPolicy is not used (Manual)L1Equivalent Control
    1.2.13Ensure that the admission control plugin ServiceAccount is set (Automated)L1Pass
    1.2.14Ensure that the admission control plugin NamespaceLifecycle is set (Automated)L1Pass
    1.2.15Ensure that the admission control plugin NodeRestriction is set (Automated)L1Pass
    1.2.16Ensure that the --profiling argument is set to false (Automated)L1Pass
    1.2.17Ensure that the --audit-log-path argument is set (Automated)L1Pass
    1.2.18Ensure that the --audit-log-maxage argument is set to 30 or as appropriate (Automated)L1Equivalent Control
    1.2.19Ensure that the --audit-log-maxbackup argument is set to 10 or as appropriate (Automated)L1Equivalent Control
    1.2.20Ensure that the --audit-log-maxsize argument is set to 100 or as appropriate (Automated)L1Pass
    1.2.21Ensure that the --request-timeout argument is set as appropriate (Manual)L1Pass
    1.2.22Ensure that the --service-account-lookup argument is set to true (Automated)L1Pass
    1.2.23Ensure that the --service-account-key-file argument is set as appropriate (Automated)L1Pass
    1.2.24Ensure that the --etcd-certfile and --etcd-keyfile arguments are set as appropriate (Automated)L1Pass
    1.2.25Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate (Automated)L1Pass
    1.2.26Ensure that the --client-ca-file argument is set as appropriate (Automated)L1Pass
    1.2.27Ensure that the --etcd-cafile argument is set as appropriate (Automated)L1Pass
    1.2.28Ensure that the --encryption-provider-config argument is set as appropriate (Manual)L1Pass
    1.2.29Ensure that encryption providers are appropriately configured (Manual)L1Pass
    1.2.30Ensure that the API Server only makes use of Strong Cryptographic Ciphers (Manual)L1Pass
    1.3Controller Manager
    1.3.1Ensure that the --terminated-pod-gc-threshold argument is set as appropriate (Manual)L1Pass
    1.3.2Ensure that the --profiling argument is set to false (Automated)L1Pass
    1.3.3Ensure that the --use-service-account-credentials argument is set to true (Automated)L1Pass
    1.3.4Ensure that the --service-account-private-key-file argument is set as appropriate (Automated)L1Pass
    1.3.5Ensure that the --root-ca-file argument is set as appropriate (Automated)L1Pass
    1.3.6Ensure that the RotateKubeletServerCertificate argument is set to true (Automated)L2Pass
    1.3.7Ensure that the --bind-address argument is set to 127.0.0.1 (Automated)L1Fail
    1.4Scheduler
    1.4.1Ensure that the --profiling argument is set to false (Automated)L1Pass
    1.4.2Ensure that the --bind-address argument is set to 127.0.0.1 (Automated)L1Fail
    2Etcd Node Configuration
    2Etcd Node Configuration
    2.1Ensure that the --cert-file and --key-file arguments are set as appropriate (Automated)L1Pass
    2.2Ensure that the --client-cert-auth argument is set to true (Automated)L1Pass
    2.3Ensure that the --auto-tls argument is not set to true (Automated)L1Pass
    2.4Ensure that the --peer-cert-file and --peer-key-file arguments are set as appropriate (Automated)L1Pass
    2.5Ensure that the --peer-client-cert-auth argument is set to true (Automated)L1Pass
    2.6Ensure that the --peer-auto-tls argument is not set to true (Automated)L1Pass
    2.7Ensure that a unique Certificate Authority is used for etcd (Manual)L2Pass
    3Control Plane Configuration
    3.1Authentication and Authorization
    3.1.1Client certificate authentication should not be used for users (Manual)L2Pass
    3.1.2Service account token authentication should not be used for users (Manual)L1Warn
    3.1.3Bootstrap token authentication should not be used for users (Manual)L1Warn
    3.2Logging
    3.2.1Ensure that a minimal audit policy is created (Manual)L1Pass
    3.2.2Ensure that the audit policy covers key security concerns (Manual)L2Equivalent Control

    Descriptions of Failures and Equivalent Controls for Google Distributed Cloud admin cluster

    #RecommendationLevelStatusValueJustification
    1.1.1Ensure that the API server pod specification file permissions are set to 600 or more restrictive (Automated)L1Equivalent ControlN/AIn kubeception mode, user cluster's API server pod specification is stored in etcd.
    1.1.3Ensure that the controller manager pod specification file permissions are set to 600 or more restrictive (Automated)L1Equivalent ControlN/AIn kubeception mode, user cluster's controller manager pod specification is stored in etcd.
    1.1.5Ensure that the scheduler pod specification file permissions are set to 600 or more restrictive (Automated)L1Equivalent ControlN/AIn kubeception mode, user cluster's scheduler pod specification is stored in etcd.
    1.1.7Ensure that the etcd pod specification file permissions are set to 600 or more restrictive (Automated)L1Equivalent ControlN/AIn kubeception mode, user cluster's etcd specification is stored in admin cluster's etcd.
    1.1.12Ensure that the etcd data directory ownership is set to etcd:etcd (Automated)L1Equivalent Control2001:2001The etcd container runs as 2001 and the etcd data directory is owned by 2001:2001.
    1.1.16Ensure that the scheduler.conf file ownership is set to root:root (Automated)L1Equivalent Control2000:2000The kube-scheduler container runs as 2000 and this file is owned by 2000:2000.
    1.1.18Ensure that the controller-manager.conf file ownership is set to root:root (Automated)L1Equivalent Control2002:2002The controller-manager container runs as 2002 and this file is owned by 2002:2002.
    1.2.3Ensure that the --DenyServiceExternalIPs is set (Manual)L1Warn
    1.2.9Ensure that the admission control plugin EventRateLimit is set (Manual)L1Warnnot setAnthos clusters on VMware does not support the Event Rate Limit admission controller as it is a Kubernetes Alpha feature.
    1.2.11Ensure that the admission control plugin AlwaysPullImages is set (Manual)L1Depends On Environmentnot setThe AlwaysPullImages admission controller provides some protection for private registry images in noncooperative multitenant clusters, at the cost of making container registries a single-point-of-failure for creating new Pods across the entire cluster. Google Distributed Cloud does not enable the AlwaysPullImages admission controller, which leaves it up to cluster admins to implement admission policy to make this tradeoff for themselves.
    1.2.12Ensure that the admission control plugin SecurityContextDeny is set if PodSecurityPolicy is not used (Manual)L1Equivalent Controlnot setPodSecurityPolicy will be removed from Kubernetes in 1.25. As a replacement, Pod Security Admission is enabled by default as of 1.23.
    1.2.18Ensure that the --audit-log-maxage argument is set to 30 or as appropriate (Automated)L1Equivalent Controlnot setGoogle Distributed Cloud captures audit logs but does not use these flags for auditing. See Google Distributed Cloud Audit policy for more details.
    1.2.19Ensure that the --audit-log-maxbackup argument is set to 10 or as appropriate (Automated)L1Equivalent Controlnot setGoogle Distributed Cloud captures audit logs but does not use these flags for auditing. See Google Distributed Cloud Audit policy for more details.
    1.3.7Ensure that the --bind-address argument is set to 127.0.0.1 (Automated)L1Fail
    1.4.2Ensure that the --bind-address argument is set to 127.0.0.1 (Automated)L1Fail
    3.1.2Service account token authentication should not be used for users (Manual)L1Warn
    3.1.3Bootstrap token authentication should not be used for users (Manual)L1Warn
    3.2.2Ensure that the audit policy covers key security concerns (Manual)L2Equivalent Controlnot setGoogle Distributed Cloud captures audit logs but does not use these flags for auditing. See Google Distributed Cloud Audit policy for more details.

    Status of Google Distributed Cloud user cluster

    #RecommendationLevelStatus
    1Control Plane Security Configuration
    1.1Control Plane Node Configuration Files
    1.1.1Ensure that the API server pod specification file permissions are set to 600 or more restrictive (Automated)L1Equivalent Control
    1.1.2Ensure that the API server pod specification file ownership is set to root:root (Automated)L1Pass
    1.1.3Ensure that the controller manager pod specification file permissions are set to 600 or more restrictive (Automated)L1Equivalent Control
    1.1.4Ensure that the controller manager pod specification file ownership is set to root:root (Automated)L1Pass
    1.1.5Ensure that the scheduler pod specification file permissions are set to 600 or more restrictive (Automated)L1Equivalent Control
    1.1.6Ensure that the scheduler pod specification file ownership is set to root:root (Automated)L1Pass
    1.1.7Ensure that the etcd pod specification file permissions are set to 600 or more restrictive (Automated)L1Equivalent Control
    1.1.8Ensure that the etcd pod specification file ownership is set to root:root (Automated)L1Pass
    1.1.9Ensure that the Container Network Interface file permissions are set to 600 or more restrictive (Manual)L1Pass
    1.1.10Ensure that the Container Network Interface file ownership is set to root:root (Manual)L1Pass
    1.1.11Ensure that the etcd data directory permissions are set to 700 or more restrictive (Automated)L1Pass
    1.1.12Ensure that the etcd data directory ownership is set to etcd:etcd (Automated)L1Equivalent Control
    1.1.13Ensure that the admin.conf file permissions are set to 600 or more restrictive (Automated)L1Pass
    1.1.14Ensure that the admin.conf file ownership is set to root:root (Automated)L1Pass
    1.1.15Ensure that the scheduler.conf file permissions are set to 600 or more restrictive (Automated)L1Pass
    1.1.16Ensure that the scheduler.conf file ownership is set to root:root (Automated)L1Equivalent Control
    1.1.17Ensure that the controller-manager.conf file permissions are set to 600 or more restrictive (Automated)L1Pass
    1.1.18Ensure that the controller-manager.conf file ownership is set to root:root (Automated)L1Equivalent Control
    1.1.19Ensure that the Kubernetes PKI directory and file ownership is set to root:root (Automated)L1Pass
    1.1.20Ensure that the Kubernetes PKI certificate file permissions are set to 600 or more restrictive (Manual)L1Pass
    1.1.21Ensure that the Kubernetes PKI key file permissions are set to 600 (Manual)L1Pass
    1.2API Server
    1.2.1Ensure that the --anonymous-auth argument is set to false (Manual)L1Pass
    1.2.2Ensure that the --token-auth-file parameter is not set (Automated)L1Pass
    1.2.3Ensure that the --DenyServiceExternalIPs is set (Manual)L1Warn
    1.2.4Ensure that the --kubelet-client-certificate and --kubelet-client-key arguments are set as appropriate (Automated)L1Pass
    1.2.5Ensure that the --kubelet-certificate-authority argument is set as appropriate (Automated)L1Pass
    1.2.6Ensure that the --authorization-mode argument is not set to AlwaysAllow (Automated)L1Pass
    1.2.7Ensure that the --authorization-mode argument includes Node (Automated)L1Pass
    1.2.8Ensure that the --authorization-mode argument includes RBAC (Automated)L1Pass
    1.2.9Ensure that the admission control plugin EventRateLimit is set (Manual)L1Warn
    1.2.10Ensure that the admission control plugin AlwaysAdmit is not set (Automated)L1Pass
    1.2.11Ensure that the admission control plugin AlwaysPullImages is set (Manual)L1Depends On Environment
    1.2.12Ensure that the admission control plugin SecurityContextDeny is set if PodSecurityPolicy is not used (Manual)L1Equivalent Control
    1.2.13Ensure that the admission control plugin ServiceAccount is set (Automated)L1Pass
    1.2.14Ensure that the admission control plugin NamespaceLifecycle is set (Automated)L1Pass
    1.2.15Ensure that the admission control plugin NodeRestriction is set (Automated)L1Pass
    1.2.16Ensure that the --profiling argument is set to false (Automated)L1Pass
    1.2.17Ensure that the --audit-log-path argument is set (Automated)L1Pass
    1.2.18Ensure that the --audit-log-maxage argument is set to 30 or as appropriate (Automated)L1Equivalent Control
    1.2.19Ensure that the --audit-log-maxbackup argument is set to 10 or as appropriate (Automated)L1Equivalent Control
    1.2.20Ensure that the --audit-log-maxsize argument is set to 100 or as appropriate (Automated)L1Pass
    1.2.21Ensure that the --request-timeout argument is set as appropriate (Manual)L1Pass
    1.2.22Ensure that the --service-account-lookup argument is set to true (Automated)L1Pass
    1.2.23Ensure that the --service-account-key-file argument is set as appropriate (Automated)L1Pass
    1.2.24Ensure that the --etcd-certfile and --etcd-keyfile arguments are set as appropriate (Automated)L1Pass
    1.2.25Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate (Automated)L1Pass
    1.2.26Ensure that the --client-ca-file argument is set as appropriate (Automated)L1Pass
    1.2.27Ensure that the --etcd-cafile argument is set as appropriate (Automated)L1Pass
    1.2.28Ensure that the --encryption-provider-config argument is set as appropriate (Manual)L1Pass
    1.2.29Ensure that encryption providers are appropriately configured (Manual)L1Pass
    1.2.30Ensure that the API Server only makes use of Strong Cryptographic Ciphers (Manual)L1Pass
    1.3Controller Manager
    1.3.1Ensure that the --terminated-pod-gc-threshold argument is set as appropriate (Manual)L1Pass
    1.3.2Ensure that the --profiling argument is set to false (Automated)L1Pass
    1.3.3Ensure that the --use-service-account-credentials argument is set to true (Automated)L1Pass
    1.3.4Ensure that the --service-account-private-key-file argument is set as appropriate (Automated)L1Pass
    1.3.5Ensure that the --root-ca-file argument is set as appropriate (Automated)L1Pass
    1.3.6Ensure that the RotateKubeletServerCertificate argument is set to true (Automated)L2Pass
    1.3.7Ensure that the --bind-address argument is set to 127.0.0.1 (Automated)L1Fail
    1.4Scheduler
    1.4.1Ensure that the --profiling argument is set to false (Automated)L1Pass
    1.4.2Ensure that the --bind-address argument is set to 127.0.0.1 (Automated)L1Fail
    2Etcd Node Configuration
    2Etcd Node Configuration
    2.1Ensure that the --cert-file and --key-file arguments are set as appropriate (Automated)L1Pass
    2.2Ensure that the --client-cert-auth argument is set to true (Automated)L1Pass
    2.3Ensure that the --auto-tls argument is not set to true (Automated)L1Pass
    2.4Ensure that the --peer-cert-file and --peer-key-file arguments are set as appropriate (Automated)L1Pass
    2.5Ensure that the --peer-client-cert-auth argument is set to true (Automated)L1Pass
    2.6Ensure that the --peer-auto-tls argument is not set to true (Automated)L1Pass
    2.7Ensure that a unique Certificate Authority is used for etcd (Manual)L2Pass
    3Control Plane Configuration
    3.1Authentication and Authorization
    3.1.1Client certificate authentication should not be used for users (Manual)L2Pass
    3.1.2Service account token authentication should not be used for users (Manual)L1Warn
    3.1.3Bootstrap token authentication should not be used for users (Manual)L1Warn
    3.2Logging
    3.2.1Ensure that a minimal audit policy is created (Manual)L1Pass
    3.2.2Ensure that the audit policy covers key security concerns (Manual)L2Equivalent Control
    4Worker Node Security Configuration
    4.1Worker Node Configuration Files
    4.1.1Ensure that the kubelet service file permissions are set to 600 or more restrictive (Automated)L1Fail
    4.1.2Ensure that the kubelet service file ownership is set to root:root (Automated)L1Pass
    4.1.3If proxy kubeconfig file exists ensure permissions are set to 600 or more restrictive (Manual)L1Warn
    4.1.4If proxy kubeconfig file exists ensure ownership is set to root:root (Manual)L1Warn
    4.1.5Ensure that the --kubeconfig kubelet.conf file permissions are set to 600 or more restrictive (Automated)L1Pass
    4.1.6Ensure that the --kubeconfig kubelet.conf file ownership is set to root:root (Automated)L1Pass
    4.1.7Ensure that the certificate authorities file permissions are set to 600 or more restrictive (Manual)L1Pass
    4.1.8Ensure that the client certificate authorities file ownership is set to root:root (Manual)L1Pass
    4.1.9If the kubelet config.yaml configuration file is being used validate permissions set to 600 or more restrictive (Automated)L1Fail
    4.1.10If the kubelet config.yaml configuration file is being used validate file ownership is set to root:root (Automated)L1Pass
    4.2Kubelet
    4.2.1Ensure that the --anonymous-auth argument is set to false (Automated)L1Pass
    4.2.2Ensure that the --authorization-mode argument is not set to AlwaysAllow (Automated)L1Pass
    4.2.3Ensure that the --client-ca-file argument is set as appropriate (Automated)L1Pass
    4.2.4Verify that the --read-only-port argument is set to 0 (Manual)L1Pass
    4.2.5Ensure that the ---connection-idle-timeout argument is not set to 0 (Manual)L1Pass
    4.2.6Ensure that the --make-iptables-util-chains argument is set to true (Automated)L1Pass
    4.2.7Ensure that the --hostname-override argument is not set (Manual)L1Pass
    4.2.8Ensure that the eventRecordQPS argument is set to a level which ensures appropriate event capture (Manual)L1Pass
    4.2.9Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate (Manual)L2Equivalent Control
    4.2.10Ensure that the --rotate-certificates argument is not set to false (Automated)L1Pass
    4.2.11Verify that the RotateKubeletServerCertificate argument is set to true (Manual)L1Pass
    4.2.12Ensure that the Kubelet only makes use of Strong Cryptographic Ciphers (Manual)L1Pass
    4.2.13Ensure that a limit is set on pod PIDs (Manual)L1Pass

    Descriptions of Failures and Equivalent Controls for Google Distributed Cloud user cluster

    #RecommendationLevelStatus
    1Control Plane Security Configuration
    1.1Control Plane Node Configuration Files
    1.1.1Ensure that the API server pod specification file permissions are set to 600 or more restrictive (Automated)L1Equivalent Control
    1.1.2Ensure that the API server pod specification file ownership is set to root:root (Automated)L1Pass
    1.1.3Ensure that the controller manager pod specification file permissions are set to 600 or more restrictive (Automated)L1Equivalent Control
    1.1.4Ensure that the controller manager pod specification file ownership is set to root:root (Automated)L1Pass
    1.1.5Ensure that the scheduler pod specification file permissions are set to 600 or more restrictive (Automated)L1Equivalent Control
    1.1.6Ensure that the scheduler pod specification file ownership is set to root:root (Automated)L1Pass
    1.1.7Ensure that the etcd pod specification file permissions are set to 600 or more restrictive (Automated)L1Equivalent Control
    1.1.8Ensure that the etcd pod specification file ownership is set to root:root (Automated)L1Pass
    1.1.9Ensure that the Container Network Interface file permissions are set to 600 or more restrictive (Manual)L1Pass
    1.1.10Ensure that the Container Network Interface file ownership is set to root:root (Manual)L1Pass
    1.1.11Ensure that the etcd data directory permissions are set to 700 or more restrictive (Automated)L1Pass
    1.1.12Ensure that the etcd data directory ownership is set to etcd:etcd (Automated)L1Equivalent Control
    1.1.13Ensure that the admin.conf file permissions are set to 600 or more restrictive (Automated)L1Pass
    1.1.14Ensure that the admin.conf file ownership is set to root:root (Automated)L1Pass
    1.1.15Ensure that the scheduler.conf file permissions are set to 600 or more restrictive (Automated)L1Pass
    1.1.16Ensure that the scheduler.conf file ownership is set to root:root (Automated)L1Equivalent Control
    1.1.17Ensure that the controller-manager.conf file permissions are set to 600 or more restrictive (Automated)L1Pass
    1.1.18Ensure that the controller-manager.conf file ownership is set to root:root (Automated)L1Equivalent Control
    1.1.19Ensure that the Kubernetes PKI directory and file ownership is set to root:root (Automated)L1Pass
    1.1.20Ensure that the Kubernetes PKI certificate file permissions are set to 600 or more restrictive (Manual)L1Pass
    1.1.21Ensure that the Kubernetes PKI key file permissions are set to 600 (Manual)L1Pass
    1.2API Server
    1.2.1Ensure that the --anonymous-auth argument is set to false (Manual)L1Pass
    1.2.2Ensure that the --token-auth-file parameter is not set (Automated)L1Pass
    1.2.3Ensure that the --DenyServiceExternalIPs is set (Manual)L1Warn
    1.2.4Ensure that the --kubelet-client-certificate and --kubelet-client-key arguments are set as appropriate (Automated)L1Pass
    1.2.5Ensure that the --kubelet-certificate-authority argument is set as appropriate (Automated)L1Pass
    1.2.6Ensure that the --authorization-mode argument is not set to AlwaysAllow (Automated)L1Pass
    1.2.7Ensure that the --authorization-mode argument includes Node (Automated)L1Pass
    1.2.8Ensure that the --authorization-mode argument includes RBAC (Automated)L1Pass
    1.2.9Ensure that the admission control plugin EventRateLimit is set (Manual)L1Warn
    1.2.10Ensure that the admission control plugin AlwaysAdmit is not set (Automated)L1Pass
    1.2.11Ensure that the admission control plugin AlwaysPullImages is set (Manual)L1Depends On Environment
    1.2.12Ensure that the admission control plugin SecurityContextDeny is set if PodSecurityPolicy is not used (Manual)L1Equivalent Control
    1.2.13Ensure that the admission control plugin ServiceAccount is set (Automated)L1Pass
    1.2.14Ensure that the admission control plugin NamespaceLifecycle is set (Automated)L1Pass
    1.2.15Ensure that the admission control plugin NodeRestriction is set (Automated)L1Pass
    1.2.16Ensure that the --profiling argument is set to false (Automated)L1Pass
    1.2.17Ensure that the --audit-log-path argument is set (Automated)L1Pass
    1.2.18Ensure that the --audit-log-maxage argument is set to 30 or as appropriate (Automated)L1Equivalent Control
    1.2.19Ensure that the --audit-log-maxbackup argument is set to 10 or as appropriate (Automated)L1Equivalent Control
    1.2.20Ensure that the --audit-log-maxsize argument is set to 100 or as appropriate (Automated)L1Pass
    1.2.21Ensure that the --request-timeout argument is set as appropriate (Manual)L1Pass
    1.2.22Ensure that the --service-account-lookup argument is set to true (Automated)L1Pass
    1.2.23Ensure that the --service-account-key-file argument is set as appropriate (Automated)L1Pass
    1.2.24Ensure that the --etcd-certfile and --etcd-keyfile arguments are set as appropriate (Automated)L1Pass
    1.2.25Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate (Automated)L1Pass
    1.2.26Ensure that the --client-ca-file argument is set as appropriate (Automated)L1Pass
    1.2.27Ensure that the --etcd-cafile argument is set as appropriate (Automated)L1Pass
    1.2.28Ensure that the --encryption-provider-config argument is set as appropriate (Manual)L1Pass
    1.2.29Ensure that encryption providers are appropriately configured (Manual)L1Pass
    1.2.30Ensure that the API Server only makes use of Strong Cryptographic Ciphers (Manual)L1Pass
    1.3Controller Manager
    1.3.1Ensure that the --terminated-pod-gc-threshold argument is set as appropriate (Manual)L1Pass
    1.3.2Ensure that the --profiling argument is set to false (Automated)L1Pass
    1.3.3Ensure that the --use-service-account-credentials argument is set to true (Automated)L1Pass
    1.3.4Ensure that the --service-account-private-key-file argument is set as appropriate (Automated)L1Pass
    1.3.5Ensure that the --root-ca-file argument is set as appropriate (Automated)L1Pass
    1.3.6Ensure that the RotateKubeletServerCertificate argument is set to true (Automated)L2Pass
    1.3.7Ensure that the --bind-address argument is set to 127.0.0.1 (Automated)L1Fail
    1.4Scheduler
    1.4.1Ensure that the --profiling argument is set to false (Automated)L1Pass
    1.4.2Ensure that the --bind-address argument is set to 127.0.0.1 (Automated)L1Fail
    2Etcd Node Configuration
    2Etcd Node Configuration
    2.1Ensure that the --cert-file and --key-file arguments are set as appropriate (Automated)L1Pass
    2.2Ensure that the --client-cert-auth argument is set to true (Automated)L1Pass
    2.3Ensure that the --auto-tls argument is not set to true (Automated)L1Pass
    2.4Ensure that the --peer-cert-file and --peer-key-file arguments are set as appropriate (Automated)L1Pass
    2.5Ensure that the --peer-client-cert-auth argument is set to true (Automated)L1Pass
    2.6Ensure that the --peer-auto-tls argument is not set to true (Automated)L1Pass
    2.7Ensure that a unique Certificate Authority is used for etcd (Manual)L2Pass
    3Control Plane Configuration
    3.1Authentication and Authorization
    3.1.1Client certificate authentication should not be used for users (Manual)L2Pass
    3.1.2Service account token authentication should not be used for users (Manual)L1Warn
    3.1.3Bootstrap token authentication should not be used for users (Manual)L1Warn
    3.2Logging
    3.2.1Ensure that a minimal audit policy is created (Manual)L1Pass
    3.2.2Ensure that the audit policy covers key security concerns (Manual)L2Equivalent Control
    4Worker Node Security Configuration
    4.1Worker Node Configuration Files
    4.1.1Ensure that the kubelet service file permissions are set to 600 or more restrictive (Automated)L1Fail
    4.1.2Ensure that the kubelet service file ownership is set to root:root (Automated)L1Pass
    4.1.3If proxy kubeconfig file exists ensure permissions are set to 600 or more restrictive (Manual)L1Warn
    4.1.4If proxy kubeconfig file exists ensure ownership is set to root:root (Manual)L1Warn
    4.1.5Ensure that the --kubeconfig kubelet.conf file permissions are set to 600 or more restrictive (Automated)L1Pass
    4.1.6Ensure that the --kubeconfig kubelet.conf file ownership is set to root:root (Automated)L1Pass
    4.1.7Ensure that the certificate authorities file permissions are set to 600 or more restrictive (Manual)L1Pass
    4.1.8Ensure that the client certificate authorities file ownership is set to root:root (Manual)L1Pass
    4.1.9If the kubelet config.yaml configuration file is being used validate permissions set to 600 or more restrictive (Automated)L1Fail
    4.1.10If the kubelet config.yaml configuration file is being used validate file ownership is set to root:root (Automated)L1Pass
    4.2Kubelet
    4.2.1Ensure that the --anonymous-auth argument is set to false (Automated)L1Pass
    4.2.2Ensure that the --authorization-mode argument is not set to AlwaysAllow (Automated)L1Pass
    4.2.3Ensure that the --client-ca-file argument is set as appropriate (Automated)L1Pass
    4.2.4Verify that the --read-only-port argument is set to 0 (Manual)L1Pass
    4.2.5Ensure that the ---connection-idle-timeout argument is not set to 0 (Manual)L1Pass
    4.2.6Ensure that the --make-iptables-util-chains argument is set to true (Automated)L1Pass
    4.2.7Ensure that the --hostname-override argument is not set (Manual)L1Pass
    4.2.8Ensure that the eventRecordQPS argument is set to a level which ensures appropriate event capture (Manual)L1Pass
    4.2.9Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate (Manual)L2Equivalent Control
    4.2.10Ensure that the --rotate-certificates argument is not set to false (Automated)L1Pass
    4.2.11Verify that the RotateKubeletServerCertificate argument is set to true (Manual)L1Pass
    4.2.12Ensure that the Kubelet only makes use of Strong Cryptographic Ciphers (Manual)L1Pass
    4.2.13Ensure that a limit is set on pod PIDs (Manual)L1Pass

    1.28

    Versions

    This section refers to the following versions:

    Anthos versionKubernetes versionCIS Kubernetes Benchmark version
    1.281.29.71.7

    Status of Google Distributed Cloud admin cluster

    #RecommendationLevelStatus
    1Control Plane Security Configuration
    1.1Control Plane Node Configuration Files
    1.1.1Ensure that the API server pod specification file permissions are set to 600 or more restrictive (Automated)L1Equivalent Control
    1.1.2Ensure that the API server pod specification file ownership is set to root:root (Automated)L1Pass
    1.1.3Ensure that the controller manager pod specification file permissions are set to 600 or more restrictive (Automated)L1Equivalent Control
    1.1.4Ensure that the controller manager pod specification file ownership is set to root:root (Automated)L1Pass
    1.1.5Ensure that the scheduler pod specification file permissions are set to 600 or more restrictive (Automated)L1Equivalent Control
    1.1.6Ensure that the scheduler pod specification file ownership is set to root:root (Automated)L1Pass
    1.1.7Ensure that the etcd pod specification file permissions are set to 600 or more restrictive (Automated)L1Equivalent Control
    1.1.8Ensure that the etcd pod specification file ownership is set to root:root (Automated)L1Pass
    1.1.9Ensure that the Container Network Interface file permissions are set to 600 or more restrictive (Manual)L1Pass
    1.1.10Ensure that the Container Network Interface file ownership is set to root:root (Manual)L1Pass
    1.1.11Ensure that the etcd data directory permissions are set to 700 or more restrictive (Automated)L1Pass
    1.1.12Ensure that the etcd data directory ownership is set to etcd:etcd (Automated)L1Equivalent Control
    1.1.13Ensure that the admin.conf file permissions are set to 600 or more restrictive (Automated)L1Pass
    1.1.14Ensure that the admin.conf file ownership is set to root:root (Automated)L1Pass
    1.1.15Ensure that the scheduler.conf file permissions are set to 600 or more restrictive (Automated)L1Pass
    1.1.16Ensure that the scheduler.conf file ownership is set to root:root (Automated)L1Equivalent Control
    1.1.17Ensure that the controller-manager.conf file permissions are set to 600 or more restrictive (Automated)L1Pass
    1.1.18Ensure that the controller-manager.conf file ownership is set to root:root (Automated)L1Equivalent Control
    1.1.19Ensure that the Kubernetes PKI directory and file ownership is set to root:root (Automated)L1Pass
    1.1.20Ensure that the Kubernetes PKI certificate file permissions are set to 600 or more restrictive (Manual)L1Pass
    1.1.21Ensure that the Kubernetes PKI key file permissions are set to 600 (Manual)L1Pass
    1.2API Server
    1.2.1Ensure that the --anonymous-auth argument is set to false (Manual)L1Pass
    1.2.2Ensure that the --token-auth-file parameter is not set (Automated)L1Pass
    1.2.3Ensure that the --DenyServiceExternalIPs is set (Manual)L1Warn
    1.2.4Ensure that the --kubelet-client-certificate and --kubelet-client-key arguments are set as appropriate (Automated)L1Pass
    1.2.5Ensure that the --kubelet-certificate-authority argument is set as appropriate (Automated)L1Pass
    1.2.6Ensure that the --authorization-mode argument is not set to AlwaysAllow (Automated)L1Pass
    1.2.7Ensure that the --authorization-mode argument includes Node (Automated)L1Pass
    1.2.8Ensure that the --authorization-mode argument includes RBAC (Automated)L1Pass
    1.2.9Ensure that the admission control plugin EventRateLimit is set (Manual)L1Warn
    1.2.10Ensure that the admission control plugin AlwaysAdmit is not set (Automated)L1Pass
    1.2.11Ensure that the admission control plugin AlwaysPullImages is set (Manual)L1Depends On Environment
    1.2.12Ensure that the admission control plugin SecurityContextDeny is set if PodSecurityPolicy is not used (Manual)L1Equivalent Control
    1.2.13Ensure that the admission control plugin ServiceAccount is set (Automated)L1Pass
    1.2.14Ensure that the admission control plugin NamespaceLifecycle is set (Automated)L1Pass
    1.2.15Ensure that the admission control plugin NodeRestriction is set (Automated)L1Pass
    1.2.16Ensure that the --secure-port argument is not set to 0 - NoteThis recommendation is obsolete and will be deleted per the consensus process (Manual)L1Pass
    1.2.17Ensure that the --profiling argument is set to false (Automated)L1Pass
    1.2.18Ensure that the --audit-log-path argument is set (Automated)L1Pass
    1.2.19Ensure that the --audit-log-maxage argument is set to 30 or as appropriate (Automated)L1Equivalent Control
    1.2.20Ensure that the --audit-log-maxbackup argument is set to 10 or as appropriate (Automated)L1Pass
    1.2.21Ensure that the --audit-log-maxsize argument is set to 100 or as appropriate (Automated)L1Pass
    1.2.22Ensure that the --request-timeout argument is set as appropriate (Manual)L1Pass
    1.2.23Ensure that the --service-account-lookup argument is set to true (Automated)L1Pass
    1.2.24Ensure that the --service-account-key-file argument is set as appropriate (Automated)L1Pass
    1.2.25Ensure that the --etcd-certfile and --etcd-keyfile arguments are set as appropriate (Automated)L1Pass
    1.2.26Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate (Automated)L1Pass
    1.2.27Ensure that the --client-ca-file argument is set as appropriate (Automated)L1Pass
    1.2.28Ensure that the --etcd-cafile argument is set as appropriate (Automated)L1Pass
    1.2.29Ensure that the --encryption-provider-config argument is set as appropriate (Manual)L1Pass
    1.2.30Ensure that encryption providers are appropriately configured (Manual)L1Pass
    1.2.31Ensure that the API Server only makes use of Strong Cryptographic Ciphers (Manual)L1Pass
    1.3Controller Manager
    1.3.1Ensure that the --terminated-pod-gc-threshold argument is set as appropriate (Manual)L1Pass
    1.3.2Ensure that the --profiling argument is set to false (Automated)L1Pass
    1.3.3Ensure that the --use-service-account-credentials argument is set to true (Automated)L1Pass
    1.3.4Ensure that the --service-account-private-key-file argument is set as appropriate (Automated)L1Pass
    1.3.5Ensure that the --root-ca-file argument is set as appropriate (Automated)L1Pass
    1.3.6Ensure that the RotateKubeletServerCertificate argument is set to true (Automated)L2Pass
    1.3.7Ensure that the --bind-address argument is set to 127.0.0.1 (Automated)L1Pass
    1.4Scheduler
    1.4.1Ensure that the --profiling argument is set to false (Automated)L1Pass
    1.4.2Ensure that the --bind-address argument is set to 127.0.0.1 (Automated)L1Pass
    2Etcd Node Configuration
    2Etcd Node Configuration
    2.1Ensure that the --cert-file and --key-file arguments are set as appropriate (Automated)L1Pass
    2.2Ensure that the --client-cert-auth argument is set to true (Automated)L1Pass
    2.3Ensure that the --auto-tls argument is not set to true (Automated)L1Pass
    2.4Ensure that the --peer-cert-file and --peer-key-file arguments are set as appropriate (Automated)L1Pass
    2.5Ensure that the --peer-client-cert-auth argument is set to true (Automated)L1Pass
    2.6Ensure that the --peer-auto-tls argument is not set to true (Automated)L1Pass
    2.7Ensure that a unique Certificate Authority is used for etcd (Manual)L2Pass
    3Control Plane Configuration
    3.1Authentication and Authorization
    3.1.1Client certificate authentication should not be used for users (Manual)L2Pass
    3.1.2Service account token authentication should not be used for users (Manual)L1Warn
    3.1.3Bootstrap token authentication should not be used for users (Manual)L1Warn
    3.2Logging
    3.2.1Ensure that a minimal audit policy is created (Manual)L1Pass
    3.2.2Ensure that the audit policy covers key security concerns (Manual)L2Equivalent Control
    4Worker Node Security Configuration
    4.1Worker Node Configuration Files
    4.1.1Ensure that the kubelet service file permissions are set to 600 or more restrictive (Automated)L1Fail
    4.1.2Ensure that the kubelet service file ownership is set to root:root (Automated)L1Pass
    4.1.3If proxy kubeconfig file exists ensure permissions are set to 600 or more restrictive (Manual)L1Pass
    4.1.4If proxy kubeconfig file exists ensure ownership is set to root:root (Manual)L1Pass
    4.1.5Ensure that the --kubeconfig kubelet.conf file permissions are set to 600 or more restrictive (Automated)L1Pass
    4.1.6Ensure that the --kubeconfig kubelet.conf file ownership is set to root:root (Automated)L1Pass
    4.1.7Ensure that the certificate authorities file permissions are set to 600 or more restrictive (Manual)L1Pass
    4.1.8Ensure that the client certificate authorities file ownership is set to root:root (Manual)L1Pass
    4.1.9If the kubelet config.yaml configuration file is being used validate permissions set to 600 or more restrictive (Manual)L1Warn
    4.1.10If the kubelet config.yaml configuration file is being used validate file ownership is set to root:root (Manual)L1Pass
    4.2Kubelet
    4.2.1Ensure that the --anonymous-auth argument is set to false (Automated)L1Pass
    4.2.2Ensure that the --authorization-mode argument is not set to AlwaysAllow (Automated)L1Pass
    4.2.3Ensure that the --client-ca-file argument is set as appropriate (Automated)L1Pass
    4.2.4Verify that the --read-only-port argument is set to 0 (Manual)L1Pass
    4.2.5Ensure that the ---connection-idle-timeout argument is not set to 0 (Manual)L1Pass
    4.2.6Ensure that the --make-iptables-util-chains argument is set to true (Automated)L1Pass
    4.2.7Ensure that the --hostname-override argument is not set (Manual)L1Pass
    4.2.8Ensure that the eventRecordQPS argument is set to a level which ensures appropriate event capture (Manual)L1Pass
    4.2.9Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate (Manual)L2Equivalent Control
    4.2.10Ensure that the --rotate-certificates argument is not set to false (Automated)L1Pass
    4.2.11Verify that the RotateKubeletServerCertificate argument is set to true (Manual)L1Pass
    4.2.12Ensure that the Kubelet only makes use of Strong Cryptographic Ciphers (Manual)L1Pass
    4.2.13Ensure that a limit is set on pod PIDs (Manual)L1Pass

    Descriptions of Failures and Equivalent Controls for Google Distributed Cloud admin cluster

    #RecommendationLevelStatusValueJustification
    1.1.1Ensure that the API server pod specification file permissions are set to 600 or more restrictive (Automated)L1Equivalent ControlN/AIn kubeception mode, user cluster's API server pod specification is stored in etcd.
    1.1.3Ensure that the controller manager pod specification file permissions are set to 600 or more restrictive (Automated)L1Equivalent ControlN/AIn kubeception mode, user cluster's controller manager pod specification is stored in etcd.
    1.1.5Ensure that the scheduler pod specification file permissions are set to 600 or more restrictive (Automated)L1Equivalent ControlN/AIn kubeception mode, user cluster's scheduler pod specification is stored in etcd.
    1.1.7Ensure that the etcd pod specification file permissions are set to 600 or more restrictive (Automated)L1Equivalent ControlN/AIn kubeception mode, user cluster's etcd specification is stored in admin cluster's etcd.
    1.1.12Ensure that the etcd data directory ownership is set to etcd:etcd (Automated)L1Equivalent Control2001:2001The etcd container runs as 2001 and the etcd data directory is owned by 2001:2001.
    1.1.16Ensure that the scheduler.conf file ownership is set to root:root (Automated)L1Equivalent Control2000:2000The kube-scheduler container runs as 2000 and this file is owned by 2000:2000.
    1.1.18Ensure that the controller-manager.conf file ownership is set to root:root (Automated)L1Equivalent Control2002:2002The controller-manager container runs as 2002 and this file is owned by 2002:2002.
    1.2.3Ensure that the --DenyServiceExternalIPs is set (Manual)L1Warnnot setAnthos clusters on VMware does not support the Event Rate Limit admission controller as it is a Kubernetes Alpha feature.
    1.2.9Ensure that the admission control plugin EventRateLimit is set (Manual)L1Warnnot setAnthos clusters on VMware does not support the Event Rate Limit admission controller as it is a Kubernetes Alpha feature.
    1.2.11Ensure that the admission control plugin AlwaysPullImages is set (Manual)L1Depends On Environmentnot setThe AlwaysPullImages admission controller provides some protection for private registry images in noncooperative multitenant clusters, at the cost of making container registries a single-point-of-failure for creating new Pods across the entire cluster. Google Distributed Cloud does not enable the AlwaysPullImages admission controller, which leaves it up to cluster admins to implement admission policy to make this tradeoff for themselves.
    1.2.12Ensure that the admission control plugin SecurityContextDeny is set if PodSecurityPolicy is not used (Manual)L1Equivalent Controlnot setPodSecurityPolicy will be removed from Kubernetes in 1.25. As a replacement, Pod Security Admission is enabled by default as of 1.23.
    1.2.19Ensure that the --audit-log-maxage argument is set to 30 or as appropriate (Automated)L1Equivalent Controlnot setGoogle Distributed Cloud captures audit logs but does not use these flags for auditing. See Google Distributed Cloud Audit policy for more details.
    3.1.2Service account token authentication should not be used for users (Manual)L1Warnnot setAnthos clusters on VMware does not support the Event Rate Limit admission controller as it is a Kubernetes Alpha feature.
    3.1.3Bootstrap token authentication should not be used for users (Manual)L1Warnnot setAnthos clusters on VMware does not support the Event Rate Limit admission controller as it is a Kubernetes Alpha feature.
    3.2.2Ensure that the audit policy covers key security concerns (Manual)L2Equivalent Controlnot setGoogle Distributed Cloud captures audit logs but does not use these flags for auditing. See Google Distributed Cloud Audit policy for more details.
    4.1.1Ensure that the kubelet service file permissions are set to 600 or more restrictive (Automated)L1Failnot setAnthos clusters on VMware does not support the Event Rate Limit admission controller as it is a Kubernetes Alpha feature.
    4.1.9If the kubelet config.yaml configuration file is being used validate permissions set to 600 or more restrictive (Manual)L1Warnnot setAnthos clusters on VMware does not support the Event Rate Limit admission controller as it is a Kubernetes Alpha feature.
    4.2.9Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate (Manual)L2Equivalent Controlnot setGoogle Distributed Cloud manages kubelet server TLS using the --rotate-server-certificates flag.

    Status of Google Distributed Cloud user cluster

    #RecommendationLevelStatus
    1Control Plane Security Configuration
    1.1Control Plane Node Configuration Files
    1.1.1Ensure that the API server pod specification file permissions are set to 600 or more restrictive (Automated)L1Equivalent Control
    1.1.2Ensure that the API server pod specification file ownership is set to root:root (Automated)L1Pass
    1.1.3Ensure that the controller manager pod specification file permissions are set to 600 or more restrictive (Automated)L1Equivalent Control
    1.1.4Ensure that the controller manager pod specification file ownership is set to root:root (Automated)L1Pass
    1.1.5Ensure that the scheduler pod specification file permissions are set to 600 or more restrictive (Automated)L1Equivalent Control
    1.1.6Ensure that the scheduler pod specification file ownership is set to root:root (Automated)L1Pass
    1.1.7Ensure that the etcd pod specification file permissions are set to 600 or more restrictive (Automated)L1Equivalent Control
    1.1.8Ensure that the etcd pod specification file ownership is set to root:root (Automated)L1Pass
    1.1.9Ensure that the Container Network Interface file permissions are set to 600 or more restrictive (Manual)L1Pass
    1.1.10Ensure that the Container Network Interface file ownership is set to root:root (Manual)L1Pass
    1.1.11Ensure that the etcd data directory permissions are set to 700 or more restrictive (Automated)L1Pass
    1.1.12Ensure that the etcd data directory ownership is set to etcd:etcd (Automated)L1Equivalent Control
    1.1.13Ensure that the admin.conf file permissions are set to 600 or more restrictive (Automated)L1Pass
    1.1.14Ensure that the admin.conf file ownership is set to root:root (Automated)L1Pass
    1.1.15Ensure that the scheduler.conf file permissions are set to 600 or more restrictive (Automated)L1Pass
    1.1.16Ensure that the scheduler.conf file ownership is set to root:root (Automated)L1Equivalent Control
    1.1.17Ensure that the controller-manager.conf file permissions are set to 600 or more restrictive (Automated)L1Pass
    1.1.18Ensure that the controller-manager.conf file ownership is set to root:root (Automated)L1Equivalent Control
    1.1.19Ensure that the Kubernetes PKI directory and file ownership is set to root:root (Automated)L1Pass
    1.1.20Ensure that the Kubernetes PKI certificate file permissions are set to 600 or more restrictive (Manual)L1Pass
    1.1.21Ensure that the Kubernetes PKI key file permissions are set to 600 (Manual)L1Pass
    1.2API Server
    1.2.1Ensure that the --anonymous-auth argument is set to false (Manual)L1Pass
    1.2.2Ensure that the --token-auth-file parameter is not set (Automated)L1Pass
    1.2.3Ensure that the --DenyServiceExternalIPs is set (Manual)L1Warn
    1.2.4Ensure that the --kubelet-client-certificate and --kubelet-client-key arguments are set as appropriate (Automated)L1Pass
    1.2.5Ensure that the --kubelet-certificate-authority argument is set as appropriate (Automated)L1Pass
    1.2.6Ensure that the --authorization-mode argument is not set to AlwaysAllow (Automated)L1Pass
    1.2.7Ensure that the --authorization-mode argument includes Node (Automated)L1Pass
    1.2.8Ensure that the --authorization-mode argument includes RBAC (Automated)L1Pass
    1.2.9Ensure that the admission control plugin EventRateLimit is set (Manual)L1Warn
    1.2.10Ensure that the admission control plugin AlwaysAdmit is not set (Automated)L1Pass
    1.2.11Ensure that the admission control plugin AlwaysPullImages is set (Manual)L1Depends On Environment
    1.2.12Ensure that the admission control plugin SecurityContextDeny is set if PodSecurityPolicy is not used (Manual)L1Equivalent Control
    1.2.13Ensure that the admission control plugin ServiceAccount is set (Automated)L1Pass
    1.2.14Ensure that the admission control plugin NamespaceLifecycle is set (Automated)L1Pass
    1.2.15Ensure that the admission control plugin NodeRestriction is set (Automated)L1Pass
    1.2.16Ensure that the --secure-port argument is not set to 0 - NoteThis recommendation is obsolete and will be deleted per the consensus process (Manual)L1Pass
    1.2.17Ensure that the --profiling argument is set to false (Automated)L1Pass
    1.2.18Ensure that the --audit-log-path argument is set (Automated)L1Pass
    1.2.19Ensure that the --audit-log-maxage argument is set to 30 or as appropriate (Automated)L1Equivalent Control
    1.2.20Ensure that the --audit-log-maxbackup argument is set to 10 or as appropriate (Automated)L1Pass
    1.2.21Ensure that the --audit-log-maxsize argument is set to 100 or as appropriate (Automated)L1Pass
    1.2.22Ensure that the --request-timeout argument is set as appropriate (Manual)L1Pass
    1.2.23Ensure that the --service-account-lookup argument is set to true (Automated)L1Pass
    1.2.24Ensure that the --service-account-key-file argument is set as appropriate (Automated)L1Pass
    1.2.25Ensure that the --etcd-certfile and --etcd-keyfile arguments are set as appropriate (Automated)L1Pass
    1.2.26Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate (Automated)L1Pass
    1.2.27Ensure that the --client-ca-file argument is set as appropriate (Automated)L1Pass
    1.2.28Ensure that the --etcd-cafile argument is set as appropriate (Automated)L1Pass
    1.2.29Ensure that the --encryption-provider-config argument is set as appropriate (Manual)L1Pass
    1.2.30Ensure that encryption providers are appropriately configured (Manual)L1Pass
    1.2.31Ensure that the API Server only makes use of Strong Cryptographic Ciphers (Manual)L1Pass
    1.3Controller Manager
    1.3.1Ensure that the --terminated-pod-gc-threshold argument is set as appropriate (Manual)L1Pass
    1.3.2Ensure that the --profiling argument is set to false (Automated)L1Pass
    1.3.3Ensure that the --use-service-account-credentials argument is set to true (Automated)L1Pass
    1.3.4Ensure that the --service-account-private-key-file argument is set as appropriate (Automated)L1Pass
    1.3.5Ensure that the --root-ca-file argument is set as appropriate (Automated)L1Pass
    1.3.6Ensure that the RotateKubeletServerCertificate argument is set to true (Automated)L2Pass
    1.3.7Ensure that the --bind-address argument is set to 127.0.0.1 (Automated)L1Pass
    1.4Scheduler
    1.4.1Ensure that the --profiling argument is set to false (Automated)L1Pass
    1.4.2Ensure that the --bind-address argument is set to 127.0.0.1 (Automated)L1Pass
    2Etcd Node Configuration
    2Etcd Node Configuration
    2.1Ensure that the --cert-file and --key-file arguments are set as appropriate (Automated)L1Pass
    2.2Ensure that the --client-cert-auth argument is set to true (Automated)L1Pass
    2.3Ensure that the --auto-tls argument is not set to true (Automated)L1Pass
    2.4Ensure that the --peer-cert-file and --peer-key-file arguments are set as appropriate (Automated)L1Pass
    2.5Ensure that the --peer-client-cert-auth argument is set to true (Automated)L1Pass
    2.6Ensure that the --peer-auto-tls argument is not set to true (Automated)L1Pass
    2.7Ensure that a unique Certificate Authority is used for etcd (Manual)L2Pass
    3Control Plane Configuration
    3.1Authentication and Authorization
    3.1.1Client certificate authentication should not be used for users (Manual)L2Pass
    3.1.2Service account token authentication should not be used for users (Manual)L1Warn
    3.1.3Bootstrap token authentication should not be used for users (Manual)L1Warn
    3.2Logging
    3.2.1Ensure that a minimal audit policy is created (Manual)L1Pass
    3.2.2Ensure that the audit policy covers key security concerns (Manual)L2Equivalent Control
    4Worker Node Security Configuration
    4.1Worker Node Configuration Files
    4.1.1Ensure that the kubelet service file permissions are set to 600 or more restrictive (Automated)L1Fail
    4.1.2Ensure that the kubelet service file ownership is set to root:root (Automated)L1Pass
    4.1.3If proxy kubeconfig file exists ensure permissions are set to 600 or more restrictive (Manual)L1Pass
    4.1.4If proxy kubeconfig file exists ensure ownership is set to root:root (Manual)L1Pass
    4.1.5Ensure that the --kubeconfig kubelet.conf file permissions are set to 600 or more restrictive (Automated)L1Pass
    4.1.6Ensure that the --kubeconfig kubelet.conf file ownership is set to root:root (Automated)L1Pass
    4.1.7Ensure that the certificate authorities file permissions are set to 600 or more restrictive (Manual)L1Pass
    4.1.8Ensure that the client certificate authorities file ownership is set to root:root (Manual)L1Pass
    4.1.9If the kubelet config.yaml configuration file is being used validate permissions set to 600 or more restrictive (Manual)L1Warn
    4.1.10If the kubelet config.yaml configuration file is being used validate file ownership is set to root:root (Manual)L1Pass
    4.2Kubelet
    4.2.1Ensure that the --anonymous-auth argument is set to false (Automated)L1Pass
    4.2.2Ensure that the --authorization-mode argument is not set to AlwaysAllow (Automated)L1Pass
    4.2.3Ensure that the --client-ca-file argument is set as appropriate (Automated)L1Pass
    4.2.4Verify that the --read-only-port argument is set to 0 (Manual)L1Pass
    4.2.5Ensure that the ---connection-idle-timeout argument is not set to 0 (Manual)L1Pass
    4.2.6Ensure that the --make-iptables-util-chains argument is set to true (Automated)L1Pass
    4.2.7Ensure that the --hostname-override argument is not set (Manual)L1Pass
    4.2.8Ensure that the eventRecordQPS argument is set to a level which ensures appropriate event capture (Manual)L1Pass
    4.2.9Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate (Manual)L2Equivalent Control
    4.2.10Ensure that the --rotate-certificates argument is not set to false (Automated)L1Pass
    4.2.11Verify that the RotateKubeletServerCertificate argument is set to true (Manual)L1Pass
    4.2.12Ensure that the Kubelet only makes use of Strong Cryptographic Ciphers (Manual)L1Pass
    4.2.13Ensure that a limit is set on pod PIDs (Manual)L1Pass

    Descriptions of Failures and Equivalent Controls for Google Distributed Cloud user cluster

    #RecommendationLevelStatusValueJustification
    1.1.1Ensure that the API server pod specification file permissions are set to 600 or more restrictive (Automated)L1Equivalent ControlN/AIn kubeception mode, user cluster's API server pod specification is stored in etcd.
    1.1.3Ensure that the controller manager pod specification file permissions are set to 600 or more restrictive (Automated)L1Equivalent ControlN/AIn kubeception mode, user cluster's controller manager pod specification is stored in etcd.
    1.1.5Ensure that the scheduler pod specification file permissions are set to 600 or more restrictive (Automated)L1Equivalent ControlN/AIn kubeception mode, user cluster's scheduler pod specification is stored in etcd.
    1.1.7Ensure that the etcd pod specification file permissions are set to 600 or more restrictive (Automated)L1Equivalent ControlN/AIn kubeception mode, user cluster's etcd specification is stored in admin cluster's etcd.
    1.1.12Ensure that the etcd data directory ownership is set to etcd:etcd (Automated)L1Equivalent Control2001:2001The etcd container runs as 2001 and the etcd data directory is owned by 2001:2001.
    1.1.16Ensure that the scheduler.conf file ownership is set to root:root (Automated)L1Equivalent Control2000:2000The kube-scheduler container runs as 2000 and this file is owned by 2000:2000.
    1.1.18Ensure that the controller-manager.conf file ownership is set to root:root (Automated)L1Equivalent Control2002:2002The controller-manager container runs as 2002 and this file is owned by 2002:2002.
    1.2.3Ensure that the --DenyServiceExternalIPs is set (Manual)L1Warnnot setAnthos clusters on VMware does not support the Event Rate Limit admission controller as it is a Kubernetes Alpha feature.
    1.2.9Ensure that the admission control plugin EventRateLimit is set (Manual)L1Warnnot setAnthos clusters on VMware does not support the Event Rate Limit admission controller as it is a Kubernetes Alpha feature.
    1.2.11Ensure that the admission control plugin AlwaysPullImages is set (Manual)L1Depends On Environmentnot setThe AlwaysPullImages admission controller provides some protection for private registry images in noncooperative multitenant clusters, at the cost of making container registries a single-point-of-failure for creating new Pods across the entire cluster. Google Distributed Cloud does not enable the AlwaysPullImages admission controller, which leaves it up to cluster admins to implement admission policy to make this tradeoff for themselves.
    1.2.12Ensure that the admission control plugin SecurityContextDeny is set if PodSecurityPolicy is not used (Manual)L1Equivalent Controlnot setPodSecurityPolicy will be removed from Kubernetes in 1.25. As a replacement, Pod Security Admission is enabled by default as of 1.23.
    1.2.19Ensure that the --audit-log-maxage argument is set to 30 or as appropriate (Automated)L1Equivalent Controlnot setGoogle Distributed Cloud captures audit logs but does not use these flags for auditing. See Google Distributed Cloud Audit policy for more details.
    3.1.2Service account token authentication should not be used for users (Manual)L1Warnnot setAnthos clusters on VMware does not support the Event Rate Limit admission controller as it is a Kubernetes Alpha feature.
    3.1.3Bootstrap token authentication should not be used for users (Manual)L1Warnnot setAnthos clusters on VMware does not support the Event Rate Limit admission controller as it is a Kubernetes Alpha feature.
    3.2.2Ensure that the audit policy covers key security concerns (Manual)L2Equivalent Controlnot setGoogle Distributed Cloud captures audit logs but does not use these flags for auditing. See Google Distributed Cloud Audit policy for more details.
    4.1.1Ensure that the kubelet service file permissions are set to 600 or more restrictive (Automated)L1Failnot setAnthos clusters on VMware does not support the Event Rate Limit admission controller as it is a Kubernetes Alpha feature.
    4.1.9If the kubelet config.yaml configuration file is being used validate permissions set to 600 or more restrictive (Manual)L1Warnnot setAnthos clusters on VMware does not support the Event Rate Limit admission controller as it is a Kubernetes Alpha feature.
    4.2.9Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate (Manual)L2Equivalent Controlnot setGoogle Distributed Cloud manages kubelet server TLS using the --rotate-server-certificates flag.

    1.16

    Versions

    This section refers to the following versions:

    Anthos versionKubernetes versionCIS Kubernetes Benchmark version
    1.16.01.27.11.7

    Status of Google Distributed Cloud admin cluster

    #RecommendationLevelStatus
    1Control Plane Security Configuration
    1.1Control Plane Node Configuration Files
    1.1.1Ensure that the API server pod specification file permissions are set to 600 or more restrictive (Automated)L1Equivalent Control
    1.1.2Ensure that the API server pod specification file ownership is set to root:root (Automated)L1Pass
    1.1.3Ensure that the controller manager pod specification file permissions are set to 600 or more restrictive (Automated)L1Equivalent Control
    1.1.4Ensure that the controller manager pod specification file ownership is set to root:root (Automated)L1Pass
    1.1.5Ensure that the scheduler pod specification file permissions are set to 600 or more restrictive (Automated)L1Equivalent Control
    1.1.6Ensure that the scheduler pod specification file ownership is set to root:root (Automated)L1Pass
    1.1.7Ensure that the etcd pod specification file permissions are set to 600 or more restrictive (Automated)L1Equivalent Control
    1.1.8Ensure that the etcd pod specification file ownership is set to root:root (Automated)L1Pass
    1.1.9Ensure that the Container Network Interface file permissions are set to 600 or more restrictive (Manual)L1Pass
    1.1.10Ensure that the Container Network Interface file ownership is set to root:root (Manual)L1Pass
    1.1.11Ensure that the etcd data directory permissions are set to 700 or more restrictive (Automated)L1Pass
    1.1.12Ensure that the etcd data directory ownership is set to etcd:etcd (Automated)L1Equivalent Control
    1.1.13Ensure that the admin.conf file permissions are set to 600 or more restrictive (Automated)L1Pass
    1.1.14Ensure that the admin.conf file ownership is set to root:root (Automated)L1Pass
    1.1.15Ensure that the scheduler.conf file permissions are set to 600 or more restrictive (Automated)L1Pass
    1.1.16Ensure that the scheduler.conf file ownership is set to root:root (Automated)L1Equivalent Control
    1.1.17Ensure that the controller-manager.conf file permissions are set to 600 or more restrictive (Automated)L1Pass
    1.1.18Ensure that the controller-manager.conf file ownership is set to root:root (Automated)L1Equivalent Control
    1.1.19Ensure that the Kubernetes PKI directory and file ownership is set to root:root (Automated)L1Pass
    1.1.20Ensure that the Kubernetes PKI certificate file permissions are set to 600 or more restrictive (Manual)L1Pass
    1.1.21Ensure that the Kubernetes PKI key file permissions are set to 600 (Manual)L1Pass
    1.2API Server
    1.2.1Ensure that the --anonymous-auth argument is set to false (Manual)L1Pass
    1.2.2Ensure that the --token-auth-file parameter is not set (Automated)L1Pass
    1.2.3Ensure that the --DenyServiceExternalIPs is set (Manual)L1Warn
    1.2.4Ensure that the --kubelet-client-certificate and --kubelet-client-key arguments are set as appropriate (Automated)L1Pass
    1.2.5Ensure that the --kubelet-certificate-authority argument is set as appropriate (Automated)L1Pass
    1.2.6Ensure that the --authorization-mode argument is not set to AlwaysAllow (Automated)L1Pass
    1.2.7Ensure that the --authorization-mode argument includes Node (Automated)L1Pass
    1.2.8Ensure that the --authorization-mode argument includes RBAC (Automated)L1Pass
    1.2.9Ensure that the admission control plugin EventRateLimit is set (Manual)L1Warn
    1.2.10Ensure that the admission control plugin AlwaysAdmit is not set (Automated)L1Pass
    1.2.11Ensure that the admission control plugin AlwaysPullImages is set (Manual)L1Depends On Environment
    1.2.12Ensure that the admission control plugin SecurityContextDeny is set if PodSecurityPolicy is not used (Manual)L1Equivalent Control
    1.2.13Ensure that the admission control plugin ServiceAccount is set (Automated)L1Pass
    1.2.14Ensure that the admission control plugin NamespaceLifecycle is set (Automated)L1Pass
    1.2.15Ensure that the admission control plugin NodeRestriction is set (Automated)L1Pass
    1.2.16Ensure that the --secure-port argument is not set to 0 - NoteThis recommendation is obsolete and will be deleted per the consensus process (Manual)L1Pass
    1.2.17Ensure that the --profiling argument is set to false (Automated)L1Pass
    1.2.18Ensure that the --audit-log-path argument is set (Automated)L1Pass
    1.2.19Ensure that the --audit-log-maxage argument is set to 30 or as appropriate (Automated)L1Equivalent Control
    1.2.20Ensure that the --audit-log-maxbackup argument is set to 10 or as appropriate (Automated)L1Pass
    1.2.21Ensure that the --audit-log-maxsize argument is set to 100 or as appropriate (Automated)L1Pass
    1.2.22Ensure that the --request-timeout argument is set as appropriate (Manual)L1Pass
    1.2.23Ensure that the --service-account-lookup argument is set to true (Automated)L1Pass
    1.2.24Ensure that the --service-account-key-file argument is set as appropriate (Automated)L1Pass
    1.2.25Ensure that the --etcd-certfile and --etcd-keyfile arguments are set as appropriate (Automated)L1Pass
    1.2.26Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate (Automated)L1Pass
    1.2.27Ensure that the --client-ca-file argument is set as appropriate (Automated)L1Pass
    1.2.28Ensure that the --etcd-cafile argument is set as appropriate (Automated)L1Pass
    1.2.29Ensure that the --encryption-provider-config argument is set as appropriate (Manual)L1Pass
    1.2.30Ensure that encryption providers are appropriately configured (Manual)L1Pass
    1.2.31Ensure that the API Server only makes use of Strong Cryptographic Ciphers (Manual)L1Pass
    1.3Controller Manager
    1.3.1Ensure that the --terminated-pod-gc-threshold argument is set as appropriate (Manual)L1Pass
    1.3.2Ensure that the --profiling argument is set to false (Automated)L1Pass
    1.3.3Ensure that the --use-service-account-credentials argument is set to true (Automated)L1Pass
    1.3.4Ensure that the --service-account-private-key-file argument is set as appropriate (Automated)L1Pass
    1.3.5Ensure that the --root-ca-file argument is set as appropriate (Automated)L1Pass
    1.3.6Ensure that the RotateKubeletServerCertificate argument is set to true (Automated)L2Pass
    1.3.7Ensure that the --bind-address argument is set to 127.0.0.1 (Automated)L1Pass
    1.4Scheduler
    1.4.1Ensure that the --profiling argument is set to false (Automated)L1Pass
    1.4.2Ensure that the --bind-address argument is set to 127.0.0.1 (Automated)L1Pass
    2Etcd Node Configuration
    2Etcd Node Configuration
    2.1Ensure that the --cert-file and --key-file arguments are set as appropriate (Automated)L1Pass
    2.2Ensure that the --client-cert-auth argument is set to true (Automated)L1Pass
    2.3Ensure that the --auto-tls argument is not set to true (Automated)L1Pass
    2.4Ensure that the --peer-cert-file and --peer-key-file arguments are set as appropriate (Automated)L1Pass
    2.5Ensure that the --peer-client-cert-auth argument is set to true (Automated)L1Pass
    2.6Ensure that the --peer-auto-tls argument is not set to true (Automated)L1Pass
    2.7Ensure that a unique Certificate Authority is used for etcd (Manual)L2Pass
    3Control Plane Configuration
    3.1Authentication and Authorization
    3.1.1Client certificate authentication should not be used for users (Manual)L2Pass
    3.1.2Service account token authentication should not be used for users (Manual)L1Warn
    3.1.3Bootstrap token authentication should not be used for users (Manual)L1Warn
    3.2Logging
    3.2.1Ensure that a minimal audit policy is created (Manual)L1Pass
    3.2.2Ensure that the audit policy covers key security concerns (Manual)L2Equivalent Control
    4Worker Node Security Configuration
    4.1Worker Node Configuration Files
    4.1.1Ensure that the kubelet service file permissions are set to 600 or more restrictive (Automated)L1Fail
    4.1.2Ensure that the kubelet service file ownership is set to root:root (Automated)L1Pass
    4.1.3If proxy kubeconfig file exists ensure permissions are set to 600 or more restrictive (Manual)L1Pass
    4.1.4If proxy kubeconfig file exists ensure ownership is set to root:root (Manual)L1Pass
    4.1.5Ensure that the --kubeconfig kubelet.conf file permissions are set to 600 or more restrictive (Automated)L1Pass
    4.1.6Ensure that the --kubeconfig kubelet.conf file ownership is set to root:root (Automated)L1Pass
    4.1.7Ensure that the certificate authorities file permissions are set to 600 or more restrictive (Manual)L1Pass
    4.1.8Ensure that the client certificate authorities file ownership is set to root:root (Manual)L1Pass
    4.1.9If the kubelet config.yaml configuration file is being used validate permissions set to 600 or more restrictive (Manual)L1Warn
    4.1.10If the kubelet config.yaml configuration file is being used validate file ownership is set to root:root (Manual)L1Pass
    4.2Kubelet
    4.2.1Ensure that the --anonymous-auth argument is set to false (Automated)L1Pass
    4.2.2Ensure that the --authorization-mode argument is not set to AlwaysAllow (Automated)L1Pass
    4.2.3Ensure that the --client-ca-file argument is set as appropriate (Automated)L1Pass
    4.2.4Verify that the --read-only-port argument is set to 0 (Manual)L1Pass
    4.2.5Ensure that the ---connection-idle-timeout argument is not set to 0 (Manual)L1Pass
    4.2.6Ensure that the --make-iptables-util-chains argument is set to true (Automated)L1Pass
    4.2.7Ensure that the --hostname-override argument is not set (Manual)L1Pass
    4.2.8Ensure that the eventRecordQPS argument is set to a level which ensures appropriate event capture (Manual)L1Pass
    4.2.9Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate (Manual)L2Equivalent Control
    4.2.10Ensure that the --rotate-certificates argument is not set to false (Automated)L1Pass
    4.2.11Verify that the RotateKubeletServerCertificate argument is set to true (Manual)L1Pass
    4.2.12Ensure that the Kubelet only makes use of Strong Cryptographic Ciphers (Manual)L1Pass
    4.2.13Ensure that a limit is set on pod PIDs (Manual)L1Pass

    Descriptions of Failures and Equivalent Controls for Google Distributed Cloud admin cluster

    #RecommendationLevelStatusValueJustification
    1.1.1Ensure that the API server pod specification file permissions are set to 600 or more restrictive (Automated)L1Equivalent ControlN/AIn kubeception mode, user cluster's API server pod specification is stored in etcd.
    1.1.3Ensure that the controller manager pod specification file permissions are set to 600 or more restrictive (Automated)L1Equivalent ControlN/AIn kubeception mode, user cluster's controller manager pod specification is stored in etcd.
    1.1.5Ensure that the scheduler pod specification file permissions are set to 600 or more restrictive (Automated)L1Equivalent ControlN/AIn kubeception mode, user cluster's scheduler pod specification is stored in etcd.
    1.1.7Ensure that the etcd pod specification file permissions are set to 600 or more restrictive (Automated)L1Equivalent ControlN/AIn kubeception mode, user cluster's etcd specification is stored in admin cluster's etcd.
    1.1.12Ensure that the etcd data directory ownership is set to etcd:etcd (Automated)L1Equivalent Control2001:2001The etcd container runs as 2001 and the etcd data directory is owned by 2001:2001.
    1.1.16Ensure that the scheduler.conf file ownership is set to root:root (Automated)L1Equivalent Control2000:2000The kube-scheduler container runs as 2000 and this file is owned by 2000:2000.
    1.1.18Ensure that the controller-manager.conf file ownership is set to root:root (Automated)L1Equivalent Control2002:2002The controller-manager container runs as 2002 and this file is owned by 2002:2002.
    1.2.3Ensure that the --DenyServiceExternalIPs is set (Manual)L1Warnnot setAnthos clusters on VMware does not support the Event Rate Limit admission controller as it is a Kubernetes Alpha feature.
    1.2.9Ensure that the admission control plugin EventRateLimit is set (Manual)L1Warnnot setAnthos clusters on VMware does not support the Event Rate Limit admission controller as it is a Kubernetes Alpha feature.
    1.2.11Ensure that the admission control plugin AlwaysPullImages is set (Manual)L1Depends On Environmentnot setThe AlwaysPullImages admission controller provides some protection for private registry images in noncooperative multitenant clusters, at the cost of making container registries a single-point-of-failure for creating new Pods across the entire cluster. Google Distributed Cloud does not enable the AlwaysPullImages admission controller, which leaves it up to cluster admins to implement admission policy to make this tradeoff for themselves.
    1.2.12Ensure that the admission control plugin SecurityContextDeny is set if PodSecurityPolicy is not used (Manual)L1Equivalent Controlnot setPodSecurityPolicy will be removed from Kubernetes in 1.25. As a replacement, Pod Security Admission is enabled by default as of 1.23.
    1.2.19Ensure that the --audit-log-maxage argument is set to 30 or as appropriate (Automated)L1Equivalent Controlnot setGoogle Distributed Cloud captures audit logs but does not use these flags for auditing. See Google Distributed Cloud Audit policy for more details.
    3.1.2Service account token authentication should not be used for users (Manual)L1Warnnot setAnthos clusters on VMware does not support the Event Rate Limit admission controller as it is a Kubernetes Alpha feature.
    3.1.3Bootstrap token authentication should not be used for users (Manual)L1Warnnot setAnthos clusters on VMware does not support the Event Rate Limit admission controller as it is a Kubernetes Alpha feature.
    3.2.2Ensure that the audit policy covers key security concerns (Manual)L2Equivalent Controlnot setGoogle Distributed Cloud captures audit logs but does not use these flags for auditing. See Google Distributed Cloud Audit policy for more details.
    4.1.1Ensure that the kubelet service file permissions are set to 600 or more restrictive (Automated)L1Failnot setAnthos clusters on VMware does not support the Event Rate Limit admission controller as it is a Kubernetes Alpha feature.
    4.1.9If the kubelet config.yaml configuration file is being used validate permissions set to 600 or more restrictive (Manual)L1Warnnot setAnthos clusters on VMware does not support the Event Rate Limit admission controller as it is a Kubernetes Alpha feature.
    4.2.9Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate (Manual)L2Equivalent Controlnot setGoogle Distributed Cloud manages kubelet server TLS using the --rotate-server-certificates flag.

    Status of Google Distributed Cloud user cluster

    #RecommendationLevelStatus
    1Control Plane Security Configuration
    1.1Control Plane Node Configuration Files
    1.1.1Ensure that the API server pod specification file permissions are set to 600 or more restrictive (Automated)L1Equivalent Control
    1.1.2Ensure that the API server pod specification file ownership is set to root:root (Automated)L1Pass
    1.1.3Ensure that the controller manager pod specification file permissions are set to 600 or more restrictive (Automated)L1Equivalent Control
    1.1.4Ensure that the controller manager pod specification file ownership is set to root:root (Automated)L1Pass
    1.1.5Ensure that the scheduler pod specification file permissions are set to 600 or more restrictive (Automated)L1Equivalent Control
    1.1.6Ensure that the scheduler pod specification file ownership is set to root:root (Automated)L1Pass
    1.1.7Ensure that the etcd pod specification file permissions are set to 600 or more restrictive (Automated)L1Equivalent Control
    1.1.8Ensure that the etcd pod specification file ownership is set to root:root (Automated)L1Pass
    1.1.9Ensure that the Container Network Interface file permissions are set to 600 or more restrictive (Manual)L1Pass
    1.1.10Ensure that the Container Network Interface file ownership is set to root:root (Manual)L1Pass
    1.1.11Ensure that the etcd data directory permissions are set to 700 or more restrictive (Automated)L1Pass
    1.1.12Ensure that the etcd data directory ownership is set to etcd:etcd (Automated)L1Equivalent Control
    1.1.13Ensure that the admin.conf file permissions are set to 600 or more restrictive (Automated)L1Pass
    1.1.14Ensure that the admin.conf file ownership is set to root:root (Automated)L1Pass
    1.1.15Ensure that the scheduler.conf file permissions are set to 600 or more restrictive (Automated)L1Pass
    1.1.16Ensure that the scheduler.conf file ownership is set to root:root (Automated)L1Equivalent Control
    1.1.17Ensure that the controller-manager.conf file permissions are set to 600 or more restrictive (Automated)L1Pass
    1.1.18Ensure that the controller-manager.conf file ownership is set to root:root (Automated)L1Equivalent Control
    1.1.19Ensure that the Kubernetes PKI directory and file ownership is set to root:root (Automated)L1Pass
    1.1.20Ensure that the Kubernetes PKI certificate file permissions are set to 600 or more restrictive (Manual)L1Pass
    1.1.21Ensure that the Kubernetes PKI key file permissions are set to 600 (Manual)L1Pass
    1.2API Server
    1.2.1Ensure that the --anonymous-auth argument is set to false (Manual)L1Pass
    1.2.2Ensure that the --token-auth-file parameter is not set (Automated)L1Pass
    1.2.3Ensure that the --DenyServiceExternalIPs is set (Manual)L1Warn
    1.2.4Ensure that the --kubelet-client-certificate and --kubelet-client-key arguments are set as appropriate (Automated)L1Pass
    1.2.5Ensure that the --kubelet-certificate-authority argument is set as appropriate (Automated)L1Pass
    1.2.6Ensure that the --authorization-mode argument is not set to AlwaysAllow (Automated)L1Pass
    1.2.7Ensure that the --authorization-mode argument includes Node (Automated)L1Pass
    1.2.8Ensure that the --authorization-mode argument includes RBAC (Automated)L1Pass
    1.2.9Ensure that the admission control plugin EventRateLimit is set (Manual)L1Warn
    1.2.10Ensure that the admission control plugin AlwaysAdmit is not set (Automated)L1Pass
    1.2.11Ensure that the admission control plugin AlwaysPullImages is set (Manual)L1Depends On Environment
    1.2.12Ensure that the admission control plugin SecurityContextDeny is set if PodSecurityPolicy is not used (Manual)L1Equivalent Control
    1.2.13Ensure that the admission control plugin ServiceAccount is set (Automated)L1Pass
    1.2.14Ensure that the admission control plugin NamespaceLifecycle is set (Automated)L1Pass
    1.2.15Ensure that the admission control plugin NodeRestriction is set (Automated)L1Pass
    1.2.16Ensure that the --secure-port argument is not set to 0 - NoteThis recommendation is obsolete and will be deleted per the consensus process (Manual)L1Pass
    1.2.17Ensure that the --profiling argument is set to false (Automated)L1Pass
    1.2.18Ensure that the --audit-log-path argument is set (Automated)L1Pass
    1.2.19Ensure that the --audit-log-maxage argument is set to 30 or as appropriate (Automated)L1Equivalent Control
    1.2.20Ensure that the --audit-log-maxbackup argument is set to 10 or as appropriate (Automated)L1Pass
    1.2.21Ensure that the --audit-log-maxsize argument is set to 100 or as appropriate (Automated)L1Pass
    1.2.22Ensure that the --request-timeout argument is set as appropriate (Manual)L1Pass
    1.2.23Ensure that the --service-account-lookup argument is set to true (Automated)L1Pass
    1.2.24Ensure that the --service-account-key-file argument is set as appropriate (Automated)L1Pass
    1.2.25Ensure that the --etcd-certfile and --etcd-keyfile arguments are set as appropriate (Automated)L1Pass
    1.2.26Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate (Automated)L1Pass
    1.2.27Ensure that the --client-ca-file argument is set as appropriate (Automated)L1Pass
    1.2.28Ensure that the --etcd-cafile argument is set as appropriate (Automated)L1Pass
    1.2.29Ensure that the --encryption-provider-config argument is set as appropriate (Manual)L1Pass
    1.2.30Ensure that encryption providers are appropriately configured (Manual)L1Pass
    1.2.31Ensure that the API Server only makes use of Strong Cryptographic Ciphers (Manual)L1Pass
    1.3Controller Manager
    1.3.1Ensure that the --terminated-pod-gc-threshold argument is set as appropriate (Manual)L1Pass
    1.3.2Ensure that the --profiling argument is set to false (Automated)L1Pass
    1.3.3Ensure that the --use-service-account-credentials argument is set to true (Automated)L1Pass
    1.3.4Ensure that the --service-account-private-key-file argument is set as appropriate (Automated)L1Pass
    1.3.5Ensure that the --root-ca-file argument is set as appropriate (Automated)L1Pass
    1.3.6Ensure that the RotateKubeletServerCertificate argument is set to true (Automated)L2Pass
    1.3.7Ensure that the --bind-address argument is set to 127.0.0.1 (Automated)L1Pass
    1.4Scheduler
    1.4.1Ensure that the --profiling argument is set to false (Automated)L1Pass
    1.4.2Ensure that the --bind-address argument is set to 127.0.0.1 (Automated)L1Pass
    2Etcd Node Configuration
    2Etcd Node Configuration
    2.1Ensure that the --cert-file and --key-file arguments are set as appropriate (Automated)L1Pass
    2.2Ensure that the --client-cert-auth argument is set to true (Automated)L1Pass
    2.3Ensure that the --auto-tls argument is not set to true (Automated)L1Pass
    2.4Ensure that the --peer-cert-file and --peer-key-file arguments are set as appropriate (Automated)L1Pass
    2.5Ensure that the --peer-client-cert-auth argument is set to true (Automated)L1Pass
    2.6Ensure that the --peer-auto-tls argument is not set to true (Automated)L1Pass
    2.7Ensure that a unique Certificate Authority is used for etcd (Manual)L2Pass
    3Control Plane Configuration
    3.1Authentication and Authorization
    3.1.1Client certificate authentication should not be used for users (Manual)L2Pass
    3.1.2Service account token authentication should not be used for users (Manual)L1Warn
    3.1.3Bootstrap token authentication should not be used for users (Manual)L1Warn
    3.2Logging
    3.2.1Ensure that a minimal audit policy is created (Manual)L1Pass
    3.2.2Ensure that the audit policy covers key security concerns (Manual)L2Equivalent Control
    4Worker Node Security Configuration
    4.1Worker Node Configuration Files
    4.1.1Ensure that the kubelet service file permissions are set to 600 or more restrictive (Automated)L1Fail
    4.1.2Ensure that the kubelet service file ownership is set to root:root (Automated)L1Pass
    4.1.3If proxy kubeconfig file exists ensure permissions are set to 600 or more restrictive (Manual)L1Pass
    4.1.4If proxy kubeconfig file exists ensure ownership is set to root:root (Manual)L1Pass
    4.1.5Ensure that the --kubeconfig kubelet.conf file permissions are set to 600 or more restrictive (Automated)L1Pass
    4.1.6Ensure that the --kubeconfig kubelet.conf file ownership is set to root:root (Automated)L1Pass
    4.1.7Ensure that the certificate authorities file permissions are set to 600 or more restrictive (Manual)L1Pass
    4.1.8Ensure that the client certificate authorities file ownership is set to root:root (Manual)L1Pass
    4.1.9If the kubelet config.yaml configuration file is being used validate permissions set to 600 or more restrictive (Manual)L1Warn
    4.1.10If the kubelet config.yaml configuration file is being used validate file ownership is set to root:root (Manual)L1Pass
    4.2Kubelet
    4.2.1Ensure that the --anonymous-auth argument is set to false (Automated)L1Pass
    4.2.2Ensure that the --authorization-mode argument is not set to AlwaysAllow (Automated)L1Pass
    4.2.3Ensure that the --client-ca-file argument is set as appropriate (Automated)L1Pass
    4.2.4Verify that the --read-only-port argument is set to 0 (Manual)L1Pass
    4.2.5Ensure that the ---connection-idle-timeout argument is not set to 0 (Manual)L1Pass
    4.2.6Ensure that the --make-iptables-util-chains argument is set to true (Automated)L1Pass
    4.2.7Ensure that the --hostname-override argument is not set (Manual)L1Pass
    4.2.8Ensure that the eventRecordQPS argument is set to a level which ensures appropriate event capture (Manual)L1Pass
    4.2.9Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate (Manual)L2Equivalent Control
    4.2.10Ensure that the --rotate-certificates argument is not set to false (Automated)L1Pass
    4.2.11Verify that the RotateKubeletServerCertificate argument is set to true (Manual)L1Pass
    4.2.12Ensure that the Kubelet only makes use of Strong Cryptographic Ciphers (Manual)L1Pass
    4.2.13Ensure that a limit is set on pod PIDs (Manual)L1Pass

    Descriptions of Failures and Equivalent Controls for Google Distributed Cloud user cluster

    #RecommendationLevelStatusValueJustification
    1.1.1Ensure that the API server pod specification file permissions are set to 600 or more restrictive (Automated)L1Equivalent ControlN/AIn kubeception mode, user cluster's API server pod specification is stored in etcd.
    1.1.3Ensure that the controller manager pod specification file permissions are set to 600 or more restrictive (Automated)L1Equivalent ControlN/AIn kubeception mode, user cluster's controller manager pod specification is stored in etcd.
    1.1.5Ensure that the scheduler pod specification file permissions are set to 600 or more restrictive (Automated)L1Equivalent ControlN/AIn kubeception mode, user cluster's scheduler pod specification is stored in etcd.
    1.1.7Ensure that the etcd pod specification file permissions are set to 600 or more restrictive (Automated)L1Equivalent ControlN/AIn kubeception mode, user cluster's etcd specification is stored in admin cluster's etcd.
    1.1.12Ensure that the etcd data directory ownership is set to etcd:etcd (Automated)L1Equivalent Control2001:2001The etcd container runs as 2001 and the etcd data directory is owned by 2001:2001.
    1.1.16Ensure that the scheduler.conf file ownership is set to root:root (Automated)L1Equivalent Control2000:2000The kube-scheduler container runs as 2000 and this file is owned by 2000:2000.
    1.1.18Ensure that the controller-manager.conf file ownership is set to root:root (Automated)L1Equivalent Control2002:2002The controller-manager container runs as 2002 and this file is owned by 2002:2002.
    1.2.3Ensure that the --DenyServiceExternalIPs is set (Manual)L1Warnnot setAnthos clusters on VMware does not support the Event Rate Limit admission controller as it is a Kubernetes Alpha feature.
    1.2.9Ensure that the admission control plugin EventRateLimit is set (Manual)L1Warnnot setAnthos clusters on VMware does not support the Event Rate Limit admission controller as it is a Kubernetes Alpha feature.
    1.2.11Ensure that the admission control plugin AlwaysPullImages is set (Manual)L1Depends On Environmentnot setThe AlwaysPullImages admission controller provides some protection for private registry images in noncooperative multitenant clusters, at the cost of making container registries a single-point-of-failure for creating new Pods across the entire cluster. Google Distributed Cloud does not enable the AlwaysPullImages admission controller, which leaves it up to cluster admins to implement admission policy to make this tradeoff for themselves.
    1.2.12Ensure that the admission control plugin SecurityContextDeny is set if PodSecurityPolicy is not used (Manual)L1Equivalent Controlnot setPodSecurityPolicy will be removed from Kubernetes in 1.25. As a replacement, Pod Security Admission is enabled by default as of 1.23.
    1.2.19Ensure that the --audit-log-maxage argument is set to 30 or as appropriate (Automated)L1Equivalent Controlnot setGoogle Distributed Cloud captures audit logs but does not use these flags for auditing. See Google Distributed Cloud Audit policy for more details.
    3.1.2Service account token authentication should not be used for users (Manual)L1Warnnot setAnthos clusters on VMware does not support the Event Rate Limit admission controller as it is a Kubernetes Alpha feature.
    3.1.3Bootstrap token authentication should not be used for users (Manual)L1Warnnot setAnthos clusters on VMware does not support the Event Rate Limit admission controller as it is a Kubernetes Alpha feature.
    3.2.2Ensure that the audit policy covers key security concerns (Manual)L2Equivalent Controlnot setGoogle Distributed Cloud captures audit logs but does not use these flags for auditing. See Google Distributed Cloud Audit policy for more details.
    4.1.1Ensure that the kubelet service file permissions are set to 600 or more restrictive (Automated)L1Failnot setAnthos clusters on VMware does not support the Event Rate Limit admission controller as it is a Kubernetes Alpha feature.
    4.1.9If the kubelet config.yaml configuration file is being used validate permissions set to 600 or more restrictive (Manual)L1Warnnot setAnthos clusters on VMware does not support the Event Rate Limit admission controller as it is a Kubernetes Alpha feature.
    4.2.9Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate (Manual)L2Equivalent Controlnot setGoogle Distributed Cloud manages kubelet server TLS using the --rotate-server-certificates flag.

    Audit benchmarks

    Specific instructions for auditing each recommendation is available as part of the relevant CIS Benchmark. However, you may wish to automate some of these checks to simplify the verification of these controls in your environment. The following tool can help with this.

    Automated auditing of the CIS Kubernetes Benchmark

    You can use an open-source tool kube-bench to test your cluster configuration against the CIS Kubernetes Benchmark.

    Make sure to specify the appropriate version. For example:

    kube-bench node --benchmark cis-1.7