Guide to the Secure Configuration of Amazon Elastic Kubernetes Service
Rules, Groups, and Values defined within the XCCDF Benchmark
-
kubelet - Configure the Client CA Certificate
By default, the kubelet is not configured with a CA certificate which can subject the kubelet to man-in-the-middle attacks. To configure a client CA certificate, edit the kubelet configuration fil...Rule Medium Severity -
kubelet - Enable Certificate Rotation
To enable the kubelet to rotate client certificates, edit the kubelet configuration file <code>/etc/kubernetes/kubelet/kubelet-config.json</code> on the kubelet node(s) and set the below parameter:...Rule Medium Severity -
kubelet - Do Not Disable Streaming Timeouts
Timouts for streaming connections should not be disabled as they help to prevent denial-of-service attacks. To configure streaming connection timeouts To set the <code>streamingConnectionIdleTimeou...Rule Medium Severity -
Kubernetes - Network Configuration and Firewalls
Most systems must be connected to a network of some sort, and this brings with it the substantial risk of network attack. This section discusses the security impact of decisions about networking wh...Group -
Namespaces exempt of Network Policies
Namespaces regular expression explicitly allowed through network policy filters, e.g. setting value to "namespace1|namespace2" will exempt namespace "namespace1" and "namespace2" for network polici...Value -
Restrict Access to the Control Plane Endpoint
Enable Endpoint Private Access to restrict access to the cluster's control plane to only an allowlist of authorized IPs.Rule Unknown Severity
Node 2
The content of the drawer really is up to you. It could have form fields, definition lists, text lists, labels, charts, progress bars, etc. Spacing recommendation is 24px margins. You can put tabs in here, and can also make the drawer scrollable.
Capacity
Modules