Verify Group Who Owns The etcd Member Pod Specification File
An XCCDF Rule
Description
To properly set the group owner of /etc/kubernetes/manifests/etcd-pod.yaml, run the command:
$ sudo chgrp root /etc/kubernetes/manifests/etcd-pod.yaml
warning alert: Dependency Warning
This rule is only applicable for nodes that run the Etcd service.
The aforementioned service is only running on the nodes labeled
"master" by default.
Rationale
The etcd pod specification file controls various parameters that set the behavior of the etcd service in the master node. etcd is a highly-available key-value store which Kubernetes uses for persistent storage of all of its REST API object. You should restrict its file permissions to maintain the integrity of the file. The file should be writable by only the administrators on the system.
- ID
- xccdf_org.ssgproject.content_rule_file_groupowner_etcd_member
- Severity
- Medium
- References
- Updated