CIS 1.9 自我评估指南

概述

本文件是 RKE2 安全强化指南的补充。安全强化指南提供了对 RKE2 生产安装进行强化的建议性指导，而本基准指南旨在帮助您评估强化集群在 CIS Kubernetes 基准中的每项控制的安全级别。该指南供 RKE2 操作员、安全团队、审计员和决策者使用。

本指南特定于 RKE2 的 v1.27-1.32 版本线和 CIS Kubernetes 基准的 v1.9 版本。

有关每项控制的更多信息，包括详细的理由和描述检查，您可以参考 CIS Kubernetes 基准 v1.8 的相应部分。您可以在 互联网安全中心 (CIS) 创建免费账户后下载基准。

测试控制方法

CIS Kubernetes 基准中的每项控制都是针对根据附带的安全强化指南配置的 RKE2 集群进行评估的。

每项控制的可能结果如下：

  • 通过 - 该控制是自动化的（得分：真）。被测试的 RKE2 集群通过了基准中概述的审计。

  • 不适用 - 由于 RKE2 的设计方式，该控制不适用（类型：跳过）。理由部分将解释原因。

  • 警告 - 该控制在 CIS 基准中是手动的（得分：假），并依赖于手动操作员干预。补救部分将提供如何获得通过结果的指导。

1 控制平面安全配置

1.1 控制平面节点配置文件

1.1.1 确保 API 服务器 pod 规范文件的权限设置为 600 或更严格（自动化）

*结果：*PASS

Audit:

stat -c permissions=%a /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml

预期结果： 权限为 600，预期为 600 或更严格

返回值： 
permissions=600
修正：

在控制平面节点上运行以下命令（根据您系统上的文件位置）。例如，chmod 600 /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml

1.1.2 确保 API 服务器 pod 规范文件的所有权设置为 root:root（自动化）

*结果：*PASS

Audit:

/bin/sh -c 'if test -e /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml; then stat -c %U:%G /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml; fi'

预期结果： 'root:root' 等于 'root:root'

返回值： 
root:root
修正：

在控制平面节点上运行以下命令（根据您系统上的文件位置）。例如，chown root:root /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml

1.1.3 确保控制器管理器 pod 规范文件的权限设置为 600 或更严格（自动化）

*结果：*PASS

Audit:

/bin/sh -c 'if test -e /var/lib/rancher/rke2/agent/pod-manifests/kube-controller-manager.yaml; then stat -c permissions=%a /var/lib/rancher/rke2/agent/pod-manifests/kube-controller-manager.yaml; fi'

预期结果： 权限为 600，预期为 600 或更严格

返回值： 
permissions=600
修正：

在控制平面节点上运行以下命令（根据您系统上的文件位置）。例如，chmod 600 /var/lib/rancher/rke2/agent/pod-manifests/kube-controller-manager.yaml

1.1.4 确保控制器管理器 pod 规范文件的所有权设置为 root:root（自动化）

*结果：*PASS

Audit:

/bin/sh -c 'if test -e /var/lib/rancher/rke2/agent/pod-manifests/kube-controller-manager.yaml; then stat -c %U:%G /var/lib/rancher/rke2/agent/pod-manifests/kube-controller-manager.yaml; fi'

预期结果： 'root:root' 等于 'root:root'

返回值： 
root:root
修正：

在控制平面节点上运行以下命令（根据您系统上的文件位置）。例如，chown root:root /var/lib/rancher/rke2/agent/pod-manifests/kube-controller-manager.yaml

1.1.5 确保调度程序 pod 规范文件的权限设置为 600 或更严格（自动化）

*结果：*PASS

Audit:

/bin/sh -c 'if test -e /var/lib/rancher/rke2/agent/pod-manifests/kube-scheduler.yaml; then stat -c permissions=%a /var/lib/rancher/rke2/agent/pod-manifests/kube-scheduler.yaml; fi'

预期结果： 权限为 600，预期为 600 或更严格

返回值： 
permissions=600
修正：

在控制平面节点上运行以下命令（根据您系统上的文件位置）。例如，chmod 600 /var/lib/rancher/rke2/agent/pod-manifests/kube-scheduler.yaml

1.1.6 确保调度程序 pod 规范文件的所有权设置为 root:root（自动化）

*结果：*PASS

Audit:

/bin/sh -c 'if test -e /var/lib/rancher/rke2/agent/pod-manifests/kube-scheduler.yaml; then stat -c %U:%G /var/lib/rancher/rke2/agent/pod-manifests/kube-scheduler.yaml; fi'

预期结果： 'root:root' 存在

返回值： 
root:root
修正：

在控制平面节点上运行以下命令（根据您系统上的文件位置）。例如，chown root:root /var/lib/rancher/rke2/agent/pod-manifests/kube-scheduler.yaml

1.1.7 确保 etcd pod 规范文件的权限设置为 600 或更严格（手动）

*结果：*PASS

Audit:

/bin/sh -c 'if test -e /var/lib/rancher/rke2/agent/pod-manifests/etcd.yaml; then stat -c permissions=%a /var/lib/rancher/rke2/agent/pod-manifests/etcd.yaml; fi'

预期结果： 权限为 600，预期为 600 或更严格

返回值： 
permissions=600
修正：

如果仅运行主节点而没有 etcd 角色，则此检查不适用。如果控制平面和 etcd 角色在同一节点上，但此检查为警告，则在控制平面节点上运行以下命令（基于您系统上的文件位置）。例如，chmod 600 /var/lib/rancher/rke2/agent/pod-manifests/etcd.yaml

1.1.8 确保 etcd pod 规范文件的所有权设置为 root:root（手动）

*结果：*PASS

Audit:

/bin/sh -c 'if test -e /var/lib/rancher/rke2/agent/pod-manifests/etcd.yaml; then stat -c %U:%G /var/lib/rancher/rke2/agent/pod-manifests/etcd.yaml; fi'

预期结果： 'root:root' 等于 'root:root'

返回值： 
root:root
修正：

如果仅运行主节点而没有 etcd 角色，则此检查不适用。如果控制平面和 etcd 角色在同一节点上，但此检查为警告，则在控制平面节点上运行以下命令（基于您系统上的文件位置）。例如，chown root:root /var/lib/rancher/rke2/agent/pod-manifests/etcd.yaml

1.1.9 确保容器网络接口文件的权限设置为 600 或更严格（手动）

*结果：*警告

修正： 请注意，对于许多 CNI，会创建一个权限为 750 的锁定文件。这是预期的，可以忽略。 在控制平面节点上运行以下命令（根据您系统上的文件位置）。 例如，chmod 600 /var/lib/cni/networks/<filename> and chmod 600 /etc/cni/net.d/<filename>

1.1.10 确保容器网络接口文件的所有权设置为 root:root（手动）

*结果：*PASS

Audit:

ps -fC ${kubeletbin:-kubelet} | grep -- --cni-conf-dir || echo "/etc/cni/net.d" | sed 's%.*cni-conf-dir[= ]\([^ ]*\).*%\1%' | xargs -I{} find {} -mindepth 1 | xargs --no-run-if-empty stat -c %U:%G
find /var/lib/cni/networks -type f 2> /dev/null | xargs --no-run-if-empty stat -c %U:%G

预期结果： 'root:root' 存在

返回值： 
root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root
修正：

在控制平面节点上运行以下命令（根据您系统上的文件位置）。例如，chown root:root <path/to/cni/files>

1.1.11 确保 etcd 目录的权限设置为 700 或更严格（手动）

*结果：*PASS

Audit:

stat -c permissions=%a /var/lib/rancher/rke2/server/db/etcd

预期结果： 权限为 700，预期为 700 或更严格

返回值： 
permissions=700
修正：

如果仅运行主节点而没有 etcd 角色，则此检查不适用。如果控制平面和 etcd 角色在同一节点上，但此检查为警告，则在 etcd 服务器节点上，从命令 'ps -ef | grep etcd' 获取 etcd 数据目录，作为参数 --data-dir。运行以下命令（根据上面找到的 etcd 数据目录）。例如，chmod 700 /var/lib/rancher/rke2/server/db/etcd

1.1.12 确保 etcd 数据目录的所有权设置为 etcd:etcd（手动）

*结果：*PASS

Audit:

stat -c %U:%G /var/lib/rancher/rke2/server/db/etcd

预期结果: 'etcd:etcd' 存在

返回值： 
etcd:etcd
修正：

如果仅运行主节点而没有 etcd 角色，则此检查不适用。如果控制平面和 etcd 角色在同一节点上，但此检查为警告，则在 etcd 服务器节点上，从命令 'ps -ef | grep etcd' 获取 etcd 数据目录，作为参数 --data-dir。运行以下命令（根据上面找到的 etcd 数据目录）。例如，chown etcd:etcd /var/lib/rancher/rke2/server/db/etcd

1.1.13 确保 admin.conf 文件的权限设置为 600 或更严格（自动化）

*结果：*PASS

Audit:

stat -c permissions=%a /var/lib/rancher/rke2/server/cred/admin.kubeconfig

预期结果： 权限为 600，预期为 600 或更严格

返回值： 
permissions=600
修正：

在控制平面节点上运行以下命令（根据您系统上的文件位置）。例如，chmod 600 /var/lib/rancher/rke2/server/cred/admin.kubeconfig

1.1.14 确保 admin.conf 文件的所有权设置为 root:root（自动化）

*结果：*PASS

Audit:

stat -c %U:%G /var/lib/rancher/rke2/server/cred/admin.kubeconfig

预期结果： 'root:root' 等于 'root:root'

返回值： 
root:root
修正：

在控制平面节点上运行以下命令（根据您系统上的文件位置）。例如，chown root:root /var/lib/rancher/rke2/server/cred/admin.kubeconfig

1.1.15 确保 scheduler.conf 文件的权限设置为 600 或更严格（自动化）

*结果：*PASS

Audit:

/bin/sh -c 'if test -e /var/lib/rancher/rke2/server/cred/scheduler.kubeconfig; then stat -c permissions=%a /var/lib/rancher/rke2/server/cred/scheduler.kubeconfig; fi'

预期结果： 权限为 600，预期为 600 或更严格

返回值： 
permissions=600
修正：

在控制平面节点上运行以下命令（根据您系统上的文件位置）。例如，chmod 600 /var/lib/rancher/rke2/server/cred/scheduler.kubeconfig

1.1.16 确保 scheduler.conf 文件的所有权设置为 root:root（自动化）

*结果：*PASS

Audit:

stat -c %U:%G /var/lib/rancher/rke2/server/cred/scheduler.kubeconfig

预期结果： 'root:root' 等于 'root:root'

返回值： 
root:root
修正：

在控制平面节点上运行以下命令（根据您系统上的文件位置）。例如，chown root:root /var/lib/rancher/rke2/server/cred/scheduler.kubeconfig

1.1.17 确保 controller-manager.conf 文件的权限设置为 600 或更严格（自动化）

*结果：*PASS

Audit:

/bin/sh -c 'if test -e /var/lib/rancher/rke2/server/cred/controller.kubeconfig; then stat -c permissions=%a /var/lib/rancher/rke2/server/cred/controller.kubeconfig; fi'

预期结果： 权限为 600，预期为 600 或更严格

返回值： 
permissions=600
修正：

在控制平面节点上运行以下命令（根据您系统上的文件位置）。例如，chmod 600 /var/lib/rancher/rke2/server/cred/controller.kubeconfig

1.1.18 确保 controller-manager.conf 文件的所有权设置为 root:root（自动化）

*结果：*PASS

Audit:

stat -c %U:%G /var/lib/rancher/rke2/server/cred/controller.kubeconfig

预期结果： 'root:root' 等于 'root:root'

返回值： 
root:root
修正：

在控制平面节点上运行以下命令（根据您系统上的文件位置）。例如，chown root:root /var/lib/rancher/rke2/server/cred/controller.kubeconfig

1.1.19 确保 Kubernetes PKI 目录和文件的所有权设置为 root:root（自动化）

*结果：*PASS

Audit:

stat -c %U:%G /var/lib/rancher/rke2/server/tls

预期结果： 'root:root' 等于 'root:root'

返回值： 
root:root
修正：

在控制平面节点上运行以下命令（根据您系统上的文件位置）。例如，chown -R root:root /var/lib/rancher/rke2/server/tls

1.1.20 确保 Kubernetes PKI 证书文件的权限设置为 600 或更严格（手动）

*结果：*警告

修正： 在控制平面节点上运行以下命令（根据您系统上的文件位置）。 例如，chmod -R 600 /var/lib/rancher/rke2/server/tls/*.crt

1.1.21 确保 Kubernetes PKI 密钥文件的权限设置为 600（自动化）

*结果：*PASS

Audit:

stat -c permissions=%a /var/lib/rancher/rke2/server/tls/*.key

预期结果： 权限为 600，预期为 600 或更严格

返回值： 
permissions=600 permissions=600 permissions=600 permissions=600 permissions=600 permissions=600 permissions=600 permissions=600 permissions=600 permissions=600 permissions=600 permissions=600 permissions=600 permissions=600 permissions=600 permissions=600 permissions=600
修正：

在控制平面节点上运行以下命令（根据您系统上的文件位置）。例如，chmod -R 600 /var/lib/rancher/rke2/server/tls/*.key

1.2 API 服务器

1.2.1 确保 --anonymous-auth 参数设置为 false（自动化）

*结果：*PASS

Audit:

/bin/ps -fC kube-apiserver

预期结果： '--anonymous-auth' 等于 'false'

返回值： 
UID PID PPID C STIME TTY TIME CMD root 2840 2791 5 18:32 ? 00:01:35 kube-apiserver --admission-control-config-file=/etc/rancher/rke2/rke2-pss.yaml --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --advertise-address=10.10.10.100 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key
修正：

默认情况下，RKE2 将 --anonymous-auth 参数设置为 false。如果此检查失败，请编辑 RKE2 配置文件 /etc/rancher/rke2/config.yaml 并去除类似以下内容。

kube-apiserver-arg: - "anonymous-auth=true"

1.2.2 确保 --token-auth-file 参数未设置（自动化）

*结果：*PASS

Audit:

/bin/ps -fC kube-apiserver

预期结果： '--token-auth-file' 不存在

返回值： 
UID PID PPID C STIME TTY TIME CMD root 2840 2791 5 18:32 ? 00:01:35 kube-apiserver --admission-control-config-file=/etc/rancher/rke2/rke2-pss.yaml --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --advertise-address=10.10.10.100 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key
修正：

请遵循文档并配置替代的身份验证机制。如果此检查失败，请编辑 RKE2 配置文件 /etc/rancher/rke2/config.yaml 并去除类似以下内容。

kube-apiserver-arg: - "token-auth-file=+++<path>+++"

1.2.3 确保 --DenyServiceExternalIPs 已设置（手动）

结果：警告

修正：默认情况下，RKE2 不会设置 DenyServiceExternalIPs。要启用此标志，请编辑 RKE2 配置文件 /etc/rancher/rke2/config.yaml，如下所示。

kube-apiserver-arg: - "enable-admission-plugins=DenyServiceExternalIPs"

1.2.4 确保 --kubelet-client-certificate 和 --kubelet-client-key 参数设置正确（自动化）

结果：PASS

Audit:

/bin/ps -fC kube-apiserver

预期结果： '--kubelet-client-certificate' 存在且 '--kubelet-client-key' 存在

返回值： 
UID PID PPID C STIME TTY TIME CMD root 2840 2791 5 18:32 ? 00:01:35 kube-apiserver --admission-control-config-file=/etc/rancher/rke2/rke2-pss.yaml --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --advertise-address=10.10.10.100 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key
修正：

默认情况下，RKE2 自动提供 kubelet 客户端证书和密钥。它们在 /var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt 和 /var/lib/rancher/rke2/server/tls/client-kube-apiserver.key 生成并存放。如果出于某种原因需要提供自己的证书和密钥，可以在 RKE2 配置文件 /etc/rancher/rke2/config.yaml 中设置以下参数。

kube-apiserver-arg: - "kubelet-client-certificate=<path/to/client-cert-file>" - "kubelet-client-key=<path/to/client-key-file>"

1.2.5 确保 --kubelet-certificate-authority 参数设置正确（自动化）

结果：PASS

Audit:

/bin/ps -fC kube-apiserver

预期结果： '--kubelet-certificate-authority' 存在

返回值： 
UID PID PPID C STIME TTY TIME CMD root 2840 2791 5 18:32 ? 00:01:35 kube-apiserver --admission-control-config-file=/etc/rancher/rke2/rke2-pss.yaml --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --advertise-address=10.10.10.100 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key
修正：

默认情况下，RKE2 自动提供 kubelet CA 证书文件，位于 /var/lib/rancher/rke2/server/tls/server-ca.crt。如果出于某种原因需要提供自己的 CA 证书，请考虑使用 rke2 证书命令行工具。如果此检查失败，请编辑 RKE2 配置文件 /etc/rancher/rke2/config.yaml 并去除以下类似的行。

kube-apiserver-arg: - "kubelet-certificate-authority=<path/to/ca-cert-file>"

1.2.6 确保 --authorization-mode 参数未设置为 AlwaysAllow（自动化）

结果：PASS

Audit:

/bin/ps -fC kube-apiserver

预期结果: '--authorization-mode' 不包含 'AlwaysAllow'

返回值： 
UID PID PPID C STIME TTY TIME CMD root 2840 2791 5 18:32 ? 00:01:35 kube-apiserver --admission-control-config-file=/etc/rancher/rke2/rke2-pss.yaml --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --advertise-address=10.10.10.100 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key
修正：

默认情况下，RKE2 不会将 --authorization-mode 设置为 AlwaysAllow。如果此检查失败，请编辑 RKE2 配置文件 /etc/rancher/rke2/config.yaml，去除以下类似的行。

kube-apiserver-arg: - "authorization-mode=AlwaysAllow"

1.2.7 确保 --authorization-mode 参数包含 Node（自动化）

结果：PASS

Audit:

/bin/ps -fC kube-apiserver

预期结果： '--authorization-mode' 包含 'Node'

返回值： 
UID PID PPID C STIME TTY TIME CMD root 2840 2791 5 18:32 ? 00:01:35 kube-apiserver --admission-control-config-file=/etc/rancher/rke2/rke2-pss.yaml --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --advertise-address=10.10.10.100 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key
修正：

默认情况下，RKE2 将 --authorization-mode 设置为 Node 和 RBAC。如果此检查失败，请编辑 RKE2 配置文件 /etc/rancher/rke2/config.yaml，确保没有覆盖 authorization-mode。

1.2.8 确保 --authorization-mode 参数包含 RBAC（自动化）

结果：PASS

Audit:

/bin/ps -fC kube-apiserver

预期结果： '--authorization-mode' 包含 'RBAC'

返回值： 
UID PID PPID C STIME TTY TIME CMD root 2840 2791 5 18:32 ? 00:01:35 kube-apiserver --admission-control-config-file=/etc/rancher/rke2/rke2-pss.yaml --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --advertise-address=10.10.10.100 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key
修正：

默认情况下，RKE2 将 --authorization-mode 设置为 Node 和 RBAC。如果此检查失败，请编辑 RKE2 配置文件 /etc/rancher/rke2/config.yaml，确保没有覆盖 authorization-mode。

1.2.9 确保 admission control 插件 EventRateLimit 已设置（手动）

结果：警告

修正:请遵循 Kubernetes 文档，并在配置文件中设置所需的限制。然后，编辑 RKE2 配置文件 /etc/rancher/rke2/config.yaml 并设置以下参数。

kube-apiserver-arg: - "enable-admission-plugins=\...,EventRateLimit,\..." - "admission-control-config-file=<path/to/configuration/file>"

1.2.10 确保 admission control 插件 AlwaysAdmit 未设置（自动）

结果：PASS

Audit:

/bin/ps -fC kube-apiserver

预期结果: '--enable-admission-plugins' 不包含 'AlwaysAdmit' 或者 '--enable-admission-plugins' 不存在

返回值： 
UID PID PPID C STIME TTY TIME CMD root 2840 2791 5 18:32 ? 00:01:35 kube-apiserver --admission-control-config-file=/etc/rancher/rke2/rke2-pss.yaml --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --advertise-address=10.10.10.100 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key
修正：

默认情况下，RKE2 不将 --enable-admission-plugins 设置为 AlwaysAdmit。如果此检查失败，请编辑 RKE2 配置文件 /etc/rancher/rke2/config.yaml，去除以下类似的行。

kube-apiserver-arg: - "enable-admission-plugins=AlwaysAdmit"

1.2.11 确保 admission control 插件 AlwaysPullImages 已设置（手动）

结果：警告

修正：根据 CIS 指南，"此设置可能会影响离线或隔离的集群，这些集群已预加载镜像且无法访问注册表以拉取正在使用的镜像。"此设置不适合使用此配置的集群。"在控制平面节点上编辑 RKE2 配置文件 /etc/rancher/rke2/config.yaml，并将 --enable-admission-plugins 参数设置为包含 AlwaysPullImages。 --enable-admission-plugins=...,AlwaysPullImages,...

1.2.12 确保设置 admission control 插件 ServiceAccount（自动化）

结果：PASS

Audit:

/bin/ps -fC kube-apiserver

预期结果： '--disable-admission-plugins' 存在或者 '--disable-admission-plugins' 不存在

返回值： 
UID PID PPID C STIME TTY TIME CMD root 2840 2791 5 18:32 ? 00:01:35 kube-apiserver --admission-control-config-file=/etc/rancher/rke2/rke2-pss.yaml --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --advertise-address=10.10.10.100 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key
修正：

默认情况下，RKE2 不将 --disable-admission-plugins 设置为任何值。请遵循文档并根据您的环境创建 ServiceAccount 对象。如果此检查失败，请编辑 RKE2 配置文件 /etc/rancher/rke2/config.yaml 并去除以下类似的行。

kube-apiserver-arg: - "disable-admission-plugins=ServiceAccount"

1.2.13 确保设置 admission control 插件 NamespaceLifecycle（自动化）

结果：PASS

Audit:

/bin/ps -fC kube-apiserver

预期结果： '--disable-admission-plugins' 存在或者 '--disable-admission-plugins' 不存在

返回值： 
UID PID PPID C STIME TTY TIME CMD root 2840 2791 5 18:32 ? 00:01:35 kube-apiserver --admission-control-config-file=/etc/rancher/rke2/rke2-pss.yaml --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --advertise-address=10.10.10.100 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key
修正：

默认情况下，RKE2 不将 --disable-admission-plugins 设置为任何值。如果此检查失败，请编辑 RKE2 配置文件 /etc/rancher/rke2/config.yaml 并去除以下类似的行。

kube-apiserver-arg: - "disable-admission-plugins=\...,NamespaceLifecycle,\..."

1.2.14 确保设置 admission control 插件 NodeRestriction（自动化）

结果：PASS

Audit:

/bin/ps -fC kube-apiserver

预期结果： '--enable-admission-plugins' 包含 'NodeRestriction'

返回值： 
UID PID PPID C STIME TTY TIME CMD root 2840 2791 5 18:32 ? 00:01:35 kube-apiserver --admission-control-config-file=/etc/rancher/rke2/rke2-pss.yaml --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --advertise-address=10.10.10.100 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key
修正：

默认情况下，RKE2 将 --enable-admission-plugins 设置为 NodeRestriction。检查 RKE2 配置文件 /etc/rancher/rke2/config.yaml，并确保您没有覆盖 admission 插件。如果是，请在列表中包含 NodeRestriction。

kube-apiserver-arg: - "enable-admission-plugins=\...,NodeRestriction,\..."

1.2.15 确保 --profiling 参数设置为 false（自动化）

结果：PASS

Audit:

/bin/ps -fC kube-apiserver

预期结果: '--profiling' 等于 'false'

返回值： 
UID PID PPID C STIME TTY TIME CMD root 2840 2791 5 18:32 ? 00:01:35 kube-apiserver --admission-control-config-file=/etc/rancher/rke2/rke2-pss.yaml --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --advertise-address=10.10.10.100 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key
修正：

默认情况下，RKE2 将 --profiling 参数设置为 false。如果此检查失败，请编辑 RKE2 配置文件 /etc/rancher/rke2/config.yaml 并去除以下类似的行。

kube-apiserver-arg: - "profiling=true"

1.2.16 确保 --audit-log-path 参数已设置（自动化）

结果：PASS

Audit:

/bin/ps -fC kube-apiserver

预期结果: '--audit-log-path' 存在

返回值： 
UID PID PPID C STIME TTY TIME CMD root 2840 2791 5 18:32 ? 00:01:35 kube-apiserver --admission-control-config-file=/etc/rancher/rke2/rke2-pss.yaml --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --advertise-address=10.10.10.100 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key
修正：

默认情况下，RKE2 将 --audit-log-path 参数设置为 /var/lib/rancher/rke2/server/logs/audit.log。如果您想更改此设置，请在控制平面节点上编辑 RKE2 配置文件 /etc/rancher/rke2/config.yaml，并将 --audit-log-path 参数设置为您希望审计日志写入的合适路径和文件，例如，

kube-apiserver-arg: - "audit-log-path=/var/log/rke2/audit.log"

1.2.17 确保 --audit-log-maxage 参数设置为 30 或适当的值（自动化）

结果：PASS

Audit:

/bin/ps -fC kube-apiserver

预期结果: '--audit-log-maxage' 大于或等于 30

返回值： 
UID PID PPID C STIME TTY TIME CMD root 2840 2791 5 18:32 ? 00:01:35 kube-apiserver --admission-control-config-file=/etc/rancher/rke2/rke2-pss.yaml --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --advertise-address=10.10.10.100 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key
修正：

默认情况下，RKE2 将 --audit-log-maxage 参数设置为 30 天。如果您想更改此设置，请在控制平面节点上编辑 RKE2 配置文件 /etc/rancher/rke2/config.yaml，并将 --audit-log-maxage 参数设置为适当的天数，例如，

kube-apiserver-arg: - "audit-log-maxage=40"

1.2.18 确保 --audit-log-maxbackup 参数设置为 10 或适当的值（自动化）

结果：PASS

Audit:

/bin/ps -fC kube-apiserver

预期结果: '--audit-log-maxbackup' 大于或等于 10

返回值： 
UID PID PPID C STIME TTY TIME CMD root 2840 2791 5 18:32 ? 00:01:35 kube-apiserver --admission-control-config-file=/etc/rancher/rke2/rke2-pss.yaml --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --advertise-address=10.10.10.100 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key
修正：

默认情况下，RKE2 将 --audit-log-maxbackup 参数设置为 10。如果您想更改此设置，请在控制平面节点上编辑 RKE2 配置文件 /etc/rancher/rke2/config.yaml，并将 --audit-log-maxbackup 参数设置为适当的值。例如，

kube-apiserver-arg: - "audit-log-maxbackup=15"

1.2.19 确保 --audit-log-maxsize 参数设置为 100 或适当的值（自动化）

结果：PASS

Audit:

/bin/ps -fC kube-apiserver

预期结果: '--audit-log-maxsize' 大于或等于 100

返回值： 
UID PID PPID C STIME TTY TIME CMD root 2840 2791 5 18:32 ? 00:01:35 kube-apiserver --admission-control-config-file=/etc/rancher/rke2/rke2-pss.yaml --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --advertise-address=10.10.10.100 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key
修正：

默认情况下，RKE2 将 --audit-log-maxsize 参数设置为 100 MB。如果您想更改此设置，请在控制平面节点上编辑 RKE2 配置文件 /etc/rancher/rke2/config.yaml，并将 --audit-log-maxsize 参数设置为适当的大小（以 MB 为单位）。例如，

kube-apiserver-arg: - "audit-log-maxsize=150"

1.2.20 确保 --request-timeout 参数设置得当（自动化）

结果：PASS

Audit:

/bin/ps -fC kube-apiserver

预期结果: '--request-timeout' 不存在 或 '--request-timeout' 存在

返回值： 
UID PID PPID C STIME TTY TIME CMD root 2840 2791 5 18:32 ? 00:01:35 kube-apiserver --admission-control-config-file=/etc/rancher/rke2/rke2-pss.yaml --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --advertise-address=10.10.10.100 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key
修正：

根据 CIS 指南，"建议根据需要设置此限制，并仅在必要时更改默认限制 60 秒"。编辑 RKE2 配置文件 /etc/rancher/rke2/config.yaml，并在需要时设置以下参数。例如，

kube-apiserver-arg: - "request-timeout=300s"

1.2.21 确保 --service-account-lookup 参数设置为 true（自动）

结果：PASS

Audit:

/bin/ps -fC kube-apiserver

预期结果： '--service-account-lookup' 不存在 或者 '--service-account-lookup' 存在

返回值： 
UID PID PPID C STIME TTY TIME CMD root 2840 2791 5 18:32 ? 00:01:35 kube-apiserver --admission-control-config-file=/etc/rancher/rke2/rke2-pss.yaml --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --advertise-address=10.10.10.100 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key
修正：

默认情况下，RKE2 不设置 --service-account-lookup 参数。编辑 RKE2 配置文件 /etc/rancher/rke2/config.yaml 并设置 service-account-lookup。例如，

kube-apiserver-arg: - "service-account-lookup=true"

或者，您可以从此文件中删除 service-account-lookup 参数，以使默认值生效。

1.2.22 确保 --service-account-key-file 参数设置正确（自动化）

结果：PASS

Audit:

/bin/ps -fC kube-apiserver

预期结果： '--service-account-key-file' 存在

返回值： 
UID PID PPID C STIME TTY TIME CMD root 2840 2791 5 18:32 ? 00:01:35 kube-apiserver --admission-control-config-file=/etc/rancher/rke2/rke2-pss.yaml --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --advertise-address=10.10.10.100 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key
修正：

RKE2 会自动生成并设置服务账户密钥文件。它位于 /var/lib/rancher/rke2/server/tls/service.key。如果此检查失败，请编辑 RKE2 配置文件 /etc/rancher/rke2/config.yaml，并去除以下类似的行。

kube-apiserver-arg: - "service-account-key-file=+++<path>+++"

1.2.23 确保 --etcd-certfile 和 --etcd-keyfile 参数设置正确（自动化）

结果：PASS

Audit:

/bin/ps -fC kube-apiserver

预期结果： '--etcd-certfile' 存在 且 '--etcd-keyfile' 存在

返回值： 
UID PID PPID C STIME TTY TIME CMD root 2840 2791 5 18:32 ? 00:01:35 kube-apiserver --admission-control-config-file=/etc/rancher/rke2/rke2-pss.yaml --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --advertise-address=10.10.10.100 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key
修正：

RKE2 会自动生成并设置 etcd 证书和密钥文件。它们位于 /var/lib/rancher/rke2/server/tls/etcd/client.crt 和 /var/lib/rancher/rke2/server/tls/etcd/client.key。如果此检查失败，请编辑 RKE2 配置文件 /etc/rancher/rke2/config.yaml 并去除以下类似的行。

kube-apiserver-arg: - "etcd-certfile=+++<path>+++" - "etcd-keyfile=+++<path>+++"

1.2.24 确保 --tls-cert-file 和 --tls-private-key-file 参数设置正确（自动化）

结果：PASS

Audit:

/bin/ps -fC kube-apiserver

预期结果: '--tls-cert-file' 存在并且 '--tls-private-key-file' 存在

返回值： 
UID PID PPID C STIME TTY TIME CMD root 2840 2791 5 18:32 ? 00:01:35 kube-apiserver --admission-control-config-file=/etc/rancher/rke2/rke2-pss.yaml --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --advertise-address=10.10.10.100 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key
修正：

默认情况下，RKE2 会自动生成并提供 apiserver 的 TLS 证书和私钥。它们生成并位于 /var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt 和 /var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key。如果此检查失败，请编辑 RKE2 配置文件 /etc/rancher/rke2/config.yaml，并去除以下类似的行。

kube-apiserver-arg: - "tls-cert-file=+++<path>+++" - "tls-private-key-file=+++<path>+++"

1.2.25 确保 --client-ca-file 参数设置正确（自动化）

结果：PASS

Audit:

/bin/ps -fC kube-apiserver

预期结果: '--client-ca-file' 存在

返回值： 
UID PID PPID C STIME TTY TIME CMD root 2840 2791 5 18:32 ? 00:01:35 kube-apiserver --admission-control-config-file=/etc/rancher/rke2/rke2-pss.yaml --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --advertise-address=10.10.10.100 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key
修正：

默认情况下，RKE2 会自动提供客户端证书颁发机构文件。它生成并位于 /var/lib/rancher/rke2/server/tls/client-ca.crt。如果出于某种原因需要提供自己的 CA 证书，请考虑使用 rke2 证书命令行工具。如果此检查失败，请编辑 RKE2 配置文件 /etc/rancher/rke2/config.yaml 并去除以下类似的行。

kube-apiserver-arg: - "client-ca-file=+++<path>+++"

1.2.26 确保 --etcd-cafile 参数设置正确（自动化）

结果：PASS

Audit:

/bin/ps -fC kube-apiserver

预期结果: '--etcd-cafile' 存在

返回值： 
UID PID PPID C STIME TTY TIME CMD root 2840 2791 5 18:32 ? 00:01:35 kube-apiserver --admission-control-config-file=/etc/rancher/rke2/rke2-pss.yaml --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --advertise-address=10.10.10.100 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key
修正：

默认情况下，RKE2 会自动提供 etcd 证书颁发机构文件。它生成并位于 /var/lib/rancher/rke2/server/tls/client-ca.crt。如果出于某种原因需要提供自己的 CA 证书，请考虑使用 rke2 证书命令行工具。如果此检查失败，请编辑 RKE2 配置文件 /etc/rancher/rke2/config.yaml 并去除以下类似的行。

kube-apiserver-arg: - "etcd-cafile=+++<path>+++"

1.2.27 确保 --encryption-provider-config 参数设置正确（自动化）

结果：PASS

Audit:

/bin/ps -fC kube-apiserver

预期结果: '--encryption-provider-config' 存在

返回值： 
UID PID PPID C STIME TTY TIME CMD root 2840 2791 5 18:32 ? 00:01:35 kube-apiserver --admission-control-config-file=/etc/rancher/rke2/rke2-pss.yaml --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --advertise-address=10.10.10.100 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key
修正：

RKE2 始终配置为加密机密。机密加密由 rke2 secrets-encrypt 命令行工具管理。如有需要，您可以在 /var/lib/rancher/rke2/server/cred/encryption-config.json 找到生成的加密配置。

1.2.28 确保加密提供程序配置正确（自动化）

结果：PASS

Audit:

ENCRYPTION_PROVIDER_CONFIG=$(ps -ef | grep kube-apiserver | grep -- --encryption-provider-config | sed 's%.*encryption-provider-config[= ]\([{caret} ]*\).*%\1%') if test -e $ENCRYPTION_PROVIDER_CONFIG; then grep -o 'providers\"\:\[.*\]' $ENCRYPTION_PROVIDER_CONFIG | grep -o "[A-Za-z]*" | head -2 | tail -1 | sed 's/{caret}/provider=/'; fi

预期结果: 'provider' 包含来自 'aescbc,kms,secretbox' 的有效元素

返回值： 
provider=aescbc
修正：

RKE2 始终配置为使用 aescbc 加密提供程序来加密机密。机密加密由 rke2 secrets-encrypt 命令行工具管理。如有需要，您可以在 /var/lib/rancher/rke2/server/cred/encryption-config.json 找到生成的加密配置。

1.2.29 确保 API 服务器仅使用强加密密码（自动）

结果：PASS

Audit:

/bin/ps -fC kube-apiserver

预期结果: '--tls-cipher-suites' 包含来自 'TLS_AES_128_GCM_SHA256,TLS_AES_256_GCM_SHA384,TLS_CHACHA20_POLY1305_SHA256,TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256,TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256,TLS_RSA_WITH_3DES_EDE_CBC_SHA,TLS_RSA_WITH_AES_128_CBC_SHA,TLS_RSA_WITH_AES_128_GCM_SHA256,TLS_RSA_WITH_AES_256_CBC_SHA,TLS_RSA_WITH_AES_256_GCM_SHA384' 的有效元素

返回值： 
UID PID PPID C STIME TTY TIME CMD root 2840 2791 5 18:32 ? 00:01:35 kube-apiserver --admission-control-config-file=/etc/rancher/rke2/rke2-pss.yaml --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --advertise-address=10.10.10.100 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key
修正：

默认情况下，RKE2 kube-apiserver 符合此测试。更改这些值可能会导致回归，因此在生产部署中应用之前，请确保所有 apiserver 客户端支持新的 TLS 配置。如果需要自定义 TLS 配置，请考虑创建与您的要求相符的此规则的自定义版本。如果此检查失败，请去除围绕 tls-cipher-suites 的任何自定义配置，或更新 /etc/rancher/rke2/config.yaml 文件以匹配默认值，添加以下内容：kube-apiserver-arg: - "tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305"

1.3 控制器管理器

1.3.1 确保 --terminated-pod-gc-threshold 参数设置适当（手动）

结果：PASS

Audit:

/bin/ps -fC kube-controller-manager

预期结果: '--terminated-pod-gc-threshold' 存在

返回值： 
UID PID PPID C STIME TTY TIME CMD root 2987 2893 1 18:32 ? 00:00:25 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,tokencleaner,-service,-route,-cloud-node-lifecycle --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true
修正：

默认情况下，RKE2 设置 terminated-pod-gc-threshold 为 1000。如果您需要更改此值，请在控制平面节点上编辑 RKE2 配置文件 /etc/rancher/rke2/config.yaml，并将 --terminated-pod-gc-threshold 设置为适当的阈值，

kube-controller-manager-arg: - "terminated-pod-gc-threshold=10"

1.3.2 确保 --profiling 参数设置为 false（自动化）

结果：PASS

Audit:

/bin/ps -fC kube-controller-manager

预期结果: '--profiling' 等于 'false'

返回值： 
UID PID PPID C STIME TTY TIME CMD root 2987 2893 1 18:32 ? 00:00:25 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,tokencleaner,-service,-route,-cloud-node-lifecycle --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true
修正：

默认情况下，RKE2 将 --profiling 参数设置为 false。如果此检查失败，请编辑 RKE2 配置文件 /etc/rancher/rke2/config.yaml 并去除以下类似的行。

kube-controller-manager-arg: - "profiling=true"

1.3.3 确保 --use-service-account-credentials 参数设置为 true（自动）

结果：PASS

Audit:

/bin/ps -fC kube-controller-manager

预期结果: '--use-service-account-credentials' 不等于 'false'

返回值： 
UID PID PPID C STIME TTY TIME CMD root 2987 2893 1 18:32 ? 00:00:25 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,tokencleaner,-service,-route,-cloud-node-lifecycle --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true
修正：

默认情况下，RKE2 将 --use-service-account-credentials 参数设置为 true。如果此检查失败，请编辑 RKE2 配置文件 /etc/rancher/rke2/config.yaml 并去除以下类似的行。

kube-controller-manager-arg: - "use-service-account-credentials=false"

1.3.4 确保 --service-account-private-key-file 参数设置适当（自动）

结果：PASS

Audit:

/bin/ps -fC kube-controller-manager

预期结果: '--service-account-private-key-file' 存在

返回值： 
UID PID PPID C STIME TTY TIME CMD root 2987 2893 1 18:32 ? 00:00:25 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,tokencleaner,-service,-route,-cloud-node-lifecycle --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true
修正：

默认情况下，RKE2 自动提供服务账户私钥文件。它是在 /var/lib/rancher/rke2/server/tls/service.current.key 生成并存放的。如果此检查失败，请编辑 RKE2 配置文件 /etc/rancher/rke2/config.yaml 并去除以下类似的行。

kube-controller-manager-arg: - "service-account-private-key-file=+++<path>+++"

1.3.5 确保 --root-ca-file 参数设置正确（自动化）

结果：PASS

Audit:

/bin/ps -fC kube-controller-manager

预期结果: '--root-ca-file' 存在

返回值： 
UID PID PPID C STIME TTY TIME CMD root 2987 2893 1 18:32 ? 00:00:25 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,tokencleaner,-service,-route,-cloud-node-lifecycle --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true
修正：

默认情况下，RKE2 会自动提供根 CA 文件。它在 /var/lib/rancher/rke2/server/tls/server-ca.crt 生成并存放。如果出于某种原因您需要提供自己的 CA 证书，请考虑使用 rke2 证书命令行工具。如果此检查失败，请编辑 RKE2 配置文件 /etc/rancher/rke2/config.yaml 并去除以下类似的行。

kube-controller-manager-arg: - "root-ca-file=+++<path>+++"

1.3.6 确保 RotateKubeletServerCertificate 参数设置为 true（自动化）

结果：PASS

Audit:

/bin/ps -fC kube-controller-manager

预期结果: '--feature-gates' 存在 或 '--feature-gates' 不存在

返回值： 
UID PID PPID C STIME TTY TIME CMD root 2987 2893 1 18:32 ? 00:00:25 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,tokencleaner,-service,-route,-cloud-node-lifecycle --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true
修正：

默认情况下，RKE2 不会设置 RotateKubeletServerCertificate 功能开关。如果您启用了此功能开关，您应该将其去除。如果此检查失败，请编辑 RKE2 配置文件 /etc/rancher/rke2/config.yaml，并去除以下类似的行。

kube-controller-manager-arg: - "feature-gate=RotateKubeletServerCertificate"

1.3.7 确保 --bind-address 参数设置为 127.0.0.1（自动化）

结果：PASS

Audit:

/bin/ps -fC kube-controller-manager

预期结果: '--bind-address' 等于 '127.0.0.1' 或 '--bind-address' 不存在

返回值： 
UID PID PPID C STIME TTY TIME CMD root 2987 2893 1 18:32 ? 00:00:25 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,tokencleaner,-service,-route,-cloud-node-lifecycle --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true
修正：

默认情况下，RKE2 将 --bind-address 参数设置为 127.0.0.1。如果此检查失败，请编辑 RKE2 配置文件 /etc/rancher/rke2/config.yaml，并去除以下类似的行。

kube-controller-manager-arg: - "bind-address=+++<IP>+++"

1.4 调度程序

1.4.1 确保 --profiling 参数设置为 false（自动化）

结果：PASS

Audit:

/bin/ps -fC kube-scheduler

预期结果: '--profiling' 等于 'false'

返回值： 
UID PID PPID C STIME TTY TIME CMD root 2992 2874 0 18:32 ? 00:00:05 kube-scheduler --permit-port-sharing=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/scheduler.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/scheduler.kubeconfig --bind-address=127.0.0.1 --kubeconfig=/var/lib/rancher/rke2/server/cred/scheduler.kubeconfig --profiling=false --secure-port=10259
修正：

默认情况下，RKE2 将 --profiling 参数设置为 false。如果此检查失败，请编辑 RKE2 配置文件 /etc/rancher/rke2/config.yaml 并去除以下类似的行。

kube-scheduler-arg: - "profiling=true"

1.4.2 确保 --bind-address 参数设置为 127.0.0.1（自动化）

结果：PASS

Audit:

/bin/ps -fC kube-scheduler

预期结果: '--bind-address' 等于 '127.0.0.1' 或 '--bind-address' 不存在

返回值： 
UID PID PPID C STIME TTY TIME CMD root 2992 2874 0 18:32 ? 00:00:05 kube-scheduler --permit-port-sharing=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/scheduler.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/scheduler.kubeconfig --bind-address=127.0.0.1 --kubeconfig=/var/lib/rancher/rke2/server/cred/scheduler.kubeconfig --profiling=false --secure-port=10259
修正：

默认情况下，RKE2 将 --bind-address 参数设置为 127.0.0.1。如果此检查失败，请编辑 RKE2 配置文件 /etc/rancher/rke2/config.yaml，并去除以下类似的行。

kube-scheduler-arg: - "bind-address=+++<IP>+++"

2 Etcd 节点配置

2 Etcd 节点配置

2.1 确保 --cert-file 和 --key-file 参数设置正确（自动化）

结果：PASS

Audit:

cat /var/lib/rancher/rke2/server/db/etcd/config

预期结果: '.client-transport-security.cert-file' 等于 '/var/lib/rancher/rke2/server/tls/etcd/server-client.crt' 且 '.client-transport-security.key-file' 等于 '/var/lib/rancher/rke2/server/tls/etcd/server-client.key'

返回值： 
advertise-client-urls: https://10.10.10.100:2379 client-transport-security: cert-file: /var/lib/rancher/rke2/server/tls/etcd/server-client.crt client-cert-auth: true key-file: /var/lib/rancher/rke2/server/tls/etcd/server-client.key trusted-ca-file: /var/lib/rancher/rke2/server/tls/etcd/server-ca.crt data-dir: /var/lib/rancher/rke2/server/db/etcd election-timeout: 5000 experimental-initial-corrupt-check: true experimental-watch-progress-notify-interval: 5000000000 heartbeat-interval: 500 initial-advertise-peer-urls: https://10.10.10.100:2380 initial-cluster: server-0-eb0b952d=https://10.10.10.100:2380 initial-cluster-state: new listen-client-http-urls: https://127.0.0.1:2382 listen-client-urls: https://127.0.0.1:2379,https://10.10.10.100:2379 listen-metrics-urls: http://127.0.0.1:2381 listen-peer-urls: https://127.0.0.1:2380,https://10.10.10.100:2380 log-outputs: - stderr logger: zap name: server-0-eb0b952d peer-transport-security: cert-file: /var/lib/rancher/rke2/server/tls/etcd/peer-server-client.crt client-cert-auth: true key-file: /var/lib/rancher/rke2/server/tls/etcd/peer-server-client.key trusted-ca-file: /var/lib/rancher/rke2/server/tls/etcd/peer-ca.crt snapshot-count: 10000
修正：

默认情况下，RKE2 为 etcd 生成证书和密钥文件。这些文件位于 /var/lib/rancher/rke2/server/tls/etcd/。如果此检查失败，请确保配置文件 /var/lib/rancher/rke2/server/db/etcd/config 未被修改为使用自定义证书和密钥文件。

2.2 确保 --client-cert-auth 参数设置为 true（自动化）

结果：PASS

Audit:

cat /var/lib/rancher/rke2/server/db/etcd/config

预期结果：'ETCD_CLIENT_CERT_AUTH' 存在 或 '.client-transport-security.client-cert-auth' 等于 'true'

返回值： 
advertise-client-urls: https://10.10.10.100:2379 client-transport-security: cert-file: /var/lib/rancher/rke2/server/tls/etcd/server-client.crt client-cert-auth: true key-file: /var/lib/rancher/rke2/server/tls/etcd/server-client.key trusted-ca-file: /var/lib/rancher/rke2/server/tls/etcd/server-ca.crt data-dir: /var/lib/rancher/rke2/server/db/etcd election-timeout: 5000 experimental-initial-corrupt-check: true experimental-watch-progress-notify-interval: 5000000000 heartbeat-interval: 500 initial-advertise-peer-urls: https://10.10.10.100:2380 initial-cluster: server-0-a6fd4758=https://10.10.10.100:2380 initial-cluster-state: new listen-client-http-urls: https://127.0.0.1:2382 listen-client-urls: https://127.0.0.1:2379,https://10.10.10.100:2379 listen-metrics-urls: http://127.0.0.1:2381 listen-peer-urls: https://127.0.0.1:2380,https://10.10.10.100:2380 log-outputs: - stderr logger: zap name: server-0-a6fd4758 peer-transport-security: cert-file: /var/lib/rancher/rke2/server/tls/etcd/peer-server-client.crt client-cert-auth: true key-file: /var/lib/rancher/rke2/server/tls/etcd/peer-server-client.key trusted-ca-file: /var/lib/rancher/rke2/server/tls/etcd/peer-ca.crt snapshot-count: 10000
修正：

默认情况下，RKE2 将 --client-cert-auth 参数设置为 true。如果此检查失败，请确保配置文件 /var/lib/rancher/rke2/server/db/etcd/config 未被修改为禁用客户端证书认证。

2.3 确保 --auto-tls 参数未设置为 true（自动化）

结果：PASS

Audit:

cat /var/lib/rancher/rke2/server/db/etcd/config

预期结果：'ETCD_AUTO_TLS' 不存在 或 'ETCD_AUTO_TLS' 存在 或 '.client-transport-security.auto-tls' 存在

返回值： 
advertise-client-urls: https://10.10.10.100:2379 client-transport-security: cert-file: /var/lib/rancher/rke2/server/tls/etcd/server-client.crt client-cert-auth: true key-file: /var/lib/rancher/rke2/server/tls/etcd/server-client.key trusted-ca-file: /var/lib/rancher/rke2/server/tls/etcd/server-ca.crt data-dir: /var/lib/rancher/rke2/server/db/etcd election-timeout: 5000 experimental-initial-corrupt-check: true experimental-watch-progress-notify-interval: 5000000000 heartbeat-interval: 500 initial-advertise-peer-urls: https://10.10.10.100:2380 initial-cluster: server-0-a6fd4758=https://10.10.10.100:2380 initial-cluster-state: new listen-client-http-urls: https://127.0.0.1:2382 listen-client-urls: https://127.0.0.1:2379,https://10.10.10.100:2379 listen-metrics-urls: http://127.0.0.1:2381 listen-peer-urls: https://127.0.0.1:2380,https://10.10.10.100:2380 log-outputs: - stderr logger: zap name: server-0-a6fd4758 peer-transport-security: cert-file: /var/lib/rancher/rke2/server/tls/etcd/peer-server-client.crt client-cert-auth: true key-file: /var/lib/rancher/rke2/server/tls/etcd/peer-server-client.key trusted-ca-file: /var/lib/rancher/rke2/server/tls/etcd/peer-ca.crt snapshot-count: 10000
修正：

默认情况下，RKE2 不会设置 --auto-tls 参数。如果此检查失败，请在主节点上编辑 etcd pod 规格文件 /var/lib/rancher/rke2/server/db/etcd/config，删除 --auto-tls 参数或将其设置为 false。client-transport-security: auto-tls: false

2.4 确保 --peer-cert-file 和 --peer-key-file 参数设置正确（自动化）

结果：PASS

Audit:

cat /var/lib/rancher/rke2/server/db/etcd/config

预期结果： '.peer-transport-security.cert-file' 等于 '/var/lib/rancher/rke2/server/tls/etcd/peer-server-client.crt' 且 '.peer-transport-security.key-file' 等于 '/var/lib/rancher/rke2/server/tls/etcd/peer-server-client.key'

返回值： 
advertise-client-urls: https://10.10.10.100:2379 client-transport-security: cert-file: /var/lib/rancher/rke2/server/tls/etcd/server-client.crt client-cert-auth: true key-file: /var/lib/rancher/rke2/server/tls/etcd/server-client.key trusted-ca-file: /var/lib/rancher/rke2/server/tls/etcd/server-ca.crt data-dir: /var/lib/rancher/rke2/server/db/etcd election-timeout: 5000 experimental-initial-corrupt-check: true experimental-watch-progress-notify-interval: 5000000000 heartbeat-interval: 500 initial-advertise-peer-urls: https://10.10.10.100:2380 initial-cluster: server-0-eb0b952d=https://10.10.10.100:2380 initial-cluster-state: new listen-client-http-urls: https://127.0.0.1:2382 listen-client-urls: https://127.0.0.1:2379,https://10.10.10.100:2379 listen-metrics-urls: http://127.0.0.1:2381 listen-peer-urls: https://127.0.0.1:2380,https://10.10.10.100:2380 log-outputs: - stderr logger: zap name: server-0-eb0b952d peer-transport-security: cert-file: /var/lib/rancher/rke2/server/tls/etcd/peer-server-client.crt client-cert-auth: true key-file: /var/lib/rancher/rke2/server/tls/etcd/peer-server-client.key trusted-ca-file: /var/lib/rancher/rke2/server/tls/etcd/peer-ca.crt snapshot-count: 10000
修正：

默认情况下，RKE2 为 etcd 生成对等证书和密钥文件。这些文件位于 /var/lib/rancher/rke2/server/tls/etcd/。如果此检查失败，请确保配置文件 /var/lib/rancher/rke2/server/db/etcd/config 未被修改为使用自定义对等证书和密钥文件。

2.5 确保 --peer-client-cert-auth 参数设置为 true（自动化）

结果：PASS

Audit:

cat /var/lib/rancher/rke2/server/db/etcd/config

预期结果：'ETCD_PEER_CLIENT_CERT_AUTH' 存在 或 '.peer-transport-security.client-cert-auth' 等于 'true'

返回值： 
advertise-client-urls: https://10.10.10.100:2379 client-transport-security: cert-file: /var/lib/rancher/rke2/server/tls/etcd/server-client.crt client-cert-auth: true key-file: /var/lib/rancher/rke2/server/tls/etcd/server-client.key trusted-ca-file: /var/lib/rancher/rke2/server/tls/etcd/server-ca.crt data-dir: /var/lib/rancher/rke2/server/db/etcd election-timeout: 5000 experimental-initial-corrupt-check: true experimental-watch-progress-notify-interval: 5000000000 heartbeat-interval: 500 initial-advertise-peer-urls: https://10.10.10.100:2380 initial-cluster: server-0-a6fd4758=https://10.10.10.100:2380 initial-cluster-state: new listen-client-http-urls: https://127.0.0.1:2382 listen-client-urls: https://127.0.0.1:2379,https://10.10.10.100:2379 listen-metrics-urls: http://127.0.0.1:2381 listen-peer-urls: https://127.0.0.1:2380,https://10.10.10.100:2380 log-outputs: - stderr logger: zap name: server-0-a6fd4758 peer-transport-security: cert-file: /var/lib/rancher/rke2/server/tls/etcd/peer-server-client.crt client-cert-auth: true key-file: /var/lib/rancher/rke2/server/tls/etcd/peer-server-client.key trusted-ca-file: /var/lib/rancher/rke2/server/tls/etcd/peer-ca.crt snapshot-count: 10000
修正：

默认情况下，RKE2 将 --peer-cert-auth 参数设置为 true。如果此检查失败，请确保配置文件 /var/lib/rancher/rke2/server/db/etcd/config 未被修改为禁用对等客户端证书认证。

2.6 确保 --peer-auto-tls 参数未设置为 true（自动化）

结果：PASS

Audit:

cat /var/lib/rancher/rke2/server/db/etcd/config

预期结果：'ETCD_PEER_AUTO_TLS' 不存在 或 'ETCD_PEER_AUTO_TLS' 存在 或 '.peer-transport-security.auto-tls' 存在

返回值： 
advertise-client-urls: https://10.10.10.100:2379 client-transport-security: cert-file: /var/lib/rancher/rke2/server/tls/etcd/server-client.crt client-cert-auth: true key-file: /var/lib/rancher/rke2/server/tls/etcd/server-client.key trusted-ca-file: /var/lib/rancher/rke2/server/tls/etcd/server-ca.crt data-dir: /var/lib/rancher/rke2/server/db/etcd election-timeout: 5000 experimental-initial-corrupt-check: true experimental-watch-progress-notify-interval: 5000000000 heartbeat-interval: 500 initial-advertise-peer-urls: https://10.10.10.100:2380 initial-cluster: server-0-a6fd4758=https://10.10.10.100:2380 initial-cluster-state: new listen-client-http-urls: https://127.0.0.1:2382 listen-client-urls: https://127.0.0.1:2379,https://10.10.10.100:2379 listen-metrics-urls: http://127.0.0.1:2381 listen-peer-urls: https://127.0.0.1:2380,https://10.10.10.100:2380 log-outputs: - stderr logger: zap name: server-0-a6fd4758 peer-transport-security: cert-file: /var/lib/rancher/rke2/server/tls/etcd/peer-server-client.crt client-cert-auth: true key-file: /var/lib/rancher/rke2/server/tls/etcd/peer-server-client.key trusted-ca-file: /var/lib/rancher/rke2/server/tls/etcd/peer-ca.crt snapshot-count: 10000
修正：

默认情况下，RKE2 不会设置 --peer-auto-tls 参数。如果此检查失败，请在主节点上编辑 etcd pod 规格文件 /var/lib/rancher/rke2/server/db/etcd/config，删除 --peer-auto-tls 参数或将其设置为 false。peer-transport-security: auto-tls: false

2.7 确保为 etcd 使用唯一的证书颁发机构（自动化）

结果：PASS

Audit:

cat /var/lib/rancher/rke2/server/db/etcd/config

预期结果：'ETCD_TRUSTED_CA_FILE' 存在 或 '.peer-transport-security.trusted-ca-file' 等于 '/var/lib/rancher/rke2/server/tls/etcd/peer-ca.crt'

返回值： 
advertise-client-urls: https://10.10.10.100:2379 client-transport-security: cert-file: /var/lib/rancher/rke2/server/tls/etcd/server-client.crt client-cert-auth: true key-file: /var/lib/rancher/rke2/server/tls/etcd/server-client.key trusted-ca-file: /var/lib/rancher/rke2/server/tls/etcd/server-ca.crt data-dir: /var/lib/rancher/rke2/server/db/etcd election-timeout: 5000 experimental-initial-corrupt-check: true experimental-watch-progress-notify-interval: 5000000000 heartbeat-interval: 500 initial-advertise-peer-urls: https://10.10.10.100:2380 initial-cluster: server-0-a6fd4758=https://10.10.10.100:2380 initial-cluster-state: new listen-client-http-urls: https://127.0.0.1:2382 listen-client-urls: https://127.0.0.1:2379,https://10.10.10.100:2379 listen-metrics-urls: http://127.0.0.1:2381 listen-peer-urls: https://127.0.0.1:2380,https://10.10.10.100:2380 log-outputs: - stderr logger: zap name: server-0-a6fd4758 peer-transport-security: cert-file: /var/lib/rancher/rke2/server/tls/etcd/peer-server-client.crt client-cert-auth: true key-file: /var/lib/rancher/rke2/server/tls/etcd/peer-server-client.key trusted-ca-file: /var/lib/rancher/rke2/server/tls/etcd/peer-ca.crt snapshot-count: 10000
修正：

默认情况下，RKE2 为 etcd 生成一个唯一的证书颁发机构。该证书位于 /var/lib/rancher/rke2/server/tls/etcd/peer-ca.crt。如果此检查失败，请确保配置文件 /var/lib/rancher/rke2/server/db/etcd/config 未被修改为使用共享证书颁发机构。

3 控制平面配置

3.1 身份验证和授权

3.1.1 不应为用户使用客户端证书认证（手动）

结果：警告

修正：应实施 Kubernetes 提供的替代机制，例如使用 OIDC，来替代客户端证书。

3.1.2 不应为用户使用服务账户令牌认证（手动）

结果：警告

修正：应实施 Kubernetes 提供的替代机制，例如使用 OIDC，来替代服务账户令牌。

3.1.3 不应将启动词元身份验证用于用户（手动）

结果：警告

修正：应实施 Kubernetes 提供的替代机制，例如使用 OIDC，来替代启动词元。

3.2 日志记录

3.2.1 确保创建最小审计策略（自动化）

结果：PASS

Audit:

/bin/ps -ef | grep kube-apiserver | grep -v grep

预期结果: '--审计策略文件' 存在

返回值： 
root 2840 2791 5 18:32 ? 00:01:35 kube-apiserver --admission-control-config-file=/etc/rancher/rke2/rke2-pss.yaml --audit-policy-file=/etc/rancher/rke2/audit-policy.yaml --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/rke2/server/logs/audit.log --advertise-address=10.10.10.100 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,rke2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --cert-dir=/var/lib/rancher/rke2/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/rke2/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/rke2/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/rke2/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/rke2/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/rke2/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/rke2/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --kubelet-certificate-authority=/var/lib/rancher/rke2/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/rke2/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/rke2/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/rke2/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/rke2/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/rke2/server/tls/serving-kube-apiserver.key root 2987 2893 1 18:32 ? 00:00:25 kube-controller-manager --flex-volume-plugin-dir=/var/lib/kubelet/volumeplugins --terminated-pod-gc-threshold=1000 --permit-port-sharing=true --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/rke2/server/tls/client-ca.nochain.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/rke2/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/rke2/server/tls/server-ca.nochain.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/rke2/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,tokencleaner,-service,-route,-cloud-node-lifecycle --kubeconfig=/var/lib/rancher/rke2/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/rke2/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/rke2/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true
修正：

为您的集群创建一个审计策略文件。

3.2.2 确保审计策略涵盖关键安全问题（手动）

结果：警告

修正：审查为集群提供的审计策略，并确保至少涵盖以下领域：- 访问集群管理的机密。应注意仅记录对机密、配置映射和词元审查的请求的元数据，以避免记录敏感数据的风险。- 修改 Pod 和部署对象。- 使用 pods/exec、pods/portforward、pods/proxy 和 services/proxy。对于大多数请求，建议至少在元数据级别进行日志记录（最基本的日志记录级别）。

4 工作节点安全配置

4.1 工作节点配置文件

4.1.1 确保 kubelet 服务文件权限设置为 600 或更严格（自动化）

结果：不适用

说明：kubelet 由 RKE2 进程管理。没有 kubelet 服务文件，所有配置在运行时作为参数传递。

4.1.2 确保 kubelet 服务文件的所有权设置为 root:root（自动化）

结果：不适用

说明：kubelet 由 RKE2 进程管理。没有 kubelet 服务文件，所有配置在运行时作为参数传递。

4.1.3 如果代理 kubeconfig 文件存在，请确保权限设置为 600 或更严格（自动）

结果：PASS

Audit:

/bin/sh -c 'if test -e /var/lib/rancher/rke2/agent/kubeproxy.kubeconfig; then stat -c permissions=%a /var/lib/rancher/rke2/agent/kubeproxy.kubeconfig; fi'

预期结果: 权限为 600，预期为 600 或更严格

返回值： 
permissions=600
修正：

在每个工作节点上运行以下命令（根据您系统上的文件位置）。例如，chmod 600 /var/lib/rancher/rke2/agent/kubeproxy.kubeconfig

4.1.4 如果代理 kubeconfig 文件存在，确保所有权设置为 root:root（自动化）

结果：PASS

Audit:

/bin/sh -c 'if test -e /var/lib/rancher/rke2/agent/kubeproxy.kubeconfig; then stat -c %U:%G /var/lib/rancher/rke2/agent/kubeproxy.kubeconfig; fi'

预期结果: 'root:root' 存在

返回值： 
root:root
修正：

在每个工作节点上运行以下命令（根据您系统上的文件位置）。例如，chown root:root /var/lib/rancher/rke2/agent/kubeproxy.kubeconfig

4.1.5 确保 --kubeconfig kubelet.conf 文件权限设置为 600 或更严格（自动化）

结果：PASS

Audit:

/bin/sh -c 'if test -e /var/lib/rancher/rke2/agent/kubelet.kubeconfig; then stat -c permissions=%a /var/lib/rancher/rke2/agent/kubelet.kubeconfig; fi'

预期结果: 权限为 600，预期为 600 或更严格

返回值： 
permissions=600
修正：

在每个工作节点上运行以下命令（根据您系统上的文件位置）。例如，chmod 600 /var/lib/rancher/rke2/agent/kubelet.kubeconfig

4.1.6 确保 --kubeconfig kubelet.conf 文件的所有权设置为 root:root（自动化）

结果：PASS

Audit:

/bin/sh -c 'if test -e /var/lib/rancher/rke2/agent/kubelet.kubeconfig; then stat -c %U:%G /var/lib/rancher/rke2/agent/kubelet.kubeconfig; fi'

预期结果: 'root:root' 等于 'root:root'

返回值： 
root:root
修正：

在每个工作节点上运行以下命令（根据您系统上的文件位置）。例如，chown root:root /var/lib/rancher/rke2/agent/kubelet.kubeconfig

4.1.7 确保证书颁发机构文件权限设置为 600 或更严格（自动化）

结果：PASS

Audit:

/bin/sh -c 'if test -e /var/lib/rancher/rke2/agent/client-ca.crt; then stat -c permissions=%a /var/lib/rancher/rke2/agent/client-ca.crt; fi'

预期结果: 权限为 600，预期为 600 或更严格

返回值： 
permissions=600
修正：

在每个工作节点上运行以下命令（根据您系统上的文件位置）。例如，chmod 600 /var/lib/rancher/rke2/agent/client-ca.crt

4.1.8 确保客户端证书颁发机构文件的所有权设置为 root:root（自动化）

结果：PASS

Audit:

/bin/sh -c 'if test -e /var/lib/rancher/rke2/agent/client-ca.crt; then stat -c %U:%G /var/lib/rancher/rke2/agent/client-ca.crt; fi'

预期结果: 'root:root' 等于 'root:root'

返回值： 
root:root
修正：

运行以下命令以修改 --client-ca-file 的所有权。chown root:root /var/lib/rancher/rke2/agent/client-ca.crt

4.1.9 如果正在使用 kubelet config.yaml 配置文件，请验证权限设置为 600 或更严格（自动化）

结果：不适用

说明：kubelet 由 RKE2 进程管理。没有 kubelet 配置文件，所有配置在运行时作为参数传递。

4.1.10 如果正在使用 kubelet config.yaml 配置文件，请验证文件所有权设置为 root:root（自动化）

结果：不适用

说明：kubelet 由 RKE2 进程管理。没有 kubelet 配置文件，所有配置在运行时作为参数传递。

4.2 Kubelet

4.2.1 确保 --anonymous-auth 参数设置为 false（自动化）

结果：PASS

Audit:

/bin/ps -fC kubelet

预期结果: '--anonymous-auth' 等于 'false'

返回值： 
UID PID PPID C STIME TTY TIME CMD root 2592 2508 2 18:32 ? 00:00:41 kubelet --volume-plugin-dir=/var/lib/kubelet/volumeplugins --file-check-frequency=5s --sync-frequency=30s --address=0.0.0.0 --anonymous-auth=false --authentication-token-webhook=true --authorization-mode=Webhook --cgroup-driver=systemd --client-ca-file=/var/lib/rancher/rke2/agent/client-ca.crt --cloud-provider=external --cluster-dns=10.43.0.10 --cluster-domain=cluster.local --container-runtime-endpoint=unix:///run/k3s/containerd/containerd.sock --containerd=/run/k3s/containerd/containerd.sock --eviction-hard=imagefs.available<5%,nodefs.available<5% --eviction-minimum-reclaim=imagefs.available=10%,nodefs.available=10% --fail-swap-on=false --feature-gates=CloudDualStackNodeIPs=true --healthz-bind-address=127.0.0.1 --hostname-override=server-0 --kubeconfig=/var/lib/rancher/rke2/agent/kubelet.kubeconfig --node-ip=10.10.10.100 --node-labels= --pod-infra-container-image=index.docker.io/rancher/mirrored-pause:3.6 --pod-manifest-path=/var/lib/rancher/rke2/agent/pod-manifests --protect-kernel-defaults=true --read-only-port=0 --resolv-conf=/run/systemd/resolve/resolv.conf --serialize-image-pulls=false --tls-cert-file=/var/lib/rancher/rke2/agent/serving-kubelet.crt --tls-private-key-file=/var/lib/rancher/rke2/agent/serving-kubelet.key
修正：

默认情况下，RKE2 将 --anonymous-auth 参数设置为 false。如果此检查失败，请编辑 RKE2 配置文件 /etc/rancher/rke2/config.yaml，删除任何类似于以下的行。

kubelet-arg: - "anonymous-auth=true"

根据您的系统，重启 RKE2 服务。例如，systemctl restart rke2-server.service

4.2.2 确保 --authorization-mode 参数未设置为 AlwaysAllow（自动化）

结果：PASS

Audit:

/bin/ps -fC kubelet

预期结果: '--authorization-mode' 不包含 'AlwaysAllow'

返回值： 
UID PID PPID C STIME TTY TIME CMD root 2592 2508 2 18:32 ? 00:00:41 kubelet --volume-plugin-dir=/var/lib/kubelet/volumeplugins --file-check-frequency=5s --sync-frequency=30s --address=0.0.0.0 --anonymous-auth=false --authentication-token-webhook=true --authorization-mode=Webhook --cgroup-driver=systemd --client-ca-file=/var/lib/rancher/rke2/agent/client-ca.crt --cloud-provider=external --cluster-dns=10.43.0.10 --cluster-domain=cluster.local --container-runtime-endpoint=unix:///run/k3s/containerd/containerd.sock --containerd=/run/k3s/containerd/containerd.sock --eviction-hard=imagefs.available<5%,nodefs.available<5% --eviction-minimum-reclaim=imagefs.available=10%,nodefs.available=10% --fail-swap-on=false --feature-gates=CloudDualStackNodeIPs=true --healthz-bind-address=127.0.0.1 --hostname-override=server-0 --kubeconfig=/var/lib/rancher/rke2/agent/kubelet.kubeconfig --node-ip=10.10.10.100 --node-labels= --pod-infra-container-image=index.docker.io/rancher/mirrored-pause:3.6 --pod-manifest-path=/var/lib/rancher/rke2/agent/pod-manifests --protect-kernel-defaults=true --read-only-port=0 --resolv-conf=/run/systemd/resolve/resolv.conf --serialize-image-pulls=false --tls-cert-file=/var/lib/rancher/rke2/agent/serving-kubelet.crt --tls-private-key-file=/var/lib/rancher/rke2/agent/serving-kubelet.key
修正：

默认情况下，RKE2 不会将 --authorization-mode 设置为 AlwaysAllow。如果此检查失败，请编辑 RKE2 配置文件 /etc/rancher/rke2/config.yaml，删除任何类似于以下的行。

kubelet-arg: - "authorization-mode=AlwaysAllow"

根据您的系统，重启 RKE2 服务。例如，systemctl restart rke2-server.service

4.2.3 确保 --client-ca-file 参数设置为适当值（自动化）

结果：PASS

Audit:

/bin/ps -fC kubelet

预期结果: '--client-ca-file' 存在

返回值： 
UID PID PPID C STIME TTY TIME CMD root 2592 2508 2 18:32 ? 00:00:41 kubelet --volume-plugin-dir=/var/lib/kubelet/volumeplugins --file-check-frequency=5s --sync-frequency=30s --address=0.0.0.0 --anonymous-auth=false --authentication-token-webhook=true --authorization-mode=Webhook --cgroup-driver=systemd --client-ca-file=/var/lib/rancher/rke2/agent/client-ca.crt --cloud-provider=external --cluster-dns=10.43.0.10 --cluster-domain=cluster.local --container-runtime-endpoint=unix:///run/k3s/containerd/containerd.sock --containerd=/run/k3s/containerd/containerd.sock --eviction-hard=imagefs.available<5%,nodefs.available<5% --eviction-minimum-reclaim=imagefs.available=10%,nodefs.available=10% --fail-swap-on=false --feature-gates=CloudDualStackNodeIPs=true --healthz-bind-address=127.0.0.1 --hostname-override=server-0 --kubeconfig=/var/lib/rancher/rke2/agent/kubelet.kubeconfig --node-ip=10.10.10.100 --node-labels= --pod-infra-container-image=index.docker.io/rancher/mirrored-pause:3.6 --pod-manifest-path=/var/lib/rancher/rke2/agent/pod-manifests --protect-kernel-defaults=true --read-only-port=0 --resolv-conf=/run/systemd/resolve/resolv.conf --serialize-image-pulls=false --tls-cert-file=/var/lib/rancher/rke2/agent/serving-kubelet.crt --tls-private-key-file=/var/lib/rancher/rke2/agent/serving-kubelet.key
修正：

默认情况下，RKE2 会自动为 Kubelet 提供客户端 CA 证书。它是在 /var/lib/rancher/rke2/agent/client-ca.crt 生成并存放的。

4.2.4 验证 --read-only-port 参数是否设置为 0（自动化）

结果：PASS

Audit:

/bin/ps -fC kubelet

预期结果: '--read-only-port' 等于 '0' 或 '--read-only-port' 不存在

返回值： 
UID PID PPID C STIME TTY TIME CMD root 2592 2508 2 18:32 ? 00:00:41 kubelet --volume-plugin-dir=/var/lib/kubelet/volumeplugins --file-check-frequency=5s --sync-frequency=30s --address=0.0.0.0 --anonymous-auth=false --authentication-token-webhook=true --authorization-mode=Webhook --cgroup-driver=systemd --client-ca-file=/var/lib/rancher/rke2/agent/client-ca.crt --cloud-provider=external --cluster-dns=10.43.0.10 --cluster-domain=cluster.local --container-runtime-endpoint=unix:///run/k3s/containerd/containerd.sock --containerd=/run/k3s/containerd/containerd.sock --eviction-hard=imagefs.available<5%,nodefs.available<5% --eviction-minimum-reclaim=imagefs.available=10%,nodefs.available=10% --fail-swap-on=false --feature-gates=CloudDualStackNodeIPs=true --healthz-bind-address=127.0.0.1 --hostname-override=server-0 --kubeconfig=/var/lib/rancher/rke2/agent/kubelet.kubeconfig --node-ip=10.10.10.100 --node-labels= --pod-infra-container-image=index.docker.io/rancher/mirrored-pause:3.6 --pod-manifest-path=/var/lib/rancher/rke2/agent/pod-manifests --protect-kernel-defaults=true --read-only-port=0 --resolv-conf=/run/systemd/resolve/resolv.conf --serialize-image-pulls=false --tls-cert-file=/var/lib/rancher/rke2/agent/serving-kubelet.crt --tls-private-key-file=/var/lib/rancher/rke2/agent/serving-kubelet.key
修正：

默认情况下，RKE2 将 --read-only-port 设置为 0。如果您将其设置为其他值，则应将其设置回 0。编辑 RKE2 配置文件 /etc/rancher/rke2/config.yaml，去除任何类似于以下内容的行。

kubelet-arg: - "read-only-port=XXXX"

根据您的系统，重启 RKE2 服务。例如，systemctl restart rke2-server.service

4.2.5 确保 --streaming-connection-idle-timeout 参数未设置为 0（手动）

结果：PASS

Audit:

/bin/ps -fC kubelet

预期结果： '--streaming-connection-idle-timeout' 存在 或者 '--streaming-connection-idle-timeout' 不存在。

返回值： 
UID PID PPID C STIME TTY TIME CMD root 2592 2508 2 18:32 ? 00:00:41 kubelet --volume-plugin-dir=/var/lib/kubelet/volumeplugins --file-check-frequency=5s --sync-frequency=30s --address=0.0.0.0 --anonymous-auth=false --authentication-token-webhook=true --authorization-mode=Webhook --cgroup-driver=systemd --client-ca-file=/var/lib/rancher/rke2/agent/client-ca.crt --cloud-provider=external --cluster-dns=10.43.0.10 --cluster-domain=cluster.local --container-runtime-endpoint=unix:///run/k3s/containerd/containerd.sock --containerd=/run/k3s/containerd/containerd.sock --eviction-hard=imagefs.available<5%,nodefs.available<5% --eviction-minimum-reclaim=imagefs.available=10%,nodefs.available=10% --fail-swap-on=false --feature-gates=CloudDualStackNodeIPs=true --healthz-bind-address=127.0.0.1 --hostname-override=server-0 --kubeconfig=/var/lib/rancher/rke2/agent/kubelet.kubeconfig --node-ip=10.10.10.100 --node-labels= --pod-infra-container-image=index.docker.io/rancher/mirrored-pause:3.6 --pod-manifest-path=/var/lib/rancher/rke2/agent/pod-manifests --protect-kernel-defaults=true --read-only-port=0 --resolv-conf=/run/systemd/resolve/resolv.conf --serialize-image-pulls=false --tls-cert-file=/var/lib/rancher/rke2/agent/serving-kubelet.crt --tls-private-key-file=/var/lib/rancher/rke2/agent/serving-kubelet.key
修正：

编辑 RKE2 配置文件 /etc/rancher/rke2/config.yaml，将以下参数设置为适当的值。

kubelet-arg: - "streaming-connection-idle-timeout=5m"

根据您的系统，重启 RKE2 服务。例如，systemctl restart rke2-server.service

4.2.6 确保 --make-iptables-util-chains 参数设置为 true（自动化）

结果：PASS

Audit:

/bin/ps -fC kubelet

预期结果： '--make-iptables-util-chains' 存在 或者 '--make-iptables-util-chains' 不存在。

返回值： 
UID PID PPID C STIME TTY TIME CMD root 2592 2508 2 18:32 ? 00:00:41 kubelet --volume-plugin-dir=/var/lib/kubelet/volumeplugins --file-check-frequency=5s --sync-frequency=30s --address=0.0.0.0 --anonymous-auth=false --authentication-token-webhook=true --authorization-mode=Webhook --cgroup-driver=systemd --client-ca-file=/var/lib/rancher/rke2/agent/client-ca.crt --cloud-provider=external --cluster-dns=10.43.0.10 --cluster-domain=cluster.local --container-runtime-endpoint=unix:///run/k3s/containerd/containerd.sock --containerd=/run/k3s/containerd/containerd.sock --eviction-hard=imagefs.available<5%,nodefs.available<5% --eviction-minimum-reclaim=imagefs.available=10%,nodefs.available=10% --fail-swap-on=false --feature-gates=CloudDualStackNodeIPs=true --healthz-bind-address=127.0.0.1 --hostname-override=server-0 --kubeconfig=/var/lib/rancher/rke2/agent/kubelet.kubeconfig --node-ip=10.10.10.100 --node-labels= --pod-infra-container-image=index.docker.io/rancher/mirrored-pause:3.6 --pod-manifest-path=/var/lib/rancher/rke2/agent/pod-manifests --protect-kernel-defaults=true --read-only-port=0 --resolv-conf=/run/systemd/resolve/resolv.conf --serialize-image-pulls=false --tls-cert-file=/var/lib/rancher/rke2/agent/serving-kubelet.crt --tls-private-key-file=/var/lib/rancher/rke2/agent/serving-kubelet.key
修正：

编辑 RKE2 配置文件 /etc/rancher/rke2/config.yaml，设置以下参数。

kubelet-arg: - "make-iptables-util-chains=true"

或者，去除 --make-iptables-util-chains 参数以让 RKE2 使用默认值。根据您的系统，重启 RKE2 服务。例如，systemctl restart rke2-server.service

4.2.7 确保未设置 --hostname-override 参数（自动化）

结果：不适用

说明：默认情况下，RKE2 会设置 --hostname-override 参数。根据 CIS 指南，这是为了遵守要求此标志的云服务提供商，以确保主机名与节点名称匹配。

4.2.8 确保 eventRecordQPS 参数设置为确保适当事件捕获的级别（手动）

结果：PASS

Audit:

/bin/ps -fC kubelet

预期结果： '--event-qps' 存在 或者 '--event-qps' 不存在。

返回值： 
UID PID PPID C STIME TTY TIME CMD root 2592 2508 2 18:32 ? 00:00:41 kubelet --volume-plugin-dir=/var/lib/kubelet/volumeplugins --file-check-frequency=5s --sync-frequency=30s --address=0.0.0.0 --anonymous-auth=false --authentication-token-webhook=true --authorization-mode=Webhook --cgroup-driver=systemd --client-ca-file=/var/lib/rancher/rke2/agent/client-ca.crt --cloud-provider=external --cluster-dns=10.43.0.10 --cluster-domain=cluster.local --container-runtime-endpoint=unix:///run/k3s/containerd/containerd.sock --containerd=/run/k3s/containerd/containerd.sock --eviction-hard=imagefs.available<5%,nodefs.available<5% --eviction-minimum-reclaim=imagefs.available=10%,nodefs.available=10% --fail-swap-on=false --feature-gates=CloudDualStackNodeIPs=true --healthz-bind-address=127.0.0.1 --hostname-override=server-0 --kubeconfig=/var/lib/rancher/rke2/agent/kubelet.kubeconfig --node-ip=10.10.10.100 --node-labels= --pod-infra-container-image=index.docker.io/rancher/mirrored-pause:3.6 --pod-manifest-path=/var/lib/rancher/rke2/agent/pod-manifests --protect-kernel-defaults=true --read-only-port=0 --resolv-conf=/run/systemd/resolve/resolv.conf --serialize-image-pulls=false --tls-cert-file=/var/lib/rancher/rke2/agent/serving-kubelet.crt --tls-private-key-file=/var/lib/rancher/rke2/agent/serving-kubelet.key
修正：

编辑 RKE2 配置文件 /etc/rancher/rke2/config.yaml，将以下参数设置为适当的值。

kubelet-arg: - "event-qps=+++<value>+++"

根据您的系统，重启 RKE2 服务。例如，systemctl restart rke2-server.service

4.2.9 确保 --tls-cert-file 和 --tls-private-key-file 参数设置为适当值（自动化）

结果：PASS

Audit:

/bin/ps -fC kubelet

预期结果: '--tls-cert-file' 存在并且 '--tls-private-key-file' 存在

返回值： 
UID PID PPID C STIME TTY TIME CMD root 2592 2508 2 18:32 ? 00:00:41 kubelet --volume-plugin-dir=/var/lib/kubelet/volumeplugins --file-check-frequency=5s --sync-frequency=30s --address=0.0.0.0 --anonymous-auth=false --authentication-token-webhook=true --authorization-mode=Webhook --cgroup-driver=systemd --client-ca-file=/var/lib/rancher/rke2/agent/client-ca.crt --cloud-provider=external --cluster-dns=10.43.0.10 --cluster-domain=cluster.local --container-runtime-endpoint=unix:///run/k3s/containerd/containerd.sock --containerd=/run/k3s/containerd/containerd.sock --eviction-hard=imagefs.available<5%,nodefs.available<5% --eviction-minimum-reclaim=imagefs.available=10%,nodefs.available=10% --fail-swap-on=false --feature-gates=CloudDualStackNodeIPs=true --healthz-bind-address=127.0.0.1 --hostname-override=server-0 --kubeconfig=/var/lib/rancher/rke2/agent/kubelet.kubeconfig --node-ip=10.10.10.100 --node-labels= --pod-infra-container-image=index.docker.io/rancher/mirrored-pause:3.6 --pod-manifest-path=/var/lib/rancher/rke2/agent/pod-manifests --protect-kernel-defaults=true --read-only-port=0 --resolv-conf=/run/systemd/resolve/resolv.conf --serialize-image-pulls=false --tls-cert-file=/var/lib/rancher/rke2/agent/serving-kubelet.crt --tls-private-key-file=/var/lib/rancher/rke2/agent/serving-kubelet.key
修正：

默认情况下，RKE2 会自动提供 Kubelet 的 TLS 证书和私钥。它们生成后存放在 /var/lib/rancher/rke2/agent/serving-kubelet.crt 和 /var/lib/rancher/rke2/agent/serving-kubelet.key。如果此检查失败，请编辑 RKE2 配置文件 /etc/rancher/rke2/config.yaml，去除任何类似于以下内容的行。

kubelet-arg: - "tls-cert-file=<path/to/tls-cert-file>" - "tls-private-key-file=<path/to/tls-private-key-file>"

4.2.10 确保 --rotate-certificates 参数未设置为 false（自动化）

结果：PASS

Audit:

/bin/ps -fC kubelet

预期结果: '--rotate-certificates' 存在 或 '--rotate-certificates' 不存在

返回值： 
UID PID PPID C STIME TTY TIME CMD root 2592 2508 2 18:32 ? 00:00:41 kubelet --volume-plugin-dir=/var/lib/kubelet/volumeplugins --file-check-frequency=5s --sync-frequency=30s --address=0.0.0.0 --anonymous-auth=false --authentication-token-webhook=true --authorization-mode=Webhook --cgroup-driver=systemd --client-ca-file=/var/lib/rancher/rke2/agent/client-ca.crt --cloud-provider=external --cluster-dns=10.43.0.10 --cluster-domain=cluster.local --container-runtime-endpoint=unix:///run/k3s/containerd/containerd.sock --containerd=/run/k3s/containerd/containerd.sock --eviction-hard=imagefs.available<5%,nodefs.available<5% --eviction-minimum-reclaim=imagefs.available=10%,nodefs.available=10% --fail-swap-on=false --feature-gates=CloudDualStackNodeIPs=true --healthz-bind-address=127.0.0.1 --hostname-override=server-0 --kubeconfig=/var/lib/rancher/rke2/agent/kubelet.kubeconfig --node-ip=10.10.10.100 --node-labels= --pod-infra-container-image=index.docker.io/rancher/mirrored-pause:3.6 --pod-manifest-path=/var/lib/rancher/rke2/agent/pod-manifests --protect-kernel-defaults=true --read-only-port=0 --resolv-conf=/run/systemd/resolve/resolv.conf --serialize-image-pulls=false --tls-cert-file=/var/lib/rancher/rke2/agent/serving-kubelet.crt --tls-private-key-file=/var/lib/rancher/rke2/agent/serving-kubelet.key
修正：

默认情况下，RKE2 不会设置 --rotate-certificates 参数。如果此检查失败，请编辑 RKE2 配置文件 /etc/rancher/rke2/config.yaml，去除任何 rotate-certificates 参数。根据您的系统，重启 RKE2 服务。例如，systemctl restart rke2-server.service

4.2.11 验证 RotateKubeletServerCertificate 参数是否设置为 true（自动化）

结果：PASS

Audit:

/bin/ps -fC kubelet

预期结果:'RotateKubeletServerCertificate' 存在 或者 'RotateKubeletServerCertificate' 不存在

返回值： 
UID PID PPID C STIME TTY TIME CMD root 2592 2508 2 18:32 ? 00:00:41 kubelet --volume-plugin-dir=/var/lib/kubelet/volumeplugins --file-check-frequency=5s --sync-frequency=30s --address=0.0.0.0 --anonymous-auth=false --authentication-token-webhook=true --authorization-mode=Webhook --cgroup-driver=systemd --client-ca-file=/var/lib/rancher/rke2/agent/client-ca.crt --cloud-provider=external --cluster-dns=10.43.0.10 --cluster-domain=cluster.local --container-runtime-endpoint=unix:///run/k3s/containerd/containerd.sock --containerd=/run/k3s/containerd/containerd.sock --eviction-hard=imagefs.available<5%,nodefs.available<5% --eviction-minimum-reclaim=imagefs.available=10%,nodefs.available=10% --fail-swap-on=false --feature-gates=CloudDualStackNodeIPs=true --healthz-bind-address=127.0.0.1 --hostname-override=server-0 --kubeconfig=/var/lib/rancher/rke2/agent/kubelet.kubeconfig --node-ip=10.10.10.100 --node-labels= --pod-infra-container-image=index.docker.io/rancher/mirrored-pause:3.6 --pod-manifest-path=/var/lib/rancher/rke2/agent/pod-manifests --protect-kernel-defaults=true --read-only-port=0 --resolv-conf=/run/systemd/resolve/resolv.conf --serialize-image-pulls=false --tls-cert-file=/var/lib/rancher/rke2/agent/serving-kubelet.crt --tls-private-key-file=/var/lib/rancher/rke2/agent/serving-kubelet.key
修正：

默认情况下，RKE2 不会设置 RotateKubeletServerCertificate 功能开关。如果此检查失败，请编辑 RKE2 配置文件 /etc/rancher/rke2/config.yaml，去除任何 RotateKubeletServerCertificate 参数。根据您的系统，重启 RKE2 服务。例如，systemctl restart rke2-server.service

4.2.12 确保 Kubelet 仅使用强加密套件（手动）

结果：警告

修正：编辑 RKE2 配置文件 /etc/rancher/rke2/config.yaml，

kubelet-arg: - "tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305"

或这些值的子集。根据您的系统，重启 RKE2 服务。例如，systemctl restart rke2-server.service

4.2.13 确保对 pod PIDs 设置了限制（手动）

结果：警告

修正：编辑 RKE2 配置文件 /etc/rancher/rke2/config.yaml，将以下参数设置为适当值。

kubelet-arg: - "pod-max-pids=+++<value>+++"

根据您的系统，重启 RKE2 服务。例如，systemctl restart rke2-server.service

4.3 kube-proxy

4.3.1 确保 kube-proxy 指标服务绑定到 localhost（自动化）

结果：PASS

Audit:

/bin/ps -fC kube-proxy

预期结果： '--metrics-bind-address' 存在 或者 '--metrics-bind-address' 不存在

返回值： 
UID PID PPID C STIME TTY TIME CMD root 2730 2644 0 18:32 ? 00:00:01 kube-proxy --cluster-cidr=10.42.0.0/16 --conntrack-max-per-core=0 --conntrack-tcp-timeout-close-wait=0s --conntrack-tcp-timeout-established=0s --healthz-bind-address=127.0.0.1 --hostname-override=server-0 --kubeconfig=/var/lib/rancher/rke2/agent/kubeproxy.kubeconfig --proxy-mode=iptables
修正：

修改或删除任何将指标服务绑定到非 localhost 地址的值。默认值为 127.0.0.1:10249。

5 Kubernetes 策略

5.1 RBAC 和服务账户

5.1.1 确保仅在需要时使用 cluster-admin 角色（自动化）

结果：PASS

Audit:

kubectl get clusterrolebindings -o=custom-columns=ROLE:.roleRef.name,NAME:.metadata.name,SUBJECT:.subjects[*].name --no-headers | grep cluster-admin

预期结果： 'cluster-admin' 与正则表达式 'cluster-admin|helm-kube-system-rke2-.*' 匹配。

返回值： 
cluster-admin cluster-admin system:masters cluster-admin helm-kube-system-rke2-canal helm-rke2-canal cluster-admin helm-kube-system-rke2-coredns helm-rke2-coredns cluster-admin helm-kube-system-rke2-ingress-nginx helm-rke2-ingress-nginx cluster-admin helm-kube-system-rke2-metrics-server helm-rke2-metrics-server cluster-admin helm-kube-system-rke2-snapshot-controller helm-rke2-snapshot-controller cluster-admin helm-kube-system-rke2-snapshot-controller-crd helm-rke2-snapshot-controller-crd cluster-admin helm-kube-system-rke2-snapshot-validation-webhook helm-rke2-snapshot-validation-webhook
修正：

识别所有与 cluster-admin 角色相关的 clusterrolebindings。检查它们是否被使用，以及是否需要此角色，或者是否可以使用权限更少的角色。RKE2 对 helm-kube-system-rke2-* clusterrolebindings 给予例外，这些绑定处理所有 RKE2 管理组件的安装。在可能的情况下，首先将用户绑定到权限较低的角色，然后去除对 cluster-admin 角色的 clusterrolebinding：

kubectl delete clusterrolebinding [name]

5.1.2 最小化对机密的访问（自动化）

结果：警告

修正：在可能的情况下，去除对集群中 Secret 对象的获取、列出和监视访问。

5.1.3 最小化角色和集群角色中的通配符使用（自动化）

结果：PASS

Audit:

# Check Roles kubectl get roles --all-namespaces -o custom-columns=ROLE_NAMESPACE:.metadata.namespace,ROLE_NAME:.metadata.name --no-headers | while read -r role_namespace role_name do role_rules=$(kubectl get role -n "$\{role_namespace}" "$\{role_name}" -o=json | jq -c '.rules') if echo "$\{role_rules}" | grep -q "\[\"\*\"\]"; then printf "**role_name: %-50s role_namespace: %-25s role_rules: %s is_compliant: false\n" "$\{role_name}" "$\{role_namespace}" "$\{role_rules}" else printf "**role_name: %-50s role_namespace: %-25s is_compliant: true\n" "$\{role_name}" "$\{role_namespace}" fi; done cr_whitelist="cluster-admin rke2-cloud-controller-manager local-path-provisioner-role" cr_whitelist="$cr_whitelist system:kube-controller-manager system:kubelet-api-admin system:controller:namespace-controller" cr_whitelist="$cr_whitelist system:controller:disruption-controller system:controller:generic-garbage-collector" cr_whitelist="$cr_whitelist system:controller:horizontal-pod-autoscaler system:controller:resourcequota-controller" # Check ClusterRoles kubectl get clusterroles -o custom-columns=CLUSTERROLE_NAME:.metadata.name --no-headers | while read -r clusterrole_name do clusterrole_rules=$(kubectl get clusterrole "$\{clusterrole_name}" -o=json | jq -c '.rules') if echo "$\{cr_whitelist}" | grep -q "$\{clusterrole_name}"; then printf "**clusterrole_name: %-50s is_whitelist: true is_compliant: true\n" "$\{clusterrole_name}" elif echo "$\{clusterrole_rules}" | grep -q "\[\"\*\"\]"; then echo "**clusterrole_name: $\{clusterrole_name} clusterrole_rules: $\{clusterrole_rules} is_compliant: false" else printf "**clusterrole_name: %-50s is_whitelist: false is_compliant: true\n" "$\{clusterrole_name}" fi; done

预期结果： 'is_compliant' 等于 'true'

返回值： 
**role_name: system:controller:bootstrap-signer role_namespace: kube-public is_compliant: true **role_name: extension-apiserver-authentication-reader role_namespace: kube-system is_compliant: true **role_name: rke2-ingress-nginx role_namespace: kube-system is_compliant: true **role_name: rke2-snapshot-controller role_namespace: kube-system is_compliant: true **role_name: system::leader-locking-kube-controller-manager role_namespace: kube-system is_compliant: true **role_name: system::leader-locking-kube-scheduler role_namespace: kube-system is_compliant: true **role_name: system:controller:bootstrap-signer role_namespace: kube-system is_compliant: true **role_name: system:controller:cloud-provider role_namespace: kube-system is_compliant: true **role_name: system:controller:token-cleaner role_namespace: kube-system is_compliant: true **clusterrole_name: admin is_whitelist: true is_compliant: true **clusterrole_name: calico-node is_whitelist: false is_compliant: true **clusterrole_name: cluster-admin is_whitelist: true is_compliant: true **clusterrole_name: edit is_whitelist: false is_compliant: true **clusterrole_name: flannel is_whitelist: false is_compliant: true **clusterrole_name: rke2-cloud-controller-manager is_whitelist: true is_compliant: true **clusterrole_name: rke2-coredns-rke2-coredns is_whitelist: false is_compliant: true **clusterrole_name: rke2-coredns-rke2-coredns-autoscaler is_whitelist: false is_compliant: true **clusterrole_name: rke2-ingress-nginx is_whitelist: false is_compliant: true **clusterrole_name: rke2-snapshot-controller is_whitelist: false is_compliant: true **clusterrole_name: rke2-snapshot-validation-webhook is_whitelist: false is_compliant: true **clusterrole_name: system:aggregate-to-admin is_whitelist: false is_compliant: true **clusterrole_name: system:aggregate-to-edit is_whitelist: false is_compliant: true **clusterrole_name: system:aggregate-to-view is_whitelist: false is_compliant: true **clusterrole_name: system:auth-delegator is_whitelist: false is_compliant: true **clusterrole_name: system:basic-user is_whitelist: false is_compliant: true **clusterrole_name: system:certificates.k8s.io:certificatesigningrequests:nodeclient is_whitelist: false is_compliant: true **clusterrole_name: system:certificates.k8s.io:certificatesigningrequests:selfnodeclient is_whitelist: false is_compliant: true **clusterrole_name: system:certificates.k8s.io:kube-apiserver-client-approver is_whitelist: false is_compliant: true **clusterrole_name: system:certificates.k8s.io:kube-apiserver-client-kubelet-approver is_whitelist: false is_compliant: true **clusterrole_name: system:certificates.k8s.io:kubelet-serving-approver is_whitelist: false is_compliant: true **clusterrole_name: system:certificates.k8s.io:legacy-unknown-approver is_whitelist: false is_compliant: true **clusterrole_name: system:controller:attachdetach-controller is_whitelist: false is_compliant: true **clusterrole_name: system:controller:certificate-controller is_whitelist: false is_compliant: true **clusterrole_name: system:controller:clusterrole-aggregation-controller is_whitelist: false is_compliant: true **clusterrole_name: system:controller:cronjob-controller is_whitelist: false is_compliant: true **clusterrole_name: system:controller:daemon-set-controller is_whitelist: false is_compliant: true **clusterrole_name: system:controller:deployment-controller is_whitelist: false is_compliant: true **clusterrole_name: system:controller:disruption-controller is_whitelist: true is_compliant: true **clusterrole_name: system:controller:endpoint-controller is_whitelist: false is_compliant: true **clusterrole_name: system:controller:endpointslice-controller is_whitelist: false is_compliant: true **clusterrole_name: system:controller:endpointslicemirroring-controller is_whitelist: false is_compliant: true **clusterrole_name: system:controller:ephemeral-volume-controller is_whitelist: false is_compliant: true **clusterrole_name: system:controller:expand-controller is_whitelist: false is_compliant: true **clusterrole_name: system:controller:generic-garbage-collector is_whitelist: true is_compliant: true **clusterrole_name: system:controller:horizontal-pod-autoscaler is_whitelist: true is_compliant: true **clusterrole_name: system:controller:job-controller is_whitelist: false is_compliant: true **clusterrole_name: system:controller:namespace-controller is_whitelist: true is_compliant: true **clusterrole_name: system:controller:node-controller is_whitelist: false is_compliant: true **clusterrole_name: system:controller:persistent-volume-binder is_whitelist: false is_compliant: true **clusterrole_name: system:controller:pod-garbage-collector is_whitelist: false is_compliant: true **clusterrole_name: system:controller:pv-protection-controller is_whitelist: false is_compliant: true **clusterrole_name: system:controller:pvc-protection-controller is_whitelist: false is_compliant: true **clusterrole_name: system:controller:replicaset-controller is_whitelist: false is_compliant: true **clusterrole_name: system:controller:replication-controller is_whitelist: false is_compliant: true **clusterrole_name: system:controller:resourcequota-controller is_whitelist: true is_compliant: true **clusterrole_name: system:controller:root-ca-cert-publisher is_whitelist: false is_compliant: true **clusterrole_name: system:controller:route-controller is_whitelist: false is_compliant: true **clusterrole_name: system:controller:service-account-controller is_whitelist: false is_compliant: true **clusterrole_name: system:controller:service-controller is_whitelist: false is_compliant: true **clusterrole_name: system:controller:statefulset-controller is_whitelist: false is_compliant: true **clusterrole_name: system:controller:ttl-after-finished-controller is_whitelist: false is_compliant: true **clusterrole_name: system:controller:ttl-controller is_whitelist: false is_compliant: true **clusterrole_name: system:discovery is_whitelist: false is_compliant: true **clusterrole_name: system:heapster is_whitelist: false is_compliant: true **clusterrole_name: system:kube-aggregator is_whitelist: false is_compliant: true **clusterrole_name: system:kube-controller-manager is_whitelist: true is_compliant: true **clusterrole_name: system:kube-dns is_whitelist: false is_compliant: true **clusterrole_name: system:kube-proxy is_whitelist: false is_compliant: true **clusterrole_name: system:kube-scheduler is_whitelist: false is_compliant: true **clusterrole_name: system:kubelet-api-admin is_whitelist: true is_compliant: true **clusterrole_name: system:monitoring is_whitelist: false is_compliant: true **clusterrole_name: system:node is_whitelist: false is_compliant: true **clusterrole_name: system:node-bootstrapper is_whitelist: false is_compliant: true **clusterrole_name: system:node-problem-detector is_whitelist: false is_compliant: true **clusterrole_name: system:node-proxier is_whitelist: false is_compliant: true **clusterrole_name: system:persistent-volume-provisioner is_whitelist: false is_compliant: true **clusterrole_name: system:public-info-viewer is_whitelist: false is_compliant: true **clusterrole_name: system:rke2-controller is_whitelist: false is_compliant: true **clusterrole_name: system:rke2-metrics-server is_whitelist: false is_compliant: true **clusterrole_name: system:rke2-metrics-server-aggregated-reader is_whitelist: false is_compliant: true **clusterrole_name: system:service-account-issuer-discovery is_whitelist: false is_compliant: true **clusterrole_name: system:volume-scheduler is_whitelist: false is_compliant: true **clusterrole_name: view is_whitelist: false is_compliant: true
修正：

在可能的情况下，将集群角色和角色中的任何通配符使用替换为特定对象或操作。RKE2 对以下集群角色给予例外，这些角色是常规操作所必需的： - rke2-cloud-controller-manager, local-path-provisioner-role, cluster-admin - system:kube-controller-manager, system:kubelet-api-admin, system:controller:namespace-controller, - system:controller:disruption-controller, system:controller:generic-garbage-collector, - system:controller:horizontal-pod-autoscaler, system:controller:resourcequota-controller

5.1.4 最小化对创建 Pod 的访问（自动化）

结果：警告

修正：在可能的情况下，去除对集群中 Pod 对象的创建访问。

5.1.5 确保默认服务账户未被积极使用。（自动化）

结果：PASS

Audit:

kubectl get serviceaccounts --all-namespaces --field-selector metadata.name=default \ -o custom-columns=N:.metadata.namespace,SA:.metadata.name,ASA:.automountServiceAccountToken --no-headers \ | while read -r namespace serviceaccount automountserviceaccounttoken do if [ "$\{automountserviceaccounttoken}" = "+++<none>+++" ]; then automountserviceaccounttoken="notset" fi if [ "$\{namespace}" != "kube-system" ] && [ "$\{automountserviceaccounttoken}" != "false" ]; then printf "**namespace: %-20s service_account: %-10s automountServiceAccountToken: %-6s is_compliant: false\n" "$\{namespace}" "$\{serviceaccount}" "$\{automountserviceaccounttoken}" else printf "**namespace: %-20s service_account: %-10s automountServiceAccountToken: %-6s is_compliant: true\n" "$\{namespace}" "$\{serviceaccount}" "$\{automountserviceaccounttoken}" fi done

预期结果： 'is_compliant' 等于 'true'

返回值： 
**namespace: default service_account: default automountServiceAccountToken: false is_compliant: true **namespace: kube-node-lease service_account: default automountServiceAccountToken: false is_compliant: true **namespace: kube-public service_account: default automountServiceAccountToken: false is_compliant: true **namespace: kube-system service_account: default automountServiceAccountToken: false is_compliant: true
修正：

在 Kubernetes 工作负载需要特定访问 Kubernetes API 服务器的地方创建显式服务帐户。修改每个默认服务账户的配置，以包含此值 automountServiceAccountToken: false 或使用 kubectl：

kubectl patch serviceaccount --namespace <NAMESPACE> default --patch '{"automountServiceAccountToken": false}'

5.1.6 确保服务账户令牌仅在必要时挂载（自动化）

结果：PASS

Audit:

kubectl get pods --all-namespaces -o custom-columns=POD_NAMESPACE:.metadata.namespace,POD_NAME:.metadata.name,POD_SERVICE_ACCOUNT:.spec.serviceAccount,POD_IS_AUTOMOUNTSERVICEACCOUNTTOKEN:.spec.automountServiceAccountToken --no-headers | while read -r pod_namespace pod_name pod_service_account pod_is_automountserviceaccounttoken do # Skip pods with no service account if [ "$\{pod_service_account}" = "+++<none>+++" ]; then continue fi # Retrieve automountServiceAccountToken's value for ServiceAccount and Pod, set to notset if null or +++<none>+++. svacc_is_automountserviceaccounttoken=$(kubectl get serviceaccount -n "$\{pod_namespace}" "$\{pod_service_account}" -o json | jq -r '.automountServiceAccountToken' | sed -e 's/+++<none>+++/notset/g' -e 's/null/notset/g') pod_is_automountserviceaccounttoken=$(echo "$\{pod_is_automountserviceaccounttoken}" | sed -e 's/+++<none>+++/notset/g' -e 's/null/notset/g') if [ "$\{svacc_is_automountserviceaccounttoken}" = "false" ] && ( [ "$\{pod_is_automountserviceaccounttoken}" = "false" ] || [ "$\{pod_is_automountserviceaccounttoken}" = "notset" ] ); then is_compliant="true" elif [ "$\{svacc_is_automountserviceaccounttoken}" = "true" ] && [ "$\{pod_is_automountserviceaccounttoken}" = "false" ]; then is_compliant="true" else is_compliant="false" fi # Whitelist kube-system namespace as these pods are expected to contact the apiserver if [ "$\{pod_namespace}" = "kube-system" ]; then is_compliant="true" fi echo "**namespace: $\{pod_namespace} pod_name: $\{pod_name} service_account: $\{pod_service_account} pod_is_automountserviceaccounttoken: $\{pod_is_automountserviceaccounttoken} svacc_is_automountServiceAccountToken: $\{svacc_is_automountserviceaccounttoken} is_compliant: $\{is_compliant}" done

预期结果： 'is_compliant' 等于 'true'

返回值： 
**namespace: kube-system pod_name: helm-install-rke2-canal-sf57z service_account: helm-rke2-canal pod_is_automountserviceaccounttoken: notset svacc_is_automountServiceAccountToken: true is_compliant: true **namespace: kube-system pod_name: helm-install-rke2-coredns-sc5xz service_account: helm-rke2-coredns pod_is_automountserviceaccounttoken: notset svacc_is_automountServiceAccountToken: true is_compliant: true **namespace: kube-system pod_name: helm-install-rke2-ingress-nginx-khgxr service_account: helm-rke2-ingress-nginx pod_is_automountserviceaccounttoken: notset svacc_is_automountServiceAccountToken: true is_compliant: true **namespace: kube-system pod_name: helm-install-rke2-metrics-server-s7drs service_account: helm-rke2-metrics-server pod_is_automountserviceaccounttoken: notset svacc_is_automountServiceAccountToken: true is_compliant: true **namespace: kube-system pod_name: helm-install-rke2-snapshot-controller-crd-vdm6s service_account: helm-rke2-snapshot-controller-crd pod_is_automountserviceaccounttoken: notset svacc_is_automountServiceAccountToken: true is_compliant: true **namespace: kube-system pod_name: helm-install-rke2-snapshot-controller-f9mkz service_account: helm-rke2-snapshot-controller pod_is_automountserviceaccounttoken: notset svacc_is_automountServiceAccountToken: true is_compliant: true **namespace: kube-system pod_name: helm-install-rke2-snapshot-validation-webhook-66gdl service_account: helm-rke2-snapshot-validation-webhook pod_is_automountserviceaccounttoken: notset svacc_is_automountServiceAccountToken: true is_compliant: true **namespace: kube-system pod_name: rke2-canal-cv8xl service_account: canal pod_is_automountserviceaccounttoken: notset svacc_is_automountServiceAccountToken: notset is_compliant: true **namespace: kube-system pod_name: rke2-coredns-rke2-coredns-864fbd7785-tlfwz service_account: coredns pod_is_automountserviceaccounttoken: notset svacc_is_automountServiceAccountToken: notset is_compliant: true **namespace: kube-system pod_name: rke2-coredns-rke2-coredns-autoscaler-6c87968579-k2kf8 service_account: rke2-coredns-rke2-coredns-autoscaler pod_is_automountserviceaccounttoken: notset svacc_is_automountServiceAccountToken: notset is_compliant: true **namespace: kube-system pod_name: rke2-ingress-nginx-controller-4mq9l service_account: rke2-ingress-nginx pod_is_automountserviceaccounttoken: notset svacc_is_automountServiceAccountToken: true is_compliant: true **namespace: kube-system pod_name: rke2-metrics-server-7f745dbddf-96zw8 service_account: rke2-metrics-server pod_is_automountserviceaccounttoken: notset svacc_is_automountServiceAccountToken: notset is_compliant: true **namespace: kube-system pod_name: rke2-snapshot-controller-7d6476d7cb-trhbn service_account: rke2-snapshot-controller pod_is_automountserviceaccounttoken: notset svacc_is_automountServiceAccountToken: notset is_compliant: true **namespace: kube-system pod_name: rke2-snapshot-validation-webhook-5649fbd66c-zrkf5 service_account: rke2-snapshot-validation-webhook pod_is_automountserviceaccounttoken: notset svacc_is_automountServiceAccountToken: notset is_compliant: true
修正：

修改不需要挂载服务账户令牌的 ServiceAccounts 和 Pods 的定义，以禁用该功能，使用 automountServiceAccountToken: false.RKE2 对 kube-system 名称空间中的 ServiceAccounts 给予例外，因为这些账户通常会与 apiserver 通信。在 cis 模式下，RKE2 禁用以下名称空间的 automountServiceAccountToken： - kube-public, default, kube-node-lease。如果 ServiceAccount 和 Pod 的 .spec 都指定了 automountServiceAccountToken 的值，则以 Pod 的 spec 为准。条件：当满足以下条件时，Pod 被视为合规： - ServiceAccount 的 automountServiceAccountToken 为 false，且 Pod 的 automountServiceAccountToken 为 false 或未设置 - ServiceAccount 的 automountServiceAccountToken 为 true/未设置，且 Pod 的 automountServiceAccountToken 为 false

5.1.7 避免使用 system:masters 组（手动）

结果：警告

修正:从集群中的所有用户中去除 system:masters 组。

5.1.8 限制在 Kubernetes 集群中使用 Bind、Impersonate 和 Escalate 权限（手动）

结果：警告

修正:在可能的情况下，从主体中去除 impersonate、bind 和 escalate 权利。

5.1.9 最小化对创建持久卷的访问（手动）

结果：警告

修正:在可能的情况下，去除对集群中 PersistentVolume 对象的创建访问。

5.1.10 最小化对节点的代理子资源的访问（手动）

结果：警告

修正:在可能的情况下，去除对节点对象的代理子资源的访问权限。

5.1.11 最小化对证书签名请求对象的审批子资源的访问权限（手动）

结果：警告

修正:在可能的情况下，去除对证书签名请求对象的审批子资源的访问权限。

5.1.12 最小化对网络钩子配置对象的访问权限（手动）

结果：警告

修正:在可能的情况下，去除对验证网络钩子配置或变更网络钩子配置对象的访问权限。

5.1.13 最小化对服务账户令牌创建的访问权限（手动）

结果：警告

修正:在可能的情况下，去除对服务账户对象的令牌子资源的访问权限。

5.2 Pod 安全标准

5.2.1 确保集群中至少有一个活动的策略控制机制（手动）

结果：警告

修正:确保每个包含用户工作负载的名称空间中都有 Pod 安全准入或外部策略控制系统。

5.2.2 最小化特权容器的准入（手动）

结果：警告

修正:为集群中每个包含用户工作负载的名称空间添加策略，以限制特权容器的准入。

5.2.3 最小化希望共享主机进程ID命名空间的容器的准入（手动）

结果：警告

修正:为集群中每个包含用户工作负载的名称空间添加策略，以限制`hostPID`容器的准入。

5.2.4 最小化希望共享主机IPC命名空间的容器的准入（手动）

结果：警告

修正:为集群中每个包含用户工作负载的名称空间添加策略，以限制`hostIPC`容器的准入。

5.2.5 最小化希望共享主机网络命名空间的容器的准入（手动）

结果：警告

修正:为集群中每个包含用户工作负载的名称空间添加策略，以限制`hostNetwork`容器的准入。

5.2.6 最小化允许特权提升的容器的准入（手动）

结果：警告

修正:为集群中每个包含用户工作负载的名称空间添加策略，以限制`.spec.allowPrivilegeEscalation`设置为`true`的容器的准入。

5.2.7 最小化根容器的准入（手动）

结果：警告

修正:为集群中的每个名称空间创建一个策略，确保`MustRunAsNonRoot`或`MustRunAs`的 UID 范围不包括 0。

5.2.8 最小化具有NET_RAW能力的容器的准入（手动）

结果：警告

修正:为集群中每个包含用户工作负载的名称空间添加策略，以限制具有`NET_RAW`能力的容器的准入。

5.2.9 最小化具有附加能力的容器的准入（手动）

结果：警告

修正:确保在集群的策略中不包含`allowedCapabilities`，除非将其设置为空数组。

5.2.10 最小化分配能力的容器的准入（手动）

结果：警告

修正：审查在您的集群上运行的应用程序中能力的使用。如果名称空间包含不需要任何 Linux 能力来运行的应用程序，请考虑添加一个 PSP，以禁止不丢弃所有能力的容器的准入。

5.2.11 最小化 Windows HostProcess 容器的准入（手动）

结果：警告

修正:为集群中每个包含用户工作负载的名称空间添加策略，以限制`.securityContext.windowsOptions.hostProcess`设置为`true`的容器的准入。

5.2.12 最小化 HostPath 卷的准入（手动）

结果：警告

修正:为集群中每个包含用户工作负载的名称空间添加策略，以限制具有`hostPath`卷的容器的准入。

5.2.13 最小化使用 HostPorts 的容器的准入（手动）

结果：警告

修正：为集群中具有用户工作负载的每个名称空间添加策略，以限制使用 hostPort 部分的容器的准入。

5.3 网络策略和 CNI

5.3.1 确保所使用的 CNI 支持网络策略（手动）

结果：警告

修正:如果所使用的 CNI 插件不支持网络策略，则应考虑使用其他插件，或寻找替代机制来限制 Kubernetes 集群中的流量。

5.3.2 确保所有名称空间都定义了网络策略（手动）

结果：警告

修正：按照文档创建所需的 NetworkPolicy 对象。

5.4 秘密管理

5.4.1 优先使用文件形式的 Secrets 而不是环境变量形式的 Secrets（手动）

结果：警告

修正:如果可能，重写应用程序代码以从挂载的秘密文件中读取 Secrets，而不是从环境变量中读取。

5.4.2 考虑使用外部 Secrets 存储（手动）

结果：警告

修正：请参考您的云服务提供商或第三方密钥管理解决方案所提供的密钥管理选项。

5.5 可扩展的准入控制

5.5.1 使用 ImagePolicyWebhook 准入控制器配置图像溯源（手动）

结果：警告

修正：遵循Kubernetes文档并设置镜像溯源。

5.7 一般策略

5.7.1 使用名称空间在资源之间创建管理边界（手动）

结果：警告

修正:遵循文档并根据需要为您的部署中的对象创建名称空间。

5.7.2 确保在您的 Pod 定义中将 seccomp 配置文件设置为 docker/default（手动）

结果：警告

修正：使用 securityContext 在您的 Pod 定义中启用 docker/default seccomp 配置文件。示例如下： securityContext: seccompProfile: type:RuntimeDefault

5.7.3 将SecurityContext应用于您的Pod和容器（手动）

结果：警告

修正：遵循 Kubernetes 文档并将 SecurityContexts 应用到您的 Pods。有关建议的 SecurityContexts 列表，您可以参考 CIS Docker 容器安全基准。

5.7.4 不应使用默认名称空间（手动）

结果：警告

修正：确保创建名称空间，以实现对Kubernetes资源的适当隔离，并确保所有新资源都在特定的名称空间中创建。