k3s-server-sample.json

{
  "platform": {
    "name": "centos",
    "release": "8.3.2011"
  },
  "profiles": [
    {
      "attributes": [],
      "controls": [
        {
          "code": "control 'V-242376' do\n  title \"The Kubernetes Controller Manager must use TLS 1.2, at a minimum, to\nprotect the confidentiality of sensitive data during electronic dissemination.\"\n  desc  \"The Kubernetes Controller Manager will prohibit the use of SSL and\nunauthorized versions of TLS protocols to properly secure communication.\n\n    The use of unsupported protocol exposes vulnerabilities to the Kubernetes\nby rogue traffic interceptions, man-in-the-middle attacks, and impersonation of\nusers or services from the container platform runtime, registry, and key store.\nTo enable the minimum version of TLS to be used by the Kubernetes Controller\nManager, the setting \\\"tls-min-version\\\" must be set.\n  \"\n  desc  'rationale', ''\n  desc  'check', \"\n    Change to the /etc/kubernetes/manifests/ directory on the Kubernetes Master\nNode. Run the command:\n\n    grep -i tls-min-version *\n\n    If the setting \\\"tls-min-version\\\" is not configured in the Kubernetes\nController Manager manifest file or it is set to \\\"VersionTLS10\\\" or\n\\\"VersionTLS11\\\", this is a finding.\n  \"\n  desc 'fix', \"Edit the Kubernetes Controller Manager manifest file in the\n/etc/kubernetes/manifests directory on the Kubernetes Master Node. Set the\nvalue of \\\"--tls-min-version\\\" to \\\"VersionTLS12\\\" or higher.\"\n  impact 0.5\n  tag severity: 'medium'\n  tag gtitle: 'SRG-APP-000014-CTR-000035'\n  tag gid: 'V-242376'\n  tag rid: 'SV-242376r712484_rule'\n  tag stig_id: 'CNTR-K8-000150'\n  tag fix_id: 'F-45609r712483_fix'\n  tag cci: ['CCI-000068']\n  tag nist: ['AC-17 (2)']\n\n  unless kube_controller_manager.exist?\n    impact 0.0\n    desc 'caveat', 'Kubernetes Controller Manager process is not running on the target.'\n  end\n\n  describe kube_controller_manager do\n    its('tls-min-version') { should_not be_nil }\n    its('tls-min-version') { should_not cmp 'VersionTLS10' }\n    its('tls-min-version') { should_not cmp 'VersionTLS11' }\n  end\nend\n",
          "desc": "The Kubernetes Controller Manager will prohibit the use of SSL and\nunauthorized versions of TLS protocols to properly secure communication.\n\n    The use of unsupported protocol exposes vulnerabilities to the Kubernetes\nby rogue traffic interceptions, man-in-the-middle attacks, and impersonation of\nusers or services from the container platform runtime, registry, and key store.\nTo enable the minimum version of TLS to be used by the Kubernetes Controller\nManager, the setting \"tls-min-version\" must be set.",
          "descriptions": [
            {
              "data": "The Kubernetes Controller Manager will prohibit the use of SSL and\nunauthorized versions of TLS protocols to properly secure communication.\n\n    The use of unsupported protocol exposes vulnerabilities to the Kubernetes\nby rogue traffic interceptions, man-in-the-middle attacks, and impersonation of\nusers or services from the container platform runtime, registry, and key store.\nTo enable the minimum version of TLS to be used by the Kubernetes Controller\nManager, the setting \"tls-min-version\" must be set.",
              "label": "default"
            },
            {
              "data": "",
              "label": "rationale"
            },
            {
              "data": "Change to the /etc/kubernetes/manifests/ directory on the Kubernetes Master\nNode. Run the command:\n\n    grep -i tls-min-version *\n\n    If the setting \"tls-min-version\" is not configured in the Kubernetes\nController Manager manifest file or it is set to \"VersionTLS10\" or\n\"VersionTLS11\", this is a finding.",
              "label": "check"
            },
            {
              "data": "Edit the Kubernetes Controller Manager manifest file in the\n/etc/kubernetes/manifests directory on the Kubernetes Master Node. Set the\nvalue of \"--tls-min-version\" to \"VersionTLS12\" or higher.",
              "label": "fix"
            }
          ],
          "id": "V-242376",
          "impact": 0.5,
          "refs": [],
          "results": [],
          "source_location": {
            "line": 3,
            "ref": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242376.rb"
          },
          "tags": {
            "cci": ["CCI-000068"],
            "fix_id": "F-45609r712483_fix",
            "gid": "V-242376",
            "gtitle": "SRG-APP-000014-CTR-000035",
            "nist": ["AC-17 (2)"],
            "rid": "SV-242376r712484_rule",
            "severity": "medium",
            "stig_id": "CNTR-K8-000150"
          },
          "title": "The Kubernetes Controller Manager must use TLS 1.2, at a minimum, to\nprotect the confidentiality of sensitive data during electronic dissemination.",
          "waiver_data": {}
        },
        {
          "code": "control 'V-242377' do\n  title \"The Kubernetes Scheduler must use TLS 1.2, at a minimum, to protect\nthe confidentiality of sensitive data during electronic dissemination.\"\n  desc  \"The Kubernetes Scheduler will prohibit the use of SSL and unauthorized\nversions of TLS protocols to properly secure communication.\n\n    The use of unsupported protocol exposes vulnerabilities to the Kubernetes\nby rogue traffic interceptions, man-in-the-middle attacks, and impersonation of\nusers or services from the container platform runtime, registry, and keystore.\nTo enable the minimum version of TLS to be used by the Kubernetes API Server,\nthe setting \\\"tls-min-version\\\" must be set.\n  \"\n  desc  'rationale', ''\n  desc  'check', \"\n    Change to the /etc/kubernetes/manifests/ directory on the Kubernetes Master\nNode. Run the command:\n\n    grep -i tls-min-version *\n\n    If the setting \\\"tls-min-version\\\" is not configured in the Kubernetes\nScheduler manifest file or it is set to \\\"VersionTLS10\\\" or \\\"VersionTLS11\\\",\nthis is a finding.\n  \"\n  desc 'fix', \"Edit the Kubernetes Scheduler manifest file in the\n/etc/kubernetes/manifests directory on the Kubernetes Master Node. Set the\nvalue of \\\"--tls-min-version\\\" to \\\"VersionTLS12\\\" or higher.\"\n  impact 0.5\n  tag severity: 'medium'\n  tag gtitle: 'SRG-APP-000014-CTR-000035'\n  tag gid: 'V-242377'\n  tag rid: 'SV-242377r712487_rule'\n  tag stig_id: 'CNTR-K8-000160'\n  tag fix_id: 'F-45610r712486_fix'\n  tag cci: ['CCI-000068']\n  tag nist: ['AC-17 (2)']\n\n  unless kube_scheduler.exist?\n    impact 0.0\n    desc 'caveat', 'Kubernetes Scheduler process is not running on the target.'\n  end\n\n  describe kube_scheduler do\n    its('tls-min-version') { should_not be_nil }\n    its('tls-min-version') { should_not cmp 'VersionTLS10' }\n    its('tls-min-version') { should_not cmp 'VersionTLS11' }\n  end\nend\n",
          "desc": "The Kubernetes Scheduler will prohibit the use of SSL and unauthorized\nversions of TLS protocols to properly secure communication.\n\n    The use of unsupported protocol exposes vulnerabilities to the Kubernetes\nby rogue traffic interceptions, man-in-the-middle attacks, and impersonation of\nusers or services from the container platform runtime, registry, and keystore.\nTo enable the minimum version of TLS to be used by the Kubernetes API Server,\nthe setting \"tls-min-version\" must be set.",
          "descriptions": [
            {
              "data": "The Kubernetes Scheduler will prohibit the use of SSL and unauthorized\nversions of TLS protocols to properly secure communication.\n\n    The use of unsupported protocol exposes vulnerabilities to the Kubernetes\nby rogue traffic interceptions, man-in-the-middle attacks, and impersonation of\nusers or services from the container platform runtime, registry, and keystore.\nTo enable the minimum version of TLS to be used by the Kubernetes API Server,\nthe setting \"tls-min-version\" must be set.",
              "label": "default"
            },
            {
              "data": "",
              "label": "rationale"
            },
            {
              "data": "Change to the /etc/kubernetes/manifests/ directory on the Kubernetes Master\nNode. Run the command:\n\n    grep -i tls-min-version *\n\n    If the setting \"tls-min-version\" is not configured in the Kubernetes\nScheduler manifest file or it is set to \"VersionTLS10\" or \"VersionTLS11\",\nthis is a finding.",
              "label": "check"
            },
            {
              "data": "Edit the Kubernetes Scheduler manifest file in the\n/etc/kubernetes/manifests directory on the Kubernetes Master Node. Set the\nvalue of \"--tls-min-version\" to \"VersionTLS12\" or higher.",
              "label": "fix"
            }
          ],
          "id": "V-242377",
          "impact": 0.5,
          "refs": [],
          "results": [],
          "source_location": {
            "line": 3,
            "ref": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242377.rb"
          },
          "tags": {
            "cci": ["CCI-000068"],
            "fix_id": "F-45610r712486_fix",
            "gid": "V-242377",
            "gtitle": "SRG-APP-000014-CTR-000035",
            "nist": ["AC-17 (2)"],
            "rid": "SV-242377r712487_rule",
            "severity": "medium",
            "stig_id": "CNTR-K8-000160"
          },
          "title": "The Kubernetes Scheduler must use TLS 1.2, at a minimum, to protect\nthe confidentiality of sensitive data during electronic dissemination.",
          "waiver_data": {}
        },
        {
          "code": "control 'V-242378' do\n  title \"The Kubernetes API Server must use TLS 1.2, at a minimum, to protect\nthe confidentiality of sensitive data during electronic dissemination.\"\n  desc  \"The Kubernetes API Server will prohibit the use of SSL and\nunauthorized versions of TLS protocols to properly secure communication.\n\n    The use of unsupported protocol exposes vulnerabilities to the Kubernetes\nby rogue traffic interceptions, man-in-the-middle attacks, and impersonation of\nusers or services from the container platform runtime, registry, and keystore.\nTo enable the minimum version of TLS to be used by the Kubernetes API Server,\nthe setting \\\"tls-min-version\\\" must be set.\n  \"\n  desc  'rationale', ''\n  desc  'check', \"\n    Change to the /etc/kubernetes/manifests directory on the Kubernetes Master\nNode. Run the command:\n\n    grep -i tls-min-version *\n\n    If the setting \\\"tls-min-version\\\" is not configured in the Kubernetes API\nServer manifest file or it is set to \\\"VersionTLS10\\\" or \\\"VersionTLS11\\\", this\nis a finding.\n  \"\n  desc 'fix', \"Edit the Kubernetes API Server manifest file in the\n/etc/kubernetes/manifests directory on the Kubernetes Master Node. Set the\nvalue of \\\"--tls-min-version\\\" to \\\"VersionTLS12\\\" or higher.\"\n  impact 0.5\n  tag severity: 'medium'\n  tag gtitle: 'SRG-APP-000014-CTR-000040'\n  tag gid: 'V-242378'\n  tag rid: 'SV-242378r712490_rule'\n  tag stig_id: 'CNTR-K8-000170'\n  tag fix_id: 'F-45611r712489_fix'\n  tag cci: ['CCI-000068']\n  tag nist: ['AC-17 (2)']\n\n  unless kube_apiserver.exist?\n    impact 0.0\n    desc 'caveat', 'Kubernetes API Server process is not running on the target.'\n  end\n\n  describe kube_apiserver do\n    its('tls-min-version') { should_not be_nil }\n    its('tls-min-version') { should_not cmp 'VersionTLS10' }\n    its('tls-min-version') { should_not cmp 'VersionTLS11' }\n  end\nend\n",
          "desc": "The Kubernetes API Server will prohibit the use of SSL and\nunauthorized versions of TLS protocols to properly secure communication.\n\n    The use of unsupported protocol exposes vulnerabilities to the Kubernetes\nby rogue traffic interceptions, man-in-the-middle attacks, and impersonation of\nusers or services from the container platform runtime, registry, and keystore.\nTo enable the minimum version of TLS to be used by the Kubernetes API Server,\nthe setting \"tls-min-version\" must be set.",
          "descriptions": [
            {
              "data": "The Kubernetes API Server will prohibit the use of SSL and\nunauthorized versions of TLS protocols to properly secure communication.\n\n    The use of unsupported protocol exposes vulnerabilities to the Kubernetes\nby rogue traffic interceptions, man-in-the-middle attacks, and impersonation of\nusers or services from the container platform runtime, registry, and keystore.\nTo enable the minimum version of TLS to be used by the Kubernetes API Server,\nthe setting \"tls-min-version\" must be set.",
              "label": "default"
            },
            {
              "data": "",
              "label": "rationale"
            },
            {
              "data": "Change to the /etc/kubernetes/manifests directory on the Kubernetes Master\nNode. Run the command:\n\n    grep -i tls-min-version *\n\n    If the setting \"tls-min-version\" is not configured in the Kubernetes API\nServer manifest file or it is set to \"VersionTLS10\" or \"VersionTLS11\", this\nis a finding.",
              "label": "check"
            },
            {
              "data": "Edit the Kubernetes API Server manifest file in the\n/etc/kubernetes/manifests directory on the Kubernetes Master Node. Set the\nvalue of \"--tls-min-version\" to \"VersionTLS12\" or higher.",
              "label": "fix"
            }
          ],
          "id": "V-242378",
          "impact": 0.5,
          "refs": [],
          "results": [],
          "source_location": {
            "line": 3,
            "ref": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242378.rb"
          },
          "tags": {
            "cci": ["CCI-000068"],
            "fix_id": "F-45611r712489_fix",
            "gid": "V-242378",
            "gtitle": "SRG-APP-000014-CTR-000040",
            "nist": ["AC-17 (2)"],
            "rid": "SV-242378r712490_rule",
            "severity": "medium",
            "stig_id": "CNTR-K8-000170"
          },
          "title": "The Kubernetes API Server must use TLS 1.2, at a minimum, to protect\nthe confidentiality of sensitive data during electronic dissemination.",
          "waiver_data": {}
        },
        {
          "code": "control 'V-242379' do\n  title \"The Kubernetes etcd must use TLS to protect the confidentiality of\nsensitive data during electronic dissemination.\"\n  desc  \"Kubernetes etcd will prohibit the use of SSL and unauthorized versions\nof TLS protocols to properly secure communication.\n\n    The use of unsupported protocol exposes vulnerabilities to the Kubernetes\nby rogue traffic interceptions, man-in-the-middle attacks, and impersonation of\nusers or services from the container platform runtime, registry, and keystore.\nTo enable the minimum version of TLS to be used by the Kubernetes API Server,\nthe setting \\\"tls-min-version\\\" must be set.\n  \"\n  desc  'rationale', ''\n  desc  'check', \"\n    Change to the /etc/kubernetes/manifests directory on the Kubernetes Master\nNode. Run the command:\n\n    grep -i  auto-tls *\n\n    If the setting \\\"auto-tls\\\" is not configured in the Kubernetes etcd\nmanifest file or it is set to true, this is a finding.\n  \"\n  desc 'fix', \"Edit the Kubernetes etcd manifest file in the\n/etc/kubernetes/manifests directory on the Kubernetes Master Node. Set the\nvalue of \\\"-auto-tls\\\" to \\\"false\\\".\"\n  impact 0.5\n  tag severity: 'medium'\n  tag gtitle: 'SRG-APP-000014-CTR-000035'\n  tag gid: 'V-242379'\n  tag rid: 'SV-242379r712493_rule'\n  tag stig_id: 'CNTR-K8-000180'\n  tag fix_id: 'F-45612r712492_fix'\n  tag cci: ['CCI-000068']\n  tag nist: ['AC-17 (2)']\n\n  if etcd.exist?\n    describe.one do\n      describe etcd do\n        its('auto-tls') { should cmp 'false' }\n      end\n\n      describe process_env_var('etcd') do\n        its(:ETCD_AUTO_TLS) { should cmp 'false' }\n      end\n    end\n  else\n    describe 'ETCD process is not running on the target.' do\n      skip\n    end\n  end\nend\n",
          "desc": "Kubernetes etcd will prohibit the use of SSL and unauthorized versions\nof TLS protocols to properly secure communication.\n\n    The use of unsupported protocol exposes vulnerabilities to the Kubernetes\nby rogue traffic interceptions, man-in-the-middle attacks, and impersonation of\nusers or services from the container platform runtime, registry, and keystore.\nTo enable the minimum version of TLS to be used by the Kubernetes API Server,\nthe setting \"tls-min-version\" must be set.",
          "descriptions": [
            {
              "data": "Kubernetes etcd will prohibit the use of SSL and unauthorized versions\nof TLS protocols to properly secure communication.\n\n    The use of unsupported protocol exposes vulnerabilities to the Kubernetes\nby rogue traffic interceptions, man-in-the-middle attacks, and impersonation of\nusers or services from the container platform runtime, registry, and keystore.\nTo enable the minimum version of TLS to be used by the Kubernetes API Server,\nthe setting \"tls-min-version\" must be set.",
              "label": "default"
            },
            {
              "data": "",
              "label": "rationale"
            },
            {
              "data": "Change to the /etc/kubernetes/manifests directory on the Kubernetes Master\nNode. Run the command:\n\n    grep -i  auto-tls *\n\n    If the setting \"auto-tls\" is not configured in the Kubernetes etcd\nmanifest file or it is set to true, this is a finding.",
              "label": "check"
            },
            {
              "data": "Edit the Kubernetes etcd manifest file in the\n/etc/kubernetes/manifests directory on the Kubernetes Master Node. Set the\nvalue of \"-auto-tls\" to \"false\".",
              "label": "fix"
            }
          ],
          "id": "V-242379",
          "impact": 0.5,
          "refs": [],
          "results": [],
          "source_location": {
            "line": 3,
            "ref": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242379.rb"
          },
          "tags": {
            "cci": ["CCI-000068"],
            "fix_id": "F-45612r712492_fix",
            "gid": "V-242379",
            "gtitle": "SRG-APP-000014-CTR-000035",
            "nist": ["AC-17 (2)"],
            "rid": "SV-242379r712493_rule",
            "severity": "medium",
            "stig_id": "CNTR-K8-000180"
          },
          "title": "The Kubernetes etcd must use TLS to protect the confidentiality of\nsensitive data during electronic dissemination.",
          "waiver_data": {}
        },
        {
          "code": "control 'V-242380' do\n  title \"The Kubernetes etcd must use TLS to protect the confidentiality of\nsensitive data during electronic dissemination.\"\n  desc  \"The Kubernetes API Server will prohibit the use of SSL and\nunauthorized versions of TLS protocols to properly secure communication.\n\n    The use of unsupported protocol exposes vulnerabilities to the Kubernetes\nby rogue traffic interceptions, man-in-the-middle attacks, and impersonation of\nusers or services from the container platform runtime, registry, and keystore.\nTo enable the minimum version of TLS to be used by the Kubernetes API Server,\nthe setting \\\"tls-min-version\\\" must be set.\n  \"\n  desc  'rationale', ''\n  desc  'check', \"\n    Change to the /etc/kubernetes/manifests directory on the Kubernetes Master\nNode. Run the command:\n\n    grep -I  peer-auto-tls *\n\n    If the setting \\\"peer-auto-tls\\\" is not configured in the Kubernetes etcd\nmanifest file or it is set to \\\"true\\\", this is a finding.\n  \"\n  desc 'fix', \"Edit the Kubernetes etcd manifest file in the\n/etc/kubernetes/manifests directory on the Kubernetes Master Node. Set the\nvalue of \\\"peer-auto-tls\\\" to \\\"false\\\".\"\n  impact 0.5\n  tag severity: 'medium'\n  tag gtitle: 'SRG-APP-000014-CTR-000035'\n  tag gid: 'V-242380'\n  tag rid: 'SV-242380r712496_rule'\n  tag stig_id: 'CNTR-K8-000190'\n  tag fix_id: 'F-45613r712495_fix'\n  tag cci: ['CCI-000068']\n  tag nist: ['AC-17 (2)']\n\n  if etcd.exist?\n    describe.one do\n      describe etcd do\n        its('peer-auto-tls') { should cmp 'false' }\n      end\n\n      describe process_env_var('etcd') do\n        its(:ETCD_PEER_AUTO_TLS) { should cmp 'false' }\n      end\n    end\n  else\n    describe 'ETCD process is not running on the target.' do\n      skip\n    end\n  end\nend\n",
          "desc": "The Kubernetes API Server will prohibit the use of SSL and\nunauthorized versions of TLS protocols to properly secure communication.\n\n    The use of unsupported protocol exposes vulnerabilities to the Kubernetes\nby rogue traffic interceptions, man-in-the-middle attacks, and impersonation of\nusers or services from the container platform runtime, registry, and keystore.\nTo enable the minimum version of TLS to be used by the Kubernetes API Server,\nthe setting \"tls-min-version\" must be set.",
          "descriptions": [
            {
              "data": "The Kubernetes API Server will prohibit the use of SSL and\nunauthorized versions of TLS protocols to properly secure communication.\n\n    The use of unsupported protocol exposes vulnerabilities to the Kubernetes\nby rogue traffic interceptions, man-in-the-middle attacks, and impersonation of\nusers or services from the container platform runtime, registry, and keystore.\nTo enable the minimum version of TLS to be used by the Kubernetes API Server,\nthe setting \"tls-min-version\" must be set.",
              "label": "default"
            },
            {
              "data": "",
              "label": "rationale"
            },
            {
              "data": "Change to the /etc/kubernetes/manifests directory on the Kubernetes Master\nNode. Run the command:\n\n    grep -I  peer-auto-tls *\n\n    If the setting \"peer-auto-tls\" is not configured in the Kubernetes etcd\nmanifest file or it is set to \"true\", this is a finding.",
              "label": "check"
            },
            {
              "data": "Edit the Kubernetes etcd manifest file in the\n/etc/kubernetes/manifests directory on the Kubernetes Master Node. Set the\nvalue of \"peer-auto-tls\" to \"false\".",
              "label": "fix"
            }
          ],
          "id": "V-242380",
          "impact": 0.5,
          "refs": [],
          "results": [],
          "source_location": {
            "line": 3,
            "ref": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242380.rb"
          },
          "tags": {
            "cci": ["CCI-000068"],
            "fix_id": "F-45613r712495_fix",
            "gid": "V-242380",
            "gtitle": "SRG-APP-000014-CTR-000035",
            "nist": ["AC-17 (2)"],
            "rid": "SV-242380r712496_rule",
            "severity": "medium",
            "stig_id": "CNTR-K8-000190"
          },
          "title": "The Kubernetes etcd must use TLS to protect the confidentiality of\nsensitive data during electronic dissemination.",
          "waiver_data": {}
        },
        {
          "code": "control 'V-242381' do\n  title \"The Kubernetes Controller Manager must create unique service accounts\nfor each work payload.\"\n  desc  \"The Kubernetes Controller Manager is a background process that embeds\ncore control loops regulating cluster system state through the API Server.\nEvery process executed in a pod has an associated service account. By default,\nservice accounts use the same credentials for authentication. Implementing the\ndefault settings poses a High risk to the Kubernetes Controller Manager.\nSetting the use-service-account-credentials value lowers the attack surface by\ngenerating unique service accounts settings for each controller instance.\"\n  desc  'rationale', ''\n  desc  'check', \"\n    Change to the /etc/kubernetes/manifests directory on the Kubernetes Master\nNode. Run the command:\n\n    grep -i use-service-account-credentials *\n\n    If the setting use-service-account-credential is not configured in the\nKubernetes Controller Manager manifest file or it is set to \\\"false\\\", this is\na finding.\n  \"\n  desc 'fix', \"Edit the Kubernetes Controller Manager manifest file in the\n/etc/kubernetes/manifests directory on the Kubernetes Master Node. Set the\nvalue of \\\"use-service-account-credentials\\\" to \\\"true\\\".\"\n  impact 0.7\n  tag severity: 'high'\n  tag gtitle: 'SRG-APP-000023-CTR-000055'\n  tag gid: 'V-242381'\n  tag rid: 'SV-242381r712499_rule'\n  tag stig_id: 'CNTR-K8-000220'\n  tag fix_id: 'F-45614r712498_fix'\n  tag cci: ['CCI-000015']\n  tag nist: ['AC-2 (1)']\n\n  unless kube_controller_manager.exist?\n    impact 0.0\n    desc 'caveat', 'Kubernetes Controller Manager process is not running on the target.'\n  end\n\n  describe kube_controller_manager do\n    its('use-service-account-credentials') { should cmp 'true' }\n  end\nend\n",
          "desc": "The Kubernetes Controller Manager is a background process that embeds\ncore control loops regulating cluster system state through the API Server.\nEvery process executed in a pod has an associated service account. By default,\nservice accounts use the same credentials for authentication. Implementing the\ndefault settings poses a High risk to the Kubernetes Controller Manager.\nSetting the use-service-account-credentials value lowers the attack surface by\ngenerating unique service accounts settings for each controller instance.",
          "descriptions": [
            {
              "data": "The Kubernetes Controller Manager is a background process that embeds\ncore control loops regulating cluster system state through the API Server.\nEvery process executed in a pod has an associated service account. By default,\nservice accounts use the same credentials for authentication. Implementing the\ndefault settings poses a High risk to the Kubernetes Controller Manager.\nSetting the use-service-account-credentials value lowers the attack surface by\ngenerating unique service accounts settings for each controller instance.",
              "label": "default"
            },
            {
              "data": "",
              "label": "rationale"
            },
            {
              "data": "Change to the /etc/kubernetes/manifests directory on the Kubernetes Master\nNode. Run the command:\n\n    grep -i use-service-account-credentials *\n\n    If the setting use-service-account-credential is not configured in the\nKubernetes Controller Manager manifest file or it is set to \"false\", this is\na finding.",
              "label": "check"
            },
            {
              "data": "Edit the Kubernetes Controller Manager manifest file in the\n/etc/kubernetes/manifests directory on the Kubernetes Master Node. Set the\nvalue of \"use-service-account-credentials\" to \"true\".",
              "label": "fix"
            }
          ],
          "id": "V-242381",
          "impact": 0.7,
          "refs": [],
          "results": [],
          "source_location": {
            "line": 3,
            "ref": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242381.rb"
          },
          "tags": {
            "cci": ["CCI-000015"],
            "fix_id": "F-45614r712498_fix",
            "gid": "V-242381",
            "gtitle": "SRG-APP-000023-CTR-000055",
            "nist": ["AC-2 (1)"],
            "rid": "SV-242381r712499_rule",
            "severity": "high",
            "stig_id": "CNTR-K8-000220"
          },
          "title": "The Kubernetes Controller Manager must create unique service accounts\nfor each work payload.",
          "waiver_data": {}
        },
        {
          "code": "control 'V-242382' do\n  title \"The Kubernetes API Server must enable Node,RBAC as the authorization\nmode.\"\n  desc  \"To mitigate the risk of unauthorized access to sensitive information\nby entities that have been issued certificates by DoD-approved PKIs, all DoD\nsystems (e.g., networks, web servers, and web portals) must be properly\nconfigured to incorporate access control methods that do not rely solely on the\npossession of a certificate for access. Successful authentication must not\nautomatically give an entity access to an asset or security boundary.\nAuthorization procedures and controls must be implemented to ensure each\nauthenticated entity also has a validated and current authorization.\nAuthorization is the process of determining whether an entity, once\nauthenticated, is permitted to access a specific asset.\n\n    Node,RBAC is the method within Kubernetes to control access of users and\napplications. Kubernetes uses roles to grant authorization API requests made by\nkubelets.\n\n\n  \"\n  desc  'rationale', ''\n  desc  'check', \"\n    Change to the /etc/kubernetes/manifests directory on the Kubernetes Master\nNode. Run the command:\n\n    \\\"grep -i authorization-mode *\\\"\n\n    If the setting \\\"authorization-mode\\\" is not configured in the Kubernetes\nAPI Server manifest file or is not set to \\\"Node,RBAC\\\", this is a finding.\n  \"\n  desc 'fix', \"Edit the Kubernetes API Server manifest file in the\n/etc/kubernetes/manifests directory on the Kubernetes Master Node. Set the\nvalue of \\\"--authorization-mode\\\" to \\\"Node,RBAC\\\".\"\n  impact 0.5\n  tag severity: 'medium'\n  tag gtitle: 'SRG-APP-000033-CTR-000090'\n  tag satisfies: ['SRG-APP-000033-CTR-000090', 'SRG-APP-000033-CTR-000095']\n  tag gid: 'V-242382'\n  tag rid: 'SV-242382r712502_rule'\n  tag stig_id: 'CNTR-K8-000270'\n  tag fix_id: 'F-45615r712501_fix'\n  tag cci: ['CCI-000213']\n  tag nist: ['AC-3']\n\n  unless kube_apiserver.exist?\n    impact 0.0\n    desc 'caveat', 'Kubernetes API Server process is not running on the target.'\n  end\n\n  describe kube_apiserver do\n    its('authorization-mode') { should cmp 'Node,RBAC' }\n  end\nend\n",
          "desc": "To mitigate the risk of unauthorized access to sensitive information\nby entities that have been issued certificates by DoD-approved PKIs, all DoD\nsystems (e.g., networks, web servers, and web portals) must be properly\nconfigured to incorporate access control methods that do not rely solely on the\npossession of a certificate for access. Successful authentication must not\nautomatically give an entity access to an asset or security boundary.\nAuthorization procedures and controls must be implemented to ensure each\nauthenticated entity also has a validated and current authorization.\nAuthorization is the process of determining whether an entity, once\nauthenticated, is permitted to access a specific asset.\n\n    Node,RBAC is the method within Kubernetes to control access of users and\napplications. Kubernetes uses roles to grant authorization API requests made by\nkubelets.",
          "descriptions": [
            {
              "data": "To mitigate the risk of unauthorized access to sensitive information\nby entities that have been issued certificates by DoD-approved PKIs, all DoD\nsystems (e.g., networks, web servers, and web portals) must be properly\nconfigured to incorporate access control methods that do not rely solely on the\npossession of a certificate for access. Successful authentication must not\nautomatically give an entity access to an asset or security boundary.\nAuthorization procedures and controls must be implemented to ensure each\nauthenticated entity also has a validated and current authorization.\nAuthorization is the process of determining whether an entity, once\nauthenticated, is permitted to access a specific asset.\n\n    Node,RBAC is the method within Kubernetes to control access of users and\napplications. Kubernetes uses roles to grant authorization API requests made by\nkubelets.",
              "label": "default"
            },
            {
              "data": "",
              "label": "rationale"
            },
            {
              "data": "Change to the /etc/kubernetes/manifests directory on the Kubernetes Master\nNode. Run the command:\n\n    \"grep -i authorization-mode *\"\n\n    If the setting \"authorization-mode\" is not configured in the Kubernetes\nAPI Server manifest file or is not set to \"Node,RBAC\", this is a finding.",
              "label": "check"
            },
            {
              "data": "Edit the Kubernetes API Server manifest file in the\n/etc/kubernetes/manifests directory on the Kubernetes Master Node. Set the\nvalue of \"--authorization-mode\" to \"Node,RBAC\".",
              "label": "fix"
            }
          ],
          "id": "V-242382",
          "impact": 0.5,
          "refs": [],
          "results": [],
          "source_location": {
            "line": 3,
            "ref": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242382.rb"
          },
          "tags": {
            "cci": ["CCI-000213"],
            "fix_id": "F-45615r712501_fix",
            "gid": "V-242382",
            "gtitle": "SRG-APP-000033-CTR-000090",
            "nist": ["AC-3"],
            "rid": "SV-242382r712502_rule",
            "satisfies": [
              "SRG-APP-000033-CTR-000090",
              "SRG-APP-000033-CTR-000095"
            ],
            "severity": "medium",
            "stig_id": "CNTR-K8-000270"
          },
          "title": "The Kubernetes API Server must enable Node,RBAC as the authorization\nmode.",
          "waiver_data": {}
        },
        {
          "code": "control 'V-242384' do\n  title 'The Kubernetes Scheduler must have secure binding.'\n  desc  \"Limiting the number of attack vectors and implementing authentication\nand encryption on the endpoints available to external sources is paramount when\nsecuring the overall Kubernetes cluster. The Scheduler API service exposes port\n10251/TCP by default for health and metrics information use. This port does not\nencrypt or authenticate connections. If this port is exposed externally, an\nattacker can use this port to attack the entire Kubernetes cluster. By setting\nthe bind address to localhost (i.e., 127.0.0.1), only those internal services\nthat require health and metrics information can access the Scheduler API.\"\n  desc  'rationale', ''\n  desc  'check', \"\n    Change to the /etc/kubernetes/manifests directory on the Kubernetes Master\nNode. Run the command:\n\n    grep -i bind-address *\n\n    If the setting \\\"bind-address\\\" is not set to \\\"127.0.0.1\\\" or is not found\nin the Kubernetes Scheduler manifest file, this is a finding.\n  \"\n  desc 'fix', \"Edit the Kubernetes Scheduler manifest file in the\n/etc/kubernetes/manifests directory on the Kubernetes Master Node. Set the\nargument \\\"--bind-address\\\" to \\\"127.0.0.1\\\".\"\n  impact 0.5\n  tag severity: 'medium'\n  tag gtitle: 'SRG-APP-000033-CTR-000090'\n  tag gid: 'V-242384'\n  tag rid: 'SV-242384r712508_rule'\n  tag stig_id: 'CNTR-K8-000300'\n  tag fix_id: 'F-45617r712507_fix'\n  tag cci: ['CCI-000213']\n  tag nist: ['AC-3']\n\n  unless kube_scheduler.exist?\n    impact 0.0\n    desc 'caveat', 'Kubernetes Scheduler process is not running on the target.'\n  end\n\n  describe kube_scheduler do\n    its('bind-address') { should cmp '127.0.0.1' }\n  end\nend\n",
          "desc": "Limiting the number of attack vectors and implementing authentication\nand encryption on the endpoints available to external sources is paramount when\nsecuring the overall Kubernetes cluster. The Scheduler API service exposes port\n10251/TCP by default for health and metrics information use. This port does not\nencrypt or authenticate connections. If this port is exposed externally, an\nattacker can use this port to attack the entire Kubernetes cluster. By setting\nthe bind address to localhost (i.e., 127.0.0.1), only those internal services\nthat require health and metrics information can access the Scheduler API.",
          "descriptions": [
            {
              "data": "Limiting the number of attack vectors and implementing authentication\nand encryption on the endpoints available to external sources is paramount when\nsecuring the overall Kubernetes cluster. The Scheduler API service exposes port\n10251/TCP by default for health and metrics information use. This port does not\nencrypt or authenticate connections. If this port is exposed externally, an\nattacker can use this port to attack the entire Kubernetes cluster. By setting\nthe bind address to localhost (i.e., 127.0.0.1), only those internal services\nthat require health and metrics information can access the Scheduler API.",
              "label": "default"
            },
            {
              "data": "",
              "label": "rationale"
            },
            {
              "data": "Change to the /etc/kubernetes/manifests directory on the Kubernetes Master\nNode. Run the command:\n\n    grep -i bind-address *\n\n    If the setting \"bind-address\" is not set to \"127.0.0.1\" or is not found\nin the Kubernetes Scheduler manifest file, this is a finding.",
              "label": "check"
            },
            {
              "data": "Edit the Kubernetes Scheduler manifest file in the\n/etc/kubernetes/manifests directory on the Kubernetes Master Node. Set the\nargument \"--bind-address\" to \"127.0.0.1\".",
              "label": "fix"
            }
          ],
          "id": "V-242384",
          "impact": 0.5,
          "refs": [],
          "results": [],
          "source_location": {
            "line": 3,
            "ref": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242384.rb"
          },
          "tags": {
            "cci": ["CCI-000213"],
            "fix_id": "F-45617r712507_fix",
            "gid": "V-242384",
            "gtitle": "SRG-APP-000033-CTR-000090",
            "nist": ["AC-3"],
            "rid": "SV-242384r712508_rule",
            "severity": "medium",
            "stig_id": "CNTR-K8-000300"
          },
          "title": "The Kubernetes Scheduler must have secure binding.",
          "waiver_data": {}
        },
        {
          "code": "control 'V-242385' do\n  title 'The Kubernetes Controller Manager must have secure binding.'\n  desc  \"Limiting the number of attack vectors and implementing authentication\nand encryption on the endpoints available to external sources is paramount when\nsecuring the overall Kubernetes cluster. The Controller Manager API service\nexposes port 10252/TCP by default for health and metrics information use. This\nport does not encrypt or authenticate connections. If this port is exposed\nexternally, an attacker can use this port to attack the entire Kubernetes\ncluster. By setting the bind address to only localhost (i.e., 127.0.0.1), only\nthose internal services that require health and metrics information can access\nthe Control Manager API.\"\n  desc  'rationale', ''\n  desc  'check', \"\n    Change to the /etc/kubernetes/manifests directory on the Kubernetes Master\nNode. Run the command:\n\n    grep -i bind-address *\n\n    If the setting bind-address is not set to \\\"127.0.0.1\\\" or is not found in\nthe Kubernetes Controller Manager manifest file, this is a finding.\n  \"\n  desc 'fix', \"Edit the Kubernetes Controller Manager manifest file in the\n/etc/kubernetes/manifests directory on the Kubernetes Master Node. Set the\nargument \\\"--bind-address\\\" to \\\"127.0.0.1\\\".\"\n  impact 0.5\n  tag severity: 'medium'\n  tag gtitle: 'SRG-APP-000033-CTR-000090'\n  tag gid: 'V-242385'\n  tag rid: 'SV-242385r712511_rule'\n  tag stig_id: 'CNTR-K8-000310'\n  tag fix_id: 'F-45618r712510_fix'\n  tag cci: ['CCI-000213']\n  tag nist: ['AC-3']\n\n  unless kube_controller_manager.exist?\n    impact 0.0\n    desc 'caveat', 'Kubernetes Controller Manager process is not running on the target.'\n  end\n\n  describe kube_controller_manager do\n    its('bind-address') { should cmp '127.0.0.1' }\n  end\nend\n",
          "desc": "Limiting the number of attack vectors and implementing authentication\nand encryption on the endpoints available to external sources is paramount when\nsecuring the overall Kubernetes cluster. The Controller Manager API service\nexposes port 10252/TCP by default for health and metrics information use. This\nport does not encrypt or authenticate connections. If this port is exposed\nexternally, an attacker can use this port to attack the entire Kubernetes\ncluster. By setting the bind address to only localhost (i.e., 127.0.0.1), only\nthose internal services that require health and metrics information can access\nthe Control Manager API.",
          "descriptions": [
            {
              "data": "Limiting the number of attack vectors and implementing authentication\nand encryption on the endpoints available to external sources is paramount when\nsecuring the overall Kubernetes cluster. The Controller Manager API service\nexposes port 10252/TCP by default for health and metrics information use. This\nport does not encrypt or authenticate connections. If this port is exposed\nexternally, an attacker can use this port to attack the entire Kubernetes\ncluster. By setting the bind address to only localhost (i.e., 127.0.0.1), only\nthose internal services that require health and metrics information can access\nthe Control Manager API.",
              "label": "default"
            },
            {
              "data": "",
              "label": "rationale"
            },
            {
              "data": "Change to the /etc/kubernetes/manifests directory on the Kubernetes Master\nNode. Run the command:\n\n    grep -i bind-address *\n\n    If the setting bind-address is not set to \"127.0.0.1\" or is not found in\nthe Kubernetes Controller Manager manifest file, this is a finding.",
              "label": "check"
            },
            {
              "data": "Edit the Kubernetes Controller Manager manifest file in the\n/etc/kubernetes/manifests directory on the Kubernetes Master Node. Set the\nargument \"--bind-address\" to \"127.0.0.1\".",
              "label": "fix"
            }
          ],
          "id": "V-242385",
          "impact": 0.5,
          "refs": [],
          "results": [],
          "source_location": {
            "line": 3,
            "ref": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242385.rb"
          },
          "tags": {
            "cci": ["CCI-000213"],
            "fix_id": "F-45618r712510_fix",
            "gid": "V-242385",
            "gtitle": "SRG-APP-000033-CTR-000090",
            "nist": ["AC-3"],
            "rid": "SV-242385r712511_rule",
            "severity": "medium",
            "stig_id": "CNTR-K8-000310"
          },
          "title": "The Kubernetes Controller Manager must have secure binding.",
          "waiver_data": {}
        },
        {
          "code": "control 'V-242386' do\n  title 'The Kubernetes API server must have the insecure port flag disabled.'\n  desc  \"By default, the API server will listen on two ports. One port is the\nsecure port and the other port is called the \\\"localhost port\\\". This port is\nalso called the \\\"insecure port\\\", port 8080. Any requests to this port bypass\nauthentication and authorization checks. If this port is left open, anyone who\ngains access to the host on which the master is running can bypass all\nauthorization and authentication mechanisms put in place, and have full control\nover the entire cluster.\n\n    Close the insecure port by setting the API server's --insecure-port flag to\n\\\"0\\\", ensuring that the --insecure-bind-address is not set.\n  \"\n  desc  'rationale', ''\n  desc  'check', \"\n    Change to the /etc/kubernetes/manifests directory on the Kubernetes Master\nNode. Run the command:\n\n    grep -i insecure-port *\n\n    If the setting insecure-port is not set to \\\"0\\\" or is not configured in\nthe Kubernetes API server manifest file, this is a finding.\n  \"\n  desc 'fix', \"Edit the Kubernetes API Server manifest file in the\n/etc/kubernetes/manifests directory on the Kubernetes Master Node. Set the\nargument --insecure-port to \\\"0\\\".\"\n  impact 0.7\n  tag severity: 'high'\n  tag gtitle: 'SRG-APP-000033-CTR-000095'\n  tag gid: 'V-242386'\n  tag rid: 'SV-242386r712514_rule'\n  tag stig_id: 'CNTR-K8-000320'\n  tag fix_id: 'F-45619r712513_fix'\n  tag cci: ['CCI-000213']\n  tag nist: ['AC-3']\n\n  unless kube_apiserver.exist?\n    impact 0.0\n    desc 'caveat', 'Kubernetes API Server process is not running on the target.'\n  end\n\n  describe kube_apiserver do\n    its('insecure-port') { should cmp '0' }\n  end\nend\n",
          "desc": "By default, the API server will listen on two ports. One port is the\nsecure port and the other port is called the \"localhost port\". This port is\nalso called the \"insecure port\", port 8080. Any requests to this port bypass\nauthentication and authorization checks. If this port is left open, anyone who\ngains access to the host on which the master is running can bypass all\nauthorization and authentication mechanisms put in place, and have full control\nover the entire cluster.\n\n    Close the insecure port by setting the API server's --insecure-port flag to\n\"0\", ensuring that the --insecure-bind-address is not set.",
          "descriptions": [
            {
              "data": "By default, the API server will listen on two ports. One port is the\nsecure port and the other port is called the \"localhost port\". This port is\nalso called the \"insecure port\", port 8080. Any requests to this port bypass\nauthentication and authorization checks. If this port is left open, anyone who\ngains access to the host on which the master is running can bypass all\nauthorization and authentication mechanisms put in place, and have full control\nover the entire cluster.\n\n    Close the insecure port by setting the API server's --insecure-port flag to\n\"0\", ensuring that the --insecure-bind-address is not set.",
              "label": "default"
            },
            {
              "data": "",
              "label": "rationale"
            },
            {
              "data": "Change to the /etc/kubernetes/manifests directory on the Kubernetes Master\nNode. Run the command:\n\n    grep -i insecure-port *\n\n    If the setting insecure-port is not set to \"0\" or is not configured in\nthe Kubernetes API server manifest file, this is a finding.",
              "label": "check"
            },
            {
              "data": "Edit the Kubernetes API Server manifest file in the\n/etc/kubernetes/manifests directory on the Kubernetes Master Node. Set the\nargument --insecure-port to \"0\".",
              "label": "fix"
            }
          ],
          "id": "V-242386",
          "impact": 0.7,
          "refs": [],
          "results": [],
          "source_location": {
            "line": 3,
            "ref": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242386.rb"
          },
          "tags": {
            "cci": ["CCI-000213"],
            "fix_id": "F-45619r712513_fix",
            "gid": "V-242386",
            "gtitle": "SRG-APP-000033-CTR-000095",
            "nist": ["AC-3"],
            "rid": "SV-242386r712514_rule",
            "severity": "high",
            "stig_id": "CNTR-K8-000320"
          },
          "title": "The Kubernetes API server must have the insecure port flag disabled.",
          "waiver_data": {}
        },
        {
          "code": "control 'V-242387' do\n  title 'The Kubernetes Kubelet must have the read-only port flag disabled.'\n  desc  \"Kubelet serves a small REST API with read access to port 10255. The\nread-only port for Kubernetes provides no authentication or authorization\nsecurity control. Providing unrestricted access on port 10255 exposes\nKubernetes pods and containers to malicious attacks or compromise. Port 10255\nis deprecated and should be disabled.\n\n    Close the read-only-port by setting the API server's read-only port flag to\n\\\"0\\\".\n  \"\n  desc  'rationale', ''\n  desc  'check', \"\n    Run the following command on each Worker Node:\n    ps -ef | grep kubelet\n\n    Verify that the --read-only-port argument exists and is set to \\\"0\\\".\n\n    If the --read-only-port argument exists and is not set to \\\"0\\\", this is a\nfinding.\n\n    If the --read-only-port argument does not exist, check the Master Node\nKubelet config file.\n\n    On the Kubernetes Master Node, run the command:\n    ps -ef | grep kubelet\n    (path identified by: --config)\n\n    Verify there is a readOnlyPort entry in the config file and it is set to\n\\\"0\\\".\n\n    If the --read-only-port argument exists and is not set to \\\"0\\\" this is a\nfinding.\n\n    If \\\"--read-only-port=0\\\" argument does not exist on the worker node and\nthe master node, this is a finding.\n  \"\n  desc 'fix', \"\n    Edit the Kubernetes Kubelet file in the --config directory on the\nKubernetes Master Node. Set the argument --read-only-port to 0.\n\n    Reset Kubelet service using the following command:\n    service kubelet restart\n\n    If using worker node arguments, edit the kubelet service file\n/usr/lib/systemd/system/kubelet.service.d/10-kubeadm.conf on each Worker Node:\nset the parameter in KUBELET_SYSTEM_PODS_ARGS variable to\n\\\"--read-only-port=0\\\".\n  \"\n  impact 0.7\n  tag severity: 'high'\n  tag gtitle: 'SRG-APP-000033-CTR-000095'\n  tag gid: 'V-242387'\n  tag rid: 'SV-242387r717013_rule'\n  tag stig_id: 'CNTR-K8-000330'\n  tag fix_id: 'F-45620r717012_fix'\n  tag cci: ['CCI-000213']\n  tag nist: ['AC-3']\n\n  describe.one do\n    describe kubelet do\n      its('read-only-port') { should cmp 0 }\n    end\n\n    describe kubelet_config_file do\n      its('readOnlyPort') { should cmp 0 }\n    end\n  end\nend\n",
          "desc": "Kubelet serves a small REST API with read access to port 10255. The\nread-only port for Kubernetes provides no authentication or authorization\nsecurity control. Providing unrestricted access on port 10255 exposes\nKubernetes pods and containers to malicious attacks or compromise. Port 10255\nis deprecated and should be disabled.\n\n    Close the read-only-port by setting the API server's read-only port flag to\n\"0\".",
          "descriptions": [
            {
              "data": "Kubelet serves a small REST API with read access to port 10255. The\nread-only port for Kubernetes provides no authentication or authorization\nsecurity control. Providing unrestricted access on port 10255 exposes\nKubernetes pods and containers to malicious attacks or compromise. Port 10255\nis deprecated and should be disabled.\n\n    Close the read-only-port by setting the API server's read-only port flag to\n\"0\".",
              "label": "default"
            },
            {
              "data": "",
              "label": "rationale"
            },
            {
              "data": "Run the following command on each Worker Node:\n    ps -ef | grep kubelet\n\n    Verify that the --read-only-port argument exists and is set to \"0\".\n\n    If the --read-only-port argument exists and is not set to \"0\", this is a\nfinding.\n\n    If the --read-only-port argument does not exist, check the Master Node\nKubelet config file.\n\n    On the Kubernetes Master Node, run the command:\n    ps -ef | grep kubelet\n    (path identified by: --config)\n\n    Verify there is a readOnlyPort entry in the config file and it is set to\n\"0\".\n\n    If the --read-only-port argument exists and is not set to \"0\" this is a\nfinding.\n\n    If \"--read-only-port=0\" argument does not exist on the worker node and\nthe master node, this is a finding.",
              "label": "check"
            },
            {
              "data": "Edit the Kubernetes Kubelet file in the --config directory on the\nKubernetes Master Node. Set the argument --read-only-port to 0.\n\n    Reset Kubelet service using the following command:\n    service kubelet restart\n\n    If using worker node arguments, edit the kubelet service file\n/usr/lib/systemd/system/kubelet.service.d/10-kubeadm.conf on each Worker Node:\nset the parameter in KUBELET_SYSTEM_PODS_ARGS variable to\n\"--read-only-port=0\".",
              "label": "fix"
            }
          ],
          "id": "V-242387",
          "impact": 0.7,
          "refs": [],
          "results": [],
          "source_location": {
            "line": 3,
            "ref": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242387.rb"
          },
          "tags": {
            "cci": ["CCI-000213"],
            "fix_id": "F-45620r717012_fix",
            "gid": "V-242387",
            "gtitle": "SRG-APP-000033-CTR-000095",
            "nist": ["AC-3"],
            "rid": "SV-242387r717013_rule",
            "severity": "high",
            "stig_id": "CNTR-K8-000330"
          },
          "title": "The Kubernetes Kubelet must have the read-only port flag disabled.",
          "waiver_data": {}
        },
        {
          "code": "control 'V-242388' do\n  title 'The Kubernetes API server must have the insecure bind address not set.'\n  desc  \"By default, the API server will listen on two ports and addresses. One\naddress is the secure address and the other address is called the \\\"insecure\nbind\\\" address and is set by default to localhost. Any requests to this address\nbypass authentication and authorization checks. If this insecure bind address\nis set to localhost, anyone who gains access to the host on which the master is\nrunning can bypass all authorization and authentication mechanisms put in place\nand have full control over the entire cluster.\n\n    Close or set the insecure bind address by setting the API server's\n--insecure-bind-address flag to an IP or leave it unset and ensure that the\n--insecure-bind-port is not set.\n  \"\n  desc  'rationale', ''\n  desc  'check', \"\n    Change to the /etc/kubernetes/manifests directory on the Kubernetes Master\nNode. Run the command:\n\n    grep -i insecure-bind-address *\n\n    If the setting insecure-bind-address is found and set to \\\"localhost\\\" in\nthe Kubernetes API manifest file, this is a finding.\n  \"\n  desc 'fix', \"Edit the Kubernetes API Server manifest file in the\n/etc/kubernetes/manifests directory on the Kubernetes Master Node. Remove the\nvalue for the --insecure-bind-address setting.\"\n  impact 0.7\n  tag severity: 'high'\n  tag gtitle: 'SRG-APP-000033-CTR-000095'\n  tag gid: 'V-242388'\n  tag rid: 'SV-242388r712520_rule'\n  tag stig_id: 'CNTR-K8-000340'\n  tag fix_id: 'F-45621r712519_fix'\n  tag cci: ['CCI-000213']\n  tag nist: ['AC-3']\n\n  unless kube_apiserver.exist?\n    impact 0.0\n    desc 'caveat', 'Kubernetes API Server process is not running on the target.'\n  end\n\n  describe kube_apiserver do\n    its('insecure-bind-address') { should be_nil }\n  end\nend\n",
          "desc": "By default, the API server will listen on two ports and addresses. One\naddress is the secure address and the other address is called the \"insecure\nbind\" address and is set by default to localhost. Any requests to this address\nbypass authentication and authorization checks. If this insecure bind address\nis set to localhost, anyone who gains access to the host on which the master is\nrunning can bypass all authorization and authentication mechanisms put in place\nand have full control over the entire cluster.\n\n    Close or set the insecure bind address by setting the API server's\n--insecure-bind-address flag to an IP or leave it unset and ensure that the\n--insecure-bind-port is not set.",
          "descriptions": [
            {
              "data": "By default, the API server will listen on two ports and addresses. One\naddress is the secure address and the other address is called the \"insecure\nbind\" address and is set by default to localhost. Any requests to this address\nbypass authentication and authorization checks. If this insecure bind address\nis set to localhost, anyone who gains access to the host on which the master is\nrunning can bypass all authorization and authentication mechanisms put in place\nand have full control over the entire cluster.\n\n    Close or set the insecure bind address by setting the API server's\n--insecure-bind-address flag to an IP or leave it unset and ensure that the\n--insecure-bind-port is not set.",
              "label": "default"
            },
            {
              "data": "",
              "label": "rationale"
            },
            {
              "data": "Change to the /etc/kubernetes/manifests directory on the Kubernetes Master\nNode. Run the command:\n\n    grep -i insecure-bind-address *\n\n    If the setting insecure-bind-address is found and set to \"localhost\" in\nthe Kubernetes API manifest file, this is a finding.",
              "label": "check"
            },
            {
              "data": "Edit the Kubernetes API Server manifest file in the\n/etc/kubernetes/manifests directory on the Kubernetes Master Node. Remove the\nvalue for the --insecure-bind-address setting.",
              "label": "fix"
            }
          ],
          "id": "V-242388",
          "impact": 0.7,
          "refs": [],
          "results": [],
          "source_location": {
            "line": 3,
            "ref": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242388.rb"
          },
          "tags": {
            "cci": ["CCI-000213"],
            "fix_id": "F-45621r712519_fix",
            "gid": "V-242388",
            "gtitle": "SRG-APP-000033-CTR-000095",
            "nist": ["AC-3"],
            "rid": "SV-242388r712520_rule",
            "severity": "high",
            "stig_id": "CNTR-K8-000340"
          },
          "title": "The Kubernetes API server must have the insecure bind address not set.",
          "waiver_data": {}
        },
        {
          "code": "control 'V-242389' do\n  title 'The Kubernetes API server must have the secure port set.'\n  desc  \"By default, the API server will listen on what is rightfully called\nthe secure port, port 6443. Any requests to this port will perform\nauthentication and authorization checks. If this port is disabled, anyone who\ngains access to the host on which the master is running has full control of the\nentire cluster over encrypted traffic.\n\n    Open the secure port by setting the API server's --secure-port flag to a\nvalue other than \\\"0\\\".\n  \"\n  desc  'rationale', ''\n  desc  'check', \"\n    Change to the /etc/kubernetes/manifests directory on the Kubernetes Master\nNode. Run the command:\n\n    grep -i secure-port *\n\n    If the setting secure-port is set to \\\"0\\\" or is not configured in the\nKubernetes API manifest file, this is a finding.\n  \"\n  desc 'fix', \"Edit the Kubernetes API Server manifest file in the\n/etc/kubernetes/manifests directory on the Kubernetes Master Node. Set the\nargument --secure-port to a value greater than \\\"0\\\".\"\n  impact 0.5\n  tag severity: 'medium'\n  tag gtitle: 'SRG-APP-000033-CTR-000100'\n  tag gid: 'V-242389'\n  tag rid: 'SV-242389r712523_rule'\n  tag stig_id: 'CNTR-K8-000350'\n  tag fix_id: 'F-45622r712522_fix'\n  tag cci: ['CCI-000213']\n  tag nist: ['AC-3']\n\n  unless kube_apiserver.exist?\n    impact 0.0\n    desc 'caveat', 'Kubernetes API Server process is not running on the target.'\n  end\n\n  describe kube_apiserver do\n    its('secure-port') { should cmp > 0 }\n  end\nend\n",
          "desc": "By default, the API server will listen on what is rightfully called\nthe secure port, port 6443. Any requests to this port will perform\nauthentication and authorization checks. If this port is disabled, anyone who\ngains access to the host on which the master is running has full control of the\nentire cluster over encrypted traffic.\n\n    Open the secure port by setting the API server's --secure-port flag to a\nvalue other than \"0\".",
          "descriptions": [
            {
              "data": "By default, the API server will listen on what is rightfully called\nthe secure port, port 6443. Any requests to this port will perform\nauthentication and authorization checks. If this port is disabled, anyone who\ngains access to the host on which the master is running has full control of the\nentire cluster over encrypted traffic.\n\n    Open the secure port by setting the API server's --secure-port flag to a\nvalue other than \"0\".",
              "label": "default"
            },
            {
              "data": "",
              "label": "rationale"
            },
            {
              "data": "Change to the /etc/kubernetes/manifests directory on the Kubernetes Master\nNode. Run the command:\n\n    grep -i secure-port *\n\n    If the setting secure-port is set to \"0\" or is not configured in the\nKubernetes API manifest file, this is a finding.",
              "label": "check"
            },
            {
              "data": "Edit the Kubernetes API Server manifest file in the\n/etc/kubernetes/manifests directory on the Kubernetes Master Node. Set the\nargument --secure-port to a value greater than \"0\".",
              "label": "fix"
            }
          ],
          "id": "V-242389",
          "impact": 0.5,
          "refs": [],
          "results": [],
          "source_location": {
            "line": 3,
            "ref": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242389.rb"
          },
          "tags": {
            "cci": ["CCI-000213"],
            "fix_id": "F-45622r712522_fix",
            "gid": "V-242389",
            "gtitle": "SRG-APP-000033-CTR-000100",
            "nist": ["AC-3"],
            "rid": "SV-242389r712523_rule",
            "severity": "medium",
            "stig_id": "CNTR-K8-000350"
          },
          "title": "The Kubernetes API server must have the secure port set.",
          "waiver_data": {}
        },
        {
          "code": "control 'V-242390' do\n  title 'The Kubernetes API server must have anonymous authentication disabled.'\n  desc  \"The Kubernetes API Server controls Kubernetes via an API interface. A\nuser who has access to the API essentially has root access to the entire\nKubernetes cluster. To control access, users must be authenticated and\nauthorized. By allowing anonymous connections, the controls put in place to\nsecure the API can be bypassed.\n\n    Setting anonymous authentication to \\\"false\\\" also disables unauthenticated\nrequests from kubelets.\n\n    While there are instances where anonymous connections may be needed (e.g.,\nhealth checks) and Role-Based Access Controls (RBAC) are in place to limit the\nanonymous access, this access should be disabled, and only enabled when\nnecessary.\n  \"\n  desc  'rationale', ''\n  desc  'check', \"\n    Change to the /etc/kubernetes/manifests directory on the Kubernetes Master\nNode. Run the command:\n\n    grep -i anonymous-auth *\n\n    If the setting anonymous-auth is set to \\\"true\\\" in the Kubernetes API\nServer manifest file, this is a finding.\n  \"\n  desc 'fix', \"Edit the Kubernetes API Server manifest file in the\n/etc/kubernetes/manifests directory on the Kubernetes Master Node. Set the\nargument --anonymous-auth to \\\"false\\\".\"\n  impact 0.7\n  tag severity: 'high'\n  tag gtitle: 'SRG-APP-000033-CTR-000100'\n  tag gid: 'V-242390'\n  tag rid: 'SV-242390r712526_rule'\n  tag stig_id: 'CNTR-K8-000360'\n  tag fix_id: 'F-45623r712525_fix'\n  tag cci: ['CCI-000213']\n  tag nist: ['AC-3']\n\n  unless kube_apiserver.exist?\n    impact 0.0\n    desc 'caveat', 'Kubernetes API Server process is not running on the target.'\n  end\n\n  describe kube_apiserver do\n    its('anonymous-auth') { should_not cmp 'true' }\n  end\nend\n",
          "desc": "The Kubernetes API Server controls Kubernetes via an API interface. A\nuser who has access to the API essentially has root access to the entire\nKubernetes cluster. To control access, users must be authenticated and\nauthorized. By allowing anonymous connections, the controls put in place to\nsecure the API can be bypassed.\n\n    Setting anonymous authentication to \"false\" also disables unauthenticated\nrequests from kubelets.\n\n    While there are instances where anonymous connections may be needed (e.g.,\nhealth checks) and Role-Based Access Controls (RBAC) are in place to limit the\nanonymous access, this access should be disabled, and only enabled when\nnecessary.",
          "descriptions": [
            {
              "data": "The Kubernetes API Server controls Kubernetes via an API interface. A\nuser who has access to the API essentially has root access to the entire\nKubernetes cluster. To control access, users must be authenticated and\nauthorized. By allowing anonymous connections, the controls put in place to\nsecure the API can be bypassed.\n\n    Setting anonymous authentication to \"false\" also disables unauthenticated\nrequests from kubelets.\n\n    While there are instances where anonymous connections may be needed (e.g.,\nhealth checks) and Role-Based Access Controls (RBAC) are in place to limit the\nanonymous access, this access should be disabled, and only enabled when\nnecessary.",
              "label": "default"
            },
            {
              "data": "",
              "label": "rationale"
            },
            {
              "data": "Change to the /etc/kubernetes/manifests directory on the Kubernetes Master\nNode. Run the command:\n\n    grep -i anonymous-auth *\n\n    If the setting anonymous-auth is set to \"true\" in the Kubernetes API\nServer manifest file, this is a finding.",
              "label": "check"
            },
            {
              "data": "Edit the Kubernetes API Server manifest file in the\n/etc/kubernetes/manifests directory on the Kubernetes Master Node. Set the\nargument --anonymous-auth to \"false\".",
              "label": "fix"
            }
          ],
          "id": "V-242390",
          "impact": 0.7,
          "refs": [],
          "results": [],
          "source_location": {
            "line": 3,
            "ref": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242390.rb"
          },
          "tags": {
            "cci": ["CCI-000213"],
            "fix_id": "F-45623r712525_fix",
            "gid": "V-242390",
            "gtitle": "SRG-APP-000033-CTR-000100",
            "nist": ["AC-3"],
            "rid": "SV-242390r712526_rule",
            "severity": "high",
            "stig_id": "CNTR-K8-000360"
          },
          "title": "The Kubernetes API server must have anonymous authentication disabled.",
          "waiver_data": {}
        },
        {
          "code": "control 'V-242391' do\n  title 'The Kubernetes Kubelet must have anonymous authentication disabled.'\n  desc  \"A user who has access to the Kubelet essentially has root access to\nthe nodes contained within the Kubernetes Control Plane. To control access,\nusers must be authenticated and authorized. By allowing anonymous connections,\nthe controls put in place to secure the Kubelet can be bypassed.\n\n    Setting anonymous authentication to \\\"false\\\" also disables unauthenticated\nrequests from kubelets.\n\n    While there are instances where anonymous connections may be needed (e.g.,\nhealth checks) and Role-Based Access Controls (RBAC) are in place to limit the\nanonymous access, this access must be disabled and only enabled when necessary.\n  \"\n  desc  'rationale', ''\n  desc  'check', \"\n    Change to the /etc/sysconfig/ directory on the Kubernetes Master Node. Run\nthe command:\n\n    grep -i anonymous-auth kubelet\n\n    If the setting \\\"anonymous-auth\\\" is set to \\\"true\\\" or the parameter not\nset in the Kubernetes Kubelet configuration file, this is a finding.\n  \"\n  desc 'fix', \"\n    Edit the Kubernetes Kubelet file in the/etc/sysconfig/ directory on the\nKubernetes Master Node.\n\n    Set the argument \\\"--anonymous-auth\\\" to \\\"false\\\".\n\n    Restart kubelet service using command:\n    service kubelet restart\n  \"\n  impact 0.7\n  tag severity: 'high'\n  tag gtitle: 'SRG-APP-000033-CTR-000090'\n  tag gid: 'V-242391'\n  tag rid: 'SV-242391r712529_rule'\n  tag stig_id: 'CNTR-K8-000370'\n  tag fix_id: 'F-45624r712528_fix'\n  tag cci: ['CCI-000213']\n  tag nist: ['AC-3']\n\n  describe.one do\n    describe kubelet do\n      its('anonymous-auth') { should cmp 'false' }\n    end\n\n    describe kubelet_config_file do\n      its(%w(authentication anonymous enabled)) { should cmp 'false' }\n    end\n  end\nend\n",
          "desc": "A user who has access to the Kubelet essentially has root access to\nthe nodes contained within the Kubernetes Control Plane. To control access,\nusers must be authenticated and authorized. By allowing anonymous connections,\nthe controls put in place to secure the Kubelet can be bypassed.\n\n    Setting anonymous authentication to \"false\" also disables unauthenticated\nrequests from kubelets.\n\n    While there are instances where anonymous connections may be needed (e.g.,\nhealth checks) and Role-Based Access Controls (RBAC) are in place to limit the\nanonymous access, this access must be disabled and only enabled when necessary.",
          "descriptions": [
            {
              "data": "A user who has access to the Kubelet essentially has root access to\nthe nodes contained within the Kubernetes Control Plane. To control access,\nusers must be authenticated and authorized. By allowing anonymous connections,\nthe controls put in place to secure the Kubelet can be bypassed.\n\n    Setting anonymous authentication to \"false\" also disables unauthenticated\nrequests from kubelets.\n\n    While there are instances where anonymous connections may be needed (e.g.,\nhealth checks) and Role-Based Access Controls (RBAC) are in place to limit the\nanonymous access, this access must be disabled and only enabled when necessary.",
              "label": "default"
            },
            {
              "data": "",
              "label": "rationale"
            },
            {
              "data": "Change to the /etc/sysconfig/ directory on the Kubernetes Master Node. Run\nthe command:\n\n    grep -i anonymous-auth kubelet\n\n    If the setting \"anonymous-auth\" is set to \"true\" or the parameter not\nset in the Kubernetes Kubelet configuration file, this is a finding.",
              "label": "check"
            },
            {
              "data": "Edit the Kubernetes Kubelet file in the/etc/sysconfig/ directory on the\nKubernetes Master Node.\n\n    Set the argument \"--anonymous-auth\" to \"false\".\n\n    Restart kubelet service using command:\n    service kubelet restart",
              "label": "fix"
            }
          ],
          "id": "V-242391",
          "impact": 0.7,
          "refs": [],
          "results": [],
          "source_location": {
            "line": 3,
            "ref": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242391.rb"
          },
          "tags": {
            "cci": ["CCI-000213"],
            "fix_id": "F-45624r712528_fix",
            "gid": "V-242391",
            "gtitle": "SRG-APP-000033-CTR-000090",
            "nist": ["AC-3"],
            "rid": "SV-242391r712529_rule",
            "severity": "high",
            "stig_id": "CNTR-K8-000370"
          },
          "title": "The Kubernetes Kubelet must have anonymous authentication disabled.",
          "waiver_data": {}
        },
        {
          "code": "control 'V-242392' do\n  title 'The Kubernetes kubelet must enable explicit authorization.'\n  desc  \"Kubelet is the primary agent on each node. The API server communicates\nwith each kubelet to perform tasks such as starting/stopping pods. By default,\nkubelets allow all authenticated requests, even anonymous ones, without\nrequiring any authorization checks from the API server. This default behavior\nbypasses any authorization controls put in place to limit what users may\nperform within the Kubernetes cluster. To change this behavior, the default\nsetting of AlwaysAllow for the authorization mode must be set to \\\"Webhook\\\".\"\n  desc  'rationale', ''\n  desc  'check', \"\n    Change to the /etc/sysconfig/ directory on the Kubernetes Master Node. Run\nthe command:\n\n    grep -i authorization-mode kubelet\n\n    On each Worker node, change to the /etc/sysconfig/ directory. Run the\ncommand:\n\n    grep -i authorization-mode kubelet\n\n    If authorization-mode is missing or is set to \\\"AllowAlways\\\" on the Master\nnode or any of the Worker nodes, this is a finding.\n  \"\n  desc 'fix', \"\n    Edit the Kubernetes Kubelet file in the/etc/sysconfig/ directory on the\nKubernetes Master and Worker nodes.\n\n    Set the argument --authorization-mode to \\\"Webhook\\\".\n\n    Restart each kubelet service after the change is made using the command:\n    service kubelet restart\n  \"\n  impact 0.7\n  tag severity: 'high'\n  tag gtitle: 'SRG-APP-000033-CTR-000095'\n  tag gid: 'V-242392'\n  tag rid: 'SV-242392r712532_rule'\n  tag stig_id: 'CNTR-K8-000380'\n  tag fix_id: 'F-45625r717029_fix'\n  tag cci: ['CCI-000213']\n  tag nist: ['AC-3']\n\n  describe.one do\n    describe kubelet do\n      its('authorization-mode') { should cmp 'Webhook' }\n    end\n\n    describe kubelet_config_file do\n      its(%w(authorization mode)) { should cmp 'Webhook' }\n    end\n  end\nend\n",
          "desc": "Kubelet is the primary agent on each node. The API server communicates\nwith each kubelet to perform tasks such as starting/stopping pods. By default,\nkubelets allow all authenticated requests, even anonymous ones, without\nrequiring any authorization checks from the API server. This default behavior\nbypasses any authorization controls put in place to limit what users may\nperform within the Kubernetes cluster. To change this behavior, the default\nsetting of AlwaysAllow for the authorization mode must be set to \"Webhook\".",
          "descriptions": [
            {
              "data": "Kubelet is the primary agent on each node. The API server communicates\nwith each kubelet to perform tasks such as starting/stopping pods. By default,\nkubelets allow all authenticated requests, even anonymous ones, without\nrequiring any authorization checks from the API server. This default behavior\nbypasses any authorization controls put in place to limit what users may\nperform within the Kubernetes cluster. To change this behavior, the default\nsetting of AlwaysAllow for the authorization mode must be set to \"Webhook\".",
              "label": "default"
            },
            {
              "data": "",
              "label": "rationale"
            },
            {
              "data": "Change to the /etc/sysconfig/ directory on the Kubernetes Master Node. Run\nthe command:\n\n    grep -i authorization-mode kubelet\n\n    On each Worker node, change to the /etc/sysconfig/ directory. Run the\ncommand:\n\n    grep -i authorization-mode kubelet\n\n    If authorization-mode is missing or is set to \"AllowAlways\" on the Master\nnode or any of the Worker nodes, this is a finding.",
              "label": "check"
            },
            {
              "data": "Edit the Kubernetes Kubelet file in the/etc/sysconfig/ directory on the\nKubernetes Master and Worker nodes.\n\n    Set the argument --authorization-mode to \"Webhook\".\n\n    Restart each kubelet service after the change is made using the command:\n    service kubelet restart",
              "label": "fix"
            }
          ],
          "id": "V-242392",
          "impact": 0.7,
          "refs": [],
          "results": [],
          "source_location": {
            "line": 3,
            "ref": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242392.rb"
          },
          "tags": {
            "cci": ["CCI-000213"],
            "fix_id": "F-45625r717029_fix",
            "gid": "V-242392",
            "gtitle": "SRG-APP-000033-CTR-000095",
            "nist": ["AC-3"],
            "rid": "SV-242392r712532_rule",
            "severity": "high",
            "stig_id": "CNTR-K8-000380"
          },
          "title": "The Kubernetes kubelet must enable explicit authorization.",
          "waiver_data": {}
        },
        {
          "code": "control 'V-242393' do\n  title 'Kubernetes Worker Nodes must not have sshd service running.'\n  desc  \"Worker Nodes are maintained and monitored by the Master Node. Direct\naccess and manipulation of the nodes should not take place by administrators.\nWorker nodes should be treated as immutable and updated via replacement rather\nthan in-place upgrades.\"\n  desc  'rationale', ''\n  desc  'check', \"\n    Log in to each worker node. Verify that the sshd service is not running. To\nvalidate that the service is not running, run the command:\n\n    systemctl status sshd\n\n    If the service sshd is active (running), this is a finding.\n\n    Note: If console access is not available, SSH access can be attempted. If\nthe worker nodes cannot be reached, this requirement is \\\"not a finding\\\".\n  \"\n  desc 'fix', \"\n    To stop the sshd service, run the command:\n\n    systemctl stop sshd\n\n    Note: If access to the worker node is through an SSH session, it is\nimportant to realize there are two requirements for disabling and stopping the\nsshd service and they should be done during the same SSH session. Disabling the\nservice must be performed first and then the service stopped to guarantee both\nsettings can be made if the session is interrupted.\n  \"\n  impact 0.5\n  tag severity: 'medium'\n  tag gtitle: 'SRG-APP-000033-CTR-000095'\n  tag gid: 'V-242393'\n  tag rid: 'SV-242393r717015_rule'\n  tag stig_id: 'CNTR-K8-000400'\n  tag fix_id: 'F-45626r717014_fix'\n  tag cci: ['CCI-000213']\n  tag nist: ['AC-3']\n\n  describe service('sshd') do\n    it { should_not be_running }\n  end\nend\n",
          "desc": "Worker Nodes are maintained and monitored by the Master Node. Direct\naccess and manipulation of the nodes should not take place by administrators.\nWorker nodes should be treated as immutable and updated via replacement rather\nthan in-place upgrades.",
          "descriptions": [
            {
              "data": "Worker Nodes are maintained and monitored by the Master Node. Direct\naccess and manipulation of the nodes should not take place by administrators.\nWorker nodes should be treated as immutable and updated via replacement rather\nthan in-place upgrades.",
              "label": "default"
            },
            {
              "data": "",
              "label": "rationale"
            },
            {
              "data": "Log in to each worker node. Verify that the sshd service is not running. To\nvalidate that the service is not running, run the command:\n\n    systemctl status sshd\n\n    If the service sshd is active (running), this is a finding.\n\n    Note: If console access is not available, SSH access can be attempted. If\nthe worker nodes cannot be reached, this requirement is \"not a finding\".",
              "label": "check"
            },
            {
              "data": "To stop the sshd service, run the command:\n\n    systemctl stop sshd\n\n    Note: If access to the worker node is through an SSH session, it is\nimportant to realize there are two requirements for disabling and stopping the\nsshd service and they should be done during the same SSH session. Disabling the\nservice must be performed first and then the service stopped to guarantee both\nsettings can be made if the session is interrupted.",
              "label": "fix"
            }
          ],
          "id": "V-242393",
          "impact": 0.5,
          "refs": [],
          "results": [],
          "source_location": {
            "line": 3,
            "ref": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242393.rb"
          },
          "tags": {
            "cci": ["CCI-000213"],
            "fix_id": "F-45626r717014_fix",
            "gid": "V-242393",
            "gtitle": "SRG-APP-000033-CTR-000095",
            "nist": ["AC-3"],
            "rid": "SV-242393r717015_rule",
            "severity": "medium",
            "stig_id": "CNTR-K8-000400"
          },
          "title": "Kubernetes Worker Nodes must not have sshd service running.",
          "waiver_data": {}
        },
        {
          "code": "control 'V-242394' do\n  title 'Kubernetes Worker Nodes must not have the sshd service enabled.'\n  desc  \"Worker Nodes are maintained and monitored by the Master Node. Direct\naccess and manipulation of the nodes must not take place by administrators.\nWorker nodes must be treated as immutable and updated via replacement rather\nthan in-place upgrades.\"\n  desc  'rationale', ''\n  desc  'check', \"\n    Log in to each worker node. Verify that the sshd service is not enabled. To\nvalidate the service is not enabled, run the command:\n\n    systemctl is-enabled sshd.service\n\n    If the service sshd is enabled, this is a finding.\n\n    Note: If console access is not available, SSH access can be attempted. If\nthe worker nodes cannot be reached, this requirement is \\\"not a finding\\\".\n  \"\n  desc 'fix', \"\n    To disable the sshd service, run the command:\n\n    chkconfig sshd off\n\n    Note: If access to the worker node is through an SSH session, it is\nimportant to realize there are two requirements for disabling and stopping the\nsshd service that must be done during the same SSH session. Disabling the\nservice must be performed first and then the service stopped to guarantee both\nsettings can be made if the session is interrupted.\n  \"\n  impact 0.5\n  tag severity: 'medium'\n  tag gtitle: 'SRG-APP-000033-CTR-000095'\n  tag gid: 'V-242394'\n  tag rid: 'SV-242394r717017_rule'\n  tag stig_id: 'CNTR-K8-000410'\n  tag fix_id: 'F-45627r717016_fix'\n  tag cci: ['CCI-000213']\n  tag nist: ['AC-3']\n\n  describe service('sshd') do\n    it { should_not be_enabled }\n  end\nend\n",
          "desc": "Worker Nodes are maintained and monitored by the Master Node. Direct\naccess and manipulation of the nodes must not take place by administrators.\nWorker nodes must be treated as immutable and updated via replacement rather\nthan in-place upgrades.",
          "descriptions": [
            {
              "data": "Worker Nodes are maintained and monitored by the Master Node. Direct\naccess and manipulation of the nodes must not take place by administrators.\nWorker nodes must be treated as immutable and updated via replacement rather\nthan in-place upgrades.",
              "label": "default"
            },
            {
              "data": "",
              "label": "rationale"
            },
            {
              "data": "Log in to each worker node. Verify that the sshd service is not enabled. To\nvalidate the service is not enabled, run the command:\n\n    systemctl is-enabled sshd.service\n\n    If the service sshd is enabled, this is a finding.\n\n    Note: If console access is not available, SSH access can be attempted. If\nthe worker nodes cannot be reached, this requirement is \"not a finding\".",
              "label": "check"
            },
            {
              "data": "To disable the sshd service, run the command:\n\n    chkconfig sshd off\n\n    Note: If access to the worker node is through an SSH session, it is\nimportant to realize there are two requirements for disabling and stopping the\nsshd service that must be done during the same SSH session. Disabling the\nservice must be performed first and then the service stopped to guarantee both\nsettings can be made if the session is interrupted.",
              "label": "fix"
            }
          ],
          "id": "V-242394",
          "impact": 0.5,
          "refs": [],
          "results": [],
          "source_location": {
            "line": 3,
            "ref": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242394.rb"
          },
          "tags": {
            "cci": ["CCI-000213"],
            "fix_id": "F-45627r717016_fix",
            "gid": "V-242394",
            "gtitle": "SRG-APP-000033-CTR-000095",
            "nist": ["AC-3"],
            "rid": "SV-242394r717017_rule",
            "severity": "medium",
            "stig_id": "CNTR-K8-000410"
          },
          "title": "Kubernetes Worker Nodes must not have the sshd service enabled.",
          "waiver_data": {}
        },
        {
          "code": "control 'V-242396' do\n  title 'Kubernetes Kubectl cp command must give expected access and results.'\n  desc  \"One of the tools heavily used to interact with containers in the\nKubernetes cluster is kubectl. The command is the tool System Administrators\nused to create, modify, and delete resources. One of the capabilities of the\ntool is to copy files to and from running containers (i.e., kubectl cp). The\ncommand uses the \\\"tar\\\" command of the container to copy files from the\ncontainer to the host executing the \\\"kubectl cp\\\" command. If the \\\"tar\\\"\ncommand on the container has been replaced by a malicious user, the command can\ncopy files anywhere on the host machine. This flaw has been fixed in later\nversions of the tool. It is recommended to use kubectl versions newer than\n1.12.9.\"\n  desc  'rationale', ''\n  desc  'check', \"\n    From the Master and each Worker node, check the version of kubectl by\nexecuting the command:\n\n    kubectl version --client\n\n    If the Master or any Work nodes are not using kubectl version 1.12.9 or\nnewer, this is a finding.\n  \"\n  desc 'fix', \"Upgrade the Master and Worker nodes to the latest version of\nkubectl.\"\n  impact 0.5\n  tag severity: 'medium'\n  tag gtitle: 'SRG-APP-000033-CTR-000090'\n  tag gid: 'V-242396'\n  tag rid: 'SV-242396r712544_rule'\n  tag stig_id: 'CNTR-K8-000430'\n  tag fix_id: 'F-45629r712543_fix'\n  tag cci: ['CCI-000213']\n  tag nist: ['AC-3']\n\n  kubectl = command(input('kubectl_path'))\n\n  kubectl_minversion = input('kubectl_minversion')\n\n  unless kubectl.exist?\n    impact 0.0\n    desc 'caveat', 'kubectl command available on target on the target.'\n\n    describe 'kubectl command not found on target' do\n      skip\n    end\n  end\n\n  if kubectl.exist?\n    describe json(command: \"#{input('kubectl_path')} version --client --output=json\") do\n      its(%w(clientVersion gitVersion)) { should cmp >= kubectl_minversion }\n    end\n  end\nend\n",
          "desc": "One of the tools heavily used to interact with containers in the\nKubernetes cluster is kubectl. The command is the tool System Administrators\nused to create, modify, and delete resources. One of the capabilities of the\ntool is to copy files to and from running containers (i.e., kubectl cp). The\ncommand uses the \"tar\" command of the container to copy files from the\ncontainer to the host executing the \"kubectl cp\" command. If the \"tar\"\ncommand on the container has been replaced by a malicious user, the command can\ncopy files anywhere on the host machine. This flaw has been fixed in later\nversions of the tool. It is recommended to use kubectl versions newer than\n1.12.9.",
          "descriptions": [
            {
              "data": "One of the tools heavily used to interact with containers in the\nKubernetes cluster is kubectl. The command is the tool System Administrators\nused to create, modify, and delete resources. One of the capabilities of the\ntool is to copy files to and from running containers (i.e., kubectl cp). The\ncommand uses the \"tar\" command of the container to copy files from the\ncontainer to the host executing the \"kubectl cp\" command. If the \"tar\"\ncommand on the container has been replaced by a malicious user, the command can\ncopy files anywhere on the host machine. This flaw has been fixed in later\nversions of the tool. It is recommended to use kubectl versions newer than\n1.12.9.",
              "label": "default"
            },
            {
              "data": "",
              "label": "rationale"
            },
            {
              "data": "From the Master and each Worker node, check the version of kubectl by\nexecuting the command:\n\n    kubectl version --client\n\n    If the Master or any Work nodes are not using kubectl version 1.12.9 or\nnewer, this is a finding.",
              "label": "check"
            },
            {
              "data": "Upgrade the Master and Worker nodes to the latest version of\nkubectl.",
              "label": "fix"
            }
          ],
          "id": "V-242396",
          "impact": 0.5,
          "refs": [],
          "results": [],
          "source_location": {
            "line": 3,
            "ref": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242396.rb"
          },
          "tags": {
            "cci": ["CCI-000213"],
            "fix_id": "F-45629r712543_fix",
            "gid": "V-242396",
            "gtitle": "SRG-APP-000033-CTR-000090",
            "nist": ["AC-3"],
            "rid": "SV-242396r712544_rule",
            "severity": "medium",
            "stig_id": "CNTR-K8-000430"
          },
          "title": "Kubernetes Kubectl cp command must give expected access and results.",
          "waiver_data": {}
        },
        {
          "code": "control 'V-242397' do\n  title 'The Kubernetes kubelet static PodPath must not enable static pods.'\n  desc  \"Allowing kubelet to set a staticPodPath gives containers with root\naccess permissions to traverse the hosting filesystem. The danger comes when\nthe container can create a manifest file within the /etc/kubernetes/manifests\ndirectory. When a manifest is created within this directory, containers are\nentirely governed by the Kubelet not the API Server. The container is not\nsusceptible to admission control at all. Any containers or pods that are\ninstantiated in this manner are called \\\"static pods\\\" and are meant to be used\nfor pods such as the API server, scheduler, controller, etc., not workload pods\nthat need to be governed by the API Server.\"\n  desc  'rationale', ''\n  desc  'check', \"\n    On the Master and Worker nodes, change to the /etc/sysconfig/ directory and\nrun the command:\n\n    grep -i staticPodPath kubelet\n\n    If any of the nodes return a value for staticPodPath, this is a finding.\n  \"\n  desc 'fix', \"\n    Edit the kubelet file on each node under the /etc/sysconfig directory to\nremove the staticPodPath setting and restart the kubelet service by executing\nthe command:\n\n    service kubelet restart\n  \"\n  impact 0.7\n  tag severity: 'high'\n  tag gtitle: 'SRG-APP-000033-CTR-000090'\n  tag gid: 'V-242397'\n  tag rid: 'SV-242397r712547_rule'\n  tag stig_id: 'CNTR-K8-000440'\n  tag fix_id: 'F-45630r712546_fix'\n  tag cci: ['CCI-000213']\n  tag nist: ['AC-3']\n\n  describe kubelet do\n    its('staticPodPath') { should be_nil }\n  end\n\n  describe kubelet_config_file do\n    its('staticPodPath') { should be_nil }\n  end\nend\n",
          "desc": "Allowing kubelet to set a staticPodPath gives containers with root\naccess permissions to traverse the hosting filesystem. The danger comes when\nthe container can create a manifest file within the /etc/kubernetes/manifests\ndirectory. When a manifest is created within this directory, containers are\nentirely governed by the Kubelet not the API Server. The container is not\nsusceptible to admission control at all. Any containers or pods that are\ninstantiated in this manner are called \"static pods\" and are meant to be used\nfor pods such as the API server, scheduler, controller, etc., not workload pods\nthat need to be governed by the API Server.",
          "descriptions": [
            {
              "data": "Allowing kubelet to set a staticPodPath gives containers with root\naccess permissions to traverse the hosting filesystem. The danger comes when\nthe container can create a manifest file within the /etc/kubernetes/manifests\ndirectory. When a manifest is created within this directory, containers are\nentirely governed by the Kubelet not the API Server. The container is not\nsusceptible to admission control at all. Any containers or pods that are\ninstantiated in this manner are called \"static pods\" and are meant to be used\nfor pods such as the API server, scheduler, controller, etc., not workload pods\nthat need to be governed by the API Server.",
              "label": "default"
            },
            {
              "data": "",
              "label": "rationale"
            },
            {
              "data": "On the Master and Worker nodes, change to the /etc/sysconfig/ directory and\nrun the command:\n\n    grep -i staticPodPath kubelet\n\n    If any of the nodes return a value for staticPodPath, this is a finding.",
              "label": "check"
            },
            {
              "data": "Edit the kubelet file on each node under the /etc/sysconfig directory to\nremove the staticPodPath setting and restart the kubelet service by executing\nthe command:\n\n    service kubelet restart",
              "label": "fix"
            }
          ],
          "id": "V-242397",
          "impact": 0.7,
          "refs": [],
          "results": [],
          "source_location": {
            "line": 3,
            "ref": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242397.rb"
          },
          "tags": {
            "cci": ["CCI-000213"],
            "fix_id": "F-45630r712546_fix",
            "gid": "V-242397",
            "gtitle": "SRG-APP-000033-CTR-000090",
            "nist": ["AC-3"],
            "rid": "SV-242397r712547_rule",
            "severity": "high",
            "stig_id": "CNTR-K8-000440"
          },
          "title": "The Kubernetes kubelet static PodPath must not enable static pods.",
          "waiver_data": {}
        },
        {
          "code": "control 'V-242398' do\n  title 'Kubernetes DynamicAuditing must not be enabled.'\n  desc  \"Protecting the audit data from change or deletion is important when an\nattack occurs. One way an attacker can cover their tracks is to change or\ndelete audit records. This will either make the attack unnoticeable or make it\nmore difficult to investigate how the attack took place and what changes were\nmade. The audit data can be protected through audit log file protections and\nuser authorization.\n\n    One way for an attacker to thwart these measures is to send the audit logs\nto another source and filter the audited results before sending them on to the\noriginal target. This can be done in Kubernetes through the configuration of\ndynamic audit webhooks through the DynamicAuditing flag.\n  \"\n  desc  'rationale', ''\n  desc  'check', \"\n    On the Master node, change to the manifests' directory at\n/etc/kubernetes/manifests and run the command:\n\n    grep -i feature-gates *\n\n    Review the feature-gates setting, if one is returned.\n\n    If the feature-gates setting is available and contains the DynamicAuditing\nflag set to \\\"true\\\", this is a finding.\n\n    Change to the directory /etc/sysconfig on the Master and each Worker Node\nand execute the command:\n\n    grep -i feature-gates kubelet\n\n    Review every feature-gates setting that is returned.\n\n    If any feature-gates setting is available and contains the\n\\\"DynamicAuditing\\\" flag set to \\\"true\\\", this is a finding.\n  \"\n  desc 'fix', \"Edit any manifest files or kubelet config files that contain\nthe feature-gates setting with DynamicAuditing set to \\\"true\\\". Set the flag to\n\\\"false\\\" or remove the \\\"DynamicAuditing\\\" setting completely. Restart the\nkubelet service if the kubelet config file is changed.\"\n  impact 0.5\n  tag severity: 'medium'\n  tag gtitle: 'SRG-APP-000033-CTR-000100'\n  tag gid: 'V-242398'\n  tag rid: 'SV-242398r717019_rule'\n  tag stig_id: 'CNTR-K8-000450'\n  tag fix_id: 'F-45631r717018_fix'\n  tag cci: ['CCI-000213']\n  tag nist: ['AC-3']\n\n  describe kube_scheduler do\n    its('feature-gates.to_s') { should_not match /DynamicAuditing=[T|t]rue/ }\n  end\n\n  describe kube_controller_manager do\n    its('feature-gates.to_s') { should_not match /DynamicAuditing=[T|t]rue/ }\n  end\n\n  describe kube_apiserver do\n    its('feature-gates.to_s') { should_not match /DynamicAuditing=[T|t]rue/ }\n  end\n\n  describe kubelet do\n    its('feature-gates.to_s') { should_not match /DynamicAuditing=[T|t]rue/ }\n  end\n\n  describe kubelet_config_file do\n    its(%w(featureGates DynamicAuditing)) { should_not cmp 'true' }\n  end\nend\n",
          "desc": "Protecting the audit data from change or deletion is important when an\nattack occurs. One way an attacker can cover their tracks is to change or\ndelete audit records. This will either make the attack unnoticeable or make it\nmore difficult to investigate how the attack took place and what changes were\nmade. The audit data can be protected through audit log file protections and\nuser authorization.\n\n    One way for an attacker to thwart these measures is to send the audit logs\nto another source and filter the audited results before sending them on to the\noriginal target. This can be done in Kubernetes through the configuration of\ndynamic audit webhooks through the DynamicAuditing flag.",
          "descriptions": [
            {
              "data": "Protecting the audit data from change or deletion is important when an\nattack occurs. One way an attacker can cover their tracks is to change or\ndelete audit records. This will either make the attack unnoticeable or make it\nmore difficult to investigate how the attack took place and what changes were\nmade. The audit data can be protected through audit log file protections and\nuser authorization.\n\n    One way for an attacker to thwart these measures is to send the audit logs\nto another source and filter the audited results before sending them on to the\noriginal target. This can be done in Kubernetes through the configuration of\ndynamic audit webhooks through the DynamicAuditing flag.",
              "label": "default"
            },
            {
              "data": "",
              "label": "rationale"
            },
            {
              "data": "On the Master node, change to the manifests' directory at\n/etc/kubernetes/manifests and run the command:\n\n    grep -i feature-gates *\n\n    Review the feature-gates setting, if one is returned.\n\n    If the feature-gates setting is available and contains the DynamicAuditing\nflag set to \"true\", this is a finding.\n\n    Change to the directory /etc/sysconfig on the Master and each Worker Node\nand execute the command:\n\n    grep -i feature-gates kubelet\n\n    Review every feature-gates setting that is returned.\n\n    If any feature-gates setting is available and contains the\n\"DynamicAuditing\" flag set to \"true\", this is a finding.",
              "label": "check"
            },
            {
              "data": "Edit any manifest files or kubelet config files that contain\nthe feature-gates setting with DynamicAuditing set to \"true\". Set the flag to\n\"false\" or remove the \"DynamicAuditing\" setting completely. Restart the\nkubelet service if the kubelet config file is changed.",
              "label": "fix"
            }
          ],
          "id": "V-242398",
          "impact": 0.5,
          "refs": [],
          "results": [],
          "source_location": {
            "line": 3,
            "ref": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242398.rb"
          },
          "tags": {
            "cci": ["CCI-000213"],
            "fix_id": "F-45631r717018_fix",
            "gid": "V-242398",
            "gtitle": "SRG-APP-000033-CTR-000100",
            "nist": ["AC-3"],
            "rid": "SV-242398r717019_rule",
            "severity": "medium",
            "stig_id": "CNTR-K8-000450"
          },
          "title": "Kubernetes DynamicAuditing must not be enabled.",
          "waiver_data": {}
        },
        {
          "code": "control 'V-242399' do\n  title 'Kubernetes DynamicKubeletConfig must not be enabled.'\n  desc  \"Kubernetes allows a user to configure kubelets with dynamic\nconfigurations. When dynamic configuration is used, the kubelet will watch for\nchanges to the configuration file. When changes are made, the kubelet will\nautomatically restart. Allowing this capability bypasses access restrictions\nand authorizations. Using this capability, an attacker can lower the security\nposture of the kubelet, which includes allowing the ability to run arbitrary\ncommands in any container running on that node.\"\n  desc  'rationale', ''\n  desc  'check', \"\n    On the Master node, change to the manifests' directory at\n/etc/kubernetes/manifests and run the command:\n\n    grep -i feature-gates *\n\n    Review the feature-gates setting if one is returned.\n\n    If the feature-gates setting does not exist or feature-gates does not\ncontain the DynamicKubeletConfig flag or the \\\"DynamicKubletConfig\\\" flag is\nset to \\\"true\\\", this is a finding.\n\n    Change to the directory /etc/sysconfig on the Master and each Worker node\nand execute the command:\n\n    grep -i feature-gates kubelet\n\n    Review every feature-gates setting if one is returned.\n\n    If the feature-gates setting does not exist or feature-gates does not\ncontain the DynamicKubeletConfig flag or the DynamicKubletConfig flag is set to\n\\\"true\\\", this is a finding.\n  \"\n  desc 'fix', \"\n    Edit any manifest file or kubelet config file that does not contain a\nfeature-gates setting or has DynamicKubeletConfig set to \\\"true\\\".\n\n    An omission of DynamicKubeletConfig within the feature-gates defaults to\ntrue. Set DynamicKubeletConfig to \\\"false\\\". Restart the kubelet service if the\nkubelet config file is changed.\n  \"\n  impact 0.5\n  tag severity: 'medium'\n  tag gtitle: 'SRG-APP-000033-CTR-000095'\n  tag gid: 'V-242399'\n  tag rid: 'SV-242399r717021_rule'\n  tag stig_id: 'CNTR-K8-000460'\n  tag fix_id: 'F-45632r717020_fix'\n  tag cci: ['CCI-000213']\n  tag nist: ['AC-3']\n\n  describe kube_scheduler do\n    its('feature-gates.to_s') { should match /DynamicKubeletConfig=[F|f]alse/ }\n  end\n\n  describe kube_controller_manager do\n    its('feature-gates.to_s') { should match /DynamicKubeletConfig=[F|f]alse/ }\n  end\n\n  describe kube_apiserver do\n    its('feature-gates.to_s') { should match /DynamicKubeletConfig=[F|f]alse/ }\n  end\n\n  describe.one do\n    describe kubelet do\n      its('feature-gates.to_s') { should match /DynamicKubeletConfig=[F|f]alse/ }\n    end\n    describe kubelet_config_file do\n      its(%w(featureGates DynamicKubeletConfig)) { should_not cmp 'false' }\n    end\n  end\nend\n",
          "desc": "Kubernetes allows a user to configure kubelets with dynamic\nconfigurations. When dynamic configuration is used, the kubelet will watch for\nchanges to the configuration file. When changes are made, the kubelet will\nautomatically restart. Allowing this capability bypasses access restrictions\nand authorizations. Using this capability, an attacker can lower the security\nposture of the kubelet, which includes allowing the ability to run arbitrary\ncommands in any container running on that node.",
          "descriptions": [
            {
              "data": "Kubernetes allows a user to configure kubelets with dynamic\nconfigurations. When dynamic configuration is used, the kubelet will watch for\nchanges to the configuration file. When changes are made, the kubelet will\nautomatically restart. Allowing this capability bypasses access restrictions\nand authorizations. Using this capability, an attacker can lower the security\nposture of the kubelet, which includes allowing the ability to run arbitrary\ncommands in any container running on that node.",
              "label": "default"
            },
            {
              "data": "",
              "label": "rationale"
            },
            {
              "data": "On the Master node, change to the manifests' directory at\n/etc/kubernetes/manifests and run the command:\n\n    grep -i feature-gates *\n\n    Review the feature-gates setting if one is returned.\n\n    If the feature-gates setting does not exist or feature-gates does not\ncontain the DynamicKubeletConfig flag or the \"DynamicKubletConfig\" flag is\nset to \"true\", this is a finding.\n\n    Change to the directory /etc/sysconfig on the Master and each Worker node\nand execute the command:\n\n    grep -i feature-gates kubelet\n\n    Review every feature-gates setting if one is returned.\n\n    If the feature-gates setting does not exist or feature-gates does not\ncontain the DynamicKubeletConfig flag or the DynamicKubletConfig flag is set to\n\"true\", this is a finding.",
              "label": "check"
            },
            {
              "data": "Edit any manifest file or kubelet config file that does not contain a\nfeature-gates setting or has DynamicKubeletConfig set to \"true\".\n\n    An omission of DynamicKubeletConfig within the feature-gates defaults to\ntrue. Set DynamicKubeletConfig to \"false\". Restart the kubelet service if the\nkubelet config file is changed.",
              "label": "fix"
            }
          ],
          "id": "V-242399",
          "impact": 0.5,
          "refs": [],
          "results": [],
          "source_location": {
            "line": 3,
            "ref": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242399.rb"
          },
          "tags": {
            "cci": ["CCI-000213"],
            "fix_id": "F-45632r717020_fix",
            "gid": "V-242399",
            "gtitle": "SRG-APP-000033-CTR-000095",
            "nist": ["AC-3"],
            "rid": "SV-242399r717021_rule",
            "severity": "medium",
            "stig_id": "CNTR-K8-000460"
          },
          "title": "Kubernetes DynamicKubeletConfig must not be enabled.",
          "waiver_data": {}
        },
        {
          "code": "control 'V-242400' do\n  title 'The Kubernetes API server must have Alpha APIs disabled.'\n  desc  \"Kubernetes allows alpha API calls within the API server. The alpha\nfeatures are disabled by default since they are not ready for production and\nlikely to change without notice. These features may also contain security\nissues that are rectified as the feature matures. To keep the Kubernetes\ncluster secure and stable, these alpha features must not be used.\"\n  desc  'rationale', ''\n  desc  'check', \"\n    On the Master node, change to the manifests' directory at\n/etc/kubernetes/manifests and run the command:\n\n    grep -i feature-gates *\n\n    Review the feature-gates setting, if one is returned.\n\n    If the feature-gates setting is available and contains the AllAlpha flag\nset to \\\"true\\\", this is a finding.\n  \"\n  desc 'fix', \"\n    Edit any manifest files that contain the feature-gates setting with\nAllAlpha set to \\\"true\\\". Set the flag to \\\"false\\\" or remove the AllAlpha\nsetting completely.\n    (AllAlpha- default=false)\n  \"\n  impact 0.5\n  tag severity: 'medium'\n  tag gtitle: 'SRG-APP-000033-CTR-000090'\n  tag gid: 'V-242400'\n  tag rid: 'SV-242400r712556_rule'\n  tag stig_id: 'CNTR-K8-000470'\n  tag fix_id: 'F-45633r712555_fix'\n  tag cci: ['CCI-000213']\n  tag nist: ['AC-3']\n\n  describe kube_scheduler do\n    its('feature-gates.to_s') { should_not match /AllAlpha=[T|t]rue/ }\n  end\n\n  describe kube_controller_manager do\n    its('feature-gates.to_s') { should_not match /AllAlpha=[T|t]rue/ }\n  end\n\n  describe kube_apiserver do\n    its('feature-gates.to_s') { should_not match /AllAlpha=[T|t]rue/ }\n  end\n\n  describe kubelet do\n    its('feature-gates.to_s') { should_not match /AllAlpha=[T|t]rue/ }\n  end\n\n  describe kubelet_config_file do\n    its(%w(featureGates AllAlpha)) { should_not cmp 'true' }\n  end\nend\n",
          "desc": "Kubernetes allows alpha API calls within the API server. The alpha\nfeatures are disabled by default since they are not ready for production and\nlikely to change without notice. These features may also contain security\nissues that are rectified as the feature matures. To keep the Kubernetes\ncluster secure and stable, these alpha features must not be used.",
          "descriptions": [
            {
              "data": "Kubernetes allows alpha API calls within the API server. The alpha\nfeatures are disabled by default since they are not ready for production and\nlikely to change without notice. These features may also contain security\nissues that are rectified as the feature matures. To keep the Kubernetes\ncluster secure and stable, these alpha features must not be used.",
              "label": "default"
            },
            {
              "data": "",
              "label": "rationale"
            },
            {
              "data": "On the Master node, change to the manifests' directory at\n/etc/kubernetes/manifests and run the command:\n\n    grep -i feature-gates *\n\n    Review the feature-gates setting, if one is returned.\n\n    If the feature-gates setting is available and contains the AllAlpha flag\nset to \"true\", this is a finding.",
              "label": "check"
            },
            {
              "data": "Edit any manifest files that contain the feature-gates setting with\nAllAlpha set to \"true\". Set the flag to \"false\" or remove the AllAlpha\nsetting completely.\n    (AllAlpha- default=false)",
              "label": "fix"
            }
          ],
          "id": "V-242400",
          "impact": 0.5,
          "refs": [],
          "results": [],
          "source_location": {
            "line": 3,
            "ref": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242400.rb"
          },
          "tags": {
            "cci": ["CCI-000213"],
            "fix_id": "F-45633r712555_fix",
            "gid": "V-242400",
            "gtitle": "SRG-APP-000033-CTR-000090",
            "nist": ["AC-3"],
            "rid": "SV-242400r712556_rule",
            "severity": "medium",
            "stig_id": "CNTR-K8-000470"
          },
          "title": "The Kubernetes API server must have Alpha APIs disabled.",
          "waiver_data": {}
        },
        {
          "code": "control 'V-242401' do\n  title 'The Kubernetes API Server must have an audit policy set.'\n  desc  \"When Kubernetes is started, components and user services are started.\nFor auditing startup events, and events for components and services, it is\nimportant that auditing begin on startup. Within Kubernetes, audit data for all\ncomponents is generated by the API server. To enable auditing to begin, an\naudit policy must be defined for the events and the information to be stored\nwith each event. It is also necessary to give a secure location where the audit\nlogs are to be stored. If an audit log path is not specified, all audit data is\nsent to studio.\"\n  desc  'rationale', ''\n  desc  'check', \"\n    Change to the /etc/kubernetes/manifests directory on the Kubernetes Master\nNode. Run the command:\n\n    grep -i audit-policy-file *\n\n    If the audit-policy-file is not set, this is a finding.\n  \"\n  desc 'fix', \"\n    Edit the Kubernetes API Server manifest and set \\\"--audit-policy-file\\\" to\nthe audit policy file.\n\n    Note: If the API server is running as a Pod, then the manifest will also\nneed to be updated to mount the host system filesystem where the audit policy\nfile resides.\n  \"\n  impact 0.5\n  tag severity: 'medium'\n  tag gtitle: 'SRG-APP-000092-CTR-000165'\n  tag gid: 'V-242401'\n  tag rid: 'SV-242401r712559_rule'\n  tag stig_id: 'CNTR-K8-000600'\n  tag fix_id: 'F-45634r717023_fix'\n  tag cci: ['CCI-001464']\n  tag nist: ['AU-14 (1)']\n\n  unless kube_apiserver.exist?\n    impact 0.0\n    desc 'caveat', 'Kubernetes API Server process is not running on the target.'\n  end\n\n  describe kube_apiserver do\n    its('audit-policy-file') { should_not be_nil }\n  end\nend\n",
          "desc": "When Kubernetes is started, components and user services are started.\nFor auditing startup events, and events for components and services, it is\nimportant that auditing begin on startup. Within Kubernetes, audit data for all\ncomponents is generated by the API server. To enable auditing to begin, an\naudit policy must be defined for the events and the information to be stored\nwith each event. It is also necessary to give a secure location where the audit\nlogs are to be stored. If an audit log path is not specified, all audit data is\nsent to studio.",
          "descriptions": [
            {
              "data": "When Kubernetes is started, components and user services are started.\nFor auditing startup events, and events for components and services, it is\nimportant that auditing begin on startup. Within Kubernetes, audit data for all\ncomponents is generated by the API server. To enable auditing to begin, an\naudit policy must be defined for the events and the information to be stored\nwith each event. It is also necessary to give a secure location where the audit\nlogs are to be stored. If an audit log path is not specified, all audit data is\nsent to studio.",
              "label": "default"
            },
            {
              "data": "",
              "label": "rationale"
            },
            {
              "data": "Change to the /etc/kubernetes/manifests directory on the Kubernetes Master\nNode. Run the command:\n\n    grep -i audit-policy-file *\n\n    If the audit-policy-file is not set, this is a finding.",
              "label": "check"
            },
            {
              "data": "Edit the Kubernetes API Server manifest and set \"--audit-policy-file\" to\nthe audit policy file.\n\n    Note: If the API server is running as a Pod, then the manifest will also\nneed to be updated to mount the host system filesystem where the audit policy\nfile resides.",
              "label": "fix"
            }
          ],
          "id": "V-242401",
          "impact": 0.5,
          "refs": [],
          "results": [],
          "source_location": {
            "line": 3,
            "ref": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242401.rb"
          },
          "tags": {
            "cci": ["CCI-001464"],
            "fix_id": "F-45634r717023_fix",
            "gid": "V-242401",
            "gtitle": "SRG-APP-000092-CTR-000165",
            "nist": ["AU-14 (1)"],
            "rid": "SV-242401r712559_rule",
            "severity": "medium",
            "stig_id": "CNTR-K8-000600"
          },
          "title": "The Kubernetes API Server must have an audit policy set.",
          "waiver_data": {}
        },
        {
          "code": "control 'V-242402' do\n  title 'The Kubernetes API Server must have an audit log path set.'\n  desc  \"When Kubernetes is started, components and user services are started\nfor auditing startup events, and events for components and services, it is\nimportant that auditing begin on startup. Within Kubernetes, audit data for all\ncomponents is generated by the API server. To enable auditing to begin, an\naudit policy must be defined for the events and the information to be stored\nwith each event. It is also necessary to give a secure location where the audit\nlogs are to be stored. If an audit log path is not specified, all audit data is\nsent to studio.\"\n  desc  'rationale', ''\n  desc  'check', \"\n    Change to the /etc/kubernetes/manifests directory on the Kubernetes Master\nNode. Run the command:\n\n    grep -i audit-log-path *\n\n    If the audit-log-path is not set, this is a finding.\n  \"\n  desc 'fix', \"\n    Edit the Kubernetes API Server manifest and set \\\"--audit-log-path\\\" to a\nsecure location for the audit logs to be written.\n\n    Note: If the API server is running as a Pod, then the manifest will also\nneed to be updated to mount the host system filesystem where the audit log file\nis to be written.\n  \"\n  impact 0.5\n  tag severity: 'medium'\n  tag gtitle: 'SRG-APP-000092-CTR-000165'\n  tag gid: 'V-242402'\n  tag rid: 'SV-242402r712562_rule'\n  tag stig_id: 'CNTR-K8-000610'\n  tag fix_id: 'F-45635r717024_fix'\n  tag cci: ['CCI-001464']\n  tag nist: ['AU-14 (1)']\n\n  unless kube_apiserver.exist?\n    impact 0.0\n    desc 'caveat', 'Kubernetes API Server process is not running on the target.'\n  end\n\n  describe kube_apiserver do\n    its('audit-log-path') { should_not be_nil }\n  end\nend\n",
          "desc": "When Kubernetes is started, components and user services are started\nfor auditing startup events, and events for components and services, it is\nimportant that auditing begin on startup. Within Kubernetes, audit data for all\ncomponents is generated by the API server. To enable auditing to begin, an\naudit policy must be defined for the events and the information to be stored\nwith each event. It is also necessary to give a secure location where the audit\nlogs are to be stored. If an audit log path is not specified, all audit data is\nsent to studio.",
          "descriptions": [
            {
              "data": "When Kubernetes is started, components and user services are started\nfor auditing startup events, and events for components and services, it is\nimportant that auditing begin on startup. Within Kubernetes, audit data for all\ncomponents is generated by the API server. To enable auditing to begin, an\naudit policy must be defined for the events and the information to be stored\nwith each event. It is also necessary to give a secure location where the audit\nlogs are to be stored. If an audit log path is not specified, all audit data is\nsent to studio.",
              "label": "default"
            },
            {
              "data": "",
              "label": "rationale"
            },
            {
              "data": "Change to the /etc/kubernetes/manifests directory on the Kubernetes Master\nNode. Run the command:\n\n    grep -i audit-log-path *\n\n    If the audit-log-path is not set, this is a finding.",
              "label": "check"
            },
            {
              "data": "Edit the Kubernetes API Server manifest and set \"--audit-log-path\" to a\nsecure location for the audit logs to be written.\n\n    Note: If the API server is running as a Pod, then the manifest will also\nneed to be updated to mount the host system filesystem where the audit log file\nis to be written.",
              "label": "fix"
            }
          ],
          "id": "V-242402",
          "impact": 0.5,
          "refs": [],
          "results": [],
          "source_location": {
            "line": 3,
            "ref": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242402.rb"
          },
          "tags": {
            "cci": ["CCI-001464"],
            "fix_id": "F-45635r717024_fix",
            "gid": "V-242402",
            "gtitle": "SRG-APP-000092-CTR-000165",
            "nist": ["AU-14 (1)"],
            "rid": "SV-242402r712562_rule",
            "severity": "medium",
            "stig_id": "CNTR-K8-000610"
          },
          "title": "The Kubernetes API Server must have an audit log path set.",
          "waiver_data": {}
        },
        {
          "code": "control 'V-242403' do\n  title \"Kubernetes API Server must generate audit records that identify what\ntype of event has occurred, identify the source of the event, contain the event\nresults, identify any users, and identify any containers associated with the\nevent.\"\n  desc  \"Within Kubernetes, audit data for all components is generated by the\nAPI server. This audit data is important when there are issues, to include\nsecurity incidents that must be investigated. To make the audit data worthwhile\nfor the investigation of events, it is necessary to have the appropriate and\nrequired data logged. To fully understand the event, it is important to\nidentify any users associated with the event.\n\n    The API server policy file allows for the following levels of auditing:\n          None - Do not log events that match the rule.\n          Metadata - Log request metadata (requesting user, timestamp,\nresource, verb, etc.) but not request or response body.\n          Request - Log event metadata and request body but not response body.\n          RequestResponse - Log event metadata, request, and response bodies.\n\n\n  \"\n  desc  'rationale', ''\n  desc  'check', \"\n    Change to the /etc/kubernetes/manifests directory on the Kubernetes Master\nNode. Run the command:\n\n    grep -i audit-policy-file\n\n    If the audit-policy-file is not set, this is a finding.\n\n    The file given is the policy file and defines what is audited and what\ninformation is included with each event.\n\n    The policy file must look like this:\n\n    # Log all requests at the RequestResponse level.\n    apiVersion: audit.k8s.io/vX (Where X is the latest apiVersion)\n    kind: Policy\n    rules:\n    - level: RequestResponse\n\n    If the audit policy file does not look like above, this is a finding.\n  \"\n  desc 'fix', \"\n    Edit the Kubernetes API Server audit policy and set it to look like the\nfollowing:\n\n    # Log all requests at the RequestResponse level.\n    apiVersion: audit.k8s.io/vX (Where X is the latest apiVersion)\n    kind: Policy\n    rules:\n    - level: RequestResponse\n  \"\n  impact 0.5\n  tag severity: 'medium'\n  tag gtitle: 'SRG-APP-000026-CTR-000070'\n  tag satisfies: ['SRG-APP-000026-CTR-000070', 'SRG-APP-000027-CTR-000075',\n                  'SRG-APP-000028-CTR-000080', 'SRG-APP-000101-CTR-000205',\n                  'SRG-APP-000100-CTR-000200', 'SRG-APP-000100-CTR-000195',\n                  'SRG-APP-000099-CTR-000190', 'SRG-APP-000098-CTR-000185',\n                  'SRG-APP-000095-CTR-000170', 'SRG-APP-000096-CTR-000175',\n                  'SRG-APP-000097-CTR-000180', 'SRG-APP-000507-CTR-001295',\n                  'SRG-APP-000504-CTR-001280', 'SRG-APP-000503-CTR-001275',\n                  'SRG-APP-000501-CTR-001265', 'SRG-APP-000500-CTR-001260',\n                  'SRG-APP-000497-CTR-001245', 'SRG-APP-000496-CTR-001240',\n                  'SRG-APP-000493-CTR-001225', 'SRG-APP-000492-CTR-001220',\n                  'SRG-APP-000343-CTR-000780', 'SRG-APP-000381-CTR-000905']\n  tag gid: 'V-242403'\n  tag rid: 'SV-242403r712565_rule'\n  tag stig_id: 'CNTR-K8-000700'\n  tag fix_id: 'F-45636r712564_fix'\n  tag cci: ['CCI-000018', 'CCI-000130', 'CCI-000131', 'CCI-000132',\n            'CCI-000133', 'CCI-000134', 'CCI-000135', 'CCI-000172', 'CCI-001403',\n            'CCI-001404', 'CCI-001487', 'CCI-001814', 'CCI-002234']\n  tag nist: ['AC-2 (4)', 'AU-3', 'AU-3', 'AU-3', 'AU-3', 'AU-3', 'AU-3 (1)',\n             'AU-12 c', 'AC-2 (4)', 'AC-2 (4)', 'AU-3', 'CM-5 (1)', 'AC-6 (9)']\n\n  unless kube_apiserver.exist?\n    impact 0.0\n    desc 'caveat', 'Kubernetes API Server process is not running on the target.'\n  end\n\n  describe kube_apiserver do\n    its('audit-policy-file') { should_not be_nil }\n  end\n\n  if !kube_apiserver.params['audit-policy-file'].nil? &&\n     file(kube_apiserver.params['audit-policy-file'].join).exist?\n\n    describe yaml(kube_apiserver.params['audit-policy-file'].join) do\n      its('rules') { should cmp [{ 'level' => 'RequestResponse' }] }\n    end\n  end\nend\n",
          "desc": "Within Kubernetes, audit data for all components is generated by the\nAPI server. This audit data is important when there are issues, to include\nsecurity incidents that must be investigated. To make the audit data worthwhile\nfor the investigation of events, it is necessary to have the appropriate and\nrequired data logged. To fully understand the event, it is important to\nidentify any users associated with the event.\n\n    The API server policy file allows for the following levels of auditing:\n          None - Do not log events that match the rule.\n          Metadata - Log request metadata (requesting user, timestamp,\nresource, verb, etc.) but not request or response body.\n          Request - Log event metadata and request body but not response body.\n          RequestResponse - Log event metadata, request, and response bodies.",
          "descriptions": [
            {
              "data": "Within Kubernetes, audit data for all components is generated by the\nAPI server. This audit data is important when there are issues, to include\nsecurity incidents that must be investigated. To make the audit data worthwhile\nfor the investigation of events, it is necessary to have the appropriate and\nrequired data logged. To fully understand the event, it is important to\nidentify any users associated with the event.\n\n    The API server policy file allows for the following levels of auditing:\n          None - Do not log events that match the rule.\n          Metadata - Log request metadata (requesting user, timestamp,\nresource, verb, etc.) but not request or response body.\n          Request - Log event metadata and request body but not response body.\n          RequestResponse - Log event metadata, request, and response bodies.",
              "label": "default"
            },
            {
              "data": "",
              "label": "rationale"
            },
            {
              "data": "Change to the /etc/kubernetes/manifests directory on the Kubernetes Master\nNode. Run the command:\n\n    grep -i audit-policy-file\n\n    If the audit-policy-file is not set, this is a finding.\n\n    The file given is the policy file and defines what is audited and what\ninformation is included with each event.\n\n    The policy file must look like this:\n\n    # Log all requests at the RequestResponse level.\n    apiVersion: audit.k8s.io/vX (Where X is the latest apiVersion)\n    kind: Policy\n    rules:\n    - level: RequestResponse\n\n    If the audit policy file does not look like above, this is a finding.",
              "label": "check"
            },
            {
              "data": "Edit the Kubernetes API Server audit policy and set it to look like the\nfollowing:\n\n    # Log all requests at the RequestResponse level.\n    apiVersion: audit.k8s.io/vX (Where X is the latest apiVersion)\n    kind: Policy\n    rules:\n    - level: RequestResponse",
              "label": "fix"
            }
          ],
          "id": "V-242403",
          "impact": 0.5,
          "refs": [],
          "results": [],
          "source_location": {
            "line": 3,
            "ref": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242403.rb"
          },
          "tags": {
            "cci": [
              "CCI-000018",
              "CCI-000130",
              "CCI-000131",
              "CCI-000132",
              "CCI-000133",
              "CCI-000134",
              "CCI-000135",
              "CCI-000172",
              "CCI-001403",
              "CCI-001404",
              "CCI-001487",
              "CCI-001814",
              "CCI-002234"
            ],
            "fix_id": "F-45636r712564_fix",
            "gid": "V-242403",
            "gtitle": "SRG-APP-000026-CTR-000070",
            "nist": [
              "AC-2 (4)",
              "AU-3",
              "AU-3",
              "AU-3",
              "AU-3",
              "AU-3",
              "AU-3 (1)",
              "AU-12 c",
              "AC-2 (4)",
              "AC-2 (4)",
              "AU-3",
              "CM-5 (1)",
              "AC-6 (9)"
            ],
            "rid": "SV-242403r712565_rule",
            "satisfies": [
              "SRG-APP-000026-CTR-000070",
              "SRG-APP-000027-CTR-000075",
              "SRG-APP-000028-CTR-000080",
              "SRG-APP-000101-CTR-000205",
              "SRG-APP-000100-CTR-000200",
              "SRG-APP-000100-CTR-000195",
              "SRG-APP-000099-CTR-000190",
              "SRG-APP-000098-CTR-000185",
              "SRG-APP-000095-CTR-000170",
              "SRG-APP-000096-CTR-000175",
              "SRG-APP-000097-CTR-000180",
              "SRG-APP-000507-CTR-001295",
              "SRG-APP-000504-CTR-001280",
              "SRG-APP-000503-CTR-001275",
              "SRG-APP-000501-CTR-001265",
              "SRG-APP-000500-CTR-001260",
              "SRG-APP-000497-CTR-001245",
              "SRG-APP-000496-CTR-001240",
              "SRG-APP-000493-CTR-001225",
              "SRG-APP-000492-CTR-001220",
              "SRG-APP-000343-CTR-000780",
              "SRG-APP-000381-CTR-000905"
            ],
            "severity": "medium",
            "stig_id": "CNTR-K8-000700"
          },
          "title": "Kubernetes API Server must generate audit records that identify what\ntype of event has occurred, identify the source of the event, contain the event\nresults, identify any users, and identify any containers associated with the\nevent.",
          "waiver_data": {}
        },
        {
          "code": "control 'V-242404' do\n  title 'Kubernetes Kubelet must deny hostname override.'\n  desc  \"Kubernetes allows for the overriding of hostnames. Allowing this\nfeature to be implemented within the kubelets may break the TLS setup between\nthe kubelet service and the API server. This setting also can make it difficult\nto associate logs with nodes if security analytics needs to take place. The\nbetter practice is to setup nodes with resolvable FQDNs and avoid overriding\nthe hostnames.\"\n  desc  'rationale', ''\n  desc  'check', \"\n    On the Master and each Worker node, change to the /etc/sysconfig/ directory\nand run the command:\n\n    grep -i hostname-override kubelet\n    --hostname-override\n\n    If any of the nodes have the setting \\\"hostname-override\\\" present, this is\na finding.\n  \"\n  desc 'fix', \"\n    Edit the Kubernetes Kubelet file in the /etc/sysconfig directory on the\nMaster and Worker nodes and remove the \\\"--hostname-override\\\" setting. Restart\nthe service after the change is made by running:\n\n    service kubelet restart\n  \"\n  impact 0.5\n  tag severity: 'medium'\n  tag gtitle: 'SRG-APP-000133-CTR-000290'\n  tag gid: 'V-242404'\n  tag rid: 'SV-242404r712568_rule'\n  tag stig_id: 'CNTR-K8-000850'\n  tag fix_id: 'F-45637r712567_fix'\n  tag cci: ['CCI-001499']\n  tag nist: ['CM-5 (6)']\n\n  describe kubelet do\n    its('hostname-override') { should be_nil }\n  end\nend\n",
          "desc": "Kubernetes allows for the overriding of hostnames. Allowing this\nfeature to be implemented within the kubelets may break the TLS setup between\nthe kubelet service and the API server. This setting also can make it difficult\nto associate logs with nodes if security analytics needs to take place. The\nbetter practice is to setup nodes with resolvable FQDNs and avoid overriding\nthe hostnames.",
          "descriptions": [
            {
              "data": "Kubernetes allows for the overriding of hostnames. Allowing this\nfeature to be implemented within the kubelets may break the TLS setup between\nthe kubelet service and the API server. This setting also can make it difficult\nto associate logs with nodes if security analytics needs to take place. The\nbetter practice is to setup nodes with resolvable FQDNs and avoid overriding\nthe hostnames.",
              "label": "default"
            },
            {
              "data": "",
              "label": "rationale"
            },
            {
              "data": "On the Master and each Worker node, change to the /etc/sysconfig/ directory\nand run the command:\n\n    grep -i hostname-override kubelet\n    --hostname-override\n\n    If any of the nodes have the setting \"hostname-override\" present, this is\na finding.",
              "label": "check"
            },
            {
              "data": "Edit the Kubernetes Kubelet file in the /etc/sysconfig directory on the\nMaster and Worker nodes and remove the \"--hostname-override\" setting. Restart\nthe service after the change is made by running:\n\n    service kubelet restart",
              "label": "fix"
            }
          ],
          "id": "V-242404",
          "impact": 0.5,
          "refs": [],
          "results": [],
          "source_location": {
            "line": 3,
            "ref": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242404.rb"
          },
          "tags": {
            "cci": ["CCI-001499"],
            "fix_id": "F-45637r712567_fix",
            "gid": "V-242404",
            "gtitle": "SRG-APP-000133-CTR-000290",
            "nist": ["CM-5 (6)"],
            "rid": "SV-242404r712568_rule",
            "severity": "medium",
            "stig_id": "CNTR-K8-000850"
          },
          "title": "Kubernetes Kubelet must deny hostname override.",
          "waiver_data": {}
        },
        {
          "code": "  control 'V-242405' do\n    impact 0.0\n    desc 'caveat', 'K3S deployments are not applied using manifest files and hence non-applicable.'\n  end\n",
          "desc": "The manifest files contain the runtime configuration of the API\nserver, proxy, scheduler, controller, and etcd. If an attacker can gain access\nto these files, changes can be made to open vulnerabilities and bypass user\nauthorizations inherit within Kubernetes with RBAC implemented.",
          "descriptions": [
            {
              "data": "The manifest files contain the runtime configuration of the API\nserver, proxy, scheduler, controller, and etcd. If an attacker can gain access\nto these files, changes can be made to open vulnerabilities and bypass user\nauthorizations inherit within Kubernetes with RBAC implemented.",
              "label": "default"
            },
            {
              "data": "",
              "label": "rationale"
            },
            {
              "data": "On the Master node, change to the /etc/kubernetes/manifest directory. Run\nthe command:\n\n    ls -l *\n\n    Each manifest file must be owned by root:root.\n\n    If any manifest file is not owned by root:root, this is a finding.",
              "label": "check"
            },
            {
              "data": "On the Master node, change to the /etc/kubernetes/manifest directory. Run\nthe command:\n\n    chown root:root *\n\n    To verify the change took place, run the command:\n\n    ls -l *\n\n    All the manifest files should be owned by root:root.",
              "label": "fix"
            },
            {
              "data": "K3S deployments are not applied using manifest files and hence non-applicable.",
              "label": "caveat"
            }
          ],
          "id": "V-242405",
          "impact": 0.0,
          "refs": [
            {
              "ref": []
            }
          ],
          "results": [],
          "source_location": {
            "line": 3,
            "ref": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242405.rb"
          },
          "tags": {
            "cci": ["CCI-001499"],
            "fix_id": "F-45638r712570_fix",
            "gid": "V-242405",
            "gtitle": "SRG-APP-000133-CTR-000295",
            "nist": ["CM-5 (6)"],
            "rid": "SV-242405r712571_rule",
            "severity": "medium",
            "stig_id": "CNTR-K8-000860"
          },
          "title": "The Kubernetes manifests must be owned by root.",
          "waiver_data": {}
        },
        {
          "code": "control 'V-242406' do\n  title 'The Kubernetes kubelet configuration file must be owned by root.'\n  desc  \"The kubelet configuration file contains the runtime configuration of\nthe kubelet service. If an attacker can gain access to this file, changes can\nbe made to open vulnerabilities and bypass user authorizations inherent within\nKubernetes with RBAC implemented.\"\n  desc  'rationale', ''\n  desc  'check', \"\n    On the Master and worker nodes, change to the /etc/sysconfig directory. Run\nthe command:\n\n    ls -l kubelet\n\n    Each kubelet configuration file must be owned by root:root.\n\n    If any manifest file is not owned by root:root, this is a finding.\n  \"\n  desc 'fix', \"\n    On the Master and Worker nodes, change to the /etc/sysconfig directory. Run\nthe command:\n\n    chown root:root kubelet\n\n    To verify the change took place, run the command:\n\n    ls -l kubelet\n\n    The kubelet file should now be owned by root:root.\n  \"\n  impact 0.5\n  tag severity: 'medium'\n  tag gtitle: 'SRG-APP-000133-CTR-000300'\n  tag gid: 'V-242406'\n  tag rid: 'SV-242406r712574_rule'\n  tag stig_id: 'CNTR-K8-000880'\n  tag fix_id: 'F-45639r712573_fix'\n  tag cci: ['CCI-001499']\n  tag nist: ['CM-5 (6)']\n\n  describe kubelet do\n    its('config_file') { should be_owned_by('root') }\n    its('config_file') { should be_grouped_into('root') }\n  end\nend\n",
          "desc": "The kubelet configuration file contains the runtime configuration of\nthe kubelet service. If an attacker can gain access to this file, changes can\nbe made to open vulnerabilities and bypass user authorizations inherent within\nKubernetes with RBAC implemented.",
          "descriptions": [
            {
              "data": "The kubelet configuration file contains the runtime configuration of\nthe kubelet service. If an attacker can gain access to this file, changes can\nbe made to open vulnerabilities and bypass user authorizations inherent within\nKubernetes with RBAC implemented.",
              "label": "default"
            },
            {
              "data": "",
              "label": "rationale"
            },
            {
              "data": "On the Master and worker nodes, change to the /etc/sysconfig directory. Run\nthe command:\n\n    ls -l kubelet\n\n    Each kubelet configuration file must be owned by root:root.\n\n    If any manifest file is not owned by root:root, this is a finding.",
              "label": "check"
            },
            {
              "data": "On the Master and Worker nodes, change to the /etc/sysconfig directory. Run\nthe command:\n\n    chown root:root kubelet\n\n    To verify the change took place, run the command:\n\n    ls -l kubelet\n\n    The kubelet file should now be owned by root:root.",
              "label": "fix"
            }
          ],
          "id": "V-242406",
          "impact": 0.5,
          "refs": [],
          "results": [],
          "source_location": {
            "line": 3,
            "ref": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242406.rb"
          },
          "tags": {
            "cci": ["CCI-001499"],
            "fix_id": "F-45639r712573_fix",
            "gid": "V-242406",
            "gtitle": "SRG-APP-000133-CTR-000300",
            "nist": ["CM-5 (6)"],
            "rid": "SV-242406r712574_rule",
            "severity": "medium",
            "stig_id": "CNTR-K8-000880"
          },
          "title": "The Kubernetes kubelet configuration file must be owned by root.",
          "waiver_data": {}
        },
        {
          "code": "control 'V-242407' do\n  title 'The Kubernetes kubelet configuration file permissions set to 644 or\nmore restrictive.'\n  desc  \"The kubelet configuration file contains the runtime configuration of\nthe kubelet service. If an attacker can gain access to this file, changes can\nbe made to open vulnerabilities and bypass user authorizations inherit within\nKubernetes with RBAC implemented.\"\n  desc  'rationale', ''\n  desc  'check', \"\n    On the Master and worker nodes, change to the /etc/kubernetes/manifest\ndirectory. Run the command:\n\n    ls -l kubelet\n\n    Each kubelet configuration file must have permissions of \\\"644\\\" or more\nrestrictive.\n\n    If any kubelet configuration file is less restrictive than \\\"644\\\", this is\na finding.\n  \"\n  desc 'fix', \"\n    On the Master node, change to the /etc/kubernetes/manifest directory. Run\nthe command:\n\n    chmod 644 kubelet\n\n    To verify the change took place, run the command:\n\n    ls -l kubelet\n\n    The kubelet file should now have the permissions of \\\"644\\\".\n  \"\n  impact 0.5\n  tag severity: 'medium'\n  tag gtitle: 'SRG-APP-000133-CTR-000305'\n  tag gid: 'V-242407'\n  tag rid: 'SV-242407r712577_rule'\n  tag stig_id: 'CNTR-K8-000890'\n  tag fix_id: 'F-45640r712576_fix'\n  tag cci: ['CCI-001499']\n  tag nist: ['CM-5 (6)']\n\n  describe kubelet do\n    its('config_file') { should_not be_more_permissive_than('0644') }\n  end\nend\n",
          "desc": "The kubelet configuration file contains the runtime configuration of\nthe kubelet service. If an attacker can gain access to this file, changes can\nbe made to open vulnerabilities and bypass user authorizations inherit within\nKubernetes with RBAC implemented.",
          "descriptions": [
            {
              "data": "The kubelet configuration file contains the runtime configuration of\nthe kubelet service. If an attacker can gain access to this file, changes can\nbe made to open vulnerabilities and bypass user authorizations inherit within\nKubernetes with RBAC implemented.",
              "label": "default"
            },
            {
              "data": "",
              "label": "rationale"
            },
            {
              "data": "On the Master and worker nodes, change to the /etc/kubernetes/manifest\ndirectory. Run the command:\n\n    ls -l kubelet\n\n    Each kubelet configuration file must have permissions of \"644\" or more\nrestrictive.\n\n    If any kubelet configuration file is less restrictive than \"644\", this is\na finding.",
              "label": "check"
            },
            {
              "data": "On the Master node, change to the /etc/kubernetes/manifest directory. Run\nthe command:\n\n    chmod 644 kubelet\n\n    To verify the change took place, run the command:\n\n    ls -l kubelet\n\n    The kubelet file should now have the permissions of \"644\".",
              "label": "fix"
            }
          ],
          "id": "V-242407",
          "impact": 0.5,
          "refs": [],
          "results": [],
          "source_location": {
            "line": 3,
            "ref": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242407.rb"
          },
          "tags": {
            "cci": ["CCI-001499"],
            "fix_id": "F-45640r712576_fix",
            "gid": "V-242407",
            "gtitle": "SRG-APP-000133-CTR-000305",
            "nist": ["CM-5 (6)"],
            "rid": "SV-242407r712577_rule",
            "severity": "medium",
            "stig_id": "CNTR-K8-000890"
          },
          "title": "The Kubernetes kubelet configuration file permissions set to 644 or\nmore restrictive.",
          "waiver_data": {}
        },
        {
          "code": "  control 'V-242408' do\n    impact 0.0\n    desc 'caveat', 'K3S deployments are not applied using manifest files and hence non-applicable.'\n  end\n",
          "desc": "The manifest files contain the runtime configuration of the API\nserver, scheduler, controller, and etcd. If an attacker can gain access to\nthese files, changes can be made to open vulnerabilities and bypass user\nauthorizations inherent within Kubernetes with RBAC implemented.",
          "descriptions": [
            {
              "data": "The manifest files contain the runtime configuration of the API\nserver, scheduler, controller, and etcd. If an attacker can gain access to\nthese files, changes can be made to open vulnerabilities and bypass user\nauthorizations inherent within Kubernetes with RBAC implemented.",
              "label": "default"
            },
            {
              "data": "",
              "label": "rationale"
            },
            {
              "data": "On the Master node, change to the /etc/kubernetes/manifest directory. Run\nthe command:\n\n    ls -l *\n\n    Each manifest file must have permissions \"644\" or more restrictive.\n\n    If any manifest file is less restrictive than \"644\", this is a finding.",
              "label": "check"
            },
            {
              "data": "On the Master node, change to the /etc/kubernetes/manifest directory. Run\nthe command:\n\n    chmod 644 *\n\n    To verify the change took place, run the command:\n\n    ls -l *\n\n    All the manifest files should now have privileges of \"644\".",
              "label": "fix"
            },
            {
              "data": "K3S deployments are not applied using manifest files and hence non-applicable.",
              "label": "caveat"
            }
          ],
          "id": "V-242408",
          "impact": 0.0,
          "refs": [
            {
              "ref": []
            }
          ],
          "results": [],
          "source_location": {
            "line": 3,
            "ref": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242408.rb"
          },
          "tags": {
            "cci": ["CCI-001499"],
            "fix_id": "F-45641r712579_fix",
            "gid": "V-242408",
            "gtitle": "SRG-APP-000133-CTR-000310",
            "nist": ["CM-5 (6)"],
            "rid": "SV-242408r712580_rule",
            "satisfies": [
              "SRG-APP-000133-CTR-000310",
              "SRG-APP-000133-CTR-000295"
            ],
            "severity": "medium",
            "stig_id": "CNTR-K8-000900"
          },
          "title": "The Kubernetes manifests must have least privileges.",
          "waiver_data": {}
        },
        {
          "code": "control 'V-242409' do\n  title 'Kubernetes Controller Manager must disable profiling.'\n  desc  \"Kubernetes profiling provides the ability to analyze and troubleshoot\nController Manager events over a web interface on a host port. Enabling this\nservice can expose details about the Kubernetes architecture. This service must\nnot be enabled unless deemed necessary.\"\n  desc  'rationale', ''\n  desc  'check', \"\n    Change to the /etc/kubernetes/manifests/ directory on the Kubernetes Master\nNode. Run the command:\n\n    grep -i profiling *\n\n    If the setting \\\"profiling\\\" is not configured in the Kubernetes Controller\nManager manifest file or it is set to \\\"True\\\", this is a finding.\n  \"\n  desc 'fix', \"Edit the Kubernetes Controller Manager manifest file in the\n/etc/kubernetes/manifests directory on the Kubernetes Master Node. Set the\nargument \\\"--profiling value\\\" to \\\"false\\\".\"\n  impact 0.5\n  tag severity: 'medium'\n  tag gtitle: 'SRG-APP-000141-CTR-000315'\n  tag gid: 'V-242409'\n  tag rid: 'SV-242409r712583_rule'\n  tag stig_id: 'CNTR-K8-000910'\n  tag fix_id: 'F-45642r712582_fix'\n  tag cci: ['CCI-000381']\n  tag nist: ['CM-7 a']\n\n  unless kube_controller_manager.exist?\n    impact 0.0\n    desc 'caveat', 'Kubernetes Controller Manager process is not running on the target.'\n  end\n\n  describe kube_controller_manager do\n    its('profiling') { should cmp 'false' }\n  end\nend\n",
          "desc": "Kubernetes profiling provides the ability to analyze and troubleshoot\nController Manager events over a web interface on a host port. Enabling this\nservice can expose details about the Kubernetes architecture. This service must\nnot be enabled unless deemed necessary.",
          "descriptions": [
            {
              "data": "Kubernetes profiling provides the ability to analyze and troubleshoot\nController Manager events over a web interface on a host port. Enabling this\nservice can expose details about the Kubernetes architecture. This service must\nnot be enabled unless deemed necessary.",
              "label": "default"
            },
            {
              "data": "",
              "label": "rationale"
            },
            {
              "data": "Change to the /etc/kubernetes/manifests/ directory on the Kubernetes Master\nNode. Run the command:\n\n    grep -i profiling *\n\n    If the setting \"profiling\" is not configured in the Kubernetes Controller\nManager manifest file or it is set to \"True\", this is a finding.",
              "label": "check"
            },
            {
              "data": "Edit the Kubernetes Controller Manager manifest file in the\n/etc/kubernetes/manifests directory on the Kubernetes Master Node. Set the\nargument \"--profiling value\" to \"false\".",
              "label": "fix"
            }
          ],
          "id": "V-242409",
          "impact": 0.5,
          "refs": [],
          "results": [],
          "source_location": {
            "line": 3,
            "ref": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242409.rb"
          },
          "tags": {
            "cci": ["CCI-000381"],
            "fix_id": "F-45642r712582_fix",
            "gid": "V-242409",
            "gtitle": "SRG-APP-000141-CTR-000315",
            "nist": ["CM-7 a"],
            "rid": "SV-242409r712583_rule",
            "severity": "medium",
            "stig_id": "CNTR-K8-000910"
          },
          "title": "Kubernetes Controller Manager must disable profiling.",
          "waiver_data": {}
        },
        {
          "code": "control 'V-242416' do\n  title 'Kubernetes Kubelet must not disable timeouts.'\n  desc  \"Idle connections from the Kubelet can be use by unauthorized users to\nperform malicious activity to the nodes, pods, containers, and cluster within\nthe Kubernetes Control Plane. Setting the streaming connection idle timeout\ndefines the maximum time an idle session is permitted prior to disconnect.\nSetting the value to \\\"0\\\" never disconnects any idle sessions. Idle timeouts\nmust never be set to \\\"0\\\" and should be defined at a minimum of \\\"5 minutes\\\".\"\n  desc  'rationale', ''\n  desc  'check', \"\n    Change to the /etc/sysconfig/ directory on the Kubernetes Master Node. Run\nthe command:\n\n    grep -i streaming-connection-idle-timeout kubelet\n\n    If the setting streaming-connection-idle-timeout is set to \\\"0\\\" or the\nparameter is not configured in the Kubernetes Kubelet, this is a finding.\n  \"\n  desc 'fix', \"\n    Edit the Kubernetes Kubelet file in the /etc/sysconfig directory on the\nKubernetes Master Node. Set the argument\n\\\"--streaming-connection-idle-timeout\\\" to a value other than \\\"0\\\". Reset\nKubelet service using the following command:\n\n    service kubelet restart\n  \"\n  impact 0.5\n  tag severity: 'medium'\n  tag gtitle: 'SRG-APP-000516-CTR-001325'\n  tag gid: 'V-242416'\n  tag rid: 'SV-242416r712604_rule'\n  tag stig_id: 'CNTR-K8-001300'\n  tag fix_id: 'F-45649r712603_fix'\n  tag cci: ['CCI-001133']\n  tag nist: ['SC-10']\n\n  describe.one do\n    describe kubelet do\n      its('streaming-connection-idle-timeout') { should_not be_nil }\n      its('streaming-connection-idle-timeout') { should_not cmp 0 }\n    end\n\n    describe kubelet_config_file do\n      its('streamingConnectionIdleTimeout') { should_not be_nil }\n      its('streamingConnectionIdleTimeout') { should_not cmp 0 }\n    end\n  end\nend\n",
          "desc": "Idle connections from the Kubelet can be use by unauthorized users to\nperform malicious activity to the nodes, pods, containers, and cluster within\nthe Kubernetes Control Plane. Setting the streaming connection idle timeout\ndefines the maximum time an idle session is permitted prior to disconnect.\nSetting the value to \"0\" never disconnects any idle sessions. Idle timeouts\nmust never be set to \"0\" and should be defined at a minimum of \"5 minutes\".",
          "descriptions": [
            {
              "data": "Idle connections from the Kubelet can be use by unauthorized users to\nperform malicious activity to the nodes, pods, containers, and cluster within\nthe Kubernetes Control Plane. Setting the streaming connection idle timeout\ndefines the maximum time an idle session is permitted prior to disconnect.\nSetting the value to \"0\" never disconnects any idle sessions. Idle timeouts\nmust never be set to \"0\" and should be defined at a minimum of \"5 minutes\".",
              "label": "default"
            },
            {
              "data": "",
              "label": "rationale"
            },
            {
              "data": "Change to the /etc/sysconfig/ directory on the Kubernetes Master Node. Run\nthe command:\n\n    grep -i streaming-connection-idle-timeout kubelet\n\n    If the setting streaming-connection-idle-timeout is set to \"0\" or the\nparameter is not configured in the Kubernetes Kubelet, this is a finding.",
              "label": "check"
            },
            {
              "data": "Edit the Kubernetes Kubelet file in the /etc/sysconfig directory on the\nKubernetes Master Node. Set the argument\n\"--streaming-connection-idle-timeout\" to a value other than \"0\". Reset\nKubelet service using the following command:\n\n    service kubelet restart",
              "label": "fix"
            }
          ],
          "id": "V-242416",
          "impact": 0.5,
          "refs": [],
          "results": [],
          "source_location": {
            "line": 3,
            "ref": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242416.rb"
          },
          "tags": {
            "cci": ["CCI-001133"],
            "fix_id": "F-45649r712603_fix",
            "gid": "V-242416",
            "gtitle": "SRG-APP-000516-CTR-001325",
            "nist": ["SC-10"],
            "rid": "SV-242416r712604_rule",
            "severity": "medium",
            "stig_id": "CNTR-K8-001300"
          },
          "title": "Kubernetes Kubelet must not disable timeouts.",
          "waiver_data": {}
        },
        {
          "code": "control 'V-242418' do\n  title 'The Kubernetes API server must use approved cipher suites.'\n  desc  \"The Kubernetes API server communicates to the kubelet service on the\nnodes to deploy, update, and delete resources. If an attacker were able to get\nbetween this communication and modify the request, the Kubernetes cluster could\nbe compromised. Using approved cypher suites for the communication ensures the\nprotection of the transmitted information, confidentiality, and integrity so\nthat the attacker cannot read or alter this communication.\"\n  desc  'rationale', ''\n  desc  'check', \"\n    Change to the /etc/kubernetes/manifests/ directory on the Kubernetes Master\nNode. Run the command:\n\n    grep -i tls-cipher-suites *\n\n    If the setting feature tls-cipher-suites is not set in the Kubernetes API\nserver manifest file or contains no value or does not contain\nTLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM\n_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM\n_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM\n_SHA384, this is a finding.\n  \"\n  desc 'fix', \"\n    Edit the Kubernetes API Server manifest file in the\n/etc/kubernetes/manifests directory on the Kubernetes Master Node. Set the\nvalue of tls-cipher-suites to:\n    TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM\n_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM\n_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM\n_SHA384\n  \"\n  impact 0.5\n  tag severity: 'medium'\n  tag gtitle: 'SRG-APP-000219-CTR-000550'\n  tag gid: 'V-242418'\n  tag rid: 'SV-242418r712610_rule'\n  tag stig_id: 'CNTR-K8-001400'\n  tag fix_id: 'F-45651r717025_fix'\n  tag cci: ['CCI-001184']\n  tag nist: ['SC-23']\n\n  unless kube_apiserver.exist?\n    impact 0.0\n    desc 'caveat', 'Kubernetes API Server process is not running on the target.'\n  end\n\n  describe kube_apiserver do\n    its('tls_cipher_suites') { should include 'TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256' }\n    its('tls_cipher_suites') { should include 'TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256' }\n    its('tls_cipher_suites') { should include 'TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305' }\n    its('tls_cipher_suites') { should include 'TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384' }\n    its('tls_cipher_suites') { should include 'TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305' }\n    its('tls_cipher_suites') { should include 'TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384' }\n    its('tls_cipher_suites.count') { should cmp 6 }\n  end\nend\n",
          "desc": "The Kubernetes API server communicates to the kubelet service on the\nnodes to deploy, update, and delete resources. If an attacker were able to get\nbetween this communication and modify the request, the Kubernetes cluster could\nbe compromised. Using approved cypher suites for the communication ensures the\nprotection of the transmitted information, confidentiality, and integrity so\nthat the attacker cannot read or alter this communication.",
          "descriptions": [
            {
              "data": "The Kubernetes API server communicates to the kubelet service on the\nnodes to deploy, update, and delete resources. If an attacker were able to get\nbetween this communication and modify the request, the Kubernetes cluster could\nbe compromised. Using approved cypher suites for the communication ensures the\nprotection of the transmitted information, confidentiality, and integrity so\nthat the attacker cannot read or alter this communication.",
              "label": "default"
            },
            {
              "data": "",
              "label": "rationale"
            },
            {
              "data": "Change to the /etc/kubernetes/manifests/ directory on the Kubernetes Master\nNode. Run the command:\n\n    grep -i tls-cipher-suites *\n\n    If the setting feature tls-cipher-suites is not set in the Kubernetes API\nserver manifest file or contains no value or does not contain\nTLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM\n_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM\n_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM\n_SHA384, this is a finding.",
              "label": "check"
            },
            {
              "data": "Edit the Kubernetes API Server manifest file in the\n/etc/kubernetes/manifests directory on the Kubernetes Master Node. Set the\nvalue of tls-cipher-suites to:\n    TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM\n_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM\n_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM\n_SHA384",
              "label": "fix"
            }
          ],
          "id": "V-242418",
          "impact": 0.5,
          "refs": [],
          "results": [],
          "source_location": {
            "line": 3,
            "ref": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242418.rb"
          },
          "tags": {
            "cci": ["CCI-001184"],
            "fix_id": "F-45651r717025_fix",
            "gid": "V-242418",
            "gtitle": "SRG-APP-000219-CTR-000550",
            "nist": ["SC-23"],
            "rid": "SV-242418r712610_rule",
            "severity": "medium",
            "stig_id": "CNTR-K8-001400"
          },
          "title": "The Kubernetes API server must use approved cipher suites.",
          "waiver_data": {}
        },
        {
          "code": "control 'V-242419' do\n  title 'Kubernetes API Server must have the SSL Certificate Authority set.'\n  desc  \"Kubernetes control plane and external communication is managed by API\nServer. The main implementation of the API Server is to manage hardware\nresources for pods and containers using horizontal or vertical scaling. Anyone\nwho can access the API Server can effectively control the Kubernetes\narchitecture. Using authenticity protection, the communication can be protected\nagainst man-in-the-middle attacks/session hijacking and the insertion of false\ninformation into sessions.\n\n    The communication session is protected by utilizing transport encryption\nprotocols, such as TLS. TLS provides the Kubernetes API Server with a means to\nbe able to authenticate sessions and encrypt traffic.\n\n    To enable encrypted communication for API Server, the parameter etcd-cafile\nmust be set. This parameter gives the location of the SSL Certificate Authority\nfile used to secure API Server communication.\n  \"\n  desc  'rationale', ''\n  desc  'check', \"\n    Change to the /etc/kubernetes/manifests/ directory on the Kubernetes Master\nNode. Run the command:\n\n    grep -i client-ca-file *\n\n    If the setting feature client-ca-file is not set in the Kubernetes API\nserver manifest file or contains no value, this is a finding.\n  \"\n  desc 'fix', \"Edit the Kubernetes API Server manifest file in the\n/etc/kubernetes/manifests directory on the Kubernetes Master Node. Set the\nvalue of client-ca-file to path containing Approved Organizational Certificate.\"\n  impact 0.5\n  tag severity: 'medium'\n  tag gtitle: 'SRG-APP-000219-CTR-000550'\n  tag gid: 'V-242419'\n  tag rid: 'SV-242419r712613_rule'\n  tag stig_id: 'CNTR-K8-001410'\n  tag fix_id: 'F-45652r712612_fix'\n  tag cci: ['CCI-001184']\n  tag nist: ['SC-23']\n\n  unless kube_apiserver.exist?\n    impact 0.0\n    desc 'caveat', 'Kubernetes API Server process is not running on the target.'\n  end\n\n  describe kube_apiserver do\n    its('client-ca-file') { should_not be_nil }\n  end\nend\n",
          "desc": "Kubernetes control plane and external communication is managed by API\nServer. The main implementation of the API Server is to manage hardware\nresources for pods and containers using horizontal or vertical scaling. Anyone\nwho can access the API Server can effectively control the Kubernetes\narchitecture. Using authenticity protection, the communication can be protected\nagainst man-in-the-middle attacks/session hijacking and the insertion of false\ninformation into sessions.\n\n    The communication session is protected by utilizing transport encryption\nprotocols, such as TLS. TLS provides the Kubernetes API Server with a means to\nbe able to authenticate sessions and encrypt traffic.\n\n    To enable encrypted communication for API Server, the parameter etcd-cafile\nmust be set. This parameter gives the location of the SSL Certificate Authority\nfile used to secure API Server communication.",
          "descriptions": [
            {
              "data": "Kubernetes control plane and external communication is managed by API\nServer. The main implementation of the API Server is to manage hardware\nresources for pods and containers using horizontal or vertical scaling. Anyone\nwho can access the API Server can effectively control the Kubernetes\narchitecture. Using authenticity protection, the communication can be protected\nagainst man-in-the-middle attacks/session hijacking and the insertion of false\ninformation into sessions.\n\n    The communication session is protected by utilizing transport encryption\nprotocols, such as TLS. TLS provides the Kubernetes API Server with a means to\nbe able to authenticate sessions and encrypt traffic.\n\n    To enable encrypted communication for API Server, the parameter etcd-cafile\nmust be set. This parameter gives the location of the SSL Certificate Authority\nfile used to secure API Server communication.",
              "label": "default"
            },
            {
              "data": "",
              "label": "rationale"
            },
            {
              "data": "Change to the /etc/kubernetes/manifests/ directory on the Kubernetes Master\nNode. Run the command:\n\n    grep -i client-ca-file *\n\n    If the setting feature client-ca-file is not set in the Kubernetes API\nserver manifest file or contains no value, this is a finding.",
              "label": "check"
            },
            {
              "data": "Edit the Kubernetes API Server manifest file in the\n/etc/kubernetes/manifests directory on the Kubernetes Master Node. Set the\nvalue of client-ca-file to path containing Approved Organizational Certificate.",
              "label": "fix"
            }
          ],
          "id": "V-242419",
          "impact": 0.5,
          "refs": [],
          "results": [],
          "source_location": {
            "line": 3,
            "ref": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242419.rb"
          },
          "tags": {
            "cci": ["CCI-001184"],
            "fix_id": "F-45652r712612_fix",
            "gid": "V-242419",
            "gtitle": "SRG-APP-000219-CTR-000550",
            "nist": ["SC-23"],
            "rid": "SV-242419r712613_rule",
            "severity": "medium",
            "stig_id": "CNTR-K8-001410"
          },
          "title": "Kubernetes API Server must have the SSL Certificate Authority set.",
          "waiver_data": {}
        },
        {
          "code": "control 'V-242420' do\n  title 'Kubernetes Kubelet must have the SSL Certificate Authority set.'\n  desc  \"Kubernetes container and pod configuration are maintained by Kubelet.\nKubelet agents register nodes with the API Server, mount volume storage, and\nperform health checks for containers and pods. Anyone who gains access to\nKubelet agents can effectively control applications within the pods and\ncontainers. Using authenticity protection, the communication can be protected\nagainst man-in-the-middle attacks/session hijacking and the insertion of false\ninformation into sessions.\n\n    The communication session is protected by utilizing transport encryption\nprotocols, such as TLS. TLS provides the Kubernetes API Server with a means to\nbe able to authenticate sessions and encrypt traffic.\n\n    To enable encrypted communication for Kubelet, the parameter etcd-cafile\nmust be set. This parameter gives the location of the SSL Certificate Authority\nfile used to secure Kubelet communication.\n  \"\n  desc  'rationale', ''\n  desc  'check', \"\n    Change to the /etc/sysconfig/ directory on the Kubernetes Master Node. Run\nthe command:\n\n    grep -i client-ca-file kubelet\n\n    If the setting client-ca-file is not set in the Kubernetes API server\nmanifest file or contains no value, this is a finding.\n  \"\n  desc 'fix', \"\n    Edit the Kubernetes Kubelet file in the /etc/sysconfig/ directory on the\nKubernetes Master Node. Set the value of client-ca-file to path containing\nApproved Organizational Certificate.\n\n    Reset Kubelet service using the following command:\n    service kubelet restart\n  \"\n  impact 0.5\n  tag severity: 'medium'\n  tag gtitle: 'SRG-APP-000219-CTR-000550'\n  tag gid: 'V-242420'\n  tag rid: 'SV-242420r712616_rule'\n  tag stig_id: 'CNTR-K8-001420'\n  tag fix_id: 'F-45653r717026_fix'\n  tag cci: ['CCI-001184']\n  tag nist: ['SC-23']\n\n  describe.one do\n    describe kubelet do\n      its('client-ca-file') { should_not be_nil }\n    end\n\n    describe kubelet_config_file do\n      its(%w(authentication x509 clientCAFile)) { should_not be_nil }\n    end\n  end\nend\n",
          "desc": "Kubernetes container and pod configuration are maintained by Kubelet.\nKubelet agents register nodes with the API Server, mount volume storage, and\nperform health checks for containers and pods. Anyone who gains access to\nKubelet agents can effectively control applications within the pods and\ncontainers. Using authenticity protection, the communication can be protected\nagainst man-in-the-middle attacks/session hijacking and the insertion of false\ninformation into sessions.\n\n    The communication session is protected by utilizing transport encryption\nprotocols, such as TLS. TLS provides the Kubernetes API Server with a means to\nbe able to authenticate sessions and encrypt traffic.\n\n    To enable encrypted communication for Kubelet, the parameter etcd-cafile\nmust be set. This parameter gives the location of the SSL Certificate Authority\nfile used to secure Kubelet communication.",
          "descriptions": [
            {
              "data": "Kubernetes container and pod configuration are maintained by Kubelet.\nKubelet agents register nodes with the API Server, mount volume storage, and\nperform health checks for containers and pods. Anyone who gains access to\nKubelet agents can effectively control applications within the pods and\ncontainers. Using authenticity protection, the communication can be protected\nagainst man-in-the-middle attacks/session hijacking and the insertion of false\ninformation into sessions.\n\n    The communication session is protected by utilizing transport encryption\nprotocols, such as TLS. TLS provides the Kubernetes API Server with a means to\nbe able to authenticate sessions and encrypt traffic.\n\n    To enable encrypted communication for Kubelet, the parameter etcd-cafile\nmust be set. This parameter gives the location of the SSL Certificate Authority\nfile used to secure Kubelet communication.",
              "label": "default"
            },
            {
              "data": "",
              "label": "rationale"
            },
            {
              "data": "Change to the /etc/sysconfig/ directory on the Kubernetes Master Node. Run\nthe command:\n\n    grep -i client-ca-file kubelet\n\n    If the setting client-ca-file is not set in the Kubernetes API server\nmanifest file or contains no value, this is a finding.",
              "label": "check"
            },
            {
              "data": "Edit the Kubernetes Kubelet file in the /etc/sysconfig/ directory on the\nKubernetes Master Node. Set the value of client-ca-file to path containing\nApproved Organizational Certificate.\n\n    Reset Kubelet service using the following command:\n    service kubelet restart",
              "label": "fix"
            }
          ],
          "id": "V-242420",
          "impact": 0.5,
          "refs": [],
          "results": [],
          "source_location": {
            "line": 3,
            "ref": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242420.rb"
          },
          "tags": {
            "cci": ["CCI-001184"],
            "fix_id": "F-45653r717026_fix",
            "gid": "V-242420",
            "gtitle": "SRG-APP-000219-CTR-000550",
            "nist": ["SC-23"],
            "rid": "SV-242420r712616_rule",
            "severity": "medium",
            "stig_id": "CNTR-K8-001420"
          },
          "title": "Kubernetes Kubelet must have the SSL Certificate Authority set.",
          "waiver_data": {}
        },
        {
          "code": "control 'V-242421' do\n  title \"Kubernetes Controller Manager must have the SSL Certificate Authority\nset.\"\n  desc  \"The Kubernetes Controller Manager is responsible for creating service\naccounts and tokens for the API Server, maintaining the correct number of pods\nfor every replication controller and provides notifications when nodes are\noffline.\n\n    Anyone who gains access to the Controller Manager can generate backdoor\naccounts, take possession of, or diminish system performance without detection\nby disabling system notification. Using authenticity protection, the\ncommunication can be protected against man-in-the-middle attacks/session\nhijacking and the insertion of false information into sessions.\n\n    The communication session is protected by utilizing transport encryption\nprotocols, such as TLS. TLS provides the Kubernetes Controller Manager with a\nmeans to be able to authenticate sessions and encrypt traffic.\n  \"\n  desc  'rationale', ''\n  desc  'check', \"\n    Change to the /etc/kubernetes/manifests/ directory on the Kubernetes Master\nNode. Run the command:\n\n    grep -i root-ca-file *\n\n    If the setting client-ca-file is not set in the Kubernetes Controller\nManager manifest file or contains no value, this is a finding.\n  \"\n  desc 'fix', \"Edit the Kubernetes Controller Manager manifest file in the\n/etc/kubernetes/manifests directory on the Kubernetes Master Node. Set the\nvalue of root-ca-file to path containing Approved Organizational Certificate.\"\n  impact 0.5\n  tag severity: 'medium'\n  tag gtitle: 'SRG-APP-000219-CTR-000550'\n  tag gid: 'V-242421'\n  tag rid: 'SV-242421r717033_rule'\n  tag stig_id: 'CNTR-K8-001430'\n  tag fix_id: 'F-45654r712618_fix'\n  tag cci: ['CCI-001184']\n  tag nist: ['SC-23']\n\n  unless kube_controller_manager.exist?\n    impact 0.0\n    desc 'caveat', 'Kubernetes Controller Manager process is not running on the target.'\n  end\n\n  describe kube_controller_manager do\n    its('root-ca-file') { should_not be_nil }\n  end\nend\n",
          "desc": "The Kubernetes Controller Manager is responsible for creating service\naccounts and tokens for the API Server, maintaining the correct number of pods\nfor every replication controller and provides notifications when nodes are\noffline.\n\n    Anyone who gains access to the Controller Manager can generate backdoor\naccounts, take possession of, or diminish system performance without detection\nby disabling system notification. Using authenticity protection, the\ncommunication can be protected against man-in-the-middle attacks/session\nhijacking and the insertion of false information into sessions.\n\n    The communication session is protected by utilizing transport encryption\nprotocols, such as TLS. TLS provides the Kubernetes Controller Manager with a\nmeans to be able to authenticate sessions and encrypt traffic.",
          "descriptions": [
            {
              "data": "The Kubernetes Controller Manager is responsible for creating service\naccounts and tokens for the API Server, maintaining the correct number of pods\nfor every replication controller and provides notifications when nodes are\noffline.\n\n    Anyone who gains access to the Controller Manager can generate backdoor\naccounts, take possession of, or diminish system performance without detection\nby disabling system notification. Using authenticity protection, the\ncommunication can be protected against man-in-the-middle attacks/session\nhijacking and the insertion of false information into sessions.\n\n    The communication session is protected by utilizing transport encryption\nprotocols, such as TLS. TLS provides the Kubernetes Controller Manager with a\nmeans to be able to authenticate sessions and encrypt traffic.",
              "label": "default"
            },
            {
              "data": "",
              "label": "rationale"
            },
            {
              "data": "Change to the /etc/kubernetes/manifests/ directory on the Kubernetes Master\nNode. Run the command:\n\n    grep -i root-ca-file *\n\n    If the setting client-ca-file is not set in the Kubernetes Controller\nManager manifest file or contains no value, this is a finding.",
              "label": "check"
            },
            {
              "data": "Edit the Kubernetes Controller Manager manifest file in the\n/etc/kubernetes/manifests directory on the Kubernetes Master Node. Set the\nvalue of root-ca-file to path containing Approved Organizational Certificate.",
              "label": "fix"
            }
          ],
          "id": "V-242421",
          "impact": 0.5,
          "refs": [],
          "results": [],
          "source_location": {
            "line": 3,
            "ref": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242421.rb"
          },
          "tags": {
            "cci": ["CCI-001184"],
            "fix_id": "F-45654r712618_fix",
            "gid": "V-242421",
            "gtitle": "SRG-APP-000219-CTR-000550",
            "nist": ["SC-23"],
            "rid": "SV-242421r717033_rule",
            "severity": "medium",
            "stig_id": "CNTR-K8-001430"
          },
          "title": "Kubernetes Controller Manager must have the SSL Certificate Authority\nset.",
          "waiver_data": {}
        },
        {
          "code": "control 'V-242422' do\n  title 'Kubernetes API Server must have a certificate for communication.'\n  desc  \"Kubernetes control plane and external communication is managed by API\nServer. The main implementation of the API Server is to manage hardware\nresources for pods and container using horizontal or vertical scaling. Anyone\nwho can access the API Server can effectively control the Kubernetes\narchitecture. Using authenticity protection, the communication can be protected\nagainst man-in-the-middle attacks/session hijacking and the insertion of false\ninformation into sessions.\n\n    The communication session is protected by utilizing transport encryption\nprotocols, such as TLS. TLS provides the Kubernetes API Server with a means to\nbe able to authenticate sessions and encrypt traffic.\n\n    To enable encrypted communication for API Server, the parameter etcd-cafile\nmust be set. This parameter gives the location of the SSL Certificate Authority\nfile used to secure API Server communication.\n  \"\n  desc  'rationale', ''\n  desc  'check', \"\n    Change to the /etc/kubernetes/manifests/ directory on the Kubernetes Master\nNode. Run the command:\n\n    grep -i tls-cert-file *\n    grep -i tls-private-key-file *\n\n    If the setting tls-cert-file and private-key-file is not set in the\nKubernetes API server manifest file or contains no value, this is a finding.\n  \"\n  desc 'fix', \"Edit the Kubernetes API Server manifest file in the\n/etc/kubernetes/manifests directory on the Kubernetes Master Node. Set the\nvalue of tls-cert-file and tls-private-key-file to path containing Approved\nOrganizational Certificate.\"\n  impact 0.5\n  tag severity: 'medium'\n  tag gtitle: 'SRG-APP-000219-CTR-000550'\n  tag gid: 'V-242422'\n  tag rid: 'SV-242422r712622_rule'\n  tag stig_id: 'CNTR-K8-001440'\n  tag fix_id: 'F-45655r712621_fix'\n  tag cci: ['CCI-001184']\n  tag nist: ['SC-23']\n\n  unless kube_apiserver.exist?\n    impact 0.0\n    desc 'caveat', 'Kubernetes API Server process is not running on the target.'\n  end\n\n  describe kube_apiserver do\n    its('tls-cert-file') { should_not be_nil }\n    its('tls-private-key-file') { should_not be_nil }\n  end\nend\n",
          "desc": "Kubernetes control plane and external communication is managed by API\nServer. The main implementation of the API Server is to manage hardware\nresources for pods and container using horizontal or vertical scaling. Anyone\nwho can access the API Server can effectively control the Kubernetes\narchitecture. Using authenticity protection, the communication can be protected\nagainst man-in-the-middle attacks/session hijacking and the insertion of false\ninformation into sessions.\n\n    The communication session is protected by utilizing transport encryption\nprotocols, such as TLS. TLS provides the Kubernetes API Server with a means to\nbe able to authenticate sessions and encrypt traffic.\n\n    To enable encrypted communication for API Server, the parameter etcd-cafile\nmust be set. This parameter gives the location of the SSL Certificate Authority\nfile used to secure API Server communication.",
          "descriptions": [
            {
              "data": "Kubernetes control plane and external communication is managed by API\nServer. The main implementation of the API Server is to manage hardware\nresources for pods and container using horizontal or vertical scaling. Anyone\nwho can access the API Server can effectively control the Kubernetes\narchitecture. Using authenticity protection, the communication can be protected\nagainst man-in-the-middle attacks/session hijacking and the insertion of false\ninformation into sessions.\n\n    The communication session is protected by utilizing transport encryption\nprotocols, such as TLS. TLS provides the Kubernetes API Server with a means to\nbe able to authenticate sessions and encrypt traffic.\n\n    To enable encrypted communication for API Server, the parameter etcd-cafile\nmust be set. This parameter gives the location of the SSL Certificate Authority\nfile used to secure API Server communication.",
              "label": "default"
            },
            {
              "data": "",
              "label": "rationale"
            },
            {
              "data": "Change to the /etc/kubernetes/manifests/ directory on the Kubernetes Master\nNode. Run the command:\n\n    grep -i tls-cert-file *\n    grep -i tls-private-key-file *\n\n    If the setting tls-cert-file and private-key-file is not set in the\nKubernetes API server manifest file or contains no value, this is a finding.",
              "label": "check"
            },
            {
              "data": "Edit the Kubernetes API Server manifest file in the\n/etc/kubernetes/manifests directory on the Kubernetes Master Node. Set the\nvalue of tls-cert-file and tls-private-key-file to path containing Approved\nOrganizational Certificate.",
              "label": "fix"
            }
          ],
          "id": "V-242422",
          "impact": 0.5,
          "refs": [],
          "results": [],
          "source_location": {
            "line": 3,
            "ref": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242422.rb"
          },
          "tags": {
            "cci": ["CCI-001184"],
            "fix_id": "F-45655r712621_fix",
            "gid": "V-242422",
            "gtitle": "SRG-APP-000219-CTR-000550",
            "nist": ["SC-23"],
            "rid": "SV-242422r712622_rule",
            "severity": "medium",
            "stig_id": "CNTR-K8-001440"
          },
          "title": "Kubernetes API Server must have a certificate for communication.",
          "waiver_data": {}
        },
        {
          "code": "control 'V-242423' do\n  title 'Kubernetes etcd must enable client authentication to secure service.'\n  desc  \"Kubernetes container and pod configuration are maintained by Kubelet.\nKubelet agents register nodes with the API Server, mount volume storage, and\nperform health checks for containers and pods. Anyone who gains access to\nKubelet agents can effectively control applications within the pods and\ncontainers. Using authenticity protection, the communication can be protected\nagainst man-in-the-middle attacks/session hijacking and the insertion of false\ninformation into sessions.\n\n    The communication session is protected by utilizing transport encryption\nprotocols, such as TLS. TLS provides the Kubernetes API Server with a means to\nbe able to authenticate sessions and encrypt traffic.\n\n    To enable encrypted communication for Kubelet, the parameter etcd-cafile\nmust be set. This parameter gives the location of the SSL Certificate Authority\nfile used to secure Kubelet communication.\n  \"\n  desc  'rationale', ''\n  desc  'check', \"\n    Change to the /etc/kubernetes/manifests directory on the Kubernetes Master\nNode. Run the command:\n\n    grep -i client-cert-auth *\n\n    If the setting client-cert-auth is not configured in the Kubernetes etcd\nmanifest file or set to \\\"false\\\", this is a finding.\n  \"\n  desc 'fix', \"Edit the Kubernetes API Server manifest file in the\n/etc/kubernetes/manifests directory on the Kubernetes Master Node. Set the\nvalue of \\\"--client-cert-auth\\\" to \\\"true\\\" for the etcd.\"\n  impact 0.5\n  tag severity: 'medium'\n  tag gtitle: 'SRG-APP-000219-CTR-000550'\n  tag gid: 'V-242423'\n  tag rid: 'SV-242423r712625_rule'\n  tag stig_id: 'CNTR-K8-001450'\n  tag fix_id: 'F-45656r712624_fix'\n  tag cci: ['CCI-001184']\n  tag nist: ['SC-23']\n\n  if etcd.exist?\n    describe.one do\n      describe etcd do\n        its('client-cert-auth') { should cmp 'true' }\n      end\n\n      describe process_env_var('etcd') do\n        its(:ETCD_CLIENT_CERT_AUTH) { should cmp 'true' }\n      end\n    end\n  else\n    describe 'ETCD process is not running on the target.' do\n      skip\n    end\n  end\nend\n",
          "desc": "Kubernetes container and pod configuration are maintained by Kubelet.\nKubelet agents register nodes with the API Server, mount volume storage, and\nperform health checks for containers and pods. Anyone who gains access to\nKubelet agents can effectively control applications within the pods and\ncontainers. Using authenticity protection, the communication can be protected\nagainst man-in-the-middle attacks/session hijacking and the insertion of false\ninformation into sessions.\n\n    The communication session is protected by utilizing transport encryption\nprotocols, such as TLS. TLS provides the Kubernetes API Server with a means to\nbe able to authenticate sessions and encrypt traffic.\n\n    To enable encrypted communication for Kubelet, the parameter etcd-cafile\nmust be set. This parameter gives the location of the SSL Certificate Authority\nfile used to secure Kubelet communication.",
          "descriptions": [
            {
              "data": "Kubernetes container and pod configuration are maintained by Kubelet.\nKubelet agents register nodes with the API Server, mount volume storage, and\nperform health checks for containers and pods. Anyone who gains access to\nKubelet agents can effectively control applications within the pods and\ncontainers. Using authenticity protection, the communication can be protected\nagainst man-in-the-middle attacks/session hijacking and the insertion of false\ninformation into sessions.\n\n    The communication session is protected by utilizing transport encryption\nprotocols, such as TLS. TLS provides the Kubernetes API Server with a means to\nbe able to authenticate sessions and encrypt traffic.\n\n    To enable encrypted communication for Kubelet, the parameter etcd-cafile\nmust be set. This parameter gives the location of the SSL Certificate Authority\nfile used to secure Kubelet communication.",
              "label": "default"
            },
            {
              "data": "",
              "label": "rationale"
            },
            {
              "data": "Change to the /etc/kubernetes/manifests directory on the Kubernetes Master\nNode. Run the command:\n\n    grep -i client-cert-auth *\n\n    If the setting client-cert-auth is not configured in the Kubernetes etcd\nmanifest file or set to \"false\", this is a finding.",
              "label": "check"
            },
            {
              "data": "Edit the Kubernetes API Server manifest file in the\n/etc/kubernetes/manifests directory on the Kubernetes Master Node. Set the\nvalue of \"--client-cert-auth\" to \"true\" for the etcd.",
              "label": "fix"
            }
          ],
          "id": "V-242423",
          "impact": 0.5,
          "refs": [],
          "results": [],
          "source_location": {
            "line": 3,
            "ref": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242423.rb"
          },
          "tags": {
            "cci": ["CCI-001184"],
            "fix_id": "F-45656r712624_fix",
            "gid": "V-242423",
            "gtitle": "SRG-APP-000219-CTR-000550",
            "nist": ["SC-23"],
            "rid": "SV-242423r712625_rule",
            "severity": "medium",
            "stig_id": "CNTR-K8-001450"
          },
          "title": "Kubernetes etcd must enable client authentication to secure service.",
          "waiver_data": {}
        },
        {
          "code": "control 'V-242424' do\n  title \"Kubernetes Kubelet must enable tls-private-key-file for client\nauthentication to secure service.\"\n  desc  \"Kubernetes container and pod configuration are maintained by Kubelet.\nKubelet agents register nodes with the API Server, mount volume storage, and\nperform health checks for containers and pods. Anyone who gains access to\nKubelet agents can effectively control applications within the pods and\ncontainers. Using authenticity protection, the communication can be protected\nagainst man-in-the-middle attacks/session hijacking and the insertion of false\ninformation into sessions.\n\n    The communication session is protected by utilizing transport encryption\nprotocols, such as TLS. TLS provides the Kubernetes API Server with a means to\nbe able to authenticate sessions and encrypt traffic.\n\n    To enable encrypted communication for Kubelet, the parameter etcd-cafile\nmust be set. This parameter gives the location of the SSL Certificate Authority\nfile used to secure Kubelet communication.\n  \"\n  desc  'rationale', ''\n  desc  'check', \"\n    Change to the /etc/sysconfig/ directory on the Kubernetes Master Node. Run\nthe commands:\n\n    grep -i tls-private-key-file kubelet\n\n    If the setting \\\"tls-private-key-file\\\" is not configured in the Kubernetes\nKubelet, this is a finding.\n  \"\n  desc 'fix', \"\n    Edit the Kubernetes Kuberlet file in the /etc/sysconfig directory on the\nKubernetes Master Node. Set the argument tls-private-key-file to an Approved\nOrganization Certificate. Reset Kubelet service using the following command:\n\n    service kubelet restart\n  \"\n  impact 0.5\n  tag severity: 'medium'\n  tag gtitle: 'SRG-APP-000219-CTR-000550'\n  tag gid: 'V-242424'\n  tag rid: 'SV-242424r712628_rule'\n  tag stig_id: 'CNTR-K8-001460'\n  tag fix_id: 'F-45657r712627_fix'\n  tag cci: ['CCI-001184']\n  tag nist: ['SC-23']\n\n  describe.one do\n    describe kubelet do\n      its('tls-private-key-file') { should_not be_nil }\n    end\n\n    describe kubelet_config_file do\n      its('tlsPrivateKeyFile') { should_not be_nil }\n    end\n  end\nend\n",
          "desc": "Kubernetes container and pod configuration are maintained by Kubelet.\nKubelet agents register nodes with the API Server, mount volume storage, and\nperform health checks for containers and pods. Anyone who gains access to\nKubelet agents can effectively control applications within the pods and\ncontainers. Using authenticity protection, the communication can be protected\nagainst man-in-the-middle attacks/session hijacking and the insertion of false\ninformation into sessions.\n\n    The communication session is protected by utilizing transport encryption\nprotocols, such as TLS. TLS provides the Kubernetes API Server with a means to\nbe able to authenticate sessions and encrypt traffic.\n\n    To enable encrypted communication for Kubelet, the parameter etcd-cafile\nmust be set. This parameter gives the location of the SSL Certificate Authority\nfile used to secure Kubelet communication.",
          "descriptions": [
            {
              "data": "Kubernetes container and pod configuration are maintained by Kubelet.\nKubelet agents register nodes with the API Server, mount volume storage, and\nperform health checks for containers and pods. Anyone who gains access to\nKubelet agents can effectively control applications within the pods and\ncontainers. Using authenticity protection, the communication can be protected\nagainst man-in-the-middle attacks/session hijacking and the insertion of false\ninformation into sessions.\n\n    The communication session is protected by utilizing transport encryption\nprotocols, such as TLS. TLS provides the Kubernetes API Server with a means to\nbe able to authenticate sessions and encrypt traffic.\n\n    To enable encrypted communication for Kubelet, the parameter etcd-cafile\nmust be set. This parameter gives the location of the SSL Certificate Authority\nfile used to secure Kubelet communication.",
              "label": "default"
            },
            {
              "data": "",
              "label": "rationale"
            },
            {
              "data": "Change to the /etc/sysconfig/ directory on the Kubernetes Master Node. Run\nthe commands:\n\n    grep -i tls-private-key-file kubelet\n\n    If the setting \"tls-private-key-file\" is not configured in the Kubernetes\nKubelet, this is a finding.",
              "label": "check"
            },
            {
              "data": "Edit the Kubernetes Kuberlet file in the /etc/sysconfig directory on the\nKubernetes Master Node. Set the argument tls-private-key-file to an Approved\nOrganization Certificate. Reset Kubelet service using the following command:\n\n    service kubelet restart",
              "label": "fix"
            }
          ],
          "id": "V-242424",
          "impact": 0.5,
          "refs": [],
          "results": [],
          "source_location": {
            "line": 3,
            "ref": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242424.rb"
          },
          "tags": {
            "cci": ["CCI-001184"],
            "fix_id": "F-45657r712627_fix",
            "gid": "V-242424",
            "gtitle": "SRG-APP-000219-CTR-000550",
            "nist": ["SC-23"],
            "rid": "SV-242424r712628_rule",
            "severity": "medium",
            "stig_id": "CNTR-K8-001460"
          },
          "title": "Kubernetes Kubelet must enable tls-private-key-file for client\nauthentication to secure service.",
          "waiver_data": {}
        },
        {
          "code": "control 'V-242425' do\n  title \"Kubernetes Kubelet must enable tls-cert-file for client authentication\nto secure service.\"\n  desc  \"Kubernetes container and pod configuration are maintained by Kubelet.\nKubelet agents register nodes with the API Server, mount volume storage, and\nperform health checks for containers and pods. Anyone who gains access to\nKubelet agents can effectively control applications within the pods and\ncontainers. Using authenticity protection, the communication can be protected\nagainst man-in-the-middle attacks/session hijacking and the insertion of false\ninformation into sessions.\n\n    The communication session is protected by utilizing transport encryption\nprotocols, such as TLS. TLS provides the Kubernetes API Server with a means to\nbe able to authenticate sessions and encrypt traffic.\n\n    To enable encrypted communication for Kubelet, the parameter etcd-cafile\nmust be set. This parameter gives the location of the SSL Certificate Authority\nfile used to secure Kubelet communication.\n  \"\n  desc  'rationale', ''\n  desc  'check', \"\n    Change to the /etc/sysconfig/ directory on the Kubernetes Master Node. Run\nthe commands:\n\n    grep -i tls-cert-file kubelet\n\n    If the setting \\\"tls-cert-file\\\" is not configured in the Kubernetes\nKubelet, this is a finding.\n  \"\n  desc 'fix', \"\n    Edit the Kubernetes Kuberlet file in the /etc/sysconfig directory on the\nKubernetes Master Node. Set the argument \\\"tls-cert-file\\\" to an Approved\nOrganization Certificate. Reset Kubelet service using the following command:\n\n    service kubelet restart\n  \"\n  impact 0.5\n  tag severity: 'medium'\n  tag gtitle: 'SRG-APP-000219-CTR-000550'\n  tag gid: 'V-242425'\n  tag rid: 'SV-242425r712631_rule'\n  tag stig_id: 'CNTR-K8-001470'\n  tag fix_id: 'F-45658r712630_fix'\n  tag cci: ['CCI-001184']\n  tag nist: ['SC-23']\n\n  describe.one do\n    describe kubelet do\n      its('tls-cert-file') { should_not be_nil }\n    end\n\n    describe kubelet_config_file do\n      its('tlsCertFile') { should_not be_nil }\n    end\n  end\nend\n",
          "desc": "Kubernetes container and pod configuration are maintained by Kubelet.\nKubelet agents register nodes with the API Server, mount volume storage, and\nperform health checks for containers and pods. Anyone who gains access to\nKubelet agents can effectively control applications within the pods and\ncontainers. Using authenticity protection, the communication can be protected\nagainst man-in-the-middle attacks/session hijacking and the insertion of false\ninformation into sessions.\n\n    The communication session is protected by utilizing transport encryption\nprotocols, such as TLS. TLS provides the Kubernetes API Server with a means to\nbe able to authenticate sessions and encrypt traffic.\n\n    To enable encrypted communication for Kubelet, the parameter etcd-cafile\nmust be set. This parameter gives the location of the SSL Certificate Authority\nfile used to secure Kubelet communication.",
          "descriptions": [
            {
              "data": "Kubernetes container and pod configuration are maintained by Kubelet.\nKubelet agents register nodes with the API Server, mount volume storage, and\nperform health checks for containers and pods. Anyone who gains access to\nKubelet agents can effectively control applications within the pods and\ncontainers. Using authenticity protection, the communication can be protected\nagainst man-in-the-middle attacks/session hijacking and the insertion of false\ninformation into sessions.\n\n    The communication session is protected by utilizing transport encryption\nprotocols, such as TLS. TLS provides the Kubernetes API Server with a means to\nbe able to authenticate sessions and encrypt traffic.\n\n    To enable encrypted communication for Kubelet, the parameter etcd-cafile\nmust be set. This parameter gives the location of the SSL Certificate Authority\nfile used to secure Kubelet communication.",
              "label": "default"
            },
            {
              "data": "",
              "label": "rationale"
            },
            {
              "data": "Change to the /etc/sysconfig/ directory on the Kubernetes Master Node. Run\nthe commands:\n\n    grep -i tls-cert-file kubelet\n\n    If the setting \"tls-cert-file\" is not configured in the Kubernetes\nKubelet, this is a finding.",
              "label": "check"
            },
            {
              "data": "Edit the Kubernetes Kuberlet file in the /etc/sysconfig directory on the\nKubernetes Master Node. Set the argument \"tls-cert-file\" to an Approved\nOrganization Certificate. Reset Kubelet service using the following command:\n\n    service kubelet restart",
              "label": "fix"
            }
          ],
          "id": "V-242425",
          "impact": 0.5,
          "refs": [],
          "results": [],
          "source_location": {
            "line": 3,
            "ref": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242425.rb"
          },
          "tags": {
            "cci": ["CCI-001184"],
            "fix_id": "F-45658r712630_fix",
            "gid": "V-242425",
            "gtitle": "SRG-APP-000219-CTR-000550",
            "nist": ["SC-23"],
            "rid": "SV-242425r712631_rule",
            "severity": "medium",
            "stig_id": "CNTR-K8-001470"
          },
          "title": "Kubernetes Kubelet must enable tls-cert-file for client authentication\nto secure service.",
          "waiver_data": {}
        },
        {
          "code": "control 'V-242426' do\n  title 'Kubernetes etcd must enable client authentication to secure service.'\n  desc  \"Kubernetes container and pod configuration are maintained by Kubelet.\nKubelet agents register nodes with the API Server, mount volume storage, and\nperform health checks for containers and pods. Anyone who gains access to\nKubelet agents can effectively control applications within the pods and\ncontainers. Using authenticity protection, the communication can be protected\nagainst man-in-the-middle attacks/session hijacking and the insertion of false\ninformation into sessions.\n\n    The communication session is protected by utilizing transport encryption\nprotocols, such as TLS. TLS provides the Kubernetes API Server with a means to\nbe able to authenticate sessions and encrypt traffic.\n\n    To enable encrypted communication for Kubelet, the parameter etcd-cafile\nmust be set. This parameter gives the location of the SSL Certificate Authority\nfile used to secure Kubelet communication.\n  \"\n  desc  'rationale', ''\n  desc  'check', \"\n    Change to the /etc/kubernetes/manifests directory on the Kubernetes Master\nNode. Run the command:\n\n    grep -i peer-client-cert-auth *\n\n    If the setting \\\"peer-client-cert-auth\\\" is not configured in the Kubernetes\netcd manifest file or set to \\\"false\\\", this is a finding.\n  \"\n  desc 'fix', \"Edit the Kubernetes etcd manifest file in the\n/etc/kubernetes/manifests directory on the Kubernetes Master Node. Set the\nvalue of \\\"--peer-client-cert-auth\\\" to \\\"true\\\" for the etcd.\"\n  impact 0.5\n  tag severity: 'medium'\n  tag gtitle: 'SRG-APP-000219-CTR-000550'\n  tag gid: 'V-242426'\n  tag rid: 'SV-242426r712634_rule'\n  tag stig_id: 'CNTR-K8-001480'\n  tag fix_id: 'F-45659r712633_fix'\n  tag cci: ['CCI-001184']\n  tag nist: ['SC-23']\n\n  if etcd.exist?\n    describe.one do\n      describe etcd do\n        its('peer-client-cert-auth') { should cmp 'true' }\n      end\n\n      describe process_env_var('etcd') do\n        its(:ETCD_PEER_CLIENT_CERT_AUTH) { should cmp 'true' }\n      end\n    end\n  else\n    describe 'ETCD process is not running on the target.' do\n      skip\n    end\n  end\nend\n",
          "desc": "Kubernetes container and pod configuration are maintained by Kubelet.\nKubelet agents register nodes with the API Server, mount volume storage, and\nperform health checks for containers and pods. Anyone who gains access to\nKubelet agents can effectively control applications within the pods and\ncontainers. Using authenticity protection, the communication can be protected\nagainst man-in-the-middle attacks/session hijacking and the insertion of false\ninformation into sessions.\n\n    The communication session is protected by utilizing transport encryption\nprotocols, such as TLS. TLS provides the Kubernetes API Server with a means to\nbe able to authenticate sessions and encrypt traffic.\n\n    To enable encrypted communication for Kubelet, the parameter etcd-cafile\nmust be set. This parameter gives the location of the SSL Certificate Authority\nfile used to secure Kubelet communication.",
          "descriptions": [
            {
              "data": "Kubernetes container and pod configuration are maintained by Kubelet.\nKubelet agents register nodes with the API Server, mount volume storage, and\nperform health checks for containers and pods. Anyone who gains access to\nKubelet agents can effectively control applications within the pods and\ncontainers. Using authenticity protection, the communication can be protected\nagainst man-in-the-middle attacks/session hijacking and the insertion of false\ninformation into sessions.\n\n    The communication session is protected by utilizing transport encryption\nprotocols, such as TLS. TLS provides the Kubernetes API Server with a means to\nbe able to authenticate sessions and encrypt traffic.\n\n    To enable encrypted communication for Kubelet, the parameter etcd-cafile\nmust be set. This parameter gives the location of the SSL Certificate Authority\nfile used to secure Kubelet communication.",
              "label": "default"
            },
            {
              "data": "",
              "label": "rationale"
            },
            {
              "data": "Change to the /etc/kubernetes/manifests directory on the Kubernetes Master\nNode. Run the command:\n\n    grep -i peer-client-cert-auth *\n\n    If the setting \"peer-client-cert-auth\" is not configured in the Kubernetes\netcd manifest file or set to \"false\", this is a finding.",
              "label": "check"
            },
            {
              "data": "Edit the Kubernetes etcd manifest file in the\n/etc/kubernetes/manifests directory on the Kubernetes Master Node. Set the\nvalue of \"--peer-client-cert-auth\" to \"true\" for the etcd.",
              "label": "fix"
            }
          ],
          "id": "V-242426",
          "impact": 0.5,
          "refs": [],
          "results": [],
          "source_location": {
            "line": 3,
            "ref": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242426.rb"
          },
          "tags": {
            "cci": ["CCI-001184"],
            "fix_id": "F-45659r712633_fix",
            "gid": "V-242426",
            "gtitle": "SRG-APP-000219-CTR-000550",
            "nist": ["SC-23"],
            "rid": "SV-242426r712634_rule",
            "severity": "medium",
            "stig_id": "CNTR-K8-001480"
          },
          "title": "Kubernetes etcd must enable client authentication to secure service.",
          "waiver_data": {}
        },
        {
          "code": "control 'V-242427' do\n  title 'Kubernetes etcd must have a key file for secure communication.'\n  desc  \"Kubernetes stores configuration and state information in a distributed\nkey-value store called etcd. Anyone who can write to etcd can effectively\ncontrol the Kubernetes cluster. Even just reading the contents of etcd could\neasily provide helpful hints to a would-be attacker. Using authenticity\nprotection, the communication can be protected against man-in-the-middle\nattacks/session hijacking and the insertion of false information into sessions.\n\n    The communication session is protected by utilizing transport encryption\nprotocols, such as TLS. TLS provides the Kubernetes API Server and etcd with a\nmeans to be able to authenticate sessions and encrypt traffic.\n\n    To enable encrypted communication for etcd, the parameter etcd-keyfile must\nbe set. This parameter gives the location of the key file used to secure etcd\ncommunication.\n  \"\n  desc  'rationale', ''\n  desc  'check', \"\n    Change to the /etc/kubernetes/manifests directory on the Kubernetes Master\nNode. Run the command:\n\n    grep -i key-file *\n\n    If the setting \\\"key-file\\\" is not configured in the Kubernetes etcd\nmanifest file, this is a finding.\n  \"\n  desc 'fix', \"Edit the etcd manifest file in the\n/etc/kubernetes/manifests directory on the Kubernetes Master Node. Set the\nvalue of \\\"--key-file\\\" to the Approved Organizational Certificate.\"\n  impact 0.5\n  tag severity: 'medium'\n  tag gtitle: 'SRG-APP-000219-CTR-000550'\n  tag gid: 'V-242427'\n  tag rid: 'SV-242427r712637_rule'\n  tag stig_id: 'CNTR-K8-001490'\n  tag fix_id: 'F-45660r712636_fix'\n  tag cci: ['CCI-001184']\n  tag nist: ['SC-23']\n\n  if etcd.exist?\n    describe.one do\n      describe etcd do\n        its('key-file') { should_not be_nil }\n      end\n\n      describe process_env_var('etcd') do\n        its(:ETCD_KEY_FILE) { should_not be_nil }\n      end\n    end\n  else\n    describe 'ETCD process is not running on the target.' do\n      skip\n    end\n  end\nend\n",
          "desc": "Kubernetes stores configuration and state information in a distributed\nkey-value store called etcd. Anyone who can write to etcd can effectively\ncontrol the Kubernetes cluster. Even just reading the contents of etcd could\neasily provide helpful hints to a would-be attacker. Using authenticity\nprotection, the communication can be protected against man-in-the-middle\nattacks/session hijacking and the insertion of false information into sessions.\n\n    The communication session is protected by utilizing transport encryption\nprotocols, such as TLS. TLS provides the Kubernetes API Server and etcd with a\nmeans to be able to authenticate sessions and encrypt traffic.\n\n    To enable encrypted communication for etcd, the parameter etcd-keyfile must\nbe set. This parameter gives the location of the key file used to secure etcd\ncommunication.",
          "descriptions": [
            {
              "data": "Kubernetes stores configuration and state information in a distributed\nkey-value store called etcd. Anyone who can write to etcd can effectively\ncontrol the Kubernetes cluster. Even just reading the contents of etcd could\neasily provide helpful hints to a would-be attacker. Using authenticity\nprotection, the communication can be protected against man-in-the-middle\nattacks/session hijacking and the insertion of false information into sessions.\n\n    The communication session is protected by utilizing transport encryption\nprotocols, such as TLS. TLS provides the Kubernetes API Server and etcd with a\nmeans to be able to authenticate sessions and encrypt traffic.\n\n    To enable encrypted communication for etcd, the parameter etcd-keyfile must\nbe set. This parameter gives the location of the key file used to secure etcd\ncommunication.",
              "label": "default"
            },
            {
              "data": "",
              "label": "rationale"
            },
            {
              "data": "Change to the /etc/kubernetes/manifests directory on the Kubernetes Master\nNode. Run the command:\n\n    grep -i key-file *\n\n    If the setting \"key-file\" is not configured in the Kubernetes etcd\nmanifest file, this is a finding.",
              "label": "check"
            },
            {
              "data": "Edit the etcd manifest file in the\n/etc/kubernetes/manifests directory on the Kubernetes Master Node. Set the\nvalue of \"--key-file\" to the Approved Organizational Certificate.",
              "label": "fix"
            }
          ],
          "id": "V-242427",
          "impact": 0.5,
          "refs": [],
          "results": [],
          "source_location": {
            "line": 3,
            "ref": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242427.rb"
          },
          "tags": {
            "cci": ["CCI-001184"],
            "fix_id": "F-45660r712636_fix",
            "gid": "V-242427",
            "gtitle": "SRG-APP-000219-CTR-000550",
            "nist": ["SC-23"],
            "rid": "SV-242427r712637_rule",
            "severity": "medium",
            "stig_id": "CNTR-K8-001490"
          },
          "title": "Kubernetes etcd must have a key file for secure communication.",
          "waiver_data": {}
        },
        {
          "code": "control 'V-242428' do\n  title 'Kubernetes etcd must have a certificate for communication.'\n  desc  \"Kubernetes stores configuration and state information in a distributed\nkey-value store called etcd. Anyone who can write to etcd can effectively\ncontrol a Kubernetes cluster. Even just reading the contents of etcd could\neasily provide helpful hints to a would-be attacker. Using authenticity\nprotection, the communication can be protected against man-in-the-middle\nattacks/session hijacking and the insertion of false information into sessions.\n\n    The communication session is protected by utilizing transport encryption\nprotocols, such as TLS. TLS provides the Kubernetes API Server and etcd with a\nmeans to be able to authenticate sessions and encrypt traffic.\n\n    To enable encrypted communication for etcd, the parameter cert-file\nmust be set. This parameter gives the location of the SSL certification file\nused to secure etcd communication.\n  \"\n  desc  'rationale', ''\n  desc  'check', \"\n    Change to the /etc/kubernetes/manifests directory on the Kubernetes Master\n Node. Run the command:\n\n    grep -i cert-file *\n\n    If the setting \\\"cert-file\\\" is not configured in the Kubernetes etcd\nmanifest file, this is a finding.\n  \"\n  desc 'fix', \"Edit the Kubernetes etcd manifest file in the\n/etc/kubernetes/manifests directory on the Kubernetes Master Node.\n\n  Set the value of \\\"--cert-file\\\" to the Approved Organizational Certificate.\n  \"\n  impact 0.5\n  tag severity: 'medium'\n  tag gtitle: 'SRG-APP-000219-CTR-000550'\n  tag gid: 'V-242428'\n  tag rid: 'SV-242428r712640_rule'\n  tag stig_id: 'CNTR-K8-001500'\n  tag fix_id: 'F-45661r712639_fix'\n  tag cci: ['CCI-001184']\n  tag nist: ['SC-23']\n\n  if etcd.exist?\n    describe.one do\n      describe etcd do\n        its('cert-file') { should_not be_nil }\n      end\n\n      describe process_env_var('etcd') do\n        its(:ETCD_CERT_FILE) { should_not be_nil }\n      end\n    end\n  else\n    describe 'ETCD process is not running on the target.' do\n      skip\n    end\n  end\nend\n",
          "desc": "Kubernetes stores configuration and state information in a distributed\nkey-value store called etcd. Anyone who can write to etcd can effectively\ncontrol a Kubernetes cluster. Even just reading the contents of etcd could\neasily provide helpful hints to a would-be attacker. Using authenticity\nprotection, the communication can be protected against man-in-the-middle\nattacks/session hijacking and the insertion of false information into sessions.\n\n    The communication session is protected by utilizing transport encryption\nprotocols, such as TLS. TLS provides the Kubernetes API Server and etcd with a\nmeans to be able to authenticate sessions and encrypt traffic.\n\n    To enable encrypted communication for etcd, the parameter cert-file\nmust be set. This parameter gives the location of the SSL certification file\nused to secure etcd communication.",
          "descriptions": [
            {
              "data": "Kubernetes stores configuration and state information in a distributed\nkey-value store called etcd. Anyone who can write to etcd can effectively\ncontrol a Kubernetes cluster. Even just reading the contents of etcd could\neasily provide helpful hints to a would-be attacker. Using authenticity\nprotection, the communication can be protected against man-in-the-middle\nattacks/session hijacking and the insertion of false information into sessions.\n\n    The communication session is protected by utilizing transport encryption\nprotocols, such as TLS. TLS provides the Kubernetes API Server and etcd with a\nmeans to be able to authenticate sessions and encrypt traffic.\n\n    To enable encrypted communication for etcd, the parameter cert-file\nmust be set. This parameter gives the location of the SSL certification file\nused to secure etcd communication.",
              "label": "default"
            },
            {
              "data": "",
              "label": "rationale"
            },
            {
              "data": "Change to the /etc/kubernetes/manifests directory on the Kubernetes Master\n Node. Run the command:\n\n    grep -i cert-file *\n\n    If the setting \"cert-file\" is not configured in the Kubernetes etcd\nmanifest file, this is a finding.",
              "label": "check"
            },
            {
              "data": "Edit the Kubernetes etcd manifest file in the\n/etc/kubernetes/manifests directory on the Kubernetes Master Node.\n\n  Set the value of \"--cert-file\" to the Approved Organizational Certificate.",
              "label": "fix"
            }
          ],
          "id": "V-242428",
          "impact": 0.5,
          "refs": [],
          "results": [],
          "source_location": {
            "line": 3,
            "ref": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242428.rb"
          },
          "tags": {
            "cci": ["CCI-001184"],
            "fix_id": "F-45661r712639_fix",
            "gid": "V-242428",
            "gtitle": "SRG-APP-000219-CTR-000550",
            "nist": ["SC-23"],
            "rid": "SV-242428r712640_rule",
            "severity": "medium",
            "stig_id": "CNTR-K8-001500"
          },
          "title": "Kubernetes etcd must have a certificate for communication.",
          "waiver_data": {}
        },
        {
          "code": "  control 'V-242429' do\n    unless kube_process('k3s server').exist?\n      impact 0.0\n      desc 'caveat', 'K3S Server process is not running on the target.'\n    end\n\n    describe kube_process('k3s server') do\n      its('datastore-cafile') { should_not be_nil }\n    end\n  end\n",
          "desc": "Kubernetes stores configuration and state information in a distributed\nkey-value store called etcd. Anyone who can write to etcd can effectively\ncontrol a Kubernetes cluster. Even just reading the contents of etcd could\neasily provide helpful hints to a would-be attacker. Using authenticity\nprotection, the communication can be protected against man-in-the-middle\nattacks/session hijacking and the insertion of false information into sessions.\n\n    The communication session is protected by utilizing transport encryption\nprotocols, such as TLS. TLS provides the Kubernetes API Server and etcd with a\nmeans to be able to authenticate sessions and encrypt traffic.\n\n    To enable encrypted communication for etcd, the parameter etcd-cafile must\nbe set. This parameter gives the location of the SSL Certificate Authority file\nused to secure etcd communication.",
          "descriptions": [
            {
              "data": "Kubernetes stores configuration and state information in a distributed\nkey-value store called etcd. Anyone who can write to etcd can effectively\ncontrol a Kubernetes cluster. Even just reading the contents of etcd could\neasily provide helpful hints to a would-be attacker. Using authenticity\nprotection, the communication can be protected against man-in-the-middle\nattacks/session hijacking and the insertion of false information into sessions.\n\n    The communication session is protected by utilizing transport encryption\nprotocols, such as TLS. TLS provides the Kubernetes API Server and etcd with a\nmeans to be able to authenticate sessions and encrypt traffic.\n\n    To enable encrypted communication for etcd, the parameter etcd-cafile must\nbe set. This parameter gives the location of the SSL Certificate Authority file\nused to secure etcd communication.",
              "label": "default"
            },
            {
              "data": "",
              "label": "rationale"
            },
            {
              "data": "Change to the /etc/kubernetes/manifests directory on the Kubernetes Master\nNode. Run the command:\n\n    grep -i etcd-cafile *\n\n    If the setting \"etcd-cafile\" is not configured in the Kubernetes API\nServer manifest file, this is a finding.",
              "label": "check"
            },
            {
              "data": "Edit the Kubernetes API Server manifest file in the\n/etc/kubernetes/manifests directory on the Kubernetes Master Node. Set the\nvalue of \"--etcd-cafile\" to the Certificate Authority for etcd.",
              "label": "fix"
            }
          ],
          "id": "V-242429",
          "impact": 0.5,
          "refs": [
            {
              "ref": []
            }
          ],
          "results": [],
          "source_location": {
            "line": 3,
            "ref": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242429.rb"
          },
          "tags": {
            "cci": ["CCI-001184"],
            "fix_id": "F-45662r712642_fix",
            "gid": "V-242429",
            "gtitle": "SRG-APP-000219-CTR-000550",
            "nist": ["SC-23"],
            "rid": "SV-242429r712643_rule",
            "severity": "medium",
            "stig_id": "CNTR-K8-001510"
          },
          "title": "Kubernetes etcd must have the SSL Certificate Authority set.",
          "waiver_data": {}
        },
        {
          "code": "  control 'V-242430' do\n    unless kube_process('k3s server').exist?\n      impact 0.0\n      desc 'caveat', 'K3S  Server process is not running on the target.'\n    end\n\n    describe kube_process('k3s server') do\n      its('datastore-certfile') { should_not be_nil }\n    end\n  end\n",
          "desc": "Kubernetes stores configuration and state information in a distributed\nkey-value store called etcd. Anyone who can write to etcd can effectively\ncontrol your Kubernetes cluster. Even just reading the contents of etcd could\neasily provide helpful hints to a would-be attacker. Using authenticity\nprotection, the communication can be protected against man-in-the-middle\nattacks/session hijacking and the insertion of false information into sessions.\n\n    The communication session is protected by utilizing transport encryption\nprotocols, such as TLS. TLS provides the Kubernetes API Server and etcd with a\nmeans to be able to authenticate sessions and encrypt traffic.\n\n    To enable encrypted communication for etcd, the parameter etcd-certfile\nmust be set. This parameter gives the location of the SSL certification file\nused to secure etcd communication.",
          "descriptions": [
            {
              "data": "Kubernetes stores configuration and state information in a distributed\nkey-value store called etcd. Anyone who can write to etcd can effectively\ncontrol your Kubernetes cluster. Even just reading the contents of etcd could\neasily provide helpful hints to a would-be attacker. Using authenticity\nprotection, the communication can be protected against man-in-the-middle\nattacks/session hijacking and the insertion of false information into sessions.\n\n    The communication session is protected by utilizing transport encryption\nprotocols, such as TLS. TLS provides the Kubernetes API Server and etcd with a\nmeans to be able to authenticate sessions and encrypt traffic.\n\n    To enable encrypted communication for etcd, the parameter etcd-certfile\nmust be set. This parameter gives the location of the SSL certification file\nused to secure etcd communication.",
              "label": "default"
            },
            {
              "data": "",
              "label": "rationale"
            },
            {
              "data": "Change to the /etc/kubernetes/manifests directory on the Kubernetes Master\nNode. Run the command:\n\n    grep -i etcd-certfile *\n\n    If the setting \"etcd-certfile\" is not set in the Kubernetes API Server\nmanifest file, this is a finding.",
              "label": "check"
            },
            {
              "data": "Edit the Kubernetes API Server manifest file in the\n/etc/kubernetes/manifests directory on the Kubernetes Master Node. Set the\nvalue of \"--etcd-certfile\" to the certificate to be used for communication\nwith etcd.",
              "label": "fix"
            }
          ],
          "id": "V-242430",
          "impact": 0.5,
          "refs": [
            {
              "ref": []
            }
          ],
          "results": [],
          "source_location": {
            "line": 3,
            "ref": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242430.rb"
          },
          "tags": {
            "cci": ["CCI-001184"],
            "fix_id": "F-45663r712645_fix",
            "gid": "V-242430",
            "gtitle": "SRG-APP-000219-CTR-000550",
            "nist": ["SC-23"],
            "rid": "SV-242430r712646_rule",
            "severity": "medium",
            "stig_id": "CNTR-K8-001520"
          },
          "title": "Kubernetes etcd must have a certificate for communication.",
          "waiver_data": {}
        },
        {
          "code": "  control 'V-242431' do\n    unless kube_process('k3s server').exist?\n      impact 0.0\n      desc 'caveat', 'K3S Server process is not running on the target.'\n    end\n\n    describe kube_process('k3s server') do\n      its('datastore-keyfile') { should_not be_nil }\n    end\n  end\n",
          "desc": "Kubernetes stores configuration and state information in a distributed\nkey-value store called etcd. Anyone who can write to etcd can effectively\ncontrol a Kubernetes cluster. Even just reading the contents of etcd could\neasily provide helpful hints to a would-be attacker. Using authenticity\nprotection, the communication can be protected against man-in-the-middle\nattacks/session hijacking and the insertion of false information into sessions.\n\n    The communication session is protected by utilizing transport encryption\nprotocols, such as TLS. TLS provides the Kubernetes API Server and etcd with a\nmeans to be able to authenticate sessions and encrypt traffic.\n\n    To enable encrypted communication for etcd, the parameter etcd-keyfile must\nbe set. This parameter gives the location of the key file used to secure etcd\ncommunication.",
          "descriptions": [
            {
              "data": "Kubernetes stores configuration and state information in a distributed\nkey-value store called etcd. Anyone who can write to etcd can effectively\ncontrol a Kubernetes cluster. Even just reading the contents of etcd could\neasily provide helpful hints to a would-be attacker. Using authenticity\nprotection, the communication can be protected against man-in-the-middle\nattacks/session hijacking and the insertion of false information into sessions.\n\n    The communication session is protected by utilizing transport encryption\nprotocols, such as TLS. TLS provides the Kubernetes API Server and etcd with a\nmeans to be able to authenticate sessions and encrypt traffic.\n\n    To enable encrypted communication for etcd, the parameter etcd-keyfile must\nbe set. This parameter gives the location of the key file used to secure etcd\ncommunication.",
              "label": "default"
            },
            {
              "data": "",
              "label": "rationale"
            },
            {
              "data": "Change to the /etc/kubernetes/manifests directory on the Kubernetes Master\nNode. Run the command:\n\n    grep -i etcd-keyfile *\n\n    If the setting \"etcd-keyfile\" is not configured in the Kubernetes API\nServer manifest file, this is a finding.",
              "label": "check"
            },
            {
              "data": "Edit the Kubernetes API Server manifest file in the\n/etc/kubernetes/manifests directory on the Kubernetes Master Node. Set the\nvalue of \"--etcd-keyfile\" to the certificate to be used for communication\nwith etcd.",
              "label": "fix"
            }
          ],
          "id": "V-242431",
          "impact": 0.5,
          "refs": [
            {
              "ref": []
            }
          ],
          "results": [],
          "source_location": {
            "line": 3,
            "ref": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242431.rb"
          },
          "tags": {
            "cci": ["CCI-001184"],
            "fix_id": "F-45664r712648_fix",
            "gid": "V-242431",
            "gtitle": "SRG-APP-000219-CTR-000550",
            "nist": ["SC-23"],
            "rid": "SV-242431r712649_rule",
            "severity": "medium",
            "stig_id": "CNTR-K8-001530"
          },
          "title": "Kubernetes etcd must have a key file for secure communication.",
          "waiver_data": {}
        },
        {
          "code": "control 'V-242432' do\n  title 'Kubernetes etcd must have peer-cert-file set for secure communication.'\n  desc  \"Kubernetes stores configuration and state information in a distributed\nkey-value store called etcd. Anyone who can write to etcd can effectively\ncontrol the Kubernetes cluster. Even just reading the contents of etcd could\neasily provide helpful hints to a would-be attacker. Using authenticity\nprotection, the communication can be protected against man-in-the-middle\nattacks/session hijacking and the insertion of false information into sessions.\n\n    The communication session is protected by utilizing transport encryption\nprotocols, such as TLS. TLS provides the Kubernetes API Server and etcd with a\nmeans to be able to authenticate sessions and encrypt traffic.\n\n    To enable encrypted communication for etcd, the parameter etcd-certfile\nmust be set. This parameter gives the location of the SSL certification file\nused to secure etcd communication.\n  \"\n  desc  'rationale', ''\n  desc  'check', \"\n    Change to the /etc/kubernetes/manifests directory on the Kubernetes Master\nNode. Run the command:\n\n    grep -i peer-cert-file *\n\n    If the setting \\\"peer-cert-file\\\" is not configured in the Kubernetes etcd\nmanifest file, this is a finding.\n  \"\n  desc 'fix', \"Edit the Kubernetes etcd manifest file in the\n/etc/kubernetes/manifests directory on the Kubernetes Master Node. Set the\nvalue of \\\"--peer-cert-file\\\" to the certificate to be used for communication\nwith etcd.\"\n  impact 0.5\n  tag severity: 'medium'\n  tag gtitle: 'SRG-APP-000219-CTR-000550'\n  tag gid: 'V-242432'\n  tag rid: 'SV-242432r712652_rule'\n  tag stig_id: 'CNTR-K8-001540'\n  tag fix_id: 'F-45665r712651_fix'\n  tag cci: ['CCI-001184']\n  tag nist: ['SC-23']\n\n  if etcd.exist?\n    describe.one do\n      describe etcd do\n        its('peer-cert-file') { should_not be_nil }\n      end\n\n      describe process_env_var('etcd') do\n        its(:ETCD_PEER_CERT_FILE) { should_not be_nil }\n      end\n    end\n  else\n    describe 'ETCD process is not running on the target.' do\n      skip\n    end\n  end\nend\n",
          "desc": "Kubernetes stores configuration and state information in a distributed\nkey-value store called etcd. Anyone who can write to etcd can effectively\ncontrol the Kubernetes cluster. Even just reading the contents of etcd could\neasily provide helpful hints to a would-be attacker. Using authenticity\nprotection, the communication can be protected against man-in-the-middle\nattacks/session hijacking and the insertion of false information into sessions.\n\n    The communication session is protected by utilizing transport encryption\nprotocols, such as TLS. TLS provides the Kubernetes API Server and etcd with a\nmeans to be able to authenticate sessions and encrypt traffic.\n\n    To enable encrypted communication for etcd, the parameter etcd-certfile\nmust be set. This parameter gives the location of the SSL certification file\nused to secure etcd communication.",
          "descriptions": [
            {
              "data": "Kubernetes stores configuration and state information in a distributed\nkey-value store called etcd. Anyone who can write to etcd can effectively\ncontrol the Kubernetes cluster. Even just reading the contents of etcd could\neasily provide helpful hints to a would-be attacker. Using authenticity\nprotection, the communication can be protected against man-in-the-middle\nattacks/session hijacking and the insertion of false information into sessions.\n\n    The communication session is protected by utilizing transport encryption\nprotocols, such as TLS. TLS provides the Kubernetes API Server and etcd with a\nmeans to be able to authenticate sessions and encrypt traffic.\n\n    To enable encrypted communication for etcd, the parameter etcd-certfile\nmust be set. This parameter gives the location of the SSL certification file\nused to secure etcd communication.",
              "label": "default"
            },
            {
              "data": "",
              "label": "rationale"
            },
            {
              "data": "Change to the /etc/kubernetes/manifests directory on the Kubernetes Master\nNode. Run the command:\n\n    grep -i peer-cert-file *\n\n    If the setting \"peer-cert-file\" is not configured in the Kubernetes etcd\nmanifest file, this is a finding.",
              "label": "check"
            },
            {
              "data": "Edit the Kubernetes etcd manifest file in the\n/etc/kubernetes/manifests directory on the Kubernetes Master Node. Set the\nvalue of \"--peer-cert-file\" to the certificate to be used for communication\nwith etcd.",
              "label": "fix"
            }
          ],
          "id": "V-242432",
          "impact": 0.5,
          "refs": [],
          "results": [],
          "source_location": {
            "line": 3,
            "ref": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242432.rb"
          },
          "tags": {
            "cci": ["CCI-001184"],
            "fix_id": "F-45665r712651_fix",
            "gid": "V-242432",
            "gtitle": "SRG-APP-000219-CTR-000550",
            "nist": ["SC-23"],
            "rid": "SV-242432r712652_rule",
            "severity": "medium",
            "stig_id": "CNTR-K8-001540"
          },
          "title": "Kubernetes etcd must have peer-cert-file set for secure communication.",
          "waiver_data": {}
        },
        {
          "code": "control 'V-242433' do\n  title \"Kubernetes etcd must have a peer-key-file set for secure\ncommunication.\"\n  desc  \"Kubernetes stores configuration and state information in a distributed\nkey-value store called etcd. Anyone who can write to etcd can effectively\ncontrol a Kubernetes cluster. Even just reading the contents of etcd could\neasily provide helpful hints to a would-be attacker. Using authenticity\nprotection, the communication can be protected against man-in-the-middle\nattacks/session hijacking and the insertion of false information into sessions.\n\n    The communication session is protected by utilizing transport encryption\nprotocols, such as TLS. TLS provides the Kubernetes API Server and etcd with a\nmeans to be able to authenticate sessions and encrypt traffic.\n\n    To enable encrypted communication for etcd, the parameter etcd-certfile\nmust be set. This parameter gives the location of the SSL certification file\nused to secure etcd communication.\n  \"\n  desc  'rationale', ''\n  desc  'check', \"\n    Change to the /etc/kubernetes/manifests directory on the Kubernetes Master\nNode. Run the command:\n\n    grep -i peer-key-file *\n\n    If the setting \\\"peer-key-file\\\" is not set in the Kubernetes etcd manifest\nfile, this is a finding.\n  \"\n  desc 'fix', \"Edit the Kubernetes etcd manifest file in the\n/etc/kubernetes/manifests directory on the Kubernetes Master Node. Set the\nvalue of \\\"--peer-key-file\\\" to the certificate to be used for communication\nwith etcd.\"\n  impact 0.5\n  tag severity: 'medium'\n  tag gtitle: 'SRG-APP-000219-CTR-000550'\n  tag gid: 'V-242433'\n  tag rid: 'SV-242433r712655_rule'\n  tag stig_id: 'CNTR-K8-001550'\n  tag fix_id: 'F-45666r712654_fix'\n  tag cci: ['CCI-001184']\n  tag nist: ['SC-23']\n\n  if etcd.exist?\n    describe.one do\n      describe etcd do\n        its('peer-key-file') { should_not be_nil }\n      end\n\n      describe process_env_var('etcd') do\n        its(:ETCD_PEER_KEY_FILE) { should_not be_nil }\n      end\n    end\n  else\n    describe 'ETCD process is not running on the target.' do\n      skip\n    end\n  end\nend\n",
          "desc": "Kubernetes stores configuration and state information in a distributed\nkey-value store called etcd. Anyone who can write to etcd can effectively\ncontrol a Kubernetes cluster. Even just reading the contents of etcd could\neasily provide helpful hints to a would-be attacker. Using authenticity\nprotection, the communication can be protected against man-in-the-middle\nattacks/session hijacking and the insertion of false information into sessions.\n\n    The communication session is protected by utilizing transport encryption\nprotocols, such as TLS. TLS provides the Kubernetes API Server and etcd with a\nmeans to be able to authenticate sessions and encrypt traffic.\n\n    To enable encrypted communication for etcd, the parameter etcd-certfile\nmust be set. This parameter gives the location of the SSL certification file\nused to secure etcd communication.",
          "descriptions": [
            {
              "data": "Kubernetes stores configuration and state information in a distributed\nkey-value store called etcd. Anyone who can write to etcd can effectively\ncontrol a Kubernetes cluster. Even just reading the contents of etcd could\neasily provide helpful hints to a would-be attacker. Using authenticity\nprotection, the communication can be protected against man-in-the-middle\nattacks/session hijacking and the insertion of false information into sessions.\n\n    The communication session is protected by utilizing transport encryption\nprotocols, such as TLS. TLS provides the Kubernetes API Server and etcd with a\nmeans to be able to authenticate sessions and encrypt traffic.\n\n    To enable encrypted communication for etcd, the parameter etcd-certfile\nmust be set. This parameter gives the location of the SSL certification file\nused to secure etcd communication.",
              "label": "default"
            },
            {
              "data": "",
              "label": "rationale"
            },
            {
              "data": "Change to the /etc/kubernetes/manifests directory on the Kubernetes Master\nNode. Run the command:\n\n    grep -i peer-key-file *\n\n    If the setting \"peer-key-file\" is not set in the Kubernetes etcd manifest\nfile, this is a finding.",
              "label": "check"
            },
            {
              "data": "Edit the Kubernetes etcd manifest file in the\n/etc/kubernetes/manifests directory on the Kubernetes Master Node. Set the\nvalue of \"--peer-key-file\" to the certificate to be used for communication\nwith etcd.",
              "label": "fix"
            }
          ],
          "id": "V-242433",
          "impact": 0.5,
          "refs": [],
          "results": [],
          "source_location": {
            "line": 3,
            "ref": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242433.rb"
          },
          "tags": {
            "cci": ["CCI-001184"],
            "fix_id": "F-45666r712654_fix",
            "gid": "V-242433",
            "gtitle": "SRG-APP-000219-CTR-000550",
            "nist": ["SC-23"],
            "rid": "SV-242433r712655_rule",
            "severity": "medium",
            "stig_id": "CNTR-K8-001550"
          },
          "title": "Kubernetes etcd must have a peer-key-file set for secure\ncommunication.",
          "waiver_data": {}
        },
        {
          "code": "control 'V-242434' do\n  title 'Kubernetes Kubelet must enable kernel protection.'\n  desc  \"System kernel is responsible for memory, disk, and task management.\nThe kernel provides a gateway between the system hardware and software.\nKubernetes requires kernel access to allocate resources to the Control Plane.\nThreat actors that penetrate the system kernel can inject malicious code or\nhijack the Kubernetes architecture. It is vital to implement protections\nthrough Kubernetes components to reduce the attack surface.\"\n  desc  'rationale', ''\n  desc  'check', \"\n    Change to the /etc/sysconfig/ directory on the Kubernetes Master Node. Run\nthe command:\n\n    grep -i protect-kernel-defaults kubelet\n\n    If the setting \\\"protect-kernel-defaults\\\" is set to false or not set in\nthe Kubernetes Kubelet, this is a finding.\n  \"\n  desc 'fix', \"\n    Edit the Kubernetes Kuberlet file in the /etc/sysconfig directory on the\nKubernetes Master Node. Set the argument \\\"--protect-kernel-defaults\\\" to\n\\\"true\\\".\n\n    Reset Kubelet service using the following command:\n\n    service kubelet restart\n  \"\n  impact 0.7\n  tag severity: 'high'\n  tag gtitle: 'SRG-APP-000233-CTR-000585'\n  tag gid: 'V-242434'\n  tag rid: 'SV-242434r712658_rule'\n  tag stig_id: 'CNTR-K8-001620'\n  tag fix_id: 'F-45667r712657_fix'\n  tag cci: ['CCI-001084']\n  tag nist: ['SC-3']\n\n  describe.one do\n    describe kubelet do\n      its('protect-kernel-defaults') { should cmp 'true' }\n    end\n\n    describe kubelet_config_file do\n      its('protectKernelDefaults') { should cmp 'true' }\n    end\n  end\nend\n",
          "desc": "System kernel is responsible for memory, disk, and task management.\nThe kernel provides a gateway between the system hardware and software.\nKubernetes requires kernel access to allocate resources to the Control Plane.\nThreat actors that penetrate the system kernel can inject malicious code or\nhijack the Kubernetes architecture. It is vital to implement protections\nthrough Kubernetes components to reduce the attack surface.",
          "descriptions": [
            {
              "data": "System kernel is responsible for memory, disk, and task management.\nThe kernel provides a gateway between the system hardware and software.\nKubernetes requires kernel access to allocate resources to the Control Plane.\nThreat actors that penetrate the system kernel can inject malicious code or\nhijack the Kubernetes architecture. It is vital to implement protections\nthrough Kubernetes components to reduce the attack surface.",
              "label": "default"
            },
            {
              "data": "",
              "label": "rationale"
            },
            {
              "data": "Change to the /etc/sysconfig/ directory on the Kubernetes Master Node. Run\nthe command:\n\n    grep -i protect-kernel-defaults kubelet\n\n    If the setting \"protect-kernel-defaults\" is set to false or not set in\nthe Kubernetes Kubelet, this is a finding.",
              "label": "check"
            },
            {
              "data": "Edit the Kubernetes Kuberlet file in the /etc/sysconfig directory on the\nKubernetes Master Node. Set the argument \"--protect-kernel-defaults\" to\n\"true\".\n\n    Reset Kubelet service using the following command:\n\n    service kubelet restart",
              "label": "fix"
            }
          ],
          "id": "V-242434",
          "impact": 0.7,
          "refs": [],
          "results": [],
          "source_location": {
            "line": 3,
            "ref": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242434.rb"
          },
          "tags": {
            "cci": ["CCI-001084"],
            "fix_id": "F-45667r712657_fix",
            "gid": "V-242434",
            "gtitle": "SRG-APP-000233-CTR-000585",
            "nist": ["SC-3"],
            "rid": "SV-242434r712658_rule",
            "severity": "high",
            "stig_id": "CNTR-K8-001620"
          },
          "title": "Kubernetes Kubelet must enable kernel protection.",
          "waiver_data": {}
        },
        {
          "code": "control 'V-242435' do\n  title \"Kubernetes must prevent non-privileged users from executing privileged\nfunctions to include disabling, circumventing, or altering implemented security\nsafeguards/countermeasures or the installation of patches and updates.\"\n  desc  \"Kubernetes uses the API Server to control communication to the other\nservices that makeup Kubernetes. The use of authorizations and not the default\nof \\\"AlwaysAllow\\\" enables the Kubernetes functions control to only the groups\nthat need them.\n\n    To control access the API server must have one of the following options set\nfor the authorization mode:\n        --authorization-mode=ABAC Attribute-Based Access Control (ABAC) mode\nallows a user to configure policies using local files.\n        --authorization-mode=RBAC Role-based access control (RBAC) mode allows\na user to create and store policies using the Kubernetes API.\n        --authorization-mode=Webhook\n\n    WebHook is an HTTP callback mode that allows a user to manage authorization\nusing a remote REST endpoint.\n        --authorization-mode=Node\n\n    Node authorization is a special-purpose authorization mode that\nspecifically authorizes API requests made by kubelets.\n        --authorization-mode=AlwaysDeny\n\n    This flag blocks all requests. Use this flag only for testing.\n\n\n  \"\n  desc  'rationale', ''\n  desc  'check', \"\n    Change to the /etc/kubernetes/manifests directory on the Kubernetes Master\nNode. Run the command:\n\n    grep -i authorization-mode *\n\n    If the setting authorization-mode is set to \\\"AlwaysAllow\\\" in the\nKubernetes API Server manifest file or is not configured, this is a finding.\n  \"\n  desc 'fix', \"Edit the Kubernetes API Server manifest file in the\n/etc/kubernetes/manifests directory on the Kubernetes Master Node. Set the\nargument \\\"--authorization-mode\\\" to any valid authorization mode other than\nAlwaysAllow.\"\n  impact 0.7\n  tag severity: 'high'\n  tag gtitle: 'SRG-APP-000340-CTR-000770'\n  tag satisfies: ['SRG-APP-000340-CTR-000770', 'SRG-APP-000033-CTR-000095',\n                  'SRG-APP-000378-CTR-000880']\n  tag gid: 'V-242435'\n  tag rid: 'SV-242435r712661_rule'\n  tag stig_id: 'CNTR-K8-001990'\n  tag fix_id: 'F-45668r712660_fix'\n  tag cci: ['CCI-000213', 'CCI-001812', 'CCI-002235']\n  tag nist: ['AC-3', 'CM-11 (2)', 'AC-6 (10)']\n\n  unless kube_apiserver.exist?\n    impact 0.0\n    desc 'caveat', 'Kubernetes API Server process is not running on the target.'\n  end\n\n  describe kube_apiserver do\n    its('authorization-mode') { should_not be_nil }\n    its('authorization-mode') { should_not cmp 'AlwaysAllow' }\n  end\nend\n",
          "desc": "Kubernetes uses the API Server to control communication to the other\nservices that makeup Kubernetes. The use of authorizations and not the default\nof \"AlwaysAllow\" enables the Kubernetes functions control to only the groups\nthat need them.\n\n    To control access the API server must have one of the following options set\nfor the authorization mode:\n        --authorization-mode=ABAC Attribute-Based Access Control (ABAC) mode\nallows a user to configure policies using local files.\n        --authorization-mode=RBAC Role-based access control (RBAC) mode allows\na user to create and store policies using the Kubernetes API.\n        --authorization-mode=Webhook\n\n    WebHook is an HTTP callback mode that allows a user to manage authorization\nusing a remote REST endpoint.\n        --authorization-mode=Node\n\n    Node authorization is a special-purpose authorization mode that\nspecifically authorizes API requests made by kubelets.\n        --authorization-mode=AlwaysDeny\n\n    This flag blocks all requests. Use this flag only for testing.",
          "descriptions": [
            {
              "data": "Kubernetes uses the API Server to control communication to the other\nservices that makeup Kubernetes. The use of authorizations and not the default\nof \"AlwaysAllow\" enables the Kubernetes functions control to only the groups\nthat need them.\n\n    To control access the API server must have one of the following options set\nfor the authorization mode:\n        --authorization-mode=ABAC Attribute-Based Access Control (ABAC) mode\nallows a user to configure policies using local files.\n        --authorization-mode=RBAC Role-based access control (RBAC) mode allows\na user to create and store policies using the Kubernetes API.\n        --authorization-mode=Webhook\n\n    WebHook is an HTTP callback mode that allows a user to manage authorization\nusing a remote REST endpoint.\n        --authorization-mode=Node\n\n    Node authorization is a special-purpose authorization mode that\nspecifically authorizes API requests made by kubelets.\n        --authorization-mode=AlwaysDeny\n\n    This flag blocks all requests. Use this flag only for testing.",
              "label": "default"
            },
            {
              "data": "",
              "label": "rationale"
            },
            {
              "data": "Change to the /etc/kubernetes/manifests directory on the Kubernetes Master\nNode. Run the command:\n\n    grep -i authorization-mode *\n\n    If the setting authorization-mode is set to \"AlwaysAllow\" in the\nKubernetes API Server manifest file or is not configured, this is a finding.",
              "label": "check"
            },
            {
              "data": "Edit the Kubernetes API Server manifest file in the\n/etc/kubernetes/manifests directory on the Kubernetes Master Node. Set the\nargument \"--authorization-mode\" to any valid authorization mode other than\nAlwaysAllow.",
              "label": "fix"
            }
          ],
          "id": "V-242435",
          "impact": 0.7,
          "refs": [],
          "results": [],
          "source_location": {
            "line": 3,
            "ref": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242435.rb"
          },
          "tags": {
            "cci": ["CCI-000213", "CCI-001812", "CCI-002235"],
            "fix_id": "F-45668r712660_fix",
            "gid": "V-242435",
            "gtitle": "SRG-APP-000340-CTR-000770",
            "nist": ["AC-3", "CM-11 (2)", "AC-6 (10)"],
            "rid": "SV-242435r712661_rule",
            "satisfies": [
              "SRG-APP-000340-CTR-000770",
              "SRG-APP-000033-CTR-000095",
              "SRG-APP-000378-CTR-000880"
            ],
            "severity": "high",
            "stig_id": "CNTR-K8-001990"
          },
          "title": "Kubernetes must prevent non-privileged users from executing privileged\nfunctions to include disabling, circumventing, or altering implemented security\nsafeguards/countermeasures or the installation of patches and updates.",
          "waiver_data": {}
        },
        {
          "code": "control 'V-242436' do\n  title \"The Kubernetes API server must have the ValidatingAdmissionWebhook\nenabled.\"\n  desc  \"Enabling the admissions webhook allows for Kubernetes to apply\npolicies against objects that are to be created, read, updated, or deleted. By\napplying a pod security policy, control can be given to not allow images to be\ninstantiated that run as the root user. If pods run as the root user, the pod\nthen has root privileges to the host system and all the resources it has. An\nattacker can use this to attack the Kubernetes cluster. By implementing a\npolicy that does not allow root or privileged pods, the pod users are limited\nin what the pod can do and access.\"\n  desc  'rationale', ''\n  desc  'check', \"\n    Change to the /etc/kubernetes/manifests directory on the Kubernetes Master\nNode. Run the command:\n\n    grep -i ValidatingAdmissionWebhook *\n\n    If a line is not returned that includes enable-admission-plugins and\nValidatingAdmissionWebhook, this is a finding.\n  \"\n  desc 'fix', \"\n    Edit the Kubernetes API Server manifest file in the\n/etc/kubernetes/manifests directory on the Kubernetes Master Node. Set the\nargument \\\"--enable-admission-plugins\\\" to include\n\\\"ValidatingAdmissionWebhook\\\".  Each enabled plugin is separated by commas.\n\n    Note: It is best to implement policies first and then enable the webhook,\notherwise a denial of service may occur.\n  \"\n  impact 0.7\n  tag severity: 'high'\n  tag gtitle: 'SRG-APP-000342-CTR-000775'\n  tag gid: 'V-242436'\n  tag rid: 'SV-242436r712664_rule'\n  tag stig_id: 'CNTR-K8-002000'\n  tag fix_id: 'F-45669r717027_fix'\n  tag cci: ['CCI-002233']\n  tag nist: ['AC-6 (8)']\n\n  unless kube_apiserver.exist?\n    impact 0.0\n    desc 'caveat', 'Kubernetes API Server process is not running on the target.'\n  end\n\n  describe kube_apiserver do\n    its('enable-admission-plugins.to_s') { should include 'ValidatingAdmissionWebhook' }\n  end\nend\n",
          "desc": "Enabling the admissions webhook allows for Kubernetes to apply\npolicies against objects that are to be created, read, updated, or deleted. By\napplying a pod security policy, control can be given to not allow images to be\ninstantiated that run as the root user. If pods run as the root user, the pod\nthen has root privileges to the host system and all the resources it has. An\nattacker can use this to attack the Kubernetes cluster. By implementing a\npolicy that does not allow root or privileged pods, the pod users are limited\nin what the pod can do and access.",
          "descriptions": [
            {
              "data": "Enabling the admissions webhook allows for Kubernetes to apply\npolicies against objects that are to be created, read, updated, or deleted. By\napplying a pod security policy, control can be given to not allow images to be\ninstantiated that run as the root user. If pods run as the root user, the pod\nthen has root privileges to the host system and all the resources it has. An\nattacker can use this to attack the Kubernetes cluster. By implementing a\npolicy that does not allow root or privileged pods, the pod users are limited\nin what the pod can do and access.",
              "label": "default"
            },
            {
              "data": "",
              "label": "rationale"
            },
            {
              "data": "Change to the /etc/kubernetes/manifests directory on the Kubernetes Master\nNode. Run the command:\n\n    grep -i ValidatingAdmissionWebhook *\n\n    If a line is not returned that includes enable-admission-plugins and\nValidatingAdmissionWebhook, this is a finding.",
              "label": "check"
            },
            {
              "data": "Edit the Kubernetes API Server manifest file in the\n/etc/kubernetes/manifests directory on the Kubernetes Master Node. Set the\nargument \"--enable-admission-plugins\" to include\n\"ValidatingAdmissionWebhook\".  Each enabled plugin is separated by commas.\n\n    Note: It is best to implement policies first and then enable the webhook,\notherwise a denial of service may occur.",
              "label": "fix"
            }
          ],
          "id": "V-242436",
          "impact": 0.7,
          "refs": [],
          "results": [],
          "source_location": {
            "line": 3,
            "ref": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242436.rb"
          },
          "tags": {
            "cci": ["CCI-002233"],
            "fix_id": "F-45669r717027_fix",
            "gid": "V-242436",
            "gtitle": "SRG-APP-000342-CTR-000775",
            "nist": ["AC-6 (8)"],
            "rid": "SV-242436r712664_rule",
            "severity": "high",
            "stig_id": "CNTR-K8-002000"
          },
          "title": "The Kubernetes API server must have the ValidatingAdmissionWebhook\nenabled.",
          "waiver_data": {}
        },
        {
          "code": "control 'V-242438' do\n  title 'Kubernetes API Server must configure timeouts to limit attack surface.'\n  desc  \"Kubernetes API Server request timeouts sets the duration a request\nstays open before timing out. Since the API Server is the central component in\nthe Kubernetes Control Plane, it is vital to protect this service. If request\ntimeouts were not set, malicious attacks or unwanted activities might affect\nmultiple deployments across different applications or environments. This might\ndeplete all resources from the Kubernetes infrastructure causing the\ninformation system to go offline. The request-timeout value must never be set\nto \\\"0\\\". This disables the request-timeout feature. By default, the\nrequest-timeout is set to \\\"1 minute\\\".\"\n  desc  'rationale', ''\n  desc  'check', \"\n    Change to the /etc/kubernetes/manifests/ directory on the Kubernetes Master\nNode. Run the command:\n\n    grep -I request-timeout *\n\n    If Kubernetes API Server manifest file does not exist, this is a finding.\n\n    If the setting request-timeout is set to \\\"0\\\" in the Kubernetes API Server\nmanifest file, or is not configured this is a finding.\n  \"\n  desc 'fix', \"Edit the Kubernetes API Server manifest file in the\n/etc/kubernetes/manifests directory on the Kubernetes Master Node. Set the\nvalue of request-timeout greater than \\\"0\\\".\"\n  impact 0.5\n  tag severity: 'medium'\n  tag gtitle: 'SRG-APP-000435-CTR-001070'\n  tag gid: 'V-242438'\n  tag rid: 'SV-242438r712670_rule'\n  tag stig_id: 'CNTR-K8-002600'\n  tag fix_id: 'F-45671r712669_fix'\n  tag cci: ['CCI-002385']\n  tag nist: ['SC-5']\n\n  unless kube_apiserver.exist?\n    impact 0.0\n    desc 'caveat', 'Kubernetes API Server process is not running on the target.'\n  end\n\n  describe kube_apiserver do\n    its('request-timeout') { should_not be_nil }\n    its('request-timeout') { should_not cmp '0' }\n  end\nend\n",
          "desc": "Kubernetes API Server request timeouts sets the duration a request\nstays open before timing out. Since the API Server is the central component in\nthe Kubernetes Control Plane, it is vital to protect this service. If request\ntimeouts were not set, malicious attacks or unwanted activities might affect\nmultiple deployments across different applications or environments. This might\ndeplete all resources from the Kubernetes infrastructure causing the\ninformation system to go offline. The request-timeout value must never be set\nto \"0\". This disables the request-timeout feature. By default, the\nrequest-timeout is set to \"1 minute\".",
          "descriptions": [
            {
              "data": "Kubernetes API Server request timeouts sets the duration a request\nstays open before timing out. Since the API Server is the central component in\nthe Kubernetes Control Plane, it is vital to protect this service. If request\ntimeouts were not set, malicious attacks or unwanted activities might affect\nmultiple deployments across different applications or environments. This might\ndeplete all resources from the Kubernetes infrastructure causing the\ninformation system to go offline. The request-timeout value must never be set\nto \"0\". This disables the request-timeout feature. By default, the\nrequest-timeout is set to \"1 minute\".",
              "label": "default"
            },
            {
              "data": "",
              "label": "rationale"
            },
            {
              "data": "Change to the /etc/kubernetes/manifests/ directory on the Kubernetes Master\nNode. Run the command:\n\n    grep -I request-timeout *\n\n    If Kubernetes API Server manifest file does not exist, this is a finding.\n\n    If the setting request-timeout is set to \"0\" in the Kubernetes API Server\nmanifest file, or is not configured this is a finding.",
              "label": "check"
            },
            {
              "data": "Edit the Kubernetes API Server manifest file in the\n/etc/kubernetes/manifests directory on the Kubernetes Master Node. Set the\nvalue of request-timeout greater than \"0\".",
              "label": "fix"
            }
          ],
          "id": "V-242438",
          "impact": 0.5,
          "refs": [],
          "results": [],
          "source_location": {
            "line": 3,
            "ref": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242438.rb"
          },
          "tags": {
            "cci": ["CCI-002385"],
            "fix_id": "F-45671r712669_fix",
            "gid": "V-242438",
            "gtitle": "SRG-APP-000435-CTR-001070",
            "nist": ["SC-5"],
            "rid": "SV-242438r712670_rule",
            "severity": "medium",
            "stig_id": "CNTR-K8-002600"
          },
          "title": "Kubernetes API Server must configure timeouts to limit attack surface.",
          "waiver_data": {}
        },
        {
          "code": "control 'V-242439' do\n  title \"Kubernetes API Server must disable basic authentication to protect\ninformation in transit.\"\n  desc  \"Kubernetes basic authentication sends and receives request containing\nusername, uid, groups, and other fields over a clear text HTTP communication.\nBasic authentication does not provide any security mechanisms using encryption\nstandards. PKI certificate-based authentication must be set over a secure\nchannel to ensure confidentiality and integrity. Basic authentication must not\nbe set in the manifest file.\"\n  desc  'rationale', ''\n  desc  'check', \"\n    Change to the /etc/kubernetes/manifests/ directory on the Kubernetes Master\nNode. Run the command:\n\n    grep -i basic-auth-file *\n\n    If \\\"basic-auth-file\\\" is set in the Kubernetes API server manifest file\nthis is a finding.\n  \"\n  desc 'fix', \"Edit the Kubernetes API Server manifest file in the\n/etc/kubernetes/manifests directory on the Kubernetes Master Node. Remove the\nsetting \\\"--basic-auth-file\\\".\"\n  impact 0.7\n  tag severity: 'high'\n  tag gtitle: 'SRG-APP-000516-CTR-001325'\n  tag gid: 'V-242439'\n  tag rid: 'SV-242439r712673_rule'\n  tag stig_id: 'CNTR-K8-002620'\n  tag fix_id: 'F-45672r712672_fix'\n  tag cci: ['CCI-002418']\n  tag nist: ['SC-8']\n\n  unless kube_apiserver.exist?\n    impact 0.0\n    desc 'caveat', 'Kubernetes API Server process is not running on the target.'\n  end\n\n  describe kube_apiserver do\n    its('basic-auth-file') { should be_nil }\n  end\nend\n",
          "desc": "Kubernetes basic authentication sends and receives request containing\nusername, uid, groups, and other fields over a clear text HTTP communication.\nBasic authentication does not provide any security mechanisms using encryption\nstandards. PKI certificate-based authentication must be set over a secure\nchannel to ensure confidentiality and integrity. Basic authentication must not\nbe set in the manifest file.",
          "descriptions": [
            {
              "data": "Kubernetes basic authentication sends and receives request containing\nusername, uid, groups, and other fields over a clear text HTTP communication.\nBasic authentication does not provide any security mechanisms using encryption\nstandards. PKI certificate-based authentication must be set over a secure\nchannel to ensure confidentiality and integrity. Basic authentication must not\nbe set in the manifest file.",
              "label": "default"
            },
            {
              "data": "",
              "label": "rationale"
            },
            {
              "data": "Change to the /etc/kubernetes/manifests/ directory on the Kubernetes Master\nNode. Run the command:\n\n    grep -i basic-auth-file *\n\n    If \"basic-auth-file\" is set in the Kubernetes API server manifest file\nthis is a finding.",
              "label": "check"
            },
            {
              "data": "Edit the Kubernetes API Server manifest file in the\n/etc/kubernetes/manifests directory on the Kubernetes Master Node. Remove the\nsetting \"--basic-auth-file\".",
              "label": "fix"
            }
          ],
          "id": "V-242439",
          "impact": 0.7,
          "refs": [],
          "results": [],
          "source_location": {
            "line": 3,
            "ref": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242439.rb"
          },
          "tags": {
            "cci": ["CCI-002418"],
            "fix_id": "F-45672r712672_fix",
            "gid": "V-242439",
            "gtitle": "SRG-APP-000516-CTR-001325",
            "nist": ["SC-8"],
            "rid": "SV-242439r712673_rule",
            "severity": "high",
            "stig_id": "CNTR-K8-002620"
          },
          "title": "Kubernetes API Server must disable basic authentication to protect\ninformation in transit.",
          "waiver_data": {}
        },
        {
          "code": "control 'V-242440' do\n  title \"Kubernetes API Server must disable token authentication to protect\ninformation in transit.\"\n  desc  \"Kubernetes token authentication uses password known as secrets in a\nplaintext file. This file contains sensitive information such as token,\nusername and user uid. This token is used by service accounts within pods to\nauthenticate with the API Server. This information is very valuable for\nattackers with malicious intent if the service account is privileged having\naccess to the token. With this token a threat actor can impersonate the service\naccount gaining access to the Rest API service.\"\n  desc  'rationale', ''\n  desc  'check', \"\n    Change to the /etc/kubernetes/manifests/ directory on the Kubernetes Master\nNode. Run the command:\n\n    grep -i token-auth-file *\n\n    If \\\"token-auth-file\\\" is set in the Kubernetes API server manifest file,\nthis is a finding.\n  \"\n  desc 'fix', \"Edit the Kubernetes API Server manifest file in the\n/etc/kubernetes/manifests directory on the Kubernetes Master Node. Remove\nparameter \\\"--token-auth-file\\\".\"\n  impact 0.5\n  tag severity: 'medium'\n  tag gtitle: 'SRG-APP-000516-CTR-001325'\n  tag gid: 'V-242440'\n  tag rid: 'SV-242440r712676_rule'\n  tag stig_id: 'CNTR-K8-002630'\n  tag fix_id: 'F-45673r712675_fix'\n  tag cci: ['CCI-002418']\n  tag nist: ['SC-8']\n\n  unless kube_apiserver.exist?\n    impact 0.0\n    desc 'caveat', 'Kubernetes API Server process is not running on the target.'\n  end\n\n  describe kube_apiserver do\n    its('token-auth-file') { should be_nil }\n  end\nend\n",
          "desc": "Kubernetes token authentication uses password known as secrets in a\nplaintext file. This file contains sensitive information such as token,\nusername and user uid. This token is used by service accounts within pods to\nauthenticate with the API Server. This information is very valuable for\nattackers with malicious intent if the service account is privileged having\naccess to the token. With this token a threat actor can impersonate the service\naccount gaining access to the Rest API service.",
          "descriptions": [
            {
              "data": "Kubernetes token authentication uses password known as secrets in a\nplaintext file. This file contains sensitive information such as token,\nusername and user uid. This token is used by service accounts within pods to\nauthenticate with the API Server. This information is very valuable for\nattackers with malicious intent if the service account is privileged having\naccess to the token. With this token a threat actor can impersonate the service\naccount gaining access to the Rest API service.",
              "label": "default"
            },
            {
              "data": "",
              "label": "rationale"
            },
            {
              "data": "Change to the /etc/kubernetes/manifests/ directory on the Kubernetes Master\nNode. Run the command:\n\n    grep -i token-auth-file *\n\n    If \"token-auth-file\" is set in the Kubernetes API server manifest file,\nthis is a finding.",
              "label": "check"
            },
            {
              "data": "Edit the Kubernetes API Server manifest file in the\n/etc/kubernetes/manifests directory on the Kubernetes Master Node. Remove\nparameter \"--token-auth-file\".",
              "label": "fix"
            }
          ],
          "id": "V-242440",
          "impact": 0.5,
          "refs": [],
          "results": [],
          "source_location": {
            "line": 3,
            "ref": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242440.rb"
          },
          "tags": {
            "cci": ["CCI-002418"],
            "fix_id": "F-45673r712675_fix",
            "gid": "V-242440",
            "gtitle": "SRG-APP-000516-CTR-001325",
            "nist": ["SC-8"],
            "rid": "SV-242440r712676_rule",
            "severity": "medium",
            "stig_id": "CNTR-K8-002630"
          },
          "title": "Kubernetes API Server must disable token authentication to protect\ninformation in transit.",
          "waiver_data": {}
        },
        {
          "code": "control 'V-242441' do\n  title \"Kubernetes endpoints must use approved organizational certificate and\nkey pair to protect information in transit.\"\n  desc  \"Kubernetes control plane and external communication is managed by API\nServer. The main implementation of the API Server is to manage hardware\nresources for pods and container using horizontal or vertical scaling. Anyone\nwho can gain access to the API Server can effectively control your Kubernetes\narchitecture. Using authenticity protection, the communication can be protected\nagainst man-in-the-middle attacks/session hijacking and the insertion of false\ninformation into sessions.\n\n    The communication session is protected by utilizing transport encryption\nprotocols, such as TLS. TLS provides the Kubernetes API Server with a means to\nbe able to authenticate sessions and encrypt traffic.\n\n    By default, the API Server does not authenticate to the kubelet HTTPs\nendpoint. To enable secure communication for API Server, the parameter\n-kubelet-client-certificate and kubelet-client-key must be set. This parameter\ngives the location of the certificate and key pair used to secure API Server\ncommunication.\n  \"\n  desc  'rationale', ''\n  desc  'check', \"\n    Change to the /etc/kubernetes/manifests/ directory on the Kubernetes Master\nNode. Run the command:\n\n    grep -i kubelet-client-certificate *\n    grep -I kubelet-client-key *\n\n    If the setting \\\"--kubelet-client-certificate\\\" is not configured in the\nKubernetes API server manifest file or contains no value, this is a finding.\n\n    If the setting \\\"--kubelet-client-key\\\" is not configured in the Kubernetes\nAPI server manifest file or contains no value, this is a finding.\n  \"\n  desc 'fix', \"Edit the Kubernetes API Server manifest file in the\n/etc/kubernetes/manifests directory on the Kubernetes Master Node. Set the\nvalue of \\\"--kubelet-client-certificate\\\" and \\\"--kubelet-client-key\\\" to an\nApproved Organizational Certificate and key pair.\"\n  impact 0.5\n  tag severity: 'medium'\n  tag gtitle: 'SRG-APP-000516-CTR-001325'\n  tag gid: 'V-242441'\n  tag rid: 'SV-242441r712679_rule'\n  tag stig_id: 'CNTR-K8-002640'\n  tag fix_id: 'F-45674r712678_fix'\n  tag cci: ['CCI-002418']\n  tag nist: ['SC-8']\n\n  unless kube_apiserver.exist?\n    impact 0.0\n    desc 'caveat', 'Kubernetes API Server process is not running on the target.'\n  end\n\n  describe kube_apiserver do\n    its('kubelet-client-certificate') { should_not be_nil }\n    its('kubelet-client-key') { should_not be_nil }\n  end\nend\n",
          "desc": "Kubernetes control plane and external communication is managed by API\nServer. The main implementation of the API Server is to manage hardware\nresources for pods and container using horizontal or vertical scaling. Anyone\nwho can gain access to the API Server can effectively control your Kubernetes\narchitecture. Using authenticity protection, the communication can be protected\nagainst man-in-the-middle attacks/session hijacking and the insertion of false\ninformation into sessions.\n\n    The communication session is protected by utilizing transport encryption\nprotocols, such as TLS. TLS provides the Kubernetes API Server with a means to\nbe able to authenticate sessions and encrypt traffic.\n\n    By default, the API Server does not authenticate to the kubelet HTTPs\nendpoint. To enable secure communication for API Server, the parameter\n-kubelet-client-certificate and kubelet-client-key must be set. This parameter\ngives the location of the certificate and key pair used to secure API Server\ncommunication.",
          "descriptions": [
            {
              "data": "Kubernetes control plane and external communication is managed by API\nServer. The main implementation of the API Server is to manage hardware\nresources for pods and container using horizontal or vertical scaling. Anyone\nwho can gain access to the API Server can effectively control your Kubernetes\narchitecture. Using authenticity protection, the communication can be protected\nagainst man-in-the-middle attacks/session hijacking and the insertion of false\ninformation into sessions.\n\n    The communication session is protected by utilizing transport encryption\nprotocols, such as TLS. TLS provides the Kubernetes API Server with a means to\nbe able to authenticate sessions and encrypt traffic.\n\n    By default, the API Server does not authenticate to the kubelet HTTPs\nendpoint. To enable secure communication for API Server, the parameter\n-kubelet-client-certificate and kubelet-client-key must be set. This parameter\ngives the location of the certificate and key pair used to secure API Server\ncommunication.",
              "label": "default"
            },
            {
              "data": "",
              "label": "rationale"
            },
            {
              "data": "Change to the /etc/kubernetes/manifests/ directory on the Kubernetes Master\nNode. Run the command:\n\n    grep -i kubelet-client-certificate *\n    grep -I kubelet-client-key *\n\n    If the setting \"--kubelet-client-certificate\" is not configured in the\nKubernetes API server manifest file or contains no value, this is a finding.\n\n    If the setting \"--kubelet-client-key\" is not configured in the Kubernetes\nAPI server manifest file or contains no value, this is a finding.",
              "label": "check"
            },
            {
              "data": "Edit the Kubernetes API Server manifest file in the\n/etc/kubernetes/manifests directory on the Kubernetes Master Node. Set the\nvalue of \"--kubelet-client-certificate\" and \"--kubelet-client-key\" to an\nApproved Organizational Certificate and key pair.",
              "label": "fix"
            }
          ],
          "id": "V-242441",
          "impact": 0.5,
          "refs": [],
          "results": [],
          "source_location": {
            "line": 3,
            "ref": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242441.rb"
          },
          "tags": {
            "cci": ["CCI-002418"],
            "fix_id": "F-45674r712678_fix",
            "gid": "V-242441",
            "gtitle": "SRG-APP-000516-CTR-001325",
            "nist": ["SC-8"],
            "rid": "SV-242441r712679_rule",
            "severity": "medium",
            "stig_id": "CNTR-K8-002640"
          },
          "title": "Kubernetes endpoints must use approved organizational certificate and\nkey pair to protect information in transit.",
          "waiver_data": {}
        },
        {
          "code": "  control 'V-242444' do\n    impact 0.0\n    desc 'caveat', 'K3S deployments are not applied using manifest files and hence non-applicable.'\n  end\n",
          "desc": "The Kubernetes manifests are those files that contain the arguments\nand settings for the Master Node services. These services are etcd, the api\nserver, controller, proxy, and scheduler. If these files can be changed, the\nscheduler will be implementing the changes immediately. Many of the security\nsettings within the document are implemented through these manifests.",
          "descriptions": [
            {
              "data": "The Kubernetes manifests are those files that contain the arguments\nand settings for the Master Node services. These services are etcd, the api\nserver, controller, proxy, and scheduler. If these files can be changed, the\nscheduler will be implementing the changes immediately. Many of the security\nsettings within the document are implemented through these manifests.",
              "label": "default"
            },
            {
              "data": "",
              "label": "rationale"
            },
            {
              "data": "Review the ownership of the Kubernetes manifests files by using the command:\n\n    stat -c %U:%G /etc/kubernetes/manifests/* | grep -v root:root\n\n    If the command returns any non root:root file permissions, this is a\nfinding.",
              "label": "check"
            },
            {
              "data": "Change the ownership of the manifest files to root: root by executing the\ncommand:\n\n    chown root:root /etc/kubernetes/manifests/*",
              "label": "fix"
            },
            {
              "data": "K3S deployments are not applied using manifest files and hence non-applicable.",
              "label": "caveat"
            }
          ],
          "id": "V-242444",
          "impact": 0.0,
          "refs": [
            {
              "ref": []
            }
          ],
          "results": [],
          "source_location": {
            "line": 3,
            "ref": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242444.rb"
          },
          "tags": {
            "cci": ["CCI-000366"],
            "fix_id": "F-45677r712687_fix",
            "gid": "V-242444",
            "gtitle": "SRG-APP-000516-CTR-001325",
            "nist": ["CM-6 b"],
            "rid": "SV-242444r712688_rule",
            "severity": "medium",
            "stig_id": "CNTR-K8-003110"
          },
          "title": "The Kubernetes component manifests must be owned by root.",
          "waiver_data": {}
        },
        {
          "code": "control 'V-242445' do\n  title 'The Kubernetes component etcd must be owned by etcd.'\n  desc  \"The Kubernetes etcd key-value store provides a way to store data to\nthe Master Node. If these files can be changed, data to API object and the\nmaster node would be compromised. The scheduler will implement the changes\nimmediately. Many of the security settings within the document are implemented\nthrough this file.\"\n  desc  'rationale', ''\n  desc  'check', \"\n    Review the ownership of the Kubernetes etcd files by using the command:\n\n    stat -c %U:%G /var/lib/etcd/* | grep -v etcd:etcd\n\n    If the command returns any non etcd:etcd file permissions, this is a\nfinding.\n  \"\n  desc 'fix', \"\n    Change the ownership of the manifest files to etcd:etcd by executing the\ncommand:\n\n    chown etcd:etcd /var/lib/etcd/*\n  \"\n  impact 0.5\n  tag severity: 'medium'\n  tag gtitle: 'SRG-APP-000516-CTR-001325'\n  tag gid: 'V-242445'\n  tag rid: 'SV-242445r712691_rule'\n  tag stig_id: 'CNTR-K8-003120'\n  tag fix_id: 'F-45678r712690_fix'\n  tag cci: ['CCI-000366']\n  tag nist: ['CM-6 b']\n\n  if etcd.exist?\n    describe.one do\n      if etcd.params['data-dir']\n        describe file(etcd.params['data-dir'].join) do\n          it { should be_owned_by('etcd') }\n          it { should be_grouped_into('etcd') }\n        end\n      end\n\n      describe file(process_env_var('etcd').params['ETCD_DATA_DIR']) do\n        it { should be_owned_by('etcd') }\n        it { should be_grouped_into('etcd') }\n      end\n    end\n  else\n    describe 'ETCD process is not running on the target.' do\n      skip\n    end\n  end\nend\n",
          "desc": "The Kubernetes etcd key-value store provides a way to store data to\nthe Master Node. If these files can be changed, data to API object and the\nmaster node would be compromised. The scheduler will implement the changes\nimmediately. Many of the security settings within the document are implemented\nthrough this file.",
          "descriptions": [
            {
              "data": "The Kubernetes etcd key-value store provides a way to store data to\nthe Master Node. If these files can be changed, data to API object and the\nmaster node would be compromised. The scheduler will implement the changes\nimmediately. Many of the security settings within the document are implemented\nthrough this file.",
              "label": "default"
            },
            {
              "data": "",
              "label": "rationale"
            },
            {
              "data": "Review the ownership of the Kubernetes etcd files by using the command:\n\n    stat -c %U:%G /var/lib/etcd/* | grep -v etcd:etcd\n\n    If the command returns any non etcd:etcd file permissions, this is a\nfinding.",
              "label": "check"
            },
            {
              "data": "Change the ownership of the manifest files to etcd:etcd by executing the\ncommand:\n\n    chown etcd:etcd /var/lib/etcd/*",
              "label": "fix"
            }
          ],
          "id": "V-242445",
          "impact": 0.5,
          "refs": [],
          "results": [],
          "source_location": {
            "line": 3,
            "ref": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242445.rb"
          },
          "tags": {
            "cci": ["CCI-000366"],
            "fix_id": "F-45678r712690_fix",
            "gid": "V-242445",
            "gtitle": "SRG-APP-000516-CTR-001325",
            "nist": ["CM-6 b"],
            "rid": "SV-242445r712691_rule",
            "severity": "medium",
            "stig_id": "CNTR-K8-003120"
          },
          "title": "The Kubernetes component etcd must be owned by etcd.",
          "waiver_data": {}
        },
        {
          "code": "control 'V-242446' do\n  title 'The Kubernetes conf files must be owned by root.'\n  desc  \"The Kubernetes conf files contain the arguments and settings for the\nMaster Node services. These services are controller and scheduler. If these\nfiles can be changed, the scheduler will be implementing the changes\nimmediately. Many of the security settings within the document are implemented\nthrough this file.\"\n  desc  'rationale', ''\n  desc  'check', \"\n    Review the Kubernetes conf files by using the command:\n\n    stat -c %U:%G /etc/kubernetes/admin.conf | grep -v root:root\n    stat -c %U:%G /etc/kubernetes/scheduler.conf | grep -v root:root\n    stat -c %U:%G /etc/kubernetes/controller-manager.conf | grep -v root:root\n\n    If the command returns any non root:root file permissions, this is a\nfinding.\n  \"\n  desc 'fix', \"\n    Change the ownership of the conf files to root: root by executing the\ncommand:\n\n    chown root:root /etc/kubernetes/admin.conf\n    chown root:root /etc/kubernetes/scheduler.conf\n    chown root:root /etc/kubernetes/controller-manager.conf\n  \"\n  impact 0.5\n  tag severity: 'medium'\n  tag gtitle: 'SRG-APP-000516-CTR-001325'\n  tag gid: 'V-242446'\n  tag rid: 'SV-242446r712694_rule'\n  tag stig_id: 'CNTR-K8-003130'\n  tag fix_id: 'F-45679r712693_fix'\n  tag cci: ['CCI-000366']\n  tag nist: ['CM-6 b']\n\n  input('kubernetes_conf_files').each do |file_name|\n    if file(file_name).exist?\n      describe file(file_name) do\n        it { should be_owned_by('root') }\n        it { should be_grouped_into('root') }\n      end\n    else\n      describe \"Kubernetes Conf file #{file_name} not found on target\" do\n        skip\n      end\n    end\n  end\n\n  if input('kubernetes_conf_files').empty?\n    describe 'No `kubernetes_conf_files` provided through input values.' do\n      skip\n    end\n  end\nend\n",
          "desc": "The Kubernetes conf files contain the arguments and settings for the\nMaster Node services. These services are controller and scheduler. If these\nfiles can be changed, the scheduler will be implementing the changes\nimmediately. Many of the security settings within the document are implemented\nthrough this file.",
          "descriptions": [
            {
              "data": "The Kubernetes conf files contain the arguments and settings for the\nMaster Node services. These services are controller and scheduler. If these\nfiles can be changed, the scheduler will be implementing the changes\nimmediately. Many of the security settings within the document are implemented\nthrough this file.",
              "label": "default"
            },
            {
              "data": "",
              "label": "rationale"
            },
            {
              "data": "Review the Kubernetes conf files by using the command:\n\n    stat -c %U:%G /etc/kubernetes/admin.conf | grep -v root:root\n    stat -c %U:%G /etc/kubernetes/scheduler.conf | grep -v root:root\n    stat -c %U:%G /etc/kubernetes/controller-manager.conf | grep -v root:root\n\n    If the command returns any non root:root file permissions, this is a\nfinding.",
              "label": "check"
            },
            {
              "data": "Change the ownership of the conf files to root: root by executing the\ncommand:\n\n    chown root:root /etc/kubernetes/admin.conf\n    chown root:root /etc/kubernetes/scheduler.conf\n    chown root:root /etc/kubernetes/controller-manager.conf",
              "label": "fix"
            }
          ],
          "id": "V-242446",
          "impact": 0.5,
          "refs": [],
          "results": [],
          "source_location": {
            "line": 3,
            "ref": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242446.rb"
          },
          "tags": {
            "cci": ["CCI-000366"],
            "fix_id": "F-45679r712693_fix",
            "gid": "V-242446",
            "gtitle": "SRG-APP-000516-CTR-001325",
            "nist": ["CM-6 b"],
            "rid": "SV-242446r712694_rule",
            "severity": "medium",
            "stig_id": "CNTR-K8-003130"
          },
          "title": "The Kubernetes conf files must be owned by root.",
          "waiver_data": {}
        },
        {
          "code": "control 'V-242447' do\n  title \"The Kubernetes Kube Proxy must have file permissions set to 644 or\nmore restrictive.\"\n  desc  \"The Kubernetes kube proxy kubeconfig contain the argument and setting\nfor the Master Nodes. These settings contain network rules for restricting\nnetwork communication between pods, clusters, and networks. If these files can\nbe changed, data traversing between the Kubernetes Control Panel components\nwould be compromised. Many of the security settings within the document are\nimplemented through this file.\"\n  desc  'rationale', ''\n  desc  'check', \"\n    Check if Kube-Proxy is running and obtain --kubeconfig parameter use the\nfollowing command:\n    ps -ef | grep kube-proxy\n\n    If Kube-Proxy exists:\n    Review the permissions of the Kubernetes Kube Proxy by using the command:\n    stat -c %a <location from --kubeconfig>\n\n    If the file has permissions more permissive than \\\"644\\\", this is a finding.\n  \"\n  desc 'fix', \"\n    Change the permissions of the Kube Proxy to \\\"644\\\" by executing the\ncommand:\n\n    chown 644 <location from kubeconfig>.\n  \"\n  impact 0.5\n  tag severity: 'medium'\n  tag gtitle: 'SRG-APP-000516-CTR-001325'\n  tag gid: 'V-242447'\n  tag rid: 'SV-242447r712697_rule'\n  tag stig_id: 'CNTR-K8-003140'\n  tag fix_id: 'F-45680r712696_fix'\n  tag cci: ['CCI-000366']\n  tag nist: ['CM-6 b']\n\n  unless kube_proxy.exist?\n    impact 0.0\n    desc 'caveat', 'Kube-Proxy process is not running on the target.'\n  end\n\n  describe kube_proxy do\n    its('kubeconfig_file') { should_not be_nil }\n    its('kubeconfig_file') { should_not be_more_permissive_than('0644') }\n  end\nend\n",
          "desc": "The Kubernetes kube proxy kubeconfig contain the argument and setting\nfor the Master Nodes. These settings contain network rules for restricting\nnetwork communication between pods, clusters, and networks. If these files can\nbe changed, data traversing between the Kubernetes Control Panel components\nwould be compromised. Many of the security settings within the document are\nimplemented through this file.",
          "descriptions": [
            {
              "data": "The Kubernetes kube proxy kubeconfig contain the argument and setting\nfor the Master Nodes. These settings contain network rules for restricting\nnetwork communication between pods, clusters, and networks. If these files can\nbe changed, data traversing between the Kubernetes Control Panel components\nwould be compromised. Many of the security settings within the document are\nimplemented through this file.",
              "label": "default"
            },
            {
              "data": "",
              "label": "rationale"
            },
            {
              "data": "Check if Kube-Proxy is running and obtain --kubeconfig parameter use the\nfollowing command:\n    ps -ef | grep kube-proxy\n\n    If Kube-Proxy exists:\n    Review the permissions of the Kubernetes Kube Proxy by using the command:\n    stat -c %a <location from --kubeconfig>\n\n    If the file has permissions more permissive than \"644\", this is a finding.",
              "label": "check"
            },
            {
              "data": "Change the permissions of the Kube Proxy to \"644\" by executing the\ncommand:\n\n    chown 644 <location from kubeconfig>.",
              "label": "fix"
            }
          ],
          "id": "V-242447",
          "impact": 0.5,
          "refs": [],
          "results": [],
          "source_location": {
            "line": 3,
            "ref": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242447.rb"
          },
          "tags": {
            "cci": ["CCI-000366"],
            "fix_id": "F-45680r712696_fix",
            "gid": "V-242447",
            "gtitle": "SRG-APP-000516-CTR-001325",
            "nist": ["CM-6 b"],
            "rid": "SV-242447r712697_rule",
            "severity": "medium",
            "stig_id": "CNTR-K8-003140"
          },
          "title": "The Kubernetes Kube Proxy must have file permissions set to 644 or\nmore restrictive.",
          "waiver_data": {}
        },
        {
          "code": "control 'V-242448' do\n  title 'The Kubernetes Kube Proxy must be owned by root.'\n  desc  \"The Kubernetes kube proxy kubeconfig contain the argument and setting\nfor the Master Nodes. These settings contain network rules for restricting\nnetwork communication between pods, clusters, and networks. If these files can\nbe changed, data traversing between the Kubernetes Control Panel components\nwould be compromised. Many of the security settings within the document are\nimplemented through this file.\"\n  desc  'rationale', ''\n  desc  'check', \"\n    Check if Kube-Proxy is running use the following command:\n    ps -ef | grep kube-proxy\n\n    If Kube-Proxy exists:\n    Review the permissions of the Kubernetes Kube Proxy by using the command:\n    stat -c   %U:%G <location from --kubeconfig>| grep -v root:root\n\n    If the command returns any non root:root file permissions, this is a\nfinding.\n  \"\n  desc 'fix', \"\n    Change the ownership of the Kube Proxy to root:root by executing the\ncommand:\n\n    chown root:root <location from kubeconfig>.\n  \"\n  impact 0.5\n  tag severity: 'medium'\n  tag gtitle: 'SRG-APP-000516-CTR-001325'\n  tag gid: 'V-242448'\n  tag rid: 'SV-242448r712700_rule'\n  tag stig_id: 'CNTR-K8-003150'\n  tag fix_id: 'F-45681r712699_fix'\n  tag cci: ['CCI-000366']\n  tag nist: ['CM-6 b']\n\n  unless kube_proxy.exist?\n    impact 0.0\n    desc 'caveat', 'Kube-Proxy process is not running on the target.'\n  end\n\n  describe kube_proxy do\n    its('kubeconfig_file') { should_not be_nil }\n    its('kubeconfig_file') { should be_owned_by('root') }\n    its('kubeconfig_file') { should be_grouped_into('root') }\n  end\nend\n",
          "desc": "The Kubernetes kube proxy kubeconfig contain the argument and setting\nfor the Master Nodes. These settings contain network rules for restricting\nnetwork communication between pods, clusters, and networks. If these files can\nbe changed, data traversing between the Kubernetes Control Panel components\nwould be compromised. Many of the security settings within the document are\nimplemented through this file.",
          "descriptions": [
            {
              "data": "The Kubernetes kube proxy kubeconfig contain the argument and setting\nfor the Master Nodes. These settings contain network rules for restricting\nnetwork communication between pods, clusters, and networks. If these files can\nbe changed, data traversing between the Kubernetes Control Panel components\nwould be compromised. Many of the security settings within the document are\nimplemented through this file.",
              "label": "default"
            },
            {
              "data": "",
              "label": "rationale"
            },
            {
              "data": "Check if Kube-Proxy is running use the following command:\n    ps -ef | grep kube-proxy\n\n    If Kube-Proxy exists:\n    Review the permissions of the Kubernetes Kube Proxy by using the command:\n    stat -c   %U:%G <location from --kubeconfig>| grep -v root:root\n\n    If the command returns any non root:root file permissions, this is a\nfinding.",
              "label": "check"
            },
            {
              "data": "Change the ownership of the Kube Proxy to root:root by executing the\ncommand:\n\n    chown root:root <location from kubeconfig>.",
              "label": "fix"
            }
          ],
          "id": "V-242448",
          "impact": 0.5,
          "refs": [],
          "results": [],
          "source_location": {
            "line": 3,
            "ref": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242448.rb"
          },
          "tags": {
            "cci": ["CCI-000366"],
            "fix_id": "F-45681r712699_fix",
            "gid": "V-242448",
            "gtitle": "SRG-APP-000516-CTR-001325",
            "nist": ["CM-6 b"],
            "rid": "SV-242448r712700_rule",
            "severity": "medium",
            "stig_id": "CNTR-K8-003150"
          },
          "title": "The Kubernetes Kube Proxy must be owned by root.",
          "waiver_data": {}
        },
        {
          "code": "control 'V-242449' do\n  title \"The Kubernetes Kubelet certificate authority file must have file\npermissions set to 644 or more restrictive.\"\n  desc  \"The Kubernetes kubelet certificate authority file contains settings\nfor the Kubernetes Node TLS certificate authority. Any request presenting a\nclient certificate signed by one of the authorities in the client-ca-file is\nauthenticated with an identity corresponding to the CommonName of the client\ncertificate. If this file can be changed, the Kubernetes architecture could be\ncompromised. The scheduler will implement the changes immediately. Many of the\nsecurity settings within the document are implemented through this file.\"\n  desc  'rationale', ''\n  desc  'check', \"\n    Change to the /etc/sysconfig/ directory on the Kubernetes Master Node. Run\ncommand:\n\n    more kubelet\n    --client-ca-file argument\n    Note certificate location\n\n    If the ca-file argument location file has permissions more permissive than\n\\\"644\\\", this is a finding.\n  \"\n  desc 'fix', \"\n    Change the permissions of the --client-ca-file to \\\"644\\\" by executing the\ncommand:\n\n    chown 644 <kubelet --client--ca-file argument location>.\n  \"\n  impact 0.5\n  tag severity: 'medium'\n  tag gtitle: 'SRG-APP-000516-CTR-001325'\n  tag gid: 'V-242449'\n  tag rid: 'SV-242449r712703_rule'\n  tag stig_id: 'CNTR-K8-003160'\n  tag fix_id: 'F-45682r712702_fix'\n  tag cci: ['CCI-000366']\n  tag nist: ['CM-6 b']\n\n  describe.one do\n    describe kubelet do\n      its('client_ca_file') { should_not be_nil }\n      its('client_ca_file') { should_not be_more_permissive_than('0644') }\n    end\n\n    client_ca_file = kubelet_config_file.params.dig('authentication', 'x509', 'clientCAFile')\n    if client_ca_file\n      describe file(client_ca_file) do\n        it { should_not be_more_permissive_than('0644') }\n      end\n    end\n  end\nend\n",
          "desc": "The Kubernetes kubelet certificate authority file contains settings\nfor the Kubernetes Node TLS certificate authority. Any request presenting a\nclient certificate signed by one of the authorities in the client-ca-file is\nauthenticated with an identity corresponding to the CommonName of the client\ncertificate. If this file can be changed, the Kubernetes architecture could be\ncompromised. The scheduler will implement the changes immediately. Many of the\nsecurity settings within the document are implemented through this file.",
          "descriptions": [
            {
              "data": "The Kubernetes kubelet certificate authority file contains settings\nfor the Kubernetes Node TLS certificate authority. Any request presenting a\nclient certificate signed by one of the authorities in the client-ca-file is\nauthenticated with an identity corresponding to the CommonName of the client\ncertificate. If this file can be changed, the Kubernetes architecture could be\ncompromised. The scheduler will implement the changes immediately. Many of the\nsecurity settings within the document are implemented through this file.",
              "label": "default"
            },
            {
              "data": "",
              "label": "rationale"
            },
            {
              "data": "Change to the /etc/sysconfig/ directory on the Kubernetes Master Node. Run\ncommand:\n\n    more kubelet\n    --client-ca-file argument\n    Note certificate location\n\n    If the ca-file argument location file has permissions more permissive than\n\"644\", this is a finding.",
              "label": "check"
            },
            {
              "data": "Change the permissions of the --client-ca-file to \"644\" by executing the\ncommand:\n\n    chown 644 <kubelet --client--ca-file argument location>.",
              "label": "fix"
            }
          ],
          "id": "V-242449",
          "impact": 0.5,
          "refs": [],
          "results": [],
          "source_location": {
            "line": 3,
            "ref": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242449.rb"
          },
          "tags": {
            "cci": ["CCI-000366"],
            "fix_id": "F-45682r712702_fix",
            "gid": "V-242449",
            "gtitle": "SRG-APP-000516-CTR-001325",
            "nist": ["CM-6 b"],
            "rid": "SV-242449r712703_rule",
            "severity": "medium",
            "stig_id": "CNTR-K8-003160"
          },
          "title": "The Kubernetes Kubelet certificate authority file must have file\npermissions set to 644 or more restrictive.",
          "waiver_data": {}
        },
        {
          "code": "control 'V-242450' do\n  title 'The Kubernetes Kubelet certificate authority must be owned by root.'\n  desc  \"The Kubernetes kubelet certificate authority file contains settings\nfor the Kubernetes Node TLS certificate authority. Any request presenting a\nclient certificate signed by one of the authorities in the client-ca-file is\nauthenticated with an identity corresponding to the CommonName of the client\ncertificate. If this file can be changed, the Kubernetes architecture could\nbe compromised. The scheduler will implement the changes immediately. Many of\nthe security settings within the document are implemented through this file.\"\n  desc  'rationale', ''\n  desc  'check', \"\n    Change to the /etc/sysconfig/ directory on the Kubernetes Master Node.\nReview the ownership of the Kubernetes  client-ca-file by using the command:\n\nmore kubelet\n--client-ca-file argument\nNote certificate location\n\nReview the ownership of the Kubernetes client-ca-file by using the command:\nstat -c   %U:%G <location from --client-ca-file argument>| grep -v root:root\n\nIf the command returns any non root:root file permissions, this is a finding.\n\"\n  desc 'fix', \"\n    Change the permissions of the --client-ca-file to \\\"root\\\" by executing\nthe command:\n\nchown root:root <location from --client-ca-file argument>/ *\n  \"\n  impact 0.5\n  tag severity: 'medium'\n  tag gtitle: 'SRG-APP-000516-CTR-001325'\n  tag gid: 'V-242450'\n  tag rid: 'SV-242450r712706_rule'\n  tag stig_id: 'CNTR-K8-003170'\n  tag fix_id: 'F-45683r712705_fix'\n  tag cci: ['CCI-000366']\n  tag nist: ['CM-6 b']\n\n  describe.one do\n    describe kubelet do\n      its('client_ca_file') { should_not be_nil }\n      its('client_ca_file') { should be_owned_by('root') }\n      its('client_ca_file') { should be_grouped_into('root') }\n    end\n\n    client_ca_file = kubelet_config_file.params.dig('authentication', 'x509', 'clientCAFile')\n    if client_ca_file\n      describe file(client_ca_file) do\n        it { should be_owned_by('root') }\n        it { should be_grouped_into('root') }\n      end\n    end\n  end\nend\n",
          "desc": "The Kubernetes kubelet certificate authority file contains settings\nfor the Kubernetes Node TLS certificate authority. Any request presenting a\nclient certificate signed by one of the authorities in the client-ca-file is\nauthenticated with an identity corresponding to the CommonName of the client\ncertificate. If this file can be changed, the Kubernetes architecture could\nbe compromised. The scheduler will implement the changes immediately. Many of\nthe security settings within the document are implemented through this file.",
          "descriptions": [
            {
              "data": "The Kubernetes kubelet certificate authority file contains settings\nfor the Kubernetes Node TLS certificate authority. Any request presenting a\nclient certificate signed by one of the authorities in the client-ca-file is\nauthenticated with an identity corresponding to the CommonName of the client\ncertificate. If this file can be changed, the Kubernetes architecture could\nbe compromised. The scheduler will implement the changes immediately. Many of\nthe security settings within the document are implemented through this file.",
              "label": "default"
            },
            {
              "data": "",
              "label": "rationale"
            },
            {
              "data": "Change to the /etc/sysconfig/ directory on the Kubernetes Master Node.\nReview the ownership of the Kubernetes  client-ca-file by using the command:\n\nmore kubelet\n--client-ca-file argument\nNote certificate location\n\nReview the ownership of the Kubernetes client-ca-file by using the command:\nstat -c   %U:%G <location from --client-ca-file argument>| grep -v root:root\n\nIf the command returns any non root:root file permissions, this is a finding.",
              "label": "check"
            },
            {
              "data": "Change the permissions of the --client-ca-file to \"root\" by executing\nthe command:\n\nchown root:root <location from --client-ca-file argument>/ *",
              "label": "fix"
            }
          ],
          "id": "V-242450",
          "impact": 0.5,
          "refs": [],
          "results": [],
          "source_location": {
            "line": 3,
            "ref": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242450.rb"
          },
          "tags": {
            "cci": ["CCI-000366"],
            "fix_id": "F-45683r712705_fix",
            "gid": "V-242450",
            "gtitle": "SRG-APP-000516-CTR-001325",
            "nist": ["CM-6 b"],
            "rid": "SV-242450r712706_rule",
            "severity": "medium",
            "stig_id": "CNTR-K8-003170"
          },
          "title": "The Kubernetes Kubelet certificate authority must be owned by root.",
          "waiver_data": {}
        },
        {
          "code": "control 'V-242451' do\n  title 'The Kubernetes component PKI must be owned by root.'\n  desc  \"The Kubernetes PKI directory contains all certificates (.crt files)\nsupporting secure network communications in the Kubernetes Control Plane. If\nthese files can be modified, data traversing within the architecture components\nwould become unsecure and compromised. Many of the security settings within the\ndocument are implemented through this file.\"\n  desc  'rationale', ''\n  desc  'check', \"\n    Review the PKI files in Kubernetes by using the command:\n\n    ls -laR /etc/kubernetes/pki/\n\n    If the command returns any non root:root file permissions, this is a\nfinding.\n  \"\n  desc 'fix', \"\n    Change the ownership of the PKI to root: root by executing the command:\n\n    chown -R root:root /etc/kubernetes/pki/\n  \"\n  impact 0.5\n  tag severity: 'medium'\n  tag gtitle: 'SRG-APP-000516-CTR-001325'\n  tag gid: 'V-242451'\n  tag rid: 'SV-242451r712709_rule'\n  tag stig_id: 'CNTR-K8-003180'\n  tag fix_id: 'F-45684r712708_fix'\n  tag cci: ['CCI-000366']\n  tag nist: ['CM-6 b']\n\n  pki_path = input('pki_path')\n  pki_files = command(\"find #{pki_path}/ -type f\").stdout.split\n\n  if pki_files.empty?\n    desc 'caveat', \"Kubernetes PKI files not present of the target at specified path #{pki_path}.\"\n\n    describe \"Kubernetes PKI files not present of the target at specified path #{pki_path}.\" do\n      skip\n    end\n  end\n\n  pki_files.each do |file_name|\n    describe file(file_name) do\n      it { should be_owned_by('root') }\n      it { should be_grouped_into('root') }\n    end\n  end\nend\n",
          "desc": "The Kubernetes PKI directory contains all certificates (.crt files)\nsupporting secure network communications in the Kubernetes Control Plane. If\nthese files can be modified, data traversing within the architecture components\nwould become unsecure and compromised. Many of the security settings within the\ndocument are implemented through this file.",
          "descriptions": [
            {
              "data": "The Kubernetes PKI directory contains all certificates (.crt files)\nsupporting secure network communications in the Kubernetes Control Plane. If\nthese files can be modified, data traversing within the architecture components\nwould become unsecure and compromised. Many of the security settings within the\ndocument are implemented through this file.",
              "label": "default"
            },
            {
              "data": "",
              "label": "rationale"
            },
            {
              "data": "Review the PKI files in Kubernetes by using the command:\n\n    ls -laR /etc/kubernetes/pki/\n\n    If the command returns any non root:root file permissions, this is a\nfinding.",
              "label": "check"
            },
            {
              "data": "Change the ownership of the PKI to root: root by executing the command:\n\nchown -R root:root /etc/kubernetes/pki/",
              "label": "fix"
            }
          ],
          "id": "V-242451",
          "impact": 0.5,
          "refs": [],
          "results": [],
          "source_location": {
            "line": 3,
            "ref": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242451.rb"
          },
          "tags": {
            "cci": ["CCI-000366"],
            "fix_id": "F-45684r712708_fix",
            "gid": "V-242451",
            "gtitle": "SRG-APP-000516-CTR-001325",
            "nist": ["CM-6 b"],
            "rid": "SV-242451r712709_rule",
            "severity": "medium",
            "stig_id": "CNTR-K8-003180"
          },
          "title": "The Kubernetes component PKI must be owned by root.",
          "waiver_data": {}
        },
        {
          "code": "control 'V-242452' do\n  title \"The Kubernetes kubelet config must have file permissions set to 644 or\nmore restrictive.\"\n  desc  \"The Kubernetes kubelet agent registers nodes with the API Server,\nmounts volume storage for pods, and performs health checks to containers within\npods. If these files can be modified, the information system would be unaware\nof pod or container degradation. Many of the security settings within the\ndocument are implemented through this file.\"\n  desc  'rationale', ''\n  desc  'check', \"\n    Review the permissions of the Kubernetes Kubelet conf by using the command:\n\n    stat -c %a  /etc/kubernetes/kubelet.conf\n\n    If any of the files are have permissions more permissive than \\\"644\\\", this\nis a finding.\n  \"\n  desc 'fix', \"\n    Change the permissions of the Kubelet to \\\"644\\\" by executing the command:\n\n    chown 644 /etc/kubernetes/kubelet.conf\n  \"\n  impact 0.5\n  tag severity: 'medium'\n  tag gtitle: 'SRG-APP-000516-CTR-001325'\n  tag gid: 'V-242452'\n  tag rid: 'SV-242452r712712_rule'\n  tag stig_id: 'CNTR-K8-003190'\n  tag fix_id: 'F-45685r712711_fix'\n  tag cci: ['CCI-000366']\n  tag nist: ['CM-6 b']\n\n  describe kubelet do\n    its('kubeconfig_file') { should_not be_nil }\n    its('kubeconfig_file') { should_not be_more_permissive_than('0644') }\n  end\nend\n",
          "desc": "The Kubernetes kubelet agent registers nodes with the API Server,\nmounts volume storage for pods, and performs health checks to containers within\npods. If these files can be modified, the information system would be unaware\nof pod or container degradation. Many of the security settings within the\ndocument are implemented through this file.",
          "descriptions": [
            {
              "data": "The Kubernetes kubelet agent registers nodes with the API Server,\nmounts volume storage for pods, and performs health checks to containers within\npods. If these files can be modified, the information system would be unaware\nof pod or container degradation. Many of the security settings within the\ndocument are implemented through this file.",
              "label": "default"
            },
            {
              "data": "",
              "label": "rationale"
            },
            {
              "data": "Review the permissions of the Kubernetes Kubelet conf by using the command:\n\n    stat -c %a  /etc/kubernetes/kubelet.conf\n\n    If any of the files are have permissions more permissive than \"644\", this\nis a finding.",
              "label": "check"
            },
            {
              "data": "Change the permissions of the Kubelet to \"644\" by executing the command:\n\nchown 644 /etc/kubernetes/kubelet.conf",
              "label": "fix"
            }
          ],
          "id": "V-242452",
          "impact": 0.5,
          "refs": [],
          "results": [],
          "source_location": {
            "line": 3,
            "ref": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242452.rb"
          },
          "tags": {
            "cci": ["CCI-000366"],
            "fix_id": "F-45685r712711_fix",
            "gid": "V-242452",
            "gtitle": "SRG-APP-000516-CTR-001325",
            "nist": ["CM-6 b"],
            "rid": "SV-242452r712712_rule",
            "severity": "medium",
            "stig_id": "CNTR-K8-003190"
          },
          "title": "The Kubernetes kubelet config must have file permissions set to 644 or\nmore restrictive.",
          "waiver_data": {}
        },
        {
          "code": "control 'V-242453' do\n  title 'The Kubernetes kubelet config must be owned by root.'\n  desc  \"The Kubernetes kubelet agent registers nodes with the API server and\nperforms health checks to containers within pods. If these files can be\nmodified, the information system would be unaware of pod or container\ndegradation. Many of the security settings within the document are implemented\nthrough this file.\"\n  desc  'rationale', ''\n  desc  'check', \"\n    Review the Kubernetes Kubelet conf files by using the command:\n\n    stat -c %U:%G /etc/kubernetes/kubelet.conf| grep -v root:root\n\n    If the command returns any non root:root file permissions, this is a\nfinding.\n  \"\n  desc 'fix', \"\n    Change the ownership of the kubelet.conf to root: root by executing the\ncommand:\n\n    chown root:root /etc/kubernetes/kubelet.conf\n  \"\n  impact 0.5\n  tag severity: 'medium'\n  tag gtitle: 'SRG-APP-000516-CTR-001325'\n  tag gid: 'V-242453'\n  tag rid: 'SV-242453r712715_rule'\n  tag stig_id: 'CNTR-K8-003200'\n  tag fix_id: 'F-45686r712714_fix'\n  tag cci: ['CCI-000366']\n  tag nist: ['CM-6 b']\n\n  describe kubelet do\n    its('kubeconfig_file') { should_not be_nil }\n    its('kubeconfig_file') { should be_owned_by('root') }\n    its('kubeconfig_file') { should be_grouped_into('root') }\n  end\nend\n",
          "desc": "The Kubernetes kubelet agent registers nodes with the API server and\nperforms health checks to containers within pods. If these files can be\nmodified, the information system would be unaware of pod or container\ndegradation. Many of the security settings within the document are implemented\nthrough this file.",
          "descriptions": [
            {
              "data": "The Kubernetes kubelet agent registers nodes with the API server and\nperforms health checks to containers within pods. If these files can be\nmodified, the information system would be unaware of pod or container\ndegradation. Many of the security settings within the document are implemented\nthrough this file.",
              "label": "default"
            },
            {
              "data": "",
              "label": "rationale"
            },
            {
              "data": "Review the Kubernetes Kubelet conf files by using the command:\n\n    stat -c %U:%G /etc/kubernetes/kubelet.conf| grep -v root:root\n\n    If the command returns any non root:root file permissions, this is a\nfinding.",
              "label": "check"
            },
            {
              "data": "Change the ownership of the kubelet.conf to root: root by executing the\ncommand:\n\n    chown root:root /etc/kubernetes/kubelet.conf",
              "label": "fix"
            }
          ],
          "id": "V-242453",
          "impact": 0.5,
          "refs": [],
          "results": [],
          "source_location": {
            "line": 3,
            "ref": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242453.rb"
          },
          "tags": {
            "cci": ["CCI-000366"],
            "fix_id": "F-45686r712714_fix",
            "gid": "V-242453",
            "gtitle": "SRG-APP-000516-CTR-001325",
            "nist": ["CM-6 b"],
            "rid": "SV-242453r712715_rule",
            "severity": "medium",
            "stig_id": "CNTR-K8-003200"
          },
          "title": "The Kubernetes kubelet config must be owned by root.",
          "waiver_data": {}
        },
        {
          "code": "  control 'V-242454' do\n    impact 0.0\n    desc 'caveat', 'K3S deployments are not configured through Kubeadm and hence non-applicable.'\n  end\n",
          "desc": "The Kubernetes kubeadm.conf contains sensitive information regarding\nthe cluster nodes configuration. If this file can be modified, the Kubernetes\nPlatform Plane would be degraded or compromised for malicious intent. Many of\nthe security settings within the document are implemented through this file.",
          "descriptions": [
            {
              "data": "The Kubernetes kubeadm.conf contains sensitive information regarding\nthe cluster nodes configuration. If this file can be modified, the Kubernetes\nPlatform Plane would be degraded or compromised for malicious intent. Many of\nthe security settings within the document are implemented through this file.",
              "label": "default"
            },
            {
              "data": "",
              "label": "rationale"
            },
            {
              "data": "Review the Kubeadm.conf file :\n\n    Get the path for Kubeadm.conf by running:\n\n    systemctl status kubelet\n\n  Note the configuration file installed by the kubeadm is written to\n\n  default Location: /etc/systemd/system/kubelet.service.d/10-kubeadm.conf\n\n    stat -c %U:%G <Kubeadm.conf path> | grep -v root:root\n\nIf the command returns any non root:root file permissions, this is a finding.",
              "label": "check"
            },
            {
              "data": "Change the ownership of the kubeadm.conf to root: root by executing the\ncommand:\n\n    chown root:root <Kubeadm.conf path>",
              "label": "fix"
            },
            {
              "data": "K3S deployments are not configured through Kubeadm and hence non-applicable.",
              "label": "caveat"
            }
          ],
          "id": "V-242454",
          "impact": 0.0,
          "refs": [
            {
              "ref": []
            }
          ],
          "results": [],
          "source_location": {
            "line": 3,
            "ref": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242454.rb"
          },
          "tags": {
            "cci": ["CCI-000366"],
            "fix_id": "F-45687r712717_fix",
            "gid": "V-242454",
            "gtitle": "SRG-APP-000516-CTR-001325",
            "nist": ["CM-6 b"],
            "rid": "SV-242454r712718_rule",
            "severity": "medium",
            "stig_id": "CNTR-K8-003210"
          },
          "title": "The Kubernetes kubeadm must be owned by root.",
          "waiver_data": {}
        },
        {
          "code": "  control 'V-242455' do\n    impact 0.0\n    desc 'caveat', 'K3S deployments are not configured through Kubeadm and hence non-applicable.'\n  end\n",
          "desc": "The Kubernetes kubeadm.conf contains sensitive information regarding\nthe cluster nodes configuration. If this file can be modified, the Kubernetes\nPlatform Plane would be degraded or compromised for malicious intent. Many of\nthe security settings within the document are implemented through this file.",
          "descriptions": [
            {
              "data": "The Kubernetes kubeadm.conf contains sensitive information regarding\nthe cluster nodes configuration. If this file can be modified, the Kubernetes\nPlatform Plane would be degraded or compromised for malicious intent. Many of\nthe security settings within the document are implemented through this file.",
              "label": "default"
            },
            {
              "data": "",
              "label": "rationale"
            },
            {
              "data": "Review the Kubeadm.conf file :\n\n    Get the path for Kubeadm.conf by running:\n\n    systemctl status kubelet\n\n  Note the configuration file installed by the kubeadm is written to\n\n  default Location: /etc/systemd/system/kubelet.service.d/10-kubeadm.conf\n\n    stat -c %a  <Kubeadm.conf path>\n\nIf the file has permissions more permissive than \"644\", this is a finding.",
              "label": "check"
            },
            {
              "data": "Change the permissions of kubeadm.conf to \"644\" by executing the command:\n\nchown 644 <Kubeadm.conf path>",
              "label": "fix"
            },
            {
              "data": "K3S deployments are not configured through Kubeadm and hence non-applicable.",
              "label": "caveat"
            }
          ],
          "id": "V-242455",
          "impact": 0.0,
          "refs": [
            {
              "ref": []
            }
          ],
          "results": [],
          "source_location": {
            "line": 3,
            "ref": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242455.rb"
          },
          "tags": {
            "cci": ["CCI-000366"],
            "fix_id": "F-45688r712720_fix",
            "gid": "V-242455",
            "gtitle": "SRG-APP-000516-CTR-001325",
            "nist": ["CM-6 b"],
            "rid": "SV-242455r712721_rule",
            "severity": "medium",
            "stig_id": "CNTR-K8-003220"
          },
          "title": "The Kubernetes  kubeadm.conf must have file permissions set to 644\nor more restrictive.",
          "waiver_data": {}
        },
        {
          "code": "control 'V-242456' do\n  title \"The Kubernetes kubelet config must have file permissions set to 644 or\nmore restrictive.\"\n  desc  \"The Kubernetes kubelet agent registers nodes with the API server and\nperforms health checks to containers within pods. If this file can be modified,\nthe information system would be unaware of pod or container degradation.\"\n  desc  'rationale', ''\n  desc  'check', \"\n    Review the permissions of the Kubernetes config.yaml by using the command:\n\n    stat -c %a /var/lib/kubelet/config.yaml\n\n    If any of the files are have permissions more permissive than \\\"644\\\", this\nis a finding.\n  \"\n  desc 'fix', \"\n    Change the permissions of the config.yaml to \\\"644\\\" by executing the\ncommand:\n\n    chown 644 /var/lib/kubelet/config.yaml\n  \"\n  impact 0.5\n  tag severity: 'medium'\n  tag gtitle: 'SRG-APP-000516-CTR-001330'\n  tag gid: 'V-242456'\n  tag rid: 'SV-242456r712724_rule'\n  tag stig_id: 'CNTR-K8-003230'\n  tag fix_id: 'F-45689r712723_fix'\n  tag cci: ['CCI-000366']\n  tag nist: ['CM-6 b']\n\n  describe kubelet do\n    its('config_file') { should_not be_nil }\n    its('config_file') { should_not be_more_permissive_than('0644') }\n  end\nend\n",
          "desc": "The Kubernetes kubelet agent registers nodes with the API server and\nperforms health checks to containers within pods. If this file can be modified,\nthe information system would be unaware of pod or container degradation.",
          "descriptions": [
            {
              "data": "The Kubernetes kubelet agent registers nodes with the API server and\nperforms health checks to containers within pods. If this file can be modified,\nthe information system would be unaware of pod or container degradation.",
              "label": "default"
            },
            {
              "data": "",
              "label": "rationale"
            },
            {
              "data": "Review the permissions of the Kubernetes config.yaml by using the command:\n\n    stat -c %a /var/lib/kubelet/config.yaml\n\n    If any of the files are have permissions more permissive than \"644\", this\nis a finding.",
              "label": "check"
            },
            {
              "data": "Change the permissions of the config.yaml to \"644\" by executing the\ncommand:\n\n    chown 644 /var/lib/kubelet/config.yaml",
              "label": "fix"
            }
          ],
          "id": "V-242456",
          "impact": 0.5,
          "refs": [],
          "results": [],
          "source_location": {
            "line": 3,
            "ref": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242456.rb"
          },
          "tags": {
            "cci": ["CCI-000366"],
            "fix_id": "F-45689r712723_fix",
            "gid": "V-242456",
            "gtitle": "SRG-APP-000516-CTR-001330",
            "nist": ["CM-6 b"],
            "rid": "SV-242456r712724_rule",
            "severity": "medium",
            "stig_id": "CNTR-K8-003230"
          },
          "title": "The Kubernetes kubelet config must have file permissions set to 644 or\nmore restrictive.",
          "waiver_data": {}
        },
        {
          "code": "control 'V-242457' do\n  title 'The Kubernetes kubelet config must be owned by root.'\n  desc  \"The Kubernetes kubelet agent registers nodes with the API Server and\nperforms health checks to containers within pods. If this file can be modified,\nthe information system would be unaware of pod or container degradation.\"\n  desc  'rationale', ''\n  desc  'check', \"\n    Review the Kubernetes Kubeadm kubelet conf file by using the command:\n\n    stat -c %U:%G /var/lib/kubelet/config.yaml| grep -v root:root\n\n    If the command returns any non root:root file permissions, this is a\nfinding.\n  \"\n  desc 'fix', \"\n    Change the ownership of the kubelet config to \\\"root: root\\\" by executing\nthe command:\n\n    chown root:root /var/lib/kubelet/config.yaml\n  \"\n  impact 0.5\n  tag severity: 'medium'\n  tag gtitle: 'SRG-APP-000516-CTR-001330'\n  tag gid: 'V-242457'\n  tag rid: 'SV-242457r712727_rule'\n  tag stig_id: 'CNTR-K8-003240'\n  tag fix_id: 'F-45690r712726_fix'\n  tag cci: ['CCI-000366']\n  tag nist: ['CM-6 b']\n\n  describe kubelet do\n    its('config_file') { should be_owned_by('root') }\n    its('config_file') { should be_grouped_into('root') }\n  end\nend\n",
          "desc": "The Kubernetes kubelet agent registers nodes with the API Server and\nperforms health checks to containers within pods. If this file can be modified,\nthe information system would be unaware of pod or container degradation.",
          "descriptions": [
            {
              "data": "The Kubernetes kubelet agent registers nodes with the API Server and\nperforms health checks to containers within pods. If this file can be modified,\nthe information system would be unaware of pod or container degradation.",
              "label": "default"
            },
            {
              "data": "",
              "label": "rationale"
            },
            {
              "data": "Review the Kubernetes Kubeadm kubelet conf file by using the command:\n\n    stat -c %U:%G /var/lib/kubelet/config.yaml| grep -v root:root\n\n    If the command returns any non root:root file permissions, this is a\nfinding.",
              "label": "check"
            },
            {
              "data": "Change the ownership of the kubelet config to \"root: root\" by executing\nthe command:\n\n    chown root:root /var/lib/kubelet/config.yaml",
              "label": "fix"
            }
          ],
          "id": "V-242457",
          "impact": 0.5,
          "refs": [],
          "results": [],
          "source_location": {
            "line": 3,
            "ref": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242457.rb"
          },
          "tags": {
            "cci": ["CCI-000366"],
            "fix_id": "F-45690r712726_fix",
            "gid": "V-242457",
            "gtitle": "SRG-APP-000516-CTR-001330",
            "nist": ["CM-6 b"],
            "rid": "SV-242457r712727_rule",
            "severity": "medium",
            "stig_id": "CNTR-K8-003240"
          },
          "title": "The Kubernetes kubelet config must be owned by root.",
          "waiver_data": {}
        },
        {
          "code": "  control 'V-242458' do\n    impact 0.0\n    desc 'caveat', 'K3S deployments are not applied using manifest files and hence non-applicable.'\n  end\n",
          "desc": "The Kubernetes manifests are those files that contain the arguments\nand settings for the Master Node services. These services are etcd, the API\nServer, controller, proxy, and scheduler. If these files can be changed, the\nscheduler will be implementing the changes immediately. Many of the security\nsettings within the document are implemented through these manifests.",
          "descriptions": [
            {
              "data": "The Kubernetes manifests are those files that contain the arguments\nand settings for the Master Node services. These services are etcd, the API\nServer, controller, proxy, and scheduler. If these files can be changed, the\nscheduler will be implementing the changes immediately. Many of the security\nsettings within the document are implemented through these manifests.",
              "label": "default"
            },
            {
              "data": "",
              "label": "rationale"
            },
            {
              "data": "Review the permissions of the Kubernetes Kubelet by using the command:\n\n    stat -c %a  /etc/kubernetes/manifests/*\n\n    If any of the files are have permissions more permissive than \"644\", this\nis a finding.",
              "label": "check"
            },
            {
              "data": "Change the permissions of the manifest files by executing the command:\n\nchmod 644 /etc/kubernetes/manifests/*",
              "label": "fix"
            },
            {
              "data": "K3S deployments are not applied using manifest files and hence non-applicable.",
              "label": "caveat"
            }
          ],
          "id": "V-242458",
          "impact": 0.0,
          "refs": [
            {
              "ref": []
            }
          ],
          "results": [],
          "source_location": {
            "line": 3,
            "ref": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242458.rb"
          },
          "tags": {
            "cci": ["CCI-000366"],
            "fix_id": "F-45691r712729_fix",
            "gid": "V-242458",
            "gtitle": "SRG-APP-000516-CTR-001335",
            "nist": ["CM-6 b"],
            "rid": "SV-242458r712730_rule",
            "severity": "medium",
            "stig_id": "CNTR-K8-003250"
          },
          "title": "The Kubernetes API Server must have file permissions set to 644 or\nmore restrictive.",
          "waiver_data": {}
        },
        {
          "code": "control 'V-242459' do\n  title \"The Kubernetes etcd must have file permissions set to 644 or more\nrestrictive.\"\n  desc  \"The Kubernetes etcd key-value store provides a way to store data to\nthe Master Node. If these files can be changed, data to API object and master\nnode would be compromised.\"\n  desc  'rationale', ''\n  desc  'check', \"\n    Review the permissions of the Kubernetes etcd by using the command:\n\n    stat -c %a  /var/lib/etcd/*\n\n    If any of the files are have permissions more permissive than \\\"644\\\", this\nis a finding.\n  \"\n  desc 'fix', \"\n    Change the permissions of the manifest files to \\\"644\\\" by executing the\ncommand:\n\n    chmod 644/var/lib/etcd/*\n  \"\n  impact 0.5\n  tag severity: 'medium'\n  tag gtitle: 'SRG-APP-000516-CTR-001335'\n  tag gid: 'V-242459'\n  tag rid: 'SV-242459r712733_rule'\n  tag stig_id: 'CNTR-K8-003260'\n  tag fix_id: 'F-45692r712732_fix'\n  tag cci: ['CCI-000366']\n  tag nist: ['CM-6 b']\n\n  if etcd.exist?\n    describe.one do\n      if etcd.params['data-dir']\n        describe file(etcd.params['data-dir'].join) do\n          it { should_not be_more_permissive_than('0644') }\n        end\n      end\n\n      describe file(process_env_var('etcd').params['ETCD_DATA_DIR']) do\n        it { should_not be_more_permissive_than('0644') }\n      end\n    end\n  else\n    describe 'ETCD process is not running on the target.' do\n      skip\n    end\n  end\nend\n",
          "desc": "The Kubernetes etcd key-value store provides a way to store data to\nthe Master Node. If these files can be changed, data to API object and master\nnode would be compromised.",
          "descriptions": [
            {
              "data": "The Kubernetes etcd key-value store provides a way to store data to\nthe Master Node. If these files can be changed, data to API object and master\nnode would be compromised.",
              "label": "default"
            },
            {
              "data": "",
              "label": "rationale"
            },
            {
              "data": "Review the permissions of the Kubernetes etcd by using the command:\n\n    stat -c %a  /var/lib/etcd/*\n\n    If any of the files are have permissions more permissive than \"644\", this\nis a finding.",
              "label": "check"
            },
            {
              "data": "Change the permissions of the manifest files to \"644\" by executing the\ncommand:\n\n    chmod 644/var/lib/etcd/*",
              "label": "fix"
            }
          ],
          "id": "V-242459",
          "impact": 0.5,
          "refs": [],
          "results": [],
          "source_location": {
            "line": 3,
            "ref": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242459.rb"
          },
          "tags": {
            "cci": ["CCI-000366"],
            "fix_id": "F-45692r712732_fix",
            "gid": "V-242459",
            "gtitle": "SRG-APP-000516-CTR-001335",
            "nist": ["CM-6 b"],
            "rid": "SV-242459r712733_rule",
            "severity": "medium",
            "stig_id": "CNTR-K8-003260"
          },
          "title": "The Kubernetes etcd must have file permissions set to 644 or more\nrestrictive.",
          "waiver_data": {}
        },
        {
          "code": "control 'V-242460' do\n  title \"The Kubernetes admin.conf must have file permissions set to 644 or\nmore restrictive.\"\n  desc  \"The Kubernetes conf files contain the arguments and settings for the\nMaster Node services. These services are controller and scheduler. If these\nfiles can be changed, the scheduler will be implementing the changes\nimmediately.\"\n  desc  'rationale', ''\n  desc  'check', \"\n    Review the permissions of the Kubernetes config files by using the command:\n\n    stat -c %a /etc/kubernetes/admin.conf\n    stat -c %a /etc/kubernetes/scheduler.conf\n    stat -c %a /etc/kubernetes/controller-manager.conf\n\n    If any of the files are have permissions more permissive than \\\"644\\\", this\nis a finding.\n  \"\n  desc 'fix', \"\n    Change the permissions of the conf files to \\\"644\\\" by executing the\ncommand:\n\n    chmod 644 /etc/kubernetes/admin.conf\n    chmod 644 /etc/kubernetes/scheduler.conf\n    chmod 644 /etc/kubernetes/controller-manager.conf\n  \"\n  impact 0.5\n  tag severity: 'medium'\n  tag gtitle: 'SRG-APP-000516-CTR-001335'\n  tag gid: 'V-242460'\n  tag rid: 'SV-242460r712736_rule'\n  tag stig_id: 'CNTR-K8-003270'\n  tag fix_id: 'F-45693r712735_fix'\n  tag cci: ['CCI-000366']\n  tag nist: ['CM-6 b']\n\n  input('kubernetes_conf_files').each do |file_name|\n    if file(file_name).exist?\n      describe file(file_name) do\n        it { should_not be_more_permissive_than('0644') }\n      end\n    else\n      describe \"Kubernetes Conf file #{file_name} not found on target\" do\n        skip\n      end\n    end\n  end\n\n  if input('kubernetes_conf_files').empty?\n    describe 'No `kubernetes_conf_files` provided through input values.' do\n      skip\n    end\n  end\nend\n",
          "desc": "The Kubernetes conf files contain the arguments and settings for the\nMaster Node services. These services are controller and scheduler. If these\nfiles can be changed, the scheduler will be implementing the changes\nimmediately.",
          "descriptions": [
            {
              "data": "The Kubernetes conf files contain the arguments and settings for the\nMaster Node services. These services are controller and scheduler. If these\nfiles can be changed, the scheduler will be implementing the changes\nimmediately.",
              "label": "default"
            },
            {
              "data": "",
              "label": "rationale"
            },
            {
              "data": "Review the permissions of the Kubernetes config files by using the command:\n\n    stat -c %a /etc/kubernetes/admin.conf\n    stat -c %a /etc/kubernetes/scheduler.conf\n    stat -c %a /etc/kubernetes/controller-manager.conf\n\n    If any of the files are have permissions more permissive than \"644\", this\nis a finding.",
              "label": "check"
            },
            {
              "data": "Change the permissions of the conf files to \"644\" by executing the\ncommand:\n\n    chmod 644 /etc/kubernetes/admin.conf\n    chmod 644 /etc/kubernetes/scheduler.conf\n    chmod 644 /etc/kubernetes/controller-manager.conf",
              "label": "fix"
            }
          ],
          "id": "V-242460",
          "impact": 0.5,
          "refs": [],
          "results": [],
          "source_location": {
            "line": 3,
            "ref": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242460.rb"
          },
          "tags": {
            "cci": ["CCI-000366"],
            "fix_id": "F-45693r712735_fix",
            "gid": "V-242460",
            "gtitle": "SRG-APP-000516-CTR-001335",
            "nist": ["CM-6 b"],
            "rid": "SV-242460r712736_rule",
            "severity": "medium",
            "stig_id": "CNTR-K8-003270"
          },
          "title": "The Kubernetes admin.conf must have file permissions set to 644 or\nmore restrictive.",
          "waiver_data": {}
        },
        {
          "code": "control 'V-242461' do\n  title 'Kubernetes API Server audit logs must be enabled.'\n  desc  \"Kubernetes API Server validates and configures pods and services for\nthe API object. The REST operation provides frontend functionality to the\ncluster share state. Enabling audit logs provides a way to monitor and identify\nsecurity risk events or misuse of information. Audit logs are necessary to\nprovide evidence in the case the Kubernetes API Server is compromised requiring\na Cyber Security Investigation.\"\n  desc  'rationale', ''\n  desc  'check', \"\n    Change to the /etc/kubernetes/manifests directory on the Kubernetes Master\nNode. Run the command:\n\n    grep -i audit-policy-file *\n\n    If the setting \\\"audit-policy-file\\\" is not set or is found in the\nKubernetes API manifest file without valid content, this is a finding.\n  \"\n  desc 'fix', \"Edit the Kubernetes API Server manifest file in the\n/etc/kubernetes/manifests directory on the Kubernetes Master Node. Set the\nargument \\\"--audit-policy-file\\\" to \\\"log file directory\\\".\"\n  impact 0.5\n  tag severity: 'medium'\n  tag gtitle: 'SRG-APP-000516-CTR-001335'\n  tag gid: 'V-242461'\n  tag rid: 'SV-242461r712739_rule'\n  tag stig_id: 'CNTR-K8-003280'\n  tag fix_id: 'F-45694r712738_fix'\n  tag cci: ['CCI-000366']\n  tag nist: ['CM-6 b']\n\n  unless kube_apiserver.exist?\n    impact 0.0\n    desc 'caveat', 'Kubernetes API Server process is not running on the target.'\n  end\n\n  describe kube_apiserver do\n    its('audit-policy-file') { should_not be_nil }\n  end\nend\n",
          "desc": "Kubernetes API Server validates and configures pods and services for\nthe API object. The REST operation provides frontend functionality to the\ncluster share state. Enabling audit logs provides a way to monitor and identify\nsecurity risk events or misuse of information. Audit logs are necessary to\nprovide evidence in the case the Kubernetes API Server is compromised requiring\na Cyber Security Investigation.",
          "descriptions": [
            {
              "data": "Kubernetes API Server validates and configures pods and services for\nthe API object. The REST operation provides frontend functionality to the\ncluster share state. Enabling audit logs provides a way to monitor and identify\nsecurity risk events or misuse of information. Audit logs are necessary to\nprovide evidence in the case the Kubernetes API Server is compromised requiring\na Cyber Security Investigation.",
              "label": "default"
            },
            {
              "data": "",
              "label": "rationale"
            },
            {
              "data": "Change to the /etc/kubernetes/manifests directory on the Kubernetes Master\nNode. Run the command:\n\n    grep -i audit-policy-file *\n\n    If the setting \"audit-policy-file\" is not set or is found in the\nKubernetes API manifest file without valid content, this is a finding.",
              "label": "check"
            },
            {
              "data": "Edit the Kubernetes API Server manifest file in the\n/etc/kubernetes/manifests directory on the Kubernetes Master Node. Set the\nargument \"--audit-policy-file\" to \"log file directory\".",
              "label": "fix"
            }
          ],
          "id": "V-242461",
          "impact": 0.5,
          "refs": [],
          "results": [],
          "source_location": {
            "line": 3,
            "ref": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242461.rb"
          },
          "tags": {
            "cci": ["CCI-000366"],
            "fix_id": "F-45694r712738_fix",
            "gid": "V-242461",
            "gtitle": "SRG-APP-000516-CTR-001335",
            "nist": ["CM-6 b"],
            "rid": "SV-242461r712739_rule",
            "severity": "medium",
            "stig_id": "CNTR-K8-003280"
          },
          "title": "Kubernetes API Server audit logs must be enabled.",
          "waiver_data": {}
        },
        {
          "code": "control 'V-242462' do\n  title 'The Kubernetes API Server must be set to audit log max size.'\n  desc  \"The Kubernetes API Server must be set for enough storage to retain log\ninformation over the period required. When audit logs are large in size, the\nmonitoring service for events becomes degraded. The function of the maximum log\nfile size is to set these limits.\"\n  desc  'rationale', ''\n  desc  'check', \"\n    Change to the /etc/kubernetes/manifests/ directory on the Kubernetes Master\nNode. Run the command:\n\n    grep -i audit-log-maxsize *\n\n    If the setting \\\"audit-log-maxsize\\\" is not set in the Kubernetes API\nServer manifest file or it is set to less than \\\"100\\\", this is a finding.\n  \"\n  desc 'fix', \"Edit the Kubernetes API Server manifest file in the\n/etc/kubernetes/manifests directory on the Kubernetes Master Node. Set the\nvalue of –\\\"--audit-log-maxsize\\\" to a minimum of \\\"100\\\".\"\n  impact 0.5\n  tag severity: 'medium'\n  tag gtitle: 'SRG-APP-000516-CTR-001335'\n  tag gid: 'V-242462'\n  tag rid: 'SV-242462r712742_rule'\n  tag stig_id: 'CNTR-K8-003290'\n  tag fix_id: 'F-45695r712741_fix'\n  tag cci: ['CCI-000366']\n  tag nist: ['CM-6 b']\n\n  unless kube_apiserver.exist?\n    impact 0.0\n    desc 'caveat', 'Kubernetes API Server process is not running on the target.'\n  end\n\n  describe kube_apiserver do\n    its('audit-log-maxsize') { should cmp >= 100 }\n  end\nend\n",
          "desc": "The Kubernetes API Server must be set for enough storage to retain log\ninformation over the period required. When audit logs are large in size, the\nmonitoring service for events becomes degraded. The function of the maximum log\nfile size is to set these limits.",
          "descriptions": [
            {
              "data": "The Kubernetes API Server must be set for enough storage to retain log\ninformation over the period required. When audit logs are large in size, the\nmonitoring service for events becomes degraded. The function of the maximum log\nfile size is to set these limits.",
              "label": "default"
            },
            {
              "data": "",
              "label": "rationale"
            },
            {
              "data": "Change to the /etc/kubernetes/manifests/ directory on the Kubernetes Master\nNode. Run the command:\n\n    grep -i audit-log-maxsize *\n\n    If the setting \"audit-log-maxsize\" is not set in the Kubernetes API\nServer manifest file or it is set to less than \"100\", this is a finding.",
              "label": "check"
            },
            {
              "data": "Edit the Kubernetes API Server manifest file in the\n/etc/kubernetes/manifests directory on the Kubernetes Master Node. Set the\nvalue of –\"--audit-log-maxsize\" to a minimum of \"100\".",
              "label": "fix"
            }
          ],
          "id": "V-242462",
          "impact": 0.5,
          "refs": [],
          "results": [],
          "source_location": {
            "line": 3,
            "ref": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242462.rb"
          },
          "tags": {
            "cci": ["CCI-000366"],
            "fix_id": "F-45695r712741_fix",
            "gid": "V-242462",
            "gtitle": "SRG-APP-000516-CTR-001335",
            "nist": ["CM-6 b"],
            "rid": "SV-242462r712742_rule",
            "severity": "medium",
            "stig_id": "CNTR-K8-003290"
          },
          "title": "The Kubernetes API Server must be set to audit log max size.",
          "waiver_data": {}
        },
        {
          "code": "control 'V-242463' do\n  title 'The Kubernetes API Server must be set to audit log maximum backup.'\n  desc  \"The Kubernetes API Server must set enough storage to retain logs for\nmonitoring suspicious activity and system misconfiguration, and provide\nevidence for Cyber Security Investigations.\"\n  desc  'rationale', ''\n  desc  'check', \"\n    Change to the /etc/kubernetes/manifests/ directory on the Kubernetes Master\nNode. Run the command:\n\n    grep -i audit-log-maxbackup *\n\n    If the setting \\\"audit-log-maxbackup\\\" is not set in the Kubernetes API\nServer manifest file or it is set less than \\\"10\\\", this is a finding.\n  \"\n  desc 'fix', \"Edit the Kubernetes API Server manifest file in the\n/etc/kubernetes/manifests directory on the Kubernetes Master Node. Set the\nvalue of \\\"--audit-log-maxbackup\\\" to a minimum of \\\"10\\\".\"\n  impact 0.5\n  tag severity: 'medium'\n  tag gtitle: 'SRG-APP-000516-CTR-001335'\n  tag gid: 'V-242463'\n  tag rid: 'SV-242463r712745_rule'\n  tag stig_id: 'CNTR-K8-003300'\n  tag fix_id: 'F-45696r712744_fix'\n  tag cci: ['CCI-000366']\n  tag nist: ['CM-6 b']\n\n  unless kube_apiserver.exist?\n    impact 0.0\n    desc 'caveat', 'Kubernetes API Server process is not running on the target.'\n  end\n\n  describe kube_apiserver do\n    its('audit-log-maxbackup') { should cmp >= 10 }\n  end\nend\n",
          "desc": "The Kubernetes API Server must set enough storage to retain logs for\nmonitoring suspicious activity and system misconfiguration, and provide\nevidence for Cyber Security Investigations.",
          "descriptions": [
            {
              "data": "The Kubernetes API Server must set enough storage to retain logs for\nmonitoring suspicious activity and system misconfiguration, and provide\nevidence for Cyber Security Investigations.",
              "label": "default"
            },
            {
              "data": "",
              "label": "rationale"
            },
            {
              "data": "Change to the /etc/kubernetes/manifests/ directory on the Kubernetes Master\nNode. Run the command:\n\n    grep -i audit-log-maxbackup *\n\n    If the setting \"audit-log-maxbackup\" is not set in the Kubernetes API\nServer manifest file or it is set less than \"10\", this is a finding.",
              "label": "check"
            },
            {
              "data": "Edit the Kubernetes API Server manifest file in the\n/etc/kubernetes/manifests directory on the Kubernetes Master Node. Set the\nvalue of \"--audit-log-maxbackup\" to a minimum of \"10\".",
              "label": "fix"
            }
          ],
          "id": "V-242463",
          "impact": 0.5,
          "refs": [],
          "results": [],
          "source_location": {
            "line": 3,
            "ref": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242463.rb"
          },
          "tags": {
            "cci": ["CCI-000366"],
            "fix_id": "F-45696r712744_fix",
            "gid": "V-242463",
            "gtitle": "SRG-APP-000516-CTR-001335",
            "nist": ["CM-6 b"],
            "rid": "SV-242463r712745_rule",
            "severity": "medium",
            "stig_id": "CNTR-K8-003300"
          },
          "title": "The Kubernetes API Server must be set to audit log maximum backup.",
          "waiver_data": {}
        },
        {
          "code": "control 'V-242464' do\n  title 'The Kubernetes API Server audit log retention must be set.'\n  desc  \"The Kubernetes API Server must set enough storage to retain logs for\nmonitoring suspicious activity and system misconfiguration, and provide\nevidence for Cyber Security Investigations.\"\n  desc  'rationale', ''\n  desc  'check', \"\n    Change to the /etc/kubernetes/manifests/ directory on the Kubernetes Master\nNode. Run the command:\n\n    grep -i audit-log-maxage *\n\n    If the setting \\\"audit-log-maxage\\\" is not set in the Kubernetes API Server\nmanifest file or it is set less than \\\"30\\\", this is a finding.\n  \"\n  desc 'fix', \"Edit the Kubernetes API Server manifest file in the\n/etc/kubernetes/manifests directory on the Kubernetes Master Node. Set the\nvalue of \\\"--audit-log-maxage\\\" to a minimum of \\\"30\\\".\"\n  impact 0.5\n  tag severity: 'medium'\n  tag gtitle: 'SRG-APP-000516-CTR-001335'\n  tag gid: 'V-242464'\n  tag rid: 'SV-242464r712748_rule'\n  tag stig_id: 'CNTR-K8-003310'\n  tag fix_id: 'F-45697r712747_fix'\n  tag cci: ['CCI-000366']\n  tag nist: ['CM-6 b']\n\n  unless kube_apiserver.exist?\n    impact 0.0\n    desc 'caveat', 'Kubernetes API Server process is not running on the target.'\n  end\n\n  describe kube_apiserver do\n    its('audit-log-maxage') { should cmp >= 30 }\n  end\nend\n",
          "desc": "The Kubernetes API Server must set enough storage to retain logs for\nmonitoring suspicious activity and system misconfiguration, and provide\nevidence for Cyber Security Investigations.",
          "descriptions": [
            {
              "data": "The Kubernetes API Server must set enough storage to retain logs for\nmonitoring suspicious activity and system misconfiguration, and provide\nevidence for Cyber Security Investigations.",
              "label": "default"
            },
            {
              "data": "",
              "label": "rationale"
            },
            {
              "data": "Change to the /etc/kubernetes/manifests/ directory on the Kubernetes Master\nNode. Run the command:\n\n    grep -i audit-log-maxage *\n\n    If the setting \"audit-log-maxage\" is not set in the Kubernetes API Server\nmanifest file or it is set less than \"30\", this is a finding.",
              "label": "check"
            },
            {
              "data": "Edit the Kubernetes API Server manifest file in the\n/etc/kubernetes/manifests directory on the Kubernetes Master Node. Set the\nvalue of \"--audit-log-maxage\" to a minimum of \"30\".",
              "label": "fix"
            }
          ],
          "id": "V-242464",
          "impact": 0.5,
          "refs": [],
          "results": [],
          "source_location": {
            "line": 3,
            "ref": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242464.rb"
          },
          "tags": {
            "cci": ["CCI-000366"],
            "fix_id": "F-45697r712747_fix",
            "gid": "V-242464",
            "gtitle": "SRG-APP-000516-CTR-001335",
            "nist": ["CM-6 b"],
            "rid": "SV-242464r712748_rule",
            "severity": "medium",
            "stig_id": "CNTR-K8-003310"
          },
          "title": "The Kubernetes API Server audit log retention must be set.",
          "waiver_data": {}
        },
        {
          "code": "control 'V-242465' do\n  title 'The Kubernetes API Server audit log path must be set.'\n  desc  \"Kubernetes API Server validates and configures pods and services for\nthe API object. The REST operation provides frontend functionality to the\ncluster share state. Audit logs are necessary to provide evidence in the case\nthe Kubernetes API Server is compromised requiring Cyber Security\nInvestigation. To record events in the audit log the log path value must be\nset.\"\n  desc  'rationale', ''\n  desc  'check', \"\n    Change to the /etc/kubernetes/manifests/ directory on the Kubernetes Master\nNode. Run the command:\n\n    grep -i audit-log-path *\n\n    If the setting audit-log-path is not set in the Kubernetes API Server\nmanifest file or it is not set to a valid path, this is a finding.\n  \"\n  desc 'fix', \"Edit the Kubernetes API Server manifest file in the\n/etc/kubernetes/manifests directory on the Kubernetes Master Node. Set the\nvalue of \\\"--audit-log-path\\\" to valid location.\"\n  impact 0.5\n  tag severity: 'medium'\n  tag gtitle: 'SRG-APP-000516-CTR-001335'\n  tag gid: 'V-242465'\n  tag rid: 'SV-242465r712751_rule'\n  tag stig_id: 'CNTR-K8-003320'\n  tag fix_id: 'F-45698r712750_fix'\n  tag cci: ['CCI-000366']\n  tag nist: ['CM-6 b']\n\n  unless kube_apiserver.exist?\n    impact 0.0\n    desc 'caveat', 'Kubernetes API Server process is not running on the target.'\n  end\n\n  describe kube_apiserver do\n    its('audit-log-path') { should_not be_nil }\n  end\n\n  if kube_apiserver.params['audit-log-path']\n    describe file(kube_apiserver.params['audit-log-path'].join) do\n      it { should exist }\n    end\n  end\nend\n",
          "desc": "Kubernetes API Server validates and configures pods and services for\nthe API object. The REST operation provides frontend functionality to the\ncluster share state. Audit logs are necessary to provide evidence in the case\nthe Kubernetes API Server is compromised requiring Cyber Security\nInvestigation. To record events in the audit log the log path value must be\nset.",
          "descriptions": [
            {
              "data": "Kubernetes API Server validates and configures pods and services for\nthe API object. The REST operation provides frontend functionality to the\ncluster share state. Audit logs are necessary to provide evidence in the case\nthe Kubernetes API Server is compromised requiring Cyber Security\nInvestigation. To record events in the audit log the log path value must be\nset.",
              "label": "default"
            },
            {
              "data": "",
              "label": "rationale"
            },
            {
              "data": "Change to the /etc/kubernetes/manifests/ directory on the Kubernetes Master\nNode. Run the command:\n\n    grep -i audit-log-path *\n\n    If the setting audit-log-path is not set in the Kubernetes API Server\nmanifest file or it is not set to a valid path, this is a finding.",
              "label": "check"
            },
            {
              "data": "Edit the Kubernetes API Server manifest file in the\n/etc/kubernetes/manifests directory on the Kubernetes Master Node. Set the\nvalue of \"--audit-log-path\" to valid location.",
              "label": "fix"
            }
          ],
          "id": "V-242465",
          "impact": 0.5,
          "refs": [],
          "results": [],
          "source_location": {
            "line": 3,
            "ref": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242465.rb"
          },
          "tags": {
            "cci": ["CCI-000366"],
            "fix_id": "F-45698r712750_fix",
            "gid": "V-242465",
            "gtitle": "SRG-APP-000516-CTR-001335",
            "nist": ["CM-6 b"],
            "rid": "SV-242465r712751_rule",
            "severity": "medium",
            "stig_id": "CNTR-K8-003320"
          },
          "title": "The Kubernetes API Server audit log path must be set.",
          "waiver_data": {}
        },
        {
          "code": "control 'V-242466' do\n  title \"The Kubernetes PKI CRT must have file permissions set to 644 or more\nrestrictive.\"\n  desc  \"The Kubernetes PKI directory contains all certificates (.crt files)\nsupporting secure network communications in the Kubernetes Control Plane. If\nthese files can be modified, data traversing within the architecture components\nwould become unsecure and compromised.\"\n  desc  'rationale', ''\n  desc  'check', \"\n    Review the permissions of the Kubernetes PKI cert files by using the\ncommand:\n\n    find /etc/kubernetes/pki -name \\\"*.crt\\\" | xargs stat -c '%n %a'\n\n    If any of the files are have permissions more permissive than \\\"644\\\", this\nis a finding.\n  \"\n  desc 'fix', \"\n    Change the ownership of the cert files to \\\"644\\\" by executing the command:\n\n    chmod -R 644 /etc/kubernetes/pki/*.crt\n  \"\n  impact 0.5\n  tag severity: 'medium'\n  tag gtitle: 'SRG-APP-000516-CTR-001335'\n  tag gid: 'V-242466'\n  tag rid: 'SV-242466r712754_rule'\n  tag stig_id: 'CNTR-K8-003330'\n  tag fix_id: 'F-45699r712753_fix'\n  tag cci: ['CCI-000366']\n  tag nist: ['CM-6 b']\n\n  pki_path = input('pki_path')\n  pki_files = command(\"find #{pki_path}/ -name \\\"*.crt\\\"\").stdout.split\n\n  if pki_files.empty?\n    desc 'caveat', \"Kubernetes PKI files not present of the target at specified path #{pki_path}.\"\n\n    describe \"Kubernetes PKI files not present of the target at specified path #{pki_path}.\" do\n      skip\n    end\n  end\n\n  pki_files.each do |file_name|\n    describe file(file_name) do\n      it { should_not be_more_permissive_than('0644') }\n    end\n  end\nend\n",
          "desc": "The Kubernetes PKI directory contains all certificates (.crt files)\nsupporting secure network communications in the Kubernetes Control Plane. If\nthese files can be modified, data traversing within the architecture components\nwould become unsecure and compromised.",
          "descriptions": [
            {
              "data": "The Kubernetes PKI directory contains all certificates (.crt files)\nsupporting secure network communications in the Kubernetes Control Plane. If\nthese files can be modified, data traversing within the architecture components\nwould become unsecure and compromised.",
              "label": "default"
            },
            {
              "data": "",
              "label": "rationale"
            },
            {
              "data": "Review the permissions of the Kubernetes PKI cert files by using the\ncommand:\n\n    find /etc/kubernetes/pki -name \"*.crt\" | xargs stat -c '%n %a'\n\n    If any of the files are have permissions more permissive than \"644\", this\nis a finding.",
              "label": "check"
            },
            {
              "data": "Change the ownership of the cert files to \"644\" by executing the command:\n\nchmod -R 644 /etc/kubernetes/pki/*.crt",
              "label": "fix"
            }
          ],
          "id": "V-242466",
          "impact": 0.5,
          "refs": [],
          "results": [],
          "source_location": {
            "line": 3,
            "ref": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242466.rb"
          },
          "tags": {
            "cci": ["CCI-000366"],
            "fix_id": "F-45699r712753_fix",
            "gid": "V-242466",
            "gtitle": "SRG-APP-000516-CTR-001335",
            "nist": ["CM-6 b"],
            "rid": "SV-242466r712754_rule",
            "severity": "medium",
            "stig_id": "CNTR-K8-003330"
          },
          "title": "The Kubernetes PKI CRT must have file permissions set to 644 or more\nrestrictive.",
          "waiver_data": {}
        },
        {
          "code": "control 'V-242467' do\n  title \"The Kubernetes PKI keys must have file permissions set to 600 or more\nrestrictive.\"\n  desc  \"The Kubernetes PKI directory contains all certificate key files\nsupporting secure network communications in the Kubernetes Control Plane. If\nthese files can be modified, data traversing within the architecture components\nwould become unsecure and compromised.\"\n  desc  'rationale', ''\n  desc  'check', \"\n    Review the permissions of the Kubernetes PKI key files by using the command:\n\n    find /etc/kubernetes/pki -name \\\"*.key\\\" | xargs stat -c '%n %a'\n\n    If any of the files are have permissions more permissive than \\\"600\\\", this\nis a finding.\n  \"\n  desc 'fix', \"\n    Change the ownership of the cert files to \\\"600\\\" by executing the command:\n\n    chmod -R 600 /etc/kubernetes/pki/*.key\n  \"\n  impact 0.5\n  tag severity: 'medium'\n  tag gtitle: 'SRG-APP-000516-CTR-001335'\n  tag gid: 'V-242467'\n  tag rid: 'SV-242467r712757_rule'\n  tag stig_id: 'CNTR-K8-003340'\n  tag fix_id: 'F-45700r712756_fix'\n  tag cci: ['CCI-000366']\n  tag nist: ['CM-6 b']\n\n  pki_path = input('pki_path')\n  pki_files = command(\"find #{pki_path}/ -name \\\"*.key\\\"\").stdout.split\n\n  if pki_files.empty?\n    desc 'caveat', \"Kubernetes PKI files not present of the target at specified path #{pki_path}.\"\n\n    describe \"Kubernetes PKI files not present of the target at specified path #{pki_path}.\" do\n      skip\n    end\n  end\n\n  pki_files.each do |file_name|\n    describe file(file_name) do\n      it { should_not be_more_permissive_than('0600') }\n    end\n  end\nend\n",
          "desc": "The Kubernetes PKI directory contains all certificate key files\nsupporting secure network communications in the Kubernetes Control Plane. If\nthese files can be modified, data traversing within the architecture components\nwould become unsecure and compromised.",
          "descriptions": [
            {
              "data": "The Kubernetes PKI directory contains all certificate key files\nsupporting secure network communications in the Kubernetes Control Plane. If\nthese files can be modified, data traversing within the architecture components\nwould become unsecure and compromised.",
              "label": "default"
            },
            {
              "data": "",
              "label": "rationale"
            },
            {
              "data": "Review the permissions of the Kubernetes PKI key files by using the command:\n\n    find /etc/kubernetes/pki -name \"*.key\" | xargs stat -c '%n %a'\n\n    If any of the files are have permissions more permissive than \"600\", this\nis a finding.",
              "label": "check"
            },
            {
              "data": "Change the ownership of the cert files to \"600\" by executing the command:\n\nchmod -R 600 /etc/kubernetes/pki/*.key",
              "label": "fix"
            }
          ],
          "id": "V-242467",
          "impact": 0.5,
          "refs": [],
          "results": [],
          "source_location": {
            "line": 3,
            "ref": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242467.rb"
          },
          "tags": {
            "cci": ["CCI-000366"],
            "fix_id": "F-45700r712756_fix",
            "gid": "V-242467",
            "gtitle": "SRG-APP-000516-CTR-001335",
            "nist": ["CM-6 b"],
            "rid": "SV-242467r712757_rule",
            "severity": "medium",
            "stig_id": "CNTR-K8-003340"
          },
          "title": "The Kubernetes PKI keys must have file permissions set to 600 or more\nrestrictive.",
          "waiver_data": {}
        },
        {
          "code": "control 'V-242468' do\n  title \"The Kubernetes API Server must prohibit communication using TLS\nversion 1.0 and 1.1, and SSL 2.0 and 3.0.\"\n  desc  \"The Kubernetes API Server will prohibit the use of SSL and\nunauthorized versions of TLS protocols to properly secure communication.\n\n    The use of unsupported protocol exposes vulnerabilities to Kubernetes by\nrogue traffic interceptions, man-in-the middle attacks, and impersonation of\nusers or services from the container platform runtime, registry, and keystore.\nTo enable the minimum version of TLS to be used by the Kubernetes API Server,\nthe setting \\\"tls-min-version\\\" must be set.\n\n    The container platform and its components will adhere to NIST 800-52R2.\n  \"\n  desc  'rationale', ''\n  desc  'check', \"\n    Change to the /etc/kubernetes/manifests directory on the Kubernetes Master\nNode. Run the command:\n\n    grep -i tls-min-version *\n\n    If the setting tls-min-version is not configured in the Kubernetes API\nServer manifest file or it is set to \\\"VersionTLS10\\\" or \\\"VersionTLS11\\\", this\nis a finding.\n  \"\n  desc 'fix', \"Edit the Kubernetes API Server manifest file in the\n/etc/kubernetes/manifests directory on the Kubernetes Master Node. Set the\nvalue of \\\"--tls-min-version\\\" to either \\\"VersionTLS12\\\" or higher.\"\n  impact 0.5\n  tag severity: 'medium'\n  tag gtitle: 'SRG-APP-000560-CTR-001340'\n  tag gid: 'V-242468'\n  tag rid: 'SV-242468r712760_rule'\n  tag stig_id: 'CNTR-K8-003350'\n  tag fix_id: 'F-45701r712759_fix'\n  tag cci: ['CCI-001453']\n  tag nist: ['AC-17 (2)']\n\n  unless kube_apiserver.exist?\n    impact 0.0\n    desc 'caveat', 'Kubernetes API Server process is not running on the target.'\n  end\n\n  describe kube_apiserver do\n    its('tls-min-version') { should_not be_nil }\n    its('tls-min-version') { should_not cmp 'VersionTLS10' }\n    its('tls-min-version') { should_not cmp 'VersionTLS11' }\n  end\nend\n",
          "desc": "The Kubernetes API Server will prohibit the use of SSL and\nunauthorized versions of TLS protocols to properly secure communication.\n\n    The use of unsupported protocol exposes vulnerabilities to Kubernetes by\nrogue traffic interceptions, man-in-the middle attacks, and impersonation of\nusers or services from the container platform runtime, registry, and keystore.\nTo enable the minimum version of TLS to be used by the Kubernetes API Server,\nthe setting \"tls-min-version\" must be set.\n\n    The container platform and its components will adhere to NIST 800-52R2.",
          "descriptions": [
            {
              "data": "The Kubernetes API Server will prohibit the use of SSL and\nunauthorized versions of TLS protocols to properly secure communication.\n\n    The use of unsupported protocol exposes vulnerabilities to Kubernetes by\nrogue traffic interceptions, man-in-the middle attacks, and impersonation of\nusers or services from the container platform runtime, registry, and keystore.\nTo enable the minimum version of TLS to be used by the Kubernetes API Server,\nthe setting \"tls-min-version\" must be set.\n\n    The container platform and its components will adhere to NIST 800-52R2.",
              "label": "default"
            },
            {
              "data": "",
              "label": "rationale"
            },
            {
              "data": "Change to the /etc/kubernetes/manifests directory on the Kubernetes Master\nNode. Run the command:\n\n    grep -i tls-min-version *\n\n    If the setting tls-min-version is not configured in the Kubernetes API\nServer manifest file or it is set to \"VersionTLS10\" or \"VersionTLS11\", this\nis a finding.",
              "label": "check"
            },
            {
              "data": "Edit the Kubernetes API Server manifest file in the\n/etc/kubernetes/manifests directory on the Kubernetes Master Node. Set the\nvalue of \"--tls-min-version\" to either \"VersionTLS12\" or higher.",
              "label": "fix"
            }
          ],
          "id": "V-242468",
          "impact": 0.5,
          "refs": [],
          "results": [],
          "source_location": {
            "line": 3,
            "ref": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242468.rb"
          },
          "tags": {
            "cci": ["CCI-001453"],
            "fix_id": "F-45701r712759_fix",
            "gid": "V-242468",
            "gtitle": "SRG-APP-000560-CTR-001340",
            "nist": ["AC-17 (2)"],
            "rid": "SV-242468r712760_rule",
            "severity": "medium",
            "stig_id": "CNTR-K8-003350"
          },
          "title": "The Kubernetes API Server must prohibit communication using TLS\nversion 1.0 and 1.1, and SSL 2.0 and 3.0.",
          "waiver_data": {}
        }
      ],
      "copyright": "Defense Information Systems Agency (DISA)",
      "depends": [
        {
          "git": "https://gitlab.dsolab.io/scv-content/inspec/kubernetes/baselines/k8s-node-stig-baseline.git",
          "name": "k8s-node-stig-baseline",
          "status": "loaded"
        }
      ],
      "groups": [
        {
          "controls": ["V-242468"],
          "id": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242468.rb"
        },
        {
          "controls": ["V-242467"],
          "id": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242467.rb"
        },
        {
          "controls": ["V-242466"],
          "id": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242466.rb"
        },
        {
          "controls": ["V-242465"],
          "id": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242465.rb"
        },
        {
          "controls": ["V-242464"],
          "id": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242464.rb"
        },
        {
          "controls": ["V-242463"],
          "id": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242463.rb"
        },
        {
          "controls": ["V-242462"],
          "id": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242462.rb"
        },
        {
          "controls": ["V-242461"],
          "id": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242461.rb"
        },
        {
          "controls": ["V-242460"],
          "id": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242460.rb"
        },
        {
          "controls": ["V-242459"],
          "id": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242459.rb"
        },
        {
          "controls": ["V-242458"],
          "id": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242458.rb"
        },
        {
          "controls": ["V-242457"],
          "id": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242457.rb"
        },
        {
          "controls": ["V-242456"],
          "id": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242456.rb"
        },
        {
          "controls": ["V-242455"],
          "id": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242455.rb"
        },
        {
          "controls": ["V-242454"],
          "id": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242454.rb"
        },
        {
          "controls": ["V-242453"],
          "id": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242453.rb"
        },
        {
          "controls": ["V-242452"],
          "id": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242452.rb"
        },
        {
          "controls": ["V-242451"],
          "id": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242451.rb"
        },
        {
          "controls": ["V-242450"],
          "id": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242450.rb"
        },
        {
          "controls": ["V-242449"],
          "id": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242449.rb"
        },
        {
          "controls": ["V-242448"],
          "id": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242448.rb"
        },
        {
          "controls": ["V-242447"],
          "id": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242447.rb"
        },
        {
          "controls": ["V-242446"],
          "id": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242446.rb"
        },
        {
          "controls": ["V-242445"],
          "id": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242445.rb"
        },
        {
          "controls": ["V-242444"],
          "id": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242444.rb"
        },
        {
          "controls": ["V-242441"],
          "id": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242441.rb"
        },
        {
          "controls": ["V-242440"],
          "id": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242440.rb"
        },
        {
          "controls": ["V-242439"],
          "id": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242439.rb"
        },
        {
          "controls": ["V-242438"],
          "id": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242438.rb"
        },
        {
          "controls": ["V-242436"],
          "id": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242436.rb"
        },
        {
          "controls": ["V-242435"],
          "id": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242435.rb"
        },
        {
          "controls": ["V-242434"],
          "id": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242434.rb"
        },
        {
          "controls": ["V-242433"],
          "id": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242433.rb"
        },
        {
          "controls": ["V-242432"],
          "id": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242432.rb"
        },
        {
          "controls": ["V-242431"],
          "id": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242431.rb"
        },
        {
          "controls": ["V-242430"],
          "id": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242430.rb"
        },
        {
          "controls": ["V-242429"],
          "id": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242429.rb"
        },
        {
          "controls": ["V-242428"],
          "id": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242428.rb"
        },
        {
          "controls": ["V-242427"],
          "id": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242427.rb"
        },
        {
          "controls": ["V-242426"],
          "id": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242426.rb"
        },
        {
          "controls": ["V-242425"],
          "id": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242425.rb"
        },
        {
          "controls": ["V-242424"],
          "id": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242424.rb"
        },
        {
          "controls": ["V-242423"],
          "id": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242423.rb"
        },
        {
          "controls": ["V-242422"],
          "id": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242422.rb"
        },
        {
          "controls": ["V-242421"],
          "id": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242421.rb"
        },
        {
          "controls": ["V-242420"],
          "id": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242420.rb"
        },
        {
          "controls": ["V-242419"],
          "id": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242419.rb"
        },
        {
          "controls": ["V-242418"],
          "id": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242418.rb"
        },
        {
          "controls": ["V-242416"],
          "id": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242416.rb"
        },
        {
          "controls": ["V-242409"],
          "id": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242409.rb"
        },
        {
          "controls": ["V-242408"],
          "id": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242408.rb"
        },
        {
          "controls": ["V-242407"],
          "id": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242407.rb"
        },
        {
          "controls": ["V-242406"],
          "id": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242406.rb"
        },
        {
          "controls": ["V-242405"],
          "id": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242405.rb"
        },
        {
          "controls": ["V-242404"],
          "id": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242404.rb"
        },
        {
          "controls": ["V-242403"],
          "id": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242403.rb"
        },
        {
          "controls": ["V-242402"],
          "id": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242402.rb"
        },
        {
          "controls": ["V-242401"],
          "id": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242401.rb"
        },
        {
          "controls": ["V-242400"],
          "id": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242400.rb"
        },
        {
          "controls": ["V-242399"],
          "id": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242399.rb"
        },
        {
          "controls": ["V-242398"],
          "id": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242398.rb"
        },
        {
          "controls": ["V-242397"],
          "id": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242397.rb"
        },
        {
          "controls": ["V-242396"],
          "id": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242396.rb"
        },
        {
          "controls": ["V-242394"],
          "id": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242394.rb"
        },
        {
          "controls": ["V-242393"],
          "id": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242393.rb"
        },
        {
          "controls": ["V-242392"],
          "id": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242392.rb"
        },
        {
          "controls": ["V-242391"],
          "id": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242391.rb"
        },
        {
          "controls": ["V-242390"],
          "id": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242390.rb"
        },
        {
          "controls": ["V-242389"],
          "id": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242389.rb"
        },
        {
          "controls": ["V-242388"],
          "id": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242388.rb"
        },
        {
          "controls": ["V-242387"],
          "id": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242387.rb"
        },
        {
          "controls": ["V-242386"],
          "id": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242386.rb"
        },
        {
          "controls": ["V-242385"],
          "id": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242385.rb"
        },
        {
          "controls": ["V-242384"],
          "id": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242384.rb"
        },
        {
          "controls": ["V-242382"],
          "id": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242382.rb"
        },
        {
          "controls": ["V-242381"],
          "id": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242381.rb"
        },
        {
          "controls": ["V-242380"],
          "id": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242380.rb"
        },
        {
          "controls": ["V-242379"],
          "id": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242379.rb"
        },
        {
          "controls": ["V-242378"],
          "id": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242378.rb"
        },
        {
          "controls": ["V-242377"],
          "id": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242377.rb"
        },
        {
          "controls": ["V-242376"],
          "id": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242376.rb"
        }
      ],
      "license": "Apache-2.0",
      "maintainer": "DISA DevSecOps Team",
      "name": "k3s-node-stig-baseline",
      "sha256": "46068929b4c0d889ab4eacc4bccb486a45b4c43780357d36e9d9c088bba138ac",
      "status": "loaded",
      "status_message": "",
      "summary": "InSpec testing for baseline compliance with the Kubernetes STIG Node OS Checks.",
      "supports": [],
      "title": "K3S Node Inspec profile on Kubernetes Security Technical Implementation Guideline (STIG) Node OS Checks.",
      "version": "1.0.0"
    },
    {
      "attributes": [
        {
          "name": "pki_path",
          "options": {
            "required": true,
            "type": "String",
            "value": "/var/lib/rancher/k3s/server/tls/"
          }
        },
        {
          "name": "kubectl_path",
          "options": {
            "required": true,
            "type": "String",
            "value": "/usr/local/bin/kubectl"
          }
        },
        {
          "name": "kubectl_minversion",
          "options": {
            "required": true,
            "type": "String",
            "value": "1.12.9"
          }
        },
        {
          "name": "kubernetes_conf_files",
          "options": {
            "required": true,
            "type": "Array",
            "value": [
              "/var/lib/rancher/k3s/server/cred/admin.kubeconfig",
              "/var/lib/rancher/k3s/server/cred/scheduler.kubeconfig",
              "/var/lib/rancher/k3s/server/cred/controller.kubeconfig"
            ]
          }
        },
        {
          "name": "manifests_path",
          "options": {
            "required": true,
            "type": "String",
            "value": "/etc/kubernetes/manifests"
          }
        },
        {
          "name": "kubeadm_conf_path",
          "options": {
            "required": true,
            "type": "String",
            "value": "/etc/systemd/system/kubelet.service.d/10-kubeadm.conf"
          }
        }
      ],
      "controls": [
        {
          "code": "control 'V-242376' do\n  title \"The Kubernetes Controller Manager must use TLS 1.2, at a minimum, to\nprotect the confidentiality of sensitive data during electronic dissemination.\"\n  desc  \"The Kubernetes Controller Manager will prohibit the use of SSL and\nunauthorized versions of TLS protocols to properly secure communication.\n\n    The use of unsupported protocol exposes vulnerabilities to the Kubernetes\nby rogue traffic interceptions, man-in-the-middle attacks, and impersonation of\nusers or services from the container platform runtime, registry, and key store.\nTo enable the minimum version of TLS to be used by the Kubernetes Controller\nManager, the setting \\\"tls-min-version\\\" must be set.\n  \"\n  desc  'rationale', ''\n  desc  'check', \"\n    Change to the /etc/kubernetes/manifests/ directory on the Kubernetes Master\nNode. Run the command:\n\n    grep -i tls-min-version *\n\n    If the setting \\\"tls-min-version\\\" is not configured in the Kubernetes\nController Manager manifest file or it is set to \\\"VersionTLS10\\\" or\n\\\"VersionTLS11\\\", this is a finding.\n  \"\n  desc 'fix', \"Edit the Kubernetes Controller Manager manifest file in the\n/etc/kubernetes/manifests directory on the Kubernetes Master Node. Set the\nvalue of \\\"--tls-min-version\\\" to \\\"VersionTLS12\\\" or higher.\"\n  impact 0.5\n  tag severity: 'medium'\n  tag gtitle: 'SRG-APP-000014-CTR-000035'\n  tag gid: 'V-242376'\n  tag rid: 'SV-242376r712484_rule'\n  tag stig_id: 'CNTR-K8-000150'\n  tag fix_id: 'F-45609r712483_fix'\n  tag cci: ['CCI-000068']\n  tag nist: ['AC-17 (2)']\n\n  unless kube_controller_manager.exist?\n    impact 0.0\n    desc 'caveat', 'Kubernetes Controller Manager process is not running on the target.'\n  end\n\n  describe kube_controller_manager do\n    its('tls-min-version') { should_not be_nil }\n    its('tls-min-version') { should_not cmp 'VersionTLS10' }\n    its('tls-min-version') { should_not cmp 'VersionTLS11' }\n  end\nend\n",
          "desc": "The Kubernetes Controller Manager will prohibit the use of SSL and\nunauthorized versions of TLS protocols to properly secure communication.\n\n    The use of unsupported protocol exposes vulnerabilities to the Kubernetes\nby rogue traffic interceptions, man-in-the-middle attacks, and impersonation of\nusers or services from the container platform runtime, registry, and key store.\nTo enable the minimum version of TLS to be used by the Kubernetes Controller\nManager, the setting \"tls-min-version\" must be set.",
          "descriptions": [
            {
              "data": "The Kubernetes Controller Manager will prohibit the use of SSL and\nunauthorized versions of TLS protocols to properly secure communication.\n\n    The use of unsupported protocol exposes vulnerabilities to the Kubernetes\nby rogue traffic interceptions, man-in-the-middle attacks, and impersonation of\nusers or services from the container platform runtime, registry, and key store.\nTo enable the minimum version of TLS to be used by the Kubernetes Controller\nManager, the setting \"tls-min-version\" must be set.",
              "label": "default"
            },
            {
              "data": "",
              "label": "rationale"
            },
            {
              "data": "Change to the /etc/kubernetes/manifests/ directory on the Kubernetes Master\nNode. Run the command:\n\n    grep -i tls-min-version *\n\n    If the setting \"tls-min-version\" is not configured in the Kubernetes\nController Manager manifest file or it is set to \"VersionTLS10\" or\n\"VersionTLS11\", this is a finding.",
              "label": "check"
            },
            {
              "data": "Edit the Kubernetes Controller Manager manifest file in the\n/etc/kubernetes/manifests directory on the Kubernetes Master Node. Set the\nvalue of \"--tls-min-version\" to \"VersionTLS12\" or higher.",
              "label": "fix"
            }
          ],
          "id": "V-242376",
          "impact": 0.5,
          "refs": [],
          "results": [
            {
              "code_desc": "Process arguments for k3s server tls-min-version is expected not to be nil",
              "resource_class": "kube_controller_manager",
              "resource_params": "[]",
              "run_time": 0.00743962,
              "start_time": "2021-06-21T21:25:34-04:00",
              "status": "passed"
            },
            {
              "code_desc": "Process arguments for k3s server tls-min-version is expected not to cmp == \"VersionTLS10\"",
              "resource_class": "kube_controller_manager",
              "resource_params": "[]",
              "run_time": 0.000194887,
              "start_time": "2021-06-21T21:25:34-04:00",
              "status": "passed"
            },
            {
              "code_desc": "Process arguments for k3s server tls-min-version is expected not to cmp == \"VersionTLS11\"",
              "resource_class": "kube_controller_manager",
              "resource_params": "[]",
              "run_time": 0.000183632,
              "start_time": "2021-06-21T21:25:34-04:00",
              "status": "passed"
            }
          ],
          "source_location": {
            "line": 3,
            "ref": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242376.rb"
          },
          "tags": {
            "cci": ["CCI-000068"],
            "fix_id": "F-45609r712483_fix",
            "gid": "V-242376",
            "gtitle": "SRG-APP-000014-CTR-000035",
            "nist": ["AC-17 (2)"],
            "rid": "SV-242376r712484_rule",
            "severity": "medium",
            "stig_id": "CNTR-K8-000150"
          },
          "title": "The Kubernetes Controller Manager must use TLS 1.2, at a minimum, to\nprotect the confidentiality of sensitive data during electronic dissemination.",
          "waiver_data": {}
        },
        {
          "code": "control 'V-242377' do\n  title \"The Kubernetes Scheduler must use TLS 1.2, at a minimum, to protect\nthe confidentiality of sensitive data during electronic dissemination.\"\n  desc  \"The Kubernetes Scheduler will prohibit the use of SSL and unauthorized\nversions of TLS protocols to properly secure communication.\n\n    The use of unsupported protocol exposes vulnerabilities to the Kubernetes\nby rogue traffic interceptions, man-in-the-middle attacks, and impersonation of\nusers or services from the container platform runtime, registry, and keystore.\nTo enable the minimum version of TLS to be used by the Kubernetes API Server,\nthe setting \\\"tls-min-version\\\" must be set.\n  \"\n  desc  'rationale', ''\n  desc  'check', \"\n    Change to the /etc/kubernetes/manifests/ directory on the Kubernetes Master\nNode. Run the command:\n\n    grep -i tls-min-version *\n\n    If the setting \\\"tls-min-version\\\" is not configured in the Kubernetes\nScheduler manifest file or it is set to \\\"VersionTLS10\\\" or \\\"VersionTLS11\\\",\nthis is a finding.\n  \"\n  desc 'fix', \"Edit the Kubernetes Scheduler manifest file in the\n/etc/kubernetes/manifests directory on the Kubernetes Master Node. Set the\nvalue of \\\"--tls-min-version\\\" to \\\"VersionTLS12\\\" or higher.\"\n  impact 0.5\n  tag severity: 'medium'\n  tag gtitle: 'SRG-APP-000014-CTR-000035'\n  tag gid: 'V-242377'\n  tag rid: 'SV-242377r712487_rule'\n  tag stig_id: 'CNTR-K8-000160'\n  tag fix_id: 'F-45610r712486_fix'\n  tag cci: ['CCI-000068']\n  tag nist: ['AC-17 (2)']\n\n  unless kube_scheduler.exist?\n    impact 0.0\n    desc 'caveat', 'Kubernetes Scheduler process is not running on the target.'\n  end\n\n  describe kube_scheduler do\n    its('tls-min-version') { should_not be_nil }\n    its('tls-min-version') { should_not cmp 'VersionTLS10' }\n    its('tls-min-version') { should_not cmp 'VersionTLS11' }\n  end\nend\n",
          "desc": "The Kubernetes Scheduler will prohibit the use of SSL and unauthorized\nversions of TLS protocols to properly secure communication.\n\n    The use of unsupported protocol exposes vulnerabilities to the Kubernetes\nby rogue traffic interceptions, man-in-the-middle attacks, and impersonation of\nusers or services from the container platform runtime, registry, and keystore.\nTo enable the minimum version of TLS to be used by the Kubernetes API Server,\nthe setting \"tls-min-version\" must be set.",
          "descriptions": [
            {
              "data": "The Kubernetes Scheduler will prohibit the use of SSL and unauthorized\nversions of TLS protocols to properly secure communication.\n\n    The use of unsupported protocol exposes vulnerabilities to the Kubernetes\nby rogue traffic interceptions, man-in-the-middle attacks, and impersonation of\nusers or services from the container platform runtime, registry, and keystore.\nTo enable the minimum version of TLS to be used by the Kubernetes API Server,\nthe setting \"tls-min-version\" must be set.",
              "label": "default"
            },
            {
              "data": "",
              "label": "rationale"
            },
            {
              "data": "Change to the /etc/kubernetes/manifests/ directory on the Kubernetes Master\nNode. Run the command:\n\n    grep -i tls-min-version *\n\n    If the setting \"tls-min-version\" is not configured in the Kubernetes\nScheduler manifest file or it is set to \"VersionTLS10\" or \"VersionTLS11\",\nthis is a finding.",
              "label": "check"
            },
            {
              "data": "Edit the Kubernetes Scheduler manifest file in the\n/etc/kubernetes/manifests directory on the Kubernetes Master Node. Set the\nvalue of \"--tls-min-version\" to \"VersionTLS12\" or higher.",
              "label": "fix"
            }
          ],
          "id": "V-242377",
          "impact": 0.5,
          "refs": [],
          "results": [
            {
              "code_desc": "Process arguments for k3s server tls-min-version is expected not to be nil",
              "resource_class": "kube_scheduler",
              "resource_params": "[]",
              "run_time": 0.007551643,
              "start_time": "2021-06-21T21:25:34-04:00",
              "status": "passed"
            },
            {
              "code_desc": "Process arguments for k3s server tls-min-version is expected not to cmp == \"VersionTLS10\"",
              "resource_class": "kube_scheduler",
              "resource_params": "[]",
              "run_time": 0.00016851,
              "start_time": "2021-06-21T21:25:34-04:00",
              "status": "passed"
            },
            {
              "code_desc": "Process arguments for k3s server tls-min-version is expected not to cmp == \"VersionTLS11\"",
              "resource_class": "kube_scheduler",
              "resource_params": "[]",
              "run_time": 0.000180687,
              "start_time": "2021-06-21T21:25:34-04:00",
              "status": "passed"
            }
          ],
          "source_location": {
            "line": 3,
            "ref": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242377.rb"
          },
          "tags": {
            "cci": ["CCI-000068"],
            "fix_id": "F-45610r712486_fix",
            "gid": "V-242377",
            "gtitle": "SRG-APP-000014-CTR-000035",
            "nist": ["AC-17 (2)"],
            "rid": "SV-242377r712487_rule",
            "severity": "medium",
            "stig_id": "CNTR-K8-000160"
          },
          "title": "The Kubernetes Scheduler must use TLS 1.2, at a minimum, to protect\nthe confidentiality of sensitive data during electronic dissemination.",
          "waiver_data": {}
        },
        {
          "code": "control 'V-242378' do\n  title \"The Kubernetes API Server must use TLS 1.2, at a minimum, to protect\nthe confidentiality of sensitive data during electronic dissemination.\"\n  desc  \"The Kubernetes API Server will prohibit the use of SSL and\nunauthorized versions of TLS protocols to properly secure communication.\n\n    The use of unsupported protocol exposes vulnerabilities to the Kubernetes\nby rogue traffic interceptions, man-in-the-middle attacks, and impersonation of\nusers or services from the container platform runtime, registry, and keystore.\nTo enable the minimum version of TLS to be used by the Kubernetes API Server,\nthe setting \\\"tls-min-version\\\" must be set.\n  \"\n  desc  'rationale', ''\n  desc  'check', \"\n    Change to the /etc/kubernetes/manifests directory on the Kubernetes Master\nNode. Run the command:\n\n    grep -i tls-min-version *\n\n    If the setting \\\"tls-min-version\\\" is not configured in the Kubernetes API\nServer manifest file or it is set to \\\"VersionTLS10\\\" or \\\"VersionTLS11\\\", this\nis a finding.\n  \"\n  desc 'fix', \"Edit the Kubernetes API Server manifest file in the\n/etc/kubernetes/manifests directory on the Kubernetes Master Node. Set the\nvalue of \\\"--tls-min-version\\\" to \\\"VersionTLS12\\\" or higher.\"\n  impact 0.5\n  tag severity: 'medium'\n  tag gtitle: 'SRG-APP-000014-CTR-000040'\n  tag gid: 'V-242378'\n  tag rid: 'SV-242378r712490_rule'\n  tag stig_id: 'CNTR-K8-000170'\n  tag fix_id: 'F-45611r712489_fix'\n  tag cci: ['CCI-000068']\n  tag nist: ['AC-17 (2)']\n\n  unless kube_apiserver.exist?\n    impact 0.0\n    desc 'caveat', 'Kubernetes API Server process is not running on the target.'\n  end\n\n  describe kube_apiserver do\n    its('tls-min-version') { should_not be_nil }\n    its('tls-min-version') { should_not cmp 'VersionTLS10' }\n    its('tls-min-version') { should_not cmp 'VersionTLS11' }\n  end\nend\n",
          "desc": "The Kubernetes API Server will prohibit the use of SSL and\nunauthorized versions of TLS protocols to properly secure communication.\n\n    The use of unsupported protocol exposes vulnerabilities to the Kubernetes\nby rogue traffic interceptions, man-in-the-middle attacks, and impersonation of\nusers or services from the container platform runtime, registry, and keystore.\nTo enable the minimum version of TLS to be used by the Kubernetes API Server,\nthe setting \"tls-min-version\" must be set.",
          "descriptions": [
            {
              "data": "The Kubernetes API Server will prohibit the use of SSL and\nunauthorized versions of TLS protocols to properly secure communication.\n\n    The use of unsupported protocol exposes vulnerabilities to the Kubernetes\nby rogue traffic interceptions, man-in-the-middle attacks, and impersonation of\nusers or services from the container platform runtime, registry, and keystore.\nTo enable the minimum version of TLS to be used by the Kubernetes API Server,\nthe setting \"tls-min-version\" must be set.",
              "label": "default"
            },
            {
              "data": "",
              "label": "rationale"
            },
            {
              "data": "Change to the /etc/kubernetes/manifests directory on the Kubernetes Master\nNode. Run the command:\n\n    grep -i tls-min-version *\n\n    If the setting \"tls-min-version\" is not configured in the Kubernetes API\nServer manifest file or it is set to \"VersionTLS10\" or \"VersionTLS11\", this\nis a finding.",
              "label": "check"
            },
            {
              "data": "Edit the Kubernetes API Server manifest file in the\n/etc/kubernetes/manifests directory on the Kubernetes Master Node. Set the\nvalue of \"--tls-min-version\" to \"VersionTLS12\" or higher.",
              "label": "fix"
            }
          ],
          "id": "V-242378",
          "impact": 0.5,
          "refs": [],
          "results": [
            {
              "code_desc": "Process arguments for k3s server tls-min-version is expected not to be nil",
              "resource_class": "kube_apiserver",
              "resource_params": "[]",
              "run_time": 0.00761553,
              "start_time": "2021-06-21T21:25:34-04:00",
              "status": "passed"
            },
            {
              "code_desc": "Process arguments for k3s server tls-min-version is expected not to cmp == \"VersionTLS10\"",
              "resource_class": "kube_apiserver",
              "resource_params": "[]",
              "run_time": 0.000173815,
              "start_time": "2021-06-21T21:25:34-04:00",
              "status": "passed"
            },
            {
              "code_desc": "Process arguments for k3s server tls-min-version is expected not to cmp == \"VersionTLS11\"",
              "resource_class": "kube_apiserver",
              "resource_params": "[]",
              "run_time": 0.000158466,
              "start_time": "2021-06-21T21:25:34-04:00",
              "status": "passed"
            }
          ],
          "source_location": {
            "line": 3,
            "ref": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242378.rb"
          },
          "tags": {
            "cci": ["CCI-000068"],
            "fix_id": "F-45611r712489_fix",
            "gid": "V-242378",
            "gtitle": "SRG-APP-000014-CTR-000040",
            "nist": ["AC-17 (2)"],
            "rid": "SV-242378r712490_rule",
            "severity": "medium",
            "stig_id": "CNTR-K8-000170"
          },
          "title": "The Kubernetes API Server must use TLS 1.2, at a minimum, to protect\nthe confidentiality of sensitive data during electronic dissemination.",
          "waiver_data": {}
        },
        {
          "code": "control 'V-242379' do\n  title \"The Kubernetes etcd must use TLS to protect the confidentiality of\nsensitive data during electronic dissemination.\"\n  desc  \"Kubernetes etcd will prohibit the use of SSL and unauthorized versions\nof TLS protocols to properly secure communication.\n\n    The use of unsupported protocol exposes vulnerabilities to the Kubernetes\nby rogue traffic interceptions, man-in-the-middle attacks, and impersonation of\nusers or services from the container platform runtime, registry, and keystore.\nTo enable the minimum version of TLS to be used by the Kubernetes API Server,\nthe setting \\\"tls-min-version\\\" must be set.\n  \"\n  desc  'rationale', ''\n  desc  'check', \"\n    Change to the /etc/kubernetes/manifests directory on the Kubernetes Master\nNode. Run the command:\n\n    grep -i  auto-tls *\n\n    If the setting \\\"auto-tls\\\" is not configured in the Kubernetes etcd\nmanifest file or it is set to true, this is a finding.\n  \"\n  desc 'fix', \"Edit the Kubernetes etcd manifest file in the\n/etc/kubernetes/manifests directory on the Kubernetes Master Node. Set the\nvalue of \\\"-auto-tls\\\" to \\\"false\\\".\"\n  impact 0.5\n  tag severity: 'medium'\n  tag gtitle: 'SRG-APP-000014-CTR-000035'\n  tag gid: 'V-242379'\n  tag rid: 'SV-242379r712493_rule'\n  tag stig_id: 'CNTR-K8-000180'\n  tag fix_id: 'F-45612r712492_fix'\n  tag cci: ['CCI-000068']\n  tag nist: ['AC-17 (2)']\n\n  if etcd.exist?\n    describe.one do\n      describe etcd do\n        its('auto-tls') { should cmp 'false' }\n      end\n\n      describe process_env_var('etcd') do\n        its(:ETCD_AUTO_TLS) { should cmp 'false' }\n      end\n    end\n  else\n    describe 'ETCD process is not running on the target.' do\n      skip\n    end\n  end\nend\n",
          "desc": "Kubernetes etcd will prohibit the use of SSL and unauthorized versions\nof TLS protocols to properly secure communication.\n\n    The use of unsupported protocol exposes vulnerabilities to the Kubernetes\nby rogue traffic interceptions, man-in-the-middle attacks, and impersonation of\nusers or services from the container platform runtime, registry, and keystore.\nTo enable the minimum version of TLS to be used by the Kubernetes API Server,\nthe setting \"tls-min-version\" must be set.",
          "descriptions": [
            {
              "data": "Kubernetes etcd will prohibit the use of SSL and unauthorized versions\nof TLS protocols to properly secure communication.\n\n    The use of unsupported protocol exposes vulnerabilities to the Kubernetes\nby rogue traffic interceptions, man-in-the-middle attacks, and impersonation of\nusers or services from the container platform runtime, registry, and keystore.\nTo enable the minimum version of TLS to be used by the Kubernetes API Server,\nthe setting \"tls-min-version\" must be set.",
              "label": "default"
            },
            {
              "data": "",
              "label": "rationale"
            },
            {
              "data": "Change to the /etc/kubernetes/manifests directory on the Kubernetes Master\nNode. Run the command:\n\n    grep -i  auto-tls *\n\n    If the setting \"auto-tls\" is not configured in the Kubernetes etcd\nmanifest file or it is set to true, this is a finding.",
              "label": "check"
            },
            {
              "data": "Edit the Kubernetes etcd manifest file in the\n/etc/kubernetes/manifests directory on the Kubernetes Master Node. Set the\nvalue of \"-auto-tls\" to \"false\".",
              "label": "fix"
            }
          ],
          "id": "V-242379",
          "impact": 0.5,
          "refs": [],
          "results": [
            {
              "code_desc": "Process arguments for /usr/local/bin/etcd auto-tls is expected to cmp == \"false\"",
              "resource_class": "etcd",
              "resource_params": "[]",
              "run_time": 0.00014419,
              "start_time": "2021-06-21T21:25:34-04:00",
              "status": "passed"
            }
          ],
          "source_location": {
            "line": 3,
            "ref": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242379.rb"
          },
          "tags": {
            "cci": ["CCI-000068"],
            "fix_id": "F-45612r712492_fix",
            "gid": "V-242379",
            "gtitle": "SRG-APP-000014-CTR-000035",
            "nist": ["AC-17 (2)"],
            "rid": "SV-242379r712493_rule",
            "severity": "medium",
            "stig_id": "CNTR-K8-000180"
          },
          "title": "The Kubernetes etcd must use TLS to protect the confidentiality of\nsensitive data during electronic dissemination.",
          "waiver_data": {}
        },
        {
          "code": "control 'V-242380' do\n  title \"The Kubernetes etcd must use TLS to protect the confidentiality of\nsensitive data during electronic dissemination.\"\n  desc  \"The Kubernetes API Server will prohibit the use of SSL and\nunauthorized versions of TLS protocols to properly secure communication.\n\n    The use of unsupported protocol exposes vulnerabilities to the Kubernetes\nby rogue traffic interceptions, man-in-the-middle attacks, and impersonation of\nusers or services from the container platform runtime, registry, and keystore.\nTo enable the minimum version of TLS to be used by the Kubernetes API Server,\nthe setting \\\"tls-min-version\\\" must be set.\n  \"\n  desc  'rationale', ''\n  desc  'check', \"\n    Change to the /etc/kubernetes/manifests directory on the Kubernetes Master\nNode. Run the command:\n\n    grep -I  peer-auto-tls *\n\n    If the setting \\\"peer-auto-tls\\\" is not configured in the Kubernetes etcd\nmanifest file or it is set to \\\"true\\\", this is a finding.\n  \"\n  desc 'fix', \"Edit the Kubernetes etcd manifest file in the\n/etc/kubernetes/manifests directory on the Kubernetes Master Node. Set the\nvalue of \\\"peer-auto-tls\\\" to \\\"false\\\".\"\n  impact 0.5\n  tag severity: 'medium'\n  tag gtitle: 'SRG-APP-000014-CTR-000035'\n  tag gid: 'V-242380'\n  tag rid: 'SV-242380r712496_rule'\n  tag stig_id: 'CNTR-K8-000190'\n  tag fix_id: 'F-45613r712495_fix'\n  tag cci: ['CCI-000068']\n  tag nist: ['AC-17 (2)']\n\n  if etcd.exist?\n    describe.one do\n      describe etcd do\n        its('peer-auto-tls') { should cmp 'false' }\n      end\n\n      describe process_env_var('etcd') do\n        its(:ETCD_PEER_AUTO_TLS) { should cmp 'false' }\n      end\n    end\n  else\n    describe 'ETCD process is not running on the target.' do\n      skip\n    end\n  end\nend\n",
          "desc": "The Kubernetes API Server will prohibit the use of SSL and\nunauthorized versions of TLS protocols to properly secure communication.\n\n    The use of unsupported protocol exposes vulnerabilities to the Kubernetes\nby rogue traffic interceptions, man-in-the-middle attacks, and impersonation of\nusers or services from the container platform runtime, registry, and keystore.\nTo enable the minimum version of TLS to be used by the Kubernetes API Server,\nthe setting \"tls-min-version\" must be set.",
          "descriptions": [
            {
              "data": "The Kubernetes API Server will prohibit the use of SSL and\nunauthorized versions of TLS protocols to properly secure communication.\n\n    The use of unsupported protocol exposes vulnerabilities to the Kubernetes\nby rogue traffic interceptions, man-in-the-middle attacks, and impersonation of\nusers or services from the container platform runtime, registry, and keystore.\nTo enable the minimum version of TLS to be used by the Kubernetes API Server,\nthe setting \"tls-min-version\" must be set.",
              "label": "default"
            },
            {
              "data": "",
              "label": "rationale"
            },
            {
              "data": "Change to the /etc/kubernetes/manifests directory on the Kubernetes Master\nNode. Run the command:\n\n    grep -I  peer-auto-tls *\n\n    If the setting \"peer-auto-tls\" is not configured in the Kubernetes etcd\nmanifest file or it is set to \"true\", this is a finding.",
              "label": "check"
            },
            {
              "data": "Edit the Kubernetes etcd manifest file in the\n/etc/kubernetes/manifests directory on the Kubernetes Master Node. Set the\nvalue of \"peer-auto-tls\" to \"false\".",
              "label": "fix"
            }
          ],
          "id": "V-242380",
          "impact": 0.5,
          "refs": [],
          "results": [
            {
              "code_desc": "Process arguments for /usr/local/bin/etcd peer-auto-tls is expected to cmp == \"false\"",
              "resource_class": "etcd",
              "resource_params": "[]",
              "run_time": 0.000156278,
              "start_time": "2021-06-21T21:25:34-04:00",
              "status": "passed"
            }
          ],
          "source_location": {
            "line": 3,
            "ref": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242380.rb"
          },
          "tags": {
            "cci": ["CCI-000068"],
            "fix_id": "F-45613r712495_fix",
            "gid": "V-242380",
            "gtitle": "SRG-APP-000014-CTR-000035",
            "nist": ["AC-17 (2)"],
            "rid": "SV-242380r712496_rule",
            "severity": "medium",
            "stig_id": "CNTR-K8-000190"
          },
          "title": "The Kubernetes etcd must use TLS to protect the confidentiality of\nsensitive data during electronic dissemination.",
          "waiver_data": {}
        },
        {
          "code": "control 'V-242381' do\n  title \"The Kubernetes Controller Manager must create unique service accounts\nfor each work payload.\"\n  desc  \"The Kubernetes Controller Manager is a background process that embeds\ncore control loops regulating cluster system state through the API Server.\nEvery process executed in a pod has an associated service account. By default,\nservice accounts use the same credentials for authentication. Implementing the\ndefault settings poses a High risk to the Kubernetes Controller Manager.\nSetting the use-service-account-credentials value lowers the attack surface by\ngenerating unique service accounts settings for each controller instance.\"\n  desc  'rationale', ''\n  desc  'check', \"\n    Change to the /etc/kubernetes/manifests directory on the Kubernetes Master\nNode. Run the command:\n\n    grep -i use-service-account-credentials *\n\n    If the setting use-service-account-credential is not configured in the\nKubernetes Controller Manager manifest file or it is set to \\\"false\\\", this is\na finding.\n  \"\n  desc 'fix', \"Edit the Kubernetes Controller Manager manifest file in the\n/etc/kubernetes/manifests directory on the Kubernetes Master Node. Set the\nvalue of \\\"use-service-account-credentials\\\" to \\\"true\\\".\"\n  impact 0.7\n  tag severity: 'high'\n  tag gtitle: 'SRG-APP-000023-CTR-000055'\n  tag gid: 'V-242381'\n  tag rid: 'SV-242381r712499_rule'\n  tag stig_id: 'CNTR-K8-000220'\n  tag fix_id: 'F-45614r712498_fix'\n  tag cci: ['CCI-000015']\n  tag nist: ['AC-2 (1)']\n\n  unless kube_controller_manager.exist?\n    impact 0.0\n    desc 'caveat', 'Kubernetes Controller Manager process is not running on the target.'\n  end\n\n  describe kube_controller_manager do\n    its('use-service-account-credentials') { should cmp 'true' }\n  end\nend\n",
          "desc": "The Kubernetes Controller Manager is a background process that embeds\ncore control loops regulating cluster system state through the API Server.\nEvery process executed in a pod has an associated service account. By default,\nservice accounts use the same credentials for authentication. Implementing the\ndefault settings poses a High risk to the Kubernetes Controller Manager.\nSetting the use-service-account-credentials value lowers the attack surface by\ngenerating unique service accounts settings for each controller instance.",
          "descriptions": [
            {
              "data": "The Kubernetes Controller Manager is a background process that embeds\ncore control loops regulating cluster system state through the API Server.\nEvery process executed in a pod has an associated service account. By default,\nservice accounts use the same credentials for authentication. Implementing the\ndefault settings poses a High risk to the Kubernetes Controller Manager.\nSetting the use-service-account-credentials value lowers the attack surface by\ngenerating unique service accounts settings for each controller instance.",
              "label": "default"
            },
            {
              "data": "",
              "label": "rationale"
            },
            {
              "data": "Change to the /etc/kubernetes/manifests directory on the Kubernetes Master\nNode. Run the command:\n\n    grep -i use-service-account-credentials *\n\n    If the setting use-service-account-credential is not configured in the\nKubernetes Controller Manager manifest file or it is set to \"false\", this is\na finding.",
              "label": "check"
            },
            {
              "data": "Edit the Kubernetes Controller Manager manifest file in the\n/etc/kubernetes/manifests directory on the Kubernetes Master Node. Set the\nvalue of \"use-service-account-credentials\" to \"true\".",
              "label": "fix"
            }
          ],
          "id": "V-242381",
          "impact": 0.7,
          "refs": [],
          "results": [
            {
              "code_desc": "Process arguments for k3s server use-service-account-credentials is expected to cmp == \"true\"",
              "resource_class": "kube_controller_manager",
              "resource_params": "[]",
              "run_time": 0.007482592,
              "start_time": "2021-06-21T21:25:34-04:00",
              "status": "passed"
            }
          ],
          "source_location": {
            "line": 3,
            "ref": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242381.rb"
          },
          "tags": {
            "cci": ["CCI-000015"],
            "fix_id": "F-45614r712498_fix",
            "gid": "V-242381",
            "gtitle": "SRG-APP-000023-CTR-000055",
            "nist": ["AC-2 (1)"],
            "rid": "SV-242381r712499_rule",
            "severity": "high",
            "stig_id": "CNTR-K8-000220"
          },
          "title": "The Kubernetes Controller Manager must create unique service accounts\nfor each work payload.",
          "waiver_data": {}
        },
        {
          "code": "control 'V-242382' do\n  title \"The Kubernetes API Server must enable Node,RBAC as the authorization\nmode.\"\n  desc  \"To mitigate the risk of unauthorized access to sensitive information\nby entities that have been issued certificates by DoD-approved PKIs, all DoD\nsystems (e.g., networks, web servers, and web portals) must be properly\nconfigured to incorporate access control methods that do not rely solely on the\npossession of a certificate for access. Successful authentication must not\nautomatically give an entity access to an asset or security boundary.\nAuthorization procedures and controls must be implemented to ensure each\nauthenticated entity also has a validated and current authorization.\nAuthorization is the process of determining whether an entity, once\nauthenticated, is permitted to access a specific asset.\n\n    Node,RBAC is the method within Kubernetes to control access of users and\napplications. Kubernetes uses roles to grant authorization API requests made by\nkubelets.\n\n\n  \"\n  desc  'rationale', ''\n  desc  'check', \"\n    Change to the /etc/kubernetes/manifests directory on the Kubernetes Master\nNode. Run the command:\n\n    \\\"grep -i authorization-mode *\\\"\n\n    If the setting \\\"authorization-mode\\\" is not configured in the Kubernetes\nAPI Server manifest file or is not set to \\\"Node,RBAC\\\", this is a finding.\n  \"\n  desc 'fix', \"Edit the Kubernetes API Server manifest file in the\n/etc/kubernetes/manifests directory on the Kubernetes Master Node. Set the\nvalue of \\\"--authorization-mode\\\" to \\\"Node,RBAC\\\".\"\n  impact 0.5\n  tag severity: 'medium'\n  tag gtitle: 'SRG-APP-000033-CTR-000090'\n  tag satisfies: ['SRG-APP-000033-CTR-000090', 'SRG-APP-000033-CTR-000095']\n  tag gid: 'V-242382'\n  tag rid: 'SV-242382r712502_rule'\n  tag stig_id: 'CNTR-K8-000270'\n  tag fix_id: 'F-45615r712501_fix'\n  tag cci: ['CCI-000213']\n  tag nist: ['AC-3']\n\n  unless kube_apiserver.exist?\n    impact 0.0\n    desc 'caveat', 'Kubernetes API Server process is not running on the target.'\n  end\n\n  describe kube_apiserver do\n    its('authorization-mode') { should cmp 'Node,RBAC' }\n  end\nend\n",
          "desc": "To mitigate the risk of unauthorized access to sensitive information\nby entities that have been issued certificates by DoD-approved PKIs, all DoD\nsystems (e.g., networks, web servers, and web portals) must be properly\nconfigured to incorporate access control methods that do not rely solely on the\npossession of a certificate for access. Successful authentication must not\nautomatically give an entity access to an asset or security boundary.\nAuthorization procedures and controls must be implemented to ensure each\nauthenticated entity also has a validated and current authorization.\nAuthorization is the process of determining whether an entity, once\nauthenticated, is permitted to access a specific asset.\n\n    Node,RBAC is the method within Kubernetes to control access of users and\napplications. Kubernetes uses roles to grant authorization API requests made by\nkubelets.",
          "descriptions": [
            {
              "data": "To mitigate the risk of unauthorized access to sensitive information\nby entities that have been issued certificates by DoD-approved PKIs, all DoD\nsystems (e.g., networks, web servers, and web portals) must be properly\nconfigured to incorporate access control methods that do not rely solely on the\npossession of a certificate for access. Successful authentication must not\nautomatically give an entity access to an asset or security boundary.\nAuthorization procedures and controls must be implemented to ensure each\nauthenticated entity also has a validated and current authorization.\nAuthorization is the process of determining whether an entity, once\nauthenticated, is permitted to access a specific asset.\n\n    Node,RBAC is the method within Kubernetes to control access of users and\napplications. Kubernetes uses roles to grant authorization API requests made by\nkubelets.",
              "label": "default"
            },
            {
              "data": "",
              "label": "rationale"
            },
            {
              "data": "Change to the /etc/kubernetes/manifests directory on the Kubernetes Master\nNode. Run the command:\n\n    \"grep -i authorization-mode *\"\n\n    If the setting \"authorization-mode\" is not configured in the Kubernetes\nAPI Server manifest file or is not set to \"Node,RBAC\", this is a finding.",
              "label": "check"
            },
            {
              "data": "Edit the Kubernetes API Server manifest file in the\n/etc/kubernetes/manifests directory on the Kubernetes Master Node. Set the\nvalue of \"--authorization-mode\" to \"Node,RBAC\".",
              "label": "fix"
            }
          ],
          "id": "V-242382",
          "impact": 0.5,
          "refs": [],
          "results": [
            {
              "code_desc": "Process arguments for k3s server authorization-mode is expected to cmp == \"Node,RBAC\"",
              "resource_class": "kube_apiserver",
              "resource_params": "[]",
              "run_time": 0.007873657,
              "start_time": "2021-06-21T21:25:34-04:00",
              "status": "passed"
            }
          ],
          "source_location": {
            "line": 3,
            "ref": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242382.rb"
          },
          "tags": {
            "cci": ["CCI-000213"],
            "fix_id": "F-45615r712501_fix",
            "gid": "V-242382",
            "gtitle": "SRG-APP-000033-CTR-000090",
            "nist": ["AC-3"],
            "rid": "SV-242382r712502_rule",
            "satisfies": [
              "SRG-APP-000033-CTR-000090",
              "SRG-APP-000033-CTR-000095"
            ],
            "severity": "medium",
            "stig_id": "CNTR-K8-000270"
          },
          "title": "The Kubernetes API Server must enable Node,RBAC as the authorization\nmode.",
          "waiver_data": {}
        },
        {
          "code": "control 'V-242384' do\n  title 'The Kubernetes Scheduler must have secure binding.'\n  desc  \"Limiting the number of attack vectors and implementing authentication\nand encryption on the endpoints available to external sources is paramount when\nsecuring the overall Kubernetes cluster. The Scheduler API service exposes port\n10251/TCP by default for health and metrics information use. This port does not\nencrypt or authenticate connections. If this port is exposed externally, an\nattacker can use this port to attack the entire Kubernetes cluster. By setting\nthe bind address to localhost (i.e., 127.0.0.1), only those internal services\nthat require health and metrics information can access the Scheduler API.\"\n  desc  'rationale', ''\n  desc  'check', \"\n    Change to the /etc/kubernetes/manifests directory on the Kubernetes Master\nNode. Run the command:\n\n    grep -i bind-address *\n\n    If the setting \\\"bind-address\\\" is not set to \\\"127.0.0.1\\\" or is not found\nin the Kubernetes Scheduler manifest file, this is a finding.\n  \"\n  desc 'fix', \"Edit the Kubernetes Scheduler manifest file in the\n/etc/kubernetes/manifests directory on the Kubernetes Master Node. Set the\nargument \\\"--bind-address\\\" to \\\"127.0.0.1\\\".\"\n  impact 0.5\n  tag severity: 'medium'\n  tag gtitle: 'SRG-APP-000033-CTR-000090'\n  tag gid: 'V-242384'\n  tag rid: 'SV-242384r712508_rule'\n  tag stig_id: 'CNTR-K8-000300'\n  tag fix_id: 'F-45617r712507_fix'\n  tag cci: ['CCI-000213']\n  tag nist: ['AC-3']\n\n  unless kube_scheduler.exist?\n    impact 0.0\n    desc 'caveat', 'Kubernetes Scheduler process is not running on the target.'\n  end\n\n  describe kube_scheduler do\n    its('bind-address') { should cmp '127.0.0.1' }\n  end\nend\n",
          "desc": "Limiting the number of attack vectors and implementing authentication\nand encryption on the endpoints available to external sources is paramount when\nsecuring the overall Kubernetes cluster. The Scheduler API service exposes port\n10251/TCP by default for health and metrics information use. This port does not\nencrypt or authenticate connections. If this port is exposed externally, an\nattacker can use this port to attack the entire Kubernetes cluster. By setting\nthe bind address to localhost (i.e., 127.0.0.1), only those internal services\nthat require health and metrics information can access the Scheduler API.",
          "descriptions": [
            {
              "data": "Limiting the number of attack vectors and implementing authentication\nand encryption on the endpoints available to external sources is paramount when\nsecuring the overall Kubernetes cluster. The Scheduler API service exposes port\n10251/TCP by default for health and metrics information use. This port does not\nencrypt or authenticate connections. If this port is exposed externally, an\nattacker can use this port to attack the entire Kubernetes cluster. By setting\nthe bind address to localhost (i.e., 127.0.0.1), only those internal services\nthat require health and metrics information can access the Scheduler API.",
              "label": "default"
            },
            {
              "data": "",
              "label": "rationale"
            },
            {
              "data": "Change to the /etc/kubernetes/manifests directory on the Kubernetes Master\nNode. Run the command:\n\n    grep -i bind-address *\n\n    If the setting \"bind-address\" is not set to \"127.0.0.1\" or is not found\nin the Kubernetes Scheduler manifest file, this is a finding.",
              "label": "check"
            },
            {
              "data": "Edit the Kubernetes Scheduler manifest file in the\n/etc/kubernetes/manifests directory on the Kubernetes Master Node. Set the\nargument \"--bind-address\" to \"127.0.0.1\".",
              "label": "fix"
            }
          ],
          "id": "V-242384",
          "impact": 0.5,
          "refs": [],
          "results": [
            {
              "code_desc": "Process arguments for k3s server bind-address is expected to cmp == \"127.0.0.1\"",
              "resource_class": "kube_scheduler",
              "resource_params": "[]",
              "run_time": 0.007982786,
              "start_time": "2021-06-21T21:25:34-04:00",
              "status": "passed"
            }
          ],
          "source_location": {
            "line": 3,
            "ref": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242384.rb"
          },
          "tags": {
            "cci": ["CCI-000213"],
            "fix_id": "F-45617r712507_fix",
            "gid": "V-242384",
            "gtitle": "SRG-APP-000033-CTR-000090",
            "nist": ["AC-3"],
            "rid": "SV-242384r712508_rule",
            "severity": "medium",
            "stig_id": "CNTR-K8-000300"
          },
          "title": "The Kubernetes Scheduler must have secure binding.",
          "waiver_data": {}
        },
        {
          "code": "control 'V-242385' do\n  title 'The Kubernetes Controller Manager must have secure binding.'\n  desc  \"Limiting the number of attack vectors and implementing authentication\nand encryption on the endpoints available to external sources is paramount when\nsecuring the overall Kubernetes cluster. The Controller Manager API service\nexposes port 10252/TCP by default for health and metrics information use. This\nport does not encrypt or authenticate connections. If this port is exposed\nexternally, an attacker can use this port to attack the entire Kubernetes\ncluster. By setting the bind address to only localhost (i.e., 127.0.0.1), only\nthose internal services that require health and metrics information can access\nthe Control Manager API.\"\n  desc  'rationale', ''\n  desc  'check', \"\n    Change to the /etc/kubernetes/manifests directory on the Kubernetes Master\nNode. Run the command:\n\n    grep -i bind-address *\n\n    If the setting bind-address is not set to \\\"127.0.0.1\\\" or is not found in\nthe Kubernetes Controller Manager manifest file, this is a finding.\n  \"\n  desc 'fix', \"Edit the Kubernetes Controller Manager manifest file in the\n/etc/kubernetes/manifests directory on the Kubernetes Master Node. Set the\nargument \\\"--bind-address\\\" to \\\"127.0.0.1\\\".\"\n  impact 0.5\n  tag severity: 'medium'\n  tag gtitle: 'SRG-APP-000033-CTR-000090'\n  tag gid: 'V-242385'\n  tag rid: 'SV-242385r712511_rule'\n  tag stig_id: 'CNTR-K8-000310'\n  tag fix_id: 'F-45618r712510_fix'\n  tag cci: ['CCI-000213']\n  tag nist: ['AC-3']\n\n  unless kube_controller_manager.exist?\n    impact 0.0\n    desc 'caveat', 'Kubernetes Controller Manager process is not running on the target.'\n  end\n\n  describe kube_controller_manager do\n    its('bind-address') { should cmp '127.0.0.1' }\n  end\nend\n",
          "desc": "Limiting the number of attack vectors and implementing authentication\nand encryption on the endpoints available to external sources is paramount when\nsecuring the overall Kubernetes cluster. The Controller Manager API service\nexposes port 10252/TCP by default for health and metrics information use. This\nport does not encrypt or authenticate connections. If this port is exposed\nexternally, an attacker can use this port to attack the entire Kubernetes\ncluster. By setting the bind address to only localhost (i.e., 127.0.0.1), only\nthose internal services that require health and metrics information can access\nthe Control Manager API.",
          "descriptions": [
            {
              "data": "Limiting the number of attack vectors and implementing authentication\nand encryption on the endpoints available to external sources is paramount when\nsecuring the overall Kubernetes cluster. The Controller Manager API service\nexposes port 10252/TCP by default for health and metrics information use. This\nport does not encrypt or authenticate connections. If this port is exposed\nexternally, an attacker can use this port to attack the entire Kubernetes\ncluster. By setting the bind address to only localhost (i.e., 127.0.0.1), only\nthose internal services that require health and metrics information can access\nthe Control Manager API.",
              "label": "default"
            },
            {
              "data": "",
              "label": "rationale"
            },
            {
              "data": "Change to the /etc/kubernetes/manifests directory on the Kubernetes Master\nNode. Run the command:\n\n    grep -i bind-address *\n\n    If the setting bind-address is not set to \"127.0.0.1\" or is not found in\nthe Kubernetes Controller Manager manifest file, this is a finding.",
              "label": "check"
            },
            {
              "data": "Edit the Kubernetes Controller Manager manifest file in the\n/etc/kubernetes/manifests directory on the Kubernetes Master Node. Set the\nargument \"--bind-address\" to \"127.0.0.1\".",
              "label": "fix"
            }
          ],
          "id": "V-242385",
          "impact": 0.5,
          "refs": [],
          "results": [
            {
              "code_desc": "Process arguments for k3s server bind-address is expected to cmp == \"127.0.0.1\"",
              "resource_class": "kube_controller_manager",
              "resource_params": "[]",
              "run_time": 0.026740434,
              "start_time": "2021-06-21T21:25:34-04:00",
              "status": "passed"
            }
          ],
          "source_location": {
            "line": 3,
            "ref": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242385.rb"
          },
          "tags": {
            "cci": ["CCI-000213"],
            "fix_id": "F-45618r712510_fix",
            "gid": "V-242385",
            "gtitle": "SRG-APP-000033-CTR-000090",
            "nist": ["AC-3"],
            "rid": "SV-242385r712511_rule",
            "severity": "medium",
            "stig_id": "CNTR-K8-000310"
          },
          "title": "The Kubernetes Controller Manager must have secure binding.",
          "waiver_data": {}
        },
        {
          "code": "control 'V-242386' do\n  title 'The Kubernetes API server must have the insecure port flag disabled.'\n  desc  \"By default, the API server will listen on two ports. One port is the\nsecure port and the other port is called the \\\"localhost port\\\". This port is\nalso called the \\\"insecure port\\\", port 8080. Any requests to this port bypass\nauthentication and authorization checks. If this port is left open, anyone who\ngains access to the host on which the master is running can bypass all\nauthorization and authentication mechanisms put in place, and have full control\nover the entire cluster.\n\n    Close the insecure port by setting the API server's --insecure-port flag to\n\\\"0\\\", ensuring that the --insecure-bind-address is not set.\n  \"\n  desc  'rationale', ''\n  desc  'check', \"\n    Change to the /etc/kubernetes/manifests directory on the Kubernetes Master\nNode. Run the command:\n\n    grep -i insecure-port *\n\n    If the setting insecure-port is not set to \\\"0\\\" or is not configured in\nthe Kubernetes API server manifest file, this is a finding.\n  \"\n  desc 'fix', \"Edit the Kubernetes API Server manifest file in the\n/etc/kubernetes/manifests directory on the Kubernetes Master Node. Set the\nargument --insecure-port to \\\"0\\\".\"\n  impact 0.7\n  tag severity: 'high'\n  tag gtitle: 'SRG-APP-000033-CTR-000095'\n  tag gid: 'V-242386'\n  tag rid: 'SV-242386r712514_rule'\n  tag stig_id: 'CNTR-K8-000320'\n  tag fix_id: 'F-45619r712513_fix'\n  tag cci: ['CCI-000213']\n  tag nist: ['AC-3']\n\n  unless kube_apiserver.exist?\n    impact 0.0\n    desc 'caveat', 'Kubernetes API Server process is not running on the target.'\n  end\n\n  describe kube_apiserver do\n    its('insecure-port') { should cmp '0' }\n  end\nend\n",
          "desc": "By default, the API server will listen on two ports. One port is the\nsecure port and the other port is called the \"localhost port\". This port is\nalso called the \"insecure port\", port 8080. Any requests to this port bypass\nauthentication and authorization checks. If this port is left open, anyone who\ngains access to the host on which the master is running can bypass all\nauthorization and authentication mechanisms put in place, and have full control\nover the entire cluster.\n\n    Close the insecure port by setting the API server's --insecure-port flag to\n\"0\", ensuring that the --insecure-bind-address is not set.",
          "descriptions": [
            {
              "data": "By default, the API server will listen on two ports. One port is the\nsecure port and the other port is called the \"localhost port\". This port is\nalso called the \"insecure port\", port 8080. Any requests to this port bypass\nauthentication and authorization checks. If this port is left open, anyone who\ngains access to the host on which the master is running can bypass all\nauthorization and authentication mechanisms put in place, and have full control\nover the entire cluster.\n\n    Close the insecure port by setting the API server's --insecure-port flag to\n\"0\", ensuring that the --insecure-bind-address is not set.",
              "label": "default"
            },
            {
              "data": "",
              "label": "rationale"
            },
            {
              "data": "Change to the /etc/kubernetes/manifests directory on the Kubernetes Master\nNode. Run the command:\n\n    grep -i insecure-port *\n\n    If the setting insecure-port is not set to \"0\" or is not configured in\nthe Kubernetes API server manifest file, this is a finding.",
              "label": "check"
            },
            {
              "data": "Edit the Kubernetes API Server manifest file in the\n/etc/kubernetes/manifests directory on the Kubernetes Master Node. Set the\nargument --insecure-port to \"0\".",
              "label": "fix"
            }
          ],
          "id": "V-242386",
          "impact": 0.7,
          "refs": [],
          "results": [
            {
              "code_desc": "Process arguments for k3s server insecure-port is expected to cmp == \"0\"",
              "resource_class": "kube_apiserver",
              "resource_params": "[]",
              "run_time": 0.006939178,
              "start_time": "2021-06-21T21:25:34-04:00",
              "status": "passed"
            }
          ],
          "source_location": {
            "line": 3,
            "ref": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242386.rb"
          },
          "tags": {
            "cci": ["CCI-000213"],
            "fix_id": "F-45619r712513_fix",
            "gid": "V-242386",
            "gtitle": "SRG-APP-000033-CTR-000095",
            "nist": ["AC-3"],
            "rid": "SV-242386r712514_rule",
            "severity": "high",
            "stig_id": "CNTR-K8-000320"
          },
          "title": "The Kubernetes API server must have the insecure port flag disabled.",
          "waiver_data": {}
        },
        {
          "code": "control 'V-242387' do\n  title 'The Kubernetes Kubelet must have the read-only port flag disabled.'\n  desc  \"Kubelet serves a small REST API with read access to port 10255. The\nread-only port for Kubernetes provides no authentication or authorization\nsecurity control. Providing unrestricted access on port 10255 exposes\nKubernetes pods and containers to malicious attacks or compromise. Port 10255\nis deprecated and should be disabled.\n\n    Close the read-only-port by setting the API server's read-only port flag to\n\\\"0\\\".\n  \"\n  desc  'rationale', ''\n  desc  'check', \"\n    Run the following command on each Worker Node:\n    ps -ef | grep kubelet\n\n    Verify that the --read-only-port argument exists and is set to \\\"0\\\".\n\n    If the --read-only-port argument exists and is not set to \\\"0\\\", this is a\nfinding.\n\n    If the --read-only-port argument does not exist, check the Master Node\nKubelet config file.\n\n    On the Kubernetes Master Node, run the command:\n    ps -ef | grep kubelet\n    (path identified by: --config)\n\n    Verify there is a readOnlyPort entry in the config file and it is set to\n\\\"0\\\".\n\n    If the --read-only-port argument exists and is not set to \\\"0\\\" this is a\nfinding.\n\n    If \\\"--read-only-port=0\\\" argument does not exist on the worker node and\nthe master node, this is a finding.\n  \"\n  desc 'fix', \"\n    Edit the Kubernetes Kubelet file in the --config directory on the\nKubernetes Master Node. Set the argument --read-only-port to 0.\n\n    Reset Kubelet service using the following command:\n    service kubelet restart\n\n    If using worker node arguments, edit the kubelet service file\n/usr/lib/systemd/system/kubelet.service.d/10-kubeadm.conf on each Worker Node:\nset the parameter in KUBELET_SYSTEM_PODS_ARGS variable to\n\\\"--read-only-port=0\\\".\n  \"\n  impact 0.7\n  tag severity: 'high'\n  tag gtitle: 'SRG-APP-000033-CTR-000095'\n  tag gid: 'V-242387'\n  tag rid: 'SV-242387r717013_rule'\n  tag stig_id: 'CNTR-K8-000330'\n  tag fix_id: 'F-45620r717012_fix'\n  tag cci: ['CCI-000213']\n  tag nist: ['AC-3']\n\n  describe.one do\n    describe kubelet do\n      its('read-only-port') { should cmp 0 }\n    end\n\n    describe kubelet_config_file do\n      its('readOnlyPort') { should cmp 0 }\n    end\n  end\nend\n",
          "desc": "Kubelet serves a small REST API with read access to port 10255. The\nread-only port for Kubernetes provides no authentication or authorization\nsecurity control. Providing unrestricted access on port 10255 exposes\nKubernetes pods and containers to malicious attacks or compromise. Port 10255\nis deprecated and should be disabled.\n\n    Close the read-only-port by setting the API server's read-only port flag to\n\"0\".",
          "descriptions": [
            {
              "data": "Kubelet serves a small REST API with read access to port 10255. The\nread-only port for Kubernetes provides no authentication or authorization\nsecurity control. Providing unrestricted access on port 10255 exposes\nKubernetes pods and containers to malicious attacks or compromise. Port 10255\nis deprecated and should be disabled.\n\n    Close the read-only-port by setting the API server's read-only port flag to\n\"0\".",
              "label": "default"
            },
            {
              "data": "",
              "label": "rationale"
            },
            {
              "data": "Run the following command on each Worker Node:\n    ps -ef | grep kubelet\n\n    Verify that the --read-only-port argument exists and is set to \"0\".\n\n    If the --read-only-port argument exists and is not set to \"0\", this is a\nfinding.\n\n    If the --read-only-port argument does not exist, check the Master Node\nKubelet config file.\n\n    On the Kubernetes Master Node, run the command:\n    ps -ef | grep kubelet\n    (path identified by: --config)\n\n    Verify there is a readOnlyPort entry in the config file and it is set to\n\"0\".\n\n    If the --read-only-port argument exists and is not set to \"0\" this is a\nfinding.\n\n    If \"--read-only-port=0\" argument does not exist on the worker node and\nthe master node, this is a finding.",
              "label": "check"
            },
            {
              "data": "Edit the Kubernetes Kubelet file in the --config directory on the\nKubernetes Master Node. Set the argument --read-only-port to 0.\n\n    Reset Kubelet service using the following command:\n    service kubelet restart\n\n    If using worker node arguments, edit the kubelet service file\n/usr/lib/systemd/system/kubelet.service.d/10-kubeadm.conf on each Worker Node:\nset the parameter in KUBELET_SYSTEM_PODS_ARGS variable to\n\"--read-only-port=0\".",
              "label": "fix"
            }
          ],
          "id": "V-242387",
          "impact": 0.7,
          "refs": [],
          "results": [
            {
              "code_desc": "Process arguments for k3s read-only-port is expected to cmp == 0",
              "resource_class": "kubelet",
              "resource_params": "[]",
              "run_time": 0.000165479,
              "start_time": "2021-06-21T21:25:34-04:00",
              "status": "passed"
            }
          ],
          "source_location": {
            "line": 3,
            "ref": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242387.rb"
          },
          "tags": {
            "cci": ["CCI-000213"],
            "fix_id": "F-45620r717012_fix",
            "gid": "V-242387",
            "gtitle": "SRG-APP-000033-CTR-000095",
            "nist": ["AC-3"],
            "rid": "SV-242387r717013_rule",
            "severity": "high",
            "stig_id": "CNTR-K8-000330"
          },
          "title": "The Kubernetes Kubelet must have the read-only port flag disabled.",
          "waiver_data": {}
        },
        {
          "code": "control 'V-242388' do\n  title 'The Kubernetes API server must have the insecure bind address not set.'\n  desc  \"By default, the API server will listen on two ports and addresses. One\naddress is the secure address and the other address is called the \\\"insecure\nbind\\\" address and is set by default to localhost. Any requests to this address\nbypass authentication and authorization checks. If this insecure bind address\nis set to localhost, anyone who gains access to the host on which the master is\nrunning can bypass all authorization and authentication mechanisms put in place\nand have full control over the entire cluster.\n\n    Close or set the insecure bind address by setting the API server's\n--insecure-bind-address flag to an IP or leave it unset and ensure that the\n--insecure-bind-port is not set.\n  \"\n  desc  'rationale', ''\n  desc  'check', \"\n    Change to the /etc/kubernetes/manifests directory on the Kubernetes Master\nNode. Run the command:\n\n    grep -i insecure-bind-address *\n\n    If the setting insecure-bind-address is found and set to \\\"localhost\\\" in\nthe Kubernetes API manifest file, this is a finding.\n  \"\n  desc 'fix', \"Edit the Kubernetes API Server manifest file in the\n/etc/kubernetes/manifests directory on the Kubernetes Master Node. Remove the\nvalue for the --insecure-bind-address setting.\"\n  impact 0.7\n  tag severity: 'high'\n  tag gtitle: 'SRG-APP-000033-CTR-000095'\n  tag gid: 'V-242388'\n  tag rid: 'SV-242388r712520_rule'\n  tag stig_id: 'CNTR-K8-000340'\n  tag fix_id: 'F-45621r712519_fix'\n  tag cci: ['CCI-000213']\n  tag nist: ['AC-3']\n\n  unless kube_apiserver.exist?\n    impact 0.0\n    desc 'caveat', 'Kubernetes API Server process is not running on the target.'\n  end\n\n  describe kube_apiserver do\n    its('insecure-bind-address') { should be_nil }\n  end\nend\n",
          "desc": "By default, the API server will listen on two ports and addresses. One\naddress is the secure address and the other address is called the \"insecure\nbind\" address and is set by default to localhost. Any requests to this address\nbypass authentication and authorization checks. If this insecure bind address\nis set to localhost, anyone who gains access to the host on which the master is\nrunning can bypass all authorization and authentication mechanisms put in place\nand have full control over the entire cluster.\n\n    Close or set the insecure bind address by setting the API server's\n--insecure-bind-address flag to an IP or leave it unset and ensure that the\n--insecure-bind-port is not set.",
          "descriptions": [
            {
              "data": "By default, the API server will listen on two ports and addresses. One\naddress is the secure address and the other address is called the \"insecure\nbind\" address and is set by default to localhost. Any requests to this address\nbypass authentication and authorization checks. If this insecure bind address\nis set to localhost, anyone who gains access to the host on which the master is\nrunning can bypass all authorization and authentication mechanisms put in place\nand have full control over the entire cluster.\n\n    Close or set the insecure bind address by setting the API server's\n--insecure-bind-address flag to an IP or leave it unset and ensure that the\n--insecure-bind-port is not set.",
              "label": "default"
            },
            {
              "data": "",
              "label": "rationale"
            },
            {
              "data": "Change to the /etc/kubernetes/manifests directory on the Kubernetes Master\nNode. Run the command:\n\n    grep -i insecure-bind-address *\n\n    If the setting insecure-bind-address is found and set to \"localhost\" in\nthe Kubernetes API manifest file, this is a finding.",
              "label": "check"
            },
            {
              "data": "Edit the Kubernetes API Server manifest file in the\n/etc/kubernetes/manifests directory on the Kubernetes Master Node. Remove the\nvalue for the --insecure-bind-address setting.",
              "label": "fix"
            }
          ],
          "id": "V-242388",
          "impact": 0.7,
          "refs": [],
          "results": [
            {
              "code_desc": "Process arguments for k3s server insecure-bind-address is expected to be nil",
              "resource_class": "kube_apiserver",
              "resource_params": "[]",
              "run_time": 0.006989367,
              "start_time": "2021-06-21T21:25:34-04:00",
              "status": "passed"
            }
          ],
          "source_location": {
            "line": 3,
            "ref": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242388.rb"
          },
          "tags": {
            "cci": ["CCI-000213"],
            "fix_id": "F-45621r712519_fix",
            "gid": "V-242388",
            "gtitle": "SRG-APP-000033-CTR-000095",
            "nist": ["AC-3"],
            "rid": "SV-242388r712520_rule",
            "severity": "high",
            "stig_id": "CNTR-K8-000340"
          },
          "title": "The Kubernetes API server must have the insecure bind address not set.",
          "waiver_data": {}
        },
        {
          "code": "control 'V-242389' do\n  title 'The Kubernetes API server must have the secure port set.'\n  desc  \"By default, the API server will listen on what is rightfully called\nthe secure port, port 6443. Any requests to this port will perform\nauthentication and authorization checks. If this port is disabled, anyone who\ngains access to the host on which the master is running has full control of the\nentire cluster over encrypted traffic.\n\n    Open the secure port by setting the API server's --secure-port flag to a\nvalue other than \\\"0\\\".\n  \"\n  desc  'rationale', ''\n  desc  'check', \"\n    Change to the /etc/kubernetes/manifests directory on the Kubernetes Master\nNode. Run the command:\n\n    grep -i secure-port *\n\n    If the setting secure-port is set to \\\"0\\\" or is not configured in the\nKubernetes API manifest file, this is a finding.\n  \"\n  desc 'fix', \"Edit the Kubernetes API Server manifest file in the\n/etc/kubernetes/manifests directory on the Kubernetes Master Node. Set the\nargument --secure-port to a value greater than \\\"0\\\".\"\n  impact 0.5\n  tag severity: 'medium'\n  tag gtitle: 'SRG-APP-000033-CTR-000100'\n  tag gid: 'V-242389'\n  tag rid: 'SV-242389r712523_rule'\n  tag stig_id: 'CNTR-K8-000350'\n  tag fix_id: 'F-45622r712522_fix'\n  tag cci: ['CCI-000213']\n  tag nist: ['AC-3']\n\n  unless kube_apiserver.exist?\n    impact 0.0\n    desc 'caveat', 'Kubernetes API Server process is not running on the target.'\n  end\n\n  describe kube_apiserver do\n    its('secure-port') { should cmp > 0 }\n  end\nend\n",
          "desc": "By default, the API server will listen on what is rightfully called\nthe secure port, port 6443. Any requests to this port will perform\nauthentication and authorization checks. If this port is disabled, anyone who\ngains access to the host on which the master is running has full control of the\nentire cluster over encrypted traffic.\n\n    Open the secure port by setting the API server's --secure-port flag to a\nvalue other than \"0\".",
          "descriptions": [
            {
              "data": "By default, the API server will listen on what is rightfully called\nthe secure port, port 6443. Any requests to this port will perform\nauthentication and authorization checks. If this port is disabled, anyone who\ngains access to the host on which the master is running has full control of the\nentire cluster over encrypted traffic.\n\n    Open the secure port by setting the API server's --secure-port flag to a\nvalue other than \"0\".",
              "label": "default"
            },
            {
              "data": "",
              "label": "rationale"
            },
            {
              "data": "Change to the /etc/kubernetes/manifests directory on the Kubernetes Master\nNode. Run the command:\n\n    grep -i secure-port *\n\n    If the setting secure-port is set to \"0\" or is not configured in the\nKubernetes API manifest file, this is a finding.",
              "label": "check"
            },
            {
              "data": "Edit the Kubernetes API Server manifest file in the\n/etc/kubernetes/manifests directory on the Kubernetes Master Node. Set the\nargument --secure-port to a value greater than \"0\".",
              "label": "fix"
            }
          ],
          "id": "V-242389",
          "impact": 0.5,
          "refs": [],
          "results": [
            {
              "code_desc": "Process arguments for k3s server secure-port is expected to cmp > 0",
              "resource_class": "kube_apiserver",
              "resource_params": "[]",
              "run_time": 0.007335723,
              "start_time": "2021-06-21T21:25:34-04:00",
              "status": "passed"
            }
          ],
          "source_location": {
            "line": 3,
            "ref": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242389.rb"
          },
          "tags": {
            "cci": ["CCI-000213"],
            "fix_id": "F-45622r712522_fix",
            "gid": "V-242389",
            "gtitle": "SRG-APP-000033-CTR-000100",
            "nist": ["AC-3"],
            "rid": "SV-242389r712523_rule",
            "severity": "medium",
            "stig_id": "CNTR-K8-000350"
          },
          "title": "The Kubernetes API server must have the secure port set.",
          "waiver_data": {}
        },
        {
          "code": "control 'V-242390' do\n  title 'The Kubernetes API server must have anonymous authentication disabled.'\n  desc  \"The Kubernetes API Server controls Kubernetes via an API interface. A\nuser who has access to the API essentially has root access to the entire\nKubernetes cluster. To control access, users must be authenticated and\nauthorized. By allowing anonymous connections, the controls put in place to\nsecure the API can be bypassed.\n\n    Setting anonymous authentication to \\\"false\\\" also disables unauthenticated\nrequests from kubelets.\n\n    While there are instances where anonymous connections may be needed (e.g.,\nhealth checks) and Role-Based Access Controls (RBAC) are in place to limit the\nanonymous access, this access should be disabled, and only enabled when\nnecessary.\n  \"\n  desc  'rationale', ''\n  desc  'check', \"\n    Change to the /etc/kubernetes/manifests directory on the Kubernetes Master\nNode. Run the command:\n\n    grep -i anonymous-auth *\n\n    If the setting anonymous-auth is set to \\\"true\\\" in the Kubernetes API\nServer manifest file, this is a finding.\n  \"\n  desc 'fix', \"Edit the Kubernetes API Server manifest file in the\n/etc/kubernetes/manifests directory on the Kubernetes Master Node. Set the\nargument --anonymous-auth to \\\"false\\\".\"\n  impact 0.7\n  tag severity: 'high'\n  tag gtitle: 'SRG-APP-000033-CTR-000100'\n  tag gid: 'V-242390'\n  tag rid: 'SV-242390r712526_rule'\n  tag stig_id: 'CNTR-K8-000360'\n  tag fix_id: 'F-45623r712525_fix'\n  tag cci: ['CCI-000213']\n  tag nist: ['AC-3']\n\n  unless kube_apiserver.exist?\n    impact 0.0\n    desc 'caveat', 'Kubernetes API Server process is not running on the target.'\n  end\n\n  describe kube_apiserver do\n    its('anonymous-auth') { should_not cmp 'true' }\n  end\nend\n",
          "desc": "The Kubernetes API Server controls Kubernetes via an API interface. A\nuser who has access to the API essentially has root access to the entire\nKubernetes cluster. To control access, users must be authenticated and\nauthorized. By allowing anonymous connections, the controls put in place to\nsecure the API can be bypassed.\n\n    Setting anonymous authentication to \"false\" also disables unauthenticated\nrequests from kubelets.\n\n    While there are instances where anonymous connections may be needed (e.g.,\nhealth checks) and Role-Based Access Controls (RBAC) are in place to limit the\nanonymous access, this access should be disabled, and only enabled when\nnecessary.",
          "descriptions": [
            {
              "data": "The Kubernetes API Server controls Kubernetes via an API interface. A\nuser who has access to the API essentially has root access to the entire\nKubernetes cluster. To control access, users must be authenticated and\nauthorized. By allowing anonymous connections, the controls put in place to\nsecure the API can be bypassed.\n\n    Setting anonymous authentication to \"false\" also disables unauthenticated\nrequests from kubelets.\n\n    While there are instances where anonymous connections may be needed (e.g.,\nhealth checks) and Role-Based Access Controls (RBAC) are in place to limit the\nanonymous access, this access should be disabled, and only enabled when\nnecessary.",
              "label": "default"
            },
            {
              "data": "",
              "label": "rationale"
            },
            {
              "data": "Change to the /etc/kubernetes/manifests directory on the Kubernetes Master\nNode. Run the command:\n\n    grep -i anonymous-auth *\n\n    If the setting anonymous-auth is set to \"true\" in the Kubernetes API\nServer manifest file, this is a finding.",
              "label": "check"
            },
            {
              "data": "Edit the Kubernetes API Server manifest file in the\n/etc/kubernetes/manifests directory on the Kubernetes Master Node. Set the\nargument --anonymous-auth to \"false\".",
              "label": "fix"
            }
          ],
          "id": "V-242390",
          "impact": 0.7,
          "refs": [],
          "results": [
            {
              "code_desc": "Process arguments for k3s server anonymous-auth is expected not to cmp == \"true\"",
              "resource_class": "kube_apiserver",
              "resource_params": "[]",
              "run_time": 0.007649778,
              "start_time": "2021-06-21T21:25:34-04:00",
              "status": "passed"
            }
          ],
          "source_location": {
            "line": 3,
            "ref": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242390.rb"
          },
          "tags": {
            "cci": ["CCI-000213"],
            "fix_id": "F-45623r712525_fix",
            "gid": "V-242390",
            "gtitle": "SRG-APP-000033-CTR-000100",
            "nist": ["AC-3"],
            "rid": "SV-242390r712526_rule",
            "severity": "high",
            "stig_id": "CNTR-K8-000360"
          },
          "title": "The Kubernetes API server must have anonymous authentication disabled.",
          "waiver_data": {}
        },
        {
          "code": "control 'V-242391' do\n  title 'The Kubernetes Kubelet must have anonymous authentication disabled.'\n  desc  \"A user who has access to the Kubelet essentially has root access to\nthe nodes contained within the Kubernetes Control Plane. To control access,\nusers must be authenticated and authorized. By allowing anonymous connections,\nthe controls put in place to secure the Kubelet can be bypassed.\n\n    Setting anonymous authentication to \\\"false\\\" also disables unauthenticated\nrequests from kubelets.\n\n    While there are instances where anonymous connections may be needed (e.g.,\nhealth checks) and Role-Based Access Controls (RBAC) are in place to limit the\nanonymous access, this access must be disabled and only enabled when necessary.\n  \"\n  desc  'rationale', ''\n  desc  'check', \"\n    Change to the /etc/sysconfig/ directory on the Kubernetes Master Node. Run\nthe command:\n\n    grep -i anonymous-auth kubelet\n\n    If the setting \\\"anonymous-auth\\\" is set to \\\"true\\\" or the parameter not\nset in the Kubernetes Kubelet configuration file, this is a finding.\n  \"\n  desc 'fix', \"\n    Edit the Kubernetes Kubelet file in the/etc/sysconfig/ directory on the\nKubernetes Master Node.\n\n    Set the argument \\\"--anonymous-auth\\\" to \\\"false\\\".\n\n    Restart kubelet service using command:\n    service kubelet restart\n  \"\n  impact 0.7\n  tag severity: 'high'\n  tag gtitle: 'SRG-APP-000033-CTR-000090'\n  tag gid: 'V-242391'\n  tag rid: 'SV-242391r712529_rule'\n  tag stig_id: 'CNTR-K8-000370'\n  tag fix_id: 'F-45624r712528_fix'\n  tag cci: ['CCI-000213']\n  tag nist: ['AC-3']\n\n  describe.one do\n    describe kubelet do\n      its('anonymous-auth') { should cmp 'false' }\n    end\n\n    describe kubelet_config_file do\n      its(%w(authentication anonymous enabled)) { should cmp 'false' }\n    end\n  end\nend\n",
          "desc": "A user who has access to the Kubelet essentially has root access to\nthe nodes contained within the Kubernetes Control Plane. To control access,\nusers must be authenticated and authorized. By allowing anonymous connections,\nthe controls put in place to secure the Kubelet can be bypassed.\n\n    Setting anonymous authentication to \"false\" also disables unauthenticated\nrequests from kubelets.\n\n    While there are instances where anonymous connections may be needed (e.g.,\nhealth checks) and Role-Based Access Controls (RBAC) are in place to limit the\nanonymous access, this access must be disabled and only enabled when necessary.",
          "descriptions": [
            {
              "data": "A user who has access to the Kubelet essentially has root access to\nthe nodes contained within the Kubernetes Control Plane. To control access,\nusers must be authenticated and authorized. By allowing anonymous connections,\nthe controls put in place to secure the Kubelet can be bypassed.\n\n    Setting anonymous authentication to \"false\" also disables unauthenticated\nrequests from kubelets.\n\n    While there are instances where anonymous connections may be needed (e.g.,\nhealth checks) and Role-Based Access Controls (RBAC) are in place to limit the\nanonymous access, this access must be disabled and only enabled when necessary.",
              "label": "default"
            },
            {
              "data": "",
              "label": "rationale"
            },
            {
              "data": "Change to the /etc/sysconfig/ directory on the Kubernetes Master Node. Run\nthe command:\n\n    grep -i anonymous-auth kubelet\n\n    If the setting \"anonymous-auth\" is set to \"true\" or the parameter not\nset in the Kubernetes Kubelet configuration file, this is a finding.",
              "label": "check"
            },
            {
              "data": "Edit the Kubernetes Kubelet file in the/etc/sysconfig/ directory on the\nKubernetes Master Node.\n\n    Set the argument \"--anonymous-auth\" to \"false\".\n\n    Restart kubelet service using command:\n    service kubelet restart",
              "label": "fix"
            }
          ],
          "id": "V-242391",
          "impact": 0.7,
          "refs": [],
          "results": [
            {
              "code_desc": "Process arguments for k3s anonymous-auth is expected to cmp == \"false\"",
              "resource_class": "kubelet",
              "resource_params": "[]",
              "run_time": 0.000147507,
              "start_time": "2021-06-21T21:25:34-04:00",
              "status": "passed"
            }
          ],
          "source_location": {
            "line": 3,
            "ref": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242391.rb"
          },
          "tags": {
            "cci": ["CCI-000213"],
            "fix_id": "F-45624r712528_fix",
            "gid": "V-242391",
            "gtitle": "SRG-APP-000033-CTR-000090",
            "nist": ["AC-3"],
            "rid": "SV-242391r712529_rule",
            "severity": "high",
            "stig_id": "CNTR-K8-000370"
          },
          "title": "The Kubernetes Kubelet must have anonymous authentication disabled.",
          "waiver_data": {}
        },
        {
          "code": "control 'V-242392' do\n  title 'The Kubernetes kubelet must enable explicit authorization.'\n  desc  \"Kubelet is the primary agent on each node. The API server communicates\nwith each kubelet to perform tasks such as starting/stopping pods. By default,\nkubelets allow all authenticated requests, even anonymous ones, without\nrequiring any authorization checks from the API server. This default behavior\nbypasses any authorization controls put in place to limit what users may\nperform within the Kubernetes cluster. To change this behavior, the default\nsetting of AlwaysAllow for the authorization mode must be set to \\\"Webhook\\\".\"\n  desc  'rationale', ''\n  desc  'check', \"\n    Change to the /etc/sysconfig/ directory on the Kubernetes Master Node. Run\nthe command:\n\n    grep -i authorization-mode kubelet\n\n    On each Worker node, change to the /etc/sysconfig/ directory. Run the\ncommand:\n\n    grep -i authorization-mode kubelet\n\n    If authorization-mode is missing or is set to \\\"AllowAlways\\\" on the Master\nnode or any of the Worker nodes, this is a finding.\n  \"\n  desc 'fix', \"\n    Edit the Kubernetes Kubelet file in the/etc/sysconfig/ directory on the\nKubernetes Master and Worker nodes.\n\n    Set the argument --authorization-mode to \\\"Webhook\\\".\n\n    Restart each kubelet service after the change is made using the command:\n    service kubelet restart\n  \"\n  impact 0.7\n  tag severity: 'high'\n  tag gtitle: 'SRG-APP-000033-CTR-000095'\n  tag gid: 'V-242392'\n  tag rid: 'SV-242392r712532_rule'\n  tag stig_id: 'CNTR-K8-000380'\n  tag fix_id: 'F-45625r717029_fix'\n  tag cci: ['CCI-000213']\n  tag nist: ['AC-3']\n\n  describe.one do\n    describe kubelet do\n      its('authorization-mode') { should cmp 'Webhook' }\n    end\n\n    describe kubelet_config_file do\n      its(%w(authorization mode)) { should cmp 'Webhook' }\n    end\n  end\nend\n",
          "desc": "Kubelet is the primary agent on each node. The API server communicates\nwith each kubelet to perform tasks such as starting/stopping pods. By default,\nkubelets allow all authenticated requests, even anonymous ones, without\nrequiring any authorization checks from the API server. This default behavior\nbypasses any authorization controls put in place to limit what users may\nperform within the Kubernetes cluster. To change this behavior, the default\nsetting of AlwaysAllow for the authorization mode must be set to \"Webhook\".",
          "descriptions": [
            {
              "data": "Kubelet is the primary agent on each node. The API server communicates\nwith each kubelet to perform tasks such as starting/stopping pods. By default,\nkubelets allow all authenticated requests, even anonymous ones, without\nrequiring any authorization checks from the API server. This default behavior\nbypasses any authorization controls put in place to limit what users may\nperform within the Kubernetes cluster. To change this behavior, the default\nsetting of AlwaysAllow for the authorization mode must be set to \"Webhook\".",
              "label": "default"
            },
            {
              "data": "",
              "label": "rationale"
            },
            {
              "data": "Change to the /etc/sysconfig/ directory on the Kubernetes Master Node. Run\nthe command:\n\n    grep -i authorization-mode kubelet\n\n    On each Worker node, change to the /etc/sysconfig/ directory. Run the\ncommand:\n\n    grep -i authorization-mode kubelet\n\n    If authorization-mode is missing or is set to \"AllowAlways\" on the Master\nnode or any of the Worker nodes, this is a finding.",
              "label": "check"
            },
            {
              "data": "Edit the Kubernetes Kubelet file in the/etc/sysconfig/ directory on the\nKubernetes Master and Worker nodes.\n\n    Set the argument --authorization-mode to \"Webhook\".\n\n    Restart each kubelet service after the change is made using the command:\n    service kubelet restart",
              "label": "fix"
            }
          ],
          "id": "V-242392",
          "impact": 0.7,
          "refs": [],
          "results": [
            {
              "code_desc": "Process arguments for k3s authorization-mode is expected to cmp == \"Webhook\"",
              "resource_class": "kubelet",
              "resource_params": "[]",
              "run_time": 0.000201651,
              "start_time": "2021-06-21T21:25:34-04:00",
              "status": "passed"
            }
          ],
          "source_location": {
            "line": 3,
            "ref": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242392.rb"
          },
          "tags": {
            "cci": ["CCI-000213"],
            "fix_id": "F-45625r717029_fix",
            "gid": "V-242392",
            "gtitle": "SRG-APP-000033-CTR-000095",
            "nist": ["AC-3"],
            "rid": "SV-242392r712532_rule",
            "severity": "high",
            "stig_id": "CNTR-K8-000380"
          },
          "title": "The Kubernetes kubelet must enable explicit authorization.",
          "waiver_data": {}
        },
        {
          "code": "control 'V-242393' do\n  title 'Kubernetes Worker Nodes must not have sshd service running.'\n  desc  \"Worker Nodes are maintained and monitored by the Master Node. Direct\naccess and manipulation of the nodes should not take place by administrators.\nWorker nodes should be treated as immutable and updated via replacement rather\nthan in-place upgrades.\"\n  desc  'rationale', ''\n  desc  'check', \"\n    Log in to each worker node. Verify that the sshd service is not running. To\nvalidate that the service is not running, run the command:\n\n    systemctl status sshd\n\n    If the service sshd is active (running), this is a finding.\n\n    Note: If console access is not available, SSH access can be attempted. If\nthe worker nodes cannot be reached, this requirement is \\\"not a finding\\\".\n  \"\n  desc 'fix', \"\n    To stop the sshd service, run the command:\n\n    systemctl stop sshd\n\n    Note: If access to the worker node is through an SSH session, it is\nimportant to realize there are two requirements for disabling and stopping the\nsshd service and they should be done during the same SSH session. Disabling the\nservice must be performed first and then the service stopped to guarantee both\nsettings can be made if the session is interrupted.\n  \"\n  impact 0.5\n  tag severity: 'medium'\n  tag gtitle: 'SRG-APP-000033-CTR-000095'\n  tag gid: 'V-242393'\n  tag rid: 'SV-242393r717015_rule'\n  tag stig_id: 'CNTR-K8-000400'\n  tag fix_id: 'F-45626r717014_fix'\n  tag cci: ['CCI-000213']\n  tag nist: ['AC-3']\n\n  describe service('sshd') do\n    it { should_not be_running }\n  end\nend\n",
          "desc": "Worker Nodes are maintained and monitored by the Master Node. Direct\naccess and manipulation of the nodes should not take place by administrators.\nWorker nodes should be treated as immutable and updated via replacement rather\nthan in-place upgrades.",
          "descriptions": [
            {
              "data": "Worker Nodes are maintained and monitored by the Master Node. Direct\naccess and manipulation of the nodes should not take place by administrators.\nWorker nodes should be treated as immutable and updated via replacement rather\nthan in-place upgrades.",
              "label": "default"
            },
            {
              "data": "",
              "label": "rationale"
            },
            {
              "data": "Log in to each worker node. Verify that the sshd service is not running. To\nvalidate that the service is not running, run the command:\n\n    systemctl status sshd\n\n    If the service sshd is active (running), this is a finding.\n\n    Note: If console access is not available, SSH access can be attempted. If\nthe worker nodes cannot be reached, this requirement is \"not a finding\".",
              "label": "check"
            },
            {
              "data": "To stop the sshd service, run the command:\n\n    systemctl stop sshd\n\n    Note: If access to the worker node is through an SSH session, it is\nimportant to realize there are two requirements for disabling and stopping the\nsshd service and they should be done during the same SSH session. Disabling the\nservice must be performed first and then the service stopped to guarantee both\nsettings can be made if the session is interrupted.",
              "label": "fix"
            }
          ],
          "id": "V-242393",
          "impact": 0.5,
          "refs": [],
          "results": [
            {
              "code_desc": "Service sshd is expected not to be running",
              "message": "expected Service sshd not to be running",
              "resource_class": "service",
              "resource_params": "[\"sshd\"]",
              "run_time": 0.001617012,
              "start_time": "2021-06-21T21:25:34-04:00",
              "status": "failed"
            }
          ],
          "source_location": {
            "line": 3,
            "ref": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242393.rb"
          },
          "tags": {
            "cci": ["CCI-000213"],
            "fix_id": "F-45626r717014_fix",
            "gid": "V-242393",
            "gtitle": "SRG-APP-000033-CTR-000095",
            "nist": ["AC-3"],
            "rid": "SV-242393r717015_rule",
            "severity": "medium",
            "stig_id": "CNTR-K8-000400"
          },
          "title": "Kubernetes Worker Nodes must not have sshd service running.",
          "waiver_data": {}
        },
        {
          "code": "control 'V-242394' do\n  title 'Kubernetes Worker Nodes must not have the sshd service enabled.'\n  desc  \"Worker Nodes are maintained and monitored by the Master Node. Direct\naccess and manipulation of the nodes must not take place by administrators.\nWorker nodes must be treated as immutable and updated via replacement rather\nthan in-place upgrades.\"\n  desc  'rationale', ''\n  desc  'check', \"\n    Log in to each worker node. Verify that the sshd service is not enabled. To\nvalidate the service is not enabled, run the command:\n\n    systemctl is-enabled sshd.service\n\n    If the service sshd is enabled, this is a finding.\n\n    Note: If console access is not available, SSH access can be attempted. If\nthe worker nodes cannot be reached, this requirement is \\\"not a finding\\\".\n  \"\n  desc 'fix', \"\n    To disable the sshd service, run the command:\n\n    chkconfig sshd off\n\n    Note: If access to the worker node is through an SSH session, it is\nimportant to realize there are two requirements for disabling and stopping the\nsshd service that must be done during the same SSH session. Disabling the\nservice must be performed first and then the service stopped to guarantee both\nsettings can be made if the session is interrupted.\n  \"\n  impact 0.5\n  tag severity: 'medium'\n  tag gtitle: 'SRG-APP-000033-CTR-000095'\n  tag gid: 'V-242394'\n  tag rid: 'SV-242394r717017_rule'\n  tag stig_id: 'CNTR-K8-000410'\n  tag fix_id: 'F-45627r717016_fix'\n  tag cci: ['CCI-000213']\n  tag nist: ['AC-3']\n\n  describe service('sshd') do\n    it { should_not be_enabled }\n  end\nend\n",
          "desc": "Worker Nodes are maintained and monitored by the Master Node. Direct\naccess and manipulation of the nodes must not take place by administrators.\nWorker nodes must be treated as immutable and updated via replacement rather\nthan in-place upgrades.",
          "descriptions": [
            {
              "data": "Worker Nodes are maintained and monitored by the Master Node. Direct\naccess and manipulation of the nodes must not take place by administrators.\nWorker nodes must be treated as immutable and updated via replacement rather\nthan in-place upgrades.",
              "label": "default"
            },
            {
              "data": "",
              "label": "rationale"
            },
            {
              "data": "Log in to each worker node. Verify that the sshd service is not enabled. To\nvalidate the service is not enabled, run the command:\n\n    systemctl is-enabled sshd.service\n\n    If the service sshd is enabled, this is a finding.\n\n    Note: If console access is not available, SSH access can be attempted. If\nthe worker nodes cannot be reached, this requirement is \"not a finding\".",
              "label": "check"
            },
            {
              "data": "To disable the sshd service, run the command:\n\n    chkconfig sshd off\n\n    Note: If access to the worker node is through an SSH session, it is\nimportant to realize there are two requirements for disabling and stopping the\nsshd service that must be done during the same SSH session. Disabling the\nservice must be performed first and then the service stopped to guarantee both\nsettings can be made if the session is interrupted.",
              "label": "fix"
            }
          ],
          "id": "V-242394",
          "impact": 0.5,
          "refs": [],
          "results": [
            {
              "code_desc": "Service sshd is expected not to be enabled",
              "message": "expected Service sshd not to be enabled",
              "resource_class": "service",
              "resource_params": "[\"sshd\"]",
              "run_time": 0.937629732,
              "start_time": "2021-06-21T21:25:33-04:00",
              "status": "failed"
            }
          ],
          "source_location": {
            "line": 3,
            "ref": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242394.rb"
          },
          "tags": {
            "cci": ["CCI-000213"],
            "fix_id": "F-45627r717016_fix",
            "gid": "V-242394",
            "gtitle": "SRG-APP-000033-CTR-000095",
            "nist": ["AC-3"],
            "rid": "SV-242394r717017_rule",
            "severity": "medium",
            "stig_id": "CNTR-K8-000410"
          },
          "title": "Kubernetes Worker Nodes must not have the sshd service enabled.",
          "waiver_data": {}
        },
        {
          "code": "control 'V-242396' do\n  title 'Kubernetes Kubectl cp command must give expected access and results.'\n  desc  \"One of the tools heavily used to interact with containers in the\nKubernetes cluster is kubectl. The command is the tool System Administrators\nused to create, modify, and delete resources. One of the capabilities of the\ntool is to copy files to and from running containers (i.e., kubectl cp). The\ncommand uses the \\\"tar\\\" command of the container to copy files from the\ncontainer to the host executing the \\\"kubectl cp\\\" command. If the \\\"tar\\\"\ncommand on the container has been replaced by a malicious user, the command can\ncopy files anywhere on the host machine. This flaw has been fixed in later\nversions of the tool. It is recommended to use kubectl versions newer than\n1.12.9.\"\n  desc  'rationale', ''\n  desc  'check', \"\n    From the Master and each Worker node, check the version of kubectl by\nexecuting the command:\n\n    kubectl version --client\n\n    If the Master or any Work nodes are not using kubectl version 1.12.9 or\nnewer, this is a finding.\n  \"\n  desc 'fix', \"Upgrade the Master and Worker nodes to the latest version of\nkubectl.\"\n  impact 0.5\n  tag severity: 'medium'\n  tag gtitle: 'SRG-APP-000033-CTR-000090'\n  tag gid: 'V-242396'\n  tag rid: 'SV-242396r712544_rule'\n  tag stig_id: 'CNTR-K8-000430'\n  tag fix_id: 'F-45629r712543_fix'\n  tag cci: ['CCI-000213']\n  tag nist: ['AC-3']\n\n  kubectl = command(input('kubectl_path'))\n\n  kubectl_minversion = input('kubectl_minversion')\n\n  unless kubectl.exist?\n    impact 0.0\n    desc 'caveat', 'kubectl command available on target on the target.'\n\n    describe 'kubectl command not found on target' do\n      skip\n    end\n  end\n\n  if kubectl.exist?\n    describe json(command: \"#{input('kubectl_path')} version --client --output=json\") do\n      its(%w(clientVersion gitVersion)) { should cmp >= kubectl_minversion }\n    end\n  end\nend\n",
          "desc": "One of the tools heavily used to interact with containers in the\nKubernetes cluster is kubectl. The command is the tool System Administrators\nused to create, modify, and delete resources. One of the capabilities of the\ntool is to copy files to and from running containers (i.e., kubectl cp). The\ncommand uses the \"tar\" command of the container to copy files from the\ncontainer to the host executing the \"kubectl cp\" command. If the \"tar\"\ncommand on the container has been replaced by a malicious user, the command can\ncopy files anywhere on the host machine. This flaw has been fixed in later\nversions of the tool. It is recommended to use kubectl versions newer than\n1.12.9.",
          "descriptions": [
            {
              "data": "One of the tools heavily used to interact with containers in the\nKubernetes cluster is kubectl. The command is the tool System Administrators\nused to create, modify, and delete resources. One of the capabilities of the\ntool is to copy files to and from running containers (i.e., kubectl cp). The\ncommand uses the \"tar\" command of the container to copy files from the\ncontainer to the host executing the \"kubectl cp\" command. If the \"tar\"\ncommand on the container has been replaced by a malicious user, the command can\ncopy files anywhere on the host machine. This flaw has been fixed in later\nversions of the tool. It is recommended to use kubectl versions newer than\n1.12.9.",
              "label": "default"
            },
            {
              "data": "",
              "label": "rationale"
            },
            {
              "data": "From the Master and each Worker node, check the version of kubectl by\nexecuting the command:\n\n    kubectl version --client\n\n    If the Master or any Work nodes are not using kubectl version 1.12.9 or\nnewer, this is a finding.",
              "label": "check"
            },
            {
              "data": "Upgrade the Master and Worker nodes to the latest version of\nkubectl.",
              "label": "fix"
            }
          ],
          "id": "V-242396",
          "impact": 0.5,
          "refs": [],
          "results": [
            {
              "code_desc": "JSON from command: /usr/local/bin/kubectl version --client --output=json [\"clientVersion\", \"gitVersion\"] is expected to cmp >= \"1.12.9\"",
              "resource_class": "json",
              "resource_params": "[{:command=>\"/usr/local/bin/kubectl version --client --output=json\"}]",
              "run_time": 0.000246084,
              "start_time": "2021-06-21T21:25:33-04:00",
              "status": "passed"
            }
          ],
          "source_location": {
            "line": 3,
            "ref": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242396.rb"
          },
          "tags": {
            "cci": ["CCI-000213"],
            "fix_id": "F-45629r712543_fix",
            "gid": "V-242396",
            "gtitle": "SRG-APP-000033-CTR-000090",
            "nist": ["AC-3"],
            "rid": "SV-242396r712544_rule",
            "severity": "medium",
            "stig_id": "CNTR-K8-000430"
          },
          "title": "Kubernetes Kubectl cp command must give expected access and results.",
          "waiver_data": {}
        },
        {
          "code": "control 'V-242397' do\n  title 'The Kubernetes kubelet static PodPath must not enable static pods.'\n  desc  \"Allowing kubelet to set a staticPodPath gives containers with root\naccess permissions to traverse the hosting filesystem. The danger comes when\nthe container can create a manifest file within the /etc/kubernetes/manifests\ndirectory. When a manifest is created within this directory, containers are\nentirely governed by the Kubelet not the API Server. The container is not\nsusceptible to admission control at all. Any containers or pods that are\ninstantiated in this manner are called \\\"static pods\\\" and are meant to be used\nfor pods such as the API server, scheduler, controller, etc., not workload pods\nthat need to be governed by the API Server.\"\n  desc  'rationale', ''\n  desc  'check', \"\n    On the Master and Worker nodes, change to the /etc/sysconfig/ directory and\nrun the command:\n\n    grep -i staticPodPath kubelet\n\n    If any of the nodes return a value for staticPodPath, this is a finding.\n  \"\n  desc 'fix', \"\n    Edit the kubelet file on each node under the /etc/sysconfig directory to\nremove the staticPodPath setting and restart the kubelet service by executing\nthe command:\n\n    service kubelet restart\n  \"\n  impact 0.7\n  tag severity: 'high'\n  tag gtitle: 'SRG-APP-000033-CTR-000090'\n  tag gid: 'V-242397'\n  tag rid: 'SV-242397r712547_rule'\n  tag stig_id: 'CNTR-K8-000440'\n  tag fix_id: 'F-45630r712546_fix'\n  tag cci: ['CCI-000213']\n  tag nist: ['AC-3']\n\n  describe kubelet do\n    its('staticPodPath') { should be_nil }\n  end\n\n  describe kubelet_config_file do\n    its('staticPodPath') { should be_nil }\n  end\nend\n",
          "desc": "Allowing kubelet to set a staticPodPath gives containers with root\naccess permissions to traverse the hosting filesystem. The danger comes when\nthe container can create a manifest file within the /etc/kubernetes/manifests\ndirectory. When a manifest is created within this directory, containers are\nentirely governed by the Kubelet not the API Server. The container is not\nsusceptible to admission control at all. Any containers or pods that are\ninstantiated in this manner are called \"static pods\" and are meant to be used\nfor pods such as the API server, scheduler, controller, etc., not workload pods\nthat need to be governed by the API Server.",
          "descriptions": [
            {
              "data": "Allowing kubelet to set a staticPodPath gives containers with root\naccess permissions to traverse the hosting filesystem. The danger comes when\nthe container can create a manifest file within the /etc/kubernetes/manifests\ndirectory. When a manifest is created within this directory, containers are\nentirely governed by the Kubelet not the API Server. The container is not\nsusceptible to admission control at all. Any containers or pods that are\ninstantiated in this manner are called \"static pods\" and are meant to be used\nfor pods such as the API server, scheduler, controller, etc., not workload pods\nthat need to be governed by the API Server.",
              "label": "default"
            },
            {
              "data": "",
              "label": "rationale"
            },
            {
              "data": "On the Master and Worker nodes, change to the /etc/sysconfig/ directory and\nrun the command:\n\n    grep -i staticPodPath kubelet\n\n    If any of the nodes return a value for staticPodPath, this is a finding.",
              "label": "check"
            },
            {
              "data": "Edit the kubelet file on each node under the /etc/sysconfig directory to\nremove the staticPodPath setting and restart the kubelet service by executing\nthe command:\n\n    service kubelet restart",
              "label": "fix"
            }
          ],
          "id": "V-242397",
          "impact": 0.7,
          "refs": [],
          "results": [
            {
              "code_desc": "Process arguments for k3s staticPodPath is expected to be nil",
              "resource_class": "kubelet",
              "resource_params": "[]",
              "run_time": 0.007418322,
              "start_time": "2021-06-21T21:25:33-04:00",
              "status": "passed"
            },
            {
              "code_desc": "Kubelet Config File /var/lib/kubelet/config.yaml staticPodPath is expected to be nil",
              "resource_class": "kubelet_config_file",
              "resource_params": "[]",
              "run_time": 0.000102751,
              "start_time": "2021-06-21T21:25:33-04:00",
              "status": "passed"
            }
          ],
          "source_location": {
            "line": 3,
            "ref": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242397.rb"
          },
          "tags": {
            "cci": ["CCI-000213"],
            "fix_id": "F-45630r712546_fix",
            "gid": "V-242397",
            "gtitle": "SRG-APP-000033-CTR-000090",
            "nist": ["AC-3"],
            "rid": "SV-242397r712547_rule",
            "severity": "high",
            "stig_id": "CNTR-K8-000440"
          },
          "title": "The Kubernetes kubelet static PodPath must not enable static pods.",
          "waiver_data": {}
        },
        {
          "code": "control 'V-242398' do\n  title 'Kubernetes DynamicAuditing must not be enabled.'\n  desc  \"Protecting the audit data from change or deletion is important when an\nattack occurs. One way an attacker can cover their tracks is to change or\ndelete audit records. This will either make the attack unnoticeable or make it\nmore difficult to investigate how the attack took place and what changes were\nmade. The audit data can be protected through audit log file protections and\nuser authorization.\n\n    One way for an attacker to thwart these measures is to send the audit logs\nto another source and filter the audited results before sending them on to the\noriginal target. This can be done in Kubernetes through the configuration of\ndynamic audit webhooks through the DynamicAuditing flag.\n  \"\n  desc  'rationale', ''\n  desc  'check', \"\n    On the Master node, change to the manifests' directory at\n/etc/kubernetes/manifests and run the command:\n\n    grep -i feature-gates *\n\n    Review the feature-gates setting, if one is returned.\n\n    If the feature-gates setting is available and contains the DynamicAuditing\nflag set to \\\"true\\\", this is a finding.\n\n    Change to the directory /etc/sysconfig on the Master and each Worker Node\nand execute the command:\n\n    grep -i feature-gates kubelet\n\n    Review every feature-gates setting that is returned.\n\n    If any feature-gates setting is available and contains the\n\\\"DynamicAuditing\\\" flag set to \\\"true\\\", this is a finding.\n  \"\n  desc 'fix', \"Edit any manifest files or kubelet config files that contain\nthe feature-gates setting with DynamicAuditing set to \\\"true\\\". Set the flag to\n\\\"false\\\" or remove the \\\"DynamicAuditing\\\" setting completely. Restart the\nkubelet service if the kubelet config file is changed.\"\n  impact 0.5\n  tag severity: 'medium'\n  tag gtitle: 'SRG-APP-000033-CTR-000100'\n  tag gid: 'V-242398'\n  tag rid: 'SV-242398r717019_rule'\n  tag stig_id: 'CNTR-K8-000450'\n  tag fix_id: 'F-45631r717018_fix'\n  tag cci: ['CCI-000213']\n  tag nist: ['AC-3']\n\n  describe kube_scheduler do\n    its('feature-gates.to_s') { should_not match /DynamicAuditing=[T|t]rue/ }\n  end\n\n  describe kube_controller_manager do\n    its('feature-gates.to_s') { should_not match /DynamicAuditing=[T|t]rue/ }\n  end\n\n  describe kube_apiserver do\n    its('feature-gates.to_s') { should_not match /DynamicAuditing=[T|t]rue/ }\n  end\n\n  describe kubelet do\n    its('feature-gates.to_s') { should_not match /DynamicAuditing=[T|t]rue/ }\n  end\n\n  describe kubelet_config_file do\n    its(%w(featureGates DynamicAuditing)) { should_not cmp 'true' }\n  end\nend\n",
          "desc": "Protecting the audit data from change or deletion is important when an\nattack occurs. One way an attacker can cover their tracks is to change or\ndelete audit records. This will either make the attack unnoticeable or make it\nmore difficult to investigate how the attack took place and what changes were\nmade. The audit data can be protected through audit log file protections and\nuser authorization.\n\n    One way for an attacker to thwart these measures is to send the audit logs\nto another source and filter the audited results before sending them on to the\noriginal target. This can be done in Kubernetes through the configuration of\ndynamic audit webhooks through the DynamicAuditing flag.",
          "descriptions": [
            {
              "data": "Protecting the audit data from change or deletion is important when an\nattack occurs. One way an attacker can cover their tracks is to change or\ndelete audit records. This will either make the attack unnoticeable or make it\nmore difficult to investigate how the attack took place and what changes were\nmade. The audit data can be protected through audit log file protections and\nuser authorization.\n\n    One way for an attacker to thwart these measures is to send the audit logs\nto another source and filter the audited results before sending them on to the\noriginal target. This can be done in Kubernetes through the configuration of\ndynamic audit webhooks through the DynamicAuditing flag.",
              "label": "default"
            },
            {
              "data": "",
              "label": "rationale"
            },
            {
              "data": "On the Master node, change to the manifests' directory at\n/etc/kubernetes/manifests and run the command:\n\n    grep -i feature-gates *\n\n    Review the feature-gates setting, if one is returned.\n\n    If the feature-gates setting is available and contains the DynamicAuditing\nflag set to \"true\", this is a finding.\n\n    Change to the directory /etc/sysconfig on the Master and each Worker Node\nand execute the command:\n\n    grep -i feature-gates kubelet\n\n    Review every feature-gates setting that is returned.\n\n    If any feature-gates setting is available and contains the\n\"DynamicAuditing\" flag set to \"true\", this is a finding.",
              "label": "check"
            },
            {
              "data": "Edit any manifest files or kubelet config files that contain\nthe feature-gates setting with DynamicAuditing set to \"true\". Set the flag to\n\"false\" or remove the \"DynamicAuditing\" setting completely. Restart the\nkubelet service if the kubelet config file is changed.",
              "label": "fix"
            }
          ],
          "id": "V-242398",
          "impact": 0.5,
          "refs": [],
          "results": [
            {
              "code_desc": "Process arguments for k3s server feature-gates.to_s is expected not to match /DynamicAuditing=[T|t]rue/",
              "resource_class": "kube_scheduler",
              "resource_params": "[]",
              "run_time": 0.007272092,
              "start_time": "2021-06-21T21:25:33-04:00",
              "status": "passed"
            },
            {
              "code_desc": "Process arguments for k3s server feature-gates.to_s is expected not to match /DynamicAuditing=[T|t]rue/",
              "resource_class": "kube_controller_manager",
              "resource_params": "[]",
              "run_time": 0.007452195,
              "start_time": "2021-06-21T21:25:33-04:00",
              "status": "passed"
            },
            {
              "code_desc": "Process arguments for k3s server feature-gates.to_s is expected not to match /DynamicAuditing=[T|t]rue/",
              "resource_class": "kube_apiserver",
              "resource_params": "[]",
              "run_time": 0.007402507,
              "start_time": "2021-06-21T21:25:33-04:00",
              "status": "passed"
            },
            {
              "code_desc": "Process arguments for k3s feature-gates.to_s is expected not to match /DynamicAuditing=[T|t]rue/",
              "resource_class": "kubelet",
              "resource_params": "[]",
              "run_time": 0.007392431,
              "start_time": "2021-06-21T21:25:33-04:00",
              "status": "passed"
            },
            {
              "code_desc": "Kubelet Config File /var/lib/kubelet/config.yaml [\"featureGates\", \"DynamicAuditing\"] is expected not to cmp == \"true\"",
              "resource_class": "kubelet_config_file",
              "resource_params": "[]",
              "run_time": 0.000187553,
              "start_time": "2021-06-21T21:25:33-04:00",
              "status": "passed"
            }
          ],
          "source_location": {
            "line": 3,
            "ref": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242398.rb"
          },
          "tags": {
            "cci": ["CCI-000213"],
            "fix_id": "F-45631r717018_fix",
            "gid": "V-242398",
            "gtitle": "SRG-APP-000033-CTR-000100",
            "nist": ["AC-3"],
            "rid": "SV-242398r717019_rule",
            "severity": "medium",
            "stig_id": "CNTR-K8-000450"
          },
          "title": "Kubernetes DynamicAuditing must not be enabled.",
          "waiver_data": {}
        },
        {
          "code": "control 'V-242399' do\n  title 'Kubernetes DynamicKubeletConfig must not be enabled.'\n  desc  \"Kubernetes allows a user to configure kubelets with dynamic\nconfigurations. When dynamic configuration is used, the kubelet will watch for\nchanges to the configuration file. When changes are made, the kubelet will\nautomatically restart. Allowing this capability bypasses access restrictions\nand authorizations. Using this capability, an attacker can lower the security\nposture of the kubelet, which includes allowing the ability to run arbitrary\ncommands in any container running on that node.\"\n  desc  'rationale', ''\n  desc  'check', \"\n    On the Master node, change to the manifests' directory at\n/etc/kubernetes/manifests and run the command:\n\n    grep -i feature-gates *\n\n    Review the feature-gates setting if one is returned.\n\n    If the feature-gates setting does not exist or feature-gates does not\ncontain the DynamicKubeletConfig flag or the \\\"DynamicKubletConfig\\\" flag is\nset to \\\"true\\\", this is a finding.\n\n    Change to the directory /etc/sysconfig on the Master and each Worker node\nand execute the command:\n\n    grep -i feature-gates kubelet\n\n    Review every feature-gates setting if one is returned.\n\n    If the feature-gates setting does not exist or feature-gates does not\ncontain the DynamicKubeletConfig flag or the DynamicKubletConfig flag is set to\n\\\"true\\\", this is a finding.\n  \"\n  desc 'fix', \"\n    Edit any manifest file or kubelet config file that does not contain a\nfeature-gates setting or has DynamicKubeletConfig set to \\\"true\\\".\n\n    An omission of DynamicKubeletConfig within the feature-gates defaults to\ntrue. Set DynamicKubeletConfig to \\\"false\\\". Restart the kubelet service if the\nkubelet config file is changed.\n  \"\n  impact 0.5\n  tag severity: 'medium'\n  tag gtitle: 'SRG-APP-000033-CTR-000095'\n  tag gid: 'V-242399'\n  tag rid: 'SV-242399r717021_rule'\n  tag stig_id: 'CNTR-K8-000460'\n  tag fix_id: 'F-45632r717020_fix'\n  tag cci: ['CCI-000213']\n  tag nist: ['AC-3']\n\n  describe kube_scheduler do\n    its('feature-gates.to_s') { should match /DynamicKubeletConfig=[F|f]alse/ }\n  end\n\n  describe kube_controller_manager do\n    its('feature-gates.to_s') { should match /DynamicKubeletConfig=[F|f]alse/ }\n  end\n\n  describe kube_apiserver do\n    its('feature-gates.to_s') { should match /DynamicKubeletConfig=[F|f]alse/ }\n  end\n\n  describe.one do\n    describe kubelet do\n      its('feature-gates.to_s') { should match /DynamicKubeletConfig=[F|f]alse/ }\n    end\n    describe kubelet_config_file do\n      its(%w(featureGates DynamicKubeletConfig)) { should_not cmp 'false' }\n    end\n  end\nend\n",
          "desc": "Kubernetes allows a user to configure kubelets with dynamic\nconfigurations. When dynamic configuration is used, the kubelet will watch for\nchanges to the configuration file. When changes are made, the kubelet will\nautomatically restart. Allowing this capability bypasses access restrictions\nand authorizations. Using this capability, an attacker can lower the security\nposture of the kubelet, which includes allowing the ability to run arbitrary\ncommands in any container running on that node.",
          "descriptions": [
            {
              "data": "Kubernetes allows a user to configure kubelets with dynamic\nconfigurations. When dynamic configuration is used, the kubelet will watch for\nchanges to the configuration file. When changes are made, the kubelet will\nautomatically restart. Allowing this capability bypasses access restrictions\nand authorizations. Using this capability, an attacker can lower the security\nposture of the kubelet, which includes allowing the ability to run arbitrary\ncommands in any container running on that node.",
              "label": "default"
            },
            {
              "data": "",
              "label": "rationale"
            },
            {
              "data": "On the Master node, change to the manifests' directory at\n/etc/kubernetes/manifests and run the command:\n\n    grep -i feature-gates *\n\n    Review the feature-gates setting if one is returned.\n\n    If the feature-gates setting does not exist or feature-gates does not\ncontain the DynamicKubeletConfig flag or the \"DynamicKubletConfig\" flag is\nset to \"true\", this is a finding.\n\n    Change to the directory /etc/sysconfig on the Master and each Worker node\nand execute the command:\n\n    grep -i feature-gates kubelet\n\n    Review every feature-gates setting if one is returned.\n\n    If the feature-gates setting does not exist or feature-gates does not\ncontain the DynamicKubeletConfig flag or the DynamicKubletConfig flag is set to\n\"true\", this is a finding.",
              "label": "check"
            },
            {
              "data": "Edit any manifest file or kubelet config file that does not contain a\nfeature-gates setting or has DynamicKubeletConfig set to \"true\".\n\n    An omission of DynamicKubeletConfig within the feature-gates defaults to\ntrue. Set DynamicKubeletConfig to \"false\". Restart the kubelet service if the\nkubelet config file is changed.",
              "label": "fix"
            }
          ],
          "id": "V-242399",
          "impact": 0.5,
          "refs": [],
          "results": [
            {
              "code_desc": "Process arguments for k3s server feature-gates.to_s is expected to match /DynamicKubeletConfig=[F|f]alse/",
              "resource_class": "kube_scheduler",
              "resource_params": "[]",
              "run_time": 0.007849744,
              "start_time": "2021-06-21T21:25:33-04:00",
              "status": "passed"
            },
            {
              "code_desc": "Process arguments for k3s server feature-gates.to_s is expected to match /DynamicKubeletConfig=[F|f]alse/",
              "resource_class": "kube_controller_manager",
              "resource_params": "[]",
              "run_time": 0.00769626,
              "start_time": "2021-06-21T21:25:33-04:00",
              "status": "passed"
            },
            {
              "code_desc": "Process arguments for k3s server feature-gates.to_s is expected to match /DynamicKubeletConfig=[F|f]alse/",
              "resource_class": "kube_apiserver",
              "resource_params": "[]",
              "run_time": 0.007712343,
              "start_time": "2021-06-21T21:25:33-04:00",
              "status": "passed"
            },
            {
              "code_desc": "Process arguments for k3s feature-gates.to_s is expected to match /DynamicKubeletConfig=[F|f]alse/",
              "resource_class": "kubelet",
              "resource_params": "[]",
              "run_time": 0.000138636,
              "start_time": "2021-06-21T21:25:33-04:00",
              "status": "passed"
            },
            {
              "code_desc": "Kubelet Config File /var/lib/kubelet/config.yaml [\"featureGates\", \"DynamicKubeletConfig\"] is expected not to cmp == \"false\"",
              "resource_class": "kubelet_config_file",
              "resource_params": "[]",
              "run_time": 0.000177617,
              "start_time": "2021-06-21T21:25:33-04:00",
              "status": "passed"
            }
          ],
          "source_location": {
            "line": 3,
            "ref": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242399.rb"
          },
          "tags": {
            "cci": ["CCI-000213"],
            "fix_id": "F-45632r717020_fix",
            "gid": "V-242399",
            "gtitle": "SRG-APP-000033-CTR-000095",
            "nist": ["AC-3"],
            "rid": "SV-242399r717021_rule",
            "severity": "medium",
            "stig_id": "CNTR-K8-000460"
          },
          "title": "Kubernetes DynamicKubeletConfig must not be enabled.",
          "waiver_data": {}
        },
        {
          "code": "control 'V-242400' do\n  title 'The Kubernetes API server must have Alpha APIs disabled.'\n  desc  \"Kubernetes allows alpha API calls within the API server. The alpha\nfeatures are disabled by default since they are not ready for production and\nlikely to change without notice. These features may also contain security\nissues that are rectified as the feature matures. To keep the Kubernetes\ncluster secure and stable, these alpha features must not be used.\"\n  desc  'rationale', ''\n  desc  'check', \"\n    On the Master node, change to the manifests' directory at\n/etc/kubernetes/manifests and run the command:\n\n    grep -i feature-gates *\n\n    Review the feature-gates setting, if one is returned.\n\n    If the feature-gates setting is available and contains the AllAlpha flag\nset to \\\"true\\\", this is a finding.\n  \"\n  desc 'fix', \"\n    Edit any manifest files that contain the feature-gates setting with\nAllAlpha set to \\\"true\\\". Set the flag to \\\"false\\\" or remove the AllAlpha\nsetting completely.\n    (AllAlpha- default=false)\n  \"\n  impact 0.5\n  tag severity: 'medium'\n  tag gtitle: 'SRG-APP-000033-CTR-000090'\n  tag gid: 'V-242400'\n  tag rid: 'SV-242400r712556_rule'\n  tag stig_id: 'CNTR-K8-000470'\n  tag fix_id: 'F-45633r712555_fix'\n  tag cci: ['CCI-000213']\n  tag nist: ['AC-3']\n\n  describe kube_scheduler do\n    its('feature-gates.to_s') { should_not match /AllAlpha=[T|t]rue/ }\n  end\n\n  describe kube_controller_manager do\n    its('feature-gates.to_s') { should_not match /AllAlpha=[T|t]rue/ }\n  end\n\n  describe kube_apiserver do\n    its('feature-gates.to_s') { should_not match /AllAlpha=[T|t]rue/ }\n  end\n\n  describe kubelet do\n    its('feature-gates.to_s') { should_not match /AllAlpha=[T|t]rue/ }\n  end\n\n  describe kubelet_config_file do\n    its(%w(featureGates AllAlpha)) { should_not cmp 'true' }\n  end\nend\n",
          "desc": "Kubernetes allows alpha API calls within the API server. The alpha\nfeatures are disabled by default since they are not ready for production and\nlikely to change without notice. These features may also contain security\nissues that are rectified as the feature matures. To keep the Kubernetes\ncluster secure and stable, these alpha features must not be used.",
          "descriptions": [
            {
              "data": "Kubernetes allows alpha API calls within the API server. The alpha\nfeatures are disabled by default since they are not ready for production and\nlikely to change without notice. These features may also contain security\nissues that are rectified as the feature matures. To keep the Kubernetes\ncluster secure and stable, these alpha features must not be used.",
              "label": "default"
            },
            {
              "data": "",
              "label": "rationale"
            },
            {
              "data": "On the Master node, change to the manifests' directory at\n/etc/kubernetes/manifests and run the command:\n\n    grep -i feature-gates *\n\n    Review the feature-gates setting, if one is returned.\n\n    If the feature-gates setting is available and contains the AllAlpha flag\nset to \"true\", this is a finding.",
              "label": "check"
            },
            {
              "data": "Edit any manifest files that contain the feature-gates setting with\nAllAlpha set to \"true\". Set the flag to \"false\" or remove the AllAlpha\nsetting completely.\n    (AllAlpha- default=false)",
              "label": "fix"
            }
          ],
          "id": "V-242400",
          "impact": 0.5,
          "refs": [],
          "results": [
            {
              "code_desc": "Process arguments for k3s server feature-gates.to_s is expected not to match /AllAlpha=[T|t]rue/",
              "resource_class": "kube_scheduler",
              "resource_params": "[]",
              "run_time": 0.007111696,
              "start_time": "2021-06-21T21:25:33-04:00",
              "status": "passed"
            },
            {
              "code_desc": "Process arguments for k3s server feature-gates.to_s is expected not to match /AllAlpha=[T|t]rue/",
              "resource_class": "kube_controller_manager",
              "resource_params": "[]",
              "run_time": 0.007714268,
              "start_time": "2021-06-21T21:25:33-04:00",
              "status": "passed"
            },
            {
              "code_desc": "Process arguments for k3s server feature-gates.to_s is expected not to match /AllAlpha=[T|t]rue/",
              "resource_class": "kube_apiserver",
              "resource_params": "[]",
              "run_time": 0.0278329,
              "start_time": "2021-06-21T21:25:33-04:00",
              "status": "passed"
            },
            {
              "code_desc": "Process arguments for k3s feature-gates.to_s is expected not to match /AllAlpha=[T|t]rue/",
              "resource_class": "kubelet",
              "resource_params": "[]",
              "run_time": 0.007903704,
              "start_time": "2021-06-21T21:25:33-04:00",
              "status": "passed"
            },
            {
              "code_desc": "Kubelet Config File /var/lib/kubelet/config.yaml [\"featureGates\", \"AllAlpha\"] is expected not to cmp == \"true\"",
              "resource_class": "kubelet_config_file",
              "resource_params": "[]",
              "run_time": 0.000223507,
              "start_time": "2021-06-21T21:25:33-04:00",
              "status": "passed"
            }
          ],
          "source_location": {
            "line": 3,
            "ref": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242400.rb"
          },
          "tags": {
            "cci": ["CCI-000213"],
            "fix_id": "F-45633r712555_fix",
            "gid": "V-242400",
            "gtitle": "SRG-APP-000033-CTR-000090",
            "nist": ["AC-3"],
            "rid": "SV-242400r712556_rule",
            "severity": "medium",
            "stig_id": "CNTR-K8-000470"
          },
          "title": "The Kubernetes API server must have Alpha APIs disabled.",
          "waiver_data": {}
        },
        {
          "code": "control 'V-242401' do\n  title 'The Kubernetes API Server must have an audit policy set.'\n  desc  \"When Kubernetes is started, components and user services are started.\nFor auditing startup events, and events for components and services, it is\nimportant that auditing begin on startup. Within Kubernetes, audit data for all\ncomponents is generated by the API server. To enable auditing to begin, an\naudit policy must be defined for the events and the information to be stored\nwith each event. It is also necessary to give a secure location where the audit\nlogs are to be stored. If an audit log path is not specified, all audit data is\nsent to studio.\"\n  desc  'rationale', ''\n  desc  'check', \"\n    Change to the /etc/kubernetes/manifests directory on the Kubernetes Master\nNode. Run the command:\n\n    grep -i audit-policy-file *\n\n    If the audit-policy-file is not set, this is a finding.\n  \"\n  desc 'fix', \"\n    Edit the Kubernetes API Server manifest and set \\\"--audit-policy-file\\\" to\nthe audit policy file.\n\n    Note: If the API server is running as a Pod, then the manifest will also\nneed to be updated to mount the host system filesystem where the audit policy\nfile resides.\n  \"\n  impact 0.5\n  tag severity: 'medium'\n  tag gtitle: 'SRG-APP-000092-CTR-000165'\n  tag gid: 'V-242401'\n  tag rid: 'SV-242401r712559_rule'\n  tag stig_id: 'CNTR-K8-000600'\n  tag fix_id: 'F-45634r717023_fix'\n  tag cci: ['CCI-001464']\n  tag nist: ['AU-14 (1)']\n\n  unless kube_apiserver.exist?\n    impact 0.0\n    desc 'caveat', 'Kubernetes API Server process is not running on the target.'\n  end\n\n  describe kube_apiserver do\n    its('audit-policy-file') { should_not be_nil }\n  end\nend\n",
          "desc": "When Kubernetes is started, components and user services are started.\nFor auditing startup events, and events for components and services, it is\nimportant that auditing begin on startup. Within Kubernetes, audit data for all\ncomponents is generated by the API server. To enable auditing to begin, an\naudit policy must be defined for the events and the information to be stored\nwith each event. It is also necessary to give a secure location where the audit\nlogs are to be stored. If an audit log path is not specified, all audit data is\nsent to studio.",
          "descriptions": [
            {
              "data": "When Kubernetes is started, components and user services are started.\nFor auditing startup events, and events for components and services, it is\nimportant that auditing begin on startup. Within Kubernetes, audit data for all\ncomponents is generated by the API server. To enable auditing to begin, an\naudit policy must be defined for the events and the information to be stored\nwith each event. It is also necessary to give a secure location where the audit\nlogs are to be stored. If an audit log path is not specified, all audit data is\nsent to studio.",
              "label": "default"
            },
            {
              "data": "",
              "label": "rationale"
            },
            {
              "data": "Change to the /etc/kubernetes/manifests directory on the Kubernetes Master\nNode. Run the command:\n\n    grep -i audit-policy-file *\n\n    If the audit-policy-file is not set, this is a finding.",
              "label": "check"
            },
            {
              "data": "Edit the Kubernetes API Server manifest and set \"--audit-policy-file\" to\nthe audit policy file.\n\n    Note: If the API server is running as a Pod, then the manifest will also\nneed to be updated to mount the host system filesystem where the audit policy\nfile resides.",
              "label": "fix"
            }
          ],
          "id": "V-242401",
          "impact": 0.5,
          "refs": [],
          "results": [
            {
              "code_desc": "Process arguments for k3s server audit-policy-file is expected not to be nil",
              "resource_class": "kube_apiserver",
              "resource_params": "[]",
              "run_time": 0.008537792,
              "start_time": "2021-06-21T21:25:33-04:00",
              "status": "passed"
            }
          ],
          "source_location": {
            "line": 3,
            "ref": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242401.rb"
          },
          "tags": {
            "cci": ["CCI-001464"],
            "fix_id": "F-45634r717023_fix",
            "gid": "V-242401",
            "gtitle": "SRG-APP-000092-CTR-000165",
            "nist": ["AU-14 (1)"],
            "rid": "SV-242401r712559_rule",
            "severity": "medium",
            "stig_id": "CNTR-K8-000600"
          },
          "title": "The Kubernetes API Server must have an audit policy set.",
          "waiver_data": {}
        },
        {
          "code": "control 'V-242402' do\n  title 'The Kubernetes API Server must have an audit log path set.'\n  desc  \"When Kubernetes is started, components and user services are started\nfor auditing startup events, and events for components and services, it is\nimportant that auditing begin on startup. Within Kubernetes, audit data for all\ncomponents is generated by the API server. To enable auditing to begin, an\naudit policy must be defined for the events and the information to be stored\nwith each event. It is also necessary to give a secure location where the audit\nlogs are to be stored. If an audit log path is not specified, all audit data is\nsent to studio.\"\n  desc  'rationale', ''\n  desc  'check', \"\n    Change to the /etc/kubernetes/manifests directory on the Kubernetes Master\nNode. Run the command:\n\n    grep -i audit-log-path *\n\n    If the audit-log-path is not set, this is a finding.\n  \"\n  desc 'fix', \"\n    Edit the Kubernetes API Server manifest and set \\\"--audit-log-path\\\" to a\nsecure location for the audit logs to be written.\n\n    Note: If the API server is running as a Pod, then the manifest will also\nneed to be updated to mount the host system filesystem where the audit log file\nis to be written.\n  \"\n  impact 0.5\n  tag severity: 'medium'\n  tag gtitle: 'SRG-APP-000092-CTR-000165'\n  tag gid: 'V-242402'\n  tag rid: 'SV-242402r712562_rule'\n  tag stig_id: 'CNTR-K8-000610'\n  tag fix_id: 'F-45635r717024_fix'\n  tag cci: ['CCI-001464']\n  tag nist: ['AU-14 (1)']\n\n  unless kube_apiserver.exist?\n    impact 0.0\n    desc 'caveat', 'Kubernetes API Server process is not running on the target.'\n  end\n\n  describe kube_apiserver do\n    its('audit-log-path') { should_not be_nil }\n  end\nend\n",
          "desc": "When Kubernetes is started, components and user services are started\nfor auditing startup events, and events for components and services, it is\nimportant that auditing begin on startup. Within Kubernetes, audit data for all\ncomponents is generated by the API server. To enable auditing to begin, an\naudit policy must be defined for the events and the information to be stored\nwith each event. It is also necessary to give a secure location where the audit\nlogs are to be stored. If an audit log path is not specified, all audit data is\nsent to studio.",
          "descriptions": [
            {
              "data": "When Kubernetes is started, components and user services are started\nfor auditing startup events, and events for components and services, it is\nimportant that auditing begin on startup. Within Kubernetes, audit data for all\ncomponents is generated by the API server. To enable auditing to begin, an\naudit policy must be defined for the events and the information to be stored\nwith each event. It is also necessary to give a secure location where the audit\nlogs are to be stored. If an audit log path is not specified, all audit data is\nsent to studio.",
              "label": "default"
            },
            {
              "data": "",
              "label": "rationale"
            },
            {
              "data": "Change to the /etc/kubernetes/manifests directory on the Kubernetes Master\nNode. Run the command:\n\n    grep -i audit-log-path *\n\n    If the audit-log-path is not set, this is a finding.",
              "label": "check"
            },
            {
              "data": "Edit the Kubernetes API Server manifest and set \"--audit-log-path\" to a\nsecure location for the audit logs to be written.\n\n    Note: If the API server is running as a Pod, then the manifest will also\nneed to be updated to mount the host system filesystem where the audit log file\nis to be written.",
              "label": "fix"
            }
          ],
          "id": "V-242402",
          "impact": 0.5,
          "refs": [],
          "results": [
            {
              "code_desc": "Process arguments for k3s server audit-log-path is expected not to be nil",
              "resource_class": "kube_apiserver",
              "resource_params": "[]",
              "run_time": 0.007122946,
              "start_time": "2021-06-21T21:25:33-04:00",
              "status": "passed"
            }
          ],
          "source_location": {
            "line": 3,
            "ref": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242402.rb"
          },
          "tags": {
            "cci": ["CCI-001464"],
            "fix_id": "F-45635r717024_fix",
            "gid": "V-242402",
            "gtitle": "SRG-APP-000092-CTR-000165",
            "nist": ["AU-14 (1)"],
            "rid": "SV-242402r712562_rule",
            "severity": "medium",
            "stig_id": "CNTR-K8-000610"
          },
          "title": "The Kubernetes API Server must have an audit log path set.",
          "waiver_data": {}
        },
        {
          "code": "control 'V-242403' do\n  title \"Kubernetes API Server must generate audit records that identify what\ntype of event has occurred, identify the source of the event, contain the event\nresults, identify any users, and identify any containers associated with the\nevent.\"\n  desc  \"Within Kubernetes, audit data for all components is generated by the\nAPI server. This audit data is important when there are issues, to include\nsecurity incidents that must be investigated. To make the audit data worthwhile\nfor the investigation of events, it is necessary to have the appropriate and\nrequired data logged. To fully understand the event, it is important to\nidentify any users associated with the event.\n\n    The API server policy file allows for the following levels of auditing:\n          None - Do not log events that match the rule.\n          Metadata - Log request metadata (requesting user, timestamp,\nresource, verb, etc.) but not request or response body.\n          Request - Log event metadata and request body but not response body.\n          RequestResponse - Log event metadata, request, and response bodies.\n\n\n  \"\n  desc  'rationale', ''\n  desc  'check', \"\n    Change to the /etc/kubernetes/manifests directory on the Kubernetes Master\nNode. Run the command:\n\n    grep -i audit-policy-file\n\n    If the audit-policy-file is not set, this is a finding.\n\n    The file given is the policy file and defines what is audited and what\ninformation is included with each event.\n\n    The policy file must look like this:\n\n    # Log all requests at the RequestResponse level.\n    apiVersion: audit.k8s.io/vX (Where X is the latest apiVersion)\n    kind: Policy\n    rules:\n    - level: RequestResponse\n\n    If the audit policy file does not look like above, this is a finding.\n  \"\n  desc 'fix', \"\n    Edit the Kubernetes API Server audit policy and set it to look like the\nfollowing:\n\n    # Log all requests at the RequestResponse level.\n    apiVersion: audit.k8s.io/vX (Where X is the latest apiVersion)\n    kind: Policy\n    rules:\n    - level: RequestResponse\n  \"\n  impact 0.5\n  tag severity: 'medium'\n  tag gtitle: 'SRG-APP-000026-CTR-000070'\n  tag satisfies: ['SRG-APP-000026-CTR-000070', 'SRG-APP-000027-CTR-000075',\n                  'SRG-APP-000028-CTR-000080', 'SRG-APP-000101-CTR-000205',\n                  'SRG-APP-000100-CTR-000200', 'SRG-APP-000100-CTR-000195',\n                  'SRG-APP-000099-CTR-000190', 'SRG-APP-000098-CTR-000185',\n                  'SRG-APP-000095-CTR-000170', 'SRG-APP-000096-CTR-000175',\n                  'SRG-APP-000097-CTR-000180', 'SRG-APP-000507-CTR-001295',\n                  'SRG-APP-000504-CTR-001280', 'SRG-APP-000503-CTR-001275',\n                  'SRG-APP-000501-CTR-001265', 'SRG-APP-000500-CTR-001260',\n                  'SRG-APP-000497-CTR-001245', 'SRG-APP-000496-CTR-001240',\n                  'SRG-APP-000493-CTR-001225', 'SRG-APP-000492-CTR-001220',\n                  'SRG-APP-000343-CTR-000780', 'SRG-APP-000381-CTR-000905']\n  tag gid: 'V-242403'\n  tag rid: 'SV-242403r712565_rule'\n  tag stig_id: 'CNTR-K8-000700'\n  tag fix_id: 'F-45636r712564_fix'\n  tag cci: ['CCI-000018', 'CCI-000130', 'CCI-000131', 'CCI-000132',\n            'CCI-000133', 'CCI-000134', 'CCI-000135', 'CCI-000172', 'CCI-001403',\n            'CCI-001404', 'CCI-001487', 'CCI-001814', 'CCI-002234']\n  tag nist: ['AC-2 (4)', 'AU-3', 'AU-3', 'AU-3', 'AU-3', 'AU-3', 'AU-3 (1)',\n             'AU-12 c', 'AC-2 (4)', 'AC-2 (4)', 'AU-3', 'CM-5 (1)', 'AC-6 (9)']\n\n  unless kube_apiserver.exist?\n    impact 0.0\n    desc 'caveat', 'Kubernetes API Server process is not running on the target.'\n  end\n\n  describe kube_apiserver do\n    its('audit-policy-file') { should_not be_nil }\n  end\n\n  if !kube_apiserver.params['audit-policy-file'].nil? &&\n     file(kube_apiserver.params['audit-policy-file'].join).exist?\n\n    describe yaml(kube_apiserver.params['audit-policy-file'].join) do\n      its('rules') { should cmp [{ 'level' => 'RequestResponse' }] }\n    end\n  end\nend\n",
          "desc": "Within Kubernetes, audit data for all components is generated by the\nAPI server. This audit data is important when there are issues, to include\nsecurity incidents that must be investigated. To make the audit data worthwhile\nfor the investigation of events, it is necessary to have the appropriate and\nrequired data logged. To fully understand the event, it is important to\nidentify any users associated with the event.\n\n    The API server policy file allows for the following levels of auditing:\n          None - Do not log events that match the rule.\n          Metadata - Log request metadata (requesting user, timestamp,\nresource, verb, etc.) but not request or response body.\n          Request - Log event metadata and request body but not response body.\n          RequestResponse - Log event metadata, request, and response bodies.",
          "descriptions": [
            {
              "data": "Within Kubernetes, audit data for all components is generated by the\nAPI server. This audit data is important when there are issues, to include\nsecurity incidents that must be investigated. To make the audit data worthwhile\nfor the investigation of events, it is necessary to have the appropriate and\nrequired data logged. To fully understand the event, it is important to\nidentify any users associated with the event.\n\n    The API server policy file allows for the following levels of auditing:\n          None - Do not log events that match the rule.\n          Metadata - Log request metadata (requesting user, timestamp,\nresource, verb, etc.) but not request or response body.\n          Request - Log event metadata and request body but not response body.\n          RequestResponse - Log event metadata, request, and response bodies.",
              "label": "default"
            },
            {
              "data": "",
              "label": "rationale"
            },
            {
              "data": "Change to the /etc/kubernetes/manifests directory on the Kubernetes Master\nNode. Run the command:\n\n    grep -i audit-policy-file\n\n    If the audit-policy-file is not set, this is a finding.\n\n    The file given is the policy file and defines what is audited and what\ninformation is included with each event.\n\n    The policy file must look like this:\n\n    # Log all requests at the RequestResponse level.\n    apiVersion: audit.k8s.io/vX (Where X is the latest apiVersion)\n    kind: Policy\n    rules:\n    - level: RequestResponse\n\n    If the audit policy file does not look like above, this is a finding.",
              "label": "check"
            },
            {
              "data": "Edit the Kubernetes API Server audit policy and set it to look like the\nfollowing:\n\n    # Log all requests at the RequestResponse level.\n    apiVersion: audit.k8s.io/vX (Where X is the latest apiVersion)\n    kind: Policy\n    rules:\n    - level: RequestResponse",
              "label": "fix"
            }
          ],
          "id": "V-242403",
          "impact": 0.5,
          "refs": [],
          "results": [
            {
              "code_desc": "Process arguments for k3s server audit-policy-file is expected not to be nil",
              "resource_class": "kube_apiserver",
              "resource_params": "[]",
              "run_time": 0.00696363,
              "start_time": "2021-06-21T21:25:33-04:00",
              "status": "passed"
            },
            {
              "code_desc": "YAML /var/lib/rancher/audit/audit-policy.yaml rules is expected to cmp == [{\"level\"=>\"RequestResponse\"}]",
              "resource_class": "yaml",
              "resource_params": "[\"/var/lib/rancher/audit/audit-policy.yaml\"]",
              "run_time": 0.000225976,
              "start_time": "2021-06-21T21:25:33-04:00",
              "status": "passed"
            }
          ],
          "source_location": {
            "line": 3,
            "ref": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242403.rb"
          },
          "tags": {
            "cci": [
              "CCI-000018",
              "CCI-000130",
              "CCI-000131",
              "CCI-000132",
              "CCI-000133",
              "CCI-000134",
              "CCI-000135",
              "CCI-000172",
              "CCI-001403",
              "CCI-001404",
              "CCI-001487",
              "CCI-001814",
              "CCI-002234"
            ],
            "fix_id": "F-45636r712564_fix",
            "gid": "V-242403",
            "gtitle": "SRG-APP-000026-CTR-000070",
            "nist": [
              "AC-2 (4)",
              "AU-3",
              "AU-3",
              "AU-3",
              "AU-3",
              "AU-3",
              "AU-3 (1)",
              "AU-12 c",
              "AC-2 (4)",
              "AC-2 (4)",
              "AU-3",
              "CM-5 (1)",
              "AC-6 (9)"
            ],
            "rid": "SV-242403r712565_rule",
            "satisfies": [
              "SRG-APP-000026-CTR-000070",
              "SRG-APP-000027-CTR-000075",
              "SRG-APP-000028-CTR-000080",
              "SRG-APP-000101-CTR-000205",
              "SRG-APP-000100-CTR-000200",
              "SRG-APP-000100-CTR-000195",
              "SRG-APP-000099-CTR-000190",
              "SRG-APP-000098-CTR-000185",
              "SRG-APP-000095-CTR-000170",
              "SRG-APP-000096-CTR-000175",
              "SRG-APP-000097-CTR-000180",
              "SRG-APP-000507-CTR-001295",
              "SRG-APP-000504-CTR-001280",
              "SRG-APP-000503-CTR-001275",
              "SRG-APP-000501-CTR-001265",
              "SRG-APP-000500-CTR-001260",
              "SRG-APP-000497-CTR-001245",
              "SRG-APP-000496-CTR-001240",
              "SRG-APP-000493-CTR-001225",
              "SRG-APP-000492-CTR-001220",
              "SRG-APP-000343-CTR-000780",
              "SRG-APP-000381-CTR-000905"
            ],
            "severity": "medium",
            "stig_id": "CNTR-K8-000700"
          },
          "title": "Kubernetes API Server must generate audit records that identify what\ntype of event has occurred, identify the source of the event, contain the event\nresults, identify any users, and identify any containers associated with the\nevent.",
          "waiver_data": {}
        },
        {
          "code": "control 'V-242404' do\n  title 'Kubernetes Kubelet must deny hostname override.'\n  desc  \"Kubernetes allows for the overriding of hostnames. Allowing this\nfeature to be implemented within the kubelets may break the TLS setup between\nthe kubelet service and the API server. This setting also can make it difficult\nto associate logs with nodes if security analytics needs to take place. The\nbetter practice is to setup nodes with resolvable FQDNs and avoid overriding\nthe hostnames.\"\n  desc  'rationale', ''\n  desc  'check', \"\n    On the Master and each Worker node, change to the /etc/sysconfig/ directory\nand run the command:\n\n    grep -i hostname-override kubelet\n    --hostname-override\n\n    If any of the nodes have the setting \\\"hostname-override\\\" present, this is\na finding.\n  \"\n  desc 'fix', \"\n    Edit the Kubernetes Kubelet file in the /etc/sysconfig directory on the\nMaster and Worker nodes and remove the \\\"--hostname-override\\\" setting. Restart\nthe service after the change is made by running:\n\n    service kubelet restart\n  \"\n  impact 0.5\n  tag severity: 'medium'\n  tag gtitle: 'SRG-APP-000133-CTR-000290'\n  tag gid: 'V-242404'\n  tag rid: 'SV-242404r712568_rule'\n  tag stig_id: 'CNTR-K8-000850'\n  tag fix_id: 'F-45637r712567_fix'\n  tag cci: ['CCI-001499']\n  tag nist: ['CM-5 (6)']\n\n  describe kubelet do\n    its('hostname-override') { should be_nil }\n  end\nend\n",
          "desc": "Kubernetes allows for the overriding of hostnames. Allowing this\nfeature to be implemented within the kubelets may break the TLS setup between\nthe kubelet service and the API server. This setting also can make it difficult\nto associate logs with nodes if security analytics needs to take place. The\nbetter practice is to setup nodes with resolvable FQDNs and avoid overriding\nthe hostnames.",
          "descriptions": [
            {
              "data": "Kubernetes allows for the overriding of hostnames. Allowing this\nfeature to be implemented within the kubelets may break the TLS setup between\nthe kubelet service and the API server. This setting also can make it difficult\nto associate logs with nodes if security analytics needs to take place. The\nbetter practice is to setup nodes with resolvable FQDNs and avoid overriding\nthe hostnames.",
              "label": "default"
            },
            {
              "data": "",
              "label": "rationale"
            },
            {
              "data": "On the Master and each Worker node, change to the /etc/sysconfig/ directory\nand run the command:\n\n    grep -i hostname-override kubelet\n    --hostname-override\n\n    If any of the nodes have the setting \"hostname-override\" present, this is\na finding.",
              "label": "check"
            },
            {
              "data": "Edit the Kubernetes Kubelet file in the /etc/sysconfig directory on the\nMaster and Worker nodes and remove the \"--hostname-override\" setting. Restart\nthe service after the change is made by running:\n\n    service kubelet restart",
              "label": "fix"
            }
          ],
          "id": "V-242404",
          "impact": 0.5,
          "refs": [],
          "results": [
            {
              "code_desc": "Process arguments for k3s hostname-override is expected to be nil",
              "resource_class": "kubelet",
              "resource_params": "[]",
              "run_time": 0.007676147,
              "start_time": "2021-06-21T21:25:33-04:00",
              "status": "passed"
            }
          ],
          "source_location": {
            "line": 3,
            "ref": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242404.rb"
          },
          "tags": {
            "cci": ["CCI-001499"],
            "fix_id": "F-45637r712567_fix",
            "gid": "V-242404",
            "gtitle": "SRG-APP-000133-CTR-000290",
            "nist": ["CM-5 (6)"],
            "rid": "SV-242404r712568_rule",
            "severity": "medium",
            "stig_id": "CNTR-K8-000850"
          },
          "title": "Kubernetes Kubelet must deny hostname override.",
          "waiver_data": {}
        },
        {
          "code": "control 'V-242405' do\n  title 'The Kubernetes manifests must be owned by root.'\n  desc  \"The manifest files contain the runtime configuration of the API\nserver, proxy, scheduler, controller, and etcd. If an attacker can gain access\nto these files, changes can be made to open vulnerabilities and bypass user\nauthorizations inherit within Kubernetes with RBAC implemented.\"\n  desc  'rationale', ''\n  desc  'check', \"\n    On the Master node, change to the /etc/kubernetes/manifest directory. Run\nthe command:\n\n    ls -l *\n\n    Each manifest file must be owned by root:root.\n\n    If any manifest file is not owned by root:root, this is a finding.\n  \"\n  desc 'fix', \"\n    On the Master node, change to the /etc/kubernetes/manifest directory. Run\nthe command:\n\n    chown root:root *\n\n    To verify the change took place, run the command:\n\n    ls -l *\n\n    All the manifest files should be owned by root:root.\n  \"\n  impact 0.5\n  tag severity: 'medium'\n  tag gtitle: 'SRG-APP-000133-CTR-000295'\n  tag gid: 'V-242405'\n  tag rid: 'SV-242405r712571_rule'\n  tag stig_id: 'CNTR-K8-000860'\n  tag fix_id: 'F-45638r712570_fix'\n  tag cci: ['CCI-001499']\n  tag nist: ['CM-5 (6)']\n\n  manifests_path = input('manifests_path')\n  manifests_files = command(\"find #{manifests_path} -type f\").stdout.split\n\n  if manifests_files.empty?\n    desc 'caveat', \"Kubernetes Manifest files not present of the target at specified path #{manifests_path}.\"\n\n    describe \"Kubernetes Manifest files not present of the target at specified path #{manifests_path}.\" do\n      skip\n    end\n  end\n\n  manifests_files.each do |file_name|\n    describe file(file_name) do\n      it { should be_owned_by('root') }\n      it { should be_grouped_into('root') }\n    end\n  end\nend\n",
          "desc": "The manifest files contain the runtime configuration of the API\nserver, proxy, scheduler, controller, and etcd. If an attacker can gain access\nto these files, changes can be made to open vulnerabilities and bypass user\nauthorizations inherit within Kubernetes with RBAC implemented.",
          "descriptions": [
            {
              "data": "The manifest files contain the runtime configuration of the API\nserver, proxy, scheduler, controller, and etcd. If an attacker can gain access\nto these files, changes can be made to open vulnerabilities and bypass user\nauthorizations inherit within Kubernetes with RBAC implemented.",
              "label": "default"
            },
            {
              "data": "",
              "label": "rationale"
            },
            {
              "data": "On the Master node, change to the /etc/kubernetes/manifest directory. Run\nthe command:\n\n    ls -l *\n\n    Each manifest file must be owned by root:root.\n\n    If any manifest file is not owned by root:root, this is a finding.",
              "label": "check"
            },
            {
              "data": "On the Master node, change to the /etc/kubernetes/manifest directory. Run\nthe command:\n\n    chown root:root *\n\n    To verify the change took place, run the command:\n\n    ls -l *\n\n    All the manifest files should be owned by root:root.",
              "label": "fix"
            },
            {
              "data": "K3S deployments are not applied using manifest files and hence non-applicable.",
              "label": "caveat"
            }
          ],
          "id": "V-242405",
          "impact": 0.0,
          "refs": [
            {
              "ref": []
            }
          ],
          "results": [
            {
              "code_desc": "Kubernetes Manifest files not present of the target at specified path /etc/kubernetes/manifests. ",
              "resource": "",
              "resource_class": "Object",
              "resource_params": "[]",
              "run_time": 8.574e-6,
              "skip_message": "",
              "start_time": "2021-06-21T21:25:33-04:00",
              "status": "skipped"
            }
          ],
          "source_location": {
            "line": 3,
            "ref": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242405.rb"
          },
          "tags": {
            "cci": ["CCI-001499"],
            "fix_id": "F-45638r712570_fix",
            "gid": "V-242405",
            "gtitle": "SRG-APP-000133-CTR-000295",
            "nist": ["CM-5 (6)"],
            "rid": "SV-242405r712571_rule",
            "severity": "medium",
            "stig_id": "CNTR-K8-000860"
          },
          "title": "The Kubernetes manifests must be owned by root.",
          "waiver_data": {}
        },
        {
          "code": "control 'V-242406' do\n  title 'The Kubernetes kubelet configuration file must be owned by root.'\n  desc  \"The kubelet configuration file contains the runtime configuration of\nthe kubelet service. If an attacker can gain access to this file, changes can\nbe made to open vulnerabilities and bypass user authorizations inherent within\nKubernetes with RBAC implemented.\"\n  desc  'rationale', ''\n  desc  'check', \"\n    On the Master and worker nodes, change to the /etc/sysconfig directory. Run\nthe command:\n\n    ls -l kubelet\n\n    Each kubelet configuration file must be owned by root:root.\n\n    If any manifest file is not owned by root:root, this is a finding.\n  \"\n  desc 'fix', \"\n    On the Master and Worker nodes, change to the /etc/sysconfig directory. Run\nthe command:\n\n    chown root:root kubelet\n\n    To verify the change took place, run the command:\n\n    ls -l kubelet\n\n    The kubelet file should now be owned by root:root.\n  \"\n  impact 0.5\n  tag severity: 'medium'\n  tag gtitle: 'SRG-APP-000133-CTR-000300'\n  tag gid: 'V-242406'\n  tag rid: 'SV-242406r712574_rule'\n  tag stig_id: 'CNTR-K8-000880'\n  tag fix_id: 'F-45639r712573_fix'\n  tag cci: ['CCI-001499']\n  tag nist: ['CM-5 (6)']\n\n  describe kubelet do\n    its('config_file') { should be_owned_by('root') }\n    its('config_file') { should be_grouped_into('root') }\n  end\nend\n",
          "desc": "The kubelet configuration file contains the runtime configuration of\nthe kubelet service. If an attacker can gain access to this file, changes can\nbe made to open vulnerabilities and bypass user authorizations inherent within\nKubernetes with RBAC implemented.",
          "descriptions": [
            {
              "data": "The kubelet configuration file contains the runtime configuration of\nthe kubelet service. If an attacker can gain access to this file, changes can\nbe made to open vulnerabilities and bypass user authorizations inherent within\nKubernetes with RBAC implemented.",
              "label": "default"
            },
            {
              "data": "",
              "label": "rationale"
            },
            {
              "data": "On the Master and worker nodes, change to the /etc/sysconfig directory. Run\nthe command:\n\n    ls -l kubelet\n\n    Each kubelet configuration file must be owned by root:root.\n\n    If any manifest file is not owned by root:root, this is a finding.",
              "label": "check"
            },
            {
              "data": "On the Master and Worker nodes, change to the /etc/sysconfig directory. Run\nthe command:\n\n    chown root:root kubelet\n\n    To verify the change took place, run the command:\n\n    ls -l kubelet\n\n    The kubelet file should now be owned by root:root.",
              "label": "fix"
            }
          ],
          "id": "V-242406",
          "impact": 0.5,
          "refs": [],
          "results": [
            {
              "code_desc": "Process arguments for k3s config_file is expected to be owned by \"root\"",
              "resource_class": "kubelet",
              "resource_params": "[]",
              "run_time": 0.012447815,
              "start_time": "2021-06-21T21:25:33-04:00",
              "status": "passed"
            },
            {
              "code_desc": "Process arguments for k3s config_file is expected to be grouped into \"root\"",
              "resource_class": "kubelet",
              "resource_params": "[]",
              "run_time": 0.004845567,
              "start_time": "2021-06-21T21:25:33-04:00",
              "status": "passed"
            }
          ],
          "source_location": {
            "line": 3,
            "ref": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242406.rb"
          },
          "tags": {
            "cci": ["CCI-001499"],
            "fix_id": "F-45639r712573_fix",
            "gid": "V-242406",
            "gtitle": "SRG-APP-000133-CTR-000300",
            "nist": ["CM-5 (6)"],
            "rid": "SV-242406r712574_rule",
            "severity": "medium",
            "stig_id": "CNTR-K8-000880"
          },
          "title": "The Kubernetes kubelet configuration file must be owned by root.",
          "waiver_data": {}
        },
        {
          "code": "control 'V-242407' do\n  title 'The Kubernetes kubelet configuration file permissions set to 644 or\nmore restrictive.'\n  desc  \"The kubelet configuration file contains the runtime configuration of\nthe kubelet service. If an attacker can gain access to this file, changes can\nbe made to open vulnerabilities and bypass user authorizations inherit within\nKubernetes with RBAC implemented.\"\n  desc  'rationale', ''\n  desc  'check', \"\n    On the Master and worker nodes, change to the /etc/kubernetes/manifest\ndirectory. Run the command:\n\n    ls -l kubelet\n\n    Each kubelet configuration file must have permissions of \\\"644\\\" or more\nrestrictive.\n\n    If any kubelet configuration file is less restrictive than \\\"644\\\", this is\na finding.\n  \"\n  desc 'fix', \"\n    On the Master node, change to the /etc/kubernetes/manifest directory. Run\nthe command:\n\n    chmod 644 kubelet\n\n    To verify the change took place, run the command:\n\n    ls -l kubelet\n\n    The kubelet file should now have the permissions of \\\"644\\\".\n  \"\n  impact 0.5\n  tag severity: 'medium'\n  tag gtitle: 'SRG-APP-000133-CTR-000305'\n  tag gid: 'V-242407'\n  tag rid: 'SV-242407r712577_rule'\n  tag stig_id: 'CNTR-K8-000890'\n  tag fix_id: 'F-45640r712576_fix'\n  tag cci: ['CCI-001499']\n  tag nist: ['CM-5 (6)']\n\n  describe kubelet do\n    its('config_file') { should_not be_more_permissive_than('0644') }\n  end\nend\n",
          "desc": "The kubelet configuration file contains the runtime configuration of\nthe kubelet service. If an attacker can gain access to this file, changes can\nbe made to open vulnerabilities and bypass user authorizations inherit within\nKubernetes with RBAC implemented.",
          "descriptions": [
            {
              "data": "The kubelet configuration file contains the runtime configuration of\nthe kubelet service. If an attacker can gain access to this file, changes can\nbe made to open vulnerabilities and bypass user authorizations inherit within\nKubernetes with RBAC implemented.",
              "label": "default"
            },
            {
              "data": "",
              "label": "rationale"
            },
            {
              "data": "On the Master and worker nodes, change to the /etc/kubernetes/manifest\ndirectory. Run the command:\n\n    ls -l kubelet\n\n    Each kubelet configuration file must have permissions of \"644\" or more\nrestrictive.\n\n    If any kubelet configuration file is less restrictive than \"644\", this is\na finding.",
              "label": "check"
            },
            {
              "data": "On the Master node, change to the /etc/kubernetes/manifest directory. Run\nthe command:\n\n    chmod 644 kubelet\n\n    To verify the change took place, run the command:\n\n    ls -l kubelet\n\n    The kubelet file should now have the permissions of \"644\".",
              "label": "fix"
            }
          ],
          "id": "V-242407",
          "impact": 0.5,
          "refs": [],
          "results": [
            {
              "code_desc": "Process arguments for k3s config_file is expected not to be more permissive than \"0644\"",
              "resource_class": "kubelet",
              "resource_params": "[]",
              "run_time": 0.01282655,
              "start_time": "2021-06-21T21:25:33-04:00",
              "status": "passed"
            }
          ],
          "source_location": {
            "line": 3,
            "ref": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242407.rb"
          },
          "tags": {
            "cci": ["CCI-001499"],
            "fix_id": "F-45640r712576_fix",
            "gid": "V-242407",
            "gtitle": "SRG-APP-000133-CTR-000305",
            "nist": ["CM-5 (6)"],
            "rid": "SV-242407r712577_rule",
            "severity": "medium",
            "stig_id": "CNTR-K8-000890"
          },
          "title": "The Kubernetes kubelet configuration file permissions set to 644 or\nmore restrictive.",
          "waiver_data": {}
        },
        {
          "code": "control 'V-242408' do\n  title 'The Kubernetes manifests must have least privileges.'\n  desc  \"The manifest files contain the runtime configuration of the API\nserver, scheduler, controller, and etcd. If an attacker can gain access to\nthese files, changes can be made to open vulnerabilities and bypass user\nauthorizations inherent within Kubernetes with RBAC implemented.\n\n\n  \"\n  desc  'rationale', ''\n  desc  'check', \"\n    On the Master node, change to the /etc/kubernetes/manifest directory. Run\nthe command:\n\n    ls -l *\n\n    Each manifest file must have permissions \\\"644\\\" or more restrictive.\n\n    If any manifest file is less restrictive than \\\"644\\\", this is a finding.\n  \"\n  desc 'fix', \"\n    On the Master node, change to the /etc/kubernetes/manifest directory. Run\nthe command:\n\n    chmod 644 *\n\n    To verify the change took place, run the command:\n\n    ls -l *\n\n    All the manifest files should now have privileges of \\\"644\\\".\n  \"\n  impact 0.5\n  tag severity: 'medium'\n  tag gtitle: 'SRG-APP-000133-CTR-000310'\n  tag satisfies: ['SRG-APP-000133-CTR-000310', 'SRG-APP-000133-CTR-000295']\n  tag gid: 'V-242408'\n  tag rid: 'SV-242408r712580_rule'\n  tag stig_id: 'CNTR-K8-000900'\n  tag fix_id: 'F-45641r712579_fix'\n  tag cci: ['CCI-001499']\n  tag nist: ['CM-5 (6)']\n\n  manifests_path = input('manifests_path')\n  manifests_files = command(\"find #{manifests_path} -type f\").stdout.split\n\n  if manifests_files.empty?\n    desc 'caveat', \"Kubernetes Manifest files not present of the target at specified path #{manifests_path}.\"\n\n    describe \"Kubernetes Manifest files not present of the target at specified path #{manifests_path}.\" do\n      skip\n    end\n  end\n\n  manifests_files.each do |file_name|\n    describe file(file_name) do\n      it { should_not be_more_permissive_than('0644') }\n    end\n  end\nend\n",
          "desc": "The manifest files contain the runtime configuration of the API\nserver, scheduler, controller, and etcd. If an attacker can gain access to\nthese files, changes can be made to open vulnerabilities and bypass user\nauthorizations inherent within Kubernetes with RBAC implemented.",
          "descriptions": [
            {
              "data": "The manifest files contain the runtime configuration of the API\nserver, scheduler, controller, and etcd. If an attacker can gain access to\nthese files, changes can be made to open vulnerabilities and bypass user\nauthorizations inherent within Kubernetes with RBAC implemented.",
              "label": "default"
            },
            {
              "data": "",
              "label": "rationale"
            },
            {
              "data": "On the Master node, change to the /etc/kubernetes/manifest directory. Run\nthe command:\n\n    ls -l *\n\n    Each manifest file must have permissions \"644\" or more restrictive.\n\n    If any manifest file is less restrictive than \"644\", this is a finding.",
              "label": "check"
            },
            {
              "data": "On the Master node, change to the /etc/kubernetes/manifest directory. Run\nthe command:\n\n    chmod 644 *\n\n    To verify the change took place, run the command:\n\n    ls -l *\n\n    All the manifest files should now have privileges of \"644\".",
              "label": "fix"
            },
            {
              "data": "K3S deployments are not applied using manifest files and hence non-applicable.",
              "label": "caveat"
            }
          ],
          "id": "V-242408",
          "impact": 0.0,
          "refs": [
            {
              "ref": []
            }
          ],
          "results": [
            {
              "code_desc": "Kubernetes Manifest files not present of the target at specified path /etc/kubernetes/manifests. ",
              "resource": "",
              "resource_class": "Object",
              "resource_params": "[]",
              "run_time": 1.1117e-5,
              "skip_message": "",
              "start_time": "2021-06-21T21:25:33-04:00",
              "status": "skipped"
            }
          ],
          "source_location": {
            "line": 3,
            "ref": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242408.rb"
          },
          "tags": {
            "cci": ["CCI-001499"],
            "fix_id": "F-45641r712579_fix",
            "gid": "V-242408",
            "gtitle": "SRG-APP-000133-CTR-000310",
            "nist": ["CM-5 (6)"],
            "rid": "SV-242408r712580_rule",
            "satisfies": [
              "SRG-APP-000133-CTR-000310",
              "SRG-APP-000133-CTR-000295"
            ],
            "severity": "medium",
            "stig_id": "CNTR-K8-000900"
          },
          "title": "The Kubernetes manifests must have least privileges.",
          "waiver_data": {}
        },
        {
          "code": "control 'V-242409' do\n  title 'Kubernetes Controller Manager must disable profiling.'\n  desc  \"Kubernetes profiling provides the ability to analyze and troubleshoot\nController Manager events over a web interface on a host port. Enabling this\nservice can expose details about the Kubernetes architecture. This service must\nnot be enabled unless deemed necessary.\"\n  desc  'rationale', ''\n  desc  'check', \"\n    Change to the /etc/kubernetes/manifests/ directory on the Kubernetes Master\nNode. Run the command:\n\n    grep -i profiling *\n\n    If the setting \\\"profiling\\\" is not configured in the Kubernetes Controller\nManager manifest file or it is set to \\\"True\\\", this is a finding.\n  \"\n  desc 'fix', \"Edit the Kubernetes Controller Manager manifest file in the\n/etc/kubernetes/manifests directory on the Kubernetes Master Node. Set the\nargument \\\"--profiling value\\\" to \\\"false\\\".\"\n  impact 0.5\n  tag severity: 'medium'\n  tag gtitle: 'SRG-APP-000141-CTR-000315'\n  tag gid: 'V-242409'\n  tag rid: 'SV-242409r712583_rule'\n  tag stig_id: 'CNTR-K8-000910'\n  tag fix_id: 'F-45642r712582_fix'\n  tag cci: ['CCI-000381']\n  tag nist: ['CM-7 a']\n\n  unless kube_controller_manager.exist?\n    impact 0.0\n    desc 'caveat', 'Kubernetes Controller Manager process is not running on the target.'\n  end\n\n  describe kube_controller_manager do\n    its('profiling') { should cmp 'false' }\n  end\nend\n",
          "desc": "Kubernetes profiling provides the ability to analyze and troubleshoot\nController Manager events over a web interface on a host port. Enabling this\nservice can expose details about the Kubernetes architecture. This service must\nnot be enabled unless deemed necessary.",
          "descriptions": [
            {
              "data": "Kubernetes profiling provides the ability to analyze and troubleshoot\nController Manager events over a web interface on a host port. Enabling this\nservice can expose details about the Kubernetes architecture. This service must\nnot be enabled unless deemed necessary.",
              "label": "default"
            },
            {
              "data": "",
              "label": "rationale"
            },
            {
              "data": "Change to the /etc/kubernetes/manifests/ directory on the Kubernetes Master\nNode. Run the command:\n\n    grep -i profiling *\n\n    If the setting \"profiling\" is not configured in the Kubernetes Controller\nManager manifest file or it is set to \"True\", this is a finding.",
              "label": "check"
            },
            {
              "data": "Edit the Kubernetes Controller Manager manifest file in the\n/etc/kubernetes/manifests directory on the Kubernetes Master Node. Set the\nargument \"--profiling value\" to \"false\".",
              "label": "fix"
            }
          ],
          "id": "V-242409",
          "impact": 0.5,
          "refs": [],
          "results": [
            {
              "code_desc": "Process arguments for k3s server profiling is expected to cmp == \"false\"",
              "resource_class": "kube_controller_manager",
              "resource_params": "[]",
              "run_time": 0.007251712,
              "start_time": "2021-06-21T21:25:33-04:00",
              "status": "passed"
            }
          ],
          "source_location": {
            "line": 3,
            "ref": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242409.rb"
          },
          "tags": {
            "cci": ["CCI-000381"],
            "fix_id": "F-45642r712582_fix",
            "gid": "V-242409",
            "gtitle": "SRG-APP-000141-CTR-000315",
            "nist": ["CM-7 a"],
            "rid": "SV-242409r712583_rule",
            "severity": "medium",
            "stig_id": "CNTR-K8-000910"
          },
          "title": "Kubernetes Controller Manager must disable profiling.",
          "waiver_data": {}
        },
        {
          "code": "control 'V-242416' do\n  title 'Kubernetes Kubelet must not disable timeouts.'\n  desc  \"Idle connections from the Kubelet can be use by unauthorized users to\nperform malicious activity to the nodes, pods, containers, and cluster within\nthe Kubernetes Control Plane. Setting the streaming connection idle timeout\ndefines the maximum time an idle session is permitted prior to disconnect.\nSetting the value to \\\"0\\\" never disconnects any idle sessions. Idle timeouts\nmust never be set to \\\"0\\\" and should be defined at a minimum of \\\"5 minutes\\\".\"\n  desc  'rationale', ''\n  desc  'check', \"\n    Change to the /etc/sysconfig/ directory on the Kubernetes Master Node. Run\nthe command:\n\n    grep -i streaming-connection-idle-timeout kubelet\n\n    If the setting streaming-connection-idle-timeout is set to \\\"0\\\" or the\nparameter is not configured in the Kubernetes Kubelet, this is a finding.\n  \"\n  desc 'fix', \"\n    Edit the Kubernetes Kubelet file in the /etc/sysconfig directory on the\nKubernetes Master Node. Set the argument\n\\\"--streaming-connection-idle-timeout\\\" to a value other than \\\"0\\\". Reset\nKubelet service using the following command:\n\n    service kubelet restart\n  \"\n  impact 0.5\n  tag severity: 'medium'\n  tag gtitle: 'SRG-APP-000516-CTR-001325'\n  tag gid: 'V-242416'\n  tag rid: 'SV-242416r712604_rule'\n  tag stig_id: 'CNTR-K8-001300'\n  tag fix_id: 'F-45649r712603_fix'\n  tag cci: ['CCI-001133']\n  tag nist: ['SC-10']\n\n  describe.one do\n    describe kubelet do\n      its('streaming-connection-idle-timeout') { should_not be_nil }\n      its('streaming-connection-idle-timeout') { should_not cmp 0 }\n    end\n\n    describe kubelet_config_file do\n      its('streamingConnectionIdleTimeout') { should_not be_nil }\n      its('streamingConnectionIdleTimeout') { should_not cmp 0 }\n    end\n  end\nend\n",
          "desc": "Idle connections from the Kubelet can be use by unauthorized users to\nperform malicious activity to the nodes, pods, containers, and cluster within\nthe Kubernetes Control Plane. Setting the streaming connection idle timeout\ndefines the maximum time an idle session is permitted prior to disconnect.\nSetting the value to \"0\" never disconnects any idle sessions. Idle timeouts\nmust never be set to \"0\" and should be defined at a minimum of \"5 minutes\".",
          "descriptions": [
            {
              "data": "Idle connections from the Kubelet can be use by unauthorized users to\nperform malicious activity to the nodes, pods, containers, and cluster within\nthe Kubernetes Control Plane. Setting the streaming connection idle timeout\ndefines the maximum time an idle session is permitted prior to disconnect.\nSetting the value to \"0\" never disconnects any idle sessions. Idle timeouts\nmust never be set to \"0\" and should be defined at a minimum of \"5 minutes\".",
              "label": "default"
            },
            {
              "data": "",
              "label": "rationale"
            },
            {
              "data": "Change to the /etc/sysconfig/ directory on the Kubernetes Master Node. Run\nthe command:\n\n    grep -i streaming-connection-idle-timeout kubelet\n\n    If the setting streaming-connection-idle-timeout is set to \"0\" or the\nparameter is not configured in the Kubernetes Kubelet, this is a finding.",
              "label": "check"
            },
            {
              "data": "Edit the Kubernetes Kubelet file in the /etc/sysconfig directory on the\nKubernetes Master Node. Set the argument\n\"--streaming-connection-idle-timeout\" to a value other than \"0\". Reset\nKubelet service using the following command:\n\n    service kubelet restart",
              "label": "fix"
            }
          ],
          "id": "V-242416",
          "impact": 0.5,
          "refs": [],
          "results": [
            {
              "code_desc": "Process arguments for k3s streaming-connection-idle-timeout is expected not to be nil",
              "resource_class": "kubelet",
              "resource_params": "[]",
              "run_time": 0.00023873,
              "start_time": "2021-06-21T21:25:33-04:00",
              "status": "passed"
            },
            {
              "code_desc": "Process arguments for k3s streaming-connection-idle-timeout is expected not to cmp == 0",
              "resource_class": "kubelet",
              "resource_params": "[]",
              "run_time": 0.000169786,
              "start_time": "2021-06-21T21:25:33-04:00",
              "status": "passed"
            }
          ],
          "source_location": {
            "line": 3,
            "ref": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242416.rb"
          },
          "tags": {
            "cci": ["CCI-001133"],
            "fix_id": "F-45649r712603_fix",
            "gid": "V-242416",
            "gtitle": "SRG-APP-000516-CTR-001325",
            "nist": ["SC-10"],
            "rid": "SV-242416r712604_rule",
            "severity": "medium",
            "stig_id": "CNTR-K8-001300"
          },
          "title": "Kubernetes Kubelet must not disable timeouts.",
          "waiver_data": {}
        },
        {
          "code": "control 'V-242418' do\n  title 'The Kubernetes API server must use approved cipher suites.'\n  desc  \"The Kubernetes API server communicates to the kubelet service on the\nnodes to deploy, update, and delete resources. If an attacker were able to get\nbetween this communication and modify the request, the Kubernetes cluster could\nbe compromised. Using approved cypher suites for the communication ensures the\nprotection of the transmitted information, confidentiality, and integrity so\nthat the attacker cannot read or alter this communication.\"\n  desc  'rationale', ''\n  desc  'check', \"\n    Change to the /etc/kubernetes/manifests/ directory on the Kubernetes Master\nNode. Run the command:\n\n    grep -i tls-cipher-suites *\n\n    If the setting feature tls-cipher-suites is not set in the Kubernetes API\nserver manifest file or contains no value or does not contain\nTLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM\n_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM\n_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM\n_SHA384, this is a finding.\n  \"\n  desc 'fix', \"\n    Edit the Kubernetes API Server manifest file in the\n/etc/kubernetes/manifests directory on the Kubernetes Master Node. Set the\nvalue of tls-cipher-suites to:\n    TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM\n_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM\n_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM\n_SHA384\n  \"\n  impact 0.5\n  tag severity: 'medium'\n  tag gtitle: 'SRG-APP-000219-CTR-000550'\n  tag gid: 'V-242418'\n  tag rid: 'SV-242418r712610_rule'\n  tag stig_id: 'CNTR-K8-001400'\n  tag fix_id: 'F-45651r717025_fix'\n  tag cci: ['CCI-001184']\n  tag nist: ['SC-23']\n\n  unless kube_apiserver.exist?\n    impact 0.0\n    desc 'caveat', 'Kubernetes API Server process is not running on the target.'\n  end\n\n  describe kube_apiserver do\n    its('tls_cipher_suites') { should include 'TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256' }\n    its('tls_cipher_suites') { should include 'TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256' }\n    its('tls_cipher_suites') { should include 'TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305' }\n    its('tls_cipher_suites') { should include 'TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384' }\n    its('tls_cipher_suites') { should include 'TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305' }\n    its('tls_cipher_suites') { should include 'TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384' }\n    its('tls_cipher_suites.count') { should cmp 6 }\n  end\nend\n",
          "desc": "The Kubernetes API server communicates to the kubelet service on the\nnodes to deploy, update, and delete resources. If an attacker were able to get\nbetween this communication and modify the request, the Kubernetes cluster could\nbe compromised. Using approved cypher suites for the communication ensures the\nprotection of the transmitted information, confidentiality, and integrity so\nthat the attacker cannot read or alter this communication.",
          "descriptions": [
            {
              "data": "The Kubernetes API server communicates to the kubelet service on the\nnodes to deploy, update, and delete resources. If an attacker were able to get\nbetween this communication and modify the request, the Kubernetes cluster could\nbe compromised. Using approved cypher suites for the communication ensures the\nprotection of the transmitted information, confidentiality, and integrity so\nthat the attacker cannot read or alter this communication.",
              "label": "default"
            },
            {
              "data": "",
              "label": "rationale"
            },
            {
              "data": "Change to the /etc/kubernetes/manifests/ directory on the Kubernetes Master\nNode. Run the command:\n\n    grep -i tls-cipher-suites *\n\n    If the setting feature tls-cipher-suites is not set in the Kubernetes API\nserver manifest file or contains no value or does not contain\nTLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM\n_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM\n_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM\n_SHA384, this is a finding.",
              "label": "check"
            },
            {
              "data": "Edit the Kubernetes API Server manifest file in the\n/etc/kubernetes/manifests directory on the Kubernetes Master Node. Set the\nvalue of tls-cipher-suites to:\n    TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM\n_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM\n_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM\n_SHA384",
              "label": "fix"
            }
          ],
          "id": "V-242418",
          "impact": 0.5,
          "refs": [],
          "results": [
            {
              "code_desc": "Process arguments for k3s server tls_cipher_suites is expected to include \"TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256\"",
              "resource_class": "kube_apiserver",
              "resource_params": "[]",
              "run_time": 0.00744602,
              "start_time": "2021-06-21T21:25:33-04:00",
              "status": "passed"
            },
            {
              "code_desc": "Process arguments for k3s server tls_cipher_suites is expected to include \"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256\"",
              "resource_class": "kube_apiserver",
              "resource_params": "[]",
              "run_time": 0.00012943,
              "start_time": "2021-06-21T21:25:33-04:00",
              "status": "passed"
            },
            {
              "code_desc": "Process arguments for k3s server tls_cipher_suites is expected to include \"TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305\"",
              "resource_class": "kube_apiserver",
              "resource_params": "[]",
              "run_time": 0.000119703,
              "start_time": "2021-06-21T21:25:33-04:00",
              "status": "passed"
            },
            {
              "code_desc": "Process arguments for k3s server tls_cipher_suites is expected to include \"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384\"",
              "resource_class": "kube_apiserver",
              "resource_params": "[]",
              "run_time": 0.000144398,
              "start_time": "2021-06-21T21:25:33-04:00",
              "status": "passed"
            },
            {
              "code_desc": "Process arguments for k3s server tls_cipher_suites is expected to include \"TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305\"",
              "resource_class": "kube_apiserver",
              "resource_params": "[]",
              "run_time": 0.000116997,
              "start_time": "2021-06-21T21:25:33-04:00",
              "status": "passed"
            },
            {
              "code_desc": "Process arguments for k3s server tls_cipher_suites is expected to include \"TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384\"",
              "resource_class": "kube_apiserver",
              "resource_params": "[]",
              "run_time": 0.00011439,
              "start_time": "2021-06-21T21:25:33-04:00",
              "status": "passed"
            },
            {
              "code_desc": "Process arguments for k3s server tls_cipher_suites.count is expected to cmp == 6",
              "resource_class": "kube_apiserver",
              "resource_params": "[]",
              "run_time": 0.000186609,
              "start_time": "2021-06-21T21:25:33-04:00",
              "status": "passed"
            }
          ],
          "source_location": {
            "line": 3,
            "ref": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242418.rb"
          },
          "tags": {
            "cci": ["CCI-001184"],
            "fix_id": "F-45651r717025_fix",
            "gid": "V-242418",
            "gtitle": "SRG-APP-000219-CTR-000550",
            "nist": ["SC-23"],
            "rid": "SV-242418r712610_rule",
            "severity": "medium",
            "stig_id": "CNTR-K8-001400"
          },
          "title": "The Kubernetes API server must use approved cipher suites.",
          "waiver_data": {}
        },
        {
          "code": "control 'V-242419' do\n  title 'Kubernetes API Server must have the SSL Certificate Authority set.'\n  desc  \"Kubernetes control plane and external communication is managed by API\nServer. The main implementation of the API Server is to manage hardware\nresources for pods and containers using horizontal or vertical scaling. Anyone\nwho can access the API Server can effectively control the Kubernetes\narchitecture. Using authenticity protection, the communication can be protected\nagainst man-in-the-middle attacks/session hijacking and the insertion of false\ninformation into sessions.\n\n    The communication session is protected by utilizing transport encryption\nprotocols, such as TLS. TLS provides the Kubernetes API Server with a means to\nbe able to authenticate sessions and encrypt traffic.\n\n    To enable encrypted communication for API Server, the parameter etcd-cafile\nmust be set. This parameter gives the location of the SSL Certificate Authority\nfile used to secure API Server communication.\n  \"\n  desc  'rationale', ''\n  desc  'check', \"\n    Change to the /etc/kubernetes/manifests/ directory on the Kubernetes Master\nNode. Run the command:\n\n    grep -i client-ca-file *\n\n    If the setting feature client-ca-file is not set in the Kubernetes API\nserver manifest file or contains no value, this is a finding.\n  \"\n  desc 'fix', \"Edit the Kubernetes API Server manifest file in the\n/etc/kubernetes/manifests directory on the Kubernetes Master Node. Set the\nvalue of client-ca-file to path containing Approved Organizational Certificate.\"\n  impact 0.5\n  tag severity: 'medium'\n  tag gtitle: 'SRG-APP-000219-CTR-000550'\n  tag gid: 'V-242419'\n  tag rid: 'SV-242419r712613_rule'\n  tag stig_id: 'CNTR-K8-001410'\n  tag fix_id: 'F-45652r712612_fix'\n  tag cci: ['CCI-001184']\n  tag nist: ['SC-23']\n\n  unless kube_apiserver.exist?\n    impact 0.0\n    desc 'caveat', 'Kubernetes API Server process is not running on the target.'\n  end\n\n  describe kube_apiserver do\n    its('client-ca-file') { should_not be_nil }\n  end\nend\n",
          "desc": "Kubernetes control plane and external communication is managed by API\nServer. The main implementation of the API Server is to manage hardware\nresources for pods and containers using horizontal or vertical scaling. Anyone\nwho can access the API Server can effectively control the Kubernetes\narchitecture. Using authenticity protection, the communication can be protected\nagainst man-in-the-middle attacks/session hijacking and the insertion of false\ninformation into sessions.\n\n    The communication session is protected by utilizing transport encryption\nprotocols, such as TLS. TLS provides the Kubernetes API Server with a means to\nbe able to authenticate sessions and encrypt traffic.\n\n    To enable encrypted communication for API Server, the parameter etcd-cafile\nmust be set. This parameter gives the location of the SSL Certificate Authority\nfile used to secure API Server communication.",
          "descriptions": [
            {
              "data": "Kubernetes control plane and external communication is managed by API\nServer. The main implementation of the API Server is to manage hardware\nresources for pods and containers using horizontal or vertical scaling. Anyone\nwho can access the API Server can effectively control the Kubernetes\narchitecture. Using authenticity protection, the communication can be protected\nagainst man-in-the-middle attacks/session hijacking and the insertion of false\ninformation into sessions.\n\n    The communication session is protected by utilizing transport encryption\nprotocols, such as TLS. TLS provides the Kubernetes API Server with a means to\nbe able to authenticate sessions and encrypt traffic.\n\n    To enable encrypted communication for API Server, the parameter etcd-cafile\nmust be set. This parameter gives the location of the SSL Certificate Authority\nfile used to secure API Server communication.",
              "label": "default"
            },
            {
              "data": "",
              "label": "rationale"
            },
            {
              "data": "Change to the /etc/kubernetes/manifests/ directory on the Kubernetes Master\nNode. Run the command:\n\n    grep -i client-ca-file *\n\n    If the setting feature client-ca-file is not set in the Kubernetes API\nserver manifest file or contains no value, this is a finding.",
              "label": "check"
            },
            {
              "data": "Edit the Kubernetes API Server manifest file in the\n/etc/kubernetes/manifests directory on the Kubernetes Master Node. Set the\nvalue of client-ca-file to path containing Approved Organizational Certificate.",
              "label": "fix"
            }
          ],
          "id": "V-242419",
          "impact": 0.5,
          "refs": [],
          "results": [
            {
              "code_desc": "Process arguments for k3s server client-ca-file is expected not to be nil",
              "resource_class": "kube_apiserver",
              "resource_params": "[]",
              "run_time": 0.007924113,
              "start_time": "2021-06-21T21:25:33-04:00",
              "status": "passed"
            }
          ],
          "source_location": {
            "line": 3,
            "ref": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242419.rb"
          },
          "tags": {
            "cci": ["CCI-001184"],
            "fix_id": "F-45652r712612_fix",
            "gid": "V-242419",
            "gtitle": "SRG-APP-000219-CTR-000550",
            "nist": ["SC-23"],
            "rid": "SV-242419r712613_rule",
            "severity": "medium",
            "stig_id": "CNTR-K8-001410"
          },
          "title": "Kubernetes API Server must have the SSL Certificate Authority set.",
          "waiver_data": {}
        },
        {
          "code": "control 'V-242420' do\n  title 'Kubernetes Kubelet must have the SSL Certificate Authority set.'\n  desc  \"Kubernetes container and pod configuration are maintained by Kubelet.\nKubelet agents register nodes with the API Server, mount volume storage, and\nperform health checks for containers and pods. Anyone who gains access to\nKubelet agents can effectively control applications within the pods and\ncontainers. Using authenticity protection, the communication can be protected\nagainst man-in-the-middle attacks/session hijacking and the insertion of false\ninformation into sessions.\n\n    The communication session is protected by utilizing transport encryption\nprotocols, such as TLS. TLS provides the Kubernetes API Server with a means to\nbe able to authenticate sessions and encrypt traffic.\n\n    To enable encrypted communication for Kubelet, the parameter etcd-cafile\nmust be set. This parameter gives the location of the SSL Certificate Authority\nfile used to secure Kubelet communication.\n  \"\n  desc  'rationale', ''\n  desc  'check', \"\n    Change to the /etc/sysconfig/ directory on the Kubernetes Master Node. Run\nthe command:\n\n    grep -i client-ca-file kubelet\n\n    If the setting client-ca-file is not set in the Kubernetes API server\nmanifest file or contains no value, this is a finding.\n  \"\n  desc 'fix', \"\n    Edit the Kubernetes Kubelet file in the /etc/sysconfig/ directory on the\nKubernetes Master Node. Set the value of client-ca-file to path containing\nApproved Organizational Certificate.\n\n    Reset Kubelet service using the following command:\n    service kubelet restart\n  \"\n  impact 0.5\n  tag severity: 'medium'\n  tag gtitle: 'SRG-APP-000219-CTR-000550'\n  tag gid: 'V-242420'\n  tag rid: 'SV-242420r712616_rule'\n  tag stig_id: 'CNTR-K8-001420'\n  tag fix_id: 'F-45653r717026_fix'\n  tag cci: ['CCI-001184']\n  tag nist: ['SC-23']\n\n  describe.one do\n    describe kubelet do\n      its('client-ca-file') { should_not be_nil }\n    end\n\n    describe kubelet_config_file do\n      its(%w(authentication x509 clientCAFile)) { should_not be_nil }\n    end\n  end\nend\n",
          "desc": "Kubernetes container and pod configuration are maintained by Kubelet.\nKubelet agents register nodes with the API Server, mount volume storage, and\nperform health checks for containers and pods. Anyone who gains access to\nKubelet agents can effectively control applications within the pods and\ncontainers. Using authenticity protection, the communication can be protected\nagainst man-in-the-middle attacks/session hijacking and the insertion of false\ninformation into sessions.\n\n    The communication session is protected by utilizing transport encryption\nprotocols, such as TLS. TLS provides the Kubernetes API Server with a means to\nbe able to authenticate sessions and encrypt traffic.\n\n    To enable encrypted communication for Kubelet, the parameter etcd-cafile\nmust be set. This parameter gives the location of the SSL Certificate Authority\nfile used to secure Kubelet communication.",
          "descriptions": [
            {
              "data": "Kubernetes container and pod configuration are maintained by Kubelet.\nKubelet agents register nodes with the API Server, mount volume storage, and\nperform health checks for containers and pods. Anyone who gains access to\nKubelet agents can effectively control applications within the pods and\ncontainers. Using authenticity protection, the communication can be protected\nagainst man-in-the-middle attacks/session hijacking and the insertion of false\ninformation into sessions.\n\n    The communication session is protected by utilizing transport encryption\nprotocols, such as TLS. TLS provides the Kubernetes API Server with a means to\nbe able to authenticate sessions and encrypt traffic.\n\n    To enable encrypted communication for Kubelet, the parameter etcd-cafile\nmust be set. This parameter gives the location of the SSL Certificate Authority\nfile used to secure Kubelet communication.",
              "label": "default"
            },
            {
              "data": "",
              "label": "rationale"
            },
            {
              "data": "Change to the /etc/sysconfig/ directory on the Kubernetes Master Node. Run\nthe command:\n\n    grep -i client-ca-file kubelet\n\n    If the setting client-ca-file is not set in the Kubernetes API server\nmanifest file or contains no value, this is a finding.",
              "label": "check"
            },
            {
              "data": "Edit the Kubernetes Kubelet file in the /etc/sysconfig/ directory on the\nKubernetes Master Node. Set the value of client-ca-file to path containing\nApproved Organizational Certificate.\n\n    Reset Kubelet service using the following command:\n    service kubelet restart",
              "label": "fix"
            }
          ],
          "id": "V-242420",
          "impact": 0.5,
          "refs": [],
          "results": [
            {
              "code_desc": "Process arguments for k3s client-ca-file is expected not to be nil",
              "resource_class": "kubelet",
              "resource_params": "[]",
              "run_time": 9.5829e-5,
              "start_time": "2021-06-21T21:25:33-04:00",
              "status": "passed"
            }
          ],
          "source_location": {
            "line": 3,
            "ref": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242420.rb"
          },
          "tags": {
            "cci": ["CCI-001184"],
            "fix_id": "F-45653r717026_fix",
            "gid": "V-242420",
            "gtitle": "SRG-APP-000219-CTR-000550",
            "nist": ["SC-23"],
            "rid": "SV-242420r712616_rule",
            "severity": "medium",
            "stig_id": "CNTR-K8-001420"
          },
          "title": "Kubernetes Kubelet must have the SSL Certificate Authority set.",
          "waiver_data": {}
        },
        {
          "code": "control 'V-242421' do\n  title \"Kubernetes Controller Manager must have the SSL Certificate Authority\nset.\"\n  desc  \"The Kubernetes Controller Manager is responsible for creating service\naccounts and tokens for the API Server, maintaining the correct number of pods\nfor every replication controller and provides notifications when nodes are\noffline.\n\n    Anyone who gains access to the Controller Manager can generate backdoor\naccounts, take possession of, or diminish system performance without detection\nby disabling system notification. Using authenticity protection, the\ncommunication can be protected against man-in-the-middle attacks/session\nhijacking and the insertion of false information into sessions.\n\n    The communication session is protected by utilizing transport encryption\nprotocols, such as TLS. TLS provides the Kubernetes Controller Manager with a\nmeans to be able to authenticate sessions and encrypt traffic.\n  \"\n  desc  'rationale', ''\n  desc  'check', \"\n    Change to the /etc/kubernetes/manifests/ directory on the Kubernetes Master\nNode. Run the command:\n\n    grep -i root-ca-file *\n\n    If the setting client-ca-file is not set in the Kubernetes Controller\nManager manifest file or contains no value, this is a finding.\n  \"\n  desc 'fix', \"Edit the Kubernetes Controller Manager manifest file in the\n/etc/kubernetes/manifests directory on the Kubernetes Master Node. Set the\nvalue of root-ca-file to path containing Approved Organizational Certificate.\"\n  impact 0.5\n  tag severity: 'medium'\n  tag gtitle: 'SRG-APP-000219-CTR-000550'\n  tag gid: 'V-242421'\n  tag rid: 'SV-242421r717033_rule'\n  tag stig_id: 'CNTR-K8-001430'\n  tag fix_id: 'F-45654r712618_fix'\n  tag cci: ['CCI-001184']\n  tag nist: ['SC-23']\n\n  unless kube_controller_manager.exist?\n    impact 0.0\n    desc 'caveat', 'Kubernetes Controller Manager process is not running on the target.'\n  end\n\n  describe kube_controller_manager do\n    its('root-ca-file') { should_not be_nil }\n  end\nend\n",
          "desc": "The Kubernetes Controller Manager is responsible for creating service\naccounts and tokens for the API Server, maintaining the correct number of pods\nfor every replication controller and provides notifications when nodes are\noffline.\n\n    Anyone who gains access to the Controller Manager can generate backdoor\naccounts, take possession of, or diminish system performance without detection\nby disabling system notification. Using authenticity protection, the\ncommunication can be protected against man-in-the-middle attacks/session\nhijacking and the insertion of false information into sessions.\n\n    The communication session is protected by utilizing transport encryption\nprotocols, such as TLS. TLS provides the Kubernetes Controller Manager with a\nmeans to be able to authenticate sessions and encrypt traffic.",
          "descriptions": [
            {
              "data": "The Kubernetes Controller Manager is responsible for creating service\naccounts and tokens for the API Server, maintaining the correct number of pods\nfor every replication controller and provides notifications when nodes are\noffline.\n\n    Anyone who gains access to the Controller Manager can generate backdoor\naccounts, take possession of, or diminish system performance without detection\nby disabling system notification. Using authenticity protection, the\ncommunication can be protected against man-in-the-middle attacks/session\nhijacking and the insertion of false information into sessions.\n\n    The communication session is protected by utilizing transport encryption\nprotocols, such as TLS. TLS provides the Kubernetes Controller Manager with a\nmeans to be able to authenticate sessions and encrypt traffic.",
              "label": "default"
            },
            {
              "data": "",
              "label": "rationale"
            },
            {
              "data": "Change to the /etc/kubernetes/manifests/ directory on the Kubernetes Master\nNode. Run the command:\n\n    grep -i root-ca-file *\n\n    If the setting client-ca-file is not set in the Kubernetes Controller\nManager manifest file or contains no value, this is a finding.",
              "label": "check"
            },
            {
              "data": "Edit the Kubernetes Controller Manager manifest file in the\n/etc/kubernetes/manifests directory on the Kubernetes Master Node. Set the\nvalue of root-ca-file to path containing Approved Organizational Certificate.",
              "label": "fix"
            }
          ],
          "id": "V-242421",
          "impact": 0.5,
          "refs": [],
          "results": [
            {
              "code_desc": "Process arguments for k3s server root-ca-file is expected not to be nil",
              "resource_class": "kube_controller_manager",
              "resource_params": "[]",
              "run_time": 0.007746128,
              "start_time": "2021-06-21T21:25:33-04:00",
              "status": "passed"
            }
          ],
          "source_location": {
            "line": 3,
            "ref": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242421.rb"
          },
          "tags": {
            "cci": ["CCI-001184"],
            "fix_id": "F-45654r712618_fix",
            "gid": "V-242421",
            "gtitle": "SRG-APP-000219-CTR-000550",
            "nist": ["SC-23"],
            "rid": "SV-242421r717033_rule",
            "severity": "medium",
            "stig_id": "CNTR-K8-001430"
          },
          "title": "Kubernetes Controller Manager must have the SSL Certificate Authority\nset.",
          "waiver_data": {}
        },
        {
          "code": "control 'V-242422' do\n  title 'Kubernetes API Server must have a certificate for communication.'\n  desc  \"Kubernetes control plane and external communication is managed by API\nServer. The main implementation of the API Server is to manage hardware\nresources for pods and container using horizontal or vertical scaling. Anyone\nwho can access the API Server can effectively control the Kubernetes\narchitecture. Using authenticity protection, the communication can be protected\nagainst man-in-the-middle attacks/session hijacking and the insertion of false\ninformation into sessions.\n\n    The communication session is protected by utilizing transport encryption\nprotocols, such as TLS. TLS provides the Kubernetes API Server with a means to\nbe able to authenticate sessions and encrypt traffic.\n\n    To enable encrypted communication for API Server, the parameter etcd-cafile\nmust be set. This parameter gives the location of the SSL Certificate Authority\nfile used to secure API Server communication.\n  \"\n  desc  'rationale', ''\n  desc  'check', \"\n    Change to the /etc/kubernetes/manifests/ directory on the Kubernetes Master\nNode. Run the command:\n\n    grep -i tls-cert-file *\n    grep -i tls-private-key-file *\n\n    If the setting tls-cert-file and private-key-file is not set in the\nKubernetes API server manifest file or contains no value, this is a finding.\n  \"\n  desc 'fix', \"Edit the Kubernetes API Server manifest file in the\n/etc/kubernetes/manifests directory on the Kubernetes Master Node. Set the\nvalue of tls-cert-file and tls-private-key-file to path containing Approved\nOrganizational Certificate.\"\n  impact 0.5\n  tag severity: 'medium'\n  tag gtitle: 'SRG-APP-000219-CTR-000550'\n  tag gid: 'V-242422'\n  tag rid: 'SV-242422r712622_rule'\n  tag stig_id: 'CNTR-K8-001440'\n  tag fix_id: 'F-45655r712621_fix'\n  tag cci: ['CCI-001184']\n  tag nist: ['SC-23']\n\n  unless kube_apiserver.exist?\n    impact 0.0\n    desc 'caveat', 'Kubernetes API Server process is not running on the target.'\n  end\n\n  describe kube_apiserver do\n    its('tls-cert-file') { should_not be_nil }\n    its('tls-private-key-file') { should_not be_nil }\n  end\nend\n",
          "desc": "Kubernetes control plane and external communication is managed by API\nServer. The main implementation of the API Server is to manage hardware\nresources for pods and container using horizontal or vertical scaling. Anyone\nwho can access the API Server can effectively control the Kubernetes\narchitecture. Using authenticity protection, the communication can be protected\nagainst man-in-the-middle attacks/session hijacking and the insertion of false\ninformation into sessions.\n\n    The communication session is protected by utilizing transport encryption\nprotocols, such as TLS. TLS provides the Kubernetes API Server with a means to\nbe able to authenticate sessions and encrypt traffic.\n\n    To enable encrypted communication for API Server, the parameter etcd-cafile\nmust be set. This parameter gives the location of the SSL Certificate Authority\nfile used to secure API Server communication.",
          "descriptions": [
            {
              "data": "Kubernetes control plane and external communication is managed by API\nServer. The main implementation of the API Server is to manage hardware\nresources for pods and container using horizontal or vertical scaling. Anyone\nwho can access the API Server can effectively control the Kubernetes\narchitecture. Using authenticity protection, the communication can be protected\nagainst man-in-the-middle attacks/session hijacking and the insertion of false\ninformation into sessions.\n\n    The communication session is protected by utilizing transport encryption\nprotocols, such as TLS. TLS provides the Kubernetes API Server with a means to\nbe able to authenticate sessions and encrypt traffic.\n\n    To enable encrypted communication for API Server, the parameter etcd-cafile\nmust be set. This parameter gives the location of the SSL Certificate Authority\nfile used to secure API Server communication.",
              "label": "default"
            },
            {
              "data": "",
              "label": "rationale"
            },
            {
              "data": "Change to the /etc/kubernetes/manifests/ directory on the Kubernetes Master\nNode. Run the command:\n\n    grep -i tls-cert-file *\n    grep -i tls-private-key-file *\n\n    If the setting tls-cert-file and private-key-file is not set in the\nKubernetes API server manifest file or contains no value, this is a finding.",
              "label": "check"
            },
            {
              "data": "Edit the Kubernetes API Server manifest file in the\n/etc/kubernetes/manifests directory on the Kubernetes Master Node. Set the\nvalue of tls-cert-file and tls-private-key-file to path containing Approved\nOrganizational Certificate.",
              "label": "fix"
            }
          ],
          "id": "V-242422",
          "impact": 0.5,
          "refs": [],
          "results": [
            {
              "code_desc": "Process arguments for k3s server tls-cert-file is expected not to be nil",
              "resource_class": "kube_apiserver",
              "resource_params": "[]",
              "run_time": 0.007874363,
              "start_time": "2021-06-21T21:25:33-04:00",
              "status": "passed"
            },
            {
              "code_desc": "Process arguments for k3s server tls-private-key-file is expected not to be nil",
              "resource_class": "kube_apiserver",
              "resource_params": "[]",
              "run_time": 9.4928e-5,
              "start_time": "2021-06-21T21:25:33-04:00",
              "status": "passed"
            }
          ],
          "source_location": {
            "line": 3,
            "ref": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242422.rb"
          },
          "tags": {
            "cci": ["CCI-001184"],
            "fix_id": "F-45655r712621_fix",
            "gid": "V-242422",
            "gtitle": "SRG-APP-000219-CTR-000550",
            "nist": ["SC-23"],
            "rid": "SV-242422r712622_rule",
            "severity": "medium",
            "stig_id": "CNTR-K8-001440"
          },
          "title": "Kubernetes API Server must have a certificate for communication.",
          "waiver_data": {}
        },
        {
          "code": "control 'V-242423' do\n  title 'Kubernetes etcd must enable client authentication to secure service.'\n  desc  \"Kubernetes container and pod configuration are maintained by Kubelet.\nKubelet agents register nodes with the API Server, mount volume storage, and\nperform health checks for containers and pods. Anyone who gains access to\nKubelet agents can effectively control applications within the pods and\ncontainers. Using authenticity protection, the communication can be protected\nagainst man-in-the-middle attacks/session hijacking and the insertion of false\ninformation into sessions.\n\n    The communication session is protected by utilizing transport encryption\nprotocols, such as TLS. TLS provides the Kubernetes API Server with a means to\nbe able to authenticate sessions and encrypt traffic.\n\n    To enable encrypted communication for Kubelet, the parameter etcd-cafile\nmust be set. This parameter gives the location of the SSL Certificate Authority\nfile used to secure Kubelet communication.\n  \"\n  desc  'rationale', ''\n  desc  'check', \"\n    Change to the /etc/kubernetes/manifests directory on the Kubernetes Master\nNode. Run the command:\n\n    grep -i client-cert-auth *\n\n    If the setting client-cert-auth is not configured in the Kubernetes etcd\nmanifest file or set to \\\"false\\\", this is a finding.\n  \"\n  desc 'fix', \"Edit the Kubernetes API Server manifest file in the\n/etc/kubernetes/manifests directory on the Kubernetes Master Node. Set the\nvalue of \\\"--client-cert-auth\\\" to \\\"true\\\" for the etcd.\"\n  impact 0.5\n  tag severity: 'medium'\n  tag gtitle: 'SRG-APP-000219-CTR-000550'\n  tag gid: 'V-242423'\n  tag rid: 'SV-242423r712625_rule'\n  tag stig_id: 'CNTR-K8-001450'\n  tag fix_id: 'F-45656r712624_fix'\n  tag cci: ['CCI-001184']\n  tag nist: ['SC-23']\n\n  if etcd.exist?\n    describe.one do\n      describe etcd do\n        its('client-cert-auth') { should cmp 'true' }\n      end\n\n      describe process_env_var('etcd') do\n        its(:ETCD_CLIENT_CERT_AUTH) { should cmp 'true' }\n      end\n    end\n  else\n    describe 'ETCD process is not running on the target.' do\n      skip\n    end\n  end\nend\n",
          "desc": "Kubernetes container and pod configuration are maintained by Kubelet.\nKubelet agents register nodes with the API Server, mount volume storage, and\nperform health checks for containers and pods. Anyone who gains access to\nKubelet agents can effectively control applications within the pods and\ncontainers. Using authenticity protection, the communication can be protected\nagainst man-in-the-middle attacks/session hijacking and the insertion of false\ninformation into sessions.\n\n    The communication session is protected by utilizing transport encryption\nprotocols, such as TLS. TLS provides the Kubernetes API Server with a means to\nbe able to authenticate sessions and encrypt traffic.\n\n    To enable encrypted communication for Kubelet, the parameter etcd-cafile\nmust be set. This parameter gives the location of the SSL Certificate Authority\nfile used to secure Kubelet communication.",
          "descriptions": [
            {
              "data": "Kubernetes container and pod configuration are maintained by Kubelet.\nKubelet agents register nodes with the API Server, mount volume storage, and\nperform health checks for containers and pods. Anyone who gains access to\nKubelet agents can effectively control applications within the pods and\ncontainers. Using authenticity protection, the communication can be protected\nagainst man-in-the-middle attacks/session hijacking and the insertion of false\ninformation into sessions.\n\n    The communication session is protected by utilizing transport encryption\nprotocols, such as TLS. TLS provides the Kubernetes API Server with a means to\nbe able to authenticate sessions and encrypt traffic.\n\n    To enable encrypted communication for Kubelet, the parameter etcd-cafile\nmust be set. This parameter gives the location of the SSL Certificate Authority\nfile used to secure Kubelet communication.",
              "label": "default"
            },
            {
              "data": "",
              "label": "rationale"
            },
            {
              "data": "Change to the /etc/kubernetes/manifests directory on the Kubernetes Master\nNode. Run the command:\n\n    grep -i client-cert-auth *\n\n    If the setting client-cert-auth is not configured in the Kubernetes etcd\nmanifest file or set to \"false\", this is a finding.",
              "label": "check"
            },
            {
              "data": "Edit the Kubernetes API Server manifest file in the\n/etc/kubernetes/manifests directory on the Kubernetes Master Node. Set the\nvalue of \"--client-cert-auth\" to \"true\" for the etcd.",
              "label": "fix"
            }
          ],
          "id": "V-242423",
          "impact": 0.5,
          "refs": [],
          "results": [
            {
              "code_desc": "Process arguments for /usr/local/bin/etcd client-cert-auth is expected to cmp == \"true\"",
              "resource_class": "etcd",
              "resource_params": "[]",
              "run_time": 0.000160554,
              "start_time": "2021-06-21T21:25:33-04:00",
              "status": "passed"
            }
          ],
          "source_location": {
            "line": 3,
            "ref": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242423.rb"
          },
          "tags": {
            "cci": ["CCI-001184"],
            "fix_id": "F-45656r712624_fix",
            "gid": "V-242423",
            "gtitle": "SRG-APP-000219-CTR-000550",
            "nist": ["SC-23"],
            "rid": "SV-242423r712625_rule",
            "severity": "medium",
            "stig_id": "CNTR-K8-001450"
          },
          "title": "Kubernetes etcd must enable client authentication to secure service.",
          "waiver_data": {}
        },
        {
          "code": "control 'V-242424' do\n  title \"Kubernetes Kubelet must enable tls-private-key-file for client\nauthentication to secure service.\"\n  desc  \"Kubernetes container and pod configuration are maintained by Kubelet.\nKubelet agents register nodes with the API Server, mount volume storage, and\nperform health checks for containers and pods. Anyone who gains access to\nKubelet agents can effectively control applications within the pods and\ncontainers. Using authenticity protection, the communication can be protected\nagainst man-in-the-middle attacks/session hijacking and the insertion of false\ninformation into sessions.\n\n    The communication session is protected by utilizing transport encryption\nprotocols, such as TLS. TLS provides the Kubernetes API Server with a means to\nbe able to authenticate sessions and encrypt traffic.\n\n    To enable encrypted communication for Kubelet, the parameter etcd-cafile\nmust be set. This parameter gives the location of the SSL Certificate Authority\nfile used to secure Kubelet communication.\n  \"\n  desc  'rationale', ''\n  desc  'check', \"\n    Change to the /etc/sysconfig/ directory on the Kubernetes Master Node. Run\nthe commands:\n\n    grep -i tls-private-key-file kubelet\n\n    If the setting \\\"tls-private-key-file\\\" is not configured in the Kubernetes\nKubelet, this is a finding.\n  \"\n  desc 'fix', \"\n    Edit the Kubernetes Kuberlet file in the /etc/sysconfig directory on the\nKubernetes Master Node. Set the argument tls-private-key-file to an Approved\nOrganization Certificate. Reset Kubelet service using the following command:\n\n    service kubelet restart\n  \"\n  impact 0.5\n  tag severity: 'medium'\n  tag gtitle: 'SRG-APP-000219-CTR-000550'\n  tag gid: 'V-242424'\n  tag rid: 'SV-242424r712628_rule'\n  tag stig_id: 'CNTR-K8-001460'\n  tag fix_id: 'F-45657r712627_fix'\n  tag cci: ['CCI-001184']\n  tag nist: ['SC-23']\n\n  describe.one do\n    describe kubelet do\n      its('tls-private-key-file') { should_not be_nil }\n    end\n\n    describe kubelet_config_file do\n      its('tlsPrivateKeyFile') { should_not be_nil }\n    end\n  end\nend\n",
          "desc": "Kubernetes container and pod configuration are maintained by Kubelet.\nKubelet agents register nodes with the API Server, mount volume storage, and\nperform health checks for containers and pods. Anyone who gains access to\nKubelet agents can effectively control applications within the pods and\ncontainers. Using authenticity protection, the communication can be protected\nagainst man-in-the-middle attacks/session hijacking and the insertion of false\ninformation into sessions.\n\n    The communication session is protected by utilizing transport encryption\nprotocols, such as TLS. TLS provides the Kubernetes API Server with a means to\nbe able to authenticate sessions and encrypt traffic.\n\n    To enable encrypted communication for Kubelet, the parameter etcd-cafile\nmust be set. This parameter gives the location of the SSL Certificate Authority\nfile used to secure Kubelet communication.",
          "descriptions": [
            {
              "data": "Kubernetes container and pod configuration are maintained by Kubelet.\nKubelet agents register nodes with the API Server, mount volume storage, and\nperform health checks for containers and pods. Anyone who gains access to\nKubelet agents can effectively control applications within the pods and\ncontainers. Using authenticity protection, the communication can be protected\nagainst man-in-the-middle attacks/session hijacking and the insertion of false\ninformation into sessions.\n\n    The communication session is protected by utilizing transport encryption\nprotocols, such as TLS. TLS provides the Kubernetes API Server with a means to\nbe able to authenticate sessions and encrypt traffic.\n\n    To enable encrypted communication for Kubelet, the parameter etcd-cafile\nmust be set. This parameter gives the location of the SSL Certificate Authority\nfile used to secure Kubelet communication.",
              "label": "default"
            },
            {
              "data": "",
              "label": "rationale"
            },
            {
              "data": "Change to the /etc/sysconfig/ directory on the Kubernetes Master Node. Run\nthe commands:\n\n    grep -i tls-private-key-file kubelet\n\n    If the setting \"tls-private-key-file\" is not configured in the Kubernetes\nKubelet, this is a finding.",
              "label": "check"
            },
            {
              "data": "Edit the Kubernetes Kuberlet file in the /etc/sysconfig directory on the\nKubernetes Master Node. Set the argument tls-private-key-file to an Approved\nOrganization Certificate. Reset Kubelet service using the following command:\n\n    service kubelet restart",
              "label": "fix"
            }
          ],
          "id": "V-242424",
          "impact": 0.5,
          "refs": [],
          "results": [
            {
              "code_desc": "Process arguments for k3s tls-private-key-file is expected not to be nil",
              "resource_class": "kubelet",
              "resource_params": "[]",
              "run_time": 7.9604e-5,
              "start_time": "2021-06-21T21:25:33-04:00",
              "status": "passed"
            }
          ],
          "source_location": {
            "line": 3,
            "ref": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242424.rb"
          },
          "tags": {
            "cci": ["CCI-001184"],
            "fix_id": "F-45657r712627_fix",
            "gid": "V-242424",
            "gtitle": "SRG-APP-000219-CTR-000550",
            "nist": ["SC-23"],
            "rid": "SV-242424r712628_rule",
            "severity": "medium",
            "stig_id": "CNTR-K8-001460"
          },
          "title": "Kubernetes Kubelet must enable tls-private-key-file for client\nauthentication to secure service.",
          "waiver_data": {}
        },
        {
          "code": "control 'V-242425' do\n  title \"Kubernetes Kubelet must enable tls-cert-file for client authentication\nto secure service.\"\n  desc  \"Kubernetes container and pod configuration are maintained by Kubelet.\nKubelet agents register nodes with the API Server, mount volume storage, and\nperform health checks for containers and pods. Anyone who gains access to\nKubelet agents can effectively control applications within the pods and\ncontainers. Using authenticity protection, the communication can be protected\nagainst man-in-the-middle attacks/session hijacking and the insertion of false\ninformation into sessions.\n\n    The communication session is protected by utilizing transport encryption\nprotocols, such as TLS. TLS provides the Kubernetes API Server with a means to\nbe able to authenticate sessions and encrypt traffic.\n\n    To enable encrypted communication for Kubelet, the parameter etcd-cafile\nmust be set. This parameter gives the location of the SSL Certificate Authority\nfile used to secure Kubelet communication.\n  \"\n  desc  'rationale', ''\n  desc  'check', \"\n    Change to the /etc/sysconfig/ directory on the Kubernetes Master Node. Run\nthe commands:\n\n    grep -i tls-cert-file kubelet\n\n    If the setting \\\"tls-cert-file\\\" is not configured in the Kubernetes\nKubelet, this is a finding.\n  \"\n  desc 'fix', \"\n    Edit the Kubernetes Kuberlet file in the /etc/sysconfig directory on the\nKubernetes Master Node. Set the argument \\\"tls-cert-file\\\" to an Approved\nOrganization Certificate. Reset Kubelet service using the following command:\n\n    service kubelet restart\n  \"\n  impact 0.5\n  tag severity: 'medium'\n  tag gtitle: 'SRG-APP-000219-CTR-000550'\n  tag gid: 'V-242425'\n  tag rid: 'SV-242425r712631_rule'\n  tag stig_id: 'CNTR-K8-001470'\n  tag fix_id: 'F-45658r712630_fix'\n  tag cci: ['CCI-001184']\n  tag nist: ['SC-23']\n\n  describe.one do\n    describe kubelet do\n      its('tls-cert-file') { should_not be_nil }\n    end\n\n    describe kubelet_config_file do\n      its('tlsCertFile') { should_not be_nil }\n    end\n  end\nend\n",
          "desc": "Kubernetes container and pod configuration are maintained by Kubelet.\nKubelet agents register nodes with the API Server, mount volume storage, and\nperform health checks for containers and pods. Anyone who gains access to\nKubelet agents can effectively control applications within the pods and\ncontainers. Using authenticity protection, the communication can be protected\nagainst man-in-the-middle attacks/session hijacking and the insertion of false\ninformation into sessions.\n\n    The communication session is protected by utilizing transport encryption\nprotocols, such as TLS. TLS provides the Kubernetes API Server with a means to\nbe able to authenticate sessions and encrypt traffic.\n\n    To enable encrypted communication for Kubelet, the parameter etcd-cafile\nmust be set. This parameter gives the location of the SSL Certificate Authority\nfile used to secure Kubelet communication.",
          "descriptions": [
            {
              "data": "Kubernetes container and pod configuration are maintained by Kubelet.\nKubelet agents register nodes with the API Server, mount volume storage, and\nperform health checks for containers and pods. Anyone who gains access to\nKubelet agents can effectively control applications within the pods and\ncontainers. Using authenticity protection, the communication can be protected\nagainst man-in-the-middle attacks/session hijacking and the insertion of false\ninformation into sessions.\n\n    The communication session is protected by utilizing transport encryption\nprotocols, such as TLS. TLS provides the Kubernetes API Server with a means to\nbe able to authenticate sessions and encrypt traffic.\n\n    To enable encrypted communication for Kubelet, the parameter etcd-cafile\nmust be set. This parameter gives the location of the SSL Certificate Authority\nfile used to secure Kubelet communication.",
              "label": "default"
            },
            {
              "data": "",
              "label": "rationale"
            },
            {
              "data": "Change to the /etc/sysconfig/ directory on the Kubernetes Master Node. Run\nthe commands:\n\n    grep -i tls-cert-file kubelet\n\n    If the setting \"tls-cert-file\" is not configured in the Kubernetes\nKubelet, this is a finding.",
              "label": "check"
            },
            {
              "data": "Edit the Kubernetes Kuberlet file in the /etc/sysconfig directory on the\nKubernetes Master Node. Set the argument \"tls-cert-file\" to an Approved\nOrganization Certificate. Reset Kubelet service using the following command:\n\n    service kubelet restart",
              "label": "fix"
            }
          ],
          "id": "V-242425",
          "impact": 0.5,
          "refs": [],
          "results": [
            {
              "code_desc": "Process arguments for k3s tls-cert-file is expected not to be nil",
              "resource_class": "kubelet",
              "resource_params": "[]",
              "run_time": 9.1967e-5,
              "start_time": "2021-06-21T21:25:33-04:00",
              "status": "passed"
            }
          ],
          "source_location": {
            "line": 3,
            "ref": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242425.rb"
          },
          "tags": {
            "cci": ["CCI-001184"],
            "fix_id": "F-45658r712630_fix",
            "gid": "V-242425",
            "gtitle": "SRG-APP-000219-CTR-000550",
            "nist": ["SC-23"],
            "rid": "SV-242425r712631_rule",
            "severity": "medium",
            "stig_id": "CNTR-K8-001470"
          },
          "title": "Kubernetes Kubelet must enable tls-cert-file for client authentication\nto secure service.",
          "waiver_data": {}
        },
        {
          "code": "control 'V-242426' do\n  title 'Kubernetes etcd must enable client authentication to secure service.'\n  desc  \"Kubernetes container and pod configuration are maintained by Kubelet.\nKubelet agents register nodes with the API Server, mount volume storage, and\nperform health checks for containers and pods. Anyone who gains access to\nKubelet agents can effectively control applications within the pods and\ncontainers. Using authenticity protection, the communication can be protected\nagainst man-in-the-middle attacks/session hijacking and the insertion of false\ninformation into sessions.\n\n    The communication session is protected by utilizing transport encryption\nprotocols, such as TLS. TLS provides the Kubernetes API Server with a means to\nbe able to authenticate sessions and encrypt traffic.\n\n    To enable encrypted communication for Kubelet, the parameter etcd-cafile\nmust be set. This parameter gives the location of the SSL Certificate Authority\nfile used to secure Kubelet communication.\n  \"\n  desc  'rationale', ''\n  desc  'check', \"\n    Change to the /etc/kubernetes/manifests directory on the Kubernetes Master\nNode. Run the command:\n\n    grep -i peer-client-cert-auth *\n\n    If the setting \\\"peer-client-cert-auth\\\" is not configured in the Kubernetes\netcd manifest file or set to \\\"false\\\", this is a finding.\n  \"\n  desc 'fix', \"Edit the Kubernetes etcd manifest file in the\n/etc/kubernetes/manifests directory on the Kubernetes Master Node. Set the\nvalue of \\\"--peer-client-cert-auth\\\" to \\\"true\\\" for the etcd.\"\n  impact 0.5\n  tag severity: 'medium'\n  tag gtitle: 'SRG-APP-000219-CTR-000550'\n  tag gid: 'V-242426'\n  tag rid: 'SV-242426r712634_rule'\n  tag stig_id: 'CNTR-K8-001480'\n  tag fix_id: 'F-45659r712633_fix'\n  tag cci: ['CCI-001184']\n  tag nist: ['SC-23']\n\n  if etcd.exist?\n    describe.one do\n      describe etcd do\n        its('peer-client-cert-auth') { should cmp 'true' }\n      end\n\n      describe process_env_var('etcd') do\n        its(:ETCD_PEER_CLIENT_CERT_AUTH) { should cmp 'true' }\n      end\n    end\n  else\n    describe 'ETCD process is not running on the target.' do\n      skip\n    end\n  end\nend\n",
          "desc": "Kubernetes container and pod configuration are maintained by Kubelet.\nKubelet agents register nodes with the API Server, mount volume storage, and\nperform health checks for containers and pods. Anyone who gains access to\nKubelet agents can effectively control applications within the pods and\ncontainers. Using authenticity protection, the communication can be protected\nagainst man-in-the-middle attacks/session hijacking and the insertion of false\ninformation into sessions.\n\n    The communication session is protected by utilizing transport encryption\nprotocols, such as TLS. TLS provides the Kubernetes API Server with a means to\nbe able to authenticate sessions and encrypt traffic.\n\n    To enable encrypted communication for Kubelet, the parameter etcd-cafile\nmust be set. This parameter gives the location of the SSL Certificate Authority\nfile used to secure Kubelet communication.",
          "descriptions": [
            {
              "data": "Kubernetes container and pod configuration are maintained by Kubelet.\nKubelet agents register nodes with the API Server, mount volume storage, and\nperform health checks for containers and pods. Anyone who gains access to\nKubelet agents can effectively control applications within the pods and\ncontainers. Using authenticity protection, the communication can be protected\nagainst man-in-the-middle attacks/session hijacking and the insertion of false\ninformation into sessions.\n\n    The communication session is protected by utilizing transport encryption\nprotocols, such as TLS. TLS provides the Kubernetes API Server with a means to\nbe able to authenticate sessions and encrypt traffic.\n\n    To enable encrypted communication for Kubelet, the parameter etcd-cafile\nmust be set. This parameter gives the location of the SSL Certificate Authority\nfile used to secure Kubelet communication.",
              "label": "default"
            },
            {
              "data": "",
              "label": "rationale"
            },
            {
              "data": "Change to the /etc/kubernetes/manifests directory on the Kubernetes Master\nNode. Run the command:\n\n    grep -i peer-client-cert-auth *\n\n    If the setting \"peer-client-cert-auth\" is not configured in the Kubernetes\netcd manifest file or set to \"false\", this is a finding.",
              "label": "check"
            },
            {
              "data": "Edit the Kubernetes etcd manifest file in the\n/etc/kubernetes/manifests directory on the Kubernetes Master Node. Set the\nvalue of \"--peer-client-cert-auth\" to \"true\" for the etcd.",
              "label": "fix"
            }
          ],
          "id": "V-242426",
          "impact": 0.5,
          "refs": [],
          "results": [
            {
              "code_desc": "Process arguments for /usr/local/bin/etcd peer-client-cert-auth is expected to cmp == \"true\"",
              "resource_class": "etcd",
              "resource_params": "[]",
              "run_time": 0.000191153,
              "start_time": "2021-06-21T21:25:33-04:00",
              "status": "passed"
            }
          ],
          "source_location": {
            "line": 3,
            "ref": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242426.rb"
          },
          "tags": {
            "cci": ["CCI-001184"],
            "fix_id": "F-45659r712633_fix",
            "gid": "V-242426",
            "gtitle": "SRG-APP-000219-CTR-000550",
            "nist": ["SC-23"],
            "rid": "SV-242426r712634_rule",
            "severity": "medium",
            "stig_id": "CNTR-K8-001480"
          },
          "title": "Kubernetes etcd must enable client authentication to secure service.",
          "waiver_data": {}
        },
        {
          "code": "control 'V-242427' do\n  title 'Kubernetes etcd must have a key file for secure communication.'\n  desc  \"Kubernetes stores configuration and state information in a distributed\nkey-value store called etcd. Anyone who can write to etcd can effectively\ncontrol the Kubernetes cluster. Even just reading the contents of etcd could\neasily provide helpful hints to a would-be attacker. Using authenticity\nprotection, the communication can be protected against man-in-the-middle\nattacks/session hijacking and the insertion of false information into sessions.\n\n    The communication session is protected by utilizing transport encryption\nprotocols, such as TLS. TLS provides the Kubernetes API Server and etcd with a\nmeans to be able to authenticate sessions and encrypt traffic.\n\n    To enable encrypted communication for etcd, the parameter etcd-keyfile must\nbe set. This parameter gives the location of the key file used to secure etcd\ncommunication.\n  \"\n  desc  'rationale', ''\n  desc  'check', \"\n    Change to the /etc/kubernetes/manifests directory on the Kubernetes Master\nNode. Run the command:\n\n    grep -i key-file *\n\n    If the setting \\\"key-file\\\" is not configured in the Kubernetes etcd\nmanifest file, this is a finding.\n  \"\n  desc 'fix', \"Edit the etcd manifest file in the\n/etc/kubernetes/manifests directory on the Kubernetes Master Node. Set the\nvalue of \\\"--key-file\\\" to the Approved Organizational Certificate.\"\n  impact 0.5\n  tag severity: 'medium'\n  tag gtitle: 'SRG-APP-000219-CTR-000550'\n  tag gid: 'V-242427'\n  tag rid: 'SV-242427r712637_rule'\n  tag stig_id: 'CNTR-K8-001490'\n  tag fix_id: 'F-45660r712636_fix'\n  tag cci: ['CCI-001184']\n  tag nist: ['SC-23']\n\n  if etcd.exist?\n    describe.one do\n      describe etcd do\n        its('key-file') { should_not be_nil }\n      end\n\n      describe process_env_var('etcd') do\n        its(:ETCD_KEY_FILE) { should_not be_nil }\n      end\n    end\n  else\n    describe 'ETCD process is not running on the target.' do\n      skip\n    end\n  end\nend\n",
          "desc": "Kubernetes stores configuration and state information in a distributed\nkey-value store called etcd. Anyone who can write to etcd can effectively\ncontrol the Kubernetes cluster. Even just reading the contents of etcd could\neasily provide helpful hints to a would-be attacker. Using authenticity\nprotection, the communication can be protected against man-in-the-middle\nattacks/session hijacking and the insertion of false information into sessions.\n\n    The communication session is protected by utilizing transport encryption\nprotocols, such as TLS. TLS provides the Kubernetes API Server and etcd with a\nmeans to be able to authenticate sessions and encrypt traffic.\n\n    To enable encrypted communication for etcd, the parameter etcd-keyfile must\nbe set. This parameter gives the location of the key file used to secure etcd\ncommunication.",
          "descriptions": [
            {
              "data": "Kubernetes stores configuration and state information in a distributed\nkey-value store called etcd. Anyone who can write to etcd can effectively\ncontrol the Kubernetes cluster. Even just reading the contents of etcd could\neasily provide helpful hints to a would-be attacker. Using authenticity\nprotection, the communication can be protected against man-in-the-middle\nattacks/session hijacking and the insertion of false information into sessions.\n\n    The communication session is protected by utilizing transport encryption\nprotocols, such as TLS. TLS provides the Kubernetes API Server and etcd with a\nmeans to be able to authenticate sessions and encrypt traffic.\n\n    To enable encrypted communication for etcd, the parameter etcd-keyfile must\nbe set. This parameter gives the location of the key file used to secure etcd\ncommunication.",
              "label": "default"
            },
            {
              "data": "",
              "label": "rationale"
            },
            {
              "data": "Change to the /etc/kubernetes/manifests directory on the Kubernetes Master\nNode. Run the command:\n\n    grep -i key-file *\n\n    If the setting \"key-file\" is not configured in the Kubernetes etcd\nmanifest file, this is a finding.",
              "label": "check"
            },
            {
              "data": "Edit the etcd manifest file in the\n/etc/kubernetes/manifests directory on the Kubernetes Master Node. Set the\nvalue of \"--key-file\" to the Approved Organizational Certificate.",
              "label": "fix"
            }
          ],
          "id": "V-242427",
          "impact": 0.5,
          "refs": [],
          "results": [
            {
              "code_desc": "Process arguments for /usr/local/bin/etcd key-file is expected not to be nil",
              "resource_class": "etcd",
              "resource_params": "[]",
              "run_time": 0.00014214,
              "start_time": "2021-06-21T21:25:33-04:00",
              "status": "passed"
            }
          ],
          "source_location": {
            "line": 3,
            "ref": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242427.rb"
          },
          "tags": {
            "cci": ["CCI-001184"],
            "fix_id": "F-45660r712636_fix",
            "gid": "V-242427",
            "gtitle": "SRG-APP-000219-CTR-000550",
            "nist": ["SC-23"],
            "rid": "SV-242427r712637_rule",
            "severity": "medium",
            "stig_id": "CNTR-K8-001490"
          },
          "title": "Kubernetes etcd must have a key file for secure communication.",
          "waiver_data": {}
        },
        {
          "code": "control 'V-242428' do\n  title 'Kubernetes etcd must have a certificate for communication.'\n  desc  \"Kubernetes stores configuration and state information in a distributed\nkey-value store called etcd. Anyone who can write to etcd can effectively\ncontrol a Kubernetes cluster. Even just reading the contents of etcd could\neasily provide helpful hints to a would-be attacker. Using authenticity\nprotection, the communication can be protected against man-in-the-middle\nattacks/session hijacking and the insertion of false information into sessions.\n\n    The communication session is protected by utilizing transport encryption\nprotocols, such as TLS. TLS provides the Kubernetes API Server and etcd with a\nmeans to be able to authenticate sessions and encrypt traffic.\n\n    To enable encrypted communication for etcd, the parameter cert-file\nmust be set. This parameter gives the location of the SSL certification file\nused to secure etcd communication.\n  \"\n  desc  'rationale', ''\n  desc  'check', \"\n    Change to the /etc/kubernetes/manifests directory on the Kubernetes Master\n Node. Run the command:\n\n    grep -i cert-file *\n\n    If the setting \\\"cert-file\\\" is not configured in the Kubernetes etcd\nmanifest file, this is a finding.\n  \"\n  desc 'fix', \"Edit the Kubernetes etcd manifest file in the\n/etc/kubernetes/manifests directory on the Kubernetes Master Node.\n\n  Set the value of \\\"--cert-file\\\" to the Approved Organizational Certificate.\n  \"\n  impact 0.5\n  tag severity: 'medium'\n  tag gtitle: 'SRG-APP-000219-CTR-000550'\n  tag gid: 'V-242428'\n  tag rid: 'SV-242428r712640_rule'\n  tag stig_id: 'CNTR-K8-001500'\n  tag fix_id: 'F-45661r712639_fix'\n  tag cci: ['CCI-001184']\n  tag nist: ['SC-23']\n\n  if etcd.exist?\n    describe.one do\n      describe etcd do\n        its('cert-file') { should_not be_nil }\n      end\n\n      describe process_env_var('etcd') do\n        its(:ETCD_CERT_FILE) { should_not be_nil }\n      end\n    end\n  else\n    describe 'ETCD process is not running on the target.' do\n      skip\n    end\n  end\nend\n",
          "desc": "Kubernetes stores configuration and state information in a distributed\nkey-value store called etcd. Anyone who can write to etcd can effectively\ncontrol a Kubernetes cluster. Even just reading the contents of etcd could\neasily provide helpful hints to a would-be attacker. Using authenticity\nprotection, the communication can be protected against man-in-the-middle\nattacks/session hijacking and the insertion of false information into sessions.\n\n    The communication session is protected by utilizing transport encryption\nprotocols, such as TLS. TLS provides the Kubernetes API Server and etcd with a\nmeans to be able to authenticate sessions and encrypt traffic.\n\n    To enable encrypted communication for etcd, the parameter cert-file\nmust be set. This parameter gives the location of the SSL certification file\nused to secure etcd communication.",
          "descriptions": [
            {
              "data": "Kubernetes stores configuration and state information in a distributed\nkey-value store called etcd. Anyone who can write to etcd can effectively\ncontrol a Kubernetes cluster. Even just reading the contents of etcd could\neasily provide helpful hints to a would-be attacker. Using authenticity\nprotection, the communication can be protected against man-in-the-middle\nattacks/session hijacking and the insertion of false information into sessions.\n\n    The communication session is protected by utilizing transport encryption\nprotocols, such as TLS. TLS provides the Kubernetes API Server and etcd with a\nmeans to be able to authenticate sessions and encrypt traffic.\n\n    To enable encrypted communication for etcd, the parameter cert-file\nmust be set. This parameter gives the location of the SSL certification file\nused to secure etcd communication.",
              "label": "default"
            },
            {
              "data": "",
              "label": "rationale"
            },
            {
              "data": "Change to the /etc/kubernetes/manifests directory on the Kubernetes Master\n Node. Run the command:\n\n    grep -i cert-file *\n\n    If the setting \"cert-file\" is not configured in the Kubernetes etcd\nmanifest file, this is a finding.",
              "label": "check"
            },
            {
              "data": "Edit the Kubernetes etcd manifest file in the\n/etc/kubernetes/manifests directory on the Kubernetes Master Node.\n\n  Set the value of \"--cert-file\" to the Approved Organizational Certificate.",
              "label": "fix"
            }
          ],
          "id": "V-242428",
          "impact": 0.5,
          "refs": [],
          "results": [
            {
              "code_desc": "Process arguments for /usr/local/bin/etcd cert-file is expected not to be nil",
              "resource_class": "etcd",
              "resource_params": "[]",
              "run_time": 9.8976e-5,
              "start_time": "2021-06-21T21:25:33-04:00",
              "status": "passed"
            }
          ],
          "source_location": {
            "line": 3,
            "ref": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242428.rb"
          },
          "tags": {
            "cci": ["CCI-001184"],
            "fix_id": "F-45661r712639_fix",
            "gid": "V-242428",
            "gtitle": "SRG-APP-000219-CTR-000550",
            "nist": ["SC-23"],
            "rid": "SV-242428r712640_rule",
            "severity": "medium",
            "stig_id": "CNTR-K8-001500"
          },
          "title": "Kubernetes etcd must have a certificate for communication.",
          "waiver_data": {}
        },
        {
          "code": "control 'V-242429' do\n  title 'Kubernetes etcd must have the SSL Certificate Authority set.'\n  desc  \"Kubernetes stores configuration and state information in a distributed\nkey-value store called etcd. Anyone who can write to etcd can effectively\ncontrol a Kubernetes cluster. Even just reading the contents of etcd could\neasily provide helpful hints to a would-be attacker. Using authenticity\nprotection, the communication can be protected against man-in-the-middle\nattacks/session hijacking and the insertion of false information into sessions.\n\n    The communication session is protected by utilizing transport encryption\nprotocols, such as TLS. TLS provides the Kubernetes API Server and etcd with a\nmeans to be able to authenticate sessions and encrypt traffic.\n\n    To enable encrypted communication for etcd, the parameter etcd-cafile must\nbe set. This parameter gives the location of the SSL Certificate Authority file\nused to secure etcd communication.\n  \"\n  desc  'rationale', ''\n  desc  'check', \"\n    Change to the /etc/kubernetes/manifests directory on the Kubernetes Master\nNode. Run the command:\n\n    grep -i etcd-cafile *\n\n    If the setting \\\"etcd-cafile\\\" is not configured in the Kubernetes API\nServer manifest file, this is a finding.\n  \"\n  desc 'fix', \"Edit the Kubernetes API Server manifest file in the\n/etc/kubernetes/manifests directory on the Kubernetes Master Node. Set the\nvalue of \\\"--etcd-cafile\\\" to the Certificate Authority for etcd.\"\n  impact 0.5\n  tag severity: 'medium'\n  tag gtitle: 'SRG-APP-000219-CTR-000550'\n  tag gid: 'V-242429'\n  tag rid: 'SV-242429r712643_rule'\n  tag stig_id: 'CNTR-K8-001510'\n  tag fix_id: 'F-45662r712642_fix'\n  tag cci: ['CCI-001184']\n  tag nist: ['SC-23']\n\n  unless kube_apiserver.exist?\n    impact 0.0\n    desc 'caveat', 'Kubernetes API Server process is not running on the target.'\n  end\n\n  describe kube_apiserver do\n    its('etcd-cafile') { should_not be_nil }\n  end\nend\n",
          "desc": "Kubernetes stores configuration and state information in a distributed\nkey-value store called etcd. Anyone who can write to etcd can effectively\ncontrol a Kubernetes cluster. Even just reading the contents of etcd could\neasily provide helpful hints to a would-be attacker. Using authenticity\nprotection, the communication can be protected against man-in-the-middle\nattacks/session hijacking and the insertion of false information into sessions.\n\n    The communication session is protected by utilizing transport encryption\nprotocols, such as TLS. TLS provides the Kubernetes API Server and etcd with a\nmeans to be able to authenticate sessions and encrypt traffic.\n\n    To enable encrypted communication for etcd, the parameter etcd-cafile must\nbe set. This parameter gives the location of the SSL Certificate Authority file\nused to secure etcd communication.",
          "descriptions": [
            {
              "data": "Kubernetes stores configuration and state information in a distributed\nkey-value store called etcd. Anyone who can write to etcd can effectively\ncontrol a Kubernetes cluster. Even just reading the contents of etcd could\neasily provide helpful hints to a would-be attacker. Using authenticity\nprotection, the communication can be protected against man-in-the-middle\nattacks/session hijacking and the insertion of false information into sessions.\n\n    The communication session is protected by utilizing transport encryption\nprotocols, such as TLS. TLS provides the Kubernetes API Server and etcd with a\nmeans to be able to authenticate sessions and encrypt traffic.\n\n    To enable encrypted communication for etcd, the parameter etcd-cafile must\nbe set. This parameter gives the location of the SSL Certificate Authority file\nused to secure etcd communication.",
              "label": "default"
            },
            {
              "data": "",
              "label": "rationale"
            },
            {
              "data": "Change to the /etc/kubernetes/manifests directory on the Kubernetes Master\nNode. Run the command:\n\n    grep -i etcd-cafile *\n\n    If the setting \"etcd-cafile\" is not configured in the Kubernetes API\nServer manifest file, this is a finding.",
              "label": "check"
            },
            {
              "data": "Edit the Kubernetes API Server manifest file in the\n/etc/kubernetes/manifests directory on the Kubernetes Master Node. Set the\nvalue of \"--etcd-cafile\" to the Certificate Authority for etcd.",
              "label": "fix"
            }
          ],
          "id": "V-242429",
          "impact": 0.5,
          "refs": [
            {
              "ref": []
            }
          ],
          "results": [
            {
              "code_desc": "Process arguments for k3s server datastore-cafile is expected not to be nil",
              "resource_class": "kube_process",
              "resource_params": "[\"k3s server\"]",
              "run_time": 0.009310561,
              "start_time": "2021-06-21T21:25:33-04:00",
              "status": "passed"
            }
          ],
          "source_location": {
            "line": 3,
            "ref": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242429.rb"
          },
          "tags": {
            "cci": ["CCI-001184"],
            "fix_id": "F-45662r712642_fix",
            "gid": "V-242429",
            "gtitle": "SRG-APP-000219-CTR-000550",
            "nist": ["SC-23"],
            "rid": "SV-242429r712643_rule",
            "severity": "medium",
            "stig_id": "CNTR-K8-001510"
          },
          "title": "Kubernetes etcd must have the SSL Certificate Authority set.",
          "waiver_data": {}
        },
        {
          "code": "control 'V-242430' do\n  title 'Kubernetes etcd must have a certificate for communication.'\n  desc  \"Kubernetes stores configuration and state information in a distributed\nkey-value store called etcd. Anyone who can write to etcd can effectively\ncontrol your Kubernetes cluster. Even just reading the contents of etcd could\neasily provide helpful hints to a would-be attacker. Using authenticity\nprotection, the communication can be protected against man-in-the-middle\nattacks/session hijacking and the insertion of false information into sessions.\n\n    The communication session is protected by utilizing transport encryption\nprotocols, such as TLS. TLS provides the Kubernetes API Server and etcd with a\nmeans to be able to authenticate sessions and encrypt traffic.\n\n    To enable encrypted communication for etcd, the parameter etcd-certfile\nmust be set. This parameter gives the location of the SSL certification file\nused to secure etcd communication.\n  \"\n  desc  'rationale', ''\n  desc  'check', \"\n    Change to the /etc/kubernetes/manifests directory on the Kubernetes Master\nNode. Run the command:\n\n    grep -i etcd-certfile *\n\n    If the setting \\\"etcd-certfile\\\" is not set in the Kubernetes API Server\nmanifest file, this is a finding.\n  \"\n  desc 'fix', \"Edit the Kubernetes API Server manifest file in the\n/etc/kubernetes/manifests directory on the Kubernetes Master Node. Set the\nvalue of \\\"--etcd-certfile\\\" to the certificate to be used for communication\nwith etcd.\"\n  impact 0.5\n  tag severity: 'medium'\n  tag gtitle: 'SRG-APP-000219-CTR-000550'\n  tag gid: 'V-242430'\n  tag rid: 'SV-242430r712646_rule'\n  tag stig_id: 'CNTR-K8-001520'\n  tag fix_id: 'F-45663r712645_fix'\n  tag cci: ['CCI-001184']\n  tag nist: ['SC-23']\n\n  unless kube_apiserver.exist?\n    impact 0.0\n    desc 'caveat', 'Kubernetes API Server process is not running on the target.'\n  end\n\n  describe kube_apiserver do\n    its('etcd-certfile') { should_not be_nil }\n  end\nend\n",
          "desc": "Kubernetes stores configuration and state information in a distributed\nkey-value store called etcd. Anyone who can write to etcd can effectively\ncontrol your Kubernetes cluster. Even just reading the contents of etcd could\neasily provide helpful hints to a would-be attacker. Using authenticity\nprotection, the communication can be protected against man-in-the-middle\nattacks/session hijacking and the insertion of false information into sessions.\n\n    The communication session is protected by utilizing transport encryption\nprotocols, such as TLS. TLS provides the Kubernetes API Server and etcd with a\nmeans to be able to authenticate sessions and encrypt traffic.\n\n    To enable encrypted communication for etcd, the parameter etcd-certfile\nmust be set. This parameter gives the location of the SSL certification file\nused to secure etcd communication.",
          "descriptions": [
            {
              "data": "Kubernetes stores configuration and state information in a distributed\nkey-value store called etcd. Anyone who can write to etcd can effectively\ncontrol your Kubernetes cluster. Even just reading the contents of etcd could\neasily provide helpful hints to a would-be attacker. Using authenticity\nprotection, the communication can be protected against man-in-the-middle\nattacks/session hijacking and the insertion of false information into sessions.\n\n    The communication session is protected by utilizing transport encryption\nprotocols, such as TLS. TLS provides the Kubernetes API Server and etcd with a\nmeans to be able to authenticate sessions and encrypt traffic.\n\n    To enable encrypted communication for etcd, the parameter etcd-certfile\nmust be set. This parameter gives the location of the SSL certification file\nused to secure etcd communication.",
              "label": "default"
            },
            {
              "data": "",
              "label": "rationale"
            },
            {
              "data": "Change to the /etc/kubernetes/manifests directory on the Kubernetes Master\nNode. Run the command:\n\n    grep -i etcd-certfile *\n\n    If the setting \"etcd-certfile\" is not set in the Kubernetes API Server\nmanifest file, this is a finding.",
              "label": "check"
            },
            {
              "data": "Edit the Kubernetes API Server manifest file in the\n/etc/kubernetes/manifests directory on the Kubernetes Master Node. Set the\nvalue of \"--etcd-certfile\" to the certificate to be used for communication\nwith etcd.",
              "label": "fix"
            }
          ],
          "id": "V-242430",
          "impact": 0.5,
          "refs": [
            {
              "ref": []
            }
          ],
          "results": [
            {
              "code_desc": "Process arguments for k3s server datastore-certfile is expected not to be nil",
              "resource_class": "kube_process",
              "resource_params": "[\"k3s server\"]",
              "run_time": 0.007806516,
              "start_time": "2021-06-21T21:25:33-04:00",
              "status": "passed"
            }
          ],
          "source_location": {
            "line": 3,
            "ref": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242430.rb"
          },
          "tags": {
            "cci": ["CCI-001184"],
            "fix_id": "F-45663r712645_fix",
            "gid": "V-242430",
            "gtitle": "SRG-APP-000219-CTR-000550",
            "nist": ["SC-23"],
            "rid": "SV-242430r712646_rule",
            "severity": "medium",
            "stig_id": "CNTR-K8-001520"
          },
          "title": "Kubernetes etcd must have a certificate for communication.",
          "waiver_data": {}
        },
        {
          "code": "control 'V-242431' do\n  title 'Kubernetes etcd must have a key file for secure communication.'\n  desc  \"Kubernetes stores configuration and state information in a distributed\nkey-value store called etcd. Anyone who can write to etcd can effectively\ncontrol a Kubernetes cluster. Even just reading the contents of etcd could\neasily provide helpful hints to a would-be attacker. Using authenticity\nprotection, the communication can be protected against man-in-the-middle\nattacks/session hijacking and the insertion of false information into sessions.\n\n    The communication session is protected by utilizing transport encryption\nprotocols, such as TLS. TLS provides the Kubernetes API Server and etcd with a\nmeans to be able to authenticate sessions and encrypt traffic.\n\n    To enable encrypted communication for etcd, the parameter etcd-keyfile must\nbe set. This parameter gives the location of the key file used to secure etcd\ncommunication.\n  \"\n  desc  'rationale', ''\n  desc  'check', \"\n    Change to the /etc/kubernetes/manifests directory on the Kubernetes Master\nNode. Run the command:\n\n    grep -i etcd-keyfile *\n\n    If the setting \\\"etcd-keyfile\\\" is not configured in the Kubernetes API\nServer manifest file, this is a finding.\n  \"\n  desc 'fix', \"Edit the Kubernetes API Server manifest file in the\n/etc/kubernetes/manifests directory on the Kubernetes Master Node. Set the\nvalue of \\\"--etcd-keyfile\\\" to the certificate to be used for communication\nwith etcd.\"\n  impact 0.5\n  tag severity: 'medium'\n  tag gtitle: 'SRG-APP-000219-CTR-000550'\n  tag gid: 'V-242431'\n  tag rid: 'SV-242431r712649_rule'\n  tag stig_id: 'CNTR-K8-001530'\n  tag fix_id: 'F-45664r712648_fix'\n  tag cci: ['CCI-001184']\n  tag nist: ['SC-23']\n\n  unless kube_apiserver.exist?\n    impact 0.0\n    desc 'caveat', 'Kubernetes API Server process is not running on the target.'\n  end\n\n  describe kube_apiserver do\n    its('etcd-keyfile') { should_not be_nil }\n  end\nend\n",
          "desc": "Kubernetes stores configuration and state information in a distributed\nkey-value store called etcd. Anyone who can write to etcd can effectively\ncontrol a Kubernetes cluster. Even just reading the contents of etcd could\neasily provide helpful hints to a would-be attacker. Using authenticity\nprotection, the communication can be protected against man-in-the-middle\nattacks/session hijacking and the insertion of false information into sessions.\n\n    The communication session is protected by utilizing transport encryption\nprotocols, such as TLS. TLS provides the Kubernetes API Server and etcd with a\nmeans to be able to authenticate sessions and encrypt traffic.\n\n    To enable encrypted communication for etcd, the parameter etcd-keyfile must\nbe set. This parameter gives the location of the key file used to secure etcd\ncommunication.",
          "descriptions": [
            {
              "data": "Kubernetes stores configuration and state information in a distributed\nkey-value store called etcd. Anyone who can write to etcd can effectively\ncontrol a Kubernetes cluster. Even just reading the contents of etcd could\neasily provide helpful hints to a would-be attacker. Using authenticity\nprotection, the communication can be protected against man-in-the-middle\nattacks/session hijacking and the insertion of false information into sessions.\n\n    The communication session is protected by utilizing transport encryption\nprotocols, such as TLS. TLS provides the Kubernetes API Server and etcd with a\nmeans to be able to authenticate sessions and encrypt traffic.\n\n    To enable encrypted communication for etcd, the parameter etcd-keyfile must\nbe set. This parameter gives the location of the key file used to secure etcd\ncommunication.",
              "label": "default"
            },
            {
              "data": "",
              "label": "rationale"
            },
            {
              "data": "Change to the /etc/kubernetes/manifests directory on the Kubernetes Master\nNode. Run the command:\n\n    grep -i etcd-keyfile *\n\n    If the setting \"etcd-keyfile\" is not configured in the Kubernetes API\nServer manifest file, this is a finding.",
              "label": "check"
            },
            {
              "data": "Edit the Kubernetes API Server manifest file in the\n/etc/kubernetes/manifests directory on the Kubernetes Master Node. Set the\nvalue of \"--etcd-keyfile\" to the certificate to be used for communication\nwith etcd.",
              "label": "fix"
            }
          ],
          "id": "V-242431",
          "impact": 0.5,
          "refs": [
            {
              "ref": []
            }
          ],
          "results": [
            {
              "code_desc": "Process arguments for k3s server datastore-keyfile is expected not to be nil",
              "resource_class": "kube_process",
              "resource_params": "[\"k3s server\"]",
              "run_time": 0.027488661,
              "start_time": "2021-06-21T21:25:33-04:00",
              "status": "passed"
            }
          ],
          "source_location": {
            "line": 3,
            "ref": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242431.rb"
          },
          "tags": {
            "cci": ["CCI-001184"],
            "fix_id": "F-45664r712648_fix",
            "gid": "V-242431",
            "gtitle": "SRG-APP-000219-CTR-000550",
            "nist": ["SC-23"],
            "rid": "SV-242431r712649_rule",
            "severity": "medium",
            "stig_id": "CNTR-K8-001530"
          },
          "title": "Kubernetes etcd must have a key file for secure communication.",
          "waiver_data": {}
        },
        {
          "code": "control 'V-242432' do\n  title 'Kubernetes etcd must have peer-cert-file set for secure communication.'\n  desc  \"Kubernetes stores configuration and state information in a distributed\nkey-value store called etcd. Anyone who can write to etcd can effectively\ncontrol the Kubernetes cluster. Even just reading the contents of etcd could\neasily provide helpful hints to a would-be attacker. Using authenticity\nprotection, the communication can be protected against man-in-the-middle\nattacks/session hijacking and the insertion of false information into sessions.\n\n    The communication session is protected by utilizing transport encryption\nprotocols, such as TLS. TLS provides the Kubernetes API Server and etcd with a\nmeans to be able to authenticate sessions and encrypt traffic.\n\n    To enable encrypted communication for etcd, the parameter etcd-certfile\nmust be set. This parameter gives the location of the SSL certification file\nused to secure etcd communication.\n  \"\n  desc  'rationale', ''\n  desc  'check', \"\n    Change to the /etc/kubernetes/manifests directory on the Kubernetes Master\nNode. Run the command:\n\n    grep -i peer-cert-file *\n\n    If the setting \\\"peer-cert-file\\\" is not configured in the Kubernetes etcd\nmanifest file, this is a finding.\n  \"\n  desc 'fix', \"Edit the Kubernetes etcd manifest file in the\n/etc/kubernetes/manifests directory on the Kubernetes Master Node. Set the\nvalue of \\\"--peer-cert-file\\\" to the certificate to be used for communication\nwith etcd.\"\n  impact 0.5\n  tag severity: 'medium'\n  tag gtitle: 'SRG-APP-000219-CTR-000550'\n  tag gid: 'V-242432'\n  tag rid: 'SV-242432r712652_rule'\n  tag stig_id: 'CNTR-K8-001540'\n  tag fix_id: 'F-45665r712651_fix'\n  tag cci: ['CCI-001184']\n  tag nist: ['SC-23']\n\n  if etcd.exist?\n    describe.one do\n      describe etcd do\n        its('peer-cert-file') { should_not be_nil }\n      end\n\n      describe process_env_var('etcd') do\n        its(:ETCD_PEER_CERT_FILE) { should_not be_nil }\n      end\n    end\n  else\n    describe 'ETCD process is not running on the target.' do\n      skip\n    end\n  end\nend\n",
          "desc": "Kubernetes stores configuration and state information in a distributed\nkey-value store called etcd. Anyone who can write to etcd can effectively\ncontrol the Kubernetes cluster. Even just reading the contents of etcd could\neasily provide helpful hints to a would-be attacker. Using authenticity\nprotection, the communication can be protected against man-in-the-middle\nattacks/session hijacking and the insertion of false information into sessions.\n\n    The communication session is protected by utilizing transport encryption\nprotocols, such as TLS. TLS provides the Kubernetes API Server and etcd with a\nmeans to be able to authenticate sessions and encrypt traffic.\n\n    To enable encrypted communication for etcd, the parameter etcd-certfile\nmust be set. This parameter gives the location of the SSL certification file\nused to secure etcd communication.",
          "descriptions": [
            {
              "data": "Kubernetes stores configuration and state information in a distributed\nkey-value store called etcd. Anyone who can write to etcd can effectively\ncontrol the Kubernetes cluster. Even just reading the contents of etcd could\neasily provide helpful hints to a would-be attacker. Using authenticity\nprotection, the communication can be protected against man-in-the-middle\nattacks/session hijacking and the insertion of false information into sessions.\n\n    The communication session is protected by utilizing transport encryption\nprotocols, such as TLS. TLS provides the Kubernetes API Server and etcd with a\nmeans to be able to authenticate sessions and encrypt traffic.\n\n    To enable encrypted communication for etcd, the parameter etcd-certfile\nmust be set. This parameter gives the location of the SSL certification file\nused to secure etcd communication.",
              "label": "default"
            },
            {
              "data": "",
              "label": "rationale"
            },
            {
              "data": "Change to the /etc/kubernetes/manifests directory on the Kubernetes Master\nNode. Run the command:\n\n    grep -i peer-cert-file *\n\n    If the setting \"peer-cert-file\" is not configured in the Kubernetes etcd\nmanifest file, this is a finding.",
              "label": "check"
            },
            {
              "data": "Edit the Kubernetes etcd manifest file in the\n/etc/kubernetes/manifests directory on the Kubernetes Master Node. Set the\nvalue of \"--peer-cert-file\" to the certificate to be used for communication\nwith etcd.",
              "label": "fix"
            }
          ],
          "id": "V-242432",
          "impact": 0.5,
          "refs": [],
          "results": [
            {
              "code_desc": "Process arguments for /usr/local/bin/etcd peer-cert-file is expected not to be nil",
              "resource_class": "etcd",
              "resource_params": "[]",
              "run_time": 8.4748e-5,
              "start_time": "2021-06-21T21:25:33-04:00",
              "status": "passed"
            }
          ],
          "source_location": {
            "line": 3,
            "ref": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242432.rb"
          },
          "tags": {
            "cci": ["CCI-001184"],
            "fix_id": "F-45665r712651_fix",
            "gid": "V-242432",
            "gtitle": "SRG-APP-000219-CTR-000550",
            "nist": ["SC-23"],
            "rid": "SV-242432r712652_rule",
            "severity": "medium",
            "stig_id": "CNTR-K8-001540"
          },
          "title": "Kubernetes etcd must have peer-cert-file set for secure communication.",
          "waiver_data": {}
        },
        {
          "code": "control 'V-242433' do\n  title \"Kubernetes etcd must have a peer-key-file set for secure\ncommunication.\"\n  desc  \"Kubernetes stores configuration and state information in a distributed\nkey-value store called etcd. Anyone who can write to etcd can effectively\ncontrol a Kubernetes cluster. Even just reading the contents of etcd could\neasily provide helpful hints to a would-be attacker. Using authenticity\nprotection, the communication can be protected against man-in-the-middle\nattacks/session hijacking and the insertion of false information into sessions.\n\n    The communication session is protected by utilizing transport encryption\nprotocols, such as TLS. TLS provides the Kubernetes API Server and etcd with a\nmeans to be able to authenticate sessions and encrypt traffic.\n\n    To enable encrypted communication for etcd, the parameter etcd-certfile\nmust be set. This parameter gives the location of the SSL certification file\nused to secure etcd communication.\n  \"\n  desc  'rationale', ''\n  desc  'check', \"\n    Change to the /etc/kubernetes/manifests directory on the Kubernetes Master\nNode. Run the command:\n\n    grep -i peer-key-file *\n\n    If the setting \\\"peer-key-file\\\" is not set in the Kubernetes etcd manifest\nfile, this is a finding.\n  \"\n  desc 'fix', \"Edit the Kubernetes etcd manifest file in the\n/etc/kubernetes/manifests directory on the Kubernetes Master Node. Set the\nvalue of \\\"--peer-key-file\\\" to the certificate to be used for communication\nwith etcd.\"\n  impact 0.5\n  tag severity: 'medium'\n  tag gtitle: 'SRG-APP-000219-CTR-000550'\n  tag gid: 'V-242433'\n  tag rid: 'SV-242433r712655_rule'\n  tag stig_id: 'CNTR-K8-001550'\n  tag fix_id: 'F-45666r712654_fix'\n  tag cci: ['CCI-001184']\n  tag nist: ['SC-23']\n\n  if etcd.exist?\n    describe.one do\n      describe etcd do\n        its('peer-key-file') { should_not be_nil }\n      end\n\n      describe process_env_var('etcd') do\n        its(:ETCD_PEER_KEY_FILE) { should_not be_nil }\n      end\n    end\n  else\n    describe 'ETCD process is not running on the target.' do\n      skip\n    end\n  end\nend\n",
          "desc": "Kubernetes stores configuration and state information in a distributed\nkey-value store called etcd. Anyone who can write to etcd can effectively\ncontrol a Kubernetes cluster. Even just reading the contents of etcd could\neasily provide helpful hints to a would-be attacker. Using authenticity\nprotection, the communication can be protected against man-in-the-middle\nattacks/session hijacking and the insertion of false information into sessions.\n\n    The communication session is protected by utilizing transport encryption\nprotocols, such as TLS. TLS provides the Kubernetes API Server and etcd with a\nmeans to be able to authenticate sessions and encrypt traffic.\n\n    To enable encrypted communication for etcd, the parameter etcd-certfile\nmust be set. This parameter gives the location of the SSL certification file\nused to secure etcd communication.",
          "descriptions": [
            {
              "data": "Kubernetes stores configuration and state information in a distributed\nkey-value store called etcd. Anyone who can write to etcd can effectively\ncontrol a Kubernetes cluster. Even just reading the contents of etcd could\neasily provide helpful hints to a would-be attacker. Using authenticity\nprotection, the communication can be protected against man-in-the-middle\nattacks/session hijacking and the insertion of false information into sessions.\n\n    The communication session is protected by utilizing transport encryption\nprotocols, such as TLS. TLS provides the Kubernetes API Server and etcd with a\nmeans to be able to authenticate sessions and encrypt traffic.\n\n    To enable encrypted communication for etcd, the parameter etcd-certfile\nmust be set. This parameter gives the location of the SSL certification file\nused to secure etcd communication.",
              "label": "default"
            },
            {
              "data": "",
              "label": "rationale"
            },
            {
              "data": "Change to the /etc/kubernetes/manifests directory on the Kubernetes Master\nNode. Run the command:\n\n    grep -i peer-key-file *\n\n    If the setting \"peer-key-file\" is not set in the Kubernetes etcd manifest\nfile, this is a finding.",
              "label": "check"
            },
            {
              "data": "Edit the Kubernetes etcd manifest file in the\n/etc/kubernetes/manifests directory on the Kubernetes Master Node. Set the\nvalue of \"--peer-key-file\" to the certificate to be used for communication\nwith etcd.",
              "label": "fix"
            }
          ],
          "id": "V-242433",
          "impact": 0.5,
          "refs": [],
          "results": [
            {
              "code_desc": "Process arguments for /usr/local/bin/etcd peer-key-file is expected not to be nil",
              "resource_class": "etcd",
              "resource_params": "[]",
              "run_time": 9.282e-5,
              "start_time": "2021-06-21T21:25:33-04:00",
              "status": "passed"
            }
          ],
          "source_location": {
            "line": 3,
            "ref": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242433.rb"
          },
          "tags": {
            "cci": ["CCI-001184"],
            "fix_id": "F-45666r712654_fix",
            "gid": "V-242433",
            "gtitle": "SRG-APP-000219-CTR-000550",
            "nist": ["SC-23"],
            "rid": "SV-242433r712655_rule",
            "severity": "medium",
            "stig_id": "CNTR-K8-001550"
          },
          "title": "Kubernetes etcd must have a peer-key-file set for secure\ncommunication.",
          "waiver_data": {}
        },
        {
          "code": "control 'V-242434' do\n  title 'Kubernetes Kubelet must enable kernel protection.'\n  desc  \"System kernel is responsible for memory, disk, and task management.\nThe kernel provides a gateway between the system hardware and software.\nKubernetes requires kernel access to allocate resources to the Control Plane.\nThreat actors that penetrate the system kernel can inject malicious code or\nhijack the Kubernetes architecture. It is vital to implement protections\nthrough Kubernetes components to reduce the attack surface.\"\n  desc  'rationale', ''\n  desc  'check', \"\n    Change to the /etc/sysconfig/ directory on the Kubernetes Master Node. Run\nthe command:\n\n    grep -i protect-kernel-defaults kubelet\n\n    If the setting \\\"protect-kernel-defaults\\\" is set to false or not set in\nthe Kubernetes Kubelet, this is a finding.\n  \"\n  desc 'fix', \"\n    Edit the Kubernetes Kuberlet file in the /etc/sysconfig directory on the\nKubernetes Master Node. Set the argument \\\"--protect-kernel-defaults\\\" to\n\\\"true\\\".\n\n    Reset Kubelet service using the following command:\n\n    service kubelet restart\n  \"\n  impact 0.7\n  tag severity: 'high'\n  tag gtitle: 'SRG-APP-000233-CTR-000585'\n  tag gid: 'V-242434'\n  tag rid: 'SV-242434r712658_rule'\n  tag stig_id: 'CNTR-K8-001620'\n  tag fix_id: 'F-45667r712657_fix'\n  tag cci: ['CCI-001084']\n  tag nist: ['SC-3']\n\n  describe.one do\n    describe kubelet do\n      its('protect-kernel-defaults') { should cmp 'true' }\n    end\n\n    describe kubelet_config_file do\n      its('protectKernelDefaults') { should cmp 'true' }\n    end\n  end\nend\n",
          "desc": "System kernel is responsible for memory, disk, and task management.\nThe kernel provides a gateway between the system hardware and software.\nKubernetes requires kernel access to allocate resources to the Control Plane.\nThreat actors that penetrate the system kernel can inject malicious code or\nhijack the Kubernetes architecture. It is vital to implement protections\nthrough Kubernetes components to reduce the attack surface.",
          "descriptions": [
            {
              "data": "System kernel is responsible for memory, disk, and task management.\nThe kernel provides a gateway between the system hardware and software.\nKubernetes requires kernel access to allocate resources to the Control Plane.\nThreat actors that penetrate the system kernel can inject malicious code or\nhijack the Kubernetes architecture. It is vital to implement protections\nthrough Kubernetes components to reduce the attack surface.",
              "label": "default"
            },
            {
              "data": "",
              "label": "rationale"
            },
            {
              "data": "Change to the /etc/sysconfig/ directory on the Kubernetes Master Node. Run\nthe command:\n\n    grep -i protect-kernel-defaults kubelet\n\n    If the setting \"protect-kernel-defaults\" is set to false or not set in\nthe Kubernetes Kubelet, this is a finding.",
              "label": "check"
            },
            {
              "data": "Edit the Kubernetes Kuberlet file in the /etc/sysconfig directory on the\nKubernetes Master Node. Set the argument \"--protect-kernel-defaults\" to\n\"true\".\n\n    Reset Kubelet service using the following command:\n\n    service kubelet restart",
              "label": "fix"
            }
          ],
          "id": "V-242434",
          "impact": 0.7,
          "refs": [],
          "results": [
            {
              "code_desc": "Process arguments for k3s protect-kernel-defaults is expected to cmp == \"true\"",
              "resource_class": "kubelet",
              "resource_params": "[]",
              "run_time": 0.000172652,
              "start_time": "2021-06-21T21:25:33-04:00",
              "status": "passed"
            }
          ],
          "source_location": {
            "line": 3,
            "ref": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242434.rb"
          },
          "tags": {
            "cci": ["CCI-001084"],
            "fix_id": "F-45667r712657_fix",
            "gid": "V-242434",
            "gtitle": "SRG-APP-000233-CTR-000585",
            "nist": ["SC-3"],
            "rid": "SV-242434r712658_rule",
            "severity": "high",
            "stig_id": "CNTR-K8-001620"
          },
          "title": "Kubernetes Kubelet must enable kernel protection.",
          "waiver_data": {}
        },
        {
          "code": "control 'V-242435' do\n  title \"Kubernetes must prevent non-privileged users from executing privileged\nfunctions to include disabling, circumventing, or altering implemented security\nsafeguards/countermeasures or the installation of patches and updates.\"\n  desc  \"Kubernetes uses the API Server to control communication to the other\nservices that makeup Kubernetes. The use of authorizations and not the default\nof \\\"AlwaysAllow\\\" enables the Kubernetes functions control to only the groups\nthat need them.\n\n    To control access the API server must have one of the following options set\nfor the authorization mode:\n        --authorization-mode=ABAC Attribute-Based Access Control (ABAC) mode\nallows a user to configure policies using local files.\n        --authorization-mode=RBAC Role-based access control (RBAC) mode allows\na user to create and store policies using the Kubernetes API.\n        --authorization-mode=Webhook\n\n    WebHook is an HTTP callback mode that allows a user to manage authorization\nusing a remote REST endpoint.\n        --authorization-mode=Node\n\n    Node authorization is a special-purpose authorization mode that\nspecifically authorizes API requests made by kubelets.\n        --authorization-mode=AlwaysDeny\n\n    This flag blocks all requests. Use this flag only for testing.\n\n\n  \"\n  desc  'rationale', ''\n  desc  'check', \"\n    Change to the /etc/kubernetes/manifests directory on the Kubernetes Master\nNode. Run the command:\n\n    grep -i authorization-mode *\n\n    If the setting authorization-mode is set to \\\"AlwaysAllow\\\" in the\nKubernetes API Server manifest file or is not configured, this is a finding.\n  \"\n  desc 'fix', \"Edit the Kubernetes API Server manifest file in the\n/etc/kubernetes/manifests directory on the Kubernetes Master Node. Set the\nargument \\\"--authorization-mode\\\" to any valid authorization mode other than\nAlwaysAllow.\"\n  impact 0.7\n  tag severity: 'high'\n  tag gtitle: 'SRG-APP-000340-CTR-000770'\n  tag satisfies: ['SRG-APP-000340-CTR-000770', 'SRG-APP-000033-CTR-000095',\n                  'SRG-APP-000378-CTR-000880']\n  tag gid: 'V-242435'\n  tag rid: 'SV-242435r712661_rule'\n  tag stig_id: 'CNTR-K8-001990'\n  tag fix_id: 'F-45668r712660_fix'\n  tag cci: ['CCI-000213', 'CCI-001812', 'CCI-002235']\n  tag nist: ['AC-3', 'CM-11 (2)', 'AC-6 (10)']\n\n  unless kube_apiserver.exist?\n    impact 0.0\n    desc 'caveat', 'Kubernetes API Server process is not running on the target.'\n  end\n\n  describe kube_apiserver do\n    its('authorization-mode') { should_not be_nil }\n    its('authorization-mode') { should_not cmp 'AlwaysAllow' }\n  end\nend\n",
          "desc": "Kubernetes uses the API Server to control communication to the other\nservices that makeup Kubernetes. The use of authorizations and not the default\nof \"AlwaysAllow\" enables the Kubernetes functions control to only the groups\nthat need them.\n\n    To control access the API server must have one of the following options set\nfor the authorization mode:\n        --authorization-mode=ABAC Attribute-Based Access Control (ABAC) mode\nallows a user to configure policies using local files.\n        --authorization-mode=RBAC Role-based access control (RBAC) mode allows\na user to create and store policies using the Kubernetes API.\n        --authorization-mode=Webhook\n\n    WebHook is an HTTP callback mode that allows a user to manage authorization\nusing a remote REST endpoint.\n        --authorization-mode=Node\n\n    Node authorization is a special-purpose authorization mode that\nspecifically authorizes API requests made by kubelets.\n        --authorization-mode=AlwaysDeny\n\n    This flag blocks all requests. Use this flag only for testing.",
          "descriptions": [
            {
              "data": "Kubernetes uses the API Server to control communication to the other\nservices that makeup Kubernetes. The use of authorizations and not the default\nof \"AlwaysAllow\" enables the Kubernetes functions control to only the groups\nthat need them.\n\n    To control access the API server must have one of the following options set\nfor the authorization mode:\n        --authorization-mode=ABAC Attribute-Based Access Control (ABAC) mode\nallows a user to configure policies using local files.\n        --authorization-mode=RBAC Role-based access control (RBAC) mode allows\na user to create and store policies using the Kubernetes API.\n        --authorization-mode=Webhook\n\n    WebHook is an HTTP callback mode that allows a user to manage authorization\nusing a remote REST endpoint.\n        --authorization-mode=Node\n\n    Node authorization is a special-purpose authorization mode that\nspecifically authorizes API requests made by kubelets.\n        --authorization-mode=AlwaysDeny\n\n    This flag blocks all requests. Use this flag only for testing.",
              "label": "default"
            },
            {
              "data": "",
              "label": "rationale"
            },
            {
              "data": "Change to the /etc/kubernetes/manifests directory on the Kubernetes Master\nNode. Run the command:\n\n    grep -i authorization-mode *\n\n    If the setting authorization-mode is set to \"AlwaysAllow\" in the\nKubernetes API Server manifest file or is not configured, this is a finding.",
              "label": "check"
            },
            {
              "data": "Edit the Kubernetes API Server manifest file in the\n/etc/kubernetes/manifests directory on the Kubernetes Master Node. Set the\nargument \"--authorization-mode\" to any valid authorization mode other than\nAlwaysAllow.",
              "label": "fix"
            }
          ],
          "id": "V-242435",
          "impact": 0.7,
          "refs": [],
          "results": [
            {
              "code_desc": "Process arguments for k3s server authorization-mode is expected not to be nil",
              "resource_class": "kube_apiserver",
              "resource_params": "[]",
              "run_time": 0.007287891,
              "start_time": "2021-06-21T21:25:33-04:00",
              "status": "passed"
            },
            {
              "code_desc": "Process arguments for k3s server authorization-mode is expected not to cmp == \"AlwaysAllow\"",
              "resource_class": "kube_apiserver",
              "resource_params": "[]",
              "run_time": 0.000181922,
              "start_time": "2021-06-21T21:25:33-04:00",
              "status": "passed"
            }
          ],
          "source_location": {
            "line": 3,
            "ref": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242435.rb"
          },
          "tags": {
            "cci": ["CCI-000213", "CCI-001812", "CCI-002235"],
            "fix_id": "F-45668r712660_fix",
            "gid": "V-242435",
            "gtitle": "SRG-APP-000340-CTR-000770",
            "nist": ["AC-3", "CM-11 (2)", "AC-6 (10)"],
            "rid": "SV-242435r712661_rule",
            "satisfies": [
              "SRG-APP-000340-CTR-000770",
              "SRG-APP-000033-CTR-000095",
              "SRG-APP-000378-CTR-000880"
            ],
            "severity": "high",
            "stig_id": "CNTR-K8-001990"
          },
          "title": "Kubernetes must prevent non-privileged users from executing privileged\nfunctions to include disabling, circumventing, or altering implemented security\nsafeguards/countermeasures or the installation of patches and updates.",
          "waiver_data": {}
        },
        {
          "code": "control 'V-242436' do\n  title \"The Kubernetes API server must have the ValidatingAdmissionWebhook\nenabled.\"\n  desc  \"Enabling the admissions webhook allows for Kubernetes to apply\npolicies against objects that are to be created, read, updated, or deleted. By\napplying a pod security policy, control can be given to not allow images to be\ninstantiated that run as the root user. If pods run as the root user, the pod\nthen has root privileges to the host system and all the resources it has. An\nattacker can use this to attack the Kubernetes cluster. By implementing a\npolicy that does not allow root or privileged pods, the pod users are limited\nin what the pod can do and access.\"\n  desc  'rationale', ''\n  desc  'check', \"\n    Change to the /etc/kubernetes/manifests directory on the Kubernetes Master\nNode. Run the command:\n\n    grep -i ValidatingAdmissionWebhook *\n\n    If a line is not returned that includes enable-admission-plugins and\nValidatingAdmissionWebhook, this is a finding.\n  \"\n  desc 'fix', \"\n    Edit the Kubernetes API Server manifest file in the\n/etc/kubernetes/manifests directory on the Kubernetes Master Node. Set the\nargument \\\"--enable-admission-plugins\\\" to include\n\\\"ValidatingAdmissionWebhook\\\".  Each enabled plugin is separated by commas.\n\n    Note: It is best to implement policies first and then enable the webhook,\notherwise a denial of service may occur.\n  \"\n  impact 0.7\n  tag severity: 'high'\n  tag gtitle: 'SRG-APP-000342-CTR-000775'\n  tag gid: 'V-242436'\n  tag rid: 'SV-242436r712664_rule'\n  tag stig_id: 'CNTR-K8-002000'\n  tag fix_id: 'F-45669r717027_fix'\n  tag cci: ['CCI-002233']\n  tag nist: ['AC-6 (8)']\n\n  unless kube_apiserver.exist?\n    impact 0.0\n    desc 'caveat', 'Kubernetes API Server process is not running on the target.'\n  end\n\n  describe kube_apiserver do\n    its('enable-admission-plugins.to_s') { should include 'ValidatingAdmissionWebhook' }\n  end\nend\n",
          "desc": "Enabling the admissions webhook allows for Kubernetes to apply\npolicies against objects that are to be created, read, updated, or deleted. By\napplying a pod security policy, control can be given to not allow images to be\ninstantiated that run as the root user. If pods run as the root user, the pod\nthen has root privileges to the host system and all the resources it has. An\nattacker can use this to attack the Kubernetes cluster. By implementing a\npolicy that does not allow root or privileged pods, the pod users are limited\nin what the pod can do and access.",
          "descriptions": [
            {
              "data": "Enabling the admissions webhook allows for Kubernetes to apply\npolicies against objects that are to be created, read, updated, or deleted. By\napplying a pod security policy, control can be given to not allow images to be\ninstantiated that run as the root user. If pods run as the root user, the pod\nthen has root privileges to the host system and all the resources it has. An\nattacker can use this to attack the Kubernetes cluster. By implementing a\npolicy that does not allow root or privileged pods, the pod users are limited\nin what the pod can do and access.",
              "label": "default"
            },
            {
              "data": "",
              "label": "rationale"
            },
            {
              "data": "Change to the /etc/kubernetes/manifests directory on the Kubernetes Master\nNode. Run the command:\n\n    grep -i ValidatingAdmissionWebhook *\n\n    If a line is not returned that includes enable-admission-plugins and\nValidatingAdmissionWebhook, this is a finding.",
              "label": "check"
            },
            {
              "data": "Edit the Kubernetes API Server manifest file in the\n/etc/kubernetes/manifests directory on the Kubernetes Master Node. Set the\nargument \"--enable-admission-plugins\" to include\n\"ValidatingAdmissionWebhook\".  Each enabled plugin is separated by commas.\n\n    Note: It is best to implement policies first and then enable the webhook,\notherwise a denial of service may occur.",
              "label": "fix"
            }
          ],
          "id": "V-242436",
          "impact": 0.7,
          "refs": [],
          "results": [
            {
              "code_desc": "Process arguments for k3s server enable-admission-plugins.to_s is expected to include \"ValidatingAdmissionWebhook\"",
              "resource_class": "kube_apiserver",
              "resource_params": "[]",
              "run_time": 0.009482357,
              "start_time": "2021-06-21T21:25:33-04:00",
              "status": "passed"
            }
          ],
          "source_location": {
            "line": 3,
            "ref": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242436.rb"
          },
          "tags": {
            "cci": ["CCI-002233"],
            "fix_id": "F-45669r717027_fix",
            "gid": "V-242436",
            "gtitle": "SRG-APP-000342-CTR-000775",
            "nist": ["AC-6 (8)"],
            "rid": "SV-242436r712664_rule",
            "severity": "high",
            "stig_id": "CNTR-K8-002000"
          },
          "title": "The Kubernetes API server must have the ValidatingAdmissionWebhook\nenabled.",
          "waiver_data": {}
        },
        {
          "code": "control 'V-242438' do\n  title 'Kubernetes API Server must configure timeouts to limit attack surface.'\n  desc  \"Kubernetes API Server request timeouts sets the duration a request\nstays open before timing out. Since the API Server is the central component in\nthe Kubernetes Control Plane, it is vital to protect this service. If request\ntimeouts were not set, malicious attacks or unwanted activities might affect\nmultiple deployments across different applications or environments. This might\ndeplete all resources from the Kubernetes infrastructure causing the\ninformation system to go offline. The request-timeout value must never be set\nto \\\"0\\\". This disables the request-timeout feature. By default, the\nrequest-timeout is set to \\\"1 minute\\\".\"\n  desc  'rationale', ''\n  desc  'check', \"\n    Change to the /etc/kubernetes/manifests/ directory on the Kubernetes Master\nNode. Run the command:\n\n    grep -I request-timeout *\n\n    If Kubernetes API Server manifest file does not exist, this is a finding.\n\n    If the setting request-timeout is set to \\\"0\\\" in the Kubernetes API Server\nmanifest file, or is not configured this is a finding.\n  \"\n  desc 'fix', \"Edit the Kubernetes API Server manifest file in the\n/etc/kubernetes/manifests directory on the Kubernetes Master Node. Set the\nvalue of request-timeout greater than \\\"0\\\".\"\n  impact 0.5\n  tag severity: 'medium'\n  tag gtitle: 'SRG-APP-000435-CTR-001070'\n  tag gid: 'V-242438'\n  tag rid: 'SV-242438r712670_rule'\n  tag stig_id: 'CNTR-K8-002600'\n  tag fix_id: 'F-45671r712669_fix'\n  tag cci: ['CCI-002385']\n  tag nist: ['SC-5']\n\n  unless kube_apiserver.exist?\n    impact 0.0\n    desc 'caveat', 'Kubernetes API Server process is not running on the target.'\n  end\n\n  describe kube_apiserver do\n    its('request-timeout') { should_not be_nil }\n    its('request-timeout') { should_not cmp '0' }\n  end\nend\n",
          "desc": "Kubernetes API Server request timeouts sets the duration a request\nstays open before timing out. Since the API Server is the central component in\nthe Kubernetes Control Plane, it is vital to protect this service. If request\ntimeouts were not set, malicious attacks or unwanted activities might affect\nmultiple deployments across different applications or environments. This might\ndeplete all resources from the Kubernetes infrastructure causing the\ninformation system to go offline. The request-timeout value must never be set\nto \"0\". This disables the request-timeout feature. By default, the\nrequest-timeout is set to \"1 minute\".",
          "descriptions": [
            {
              "data": "Kubernetes API Server request timeouts sets the duration a request\nstays open before timing out. Since the API Server is the central component in\nthe Kubernetes Control Plane, it is vital to protect this service. If request\ntimeouts were not set, malicious attacks or unwanted activities might affect\nmultiple deployments across different applications or environments. This might\ndeplete all resources from the Kubernetes infrastructure causing the\ninformation system to go offline. The request-timeout value must never be set\nto \"0\". This disables the request-timeout feature. By default, the\nrequest-timeout is set to \"1 minute\".",
              "label": "default"
            },
            {
              "data": "",
              "label": "rationale"
            },
            {
              "data": "Change to the /etc/kubernetes/manifests/ directory on the Kubernetes Master\nNode. Run the command:\n\n    grep -I request-timeout *\n\n    If Kubernetes API Server manifest file does not exist, this is a finding.\n\n    If the setting request-timeout is set to \"0\" in the Kubernetes API Server\nmanifest file, or is not configured this is a finding.",
              "label": "check"
            },
            {
              "data": "Edit the Kubernetes API Server manifest file in the\n/etc/kubernetes/manifests directory on the Kubernetes Master Node. Set the\nvalue of request-timeout greater than \"0\".",
              "label": "fix"
            }
          ],
          "id": "V-242438",
          "impact": 0.5,
          "refs": [],
          "results": [
            {
              "code_desc": "Process arguments for k3s server request-timeout is expected not to be nil",
              "resource_class": "kube_apiserver",
              "resource_params": "[]",
              "run_time": 0.008560564,
              "start_time": "2021-06-21T21:25:33-04:00",
              "status": "passed"
            },
            {
              "code_desc": "Process arguments for k3s server request-timeout is expected not to cmp == \"0\"",
              "resource_class": "kube_apiserver",
              "resource_params": "[]",
              "run_time": 0.000224336,
              "start_time": "2021-06-21T21:25:33-04:00",
              "status": "passed"
            }
          ],
          "source_location": {
            "line": 3,
            "ref": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242438.rb"
          },
          "tags": {
            "cci": ["CCI-002385"],
            "fix_id": "F-45671r712669_fix",
            "gid": "V-242438",
            "gtitle": "SRG-APP-000435-CTR-001070",
            "nist": ["SC-5"],
            "rid": "SV-242438r712670_rule",
            "severity": "medium",
            "stig_id": "CNTR-K8-002600"
          },
          "title": "Kubernetes API Server must configure timeouts to limit attack surface.",
          "waiver_data": {}
        },
        {
          "code": "control 'V-242439' do\n  title \"Kubernetes API Server must disable basic authentication to protect\ninformation in transit.\"\n  desc  \"Kubernetes basic authentication sends and receives request containing\nusername, uid, groups, and other fields over a clear text HTTP communication.\nBasic authentication does not provide any security mechanisms using encryption\nstandards. PKI certificate-based authentication must be set over a secure\nchannel to ensure confidentiality and integrity. Basic authentication must not\nbe set in the manifest file.\"\n  desc  'rationale', ''\n  desc  'check', \"\n    Change to the /etc/kubernetes/manifests/ directory on the Kubernetes Master\nNode. Run the command:\n\n    grep -i basic-auth-file *\n\n    If \\\"basic-auth-file\\\" is set in the Kubernetes API server manifest file\nthis is a finding.\n  \"\n  desc 'fix', \"Edit the Kubernetes API Server manifest file in the\n/etc/kubernetes/manifests directory on the Kubernetes Master Node. Remove the\nsetting \\\"--basic-auth-file\\\".\"\n  impact 0.7\n  tag severity: 'high'\n  tag gtitle: 'SRG-APP-000516-CTR-001325'\n  tag gid: 'V-242439'\n  tag rid: 'SV-242439r712673_rule'\n  tag stig_id: 'CNTR-K8-002620'\n  tag fix_id: 'F-45672r712672_fix'\n  tag cci: ['CCI-002418']\n  tag nist: ['SC-8']\n\n  unless kube_apiserver.exist?\n    impact 0.0\n    desc 'caveat', 'Kubernetes API Server process is not running on the target.'\n  end\n\n  describe kube_apiserver do\n    its('basic-auth-file') { should be_nil }\n  end\nend\n",
          "desc": "Kubernetes basic authentication sends and receives request containing\nusername, uid, groups, and other fields over a clear text HTTP communication.\nBasic authentication does not provide any security mechanisms using encryption\nstandards. PKI certificate-based authentication must be set over a secure\nchannel to ensure confidentiality and integrity. Basic authentication must not\nbe set in the manifest file.",
          "descriptions": [
            {
              "data": "Kubernetes basic authentication sends and receives request containing\nusername, uid, groups, and other fields over a clear text HTTP communication.\nBasic authentication does not provide any security mechanisms using encryption\nstandards. PKI certificate-based authentication must be set over a secure\nchannel to ensure confidentiality and integrity. Basic authentication must not\nbe set in the manifest file.",
              "label": "default"
            },
            {
              "data": "",
              "label": "rationale"
            },
            {
              "data": "Change to the /etc/kubernetes/manifests/ directory on the Kubernetes Master\nNode. Run the command:\n\n    grep -i basic-auth-file *\n\n    If \"basic-auth-file\" is set in the Kubernetes API server manifest file\nthis is a finding.",
              "label": "check"
            },
            {
              "data": "Edit the Kubernetes API Server manifest file in the\n/etc/kubernetes/manifests directory on the Kubernetes Master Node. Remove the\nsetting \"--basic-auth-file\".",
              "label": "fix"
            }
          ],
          "id": "V-242439",
          "impact": 0.7,
          "refs": [],
          "results": [
            {
              "code_desc": "Process arguments for k3s server basic-auth-file is expected to be nil",
              "resource_class": "kube_apiserver",
              "resource_params": "[]",
              "run_time": 0.007140963,
              "start_time": "2021-06-21T21:25:33-04:00",
              "status": "passed"
            }
          ],
          "source_location": {
            "line": 3,
            "ref": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242439.rb"
          },
          "tags": {
            "cci": ["CCI-002418"],
            "fix_id": "F-45672r712672_fix",
            "gid": "V-242439",
            "gtitle": "SRG-APP-000516-CTR-001325",
            "nist": ["SC-8"],
            "rid": "SV-242439r712673_rule",
            "severity": "high",
            "stig_id": "CNTR-K8-002620"
          },
          "title": "Kubernetes API Server must disable basic authentication to protect\ninformation in transit.",
          "waiver_data": {}
        },
        {
          "code": "control 'V-242440' do\n  title \"Kubernetes API Server must disable token authentication to protect\ninformation in transit.\"\n  desc  \"Kubernetes token authentication uses password known as secrets in a\nplaintext file. This file contains sensitive information such as token,\nusername and user uid. This token is used by service accounts within pods to\nauthenticate with the API Server. This information is very valuable for\nattackers with malicious intent if the service account is privileged having\naccess to the token. With this token a threat actor can impersonate the service\naccount gaining access to the Rest API service.\"\n  desc  'rationale', ''\n  desc  'check', \"\n    Change to the /etc/kubernetes/manifests/ directory on the Kubernetes Master\nNode. Run the command:\n\n    grep -i token-auth-file *\n\n    If \\\"token-auth-file\\\" is set in the Kubernetes API server manifest file,\nthis is a finding.\n  \"\n  desc 'fix', \"Edit the Kubernetes API Server manifest file in the\n/etc/kubernetes/manifests directory on the Kubernetes Master Node. Remove\nparameter \\\"--token-auth-file\\\".\"\n  impact 0.5\n  tag severity: 'medium'\n  tag gtitle: 'SRG-APP-000516-CTR-001325'\n  tag gid: 'V-242440'\n  tag rid: 'SV-242440r712676_rule'\n  tag stig_id: 'CNTR-K8-002630'\n  tag fix_id: 'F-45673r712675_fix'\n  tag cci: ['CCI-002418']\n  tag nist: ['SC-8']\n\n  unless kube_apiserver.exist?\n    impact 0.0\n    desc 'caveat', 'Kubernetes API Server process is not running on the target.'\n  end\n\n  describe kube_apiserver do\n    its('token-auth-file') { should be_nil }\n  end\nend\n",
          "desc": "Kubernetes token authentication uses password known as secrets in a\nplaintext file. This file contains sensitive information such as token,\nusername and user uid. This token is used by service accounts within pods to\nauthenticate with the API Server. This information is very valuable for\nattackers with malicious intent if the service account is privileged having\naccess to the token. With this token a threat actor can impersonate the service\naccount gaining access to the Rest API service.",
          "descriptions": [
            {
              "data": "Kubernetes token authentication uses password known as secrets in a\nplaintext file. This file contains sensitive information such as token,\nusername and user uid. This token is used by service accounts within pods to\nauthenticate with the API Server. This information is very valuable for\nattackers with malicious intent if the service account is privileged having\naccess to the token. With this token a threat actor can impersonate the service\naccount gaining access to the Rest API service.",
              "label": "default"
            },
            {
              "data": "",
              "label": "rationale"
            },
            {
              "data": "Change to the /etc/kubernetes/manifests/ directory on the Kubernetes Master\nNode. Run the command:\n\n    grep -i token-auth-file *\n\n    If \"token-auth-file\" is set in the Kubernetes API server manifest file,\nthis is a finding.",
              "label": "check"
            },
            {
              "data": "Edit the Kubernetes API Server manifest file in the\n/etc/kubernetes/manifests directory on the Kubernetes Master Node. Remove\nparameter \"--token-auth-file\".",
              "label": "fix"
            }
          ],
          "id": "V-242440",
          "impact": 0.5,
          "refs": [],
          "results": [
            {
              "code_desc": "Process arguments for k3s server token-auth-file is expected to be nil",
              "resource_class": "kube_apiserver",
              "resource_params": "[]",
              "run_time": 0.023441235,
              "start_time": "2021-06-21T21:25:33-04:00",
              "status": "passed"
            }
          ],
          "source_location": {
            "line": 3,
            "ref": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242440.rb"
          },
          "tags": {
            "cci": ["CCI-002418"],
            "fix_id": "F-45673r712675_fix",
            "gid": "V-242440",
            "gtitle": "SRG-APP-000516-CTR-001325",
            "nist": ["SC-8"],
            "rid": "SV-242440r712676_rule",
            "severity": "medium",
            "stig_id": "CNTR-K8-002630"
          },
          "title": "Kubernetes API Server must disable token authentication to protect\ninformation in transit.",
          "waiver_data": {}
        },
        {
          "code": "control 'V-242441' do\n  title \"Kubernetes endpoints must use approved organizational certificate and\nkey pair to protect information in transit.\"\n  desc  \"Kubernetes control plane and external communication is managed by API\nServer. The main implementation of the API Server is to manage hardware\nresources for pods and container using horizontal or vertical scaling. Anyone\nwho can gain access to the API Server can effectively control your Kubernetes\narchitecture. Using authenticity protection, the communication can be protected\nagainst man-in-the-middle attacks/session hijacking and the insertion of false\ninformation into sessions.\n\n    The communication session is protected by utilizing transport encryption\nprotocols, such as TLS. TLS provides the Kubernetes API Server with a means to\nbe able to authenticate sessions and encrypt traffic.\n\n    By default, the API Server does not authenticate to the kubelet HTTPs\nendpoint. To enable secure communication for API Server, the parameter\n-kubelet-client-certificate and kubelet-client-key must be set. This parameter\ngives the location of the certificate and key pair used to secure API Server\ncommunication.\n  \"\n  desc  'rationale', ''\n  desc  'check', \"\n    Change to the /etc/kubernetes/manifests/ directory on the Kubernetes Master\nNode. Run the command:\n\n    grep -i kubelet-client-certificate *\n    grep -I kubelet-client-key *\n\n    If the setting \\\"--kubelet-client-certificate\\\" is not configured in the\nKubernetes API server manifest file or contains no value, this is a finding.\n\n    If the setting \\\"--kubelet-client-key\\\" is not configured in the Kubernetes\nAPI server manifest file or contains no value, this is a finding.\n  \"\n  desc 'fix', \"Edit the Kubernetes API Server manifest file in the\n/etc/kubernetes/manifests directory on the Kubernetes Master Node. Set the\nvalue of \\\"--kubelet-client-certificate\\\" and \\\"--kubelet-client-key\\\" to an\nApproved Organizational Certificate and key pair.\"\n  impact 0.5\n  tag severity: 'medium'\n  tag gtitle: 'SRG-APP-000516-CTR-001325'\n  tag gid: 'V-242441'\n  tag rid: 'SV-242441r712679_rule'\n  tag stig_id: 'CNTR-K8-002640'\n  tag fix_id: 'F-45674r712678_fix'\n  tag cci: ['CCI-002418']\n  tag nist: ['SC-8']\n\n  unless kube_apiserver.exist?\n    impact 0.0\n    desc 'caveat', 'Kubernetes API Server process is not running on the target.'\n  end\n\n  describe kube_apiserver do\n    its('kubelet-client-certificate') { should_not be_nil }\n    its('kubelet-client-key') { should_not be_nil }\n  end\nend\n",
          "desc": "Kubernetes control plane and external communication is managed by API\nServer. The main implementation of the API Server is to manage hardware\nresources for pods and container using horizontal or vertical scaling. Anyone\nwho can gain access to the API Server can effectively control your Kubernetes\narchitecture. Using authenticity protection, the communication can be protected\nagainst man-in-the-middle attacks/session hijacking and the insertion of false\ninformation into sessions.\n\n    The communication session is protected by utilizing transport encryption\nprotocols, such as TLS. TLS provides the Kubernetes API Server with a means to\nbe able to authenticate sessions and encrypt traffic.\n\n    By default, the API Server does not authenticate to the kubelet HTTPs\nendpoint. To enable secure communication for API Server, the parameter\n-kubelet-client-certificate and kubelet-client-key must be set. This parameter\ngives the location of the certificate and key pair used to secure API Server\ncommunication.",
          "descriptions": [
            {
              "data": "Kubernetes control plane and external communication is managed by API\nServer. The main implementation of the API Server is to manage hardware\nresources for pods and container using horizontal or vertical scaling. Anyone\nwho can gain access to the API Server can effectively control your Kubernetes\narchitecture. Using authenticity protection, the communication can be protected\nagainst man-in-the-middle attacks/session hijacking and the insertion of false\ninformation into sessions.\n\n    The communication session is protected by utilizing transport encryption\nprotocols, such as TLS. TLS provides the Kubernetes API Server with a means to\nbe able to authenticate sessions and encrypt traffic.\n\n    By default, the API Server does not authenticate to the kubelet HTTPs\nendpoint. To enable secure communication for API Server, the parameter\n-kubelet-client-certificate and kubelet-client-key must be set. This parameter\ngives the location of the certificate and key pair used to secure API Server\ncommunication.",
              "label": "default"
            },
            {
              "data": "",
              "label": "rationale"
            },
            {
              "data": "Change to the /etc/kubernetes/manifests/ directory on the Kubernetes Master\nNode. Run the command:\n\n    grep -i kubelet-client-certificate *\n    grep -I kubelet-client-key *\n\n    If the setting \"--kubelet-client-certificate\" is not configured in the\nKubernetes API server manifest file or contains no value, this is a finding.\n\n    If the setting \"--kubelet-client-key\" is not configured in the Kubernetes\nAPI server manifest file or contains no value, this is a finding.",
              "label": "check"
            },
            {
              "data": "Edit the Kubernetes API Server manifest file in the\n/etc/kubernetes/manifests directory on the Kubernetes Master Node. Set the\nvalue of \"--kubelet-client-certificate\" and \"--kubelet-client-key\" to an\nApproved Organizational Certificate and key pair.",
              "label": "fix"
            }
          ],
          "id": "V-242441",
          "impact": 0.5,
          "refs": [],
          "results": [
            {
              "code_desc": "Process arguments for k3s server kubelet-client-certificate is expected not to be nil",
              "resource_class": "kube_apiserver",
              "resource_params": "[]",
              "run_time": 0.00767106,
              "start_time": "2021-06-21T21:25:33-04:00",
              "status": "passed"
            },
            {
              "code_desc": "Process arguments for k3s server kubelet-client-key is expected not to be nil",
              "resource_class": "kube_apiserver",
              "resource_params": "[]",
              "run_time": 0.000105347,
              "start_time": "2021-06-21T21:25:33-04:00",
              "status": "passed"
            }
          ],
          "source_location": {
            "line": 3,
            "ref": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242441.rb"
          },
          "tags": {
            "cci": ["CCI-002418"],
            "fix_id": "F-45674r712678_fix",
            "gid": "V-242441",
            "gtitle": "SRG-APP-000516-CTR-001325",
            "nist": ["SC-8"],
            "rid": "SV-242441r712679_rule",
            "severity": "medium",
            "stig_id": "CNTR-K8-002640"
          },
          "title": "Kubernetes endpoints must use approved organizational certificate and\nkey pair to protect information in transit.",
          "waiver_data": {}
        },
        {
          "code": "control 'V-242444' do\n  title 'The Kubernetes component manifests must be owned by root.'\n  desc  \"The Kubernetes manifests are those files that contain the arguments\nand settings for the Master Node services. These services are etcd, the api\nserver, controller, proxy, and scheduler. If these files can be changed, the\nscheduler will be implementing the changes immediately. Many of the security\nsettings within the document are implemented through these manifests.\"\n  desc  'rationale', ''\n  desc  'check', \"\n    Review the ownership of the Kubernetes manifests files by using the command:\n\n    stat -c %U:%G /etc/kubernetes/manifests/* | grep -v root:root\n\n    If the command returns any non root:root file permissions, this is a\nfinding.\n  \"\n  desc 'fix', \"\n    Change the ownership of the manifest files to root: root by executing the\ncommand:\n\n    chown root:root /etc/kubernetes/manifests/*\n  \"\n  impact 0.5\n  tag severity: 'medium'\n  tag gtitle: 'SRG-APP-000516-CTR-001325'\n  tag gid: 'V-242444'\n  tag rid: 'SV-242444r712688_rule'\n  tag stig_id: 'CNTR-K8-003110'\n  tag fix_id: 'F-45677r712687_fix'\n  tag cci: ['CCI-000366']\n  tag nist: ['CM-6 b']\n\n  manifests_path = input('manifests_path')\n  manifests_files = command(\"find #{manifests_path} -type f\").stdout.split\n\n  if manifests_files.empty?\n    desc 'caveat', \"Kubernetes Manifest files not present of the target at specified path #{manifests_path}.\"\n\n    describe \"Kubernetes Manifest files not present of the target at specified path #{manifests_path}.\" do\n      skip\n    end\n  end\n\n  manifests_files.each do |file_name|\n    describe file(file_name) do\n      it { should be_owned_by('root') }\n      it { should be_grouped_into('root') }\n    end\n  end\nend\n",
          "desc": "The Kubernetes manifests are those files that contain the arguments\nand settings for the Master Node services. These services are etcd, the api\nserver, controller, proxy, and scheduler. If these files can be changed, the\nscheduler will be implementing the changes immediately. Many of the security\nsettings within the document are implemented through these manifests.",
          "descriptions": [
            {
              "data": "The Kubernetes manifests are those files that contain the arguments\nand settings for the Master Node services. These services are etcd, the api\nserver, controller, proxy, and scheduler. If these files can be changed, the\nscheduler will be implementing the changes immediately. Many of the security\nsettings within the document are implemented through these manifests.",
              "label": "default"
            },
            {
              "data": "",
              "label": "rationale"
            },
            {
              "data": "Review the ownership of the Kubernetes manifests files by using the command:\n\n    stat -c %U:%G /etc/kubernetes/manifests/* | grep -v root:root\n\n    If the command returns any non root:root file permissions, this is a\nfinding.",
              "label": "check"
            },
            {
              "data": "Change the ownership of the manifest files to root: root by executing the\ncommand:\n\n    chown root:root /etc/kubernetes/manifests/*",
              "label": "fix"
            },
            {
              "data": "K3S deployments are not applied using manifest files and hence non-applicable.",
              "label": "caveat"
            }
          ],
          "id": "V-242444",
          "impact": 0.0,
          "refs": [
            {
              "ref": []
            }
          ],
          "results": [
            {
              "code_desc": "Kubernetes Manifest files not present of the target at specified path /etc/kubernetes/manifests. ",
              "resource": "",
              "resource_class": "Object",
              "resource_params": "[]",
              "run_time": 8.937e-6,
              "skip_message": "",
              "start_time": "2021-06-21T21:25:33-04:00",
              "status": "skipped"
            }
          ],
          "source_location": {
            "line": 3,
            "ref": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242444.rb"
          },
          "tags": {
            "cci": ["CCI-000366"],
            "fix_id": "F-45677r712687_fix",
            "gid": "V-242444",
            "gtitle": "SRG-APP-000516-CTR-001325",
            "nist": ["CM-6 b"],
            "rid": "SV-242444r712688_rule",
            "severity": "medium",
            "stig_id": "CNTR-K8-003110"
          },
          "title": "The Kubernetes component manifests must be owned by root.",
          "waiver_data": {}
        },
        {
          "code": "control 'V-242445' do\n  title 'The Kubernetes component etcd must be owned by etcd.'\n  desc  \"The Kubernetes etcd key-value store provides a way to store data to\nthe Master Node. If these files can be changed, data to API object and the\nmaster node would be compromised. The scheduler will implement the changes\nimmediately. Many of the security settings within the document are implemented\nthrough this file.\"\n  desc  'rationale', ''\n  desc  'check', \"\n    Review the ownership of the Kubernetes etcd files by using the command:\n\n    stat -c %U:%G /var/lib/etcd/* | grep -v etcd:etcd\n\n    If the command returns any non etcd:etcd file permissions, this is a\nfinding.\n  \"\n  desc 'fix', \"\n    Change the ownership of the manifest files to etcd:etcd by executing the\ncommand:\n\n    chown etcd:etcd /var/lib/etcd/*\n  \"\n  impact 0.5\n  tag severity: 'medium'\n  tag gtitle: 'SRG-APP-000516-CTR-001325'\n  tag gid: 'V-242445'\n  tag rid: 'SV-242445r712691_rule'\n  tag stig_id: 'CNTR-K8-003120'\n  tag fix_id: 'F-45678r712690_fix'\n  tag cci: ['CCI-000366']\n  tag nist: ['CM-6 b']\n\n  if etcd.exist?\n    describe.one do\n      if etcd.params['data-dir']\n        describe file(etcd.params['data-dir'].join) do\n          it { should be_owned_by('etcd') }\n          it { should be_grouped_into('etcd') }\n        end\n      end\n\n      describe file(process_env_var('etcd').params['ETCD_DATA_DIR']) do\n        it { should be_owned_by('etcd') }\n        it { should be_grouped_into('etcd') }\n      end\n    end\n  else\n    describe 'ETCD process is not running on the target.' do\n      skip\n    end\n  end\nend\n",
          "desc": "The Kubernetes etcd key-value store provides a way to store data to\nthe Master Node. If these files can be changed, data to API object and the\nmaster node would be compromised. The scheduler will implement the changes\nimmediately. Many of the security settings within the document are implemented\nthrough this file.",
          "descriptions": [
            {
              "data": "The Kubernetes etcd key-value store provides a way to store data to\nthe Master Node. If these files can be changed, data to API object and the\nmaster node would be compromised. The scheduler will implement the changes\nimmediately. Many of the security settings within the document are implemented\nthrough this file.",
              "label": "default"
            },
            {
              "data": "",
              "label": "rationale"
            },
            {
              "data": "Review the ownership of the Kubernetes etcd files by using the command:\n\n    stat -c %U:%G /var/lib/etcd/* | grep -v etcd:etcd\n\n    If the command returns any non etcd:etcd file permissions, this is a\nfinding.",
              "label": "check"
            },
            {
              "data": "Change the ownership of the manifest files to etcd:etcd by executing the\ncommand:\n\n    chown etcd:etcd /var/lib/etcd/*",
              "label": "fix"
            }
          ],
          "id": "V-242445",
          "impact": 0.5,
          "refs": [],
          "results": [
            {
              "code_desc": "File /opt/etcd/data is expected to be owned by \"etcd\"",
              "exception": "RSpec::Core::MultipleExceptionError",
              "message": "expected `File /opt/etcd/data.owned_by?(\"etcd\")` to return true, got false",
              "resource_class": "file",
              "resource_params": "[\"/opt/etcd/data\"]",
              "run_time": 0.000255866,
              "start_time": "2021-06-21T21:25:33-04:00",
              "status": "failed"
            },
            {
              "code_desc": "File /opt/etcd/data is expected to be grouped into \"etcd\"",
              "exception": "RSpec::Core::MultipleExceptionError",
              "message": "expected `File /opt/etcd/data.grouped_into?(\"etcd\")` to return true, got false",
              "resource_class": "file",
              "resource_params": "[\"/opt/etcd/data\"]",
              "run_time": 0.000178582,
              "start_time": "2021-06-21T21:25:33-04:00",
              "status": "failed"
            },
            {
              "code_desc": "File  is expected to be owned by \"etcd\"",
              "exception": "RSpec::Core::MultipleExceptionError",
              "message": "expected `File .owned_by?(\"etcd\")` to return true, got false",
              "resource_class": "file",
              "resource_params": "[nil]",
              "run_time": 0.000192344,
              "start_time": "2021-06-21T21:25:33-04:00",
              "status": "failed"
            },
            {
              "code_desc": "File  is expected to be grouped into \"etcd\"",
              "exception": "RSpec::Core::MultipleExceptionError",
              "message": "expected `File .grouped_into?(\"etcd\")` to return true, got false",
              "resource_class": "file",
              "resource_params": "[nil]",
              "run_time": 0.000195753,
              "start_time": "2021-06-21T21:25:33-04:00",
              "status": "failed"
            }
          ],
          "source_location": {
            "line": 3,
            "ref": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242445.rb"
          },
          "tags": {
            "cci": ["CCI-000366"],
            "fix_id": "F-45678r712690_fix",
            "gid": "V-242445",
            "gtitle": "SRG-APP-000516-CTR-001325",
            "nist": ["CM-6 b"],
            "rid": "SV-242445r712691_rule",
            "severity": "medium",
            "stig_id": "CNTR-K8-003120"
          },
          "title": "The Kubernetes component etcd must be owned by etcd.",
          "waiver_data": {}
        },
        {
          "code": "control 'V-242446' do\n  title 'The Kubernetes conf files must be owned by root.'\n  desc  \"The Kubernetes conf files contain the arguments and settings for the\nMaster Node services. These services are controller and scheduler. If these\nfiles can be changed, the scheduler will be implementing the changes\nimmediately. Many of the security settings within the document are implemented\nthrough this file.\"\n  desc  'rationale', ''\n  desc  'check', \"\n    Review the Kubernetes conf files by using the command:\n\n    stat -c %U:%G /etc/kubernetes/admin.conf | grep -v root:root\n    stat -c %U:%G /etc/kubernetes/scheduler.conf | grep -v root:root\n    stat -c %U:%G /etc/kubernetes/controller-manager.conf | grep -v root:root\n\n    If the command returns any non root:root file permissions, this is a\nfinding.\n  \"\n  desc 'fix', \"\n    Change the ownership of the conf files to root: root by executing the\ncommand:\n\n    chown root:root /etc/kubernetes/admin.conf\n    chown root:root /etc/kubernetes/scheduler.conf\n    chown root:root /etc/kubernetes/controller-manager.conf\n  \"\n  impact 0.5\n  tag severity: 'medium'\n  tag gtitle: 'SRG-APP-000516-CTR-001325'\n  tag gid: 'V-242446'\n  tag rid: 'SV-242446r712694_rule'\n  tag stig_id: 'CNTR-K8-003130'\n  tag fix_id: 'F-45679r712693_fix'\n  tag cci: ['CCI-000366']\n  tag nist: ['CM-6 b']\n\n  input('kubernetes_conf_files').each do |file_name|\n    if file(file_name).exist?\n      describe file(file_name) do\n        it { should be_owned_by('root') }\n        it { should be_grouped_into('root') }\n      end\n    else\n      describe \"Kubernetes Conf file #{file_name} not found on target\" do\n        skip\n      end\n    end\n  end\n\n  if input('kubernetes_conf_files').empty?\n    describe 'No `kubernetes_conf_files` provided through input values.' do\n      skip\n    end\n  end\nend\n",
          "desc": "The Kubernetes conf files contain the arguments and settings for the\nMaster Node services. These services are controller and scheduler. If these\nfiles can be changed, the scheduler will be implementing the changes\nimmediately. Many of the security settings within the document are implemented\nthrough this file.",
          "descriptions": [
            {
              "data": "The Kubernetes conf files contain the arguments and settings for the\nMaster Node services. These services are controller and scheduler. If these\nfiles can be changed, the scheduler will be implementing the changes\nimmediately. Many of the security settings within the document are implemented\nthrough this file.",
              "label": "default"
            },
            {
              "data": "",
              "label": "rationale"
            },
            {
              "data": "Review the Kubernetes conf files by using the command:\n\n    stat -c %U:%G /etc/kubernetes/admin.conf | grep -v root:root\n    stat -c %U:%G /etc/kubernetes/scheduler.conf | grep -v root:root\n    stat -c %U:%G /etc/kubernetes/controller-manager.conf | grep -v root:root\n\n    If the command returns any non root:root file permissions, this is a\nfinding.",
              "label": "check"
            },
            {
              "data": "Change the ownership of the conf files to root: root by executing the\ncommand:\n\n    chown root:root /etc/kubernetes/admin.conf\n    chown root:root /etc/kubernetes/scheduler.conf\n    chown root:root /etc/kubernetes/controller-manager.conf",
              "label": "fix"
            }
          ],
          "id": "V-242446",
          "impact": 0.5,
          "refs": [],
          "results": [
            {
              "code_desc": "File /var/lib/rancher/k3s/server/cred/admin.kubeconfig is expected to be owned by \"root\"",
              "resource_class": "file",
              "resource_params": "[\"/var/lib/rancher/k3s/server/cred/admin.kubeconfig\"]",
              "run_time": 0.005087449,
              "start_time": "2021-06-21T21:25:33-04:00",
              "status": "passed"
            },
            {
              "code_desc": "File /var/lib/rancher/k3s/server/cred/admin.kubeconfig is expected to be grouped into \"root\"",
              "resource_class": "file",
              "resource_params": "[\"/var/lib/rancher/k3s/server/cred/admin.kubeconfig\"]",
              "run_time": 0.005072231,
              "start_time": "2021-06-21T21:25:33-04:00",
              "status": "passed"
            },
            {
              "code_desc": "File /var/lib/rancher/k3s/server/cred/scheduler.kubeconfig is expected to be owned by \"root\"",
              "resource_class": "file",
              "resource_params": "[\"/var/lib/rancher/k3s/server/cred/scheduler.kubeconfig\"]",
              "run_time": 0.005016781,
              "start_time": "2021-06-21T21:25:33-04:00",
              "status": "passed"
            },
            {
              "code_desc": "File /var/lib/rancher/k3s/server/cred/scheduler.kubeconfig is expected to be grouped into \"root\"",
              "resource_class": "file",
              "resource_params": "[\"/var/lib/rancher/k3s/server/cred/scheduler.kubeconfig\"]",
              "run_time": 0.004955165,
              "start_time": "2021-06-21T21:25:33-04:00",
              "status": "passed"
            },
            {
              "code_desc": "File /var/lib/rancher/k3s/server/cred/controller.kubeconfig is expected to be owned by \"root\"",
              "resource_class": "file",
              "resource_params": "[\"/var/lib/rancher/k3s/server/cred/controller.kubeconfig\"]",
              "run_time": 0.005012497,
              "start_time": "2021-06-21T21:25:33-04:00",
              "status": "passed"
            },
            {
              "code_desc": "File /var/lib/rancher/k3s/server/cred/controller.kubeconfig is expected to be grouped into \"root\"",
              "resource_class": "file",
              "resource_params": "[\"/var/lib/rancher/k3s/server/cred/controller.kubeconfig\"]",
              "run_time": 0.004974285,
              "start_time": "2021-06-21T21:25:33-04:00",
              "status": "passed"
            }
          ],
          "source_location": {
            "line": 3,
            "ref": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242446.rb"
          },
          "tags": {
            "cci": ["CCI-000366"],
            "fix_id": "F-45679r712693_fix",
            "gid": "V-242446",
            "gtitle": "SRG-APP-000516-CTR-001325",
            "nist": ["CM-6 b"],
            "rid": "SV-242446r712694_rule",
            "severity": "medium",
            "stig_id": "CNTR-K8-003130"
          },
          "title": "The Kubernetes conf files must be owned by root.",
          "waiver_data": {}
        },
        {
          "code": "control 'V-242447' do\n  title \"The Kubernetes Kube Proxy must have file permissions set to 644 or\nmore restrictive.\"\n  desc  \"The Kubernetes kube proxy kubeconfig contain the argument and setting\nfor the Master Nodes. These settings contain network rules for restricting\nnetwork communication between pods, clusters, and networks. If these files can\nbe changed, data traversing between the Kubernetes Control Panel components\nwould be compromised. Many of the security settings within the document are\nimplemented through this file.\"\n  desc  'rationale', ''\n  desc  'check', \"\n    Check if Kube-Proxy is running and obtain --kubeconfig parameter use the\nfollowing command:\n    ps -ef | grep kube-proxy\n\n    If Kube-Proxy exists:\n    Review the permissions of the Kubernetes Kube Proxy by using the command:\n    stat -c %a <location from --kubeconfig>\n\n    If the file has permissions more permissive than \\\"644\\\", this is a finding.\n  \"\n  desc 'fix', \"\n    Change the permissions of the Kube Proxy to \\\"644\\\" by executing the\ncommand:\n\n    chown 644 <location from kubeconfig>.\n  \"\n  impact 0.5\n  tag severity: 'medium'\n  tag gtitle: 'SRG-APP-000516-CTR-001325'\n  tag gid: 'V-242447'\n  tag rid: 'SV-242447r712697_rule'\n  tag stig_id: 'CNTR-K8-003140'\n  tag fix_id: 'F-45680r712696_fix'\n  tag cci: ['CCI-000366']\n  tag nist: ['CM-6 b']\n\n  unless kube_proxy.exist?\n    impact 0.0\n    desc 'caveat', 'Kube-Proxy process is not running on the target.'\n  end\n\n  describe kube_proxy do\n    its('kubeconfig_file') { should_not be_nil }\n    its('kubeconfig_file') { should_not be_more_permissive_than('0644') }\n  end\nend\n",
          "desc": "The Kubernetes kube proxy kubeconfig contain the argument and setting\nfor the Master Nodes. These settings contain network rules for restricting\nnetwork communication between pods, clusters, and networks. If these files can\nbe changed, data traversing between the Kubernetes Control Panel components\nwould be compromised. Many of the security settings within the document are\nimplemented through this file.",
          "descriptions": [
            {
              "data": "The Kubernetes kube proxy kubeconfig contain the argument and setting\nfor the Master Nodes. These settings contain network rules for restricting\nnetwork communication between pods, clusters, and networks. If these files can\nbe changed, data traversing between the Kubernetes Control Panel components\nwould be compromised. Many of the security settings within the document are\nimplemented through this file.",
              "label": "default"
            },
            {
              "data": "",
              "label": "rationale"
            },
            {
              "data": "Check if Kube-Proxy is running and obtain --kubeconfig parameter use the\nfollowing command:\n    ps -ef | grep kube-proxy\n\n    If Kube-Proxy exists:\n    Review the permissions of the Kubernetes Kube Proxy by using the command:\n    stat -c %a <location from --kubeconfig>\n\n    If the file has permissions more permissive than \"644\", this is a finding.",
              "label": "check"
            },
            {
              "data": "Change the permissions of the Kube Proxy to \"644\" by executing the\ncommand:\n\n    chown 644 <location from kubeconfig>.",
              "label": "fix"
            }
          ],
          "id": "V-242447",
          "impact": 0.5,
          "refs": [],
          "results": [
            {
              "code_desc": "Process arguments for k3s kubeconfig_file is expected not to be nil",
              "resource_class": "kube_proxy",
              "resource_params": "[]",
              "run_time": 0.007884368,
              "start_time": "2021-06-21T21:25:33-04:00",
              "status": "passed"
            },
            {
              "code_desc": "Process arguments for k3s kubeconfig_file is expected not to be more permissive than \"0644\"",
              "resource_class": "kube_proxy",
              "resource_params": "[]",
              "run_time": 0.224646535,
              "start_time": "2021-06-21T21:25:33-04:00",
              "status": "passed"
            }
          ],
          "source_location": {
            "line": 3,
            "ref": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242447.rb"
          },
          "tags": {
            "cci": ["CCI-000366"],
            "fix_id": "F-45680r712696_fix",
            "gid": "V-242447",
            "gtitle": "SRG-APP-000516-CTR-001325",
            "nist": ["CM-6 b"],
            "rid": "SV-242447r712697_rule",
            "severity": "medium",
            "stig_id": "CNTR-K8-003140"
          },
          "title": "The Kubernetes Kube Proxy must have file permissions set to 644 or\nmore restrictive.",
          "waiver_data": {}
        },
        {
          "code": "control 'V-242448' do\n  title 'The Kubernetes Kube Proxy must be owned by root.'\n  desc  \"The Kubernetes kube proxy kubeconfig contain the argument and setting\nfor the Master Nodes. These settings contain network rules for restricting\nnetwork communication between pods, clusters, and networks. If these files can\nbe changed, data traversing between the Kubernetes Control Panel components\nwould be compromised. Many of the security settings within the document are\nimplemented through this file.\"\n  desc  'rationale', ''\n  desc  'check', \"\n    Check if Kube-Proxy is running use the following command:\n    ps -ef | grep kube-proxy\n\n    If Kube-Proxy exists:\n    Review the permissions of the Kubernetes Kube Proxy by using the command:\n    stat -c   %U:%G <location from --kubeconfig>| grep -v root:root\n\n    If the command returns any non root:root file permissions, this is a\nfinding.\n  \"\n  desc 'fix', \"\n    Change the ownership of the Kube Proxy to root:root by executing the\ncommand:\n\n    chown root:root <location from kubeconfig>.\n  \"\n  impact 0.5\n  tag severity: 'medium'\n  tag gtitle: 'SRG-APP-000516-CTR-001325'\n  tag gid: 'V-242448'\n  tag rid: 'SV-242448r712700_rule'\n  tag stig_id: 'CNTR-K8-003150'\n  tag fix_id: 'F-45681r712699_fix'\n  tag cci: ['CCI-000366']\n  tag nist: ['CM-6 b']\n\n  unless kube_proxy.exist?\n    impact 0.0\n    desc 'caveat', 'Kube-Proxy process is not running on the target.'\n  end\n\n  describe kube_proxy do\n    its('kubeconfig_file') { should_not be_nil }\n    its('kubeconfig_file') { should be_owned_by('root') }\n    its('kubeconfig_file') { should be_grouped_into('root') }\n  end\nend\n",
          "desc": "The Kubernetes kube proxy kubeconfig contain the argument and setting\nfor the Master Nodes. These settings contain network rules for restricting\nnetwork communication between pods, clusters, and networks. If these files can\nbe changed, data traversing between the Kubernetes Control Panel components\nwould be compromised. Many of the security settings within the document are\nimplemented through this file.",
          "descriptions": [
            {
              "data": "The Kubernetes kube proxy kubeconfig contain the argument and setting\nfor the Master Nodes. These settings contain network rules for restricting\nnetwork communication between pods, clusters, and networks. If these files can\nbe changed, data traversing between the Kubernetes Control Panel components\nwould be compromised. Many of the security settings within the document are\nimplemented through this file.",
              "label": "default"
            },
            {
              "data": "",
              "label": "rationale"
            },
            {
              "data": "Check if Kube-Proxy is running use the following command:\n    ps -ef | grep kube-proxy\n\n    If Kube-Proxy exists:\n    Review the permissions of the Kubernetes Kube Proxy by using the command:\n    stat -c   %U:%G <location from --kubeconfig>| grep -v root:root\n\n    If the command returns any non root:root file permissions, this is a\nfinding.",
              "label": "check"
            },
            {
              "data": "Change the ownership of the Kube Proxy to root:root by executing the\ncommand:\n\n    chown root:root <location from kubeconfig>.",
              "label": "fix"
            }
          ],
          "id": "V-242448",
          "impact": 0.5,
          "refs": [],
          "results": [
            {
              "code_desc": "Process arguments for k3s kubeconfig_file is expected not to be nil",
              "resource_class": "kube_proxy",
              "resource_params": "[]",
              "run_time": 0.008077277,
              "start_time": "2021-06-21T21:25:32-04:00",
              "status": "passed"
            },
            {
              "code_desc": "Process arguments for k3s kubeconfig_file is expected to be owned by \"root\"",
              "resource_class": "kube_proxy",
              "resource_params": "[]",
              "run_time": 0.228566389,
              "start_time": "2021-06-21T21:25:32-04:00",
              "status": "passed"
            },
            {
              "code_desc": "Process arguments for k3s kubeconfig_file is expected to be grouped into \"root\"",
              "resource_class": "kube_proxy",
              "resource_params": "[]",
              "run_time": 0.005499344,
              "start_time": "2021-06-21T21:25:33-04:00",
              "status": "passed"
            }
          ],
          "source_location": {
            "line": 3,
            "ref": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242448.rb"
          },
          "tags": {
            "cci": ["CCI-000366"],
            "fix_id": "F-45681r712699_fix",
            "gid": "V-242448",
            "gtitle": "SRG-APP-000516-CTR-001325",
            "nist": ["CM-6 b"],
            "rid": "SV-242448r712700_rule",
            "severity": "medium",
            "stig_id": "CNTR-K8-003150"
          },
          "title": "The Kubernetes Kube Proxy must be owned by root.",
          "waiver_data": {}
        },
        {
          "code": "control 'V-242449' do\n  title \"The Kubernetes Kubelet certificate authority file must have file\npermissions set to 644 or more restrictive.\"\n  desc  \"The Kubernetes kubelet certificate authority file contains settings\nfor the Kubernetes Node TLS certificate authority. Any request presenting a\nclient certificate signed by one of the authorities in the client-ca-file is\nauthenticated with an identity corresponding to the CommonName of the client\ncertificate. If this file can be changed, the Kubernetes architecture could be\ncompromised. The scheduler will implement the changes immediately. Many of the\nsecurity settings within the document are implemented through this file.\"\n  desc  'rationale', ''\n  desc  'check', \"\n    Change to the /etc/sysconfig/ directory on the Kubernetes Master Node. Run\ncommand:\n\n    more kubelet\n    --client-ca-file argument\n    Note certificate location\n\n    If the ca-file argument location file has permissions more permissive than\n\\\"644\\\", this is a finding.\n  \"\n  desc 'fix', \"\n    Change the permissions of the --client-ca-file to \\\"644\\\" by executing the\ncommand:\n\n    chown 644 <kubelet --client--ca-file argument location>.\n  \"\n  impact 0.5\n  tag severity: 'medium'\n  tag gtitle: 'SRG-APP-000516-CTR-001325'\n  tag gid: 'V-242449'\n  tag rid: 'SV-242449r712703_rule'\n  tag stig_id: 'CNTR-K8-003160'\n  tag fix_id: 'F-45682r712702_fix'\n  tag cci: ['CCI-000366']\n  tag nist: ['CM-6 b']\n\n  describe.one do\n    describe kubelet do\n      its('client_ca_file') { should_not be_nil }\n      its('client_ca_file') { should_not be_more_permissive_than('0644') }\n    end\n\n    client_ca_file = kubelet_config_file.params.dig('authentication', 'x509', 'clientCAFile')\n    if client_ca_file\n      describe file(client_ca_file) do\n        it { should_not be_more_permissive_than('0644') }\n      end\n    end\n  end\nend\n",
          "desc": "The Kubernetes kubelet certificate authority file contains settings\nfor the Kubernetes Node TLS certificate authority. Any request presenting a\nclient certificate signed by one of the authorities in the client-ca-file is\nauthenticated with an identity corresponding to the CommonName of the client\ncertificate. If this file can be changed, the Kubernetes architecture could be\ncompromised. The scheduler will implement the changes immediately. Many of the\nsecurity settings within the document are implemented through this file.",
          "descriptions": [
            {
              "data": "The Kubernetes kubelet certificate authority file contains settings\nfor the Kubernetes Node TLS certificate authority. Any request presenting a\nclient certificate signed by one of the authorities in the client-ca-file is\nauthenticated with an identity corresponding to the CommonName of the client\ncertificate. If this file can be changed, the Kubernetes architecture could be\ncompromised. The scheduler will implement the changes immediately. Many of the\nsecurity settings within the document are implemented through this file.",
              "label": "default"
            },
            {
              "data": "",
              "label": "rationale"
            },
            {
              "data": "Change to the /etc/sysconfig/ directory on the Kubernetes Master Node. Run\ncommand:\n\n    more kubelet\n    --client-ca-file argument\n    Note certificate location\n\n    If the ca-file argument location file has permissions more permissive than\n\"644\", this is a finding.",
              "label": "check"
            },
            {
              "data": "Change the permissions of the --client-ca-file to \"644\" by executing the\ncommand:\n\n    chown 644 <kubelet --client--ca-file argument location>.",
              "label": "fix"
            }
          ],
          "id": "V-242449",
          "impact": 0.5,
          "refs": [],
          "results": [
            {
              "code_desc": "Process arguments for k3s client_ca_file is expected not to be nil",
              "resource_class": "kubelet",
              "resource_params": "[]",
              "run_time": 0.000146969,
              "start_time": "2021-06-21T21:25:32-04:00",
              "status": "passed"
            },
            {
              "code_desc": "Process arguments for k3s client_ca_file is expected not to be more permissive than \"0644\"",
              "resource_class": "kubelet",
              "resource_params": "[]",
              "run_time": 0.000194292,
              "start_time": "2021-06-21T21:25:32-04:00",
              "status": "passed"
            }
          ],
          "source_location": {
            "line": 3,
            "ref": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242449.rb"
          },
          "tags": {
            "cci": ["CCI-000366"],
            "fix_id": "F-45682r712702_fix",
            "gid": "V-242449",
            "gtitle": "SRG-APP-000516-CTR-001325",
            "nist": ["CM-6 b"],
            "rid": "SV-242449r712703_rule",
            "severity": "medium",
            "stig_id": "CNTR-K8-003160"
          },
          "title": "The Kubernetes Kubelet certificate authority file must have file\npermissions set to 644 or more restrictive.",
          "waiver_data": {}
        },
        {
          "code": "control 'V-242450' do\n  title 'The Kubernetes Kubelet certificate authority must be owned by root.'\n  desc  \"The Kubernetes kubelet certificate authority file contains settings\nfor the Kubernetes Node TLS certificate authority. Any request presenting a\nclient certificate signed by one of the authorities in the client-ca-file is\nauthenticated with an identity corresponding to the CommonName of the client\ncertificate. If this file can be changed, the Kubernetes architecture could\nbe compromised. The scheduler will implement the changes immediately. Many of\nthe security settings within the document are implemented through this file.\"\n  desc  'rationale', ''\n  desc  'check', \"\n    Change to the /etc/sysconfig/ directory on the Kubernetes Master Node.\nReview the ownership of the Kubernetes  client-ca-file by using the command:\n\nmore kubelet\n--client-ca-file argument\nNote certificate location\n\nReview the ownership of the Kubernetes client-ca-file by using the command:\nstat -c   %U:%G <location from --client-ca-file argument>| grep -v root:root\n\nIf the command returns any non root:root file permissions, this is a finding.\n\"\n  desc 'fix', \"\n    Change the permissions of the --client-ca-file to \\\"root\\\" by executing\nthe command:\n\nchown root:root <location from --client-ca-file argument>/ *\n  \"\n  impact 0.5\n  tag severity: 'medium'\n  tag gtitle: 'SRG-APP-000516-CTR-001325'\n  tag gid: 'V-242450'\n  tag rid: 'SV-242450r712706_rule'\n  tag stig_id: 'CNTR-K8-003170'\n  tag fix_id: 'F-45683r712705_fix'\n  tag cci: ['CCI-000366']\n  tag nist: ['CM-6 b']\n\n  describe.one do\n    describe kubelet do\n      its('client_ca_file') { should_not be_nil }\n      its('client_ca_file') { should be_owned_by('root') }\n      its('client_ca_file') { should be_grouped_into('root') }\n    end\n\n    client_ca_file = kubelet_config_file.params.dig('authentication', 'x509', 'clientCAFile')\n    if client_ca_file\n      describe file(client_ca_file) do\n        it { should be_owned_by('root') }\n        it { should be_grouped_into('root') }\n      end\n    end\n  end\nend\n",
          "desc": "The Kubernetes kubelet certificate authority file contains settings\nfor the Kubernetes Node TLS certificate authority. Any request presenting a\nclient certificate signed by one of the authorities in the client-ca-file is\nauthenticated with an identity corresponding to the CommonName of the client\ncertificate. If this file can be changed, the Kubernetes architecture could\nbe compromised. The scheduler will implement the changes immediately. Many of\nthe security settings within the document are implemented through this file.",
          "descriptions": [
            {
              "data": "The Kubernetes kubelet certificate authority file contains settings\nfor the Kubernetes Node TLS certificate authority. Any request presenting a\nclient certificate signed by one of the authorities in the client-ca-file is\nauthenticated with an identity corresponding to the CommonName of the client\ncertificate. If this file can be changed, the Kubernetes architecture could\nbe compromised. The scheduler will implement the changes immediately. Many of\nthe security settings within the document are implemented through this file.",
              "label": "default"
            },
            {
              "data": "",
              "label": "rationale"
            },
            {
              "data": "Change to the /etc/sysconfig/ directory on the Kubernetes Master Node.\nReview the ownership of the Kubernetes  client-ca-file by using the command:\n\nmore kubelet\n--client-ca-file argument\nNote certificate location\n\nReview the ownership of the Kubernetes client-ca-file by using the command:\nstat -c   %U:%G <location from --client-ca-file argument>| grep -v root:root\n\nIf the command returns any non root:root file permissions, this is a finding.",
              "label": "check"
            },
            {
              "data": "Change the permissions of the --client-ca-file to \"root\" by executing\nthe command:\n\nchown root:root <location from --client-ca-file argument>/ *",
              "label": "fix"
            }
          ],
          "id": "V-242450",
          "impact": 0.5,
          "refs": [],
          "results": [
            {
              "code_desc": "Process arguments for k3s client_ca_file is expected not to be nil",
              "resource_class": "kubelet",
              "resource_params": "[]",
              "run_time": 0.000213995,
              "start_time": "2021-06-21T21:25:32-04:00",
              "status": "passed"
            },
            {
              "code_desc": "Process arguments for k3s client_ca_file is expected to be owned by \"root\"",
              "resource_class": "kubelet",
              "resource_params": "[]",
              "run_time": 0.000193324,
              "start_time": "2021-06-21T21:25:32-04:00",
              "status": "passed"
            },
            {
              "code_desc": "Process arguments for k3s client_ca_file is expected to be grouped into \"root\"",
              "resource_class": "kubelet",
              "resource_params": "[]",
              "run_time": 0.000232432,
              "start_time": "2021-06-21T21:25:32-04:00",
              "status": "passed"
            }
          ],
          "source_location": {
            "line": 3,
            "ref": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242450.rb"
          },
          "tags": {
            "cci": ["CCI-000366"],
            "fix_id": "F-45683r712705_fix",
            "gid": "V-242450",
            "gtitle": "SRG-APP-000516-CTR-001325",
            "nist": ["CM-6 b"],
            "rid": "SV-242450r712706_rule",
            "severity": "medium",
            "stig_id": "CNTR-K8-003170"
          },
          "title": "The Kubernetes Kubelet certificate authority must be owned by root.",
          "waiver_data": {}
        },
        {
          "code": "control 'V-242451' do\n  title 'The Kubernetes component PKI must be owned by root.'\n  desc  \"The Kubernetes PKI directory contains all certificates (.crt files)\nsupporting secure network communications in the Kubernetes Control Plane. If\nthese files can be modified, data traversing within the architecture components\nwould become unsecure and compromised. Many of the security settings within the\ndocument are implemented through this file.\"\n  desc  'rationale', ''\n  desc  'check', \"\n    Review the PKI files in Kubernetes by using the command:\n\n    ls -laR /etc/kubernetes/pki/\n\n    If the command returns any non root:root file permissions, this is a\nfinding.\n  \"\n  desc 'fix', \"\n    Change the ownership of the PKI to root: root by executing the command:\n\n    chown -R root:root /etc/kubernetes/pki/\n  \"\n  impact 0.5\n  tag severity: 'medium'\n  tag gtitle: 'SRG-APP-000516-CTR-001325'\n  tag gid: 'V-242451'\n  tag rid: 'SV-242451r712709_rule'\n  tag stig_id: 'CNTR-K8-003180'\n  tag fix_id: 'F-45684r712708_fix'\n  tag cci: ['CCI-000366']\n  tag nist: ['CM-6 b']\n\n  pki_path = input('pki_path')\n  pki_files = command(\"find #{pki_path}/ -type f\").stdout.split\n\n  if pki_files.empty?\n    desc 'caveat', \"Kubernetes PKI files not present of the target at specified path #{pki_path}.\"\n\n    describe \"Kubernetes PKI files not present of the target at specified path #{pki_path}.\" do\n      skip\n    end\n  end\n\n  pki_files.each do |file_name|\n    describe file(file_name) do\n      it { should be_owned_by('root') }\n      it { should be_grouped_into('root') }\n    end\n  end\nend\n",
          "desc": "The Kubernetes PKI directory contains all certificates (.crt files)\nsupporting secure network communications in the Kubernetes Control Plane. If\nthese files can be modified, data traversing within the architecture components\nwould become unsecure and compromised. Many of the security settings within the\ndocument are implemented through this file.",
          "descriptions": [
            {
              "data": "The Kubernetes PKI directory contains all certificates (.crt files)\nsupporting secure network communications in the Kubernetes Control Plane. If\nthese files can be modified, data traversing within the architecture components\nwould become unsecure and compromised. Many of the security settings within the\ndocument are implemented through this file.",
              "label": "default"
            },
            {
              "data": "",
              "label": "rationale"
            },
            {
              "data": "Review the PKI files in Kubernetes by using the command:\n\n    ls -laR /etc/kubernetes/pki/\n\n    If the command returns any non root:root file permissions, this is a\nfinding.",
              "label": "check"
            },
            {
              "data": "Change the ownership of the PKI to root: root by executing the command:\n\nchown -R root:root /etc/kubernetes/pki/",
              "label": "fix"
            }
          ],
          "id": "V-242451",
          "impact": 0.5,
          "refs": [],
          "results": [
            {
              "code_desc": "File /var/lib/rancher/k3s/server/tls//serving-kube-apiserver.crt is expected to be owned by \"root\"",
              "resource_class": "file",
              "resource_params": "[\"/var/lib/rancher/k3s/server/tls//serving-kube-apiserver.crt\"]",
              "run_time": 0.005187314,
              "start_time": "2021-06-21T21:25:32-04:00",
              "status": "passed"
            },
            {
              "code_desc": "File /var/lib/rancher/k3s/server/tls//serving-kube-apiserver.crt is expected to be grouped into \"root\"",
              "resource_class": "file",
              "resource_params": "[\"/var/lib/rancher/k3s/server/tls//serving-kube-apiserver.crt\"]",
              "run_time": 0.004960551,
              "start_time": "2021-06-21T21:25:32-04:00",
              "status": "passed"
            },
            {
              "code_desc": "File /var/lib/rancher/k3s/server/tls//client-kube-apiserver.key is expected to be owned by \"root\"",
              "resource_class": "file",
              "resource_params": "[\"/var/lib/rancher/k3s/server/tls//client-kube-apiserver.key\"]",
              "run_time": 0.005006877,
              "start_time": "2021-06-21T21:25:32-04:00",
              "status": "passed"
            },
            {
              "code_desc": "File /var/lib/rancher/k3s/server/tls//client-kube-apiserver.key is expected to be grouped into \"root\"",
              "resource_class": "file",
              "resource_params": "[\"/var/lib/rancher/k3s/server/tls//client-kube-apiserver.key\"]",
              "run_time": 0.004978097,
              "start_time": "2021-06-21T21:25:32-04:00",
              "status": "passed"
            },
            {
              "code_desc": "File /var/lib/rancher/k3s/server/tls//client-cloud-controller.key is expected to be owned by \"root\"",
              "resource_class": "file",
              "resource_params": "[\"/var/lib/rancher/k3s/server/tls//client-cloud-controller.key\"]",
              "run_time": 0.004947044,
              "start_time": "2021-06-21T21:25:32-04:00",
              "status": "passed"
            },
            {
              "code_desc": "File /var/lib/rancher/k3s/server/tls//client-cloud-controller.key is expected to be grouped into \"root\"",
              "resource_class": "file",
              "resource_params": "[\"/var/lib/rancher/k3s/server/tls//client-cloud-controller.key\"]",
              "run_time": 0.004896479,
              "start_time": "2021-06-21T21:25:32-04:00",
              "status": "passed"
            },
            {
              "code_desc": "File /var/lib/rancher/k3s/server/tls//client-kube-apiserver.crt is expected to be owned by \"root\"",
              "resource_class": "file",
              "resource_params": "[\"/var/lib/rancher/k3s/server/tls//client-kube-apiserver.crt\"]",
              "run_time": 0.004839543,
              "start_time": "2021-06-21T21:25:32-04:00",
              "status": "passed"
            },
            {
              "code_desc": "File /var/lib/rancher/k3s/server/tls//client-kube-apiserver.crt is expected to be grouped into \"root\"",
              "resource_class": "file",
              "resource_params": "[\"/var/lib/rancher/k3s/server/tls//client-kube-apiserver.crt\"]",
              "run_time": 0.004930016,
              "start_time": "2021-06-21T21:25:32-04:00",
              "status": "passed"
            },
            {
              "code_desc": "File /var/lib/rancher/k3s/server/tls//client-admin.crt is expected to be owned by \"root\"",
              "resource_class": "file",
              "resource_params": "[\"/var/lib/rancher/k3s/server/tls//client-admin.crt\"]",
              "run_time": 0.004832312,
              "start_time": "2021-06-21T21:25:32-04:00",
              "status": "passed"
            },
            {
              "code_desc": "File /var/lib/rancher/k3s/server/tls//client-admin.crt is expected to be grouped into \"root\"",
              "resource_class": "file",
              "resource_params": "[\"/var/lib/rancher/k3s/server/tls//client-admin.crt\"]",
              "run_time": 0.004917724,
              "start_time": "2021-06-21T21:25:32-04:00",
              "status": "passed"
            },
            {
              "code_desc": "File /var/lib/rancher/k3s/server/tls//client-admin.key is expected to be owned by \"root\"",
              "resource_class": "file",
              "resource_params": "[\"/var/lib/rancher/k3s/server/tls//client-admin.key\"]",
              "run_time": 0.004792904,
              "start_time": "2021-06-21T21:25:32-04:00",
              "status": "passed"
            },
            {
              "code_desc": "File /var/lib/rancher/k3s/server/tls//client-admin.key is expected to be grouped into \"root\"",
              "resource_class": "file",
              "resource_params": "[\"/var/lib/rancher/k3s/server/tls//client-admin.key\"]",
              "run_time": 0.004920204,
              "start_time": "2021-06-21T21:25:32-04:00",
              "status": "passed"
            },
            {
              "code_desc": "File /var/lib/rancher/k3s/server/tls//server-ca.key is expected to be owned by \"root\"",
              "resource_class": "file",
              "resource_params": "[\"/var/lib/rancher/k3s/server/tls//server-ca.key\"]",
              "run_time": 0.004902814,
              "start_time": "2021-06-21T21:25:32-04:00",
              "status": "passed"
            },
            {
              "code_desc": "File /var/lib/rancher/k3s/server/tls//server-ca.key is expected to be grouped into \"root\"",
              "resource_class": "file",
              "resource_params": "[\"/var/lib/rancher/k3s/server/tls//server-ca.key\"]",
              "run_time": 0.004760292,
              "start_time": "2021-06-21T21:25:32-04:00",
              "status": "passed"
            },
            {
              "code_desc": "File /var/lib/rancher/k3s/server/tls//client-controller.key is expected to be owned by \"root\"",
              "resource_class": "file",
              "resource_params": "[\"/var/lib/rancher/k3s/server/tls//client-controller.key\"]",
              "run_time": 0.004744139,
              "start_time": "2021-06-21T21:25:32-04:00",
              "status": "passed"
            },
            {
              "code_desc": "File /var/lib/rancher/k3s/server/tls//client-controller.key is expected to be grouped into \"root\"",
              "resource_class": "file",
              "resource_params": "[\"/var/lib/rancher/k3s/server/tls//client-controller.key\"]",
              "run_time": 0.004791773,
              "start_time": "2021-06-21T21:25:32-04:00",
              "status": "passed"
            },
            {
              "code_desc": "File /var/lib/rancher/k3s/server/tls//request-header-ca.key is expected to be owned by \"root\"",
              "resource_class": "file",
              "resource_params": "[\"/var/lib/rancher/k3s/server/tls//request-header-ca.key\"]",
              "run_time": 0.00484522,
              "start_time": "2021-06-21T21:25:32-04:00",
              "status": "passed"
            },
            {
              "code_desc": "File /var/lib/rancher/k3s/server/tls//request-header-ca.key is expected to be grouped into \"root\"",
              "resource_class": "file",
              "resource_params": "[\"/var/lib/rancher/k3s/server/tls//request-header-ca.key\"]",
              "run_time": 0.004869331,
              "start_time": "2021-06-21T21:25:32-04:00",
              "status": "passed"
            },
            {
              "code_desc": "File /var/lib/rancher/k3s/server/tls//serving-kubelet.key is expected to be owned by \"root\"",
              "resource_class": "file",
              "resource_params": "[\"/var/lib/rancher/k3s/server/tls//serving-kubelet.key\"]",
              "run_time": 0.00485227,
              "start_time": "2021-06-21T21:25:32-04:00",
              "status": "passed"
            },
            {
              "code_desc": "File /var/lib/rancher/k3s/server/tls//serving-kubelet.key is expected to be grouped into \"root\"",
              "resource_class": "file",
              "resource_params": "[\"/var/lib/rancher/k3s/server/tls//serving-kubelet.key\"]",
              "run_time": 0.004928672,
              "start_time": "2021-06-21T21:25:32-04:00",
              "status": "passed"
            },
            {
              "code_desc": "File /var/lib/rancher/k3s/server/tls//client-k3s-controller.crt is expected to be owned by \"root\"",
              "resource_class": "file",
              "resource_params": "[\"/var/lib/rancher/k3s/server/tls//client-k3s-controller.crt\"]",
              "run_time": 0.00479545,
              "start_time": "2021-06-21T21:25:32-04:00",
              "status": "passed"
            },
            {
              "code_desc": "File /var/lib/rancher/k3s/server/tls//client-k3s-controller.crt is expected to be grouped into \"root\"",
              "resource_class": "file",
              "resource_params": "[\"/var/lib/rancher/k3s/server/tls//client-k3s-controller.crt\"]",
              "run_time": 0.00493522,
              "start_time": "2021-06-21T21:25:32-04:00",
              "status": "passed"
            },
            {
              "code_desc": "File /var/lib/rancher/k3s/server/tls//request-header-ca.crt is expected to be owned by \"root\"",
              "resource_class": "file",
              "resource_params": "[\"/var/lib/rancher/k3s/server/tls//request-header-ca.crt\"]",
              "run_time": 0.004889841,
              "start_time": "2021-06-21T21:25:32-04:00",
              "status": "passed"
            },
            {
              "code_desc": "File /var/lib/rancher/k3s/server/tls//request-header-ca.crt is expected to be grouped into \"root\"",
              "resource_class": "file",
              "resource_params": "[\"/var/lib/rancher/k3s/server/tls//request-header-ca.crt\"]",
              "run_time": 0.004723455,
              "start_time": "2021-06-21T21:25:32-04:00",
              "status": "passed"
            },
            {
              "code_desc": "File /var/lib/rancher/k3s/server/tls//client-scheduler.crt is expected to be owned by \"root\"",
              "resource_class": "file",
              "resource_params": "[\"/var/lib/rancher/k3s/server/tls//client-scheduler.crt\"]",
              "run_time": 0.004692129,
              "start_time": "2021-06-21T21:25:32-04:00",
              "status": "passed"
            },
            {
              "code_desc": "File /var/lib/rancher/k3s/server/tls//client-scheduler.crt is expected to be grouped into \"root\"",
              "resource_class": "file",
              "resource_params": "[\"/var/lib/rancher/k3s/server/tls//client-scheduler.crt\"]",
              "run_time": 0.004843733,
              "start_time": "2021-06-21T21:25:32-04:00",
              "status": "passed"
            },
            {
              "code_desc": "File /var/lib/rancher/k3s/server/tls//dynamic-cert.json is expected to be owned by \"root\"",
              "resource_class": "file",
              "resource_params": "[\"/var/lib/rancher/k3s/server/tls//dynamic-cert.json\"]",
              "run_time": 0.200979511,
              "start_time": "2021-06-21T21:25:32-04:00",
              "status": "passed"
            },
            {
              "code_desc": "File /var/lib/rancher/k3s/server/tls//dynamic-cert.json is expected to be grouped into \"root\"",
              "resource_class": "file",
              "resource_params": "[\"/var/lib/rancher/k3s/server/tls//dynamic-cert.json\"]",
              "run_time": 0.005211847,
              "start_time": "2021-06-21T21:25:32-04:00",
              "status": "passed"
            },
            {
              "code_desc": "File /var/lib/rancher/k3s/server/tls//client-auth-proxy.key is expected to be owned by \"root\"",
              "resource_class": "file",
              "resource_params": "[\"/var/lib/rancher/k3s/server/tls//client-auth-proxy.key\"]",
              "run_time": 0.004953911,
              "start_time": "2021-06-21T21:25:32-04:00",
              "status": "passed"
            },
            {
              "code_desc": "File /var/lib/rancher/k3s/server/tls//client-auth-proxy.key is expected to be grouped into \"root\"",
              "resource_class": "file",
              "resource_params": "[\"/var/lib/rancher/k3s/server/tls//client-auth-proxy.key\"]",
              "run_time": 0.00508737,
              "start_time": "2021-06-21T21:25:32-04:00",
              "status": "passed"
            },
            {
              "code_desc": "File /var/lib/rancher/k3s/server/tls//client-ca.key is expected to be owned by \"root\"",
              "resource_class": "file",
              "resource_params": "[\"/var/lib/rancher/k3s/server/tls//client-ca.key\"]",
              "run_time": 0.005005667,
              "start_time": "2021-06-21T21:25:32-04:00",
              "status": "passed"
            },
            {
              "code_desc": "File /var/lib/rancher/k3s/server/tls//client-ca.key is expected to be grouped into \"root\"",
              "resource_class": "file",
              "resource_params": "[\"/var/lib/rancher/k3s/server/tls//client-ca.key\"]",
              "run_time": 0.00488575,
              "start_time": "2021-06-21T21:25:32-04:00",
              "status": "passed"
            },
            {
              "code_desc": "File /var/lib/rancher/k3s/server/tls//serving-kube-apiserver.key is expected to be owned by \"root\"",
              "resource_class": "file",
              "resource_params": "[\"/var/lib/rancher/k3s/server/tls//serving-kube-apiserver.key\"]",
              "run_time": 0.004920429,
              "start_time": "2021-06-21T21:25:32-04:00",
              "status": "passed"
            },
            {
              "code_desc": "File /var/lib/rancher/k3s/server/tls//serving-kube-apiserver.key is expected to be grouped into \"root\"",
              "resource_class": "file",
              "resource_params": "[\"/var/lib/rancher/k3s/server/tls//serving-kube-apiserver.key\"]",
              "run_time": 0.0052532,
              "start_time": "2021-06-21T21:25:32-04:00",
              "status": "passed"
            },
            {
              "code_desc": "File /var/lib/rancher/k3s/server/tls//client-kube-proxy.crt is expected to be owned by \"root\"",
              "resource_class": "file",
              "resource_params": "[\"/var/lib/rancher/k3s/server/tls//client-kube-proxy.crt\"]",
              "run_time": 0.005068535,
              "start_time": "2021-06-21T21:25:32-04:00",
              "status": "passed"
            },
            {
              "code_desc": "File /var/lib/rancher/k3s/server/tls//client-kube-proxy.crt is expected to be grouped into \"root\"",
              "resource_class": "file",
              "resource_params": "[\"/var/lib/rancher/k3s/server/tls//client-kube-proxy.crt\"]",
              "run_time": 0.005072425,
              "start_time": "2021-06-21T21:25:32-04:00",
              "status": "passed"
            },
            {
              "code_desc": "File /var/lib/rancher/k3s/server/tls//service.key is expected to be owned by \"root\"",
              "resource_class": "file",
              "resource_params": "[\"/var/lib/rancher/k3s/server/tls//service.key\"]",
              "run_time": 0.005155357,
              "start_time": "2021-06-21T21:25:32-04:00",
              "status": "passed"
            },
            {
              "code_desc": "File /var/lib/rancher/k3s/server/tls//service.key is expected to be grouped into \"root\"",
              "resource_class": "file",
              "resource_params": "[\"/var/lib/rancher/k3s/server/tls//service.key\"]",
              "run_time": 0.004909738,
              "start_time": "2021-06-21T21:25:32-04:00",
              "status": "passed"
            },
            {
              "code_desc": "File /var/lib/rancher/k3s/server/tls//client-cloud-controller.crt is expected to be owned by \"root\"",
              "resource_class": "file",
              "resource_params": "[\"/var/lib/rancher/k3s/server/tls//client-cloud-controller.crt\"]",
              "run_time": 0.004712429,
              "start_time": "2021-06-21T21:25:32-04:00",
              "status": "passed"
            },
            {
              "code_desc": "File /var/lib/rancher/k3s/server/tls//client-cloud-controller.crt is expected to be grouped into \"root\"",
              "resource_class": "file",
              "resource_params": "[\"/var/lib/rancher/k3s/server/tls//client-cloud-controller.crt\"]",
              "run_time": 0.00474847,
              "start_time": "2021-06-21T21:25:32-04:00",
              "status": "passed"
            },
            {
              "code_desc": "File /var/lib/rancher/k3s/server/tls//client-ca.crt is expected to be owned by \"root\"",
              "resource_class": "file",
              "resource_params": "[\"/var/lib/rancher/k3s/server/tls//client-ca.crt\"]",
              "run_time": 0.004985535,
              "start_time": "2021-06-21T21:25:32-04:00",
              "status": "passed"
            },
            {
              "code_desc": "File /var/lib/rancher/k3s/server/tls//client-ca.crt is expected to be grouped into \"root\"",
              "resource_class": "file",
              "resource_params": "[\"/var/lib/rancher/k3s/server/tls//client-ca.crt\"]",
              "run_time": 0.005115801,
              "start_time": "2021-06-21T21:25:32-04:00",
              "status": "passed"
            },
            {
              "code_desc": "File /var/lib/rancher/k3s/server/tls//client-controller.crt is expected to be owned by \"root\"",
              "resource_class": "file",
              "resource_params": "[\"/var/lib/rancher/k3s/server/tls//client-controller.crt\"]",
              "run_time": 0.004927418,
              "start_time": "2021-06-21T21:25:32-04:00",
              "status": "passed"
            },
            {
              "code_desc": "File /var/lib/rancher/k3s/server/tls//client-controller.crt is expected to be grouped into \"root\"",
              "resource_class": "file",
              "resource_params": "[\"/var/lib/rancher/k3s/server/tls//client-controller.crt\"]",
              "run_time": 0.004829749,
              "start_time": "2021-06-21T21:25:32-04:00",
              "status": "passed"
            },
            {
              "code_desc": "File /var/lib/rancher/k3s/server/tls//client-auth-proxy.crt is expected to be owned by \"root\"",
              "resource_class": "file",
              "resource_params": "[\"/var/lib/rancher/k3s/server/tls//client-auth-proxy.crt\"]",
              "run_time": 0.004807106,
              "start_time": "2021-06-21T21:25:32-04:00",
              "status": "passed"
            },
            {
              "code_desc": "File /var/lib/rancher/k3s/server/tls//client-auth-proxy.crt is expected to be grouped into \"root\"",
              "resource_class": "file",
              "resource_params": "[\"/var/lib/rancher/k3s/server/tls//client-auth-proxy.crt\"]",
              "run_time": 0.004834745,
              "start_time": "2021-06-21T21:25:32-04:00",
              "status": "passed"
            },
            {
              "code_desc": "File /var/lib/rancher/k3s/server/tls//server-ca.crt is expected to be owned by \"root\"",
              "resource_class": "file",
              "resource_params": "[\"/var/lib/rancher/k3s/server/tls//server-ca.crt\"]",
              "run_time": 0.004937737,
              "start_time": "2021-06-21T21:25:32-04:00",
              "status": "passed"
            },
            {
              "code_desc": "File /var/lib/rancher/k3s/server/tls//server-ca.crt is expected to be grouped into \"root\"",
              "resource_class": "file",
              "resource_params": "[\"/var/lib/rancher/k3s/server/tls//server-ca.crt\"]",
              "run_time": 0.004845951,
              "start_time": "2021-06-21T21:25:32-04:00",
              "status": "passed"
            },
            {
              "code_desc": "File /var/lib/rancher/k3s/server/tls//temporary-certs/apiserver-loopback-client__.crt is expected to be owned by \"root\"",
              "resource_class": "file",
              "resource_params": "[\"/var/lib/rancher/k3s/server/tls//temporary-certs/apiserver-loopback-client__.crt\"]",
              "run_time": 0.004880212,
              "start_time": "2021-06-21T21:25:32-04:00",
              "status": "passed"
            },
            {
              "code_desc": "File /var/lib/rancher/k3s/server/tls//temporary-certs/apiserver-loopback-client__.crt is expected to be grouped into \"root\"",
              "resource_class": "file",
              "resource_params": "[\"/var/lib/rancher/k3s/server/tls//temporary-certs/apiserver-loopback-client__.crt\"]",
              "run_time": 0.005038013,
              "start_time": "2021-06-21T21:25:32-04:00",
              "status": "passed"
            },
            {
              "code_desc": "File /var/lib/rancher/k3s/server/tls//temporary-certs/apiserver-loopback-client__.key is expected to be owned by \"root\"",
              "resource_class": "file",
              "resource_params": "[\"/var/lib/rancher/k3s/server/tls//temporary-certs/apiserver-loopback-client__.key\"]",
              "run_time": 0.004782245,
              "start_time": "2021-06-21T21:25:32-04:00",
              "status": "passed"
            },
            {
              "code_desc": "File /var/lib/rancher/k3s/server/tls//temporary-certs/apiserver-loopback-client__.key is expected to be grouped into \"root\"",
              "resource_class": "file",
              "resource_params": "[\"/var/lib/rancher/k3s/server/tls//temporary-certs/apiserver-loopback-client__.key\"]",
              "run_time": 0.004807922,
              "start_time": "2021-06-21T21:25:32-04:00",
              "status": "passed"
            },
            {
              "code_desc": "File /var/lib/rancher/k3s/server/tls//client-k3s-controller.key is expected to be owned by \"root\"",
              "resource_class": "file",
              "resource_params": "[\"/var/lib/rancher/k3s/server/tls//client-k3s-controller.key\"]",
              "run_time": 0.004706571,
              "start_time": "2021-06-21T21:25:32-04:00",
              "status": "passed"
            },
            {
              "code_desc": "File /var/lib/rancher/k3s/server/tls//client-k3s-controller.key is expected to be grouped into \"root\"",
              "resource_class": "file",
              "resource_params": "[\"/var/lib/rancher/k3s/server/tls//client-k3s-controller.key\"]",
              "run_time": 0.004999895,
              "start_time": "2021-06-21T21:25:32-04:00",
              "status": "passed"
            },
            {
              "code_desc": "File /var/lib/rancher/k3s/server/tls//client-kube-proxy.key is expected to be owned by \"root\"",
              "resource_class": "file",
              "resource_params": "[\"/var/lib/rancher/k3s/server/tls//client-kube-proxy.key\"]",
              "run_time": 0.004638114,
              "start_time": "2021-06-21T21:25:32-04:00",
              "status": "passed"
            },
            {
              "code_desc": "File /var/lib/rancher/k3s/server/tls//client-kube-proxy.key is expected to be grouped into \"root\"",
              "resource_class": "file",
              "resource_params": "[\"/var/lib/rancher/k3s/server/tls//client-kube-proxy.key\"]",
              "run_time": 0.004893215,
              "start_time": "2021-06-21T21:25:32-04:00",
              "status": "passed"
            },
            {
              "code_desc": "File /var/lib/rancher/k3s/server/tls//client-kubelet.key is expected to be owned by \"root\"",
              "resource_class": "file",
              "resource_params": "[\"/var/lib/rancher/k3s/server/tls//client-kubelet.key\"]",
              "run_time": 0.00546614,
              "start_time": "2021-06-21T21:25:32-04:00",
              "status": "passed"
            },
            {
              "code_desc": "File /var/lib/rancher/k3s/server/tls//client-kubelet.key is expected to be grouped into \"root\"",
              "resource_class": "file",
              "resource_params": "[\"/var/lib/rancher/k3s/server/tls//client-kubelet.key\"]",
              "run_time": 0.00489272,
              "start_time": "2021-06-21T21:25:32-04:00",
              "status": "passed"
            },
            {
              "code_desc": "File /var/lib/rancher/k3s/server/tls//client-scheduler.key is expected to be owned by \"root\"",
              "resource_class": "file",
              "resource_params": "[\"/var/lib/rancher/k3s/server/tls//client-scheduler.key\"]",
              "run_time": 0.004825403,
              "start_time": "2021-06-21T21:25:32-04:00",
              "status": "passed"
            },
            {
              "code_desc": "File /var/lib/rancher/k3s/server/tls//client-scheduler.key is expected to be grouped into \"root\"",
              "resource_class": "file",
              "resource_params": "[\"/var/lib/rancher/k3s/server/tls//client-scheduler.key\"]",
              "run_time": 0.005011697,
              "start_time": "2021-06-21T21:25:32-04:00",
              "status": "passed"
            }
          ],
          "source_location": {
            "line": 3,
            "ref": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242451.rb"
          },
          "tags": {
            "cci": ["CCI-000366"],
            "fix_id": "F-45684r712708_fix",
            "gid": "V-242451",
            "gtitle": "SRG-APP-000516-CTR-001325",
            "nist": ["CM-6 b"],
            "rid": "SV-242451r712709_rule",
            "severity": "medium",
            "stig_id": "CNTR-K8-003180"
          },
          "title": "The Kubernetes component PKI must be owned by root.",
          "waiver_data": {}
        },
        {
          "code": "control 'V-242452' do\n  title \"The Kubernetes kubelet config must have file permissions set to 644 or\nmore restrictive.\"\n  desc  \"The Kubernetes kubelet agent registers nodes with the API Server,\nmounts volume storage for pods, and performs health checks to containers within\npods. If these files can be modified, the information system would be unaware\nof pod or container degradation. Many of the security settings within the\ndocument are implemented through this file.\"\n  desc  'rationale', ''\n  desc  'check', \"\n    Review the permissions of the Kubernetes Kubelet conf by using the command:\n\n    stat -c %a  /etc/kubernetes/kubelet.conf\n\n    If any of the files are have permissions more permissive than \\\"644\\\", this\nis a finding.\n  \"\n  desc 'fix', \"\n    Change the permissions of the Kubelet to \\\"644\\\" by executing the command:\n\n    chown 644 /etc/kubernetes/kubelet.conf\n  \"\n  impact 0.5\n  tag severity: 'medium'\n  tag gtitle: 'SRG-APP-000516-CTR-001325'\n  tag gid: 'V-242452'\n  tag rid: 'SV-242452r712712_rule'\n  tag stig_id: 'CNTR-K8-003190'\n  tag fix_id: 'F-45685r712711_fix'\n  tag cci: ['CCI-000366']\n  tag nist: ['CM-6 b']\n\n  describe kubelet do\n    its('kubeconfig_file') { should_not be_nil }\n    its('kubeconfig_file') { should_not be_more_permissive_than('0644') }\n  end\nend\n",
          "desc": "The Kubernetes kubelet agent registers nodes with the API Server,\nmounts volume storage for pods, and performs health checks to containers within\npods. If these files can be modified, the information system would be unaware\nof pod or container degradation. Many of the security settings within the\ndocument are implemented through this file.",
          "descriptions": [
            {
              "data": "The Kubernetes kubelet agent registers nodes with the API Server,\nmounts volume storage for pods, and performs health checks to containers within\npods. If these files can be modified, the information system would be unaware\nof pod or container degradation. Many of the security settings within the\ndocument are implemented through this file.",
              "label": "default"
            },
            {
              "data": "",
              "label": "rationale"
            },
            {
              "data": "Review the permissions of the Kubernetes Kubelet conf by using the command:\n\n    stat -c %a  /etc/kubernetes/kubelet.conf\n\n    If any of the files are have permissions more permissive than \"644\", this\nis a finding.",
              "label": "check"
            },
            {
              "data": "Change the permissions of the Kubelet to \"644\" by executing the command:\n\nchown 644 /etc/kubernetes/kubelet.conf",
              "label": "fix"
            }
          ],
          "id": "V-242452",
          "impact": 0.5,
          "refs": [],
          "results": [
            {
              "code_desc": "Process arguments for k3s kubeconfig_file is expected not to be nil",
              "resource_class": "kubelet",
              "resource_params": "[]",
              "run_time": 0.00839509,
              "start_time": "2021-06-21T21:25:31-04:00",
              "status": "passed"
            },
            {
              "code_desc": "Process arguments for k3s kubeconfig_file is expected not to be more permissive than \"0644\"",
              "resource_class": "kubelet",
              "resource_params": "[]",
              "run_time": 0.2684944,
              "start_time": "2021-06-21T21:25:31-04:00",
              "status": "passed"
            }
          ],
          "source_location": {
            "line": 3,
            "ref": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242452.rb"
          },
          "tags": {
            "cci": ["CCI-000366"],
            "fix_id": "F-45685r712711_fix",
            "gid": "V-242452",
            "gtitle": "SRG-APP-000516-CTR-001325",
            "nist": ["CM-6 b"],
            "rid": "SV-242452r712712_rule",
            "severity": "medium",
            "stig_id": "CNTR-K8-003190"
          },
          "title": "The Kubernetes kubelet config must have file permissions set to 644 or\nmore restrictive.",
          "waiver_data": {}
        },
        {
          "code": "control 'V-242453' do\n  title 'The Kubernetes kubelet config must be owned by root.'\n  desc  \"The Kubernetes kubelet agent registers nodes with the API server and\nperforms health checks to containers within pods. If these files can be\nmodified, the information system would be unaware of pod or container\ndegradation. Many of the security settings within the document are implemented\nthrough this file.\"\n  desc  'rationale', ''\n  desc  'check', \"\n    Review the Kubernetes Kubelet conf files by using the command:\n\n    stat -c %U:%G /etc/kubernetes/kubelet.conf| grep -v root:root\n\n    If the command returns any non root:root file permissions, this is a\nfinding.\n  \"\n  desc 'fix', \"\n    Change the ownership of the kubelet.conf to root: root by executing the\ncommand:\n\n    chown root:root /etc/kubernetes/kubelet.conf\n  \"\n  impact 0.5\n  tag severity: 'medium'\n  tag gtitle: 'SRG-APP-000516-CTR-001325'\n  tag gid: 'V-242453'\n  tag rid: 'SV-242453r712715_rule'\n  tag stig_id: 'CNTR-K8-003200'\n  tag fix_id: 'F-45686r712714_fix'\n  tag cci: ['CCI-000366']\n  tag nist: ['CM-6 b']\n\n  describe kubelet do\n    its('kubeconfig_file') { should_not be_nil }\n    its('kubeconfig_file') { should be_owned_by('root') }\n    its('kubeconfig_file') { should be_grouped_into('root') }\n  end\nend\n",
          "desc": "The Kubernetes kubelet agent registers nodes with the API server and\nperforms health checks to containers within pods. If these files can be\nmodified, the information system would be unaware of pod or container\ndegradation. Many of the security settings within the document are implemented\nthrough this file.",
          "descriptions": [
            {
              "data": "The Kubernetes kubelet agent registers nodes with the API server and\nperforms health checks to containers within pods. If these files can be\nmodified, the information system would be unaware of pod or container\ndegradation. Many of the security settings within the document are implemented\nthrough this file.",
              "label": "default"
            },
            {
              "data": "",
              "label": "rationale"
            },
            {
              "data": "Review the Kubernetes Kubelet conf files by using the command:\n\n    stat -c %U:%G /etc/kubernetes/kubelet.conf| grep -v root:root\n\n    If the command returns any non root:root file permissions, this is a\nfinding.",
              "label": "check"
            },
            {
              "data": "Change the ownership of the kubelet.conf to root: root by executing the\ncommand:\n\n    chown root:root /etc/kubernetes/kubelet.conf",
              "label": "fix"
            }
          ],
          "id": "V-242453",
          "impact": 0.5,
          "refs": [],
          "results": [
            {
              "code_desc": "Process arguments for k3s kubeconfig_file is expected not to be nil",
              "resource_class": "kubelet",
              "resource_params": "[]",
              "run_time": 0.007927276,
              "start_time": "2021-06-21T21:25:31-04:00",
              "status": "passed"
            },
            {
              "code_desc": "Process arguments for k3s kubeconfig_file is expected to be owned by \"root\"",
              "resource_class": "kubelet",
              "resource_params": "[]",
              "run_time": 0.240516902,
              "start_time": "2021-06-21T21:25:31-04:00",
              "status": "passed"
            },
            {
              "code_desc": "Process arguments for k3s kubeconfig_file is expected to be grouped into \"root\"",
              "resource_class": "kubelet",
              "resource_params": "[]",
              "run_time": 0.005386207,
              "start_time": "2021-06-21T21:25:31-04:00",
              "status": "passed"
            }
          ],
          "source_location": {
            "line": 3,
            "ref": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242453.rb"
          },
          "tags": {
            "cci": ["CCI-000366"],
            "fix_id": "F-45686r712714_fix",
            "gid": "V-242453",
            "gtitle": "SRG-APP-000516-CTR-001325",
            "nist": ["CM-6 b"],
            "rid": "SV-242453r712715_rule",
            "severity": "medium",
            "stig_id": "CNTR-K8-003200"
          },
          "title": "The Kubernetes kubelet config must be owned by root.",
          "waiver_data": {}
        },
        {
          "code": "control 'V-242454' do\n  title 'The Kubernetes kubeadm must be owned by root.'\n  desc  \"The Kubernetes kubeadm.conf contains sensitive information regarding\nthe cluster nodes configuration. If this file can be modified, the Kubernetes\nPlatform Plane would be degraded or compromised for malicious intent. Many of\nthe security settings within the document are implemented through this file.\"\n  desc  'rationale', ''\n  desc  'check', \"\n    Review the Kubeadm.conf file :\n\n    Get the path for Kubeadm.conf by running:\n\n    systemctl status kubelet\n\n  Note the configuration file installed by the kubeadm is written to\n\n  default Location: /etc/systemd/system/kubelet.service.d/10-kubeadm.conf\n\n    stat -c %U:%G <Kubeadm.conf path> | grep -v root:root\n\nIf the command returns any non root:root file permissions, this is a finding.\n  \"\n  desc 'fix', \"\n    Change the ownership of the kubeadm.conf to root: root by executing the\ncommand:\n\n    chown root:root <Kubeadm.conf path>\n  \"\n  impact 0.5\n  tag severity: 'medium'\n  tag gtitle: 'SRG-APP-000516-CTR-001325'\n  tag gid: 'V-242454'\n  tag rid: 'SV-242454r712718_rule'\n  tag stig_id: 'CNTR-K8-003210'\n  tag fix_id: 'F-45687r712717_fix'\n  tag cci: ['CCI-000366']\n  tag nist: ['CM-6 b']\n\n  kubeadm_conf_path = input('kubeadm_conf_path')\n\n  if file(kubeadm_conf_path).exist?\n    describe file(kubeadm_conf_path) do\n      it { should be_owned_by('root') }\n      it { should be_grouped_into('root') }\n    end\n  else\n    describe \"Kubeadm file #{kubeadm_conf_path} not found on target\" do\n      skip\n    end\n  end\nend\n",
          "desc": "The Kubernetes kubeadm.conf contains sensitive information regarding\nthe cluster nodes configuration. If this file can be modified, the Kubernetes\nPlatform Plane would be degraded or compromised for malicious intent. Many of\nthe security settings within the document are implemented through this file.",
          "descriptions": [
            {
              "data": "The Kubernetes kubeadm.conf contains sensitive information regarding\nthe cluster nodes configuration. If this file can be modified, the Kubernetes\nPlatform Plane would be degraded or compromised for malicious intent. Many of\nthe security settings within the document are implemented through this file.",
              "label": "default"
            },
            {
              "data": "",
              "label": "rationale"
            },
            {
              "data": "Review the Kubeadm.conf file :\n\n    Get the path for Kubeadm.conf by running:\n\n    systemctl status kubelet\n\n  Note the configuration file installed by the kubeadm is written to\n\n  default Location: /etc/systemd/system/kubelet.service.d/10-kubeadm.conf\n\n    stat -c %U:%G <Kubeadm.conf path> | grep -v root:root\n\nIf the command returns any non root:root file permissions, this is a finding.",
              "label": "check"
            },
            {
              "data": "Change the ownership of the kubeadm.conf to root: root by executing the\ncommand:\n\n    chown root:root <Kubeadm.conf path>",
              "label": "fix"
            },
            {
              "data": "K3S deployments are not configured through Kubeadm and hence non-applicable.",
              "label": "caveat"
            }
          ],
          "id": "V-242454",
          "impact": 0.0,
          "refs": [
            {
              "ref": []
            }
          ],
          "results": [
            {
              "code_desc": "Kubeadm file /etc/systemd/system/kubelet.service.d/10-kubeadm.conf not found on target ",
              "resource": "",
              "resource_class": "Object",
              "resource_params": "[]",
              "run_time": 6.723e-6,
              "skip_message": "",
              "start_time": "2021-06-21T21:25:31-04:00",
              "status": "skipped"
            }
          ],
          "source_location": {
            "line": 3,
            "ref": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242454.rb"
          },
          "tags": {
            "cci": ["CCI-000366"],
            "fix_id": "F-45687r712717_fix",
            "gid": "V-242454",
            "gtitle": "SRG-APP-000516-CTR-001325",
            "nist": ["CM-6 b"],
            "rid": "SV-242454r712718_rule",
            "severity": "medium",
            "stig_id": "CNTR-K8-003210"
          },
          "title": "The Kubernetes kubeadm must be owned by root.",
          "waiver_data": {}
        },
        {
          "code": "control 'V-242455' do\n  title \"The Kubernetes  kubeadm.conf must have file permissions set to 644\nor more restrictive.\"\n  desc  \"The Kubernetes kubeadm.conf contains sensitive information regarding\nthe cluster nodes configuration. If this file can be modified, the Kubernetes\nPlatform Plane would be degraded or compromised for malicious intent. Many of\nthe security settings within the document are implemented through this file.\"\n  desc  'rationale', ''\n  desc  'check', \"\n    Review the Kubeadm.conf file :\n\n    Get the path for Kubeadm.conf by running:\n\n    systemctl status kubelet\n\n  Note the configuration file installed by the kubeadm is written to\n\n  default Location: /etc/systemd/system/kubelet.service.d/10-kubeadm.conf\n\n    stat -c %a  <Kubeadm.conf path>\n\nIf the file has permissions more permissive than \\\"644\\\", this is a finding.\n  \"\n  desc 'fix', \"\n    Change the permissions of kubeadm.conf to \\\"644\\\" by executing the command:\n\n    chown 644 <Kubeadm.conf path>\n  \"\n  impact 0.5\n  tag severity: 'medium'\n  tag gtitle: 'SRG-APP-000516-CTR-001325'\n  tag gid: 'V-242455'\n  tag rid: 'SV-242455r712721_rule'\n  tag stig_id: 'CNTR-K8-003220'\n  tag fix_id: 'F-45688r712720_fix'\n  tag cci: ['CCI-000366']\n  tag nist: ['CM-6 b']\n\n  kubeadm_conf_path = input('kubeadm_conf_path')\n\n  if file(kubeadm_conf_path).exist?\n    describe file(kubeadm_conf_path) do\n      it { should_not be_more_permissive_than('0644') }\n    end\n  else\n    describe \"Kubeadm file #{kubeadm_conf_path} not found on target\" do\n      skip\n    end\n  end\nend\n",
          "desc": "The Kubernetes kubeadm.conf contains sensitive information regarding\nthe cluster nodes configuration. If this file can be modified, the Kubernetes\nPlatform Plane would be degraded or compromised for malicious intent. Many of\nthe security settings within the document are implemented through this file.",
          "descriptions": [
            {
              "data": "The Kubernetes kubeadm.conf contains sensitive information regarding\nthe cluster nodes configuration. If this file can be modified, the Kubernetes\nPlatform Plane would be degraded or compromised for malicious intent. Many of\nthe security settings within the document are implemented through this file.",
              "label": "default"
            },
            {
              "data": "",
              "label": "rationale"
            },
            {
              "data": "Review the Kubeadm.conf file :\n\n    Get the path for Kubeadm.conf by running:\n\n    systemctl status kubelet\n\n  Note the configuration file installed by the kubeadm is written to\n\n  default Location: /etc/systemd/system/kubelet.service.d/10-kubeadm.conf\n\n    stat -c %a  <Kubeadm.conf path>\n\nIf the file has permissions more permissive than \"644\", this is a finding.",
              "label": "check"
            },
            {
              "data": "Change the permissions of kubeadm.conf to \"644\" by executing the command:\n\nchown 644 <Kubeadm.conf path>",
              "label": "fix"
            },
            {
              "data": "K3S deployments are not configured through Kubeadm and hence non-applicable.",
              "label": "caveat"
            }
          ],
          "id": "V-242455",
          "impact": 0.0,
          "refs": [
            {
              "ref": []
            }
          ],
          "results": [
            {
              "code_desc": "Kubeadm file /etc/systemd/system/kubelet.service.d/10-kubeadm.conf not found on target ",
              "resource": "",
              "resource_class": "Object",
              "resource_params": "[]",
              "run_time": 9.118e-6,
              "skip_message": "",
              "start_time": "2021-06-21T21:25:31-04:00",
              "status": "skipped"
            }
          ],
          "source_location": {
            "line": 3,
            "ref": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242455.rb"
          },
          "tags": {
            "cci": ["CCI-000366"],
            "fix_id": "F-45688r712720_fix",
            "gid": "V-242455",
            "gtitle": "SRG-APP-000516-CTR-001325",
            "nist": ["CM-6 b"],
            "rid": "SV-242455r712721_rule",
            "severity": "medium",
            "stig_id": "CNTR-K8-003220"
          },
          "title": "The Kubernetes  kubeadm.conf must have file permissions set to 644\nor more restrictive.",
          "waiver_data": {}
        },
        {
          "code": "control 'V-242456' do\n  title \"The Kubernetes kubelet config must have file permissions set to 644 or\nmore restrictive.\"\n  desc  \"The Kubernetes kubelet agent registers nodes with the API server and\nperforms health checks to containers within pods. If this file can be modified,\nthe information system would be unaware of pod or container degradation.\"\n  desc  'rationale', ''\n  desc  'check', \"\n    Review the permissions of the Kubernetes config.yaml by using the command:\n\n    stat -c %a /var/lib/kubelet/config.yaml\n\n    If any of the files are have permissions more permissive than \\\"644\\\", this\nis a finding.\n  \"\n  desc 'fix', \"\n    Change the permissions of the config.yaml to \\\"644\\\" by executing the\ncommand:\n\n    chown 644 /var/lib/kubelet/config.yaml\n  \"\n  impact 0.5\n  tag severity: 'medium'\n  tag gtitle: 'SRG-APP-000516-CTR-001330'\n  tag gid: 'V-242456'\n  tag rid: 'SV-242456r712724_rule'\n  tag stig_id: 'CNTR-K8-003230'\n  tag fix_id: 'F-45689r712723_fix'\n  tag cci: ['CCI-000366']\n  tag nist: ['CM-6 b']\n\n  describe kubelet do\n    its('config_file') { should_not be_nil }\n    its('config_file') { should_not be_more_permissive_than('0644') }\n  end\nend\n",
          "desc": "The Kubernetes kubelet agent registers nodes with the API server and\nperforms health checks to containers within pods. If this file can be modified,\nthe information system would be unaware of pod or container degradation.",
          "descriptions": [
            {
              "data": "The Kubernetes kubelet agent registers nodes with the API server and\nperforms health checks to containers within pods. If this file can be modified,\nthe information system would be unaware of pod or container degradation.",
              "label": "default"
            },
            {
              "data": "",
              "label": "rationale"
            },
            {
              "data": "Review the permissions of the Kubernetes config.yaml by using the command:\n\n    stat -c %a /var/lib/kubelet/config.yaml\n\n    If any of the files are have permissions more permissive than \"644\", this\nis a finding.",
              "label": "check"
            },
            {
              "data": "Change the permissions of the config.yaml to \"644\" by executing the\ncommand:\n\n    chown 644 /var/lib/kubelet/config.yaml",
              "label": "fix"
            }
          ],
          "id": "V-242456",
          "impact": 0.5,
          "refs": [],
          "results": [
            {
              "code_desc": "Process arguments for k3s config_file is expected not to be nil",
              "resource_class": "kubelet",
              "resource_params": "[]",
              "run_time": 0.008045478,
              "start_time": "2021-06-21T21:25:31-04:00",
              "status": "passed"
            },
            {
              "code_desc": "Process arguments for k3s config_file is expected not to be more permissive than \"0644\"",
              "resource_class": "kubelet",
              "resource_params": "[]",
              "run_time": 0.00529351,
              "start_time": "2021-06-21T21:25:31-04:00",
              "status": "passed"
            }
          ],
          "source_location": {
            "line": 3,
            "ref": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242456.rb"
          },
          "tags": {
            "cci": ["CCI-000366"],
            "fix_id": "F-45689r712723_fix",
            "gid": "V-242456",
            "gtitle": "SRG-APP-000516-CTR-001330",
            "nist": ["CM-6 b"],
            "rid": "SV-242456r712724_rule",
            "severity": "medium",
            "stig_id": "CNTR-K8-003230"
          },
          "title": "The Kubernetes kubelet config must have file permissions set to 644 or\nmore restrictive.",
          "waiver_data": {}
        },
        {
          "code": "control 'V-242457' do\n  title 'The Kubernetes kubelet config must be owned by root.'\n  desc  \"The Kubernetes kubelet agent registers nodes with the API Server and\nperforms health checks to containers within pods. If this file can be modified,\nthe information system would be unaware of pod or container degradation.\"\n  desc  'rationale', ''\n  desc  'check', \"\n    Review the Kubernetes Kubeadm kubelet conf file by using the command:\n\n    stat -c %U:%G /var/lib/kubelet/config.yaml| grep -v root:root\n\n    If the command returns any non root:root file permissions, this is a\nfinding.\n  \"\n  desc 'fix', \"\n    Change the ownership of the kubelet config to \\\"root: root\\\" by executing\nthe command:\n\n    chown root:root /var/lib/kubelet/config.yaml\n  \"\n  impact 0.5\n  tag severity: 'medium'\n  tag gtitle: 'SRG-APP-000516-CTR-001330'\n  tag gid: 'V-242457'\n  tag rid: 'SV-242457r712727_rule'\n  tag stig_id: 'CNTR-K8-003240'\n  tag fix_id: 'F-45690r712726_fix'\n  tag cci: ['CCI-000366']\n  tag nist: ['CM-6 b']\n\n  describe kubelet do\n    its('config_file') { should be_owned_by('root') }\n    its('config_file') { should be_grouped_into('root') }\n  end\nend\n",
          "desc": "The Kubernetes kubelet agent registers nodes with the API Server and\nperforms health checks to containers within pods. If this file can be modified,\nthe information system would be unaware of pod or container degradation.",
          "descriptions": [
            {
              "data": "The Kubernetes kubelet agent registers nodes with the API Server and\nperforms health checks to containers within pods. If this file can be modified,\nthe information system would be unaware of pod or container degradation.",
              "label": "default"
            },
            {
              "data": "",
              "label": "rationale"
            },
            {
              "data": "Review the Kubernetes Kubeadm kubelet conf file by using the command:\n\n    stat -c %U:%G /var/lib/kubelet/config.yaml| grep -v root:root\n\n    If the command returns any non root:root file permissions, this is a\nfinding.",
              "label": "check"
            },
            {
              "data": "Change the ownership of the kubelet config to \"root: root\" by executing\nthe command:\n\n    chown root:root /var/lib/kubelet/config.yaml",
              "label": "fix"
            }
          ],
          "id": "V-242457",
          "impact": 0.5,
          "refs": [],
          "results": [
            {
              "code_desc": "Process arguments for k3s config_file is expected to be owned by \"root\"",
              "resource_class": "kubelet",
              "resource_params": "[]",
              "run_time": 0.04117526,
              "start_time": "2021-06-21T21:25:31-04:00",
              "status": "passed"
            },
            {
              "code_desc": "Process arguments for k3s config_file is expected to be grouped into \"root\"",
              "resource_class": "kubelet",
              "resource_params": "[]",
              "run_time": 0.015639184,
              "start_time": "2021-06-21T21:25:31-04:00",
              "status": "passed"
            }
          ],
          "source_location": {
            "line": 3,
            "ref": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242457.rb"
          },
          "tags": {
            "cci": ["CCI-000366"],
            "fix_id": "F-45690r712726_fix",
            "gid": "V-242457",
            "gtitle": "SRG-APP-000516-CTR-001330",
            "nist": ["CM-6 b"],
            "rid": "SV-242457r712727_rule",
            "severity": "medium",
            "stig_id": "CNTR-K8-003240"
          },
          "title": "The Kubernetes kubelet config must be owned by root.",
          "waiver_data": {}
        },
        {
          "code": "control 'V-242458' do\n  title \"The Kubernetes API Server must have file permissions set to 644 or\nmore restrictive.\"\n  desc  \"The Kubernetes manifests are those files that contain the arguments\nand settings for the Master Node services. These services are etcd, the API\nServer, controller, proxy, and scheduler. If these files can be changed, the\nscheduler will be implementing the changes immediately. Many of the security\nsettings within the document are implemented through these manifests.\"\n  desc  'rationale', ''\n  desc  'check', \"\n    Review the permissions of the Kubernetes Kubelet by using the command:\n\n    stat -c %a  /etc/kubernetes/manifests/*\n\n    If any of the files are have permissions more permissive than \\\"644\\\", this\nis a finding.\n  \"\n  desc 'fix', \"\n    Change the permissions of the manifest files by executing the command:\n\n    chmod 644 /etc/kubernetes/manifests/*\n  \"\n  impact 0.5\n  tag severity: 'medium'\n  tag gtitle: 'SRG-APP-000516-CTR-001335'\n  tag gid: 'V-242458'\n  tag rid: 'SV-242458r712730_rule'\n  tag stig_id: 'CNTR-K8-003250'\n  tag fix_id: 'F-45691r712729_fix'\n  tag cci: ['CCI-000366']\n  tag nist: ['CM-6 b']\n\n  manifests_path = input('manifests_path')\n  manifests_files = command(\"find #{manifests_path} -type f\").stdout.split\n\n  if manifests_files.empty?\n    desc 'caveat', \"Kubernetes Manifest files not present of the target at specified path #{manifests_path}.\"\n\n    describe \"Kubernetes Manifest files not present of the target at specified path #{manifests_path}.\" do\n      skip\n    end\n  end\n\n  manifests_files.each do |file_name|\n    describe file(file_name) do\n      it { should_not be_more_permissive_than('0644') }\n    end\n  end\nend\n",
          "desc": "The Kubernetes manifests are those files that contain the arguments\nand settings for the Master Node services. These services are etcd, the API\nServer, controller, proxy, and scheduler. If these files can be changed, the\nscheduler will be implementing the changes immediately. Many of the security\nsettings within the document are implemented through these manifests.",
          "descriptions": [
            {
              "data": "The Kubernetes manifests are those files that contain the arguments\nand settings for the Master Node services. These services are etcd, the API\nServer, controller, proxy, and scheduler. If these files can be changed, the\nscheduler will be implementing the changes immediately. Many of the security\nsettings within the document are implemented through these manifests.",
              "label": "default"
            },
            {
              "data": "",
              "label": "rationale"
            },
            {
              "data": "Review the permissions of the Kubernetes Kubelet by using the command:\n\n    stat -c %a  /etc/kubernetes/manifests/*\n\n    If any of the files are have permissions more permissive than \"644\", this\nis a finding.",
              "label": "check"
            },
            {
              "data": "Change the permissions of the manifest files by executing the command:\n\nchmod 644 /etc/kubernetes/manifests/*",
              "label": "fix"
            },
            {
              "data": "K3S deployments are not applied using manifest files and hence non-applicable.",
              "label": "caveat"
            }
          ],
          "id": "V-242458",
          "impact": 0.0,
          "refs": [
            {
              "ref": []
            }
          ],
          "results": [
            {
              "code_desc": "Kubernetes Manifest files not present of the target at specified path /etc/kubernetes/manifests. ",
              "resource": "",
              "resource_class": "Object",
              "resource_params": "[]",
              "run_time": 1.4402e-5,
              "skip_message": "",
              "start_time": "2021-06-21T21:25:31-04:00",
              "status": "skipped"
            }
          ],
          "source_location": {
            "line": 3,
            "ref": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242458.rb"
          },
          "tags": {
            "cci": ["CCI-000366"],
            "fix_id": "F-45691r712729_fix",
            "gid": "V-242458",
            "gtitle": "SRG-APP-000516-CTR-001335",
            "nist": ["CM-6 b"],
            "rid": "SV-242458r712730_rule",
            "severity": "medium",
            "stig_id": "CNTR-K8-003250"
          },
          "title": "The Kubernetes API Server must have file permissions set to 644 or\nmore restrictive.",
          "waiver_data": {}
        },
        {
          "code": "control 'V-242459' do\n  title \"The Kubernetes etcd must have file permissions set to 644 or more\nrestrictive.\"\n  desc  \"The Kubernetes etcd key-value store provides a way to store data to\nthe Master Node. If these files can be changed, data to API object and master\nnode would be compromised.\"\n  desc  'rationale', ''\n  desc  'check', \"\n    Review the permissions of the Kubernetes etcd by using the command:\n\n    stat -c %a  /var/lib/etcd/*\n\n    If any of the files are have permissions more permissive than \\\"644\\\", this\nis a finding.\n  \"\n  desc 'fix', \"\n    Change the permissions of the manifest files to \\\"644\\\" by executing the\ncommand:\n\n    chmod 644/var/lib/etcd/*\n  \"\n  impact 0.5\n  tag severity: 'medium'\n  tag gtitle: 'SRG-APP-000516-CTR-001335'\n  tag gid: 'V-242459'\n  tag rid: 'SV-242459r712733_rule'\n  tag stig_id: 'CNTR-K8-003260'\n  tag fix_id: 'F-45692r712732_fix'\n  tag cci: ['CCI-000366']\n  tag nist: ['CM-6 b']\n\n  if etcd.exist?\n    describe.one do\n      if etcd.params['data-dir']\n        describe file(etcd.params['data-dir'].join) do\n          it { should_not be_more_permissive_than('0644') }\n        end\n      end\n\n      describe file(process_env_var('etcd').params['ETCD_DATA_DIR']) do\n        it { should_not be_more_permissive_than('0644') }\n      end\n    end\n  else\n    describe 'ETCD process is not running on the target.' do\n      skip\n    end\n  end\nend\n",
          "desc": "The Kubernetes etcd key-value store provides a way to store data to\nthe Master Node. If these files can be changed, data to API object and master\nnode would be compromised.",
          "descriptions": [
            {
              "data": "The Kubernetes etcd key-value store provides a way to store data to\nthe Master Node. If these files can be changed, data to API object and master\nnode would be compromised.",
              "label": "default"
            },
            {
              "data": "",
              "label": "rationale"
            },
            {
              "data": "Review the permissions of the Kubernetes etcd by using the command:\n\n    stat -c %a  /var/lib/etcd/*\n\n    If any of the files are have permissions more permissive than \"644\", this\nis a finding.",
              "label": "check"
            },
            {
              "data": "Change the permissions of the manifest files to \"644\" by executing the\ncommand:\n\n    chmod 644/var/lib/etcd/*",
              "label": "fix"
            }
          ],
          "id": "V-242459",
          "impact": 0.5,
          "refs": [],
          "results": [
            {
              "code_desc": "File /opt/etcd/data is expected not to be more permissive than \"0644\"",
              "resource_class": "file",
              "resource_params": "[\"/opt/etcd/data\"]",
              "run_time": 0.000214674,
              "start_time": "2021-06-21T21:25:31-04:00",
              "status": "passed"
            },
            {
              "code_desc": "File  is expected not to be more permissive than \"0644\"",
              "resource_class": "file",
              "resource_params": "[nil]",
              "run_time": 0.000125486,
              "start_time": "2021-06-21T21:25:31-04:00",
              "status": "passed"
            }
          ],
          "source_location": {
            "line": 3,
            "ref": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242459.rb"
          },
          "tags": {
            "cci": ["CCI-000366"],
            "fix_id": "F-45692r712732_fix",
            "gid": "V-242459",
            "gtitle": "SRG-APP-000516-CTR-001335",
            "nist": ["CM-6 b"],
            "rid": "SV-242459r712733_rule",
            "severity": "medium",
            "stig_id": "CNTR-K8-003260"
          },
          "title": "The Kubernetes etcd must have file permissions set to 644 or more\nrestrictive.",
          "waiver_data": {}
        },
        {
          "code": "control 'V-242460' do\n  title \"The Kubernetes admin.conf must have file permissions set to 644 or\nmore restrictive.\"\n  desc  \"The Kubernetes conf files contain the arguments and settings for the\nMaster Node services. These services are controller and scheduler. If these\nfiles can be changed, the scheduler will be implementing the changes\nimmediately.\"\n  desc  'rationale', ''\n  desc  'check', \"\n    Review the permissions of the Kubernetes config files by using the command:\n\n    stat -c %a /etc/kubernetes/admin.conf\n    stat -c %a /etc/kubernetes/scheduler.conf\n    stat -c %a /etc/kubernetes/controller-manager.conf\n\n    If any of the files are have permissions more permissive than \\\"644\\\", this\nis a finding.\n  \"\n  desc 'fix', \"\n    Change the permissions of the conf files to \\\"644\\\" by executing the\ncommand:\n\n    chmod 644 /etc/kubernetes/admin.conf\n    chmod 644 /etc/kubernetes/scheduler.conf\n    chmod 644 /etc/kubernetes/controller-manager.conf\n  \"\n  impact 0.5\n  tag severity: 'medium'\n  tag gtitle: 'SRG-APP-000516-CTR-001335'\n  tag gid: 'V-242460'\n  tag rid: 'SV-242460r712736_rule'\n  tag stig_id: 'CNTR-K8-003270'\n  tag fix_id: 'F-45693r712735_fix'\n  tag cci: ['CCI-000366']\n  tag nist: ['CM-6 b']\n\n  input('kubernetes_conf_files').each do |file_name|\n    if file(file_name).exist?\n      describe file(file_name) do\n        it { should_not be_more_permissive_than('0644') }\n      end\n    else\n      describe \"Kubernetes Conf file #{file_name} not found on target\" do\n        skip\n      end\n    end\n  end\n\n  if input('kubernetes_conf_files').empty?\n    describe 'No `kubernetes_conf_files` provided through input values.' do\n      skip\n    end\n  end\nend\n",
          "desc": "The Kubernetes conf files contain the arguments and settings for the\nMaster Node services. These services are controller and scheduler. If these\nfiles can be changed, the scheduler will be implementing the changes\nimmediately.",
          "descriptions": [
            {
              "data": "The Kubernetes conf files contain the arguments and settings for the\nMaster Node services. These services are controller and scheduler. If these\nfiles can be changed, the scheduler will be implementing the changes\nimmediately.",
              "label": "default"
            },
            {
              "data": "",
              "label": "rationale"
            },
            {
              "data": "Review the permissions of the Kubernetes config files by using the command:\n\n    stat -c %a /etc/kubernetes/admin.conf\n    stat -c %a /etc/kubernetes/scheduler.conf\n    stat -c %a /etc/kubernetes/controller-manager.conf\n\n    If any of the files are have permissions more permissive than \"644\", this\nis a finding.",
              "label": "check"
            },
            {
              "data": "Change the permissions of the conf files to \"644\" by executing the\ncommand:\n\n    chmod 644 /etc/kubernetes/admin.conf\n    chmod 644 /etc/kubernetes/scheduler.conf\n    chmod 644 /etc/kubernetes/controller-manager.conf",
              "label": "fix"
            }
          ],
          "id": "V-242460",
          "impact": 0.5,
          "refs": [],
          "results": [
            {
              "code_desc": "File /var/lib/rancher/k3s/server/cred/admin.kubeconfig is expected not to be more permissive than \"0644\"",
              "resource_class": "file",
              "resource_params": "[\"/var/lib/rancher/k3s/server/cred/admin.kubeconfig\"]",
              "run_time": 0.25076077,
              "start_time": "2021-06-21T21:25:30-04:00",
              "status": "passed"
            },
            {
              "code_desc": "File /var/lib/rancher/k3s/server/cred/scheduler.kubeconfig is expected not to be more permissive than \"0644\"",
              "resource_class": "file",
              "resource_params": "[\"/var/lib/rancher/k3s/server/cred/scheduler.kubeconfig\"]",
              "run_time": 0.254185305,
              "start_time": "2021-06-21T21:25:31-04:00",
              "status": "passed"
            },
            {
              "code_desc": "File /var/lib/rancher/k3s/server/cred/controller.kubeconfig is expected not to be more permissive than \"0644\"",
              "resource_class": "file",
              "resource_params": "[\"/var/lib/rancher/k3s/server/cred/controller.kubeconfig\"]",
              "run_time": 0.248882316,
              "start_time": "2021-06-21T21:25:31-04:00",
              "status": "passed"
            }
          ],
          "source_location": {
            "line": 3,
            "ref": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242460.rb"
          },
          "tags": {
            "cci": ["CCI-000366"],
            "fix_id": "F-45693r712735_fix",
            "gid": "V-242460",
            "gtitle": "SRG-APP-000516-CTR-001335",
            "nist": ["CM-6 b"],
            "rid": "SV-242460r712736_rule",
            "severity": "medium",
            "stig_id": "CNTR-K8-003270"
          },
          "title": "The Kubernetes admin.conf must have file permissions set to 644 or\nmore restrictive.",
          "waiver_data": {}
        },
        {
          "code": "control 'V-242461' do\n  title 'Kubernetes API Server audit logs must be enabled.'\n  desc  \"Kubernetes API Server validates and configures pods and services for\nthe API object. The REST operation provides frontend functionality to the\ncluster share state. Enabling audit logs provides a way to monitor and identify\nsecurity risk events or misuse of information. Audit logs are necessary to\nprovide evidence in the case the Kubernetes API Server is compromised requiring\na Cyber Security Investigation.\"\n  desc  'rationale', ''\n  desc  'check', \"\n    Change to the /etc/kubernetes/manifests directory on the Kubernetes Master\nNode. Run the command:\n\n    grep -i audit-policy-file *\n\n    If the setting \\\"audit-policy-file\\\" is not set or is found in the\nKubernetes API manifest file without valid content, this is a finding.\n  \"\n  desc 'fix', \"Edit the Kubernetes API Server manifest file in the\n/etc/kubernetes/manifests directory on the Kubernetes Master Node. Set the\nargument \\\"--audit-policy-file\\\" to \\\"log file directory\\\".\"\n  impact 0.5\n  tag severity: 'medium'\n  tag gtitle: 'SRG-APP-000516-CTR-001335'\n  tag gid: 'V-242461'\n  tag rid: 'SV-242461r712739_rule'\n  tag stig_id: 'CNTR-K8-003280'\n  tag fix_id: 'F-45694r712738_fix'\n  tag cci: ['CCI-000366']\n  tag nist: ['CM-6 b']\n\n  unless kube_apiserver.exist?\n    impact 0.0\n    desc 'caveat', 'Kubernetes API Server process is not running on the target.'\n  end\n\n  describe kube_apiserver do\n    its('audit-policy-file') { should_not be_nil }\n  end\nend\n",
          "desc": "Kubernetes API Server validates and configures pods and services for\nthe API object. The REST operation provides frontend functionality to the\ncluster share state. Enabling audit logs provides a way to monitor and identify\nsecurity risk events or misuse of information. Audit logs are necessary to\nprovide evidence in the case the Kubernetes API Server is compromised requiring\na Cyber Security Investigation.",
          "descriptions": [
            {
              "data": "Kubernetes API Server validates and configures pods and services for\nthe API object. The REST operation provides frontend functionality to the\ncluster share state. Enabling audit logs provides a way to monitor and identify\nsecurity risk events or misuse of information. Audit logs are necessary to\nprovide evidence in the case the Kubernetes API Server is compromised requiring\na Cyber Security Investigation.",
              "label": "default"
            },
            {
              "data": "",
              "label": "rationale"
            },
            {
              "data": "Change to the /etc/kubernetes/manifests directory on the Kubernetes Master\nNode. Run the command:\n\n    grep -i audit-policy-file *\n\n    If the setting \"audit-policy-file\" is not set or is found in the\nKubernetes API manifest file without valid content, this is a finding.",
              "label": "check"
            },
            {
              "data": "Edit the Kubernetes API Server manifest file in the\n/etc/kubernetes/manifests directory on the Kubernetes Master Node. Set the\nargument \"--audit-policy-file\" to \"log file directory\".",
              "label": "fix"
            }
          ],
          "id": "V-242461",
          "impact": 0.5,
          "refs": [],
          "results": [
            {
              "code_desc": "Process arguments for k3s server audit-policy-file is expected not to be nil",
              "resource_class": "kube_apiserver",
              "resource_params": "[]",
              "run_time": 0.007289906,
              "start_time": "2021-06-21T21:25:30-04:00",
              "status": "passed"
            }
          ],
          "source_location": {
            "line": 3,
            "ref": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242461.rb"
          },
          "tags": {
            "cci": ["CCI-000366"],
            "fix_id": "F-45694r712738_fix",
            "gid": "V-242461",
            "gtitle": "SRG-APP-000516-CTR-001335",
            "nist": ["CM-6 b"],
            "rid": "SV-242461r712739_rule",
            "severity": "medium",
            "stig_id": "CNTR-K8-003280"
          },
          "title": "Kubernetes API Server audit logs must be enabled.",
          "waiver_data": {}
        },
        {
          "code": "control 'V-242462' do\n  title 'The Kubernetes API Server must be set to audit log max size.'\n  desc  \"The Kubernetes API Server must be set for enough storage to retain log\ninformation over the period required. When audit logs are large in size, the\nmonitoring service for events becomes degraded. The function of the maximum log\nfile size is to set these limits.\"\n  desc  'rationale', ''\n  desc  'check', \"\n    Change to the /etc/kubernetes/manifests/ directory on the Kubernetes Master\nNode. Run the command:\n\n    grep -i audit-log-maxsize *\n\n    If the setting \\\"audit-log-maxsize\\\" is not set in the Kubernetes API\nServer manifest file or it is set to less than \\\"100\\\", this is a finding.\n  \"\n  desc 'fix', \"Edit the Kubernetes API Server manifest file in the\n/etc/kubernetes/manifests directory on the Kubernetes Master Node. Set the\nvalue of –\\\"--audit-log-maxsize\\\" to a minimum of \\\"100\\\".\"\n  impact 0.5\n  tag severity: 'medium'\n  tag gtitle: 'SRG-APP-000516-CTR-001335'\n  tag gid: 'V-242462'\n  tag rid: 'SV-242462r712742_rule'\n  tag stig_id: 'CNTR-K8-003290'\n  tag fix_id: 'F-45695r712741_fix'\n  tag cci: ['CCI-000366']\n  tag nist: ['CM-6 b']\n\n  unless kube_apiserver.exist?\n    impact 0.0\n    desc 'caveat', 'Kubernetes API Server process is not running on the target.'\n  end\n\n  describe kube_apiserver do\n    its('audit-log-maxsize') { should cmp >= 100 }\n  end\nend\n",
          "desc": "The Kubernetes API Server must be set for enough storage to retain log\ninformation over the period required. When audit logs are large in size, the\nmonitoring service for events becomes degraded. The function of the maximum log\nfile size is to set these limits.",
          "descriptions": [
            {
              "data": "The Kubernetes API Server must be set for enough storage to retain log\ninformation over the period required. When audit logs are large in size, the\nmonitoring service for events becomes degraded. The function of the maximum log\nfile size is to set these limits.",
              "label": "default"
            },
            {
              "data": "",
              "label": "rationale"
            },
            {
              "data": "Change to the /etc/kubernetes/manifests/ directory on the Kubernetes Master\nNode. Run the command:\n\n    grep -i audit-log-maxsize *\n\n    If the setting \"audit-log-maxsize\" is not set in the Kubernetes API\nServer manifest file or it is set to less than \"100\", this is a finding.",
              "label": "check"
            },
            {
              "data": "Edit the Kubernetes API Server manifest file in the\n/etc/kubernetes/manifests directory on the Kubernetes Master Node. Set the\nvalue of –\"--audit-log-maxsize\" to a minimum of \"100\".",
              "label": "fix"
            }
          ],
          "id": "V-242462",
          "impact": 0.5,
          "refs": [],
          "results": [
            {
              "code_desc": "Process arguments for k3s server audit-log-maxsize is expected to cmp >= 100",
              "resource_class": "kube_apiserver",
              "resource_params": "[]",
              "run_time": 0.007523107,
              "start_time": "2021-06-21T21:25:30-04:00",
              "status": "passed"
            }
          ],
          "source_location": {
            "line": 3,
            "ref": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242462.rb"
          },
          "tags": {
            "cci": ["CCI-000366"],
            "fix_id": "F-45695r712741_fix",
            "gid": "V-242462",
            "gtitle": "SRG-APP-000516-CTR-001335",
            "nist": ["CM-6 b"],
            "rid": "SV-242462r712742_rule",
            "severity": "medium",
            "stig_id": "CNTR-K8-003290"
          },
          "title": "The Kubernetes API Server must be set to audit log max size.",
          "waiver_data": {}
        },
        {
          "code": "control 'V-242463' do\n  title 'The Kubernetes API Server must be set to audit log maximum backup.'\n  desc  \"The Kubernetes API Server must set enough storage to retain logs for\nmonitoring suspicious activity and system misconfiguration, and provide\nevidence for Cyber Security Investigations.\"\n  desc  'rationale', ''\n  desc  'check', \"\n    Change to the /etc/kubernetes/manifests/ directory on the Kubernetes Master\nNode. Run the command:\n\n    grep -i audit-log-maxbackup *\n\n    If the setting \\\"audit-log-maxbackup\\\" is not set in the Kubernetes API\nServer manifest file or it is set less than \\\"10\\\", this is a finding.\n  \"\n  desc 'fix', \"Edit the Kubernetes API Server manifest file in the\n/etc/kubernetes/manifests directory on the Kubernetes Master Node. Set the\nvalue of \\\"--audit-log-maxbackup\\\" to a minimum of \\\"10\\\".\"\n  impact 0.5\n  tag severity: 'medium'\n  tag gtitle: 'SRG-APP-000516-CTR-001335'\n  tag gid: 'V-242463'\n  tag rid: 'SV-242463r712745_rule'\n  tag stig_id: 'CNTR-K8-003300'\n  tag fix_id: 'F-45696r712744_fix'\n  tag cci: ['CCI-000366']\n  tag nist: ['CM-6 b']\n\n  unless kube_apiserver.exist?\n    impact 0.0\n    desc 'caveat', 'Kubernetes API Server process is not running on the target.'\n  end\n\n  describe kube_apiserver do\n    its('audit-log-maxbackup') { should cmp >= 10 }\n  end\nend\n",
          "desc": "The Kubernetes API Server must set enough storage to retain logs for\nmonitoring suspicious activity and system misconfiguration, and provide\nevidence for Cyber Security Investigations.",
          "descriptions": [
            {
              "data": "The Kubernetes API Server must set enough storage to retain logs for\nmonitoring suspicious activity and system misconfiguration, and provide\nevidence for Cyber Security Investigations.",
              "label": "default"
            },
            {
              "data": "",
              "label": "rationale"
            },
            {
              "data": "Change to the /etc/kubernetes/manifests/ directory on the Kubernetes Master\nNode. Run the command:\n\n    grep -i audit-log-maxbackup *\n\n    If the setting \"audit-log-maxbackup\" is not set in the Kubernetes API\nServer manifest file or it is set less than \"10\", this is a finding.",
              "label": "check"
            },
            {
              "data": "Edit the Kubernetes API Server manifest file in the\n/etc/kubernetes/manifests directory on the Kubernetes Master Node. Set the\nvalue of \"--audit-log-maxbackup\" to a minimum of \"10\".",
              "label": "fix"
            }
          ],
          "id": "V-242463",
          "impact": 0.5,
          "refs": [],
          "results": [
            {
              "code_desc": "Process arguments for k3s server audit-log-maxbackup is expected to cmp >= 10",
              "resource_class": "kube_apiserver",
              "resource_params": "[]",
              "run_time": 0.007649704,
              "start_time": "2021-06-21T21:25:30-04:00",
              "status": "passed"
            }
          ],
          "source_location": {
            "line": 3,
            "ref": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242463.rb"
          },
          "tags": {
            "cci": ["CCI-000366"],
            "fix_id": "F-45696r712744_fix",
            "gid": "V-242463",
            "gtitle": "SRG-APP-000516-CTR-001335",
            "nist": ["CM-6 b"],
            "rid": "SV-242463r712745_rule",
            "severity": "medium",
            "stig_id": "CNTR-K8-003300"
          },
          "title": "The Kubernetes API Server must be set to audit log maximum backup.",
          "waiver_data": {}
        },
        {
          "code": "control 'V-242464' do\n  title 'The Kubernetes API Server audit log retention must be set.'\n  desc  \"The Kubernetes API Server must set enough storage to retain logs for\nmonitoring suspicious activity and system misconfiguration, and provide\nevidence for Cyber Security Investigations.\"\n  desc  'rationale', ''\n  desc  'check', \"\n    Change to the /etc/kubernetes/manifests/ directory on the Kubernetes Master\nNode. Run the command:\n\n    grep -i audit-log-maxage *\n\n    If the setting \\\"audit-log-maxage\\\" is not set in the Kubernetes API Server\nmanifest file or it is set less than \\\"30\\\", this is a finding.\n  \"\n  desc 'fix', \"Edit the Kubernetes API Server manifest file in the\n/etc/kubernetes/manifests directory on the Kubernetes Master Node. Set the\nvalue of \\\"--audit-log-maxage\\\" to a minimum of \\\"30\\\".\"\n  impact 0.5\n  tag severity: 'medium'\n  tag gtitle: 'SRG-APP-000516-CTR-001335'\n  tag gid: 'V-242464'\n  tag rid: 'SV-242464r712748_rule'\n  tag stig_id: 'CNTR-K8-003310'\n  tag fix_id: 'F-45697r712747_fix'\n  tag cci: ['CCI-000366']\n  tag nist: ['CM-6 b']\n\n  unless kube_apiserver.exist?\n    impact 0.0\n    desc 'caveat', 'Kubernetes API Server process is not running on the target.'\n  end\n\n  describe kube_apiserver do\n    its('audit-log-maxage') { should cmp >= 30 }\n  end\nend\n",
          "desc": "The Kubernetes API Server must set enough storage to retain logs for\nmonitoring suspicious activity and system misconfiguration, and provide\nevidence for Cyber Security Investigations.",
          "descriptions": [
            {
              "data": "The Kubernetes API Server must set enough storage to retain logs for\nmonitoring suspicious activity and system misconfiguration, and provide\nevidence for Cyber Security Investigations.",
              "label": "default"
            },
            {
              "data": "",
              "label": "rationale"
            },
            {
              "data": "Change to the /etc/kubernetes/manifests/ directory on the Kubernetes Master\nNode. Run the command:\n\n    grep -i audit-log-maxage *\n\n    If the setting \"audit-log-maxage\" is not set in the Kubernetes API Server\nmanifest file or it is set less than \"30\", this is a finding.",
              "label": "check"
            },
            {
              "data": "Edit the Kubernetes API Server manifest file in the\n/etc/kubernetes/manifests directory on the Kubernetes Master Node. Set the\nvalue of \"--audit-log-maxage\" to a minimum of \"30\".",
              "label": "fix"
            }
          ],
          "id": "V-242464",
          "impact": 0.5,
          "refs": [],
          "results": [
            {
              "code_desc": "Process arguments for k3s server audit-log-maxage is expected to cmp >= 30",
              "resource_class": "kube_apiserver",
              "resource_params": "[]",
              "run_time": 0.008220368,
              "start_time": "2021-06-21T21:25:30-04:00",
              "status": "passed"
            }
          ],
          "source_location": {
            "line": 3,
            "ref": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242464.rb"
          },
          "tags": {
            "cci": ["CCI-000366"],
            "fix_id": "F-45697r712747_fix",
            "gid": "V-242464",
            "gtitle": "SRG-APP-000516-CTR-001335",
            "nist": ["CM-6 b"],
            "rid": "SV-242464r712748_rule",
            "severity": "medium",
            "stig_id": "CNTR-K8-003310"
          },
          "title": "The Kubernetes API Server audit log retention must be set.",
          "waiver_data": {}
        },
        {
          "code": "control 'V-242465' do\n  title 'The Kubernetes API Server audit log path must be set.'\n  desc  \"Kubernetes API Server validates and configures pods and services for\nthe API object. The REST operation provides frontend functionality to the\ncluster share state. Audit logs are necessary to provide evidence in the case\nthe Kubernetes API Server is compromised requiring Cyber Security\nInvestigation. To record events in the audit log the log path value must be\nset.\"\n  desc  'rationale', ''\n  desc  'check', \"\n    Change to the /etc/kubernetes/manifests/ directory on the Kubernetes Master\nNode. Run the command:\n\n    grep -i audit-log-path *\n\n    If the setting audit-log-path is not set in the Kubernetes API Server\nmanifest file or it is not set to a valid path, this is a finding.\n  \"\n  desc 'fix', \"Edit the Kubernetes API Server manifest file in the\n/etc/kubernetes/manifests directory on the Kubernetes Master Node. Set the\nvalue of \\\"--audit-log-path\\\" to valid location.\"\n  impact 0.5\n  tag severity: 'medium'\n  tag gtitle: 'SRG-APP-000516-CTR-001335'\n  tag gid: 'V-242465'\n  tag rid: 'SV-242465r712751_rule'\n  tag stig_id: 'CNTR-K8-003320'\n  tag fix_id: 'F-45698r712750_fix'\n  tag cci: ['CCI-000366']\n  tag nist: ['CM-6 b']\n\n  unless kube_apiserver.exist?\n    impact 0.0\n    desc 'caveat', 'Kubernetes API Server process is not running on the target.'\n  end\n\n  describe kube_apiserver do\n    its('audit-log-path') { should_not be_nil }\n  end\n\n  if kube_apiserver.params['audit-log-path']\n    describe file(kube_apiserver.params['audit-log-path'].join) do\n      it { should exist }\n    end\n  end\nend\n",
          "desc": "Kubernetes API Server validates and configures pods and services for\nthe API object. The REST operation provides frontend functionality to the\ncluster share state. Audit logs are necessary to provide evidence in the case\nthe Kubernetes API Server is compromised requiring Cyber Security\nInvestigation. To record events in the audit log the log path value must be\nset.",
          "descriptions": [
            {
              "data": "Kubernetes API Server validates and configures pods and services for\nthe API object. The REST operation provides frontend functionality to the\ncluster share state. Audit logs are necessary to provide evidence in the case\nthe Kubernetes API Server is compromised requiring Cyber Security\nInvestigation. To record events in the audit log the log path value must be\nset.",
              "label": "default"
            },
            {
              "data": "",
              "label": "rationale"
            },
            {
              "data": "Change to the /etc/kubernetes/manifests/ directory on the Kubernetes Master\nNode. Run the command:\n\n    grep -i audit-log-path *\n\n    If the setting audit-log-path is not set in the Kubernetes API Server\nmanifest file or it is not set to a valid path, this is a finding.",
              "label": "check"
            },
            {
              "data": "Edit the Kubernetes API Server manifest file in the\n/etc/kubernetes/manifests directory on the Kubernetes Master Node. Set the\nvalue of \"--audit-log-path\" to valid location.",
              "label": "fix"
            }
          ],
          "id": "V-242465",
          "impact": 0.5,
          "refs": [],
          "results": [
            {
              "code_desc": "Process arguments for k3s server audit-log-path is expected not to be nil",
              "resource_class": "kube_apiserver",
              "resource_params": "[]",
              "run_time": 0.008624852,
              "start_time": "2021-06-21T21:25:30-04:00",
              "status": "passed"
            },
            {
              "code_desc": "File /var/lib/rancher/audit/audit.log is expected to exist",
              "resource_class": "file",
              "resource_params": "[\"/var/lib/rancher/audit/audit.log\"]",
              "run_time": 0.23857742,
              "start_time": "2021-06-21T21:25:30-04:00",
              "status": "passed"
            }
          ],
          "source_location": {
            "line": 3,
            "ref": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242465.rb"
          },
          "tags": {
            "cci": ["CCI-000366"],
            "fix_id": "F-45698r712750_fix",
            "gid": "V-242465",
            "gtitle": "SRG-APP-000516-CTR-001335",
            "nist": ["CM-6 b"],
            "rid": "SV-242465r712751_rule",
            "severity": "medium",
            "stig_id": "CNTR-K8-003320"
          },
          "title": "The Kubernetes API Server audit log path must be set.",
          "waiver_data": {}
        },
        {
          "code": "control 'V-242466' do\n  title \"The Kubernetes PKI CRT must have file permissions set to 644 or more\nrestrictive.\"\n  desc  \"The Kubernetes PKI directory contains all certificates (.crt files)\nsupporting secure network communications in the Kubernetes Control Plane. If\nthese files can be modified, data traversing within the architecture components\nwould become unsecure and compromised.\"\n  desc  'rationale', ''\n  desc  'check', \"\n    Review the permissions of the Kubernetes PKI cert files by using the\ncommand:\n\n    find /etc/kubernetes/pki -name \\\"*.crt\\\" | xargs stat -c '%n %a'\n\n    If any of the files are have permissions more permissive than \\\"644\\\", this\nis a finding.\n  \"\n  desc 'fix', \"\n    Change the ownership of the cert files to \\\"644\\\" by executing the command:\n\n    chmod -R 644 /etc/kubernetes/pki/*.crt\n  \"\n  impact 0.5\n  tag severity: 'medium'\n  tag gtitle: 'SRG-APP-000516-CTR-001335'\n  tag gid: 'V-242466'\n  tag rid: 'SV-242466r712754_rule'\n  tag stig_id: 'CNTR-K8-003330'\n  tag fix_id: 'F-45699r712753_fix'\n  tag cci: ['CCI-000366']\n  tag nist: ['CM-6 b']\n\n  pki_path = input('pki_path')\n  pki_files = command(\"find #{pki_path}/ -name \\\"*.crt\\\"\").stdout.split\n\n  if pki_files.empty?\n    desc 'caveat', \"Kubernetes PKI files not present of the target at specified path #{pki_path}.\"\n\n    describe \"Kubernetes PKI files not present of the target at specified path #{pki_path}.\" do\n      skip\n    end\n  end\n\n  pki_files.each do |file_name|\n    describe file(file_name) do\n      it { should_not be_more_permissive_than('0644') }\n    end\n  end\nend\n",
          "desc": "The Kubernetes PKI directory contains all certificates (.crt files)\nsupporting secure network communications in the Kubernetes Control Plane. If\nthese files can be modified, data traversing within the architecture components\nwould become unsecure and compromised.",
          "descriptions": [
            {
              "data": "The Kubernetes PKI directory contains all certificates (.crt files)\nsupporting secure network communications in the Kubernetes Control Plane. If\nthese files can be modified, data traversing within the architecture components\nwould become unsecure and compromised.",
              "label": "default"
            },
            {
              "data": "",
              "label": "rationale"
            },
            {
              "data": "Review the permissions of the Kubernetes PKI cert files by using the\ncommand:\n\n    find /etc/kubernetes/pki -name \"*.crt\" | xargs stat -c '%n %a'\n\n    If any of the files are have permissions more permissive than \"644\", this\nis a finding.",
              "label": "check"
            },
            {
              "data": "Change the ownership of the cert files to \"644\" by executing the command:\n\nchmod -R 644 /etc/kubernetes/pki/*.crt",
              "label": "fix"
            }
          ],
          "id": "V-242466",
          "impact": 0.5,
          "refs": [],
          "results": [
            {
              "code_desc": "File /var/lib/rancher/k3s/server/tls//serving-kube-apiserver.crt is expected not to be more permissive than \"0644\"",
              "resource_class": "file",
              "resource_params": "[\"/var/lib/rancher/k3s/server/tls//serving-kube-apiserver.crt\"]",
              "run_time": 0.540664333,
              "start_time": "2021-06-21T21:25:23-04:00",
              "status": "passed"
            },
            {
              "code_desc": "File /var/lib/rancher/k3s/server/tls//client-kube-apiserver.crt is expected not to be more permissive than \"0644\"",
              "resource_class": "file",
              "resource_params": "[\"/var/lib/rancher/k3s/server/tls//client-kube-apiserver.crt\"]",
              "run_time": 0.52081947,
              "start_time": "2021-06-21T21:25:24-04:00",
              "status": "passed"
            },
            {
              "code_desc": "File /var/lib/rancher/k3s/server/tls//client-admin.crt is expected not to be more permissive than \"0644\"",
              "resource_class": "file",
              "resource_params": "[\"/var/lib/rancher/k3s/server/tls//client-admin.crt\"]",
              "run_time": 0.580242749,
              "start_time": "2021-06-21T21:25:24-04:00",
              "status": "passed"
            },
            {
              "code_desc": "File /var/lib/rancher/k3s/server/tls//client-k3s-controller.crt is expected not to be more permissive than \"0644\"",
              "resource_class": "file",
              "resource_params": "[\"/var/lib/rancher/k3s/server/tls//client-k3s-controller.crt\"]",
              "run_time": 0.537012562,
              "start_time": "2021-06-21T21:25:25-04:00",
              "status": "passed"
            },
            {
              "code_desc": "File /var/lib/rancher/k3s/server/tls//request-header-ca.crt is expected not to be more permissive than \"0644\"",
              "resource_class": "file",
              "resource_params": "[\"/var/lib/rancher/k3s/server/tls//request-header-ca.crt\"]",
              "run_time": 0.48496151,
              "start_time": "2021-06-21T21:25:26-04:00",
              "status": "passed"
            },
            {
              "code_desc": "File /var/lib/rancher/k3s/server/tls//client-scheduler.crt is expected not to be more permissive than \"0644\"",
              "resource_class": "file",
              "resource_params": "[\"/var/lib/rancher/k3s/server/tls//client-scheduler.crt\"]",
              "run_time": 0.504909713,
              "start_time": "2021-06-21T21:25:26-04:00",
              "status": "passed"
            },
            {
              "code_desc": "File /var/lib/rancher/k3s/server/tls//client-kube-proxy.crt is expected not to be more permissive than \"0644\"",
              "resource_class": "file",
              "resource_params": "[\"/var/lib/rancher/k3s/server/tls//client-kube-proxy.crt\"]",
              "run_time": 0.487181048,
              "start_time": "2021-06-21T21:25:27-04:00",
              "status": "passed"
            },
            {
              "code_desc": "File /var/lib/rancher/k3s/server/tls//client-cloud-controller.crt is expected not to be more permissive than \"0644\"",
              "resource_class": "file",
              "resource_params": "[\"/var/lib/rancher/k3s/server/tls//client-cloud-controller.crt\"]",
              "run_time": 0.494100545,
              "start_time": "2021-06-21T21:25:27-04:00",
              "status": "passed"
            },
            {
              "code_desc": "File /var/lib/rancher/k3s/server/tls//client-ca.crt is expected not to be more permissive than \"0644\"",
              "resource_class": "file",
              "resource_params": "[\"/var/lib/rancher/k3s/server/tls//client-ca.crt\"]",
              "run_time": 0.510864417,
              "start_time": "2021-06-21T21:25:28-04:00",
              "status": "passed"
            },
            {
              "code_desc": "File /var/lib/rancher/k3s/server/tls//client-controller.crt is expected not to be more permissive than \"0644\"",
              "resource_class": "file",
              "resource_params": "[\"/var/lib/rancher/k3s/server/tls//client-controller.crt\"]",
              "run_time": 0.548643186,
              "start_time": "2021-06-21T21:25:28-04:00",
              "status": "passed"
            },
            {
              "code_desc": "File /var/lib/rancher/k3s/server/tls//client-auth-proxy.crt is expected not to be more permissive than \"0644\"",
              "resource_class": "file",
              "resource_params": "[\"/var/lib/rancher/k3s/server/tls//client-auth-proxy.crt\"]",
              "run_time": 0.4748204,
              "start_time": "2021-06-21T21:25:29-04:00",
              "status": "passed"
            },
            {
              "code_desc": "File /var/lib/rancher/k3s/server/tls//server-ca.crt is expected not to be more permissive than \"0644\"",
              "resource_class": "file",
              "resource_params": "[\"/var/lib/rancher/k3s/server/tls//server-ca.crt\"]",
              "run_time": 0.524964153,
              "start_time": "2021-06-21T21:25:29-04:00",
              "status": "passed"
            },
            {
              "code_desc": "File /var/lib/rancher/k3s/server/tls//temporary-certs/apiserver-loopback-client__.crt is expected not to be more permissive than \"0644\"",
              "resource_class": "file",
              "resource_params": "[\"/var/lib/rancher/k3s/server/tls//temporary-certs/apiserver-loopback-client__.crt\"]",
              "run_time": 0.503823793,
              "start_time": "2021-06-21T21:25:30-04:00",
              "status": "passed"
            }
          ],
          "source_location": {
            "line": 3,
            "ref": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242466.rb"
          },
          "tags": {
            "cci": ["CCI-000366"],
            "fix_id": "F-45699r712753_fix",
            "gid": "V-242466",
            "gtitle": "SRG-APP-000516-CTR-001335",
            "nist": ["CM-6 b"],
            "rid": "SV-242466r712754_rule",
            "severity": "medium",
            "stig_id": "CNTR-K8-003330"
          },
          "title": "The Kubernetes PKI CRT must have file permissions set to 644 or more\nrestrictive.",
          "waiver_data": {}
        },
        {
          "code": "control 'V-242467' do\n  title \"The Kubernetes PKI keys must have file permissions set to 600 or more\nrestrictive.\"\n  desc  \"The Kubernetes PKI directory contains all certificate key files\nsupporting secure network communications in the Kubernetes Control Plane. If\nthese files can be modified, data traversing within the architecture components\nwould become unsecure and compromised.\"\n  desc  'rationale', ''\n  desc  'check', \"\n    Review the permissions of the Kubernetes PKI key files by using the command:\n\n    find /etc/kubernetes/pki -name \\\"*.key\\\" | xargs stat -c '%n %a'\n\n    If any of the files are have permissions more permissive than \\\"600\\\", this\nis a finding.\n  \"\n  desc 'fix', \"\n    Change the ownership of the cert files to \\\"600\\\" by executing the command:\n\n    chmod -R 600 /etc/kubernetes/pki/*.key\n  \"\n  impact 0.5\n  tag severity: 'medium'\n  tag gtitle: 'SRG-APP-000516-CTR-001335'\n  tag gid: 'V-242467'\n  tag rid: 'SV-242467r712757_rule'\n  tag stig_id: 'CNTR-K8-003340'\n  tag fix_id: 'F-45700r712756_fix'\n  tag cci: ['CCI-000366']\n  tag nist: ['CM-6 b']\n\n  pki_path = input('pki_path')\n  pki_files = command(\"find #{pki_path}/ -name \\\"*.key\\\"\").stdout.split\n\n  if pki_files.empty?\n    desc 'caveat', \"Kubernetes PKI files not present of the target at specified path #{pki_path}.\"\n\n    describe \"Kubernetes PKI files not present of the target at specified path #{pki_path}.\" do\n      skip\n    end\n  end\n\n  pki_files.each do |file_name|\n    describe file(file_name) do\n      it { should_not be_more_permissive_than('0600') }\n    end\n  end\nend\n",
          "desc": "The Kubernetes PKI directory contains all certificate key files\nsupporting secure network communications in the Kubernetes Control Plane. If\nthese files can be modified, data traversing within the architecture components\nwould become unsecure and compromised.",
          "descriptions": [
            {
              "data": "The Kubernetes PKI directory contains all certificate key files\nsupporting secure network communications in the Kubernetes Control Plane. If\nthese files can be modified, data traversing within the architecture components\nwould become unsecure and compromised.",
              "label": "default"
            },
            {
              "data": "",
              "label": "rationale"
            },
            {
              "data": "Review the permissions of the Kubernetes PKI key files by using the command:\n\n    find /etc/kubernetes/pki -name \"*.key\" | xargs stat -c '%n %a'\n\n    If any of the files are have permissions more permissive than \"600\", this\nis a finding.",
              "label": "check"
            },
            {
              "data": "Change the ownership of the cert files to \"600\" by executing the command:\n\nchmod -R 600 /etc/kubernetes/pki/*.key",
              "label": "fix"
            }
          ],
          "id": "V-242467",
          "impact": 0.5,
          "refs": [],
          "results": [
            {
              "code_desc": "File /var/lib/rancher/k3s/server/tls//client-kube-apiserver.key is expected not to be more permissive than \"0600\"",
              "resource_class": "file",
              "resource_params": "[\"/var/lib/rancher/k3s/server/tls//client-kube-apiserver.key\"]",
              "run_time": 0.495789691,
              "start_time": "2021-06-21T21:25:15-04:00",
              "status": "passed"
            }
          ],
          "source_location": {
            "line": 3,
            "ref": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242467.rb"
          },
          "tags": {
            "cci": ["CCI-000366"],
            "fix_id": "F-45700r712756_fix",
            "gid": "V-242467",
            "gtitle": "SRG-APP-000516-CTR-001335",
            "nist": ["CM-6 b"],
            "rid": "SV-242467r712757_rule",
            "severity": "medium",
            "stig_id": "CNTR-K8-003340"
          },
          "title": "The Kubernetes PKI keys must have file permissions set to 600 or more\nrestrictive.",
          "waiver_data": {}
        },
        {
          "code": "control 'V-242468' do\n  title \"The Kubernetes API Server must prohibit communication using TLS\nversion 1.0 and 1.1, and SSL 2.0 and 3.0.\"\n  desc  \"The Kubernetes API Server will prohibit the use of SSL and\nunauthorized versions of TLS protocols to properly secure communication.\n\n    The use of unsupported protocol exposes vulnerabilities to Kubernetes by\nrogue traffic interceptions, man-in-the middle attacks, and impersonation of\nusers or services from the container platform runtime, registry, and keystore.\nTo enable the minimum version of TLS to be used by the Kubernetes API Server,\nthe setting \\\"tls-min-version\\\" must be set.\n\n    The container platform and its components will adhere to NIST 800-52R2.\n  \"\n  desc  'rationale', ''\n  desc  'check', \"\n    Change to the /etc/kubernetes/manifests directory on the Kubernetes Master\nNode. Run the command:\n\n    grep -i tls-min-version *\n\n    If the setting tls-min-version is not configured in the Kubernetes API\nServer manifest file or it is set to \\\"VersionTLS10\\\" or \\\"VersionTLS11\\\", this\nis a finding.\n  \"\n  desc 'fix', \"Edit the Kubernetes API Server manifest file in the\n/etc/kubernetes/manifests directory on the Kubernetes Master Node. Set the\nvalue of \\\"--tls-min-version\\\" to either \\\"VersionTLS12\\\" or higher.\"\n  impact 0.5\n  tag severity: 'medium'\n  tag gtitle: 'SRG-APP-000560-CTR-001340'\n  tag gid: 'V-242468'\n  tag rid: 'SV-242468r712760_rule'\n  tag stig_id: 'CNTR-K8-003350'\n  tag fix_id: 'F-45701r712759_fix'\n  tag cci: ['CCI-001453']\n  tag nist: ['AC-17 (2)']\n\n  unless kube_apiserver.exist?\n    impact 0.0\n    desc 'caveat', 'Kubernetes API Server process is not running on the target.'\n  end\n\n  describe kube_apiserver do\n    its('tls-min-version') { should_not be_nil }\n    its('tls-min-version') { should_not cmp 'VersionTLS10' }\n    its('tls-min-version') { should_not cmp 'VersionTLS11' }\n  end\nend\n",
          "desc": "The Kubernetes API Server will prohibit the use of SSL and\nunauthorized versions of TLS protocols to properly secure communication.\n\n    The use of unsupported protocol exposes vulnerabilities to Kubernetes by\nrogue traffic interceptions, man-in-the middle attacks, and impersonation of\nusers or services from the container platform runtime, registry, and keystore.\nTo enable the minimum version of TLS to be used by the Kubernetes API Server,\nthe setting \"tls-min-version\" must be set.\n\n    The container platform and its components will adhere to NIST 800-52R2.",
          "descriptions": [
            {
              "data": "The Kubernetes API Server will prohibit the use of SSL and\nunauthorized versions of TLS protocols to properly secure communication.\n\n    The use of unsupported protocol exposes vulnerabilities to Kubernetes by\nrogue traffic interceptions, man-in-the middle attacks, and impersonation of\nusers or services from the container platform runtime, registry, and keystore.\nTo enable the minimum version of TLS to be used by the Kubernetes API Server,\nthe setting \"tls-min-version\" must be set.\n\n    The container platform and its components will adhere to NIST 800-52R2.",
              "label": "default"
            },
            {
              "data": "",
              "label": "rationale"
            },
            {
              "data": "Change to the /etc/kubernetes/manifests directory on the Kubernetes Master\nNode. Run the command:\n\n    grep -i tls-min-version *\n\n    If the setting tls-min-version is not configured in the Kubernetes API\nServer manifest file or it is set to \"VersionTLS10\" or \"VersionTLS11\", this\nis a finding.",
              "label": "check"
            },
            {
              "data": "Edit the Kubernetes API Server manifest file in the\n/etc/kubernetes/manifests directory on the Kubernetes Master Node. Set the\nvalue of \"--tls-min-version\" to either \"VersionTLS12\" or higher.",
              "label": "fix"
            }
          ],
          "id": "V-242468",
          "impact": 0.5,
          "refs": [],
          "results": [
            {
              "code_desc": "Process arguments for k3s server tls-min-version is expected not to be nil",
              "resource_class": "kube_apiserver",
              "resource_params": "[]",
              "run_time": 0.007080203,
              "start_time": "2021-06-21T21:25:15-04:00",
              "status": "passed"
            },
            {
              "code_desc": "Process arguments for k3s server tls-min-version is expected not to cmp == \"VersionTLS10\"",
              "resource_class": "kube_apiserver",
              "resource_params": "[]",
              "run_time": 0.000218167,
              "start_time": "2021-06-21T21:25:15-04:00",
              "status": "passed"
            },
            {
              "code_desc": "Process arguments for k3s server tls-min-version is expected not to cmp == \"VersionTLS11\"",
              "resource_class": "kube_apiserver",
              "resource_params": "[]",
              "run_time": 0.000149453,
              "start_time": "2021-06-21T21:25:15-04:00",
              "status": "passed"
            }
          ],
          "source_location": {
            "line": 3,
            "ref": "/home/rnemonik/.inspec/cache/64f618e96910e06ffcd837ee04f7c0c85aa2d63b/controls/V-242468.rb"
          },
          "tags": {
            "cci": ["CCI-001453"],
            "fix_id": "F-45701r712759_fix",
            "gid": "V-242468",
            "gtitle": "SRG-APP-000560-CTR-001340",
            "nist": ["AC-17 (2)"],
            "rid": "SV-242468r712760_rule",
            "severity": "medium",
            "stig_id": "CNTR-K8-003350"
          },
          "title": "The Kubernetes API Server must prohibit communication using TLS\nversion 1.0 and 1.1, and SSL 2.0 and 3.0.",
          "waiver_data": {}
        }
      ],
      "copyright": "Defense Information Systems Agency (DISA)",
      "depends": [
        {
          "git": "https://gitlab.dsolab.io/scv-content/inspec/kubernetes/baselines/inspec-k8s-node.git",
          "name": "inspec-k8s-node",
          "status": "loaded"
        }
      ],
      "groups": [
        {
          "controls": ["V-242468"],
          "id": "controls/V-242468.rb"
        },
        {
          "controls": ["V-242467"],
          "id": "controls/V-242467.rb"
        },
        {
          "controls": ["V-242466"],
          "id": "controls/V-242466.rb"
        },
        {
          "controls": ["V-242465"],
          "id": "controls/V-242465.rb"
        },
        {
          "controls": ["V-242464"],
          "id": "controls/V-242464.rb"
        },
        {
          "controls": ["V-242463"],
          "id": "controls/V-242463.rb"
        },
        {
          "controls": ["V-242462"],
          "id": "controls/V-242462.rb"
        },
        {
          "controls": ["V-242461"],
          "id": "controls/V-242461.rb"
        },
        {
          "controls": ["V-242460"],
          "id": "controls/V-242460.rb"
        },
        {
          "controls": ["V-242459"],
          "id": "controls/V-242459.rb"
        },
        {
          "controls": ["V-242458"],
          "id": "controls/V-242458.rb"
        },
        {
          "controls": ["V-242457"],
          "id": "controls/V-242457.rb"
        },
        {
          "controls": ["V-242456"],
          "id": "controls/V-242456.rb"
        },
        {
          "controls": ["V-242455"],
          "id": "controls/V-242455.rb"
        },
        {
          "controls": ["V-242454"],
          "id": "controls/V-242454.rb"
        },
        {
          "controls": ["V-242453"],
          "id": "controls/V-242453.rb"
        },
        {
          "controls": ["V-242452"],
          "id": "controls/V-242452.rb"
        },
        {
          "controls": ["V-242451"],
          "id": "controls/V-242451.rb"
        },
        {
          "controls": ["V-242450"],
          "id": "controls/V-242450.rb"
        },
        {
          "controls": ["V-242449"],
          "id": "controls/V-242449.rb"
        },
        {
          "controls": ["V-242448"],
          "id": "controls/V-242448.rb"
        },
        {
          "controls": ["V-242447"],
          "id": "controls/V-242447.rb"
        },
        {
          "controls": ["V-242446"],
          "id": "controls/V-242446.rb"
        },
        {
          "controls": ["V-242445"],
          "id": "controls/V-242445.rb"
        },
        {
          "controls": ["V-242444"],
          "id": "controls/V-242444.rb"
        },
        {
          "controls": ["V-242441"],
          "id": "controls/V-242441.rb"
        },
        {
          "controls": ["V-242440"],
          "id": "controls/V-242440.rb"
        },
        {
          "controls": ["V-242439"],
          "id": "controls/V-242439.rb"
        },
        {
          "controls": ["V-242438"],
          "id": "controls/V-242438.rb"
        },
        {
          "controls": ["V-242436"],
          "id": "controls/V-242436.rb"
        },
        {
          "controls": ["V-242435"],
          "id": "controls/V-242435.rb"
        },
        {
          "controls": ["V-242434"],
          "id": "controls/V-242434.rb"
        },
        {
          "controls": ["V-242433"],
          "id": "controls/V-242433.rb"
        },
        {
          "controls": ["V-242432"],
          "id": "controls/V-242432.rb"
        },
        {
          "controls": ["V-242431"],
          "id": "controls/V-242431.rb"
        },
        {
          "controls": ["V-242430"],
          "id": "controls/V-242430.rb"
        },
        {
          "controls": ["V-242429"],
          "id": "controls/V-242429.rb"
        },
        {
          "controls": ["V-242428"],
          "id": "controls/V-242428.rb"
        },
        {
          "controls": ["V-242427"],
          "id": "controls/V-242427.rb"
        },
        {
          "controls": ["V-242426"],
          "id": "controls/V-242426.rb"
        },
        {
          "controls": ["V-242425"],
          "id": "controls/V-242425.rb"
        },
        {
          "controls": ["V-242424"],
          "id": "controls/V-242424.rb"
        },
        {
          "controls": ["V-242423"],
          "id": "controls/V-242423.rb"
        },
        {
          "controls": ["V-242422"],
          "id": "controls/V-242422.rb"
        },
        {
          "controls": ["V-242421"],
          "id": "controls/V-242421.rb"
        },
        {
          "controls": ["V-242420"],
          "id": "controls/V-242420.rb"
        },
        {
          "controls": ["V-242419"],
          "id": "controls/V-242419.rb"
        },
        {
          "controls": ["V-242418"],
          "id": "controls/V-242418.rb"
        },
        {
          "controls": ["V-242416"],
          "id": "controls/V-242416.rb"
        },
        {
          "controls": ["V-242409"],
          "id": "controls/V-242409.rb"
        },
        {
          "controls": ["V-242408"],
          "id": "controls/V-242408.rb"
        },
        {
          "controls": ["V-242407"],
          "id": "controls/V-242407.rb"
        },
        {
          "controls": ["V-242406"],
          "id": "controls/V-242406.rb"
        },
        {
          "controls": ["V-242405"],
          "id": "controls/V-242405.rb"
        },
        {
          "controls": ["V-242404"],
          "id": "controls/V-242404.rb"
        },
        {
          "controls": ["V-242403"],
          "id": "controls/V-242403.rb"
        },
        {
          "controls": ["V-242402"],
          "id": "controls/V-242402.rb"
        },
        {
          "controls": ["V-242401"],
          "id": "controls/V-242401.rb"
        },
        {
          "controls": ["V-242400"],
          "id": "controls/V-242400.rb"
        },
        {
          "controls": ["V-242399"],
          "id": "controls/V-242399.rb"
        },
        {
          "controls": ["V-242398"],
          "id": "controls/V-242398.rb"
        },
        {
          "controls": ["V-242397"],
          "id": "controls/V-242397.rb"
        },
        {
          "controls": ["V-242396"],
          "id": "controls/V-242396.rb"
        },
        {
          "controls": ["V-242394"],
          "id": "controls/V-242394.rb"
        },
        {
          "controls": ["V-242393"],
          "id": "controls/V-242393.rb"
        },
        {
          "controls": ["V-242392"],
          "id": "controls/V-242392.rb"
        },
        {
          "controls": ["V-242391"],
          "id": "controls/V-242391.rb"
        },
        {
          "controls": ["V-242390"],
          "id": "controls/V-242390.rb"
        },
        {
          "controls": ["V-242389"],
          "id": "controls/V-242389.rb"
        },
        {
          "controls": ["V-242388"],
          "id": "controls/V-242388.rb"
        },
        {
          "controls": ["V-242387"],
          "id": "controls/V-242387.rb"
        },
        {
          "controls": ["V-242386"],
          "id": "controls/V-242386.rb"
        },
        {
          "controls": ["V-242385"],
          "id": "controls/V-242385.rb"
        },
        {
          "controls": ["V-242384"],
          "id": "controls/V-242384.rb"
        },
        {
          "controls": ["V-242382"],
          "id": "controls/V-242382.rb"
        },
        {
          "controls": ["V-242381"],
          "id": "controls/V-242381.rb"
        },
        {
          "controls": ["V-242380"],
          "id": "controls/V-242380.rb"
        },
        {
          "controls": ["V-242379"],
          "id": "controls/V-242379.rb"
        },
        {
          "controls": ["V-242378"],
          "id": "controls/V-242378.rb"
        },
        {
          "controls": ["V-242377"],
          "id": "controls/V-242377.rb"
        },
        {
          "controls": ["V-242376"],
          "id": "controls/V-242376.rb"
        }
      ],
      "license": "Apache-2.0",
      "maintainer": "DISA DevSecOps Team",
      "name": "k8s-node-stig-baseline",
      "parent_profile": "k3s-node-stig-baseline",
      "sha256": "45c143d5b9e90fb90b77de0203798b1bbf931710e8442d357b48ab3bfdd26c52",
      "status": "loaded",
      "status_message": "",
      "summary": "InSpec testing for baseline compliance with the Kubernetes STIG Node OS Checks.",
      "supports": [
        {
          "platform-family": "linux"
        }
      ],
      "title": "Kubernetes 1.16 Based upon Kubernetes 1.16 Security Technical Implementation Guideline (STIG) Node OS Checks.",
      "version": "1.0.0"
    },
    {
      "attributes": [],
      "controls": [],
      "copyright": "Defense Information Systems Agency (DISA)",
      "groups": [],
      "license": "Apache-2.0",
      "maintainer": "DISA DevSecOps Team",
      "name": "inspec-k8s-node",
      "parent_profile": "k8s-node-stig-baseline",
      "sha256": "4d03d04dc5a14f6e3a6e90c8c1db3a66dd18aea9dec3388756945165bbf67125",
      "status": "loaded",
      "status_message": "",
      "summary": "InSpec testing modules for compliance evaluation with the Kubernetes STIG Node OS Checks.",
      "supports": [
        {
          "platform-family": "linux"
        }
      ],
      "title": "Kubernetes InSpec Resource Pack for Node OS Config Checks.",
      "version": "1.0.0"
    }
  ],
  "statistics": {
    "duration": 19.04636403
  },
  "version": "4.37.20"
}