Worker nodes should be safer by default, conform to the CIS Kubernetes Benchmark

[judge-red]

I first wrote this in the kubermatic project put then realized this should probably go here so I copied the text. While my primary concern when writing this was with a KKP UC's worker nodes, and the output below is from a Kubernetes 1.31.3 cluster on KKP 2.26.1, I have the same concerns about KubeOne cluster worker nodes.

Description of the feature you would like to add

Once again I've run the CIS Kubernetes Benchmark (specifically Aqua Security's kube-bench tool, executed through the job manifest) and while I think you've addressed some open points in the past, several are still open. It's rather concerning particularly because they seem to be low-hanging fruits, as far as my understanding goes, but maybe things are more complicated than they seem.

Our end users are getting louder about this as well, as the focus on security in general keeps increasing for good reason.

Solution details

Nothing specific, but all the FAILs of the kube-bench run should be addressed (bonus points for any WARN that is addressed as well, if there's anything to do):

$ k logs kube-bench-npwmp                                                                                                                                                                                         
[INFO] 4 Worker Node Security Configuration                                                                                                                                                                       
[INFO] 4.1 Worker Node Configuration Files                                                                                                                                                                        
[FAIL] 4.1.1 Ensure that the kubelet service file permissions are set to 600 or more restrictive (Automated)                                                                                                      
[PASS] 4.1.2 Ensure that the kubelet service file ownership is set to root:root (Automated)                                                                                                                       
[PASS] 4.1.3 If proxy kubeconfig file exists ensure permissions are set to 600 or more restrictive (Manual)                                                                                                       
[PASS] 4.1.4 If proxy kubeconfig file exists ensure ownership is set to root:root (Manual)                                                                                                                        
[FAIL] 4.1.5 Ensure that the --kubeconfig kubelet.conf file permissions are set to 600 or more restrictive (Automated)                                                                                            
[PASS] 4.1.6 Ensure that the --kubeconfig kubelet.conf file ownership is set to root:root (Automated)                                                                                                             
[WARN] 4.1.7 Ensure that the certificate authorities file permissions are set to 600 or more restrictive (Manual)                                                                                                 
[PASS] 4.1.8 Ensure that the client certificate authorities file ownership is set to root:root (Manual)                                                                                                           
[PASS] 4.1.9 If the kubelet config.yaml configuration file is being used validate permissions set to 600 or more restrictive (Automated)                                                                          
[PASS] 4.1.10 If the kubelet config.yaml configuration file is being used validate file ownership is set to root:root (Automated)                                                                                 
[INFO] 4.2 Kubelet                                                                                                                                                                                                
[FAIL] 4.2.1 Ensure that the --anonymous-auth argument is set to false (Automated)                                                                                                                                
[FAIL] 4.2.2 Ensure that the --authorization-mode argument is not set to AlwaysAllow (Automated)                                                                                                                  
[FAIL] 4.2.3 Ensure that the --client-ca-file argument is set as appropriate (Automated)                                                                                                                          
[PASS] 4.2.4 Verify that the --read-only-port argument is set to 0 (Manual)                                                                                                                                       
[PASS] 4.2.5 Ensure that the --streaming-connection-idle-timeout argument is not set to 0 (Manual)                                                                                                                
[PASS] 4.2.6 Ensure that the --make-iptables-util-chains argument is set to true (Automated)                                                                                                                      
[WARN] 4.2.7 Ensure that the --hostname-override argument is not set (Manual)                                                                                                                                     
[PASS] 4.2.8 Ensure that the eventRecordQPS argument is set to a level which ensures appropriate event capture (Manual)                                                                                           
[WARN] 4.2.9 Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate (Manual)                                                                                                 
[PASS] 4.2.10 Ensure that the --rotate-certificates argument is not set to false (Automated)                                                                                                                      
[PASS] 4.2.11 Verify that the RotateKubeletServerCertificate argument is set to true (Manual)                                                                                                                     
[WARN] 4.2.12 Ensure that the Kubelet only makes use of Strong Cryptographic Ciphers (Manual)                                                                                                                     
[WARN] 4.2.13 Ensure that a limit is set on pod PIDs (Manual)                                                                                                                                                     
[INFO] 4.3 kube-proxy                                                                                                                                                                                             
[FAIL] 4.3.1 Ensure that the kube-proxy metrics service is bound to localhost (Automated)   

== Remediations node ==                                                                                                                                                                                           
4.1.1 Run the below command (based on the file location on your system) on the each worker node.                                                                                                                  
For example, chmod 600 /etc/systemd/system/kubelet.service                                               
                                                                                                                                                                                                                  
4.1.5 Run the below command (based on the file location on your system) on the each worker node.                                                                                                                  
For example,                                                                                                                                                                                                      
chmod 600 /etc/kubernetes/kubelet.conf                                                                                                                                                                            
                                                                                                                                                                                                                  
4.1.7 Run the following command to modify the file permissions of the                                                                                                                                             
--client-ca-file chmod 600 <filename>                                                                    
                                                                                                         
4.2.1 If using a Kubelet config file, edit the file to set `authentication: anonymous: enabled` to
`false`.                                                                                                 
If using executable arguments, edit the kubelet service file
/etc/systemd/system/kubelet.service on each worker node and
set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable.
`--anonymous-auth=false`
Based on your system, restart the kubelet service. For example,
systemctl daemon-reload
systemctl restart kubelet.service

4.2.2 If using a Kubelet config file, edit the file to set `authorization.mode` to Webhook. If
using executable arguments, edit the kubelet service file
/etc/systemd/system/kubelet.service on each worker node and
set the below parameter in KUBELET_AUTHZ_ARGS variable.
--authorization-mode=Webhook
Based on your system, restart the kubelet service. For example,
systemctl daemon-reload
systemctl restart kubelet.service

4.2.3 If using a Kubelet config file, edit the file to set `authentication.x509.clientCAFile` to
the location of the client CA file.
If using command line arguments, edit the kubelet service file
/etc/systemd/system/kubelet.service on each worker node and
set the below parameter in KUBELET_AUTHZ_ARGS variable.
--client-ca-file=<path/to/client-ca-file>
Based on your system, restart the kubelet service. For example,
systemctl daemon-reload
systemctl restart kubelet.service

4.2.7 Edit the kubelet service file /etc/systemd/system/kubelet.service
on each worker node and remove the --hostname-override argument from the
KUBELET_SYSTEM_PODS_ARGS variable.
Based on your system, restart the kubelet service. For example,
systemctl daemon-reload
systemctl restart kubelet.service

4.2.9 If using a Kubelet config file, edit the file to set `tlsCertFile` to the location
of the certificate file to use to identify this Kubelet, and `tlsPrivateKeyFile`
to the location of the corresponding private key file.
If using command line arguments, edit the kubelet service file
/etc/systemd/system/kubelet.service on each worker node and
set the below parameters in KUBELET_CERTIFICATE_ARGS variable.
--tls-cert-file=<path/to/tls-certificate-file>
--tls-private-key-file=<path/to/tls-key-file>
Based on your system, restart the kubelet service. For example,
systemctl daemon-reload
systemctl restart kubelet.service

4.2.12 If using a Kubelet config file, edit the file to set `tlsCipherSuites` to
TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WI
TH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256
or to a subset of these values.
If using executable arguments, edit the kubelet service file
/etc/systemd/system/kubelet.service on each worker node and
set the --tls-cipher-suites parameter as follows, or to a subset of these values.
--tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY130
5,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 
Based on your system, restart the kubelet service. For example:
systemctl daemon-reload
systemctl restart kubelet.service

4.2.13 Decide on an appropriate level for this parameter and set it,
either via the --pod-max-pids command line parameter or the PodPidsLimit configuration file setting.

4.3.1 Modify or remove any values which bind the metrics service to a non-localhost address.
The default value is 127.0.0.1:10249.

== Summary node ==
13 checks PASS
6 checks FAIL
5 checks WARN
0 checks INFO

Note that the benchmark also another suite of tests aimed at policies rather than nodes, which I consider out of scope here (and didn't include the output above) - this is just about the node security.

Alternative approaches

Maybe we could solve most of these ourselves with a custom OSP, but not sure that's the right place for everything in the first place.

Use cases

Well, security is important, and the CIS Kubernetes Benchmark is well recognized.

Additional information