| 1.1.4 Ensure that the controller manager pod specification file ownership is set to root:root | CIS Kubernetes v1.23 Benchmark v1.0.1 L1 Master | Unix | ACCESS CONTROL |
| 1.1.4 Ensure that the controller manager pod specification file ownership is set to root:root | CIS Kubernetes v1.24 Benchmark v1.0.0 L1 Master | Unix | ACCESS CONTROL |
| 1.1.5 Ensure that the scheduler pod specification file permissions are set to 600 or more restrictive | CIS Kubernetes v1.23 Benchmark v1.0.1 L1 Master | Unix | ACCESS CONTROL, MEDIA PROTECTION |
| 1.1.6 Ensure that the scheduler pod specification file ownership is set to root:root | CIS Kubernetes v1.24 Benchmark v1.0.0 L1 Master | Unix | ACCESS CONTROL |
| 1.1.6 Ensure that the scheduler pod specification file ownership is set to root:root | CIS Kubernetes v1.23 Benchmark v1.0.1 L1 Master | Unix | ACCESS CONTROL |
| 1.1.20 Ensure that the Kubernetes PKI certificate file permissions are set to 600 or more restrictive | CIS Kubernetes v1.23 Benchmark v1.0.1 L1 Master | Unix | ACCESS CONTROL |
| 1.1.20 Ensure that the Kubernetes PKI certificate file permissions are set to 600 or more restrictive | CIS Kubernetes v1.24 Benchmark v1.0.0 L1 Master | Unix | ACCESS CONTROL |
| 1.1.21 Ensure that the Kubernetes PKI key file permissions are set to 600 | CIS Kubernetes v1.24 Benchmark v1.0.0 L1 Master | Unix | ACCESS CONTROL, MEDIA PROTECTION |
| 1.1.21 Ensure that the Kubernetes PKI key file permissions are set to 600 | CIS Kubernetes v1.23 Benchmark v1.0.1 L1 Master | Unix | ACCESS CONTROL, MEDIA PROTECTION |
| 1.4.9 Ensure that the Container Network Interface file permissions are set to 644 or more restrictive | CIS Kubernetes 1.11 Benchmark v1.3.0 L1 | Unix | CONFIGURATION MANAGEMENT |
| 1.4.9 Ensure that the Container Network Interface file permissions are set to 644 or more restrictive | CIS Kubernetes 1.8 Benchmark v1.2.0 L1 | Unix | CONFIGURATION MANAGEMENT |
| 1.4.10 Ensure that the Container Network Interface file ownership is set to root:root | CIS Kubernetes 1.11 Benchmark v1.3.0 L1 | Unix | CONFIGURATION MANAGEMENT |
| 1.4.10 Ensure that the Container Network Interface file ownership is set to root:root | CIS Kubernetes 1.8 Benchmark v1.2.0 L1 | Unix | CONFIGURATION MANAGEMENT |
| 1.4.10 Ensure that the flanneld file ownership is set to root:root | CIS Kubernetes 1.7.0 Benchmark v1.1.0 L1 | Unix | CONFIGURATION MANAGEMENT |
| 2.1.10 Ensure that the --hostname-override argument is not set | CIS Kubernetes 1.7.0 Benchmark v1.1.0 L1 | Unix | CONFIGURATION MANAGEMENT |
| 2.4 Ensure that the --peer-cert-file and --peer-key-file arguments are set as appropriate - cert | CIS Kubernetes v1.20 Benchmark v1.0.1 L1 Master | Unix | IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 2.4 Ensure that the --peer-cert-file and --peer-key-file arguments are set as appropriate - cert | CIS Kubernetes v1.23 Benchmark v1.0.1 L1 Master | Unix | IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 2.4 Ensure that the --peer-cert-file and --peer-key-file arguments are set as appropriate - cert | CIS Kubernetes v1.24 Benchmark v1.0.0 L1 Master | Unix | IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 2.4 Ensure that the --peer-cert-file and --peer-key-file arguments are set as appropriate - key | CIS Kubernetes v1.24 Benchmark v1.0.0 L1 Master | Unix | IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 2.4 Ensure that the --peer-cert-file and --peer-key-file arguments are set as appropriate - key | CIS Kubernetes v1.20 Benchmark v1.0.1 L1 Master | Unix | IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 4.1.2 Ensure that the kubelet service file ownership is set to root:root | CIS Kubernetes v2.1.0 L1 Worker Node | Unix | ACCESS CONTROL |
| 4.1.3 If proxy kubeconfig file exists ensure permissions are set to 600 or more restrictive | CIS Kubernetes v2.1.0 L1 Worker Node | Unix | ACCESS CONTROL, MEDIA PROTECTION |
| 4.1.4 If proxy kubeconfig file exists ensure ownership is set to root:root | CIS Kubernetes v2.1.0 L1 Worker Node | Unix | ACCESS CONTROL |
| 4.1.5 Ensure that the --kubeconfig kubelet.conf file permissions are set to 600 or more restrictive | CIS Kubernetes v2.1.0 L1 Worker Node | Unix | ACCESS CONTROL, MEDIA PROTECTION |
| 4.1.6 Ensure that the --kubeconfig kubelet.conf file ownership is set to root:root | CIS Kubernetes v2.1.0 L1 Worker Node | Unix | ACCESS CONTROL |
| 4.1.7 Ensure that the certificate authorities file permissions are set to 644 or more restrictive | CIS Kubernetes v2.1.0 L1 Worker Node | Unix | ACCESS CONTROL, MEDIA PROTECTION |
| 4.1.8 Ensure that the client certificate authorities file ownership is set to root:root | CIS Kubernetes v2.1.0 L1 Worker Node | Unix | ACCESS CONTROL |
| 4.1.9 If the kubelet config.yaml configuration file is being used validate permissions set to 600 or more restrictive | CIS Kubernetes v2.1.0 L1 Worker Node | Unix | ACCESS CONTROL, MEDIA PROTECTION |
| 4.1.10 If the kubelet config.yaml configuration file is being used validate file ownership is set to root:root | CIS Kubernetes v2.1.0 L1 Worker Node | Unix | ACCESS CONTROL |
| 4.1.11 Ensure that the kubelet drop-in configuration directory and files have restrictive permissions | CIS Kubernetes v2.1.0 L1 Worker Node | Unix | ACCESS CONTROL, MEDIA PROTECTION |
| 4.2.1 Ensure that the --anonymous-auth argument is set to false | CIS Kubernetes v2.1.0 L1 Worker Node | Unix | ACCESS CONTROL, MEDIA PROTECTION |
| 4.2.2 Ensure that the --authorization-mode argument is not set to AlwaysAllow | CIS Kubernetes v2.1.0 L1 Worker Node | Unix | ACCESS CONTROL, MEDIA PROTECTION |
| 4.2.3 Ensure that the --client-ca-file argument is set as appropriate | CIS Kubernetes v2.1.0 L1 Worker Node | Unix | ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 4.2.4 Verify that if defined, readOnlyPort is set to 0 | CIS Kubernetes v2.1.0 L1 Worker Node | Unix | CONFIGURATION MANAGEMENT |
| 4.2.5 Ensure that the --streaming-connection-idle-timeout argument is not set to 0 | CIS Kubernetes v2.1.0 L1 Worker Node | Unix | SYSTEM AND INFORMATION INTEGRITY |
| 4.2.6 Ensure that the --make-iptables-util-chains argument is set to true | CIS Kubernetes v2.1.0 L1 Worker Node | Unix | CONFIGURATION MANAGEMENT |
| 4.2.7 Ensure that the --hostname-override argument is not set | CIS Kubernetes v2.1.0 L1 Worker Node | Unix | CONFIGURATION MANAGEMENT |
| 4.2.9 Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate | CIS Kubernetes v2.1.0 L1 Worker Node | Unix | ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 4.2.10 Ensure that the --rotate-certificates argument is not set to false | CIS Kubernetes v2.1.0 L1 Worker Node | Unix | ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 4.2.11 Verify that the RotateKubeletServerCertificate argument is set to true | CIS Kubernetes v2.1.0 L1 Worker Node | Unix | ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 4.2.12 Ensure that the Kubelet only makes use of Strong Cryptographic Ciphers | CIS Kubernetes v2.1.0 L1 Worker Node | Unix | CONFIGURATION MANAGEMENT |
| 4.2.13 Ensure that a limit is set on pod PIDs | CIS Kubernetes v2.1.0 L1 Worker Node | Unix | SYSTEM AND SERVICES ACQUISITION |
| 4.2.14 Ensure that the --seccomp-default parameter is set to true | CIS Kubernetes v2.1.0 L1 Worker Node | Unix | SYSTEM AND INFORMATION INTEGRITY |
| 4.3.1 Ensure that the kube-proxy metrics service is bound to localhost | CIS Kubernetes v2.1.0 L1 Worker Node | Unix | ACCESS CONTROL, SYSTEM AND COMMUNICATIONS PROTECTION |
| 5.1.3 Minimize wildcard use in Roles and ClusterRoles | CIS Kubernetes v2.1.0 L1 Worker Node | Unix | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY |
| 5.7.1 Create administrative boundaries between resources using namespaces | CIS Kubernetes v1.23 Benchmark v1.0.1 L1 Master | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
| 5.7.1 Create administrative boundaries between resources using namespaces | CIS Kubernetes v1.20 Benchmark v1.0.1 L1 Master | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
| 5.7.1 Create administrative boundaries between resources using namespaces | CIS Kubernetes v1.24 Benchmark v1.0.0 L1 Master | Unix | SYSTEM AND COMMUNICATIONS PROTECTION |
| CNTR-K8-000380 - The Kubernetes kubelet must enable explicit authorization. | DISA Kubernetes STIG v2r6 | Unix | ACCESS CONTROL |
| CNTR-R2-001270 - Rancher RKE2 must prohibit the installation of patches, updates, and instantiation of container images without explicit privileged status. | DISA Rancher Government Solutions RKE2 STIG v2r7 | Unix | CONFIGURATION MANAGEMENT |
