diff --git a/404.html b/404.html index 9852a4500..a918859f1 100644 --- a/404.html +++ b/404.html @@ -4,8 +4,8 @@ K3s - - + +
Skip to main content

Page Not Found

We could not find what you were looking for.

Please contact the owner of the site that linked you to the original URL and let them know their link is broken.

diff --git a/architecture.html b/architecture.html index b8b5bd914..9e87f83f2 100644 --- a/architecture.html +++ b/architecture.html @@ -4,8 +4,8 @@ Architecture | K3s - - + +
Skip to main content

Architecture

Servers and Agents​

@@ -36,7 +36,7 @@

Edit this page
Last updated on

diff --git a/assets/js/0480b142.c9f63c69.js b/assets/js/0480b142.4cd19da1.js similarity index 99% rename from assets/js/0480b142.c9f63c69.js rename to assets/js/0480b142.4cd19da1.js index d7f0e0655..1b6354ee7 100644 --- a/assets/js/0480b142.c9f63c69.js +++ b/assets/js/0480b142.4cd19da1.js @@ -1 +1 @@ -"use strict";(self.webpackChunkk_3_s_docs=self.webpackChunkk_3_s_docs||[]).push([[836],{9665:(e,n,s)=>{s.r(n),s.d(n,{assets:()=>l,contentTitle:()=>o,default:()=>h,frontMatter:()=>t,metadata:()=>a,toc:()=>d});var i=s(5893),r=s(1151);const t={title:"FAQ"},o=void 0,a={id:"faq",title:"FAQ",description:"The FAQ is updated periodically and designed to answer the questions our users most frequently ask about K3s.",source:"@site/docs/faq.md",sourceDirName:".",slug:"/faq",permalink:"/faq",draft:!1,unlisted:!1,editUrl:"https://github.com/k3s-io/docs/edit/main/docs/faq.md",tags:[],version:"current",lastUpdatedAt:1723651727e3,frontMatter:{title:"FAQ"},sidebar:"mySidebar",previous:{title:"Known Issues",permalink:"/known-issues"}},l={},d=[{value:"Is K3s a suitable replacement for Kubernetes?",id:"is-k3s-a-suitable-replacement-for-kubernetes",level:3},{value:"How can I use my own Ingress instead of Traefik?",id:"how-can-i-use-my-own-ingress-instead-of-traefik",level:3},{value:"Does K3s support Windows?",id:"does-k3s-support-windows",level:3},{value:"What exactly are Servers and Agents?",id:"what-exactly-are-servers-and-agents",level:3},{value:"How can I build from source?",id:"how-can-i-build-from-source",level:3},{value:"Where are the K3s logs?",id:"where-are-the-k3s-logs",level:3},{value:"Can I run K3s in Docker?",id:"can-i-run-k3s-in-docker",level:3},{value:"What is the difference between K3s Server and Agent Tokens?",id:"what-is-the-difference-between-k3s-server-and-agent-tokens",level:3},{value:"How compatible are different versions of K3s?",id:"how-compatible-are-different-versions-of-k3s",level:3},{value:"I'm having an issue, where can I get help?",id:"im-having-an-issue-where-can-i-get-help",level:3}];function c(e){const n={a:"a",code:"code",h3:"h3",li:"li",ol:"ol",p:"p",ul:"ul",...(0,r.a)(),...e.components};return(0,i.jsxs)(i.Fragment,{children:[(0,i.jsx)(n.p,{children:"The FAQ is updated periodically and designed to answer the questions our users most frequently ask about K3s."}),"\n",(0,i.jsx)(n.h3,{id:"is-k3s-a-suitable-replacement-for-kubernetes",children:"Is K3s a suitable replacement for Kubernetes?"}),"\n",(0,i.jsxs)(n.p,{children:["K3s is a CNCF-certified Kubernetes distribution, and can do everything required of a standard Kubernetes cluster. It is just a more lightweight version. See the ",(0,i.jsx)(n.a,{href:"/",children:"main"})," docs page for more details."]}),"\n",(0,i.jsx)(n.h3,{id:"how-can-i-use-my-own-ingress-instead-of-traefik",children:"How can I use my own Ingress instead of Traefik?"}),"\n",(0,i.jsxs)(n.p,{children:["Simply start K3s server with ",(0,i.jsx)(n.code,{children:"--disable=traefik"})," and deploy your ingress."]}),"\n",(0,i.jsx)(n.h3,{id:"does-k3s-support-windows",children:"Does K3s support Windows?"}),"\n",(0,i.jsx)(n.p,{children:"At this time K3s does not natively support Windows, however we are open to the idea in the future."}),"\n",(0,i.jsx)(n.h3,{id:"what-exactly-are-servers-and-agents",children:"What exactly are Servers and Agents?"}),"\n",(0,i.jsxs)(n.p,{children:["For a breakdown on the components that make up a server and agent, see the ",(0,i.jsx)(n.a,{href:"/architecture",children:"Architecture page"}),"."]}),"\n",(0,i.jsx)(n.h3,{id:"how-can-i-build-from-source",children:"How can I build from source?"}),"\n",(0,i.jsxs)(n.p,{children:["Please reference the K3s ",(0,i.jsx)(n.a,{href:"https://github.com/k3s-io/k3s/blob/master/BUILDING.md",children:"BUILDING.md"})," with instructions."]}),"\n",(0,i.jsx)(n.h3,{id:"where-are-the-k3s-logs",children:"Where are the K3s logs?"}),"\n",(0,i.jsx)(n.p,{children:"The location of K3s logs will vary depending on how you run K3s and the node's OS."}),"\n",(0,i.jsxs)(n.ul,{children:["\n",(0,i.jsx)(n.li,{children:"When run from the command line, logs are sent to stdout and stderr."}),"\n",(0,i.jsxs)(n.li,{children:["When running under openrc, logs will be created at ",(0,i.jsx)(n.code,{children:"/var/log/k3s.log"}),"."]}),"\n",(0,i.jsxs)(n.li,{children:["When running under Systemd, logs will be sent to Journald and can be viewed using ",(0,i.jsx)(n.code,{children:"journalctl -u k3s"}),"."]}),"\n",(0,i.jsxs)(n.li,{children:["Pod logs can be found at ",(0,i.jsx)(n.code,{children:"/var/log/pods"}),"."]}),"\n",(0,i.jsxs)(n.li,{children:["Containerd logs can be found at ",(0,i.jsx)(n.code,{children:"/var/lib/rancher/k3s/agent/containerd/containerd.log"}),"."]}),"\n"]}),"\n",(0,i.jsxs)(n.p,{children:["You can generate more detailed logs by using the ",(0,i.jsx)(n.code,{children:"--debug"})," flag when starting K3s (or ",(0,i.jsx)(n.code,{children:"debug: true"})," in the configuration file)."]}),"\n",(0,i.jsxs)(n.p,{children:["Kubernetes uses a logging framework known as ",(0,i.jsx)(n.code,{children:"klog"}),", which uses a single logging configuration for all components within a process.\nSince K3s runs all Kubernetes components within a single process, it is not possible to configure different log levels or destinations for individual Kubernetes components.\nUse of the ",(0,i.jsx)(n.code,{children:"-v="})," or ",(0,i.jsx)(n.code,{children:"--vmodule=="})," component args will likely not have the desired effect."]}),"\n",(0,i.jsxs)(n.p,{children:["See ",(0,i.jsx)(n.a,{href:"/advanced#additional-logging-sources",children:"Additional Logging Sources"})," for even more log options."]}),"\n",(0,i.jsx)(n.h3,{id:"can-i-run-k3s-in-docker",children:"Can I run K3s in Docker?"}),"\n",(0,i.jsxs)(n.p,{children:["Yes, there are multiple ways to run K3s in Docker. See ",(0,i.jsx)(n.a,{href:"/advanced#running-k3s-in-docker",children:"Advanced Options"})," for more details."]}),"\n",(0,i.jsx)(n.h3,{id:"what-is-the-difference-between-k3s-server-and-agent-tokens",children:"What is the difference between K3s Server and Agent Tokens?"}),"\n",(0,i.jsxs)(n.p,{children:["For more information on managing K3s join tokens, see the ",(0,i.jsxs)(n.a,{href:"/cli/token",children:[(0,i.jsx)(n.code,{children:"k3s token"})," command documentation"]}),"."]}),"\n",(0,i.jsx)(n.h3,{id:"how-compatible-are-different-versions-of-k3s",children:"How compatible are different versions of K3s?"}),"\n",(0,i.jsxs)(n.p,{children:["In general, the ",(0,i.jsx)(n.a,{href:"https://kubernetes.io/docs/setup/release/version-skew-policy/",children:"Kubernetes version skew policy"})," applies."]}),"\n",(0,i.jsx)(n.p,{children:"In short, servers can be newer than agents, but agents cannot be newer than servers."}),"\n",(0,i.jsx)(n.h3,{id:"im-having-an-issue-where-can-i-get-help",children:"I'm having an issue, where can I get help?"}),"\n",(0,i.jsx)(n.p,{children:"If you are having an issue with deploying K3s, you should:"}),"\n",(0,i.jsxs)(n.ol,{children:["\n",(0,i.jsxs)(n.li,{children:["\n",(0,i.jsxs)(n.p,{children:["Check the ",(0,i.jsx)(n.a,{href:"/known-issues",children:"Known Issues"})," page."]}),"\n"]}),"\n",(0,i.jsxs)(n.li,{children:["\n",(0,i.jsxs)(n.p,{children:["Check that you have resolved any ",(0,i.jsx)(n.a,{href:"/installation/requirements#operating-systems",children:"Additional OS Preparation"}),". Run ",(0,i.jsx)(n.code,{children:"k3s check-config"})," and ensure that it passes."]}),"\n"]}),"\n",(0,i.jsxs)(n.li,{children:["\n",(0,i.jsxs)(n.p,{children:["Search the K3s ",(0,i.jsx)(n.a,{href:"https://github.com/k3s-io/k3s/issues",children:"Issues"})," and ",(0,i.jsx)(n.a,{href:"https://github.com/k3s-io/k3s/discussions",children:"Discussions"})," for one that matches your problem."]}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(n.ol,{start:"4",children:["\n",(0,i.jsxs)(n.li,{children:["\n",(0,i.jsxs)(n.p,{children:["Join the ",(0,i.jsx)(n.a,{href:"https://slack.rancher.io/",children:"Rancher Slack"})," K3s channel to get help."]}),"\n"]}),"\n",(0,i.jsxs)(n.li,{children:["\n",(0,i.jsxs)(n.p,{children:["Submit a ",(0,i.jsx)(n.a,{href:"https://github.com/k3s-io/k3s/issues/new/choose",children:"New Issue"})," on the K3s Github describing your setup and the issue you are experiencing."]}),"\n"]}),"\n"]})]})}function h(e={}){const{wrapper:n}={...(0,r.a)(),...e.components};return n?(0,i.jsx)(n,{...e,children:(0,i.jsx)(c,{...e})}):c(e)}},1151:(e,n,s)=>{s.d(n,{Z:()=>a,a:()=>o});var i=s(7294);const r={},t=i.createContext(r);function o(e){const n=i.useContext(t);return i.useMemo((function(){return"function"==typeof e?e(n):{...n,...e}}),[n,e])}function a(e){let n;return n=e.disableParentContext?"function"==typeof e.components?e.components(r):e.components||r:o(e.components),i.createElement(t.Provider,{value:n},e.children)}}}]); \ No newline at end of file +"use strict";(self.webpackChunkk_3_s_docs=self.webpackChunkk_3_s_docs||[]).push([[836],{9665:(e,n,s)=>{s.r(n),s.d(n,{assets:()=>l,contentTitle:()=>o,default:()=>h,frontMatter:()=>t,metadata:()=>a,toc:()=>d});var i=s(5893),r=s(1151);const t={title:"FAQ"},o=void 0,a={id:"faq",title:"FAQ",description:"The FAQ is updated periodically and designed to answer the questions our users most frequently ask about K3s.",source:"@site/docs/faq.md",sourceDirName:".",slug:"/faq",permalink:"/faq",draft:!1,unlisted:!1,editUrl:"https://github.com/k3s-io/docs/edit/main/docs/faq.md",tags:[],version:"current",lastUpdatedAt:1723747404e3,frontMatter:{title:"FAQ"},sidebar:"mySidebar",previous:{title:"Known Issues",permalink:"/known-issues"}},l={},d=[{value:"Is K3s a suitable replacement for Kubernetes?",id:"is-k3s-a-suitable-replacement-for-kubernetes",level:3},{value:"How can I use my own Ingress instead of Traefik?",id:"how-can-i-use-my-own-ingress-instead-of-traefik",level:3},{value:"Does K3s support Windows?",id:"does-k3s-support-windows",level:3},{value:"What exactly are Servers and Agents?",id:"what-exactly-are-servers-and-agents",level:3},{value:"How can I build from source?",id:"how-can-i-build-from-source",level:3},{value:"Where are the K3s logs?",id:"where-are-the-k3s-logs",level:3},{value:"Can I run K3s in Docker?",id:"can-i-run-k3s-in-docker",level:3},{value:"What is the difference between K3s Server and Agent Tokens?",id:"what-is-the-difference-between-k3s-server-and-agent-tokens",level:3},{value:"How compatible are different versions of K3s?",id:"how-compatible-are-different-versions-of-k3s",level:3},{value:"I'm having an issue, where can I get help?",id:"im-having-an-issue-where-can-i-get-help",level:3}];function c(e){const n={a:"a",code:"code",h3:"h3",li:"li",ol:"ol",p:"p",ul:"ul",...(0,r.a)(),...e.components};return(0,i.jsxs)(i.Fragment,{children:[(0,i.jsx)(n.p,{children:"The FAQ is updated periodically and designed to answer the questions our users most frequently ask about K3s."}),"\n",(0,i.jsx)(n.h3,{id:"is-k3s-a-suitable-replacement-for-kubernetes",children:"Is K3s a suitable replacement for Kubernetes?"}),"\n",(0,i.jsxs)(n.p,{children:["K3s is a CNCF-certified Kubernetes distribution, and can do everything required of a standard Kubernetes cluster. It is just a more lightweight version. See the ",(0,i.jsx)(n.a,{href:"/",children:"main"})," docs page for more details."]}),"\n",(0,i.jsx)(n.h3,{id:"how-can-i-use-my-own-ingress-instead-of-traefik",children:"How can I use my own Ingress instead of Traefik?"}),"\n",(0,i.jsxs)(n.p,{children:["Simply start K3s server with ",(0,i.jsx)(n.code,{children:"--disable=traefik"})," and deploy your ingress."]}),"\n",(0,i.jsx)(n.h3,{id:"does-k3s-support-windows",children:"Does K3s support Windows?"}),"\n",(0,i.jsx)(n.p,{children:"At this time K3s does not natively support Windows, however we are open to the idea in the future."}),"\n",(0,i.jsx)(n.h3,{id:"what-exactly-are-servers-and-agents",children:"What exactly are Servers and Agents?"}),"\n",(0,i.jsxs)(n.p,{children:["For a breakdown on the components that make up a server and agent, see the ",(0,i.jsx)(n.a,{href:"/architecture",children:"Architecture page"}),"."]}),"\n",(0,i.jsx)(n.h3,{id:"how-can-i-build-from-source",children:"How can I build from source?"}),"\n",(0,i.jsxs)(n.p,{children:["Please reference the K3s ",(0,i.jsx)(n.a,{href:"https://github.com/k3s-io/k3s/blob/master/BUILDING.md",children:"BUILDING.md"})," with instructions."]}),"\n",(0,i.jsx)(n.h3,{id:"where-are-the-k3s-logs",children:"Where are the K3s logs?"}),"\n",(0,i.jsx)(n.p,{children:"The location of K3s logs will vary depending on how you run K3s and the node's OS."}),"\n",(0,i.jsxs)(n.ul,{children:["\n",(0,i.jsx)(n.li,{children:"When run from the command line, logs are sent to stdout and stderr."}),"\n",(0,i.jsxs)(n.li,{children:["When running under openrc, logs will be created at ",(0,i.jsx)(n.code,{children:"/var/log/k3s.log"}),"."]}),"\n",(0,i.jsxs)(n.li,{children:["When running under Systemd, logs will be sent to Journald and can be viewed using ",(0,i.jsx)(n.code,{children:"journalctl -u k3s"}),"."]}),"\n",(0,i.jsxs)(n.li,{children:["Pod logs can be found at ",(0,i.jsx)(n.code,{children:"/var/log/pods"}),"."]}),"\n",(0,i.jsxs)(n.li,{children:["Containerd logs can be found at ",(0,i.jsx)(n.code,{children:"/var/lib/rancher/k3s/agent/containerd/containerd.log"}),"."]}),"\n"]}),"\n",(0,i.jsxs)(n.p,{children:["You can generate more detailed logs by using the ",(0,i.jsx)(n.code,{children:"--debug"})," flag when starting K3s (or ",(0,i.jsx)(n.code,{children:"debug: true"})," in the configuration file)."]}),"\n",(0,i.jsxs)(n.p,{children:["Kubernetes uses a logging framework known as ",(0,i.jsx)(n.code,{children:"klog"}),", which uses a single logging configuration for all components within a process.\nSince K3s runs all Kubernetes components within a single process, it is not possible to configure different log levels or destinations for individual Kubernetes components.\nUse of the ",(0,i.jsx)(n.code,{children:"-v="})," or ",(0,i.jsx)(n.code,{children:"--vmodule=="})," component args will likely not have the desired effect."]}),"\n",(0,i.jsxs)(n.p,{children:["See ",(0,i.jsx)(n.a,{href:"/advanced#additional-logging-sources",children:"Additional Logging Sources"})," for even more log options."]}),"\n",(0,i.jsx)(n.h3,{id:"can-i-run-k3s-in-docker",children:"Can I run K3s in Docker?"}),"\n",(0,i.jsxs)(n.p,{children:["Yes, there are multiple ways to run K3s in Docker. See ",(0,i.jsx)(n.a,{href:"/advanced#running-k3s-in-docker",children:"Advanced Options"})," for more details."]}),"\n",(0,i.jsx)(n.h3,{id:"what-is-the-difference-between-k3s-server-and-agent-tokens",children:"What is the difference between K3s Server and Agent Tokens?"}),"\n",(0,i.jsxs)(n.p,{children:["For more information on managing K3s join tokens, see the ",(0,i.jsxs)(n.a,{href:"/cli/token",children:[(0,i.jsx)(n.code,{children:"k3s token"})," command documentation"]}),"."]}),"\n",(0,i.jsx)(n.h3,{id:"how-compatible-are-different-versions-of-k3s",children:"How compatible are different versions of K3s?"}),"\n",(0,i.jsxs)(n.p,{children:["In general, the ",(0,i.jsx)(n.a,{href:"https://kubernetes.io/docs/setup/release/version-skew-policy/",children:"Kubernetes version skew policy"})," applies."]}),"\n",(0,i.jsx)(n.p,{children:"In short, servers can be newer than agents, but agents cannot be newer than servers."}),"\n",(0,i.jsx)(n.h3,{id:"im-having-an-issue-where-can-i-get-help",children:"I'm having an issue, where can I get help?"}),"\n",(0,i.jsx)(n.p,{children:"If you are having an issue with deploying K3s, you should:"}),"\n",(0,i.jsxs)(n.ol,{children:["\n",(0,i.jsxs)(n.li,{children:["\n",(0,i.jsxs)(n.p,{children:["Check the ",(0,i.jsx)(n.a,{href:"/known-issues",children:"Known Issues"})," page."]}),"\n"]}),"\n",(0,i.jsxs)(n.li,{children:["\n",(0,i.jsxs)(n.p,{children:["Check that you have resolved any ",(0,i.jsx)(n.a,{href:"/installation/requirements#operating-systems",children:"Additional OS Preparation"}),". Run ",(0,i.jsx)(n.code,{children:"k3s check-config"})," and ensure that it passes."]}),"\n"]}),"\n",(0,i.jsxs)(n.li,{children:["\n",(0,i.jsxs)(n.p,{children:["Search the K3s ",(0,i.jsx)(n.a,{href:"https://github.com/k3s-io/k3s/issues",children:"Issues"})," and ",(0,i.jsx)(n.a,{href:"https://github.com/k3s-io/k3s/discussions",children:"Discussions"})," for one that matches your problem."]}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(n.ol,{start:"4",children:["\n",(0,i.jsxs)(n.li,{children:["\n",(0,i.jsxs)(n.p,{children:["Join the ",(0,i.jsx)(n.a,{href:"https://slack.rancher.io/",children:"Rancher Slack"})," K3s channel to get help."]}),"\n"]}),"\n",(0,i.jsxs)(n.li,{children:["\n",(0,i.jsxs)(n.p,{children:["Submit a ",(0,i.jsx)(n.a,{href:"https://github.com/k3s-io/k3s/issues/new/choose",children:"New Issue"})," on the K3s Github describing your setup and the issue you are experiencing."]}),"\n"]}),"\n"]})]})}function h(e={}){const{wrapper:n}={...(0,r.a)(),...e.components};return n?(0,i.jsx)(n,{...e,children:(0,i.jsx)(c,{...e})}):c(e)}},1151:(e,n,s)=>{s.d(n,{Z:()=>a,a:()=>o});var i=s(7294);const r={},t=i.createContext(r);function o(e){const n=i.useContext(t);return i.useMemo((function(){return"function"==typeof e?e(n):{...n,...e}}),[n,e])}function a(e){let n;return n=e.disableParentContext?"function"==typeof e.components?e.components(r):e.components||r:o(e.components),i.createElement(t.Provider,{value:n},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/06dc01b4.c0303864.js b/assets/js/06dc01b4.c0f89b5c.js similarity index 99% rename from assets/js/06dc01b4.c0303864.js rename to assets/js/06dc01b4.c0f89b5c.js index a96b5d3b3..650a277e3 100644 --- a/assets/js/06dc01b4.c0303864.js +++ b/assets/js/06dc01b4.c0f89b5c.js @@ -1 +1 @@ -"use strict";(self.webpackChunkk_3_s_docs=self.webpackChunkk_3_s_docs||[]).push([[9233],{6516:(e,n,i)=>{i.r(n),i.d(n,{assets:()=>l,contentTitle:()=>o,default:()=>h,frontMatter:()=>r,metadata:()=>a,toc:()=>d});var s=i(5893),t=i(1151);const r={title:"Basic Network Options"},o=void 0,a={id:"networking/basic-network-options",title:"Basic Network Options",description:"This page describes K3s network configuration options, including configuration or replacement of Flannel, and configuring IPv6 or dualStack.",source:"@site/docs/networking/basic-network-options.md",sourceDirName:"networking",slug:"/networking/basic-network-options",permalink:"/networking/basic-network-options",draft:!1,unlisted:!1,editUrl:"https://github.com/k3s-io/docs/edit/main/docs/networking/basic-network-options.md",tags:[],version:"current",lastUpdatedAt:1723651727e3,frontMatter:{title:"Basic Network Options"},sidebar:"mySidebar",previous:{title:"Networking",permalink:"/networking/"},next:{title:"Distributed hybrid or multicloud cluster",permalink:"/networking/distributed-multicloud"}},l={},d=[{value:"Flannel Options",id:"flannel-options",level:2},{value:"Migrating from wireguard or ipsec to wireguard-native",id:"migrating-from-wireguard-or-ipsec-to-wireguard-native",level:3},{value:"Custom CNI",id:"custom-cni",level:2},{value:"Control-Plane Egress Selector configuration",id:"control-plane-egress-selector-configuration",level:2},{value:"Dual-stack (IPv4 + IPv6) Networking",id:"dual-stack-ipv4--ipv6-networking",level:2},{value:"Single-stack IPv6 Networking",id:"single-stack-ipv6-networking",level:2},{value:"Nodes Without a Hostname",id:"nodes-without-a-hostname",level:2}];function c(e){const n={a:"a",admonition:"admonition",br:"br",code:"code",h2:"h2",h3:"h3",li:"li",ol:"ol",p:"p",pre:"pre",strong:"strong",table:"table",tbody:"tbody",td:"td",th:"th",thead:"thead",tr:"tr",ul:"ul",...(0,t.a)(),...e.components},{TabItem:i,Tabs:r}=n;return i||u("TabItem",!0),r||u("Tabs",!0),(0,s.jsxs)(s.Fragment,{children:[(0,s.jsx)(n.p,{children:"This page describes K3s network configuration options, including configuration or replacement of Flannel, and configuring IPv6 or dualStack."}),"\n",(0,s.jsx)(n.h2,{id:"flannel-options",children:"Flannel Options"}),"\n",(0,s.jsxs)(n.p,{children:[(0,s.jsx)(n.a,{href:"https://github.com/flannel-io/flannel/blob/master/README.md",children:"Flannel"})," is a lightweight provider of layer 3 network fabric that implements the Kubernetes Container Network Interface (CNI). It is what is commonly referred to as a CNI Plugin."]}),"\n",(0,s.jsxs)(n.ul,{children:["\n",(0,s.jsx)(n.li,{children:"Flannel options can only be set on server nodes, and must be identical on all servers in the cluster."}),"\n",(0,s.jsxs)(n.li,{children:["The default backend for Flannel is ",(0,s.jsx)(n.code,{children:"vxlan"}),". To enable encryption, use the ",(0,s.jsx)(n.code,{children:"wireguard-native"})," backend."]}),"\n",(0,s.jsxs)(n.li,{children:["Using ",(0,s.jsx)(n.code,{children:"vxlan"})," on Rasperry Pi with recent versions of Ubuntu requires ",(0,s.jsx)(n.a,{href:"/installation/requirements?os=pi#operating-systems",children:"additional preparation"}),"."]}),"\n",(0,s.jsxs)(n.li,{children:["Using ",(0,s.jsx)(n.code,{children:"wireguard-native"})," as the Flannel backend may require additional modules on some Linux distributions. Please see the ",(0,s.jsx)(n.a,{href:"https://www.wireguard.com/install/",children:"WireGuard Install Guide"})," for details.\nThe WireGuard install steps will ensure the appropriate kernel modules are installed for your operating system.\nYou must ensure that WireGuard kernel modules are available on every node, both servers and agents, before attempting to use the WireGuard Flannel backend."]}),"\n"]}),"\n",(0,s.jsxs)(n.table,{children:[(0,s.jsx)(n.thead,{children:(0,s.jsxs)(n.tr,{children:[(0,s.jsx)(n.th,{children:"CLI Flag and Value"}),(0,s.jsx)(n.th,{children:"Description"})]})}),(0,s.jsxs)(n.tbody,{children:[(0,s.jsxs)(n.tr,{children:[(0,s.jsx)(n.td,{children:(0,s.jsx)(n.code,{children:"--flannel-ipv6-masq"})}),(0,s.jsxs)(n.td,{children:["Apply masquerading rules to IPv6 traffic (default for IPv4). Only applies on dual-stack or IPv6-only clusters. Compatible with any Flannel backend other than ",(0,s.jsx)(n.code,{children:"none"}),"."]})]}),(0,s.jsxs)(n.tr,{children:[(0,s.jsx)(n.td,{children:(0,s.jsx)(n.code,{children:"--flannel-external-ip"})}),(0,s.jsx)(n.td,{children:"Use node external IP addresses as the destination for Flannel traffic, instead of internal IPs. Only applies when --node-external-ip is set on a node."})]}),(0,s.jsxs)(n.tr,{children:[(0,s.jsx)(n.td,{children:(0,s.jsx)(n.code,{children:"--flannel-backend=vxlan"})}),(0,s.jsx)(n.td,{children:"Use VXLAN to encapsulate the packets. May require additional kernel modules on Raspberry Pi."})]}),(0,s.jsxs)(n.tr,{children:[(0,s.jsx)(n.td,{children:(0,s.jsx)(n.code,{children:"--flannel-backend=host-gw"})}),(0,s.jsx)(n.td,{children:"Use IP routes to pod subnets via node IPs. Requires direct layer 2 connectivity between all nodes in the cluster."})]}),(0,s.jsxs)(n.tr,{children:[(0,s.jsx)(n.td,{children:(0,s.jsx)(n.code,{children:"--flannel-backend=wireguard-native"})}),(0,s.jsx)(n.td,{children:"Use WireGuard to encapsulate and encrypt network traffic. May require additional kernel modules."})]}),(0,s.jsxs)(n.tr,{children:[(0,s.jsx)(n.td,{children:(0,s.jsx)(n.code,{children:"--flannel-backend=ipsec"})}),(0,s.jsxs)(n.td,{children:["Use strongSwan IPSec via the ",(0,s.jsx)(n.code,{children:"swanctl"})," binary to encrypt network traffic. (Deprecated; will be removed in v1.27.0)"]})]}),(0,s.jsxs)(n.tr,{children:[(0,s.jsx)(n.td,{children:(0,s.jsx)(n.code,{children:"--flannel-backend=none"})}),(0,s.jsx)(n.td,{children:"Disable Flannel entirely."})]})]})]}),"\n",(0,s.jsx)(n.admonition,{title:"Version Gate",type:"info",children:(0,s.jsxs)(n.p,{children:["K3s no longer includes strongSwan ",(0,s.jsx)(n.code,{children:"swanctl"})," and ",(0,s.jsx)(n.code,{children:"charon"})," binaries starting with the 2022-12 releases (v1.26.0+k3s1, v1.25.5+k3s1, v1.24.9+k3s1, v1.23.15+k3s1). Please install the correct packages on your node before upgrading to or installing these releases if you want to use the ",(0,s.jsx)(n.code,{children:"ipsec"})," backend."]})}),"\n",(0,s.jsxs)(n.h3,{id:"migrating-from-wireguard-or-ipsec-to-wireguard-native",children:["Migrating from ",(0,s.jsx)(n.code,{children:"wireguard"})," or ",(0,s.jsx)(n.code,{children:"ipsec"})," to ",(0,s.jsx)(n.code,{children:"wireguard-native"})]}),"\n",(0,s.jsxs)(n.p,{children:["The legacy ",(0,s.jsx)(n.code,{children:"wireguard"})," backend requires installation of the ",(0,s.jsx)(n.code,{children:"wg"})," tool on the host. This backend is not available in K3s v1.26 and higher, in favor of ",(0,s.jsx)(n.code,{children:"wireguard-native"})," backend, which directly interfaces with the kernel."]}),"\n",(0,s.jsxs)(n.p,{children:["The legacy ",(0,s.jsx)(n.code,{children:"ipsec"})," backend requires installation of the ",(0,s.jsx)(n.code,{children:"swanctl"})," and ",(0,s.jsx)(n.code,{children:"charon"})," binaries on the host. This backend is not available in K3s v1.27 and higher, in favor of the ",(0,s.jsx)(n.code,{children:"wireguard-native"})," backend."]}),"\n",(0,s.jsx)(n.p,{children:"We recommend that users migrate to the new backend as soon as possible. The migration requires a short period of downtime while nodes come up with the new configuration. You should follow these two steps:"}),"\n",(0,s.jsxs)(n.ol,{children:["\n",(0,s.jsxs)(n.li,{children:["Update the K3s config on all server nodes. If using config files, the ",(0,s.jsx)(n.code,{children:"/etc/rancher/k3s/config.yaml"})," should include ",(0,s.jsx)(n.code,{children:"flannel-backend: wireguard-native"})," instead of ",(0,s.jsx)(n.code,{children:"flannel-backend: wireguard"})," or ",(0,s.jsx)(n.code,{children:"flannel-backend: ipsec"}),". If you are configuring K3s via CLI flags in the systemd unit, the equivalent flags should be changed."]}),"\n",(0,s.jsx)(n.li,{children:"Reboot all nodes, starting with the servers."}),"\n"]}),"\n",(0,s.jsx)(n.h2,{id:"custom-cni",children:"Custom CNI"}),"\n",(0,s.jsxs)(n.p,{children:["Start K3s with ",(0,s.jsx)(n.code,{children:"--flannel-backend=none"})," and install your CNI of choice. Most CNI plugins come with their own network policy engine, so it is recommended to set ",(0,s.jsx)(n.code,{children:"--disable-network-policy"})," as well to avoid conflicts. Some important information to take into consideration:"]}),"\n",(0,s.jsxs)(r,{queryString:"cni",children:[(0,s.jsxs)(i,{value:"Canal",default:!0,children:[(0,s.jsxs)(n.p,{children:["Visit the ",(0,s.jsx)(n.a,{href:"https://docs.tigera.io/calico/latest/getting-started/kubernetes/flannel/install-for-flannel#installing-calico-for-policy-and-flannel-aka-canal-for-networking",children:"Canal Docs"})," website. Follow the steps to install Canal. Modify the Canal YAML so that IP forwarding is allowed in the ",(0,s.jsx)(n.code,{children:"container_settings"})," section, for example:"]}),(0,s.jsx)(n.pre,{children:(0,s.jsx)(n.code,{className:"language-yaml",children:'"container_settings": {\n "allow_ip_forwarding": true\n}\n'})}),(0,s.jsx)(n.p,{children:"Apply the Canal YAML."}),(0,s.jsx)(n.p,{children:"Ensure the settings were applied by running the following command on the host:"}),(0,s.jsx)(n.pre,{children:(0,s.jsx)(n.code,{className:"language-bash",children:"cat /etc/cni/net.d/10-canal.conflist\n"})}),(0,s.jsx)(n.p,{children:"You should see that IP forwarding is set to true."})]}),(0,s.jsxs)(i,{value:"Calico",default:!0,children:[(0,s.jsxs)(n.p,{children:["Follow the ",(0,s.jsx)(n.a,{href:"https://docs.tigera.io/calico/latest/reference/configure-cni-plugins",children:"Calico CNI Plugins Guide"}),". Modify the Calico YAML so that IP forwarding is allowed in the ",(0,s.jsx)(n.code,{children:"container_settings"})," section, for example:"]}),(0,s.jsx)(n.pre,{children:(0,s.jsx)(n.code,{className:"language-yaml",children:'"container_settings": {\n "allow_ip_forwarding": true\n}\n'})}),(0,s.jsx)(n.p,{children:"Apply the Calico YAML."}),(0,s.jsx)(n.p,{children:"Ensure the settings were applied by running the following command on the host:"}),(0,s.jsx)(n.pre,{children:(0,s.jsx)(n.code,{className:"language-bash",children:"cat /etc/cni/net.d/10-calico.conflist\n"})}),(0,s.jsx)(n.p,{children:"You should see that IP forwarding is set to true."})]}),(0,s.jsxs)(i,{value:"Cilium",default:!0,children:[(0,s.jsxs)(n.p,{children:["Before running ",(0,s.jsx)(n.code,{children:"k3s-killall.sh"})," or ",(0,s.jsx)(n.code,{children:"k3s-uninstall.sh"}),", you must manually remove ",(0,s.jsx)(n.code,{children:"cilium_host"}),", ",(0,s.jsx)(n.code,{children:"cilium_net"})," and ",(0,s.jsx)(n.code,{children:"cilium_vxlan"})," interfaces. If you fail to do this, you may lose network connectivity to the host when K3s is stopped"]}),(0,s.jsx)(n.pre,{children:(0,s.jsx)(n.code,{className:"language-bash",children:"ip link delete cilium_host\nip link delete cilium_net\nip link delete cilium_vxlan\n"})}),(0,s.jsx)(n.p,{children:"Additionally, iptables rules for cilium should be removed:"}),(0,s.jsx)(n.pre,{children:(0,s.jsx)(n.code,{className:"language-bash",children:"iptables-save | grep -iv cilium | iptables-restore\nip6tables-save | grep -iv cilium | ip6tables-restore\n"})})]})]}),"\n",(0,s.jsx)(n.h2,{id:"control-plane-egress-selector-configuration",children:"Control-Plane Egress Selector configuration"}),"\n",(0,s.jsxs)(n.p,{children:["K3s agents and servers maintain websocket tunnels between nodes that are used to encapsulate bidirectional communication between the control-plane (apiserver) and agent (kubelet and containerd) components.\nThis allows agents to operate without exposing the kubelet and container runtime streaming ports to incoming connections, and for the control-plane to connect to cluster services when operating with the agent disabled.\nThis functionality is equivalent to the ",(0,s.jsx)(n.a,{href:"https://kubernetes.io/docs/tasks/extend-kubernetes/setup-konnectivity/",children:"Konnectivity"})," service commonly used on other Kubernetes distributions, and is managed via the apiserver's egress selector configuration."]}),"\n",(0,s.jsxs)(n.p,{children:["The default mode is ",(0,s.jsx)(n.code,{children:"agent"}),". ",(0,s.jsx)(n.code,{children:"pod"})," or ",(0,s.jsx)(n.code,{children:"cluster"})," modes are recommended when running ",(0,s.jsx)(n.a,{href:"/advanced#running-agentless-servers-experimental",children:"agentless servers"}),", in order to provide the apiserver with access to cluster service endpoints in the absence of flannel and kube-proxy."]}),"\n",(0,s.jsxs)(n.p,{children:["The egress selector mode may be configured on servers via the ",(0,s.jsx)(n.code,{children:"--egress-selector-mode"})," flag, and offers four modes:"]}),"\n",(0,s.jsxs)(n.ul,{children:["\n",(0,s.jsxs)(n.li,{children:[(0,s.jsx)(n.code,{children:"disabled"}),": The apiserver does not use agent tunnels to communicate with kubelets or cluster endpoints.\nThis mode requires that servers run the kubelet, CNI, and kube-proxy, and have direct connectivity to agents, or the apiserver will not be able to access service endpoints or perform ",(0,s.jsx)(n.code,{children:"kubectl exec"})," and ",(0,s.jsx)(n.code,{children:"kubectl logs"}),"."]}),"\n",(0,s.jsxs)(n.li,{children:[(0,s.jsx)(n.code,{children:"agent"})," (default): The apiserver uses agent tunnels to communicate with kubelets.\nThis mode requires that the servers also run the kubelet, CNI, and kube-proxy, or the apiserver will not be able to access service endpoints."]}),"\n",(0,s.jsxs)(n.li,{children:[(0,s.jsx)(n.code,{children:"pod"}),": The apiserver uses agent tunnels to communicate with kubelets and service endpoints, routing endpoint connections to the correct agent by watching Nodes and Endpoints.",(0,s.jsx)(n.br,{}),"\n",(0,s.jsx)(n.strong,{children:"NOTE"}),": This mode will not work when using a CNI that uses its own IPAM and does not respect the node's PodCIDR allocation. ",(0,s.jsx)(n.code,{children:"cluster"})," or ",(0,s.jsx)(n.code,{children:"agent"})," mode should be used with these CNIs instead."]}),"\n",(0,s.jsxs)(n.li,{children:[(0,s.jsx)(n.code,{children:"cluster"}),": The apiserver uses agent tunnels to communicate with kubelets and service endpoints, routing endpoint connections to the correct agent by watching Pods and Endpoints. This mode has the highest portability across different cluster configurations, at the cost of increased overhead."]}),"\n"]}),"\n",(0,s.jsx)(n.h2,{id:"dual-stack-ipv4--ipv6-networking",children:"Dual-stack (IPv4 + IPv6) Networking"}),"\n",(0,s.jsx)(n.admonition,{title:"Version Gate",type:"info",children:(0,s.jsxs)(n.p,{children:["Experimental support is available as of ",(0,s.jsx)(n.a,{href:"https://github.com/k3s-io/k3s/releases/tag/v1.21.0%2Bk3s1",children:"v1.21.0+k3s1"}),".",(0,s.jsx)(n.br,{}),"\n","Stable support is available as of ",(0,s.jsx)(n.a,{href:"https://github.com/k3s-io/k3s/releases/tag/v1.23.7%2Bk3s1",children:"v1.23.7+k3s1"}),"."]})}),"\n",(0,s.jsxs)(n.admonition,{title:"Known Issue",type:"warning",children:[(0,s.jsxs)(n.p,{children:["Before 1.27, Kubernetes ",(0,s.jsx)(n.a,{href:"https://github.com/kubernetes/kubernetes/issues/111695",children:"Issue #111695"})," causes the Kubelet to ignore the node IPv6 addresses if you have a dual-stack environment and you are not using the primary network interface for cluster traffic. To avoid this bug, use 1.27 or newer or add the following flag to both K3s servers and agents:"]}),(0,s.jsx)(n.pre,{children:(0,s.jsx)(n.code,{children:'--kubelet-arg="node-ip=0.0.0.0" # To proritize IPv4 traffic\n#OR\n--kubelet-arg="node-ip=::" # To proritize IPv6 traffic\n'})})]}),"\n",(0,s.jsx)(n.p,{children:"Dual-stack networking must be configured when the cluster is first created. It cannot be enabled on an existing cluster once it has been started as IPv4-only."}),"\n",(0,s.jsxs)(n.p,{children:["To enable dual-stack in K3s, you must provide valid dual-stack ",(0,s.jsx)(n.code,{children:"cluster-cidr"})," and ",(0,s.jsx)(n.code,{children:"service-cidr"})," on all server nodes. This is an example of a valid configuration:"]}),"\n",(0,s.jsx)(n.pre,{children:(0,s.jsx)(n.code,{children:"--cluster-cidr=10.42.0.0/16,2001:cafe:42::/56 --service-cidr=10.43.0.0/16,2001:cafe:43::/112\n"})}),"\n",(0,s.jsxs)(n.p,{children:["Note that you may configure any valid ",(0,s.jsx)(n.code,{children:"cluster-cidr"})," and ",(0,s.jsx)(n.code,{children:"service-cidr"})," values, but the above masks are recommended. If you change the ",(0,s.jsx)(n.code,{children:"cluster-cidr"})," mask, you should also change the ",(0,s.jsx)(n.code,{children:"node-cidr-mask-size-ipv4"})," and ",(0,s.jsx)(n.code,{children:"node-cidr-mask-size-ipv6"})," values to match the planned pods per node and total node count. The largest supported ",(0,s.jsx)(n.code,{children:"service-cidr"})," mask is /12 for IPv4, and /112 for IPv6. Remember to allow ipv6 traffic if you are deploying in a public cloud."]}),"\n",(0,s.jsx)(n.p,{children:"If you are using a custom CNI plugin, i.e. a CNI plugin other than Flannel, the additional configuration may be required. Please consult your plugin's dual-stack documentation and verify if network policies can be enabled."}),"\n",(0,s.jsx)(n.admonition,{title:"Known Issue",type:"warning",children:(0,s.jsx)(n.p,{children:"When defining cluster-cidr and service-cidr with IPv6 as the primary family, the node-ip of all cluster members should be explicitly set, placing node's desired IPv6 address as the first address. By default, the kubelet always uses IPv4 as the primary address family."})}),"\n",(0,s.jsx)(n.h2,{id:"single-stack-ipv6-networking",children:"Single-stack IPv6 Networking"}),"\n",(0,s.jsx)(n.admonition,{title:"Version Gate",type:"info",children:(0,s.jsxs)(n.p,{children:["Available as of ",(0,s.jsx)(n.a,{href:"https://github.com/k3s-io/k3s/releases/tag/v1.22.9%2Bk3s1",children:"v1.22.9+k3s1"})]})}),"\n",(0,s.jsx)(n.admonition,{title:"Known Issue",type:"warning",children:(0,s.jsxs)(n.p,{children:["If your IPv6 default route is set by a router advertisement (RA), you will need to set the sysctl ",(0,s.jsx)(n.code,{children:"net.ipv6.conf.all.accept_ra=2"}),"; otherwise, the node will drop the default route once it expires. Be aware that accepting RAs could increase the risk of ",(0,s.jsx)(n.a,{href:"https://github.com/kubernetes/kubernetes/issues/91507",children:"man-in-the-middle attacks"}),"."]})}),"\n",(0,s.jsxs)(n.p,{children:["Single-stack IPv6 clusters (clusters without IPv4) are supported on K3s using the ",(0,s.jsx)(n.code,{children:"--cluster-cidr"})," and ",(0,s.jsx)(n.code,{children:"--service-cidr"})," flags. This is an example of a valid configuration:"]}),"\n",(0,s.jsx)(n.pre,{children:(0,s.jsx)(n.code,{className:"language-bash",children:"--cluster-cidr=2001:cafe:42::/56 --service-cidr=2001:cafe:43::/112\n"})}),"\n",(0,s.jsx)(n.h2,{id:"nodes-without-a-hostname",children:"Nodes Without a Hostname"}),"\n",(0,s.jsxs)(n.p,{children:['Some cloud providers, such as Linode, will create machines with "localhost" as the hostname and others may not have a hostname set at all. This can cause problems with domain name resolution. You can run K3s with the ',(0,s.jsx)(n.code,{children:"--node-name"})," flag or ",(0,s.jsx)(n.code,{children:"K3S_NODE_NAME"})," environment variable and this will pass the node name to resolve this issue."]})]})}function h(e={}){const{wrapper:n}={...(0,t.a)(),...e.components};return n?(0,s.jsx)(n,{...e,children:(0,s.jsx)(c,{...e})}):c(e)}function u(e,n){throw new Error("Expected "+(n?"component":"object")+" `"+e+"` to be defined: you likely forgot to import, pass, or provide it.")}},1151:(e,n,i)=>{i.d(n,{Z:()=>a,a:()=>o});var s=i(7294);const t={},r=s.createContext(t);function o(e){const n=s.useContext(r);return s.useMemo((function(){return"function"==typeof e?e(n):{...n,...e}}),[n,e])}function a(e){let n;return n=e.disableParentContext?"function"==typeof e.components?e.components(t):e.components||t:o(e.components),s.createElement(r.Provider,{value:n},e.children)}}}]); \ No newline at end of file +"use strict";(self.webpackChunkk_3_s_docs=self.webpackChunkk_3_s_docs||[]).push([[9233],{6516:(e,n,i)=>{i.r(n),i.d(n,{assets:()=>l,contentTitle:()=>o,default:()=>h,frontMatter:()=>r,metadata:()=>a,toc:()=>d});var s=i(5893),t=i(1151);const r={title:"Basic Network Options"},o=void 0,a={id:"networking/basic-network-options",title:"Basic Network Options",description:"This page describes K3s network configuration options, including configuration or replacement of Flannel, and configuring IPv6 or dualStack.",source:"@site/docs/networking/basic-network-options.md",sourceDirName:"networking",slug:"/networking/basic-network-options",permalink:"/networking/basic-network-options",draft:!1,unlisted:!1,editUrl:"https://github.com/k3s-io/docs/edit/main/docs/networking/basic-network-options.md",tags:[],version:"current",lastUpdatedAt:1723747404e3,frontMatter:{title:"Basic Network Options"},sidebar:"mySidebar",previous:{title:"Networking",permalink:"/networking/"},next:{title:"Distributed hybrid or multicloud cluster",permalink:"/networking/distributed-multicloud"}},l={},d=[{value:"Flannel Options",id:"flannel-options",level:2},{value:"Migrating from wireguard or ipsec to wireguard-native",id:"migrating-from-wireguard-or-ipsec-to-wireguard-native",level:3},{value:"Custom CNI",id:"custom-cni",level:2},{value:"Control-Plane Egress Selector configuration",id:"control-plane-egress-selector-configuration",level:2},{value:"Dual-stack (IPv4 + IPv6) Networking",id:"dual-stack-ipv4--ipv6-networking",level:2},{value:"Single-stack IPv6 Networking",id:"single-stack-ipv6-networking",level:2},{value:"Nodes Without a Hostname",id:"nodes-without-a-hostname",level:2}];function c(e){const n={a:"a",admonition:"admonition",br:"br",code:"code",h2:"h2",h3:"h3",li:"li",ol:"ol",p:"p",pre:"pre",strong:"strong",table:"table",tbody:"tbody",td:"td",th:"th",thead:"thead",tr:"tr",ul:"ul",...(0,t.a)(),...e.components},{TabItem:i,Tabs:r}=n;return i||u("TabItem",!0),r||u("Tabs",!0),(0,s.jsxs)(s.Fragment,{children:[(0,s.jsx)(n.p,{children:"This page describes K3s network configuration options, including configuration or replacement of Flannel, and configuring IPv6 or dualStack."}),"\n",(0,s.jsx)(n.h2,{id:"flannel-options",children:"Flannel Options"}),"\n",(0,s.jsxs)(n.p,{children:[(0,s.jsx)(n.a,{href:"https://github.com/flannel-io/flannel/blob/master/README.md",children:"Flannel"})," is a lightweight provider of layer 3 network fabric that implements the Kubernetes Container Network Interface (CNI). It is what is commonly referred to as a CNI Plugin."]}),"\n",(0,s.jsxs)(n.ul,{children:["\n",(0,s.jsx)(n.li,{children:"Flannel options can only be set on server nodes, and must be identical on all servers in the cluster."}),"\n",(0,s.jsxs)(n.li,{children:["The default backend for Flannel is ",(0,s.jsx)(n.code,{children:"vxlan"}),". To enable encryption, use the ",(0,s.jsx)(n.code,{children:"wireguard-native"})," backend."]}),"\n",(0,s.jsxs)(n.li,{children:["Using ",(0,s.jsx)(n.code,{children:"vxlan"})," on Rasperry Pi with recent versions of Ubuntu requires ",(0,s.jsx)(n.a,{href:"/installation/requirements?os=pi#operating-systems",children:"additional preparation"}),"."]}),"\n",(0,s.jsxs)(n.li,{children:["Using ",(0,s.jsx)(n.code,{children:"wireguard-native"})," as the Flannel backend may require additional modules on some Linux distributions. Please see the ",(0,s.jsx)(n.a,{href:"https://www.wireguard.com/install/",children:"WireGuard Install Guide"})," for details.\nThe WireGuard install steps will ensure the appropriate kernel modules are installed for your operating system.\nYou must ensure that WireGuard kernel modules are available on every node, both servers and agents, before attempting to use the WireGuard Flannel backend."]}),"\n"]}),"\n",(0,s.jsxs)(n.table,{children:[(0,s.jsx)(n.thead,{children:(0,s.jsxs)(n.tr,{children:[(0,s.jsx)(n.th,{children:"CLI Flag and Value"}),(0,s.jsx)(n.th,{children:"Description"})]})}),(0,s.jsxs)(n.tbody,{children:[(0,s.jsxs)(n.tr,{children:[(0,s.jsx)(n.td,{children:(0,s.jsx)(n.code,{children:"--flannel-ipv6-masq"})}),(0,s.jsxs)(n.td,{children:["Apply masquerading rules to IPv6 traffic (default for IPv4). Only applies on dual-stack or IPv6-only clusters. Compatible with any Flannel backend other than ",(0,s.jsx)(n.code,{children:"none"}),"."]})]}),(0,s.jsxs)(n.tr,{children:[(0,s.jsx)(n.td,{children:(0,s.jsx)(n.code,{children:"--flannel-external-ip"})}),(0,s.jsx)(n.td,{children:"Use node external IP addresses as the destination for Flannel traffic, instead of internal IPs. Only applies when --node-external-ip is set on a node."})]}),(0,s.jsxs)(n.tr,{children:[(0,s.jsx)(n.td,{children:(0,s.jsx)(n.code,{children:"--flannel-backend=vxlan"})}),(0,s.jsx)(n.td,{children:"Use VXLAN to encapsulate the packets. May require additional kernel modules on Raspberry Pi."})]}),(0,s.jsxs)(n.tr,{children:[(0,s.jsx)(n.td,{children:(0,s.jsx)(n.code,{children:"--flannel-backend=host-gw"})}),(0,s.jsx)(n.td,{children:"Use IP routes to pod subnets via node IPs. Requires direct layer 2 connectivity between all nodes in the cluster."})]}),(0,s.jsxs)(n.tr,{children:[(0,s.jsx)(n.td,{children:(0,s.jsx)(n.code,{children:"--flannel-backend=wireguard-native"})}),(0,s.jsx)(n.td,{children:"Use WireGuard to encapsulate and encrypt network traffic. May require additional kernel modules."})]}),(0,s.jsxs)(n.tr,{children:[(0,s.jsx)(n.td,{children:(0,s.jsx)(n.code,{children:"--flannel-backend=ipsec"})}),(0,s.jsxs)(n.td,{children:["Use strongSwan IPSec via the ",(0,s.jsx)(n.code,{children:"swanctl"})," binary to encrypt network traffic. (Deprecated; will be removed in v1.27.0)"]})]}),(0,s.jsxs)(n.tr,{children:[(0,s.jsx)(n.td,{children:(0,s.jsx)(n.code,{children:"--flannel-backend=none"})}),(0,s.jsx)(n.td,{children:"Disable Flannel entirely."})]})]})]}),"\n",(0,s.jsx)(n.admonition,{title:"Version Gate",type:"info",children:(0,s.jsxs)(n.p,{children:["K3s no longer includes strongSwan ",(0,s.jsx)(n.code,{children:"swanctl"})," and ",(0,s.jsx)(n.code,{children:"charon"})," binaries starting with the 2022-12 releases (v1.26.0+k3s1, v1.25.5+k3s1, v1.24.9+k3s1, v1.23.15+k3s1). Please install the correct packages on your node before upgrading to or installing these releases if you want to use the ",(0,s.jsx)(n.code,{children:"ipsec"})," backend."]})}),"\n",(0,s.jsxs)(n.h3,{id:"migrating-from-wireguard-or-ipsec-to-wireguard-native",children:["Migrating from ",(0,s.jsx)(n.code,{children:"wireguard"})," or ",(0,s.jsx)(n.code,{children:"ipsec"})," to ",(0,s.jsx)(n.code,{children:"wireguard-native"})]}),"\n",(0,s.jsxs)(n.p,{children:["The legacy ",(0,s.jsx)(n.code,{children:"wireguard"})," backend requires installation of the ",(0,s.jsx)(n.code,{children:"wg"})," tool on the host. This backend is not available in K3s v1.26 and higher, in favor of ",(0,s.jsx)(n.code,{children:"wireguard-native"})," backend, which directly interfaces with the kernel."]}),"\n",(0,s.jsxs)(n.p,{children:["The legacy ",(0,s.jsx)(n.code,{children:"ipsec"})," backend requires installation of the ",(0,s.jsx)(n.code,{children:"swanctl"})," and ",(0,s.jsx)(n.code,{children:"charon"})," binaries on the host. This backend is not available in K3s v1.27 and higher, in favor of the ",(0,s.jsx)(n.code,{children:"wireguard-native"})," backend."]}),"\n",(0,s.jsx)(n.p,{children:"We recommend that users migrate to the new backend as soon as possible. The migration requires a short period of downtime while nodes come up with the new configuration. You should follow these two steps:"}),"\n",(0,s.jsxs)(n.ol,{children:["\n",(0,s.jsxs)(n.li,{children:["Update the K3s config on all server nodes. If using config files, the ",(0,s.jsx)(n.code,{children:"/etc/rancher/k3s/config.yaml"})," should include ",(0,s.jsx)(n.code,{children:"flannel-backend: wireguard-native"})," instead of ",(0,s.jsx)(n.code,{children:"flannel-backend: wireguard"})," or ",(0,s.jsx)(n.code,{children:"flannel-backend: ipsec"}),". If you are configuring K3s via CLI flags in the systemd unit, the equivalent flags should be changed."]}),"\n",(0,s.jsx)(n.li,{children:"Reboot all nodes, starting with the servers."}),"\n"]}),"\n",(0,s.jsx)(n.h2,{id:"custom-cni",children:"Custom CNI"}),"\n",(0,s.jsxs)(n.p,{children:["Start K3s with ",(0,s.jsx)(n.code,{children:"--flannel-backend=none"})," and install your CNI of choice. Most CNI plugins come with their own network policy engine, so it is recommended to set ",(0,s.jsx)(n.code,{children:"--disable-network-policy"})," as well to avoid conflicts. Some important information to take into consideration:"]}),"\n",(0,s.jsxs)(r,{queryString:"cni",children:[(0,s.jsxs)(i,{value:"Canal",default:!0,children:[(0,s.jsxs)(n.p,{children:["Visit the ",(0,s.jsx)(n.a,{href:"https://docs.tigera.io/calico/latest/getting-started/kubernetes/flannel/install-for-flannel#installing-calico-for-policy-and-flannel-aka-canal-for-networking",children:"Canal Docs"})," website. Follow the steps to install Canal. Modify the Canal YAML so that IP forwarding is allowed in the ",(0,s.jsx)(n.code,{children:"container_settings"})," section, for example:"]}),(0,s.jsx)(n.pre,{children:(0,s.jsx)(n.code,{className:"language-yaml",children:'"container_settings": {\n "allow_ip_forwarding": true\n}\n'})}),(0,s.jsx)(n.p,{children:"Apply the Canal YAML."}),(0,s.jsx)(n.p,{children:"Ensure the settings were applied by running the following command on the host:"}),(0,s.jsx)(n.pre,{children:(0,s.jsx)(n.code,{className:"language-bash",children:"cat /etc/cni/net.d/10-canal.conflist\n"})}),(0,s.jsx)(n.p,{children:"You should see that IP forwarding is set to true."})]}),(0,s.jsxs)(i,{value:"Calico",default:!0,children:[(0,s.jsxs)(n.p,{children:["Follow the ",(0,s.jsx)(n.a,{href:"https://docs.tigera.io/calico/latest/reference/configure-cni-plugins",children:"Calico CNI Plugins Guide"}),". Modify the Calico YAML so that IP forwarding is allowed in the ",(0,s.jsx)(n.code,{children:"container_settings"})," section, for example:"]}),(0,s.jsx)(n.pre,{children:(0,s.jsx)(n.code,{className:"language-yaml",children:'"container_settings": {\n "allow_ip_forwarding": true\n}\n'})}),(0,s.jsx)(n.p,{children:"Apply the Calico YAML."}),(0,s.jsx)(n.p,{children:"Ensure the settings were applied by running the following command on the host:"}),(0,s.jsx)(n.pre,{children:(0,s.jsx)(n.code,{className:"language-bash",children:"cat /etc/cni/net.d/10-calico.conflist\n"})}),(0,s.jsx)(n.p,{children:"You should see that IP forwarding is set to true."})]}),(0,s.jsxs)(i,{value:"Cilium",default:!0,children:[(0,s.jsxs)(n.p,{children:["Before running ",(0,s.jsx)(n.code,{children:"k3s-killall.sh"})," or ",(0,s.jsx)(n.code,{children:"k3s-uninstall.sh"}),", you must manually remove ",(0,s.jsx)(n.code,{children:"cilium_host"}),", ",(0,s.jsx)(n.code,{children:"cilium_net"})," and ",(0,s.jsx)(n.code,{children:"cilium_vxlan"})," interfaces. If you fail to do this, you may lose network connectivity to the host when K3s is stopped"]}),(0,s.jsx)(n.pre,{children:(0,s.jsx)(n.code,{className:"language-bash",children:"ip link delete cilium_host\nip link delete cilium_net\nip link delete cilium_vxlan\n"})}),(0,s.jsx)(n.p,{children:"Additionally, iptables rules for cilium should be removed:"}),(0,s.jsx)(n.pre,{children:(0,s.jsx)(n.code,{className:"language-bash",children:"iptables-save | grep -iv cilium | iptables-restore\nip6tables-save | grep -iv cilium | ip6tables-restore\n"})})]})]}),"\n",(0,s.jsx)(n.h2,{id:"control-plane-egress-selector-configuration",children:"Control-Plane Egress Selector configuration"}),"\n",(0,s.jsxs)(n.p,{children:["K3s agents and servers maintain websocket tunnels between nodes that are used to encapsulate bidirectional communication between the control-plane (apiserver) and agent (kubelet and containerd) components.\nThis allows agents to operate without exposing the kubelet and container runtime streaming ports to incoming connections, and for the control-plane to connect to cluster services when operating with the agent disabled.\nThis functionality is equivalent to the ",(0,s.jsx)(n.a,{href:"https://kubernetes.io/docs/tasks/extend-kubernetes/setup-konnectivity/",children:"Konnectivity"})," service commonly used on other Kubernetes distributions, and is managed via the apiserver's egress selector configuration."]}),"\n",(0,s.jsxs)(n.p,{children:["The default mode is ",(0,s.jsx)(n.code,{children:"agent"}),". ",(0,s.jsx)(n.code,{children:"pod"})," or ",(0,s.jsx)(n.code,{children:"cluster"})," modes are recommended when running ",(0,s.jsx)(n.a,{href:"/advanced#running-agentless-servers-experimental",children:"agentless servers"}),", in order to provide the apiserver with access to cluster service endpoints in the absence of flannel and kube-proxy."]}),"\n",(0,s.jsxs)(n.p,{children:["The egress selector mode may be configured on servers via the ",(0,s.jsx)(n.code,{children:"--egress-selector-mode"})," flag, and offers four modes:"]}),"\n",(0,s.jsxs)(n.ul,{children:["\n",(0,s.jsxs)(n.li,{children:[(0,s.jsx)(n.code,{children:"disabled"}),": The apiserver does not use agent tunnels to communicate with kubelets or cluster endpoints.\nThis mode requires that servers run the kubelet, CNI, and kube-proxy, and have direct connectivity to agents, or the apiserver will not be able to access service endpoints or perform ",(0,s.jsx)(n.code,{children:"kubectl exec"})," and ",(0,s.jsx)(n.code,{children:"kubectl logs"}),"."]}),"\n",(0,s.jsxs)(n.li,{children:[(0,s.jsx)(n.code,{children:"agent"})," (default): The apiserver uses agent tunnels to communicate with kubelets.\nThis mode requires that the servers also run the kubelet, CNI, and kube-proxy, or the apiserver will not be able to access service endpoints."]}),"\n",(0,s.jsxs)(n.li,{children:[(0,s.jsx)(n.code,{children:"pod"}),": The apiserver uses agent tunnels to communicate with kubelets and service endpoints, routing endpoint connections to the correct agent by watching Nodes and Endpoints.",(0,s.jsx)(n.br,{}),"\n",(0,s.jsx)(n.strong,{children:"NOTE"}),": This mode will not work when using a CNI that uses its own IPAM and does not respect the node's PodCIDR allocation. ",(0,s.jsx)(n.code,{children:"cluster"})," or ",(0,s.jsx)(n.code,{children:"agent"})," mode should be used with these CNIs instead."]}),"\n",(0,s.jsxs)(n.li,{children:[(0,s.jsx)(n.code,{children:"cluster"}),": The apiserver uses agent tunnels to communicate with kubelets and service endpoints, routing endpoint connections to the correct agent by watching Pods and Endpoints. This mode has the highest portability across different cluster configurations, at the cost of increased overhead."]}),"\n"]}),"\n",(0,s.jsx)(n.h2,{id:"dual-stack-ipv4--ipv6-networking",children:"Dual-stack (IPv4 + IPv6) Networking"}),"\n",(0,s.jsx)(n.admonition,{title:"Version Gate",type:"info",children:(0,s.jsxs)(n.p,{children:["Experimental support is available as of ",(0,s.jsx)(n.a,{href:"https://github.com/k3s-io/k3s/releases/tag/v1.21.0%2Bk3s1",children:"v1.21.0+k3s1"}),".",(0,s.jsx)(n.br,{}),"\n","Stable support is available as of ",(0,s.jsx)(n.a,{href:"https://github.com/k3s-io/k3s/releases/tag/v1.23.7%2Bk3s1",children:"v1.23.7+k3s1"}),"."]})}),"\n",(0,s.jsxs)(n.admonition,{title:"Known Issue",type:"warning",children:[(0,s.jsxs)(n.p,{children:["Before 1.27, Kubernetes ",(0,s.jsx)(n.a,{href:"https://github.com/kubernetes/kubernetes/issues/111695",children:"Issue #111695"})," causes the Kubelet to ignore the node IPv6 addresses if you have a dual-stack environment and you are not using the primary network interface for cluster traffic. To avoid this bug, use 1.27 or newer or add the following flag to both K3s servers and agents:"]}),(0,s.jsx)(n.pre,{children:(0,s.jsx)(n.code,{children:'--kubelet-arg="node-ip=0.0.0.0" # To proritize IPv4 traffic\n#OR\n--kubelet-arg="node-ip=::" # To proritize IPv6 traffic\n'})})]}),"\n",(0,s.jsx)(n.p,{children:"Dual-stack networking must be configured when the cluster is first created. It cannot be enabled on an existing cluster once it has been started as IPv4-only."}),"\n",(0,s.jsxs)(n.p,{children:["To enable dual-stack in K3s, you must provide valid dual-stack ",(0,s.jsx)(n.code,{children:"cluster-cidr"})," and ",(0,s.jsx)(n.code,{children:"service-cidr"})," on all server nodes. This is an example of a valid configuration:"]}),"\n",(0,s.jsx)(n.pre,{children:(0,s.jsx)(n.code,{children:"--cluster-cidr=10.42.0.0/16,2001:cafe:42::/56 --service-cidr=10.43.0.0/16,2001:cafe:43::/112\n"})}),"\n",(0,s.jsxs)(n.p,{children:["Note that you may configure any valid ",(0,s.jsx)(n.code,{children:"cluster-cidr"})," and ",(0,s.jsx)(n.code,{children:"service-cidr"})," values, but the above masks are recommended. If you change the ",(0,s.jsx)(n.code,{children:"cluster-cidr"})," mask, you should also change the ",(0,s.jsx)(n.code,{children:"node-cidr-mask-size-ipv4"})," and ",(0,s.jsx)(n.code,{children:"node-cidr-mask-size-ipv6"})," values to match the planned pods per node and total node count. The largest supported ",(0,s.jsx)(n.code,{children:"service-cidr"})," mask is /12 for IPv4, and /112 for IPv6. Remember to allow ipv6 traffic if you are deploying in a public cloud."]}),"\n",(0,s.jsx)(n.p,{children:"If you are using a custom CNI plugin, i.e. a CNI plugin other than Flannel, the additional configuration may be required. Please consult your plugin's dual-stack documentation and verify if network policies can be enabled."}),"\n",(0,s.jsx)(n.admonition,{title:"Known Issue",type:"warning",children:(0,s.jsx)(n.p,{children:"When defining cluster-cidr and service-cidr with IPv6 as the primary family, the node-ip of all cluster members should be explicitly set, placing node's desired IPv6 address as the first address. By default, the kubelet always uses IPv4 as the primary address family."})}),"\n",(0,s.jsx)(n.h2,{id:"single-stack-ipv6-networking",children:"Single-stack IPv6 Networking"}),"\n",(0,s.jsx)(n.admonition,{title:"Version Gate",type:"info",children:(0,s.jsxs)(n.p,{children:["Available as of ",(0,s.jsx)(n.a,{href:"https://github.com/k3s-io/k3s/releases/tag/v1.22.9%2Bk3s1",children:"v1.22.9+k3s1"})]})}),"\n",(0,s.jsx)(n.admonition,{title:"Known Issue",type:"warning",children:(0,s.jsxs)(n.p,{children:["If your IPv6 default route is set by a router advertisement (RA), you will need to set the sysctl ",(0,s.jsx)(n.code,{children:"net.ipv6.conf.all.accept_ra=2"}),"; otherwise, the node will drop the default route once it expires. Be aware that accepting RAs could increase the risk of ",(0,s.jsx)(n.a,{href:"https://github.com/kubernetes/kubernetes/issues/91507",children:"man-in-the-middle attacks"}),"."]})}),"\n",(0,s.jsxs)(n.p,{children:["Single-stack IPv6 clusters (clusters without IPv4) are supported on K3s using the ",(0,s.jsx)(n.code,{children:"--cluster-cidr"})," and ",(0,s.jsx)(n.code,{children:"--service-cidr"})," flags. This is an example of a valid configuration:"]}),"\n",(0,s.jsx)(n.pre,{children:(0,s.jsx)(n.code,{className:"language-bash",children:"--cluster-cidr=2001:cafe:42::/56 --service-cidr=2001:cafe:43::/112\n"})}),"\n",(0,s.jsx)(n.h2,{id:"nodes-without-a-hostname",children:"Nodes Without a Hostname"}),"\n",(0,s.jsxs)(n.p,{children:['Some cloud providers, such as Linode, will create machines with "localhost" as the hostname and others may not have a hostname set at all. This can cause problems with domain name resolution. You can run K3s with the ',(0,s.jsx)(n.code,{children:"--node-name"})," flag or ",(0,s.jsx)(n.code,{children:"K3S_NODE_NAME"})," environment variable and this will pass the node name to resolve this issue."]})]})}function h(e={}){const{wrapper:n}={...(0,t.a)(),...e.components};return n?(0,s.jsx)(n,{...e,children:(0,s.jsx)(c,{...e})}):c(e)}function u(e,n){throw new Error("Expected "+(n?"component":"object")+" `"+e+"` to be defined: you likely forgot to import, pass, or provide it.")}},1151:(e,n,i)=>{i.d(n,{Z:()=>a,a:()=>o});var s=i(7294);const t={},r=s.createContext(t);function o(e){const n=s.useContext(r);return s.useMemo((function(){return"function"==typeof e?e(n):{...n,...e}}),[n,e])}function a(e){let n;return n=e.disableParentContext?"function"==typeof e.components?e.components(t):e.components||t:o(e.components),s.createElement(r.Provider,{value:n},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/0759a3f5.61f27b73.js b/assets/js/0759a3f5.01299847.js similarity index 99% rename from assets/js/0759a3f5.61f27b73.js rename to assets/js/0759a3f5.01299847.js index 69ad66fa9..3b81a75e3 100644 --- a/assets/js/0759a3f5.61f27b73.js +++ b/assets/js/0759a3f5.01299847.js @@ -1 +1 @@ -"use strict";(self.webpackChunkk_3_s_docs=self.webpackChunkk_3_s_docs||[]).push([[2409],{2714:(e,s,i)=>{i.r(s),i.d(s,{assets:()=>c,contentTitle:()=>l,default:()=>a,frontMatter:()=>n,metadata:()=>h,toc:()=>o});var r=i(5893),t=i(1151);const n={hide_table_of_contents:!0,sidebar_position:2},l="v1.29.X",h={id:"release-notes/v1.29.X",title:"v1.29.X",description:"Before upgrading from earlier releases, be sure to read the Kubernetes Urgent Upgrade Notes.",source:"@site/docs/release-notes/v1.29.X.md",sourceDirName:"release-notes",slug:"/release-notes/v1.29.X",permalink:"/release-notes/v1.29.X",draft:!1,unlisted:!1,editUrl:"https://github.com/k3s-io/docs/edit/main/docs/release-notes/v1.29.X.md",tags:[],version:"current",lastUpdatedAt:1723651727e3,sidebarPosition:2,frontMatter:{hide_table_of_contents:!0,sidebar_position:2},sidebar:"mySidebar",previous:{title:"v1.30.X",permalink:"/release-notes/v1.30.X"},next:{title:"v1.28.X",permalink:"/release-notes/v1.28.X"}},c={},o=[{value:"Release v1.29.7+k3s1",id:"release-v1297k3s1",level:2},{value:"Changes since v1.29.6+k3s2:",id:"changes-since-v1296k3s2",level:3},{value:"Release v1.29.6+k3s2",id:"release-v1296k3s2",level:2},{value:"Changes since v1.29.6+k3s1:",id:"changes-since-v1296k3s1",level:3},{value:"Release v1.29.6+k3s1",id:"release-v1296k3s1",level:2},{value:"Changes since v1.29.5+k3s1:",id:"changes-since-v1295k3s1",level:3},{value:"Release v1.29.5+k3s1",id:"release-v1295k3s1",level:2},{value:"Changes since v1.29.4+k3s1:",id:"changes-since-v1294k3s1",level:3},{value:"Release v1.29.4+k3s1",id:"release-v1294k3s1",level:2},{value:"Changes since v1.29.3+k3s1:",id:"changes-since-v1293k3s1",level:3},{value:"Release v1.29.3+k3s1",id:"release-v1293k3s1",level:2},{value:"Changes since v1.29.2+k3s1:",id:"changes-since-v1292k3s1",level:3},{value:"Release v1.29.2+k3s1",id:"release-v1292k3s1",level:2},{value:"Changes since v1.29.1+k3s2:",id:"changes-since-v1291k3s2",level:3},{value:"Release v1.29.1+k3s2",id:"release-v1291k3s2",level:2},{value:"Changes since v1.29.0+k3s1:",id:"changes-since-v1290k3s1",level:3},{value:"Release v1.29.0+k3s1",id:"release-v1290k3s1",level:2},{value:"Changes since v1.28.4+k3s2:",id:"changes-since-v1284k3s2",level:3}];function d(e){const s={a:"a",admonition:"admonition",code:"code",h1:"h1",h2:"h2",h3:"h3",header:"header",hr:"hr",li:"li",p:"p",strong:"strong",table:"table",tbody:"tbody",td:"td",th:"th",thead:"thead",tr:"tr",ul:"ul",...(0,t.a)(),...e.components};return(0,r.jsxs)(r.Fragment,{children:[(0,r.jsx)(s.header,{children:(0,r.jsx)(s.h1,{id:"v129x",children:"v1.29.X"})}),"\n",(0,r.jsx)(s.admonition,{title:"Upgrade Notice",type:"warning",children:(0,r.jsxs)(s.p,{children:["Before upgrading from earlier releases, be sure to read the Kubernetes ",(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.29.md#urgent-upgrade-notes",children:"Urgent Upgrade Notes"}),"."]})}),"\n",(0,r.jsxs)(s.table,{children:[(0,r.jsx)(s.thead,{children:(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.th,{children:"Version"}),(0,r.jsx)(s.th,{children:"Release date"}),(0,r.jsx)(s.th,{children:"Kubernetes"}),(0,r.jsx)(s.th,{children:"Kine"}),(0,r.jsx)(s.th,{children:"SQLite"}),(0,r.jsx)(s.th,{children:"Etcd"}),(0,r.jsx)(s.th,{children:"Containerd"}),(0,r.jsx)(s.th,{children:"Runc"}),(0,r.jsx)(s.th,{children:"Flannel"}),(0,r.jsx)(s.th,{children:"Metrics-server"}),(0,r.jsx)(s.th,{children:"Traefik"}),(0,r.jsx)(s.th,{children:"CoreDNS"}),(0,r.jsx)(s.th,{children:"Helm-controller"}),(0,r.jsx)(s.th,{children:"Local-path-provisioner"})]})}),(0,r.jsxs)(s.tbody,{children:[(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"/release-notes/v1.29.X#release-v1297k3s1",children:"v1.29.7+k3s1"})}),(0,r.jsx)(s.td,{children:"Jul 31 2024"}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.29.md#v1297",children:"v1.29.7"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/kine/releases/tag/v0.11.11",children:"v0.11.11"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://sqlite.org/releaselog/3_44_0.html",children:"3.44.0"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/etcd/releases/tag/v3.5.13-k3s1",children:"v3.5.13-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/containerd/releases/tag/v1.7.17-k3s1",children:"v1.7.17-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/opencontainers/runc/releases/tag/v1.1.12",children:"v1.1.12"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/flannel-io/flannel/releases/tag/v0.25.4",children:"v0.25.4"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.7.0",children:"v0.7.0"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/traefik/traefik/releases/tag/v2.10.7",children:"v2.10.7"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/coredns/coredns/releases/tag/v1.10.1",children:"v1.10.1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/helm-controller/releases/tag/v0.15.10",children:"v0.15.10"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/rancher/local-path-provisioner/releases/tag/v0.0.28",children:"v0.0.28"})})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"/release-notes/v1.29.X#release-v1296k3s2",children:"v1.29.6+k3s2"})}),(0,r.jsx)(s.td,{children:"Jul 03 2024"}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.29.md#v1296",children:"v1.29.6"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/kine/releases/tag/v0.11.9",children:"v0.11.9"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://sqlite.org/releaselog/3_44_0.html",children:"3.44.0"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/etcd/releases/tag/v3.5.13-k3s1",children:"v3.5.13-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/containerd/releases/tag/v1.7.17-k3s1",children:"v1.7.17-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/opencontainers/runc/releases/tag/v1.1.12",children:"v1.1.12-"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/flannel-io/flannel/releases/tag/v0.25.4",children:"v0.25.4"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.7.0",children:"v0.7.0"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/traefik/traefik/releases/tag/v2.10.7",children:"v2.10.7"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/coredns/coredns/releases/tag/v1.10.1",children:"v1.10.1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/helm-controller/releases/tag/v0.15.10",children:"v0.15.10"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/rancher/local-path-provisioner/releases/tag/v0.0.27",children:"v0.0.27"})})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"/release-notes/v1.29.X#release-v1296k3s1",children:"v1.29.6+k3s1"})}),(0,r.jsx)(s.td,{children:"Jun 25 2024"}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.29.md#v1296",children:"v1.29.6"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/kine/releases/tag/v0.11.9",children:"v0.11.9"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://sqlite.org/releaselog/3_44_0.html",children:"3.44.0"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/etcd/releases/tag/v3.5.13-k3s1",children:"v3.5.13-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/containerd/releases/tag/v1.7.17-k3s1",children:"v1.7.17-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/opencontainers/runc/releases/tag/v1.1.12",children:"v1.1.12"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/flannel-io/flannel/releases/tag/v0.25.2",children:"v0.25.2"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.7.0",children:"v0.7.0"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/traefik/traefik/releases/tag/v2.10.7",children:"v2.10.7"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/coredns/coredns/releases/tag/v1.10.1",children:"v1.10.1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/helm-controller/releases/tag/v0.15.10",children:"v0.15.10"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/rancher/local-path-provisioner/releases/tag/v0.0.27",children:"v0.0.27"})})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"/release-notes/v1.29.X#release-v1295k3s1",children:"v1.29.5+k3s1"})}),(0,r.jsx)(s.td,{children:"May 22 2024"}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.29.md#v1295",children:"v1.29.5"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/kine/releases/tag/v0.11.7",children:"v0.11.7"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://sqlite.org/releaselog/3_44_0.html",children:"3.44.0"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/etcd/releases/tag/v3.5.9-k3s1",children:"v3.5.9-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/containerd/releases/tag/v1.7.15-k3s1",children:"v1.7.15-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/opencontainers/runc/releases/tag/v1.1.12-k3s1",children:"v1.1.12-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/flannel-io/flannel/releases/tag/v0.24.2",children:"v0.24.2"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.7.0",children:"v0.7.0"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/traefik/traefik/releases/tag/v2.10.7",children:"v2.10.7"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/coredns/coredns/releases/tag/v1.10.1",children:"v1.10.1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/helm-controller/releases/tag/v0.15.9",children:"v0.15.9"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/rancher/local-path-provisioner/releases/tag/v0.0.26",children:"v0.0.26"})})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"/release-notes/v1.29.X#release-v1294k3s1",children:"v1.29.4+k3s1"})}),(0,r.jsx)(s.td,{children:"Apr 25 2024"}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.29.md#v1294",children:"v1.29.4"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/kine/releases/tag/v0.11.7",children:"v0.11.7"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://sqlite.org/releaselog/3_44_0.html",children:"3.44.0"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/etcd/releases/tag/v3.5.9-k3s1",children:"v3.5.9-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/containerd/releases/tag/v1.7.15-k3s1",children:"v1.7.15-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/opencontainers/runc/releases/tag/v1.1.12",children:"v1.1.12"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/flannel-io/flannel/releases/tag/v0.24.2",children:"v0.24.2"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.7.0",children:"v0.7.0"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/traefik/traefik/releases/tag/v2.10.7",children:"v2.10.7"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/coredns/coredns/releases/tag/v1.10.1",children:"v1.10.1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/helm-controller/releases/tag/v0.15.9",children:"v0.15.9"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/rancher/local-path-provisioner/releases/tag/v0.0.26",children:"v0.0.26"})})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"/release-notes/v1.29.X#release-v1293k3s1",children:"v1.29.3+k3s1"})}),(0,r.jsx)(s.td,{children:"Mar 25 2024"}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.29.md#v1293",children:"v1.29.3"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/kine/releases/tag/v0.11.4",children:"v0.11.4"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://sqlite.org/releaselog/3_44_0.html",children:"3.44.0"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/etcd/releases/tag/v3.5.9-k3s1",children:"v3.5.9-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/containerd/releases/tag/v1.7.11-k3s2",children:"v1.7.11-k3s2"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/opencontainers/runc/releases/tag/v1.1.12-k3s1",children:"v1.1.12-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/flannel-io/flannel/releases/tag/v0.24.2",children:"v0.24.2"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.7.0",children:"v0.7.0"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/traefik/traefik/releases/tag/v2.10.5",children:"v2.10.5"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/coredns/coredns/releases/tag/v1.10.1",children:"v1.10.1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/helm-controller/releases/tag/v0.15.9",children:"v0.15.9"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/rancher/local-path-provisioner/releases/tag/v0.0.26",children:"v0.0.26"})})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"/release-notes/v1.29.X#release-v1292k3s1",children:"v1.29.2+k3s1"})}),(0,r.jsx)(s.td,{children:"Feb 29 2024"}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.29.md#v1292",children:"v1.29.2"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/kine/releases/tag/v0.11.4",children:"v0.11.4"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://sqlite.org/releaselog/3_44_0.html",children:"3.44.0"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/etcd/releases/tag/v3.5.9-k3s1",children:"v3.5.9-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/containerd/releases/tag/v1.7.11-k3s2",children:"v1.7.11-k3s2"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/runc/releases/tag/v1.1.12-k3s1",children:"v1.1.12-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/flannel-io/flannel/releases/tag/v0.24.2",children:"v0.24.2"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.6.3",children:"v0.6.3"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/traefik/traefik/releases/tag/v2.10.5",children:"v2.10.5"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/coredns/coredns/releases/tag/v1.10.1",children:"v1.10.1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/helm-controller/releases/tag/v0.15.8",children:"v0.15.8"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/rancher/local-path-provisioner/releases/tag/v0.0.26",children:"v0.0.26"})})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"/release-notes/v1.29.X#release-v1291k3s2",children:"v1.29.1+k3s2"})}),(0,r.jsx)(s.td,{children:"Feb 06 2024"}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.29.md#v1291",children:"v1.29.1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/kine/releases/tag/v0.11.0",children:"v0.11.0"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://sqlite.org/releaselog/3_42_0.html",children:"3.42.0"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/etcd/releases/tag/v3.5.9-k3s1",children:"v3.5.9-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/containerd/releases/tag/v1.7.11-k3s2",children:"v1.7.11-k3s2"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/opencontainers/runc/releases/tag/v1.1.12-k3s1",children:"v1.1.12-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/flannel-io/flannel/releases/tag/v0.24.0",children:"v0.24.0"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.6.3",children:"v0.6.3"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/traefik/traefik/releases/tag/v2.10.5",children:"v2.10.5"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/coredns/coredns/releases/tag/v1.10.1",children:"v1.10.1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/helm-controller/releases/tag/v0.15.8",children:"v0.15.8"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/rancher/local-path-provisioner/releases/tag/v0.0.24",children:"v0.0.24"})})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"/release-notes/v1.29.X#release-v1290k3s1",children:"v1.29.0+k3s1"})}),(0,r.jsx)(s.td,{children:"Dec 22 2023"}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.29.md#v1290",children:"v1.29.0"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/kine/releases/tag/v0.11.0",children:"v0.11.0"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://sqlite.org/releaselog/3_42_0.html",children:"3.42.0"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/etcd/releases/tag/v3.5.9-k3s1",children:"v3.5.9-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/containerd/releases/tag/v1.7.11-k3s2",children:"v1.7.11-k3s2"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/opencontainers/runc/releases/tag/v1.1.10",children:"v1.1.10"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/flannel-io/flannel/releases/tag/v0.24.0",children:"v0.24.0"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.6.3",children:"v0.6.3"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/traefik/traefik/releases/tag/v2.10.5",children:"v2.10.5"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/coredns/coredns/releases/tag/v1.10.1",children:"v1.10.1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/helm-controller/releases/tag/v0.15.4",children:"v0.15.4"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/rancher/local-path-provisioner/releases/tag/v0.0.24",children:"v0.0.24"})})]})]})]}),"\n",(0,r.jsx)("br",{}),"\n",(0,r.jsxs)(s.h2,{id:"release-v1297k3s1",children:["Release ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/releases/tag/v1.29.7+k3s1",children:"v1.29.7+k3s1"})]}),"\n",(0,r.jsx)(s.p,{children:"This release updates Kubernetes to v1.29.7, and fixes a number of issues."}),"\n",(0,r.jsxs)(s.p,{children:["For more details on what's new, see the ",(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.29.md#changelog-since-v1296",children:"Kubernetes release notes"}),"."]}),"\n",(0,r.jsx)(s.h3,{id:"changes-since-v1296k3s2",children:"Changes since v1.29.6+k3s2:"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsxs)(s.li,{children:["Backports for 2024-07 release cycle ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10498",children:"(#10498)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:"Bump k3s-root to v0.14.0"}),"\n",(0,r.jsx)(s.li,{children:"Bump github.com/hashicorp/go-retryablehttp from 0.7.4 to 0.7.7"}),"\n",(0,r.jsx)(s.li,{children:"Bump Local Path Provisioner version"}),"\n",(0,r.jsx)(s.li,{children:"Ensure remotedialer kubelet connections use kubelet bind address"}),"\n",(0,r.jsx)(s.li,{children:"Chore: Bump Trivy version"}),"\n",(0,r.jsx)(s.li,{children:"Add etcd s3 config secret implementation"}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["July Test Backports ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10508",children:"(#10508)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Update to v1.29.7-k3s1 and Go 1.22.5 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10539",children:"(#10539)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Fix issues loading data-dir value from env vars or dropping config files ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10597",children:"(#10597)"})]}),"\n"]}),"\n",(0,r.jsx)(s.hr,{}),"\n",(0,r.jsxs)(s.h2,{id:"release-v1296k3s2",children:["Release ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/releases/tag/v1.29.6+k3s2",children:"v1.29.6+k3s2"})]}),"\n",(0,r.jsx)(s.p,{children:"This release updates Kubernetes to v1.29.6, and fixes a number of issues."}),"\n",(0,r.jsxs)(s.p,{children:["For more details on what's new, see the ",(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.29.md#changelog-since-v1296",children:"Kubernetes release notes"}),"."]}),"\n",(0,r.jsx)(s.h3,{id:"changes-since-v1296k3s1",children:"Changes since v1.29.6+k3s1:"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsxs)(s.li,{children:["Update flannel to v0.25.4 and fixed issue with IPv6 mask ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10427",children:"(#10427)"})]}),"\n"]}),"\n",(0,r.jsx)(s.hr,{}),"\n",(0,r.jsxs)(s.h2,{id:"release-v1296k3s1",children:["Release ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/releases/tag/v1.29.6+k3s1",children:"v1.29.6+k3s1"})]}),"\n",(0,r.jsx)(s.p,{children:"This release updates Kubernetes to v1.29.6, and fixes a number of issues."}),"\n",(0,r.jsxs)(s.p,{children:["For more details on what's new, see the ",(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.29.md#changelog-since-v1295",children:"Kubernetes release notes"}),"."]}),"\n",(0,r.jsx)(s.h3,{id:"changes-since-v1295k3s1",children:"Changes since v1.29.5+k3s1:"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsxs)(s.li,{children:["Fix bug when using tailscale config by file ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10142",children:"(#10142)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Bump flannel version to v0.25.2 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10220",children:"(#10220)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Update kube-router version to v2.1.2 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10181",children:"(#10181)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Improve tailscale test & add extra log in e2e tests ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10212",children:"(#10212)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Backports for 2024-06 release cycle ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10249",children:"(#10249)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:"Add WithSkipMissing to not fail import on missing blobs"}),"\n",(0,r.jsx)(s.li,{children:"Use fixed stream server bind address for cri-dockerd"}),"\n",(0,r.jsx)(s.li,{children:"Switch stargz over to cri registry config_path"}),"\n",(0,r.jsx)(s.li,{children:"Bump to containerd v1.7.17, etcd v3.5.13"}),"\n",(0,r.jsx)(s.li,{children:"Bump spegel version"}),"\n",(0,r.jsx)(s.li,{children:"Fix issue with externalTrafficPolicy: Local for single-stack services on dual-stack nodes"}),"\n",(0,r.jsxs)(s.li,{children:["ServiceLB now sets the priorityClassName on svclb pods to ",(0,r.jsx)(s.code,{children:"system-node-critical"})," by default. This can be overridden on a per-service basis via the ",(0,r.jsx)(s.code,{children:"svccontroller.k3s.cattle.io/priorityclassname"})," annotation."]}),"\n",(0,r.jsx)(s.li,{children:"Bump minio-go to v7.0.70"}),"\n",(0,r.jsx)(s.li,{children:"Bump kine to v0.11.9 to fix pagination"}),"\n",(0,r.jsx)(s.li,{children:"Update valid resolv conf"}),"\n",(0,r.jsx)(s.li,{children:"Add missing kernel config check"}),"\n",(0,r.jsx)(s.li,{children:"Symlinked sub-directories are now respected when scanning Auto-Deploying Manifests (AddOns)"}),"\n",(0,r.jsx)(s.li,{children:"Fix bug: allow helm controller set owner reference"}),"\n",(0,r.jsx)(s.li,{children:"Bump klipper-helm image for tls secret support"}),"\n",(0,r.jsx)(s.li,{children:"Fix issue with k3s-etcd informers not starting"}),"\n",(0,r.jsxs)(s.li,{children:[(0,r.jsx)(s.code,{children:"--Enable-pprof"})," can now be set on agents to enable the debug/pprof endpoints. When set, agents will listen on the supervisor port."]}),"\n",(0,r.jsxs)(s.li,{children:[(0,r.jsx)(s.code,{children:"--Supervisor-metrics"})," can now be set on servers to enable serving internal metrics on the supervisor endpoint; when set agents will listen on the supervisor port."]}),"\n",(0,r.jsx)(s.li,{children:"Fix netpol crash when node remains tainted uninitialized"}),"\n",(0,r.jsx)(s.li,{children:"The embedded load-balancer will now fall back to trying all servers with health-checks ignored, if all servers have been marked unavailable due to failed health checks."}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["More backports for 2024-06 release cycle ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10288",children:"(#10288)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Add snapshot retention etcd-s3-folder fix ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10316",children:"(#10316)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Add test for ",(0,r.jsx)(s.code,{children:"isValidResolvConf"})," (#10302) ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10329",children:"(#10329)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Fix race condition panic in loadbalancer.nextServer ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10322",children:"(#10322)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Fix typo, use ",(0,r.jsx)(s.code,{children:"rancher/permissions"})," ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10298",children:"(#10298)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Expand GHA go caching to include newest release branch ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10334",children:"(#10334)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Update Kubernetes to v1.29.6 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10348",children:"(#10348)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Fix agent supervisor port using apiserver port instead ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10354",children:"(#10354)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Fix issue that allowed multiple simultaneous snapshots to be allowed ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10376",children:"(#10376)"})]}),"\n"]}),"\n",(0,r.jsx)(s.hr,{}),"\n",(0,r.jsxs)(s.h2,{id:"release-v1295k3s1",children:["Release ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/releases/tag/v1.29.5+k3s1",children:"v1.29.5+k3s1"})]}),"\n",(0,r.jsx)(s.p,{children:"This release updates Kubernetes to v1.29.5, and fixes a number of issues."}),"\n",(0,r.jsxs)(s.p,{children:["For more details on what's new, see the ",(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.29.md#changelog-since-v1294",children:"Kubernetes release notes"}),"."]}),"\n",(0,r.jsx)(s.h3,{id:"changes-since-v1294k3s1",children:"Changes since v1.29.4+k3s1:"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsxs)(s.li,{children:["Update stable channel to v1.29.4+k3s1 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10031",children:"(#10031)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Add E2E Split Server to Drone, support parallel testing in Drone ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9940",children:"(#9940)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Bump E2E opensuse leap to 15.6, fix btrfs test ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10057",children:"(#10057)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Replace deprecated ruby function ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10091",children:"(#10091)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Set correct release channel for e2e upgrade test ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10106",children:"(#10106)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Windows changes ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10115",children:"(#10115)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Update to v1.29.5-k3s1 and Go 1.21.9 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10108",children:"(#10108)"})]}),"\n"]}),"\n",(0,r.jsx)(s.hr,{}),"\n",(0,r.jsxs)(s.h2,{id:"release-v1294k3s1",children:["Release ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/releases/tag/v1.29.4+k3s1",children:"v1.29.4+k3s1"})]}),"\n",(0,r.jsx)(s.p,{children:"This release updates Kubernetes to v1.29.4, and fixes a number of issues."}),"\n",(0,r.jsxs)(s.p,{children:["For more details on what's new, see the ",(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.29.md#changelog-since-v1293",children:"Kubernetes release notes"}),"."]}),"\n",(0,r.jsx)(s.h3,{id:"changes-since-v1293k3s1",children:"Changes since v1.29.3+k3s1:"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsxs)(s.li,{children:["Send error response if member list cannot be retrieved ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9722",children:"(#9722)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Respect cloud-provider fields set by kubelet ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9721",children:"(#9721)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:"The k3s stub cloud provider now respects the kubelet's requested provider-id, instance type, and topology labels"}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Fix error when image has already been pulled ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9770",children:"(#9770)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Add a new error when kine is with disable apiserver or disable etcd ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9766",children:"(#9766)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Bump k3s-root to v0.13.0 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9718",children:"(#9718)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Use ubuntu latest for better golang caching keys ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9711",children:"(#9711)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Bump Trivy version ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9780",children:"(#9780)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Move to ubuntu 23.10 for E2E tests ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9755",children:"(#9755)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Update channel server ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9808",children:"(#9808)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Add /etc/passwd and /etc/group to k3s docker image ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9784",children:"(#9784)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Fix etcd snapshot reconcile for agentless servers ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9809",children:"(#9809)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Add health-check support to loadbalancer ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9757",children:"(#9757)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Add tls for kine ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9572",children:"(#9572)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:"Kine is now able to use TLS"}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Transition from deprecated pointer library to ptr ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9801",children:"(#9801)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Remove old pinned dependencies ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9806",children:"(#9806)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Several E2E Matrix improvements ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9802",children:"(#9802)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Add certificate expiry check, events, and metrics ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9772",children:"(#9772)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Add updatecli policy to update k3s-root ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9844",children:"(#9844)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Bump Trivy version ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9840",children:"(#9840)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Add workaround for containerd hosts.toml bug when passing config for default registry endpoint ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9853",children:"(#9853)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Fix: agent volume in example docker compose ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9838",children:"(#9838)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Bump spegel to v0.0.20-k3s1 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9863",children:"(#9863)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Add supervisor cert/key to rotate list ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9832",children:"(#9832)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Add quotes to avoid useless updatecli updates ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9877",children:"(#9877)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Bump containerd and cri-dockerd ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9886",children:"(#9886)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:"The embedded containerd has been bumped to v1.7.15"}),"\n",(0,r.jsx)(s.li,{children:"The embedded cri-dockerd has been bumped to v0.3.12"}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Move etcd snapshot management CLI to request/response ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9816",children:"(#9816)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsxs)(s.li,{children:["The ",(0,r.jsx)(s.code,{children:"k3s etcd-snapshot"})," command has been reworked for improved consistency. All snapshots operations are now performed by the server process, with the CLI acting as a client to initiate and report results. As a side effect, the CLI is now less noisy when managing snapshots."]}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Improve etcd load-balancer startup behavior ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9883",children:"(#9883)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Actually fix agent certificate rotation ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9902",children:"(#9902)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Bump latest to v1.29.3+k3s1 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9909",children:"(#9909)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Update packaged manifests ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9920",children:"(#9920)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:"Traefik has been bumped to v2.10.7."}),"\n",(0,r.jsx)(s.li,{children:"Traefik pod annotations are now set properly in the default chart values."}),"\n",(0,r.jsx)(s.li,{children:"The system-default-registry value now supports RFC2732 IPv6 literals."}),"\n",(0,r.jsxs)(s.li,{children:["The local-path provisioner now defaults to creating ",(0,r.jsx)(s.code,{children:"local"})," volumes, instead of ",(0,r.jsx)(s.code,{children:"hostPath"}),"."]}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Allow Local path provisioner to read helper logs ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9835",children:"(#9835)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Update kube-router to v2.1.0 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9926",children:"(#9926)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Match setup-go caching key in GitHub Actions ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9890",children:"(#9890)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Add startup testlet on preloaded images ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9941",children:"(#9941)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Update to v1.29.4-k3s1 and Go 1.21.9 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9960",children:"(#9960)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Fix on-demand snapshots timing out; not honoring folder ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9984",children:"(#9984)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Make ",(0,r.jsx)(s.code,{children:"/db/info"})," available anonymously from localhost ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10001",children:"(#10001)"})]}),"\n"]}),"\n",(0,r.jsx)(s.hr,{}),"\n",(0,r.jsxs)(s.h2,{id:"release-v1293k3s1",children:["Release ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/releases/tag/v1.29.3+k3s1",children:"v1.29.3+k3s1"})]}),"\n",(0,r.jsx)(s.p,{children:"This release updates Kubernetes to v1.29.3, and fixes a number of issues."}),"\n",(0,r.jsxs)(s.p,{children:["For more details on what's new, see the ",(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.29.md#changelog-since-v1292",children:"Kubernetes release notes"}),"."]}),"\n",(0,r.jsx)(s.h3,{id:"changes-since-v1292k3s1",children:"Changes since v1.29.2+k3s1:"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsxs)(s.li,{children:["Testing ADR ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9562",children:"(#9562)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Unit Testing Matrix and Actions bump ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9479",children:"(#9479)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Update install test OS matrix ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9480",children:"(#9480)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Update klipper-lb image version ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9488",children:"(#9488)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Add an integration test for flannel-backend=none ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9582",children:"(#9582)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Better GitHub CI caching strategy for golang ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9495",children:"(#9495)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Correct formatting of GH PR sha256sum artifact ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9472",children:"(#9472)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Rootless mode also bind service nodePort to host for LoadBalancer type ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9512",children:"(#9512)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:"Rootless mode should also bind service nodePort to host for LoadBalancer type, matching UX of rootful mode."}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Fix coredns NodeHosts on dual-stack clusters ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9584",children:"(#9584)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Tweak netpol node wait logs ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9581",children:"(#9581)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Fix issue with etcd node name missing hostname ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9522",children:"(#9522)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Bump helm-controller/klipper-helm versions ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9595",children:"(#9595)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Update stable channel to v1.28.7+k3s1 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9615",children:"(#9615)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Reenable Install and Snapshotter Testing ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9601",children:"(#9601)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Move docker tests into tests folder ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9555",children:"(#9555)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Fix setup-go typo ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9634",children:"(#9634)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Fix additional corner cases in registries handling ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9556",children:"(#9556)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Fix snapshot prune ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9502",children:"(#9502)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Use and version flannel/cni-plugin properly ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9635",children:"(#9635)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:"The embedded flannel cni-plugin binary is now built and versioned separate from the rest of the cni plugins and the embedded flannel controller."}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Bump spegel ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9599",children:"(#9599)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:"Bump spegel to v0.0.18-k3s3"}),"\n",(0,r.jsx)(s.li,{children:"Adds wildcard registry support"}),"\n",(0,r.jsx)(s.li,{children:"Fixes issue with excessive CPU utilization while waiting for containerd to start"}),"\n",(0,r.jsx)(s.li,{children:"Add env var to allow spegel mirroring of latest tag"}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Chore(deps): Remediating CVEs found by trivy; CVE-2023-45142 on otelrestful and CVE-2023-48795 on golang.org/x/crypto ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9513",children:"(#9513)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Fix: use correct wasm shims names ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9519",children:"(#9519)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Fix wildcard with embedded registry test ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9649",children:"(#9649)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Disable color outputs using ",(0,r.jsx)(s.code,{children:"NO_COLOR"})," env var ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9357",children:"(#9357)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsxs)(s.li,{children:["To enable raw output for the ",(0,r.jsx)(s.code,{children:"check-config"})," subcommand, you may now set NO_COLOR=1"]}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Improve tailscale e2e test ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9586",children:"(#9586)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Adjust first node-ip based on configured clusterCIDR ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9520",children:"(#9520)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Bump Trivy version ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9528",children:"(#9528)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Include flannel version in flannel cni plugin version ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9648",children:"(#9648)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:"The flannel controller version is now reported as build metadata on the flannel cni plugin version."}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Enable E2E tests on GitHub Actions ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9660",children:"(#9660)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Bump metrics-server to v0.7.0 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9673",children:"(#9673)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Bump upload and download actions to v4 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9666",children:"(#9666)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Warn and suppress duplicate registry mirror endpoints ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9697",children:"(#9697)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:"K3s will now warn and suppress duplicate entries in the mirror endpoint list for a registry. Containerd does not support listing the same endpoint multiple times as a mirror for a single upstream registry."}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Remove repetitive words ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9671",children:"(#9671)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Run Subset of Docker tests in GitHub Actions ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9698",children:"(#9698)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Fix wildcard entry upstream fallback ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9729",children:"(#9729)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Update to v1.29.3-k3s1 and Go 1.21.8 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9747",children:"(#9747)"})]}),"\n"]}),"\n",(0,r.jsx)(s.hr,{}),"\n",(0,r.jsxs)(s.h2,{id:"release-v1292k3s1",children:["Release ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/releases/tag/v1.29.2+k3s1",children:"v1.29.2+k3s1"})]}),"\n",(0,r.jsx)(s.p,{children:"This release updates Kubernetes to v1.29.2, and fixes a number of issues."}),"\n",(0,r.jsxs)(s.p,{children:["For more details on what's new, see the ",(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.29.md#changelog-since-v1291",children:"Kubernetes release notes"}),"."]}),"\n",(0,r.jsx)(s.h3,{id:"changes-since-v1291k3s2",children:"Changes since v1.29.1+k3s2:"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsxs)(s.li,{children:["Bump Local Path Provisioner version ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8953",children:"(#8953)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Add ability to install K3s PR Artifact from GitHub ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9185",children:"(#9185)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsxs)(s.li,{children:["Adds ",(0,r.jsx)(s.code,{children:"INSTALL_K3S_PR"})," option to install a build of K3s from any open PR with CI approval"]}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Bump Trivy version ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9237",children:"(#9237)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Bump codecov/codecov-action from 3 to 4 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9353",children:"(#9353)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Update stable channel ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9388",children:"(#9388)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Fix snapshot reconcile retry ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9318",children:"(#9318)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Add check for etcd-snapshot-dir and fix panic in Walk ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9317",children:"(#9317)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Bump CNI plugins to v1.4.0 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9249",children:"(#9249)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Fix issue with coredns node hosts controller ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9354",children:"(#9354)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:"Fixed issue that could cause coredns pods to fail to start when the embedded helm controller is disabled, due to the configmap not being updated with node hosts entries."}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Fix on-demand snapshots on ipv6-only nodes ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9247",children:"(#9247)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Bump flannel version ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9395",children:"(#9395)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:"Bumped flannel to v0.24.2"}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Build: Align drone base images ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8959",children:"(#8959)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Changed how lastHeartBeatTime works in the etcd condition ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9263",children:"(#9263)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Runtimes refactor using exec.LookPath ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9311",children:"(#9311)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:"Directories containing runtimes need to be included in the $PATH environment variable for effective runtime detection."}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Bump cri-dockerd to fix compat with Docker Engine 25 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9290",children:"(#9290)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Add codcov secret for integration tests on Push ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9422",children:"(#9422)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Allow executors to define ",(0,r.jsx)(s.code,{children:"containerd"})," and ",(0,r.jsx)(s.code,{children:"cridockerd"})," behavior ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9184",children:"(#9184)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Update Kube-router to v2.0.1 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9396",children:"(#9396)"})]}),"\n",(0,r.jsxs)(s.li,{children:[": Test_UnitApplyContainerdQoSClassConfigFileIfPresent (Created) ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8945",children:"(#8945)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Readd ",(0,r.jsx)(s.code,{children:"k3s secrets-encrypt rotate-keys"})," with correct support for KMSv2 GA ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9340",children:"(#9340)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Fix iptables check when sbin isn't in user PATH ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9344",children:"(#9344)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Don't create NodePasswordValidationFailed event if agent is disabled ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9312",children:"(#9312)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsxs)(s.li,{children:["The ",(0,r.jsx)(s.code,{children:"NodePasswordValidationFailed"})," Events will no longer be emitted, if the agent is disabled."]}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Expose rootless state dir under ~/.rancher/k3s/rootless ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9308",children:"(#9308)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsxs)(s.li,{children:["When running k3s in rootless mode, expose rootlesskit's state directory as ",(0,r.jsx)(s.code,{children:"~/.rancher/k3s/rootless"})]}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Expose rootless containerd socket directories for external access ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9309",children:"(#9309)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsxs)(s.li,{children:["Mount k3s rootless containerd & cri-dockerd socket directories to ",(0,r.jsx)(s.code,{children:"$XDG_RUNTIME_DIR/k3s/containerd"})," and ",(0,r.jsx)(s.code,{children:"$XDG_RUNTIME_DIR/k3s/cri-dockerd"})," respectively."]}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Bump kine and set NotifyInterval to what the apiserver expects ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9349",children:"(#9349)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Update Kubernetes to v1.29.2 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9493",children:"(#9493)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Fix drone publish for arm ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9503",children:"(#9503)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Remove failing Drone step ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9517",children:"(#9517)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Restore original order of agent startup functions ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9539",children:"(#9539)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Fix netpol startup when flannel is disabled ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9571",children:"(#9571)"})]}),"\n"]}),"\n",(0,r.jsx)(s.hr,{}),"\n",(0,r.jsxs)(s.h2,{id:"release-v1291k3s2",children:["Release ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/releases/tag/v1.29.1+k3s2",children:"v1.29.1+k3s2"})]}),"\n",(0,r.jsx)(s.p,{children:"This release updates Kubernetes to v1.29.1, and fixes a number of issues."}),"\n",(0,r.jsxs)(s.p,{children:["For more details on what's new, see the ",(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.29.md#changelog-since-v1290",children:"Kubernetes release notes"}),"."]}),"\n",(0,r.jsx)(s.p,{children:(0,r.jsx)(s.strong,{children:"Important Notes"})}),"\n",(0,r.jsxs)(s.p,{children:["Addresses the runc CVE: ",(0,r.jsx)(s.a,{href:"https://nvd.nist.gov/vuln/detail/CVE-2024-21626",children:"CVE-2024-21626"})," by updating runc to v1.1.12."]}),"\n",(0,r.jsx)(s.h3,{id:"changes-since-v1290k3s1",children:"Changes since v1.29.0+k3s1:"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsxs)(s.li,{children:["Bump Sonobuoy version ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8910",children:"(#8910)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Bump actions/setup-go from 4 to 5 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9036",children:"(#9036)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Chore: Update Code of Conduct to Redirect to CNCF CoC ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9104",children:"(#9104)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:"NONE"}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Update stable channel to v1.28.5+k3s1 and add v1.29 channel ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9110",children:"(#9110)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Added support for env *_PROXY variables for agent loadbalancer ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9070",children:"(#9070)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:"HTTP_PROXY, HTTPS_PROXY and NO_PROXY environment variables are now taken into account by the agent loadbalancer if K3S_AGENT_HTTP_PROXY_ALLOWED env variable is set to true."}),"\n",(0,r.jsxs)(s.li,{children:["This however doesn't affect local requests as the function used prevents that: ",(0,r.jsx)(s.a,{href:"https://pkg.go.dev/net/http#ProxyFromEnvironment",children:"https://pkg.go.dev/net/http#ProxyFromEnvironment"}),"."]}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Add a retry around updating a secrets-encrypt node annotations ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9039",children:"(#9039)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Silence SELinux warning on INSTALL_K3S_SKIP_SELINUX_RPM ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8703",children:"(#8703)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Add ServiceLB support for PodHostIPs FeatureGate ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8917",children:"(#8917)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Added support for env *_PROXY variables for agent loadbalancer ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9118",children:"(#9118)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Redirect error stream to null when checking nm-cloud systemd unit ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8815",children:"(#8815)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:'Remove confusing "nm-cloud-setup.service: No such file or directory" journalctl log'}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Dockerfile.dapper: set $HOME properly ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9090",children:"(#9090)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Add system-agent-installer-k3s step to GA release instructions ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9153",children:"(#9153)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Fix install script checksum ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9159",children:"(#9159)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Fix the OTHER etcd snapshot s3 log message that prints the wrong variable ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8944",children:"(#8944)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Handle logging flags when parsing kube-proxy args ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8916",children:"(#8916)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Fix nil map in full snapshot configmap reconcile ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9049",children:"(#9049)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Add support for containerd cri registry config_path ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8973",children:"(#8973)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Add more paths to crun runtime detection ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9086",children:"(#9086)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Add runtime checking of golang version ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9054",children:"(#9054)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Fix OS PRETTY_NAME on tagged releases ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9062",children:"(#9062)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Print error when downloading file error inside install script ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6874",children:"(#6874)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Wait for cloud-provider taint to be gone before starting the netpol controller ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9076",children:"(#9076)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Bump Trivy version ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8812",children:"(#8812)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Use ",(0,r.jsx)(s.code,{children:"ipFamilyPolicy: RequireDualStack"})," for dual-stack kube-dns ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8984",children:"(#8984)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Handle etcd status condition when node is not ready and disable etcd ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9084",children:"(#9084)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Update s3 e2e test ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9025",children:"(#9025)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Add e2e startup test for rootless k3s ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8383",children:"(#8383)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Add spegel distributed registry mirror ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8977",children:"(#8977)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Bump quic-go for CVE-2023-49295 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9208",children:"(#9208)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Enable network policy controller metrics ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9195",children:"(#9195)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:"Kube-router network policy controller metrics are now exposed via the default node metrics endpoint"}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Fix nonexistent dependency repositories ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9213",children:"(#9213)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Move proxy dialer out of init() and fix crash when using ",(0,r.jsx)(s.code,{children:"K3S_AGENT_HTTP_PROXY_ALLOWED=true"})," ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9219",children:"(#9219)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Error getting node in setEtcdStatusCondition ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9210",children:"(#9210)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Update to v1.29.1 and Go 1.21.6 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9259",children:"(#9259)"})]}),"\n",(0,r.jsxs)(s.li,{children:["New stale action ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9278",children:"(#9278)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Fix handling of bare hostname or IP as endpoint address in registries.yaml ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9323",children:"(#9323)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Bump runc to v1.1.12 and helm-controller to v0.15.7 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9332",children:"(#9332)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Bump helm-controller to fix issue with ChartContent ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9345",children:"(#9345)"})]}),"\n"]}),"\n",(0,r.jsx)(s.hr,{}),"\n",(0,r.jsxs)(s.h2,{id:"release-v1290k3s1",children:["Release ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/releases/tag/v1.29.0+k3s1",children:"v1.29.0+k3s1"})]}),"\n",(0,r.jsx)(s.p,{children:"This release is K3S's first in the v1.29 line. This release updates Kubernetes to v1.29.0."}),"\n",(0,r.jsxs)(s.p,{children:["Before upgrading from earlier releases, be sure to read the Kubernetes ",(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.29.md#urgent-upgrade-notes",children:"Urgent Upgrade Notes"}),"."]}),"\n",(0,r.jsx)(s.admonition,{title:"Important",type:"warning",children:(0,r.jsxs)(s.p,{children:["This release removes the experimental ",(0,r.jsx)(s.code,{children:"rotate-keys"})," subcommand due to changes in Kubernetes upstream for ",(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/issues/117728",children:"KMSv2"}),", the subcommand should be added back in future releases."]})}),"\n",(0,r.jsx)(s.admonition,{title:"Important",type:"warning",children:(0,r.jsxs)(s.p,{children:["This release also removes the ",(0,r.jsx)(s.code,{children:"multi-cluster-cidr"})," flag, since the support for this alpha feature has been removed completely from ",(0,r.jsx)(s.a,{href:"https://groups.google.com/g/kubernetes-sig-network/c/nts1xEZ--gQ/m/2aTOUNFFAAAJ",children:"Kubernetes upstream"}),", this flag should be removed from the configuration before upgrade."]})}),"\n",(0,r.jsx)(s.h3,{id:"changes-since-v1284k3s2",children:"Changes since v1.28.4+k3s2:"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsxs)(s.li,{children:["Fix overlapping address range ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8913",children:"(#8913)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Modify CONTRIBUTING.md guide ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8954",children:"(#8954)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Nov 2023 stable channel update ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9022",children:"(#9022)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Default runtime and runtime classes for wasm/nvidia/crun ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8936",children:"(#8936)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:"Added runtime classes for wasm/nvidia/crun"}),"\n",(0,r.jsx)(s.li,{children:"Added default runtime flag for containerd"}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Bump containerd/runc to v1.7.10-k3s1/v1.1.10 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8962",children:"(#8962)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Allow setting default-runtime on servers ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9027",children:"(#9027)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Bump containerd to v1.7.11 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9040",children:"(#9040)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Remove GA feature-gates ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8970",children:"(#8970)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Only publish to code_cov on merged E2E builds ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9051",children:"(#9051)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Update Kubernetes to v1.29.0+k3s1 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9052",children:"(#9052)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Update flannel to v0.24.0 and remove multiclustercidr flag ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9075",children:"(#9075)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Remove rotate-keys subcommand ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9079",children:"(#9079)"})]}),"\n"]}),"\n",(0,r.jsx)(s.hr,{})]})}function a(e={}){const{wrapper:s}={...(0,t.a)(),...e.components};return s?(0,r.jsx)(s,{...e,children:(0,r.jsx)(d,{...e})}):d(e)}},1151:(e,s,i)=>{i.d(s,{Z:()=>h,a:()=>l});var r=i(7294);const t={},n=r.createContext(t);function l(e){const s=r.useContext(n);return r.useMemo((function(){return"function"==typeof e?e(s):{...s,...e}}),[s,e])}function h(e){let s;return s=e.disableParentContext?"function"==typeof e.components?e.components(t):e.components||t:l(e.components),r.createElement(n.Provider,{value:s},e.children)}}}]); \ No newline at end of file +"use strict";(self.webpackChunkk_3_s_docs=self.webpackChunkk_3_s_docs||[]).push([[2409],{2714:(e,s,i)=>{i.r(s),i.d(s,{assets:()=>c,contentTitle:()=>l,default:()=>a,frontMatter:()=>n,metadata:()=>h,toc:()=>o});var r=i(5893),t=i(1151);const n={hide_table_of_contents:!0,sidebar_position:2},l="v1.29.X",h={id:"release-notes/v1.29.X",title:"v1.29.X",description:"Before upgrading from earlier releases, be sure to read the Kubernetes Urgent Upgrade Notes.",source:"@site/docs/release-notes/v1.29.X.md",sourceDirName:"release-notes",slug:"/release-notes/v1.29.X",permalink:"/release-notes/v1.29.X",draft:!1,unlisted:!1,editUrl:"https://github.com/k3s-io/docs/edit/main/docs/release-notes/v1.29.X.md",tags:[],version:"current",lastUpdatedAt:1723747404e3,sidebarPosition:2,frontMatter:{hide_table_of_contents:!0,sidebar_position:2},sidebar:"mySidebar",previous:{title:"v1.30.X",permalink:"/release-notes/v1.30.X"},next:{title:"v1.28.X",permalink:"/release-notes/v1.28.X"}},c={},o=[{value:"Release v1.29.7+k3s1",id:"release-v1297k3s1",level:2},{value:"Changes since v1.29.6+k3s2:",id:"changes-since-v1296k3s2",level:3},{value:"Release v1.29.6+k3s2",id:"release-v1296k3s2",level:2},{value:"Changes since v1.29.6+k3s1:",id:"changes-since-v1296k3s1",level:3},{value:"Release v1.29.6+k3s1",id:"release-v1296k3s1",level:2},{value:"Changes since v1.29.5+k3s1:",id:"changes-since-v1295k3s1",level:3},{value:"Release v1.29.5+k3s1",id:"release-v1295k3s1",level:2},{value:"Changes since v1.29.4+k3s1:",id:"changes-since-v1294k3s1",level:3},{value:"Release v1.29.4+k3s1",id:"release-v1294k3s1",level:2},{value:"Changes since v1.29.3+k3s1:",id:"changes-since-v1293k3s1",level:3},{value:"Release v1.29.3+k3s1",id:"release-v1293k3s1",level:2},{value:"Changes since v1.29.2+k3s1:",id:"changes-since-v1292k3s1",level:3},{value:"Release v1.29.2+k3s1",id:"release-v1292k3s1",level:2},{value:"Changes since v1.29.1+k3s2:",id:"changes-since-v1291k3s2",level:3},{value:"Release v1.29.1+k3s2",id:"release-v1291k3s2",level:2},{value:"Changes since v1.29.0+k3s1:",id:"changes-since-v1290k3s1",level:3},{value:"Release v1.29.0+k3s1",id:"release-v1290k3s1",level:2},{value:"Changes since v1.28.4+k3s2:",id:"changes-since-v1284k3s2",level:3}];function d(e){const s={a:"a",admonition:"admonition",code:"code",h1:"h1",h2:"h2",h3:"h3",header:"header",hr:"hr",li:"li",p:"p",strong:"strong",table:"table",tbody:"tbody",td:"td",th:"th",thead:"thead",tr:"tr",ul:"ul",...(0,t.a)(),...e.components};return(0,r.jsxs)(r.Fragment,{children:[(0,r.jsx)(s.header,{children:(0,r.jsx)(s.h1,{id:"v129x",children:"v1.29.X"})}),"\n",(0,r.jsx)(s.admonition,{title:"Upgrade Notice",type:"warning",children:(0,r.jsxs)(s.p,{children:["Before upgrading from earlier releases, be sure to read the Kubernetes ",(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.29.md#urgent-upgrade-notes",children:"Urgent Upgrade Notes"}),"."]})}),"\n",(0,r.jsxs)(s.table,{children:[(0,r.jsx)(s.thead,{children:(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.th,{children:"Version"}),(0,r.jsx)(s.th,{children:"Release date"}),(0,r.jsx)(s.th,{children:"Kubernetes"}),(0,r.jsx)(s.th,{children:"Kine"}),(0,r.jsx)(s.th,{children:"SQLite"}),(0,r.jsx)(s.th,{children:"Etcd"}),(0,r.jsx)(s.th,{children:"Containerd"}),(0,r.jsx)(s.th,{children:"Runc"}),(0,r.jsx)(s.th,{children:"Flannel"}),(0,r.jsx)(s.th,{children:"Metrics-server"}),(0,r.jsx)(s.th,{children:"Traefik"}),(0,r.jsx)(s.th,{children:"CoreDNS"}),(0,r.jsx)(s.th,{children:"Helm-controller"}),(0,r.jsx)(s.th,{children:"Local-path-provisioner"})]})}),(0,r.jsxs)(s.tbody,{children:[(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"/release-notes/v1.29.X#release-v1297k3s1",children:"v1.29.7+k3s1"})}),(0,r.jsx)(s.td,{children:"Jul 31 2024"}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.29.md#v1297",children:"v1.29.7"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/kine/releases/tag/v0.11.11",children:"v0.11.11"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://sqlite.org/releaselog/3_44_0.html",children:"3.44.0"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/etcd/releases/tag/v3.5.13-k3s1",children:"v3.5.13-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/containerd/releases/tag/v1.7.17-k3s1",children:"v1.7.17-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/opencontainers/runc/releases/tag/v1.1.12",children:"v1.1.12"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/flannel-io/flannel/releases/tag/v0.25.4",children:"v0.25.4"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.7.0",children:"v0.7.0"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/traefik/traefik/releases/tag/v2.10.7",children:"v2.10.7"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/coredns/coredns/releases/tag/v1.10.1",children:"v1.10.1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/helm-controller/releases/tag/v0.15.10",children:"v0.15.10"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/rancher/local-path-provisioner/releases/tag/v0.0.28",children:"v0.0.28"})})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"/release-notes/v1.29.X#release-v1296k3s2",children:"v1.29.6+k3s2"})}),(0,r.jsx)(s.td,{children:"Jul 03 2024"}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.29.md#v1296",children:"v1.29.6"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/kine/releases/tag/v0.11.9",children:"v0.11.9"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://sqlite.org/releaselog/3_44_0.html",children:"3.44.0"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/etcd/releases/tag/v3.5.13-k3s1",children:"v3.5.13-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/containerd/releases/tag/v1.7.17-k3s1",children:"v1.7.17-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/opencontainers/runc/releases/tag/v1.1.12",children:"v1.1.12-"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/flannel-io/flannel/releases/tag/v0.25.4",children:"v0.25.4"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.7.0",children:"v0.7.0"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/traefik/traefik/releases/tag/v2.10.7",children:"v2.10.7"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/coredns/coredns/releases/tag/v1.10.1",children:"v1.10.1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/helm-controller/releases/tag/v0.15.10",children:"v0.15.10"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/rancher/local-path-provisioner/releases/tag/v0.0.27",children:"v0.0.27"})})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"/release-notes/v1.29.X#release-v1296k3s1",children:"v1.29.6+k3s1"})}),(0,r.jsx)(s.td,{children:"Jun 25 2024"}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.29.md#v1296",children:"v1.29.6"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/kine/releases/tag/v0.11.9",children:"v0.11.9"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://sqlite.org/releaselog/3_44_0.html",children:"3.44.0"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/etcd/releases/tag/v3.5.13-k3s1",children:"v3.5.13-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/containerd/releases/tag/v1.7.17-k3s1",children:"v1.7.17-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/opencontainers/runc/releases/tag/v1.1.12",children:"v1.1.12"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/flannel-io/flannel/releases/tag/v0.25.2",children:"v0.25.2"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.7.0",children:"v0.7.0"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/traefik/traefik/releases/tag/v2.10.7",children:"v2.10.7"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/coredns/coredns/releases/tag/v1.10.1",children:"v1.10.1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/helm-controller/releases/tag/v0.15.10",children:"v0.15.10"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/rancher/local-path-provisioner/releases/tag/v0.0.27",children:"v0.0.27"})})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"/release-notes/v1.29.X#release-v1295k3s1",children:"v1.29.5+k3s1"})}),(0,r.jsx)(s.td,{children:"May 22 2024"}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.29.md#v1295",children:"v1.29.5"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/kine/releases/tag/v0.11.7",children:"v0.11.7"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://sqlite.org/releaselog/3_44_0.html",children:"3.44.0"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/etcd/releases/tag/v3.5.9-k3s1",children:"v3.5.9-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/containerd/releases/tag/v1.7.15-k3s1",children:"v1.7.15-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/opencontainers/runc/releases/tag/v1.1.12-k3s1",children:"v1.1.12-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/flannel-io/flannel/releases/tag/v0.24.2",children:"v0.24.2"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.7.0",children:"v0.7.0"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/traefik/traefik/releases/tag/v2.10.7",children:"v2.10.7"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/coredns/coredns/releases/tag/v1.10.1",children:"v1.10.1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/helm-controller/releases/tag/v0.15.9",children:"v0.15.9"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/rancher/local-path-provisioner/releases/tag/v0.0.26",children:"v0.0.26"})})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"/release-notes/v1.29.X#release-v1294k3s1",children:"v1.29.4+k3s1"})}),(0,r.jsx)(s.td,{children:"Apr 25 2024"}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.29.md#v1294",children:"v1.29.4"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/kine/releases/tag/v0.11.7",children:"v0.11.7"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://sqlite.org/releaselog/3_44_0.html",children:"3.44.0"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/etcd/releases/tag/v3.5.9-k3s1",children:"v3.5.9-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/containerd/releases/tag/v1.7.15-k3s1",children:"v1.7.15-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/opencontainers/runc/releases/tag/v1.1.12",children:"v1.1.12"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/flannel-io/flannel/releases/tag/v0.24.2",children:"v0.24.2"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.7.0",children:"v0.7.0"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/traefik/traefik/releases/tag/v2.10.7",children:"v2.10.7"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/coredns/coredns/releases/tag/v1.10.1",children:"v1.10.1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/helm-controller/releases/tag/v0.15.9",children:"v0.15.9"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/rancher/local-path-provisioner/releases/tag/v0.0.26",children:"v0.0.26"})})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"/release-notes/v1.29.X#release-v1293k3s1",children:"v1.29.3+k3s1"})}),(0,r.jsx)(s.td,{children:"Mar 25 2024"}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.29.md#v1293",children:"v1.29.3"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/kine/releases/tag/v0.11.4",children:"v0.11.4"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://sqlite.org/releaselog/3_44_0.html",children:"3.44.0"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/etcd/releases/tag/v3.5.9-k3s1",children:"v3.5.9-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/containerd/releases/tag/v1.7.11-k3s2",children:"v1.7.11-k3s2"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/opencontainers/runc/releases/tag/v1.1.12-k3s1",children:"v1.1.12-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/flannel-io/flannel/releases/tag/v0.24.2",children:"v0.24.2"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.7.0",children:"v0.7.0"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/traefik/traefik/releases/tag/v2.10.5",children:"v2.10.5"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/coredns/coredns/releases/tag/v1.10.1",children:"v1.10.1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/helm-controller/releases/tag/v0.15.9",children:"v0.15.9"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/rancher/local-path-provisioner/releases/tag/v0.0.26",children:"v0.0.26"})})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"/release-notes/v1.29.X#release-v1292k3s1",children:"v1.29.2+k3s1"})}),(0,r.jsx)(s.td,{children:"Feb 29 2024"}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.29.md#v1292",children:"v1.29.2"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/kine/releases/tag/v0.11.4",children:"v0.11.4"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://sqlite.org/releaselog/3_44_0.html",children:"3.44.0"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/etcd/releases/tag/v3.5.9-k3s1",children:"v3.5.9-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/containerd/releases/tag/v1.7.11-k3s2",children:"v1.7.11-k3s2"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/runc/releases/tag/v1.1.12-k3s1",children:"v1.1.12-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/flannel-io/flannel/releases/tag/v0.24.2",children:"v0.24.2"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.6.3",children:"v0.6.3"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/traefik/traefik/releases/tag/v2.10.5",children:"v2.10.5"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/coredns/coredns/releases/tag/v1.10.1",children:"v1.10.1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/helm-controller/releases/tag/v0.15.8",children:"v0.15.8"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/rancher/local-path-provisioner/releases/tag/v0.0.26",children:"v0.0.26"})})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"/release-notes/v1.29.X#release-v1291k3s2",children:"v1.29.1+k3s2"})}),(0,r.jsx)(s.td,{children:"Feb 06 2024"}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.29.md#v1291",children:"v1.29.1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/kine/releases/tag/v0.11.0",children:"v0.11.0"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://sqlite.org/releaselog/3_42_0.html",children:"3.42.0"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/etcd/releases/tag/v3.5.9-k3s1",children:"v3.5.9-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/containerd/releases/tag/v1.7.11-k3s2",children:"v1.7.11-k3s2"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/opencontainers/runc/releases/tag/v1.1.12-k3s1",children:"v1.1.12-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/flannel-io/flannel/releases/tag/v0.24.0",children:"v0.24.0"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.6.3",children:"v0.6.3"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/traefik/traefik/releases/tag/v2.10.5",children:"v2.10.5"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/coredns/coredns/releases/tag/v1.10.1",children:"v1.10.1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/helm-controller/releases/tag/v0.15.8",children:"v0.15.8"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/rancher/local-path-provisioner/releases/tag/v0.0.24",children:"v0.0.24"})})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"/release-notes/v1.29.X#release-v1290k3s1",children:"v1.29.0+k3s1"})}),(0,r.jsx)(s.td,{children:"Dec 22 2023"}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.29.md#v1290",children:"v1.29.0"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/kine/releases/tag/v0.11.0",children:"v0.11.0"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://sqlite.org/releaselog/3_42_0.html",children:"3.42.0"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/etcd/releases/tag/v3.5.9-k3s1",children:"v3.5.9-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/containerd/releases/tag/v1.7.11-k3s2",children:"v1.7.11-k3s2"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/opencontainers/runc/releases/tag/v1.1.10",children:"v1.1.10"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/flannel-io/flannel/releases/tag/v0.24.0",children:"v0.24.0"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.6.3",children:"v0.6.3"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/traefik/traefik/releases/tag/v2.10.5",children:"v2.10.5"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/coredns/coredns/releases/tag/v1.10.1",children:"v1.10.1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/helm-controller/releases/tag/v0.15.4",children:"v0.15.4"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/rancher/local-path-provisioner/releases/tag/v0.0.24",children:"v0.0.24"})})]})]})]}),"\n",(0,r.jsx)("br",{}),"\n",(0,r.jsxs)(s.h2,{id:"release-v1297k3s1",children:["Release ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/releases/tag/v1.29.7+k3s1",children:"v1.29.7+k3s1"})]}),"\n",(0,r.jsx)(s.p,{children:"This release updates Kubernetes to v1.29.7, and fixes a number of issues."}),"\n",(0,r.jsxs)(s.p,{children:["For more details on what's new, see the ",(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.29.md#changelog-since-v1296",children:"Kubernetes release notes"}),"."]}),"\n",(0,r.jsx)(s.h3,{id:"changes-since-v1296k3s2",children:"Changes since v1.29.6+k3s2:"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsxs)(s.li,{children:["Backports for 2024-07 release cycle ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10498",children:"(#10498)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:"Bump k3s-root to v0.14.0"}),"\n",(0,r.jsx)(s.li,{children:"Bump github.com/hashicorp/go-retryablehttp from 0.7.4 to 0.7.7"}),"\n",(0,r.jsx)(s.li,{children:"Bump Local Path Provisioner version"}),"\n",(0,r.jsx)(s.li,{children:"Ensure remotedialer kubelet connections use kubelet bind address"}),"\n",(0,r.jsx)(s.li,{children:"Chore: Bump Trivy version"}),"\n",(0,r.jsx)(s.li,{children:"Add etcd s3 config secret implementation"}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["July Test Backports ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10508",children:"(#10508)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Update to v1.29.7-k3s1 and Go 1.22.5 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10539",children:"(#10539)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Fix issues loading data-dir value from env vars or dropping config files ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10597",children:"(#10597)"})]}),"\n"]}),"\n",(0,r.jsx)(s.hr,{}),"\n",(0,r.jsxs)(s.h2,{id:"release-v1296k3s2",children:["Release ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/releases/tag/v1.29.6+k3s2",children:"v1.29.6+k3s2"})]}),"\n",(0,r.jsx)(s.p,{children:"This release updates Kubernetes to v1.29.6, and fixes a number of issues."}),"\n",(0,r.jsxs)(s.p,{children:["For more details on what's new, see the ",(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.29.md#changelog-since-v1296",children:"Kubernetes release notes"}),"."]}),"\n",(0,r.jsx)(s.h3,{id:"changes-since-v1296k3s1",children:"Changes since v1.29.6+k3s1:"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsxs)(s.li,{children:["Update flannel to v0.25.4 and fixed issue with IPv6 mask ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10427",children:"(#10427)"})]}),"\n"]}),"\n",(0,r.jsx)(s.hr,{}),"\n",(0,r.jsxs)(s.h2,{id:"release-v1296k3s1",children:["Release ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/releases/tag/v1.29.6+k3s1",children:"v1.29.6+k3s1"})]}),"\n",(0,r.jsx)(s.p,{children:"This release updates Kubernetes to v1.29.6, and fixes a number of issues."}),"\n",(0,r.jsxs)(s.p,{children:["For more details on what's new, see the ",(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.29.md#changelog-since-v1295",children:"Kubernetes release notes"}),"."]}),"\n",(0,r.jsx)(s.h3,{id:"changes-since-v1295k3s1",children:"Changes since v1.29.5+k3s1:"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsxs)(s.li,{children:["Fix bug when using tailscale config by file ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10142",children:"(#10142)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Bump flannel version to v0.25.2 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10220",children:"(#10220)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Update kube-router version to v2.1.2 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10181",children:"(#10181)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Improve tailscale test & add extra log in e2e tests ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10212",children:"(#10212)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Backports for 2024-06 release cycle ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10249",children:"(#10249)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:"Add WithSkipMissing to not fail import on missing blobs"}),"\n",(0,r.jsx)(s.li,{children:"Use fixed stream server bind address for cri-dockerd"}),"\n",(0,r.jsx)(s.li,{children:"Switch stargz over to cri registry config_path"}),"\n",(0,r.jsx)(s.li,{children:"Bump to containerd v1.7.17, etcd v3.5.13"}),"\n",(0,r.jsx)(s.li,{children:"Bump spegel version"}),"\n",(0,r.jsx)(s.li,{children:"Fix issue with externalTrafficPolicy: Local for single-stack services on dual-stack nodes"}),"\n",(0,r.jsxs)(s.li,{children:["ServiceLB now sets the priorityClassName on svclb pods to ",(0,r.jsx)(s.code,{children:"system-node-critical"})," by default. This can be overridden on a per-service basis via the ",(0,r.jsx)(s.code,{children:"svccontroller.k3s.cattle.io/priorityclassname"})," annotation."]}),"\n",(0,r.jsx)(s.li,{children:"Bump minio-go to v7.0.70"}),"\n",(0,r.jsx)(s.li,{children:"Bump kine to v0.11.9 to fix pagination"}),"\n",(0,r.jsx)(s.li,{children:"Update valid resolv conf"}),"\n",(0,r.jsx)(s.li,{children:"Add missing kernel config check"}),"\n",(0,r.jsx)(s.li,{children:"Symlinked sub-directories are now respected when scanning Auto-Deploying Manifests (AddOns)"}),"\n",(0,r.jsx)(s.li,{children:"Fix bug: allow helm controller set owner reference"}),"\n",(0,r.jsx)(s.li,{children:"Bump klipper-helm image for tls secret support"}),"\n",(0,r.jsx)(s.li,{children:"Fix issue with k3s-etcd informers not starting"}),"\n",(0,r.jsxs)(s.li,{children:[(0,r.jsx)(s.code,{children:"--Enable-pprof"})," can now be set on agents to enable the debug/pprof endpoints. When set, agents will listen on the supervisor port."]}),"\n",(0,r.jsxs)(s.li,{children:[(0,r.jsx)(s.code,{children:"--Supervisor-metrics"})," can now be set on servers to enable serving internal metrics on the supervisor endpoint; when set agents will listen on the supervisor port."]}),"\n",(0,r.jsx)(s.li,{children:"Fix netpol crash when node remains tainted uninitialized"}),"\n",(0,r.jsx)(s.li,{children:"The embedded load-balancer will now fall back to trying all servers with health-checks ignored, if all servers have been marked unavailable due to failed health checks."}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["More backports for 2024-06 release cycle ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10288",children:"(#10288)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Add snapshot retention etcd-s3-folder fix ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10316",children:"(#10316)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Add test for ",(0,r.jsx)(s.code,{children:"isValidResolvConf"})," (#10302) ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10329",children:"(#10329)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Fix race condition panic in loadbalancer.nextServer ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10322",children:"(#10322)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Fix typo, use ",(0,r.jsx)(s.code,{children:"rancher/permissions"})," ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10298",children:"(#10298)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Expand GHA go caching to include newest release branch ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10334",children:"(#10334)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Update Kubernetes to v1.29.6 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10348",children:"(#10348)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Fix agent supervisor port using apiserver port instead ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10354",children:"(#10354)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Fix issue that allowed multiple simultaneous snapshots to be allowed ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10376",children:"(#10376)"})]}),"\n"]}),"\n",(0,r.jsx)(s.hr,{}),"\n",(0,r.jsxs)(s.h2,{id:"release-v1295k3s1",children:["Release ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/releases/tag/v1.29.5+k3s1",children:"v1.29.5+k3s1"})]}),"\n",(0,r.jsx)(s.p,{children:"This release updates Kubernetes to v1.29.5, and fixes a number of issues."}),"\n",(0,r.jsxs)(s.p,{children:["For more details on what's new, see the ",(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.29.md#changelog-since-v1294",children:"Kubernetes release notes"}),"."]}),"\n",(0,r.jsx)(s.h3,{id:"changes-since-v1294k3s1",children:"Changes since v1.29.4+k3s1:"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsxs)(s.li,{children:["Update stable channel to v1.29.4+k3s1 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10031",children:"(#10031)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Add E2E Split Server to Drone, support parallel testing in Drone ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9940",children:"(#9940)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Bump E2E opensuse leap to 15.6, fix btrfs test ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10057",children:"(#10057)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Replace deprecated ruby function ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10091",children:"(#10091)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Set correct release channel for e2e upgrade test ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10106",children:"(#10106)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Windows changes ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10115",children:"(#10115)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Update to v1.29.5-k3s1 and Go 1.21.9 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10108",children:"(#10108)"})]}),"\n"]}),"\n",(0,r.jsx)(s.hr,{}),"\n",(0,r.jsxs)(s.h2,{id:"release-v1294k3s1",children:["Release ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/releases/tag/v1.29.4+k3s1",children:"v1.29.4+k3s1"})]}),"\n",(0,r.jsx)(s.p,{children:"This release updates Kubernetes to v1.29.4, and fixes a number of issues."}),"\n",(0,r.jsxs)(s.p,{children:["For more details on what's new, see the ",(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.29.md#changelog-since-v1293",children:"Kubernetes release notes"}),"."]}),"\n",(0,r.jsx)(s.h3,{id:"changes-since-v1293k3s1",children:"Changes since v1.29.3+k3s1:"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsxs)(s.li,{children:["Send error response if member list cannot be retrieved ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9722",children:"(#9722)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Respect cloud-provider fields set by kubelet ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9721",children:"(#9721)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:"The k3s stub cloud provider now respects the kubelet's requested provider-id, instance type, and topology labels"}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Fix error when image has already been pulled ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9770",children:"(#9770)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Add a new error when kine is with disable apiserver or disable etcd ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9766",children:"(#9766)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Bump k3s-root to v0.13.0 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9718",children:"(#9718)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Use ubuntu latest for better golang caching keys ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9711",children:"(#9711)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Bump Trivy version ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9780",children:"(#9780)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Move to ubuntu 23.10 for E2E tests ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9755",children:"(#9755)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Update channel server ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9808",children:"(#9808)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Add /etc/passwd and /etc/group to k3s docker image ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9784",children:"(#9784)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Fix etcd snapshot reconcile for agentless servers ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9809",children:"(#9809)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Add health-check support to loadbalancer ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9757",children:"(#9757)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Add tls for kine ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9572",children:"(#9572)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:"Kine is now able to use TLS"}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Transition from deprecated pointer library to ptr ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9801",children:"(#9801)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Remove old pinned dependencies ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9806",children:"(#9806)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Several E2E Matrix improvements ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9802",children:"(#9802)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Add certificate expiry check, events, and metrics ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9772",children:"(#9772)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Add updatecli policy to update k3s-root ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9844",children:"(#9844)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Bump Trivy version ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9840",children:"(#9840)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Add workaround for containerd hosts.toml bug when passing config for default registry endpoint ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9853",children:"(#9853)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Fix: agent volume in example docker compose ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9838",children:"(#9838)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Bump spegel to v0.0.20-k3s1 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9863",children:"(#9863)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Add supervisor cert/key to rotate list ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9832",children:"(#9832)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Add quotes to avoid useless updatecli updates ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9877",children:"(#9877)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Bump containerd and cri-dockerd ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9886",children:"(#9886)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:"The embedded containerd has been bumped to v1.7.15"}),"\n",(0,r.jsx)(s.li,{children:"The embedded cri-dockerd has been bumped to v0.3.12"}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Move etcd snapshot management CLI to request/response ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9816",children:"(#9816)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsxs)(s.li,{children:["The ",(0,r.jsx)(s.code,{children:"k3s etcd-snapshot"})," command has been reworked for improved consistency. All snapshots operations are now performed by the server process, with the CLI acting as a client to initiate and report results. As a side effect, the CLI is now less noisy when managing snapshots."]}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Improve etcd load-balancer startup behavior ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9883",children:"(#9883)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Actually fix agent certificate rotation ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9902",children:"(#9902)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Bump latest to v1.29.3+k3s1 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9909",children:"(#9909)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Update packaged manifests ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9920",children:"(#9920)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:"Traefik has been bumped to v2.10.7."}),"\n",(0,r.jsx)(s.li,{children:"Traefik pod annotations are now set properly in the default chart values."}),"\n",(0,r.jsx)(s.li,{children:"The system-default-registry value now supports RFC2732 IPv6 literals."}),"\n",(0,r.jsxs)(s.li,{children:["The local-path provisioner now defaults to creating ",(0,r.jsx)(s.code,{children:"local"})," volumes, instead of ",(0,r.jsx)(s.code,{children:"hostPath"}),"."]}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Allow Local path provisioner to read helper logs ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9835",children:"(#9835)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Update kube-router to v2.1.0 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9926",children:"(#9926)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Match setup-go caching key in GitHub Actions ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9890",children:"(#9890)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Add startup testlet on preloaded images ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9941",children:"(#9941)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Update to v1.29.4-k3s1 and Go 1.21.9 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9960",children:"(#9960)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Fix on-demand snapshots timing out; not honoring folder ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9984",children:"(#9984)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Make ",(0,r.jsx)(s.code,{children:"/db/info"})," available anonymously from localhost ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10001",children:"(#10001)"})]}),"\n"]}),"\n",(0,r.jsx)(s.hr,{}),"\n",(0,r.jsxs)(s.h2,{id:"release-v1293k3s1",children:["Release ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/releases/tag/v1.29.3+k3s1",children:"v1.29.3+k3s1"})]}),"\n",(0,r.jsx)(s.p,{children:"This release updates Kubernetes to v1.29.3, and fixes a number of issues."}),"\n",(0,r.jsxs)(s.p,{children:["For more details on what's new, see the ",(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.29.md#changelog-since-v1292",children:"Kubernetes release notes"}),"."]}),"\n",(0,r.jsx)(s.h3,{id:"changes-since-v1292k3s1",children:"Changes since v1.29.2+k3s1:"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsxs)(s.li,{children:["Testing ADR ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9562",children:"(#9562)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Unit Testing Matrix and Actions bump ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9479",children:"(#9479)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Update install test OS matrix ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9480",children:"(#9480)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Update klipper-lb image version ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9488",children:"(#9488)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Add an integration test for flannel-backend=none ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9582",children:"(#9582)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Better GitHub CI caching strategy for golang ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9495",children:"(#9495)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Correct formatting of GH PR sha256sum artifact ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9472",children:"(#9472)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Rootless mode also bind service nodePort to host for LoadBalancer type ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9512",children:"(#9512)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:"Rootless mode should also bind service nodePort to host for LoadBalancer type, matching UX of rootful mode."}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Fix coredns NodeHosts on dual-stack clusters ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9584",children:"(#9584)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Tweak netpol node wait logs ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9581",children:"(#9581)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Fix issue with etcd node name missing hostname ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9522",children:"(#9522)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Bump helm-controller/klipper-helm versions ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9595",children:"(#9595)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Update stable channel to v1.28.7+k3s1 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9615",children:"(#9615)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Reenable Install and Snapshotter Testing ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9601",children:"(#9601)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Move docker tests into tests folder ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9555",children:"(#9555)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Fix setup-go typo ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9634",children:"(#9634)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Fix additional corner cases in registries handling ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9556",children:"(#9556)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Fix snapshot prune ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9502",children:"(#9502)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Use and version flannel/cni-plugin properly ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9635",children:"(#9635)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:"The embedded flannel cni-plugin binary is now built and versioned separate from the rest of the cni plugins and the embedded flannel controller."}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Bump spegel ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9599",children:"(#9599)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:"Bump spegel to v0.0.18-k3s3"}),"\n",(0,r.jsx)(s.li,{children:"Adds wildcard registry support"}),"\n",(0,r.jsx)(s.li,{children:"Fixes issue with excessive CPU utilization while waiting for containerd to start"}),"\n",(0,r.jsx)(s.li,{children:"Add env var to allow spegel mirroring of latest tag"}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Chore(deps): Remediating CVEs found by trivy; CVE-2023-45142 on otelrestful and CVE-2023-48795 on golang.org/x/crypto ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9513",children:"(#9513)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Fix: use correct wasm shims names ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9519",children:"(#9519)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Fix wildcard with embedded registry test ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9649",children:"(#9649)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Disable color outputs using ",(0,r.jsx)(s.code,{children:"NO_COLOR"})," env var ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9357",children:"(#9357)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsxs)(s.li,{children:["To enable raw output for the ",(0,r.jsx)(s.code,{children:"check-config"})," subcommand, you may now set NO_COLOR=1"]}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Improve tailscale e2e test ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9586",children:"(#9586)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Adjust first node-ip based on configured clusterCIDR ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9520",children:"(#9520)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Bump Trivy version ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9528",children:"(#9528)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Include flannel version in flannel cni plugin version ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9648",children:"(#9648)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:"The flannel controller version is now reported as build metadata on the flannel cni plugin version."}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Enable E2E tests on GitHub Actions ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9660",children:"(#9660)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Bump metrics-server to v0.7.0 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9673",children:"(#9673)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Bump upload and download actions to v4 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9666",children:"(#9666)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Warn and suppress duplicate registry mirror endpoints ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9697",children:"(#9697)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:"K3s will now warn and suppress duplicate entries in the mirror endpoint list for a registry. Containerd does not support listing the same endpoint multiple times as a mirror for a single upstream registry."}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Remove repetitive words ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9671",children:"(#9671)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Run Subset of Docker tests in GitHub Actions ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9698",children:"(#9698)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Fix wildcard entry upstream fallback ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9729",children:"(#9729)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Update to v1.29.3-k3s1 and Go 1.21.8 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9747",children:"(#9747)"})]}),"\n"]}),"\n",(0,r.jsx)(s.hr,{}),"\n",(0,r.jsxs)(s.h2,{id:"release-v1292k3s1",children:["Release ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/releases/tag/v1.29.2+k3s1",children:"v1.29.2+k3s1"})]}),"\n",(0,r.jsx)(s.p,{children:"This release updates Kubernetes to v1.29.2, and fixes a number of issues."}),"\n",(0,r.jsxs)(s.p,{children:["For more details on what's new, see the ",(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.29.md#changelog-since-v1291",children:"Kubernetes release notes"}),"."]}),"\n",(0,r.jsx)(s.h3,{id:"changes-since-v1291k3s2",children:"Changes since v1.29.1+k3s2:"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsxs)(s.li,{children:["Bump Local Path Provisioner version ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8953",children:"(#8953)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Add ability to install K3s PR Artifact from GitHub ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9185",children:"(#9185)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsxs)(s.li,{children:["Adds ",(0,r.jsx)(s.code,{children:"INSTALL_K3S_PR"})," option to install a build of K3s from any open PR with CI approval"]}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Bump Trivy version ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9237",children:"(#9237)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Bump codecov/codecov-action from 3 to 4 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9353",children:"(#9353)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Update stable channel ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9388",children:"(#9388)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Fix snapshot reconcile retry ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9318",children:"(#9318)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Add check for etcd-snapshot-dir and fix panic in Walk ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9317",children:"(#9317)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Bump CNI plugins to v1.4.0 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9249",children:"(#9249)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Fix issue with coredns node hosts controller ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9354",children:"(#9354)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:"Fixed issue that could cause coredns pods to fail to start when the embedded helm controller is disabled, due to the configmap not being updated with node hosts entries."}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Fix on-demand snapshots on ipv6-only nodes ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9247",children:"(#9247)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Bump flannel version ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9395",children:"(#9395)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:"Bumped flannel to v0.24.2"}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Build: Align drone base images ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8959",children:"(#8959)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Changed how lastHeartBeatTime works in the etcd condition ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9263",children:"(#9263)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Runtimes refactor using exec.LookPath ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9311",children:"(#9311)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:"Directories containing runtimes need to be included in the $PATH environment variable for effective runtime detection."}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Bump cri-dockerd to fix compat with Docker Engine 25 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9290",children:"(#9290)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Add codcov secret for integration tests on Push ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9422",children:"(#9422)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Allow executors to define ",(0,r.jsx)(s.code,{children:"containerd"})," and ",(0,r.jsx)(s.code,{children:"cridockerd"})," behavior ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9184",children:"(#9184)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Update Kube-router to v2.0.1 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9396",children:"(#9396)"})]}),"\n",(0,r.jsxs)(s.li,{children:[": Test_UnitApplyContainerdQoSClassConfigFileIfPresent (Created) ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8945",children:"(#8945)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Readd ",(0,r.jsx)(s.code,{children:"k3s secrets-encrypt rotate-keys"})," with correct support for KMSv2 GA ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9340",children:"(#9340)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Fix iptables check when sbin isn't in user PATH ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9344",children:"(#9344)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Don't create NodePasswordValidationFailed event if agent is disabled ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9312",children:"(#9312)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsxs)(s.li,{children:["The ",(0,r.jsx)(s.code,{children:"NodePasswordValidationFailed"})," Events will no longer be emitted, if the agent is disabled."]}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Expose rootless state dir under ~/.rancher/k3s/rootless ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9308",children:"(#9308)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsxs)(s.li,{children:["When running k3s in rootless mode, expose rootlesskit's state directory as ",(0,r.jsx)(s.code,{children:"~/.rancher/k3s/rootless"})]}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Expose rootless containerd socket directories for external access ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9309",children:"(#9309)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsxs)(s.li,{children:["Mount k3s rootless containerd & cri-dockerd socket directories to ",(0,r.jsx)(s.code,{children:"$XDG_RUNTIME_DIR/k3s/containerd"})," and ",(0,r.jsx)(s.code,{children:"$XDG_RUNTIME_DIR/k3s/cri-dockerd"})," respectively."]}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Bump kine and set NotifyInterval to what the apiserver expects ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9349",children:"(#9349)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Update Kubernetes to v1.29.2 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9493",children:"(#9493)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Fix drone publish for arm ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9503",children:"(#9503)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Remove failing Drone step ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9517",children:"(#9517)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Restore original order of agent startup functions ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9539",children:"(#9539)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Fix netpol startup when flannel is disabled ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9571",children:"(#9571)"})]}),"\n"]}),"\n",(0,r.jsx)(s.hr,{}),"\n",(0,r.jsxs)(s.h2,{id:"release-v1291k3s2",children:["Release ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/releases/tag/v1.29.1+k3s2",children:"v1.29.1+k3s2"})]}),"\n",(0,r.jsx)(s.p,{children:"This release updates Kubernetes to v1.29.1, and fixes a number of issues."}),"\n",(0,r.jsxs)(s.p,{children:["For more details on what's new, see the ",(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.29.md#changelog-since-v1290",children:"Kubernetes release notes"}),"."]}),"\n",(0,r.jsx)(s.p,{children:(0,r.jsx)(s.strong,{children:"Important Notes"})}),"\n",(0,r.jsxs)(s.p,{children:["Addresses the runc CVE: ",(0,r.jsx)(s.a,{href:"https://nvd.nist.gov/vuln/detail/CVE-2024-21626",children:"CVE-2024-21626"})," by updating runc to v1.1.12."]}),"\n",(0,r.jsx)(s.h3,{id:"changes-since-v1290k3s1",children:"Changes since v1.29.0+k3s1:"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsxs)(s.li,{children:["Bump Sonobuoy version ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8910",children:"(#8910)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Bump actions/setup-go from 4 to 5 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9036",children:"(#9036)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Chore: Update Code of Conduct to Redirect to CNCF CoC ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9104",children:"(#9104)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:"NONE"}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Update stable channel to v1.28.5+k3s1 and add v1.29 channel ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9110",children:"(#9110)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Added support for env *_PROXY variables for agent loadbalancer ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9070",children:"(#9070)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:"HTTP_PROXY, HTTPS_PROXY and NO_PROXY environment variables are now taken into account by the agent loadbalancer if K3S_AGENT_HTTP_PROXY_ALLOWED env variable is set to true."}),"\n",(0,r.jsxs)(s.li,{children:["This however doesn't affect local requests as the function used prevents that: ",(0,r.jsx)(s.a,{href:"https://pkg.go.dev/net/http#ProxyFromEnvironment",children:"https://pkg.go.dev/net/http#ProxyFromEnvironment"}),"."]}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Add a retry around updating a secrets-encrypt node annotations ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9039",children:"(#9039)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Silence SELinux warning on INSTALL_K3S_SKIP_SELINUX_RPM ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8703",children:"(#8703)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Add ServiceLB support for PodHostIPs FeatureGate ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8917",children:"(#8917)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Added support for env *_PROXY variables for agent loadbalancer ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9118",children:"(#9118)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Redirect error stream to null when checking nm-cloud systemd unit ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8815",children:"(#8815)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:'Remove confusing "nm-cloud-setup.service: No such file or directory" journalctl log'}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Dockerfile.dapper: set $HOME properly ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9090",children:"(#9090)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Add system-agent-installer-k3s step to GA release instructions ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9153",children:"(#9153)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Fix install script checksum ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9159",children:"(#9159)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Fix the OTHER etcd snapshot s3 log message that prints the wrong variable ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8944",children:"(#8944)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Handle logging flags when parsing kube-proxy args ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8916",children:"(#8916)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Fix nil map in full snapshot configmap reconcile ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9049",children:"(#9049)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Add support for containerd cri registry config_path ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8973",children:"(#8973)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Add more paths to crun runtime detection ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9086",children:"(#9086)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Add runtime checking of golang version ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9054",children:"(#9054)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Fix OS PRETTY_NAME on tagged releases ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9062",children:"(#9062)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Print error when downloading file error inside install script ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6874",children:"(#6874)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Wait for cloud-provider taint to be gone before starting the netpol controller ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9076",children:"(#9076)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Bump Trivy version ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8812",children:"(#8812)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Use ",(0,r.jsx)(s.code,{children:"ipFamilyPolicy: RequireDualStack"})," for dual-stack kube-dns ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8984",children:"(#8984)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Handle etcd status condition when node is not ready and disable etcd ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9084",children:"(#9084)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Update s3 e2e test ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9025",children:"(#9025)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Add e2e startup test for rootless k3s ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8383",children:"(#8383)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Add spegel distributed registry mirror ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8977",children:"(#8977)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Bump quic-go for CVE-2023-49295 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9208",children:"(#9208)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Enable network policy controller metrics ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9195",children:"(#9195)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:"Kube-router network policy controller metrics are now exposed via the default node metrics endpoint"}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Fix nonexistent dependency repositories ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9213",children:"(#9213)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Move proxy dialer out of init() and fix crash when using ",(0,r.jsx)(s.code,{children:"K3S_AGENT_HTTP_PROXY_ALLOWED=true"})," ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9219",children:"(#9219)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Error getting node in setEtcdStatusCondition ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9210",children:"(#9210)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Update to v1.29.1 and Go 1.21.6 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9259",children:"(#9259)"})]}),"\n",(0,r.jsxs)(s.li,{children:["New stale action ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9278",children:"(#9278)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Fix handling of bare hostname or IP as endpoint address in registries.yaml ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9323",children:"(#9323)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Bump runc to v1.1.12 and helm-controller to v0.15.7 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9332",children:"(#9332)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Bump helm-controller to fix issue with ChartContent ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9345",children:"(#9345)"})]}),"\n"]}),"\n",(0,r.jsx)(s.hr,{}),"\n",(0,r.jsxs)(s.h2,{id:"release-v1290k3s1",children:["Release ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/releases/tag/v1.29.0+k3s1",children:"v1.29.0+k3s1"})]}),"\n",(0,r.jsx)(s.p,{children:"This release is K3S's first in the v1.29 line. This release updates Kubernetes to v1.29.0."}),"\n",(0,r.jsxs)(s.p,{children:["Before upgrading from earlier releases, be sure to read the Kubernetes ",(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.29.md#urgent-upgrade-notes",children:"Urgent Upgrade Notes"}),"."]}),"\n",(0,r.jsx)(s.admonition,{title:"Important",type:"warning",children:(0,r.jsxs)(s.p,{children:["This release removes the experimental ",(0,r.jsx)(s.code,{children:"rotate-keys"})," subcommand due to changes in Kubernetes upstream for ",(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/issues/117728",children:"KMSv2"}),", the subcommand should be added back in future releases."]})}),"\n",(0,r.jsx)(s.admonition,{title:"Important",type:"warning",children:(0,r.jsxs)(s.p,{children:["This release also removes the ",(0,r.jsx)(s.code,{children:"multi-cluster-cidr"})," flag, since the support for this alpha feature has been removed completely from ",(0,r.jsx)(s.a,{href:"https://groups.google.com/g/kubernetes-sig-network/c/nts1xEZ--gQ/m/2aTOUNFFAAAJ",children:"Kubernetes upstream"}),", this flag should be removed from the configuration before upgrade."]})}),"\n",(0,r.jsx)(s.h3,{id:"changes-since-v1284k3s2",children:"Changes since v1.28.4+k3s2:"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsxs)(s.li,{children:["Fix overlapping address range ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8913",children:"(#8913)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Modify CONTRIBUTING.md guide ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8954",children:"(#8954)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Nov 2023 stable channel update ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9022",children:"(#9022)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Default runtime and runtime classes for wasm/nvidia/crun ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8936",children:"(#8936)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:"Added runtime classes for wasm/nvidia/crun"}),"\n",(0,r.jsx)(s.li,{children:"Added default runtime flag for containerd"}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Bump containerd/runc to v1.7.10-k3s1/v1.1.10 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8962",children:"(#8962)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Allow setting default-runtime on servers ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9027",children:"(#9027)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Bump containerd to v1.7.11 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9040",children:"(#9040)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Remove GA feature-gates ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8970",children:"(#8970)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Only publish to code_cov on merged E2E builds ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9051",children:"(#9051)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Update Kubernetes to v1.29.0+k3s1 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9052",children:"(#9052)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Update flannel to v0.24.0 and remove multiclustercidr flag ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9075",children:"(#9075)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Remove rotate-keys subcommand ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9079",children:"(#9079)"})]}),"\n"]}),"\n",(0,r.jsx)(s.hr,{})]})}function a(e={}){const{wrapper:s}={...(0,t.a)(),...e.components};return s?(0,r.jsx)(s,{...e,children:(0,r.jsx)(d,{...e})}):d(e)}},1151:(e,s,i)=>{i.d(s,{Z:()=>h,a:()=>l});var r=i(7294);const t={},n=r.createContext(t);function l(e){const s=r.useContext(n);return r.useMemo((function(){return"function"==typeof e?e(s):{...s,...e}}),[s,e])}function h(e){let s;return s=e.disableParentContext?"function"==typeof e.components?e.components(t):e.components||t:l(e.components),r.createElement(n.Provider,{value:s},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/0ce5aa86.c1c9bf25.js b/assets/js/0ce5aa86.46b1828e.js similarity index 99% rename from assets/js/0ce5aa86.c1c9bf25.js rename to assets/js/0ce5aa86.46b1828e.js index 74ea849e2..5738e1bb1 100644 --- a/assets/js/0ce5aa86.c1c9bf25.js +++ b/assets/js/0ce5aa86.46b1828e.js @@ -1 +1 @@ -"use strict";(self.webpackChunkk_3_s_docs=self.webpackChunkk_3_s_docs||[]).push([[1620],{3012:(e,s,t)=>{t.r(s),t.d(s,{assets:()=>c,contentTitle:()=>l,default:()=>o,frontMatter:()=>n,metadata:()=>h,toc:()=>d});var i=t(5893),r=t(1151);const n={hide_table_of_contents:!0,sidebar_position:5},l="v1.26.X",h={id:"release-notes/v1.26.X",title:"v1.26.X",description:"Before upgrading from earlier releases, be sure to read the Kubernetes Urgent Upgrade Notes.",source:"@site/docs/release-notes/v1.26.X.md",sourceDirName:"release-notes",slug:"/release-notes/v1.26.X",permalink:"/release-notes/v1.26.X",draft:!1,unlisted:!1,editUrl:"https://github.com/k3s-io/docs/edit/main/docs/release-notes/v1.26.X.md",tags:[],version:"current",lastUpdatedAt:1723651727e3,sidebarPosition:5,frontMatter:{hide_table_of_contents:!0,sidebar_position:5},sidebar:"mySidebar",previous:{title:"v1.27.X",permalink:"/release-notes/v1.27.X"},next:{title:"v1.25.X",permalink:"/release-notes/v1.25.X"}},c={},d=[{value:"Release v1.26.15+k3s1",id:"release-v12615k3s1",level:2},{value:"Changes since v1.26.14+k3s1:",id:"changes-since-v12614k3s1",level:3},{value:"Release v1.26.14+k3s1",id:"release-v12614k3s1",level:2},{value:"Changes since v1.26.13+k3s2:",id:"changes-since-v12613k3s2",level:3},{value:"Release v1.26.13+k3s2",id:"release-v12613k3s2",level:2},{value:"Changes since v1.26.12+k3s1:",id:"changes-since-v12612k3s1",level:3},{value:"Release v1.26.12+k3s1",id:"release-v12612k3s1",level:2},{value:"Changes since v1.26.11+k3s2:",id:"changes-since-v12611k3s2",level:3},{value:"Release v1.26.11+k3s2",id:"release-v12611k3s2",level:2},{value:"Changes since v1.26.10+k3s2:",id:"changes-since-v12610k3s2",level:3},{value:"Release v1.26.10+k3s2",id:"release-v12610k3s2",level:2},{value:"Changes since v1.26.10+k3s1:",id:"changes-since-v12610k3s1",level:3},{value:"Release v1.26.10+k3s1",id:"release-v12610k3s1",level:2},{value:"Changes since v1.26.9+k3s1:",id:"changes-since-v1269k3s1",level:3},{value:"Release v1.26.9+k3s1",id:"release-v1269k3s1",level:2},{value:"Changes since v1.26.8+k3s1:",id:"changes-since-v1268k3s1",level:3},{value:"Release v1.26.8+k3s1",id:"release-v1268k3s1",level:2},{value:"Changes since v1.26.7+k3s1:",id:"changes-since-v1267k3s1",level:3},{value:"Release v1.26.7+k3s1",id:"release-v1267k3s1",level:2},{value:"Changes since v1.26.6+k3s1:",id:"changes-since-v1266k3s1",level:3},{value:"Release v1.26.6+k3s1",id:"release-v1266k3s1",level:2},{value:"Changes since v1.26.5+k3s1:",id:"changes-since-v1265k3s1",level:3},{value:"Release v1.26.5+k3s1",id:"release-v1265k3s1",level:2},{value:"Changes since v1.26.4+k3s1:",id:"changes-since-v1264k3s1",level:3},{value:"Release v1.26.4+k3s1",id:"release-v1264k3s1",level:2},{value:"Changes since v1.26.3+k3s1:",id:"changes-since-v1263k3s1",level:3},{value:"Release v1.26.3+k3s1",id:"release-v1263k3s1",level:2},{value:"Changes since v1.26.2+k3s1:",id:"changes-since-v1262k3s1",level:3},{value:"Release v1.26.2+k3s1",id:"release-v1262k3s1",level:2},{value:"Changes since v1.26.1+k3s1:",id:"changes-since-v1261k3s1",level:3},{value:"Release v1.26.1+k3s1",id:"release-v1261k3s1",level:2},{value:"Changes since v1.26.0+k3s2:",id:"changes-since-v1260k3s2",level:3},{value:"Release v1.26.0+k3s2",id:"release-v1260k3s2",level:2},{value:"Changes since v1.26.0+k3s1:",id:"changes-since-v1260k3s1",level:3},{value:"Release v1.26.0+k3s1",id:"release-v1260k3s1",level:2},{value:"\u26a0\ufe0f WARNING",id:"\ufe0f-warning",level:2},{value:"Changes since v1.25.5+k3s1:",id:"changes-since-v1255k3s1",level:3}];function a(e){const s={a:"a",admonition:"admonition",blockquote:"blockquote",code:"code",h1:"h1",h2:"h2",h3:"h3",header:"header",hr:"hr",li:"li",p:"p",strong:"strong",table:"table",tbody:"tbody",td:"td",th:"th",thead:"thead",tr:"tr",ul:"ul",...(0,r.a)(),...e.components};return(0,i.jsxs)(i.Fragment,{children:[(0,i.jsx)(s.header,{children:(0,i.jsx)(s.h1,{id:"v126x",children:"v1.26.X"})}),"\n",(0,i.jsx)(s.admonition,{title:"Upgrade Notice",type:"warning",children:(0,i.jsxs)(s.p,{children:["Before upgrading from earlier releases, be sure to read the Kubernetes ",(0,i.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.26.md#urgent-upgrade-notes",children:"Urgent Upgrade Notes"}),"."]})}),"\n",(0,i.jsxs)(s.table,{children:[(0,i.jsx)(s.thead,{children:(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.th,{children:"Version"}),(0,i.jsx)(s.th,{children:"Release date"}),(0,i.jsx)(s.th,{children:"Kubernetes"}),(0,i.jsx)(s.th,{children:"Kine"}),(0,i.jsx)(s.th,{children:"SQLite"}),(0,i.jsx)(s.th,{children:"Etcd"}),(0,i.jsx)(s.th,{children:"Containerd"}),(0,i.jsx)(s.th,{children:"Runc"}),(0,i.jsx)(s.th,{children:"Flannel"}),(0,i.jsx)(s.th,{children:"Metrics-server"}),(0,i.jsx)(s.th,{children:"Traefik"}),(0,i.jsx)(s.th,{children:"CoreDNS"}),(0,i.jsx)(s.th,{children:"Helm-controller"}),(0,i.jsx)(s.th,{children:"Local-path-provisioner"})]})}),(0,i.jsxs)(s.tbody,{children:[(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"/release-notes/v1.26.X#release-v12615k3s1",children:"v1.26.15+k3s1"})}),(0,i.jsx)(s.td,{children:"Mar 25 2024"}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.26.md#v12615",children:"v1.26.15"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/kine/releases/tag/v0.11.4",children:"v0.11.4"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://sqlite.org/releaselog/3_44_0.html",children:"3.44.0"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/etcd/releases/tag/v3.5.9-k3s1",children:"v3.5.9-k3s1"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/containerd/releases/tag/v1.7.11-k3s2.26",children:"v1.7.11-k3s2.26"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/opencontainers/runc/releases/tag/v1.1.12-k3s1",children:"v1.1.12-k3s1"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/flannel-io/flannel/releases/tag/v0.24.2",children:"v0.24.2"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.7.0",children:"v0.7.0"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/traefik/traefik/releases/tag/v2.10.5",children:"v2.10.5"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/coredns/coredns/releases/tag/v1.10.1",children:"v1.10.1"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/helm-controller/releases/tag/v0.15.9",children:"v0.15.9"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/rancher/local-path-provisioner/releases/tag/v0.0.26",children:"v0.0.26"})})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"/release-notes/v1.26.X#release-v12614k3s1",children:"v1.26.14+k3s1"})}),(0,i.jsx)(s.td,{children:"Feb 29 2024"}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.26.md#v12614",children:"v1.26.14"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/kine/releases/tag/v0.11.4",children:"v0.11.4"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://sqlite.org/releaselog/3_44_0.html",children:"3.44.0"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/etcd/releases/tag/v3.5.9-k3s1",children:"v3.5.9-k3s1"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/containerd/releases/tag/v1.7.11-k3s2.26",children:"v1.7.11-k3s2.26"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/runc/releases/tag/v1.1.12-k3s1",children:"v1.1.12-k3s1"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/flannel-io/flannel/releases/tag/v0.24.2",children:"v0.24.2"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.6.3",children:"v0.6.3"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/traefik/traefik/releases/tag/v2.10.5",children:"v2.10.5"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/coredns/coredns/releases/tag/v1.10.1",children:"v1.10.1"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/helm-controller/releases/tag/v0.15.8",children:"v0.15.8"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/rancher/local-path-provisioner/releases/tag/v0.0.26",children:"v0.0.26"})})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"/release-notes/v1.26.X#release-v12613k3s2",children:"v1.26.13+k3s2"})}),(0,i.jsx)(s.td,{children:"Feb 06 2024"}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.26.md#v12613",children:"v1.26.13"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/kine/releases/tag/v0.11.0",children:"v0.11.0"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://sqlite.org/releaselog/3_42_0.html",children:"3.42.0"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/etcd/releases/tag/v3.5.9-k3s1",children:"v3.5.9-k3s1"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/containerd/releases/tag/v1.7.11-k3s2.26",children:"v1.7.11-k3s2.26"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/opencontainers/runc/releases/tag/v1.1.12-k3s1",children:"v1.1.12-k3s1"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/flannel-io/flannel/releases/tag/v0.22.2",children:"v0.22.2"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.6.3",children:"v0.6.3"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/traefik/traefik/releases/tag/v2.10.5",children:"v2.10.5"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/coredns/coredns/releases/tag/v1.10.1",children:"v1.10.1"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/helm-controller/releases/tag/v0.15.8",children:"v0.15.8"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/rancher/local-path-provisioner/releases/tag/v0.0.24",children:"v0.0.24"})})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"/release-notes/v1.26.X#release-v12612k3s1",children:"v1.26.12+k3s1"})}),(0,i.jsx)(s.td,{children:"Dec 27 2023"}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.26.md#v12612",children:"v1.26.12"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/kine/releases/tag/v0.11.0",children:"v0.11.0"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://sqlite.org/releaselog/3_42_0.html",children:"3.42.0"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/etcd/releases/tag/v3.5.9-k3s1",children:"v3.5.9-k3s1"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/containerd/releases/tag/v1.7.11-k3s2.26",children:"v1.7.11-k3s2.26"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/opencontainers/runc/releases/tag/v1.1.10",children:"v1.1.10"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/flannel-io/flannel/releases/tag/v0.22.2",children:"v0.22.2"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.6.3",children:"v0.6.3"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/traefik/traefik/releases/tag/v2.10.5",children:"v2.10.5"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/coredns/coredns/releases/tag/v1.10.1",children:"v1.10.1"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/helm-controller/releases/tag/v0.15.4",children:"v0.15.4"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/rancher/local-path-provisioner/releases/tag/v0.0.24",children:"v0.0.24"})})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"/release-notes/v1.26.X#release-v12611k3s2",children:"v1.26.11+k3s2"})}),(0,i.jsx)(s.td,{children:"Dec 07 2023"}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.26.md#v12611",children:"v1.26.11"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/kine/releases/tag/v0.11.0",children:"v0.11.0"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://sqlite.org/releaselog/3_42_0.html",children:"3.42.0"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/etcd/releases/tag/v3.5.9-k3s1",children:"v3.5.9-k3s1"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/containerd/releases/tag/v1.7.7-k3s1.26",children:"v1.7.7-k3s1.26"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/opencontainers/runc/releases/tag/v1.1.8",children:"v1.1.8"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/flannel-io/flannel/releases/tag/v0.22.2",children:"v0.22.2"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.6.3",children:"v0.6.3"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/traefik/traefik/releases/tag/v2.10.5",children:"v2.10.5"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/coredns/coredns/releases/tag/v1.10.1",children:"v1.10.1"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/helm-controller/releases/tag/v0.15.4",children:"v0.15.4"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/rancher/local-path-provisioner/releases/tag/v0.0.24",children:"v0.0.24"})})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"/release-notes/v1.26.X#release-v12610k3s2",children:"v1.26.10+k3s2"})}),(0,i.jsx)(s.td,{children:"Nov 08 2023"}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.26.md#v12610",children:"v1.26.10"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/kine/releases/tag/v0.10.3",children:"v0.10.3"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://sqlite.org/releaselog/3_42_0.html",children:"3.42.0"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/etcd/releases/tag/v3.5.9-k3s1",children:"v3.5.9-k3s1"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/containerd/releases/tag/v1.7.7-k3s1.26",children:"v1.7.7-k3s1.26"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/opencontainers/runc/releases/tag/v1.1.8",children:"v1.1.8"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/flannel-io/flannel/releases/tag/v0.22.2",children:"v0.22.2"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.6.3",children:"v0.6.3"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/traefik/traefik/releases/tag/v2.10.5",children:"v2.10.5"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/coredns/coredns/releases/tag/v1.10.1",children:"v1.10.1"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/helm-controller/releases/tag/v0.15.4",children:"v0.15.4"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/rancher/local-path-provisioner/releases/tag/v0.0.24",children:"v0.0.24"})})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"/release-notes/v1.26.X#release-v12610k3s1",children:"v1.26.10+k3s1"})}),(0,i.jsx)(s.td,{children:"Oct 30 2023"}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.26.md#v12610",children:"v1.26.10"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/kine/releases/tag/v0.10.3",children:"v0.10.3"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://sqlite.org/releaselog/3_42_0.html",children:"3.42.0"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/etcd/releases/tag/v3.5.9-k3s1",children:"v3.5.9-k3s1"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/containerd/releases/tag/v1.7.7-k3s1.26",children:"v1.7.7-k3s1.26"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/opencontainers/runc/releases/tag/v1.1.8",children:"v1.1.8"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/flannel-io/flannel/releases/tag/v0.22.2",children:"v0.22.2"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.6.3",children:"v0.6.3"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/traefik/traefik/releases/tag/v2.10.5",children:"v2.10.5"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/coredns/coredns/releases/tag/v1.10.1",children:"v1.10.1"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/helm-controller/releases/tag/v0.15.4",children:"v0.15.4"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/rancher/local-path-provisioner/releases/tag/v0.0.24",children:"v0.0.24"})})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"/release-notes/v1.26.X#release-v1269k3s1",children:"v1.26.9+k3s1"})}),(0,i.jsx)(s.td,{children:"Sep 20 2023"}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.26.md#v1269",children:"v1.26.9"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/kine/releases/tag/v0.10.3",children:"v0.10.3"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://sqlite.org/releaselog/3_42_0.html",children:"3.42.0"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/etcd/releases/tag/v3.5.9-k3s1",children:"v3.5.9-k3s1"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/containerd/releases/tag/v1.7.6-k3s1.26",children:"v1.7.6-k3s1.26"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/opencontainers/runc/releases/tag/v1.1.8",children:"v1.1.8"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/flannel-io/flannel/releases/tag/v0.22.2",children:"v0.22.2"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.6.3",children:"v0.6.3"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/traefik/traefik/releases/tag/v2.9.10",children:"v2.9.10"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/coredns/coredns/releases/tag/v1.10.1",children:"v1.10.1"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/helm-controller/releases/tag/v0.15.4",children:"v0.15.4"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/rancher/local-path-provisioner/releases/tag/v0.0.24",children:"v0.0.24"})})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"/release-notes/v1.26.X#release-v1268k3s1",children:"v1.26.8+k3s1"})}),(0,i.jsx)(s.td,{children:"Sep 05 2023"}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.26.md#v1268",children:"v1.26.8"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/kine/releases/tag/v0.10.2",children:"v0.10.2"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://sqlite.org/releaselog/3_42_0.html",children:"3.42.0"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/etcd/releases/tag/v3.5.9-k3s1",children:"v3.5.9-k3s1"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/containerd/releases/tag/v1.7.3-k3s1",children:"v1.7.3-k3s1"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/opencontainers/runc/releases/tag/v1.1.8",children:"v1.1.8"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/flannel-io/flannel/releases/tag/v0.22.2",children:"v0.22.2"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.6.3",children:"v0.6.3"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/traefik/traefik/releases/tag/v2.9.10",children:"v2.9.10"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/coredns/coredns/releases/tag/v1.10.1",children:"v1.10.1"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/helm-controller/releases/tag/v0.15.4",children:"v0.15.4"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/rancher/local-path-provisioner/releases/tag/v0.0.24",children:"v0.0.24"})})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"/release-notes/v1.26.X#release-v1267k3s1",children:"v1.26.7+k3s1"})}),(0,i.jsx)(s.td,{children:"Jul 27 2023"}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.26.md#v1267",children:"v1.26.7"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/kine/releases/tag/v0.10.1",children:"v0.10.1"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://sqlite.org/releaselog/3_39_2.html",children:"3.39.2"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/etcd/releases/tag/v3.5.7-k3s1",children:"v3.5.7-k3s1"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/containerd/releases/tag/v1.7.1-k3s1",children:"v1.7.1-k3s1"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/opencontainers/runc/releases/tag/v1.1.7",children:"v1.1.7"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/flannel-io/flannel/releases/tag/v0.22.0",children:"v0.22.0"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.6.3",children:"v0.6.3"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/traefik/traefik/releases/tag/v2.9.10",children:"v2.9.10"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/coredns/coredns/releases/tag/v1.10.1",children:"v1.10.1"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/helm-controller/releases/tag/v0.15.2",children:"v0.15.2"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/rancher/local-path-provisioner/releases/tag/v0.0.24",children:"v0.0.24"})})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"/release-notes/v1.26.X#release-v1266k3s1",children:"v1.26.6+k3s1"})}),(0,i.jsx)(s.td,{children:"Jun 26 2023"}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.26.md#v1266",children:"v1.26.6"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/kine/releases/tag/v0.10.1",children:"v0.10.1"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://sqlite.org/releaselog/3_39_2.html",children:"3.39.2"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/etcd/releases/tag/v3.5.7-k3s1",children:"v3.5.7-k3s1"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/containerd/releases/tag/v1.7.1-k3s1",children:"v1.7.1-k3s1"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/opencontainers/runc/releases/tag/v1.1.7",children:"v1.1.7"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/flannel-io/flannel/releases/tag/v0.22.0",children:"v0.22.0"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.6.3",children:"v0.6.3"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/traefik/traefik/releases/tag/v2.9.10",children:"v2.9.10"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/coredns/coredns/releases/tag/v1.10.1",children:"v1.10.1"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/helm-controller/releases/tag/v0.15.0",children:"v0.15.0"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/rancher/local-path-provisioner/releases/tag/v0.0.24",children:"v0.0.24"})})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"/release-notes/v1.26.X#release-v1265k3s1",children:"v1.26.5+k3s1"})}),(0,i.jsx)(s.td,{children:"May 26 2023"}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.26.md#v1265",children:"v1.26.5"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/kine/releases/tag/v0.10.1",children:"v0.10.1"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://sqlite.org/releaselog/3_39_2.html",children:"3.39.2"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/etcd/releases/tag/v3.5.7-k3s1",children:"v3.5.7-k3s1"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/containerd/releases/tag/v1.7.1-k3s1",children:"v1.7.1-k3s1"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/opencontainers/runc/releases/tag/v1.1.7",children:"v1.1.7"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/flannel-io/flannel/releases/tag/v0.21.4",children:"v0.21.4"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.6.2",children:"v0.6.2"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/traefik/traefik/releases/tag/v2.9.10",children:"v2.9.10"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/coredns/coredns/releases/tag/v1.10.1",children:"v1.10.1"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/helm-controller/releases/tag/v0.14.0",children:"v0.14.0"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/rancher/local-path-provisioner/releases/tag/v0.0.24",children:"v0.0.24"})})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"/release-notes/v1.26.X#release-v1264k3s1",children:"v1.26.4+k3s1"})}),(0,i.jsx)(s.td,{children:"Apr 20 2023"}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.26.md#v1264",children:"v1.26.4"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/kine/releases/tag/v0.9.9",children:"v0.9.9"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://sqlite.org/releaselog/3_39_2.html",children:"3.39.2"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/etcd/releases/tag/v3.5.7-k3s1",children:"v3.5.7-k3s1"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/containerd/releases/tag/v1.6.19-k3s1",children:"v1.6.19-k3s1"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/opencontainers/runc/releases/tag/v1.1.5",children:"v1.1.5"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/flannel-io/flannel/releases/tag/v0.21.4",children:"v0.21.4"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.6.2",children:"v0.6.2"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/traefik/traefik/releases/tag/v2.9.4",children:"v2.9.4"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/coredns/coredns/releases/tag/v1.10.1",children:"v1.10.1"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/helm-controller/releases/tag/v0.13.3",children:"v0.13.3"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/rancher/local-path-provisioner/releases/tag/v0.0.24",children:"v0.0.24"})})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"/release-notes/v1.26.X#release-v1263k3s1",children:"v1.26.3+k3s1"})}),(0,i.jsx)(s.td,{children:"Mar 27 2023"}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.26.md#v1263",children:"v1.26.3"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/kine/releases/tag/v0.9.9",children:"v0.9.9"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://sqlite.org/releaselog/3_39_2.html",children:"3.39.2"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/etcd/releases/tag/v3.5.5-k3s1",children:"v3.5.5-k3s1"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/containerd/releases/tag/v1.6.19-k3s1",children:"v1.6.19-k3s1"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/opencontainers/runc/releases/tag/v1.1.4",children:"v1.1.4"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/flannel-io/flannel/releases/tag/v0.21.4",children:"v0.21.4"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.6.2",children:"v0.6.2"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/traefik/traefik/releases/tag/v2.9.4",children:"v2.9.4"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/coredns/coredns/releases/tag/v1.9.4",children:"v1.9.4"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/helm-controller/releases/tag/v0.13.1",children:"v0.13.1"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/rancher/local-path-provisioner/releases/tag/v0.0.23",children:"v0.0.23"})})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"/release-notes/v1.26.X#release-v1262k3s1",children:"v1.26.2+k3s1"})}),(0,i.jsx)(s.td,{children:"Mar 10 2023"}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.26.md#v1262",children:"v1.26.2"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/kine/releases/tag/v0.9.9",children:"v0.9.9"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://sqlite.org/releaselog/3_39_2.html",children:"3.39.2"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/etcd/releases/tag/v3.5.5-k3s1",children:"v3.5.5-k3s1"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/containerd/releases/tag/v1.6.15-k3s1",children:"v1.6.15-k3s1"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/opencontainers/runc/releases/tag/v1.1.4",children:"v1.1.4"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/flannel-io/flannel/releases/tag/v0.21.1",children:"v0.21.1"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.6.2",children:"v0.6.2"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/traefik/traefik/releases/tag/v2.9.4",children:"v2.9.4"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/coredns/coredns/releases/tag/v1.9.4",children:"v1.9.4"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/helm-controller/releases/tag/v0.13.1",children:"v0.13.1"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/rancher/local-path-provisioner/releases/tag/v0.0.23",children:"v0.0.23"})})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"/release-notes/v1.26.X#release-v1261k3s1",children:"v1.26.1+k3s1"})}),(0,i.jsx)(s.td,{children:"Jan 26 2023"}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.26.md#v1261",children:"v1.26.1"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/kine/releases/tag/v0.9.8",children:"v0.9.8"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://sqlite.org/releaselog/3_39_2.html",children:"3.39.2"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/etcd/releases/tag/v3.5.5-k3s1",children:"v3.5.5-k3s1"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/containerd/releases/tag/v1.6.15-k3s1",children:"v1.6.15-k3s1"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/opencontainers/runc/releases/tag/v1.1.4",children:"v1.1.4"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/flannel-io/flannel/releases/tag/v0.20.2",children:"v0.20.2"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.6.2",children:"v0.6.2"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/traefik/traefik/releases/tag/v2.9.4",children:"v2.9.4"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/coredns/coredns/releases/tag/v1.9.4",children:"v1.9.4"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/helm-controller/releases/tag/v0.13.1",children:"v0.13.1"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/rancher/local-path-provisioner/releases/tag/v0.0.23",children:"v0.0.23"})})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"/release-notes/v1.26.X#release-v1260k3s2",children:"v1.26.0+k3s2"})}),(0,i.jsx)(s.td,{children:"Jan 11 2023"}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.26.md#v1260",children:"v1.26.0"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/kine/releases/tag/v0.9.8",children:"v0.9.8"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://sqlite.org/releaselog/3_39_2.html",children:"3.39.2"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/etcd/releases/tag/v3.5.5-k3s1",children:"v3.5.5-k3s1"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/containerd/releases/tag/v1.6.14-k3s1",children:"v1.6.14-k3s1"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/opencontainers/runc/releases/tag/v1.1.4",children:"v1.1.4"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/flannel-io/flannel/releases/tag/v0.20.2",children:"v0.20.2"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.6.2",children:"v0.6.2"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/traefik/traefik/releases/tag/v2.9.4",children:"v2.9.4"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/coredns/coredns/releases/tag/v1.9.4",children:"v1.9.4"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/helm-controller/releases/tag/v0.13.1",children:"v0.13.1"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/rancher/local-path-provisioner/releases/tag/v0.0.23",children:"v0.0.23"})})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"/release-notes/v1.26.X#release-v1260k3s1",children:"v1.26.0+k3s1"})}),(0,i.jsx)(s.td,{children:"Dec 21 2022"}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.26.md#v1260",children:"v1.26.0"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/kine/releases/tag/v0.9.8",children:"v0.9.8"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://sqlite.org/releaselog/3_39_2.html",children:"3.39.2"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/etcd/releases/tag/v3.5.5-k3s1",children:"v3.5.5-k3s1"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/containerd/releases/tag/v1.6.12-k3s1",children:"v1.6.12-k3s1"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/opencontainers/runc/releases/tag/v1.1.4",children:"v1.1.4"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/flannel-io/flannel/releases/tag/v0.20.2",children:"v0.20.2"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.6.2",children:"v0.6.2"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/traefik/traefik/releases/tag/v2.9.4",children:"v2.9.4"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/coredns/coredns/releases/tag/v1.9.4",children:"v1.9.4"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/helm-controller/releases/tag/v0.13.1",children:"v0.13.1"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/rancher/local-path-provisioner/releases/tag/v0.0.23",children:"v0.0.23"})})]})]})]}),"\n",(0,i.jsx)("br",{}),"\n",(0,i.jsxs)(s.h2,{id:"release-v12615k3s1",children:["Release ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/releases/tag/v1.26.15+k3s1",children:"v1.26.15+k3s1"})]}),"\n",(0,i.jsx)(s.p,{children:"This release updates Kubernetes to v1.26.15, and fixes a number of issues."}),"\n",(0,i.jsxs)(s.p,{children:["For more details on what's new, see the ",(0,i.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.26.md#changelog-since-v12614",children:"Kubernetes release notes"}),"."]}),"\n",(0,i.jsx)(s.h3,{id:"changes-since-v12614k3s1",children:"Changes since v1.26.14+k3s1:"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsxs)(s.li,{children:["Update klipper-lb image version ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9607",children:"(#9607)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Install and Unit test backports ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9645",children:"(#9645)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Adjust first node-ip based on configured clusterCIDR ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9633",children:"(#9633)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Add an integration test for flannel-backend=none ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9610",children:"(#9610)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Improve tailscale e2e test ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9655",children:"(#9655)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Backports for 2024-03 release cycle ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9692",children:"(#9692)"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsx)(s.li,{children:"Fix: use correct wasm shims names"}),"\n",(0,i.jsx)(s.li,{children:"The embedded flannel cni-plugin binary is now built and versioned separate from the rest of the cni plugins and the embedded flannel controller."}),"\n",(0,i.jsx)(s.li,{children:"Bump spegel to v0.0.18-k3s3"}),"\n",(0,i.jsx)(s.li,{children:"Adds wildcard registry support"}),"\n",(0,i.jsx)(s.li,{children:"Fixes issue with excessive CPU utilization while waiting for containerd to start"}),"\n",(0,i.jsx)(s.li,{children:"Add env var to allow spegel mirroring of latest tag"}),"\n",(0,i.jsx)(s.li,{children:"Tweak netpol node wait logs"}),"\n",(0,i.jsx)(s.li,{children:"Fix coredns NodeHosts on dual-stack clusters"}),"\n",(0,i.jsx)(s.li,{children:"Bump helm-controller/klipper-helm versions"}),"\n",(0,i.jsx)(s.li,{children:"Fix snapshot prune"}),"\n",(0,i.jsx)(s.li,{children:"Fix issue with etcd node name missing hostname"}),"\n",(0,i.jsx)(s.li,{children:"Rootless mode should also bind service nodePort to host for LoadBalancer type, matching UX of rootful mode."}),"\n",(0,i.jsxs)(s.li,{children:["To enable raw output for the ",(0,i.jsx)(s.code,{children:"check-config"})," subcommand, you may now set NO_COLOR=1"]}),"\n",(0,i.jsx)(s.li,{children:"Fix additional corner cases in registries handling"}),"\n",(0,i.jsx)(s.li,{children:"Bump metrics-server to v0.7.0"}),"\n",(0,i.jsx)(s.li,{children:"K3s will now warn and suppress duplicate entries in the mirror endpoint list for a registry. Containerd does not support listing the same endpoint multiple times as a mirror for a single upstream registry."}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(s.li,{children:["Fix wildcard entry upstream fallback ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9735",children:"(#9735)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Update to v1.26.15-k3s1 and Go 1.21.8 ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9740",children:"(#9740)"})]}),"\n"]}),"\n",(0,i.jsx)(s.hr,{}),"\n",(0,i.jsxs)(s.h2,{id:"release-v12614k3s1",children:["Release ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/releases/tag/v1.26.14+k3s1",children:"v1.26.14+k3s1"})]}),"\n",(0,i.jsx)(s.p,{children:"This release updates Kubernetes to v1.26.14, and fixes a number of issues."}),"\n",(0,i.jsxs)(s.p,{children:["For more details on what's new, see the ",(0,i.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.26.md#changelog-since-v12613",children:"Kubernetes release notes"}),"."]}),"\n",(0,i.jsx)(s.h3,{id:"changes-since-v12613k3s2",children:"Changes since v1.26.13+k3s2:"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsxs)(s.li,{children:["Chore: bump Local Path Provisioner version ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9428",children:"(#9428)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Bump cri-dockerd to fix compat with Docker Engine 25 ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9292",children:"(#9292)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Auto Dependency Bump ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9421",children:"(#9421)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Runtimes refactor using exec.LookPath ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9429",children:"(#9429)"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsx)(s.li,{children:"Directories containing runtimes need to be included in the $PATH environment variable for effective runtime detection."}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(s.li,{children:["Changed how lastHeartBeatTime works in the etcd condition ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9423",children:"(#9423)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Allow executors to define containerd and docker behavior ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9252",children:"(#9252)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Update Kube-router to v2.0.1 ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9406",children:"(#9406)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Backports for 2024-02 release cycle ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9464",children:"(#9464)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Bump flannel version + remove multiclustercidr ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9409",children:"(#9409)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Enable longer http timeout requests ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9446",children:"(#9446)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Test_UnitApplyContainerdQoSClassConfigFileIfPresent ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9442",children:"(#9442)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Support PR testing installs ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9471",children:"(#9471)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Update Kubernetes to v1.26.14 ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9490",children:"(#9490)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Fix drone publish for arm ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9510",children:"(#9510)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Remove failing Drone step ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9514",children:"(#9514)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Restore original order of agent startup functions ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9547",children:"(#9547)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Fix netpol startup when flannel is disabled ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9580",children:"(#9580)"})]}),"\n"]}),"\n",(0,i.jsx)(s.hr,{}),"\n",(0,i.jsxs)(s.h2,{id:"release-v12613k3s2",children:["Release ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/releases/tag/v1.26.13+k3s2",children:"v1.26.13+k3s2"})]}),"\n",(0,i.jsx)(s.p,{children:"This release updates Kubernetes to v1.26.13, and fixes a number of issues."}),"\n",(0,i.jsxs)(s.p,{children:["For more details on what's new, see the ",(0,i.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.26.md#changelog-since-v12612",children:"Kubernetes release notes"}),"."]}),"\n",(0,i.jsx)(s.p,{children:(0,i.jsx)(s.strong,{children:"Important Notes"})}),"\n",(0,i.jsxs)(s.p,{children:["Addresses the runc CVE: ",(0,i.jsx)(s.a,{href:"https://nvd.nist.gov/vuln/detail/CVE-2024-21626",children:"CVE-2024-21626"})," by updating runc to v1.1.12."]}),"\n",(0,i.jsx)(s.h3,{id:"changes-since-v12612k3s1",children:"Changes since v1.26.12+k3s1:"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsxs)(s.li,{children:["Add a retry around updating a secrets-encrypt node annotations ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9123",children:"(#9123)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Added support for env *_PROXY variables for agent loadbalancer ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9116",children:"(#9116)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Wait for taint to be gone in the node before starting the netpol controller ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9177",children:"(#9177)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Etcd condition ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9183",children:"(#9183)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Backports for 2024-01 ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9212",children:"(#9212)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Move proxy dialer out of init() and fix crash ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9221",children:"(#9221)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Pin opa version for missing dependency chain ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9218",children:"(#9218)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Etcd node is nil ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9230",children:"(#9230)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Update to v1.26.13 and Go 1.20.13 ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9262",children:"(#9262)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Use ",(0,i.jsx)(s.code,{children:"ipFamilyPolicy: RequireDualStack"})," for dual-stack kube-dns ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9271",children:"(#9271)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Backports for 2024-01 k3s2 ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9338",children:"(#9338)"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsx)(s.li,{children:"Bump runc to v1.1.12 and helm-controller to v0.15.7"}),"\n",(0,i.jsx)(s.li,{children:"Fix handling of bare hostname or IP as endpoint address in registries.yaml"}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(s.li,{children:["Bump helm-controller to fix issue with ChartContent ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9348",children:"(#9348)"})]}),"\n"]}),"\n",(0,i.jsx)(s.hr,{}),"\n",(0,i.jsxs)(s.h2,{id:"release-v12612k3s1",children:["Release ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/releases/tag/v1.26.12+k3s1",children:"v1.26.12+k3s1"})]}),"\n",(0,i.jsx)(s.p,{children:"This release updates Kubernetes to v1.26.12, and fixes a number of issues."}),"\n",(0,i.jsxs)(s.p,{children:["For more details on what's new, see the ",(0,i.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.26.md#changelog-since-v12611",children:"Kubernetes release notes"}),"."]}),"\n",(0,i.jsx)(s.h3,{id:"changes-since-v12611k3s2",children:"Changes since v1.26.11+k3s2:"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsxs)(s.li,{children:["Runtimes backport ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9014",children:"(#9014)"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsx)(s.li,{children:"Added runtime classes for wasm/nvidia/crun"}),"\n",(0,i.jsx)(s.li,{children:"Added default runtime flag for containerd"}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(s.li,{children:["Bump containerd/runc to v1.7.10-k3s1/v1.1.10 ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8964",children:"(#8964)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Fix overlapping address range ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9019",children:"(#9019)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Allow setting default-runtime on servers ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9028",children:"(#9028)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Bump containerd to v1.7.11 ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9042",children:"(#9042)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Update to v1.26.12-k3s1 ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9077",children:"(#9077)"})]}),"\n"]}),"\n",(0,i.jsx)(s.hr,{}),"\n",(0,i.jsxs)(s.h2,{id:"release-v12611k3s2",children:["Release ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/releases/tag/v1.26.11+k3s2",children:"v1.26.11+k3s2"})]}),"\n",(0,i.jsx)(s.p,{children:"This release updates Kubernetes to v1.26.11, and fixes a number of issues."}),"\n",(0,i.jsxs)(s.p,{children:["For more details on what's new, see the ",(0,i.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.26.md#changelog-since-v12610",children:"Kubernetes release notes"}),"."]}),"\n",(0,i.jsx)(s.h3,{id:"changes-since-v12610k3s2",children:"Changes since v1.26.10+k3s2:"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsxs)(s.li,{children:["Etcd status condition ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8820",children:"(#8820)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Backports for 2023-11 release ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8879",children:"(#8879)"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsxs)(s.li,{children:["New timezone info in Docker image allows the use of ",(0,i.jsx)(s.code,{children:"spec.timeZone"})," in CronJobs"]}),"\n",(0,i.jsx)(s.li,{children:"Bumped kine to v0.11.0 to resolve issues with postgres and NATS, fix performance of watch channels under heavy load, and improve compatibility with the reference implementation."}),"\n",(0,i.jsxs)(s.li,{children:["Containerd may now be configured to use rdt or blockio configuration by defining ",(0,i.jsx)(s.code,{children:"rdt_config.yaml"})," or ",(0,i.jsx)(s.code,{children:"blockio_config.yaml"})," files."]}),"\n",(0,i.jsx)(s.li,{children:"Add agent flag disable-apiserver-lb, agent will not start load balance proxy."}),"\n",(0,i.jsx)(s.li,{children:"Improved ingress IP ordering from ServiceLB"}),"\n",(0,i.jsx)(s.li,{children:"Disable helm CRD installation for disable-helm-controller"}),"\n",(0,i.jsx)(s.li,{children:"Omit snapshot list configmap entries for snapshots without extra metadata"}),"\n",(0,i.jsx)(s.li,{children:"Add jitter to client config retry to avoid hammering servers when they are starting up"}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(s.li,{children:["Add warning for removal of multiclustercidr flag ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8760",children:"(#8760)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Handle nil pointer when runtime core is not ready in etcd ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8888",children:"(#8888)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Improve dualStack log ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8829",children:"(#8829)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Bump dynamiclistener; reduce snapshot controller log spew ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8903",children:"(#8903)"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsx)(s.li,{children:"Bumped dynamiclistener to address a race condition that could cause a server to fail to sync its certificates into the Kubernetes secret"}),"\n",(0,i.jsx)(s.li,{children:"Reduced etcd snapshot log spam during initial cluster startup"}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(s.li,{children:["Fix etcd snapshot S3 issues ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8938",children:"(#8938)"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsx)(s.li,{children:"Don't apply S3 retention if S3 client failed to initialize"}),"\n",(0,i.jsx)(s.li,{children:"Don't request metadata when listing S3 snapshots"}),"\n",(0,i.jsx)(s.li,{children:"Print key instead of file path in snapshot metadata log message"}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(s.li,{children:["Update to v1.26.11 and Go to 1.20.11 ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8922",children:"(#8922)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Remove s390x ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9000",children:"(#9000)"})]}),"\n"]}),"\n",(0,i.jsx)(s.hr,{}),"\n",(0,i.jsxs)(s.h2,{id:"release-v12610k3s2",children:["Release ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/releases/tag/v1.26.10+k3s2",children:"v1.26.10+k3s2"})]}),"\n",(0,i.jsx)(s.p,{children:"This release updates Kubernetes to v1.26.10, and fixes a number of issues."}),"\n",(0,i.jsxs)(s.p,{children:["For more details on what's new, see the ",(0,i.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.26.md#changelog-since-v12610",children:"Kubernetes release notes"}),"."]}),"\n",(0,i.jsx)(s.h3,{id:"changes-since-v12610k3s1",children:"Changes since v1.26.10+k3s1:"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsxs)(s.li,{children:["Fix SystemdCgroup in templates_linux.go ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8766",children:"(#8766)"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsx)(s.li,{children:"Fixed an issue with identifying additional container runtimes"}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(s.li,{children:["Update traefik chart to v25.0.0 ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8776",children:"(#8776)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Update traefik to fix registry value ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8790",children:"(#8790)"})]}),"\n"]}),"\n",(0,i.jsx)(s.hr,{}),"\n",(0,i.jsxs)(s.h2,{id:"release-v12610k3s1",children:["Release ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/releases/tag/v1.26.10+k3s1",children:"v1.26.10+k3s1"})]}),"\n",(0,i.jsx)(s.p,{children:"This release updates Kubernetes to v1.26.10, and fixes a number of issues."}),"\n",(0,i.jsxs)(s.p,{children:["For more details on what's new, see the ",(0,i.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.26.md#changelog-since-v1269",children:"Kubernetes release notes"}),"."]}),"\n",(0,i.jsx)(s.h3,{id:"changes-since-v1269k3s1",children:"Changes since v1.26.9+k3s1:"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsxs)(s.li,{children:["Fix error reporting ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8412",children:"(#8412)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Add context to flannel errors ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8420",children:"(#8420)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Testing Backports for September ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8300",children:"(#8300)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Include the interface name in the error message ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8436",children:"(#8436)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Update kube-router ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8444",children:"(#8444)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Add extraArgs to tailscale ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8465",children:"(#8465)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Added error when cluster reset while using server flag ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8456",children:"(#8456)"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsx)(s.li,{children:"The user will receive a error when --cluster-reset with the --server flag"}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(s.li,{children:["Cluster reset from non bootstrap nodes ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8453",children:"(#8453)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Fix spellcheck problem ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8510",children:"(#8510)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Take IPFamily precedence based on order ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8505",children:"(#8505)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Network defaults are duplicated, remove one ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8552",children:"(#8552)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Advertise address integration test ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8517",children:"(#8517)"})]}),"\n",(0,i.jsxs)(s.li,{children:["System agent push tags fix ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8570",children:"(#8570)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Fixed tailscale node IP dualstack mode in case of IPv4 only node ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8559",children:"(#8559)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Server Token Rotation ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8577",children:"(#8577)"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsxs)(s.li,{children:["Users can now rotate the server token using ",(0,i.jsx)(s.code,{children:"k3s token rotate -t --new-token "}),". After command succeeds, all server nodes must be restarted with the new token."]}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(s.li,{children:["Clear remove annotations on cluster reset ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8590",children:"(#8590)"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsx)(s.li,{children:"Fixed an issue that could cause k3s to attempt to remove members from the etcd cluster immediately following a cluster-reset/restore, if they were queued for removal at the time the snapshot was taken."}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(s.li,{children:["Use IPv6 in case is the first configured IP with dualstack ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8598",children:"(#8598)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Backports for 2023-10 release ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8616",children:"(#8616)"})]}),"\n",(0,i.jsxs)(s.li,{children:["E2E Domain Drone Cleanup ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8583",children:"(#8583)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Update kube-router package in build script ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8635",children:"(#8635)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Add etcd-only/control-plane-only server test and fix control-plane-only server crash ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8643",children:"(#8643)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Use ",(0,i.jsx)(s.code,{children:"version.Program"})," not K3s in token rotate logs ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8655",children:"(#8655)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Windows agent support ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8647",children:"(#8647)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Add --image-service-endpoint flag (#8279) ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8663",children:"(#8663)"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsxs)(s.li,{children:["Add ",(0,i.jsx)(s.code,{children:"--image-service-endpoint"})," flag to specify an external image service socket."]}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(s.li,{children:["Backport etcd fixes ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8691",children:"(#8691)"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsx)(s.li,{children:"Re-enable etcd endpoint auto-sync"}),"\n",(0,i.jsx)(s.li,{children:"Manually requeue configmap reconcile when no nodes have reconciled snapshots"}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(s.li,{children:["Update to v1.26.10 and Go to v1.20.10 ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8680",children:"(#8680)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Fix s3 snapshot restore ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8734",children:"(#8734)"})]}),"\n"]}),"\n",(0,i.jsx)(s.hr,{}),"\n",(0,i.jsxs)(s.h2,{id:"release-v1269k3s1",children:["Release ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/releases/tag/v1.26.9+k3s1",children:"v1.26.9+k3s1"})]}),"\n",(0,i.jsx)(s.p,{children:"This release updates Kubernetes to v1.26.9, and fixes a number of issues."}),"\n",(0,i.jsxs)(s.p,{children:["For more details on what's new, see the ",(0,i.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.26.md#changelog-since-v1268",children:"Kubernetes release notes"}),"."]}),"\n",(0,i.jsx)(s.h3,{id:"changes-since-v1268k3s1",children:"Changes since v1.26.8+k3s1:"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsxs)(s.li,{children:["Bump kine to v0.10.3 ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8325",children:"(#8325)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Update to v1.26.9 and go to v1.20.8 ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8357",children:"(#8357)"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsx)(s.li,{children:"Bump embedded containerd to v1.7.6"}),"\n",(0,i.jsx)(s.li,{children:"Bump embedded stargz-snapshotter plugin to latest"}),"\n",(0,i.jsx)(s.li,{children:"Fixed intermittent drone CI failures due to race conditions in test environment setup scripts"}),"\n",(0,i.jsx)(s.li,{children:"Fixed CI failures due to changes to api discovery changes in Kubernetes 1.28"}),"\n"]}),"\n"]}),"\n"]}),"\n",(0,i.jsx)(s.hr,{}),"\n",(0,i.jsxs)(s.h2,{id:"release-v1268k3s1",children:["Release ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/releases/tag/v1.26.8+k3s1",children:"v1.26.8+k3s1"})]}),"\n",(0,i.jsx)(s.p,{children:"This release updates Kubernetes to v1.26.8, and fixes a number of issues."}),"\n",(0,i.jsx)(s.admonition,{title:"Important",type:"warning",children:(0,i.jsxs)(s.p,{children:["This release includes support for remediating CVE-2023-32187, a potential Denial of Service attack vector on K3s servers. See ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/security/advisories/GHSA-m4hf-6vgr-75r2",children:"https://github.com/k3s-io/k3s/security/advisories/GHSA-m4hf-6vgr-75r2"})," for more information, including mandatory steps necessary to harden clusters against this vulnerability."]})}),"\n",(0,i.jsxs)(s.p,{children:["For more details on what's new, see the ",(0,i.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.26.md#changelog-since-v1267",children:"Kubernetes release notes"}),"."]}),"\n",(0,i.jsx)(s.h3,{id:"changes-since-v1267k3s1",children:"Changes since v1.26.7+k3s1:"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsxs)(s.li,{children:["Update flannel and plugins ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8075",children:"(#8075)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Fix tailscale bug with ip modes ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8097",children:"(#8097)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Etcd snapshots retention when node name changes ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8122",children:"(#8122)"})]}),"\n",(0,i.jsxs)(s.li,{children:["August Test Backports ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8126",children:"(#8126)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Backports for 2023-08 release ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8129",children:"(#8129)"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsx)(s.li,{children:"K3s's external apiserver listener now declines to add to its certificate any subject names not associated with the kubernetes apiserver service, server nodes, or values of the --tls-san option. This prevents the certificate's SAN list from being filled with unwanted entries."}),"\n",(0,i.jsxs)(s.li,{children:["K3s no longer enables the apiserver's ",(0,i.jsx)(s.code,{children:"enable-aggregator-routing"})," flag when the egress proxy is not being used to route connections to in-cluster endpoints."]}),"\n",(0,i.jsx)(s.li,{children:"Updated the embedded containerd to v1.7.3+k3s1"}),"\n",(0,i.jsx)(s.li,{children:"Updated the embedded runc to v1.1.8"}),"\n",(0,i.jsx)(s.li,{children:"Updated the embedded etcd to v3.5.9+k3s1"}),"\n",(0,i.jsxs)(s.li,{children:["User-provided containerd config templates may now use ",(0,i.jsx)(s.code,{children:'{{ template "base" . }}'})," to include the default K3s template content. This makes it easier to maintain user configuration if the only need is to add additional sections to the file."]}),"\n",(0,i.jsx)(s.li,{children:"Bump docker/docker module version to fix issues with cri-dockerd caused by recent releases of golang rejecting invalid host headers sent by the docker client."}),"\n",(0,i.jsx)(s.li,{children:"Updated kine to v0.10.2"}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(s.li,{children:["\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsxs)(s.li,{children:["K3s etcd-snapshot delete fail to delete local file when called with s3 flag ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8144",children:"(#8144)"})]}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(s.li,{children:["\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsxs)(s.li,{children:["Fix for cluster-reset backup from s3 when etcd snapshots are disabled ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8170",children:"(#8170)"})]}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(s.li,{children:["Fixed the etcd retention to delete orphaned snapshots based on the date ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8189",children:"(#8189)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Additional backports for 2023-08 release ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8212",children:"(#8212)"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsxs)(s.li,{children:["The version of ",(0,i.jsx)(s.code,{children:"helm"})," used by the bundled helm controller's job image has been updated to v3.12.3"]}),"\n",(0,i.jsx)(s.li,{children:"Bumped dynamiclistener to address an issue that could cause the apiserver/supervisor listener on 6443 to stop serving requests on etcd-only nodes."}),"\n",(0,i.jsx)(s.li,{children:"The K3s external apiserver/supervisor listener on 6443 now sends a complete certificate chain in the TLS handshake."}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(s.li,{children:["Move flannel to 0.22.2 ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8222",children:"(#8222)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Update to v1.26.8 ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8235",children:"(#8235)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Add new CLI flag to enable TLS SAN CN filtering ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8258",children:"(#8258)"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsxs)(s.li,{children:["Added a new ",(0,i.jsx)(s.code,{children:"--tls-san-security"})," option. This flag defaults to false, but can be set to true to disable automatically adding SANs to the server's TLS certificate to satisfy any hostname requested by a client."]}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(s.li,{children:["Add RWMutex to address controller ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8274",children:"(#8274)"})]}),"\n"]}),"\n",(0,i.jsx)(s.hr,{}),"\n",(0,i.jsxs)(s.h2,{id:"release-v1267k3s1",children:["Release ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/releases/tag/v1.26.7+k3s1",children:"v1.26.7+k3s1"})]}),"\n",(0,i.jsxs)(s.p,{children:["This release updates Kubernetes to v1.26.7, and fixes a number of issues.\r\n\u200b\r\nFor more details on what's new, see the ",(0,i.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.26.md#changelog-since-v1266",children:"Kubernetes release notes"}),".\r\n\u200b"]}),"\n",(0,i.jsx)(s.h3,{id:"changes-since-v1266k3s1",children:"Changes since v1.26.6+k3s1:"}),"\n",(0,i.jsx)(s.p,{children:"\u200b"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsxs)(s.li,{children:["Remove file_windows.go ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7855",children:"(#7855)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Fix code spell check ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7859",children:"(#7859)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Allow k3s to customize apiServerPort on helm-controller ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7874",children:"(#7874)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Check if we are on ipv4, ipv6 or dualStack when doing tailscale ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7882",children:"(#7882)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Support setting control server URL for Tailscale. ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7893",children:"(#7893)"})]}),"\n",(0,i.jsxs)(s.li,{children:["S3 and Startup tests ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7885",children:"(#7885)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Fix rootless node password ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7901",children:"(#7901)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Backports for 2023-07 release ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7908",children:"(#7908)"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsx)(s.li,{children:"Resolved an issue that caused agents joined with kubeadm-style bootstrap tokens to fail to rejoin the cluster when their node object is deleted."}),"\n",(0,i.jsxs)(s.li,{children:["The ",(0,i.jsx)(s.code,{children:"k3s certificate rotate-ca"})," command now supports the data-dir flag."]}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(s.li,{children:["Adding cli to custom klipper helm image ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7914",children:"(#7914)"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsx)(s.li,{children:"The default helm-controller job image can now be overridden with the --helm-job-image CLI flag"}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(s.li,{children:["Generation of certs and keys for etcd gated if etcd is disabled ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7944",children:"(#7944)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Don't use zgrep in ",(0,i.jsx)(s.code,{children:"check-config"})," if apparmor profile is enforced ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7956",children:"(#7956)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Fix image_scan.sh script and download trivy version (#7950) ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7968",children:"(#7968)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Adjust default kubeconfig file permissions ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7983",children:"(#7983)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Update to v1.26.7 ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8022",children:"(#8022)"}),"\r\n\u200b"]}),"\n"]}),"\n",(0,i.jsx)(s.hr,{}),"\n",(0,i.jsxs)(s.h2,{id:"release-v1266k3s1",children:["Release ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/releases/tag/v1.26.6+k3s1",children:"v1.26.6+k3s1"})]}),"\n",(0,i.jsx)(s.p,{children:"This release updates Kubernetes to v1.26.6, and fixes a number of issues."}),"\n",(0,i.jsxs)(s.p,{children:["For more details on what's new, see the ",(0,i.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.26.md#changelog-since-v1265",children:"Kubernetes release notes"}),"."]}),"\n",(0,i.jsx)(s.h3,{id:"changes-since-v1265k3s1",children:"Changes since v1.26.5+k3s1:"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsxs)(s.li,{children:["Update flannel version ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7648",children:"(#7648)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Bump vagrant libvirt with fix for plugin installs ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7658",children:"(#7658)"})]}),"\n",(0,i.jsxs)(s.li,{children:["E2E and Dep Backports - June ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7693",children:"(#7693)"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsx)(s.li,{children:"Bump docker go.mod #7681"}),"\n",(0,i.jsx)(s.li,{children:"Shortcircuit commands with version or help flags #7683"}),"\n",(0,i.jsx)(s.li,{children:"Add Rotation certification Check, remove func to restart agents #7097"}),"\n",(0,i.jsx)(s.li,{children:"E2E: Sudo for RunCmdOnNode #7686"}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(s.li,{children:["VPN integration ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7727",children:"(#7727)"})]}),"\n",(0,i.jsxs)(s.li,{children:["E2e: Private registry test ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7721",children:"(#7721)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Fix spelling check ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7751",children:"(#7751)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Remove unused libvirt config ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7757",children:"(#7757)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Backport version bumps and bugfixes ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7717",children:"(#7717)"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsx)(s.li,{children:"The bundled metrics-server has been bumped to v0.6.3, and now uses only secure TLS ciphers by default."}),"\n",(0,i.jsxs)(s.li,{children:["The ",(0,i.jsx)(s.code,{children:"coredns-custom"})," ConfigMap now allows for ",(0,i.jsx)(s.code,{children:"*.override"})," sections to be included in the ",(0,i.jsx)(s.code,{children:".:53"})," default server block."]}),"\n",(0,i.jsx)(s.li,{children:"The K3s core controllers (supervisor, deploy, and helm) no longer use the admin kubeconfig. This makes it easier to determine from access and audit logs which actions are performed by the system, and which are performed by an administrative user."}),"\n",(0,i.jsx)(s.li,{children:"Bumped klipper-lb image to v0.4.4 to resolve an issue that prevented access to ServiceLB ports from localhost when the Service ExternalTrafficPolicy was set to Local."}),"\n",(0,i.jsx)(s.li,{children:"Make LB image configurable when compiling k3s"}),"\n",(0,i.jsx)(s.li,{children:"K3s now allows nodes to join the cluster even if the node password secret cannot be created at the time the node joins. The secret create will be retried in the background. This resolves a potential deadlock created by fail-closed validating webhooks that block secret creation, where the webhook is unavailable until new nodes join the cluster to run the webhook pod."}),"\n",(0,i.jsx)(s.li,{children:"The bundled containerd's aufs/devmapper/zfs snapshotter plugins have been restored. These were unintentionally omitted when moving containerd back into the k3s multicall binary in the previous release."}),"\n",(0,i.jsx)(s.li,{children:"The embedded helm controller has been bumped to v0.15.0, and now supports creating the chart's target namespace if it does not exist."}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(s.li,{children:["Add format command on makefile ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7762",children:"(#7762)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Fix logging and cleanup in Tailscale ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7782",children:"(#7782)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Update Kubernetes to v1.26.6 ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7789",children:"(#7789)"})]}),"\n"]}),"\n",(0,i.jsx)(s.hr,{}),"\n",(0,i.jsxs)(s.h2,{id:"release-v1265k3s1",children:["Release ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/releases/tag/v1.26.5+k3s1",children:"v1.26.5+k3s1"})]}),"\n",(0,i.jsx)(s.p,{children:"This release updates Kubernetes to v1.26.5, and fixes a number of issues."}),"\n",(0,i.jsxs)(s.p,{children:["For more details on what's new, see the ",(0,i.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.26.md#changelog-since-v1264",children:"Kubernetes release notes"}),"."]}),"\n",(0,i.jsx)(s.h3,{id:"changes-since-v1264k3s1",children:"Changes since v1.26.4+k3s1:"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsxs)(s.li,{children:["Ensure that klog verbosity is set to the same level as logrus ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7360",children:"(#7360)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Prepend release branch to dependabot ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7374",children:"(#7374)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Add integration tests for etc-snapshot server flags ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7377",children:"(#7377)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Bump Runc and Containerd ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7399",children:"(#7399)"})]}),"\n",(0,i.jsxs)(s.li,{children:["CLI + Config Enhancement ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7403",children:"(#7403)"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsxs)(s.li,{children:[(0,i.jsx)(s.code,{children:"--Tls-sans"})," now accepts multiple arguments: ",(0,i.jsx)(s.code,{children:'--tls-sans="foo,bar"'})]}),"\n",(0,i.jsxs)(s.li,{children:[(0,i.jsx)(s.code,{children:"Prefer-bundled-bin: true"})," now works properly when set in ",(0,i.jsx)(s.code,{children:"config.yaml.d"})," files"]}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(s.li,{children:["Migrate netutil methods into /utils/net.go ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7432",children:"(#7432)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Bump kube-router version to fix a bug when a port name is used ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7460",children:"(#7460)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Kube flags and longhorn storage tests ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7465",children:"(#7465)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Local-storage: Fix permission ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7474",children:"(#7474)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Bump containerd to v1.7.0 and move back into multicall binary ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7444",children:"(#7444)"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsxs)(s.li,{children:["The embedded containerd version has been bumped to ",(0,i.jsx)(s.code,{children:"v1.7.0-k3s1"}),", and has been reintegrated into the main k3s binary for a significant savings in release artifact size."]}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(s.li,{children:["Backport version bumps and bugfixes ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7514",children:"(#7514)"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsx)(s.li,{children:'K3s now retries the cluster join operation when receiving a "too many learners" error from etcd. This most frequently occurred when attempting to add multiple servers at the same time.'}),"\n",(0,i.jsx)(s.li,{children:"K3s once again supports aarch64 nodes with page size > 4k"}),"\n",(0,i.jsx)(s.li,{children:"The packaged Traefik version has been bumped to v2.9.10 / chart 21.2.0"}),"\n",(0,i.jsxs)(s.li,{children:["K3s now prints a more meaningful error when attempting to run from a filesystem mounted ",(0,i.jsx)(s.code,{children:"noexec"}),"."]}),"\n",(0,i.jsxs)(s.li,{children:["K3s now exits with a proper error message when the server token uses a bootstrap token ",(0,i.jsx)(s.code,{children:"id.secret"})," format."]}),"\n",(0,i.jsx)(s.li,{children:"Fixed an issue where Addon, HelmChart, and HelmChartConfig CRDs were created without structural schema, allowing the creation of custom resources of these types with invalid content."}),"\n",(0,i.jsx)(s.li,{children:"Servers started with the (experimental) --disable-agent flag no longer attempt to run the tunnel authorizer agent component."}),"\n",(0,i.jsx)(s.li,{children:"Fixed an regression that prevented the pod and cluster egress-selector modes from working properly."}),"\n",(0,i.jsx)(s.li,{children:"K3s now correctly passes through etcd-args to the temporary etcd that is used to extract cluster bootstrap data when restarting managed etcd nodes."}),"\n",(0,i.jsx)(s.li,{children:"K3s now properly handles errors obtaining the current etcd cluster member list when a new server is joining the managed etcd cluster."}),"\n",(0,i.jsxs)(s.li,{children:["The embedded kine version has been bumped to v0.10.1. This replaces the legacy ",(0,i.jsx)(s.code,{children:"lib/pq"})," postgres driver with ",(0,i.jsx)(s.code,{children:"pgx"}),"."]}),"\n",(0,i.jsx)(s.li,{children:"The bundled CNI plugins have been upgraded to v1.2.0-k3s1. The bandwidth and firewall plugins are now included in the bundle."}),"\n",(0,i.jsx)(s.li,{children:"The embedded Helm controller now supports authenticating to chart repositories via credentials stored in a Secret, as well as passing repo CAs via ConfigMap."}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(s.li,{children:["Bump containerd/runc to v1.7.1-k3s1/v1.1.7 ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7534",children:"(#7534)"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsx)(s.li,{children:"The bundled containerd and runc versions have been bumped to v1.7.1-k3s1/v1.1.7"}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(s.li,{children:["Wrap error stating that it is coming from netpol ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7547",children:"(#7547)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Add '-all' flag to apply to inactive units ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7573",children:"(#7573)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Update to v1.26.5-k3s1 ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7576",children:"(#7576)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Pin emicklei/go-restful to v3.9.0 ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7598",children:"(#7598)"})]}),"\n"]}),"\n",(0,i.jsx)(s.hr,{}),"\n",(0,i.jsxs)(s.h2,{id:"release-v1264k3s1",children:["Release ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/releases/tag/v1.26.4+k3s1",children:"v1.26.4+k3s1"})]}),"\n",(0,i.jsx)(s.p,{children:"This release updates Kubernetes to v1.26.4, and fixes a number of issues."}),"\n",(0,i.jsxs)(s.p,{children:["For more details on what's new, see the ",(0,i.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.26.md#changelog-since-v1263",children:"Kubernetes release notes"}),"."]}),"\n",(0,i.jsx)(s.h3,{id:"changes-since-v1263k3s1",children:"Changes since v1.26.3+k3s1:"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsxs)(s.li,{children:["Enhance ",(0,i.jsx)(s.code,{children:"k3s check-config"})," ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7091",children:"(#7091)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Update stable channel to v1.25.8+k3s1 ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7161",children:"(#7161)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Drone Pipelines enhancement ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7169",children:"(#7169)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Fix_get_sha_url ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7187",children:"(#7187)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Improve Updatecli local-path-provisioner pipeline ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7181",children:"(#7181)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Improve workflow ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7142",children:"(#7142)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Improve Trivy configuration ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7154",children:"(#7154)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Bump Local Path Provisioner version ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7167",children:"(#7167)"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsx)(s.li,{children:"The bundled local-path-provisioner version has been bumped to v0.0.24"}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(s.li,{children:["Bump etcd to v3.5.7 ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7170",children:"(#7170)"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsx)(s.li,{children:"The embedded etcd version has been bumped to v3.5.7"}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(s.li,{children:["Bump runc to v1.1.5 ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7171",children:"(#7171)"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsx)(s.li,{children:"The bundled runc version has been bumped to v1.1.5"}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(s.li,{children:["Fix race condition caused by etcd advertising addresses that it does not listen on ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7147",children:"(#7147)"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsx)(s.li,{children:"Fixed a race condition during cluster reset that could cause the operation to hang and time out."}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(s.li,{children:["Bump coredns to v1.10.1 ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7168",children:"(#7168)"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsx)(s.li,{children:"The bundled coredns version has been bumped to v1.10.1"}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(s.li,{children:["Don't apply hardened args to agent ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7089",children:"(#7089)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Upgrade helm-controller to v0.13.3 ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7209",children:"(#7209)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Improve Klipper Helm and Helm controller bumps ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7146",children:"(#7146)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Fix issue with stale connections to removed LB server ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7194",children:"(#7194)"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsx)(s.li,{children:"The client load-balancer that maintains connections to active server nodes now closes connections to servers when they are removed from the cluster. This ensures that agent components immediately reconnect to a current cluster member."}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(s.li,{children:["Bump actions/setup-go from 3 to 4 ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7111",children:"(#7111)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Lock bootstrap data with empty key to prevent conflicts ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7215",children:"(#7215)"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsx)(s.li,{children:"When using an external datastore, K3s now locks the bootstrap key while creating initial cluster bootstrap data, preventing a race condition when multiple servers attempted to initialize the cluster simultaneously."}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(s.li,{children:["Updated kube-router to move the default ACCEPT rule at the end of the chain ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7218",children:"(#7218)"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsx)(s.li,{children:"The embedded kube-router controller has been updated to fix a regression that caused traffic from pods to be blocked by any default drop/deny rules present on the host. Users should still confirm that any externally-managed firewall rules explicitly allow traffic to/from pod and service networks, but this returns the old behavior that was relied upon by some users."}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(s.li,{children:["Add make commands to terraform automation and fix external dbs related issue ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7159",children:"(#7159)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Update klipper lb to v0.4.2 ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7210",children:"(#7210)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Add coreos and sle micro to selinux support ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6945",children:"(#6945)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Fix call for k3s-selinux versions in airgapped environments ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7264",children:"(#7264)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Update Kube-router ACCEPT rule insertion and install script to clean rules before start ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7274",children:"(#7274)"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsx)(s.li,{children:"The embedded kube-router controller has been updated to fix a regression that caused traffic from pods to be blocked by any default drop/deny rules present on the host. Users should still confirm that any externally-managed firewall rules explicitly allow traffic to/from pod and service networks, but this returns the old behavior that was relied upon by some users."}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(s.li,{children:["Update to v1.26.4-k3s1 ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7282",children:"(#7282)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Bump golang",":alpine"," image version ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7292",children:"(#7292)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Bump Sonobuoy version ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7256",children:"(#7256)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Bump Trivy version ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7257",children:"(#7257)"})]}),"\n"]}),"\n",(0,i.jsx)(s.hr,{}),"\n",(0,i.jsxs)(s.h2,{id:"release-v1263k3s1",children:["Release ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/releases/tag/v1.26.3+k3s1",children:"v1.26.3+k3s1"})]}),"\n",(0,i.jsx)(s.p,{children:"This release updates Kubernetes to v1.26.3, and fixes a number of issues."}),"\n",(0,i.jsxs)(s.p,{children:["For more details on what's new, see the ",(0,i.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.26.md#changelog-since-v1262",children:"Kubernetes release notes"}),"."]}),"\n",(0,i.jsx)(s.h3,{id:"changes-since-v1262k3s1",children:"Changes since v1.26.2+k3s1:"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsxs)(s.li,{children:["Add E2E to Drone ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6890",children:"(#6890)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Add flannel adr ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6973",children:"(#6973)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Update flannel and kube-router ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7039",children:"(#7039)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Bump various dependencies for CVEs ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7044",children:"(#7044)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Adds a warning about editing to the containerd config.toml file ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7057",children:"(#7057)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Update stable version in channel server ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7066",children:"(#7066)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Wait for kubelet port to be ready before setting ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7041",children:"(#7041)"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsx)(s.li,{children:"The agent tunnel authorizer now waits for the kubelet to be ready before reading the kubelet port from the node object."}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(s.li,{children:["Improve support for rotating the default self-signed certs ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7032",children:"(#7032)"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsxs)(s.li,{children:["The ",(0,i.jsx)(s.code,{children:"k3s certificate rotate-ca"})," checks now support rotating self-signed certificates without the ",(0,i.jsx)(s.code,{children:"--force"})," option."]}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(s.li,{children:["Skip all pipelines based on what is in the PR ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6996",children:"(#6996)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Add missing kernel config checks ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6946",children:"(#6946)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Remove deprecated nodeSelector label beta.kubernetes.io/os ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6970",children:"(#6970)"})]}),"\n",(0,i.jsxs)(s.li,{children:["MultiClusterCIDR for v1.26 ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6885",children:"(#6885)"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsx)(s.li,{children:"MultiClusterCIDR feature"}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(s.li,{children:["Remove Nikolai from MAINTAINERS list ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7088",children:"(#7088)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Add automation for Restart command for K3s ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7002",children:"(#7002)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Fix to Rotate CA e2e test ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7101",children:"(#7101)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Drone: Cleanup E2E VMs on test panic ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7104",children:"(#7104)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Update to v1.26.3-k3s1 ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7108",children:"(#7108)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Pin golangci-lint version to v1.51.2 ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7113",children:"(#7113)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Clean E2E VMs before testing ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7109",children:"(#7109)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Update flannel to fix NAT issue with old iptables version ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7136",children:"(#7136)"})]}),"\n"]}),"\n",(0,i.jsx)(s.hr,{}),"\n",(0,i.jsxs)(s.h2,{id:"release-v1262k3s1",children:["Release ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/releases/tag/v1.26.2+k3s1",children:"v1.26.2+k3s1"})]}),"\n",(0,i.jsx)(s.p,{children:"This release updates Kubernetes to v1.26.2, and fixes a number of issues."}),"\n",(0,i.jsxs)(s.p,{children:["For more details on what's new, see the ",(0,i.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.26.md#changelog-since-v1261",children:"Kubernetes release notes"}),"."]}),"\n",(0,i.jsx)(s.h3,{id:"changes-since-v1261k3s1",children:"Changes since v1.26.1+k3s1:"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsxs)(s.li,{children:["Add build tag to disable cri-dockerd ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6760",children:"(#6760)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Bump cri-dockerd ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6797",children:"(#6797)"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsx)(s.li,{children:"The embedded cri-dockerd has been updated to v0.3.1"}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(s.li,{children:["Update stable channel to v1.25.6+k3s1 ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6828",children:"(#6828)"})]}),"\n",(0,i.jsxs)(s.li,{children:["E2E Rancher and Hardened script improvements ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6778",children:"(#6778)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Add Ayedo to Adopters ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6801",children:"(#6801)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Consolidate E2E tests and GH Actions ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6772",children:"(#6772)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Allow ServiceLB to honor ",(0,i.jsx)(s.code,{children:"ExternalTrafficPolicy=Local"})," ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6726",children:"(#6726)"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsx)(s.li,{children:"ServiceLB now honors the Service's ExternalTrafficPolicy. When set to Local, the LoadBalancer will only advertise addresses of Nodes with a Pod for the Service, and will not forward traffic to other cluster members."}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(s.li,{children:["Fix cronjob example ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6707",children:"(#6707)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Bump vagrant boxes to fedora37 ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6832",children:"(#6832)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Ensure flag type consistency ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6852",children:"(#6852)"})]}),"\n",(0,i.jsxs)(s.li,{children:["E2E: Consoldiate docker and prefer bundled tests into new startup test ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6851",children:"(#6851)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Fix reference to documentation ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6860",children:"(#6860)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Bump deps: trivy, sonobuoy, dapper, golangci-lint, gopls ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6807",children:"(#6807)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Fix check for (open)SUSE version ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6791",children:"(#6791)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Add support for user-provided CA certificates ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6615",children:"(#6615)"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsxs)(s.li,{children:["K3s now functions properly when the cluster CA certificates are signed by an existing root or intermediate CA. You can find a sample script for generating such certificates before K3s starts in the github repo at ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/blob/master/contrib/util/certs.sh",children:"contrib/util/certs.sh"}),"."]}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(s.li,{children:["Ignore value conflicts when reencrypting secrets ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6850",children:"(#6850)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Add ",(0,i.jsx)(s.code,{children:"kubeadm"})," style bootstrap token secret support ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6663",children:"(#6663)"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsxs)(s.li,{children:["K3s now supports ",(0,i.jsx)(s.code,{children:"kubeadm"})," style join tokens. ",(0,i.jsx)(s.code,{children:"k3s token create"})," now creates join token secrets, optionally with a limited TTL."]}),"\n",(0,i.jsx)(s.li,{children:"K3s agents joined with an expired or deleted token stay in the cluster using existing client certificates via the NodeAuthorization admission plugin, unless their Node object is deleted from the cluster."}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(s.li,{children:["Add NATS to the list of supported data stores ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6876",children:"(#6876)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Use default address family when adding kubernetes service address to SAN list ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6857",children:"(#6857)"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsx)(s.li,{children:"The apiserver advertised address and IP SAN entry are now set correctly on clusters that use IPv6 as the default IP family."}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(s.li,{children:["Fix issue with servicelb startup failure when validating webhooks block creation ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6911",children:"(#6911)"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsx)(s.li,{children:"The embedded cloud controller manager will no longer attempt to unconditionally re-create its namespace and serviceaccount on startup. This resolves an issue that could cause a deadlocked cluster when fail-closed webhooks are in use."}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(s.li,{children:["Fix access to hostNetwork port on NodeIP when egress-selector-mode=agent ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6829",children:"(#6829)"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsx)(s.li,{children:"Fixed an issue that would cause the apiserver egress proxy to attempt to use the agent tunnel to connect to service endpoints even in agent or disabled mode."}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(s.li,{children:["Wait for server to become ready before creating token ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6932",children:"(#6932)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Allow for multiple sets of leader-elected controllers ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6922",children:"(#6922)"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsx)(s.li,{children:"Fixed an issue where leader-elected controllers for managed etcd did not run on etcd-only nodes"}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(s.li,{children:["Update Flannel to v0.21.1 ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6944",children:"(#6944)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Fix Nightly E2E tests ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6950",children:"(#6950)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Fix etcd and ca-cert rotate issues ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6952",children:"(#6952)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Fix ServiceLB dual-stack ingress IP listing ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6979",children:"(#6979)"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsx)(s.li,{children:"Resolved an issue with ServiceLB that would cause it to advertise node IPv6 addresses, even if the cluster or service was not enabled for dual-stack operation."}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(s.li,{children:["Bump kine to v0.9.9 ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6974",children:"(#6974)"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsxs)(s.li,{children:["The embedded kine version has been bumped to v0.9.9. Compaction log messages are now omitted at ",(0,i.jsx)(s.code,{children:"info"})," level for increased visibility."]}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(s.li,{children:["Update to v1.26.2-k3s1 ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7011",children:"(#7011)"})]}),"\n"]}),"\n",(0,i.jsx)(s.hr,{}),"\n",(0,i.jsxs)(s.h2,{id:"release-v1261k3s1",children:["Release ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/releases/tag/v1.26.1+k3s1",children:"v1.26.1+k3s1"})]}),"\n",(0,i.jsx)(s.p,{children:"This release updates Kubernetes to v1.26.1, and fixes a number of issues."}),"\n",(0,i.jsxs)(s.p,{children:["For more details on what's new, see the ",(0,i.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.26.md#changelog-since-v1260",children:"Kubernetes release notes"}),"."]}),"\n",(0,i.jsx)(s.h3,{id:"changes-since-v1260k3s2",children:"Changes since v1.26.0+k3s2:"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsxs)(s.li,{children:["Add jitter to scheduled snapshots and retry harder on conflicts ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6715",children:"(#6715)"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsx)(s.li,{children:"Scheduled etcd snapshots are now offset by a short random delay of up to several seconds. This should prevent multi-server clusters from executing pathological behavior when attempting to simultaneously update the snapshot list ConfigMap. The snapshot controller will also be more persistent in attempting to update the snapshot list."}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(s.li,{children:["Adjust e2e test run script and fixes ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6718",children:"(#6718)"})]}),"\n",(0,i.jsxs)(s.li,{children:["RIP Codespell ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6701",children:"(#6701)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Bump alpine from 3.16 to 3.17 in /package ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6688",children:"(#6688)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Bump alpine from 3.16 to 3.17 in /conformance ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6687",children:"(#6687)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Bump containerd to v1.6.15-k3s1 ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6722",children:"(#6722)"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsx)(s.li,{children:"The embedded containerd version has been bumped to v1.6.15-k3s1"}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(s.li,{children:["Containerd restart testlet ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6696",children:"(#6696)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Bump ubuntu from 20.04 to 22.04 in /tests/e2e/scripts ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6686",children:"(#6686)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Add explicit read permissions to workflows ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6700",children:"(#6700)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Pass through default tls-cipher-suites ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6725",children:"(#6725)"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsx)(s.li,{children:"The K3s default cipher suites are now explicitly passed in to kube-apiserver, ensuring that all listeners use these values."}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(s.li,{children:["Bump golang",":alpine"," image version ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6683",children:"(#6683)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Bugfix: do not break cert-manager when pprof is enabled ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6635",children:"(#6635)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Fix CI tests on Alpine 3.17 ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6744",children:"(#6744)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Update Stable to 1.25.5+k3s2 ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6753",children:"(#6753)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Bump action/download-artifact to v3 ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6746",children:"(#6746)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Generate report and upload test results ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6737",children:"(#6737)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Slow dependency CI to weekly ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6764",children:"(#6764)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Fix Drone plugins/docker tag for 32 bit arm ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6769",children:"(#6769)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Update to v1.26.1-k3s1 ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6774",children:"(#6774)"})]}),"\n"]}),"\n",(0,i.jsx)(s.hr,{}),"\n",(0,i.jsxs)(s.h2,{id:"release-v1260k3s2",children:["Release ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/releases/tag/v1.26.0+k3s2",children:"v1.26.0+k3s2"})]}),"\n",(0,i.jsx)(s.p,{children:"This release updates containerd to v1.6.14 to resolve an issue where pods would lose their CNI information when containerd was restarted, as well as a number of other stability and administrative changes."}),"\n",(0,i.jsxs)(s.p,{children:["Before upgrading from earlier releases, be sure to read the Kubernetes ",(0,i.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.26.md#urgent-upgrade-notes",children:"Urgent Upgrade Notes"}),"."]}),"\n",(0,i.jsx)(s.h3,{id:"changes-since-v1260k3s1",children:"Changes since v1.26.0+k3s1:"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsxs)(s.li,{children:["Current status badges ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6653",children:"(#6653)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Add initial Updatecli ADR automation ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6583",children:"(#6583)"})]}),"\n",(0,i.jsxs)(s.li,{children:["December 2022 channels update ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6618",children:"(#6618)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Change Updatecli GH action reference branch ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6682",children:"(#6682)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Fix OpenRC init script error 'openrc-run.sh: source: not found' ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6614",children:"(#6614)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Add Dependabot config for security ADR ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6560",children:"(#6560)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Bump containerd to v1.6.14-k3s1 ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6693",children:"(#6693)"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsxs)(s.li,{children:["The embedded containerd version has been bumped to v1.6.14-k3s1. This includes a backported fix for ",(0,i.jsx)(s.a,{href:"https://github.com/containerd/containerd/issues/7843",children:"containerd/7843"})," which caused pods to lose their CNI info when containerd was restarted, which in turn caused the kubelet to recreate the pod."]}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(s.li,{children:["Exclude December r1 releases from channel server ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6706",children:"(#6706)"})]}),"\n"]}),"\n",(0,i.jsx)(s.hr,{}),"\n",(0,i.jsxs)(s.h2,{id:"release-v1260k3s1",children:["Release ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/releases/tag/v1.26.0+k3s1",children:"v1.26.0+k3s1"})]}),"\n",(0,i.jsxs)(s.blockquote,{children:["\n",(0,i.jsx)(s.h2,{id:"\ufe0f-warning",children:"\u26a0\ufe0f WARNING"}),"\n",(0,i.jsxs)(s.p,{children:["This release is affected by ",(0,i.jsx)(s.a,{href:"https://github.com/containerd/containerd/issues/7843",children:"https://github.com/containerd/containerd/issues/7843"}),", which causes the kubelet to restart all pods whenever K3s is restarted. For this reason, we have removed this K3s release from the channel server. Please use ",(0,i.jsx)(s.code,{children:"v1.26.0+k3s2"})," instead."]}),"\n"]}),"\n",(0,i.jsx)(s.p,{children:"This release is K3S's first in the v1.26 line. This release updates Kubernetes to v1.26.0."}),"\n",(0,i.jsxs)(s.p,{children:["Before upgrading from earlier releases, be sure to read the Kubernetes ",(0,i.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.26.md#urgent-upgrade-notes",children:"Urgent Upgrade Notes"}),"."]}),"\n",(0,i.jsx)(s.h3,{id:"changes-since-v1255k3s1",children:"Changes since v1.25.5+k3s1:"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsxs)(s.li,{children:["Remove deprecated flags in v1.26 ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6574",children:"(#6574)"})]}),"\n",(0,i.jsxs)(s.li,{children:['Using "etcd-snapshot" for saving snapshots is now deprecated, use "etcd-snapshot save" instead. ',(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6575",children:"(#6575)"})]}),"\n",(0,i.jsx)(s.li,{children:"Update to v1.26.0-k3s1"}),"\n",(0,i.jsxs)(s.li,{children:["\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsx)(s.li,{children:"Update kubernetes to v1.26.0-k3s1"}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(s.li,{children:["\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsx)(s.li,{children:"Update cri-tools to v1.26.0-rc.0-k3s1"}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(s.li,{children:["\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsx)(s.li,{children:"Update helm controller to v0.13.1"}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(s.li,{children:["\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsx)(s.li,{children:"Update etcd to v3.5.5-k3s1"}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(s.li,{children:["\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsx)(s.li,{children:"Update cri-dockerd to the latest 1.26.0"}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(s.li,{children:["\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsx)(s.li,{children:"Update cadvisor"}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(s.li,{children:["\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsxs)(s.li,{children:["Update containerd to v1.6.12-k3s1 ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6370",children:"(#6370)"})]}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(s.li,{children:["Preload iptable_filter/ip6table_filter ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6645",children:"(#6645)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Bump k3s-root version to v0.12.1 ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6651",children:"(#6651)"})]}),"\n"]}),"\n",(0,i.jsx)(s.hr,{})]})}function o(e={}){const{wrapper:s}={...(0,r.a)(),...e.components};return s?(0,i.jsx)(s,{...e,children:(0,i.jsx)(a,{...e})}):a(e)}},1151:(e,s,t)=>{t.d(s,{Z:()=>h,a:()=>l});var i=t(7294);const r={},n=i.createContext(r);function l(e){const s=i.useContext(n);return i.useMemo((function(){return"function"==typeof e?e(s):{...s,...e}}),[s,e])}function h(e){let s;return s=e.disableParentContext?"function"==typeof e.components?e.components(r):e.components||r:l(e.components),i.createElement(n.Provider,{value:s},e.children)}}}]); \ No newline at end of file +"use strict";(self.webpackChunkk_3_s_docs=self.webpackChunkk_3_s_docs||[]).push([[1620],{3012:(e,s,t)=>{t.r(s),t.d(s,{assets:()=>c,contentTitle:()=>l,default:()=>o,frontMatter:()=>n,metadata:()=>h,toc:()=>d});var i=t(5893),r=t(1151);const n={hide_table_of_contents:!0,sidebar_position:5},l="v1.26.X",h={id:"release-notes/v1.26.X",title:"v1.26.X",description:"Before upgrading from earlier releases, be sure to read the Kubernetes Urgent Upgrade Notes.",source:"@site/docs/release-notes/v1.26.X.md",sourceDirName:"release-notes",slug:"/release-notes/v1.26.X",permalink:"/release-notes/v1.26.X",draft:!1,unlisted:!1,editUrl:"https://github.com/k3s-io/docs/edit/main/docs/release-notes/v1.26.X.md",tags:[],version:"current",lastUpdatedAt:1723747404e3,sidebarPosition:5,frontMatter:{hide_table_of_contents:!0,sidebar_position:5},sidebar:"mySidebar",previous:{title:"v1.27.X",permalink:"/release-notes/v1.27.X"},next:{title:"v1.25.X",permalink:"/release-notes/v1.25.X"}},c={},d=[{value:"Release v1.26.15+k3s1",id:"release-v12615k3s1",level:2},{value:"Changes since v1.26.14+k3s1:",id:"changes-since-v12614k3s1",level:3},{value:"Release v1.26.14+k3s1",id:"release-v12614k3s1",level:2},{value:"Changes since v1.26.13+k3s2:",id:"changes-since-v12613k3s2",level:3},{value:"Release v1.26.13+k3s2",id:"release-v12613k3s2",level:2},{value:"Changes since v1.26.12+k3s1:",id:"changes-since-v12612k3s1",level:3},{value:"Release v1.26.12+k3s1",id:"release-v12612k3s1",level:2},{value:"Changes since v1.26.11+k3s2:",id:"changes-since-v12611k3s2",level:3},{value:"Release v1.26.11+k3s2",id:"release-v12611k3s2",level:2},{value:"Changes since v1.26.10+k3s2:",id:"changes-since-v12610k3s2",level:3},{value:"Release v1.26.10+k3s2",id:"release-v12610k3s2",level:2},{value:"Changes since v1.26.10+k3s1:",id:"changes-since-v12610k3s1",level:3},{value:"Release v1.26.10+k3s1",id:"release-v12610k3s1",level:2},{value:"Changes since v1.26.9+k3s1:",id:"changes-since-v1269k3s1",level:3},{value:"Release v1.26.9+k3s1",id:"release-v1269k3s1",level:2},{value:"Changes since v1.26.8+k3s1:",id:"changes-since-v1268k3s1",level:3},{value:"Release v1.26.8+k3s1",id:"release-v1268k3s1",level:2},{value:"Changes since v1.26.7+k3s1:",id:"changes-since-v1267k3s1",level:3},{value:"Release v1.26.7+k3s1",id:"release-v1267k3s1",level:2},{value:"Changes since v1.26.6+k3s1:",id:"changes-since-v1266k3s1",level:3},{value:"Release v1.26.6+k3s1",id:"release-v1266k3s1",level:2},{value:"Changes since v1.26.5+k3s1:",id:"changes-since-v1265k3s1",level:3},{value:"Release v1.26.5+k3s1",id:"release-v1265k3s1",level:2},{value:"Changes since v1.26.4+k3s1:",id:"changes-since-v1264k3s1",level:3},{value:"Release v1.26.4+k3s1",id:"release-v1264k3s1",level:2},{value:"Changes since v1.26.3+k3s1:",id:"changes-since-v1263k3s1",level:3},{value:"Release v1.26.3+k3s1",id:"release-v1263k3s1",level:2},{value:"Changes since v1.26.2+k3s1:",id:"changes-since-v1262k3s1",level:3},{value:"Release v1.26.2+k3s1",id:"release-v1262k3s1",level:2},{value:"Changes since v1.26.1+k3s1:",id:"changes-since-v1261k3s1",level:3},{value:"Release v1.26.1+k3s1",id:"release-v1261k3s1",level:2},{value:"Changes since v1.26.0+k3s2:",id:"changes-since-v1260k3s2",level:3},{value:"Release v1.26.0+k3s2",id:"release-v1260k3s2",level:2},{value:"Changes since v1.26.0+k3s1:",id:"changes-since-v1260k3s1",level:3},{value:"Release v1.26.0+k3s1",id:"release-v1260k3s1",level:2},{value:"\u26a0\ufe0f WARNING",id:"\ufe0f-warning",level:2},{value:"Changes since v1.25.5+k3s1:",id:"changes-since-v1255k3s1",level:3}];function a(e){const s={a:"a",admonition:"admonition",blockquote:"blockquote",code:"code",h1:"h1",h2:"h2",h3:"h3",header:"header",hr:"hr",li:"li",p:"p",strong:"strong",table:"table",tbody:"tbody",td:"td",th:"th",thead:"thead",tr:"tr",ul:"ul",...(0,r.a)(),...e.components};return(0,i.jsxs)(i.Fragment,{children:[(0,i.jsx)(s.header,{children:(0,i.jsx)(s.h1,{id:"v126x",children:"v1.26.X"})}),"\n",(0,i.jsx)(s.admonition,{title:"Upgrade Notice",type:"warning",children:(0,i.jsxs)(s.p,{children:["Before upgrading from earlier releases, be sure to read the Kubernetes ",(0,i.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.26.md#urgent-upgrade-notes",children:"Urgent Upgrade Notes"}),"."]})}),"\n",(0,i.jsxs)(s.table,{children:[(0,i.jsx)(s.thead,{children:(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.th,{children:"Version"}),(0,i.jsx)(s.th,{children:"Release date"}),(0,i.jsx)(s.th,{children:"Kubernetes"}),(0,i.jsx)(s.th,{children:"Kine"}),(0,i.jsx)(s.th,{children:"SQLite"}),(0,i.jsx)(s.th,{children:"Etcd"}),(0,i.jsx)(s.th,{children:"Containerd"}),(0,i.jsx)(s.th,{children:"Runc"}),(0,i.jsx)(s.th,{children:"Flannel"}),(0,i.jsx)(s.th,{children:"Metrics-server"}),(0,i.jsx)(s.th,{children:"Traefik"}),(0,i.jsx)(s.th,{children:"CoreDNS"}),(0,i.jsx)(s.th,{children:"Helm-controller"}),(0,i.jsx)(s.th,{children:"Local-path-provisioner"})]})}),(0,i.jsxs)(s.tbody,{children:[(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"/release-notes/v1.26.X#release-v12615k3s1",children:"v1.26.15+k3s1"})}),(0,i.jsx)(s.td,{children:"Mar 25 2024"}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.26.md#v12615",children:"v1.26.15"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/kine/releases/tag/v0.11.4",children:"v0.11.4"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://sqlite.org/releaselog/3_44_0.html",children:"3.44.0"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/etcd/releases/tag/v3.5.9-k3s1",children:"v3.5.9-k3s1"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/containerd/releases/tag/v1.7.11-k3s2.26",children:"v1.7.11-k3s2.26"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/opencontainers/runc/releases/tag/v1.1.12-k3s1",children:"v1.1.12-k3s1"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/flannel-io/flannel/releases/tag/v0.24.2",children:"v0.24.2"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.7.0",children:"v0.7.0"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/traefik/traefik/releases/tag/v2.10.5",children:"v2.10.5"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/coredns/coredns/releases/tag/v1.10.1",children:"v1.10.1"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/helm-controller/releases/tag/v0.15.9",children:"v0.15.9"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/rancher/local-path-provisioner/releases/tag/v0.0.26",children:"v0.0.26"})})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"/release-notes/v1.26.X#release-v12614k3s1",children:"v1.26.14+k3s1"})}),(0,i.jsx)(s.td,{children:"Feb 29 2024"}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.26.md#v12614",children:"v1.26.14"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/kine/releases/tag/v0.11.4",children:"v0.11.4"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://sqlite.org/releaselog/3_44_0.html",children:"3.44.0"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/etcd/releases/tag/v3.5.9-k3s1",children:"v3.5.9-k3s1"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/containerd/releases/tag/v1.7.11-k3s2.26",children:"v1.7.11-k3s2.26"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/runc/releases/tag/v1.1.12-k3s1",children:"v1.1.12-k3s1"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/flannel-io/flannel/releases/tag/v0.24.2",children:"v0.24.2"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.6.3",children:"v0.6.3"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/traefik/traefik/releases/tag/v2.10.5",children:"v2.10.5"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/coredns/coredns/releases/tag/v1.10.1",children:"v1.10.1"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/helm-controller/releases/tag/v0.15.8",children:"v0.15.8"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/rancher/local-path-provisioner/releases/tag/v0.0.26",children:"v0.0.26"})})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"/release-notes/v1.26.X#release-v12613k3s2",children:"v1.26.13+k3s2"})}),(0,i.jsx)(s.td,{children:"Feb 06 2024"}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.26.md#v12613",children:"v1.26.13"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/kine/releases/tag/v0.11.0",children:"v0.11.0"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://sqlite.org/releaselog/3_42_0.html",children:"3.42.0"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/etcd/releases/tag/v3.5.9-k3s1",children:"v3.5.9-k3s1"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/containerd/releases/tag/v1.7.11-k3s2.26",children:"v1.7.11-k3s2.26"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/opencontainers/runc/releases/tag/v1.1.12-k3s1",children:"v1.1.12-k3s1"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/flannel-io/flannel/releases/tag/v0.22.2",children:"v0.22.2"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.6.3",children:"v0.6.3"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/traefik/traefik/releases/tag/v2.10.5",children:"v2.10.5"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/coredns/coredns/releases/tag/v1.10.1",children:"v1.10.1"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/helm-controller/releases/tag/v0.15.8",children:"v0.15.8"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/rancher/local-path-provisioner/releases/tag/v0.0.24",children:"v0.0.24"})})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"/release-notes/v1.26.X#release-v12612k3s1",children:"v1.26.12+k3s1"})}),(0,i.jsx)(s.td,{children:"Dec 27 2023"}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.26.md#v12612",children:"v1.26.12"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/kine/releases/tag/v0.11.0",children:"v0.11.0"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://sqlite.org/releaselog/3_42_0.html",children:"3.42.0"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/etcd/releases/tag/v3.5.9-k3s1",children:"v3.5.9-k3s1"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/containerd/releases/tag/v1.7.11-k3s2.26",children:"v1.7.11-k3s2.26"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/opencontainers/runc/releases/tag/v1.1.10",children:"v1.1.10"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/flannel-io/flannel/releases/tag/v0.22.2",children:"v0.22.2"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.6.3",children:"v0.6.3"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/traefik/traefik/releases/tag/v2.10.5",children:"v2.10.5"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/coredns/coredns/releases/tag/v1.10.1",children:"v1.10.1"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/helm-controller/releases/tag/v0.15.4",children:"v0.15.4"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/rancher/local-path-provisioner/releases/tag/v0.0.24",children:"v0.0.24"})})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"/release-notes/v1.26.X#release-v12611k3s2",children:"v1.26.11+k3s2"})}),(0,i.jsx)(s.td,{children:"Dec 07 2023"}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.26.md#v12611",children:"v1.26.11"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/kine/releases/tag/v0.11.0",children:"v0.11.0"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://sqlite.org/releaselog/3_42_0.html",children:"3.42.0"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/etcd/releases/tag/v3.5.9-k3s1",children:"v3.5.9-k3s1"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/containerd/releases/tag/v1.7.7-k3s1.26",children:"v1.7.7-k3s1.26"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/opencontainers/runc/releases/tag/v1.1.8",children:"v1.1.8"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/flannel-io/flannel/releases/tag/v0.22.2",children:"v0.22.2"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.6.3",children:"v0.6.3"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/traefik/traefik/releases/tag/v2.10.5",children:"v2.10.5"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/coredns/coredns/releases/tag/v1.10.1",children:"v1.10.1"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/helm-controller/releases/tag/v0.15.4",children:"v0.15.4"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/rancher/local-path-provisioner/releases/tag/v0.0.24",children:"v0.0.24"})})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"/release-notes/v1.26.X#release-v12610k3s2",children:"v1.26.10+k3s2"})}),(0,i.jsx)(s.td,{children:"Nov 08 2023"}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.26.md#v12610",children:"v1.26.10"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/kine/releases/tag/v0.10.3",children:"v0.10.3"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://sqlite.org/releaselog/3_42_0.html",children:"3.42.0"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/etcd/releases/tag/v3.5.9-k3s1",children:"v3.5.9-k3s1"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/containerd/releases/tag/v1.7.7-k3s1.26",children:"v1.7.7-k3s1.26"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/opencontainers/runc/releases/tag/v1.1.8",children:"v1.1.8"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/flannel-io/flannel/releases/tag/v0.22.2",children:"v0.22.2"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.6.3",children:"v0.6.3"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/traefik/traefik/releases/tag/v2.10.5",children:"v2.10.5"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/coredns/coredns/releases/tag/v1.10.1",children:"v1.10.1"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/helm-controller/releases/tag/v0.15.4",children:"v0.15.4"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/rancher/local-path-provisioner/releases/tag/v0.0.24",children:"v0.0.24"})})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"/release-notes/v1.26.X#release-v12610k3s1",children:"v1.26.10+k3s1"})}),(0,i.jsx)(s.td,{children:"Oct 30 2023"}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.26.md#v12610",children:"v1.26.10"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/kine/releases/tag/v0.10.3",children:"v0.10.3"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://sqlite.org/releaselog/3_42_0.html",children:"3.42.0"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/etcd/releases/tag/v3.5.9-k3s1",children:"v3.5.9-k3s1"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/containerd/releases/tag/v1.7.7-k3s1.26",children:"v1.7.7-k3s1.26"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/opencontainers/runc/releases/tag/v1.1.8",children:"v1.1.8"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/flannel-io/flannel/releases/tag/v0.22.2",children:"v0.22.2"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.6.3",children:"v0.6.3"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/traefik/traefik/releases/tag/v2.10.5",children:"v2.10.5"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/coredns/coredns/releases/tag/v1.10.1",children:"v1.10.1"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/helm-controller/releases/tag/v0.15.4",children:"v0.15.4"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/rancher/local-path-provisioner/releases/tag/v0.0.24",children:"v0.0.24"})})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"/release-notes/v1.26.X#release-v1269k3s1",children:"v1.26.9+k3s1"})}),(0,i.jsx)(s.td,{children:"Sep 20 2023"}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.26.md#v1269",children:"v1.26.9"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/kine/releases/tag/v0.10.3",children:"v0.10.3"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://sqlite.org/releaselog/3_42_0.html",children:"3.42.0"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/etcd/releases/tag/v3.5.9-k3s1",children:"v3.5.9-k3s1"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/containerd/releases/tag/v1.7.6-k3s1.26",children:"v1.7.6-k3s1.26"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/opencontainers/runc/releases/tag/v1.1.8",children:"v1.1.8"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/flannel-io/flannel/releases/tag/v0.22.2",children:"v0.22.2"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.6.3",children:"v0.6.3"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/traefik/traefik/releases/tag/v2.9.10",children:"v2.9.10"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/coredns/coredns/releases/tag/v1.10.1",children:"v1.10.1"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/helm-controller/releases/tag/v0.15.4",children:"v0.15.4"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/rancher/local-path-provisioner/releases/tag/v0.0.24",children:"v0.0.24"})})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"/release-notes/v1.26.X#release-v1268k3s1",children:"v1.26.8+k3s1"})}),(0,i.jsx)(s.td,{children:"Sep 05 2023"}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.26.md#v1268",children:"v1.26.8"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/kine/releases/tag/v0.10.2",children:"v0.10.2"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://sqlite.org/releaselog/3_42_0.html",children:"3.42.0"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/etcd/releases/tag/v3.5.9-k3s1",children:"v3.5.9-k3s1"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/containerd/releases/tag/v1.7.3-k3s1",children:"v1.7.3-k3s1"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/opencontainers/runc/releases/tag/v1.1.8",children:"v1.1.8"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/flannel-io/flannel/releases/tag/v0.22.2",children:"v0.22.2"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.6.3",children:"v0.6.3"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/traefik/traefik/releases/tag/v2.9.10",children:"v2.9.10"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/coredns/coredns/releases/tag/v1.10.1",children:"v1.10.1"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/helm-controller/releases/tag/v0.15.4",children:"v0.15.4"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/rancher/local-path-provisioner/releases/tag/v0.0.24",children:"v0.0.24"})})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"/release-notes/v1.26.X#release-v1267k3s1",children:"v1.26.7+k3s1"})}),(0,i.jsx)(s.td,{children:"Jul 27 2023"}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.26.md#v1267",children:"v1.26.7"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/kine/releases/tag/v0.10.1",children:"v0.10.1"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://sqlite.org/releaselog/3_39_2.html",children:"3.39.2"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/etcd/releases/tag/v3.5.7-k3s1",children:"v3.5.7-k3s1"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/containerd/releases/tag/v1.7.1-k3s1",children:"v1.7.1-k3s1"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/opencontainers/runc/releases/tag/v1.1.7",children:"v1.1.7"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/flannel-io/flannel/releases/tag/v0.22.0",children:"v0.22.0"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.6.3",children:"v0.6.3"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/traefik/traefik/releases/tag/v2.9.10",children:"v2.9.10"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/coredns/coredns/releases/tag/v1.10.1",children:"v1.10.1"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/helm-controller/releases/tag/v0.15.2",children:"v0.15.2"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/rancher/local-path-provisioner/releases/tag/v0.0.24",children:"v0.0.24"})})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"/release-notes/v1.26.X#release-v1266k3s1",children:"v1.26.6+k3s1"})}),(0,i.jsx)(s.td,{children:"Jun 26 2023"}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.26.md#v1266",children:"v1.26.6"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/kine/releases/tag/v0.10.1",children:"v0.10.1"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://sqlite.org/releaselog/3_39_2.html",children:"3.39.2"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/etcd/releases/tag/v3.5.7-k3s1",children:"v3.5.7-k3s1"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/containerd/releases/tag/v1.7.1-k3s1",children:"v1.7.1-k3s1"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/opencontainers/runc/releases/tag/v1.1.7",children:"v1.1.7"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/flannel-io/flannel/releases/tag/v0.22.0",children:"v0.22.0"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.6.3",children:"v0.6.3"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/traefik/traefik/releases/tag/v2.9.10",children:"v2.9.10"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/coredns/coredns/releases/tag/v1.10.1",children:"v1.10.1"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/helm-controller/releases/tag/v0.15.0",children:"v0.15.0"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/rancher/local-path-provisioner/releases/tag/v0.0.24",children:"v0.0.24"})})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"/release-notes/v1.26.X#release-v1265k3s1",children:"v1.26.5+k3s1"})}),(0,i.jsx)(s.td,{children:"May 26 2023"}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.26.md#v1265",children:"v1.26.5"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/kine/releases/tag/v0.10.1",children:"v0.10.1"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://sqlite.org/releaselog/3_39_2.html",children:"3.39.2"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/etcd/releases/tag/v3.5.7-k3s1",children:"v3.5.7-k3s1"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/containerd/releases/tag/v1.7.1-k3s1",children:"v1.7.1-k3s1"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/opencontainers/runc/releases/tag/v1.1.7",children:"v1.1.7"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/flannel-io/flannel/releases/tag/v0.21.4",children:"v0.21.4"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.6.2",children:"v0.6.2"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/traefik/traefik/releases/tag/v2.9.10",children:"v2.9.10"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/coredns/coredns/releases/tag/v1.10.1",children:"v1.10.1"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/helm-controller/releases/tag/v0.14.0",children:"v0.14.0"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/rancher/local-path-provisioner/releases/tag/v0.0.24",children:"v0.0.24"})})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"/release-notes/v1.26.X#release-v1264k3s1",children:"v1.26.4+k3s1"})}),(0,i.jsx)(s.td,{children:"Apr 20 2023"}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.26.md#v1264",children:"v1.26.4"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/kine/releases/tag/v0.9.9",children:"v0.9.9"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://sqlite.org/releaselog/3_39_2.html",children:"3.39.2"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/etcd/releases/tag/v3.5.7-k3s1",children:"v3.5.7-k3s1"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/containerd/releases/tag/v1.6.19-k3s1",children:"v1.6.19-k3s1"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/opencontainers/runc/releases/tag/v1.1.5",children:"v1.1.5"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/flannel-io/flannel/releases/tag/v0.21.4",children:"v0.21.4"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.6.2",children:"v0.6.2"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/traefik/traefik/releases/tag/v2.9.4",children:"v2.9.4"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/coredns/coredns/releases/tag/v1.10.1",children:"v1.10.1"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/helm-controller/releases/tag/v0.13.3",children:"v0.13.3"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/rancher/local-path-provisioner/releases/tag/v0.0.24",children:"v0.0.24"})})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"/release-notes/v1.26.X#release-v1263k3s1",children:"v1.26.3+k3s1"})}),(0,i.jsx)(s.td,{children:"Mar 27 2023"}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.26.md#v1263",children:"v1.26.3"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/kine/releases/tag/v0.9.9",children:"v0.9.9"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://sqlite.org/releaselog/3_39_2.html",children:"3.39.2"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/etcd/releases/tag/v3.5.5-k3s1",children:"v3.5.5-k3s1"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/containerd/releases/tag/v1.6.19-k3s1",children:"v1.6.19-k3s1"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/opencontainers/runc/releases/tag/v1.1.4",children:"v1.1.4"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/flannel-io/flannel/releases/tag/v0.21.4",children:"v0.21.4"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.6.2",children:"v0.6.2"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/traefik/traefik/releases/tag/v2.9.4",children:"v2.9.4"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/coredns/coredns/releases/tag/v1.9.4",children:"v1.9.4"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/helm-controller/releases/tag/v0.13.1",children:"v0.13.1"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/rancher/local-path-provisioner/releases/tag/v0.0.23",children:"v0.0.23"})})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"/release-notes/v1.26.X#release-v1262k3s1",children:"v1.26.2+k3s1"})}),(0,i.jsx)(s.td,{children:"Mar 10 2023"}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.26.md#v1262",children:"v1.26.2"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/kine/releases/tag/v0.9.9",children:"v0.9.9"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://sqlite.org/releaselog/3_39_2.html",children:"3.39.2"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/etcd/releases/tag/v3.5.5-k3s1",children:"v3.5.5-k3s1"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/containerd/releases/tag/v1.6.15-k3s1",children:"v1.6.15-k3s1"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/opencontainers/runc/releases/tag/v1.1.4",children:"v1.1.4"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/flannel-io/flannel/releases/tag/v0.21.1",children:"v0.21.1"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.6.2",children:"v0.6.2"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/traefik/traefik/releases/tag/v2.9.4",children:"v2.9.4"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/coredns/coredns/releases/tag/v1.9.4",children:"v1.9.4"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/helm-controller/releases/tag/v0.13.1",children:"v0.13.1"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/rancher/local-path-provisioner/releases/tag/v0.0.23",children:"v0.0.23"})})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"/release-notes/v1.26.X#release-v1261k3s1",children:"v1.26.1+k3s1"})}),(0,i.jsx)(s.td,{children:"Jan 26 2023"}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.26.md#v1261",children:"v1.26.1"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/kine/releases/tag/v0.9.8",children:"v0.9.8"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://sqlite.org/releaselog/3_39_2.html",children:"3.39.2"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/etcd/releases/tag/v3.5.5-k3s1",children:"v3.5.5-k3s1"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/containerd/releases/tag/v1.6.15-k3s1",children:"v1.6.15-k3s1"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/opencontainers/runc/releases/tag/v1.1.4",children:"v1.1.4"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/flannel-io/flannel/releases/tag/v0.20.2",children:"v0.20.2"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.6.2",children:"v0.6.2"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/traefik/traefik/releases/tag/v2.9.4",children:"v2.9.4"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/coredns/coredns/releases/tag/v1.9.4",children:"v1.9.4"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/helm-controller/releases/tag/v0.13.1",children:"v0.13.1"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/rancher/local-path-provisioner/releases/tag/v0.0.23",children:"v0.0.23"})})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"/release-notes/v1.26.X#release-v1260k3s2",children:"v1.26.0+k3s2"})}),(0,i.jsx)(s.td,{children:"Jan 11 2023"}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.26.md#v1260",children:"v1.26.0"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/kine/releases/tag/v0.9.8",children:"v0.9.8"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://sqlite.org/releaselog/3_39_2.html",children:"3.39.2"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/etcd/releases/tag/v3.5.5-k3s1",children:"v3.5.5-k3s1"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/containerd/releases/tag/v1.6.14-k3s1",children:"v1.6.14-k3s1"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/opencontainers/runc/releases/tag/v1.1.4",children:"v1.1.4"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/flannel-io/flannel/releases/tag/v0.20.2",children:"v0.20.2"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.6.2",children:"v0.6.2"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/traefik/traefik/releases/tag/v2.9.4",children:"v2.9.4"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/coredns/coredns/releases/tag/v1.9.4",children:"v1.9.4"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/helm-controller/releases/tag/v0.13.1",children:"v0.13.1"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/rancher/local-path-provisioner/releases/tag/v0.0.23",children:"v0.0.23"})})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"/release-notes/v1.26.X#release-v1260k3s1",children:"v1.26.0+k3s1"})}),(0,i.jsx)(s.td,{children:"Dec 21 2022"}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.26.md#v1260",children:"v1.26.0"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/kine/releases/tag/v0.9.8",children:"v0.9.8"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://sqlite.org/releaselog/3_39_2.html",children:"3.39.2"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/etcd/releases/tag/v3.5.5-k3s1",children:"v3.5.5-k3s1"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/containerd/releases/tag/v1.6.12-k3s1",children:"v1.6.12-k3s1"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/opencontainers/runc/releases/tag/v1.1.4",children:"v1.1.4"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/flannel-io/flannel/releases/tag/v0.20.2",children:"v0.20.2"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.6.2",children:"v0.6.2"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/traefik/traefik/releases/tag/v2.9.4",children:"v2.9.4"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/coredns/coredns/releases/tag/v1.9.4",children:"v1.9.4"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/helm-controller/releases/tag/v0.13.1",children:"v0.13.1"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/rancher/local-path-provisioner/releases/tag/v0.0.23",children:"v0.0.23"})})]})]})]}),"\n",(0,i.jsx)("br",{}),"\n",(0,i.jsxs)(s.h2,{id:"release-v12615k3s1",children:["Release ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/releases/tag/v1.26.15+k3s1",children:"v1.26.15+k3s1"})]}),"\n",(0,i.jsx)(s.p,{children:"This release updates Kubernetes to v1.26.15, and fixes a number of issues."}),"\n",(0,i.jsxs)(s.p,{children:["For more details on what's new, see the ",(0,i.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.26.md#changelog-since-v12614",children:"Kubernetes release notes"}),"."]}),"\n",(0,i.jsx)(s.h3,{id:"changes-since-v12614k3s1",children:"Changes since v1.26.14+k3s1:"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsxs)(s.li,{children:["Update klipper-lb image version ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9607",children:"(#9607)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Install and Unit test backports ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9645",children:"(#9645)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Adjust first node-ip based on configured clusterCIDR ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9633",children:"(#9633)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Add an integration test for flannel-backend=none ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9610",children:"(#9610)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Improve tailscale e2e test ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9655",children:"(#9655)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Backports for 2024-03 release cycle ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9692",children:"(#9692)"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsx)(s.li,{children:"Fix: use correct wasm shims names"}),"\n",(0,i.jsx)(s.li,{children:"The embedded flannel cni-plugin binary is now built and versioned separate from the rest of the cni plugins and the embedded flannel controller."}),"\n",(0,i.jsx)(s.li,{children:"Bump spegel to v0.0.18-k3s3"}),"\n",(0,i.jsx)(s.li,{children:"Adds wildcard registry support"}),"\n",(0,i.jsx)(s.li,{children:"Fixes issue with excessive CPU utilization while waiting for containerd to start"}),"\n",(0,i.jsx)(s.li,{children:"Add env var to allow spegel mirroring of latest tag"}),"\n",(0,i.jsx)(s.li,{children:"Tweak netpol node wait logs"}),"\n",(0,i.jsx)(s.li,{children:"Fix coredns NodeHosts on dual-stack clusters"}),"\n",(0,i.jsx)(s.li,{children:"Bump helm-controller/klipper-helm versions"}),"\n",(0,i.jsx)(s.li,{children:"Fix snapshot prune"}),"\n",(0,i.jsx)(s.li,{children:"Fix issue with etcd node name missing hostname"}),"\n",(0,i.jsx)(s.li,{children:"Rootless mode should also bind service nodePort to host for LoadBalancer type, matching UX of rootful mode."}),"\n",(0,i.jsxs)(s.li,{children:["To enable raw output for the ",(0,i.jsx)(s.code,{children:"check-config"})," subcommand, you may now set NO_COLOR=1"]}),"\n",(0,i.jsx)(s.li,{children:"Fix additional corner cases in registries handling"}),"\n",(0,i.jsx)(s.li,{children:"Bump metrics-server to v0.7.0"}),"\n",(0,i.jsx)(s.li,{children:"K3s will now warn and suppress duplicate entries in the mirror endpoint list for a registry. Containerd does not support listing the same endpoint multiple times as a mirror for a single upstream registry."}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(s.li,{children:["Fix wildcard entry upstream fallback ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9735",children:"(#9735)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Update to v1.26.15-k3s1 and Go 1.21.8 ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9740",children:"(#9740)"})]}),"\n"]}),"\n",(0,i.jsx)(s.hr,{}),"\n",(0,i.jsxs)(s.h2,{id:"release-v12614k3s1",children:["Release ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/releases/tag/v1.26.14+k3s1",children:"v1.26.14+k3s1"})]}),"\n",(0,i.jsx)(s.p,{children:"This release updates Kubernetes to v1.26.14, and fixes a number of issues."}),"\n",(0,i.jsxs)(s.p,{children:["For more details on what's new, see the ",(0,i.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.26.md#changelog-since-v12613",children:"Kubernetes release notes"}),"."]}),"\n",(0,i.jsx)(s.h3,{id:"changes-since-v12613k3s2",children:"Changes since v1.26.13+k3s2:"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsxs)(s.li,{children:["Chore: bump Local Path Provisioner version ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9428",children:"(#9428)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Bump cri-dockerd to fix compat with Docker Engine 25 ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9292",children:"(#9292)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Auto Dependency Bump ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9421",children:"(#9421)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Runtimes refactor using exec.LookPath ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9429",children:"(#9429)"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsx)(s.li,{children:"Directories containing runtimes need to be included in the $PATH environment variable for effective runtime detection."}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(s.li,{children:["Changed how lastHeartBeatTime works in the etcd condition ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9423",children:"(#9423)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Allow executors to define containerd and docker behavior ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9252",children:"(#9252)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Update Kube-router to v2.0.1 ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9406",children:"(#9406)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Backports for 2024-02 release cycle ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9464",children:"(#9464)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Bump flannel version + remove multiclustercidr ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9409",children:"(#9409)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Enable longer http timeout requests ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9446",children:"(#9446)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Test_UnitApplyContainerdQoSClassConfigFileIfPresent ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9442",children:"(#9442)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Support PR testing installs ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9471",children:"(#9471)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Update Kubernetes to v1.26.14 ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9490",children:"(#9490)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Fix drone publish for arm ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9510",children:"(#9510)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Remove failing Drone step ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9514",children:"(#9514)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Restore original order of agent startup functions ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9547",children:"(#9547)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Fix netpol startup when flannel is disabled ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9580",children:"(#9580)"})]}),"\n"]}),"\n",(0,i.jsx)(s.hr,{}),"\n",(0,i.jsxs)(s.h2,{id:"release-v12613k3s2",children:["Release ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/releases/tag/v1.26.13+k3s2",children:"v1.26.13+k3s2"})]}),"\n",(0,i.jsx)(s.p,{children:"This release updates Kubernetes to v1.26.13, and fixes a number of issues."}),"\n",(0,i.jsxs)(s.p,{children:["For more details on what's new, see the ",(0,i.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.26.md#changelog-since-v12612",children:"Kubernetes release notes"}),"."]}),"\n",(0,i.jsx)(s.p,{children:(0,i.jsx)(s.strong,{children:"Important Notes"})}),"\n",(0,i.jsxs)(s.p,{children:["Addresses the runc CVE: ",(0,i.jsx)(s.a,{href:"https://nvd.nist.gov/vuln/detail/CVE-2024-21626",children:"CVE-2024-21626"})," by updating runc to v1.1.12."]}),"\n",(0,i.jsx)(s.h3,{id:"changes-since-v12612k3s1",children:"Changes since v1.26.12+k3s1:"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsxs)(s.li,{children:["Add a retry around updating a secrets-encrypt node annotations ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9123",children:"(#9123)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Added support for env *_PROXY variables for agent loadbalancer ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9116",children:"(#9116)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Wait for taint to be gone in the node before starting the netpol controller ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9177",children:"(#9177)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Etcd condition ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9183",children:"(#9183)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Backports for 2024-01 ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9212",children:"(#9212)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Move proxy dialer out of init() and fix crash ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9221",children:"(#9221)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Pin opa version for missing dependency chain ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9218",children:"(#9218)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Etcd node is nil ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9230",children:"(#9230)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Update to v1.26.13 and Go 1.20.13 ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9262",children:"(#9262)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Use ",(0,i.jsx)(s.code,{children:"ipFamilyPolicy: RequireDualStack"})," for dual-stack kube-dns ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9271",children:"(#9271)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Backports for 2024-01 k3s2 ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9338",children:"(#9338)"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsx)(s.li,{children:"Bump runc to v1.1.12 and helm-controller to v0.15.7"}),"\n",(0,i.jsx)(s.li,{children:"Fix handling of bare hostname or IP as endpoint address in registries.yaml"}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(s.li,{children:["Bump helm-controller to fix issue with ChartContent ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9348",children:"(#9348)"})]}),"\n"]}),"\n",(0,i.jsx)(s.hr,{}),"\n",(0,i.jsxs)(s.h2,{id:"release-v12612k3s1",children:["Release ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/releases/tag/v1.26.12+k3s1",children:"v1.26.12+k3s1"})]}),"\n",(0,i.jsx)(s.p,{children:"This release updates Kubernetes to v1.26.12, and fixes a number of issues."}),"\n",(0,i.jsxs)(s.p,{children:["For more details on what's new, see the ",(0,i.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.26.md#changelog-since-v12611",children:"Kubernetes release notes"}),"."]}),"\n",(0,i.jsx)(s.h3,{id:"changes-since-v12611k3s2",children:"Changes since v1.26.11+k3s2:"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsxs)(s.li,{children:["Runtimes backport ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9014",children:"(#9014)"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsx)(s.li,{children:"Added runtime classes for wasm/nvidia/crun"}),"\n",(0,i.jsx)(s.li,{children:"Added default runtime flag for containerd"}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(s.li,{children:["Bump containerd/runc to v1.7.10-k3s1/v1.1.10 ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8964",children:"(#8964)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Fix overlapping address range ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9019",children:"(#9019)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Allow setting default-runtime on servers ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9028",children:"(#9028)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Bump containerd to v1.7.11 ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9042",children:"(#9042)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Update to v1.26.12-k3s1 ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9077",children:"(#9077)"})]}),"\n"]}),"\n",(0,i.jsx)(s.hr,{}),"\n",(0,i.jsxs)(s.h2,{id:"release-v12611k3s2",children:["Release ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/releases/tag/v1.26.11+k3s2",children:"v1.26.11+k3s2"})]}),"\n",(0,i.jsx)(s.p,{children:"This release updates Kubernetes to v1.26.11, and fixes a number of issues."}),"\n",(0,i.jsxs)(s.p,{children:["For more details on what's new, see the ",(0,i.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.26.md#changelog-since-v12610",children:"Kubernetes release notes"}),"."]}),"\n",(0,i.jsx)(s.h3,{id:"changes-since-v12610k3s2",children:"Changes since v1.26.10+k3s2:"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsxs)(s.li,{children:["Etcd status condition ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8820",children:"(#8820)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Backports for 2023-11 release ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8879",children:"(#8879)"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsxs)(s.li,{children:["New timezone info in Docker image allows the use of ",(0,i.jsx)(s.code,{children:"spec.timeZone"})," in CronJobs"]}),"\n",(0,i.jsx)(s.li,{children:"Bumped kine to v0.11.0 to resolve issues with postgres and NATS, fix performance of watch channels under heavy load, and improve compatibility with the reference implementation."}),"\n",(0,i.jsxs)(s.li,{children:["Containerd may now be configured to use rdt or blockio configuration by defining ",(0,i.jsx)(s.code,{children:"rdt_config.yaml"})," or ",(0,i.jsx)(s.code,{children:"blockio_config.yaml"})," files."]}),"\n",(0,i.jsx)(s.li,{children:"Add agent flag disable-apiserver-lb, agent will not start load balance proxy."}),"\n",(0,i.jsx)(s.li,{children:"Improved ingress IP ordering from ServiceLB"}),"\n",(0,i.jsx)(s.li,{children:"Disable helm CRD installation for disable-helm-controller"}),"\n",(0,i.jsx)(s.li,{children:"Omit snapshot list configmap entries for snapshots without extra metadata"}),"\n",(0,i.jsx)(s.li,{children:"Add jitter to client config retry to avoid hammering servers when they are starting up"}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(s.li,{children:["Add warning for removal of multiclustercidr flag ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8760",children:"(#8760)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Handle nil pointer when runtime core is not ready in etcd ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8888",children:"(#8888)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Improve dualStack log ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8829",children:"(#8829)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Bump dynamiclistener; reduce snapshot controller log spew ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8903",children:"(#8903)"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsx)(s.li,{children:"Bumped dynamiclistener to address a race condition that could cause a server to fail to sync its certificates into the Kubernetes secret"}),"\n",(0,i.jsx)(s.li,{children:"Reduced etcd snapshot log spam during initial cluster startup"}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(s.li,{children:["Fix etcd snapshot S3 issues ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8938",children:"(#8938)"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsx)(s.li,{children:"Don't apply S3 retention if S3 client failed to initialize"}),"\n",(0,i.jsx)(s.li,{children:"Don't request metadata when listing S3 snapshots"}),"\n",(0,i.jsx)(s.li,{children:"Print key instead of file path in snapshot metadata log message"}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(s.li,{children:["Update to v1.26.11 and Go to 1.20.11 ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8922",children:"(#8922)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Remove s390x ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9000",children:"(#9000)"})]}),"\n"]}),"\n",(0,i.jsx)(s.hr,{}),"\n",(0,i.jsxs)(s.h2,{id:"release-v12610k3s2",children:["Release ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/releases/tag/v1.26.10+k3s2",children:"v1.26.10+k3s2"})]}),"\n",(0,i.jsx)(s.p,{children:"This release updates Kubernetes to v1.26.10, and fixes a number of issues."}),"\n",(0,i.jsxs)(s.p,{children:["For more details on what's new, see the ",(0,i.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.26.md#changelog-since-v12610",children:"Kubernetes release notes"}),"."]}),"\n",(0,i.jsx)(s.h3,{id:"changes-since-v12610k3s1",children:"Changes since v1.26.10+k3s1:"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsxs)(s.li,{children:["Fix SystemdCgroup in templates_linux.go ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8766",children:"(#8766)"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsx)(s.li,{children:"Fixed an issue with identifying additional container runtimes"}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(s.li,{children:["Update traefik chart to v25.0.0 ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8776",children:"(#8776)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Update traefik to fix registry value ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8790",children:"(#8790)"})]}),"\n"]}),"\n",(0,i.jsx)(s.hr,{}),"\n",(0,i.jsxs)(s.h2,{id:"release-v12610k3s1",children:["Release ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/releases/tag/v1.26.10+k3s1",children:"v1.26.10+k3s1"})]}),"\n",(0,i.jsx)(s.p,{children:"This release updates Kubernetes to v1.26.10, and fixes a number of issues."}),"\n",(0,i.jsxs)(s.p,{children:["For more details on what's new, see the ",(0,i.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.26.md#changelog-since-v1269",children:"Kubernetes release notes"}),"."]}),"\n",(0,i.jsx)(s.h3,{id:"changes-since-v1269k3s1",children:"Changes since v1.26.9+k3s1:"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsxs)(s.li,{children:["Fix error reporting ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8412",children:"(#8412)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Add context to flannel errors ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8420",children:"(#8420)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Testing Backports for September ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8300",children:"(#8300)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Include the interface name in the error message ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8436",children:"(#8436)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Update kube-router ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8444",children:"(#8444)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Add extraArgs to tailscale ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8465",children:"(#8465)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Added error when cluster reset while using server flag ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8456",children:"(#8456)"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsx)(s.li,{children:"The user will receive a error when --cluster-reset with the --server flag"}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(s.li,{children:["Cluster reset from non bootstrap nodes ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8453",children:"(#8453)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Fix spellcheck problem ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8510",children:"(#8510)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Take IPFamily precedence based on order ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8505",children:"(#8505)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Network defaults are duplicated, remove one ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8552",children:"(#8552)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Advertise address integration test ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8517",children:"(#8517)"})]}),"\n",(0,i.jsxs)(s.li,{children:["System agent push tags fix ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8570",children:"(#8570)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Fixed tailscale node IP dualstack mode in case of IPv4 only node ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8559",children:"(#8559)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Server Token Rotation ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8577",children:"(#8577)"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsxs)(s.li,{children:["Users can now rotate the server token using ",(0,i.jsx)(s.code,{children:"k3s token rotate -t --new-token "}),". After command succeeds, all server nodes must be restarted with the new token."]}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(s.li,{children:["Clear remove annotations on cluster reset ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8590",children:"(#8590)"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsx)(s.li,{children:"Fixed an issue that could cause k3s to attempt to remove members from the etcd cluster immediately following a cluster-reset/restore, if they were queued for removal at the time the snapshot was taken."}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(s.li,{children:["Use IPv6 in case is the first configured IP with dualstack ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8598",children:"(#8598)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Backports for 2023-10 release ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8616",children:"(#8616)"})]}),"\n",(0,i.jsxs)(s.li,{children:["E2E Domain Drone Cleanup ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8583",children:"(#8583)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Update kube-router package in build script ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8635",children:"(#8635)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Add etcd-only/control-plane-only server test and fix control-plane-only server crash ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8643",children:"(#8643)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Use ",(0,i.jsx)(s.code,{children:"version.Program"})," not K3s in token rotate logs ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8655",children:"(#8655)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Windows agent support ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8647",children:"(#8647)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Add --image-service-endpoint flag (#8279) ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8663",children:"(#8663)"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsxs)(s.li,{children:["Add ",(0,i.jsx)(s.code,{children:"--image-service-endpoint"})," flag to specify an external image service socket."]}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(s.li,{children:["Backport etcd fixes ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8691",children:"(#8691)"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsx)(s.li,{children:"Re-enable etcd endpoint auto-sync"}),"\n",(0,i.jsx)(s.li,{children:"Manually requeue configmap reconcile when no nodes have reconciled snapshots"}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(s.li,{children:["Update to v1.26.10 and Go to v1.20.10 ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8680",children:"(#8680)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Fix s3 snapshot restore ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8734",children:"(#8734)"})]}),"\n"]}),"\n",(0,i.jsx)(s.hr,{}),"\n",(0,i.jsxs)(s.h2,{id:"release-v1269k3s1",children:["Release ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/releases/tag/v1.26.9+k3s1",children:"v1.26.9+k3s1"})]}),"\n",(0,i.jsx)(s.p,{children:"This release updates Kubernetes to v1.26.9, and fixes a number of issues."}),"\n",(0,i.jsxs)(s.p,{children:["For more details on what's new, see the ",(0,i.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.26.md#changelog-since-v1268",children:"Kubernetes release notes"}),"."]}),"\n",(0,i.jsx)(s.h3,{id:"changes-since-v1268k3s1",children:"Changes since v1.26.8+k3s1:"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsxs)(s.li,{children:["Bump kine to v0.10.3 ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8325",children:"(#8325)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Update to v1.26.9 and go to v1.20.8 ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8357",children:"(#8357)"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsx)(s.li,{children:"Bump embedded containerd to v1.7.6"}),"\n",(0,i.jsx)(s.li,{children:"Bump embedded stargz-snapshotter plugin to latest"}),"\n",(0,i.jsx)(s.li,{children:"Fixed intermittent drone CI failures due to race conditions in test environment setup scripts"}),"\n",(0,i.jsx)(s.li,{children:"Fixed CI failures due to changes to api discovery changes in Kubernetes 1.28"}),"\n"]}),"\n"]}),"\n"]}),"\n",(0,i.jsx)(s.hr,{}),"\n",(0,i.jsxs)(s.h2,{id:"release-v1268k3s1",children:["Release ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/releases/tag/v1.26.8+k3s1",children:"v1.26.8+k3s1"})]}),"\n",(0,i.jsx)(s.p,{children:"This release updates Kubernetes to v1.26.8, and fixes a number of issues."}),"\n",(0,i.jsx)(s.admonition,{title:"Important",type:"warning",children:(0,i.jsxs)(s.p,{children:["This release includes support for remediating CVE-2023-32187, a potential Denial of Service attack vector on K3s servers. See ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/security/advisories/GHSA-m4hf-6vgr-75r2",children:"https://github.com/k3s-io/k3s/security/advisories/GHSA-m4hf-6vgr-75r2"})," for more information, including mandatory steps necessary to harden clusters against this vulnerability."]})}),"\n",(0,i.jsxs)(s.p,{children:["For more details on what's new, see the ",(0,i.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.26.md#changelog-since-v1267",children:"Kubernetes release notes"}),"."]}),"\n",(0,i.jsx)(s.h3,{id:"changes-since-v1267k3s1",children:"Changes since v1.26.7+k3s1:"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsxs)(s.li,{children:["Update flannel and plugins ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8075",children:"(#8075)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Fix tailscale bug with ip modes ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8097",children:"(#8097)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Etcd snapshots retention when node name changes ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8122",children:"(#8122)"})]}),"\n",(0,i.jsxs)(s.li,{children:["August Test Backports ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8126",children:"(#8126)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Backports for 2023-08 release ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8129",children:"(#8129)"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsx)(s.li,{children:"K3s's external apiserver listener now declines to add to its certificate any subject names not associated with the kubernetes apiserver service, server nodes, or values of the --tls-san option. This prevents the certificate's SAN list from being filled with unwanted entries."}),"\n",(0,i.jsxs)(s.li,{children:["K3s no longer enables the apiserver's ",(0,i.jsx)(s.code,{children:"enable-aggregator-routing"})," flag when the egress proxy is not being used to route connections to in-cluster endpoints."]}),"\n",(0,i.jsx)(s.li,{children:"Updated the embedded containerd to v1.7.3+k3s1"}),"\n",(0,i.jsx)(s.li,{children:"Updated the embedded runc to v1.1.8"}),"\n",(0,i.jsx)(s.li,{children:"Updated the embedded etcd to v3.5.9+k3s1"}),"\n",(0,i.jsxs)(s.li,{children:["User-provided containerd config templates may now use ",(0,i.jsx)(s.code,{children:'{{ template "base" . }}'})," to include the default K3s template content. This makes it easier to maintain user configuration if the only need is to add additional sections to the file."]}),"\n",(0,i.jsx)(s.li,{children:"Bump docker/docker module version to fix issues with cri-dockerd caused by recent releases of golang rejecting invalid host headers sent by the docker client."}),"\n",(0,i.jsx)(s.li,{children:"Updated kine to v0.10.2"}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(s.li,{children:["\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsxs)(s.li,{children:["K3s etcd-snapshot delete fail to delete local file when called with s3 flag ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8144",children:"(#8144)"})]}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(s.li,{children:["\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsxs)(s.li,{children:["Fix for cluster-reset backup from s3 when etcd snapshots are disabled ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8170",children:"(#8170)"})]}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(s.li,{children:["Fixed the etcd retention to delete orphaned snapshots based on the date ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8189",children:"(#8189)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Additional backports for 2023-08 release ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8212",children:"(#8212)"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsxs)(s.li,{children:["The version of ",(0,i.jsx)(s.code,{children:"helm"})," used by the bundled helm controller's job image has been updated to v3.12.3"]}),"\n",(0,i.jsx)(s.li,{children:"Bumped dynamiclistener to address an issue that could cause the apiserver/supervisor listener on 6443 to stop serving requests on etcd-only nodes."}),"\n",(0,i.jsx)(s.li,{children:"The K3s external apiserver/supervisor listener on 6443 now sends a complete certificate chain in the TLS handshake."}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(s.li,{children:["Move flannel to 0.22.2 ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8222",children:"(#8222)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Update to v1.26.8 ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8235",children:"(#8235)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Add new CLI flag to enable TLS SAN CN filtering ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8258",children:"(#8258)"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsxs)(s.li,{children:["Added a new ",(0,i.jsx)(s.code,{children:"--tls-san-security"})," option. This flag defaults to false, but can be set to true to disable automatically adding SANs to the server's TLS certificate to satisfy any hostname requested by a client."]}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(s.li,{children:["Add RWMutex to address controller ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8274",children:"(#8274)"})]}),"\n"]}),"\n",(0,i.jsx)(s.hr,{}),"\n",(0,i.jsxs)(s.h2,{id:"release-v1267k3s1",children:["Release ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/releases/tag/v1.26.7+k3s1",children:"v1.26.7+k3s1"})]}),"\n",(0,i.jsxs)(s.p,{children:["This release updates Kubernetes to v1.26.7, and fixes a number of issues.\r\n\u200b\r\nFor more details on what's new, see the ",(0,i.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.26.md#changelog-since-v1266",children:"Kubernetes release notes"}),".\r\n\u200b"]}),"\n",(0,i.jsx)(s.h3,{id:"changes-since-v1266k3s1",children:"Changes since v1.26.6+k3s1:"}),"\n",(0,i.jsx)(s.p,{children:"\u200b"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsxs)(s.li,{children:["Remove file_windows.go ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7855",children:"(#7855)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Fix code spell check ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7859",children:"(#7859)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Allow k3s to customize apiServerPort on helm-controller ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7874",children:"(#7874)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Check if we are on ipv4, ipv6 or dualStack when doing tailscale ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7882",children:"(#7882)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Support setting control server URL for Tailscale. ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7893",children:"(#7893)"})]}),"\n",(0,i.jsxs)(s.li,{children:["S3 and Startup tests ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7885",children:"(#7885)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Fix rootless node password ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7901",children:"(#7901)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Backports for 2023-07 release ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7908",children:"(#7908)"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsx)(s.li,{children:"Resolved an issue that caused agents joined with kubeadm-style bootstrap tokens to fail to rejoin the cluster when their node object is deleted."}),"\n",(0,i.jsxs)(s.li,{children:["The ",(0,i.jsx)(s.code,{children:"k3s certificate rotate-ca"})," command now supports the data-dir flag."]}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(s.li,{children:["Adding cli to custom klipper helm image ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7914",children:"(#7914)"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsx)(s.li,{children:"The default helm-controller job image can now be overridden with the --helm-job-image CLI flag"}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(s.li,{children:["Generation of certs and keys for etcd gated if etcd is disabled ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7944",children:"(#7944)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Don't use zgrep in ",(0,i.jsx)(s.code,{children:"check-config"})," if apparmor profile is enforced ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7956",children:"(#7956)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Fix image_scan.sh script and download trivy version (#7950) ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7968",children:"(#7968)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Adjust default kubeconfig file permissions ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7983",children:"(#7983)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Update to v1.26.7 ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8022",children:"(#8022)"}),"\r\n\u200b"]}),"\n"]}),"\n",(0,i.jsx)(s.hr,{}),"\n",(0,i.jsxs)(s.h2,{id:"release-v1266k3s1",children:["Release ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/releases/tag/v1.26.6+k3s1",children:"v1.26.6+k3s1"})]}),"\n",(0,i.jsx)(s.p,{children:"This release updates Kubernetes to v1.26.6, and fixes a number of issues."}),"\n",(0,i.jsxs)(s.p,{children:["For more details on what's new, see the ",(0,i.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.26.md#changelog-since-v1265",children:"Kubernetes release notes"}),"."]}),"\n",(0,i.jsx)(s.h3,{id:"changes-since-v1265k3s1",children:"Changes since v1.26.5+k3s1:"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsxs)(s.li,{children:["Update flannel version ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7648",children:"(#7648)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Bump vagrant libvirt with fix for plugin installs ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7658",children:"(#7658)"})]}),"\n",(0,i.jsxs)(s.li,{children:["E2E and Dep Backports - June ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7693",children:"(#7693)"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsx)(s.li,{children:"Bump docker go.mod #7681"}),"\n",(0,i.jsx)(s.li,{children:"Shortcircuit commands with version or help flags #7683"}),"\n",(0,i.jsx)(s.li,{children:"Add Rotation certification Check, remove func to restart agents #7097"}),"\n",(0,i.jsx)(s.li,{children:"E2E: Sudo for RunCmdOnNode #7686"}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(s.li,{children:["VPN integration ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7727",children:"(#7727)"})]}),"\n",(0,i.jsxs)(s.li,{children:["E2e: Private registry test ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7721",children:"(#7721)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Fix spelling check ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7751",children:"(#7751)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Remove unused libvirt config ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7757",children:"(#7757)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Backport version bumps and bugfixes ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7717",children:"(#7717)"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsx)(s.li,{children:"The bundled metrics-server has been bumped to v0.6.3, and now uses only secure TLS ciphers by default."}),"\n",(0,i.jsxs)(s.li,{children:["The ",(0,i.jsx)(s.code,{children:"coredns-custom"})," ConfigMap now allows for ",(0,i.jsx)(s.code,{children:"*.override"})," sections to be included in the ",(0,i.jsx)(s.code,{children:".:53"})," default server block."]}),"\n",(0,i.jsx)(s.li,{children:"The K3s core controllers (supervisor, deploy, and helm) no longer use the admin kubeconfig. This makes it easier to determine from access and audit logs which actions are performed by the system, and which are performed by an administrative user."}),"\n",(0,i.jsx)(s.li,{children:"Bumped klipper-lb image to v0.4.4 to resolve an issue that prevented access to ServiceLB ports from localhost when the Service ExternalTrafficPolicy was set to Local."}),"\n",(0,i.jsx)(s.li,{children:"Make LB image configurable when compiling k3s"}),"\n",(0,i.jsx)(s.li,{children:"K3s now allows nodes to join the cluster even if the node password secret cannot be created at the time the node joins. The secret create will be retried in the background. This resolves a potential deadlock created by fail-closed validating webhooks that block secret creation, where the webhook is unavailable until new nodes join the cluster to run the webhook pod."}),"\n",(0,i.jsx)(s.li,{children:"The bundled containerd's aufs/devmapper/zfs snapshotter plugins have been restored. These were unintentionally omitted when moving containerd back into the k3s multicall binary in the previous release."}),"\n",(0,i.jsx)(s.li,{children:"The embedded helm controller has been bumped to v0.15.0, and now supports creating the chart's target namespace if it does not exist."}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(s.li,{children:["Add format command on makefile ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7762",children:"(#7762)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Fix logging and cleanup in Tailscale ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7782",children:"(#7782)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Update Kubernetes to v1.26.6 ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7789",children:"(#7789)"})]}),"\n"]}),"\n",(0,i.jsx)(s.hr,{}),"\n",(0,i.jsxs)(s.h2,{id:"release-v1265k3s1",children:["Release ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/releases/tag/v1.26.5+k3s1",children:"v1.26.5+k3s1"})]}),"\n",(0,i.jsx)(s.p,{children:"This release updates Kubernetes to v1.26.5, and fixes a number of issues."}),"\n",(0,i.jsxs)(s.p,{children:["For more details on what's new, see the ",(0,i.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.26.md#changelog-since-v1264",children:"Kubernetes release notes"}),"."]}),"\n",(0,i.jsx)(s.h3,{id:"changes-since-v1264k3s1",children:"Changes since v1.26.4+k3s1:"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsxs)(s.li,{children:["Ensure that klog verbosity is set to the same level as logrus ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7360",children:"(#7360)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Prepend release branch to dependabot ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7374",children:"(#7374)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Add integration tests for etc-snapshot server flags ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7377",children:"(#7377)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Bump Runc and Containerd ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7399",children:"(#7399)"})]}),"\n",(0,i.jsxs)(s.li,{children:["CLI + Config Enhancement ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7403",children:"(#7403)"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsxs)(s.li,{children:[(0,i.jsx)(s.code,{children:"--Tls-sans"})," now accepts multiple arguments: ",(0,i.jsx)(s.code,{children:'--tls-sans="foo,bar"'})]}),"\n",(0,i.jsxs)(s.li,{children:[(0,i.jsx)(s.code,{children:"Prefer-bundled-bin: true"})," now works properly when set in ",(0,i.jsx)(s.code,{children:"config.yaml.d"})," files"]}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(s.li,{children:["Migrate netutil methods into /utils/net.go ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7432",children:"(#7432)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Bump kube-router version to fix a bug when a port name is used ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7460",children:"(#7460)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Kube flags and longhorn storage tests ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7465",children:"(#7465)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Local-storage: Fix permission ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7474",children:"(#7474)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Bump containerd to v1.7.0 and move back into multicall binary ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7444",children:"(#7444)"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsxs)(s.li,{children:["The embedded containerd version has been bumped to ",(0,i.jsx)(s.code,{children:"v1.7.0-k3s1"}),", and has been reintegrated into the main k3s binary for a significant savings in release artifact size."]}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(s.li,{children:["Backport version bumps and bugfixes ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7514",children:"(#7514)"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsx)(s.li,{children:'K3s now retries the cluster join operation when receiving a "too many learners" error from etcd. This most frequently occurred when attempting to add multiple servers at the same time.'}),"\n",(0,i.jsx)(s.li,{children:"K3s once again supports aarch64 nodes with page size > 4k"}),"\n",(0,i.jsx)(s.li,{children:"The packaged Traefik version has been bumped to v2.9.10 / chart 21.2.0"}),"\n",(0,i.jsxs)(s.li,{children:["K3s now prints a more meaningful error when attempting to run from a filesystem mounted ",(0,i.jsx)(s.code,{children:"noexec"}),"."]}),"\n",(0,i.jsxs)(s.li,{children:["K3s now exits with a proper error message when the server token uses a bootstrap token ",(0,i.jsx)(s.code,{children:"id.secret"})," format."]}),"\n",(0,i.jsx)(s.li,{children:"Fixed an issue where Addon, HelmChart, and HelmChartConfig CRDs were created without structural schema, allowing the creation of custom resources of these types with invalid content."}),"\n",(0,i.jsx)(s.li,{children:"Servers started with the (experimental) --disable-agent flag no longer attempt to run the tunnel authorizer agent component."}),"\n",(0,i.jsx)(s.li,{children:"Fixed an regression that prevented the pod and cluster egress-selector modes from working properly."}),"\n",(0,i.jsx)(s.li,{children:"K3s now correctly passes through etcd-args to the temporary etcd that is used to extract cluster bootstrap data when restarting managed etcd nodes."}),"\n",(0,i.jsx)(s.li,{children:"K3s now properly handles errors obtaining the current etcd cluster member list when a new server is joining the managed etcd cluster."}),"\n",(0,i.jsxs)(s.li,{children:["The embedded kine version has been bumped to v0.10.1. This replaces the legacy ",(0,i.jsx)(s.code,{children:"lib/pq"})," postgres driver with ",(0,i.jsx)(s.code,{children:"pgx"}),"."]}),"\n",(0,i.jsx)(s.li,{children:"The bundled CNI plugins have been upgraded to v1.2.0-k3s1. The bandwidth and firewall plugins are now included in the bundle."}),"\n",(0,i.jsx)(s.li,{children:"The embedded Helm controller now supports authenticating to chart repositories via credentials stored in a Secret, as well as passing repo CAs via ConfigMap."}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(s.li,{children:["Bump containerd/runc to v1.7.1-k3s1/v1.1.7 ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7534",children:"(#7534)"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsx)(s.li,{children:"The bundled containerd and runc versions have been bumped to v1.7.1-k3s1/v1.1.7"}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(s.li,{children:["Wrap error stating that it is coming from netpol ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7547",children:"(#7547)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Add '-all' flag to apply to inactive units ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7573",children:"(#7573)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Update to v1.26.5-k3s1 ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7576",children:"(#7576)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Pin emicklei/go-restful to v3.9.0 ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7598",children:"(#7598)"})]}),"\n"]}),"\n",(0,i.jsx)(s.hr,{}),"\n",(0,i.jsxs)(s.h2,{id:"release-v1264k3s1",children:["Release ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/releases/tag/v1.26.4+k3s1",children:"v1.26.4+k3s1"})]}),"\n",(0,i.jsx)(s.p,{children:"This release updates Kubernetes to v1.26.4, and fixes a number of issues."}),"\n",(0,i.jsxs)(s.p,{children:["For more details on what's new, see the ",(0,i.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.26.md#changelog-since-v1263",children:"Kubernetes release notes"}),"."]}),"\n",(0,i.jsx)(s.h3,{id:"changes-since-v1263k3s1",children:"Changes since v1.26.3+k3s1:"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsxs)(s.li,{children:["Enhance ",(0,i.jsx)(s.code,{children:"k3s check-config"})," ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7091",children:"(#7091)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Update stable channel to v1.25.8+k3s1 ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7161",children:"(#7161)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Drone Pipelines enhancement ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7169",children:"(#7169)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Fix_get_sha_url ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7187",children:"(#7187)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Improve Updatecli local-path-provisioner pipeline ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7181",children:"(#7181)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Improve workflow ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7142",children:"(#7142)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Improve Trivy configuration ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7154",children:"(#7154)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Bump Local Path Provisioner version ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7167",children:"(#7167)"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsx)(s.li,{children:"The bundled local-path-provisioner version has been bumped to v0.0.24"}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(s.li,{children:["Bump etcd to v3.5.7 ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7170",children:"(#7170)"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsx)(s.li,{children:"The embedded etcd version has been bumped to v3.5.7"}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(s.li,{children:["Bump runc to v1.1.5 ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7171",children:"(#7171)"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsx)(s.li,{children:"The bundled runc version has been bumped to v1.1.5"}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(s.li,{children:["Fix race condition caused by etcd advertising addresses that it does not listen on ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7147",children:"(#7147)"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsx)(s.li,{children:"Fixed a race condition during cluster reset that could cause the operation to hang and time out."}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(s.li,{children:["Bump coredns to v1.10.1 ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7168",children:"(#7168)"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsx)(s.li,{children:"The bundled coredns version has been bumped to v1.10.1"}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(s.li,{children:["Don't apply hardened args to agent ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7089",children:"(#7089)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Upgrade helm-controller to v0.13.3 ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7209",children:"(#7209)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Improve Klipper Helm and Helm controller bumps ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7146",children:"(#7146)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Fix issue with stale connections to removed LB server ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7194",children:"(#7194)"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsx)(s.li,{children:"The client load-balancer that maintains connections to active server nodes now closes connections to servers when they are removed from the cluster. This ensures that agent components immediately reconnect to a current cluster member."}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(s.li,{children:["Bump actions/setup-go from 3 to 4 ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7111",children:"(#7111)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Lock bootstrap data with empty key to prevent conflicts ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7215",children:"(#7215)"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsx)(s.li,{children:"When using an external datastore, K3s now locks the bootstrap key while creating initial cluster bootstrap data, preventing a race condition when multiple servers attempted to initialize the cluster simultaneously."}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(s.li,{children:["Updated kube-router to move the default ACCEPT rule at the end of the chain ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7218",children:"(#7218)"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsx)(s.li,{children:"The embedded kube-router controller has been updated to fix a regression that caused traffic from pods to be blocked by any default drop/deny rules present on the host. Users should still confirm that any externally-managed firewall rules explicitly allow traffic to/from pod and service networks, but this returns the old behavior that was relied upon by some users."}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(s.li,{children:["Add make commands to terraform automation and fix external dbs related issue ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7159",children:"(#7159)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Update klipper lb to v0.4.2 ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7210",children:"(#7210)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Add coreos and sle micro to selinux support ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6945",children:"(#6945)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Fix call for k3s-selinux versions in airgapped environments ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7264",children:"(#7264)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Update Kube-router ACCEPT rule insertion and install script to clean rules before start ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7274",children:"(#7274)"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsx)(s.li,{children:"The embedded kube-router controller has been updated to fix a regression that caused traffic from pods to be blocked by any default drop/deny rules present on the host. Users should still confirm that any externally-managed firewall rules explicitly allow traffic to/from pod and service networks, but this returns the old behavior that was relied upon by some users."}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(s.li,{children:["Update to v1.26.4-k3s1 ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7282",children:"(#7282)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Bump golang",":alpine"," image version ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7292",children:"(#7292)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Bump Sonobuoy version ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7256",children:"(#7256)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Bump Trivy version ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7257",children:"(#7257)"})]}),"\n"]}),"\n",(0,i.jsx)(s.hr,{}),"\n",(0,i.jsxs)(s.h2,{id:"release-v1263k3s1",children:["Release ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/releases/tag/v1.26.3+k3s1",children:"v1.26.3+k3s1"})]}),"\n",(0,i.jsx)(s.p,{children:"This release updates Kubernetes to v1.26.3, and fixes a number of issues."}),"\n",(0,i.jsxs)(s.p,{children:["For more details on what's new, see the ",(0,i.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.26.md#changelog-since-v1262",children:"Kubernetes release notes"}),"."]}),"\n",(0,i.jsx)(s.h3,{id:"changes-since-v1262k3s1",children:"Changes since v1.26.2+k3s1:"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsxs)(s.li,{children:["Add E2E to Drone ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6890",children:"(#6890)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Add flannel adr ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6973",children:"(#6973)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Update flannel and kube-router ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7039",children:"(#7039)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Bump various dependencies for CVEs ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7044",children:"(#7044)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Adds a warning about editing to the containerd config.toml file ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7057",children:"(#7057)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Update stable version in channel server ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7066",children:"(#7066)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Wait for kubelet port to be ready before setting ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7041",children:"(#7041)"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsx)(s.li,{children:"The agent tunnel authorizer now waits for the kubelet to be ready before reading the kubelet port from the node object."}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(s.li,{children:["Improve support for rotating the default self-signed certs ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7032",children:"(#7032)"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsxs)(s.li,{children:["The ",(0,i.jsx)(s.code,{children:"k3s certificate rotate-ca"})," checks now support rotating self-signed certificates without the ",(0,i.jsx)(s.code,{children:"--force"})," option."]}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(s.li,{children:["Skip all pipelines based on what is in the PR ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6996",children:"(#6996)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Add missing kernel config checks ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6946",children:"(#6946)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Remove deprecated nodeSelector label beta.kubernetes.io/os ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6970",children:"(#6970)"})]}),"\n",(0,i.jsxs)(s.li,{children:["MultiClusterCIDR for v1.26 ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6885",children:"(#6885)"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsx)(s.li,{children:"MultiClusterCIDR feature"}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(s.li,{children:["Remove Nikolai from MAINTAINERS list ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7088",children:"(#7088)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Add automation for Restart command for K3s ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7002",children:"(#7002)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Fix to Rotate CA e2e test ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7101",children:"(#7101)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Drone: Cleanup E2E VMs on test panic ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7104",children:"(#7104)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Update to v1.26.3-k3s1 ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7108",children:"(#7108)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Pin golangci-lint version to v1.51.2 ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7113",children:"(#7113)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Clean E2E VMs before testing ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7109",children:"(#7109)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Update flannel to fix NAT issue with old iptables version ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7136",children:"(#7136)"})]}),"\n"]}),"\n",(0,i.jsx)(s.hr,{}),"\n",(0,i.jsxs)(s.h2,{id:"release-v1262k3s1",children:["Release ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/releases/tag/v1.26.2+k3s1",children:"v1.26.2+k3s1"})]}),"\n",(0,i.jsx)(s.p,{children:"This release updates Kubernetes to v1.26.2, and fixes a number of issues."}),"\n",(0,i.jsxs)(s.p,{children:["For more details on what's new, see the ",(0,i.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.26.md#changelog-since-v1261",children:"Kubernetes release notes"}),"."]}),"\n",(0,i.jsx)(s.h3,{id:"changes-since-v1261k3s1",children:"Changes since v1.26.1+k3s1:"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsxs)(s.li,{children:["Add build tag to disable cri-dockerd ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6760",children:"(#6760)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Bump cri-dockerd ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6797",children:"(#6797)"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsx)(s.li,{children:"The embedded cri-dockerd has been updated to v0.3.1"}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(s.li,{children:["Update stable channel to v1.25.6+k3s1 ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6828",children:"(#6828)"})]}),"\n",(0,i.jsxs)(s.li,{children:["E2E Rancher and Hardened script improvements ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6778",children:"(#6778)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Add Ayedo to Adopters ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6801",children:"(#6801)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Consolidate E2E tests and GH Actions ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6772",children:"(#6772)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Allow ServiceLB to honor ",(0,i.jsx)(s.code,{children:"ExternalTrafficPolicy=Local"})," ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6726",children:"(#6726)"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsx)(s.li,{children:"ServiceLB now honors the Service's ExternalTrafficPolicy. When set to Local, the LoadBalancer will only advertise addresses of Nodes with a Pod for the Service, and will not forward traffic to other cluster members."}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(s.li,{children:["Fix cronjob example ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6707",children:"(#6707)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Bump vagrant boxes to fedora37 ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6832",children:"(#6832)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Ensure flag type consistency ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6852",children:"(#6852)"})]}),"\n",(0,i.jsxs)(s.li,{children:["E2E: Consoldiate docker and prefer bundled tests into new startup test ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6851",children:"(#6851)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Fix reference to documentation ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6860",children:"(#6860)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Bump deps: trivy, sonobuoy, dapper, golangci-lint, gopls ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6807",children:"(#6807)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Fix check for (open)SUSE version ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6791",children:"(#6791)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Add support for user-provided CA certificates ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6615",children:"(#6615)"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsxs)(s.li,{children:["K3s now functions properly when the cluster CA certificates are signed by an existing root or intermediate CA. You can find a sample script for generating such certificates before K3s starts in the github repo at ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/blob/master/contrib/util/certs.sh",children:"contrib/util/certs.sh"}),"."]}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(s.li,{children:["Ignore value conflicts when reencrypting secrets ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6850",children:"(#6850)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Add ",(0,i.jsx)(s.code,{children:"kubeadm"})," style bootstrap token secret support ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6663",children:"(#6663)"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsxs)(s.li,{children:["K3s now supports ",(0,i.jsx)(s.code,{children:"kubeadm"})," style join tokens. ",(0,i.jsx)(s.code,{children:"k3s token create"})," now creates join token secrets, optionally with a limited TTL."]}),"\n",(0,i.jsx)(s.li,{children:"K3s agents joined with an expired or deleted token stay in the cluster using existing client certificates via the NodeAuthorization admission plugin, unless their Node object is deleted from the cluster."}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(s.li,{children:["Add NATS to the list of supported data stores ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6876",children:"(#6876)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Use default address family when adding kubernetes service address to SAN list ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6857",children:"(#6857)"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsx)(s.li,{children:"The apiserver advertised address and IP SAN entry are now set correctly on clusters that use IPv6 as the default IP family."}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(s.li,{children:["Fix issue with servicelb startup failure when validating webhooks block creation ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6911",children:"(#6911)"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsx)(s.li,{children:"The embedded cloud controller manager will no longer attempt to unconditionally re-create its namespace and serviceaccount on startup. This resolves an issue that could cause a deadlocked cluster when fail-closed webhooks are in use."}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(s.li,{children:["Fix access to hostNetwork port on NodeIP when egress-selector-mode=agent ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6829",children:"(#6829)"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsx)(s.li,{children:"Fixed an issue that would cause the apiserver egress proxy to attempt to use the agent tunnel to connect to service endpoints even in agent or disabled mode."}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(s.li,{children:["Wait for server to become ready before creating token ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6932",children:"(#6932)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Allow for multiple sets of leader-elected controllers ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6922",children:"(#6922)"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsx)(s.li,{children:"Fixed an issue where leader-elected controllers for managed etcd did not run on etcd-only nodes"}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(s.li,{children:["Update Flannel to v0.21.1 ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6944",children:"(#6944)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Fix Nightly E2E tests ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6950",children:"(#6950)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Fix etcd and ca-cert rotate issues ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6952",children:"(#6952)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Fix ServiceLB dual-stack ingress IP listing ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6979",children:"(#6979)"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsx)(s.li,{children:"Resolved an issue with ServiceLB that would cause it to advertise node IPv6 addresses, even if the cluster or service was not enabled for dual-stack operation."}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(s.li,{children:["Bump kine to v0.9.9 ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6974",children:"(#6974)"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsxs)(s.li,{children:["The embedded kine version has been bumped to v0.9.9. Compaction log messages are now omitted at ",(0,i.jsx)(s.code,{children:"info"})," level for increased visibility."]}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(s.li,{children:["Update to v1.26.2-k3s1 ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7011",children:"(#7011)"})]}),"\n"]}),"\n",(0,i.jsx)(s.hr,{}),"\n",(0,i.jsxs)(s.h2,{id:"release-v1261k3s1",children:["Release ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/releases/tag/v1.26.1+k3s1",children:"v1.26.1+k3s1"})]}),"\n",(0,i.jsx)(s.p,{children:"This release updates Kubernetes to v1.26.1, and fixes a number of issues."}),"\n",(0,i.jsxs)(s.p,{children:["For more details on what's new, see the ",(0,i.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.26.md#changelog-since-v1260",children:"Kubernetes release notes"}),"."]}),"\n",(0,i.jsx)(s.h3,{id:"changes-since-v1260k3s2",children:"Changes since v1.26.0+k3s2:"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsxs)(s.li,{children:["Add jitter to scheduled snapshots and retry harder on conflicts ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6715",children:"(#6715)"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsx)(s.li,{children:"Scheduled etcd snapshots are now offset by a short random delay of up to several seconds. This should prevent multi-server clusters from executing pathological behavior when attempting to simultaneously update the snapshot list ConfigMap. The snapshot controller will also be more persistent in attempting to update the snapshot list."}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(s.li,{children:["Adjust e2e test run script and fixes ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6718",children:"(#6718)"})]}),"\n",(0,i.jsxs)(s.li,{children:["RIP Codespell ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6701",children:"(#6701)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Bump alpine from 3.16 to 3.17 in /package ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6688",children:"(#6688)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Bump alpine from 3.16 to 3.17 in /conformance ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6687",children:"(#6687)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Bump containerd to v1.6.15-k3s1 ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6722",children:"(#6722)"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsx)(s.li,{children:"The embedded containerd version has been bumped to v1.6.15-k3s1"}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(s.li,{children:["Containerd restart testlet ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6696",children:"(#6696)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Bump ubuntu from 20.04 to 22.04 in /tests/e2e/scripts ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6686",children:"(#6686)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Add explicit read permissions to workflows ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6700",children:"(#6700)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Pass through default tls-cipher-suites ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6725",children:"(#6725)"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsx)(s.li,{children:"The K3s default cipher suites are now explicitly passed in to kube-apiserver, ensuring that all listeners use these values."}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(s.li,{children:["Bump golang",":alpine"," image version ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6683",children:"(#6683)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Bugfix: do not break cert-manager when pprof is enabled ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6635",children:"(#6635)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Fix CI tests on Alpine 3.17 ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6744",children:"(#6744)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Update Stable to 1.25.5+k3s2 ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6753",children:"(#6753)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Bump action/download-artifact to v3 ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6746",children:"(#6746)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Generate report and upload test results ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6737",children:"(#6737)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Slow dependency CI to weekly ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6764",children:"(#6764)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Fix Drone plugins/docker tag for 32 bit arm ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6769",children:"(#6769)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Update to v1.26.1-k3s1 ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6774",children:"(#6774)"})]}),"\n"]}),"\n",(0,i.jsx)(s.hr,{}),"\n",(0,i.jsxs)(s.h2,{id:"release-v1260k3s2",children:["Release ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/releases/tag/v1.26.0+k3s2",children:"v1.26.0+k3s2"})]}),"\n",(0,i.jsx)(s.p,{children:"This release updates containerd to v1.6.14 to resolve an issue where pods would lose their CNI information when containerd was restarted, as well as a number of other stability and administrative changes."}),"\n",(0,i.jsxs)(s.p,{children:["Before upgrading from earlier releases, be sure to read the Kubernetes ",(0,i.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.26.md#urgent-upgrade-notes",children:"Urgent Upgrade Notes"}),"."]}),"\n",(0,i.jsx)(s.h3,{id:"changes-since-v1260k3s1",children:"Changes since v1.26.0+k3s1:"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsxs)(s.li,{children:["Current status badges ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6653",children:"(#6653)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Add initial Updatecli ADR automation ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6583",children:"(#6583)"})]}),"\n",(0,i.jsxs)(s.li,{children:["December 2022 channels update ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6618",children:"(#6618)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Change Updatecli GH action reference branch ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6682",children:"(#6682)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Fix OpenRC init script error 'openrc-run.sh: source: not found' ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6614",children:"(#6614)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Add Dependabot config for security ADR ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6560",children:"(#6560)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Bump containerd to v1.6.14-k3s1 ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6693",children:"(#6693)"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsxs)(s.li,{children:["The embedded containerd version has been bumped to v1.6.14-k3s1. This includes a backported fix for ",(0,i.jsx)(s.a,{href:"https://github.com/containerd/containerd/issues/7843",children:"containerd/7843"})," which caused pods to lose their CNI info when containerd was restarted, which in turn caused the kubelet to recreate the pod."]}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(s.li,{children:["Exclude December r1 releases from channel server ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6706",children:"(#6706)"})]}),"\n"]}),"\n",(0,i.jsx)(s.hr,{}),"\n",(0,i.jsxs)(s.h2,{id:"release-v1260k3s1",children:["Release ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/releases/tag/v1.26.0+k3s1",children:"v1.26.0+k3s1"})]}),"\n",(0,i.jsxs)(s.blockquote,{children:["\n",(0,i.jsx)(s.h2,{id:"\ufe0f-warning",children:"\u26a0\ufe0f WARNING"}),"\n",(0,i.jsxs)(s.p,{children:["This release is affected by ",(0,i.jsx)(s.a,{href:"https://github.com/containerd/containerd/issues/7843",children:"https://github.com/containerd/containerd/issues/7843"}),", which causes the kubelet to restart all pods whenever K3s is restarted. For this reason, we have removed this K3s release from the channel server. Please use ",(0,i.jsx)(s.code,{children:"v1.26.0+k3s2"})," instead."]}),"\n"]}),"\n",(0,i.jsx)(s.p,{children:"This release is K3S's first in the v1.26 line. This release updates Kubernetes to v1.26.0."}),"\n",(0,i.jsxs)(s.p,{children:["Before upgrading from earlier releases, be sure to read the Kubernetes ",(0,i.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.26.md#urgent-upgrade-notes",children:"Urgent Upgrade Notes"}),"."]}),"\n",(0,i.jsx)(s.h3,{id:"changes-since-v1255k3s1",children:"Changes since v1.25.5+k3s1:"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsxs)(s.li,{children:["Remove deprecated flags in v1.26 ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6574",children:"(#6574)"})]}),"\n",(0,i.jsxs)(s.li,{children:['Using "etcd-snapshot" for saving snapshots is now deprecated, use "etcd-snapshot save" instead. ',(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6575",children:"(#6575)"})]}),"\n",(0,i.jsx)(s.li,{children:"Update to v1.26.0-k3s1"}),"\n",(0,i.jsxs)(s.li,{children:["\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsx)(s.li,{children:"Update kubernetes to v1.26.0-k3s1"}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(s.li,{children:["\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsx)(s.li,{children:"Update cri-tools to v1.26.0-rc.0-k3s1"}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(s.li,{children:["\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsx)(s.li,{children:"Update helm controller to v0.13.1"}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(s.li,{children:["\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsx)(s.li,{children:"Update etcd to v3.5.5-k3s1"}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(s.li,{children:["\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsx)(s.li,{children:"Update cri-dockerd to the latest 1.26.0"}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(s.li,{children:["\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsx)(s.li,{children:"Update cadvisor"}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(s.li,{children:["\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsxs)(s.li,{children:["Update containerd to v1.6.12-k3s1 ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6370",children:"(#6370)"})]}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(s.li,{children:["Preload iptable_filter/ip6table_filter ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6645",children:"(#6645)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Bump k3s-root version to v0.12.1 ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6651",children:"(#6651)"})]}),"\n"]}),"\n",(0,i.jsx)(s.hr,{})]})}function o(e={}){const{wrapper:s}={...(0,r.a)(),...e.components};return s?(0,i.jsx)(s,{...e,children:(0,i.jsx)(a,{...e})}):a(e)}},1151:(e,s,t)=>{t.d(s,{Z:()=>h,a:()=>l});var i=t(7294);const r={},n=i.createContext(r);function l(e){const s=i.useContext(n);return i.useMemo((function(){return"function"==typeof e?e(s):{...s,...e}}),[s,e])}function h(e){let s;return s=e.disableParentContext?"function"==typeof e.components?e.components(r):e.components||r:l(e.components),i.createElement(n.Provider,{value:s},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/0e4359fd.c616c97c.js b/assets/js/0e4359fd.bd0b3018.js similarity index 99% rename from assets/js/0e4359fd.c616c97c.js rename to assets/js/0e4359fd.bd0b3018.js index 23237bad7..ef3dd6052 100644 --- a/assets/js/0e4359fd.c616c97c.js +++ b/assets/js/0e4359fd.bd0b3018.js @@ -1 +1 @@ -"use strict";(self.webpackChunkk_3_s_docs=self.webpackChunkk_3_s_docs||[]).push([[9751],{8495:(e,t,n)=>{n.r(t),n.d(t,{assets:()=>o,contentTitle:()=>a,default:()=>h,frontMatter:()=>i,metadata:()=>c,toc:()=>l});var s=n(5893),r=n(1151);const i={title:"Helm"},a=void 0,c={id:"helm",title:"Helm",description:"Helm is the package management tool of choice for Kubernetes. Helm charts provide templating syntax for Kubernetes YAML manifest documents. With Helm, developers or cluster administrators can create configurable templates known as Charts, instead of just using static manifests. For more information about creating your own Chart catalog, check out the docs at https://helm.sh/docs/intro/quickstart/.",source:"@site/docs/helm.md",sourceDirName:".",slug:"/helm",permalink:"/helm",draft:!1,unlisted:!1,editUrl:"https://github.com/k3s-io/docs/edit/main/docs/helm.md",tags:[],version:"current",lastUpdatedAt:1723651727e3,frontMatter:{title:"Helm"},sidebar:"mySidebar",previous:{title:"Networking Services",permalink:"/networking/networking-services"},next:{title:"Advanced Options / Configuration",permalink:"/advanced"}},o={},l=[{value:"Using the Helm Controller",id:"using-the-helm-controller",level:3},{value:"HelmChart Field Definitions",id:"helmchart-field-definitions",level:4},{value:"Customizing Packaged Components with HelmChartConfig",id:"customizing-packaged-components-with-helmchartconfig",level:3},{value:"Migrating from Helm v2",id:"migrating-from-helm-v2",level:3}];function d(e){const t={a:"a",admonition:"admonition",code:"code",h3:"h3",h4:"h4",p:"p",pre:"pre",table:"table",tbody:"tbody",td:"td",th:"th",thead:"thead",tr:"tr",...(0,r.a)(),...e.components};return(0,s.jsxs)(s.Fragment,{children:[(0,s.jsxs)(t.p,{children:["Helm is the package management tool of choice for Kubernetes. Helm charts provide templating syntax for Kubernetes YAML manifest documents. With Helm, developers or cluster administrators can create configurable templates known as Charts, instead of just using static manifests. For more information about creating your own Chart catalog, check out the docs at ",(0,s.jsx)(t.a,{href:"https://helm.sh/docs/intro/quickstart/",children:"https://helm.sh/docs/intro/quickstart/"}),"."]}),"\n",(0,s.jsxs)(t.p,{children:["K3s does not require any special configuration to support Helm. Just be sure you have properly set the kubeconfig path as per the ",(0,s.jsx)(t.a,{href:"/cluster-access",children:"cluster access"})," documentation."]}),"\n",(0,s.jsxs)(t.p,{children:["K3s includes a ",(0,s.jsx)(t.a,{href:"https://github.com/k3s-io/helm-controller/",children:"Helm Controller"})," that manages installing, upgrading/reconfiguring, and uninstalling Helm charts using a HelmChart Custom Resource Definition (CRD). Paired with ",(0,s.jsx)(t.a,{href:"/installation/packaged-components",children:"auto-deploying AddOn manifests"}),", installing a Helm chart on your cluster can be automated by creating a single file on disk."]}),"\n",(0,s.jsx)(t.h3,{id:"using-the-helm-controller",children:"Using the Helm Controller"}),"\n",(0,s.jsxs)(t.p,{children:["The ",(0,s.jsx)(t.a,{href:"https://github.com/k3s-io/helm-controller#helm-controller",children:"HelmChart Custom Resource"})," captures most of the options you would normally pass to the ",(0,s.jsx)(t.code,{children:"helm"})," command-line tool. Here's an example of how you might deploy Apache from the Bitnami chart repository, overriding some of the default chart values. Note that the HelmChart resource itself is in the ",(0,s.jsx)(t.code,{children:"kube-system"})," namespace, but the chart's resources will be deployed to the ",(0,s.jsx)(t.code,{children:"web"})," namespace, which is created in the same manifest. This can be useful if you want to keep your HelmChart resources separated from the the resources they deploy."]}),"\n",(0,s.jsx)(t.pre,{children:(0,s.jsx)(t.code,{className:"language-yaml",children:"apiVersion: v1\nkind: Namespace\nmetadata:\n name: web\n---\napiVersion: helm.cattle.io/v1\nkind: HelmChart\nmetadata:\n name: apache\n namespace: kube-system\nspec:\n repo: https://charts.bitnami.com/bitnami\n chart: apache\n targetNamespace: web\n valuesContent: |-\n service:\n type: ClusterIP\n ingress:\n enabled: true\n hostname: www.example.com\n metrics:\n enabled: true\n"})}),"\n",(0,s.jsx)(t.p,{children:"An example of deploying a helm chart from a private repo with authentication:"}),"\n",(0,s.jsx)(t.pre,{children:(0,s.jsx)(t.code,{className:"language-yaml",children:"apiVersion: helm.cattle.io/v1\nkind: HelmChart\nmetadata:\n namespace: kube-system\n name: example-app\nspec:\n targetNamespace: example-space\n createNamespace: true\n version: v1.2.3\n chart: example-app\n repo: https://secure-repo.example.com\n authSecret:\n name: example-repo-auth\n repoCAConfigMap:\n name: example-repo-ca\n valuesContent: |-\n image:\n tag: v1.2.2\n---\napiVersion: v1\nkind: Secret\nmetadata:\n namespace: kube-system\n name: example-repo-auth\ntype: kubernetes.io/basic-auth\nstringData:\n username: user\n password: pass\n---\napiVersion: v1\nkind: ConfigMap\nmetadata:\n namespace: kube-system\n name: example-repo-ca\ndata:\n ca.crt: |-\n -----BEGIN CERTIFICATE-----\n \n -----END CERTIFICATE-----\n"})}),"\n",(0,s.jsx)(t.h4,{id:"helmchart-field-definitions",children:"HelmChart Field Definitions"}),"\n",(0,s.jsxs)(t.table,{children:[(0,s.jsx)(t.thead,{children:(0,s.jsxs)(t.tr,{children:[(0,s.jsx)(t.th,{children:"Field"}),(0,s.jsx)(t.th,{children:"Default"}),(0,s.jsx)(t.th,{children:"Description"}),(0,s.jsx)(t.th,{children:"Helm Argument / Flag Equivalent"})]})}),(0,s.jsxs)(t.tbody,{children:[(0,s.jsxs)(t.tr,{children:[(0,s.jsx)(t.td,{children:"metadata.name"}),(0,s.jsx)(t.td,{}),(0,s.jsx)(t.td,{children:"Helm Chart name"}),(0,s.jsx)(t.td,{children:"NAME"})]}),(0,s.jsxs)(t.tr,{children:[(0,s.jsx)(t.td,{children:"spec.chart"}),(0,s.jsx)(t.td,{}),(0,s.jsx)(t.td,{children:"Helm Chart name in repository, or complete HTTPS URL to chart archive (.tgz)"}),(0,s.jsx)(t.td,{children:"CHART"})]}),(0,s.jsxs)(t.tr,{children:[(0,s.jsx)(t.td,{children:"spec.targetNamespace"}),(0,s.jsx)(t.td,{children:"default"}),(0,s.jsx)(t.td,{children:"Helm Chart target namespace"}),(0,s.jsx)(t.td,{children:(0,s.jsx)(t.code,{children:"--namespace"})})]}),(0,s.jsxs)(t.tr,{children:[(0,s.jsx)(t.td,{children:"spec.createNamespace"}),(0,s.jsx)(t.td,{children:"false"}),(0,s.jsx)(t.td,{children:"Create target namespace if not present"}),(0,s.jsx)(t.td,{children:(0,s.jsx)(t.code,{children:"--create-namespace"})})]}),(0,s.jsxs)(t.tr,{children:[(0,s.jsx)(t.td,{children:"spec.version"}),(0,s.jsx)(t.td,{}),(0,s.jsx)(t.td,{children:"Helm Chart version (when installing from repository)"}),(0,s.jsx)(t.td,{children:(0,s.jsx)(t.code,{children:"--version"})})]}),(0,s.jsxs)(t.tr,{children:[(0,s.jsx)(t.td,{children:"spec.repo"}),(0,s.jsx)(t.td,{}),(0,s.jsx)(t.td,{children:"Helm Chart repository URL"}),(0,s.jsx)(t.td,{children:(0,s.jsx)(t.code,{children:"--repo"})})]}),(0,s.jsxs)(t.tr,{children:[(0,s.jsx)(t.td,{children:"spec.repoCA"}),(0,s.jsx)(t.td,{}),(0,s.jsx)(t.td,{children:"Verify certificates of HTTPS-enabled servers using this CA bundle. Should be a string containing one or more PEM-encoded CA Certificates."}),(0,s.jsx)(t.td,{children:(0,s.jsx)(t.code,{children:"--ca-file"})})]}),(0,s.jsxs)(t.tr,{children:[(0,s.jsx)(t.td,{children:"spec.repoCAConfigMap"}),(0,s.jsx)(t.td,{}),(0,s.jsxs)(t.td,{children:["Reference to a ConfigMap containing CA Certificates to be be trusted by Helm. Can be used along with or instead of ",(0,s.jsx)(t.code,{children:"repoCA"})]}),(0,s.jsx)(t.td,{children:(0,s.jsx)(t.code,{children:"--ca-file"})})]}),(0,s.jsxs)(t.tr,{children:[(0,s.jsx)(t.td,{children:"spec.helmVersion"}),(0,s.jsx)(t.td,{children:"v3"}),(0,s.jsxs)(t.td,{children:["Helm version to use (",(0,s.jsx)(t.code,{children:"v2"})," or ",(0,s.jsx)(t.code,{children:"v3"}),")"]}),(0,s.jsx)(t.td,{})]}),(0,s.jsxs)(t.tr,{children:[(0,s.jsx)(t.td,{children:"spec.bootstrap"}),(0,s.jsx)(t.td,{children:"False"}),(0,s.jsx)(t.td,{children:"Set to True if this chart is needed to bootstrap the cluster (Cloud Controller Manager, etc)"}),(0,s.jsx)(t.td,{})]}),(0,s.jsxs)(t.tr,{children:[(0,s.jsx)(t.td,{children:"spec.set"}),(0,s.jsx)(t.td,{}),(0,s.jsx)(t.td,{children:"Override simple default Chart values. These take precedence over options set via valuesContent."}),(0,s.jsxs)(t.td,{children:[(0,s.jsx)(t.code,{children:"--set"})," / ",(0,s.jsx)(t.code,{children:"--set-string"})]})]}),(0,s.jsxs)(t.tr,{children:[(0,s.jsx)(t.td,{children:"spec.jobImage"}),(0,s.jsx)(t.td,{}),(0,s.jsxs)(t.td,{children:["Specify the image to use when installing the helm chart. E.g. rancher/klipper-helm",":v0",".3.0 ."]}),(0,s.jsx)(t.td,{})]}),(0,s.jsxs)(t.tr,{children:[(0,s.jsx)(t.td,{children:"spec.backOffLimit"}),(0,s.jsx)(t.td,{children:"1000"}),(0,s.jsx)(t.td,{children:"Specify the number of retries before considering a job failed."}),(0,s.jsx)(t.td,{})]}),(0,s.jsxs)(t.tr,{children:[(0,s.jsx)(t.td,{children:"spec.timeout"}),(0,s.jsx)(t.td,{children:"300s"}),(0,s.jsxs)(t.td,{children:["Timeout for Helm operations, as a ",(0,s.jsx)(t.a,{href:"https://pkg.go.dev/time#ParseDuration",children:"duration string"})," (",(0,s.jsx)(t.code,{children:"300s"}),", ",(0,s.jsx)(t.code,{children:"10m"}),", ",(0,s.jsx)(t.code,{children:"1h"}),", etc)"]}),(0,s.jsx)(t.td,{children:(0,s.jsx)(t.code,{children:"--timeout"})})]}),(0,s.jsxs)(t.tr,{children:[(0,s.jsx)(t.td,{children:"spec.failurePolicy"}),(0,s.jsx)(t.td,{children:"reinstall"}),(0,s.jsxs)(t.td,{children:["Set to ",(0,s.jsx)(t.code,{children:"abort"})," which case the Helm operation is aborted, pending manual intervention by the operator."]}),(0,s.jsx)(t.td,{})]}),(0,s.jsxs)(t.tr,{children:[(0,s.jsx)(t.td,{children:"spec.authSecret"}),(0,s.jsx)(t.td,{}),(0,s.jsxs)(t.td,{children:["Reference to Secret of type ",(0,s.jsx)(t.code,{children:"kubernetes.io/basic-auth"})," holding Basic auth credentials for the Chart repo."]}),(0,s.jsx)(t.td,{})]}),(0,s.jsxs)(t.tr,{children:[(0,s.jsx)(t.td,{children:"spec.authPassCredentials"}),(0,s.jsx)(t.td,{children:"false"}),(0,s.jsx)(t.td,{children:"Pass Basic auth credentials to all domains."}),(0,s.jsx)(t.td,{children:(0,s.jsx)(t.code,{children:"--pass-credentials"})})]}),(0,s.jsxs)(t.tr,{children:[(0,s.jsx)(t.td,{children:"spec.dockerRegistrySecret"}),(0,s.jsx)(t.td,{}),(0,s.jsxs)(t.td,{children:["Reference to Secret of type ",(0,s.jsx)(t.code,{children:"kubernetes.io/dockerconfigjson"})," holding Docker auth credentials for the OCI-based registry acting as the Chart repo."]}),(0,s.jsx)(t.td,{})]}),(0,s.jsxs)(t.tr,{children:[(0,s.jsx)(t.td,{children:"spec.valuesContent"}),(0,s.jsx)(t.td,{}),(0,s.jsx)(t.td,{children:"Override complex default Chart values via YAML file content"}),(0,s.jsx)(t.td,{children:(0,s.jsx)(t.code,{children:"--values"})})]}),(0,s.jsxs)(t.tr,{children:[(0,s.jsx)(t.td,{children:"spec.chartContent"}),(0,s.jsx)(t.td,{}),(0,s.jsx)(t.td,{children:"Base64-encoded chart archive .tgz - overrides spec.chart"}),(0,s.jsx)(t.td,{children:"CHART"})]})]})]}),"\n",(0,s.jsxs)(t.p,{children:["Content placed in ",(0,s.jsx)(t.code,{children:"/var/lib/rancher/k3s/server/static/"})," can be accessed anonymously via the Kubernetes APIServer from within the cluster. This URL can be templated using the special variable ",(0,s.jsx)(t.code,{children:"%{KUBERNETES_API}%"})," in the ",(0,s.jsx)(t.code,{children:"spec.chart"})," field. For example, the packaged Traefik component loads its chart from ",(0,s.jsx)(t.code,{children:"https://%{KUBERNETES_API}%/static/charts/traefik-12.0.000.tgz"}),"."]}),"\n",(0,s.jsx)(t.admonition,{type:"note",children:(0,s.jsxs)(t.p,{children:["The ",(0,s.jsx)(t.code,{children:"name"})," field should follow the Helm chart naming conventions. Refer to the ",(0,s.jsx)(t.a,{href:"https://helm.sh/docs/chart_best_practices/conventions/#chart-names",children:"Helm Best Practices documentation"})," to learn more."]})}),"\n",(0,s.jsx)(t.h3,{id:"customizing-packaged-components-with-helmchartconfig",children:"Customizing Packaged Components with HelmChartConfig"}),"\n",(0,s.jsxs)(t.p,{children:["To allow overriding values for packaged components that are deployed as HelmCharts (such as Traefik), K3s supports customizing deployments via a HelmChartConfig resources. The HelmChartConfig resource must match the name and namespace of its corresponding HelmChart, and it supports providing additional ",(0,s.jsx)(t.code,{children:"valuesContent"}),", which is passed to the ",(0,s.jsx)(t.code,{children:"helm"})," command as an additional value file."]}),"\n",(0,s.jsx)(t.admonition,{type:"note",children:(0,s.jsxs)(t.p,{children:["HelmChart ",(0,s.jsx)(t.code,{children:"spec.set"})," values override HelmChart and HelmChartConfig ",(0,s.jsx)(t.code,{children:"spec.valuesContent"})," settings."]})}),"\n",(0,s.jsxs)(t.p,{children:["For example, to customize the packaged Traefik ingress configuration, you can create a file named ",(0,s.jsx)(t.code,{children:"/var/lib/rancher/k3s/server/manifests/traefik-config.yaml"})," and populate it with the following content:"]}),"\n",(0,s.jsx)(t.pre,{children:(0,s.jsx)(t.code,{className:"language-yaml",children:"apiVersion: helm.cattle.io/v1\nkind: HelmChartConfig\nmetadata:\n name: traefik\n namespace: kube-system\nspec:\n valuesContent: |-\n image:\n name: traefik\n tag: 2.9.10\n ports:\n web:\n forwardedHeaders:\n trustedIPs:\n - 10.0.0.0/8\n"})}),"\n",(0,s.jsx)(t.h3,{id:"migrating-from-helm-v2",children:"Migrating from Helm v2"}),"\n",(0,s.jsxs)(t.p,{children:["K3s can handle either Helm v2 or Helm v3. If you wish to migrate to Helm v3, ",(0,s.jsx)(t.a,{href:"https://helm.sh/blog/migrate-from-helm-v2-to-helm-v3/",children:"this"})," blog post by Helm explains how to use a plugin to successfully migrate. Refer to the official Helm 3 documentation ",(0,s.jsx)(t.a,{href:"https://helm.sh/docs/",children:"here"})," for more information. Just be sure you have properly set your kubeconfig as per the section about ",(0,s.jsx)(t.a,{href:"/cluster-access",children:"cluster access."})]}),"\n",(0,s.jsx)(t.admonition,{type:"note",children:(0,s.jsxs)(t.p,{children:["Helm 3 no longer requires Tiller and the ",(0,s.jsx)(t.code,{children:"helm init"})," command. Refer to the official documentation for details."]})})]})}function h(e={}){const{wrapper:t}={...(0,r.a)(),...e.components};return t?(0,s.jsx)(t,{...e,children:(0,s.jsx)(d,{...e})}):d(e)}},1151:(e,t,n)=>{n.d(t,{Z:()=>c,a:()=>a});var s=n(7294);const r={},i=s.createContext(r);function a(e){const t=s.useContext(i);return s.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function c(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(r):e.components||r:a(e.components),s.createElement(i.Provider,{value:t},e.children)}}}]); \ No newline at end of file +"use strict";(self.webpackChunkk_3_s_docs=self.webpackChunkk_3_s_docs||[]).push([[9751],{8495:(e,t,n)=>{n.r(t),n.d(t,{assets:()=>o,contentTitle:()=>a,default:()=>h,frontMatter:()=>i,metadata:()=>c,toc:()=>l});var s=n(5893),r=n(1151);const i={title:"Helm"},a=void 0,c={id:"helm",title:"Helm",description:"Helm is the package management tool of choice for Kubernetes. Helm charts provide templating syntax for Kubernetes YAML manifest documents. With Helm, developers or cluster administrators can create configurable templates known as Charts, instead of just using static manifests. For more information about creating your own Chart catalog, check out the docs at https://helm.sh/docs/intro/quickstart/.",source:"@site/docs/helm.md",sourceDirName:".",slug:"/helm",permalink:"/helm",draft:!1,unlisted:!1,editUrl:"https://github.com/k3s-io/docs/edit/main/docs/helm.md",tags:[],version:"current",lastUpdatedAt:1723747404e3,frontMatter:{title:"Helm"},sidebar:"mySidebar",previous:{title:"Networking Services",permalink:"/networking/networking-services"},next:{title:"Advanced Options / Configuration",permalink:"/advanced"}},o={},l=[{value:"Using the Helm Controller",id:"using-the-helm-controller",level:3},{value:"HelmChart Field Definitions",id:"helmchart-field-definitions",level:4},{value:"Customizing Packaged Components with HelmChartConfig",id:"customizing-packaged-components-with-helmchartconfig",level:3},{value:"Migrating from Helm v2",id:"migrating-from-helm-v2",level:3}];function d(e){const t={a:"a",admonition:"admonition",code:"code",h3:"h3",h4:"h4",p:"p",pre:"pre",table:"table",tbody:"tbody",td:"td",th:"th",thead:"thead",tr:"tr",...(0,r.a)(),...e.components};return(0,s.jsxs)(s.Fragment,{children:[(0,s.jsxs)(t.p,{children:["Helm is the package management tool of choice for Kubernetes. Helm charts provide templating syntax for Kubernetes YAML manifest documents. With Helm, developers or cluster administrators can create configurable templates known as Charts, instead of just using static manifests. For more information about creating your own Chart catalog, check out the docs at ",(0,s.jsx)(t.a,{href:"https://helm.sh/docs/intro/quickstart/",children:"https://helm.sh/docs/intro/quickstart/"}),"."]}),"\n",(0,s.jsxs)(t.p,{children:["K3s does not require any special configuration to support Helm. Just be sure you have properly set the kubeconfig path as per the ",(0,s.jsx)(t.a,{href:"/cluster-access",children:"cluster access"})," documentation."]}),"\n",(0,s.jsxs)(t.p,{children:["K3s includes a ",(0,s.jsx)(t.a,{href:"https://github.com/k3s-io/helm-controller/",children:"Helm Controller"})," that manages installing, upgrading/reconfiguring, and uninstalling Helm charts using a HelmChart Custom Resource Definition (CRD). Paired with ",(0,s.jsx)(t.a,{href:"/installation/packaged-components",children:"auto-deploying AddOn manifests"}),", installing a Helm chart on your cluster can be automated by creating a single file on disk."]}),"\n",(0,s.jsx)(t.h3,{id:"using-the-helm-controller",children:"Using the Helm Controller"}),"\n",(0,s.jsxs)(t.p,{children:["The ",(0,s.jsx)(t.a,{href:"https://github.com/k3s-io/helm-controller#helm-controller",children:"HelmChart Custom Resource"})," captures most of the options you would normally pass to the ",(0,s.jsx)(t.code,{children:"helm"})," command-line tool. Here's an example of how you might deploy Apache from the Bitnami chart repository, overriding some of the default chart values. Note that the HelmChart resource itself is in the ",(0,s.jsx)(t.code,{children:"kube-system"})," namespace, but the chart's resources will be deployed to the ",(0,s.jsx)(t.code,{children:"web"})," namespace, which is created in the same manifest. This can be useful if you want to keep your HelmChart resources separated from the the resources they deploy."]}),"\n",(0,s.jsx)(t.pre,{children:(0,s.jsx)(t.code,{className:"language-yaml",children:"apiVersion: v1\nkind: Namespace\nmetadata:\n name: web\n---\napiVersion: helm.cattle.io/v1\nkind: HelmChart\nmetadata:\n name: apache\n namespace: kube-system\nspec:\n repo: https://charts.bitnami.com/bitnami\n chart: apache\n targetNamespace: web\n valuesContent: |-\n service:\n type: ClusterIP\n ingress:\n enabled: true\n hostname: www.example.com\n metrics:\n enabled: true\n"})}),"\n",(0,s.jsx)(t.p,{children:"An example of deploying a helm chart from a private repo with authentication:"}),"\n",(0,s.jsx)(t.pre,{children:(0,s.jsx)(t.code,{className:"language-yaml",children:"apiVersion: helm.cattle.io/v1\nkind: HelmChart\nmetadata:\n namespace: kube-system\n name: example-app\nspec:\n targetNamespace: example-space\n createNamespace: true\n version: v1.2.3\n chart: example-app\n repo: https://secure-repo.example.com\n authSecret:\n name: example-repo-auth\n repoCAConfigMap:\n name: example-repo-ca\n valuesContent: |-\n image:\n tag: v1.2.2\n---\napiVersion: v1\nkind: Secret\nmetadata:\n namespace: kube-system\n name: example-repo-auth\ntype: kubernetes.io/basic-auth\nstringData:\n username: user\n password: pass\n---\napiVersion: v1\nkind: ConfigMap\nmetadata:\n namespace: kube-system\n name: example-repo-ca\ndata:\n ca.crt: |-\n -----BEGIN CERTIFICATE-----\n \n -----END CERTIFICATE-----\n"})}),"\n",(0,s.jsx)(t.h4,{id:"helmchart-field-definitions",children:"HelmChart Field Definitions"}),"\n",(0,s.jsxs)(t.table,{children:[(0,s.jsx)(t.thead,{children:(0,s.jsxs)(t.tr,{children:[(0,s.jsx)(t.th,{children:"Field"}),(0,s.jsx)(t.th,{children:"Default"}),(0,s.jsx)(t.th,{children:"Description"}),(0,s.jsx)(t.th,{children:"Helm Argument / Flag Equivalent"})]})}),(0,s.jsxs)(t.tbody,{children:[(0,s.jsxs)(t.tr,{children:[(0,s.jsx)(t.td,{children:"metadata.name"}),(0,s.jsx)(t.td,{}),(0,s.jsx)(t.td,{children:"Helm Chart name"}),(0,s.jsx)(t.td,{children:"NAME"})]}),(0,s.jsxs)(t.tr,{children:[(0,s.jsx)(t.td,{children:"spec.chart"}),(0,s.jsx)(t.td,{}),(0,s.jsx)(t.td,{children:"Helm Chart name in repository, or complete HTTPS URL to chart archive (.tgz)"}),(0,s.jsx)(t.td,{children:"CHART"})]}),(0,s.jsxs)(t.tr,{children:[(0,s.jsx)(t.td,{children:"spec.targetNamespace"}),(0,s.jsx)(t.td,{children:"default"}),(0,s.jsx)(t.td,{children:"Helm Chart target namespace"}),(0,s.jsx)(t.td,{children:(0,s.jsx)(t.code,{children:"--namespace"})})]}),(0,s.jsxs)(t.tr,{children:[(0,s.jsx)(t.td,{children:"spec.createNamespace"}),(0,s.jsx)(t.td,{children:"false"}),(0,s.jsx)(t.td,{children:"Create target namespace if not present"}),(0,s.jsx)(t.td,{children:(0,s.jsx)(t.code,{children:"--create-namespace"})})]}),(0,s.jsxs)(t.tr,{children:[(0,s.jsx)(t.td,{children:"spec.version"}),(0,s.jsx)(t.td,{}),(0,s.jsx)(t.td,{children:"Helm Chart version (when installing from repository)"}),(0,s.jsx)(t.td,{children:(0,s.jsx)(t.code,{children:"--version"})})]}),(0,s.jsxs)(t.tr,{children:[(0,s.jsx)(t.td,{children:"spec.repo"}),(0,s.jsx)(t.td,{}),(0,s.jsx)(t.td,{children:"Helm Chart repository URL"}),(0,s.jsx)(t.td,{children:(0,s.jsx)(t.code,{children:"--repo"})})]}),(0,s.jsxs)(t.tr,{children:[(0,s.jsx)(t.td,{children:"spec.repoCA"}),(0,s.jsx)(t.td,{}),(0,s.jsx)(t.td,{children:"Verify certificates of HTTPS-enabled servers using this CA bundle. Should be a string containing one or more PEM-encoded CA Certificates."}),(0,s.jsx)(t.td,{children:(0,s.jsx)(t.code,{children:"--ca-file"})})]}),(0,s.jsxs)(t.tr,{children:[(0,s.jsx)(t.td,{children:"spec.repoCAConfigMap"}),(0,s.jsx)(t.td,{}),(0,s.jsxs)(t.td,{children:["Reference to a ConfigMap containing CA Certificates to be be trusted by Helm. Can be used along with or instead of ",(0,s.jsx)(t.code,{children:"repoCA"})]}),(0,s.jsx)(t.td,{children:(0,s.jsx)(t.code,{children:"--ca-file"})})]}),(0,s.jsxs)(t.tr,{children:[(0,s.jsx)(t.td,{children:"spec.helmVersion"}),(0,s.jsx)(t.td,{children:"v3"}),(0,s.jsxs)(t.td,{children:["Helm version to use (",(0,s.jsx)(t.code,{children:"v2"})," or ",(0,s.jsx)(t.code,{children:"v3"}),")"]}),(0,s.jsx)(t.td,{})]}),(0,s.jsxs)(t.tr,{children:[(0,s.jsx)(t.td,{children:"spec.bootstrap"}),(0,s.jsx)(t.td,{children:"False"}),(0,s.jsx)(t.td,{children:"Set to True if this chart is needed to bootstrap the cluster (Cloud Controller Manager, etc)"}),(0,s.jsx)(t.td,{})]}),(0,s.jsxs)(t.tr,{children:[(0,s.jsx)(t.td,{children:"spec.set"}),(0,s.jsx)(t.td,{}),(0,s.jsx)(t.td,{children:"Override simple default Chart values. These take precedence over options set via valuesContent."}),(0,s.jsxs)(t.td,{children:[(0,s.jsx)(t.code,{children:"--set"})," / ",(0,s.jsx)(t.code,{children:"--set-string"})]})]}),(0,s.jsxs)(t.tr,{children:[(0,s.jsx)(t.td,{children:"spec.jobImage"}),(0,s.jsx)(t.td,{}),(0,s.jsxs)(t.td,{children:["Specify the image to use when installing the helm chart. E.g. rancher/klipper-helm",":v0",".3.0 ."]}),(0,s.jsx)(t.td,{})]}),(0,s.jsxs)(t.tr,{children:[(0,s.jsx)(t.td,{children:"spec.backOffLimit"}),(0,s.jsx)(t.td,{children:"1000"}),(0,s.jsx)(t.td,{children:"Specify the number of retries before considering a job failed."}),(0,s.jsx)(t.td,{})]}),(0,s.jsxs)(t.tr,{children:[(0,s.jsx)(t.td,{children:"spec.timeout"}),(0,s.jsx)(t.td,{children:"300s"}),(0,s.jsxs)(t.td,{children:["Timeout for Helm operations, as a ",(0,s.jsx)(t.a,{href:"https://pkg.go.dev/time#ParseDuration",children:"duration string"})," (",(0,s.jsx)(t.code,{children:"300s"}),", ",(0,s.jsx)(t.code,{children:"10m"}),", ",(0,s.jsx)(t.code,{children:"1h"}),", etc)"]}),(0,s.jsx)(t.td,{children:(0,s.jsx)(t.code,{children:"--timeout"})})]}),(0,s.jsxs)(t.tr,{children:[(0,s.jsx)(t.td,{children:"spec.failurePolicy"}),(0,s.jsx)(t.td,{children:"reinstall"}),(0,s.jsxs)(t.td,{children:["Set to ",(0,s.jsx)(t.code,{children:"abort"})," which case the Helm operation is aborted, pending manual intervention by the operator."]}),(0,s.jsx)(t.td,{})]}),(0,s.jsxs)(t.tr,{children:[(0,s.jsx)(t.td,{children:"spec.authSecret"}),(0,s.jsx)(t.td,{}),(0,s.jsxs)(t.td,{children:["Reference to Secret of type ",(0,s.jsx)(t.code,{children:"kubernetes.io/basic-auth"})," holding Basic auth credentials for the Chart repo."]}),(0,s.jsx)(t.td,{})]}),(0,s.jsxs)(t.tr,{children:[(0,s.jsx)(t.td,{children:"spec.authPassCredentials"}),(0,s.jsx)(t.td,{children:"false"}),(0,s.jsx)(t.td,{children:"Pass Basic auth credentials to all domains."}),(0,s.jsx)(t.td,{children:(0,s.jsx)(t.code,{children:"--pass-credentials"})})]}),(0,s.jsxs)(t.tr,{children:[(0,s.jsx)(t.td,{children:"spec.dockerRegistrySecret"}),(0,s.jsx)(t.td,{}),(0,s.jsxs)(t.td,{children:["Reference to Secret of type ",(0,s.jsx)(t.code,{children:"kubernetes.io/dockerconfigjson"})," holding Docker auth credentials for the OCI-based registry acting as the Chart repo."]}),(0,s.jsx)(t.td,{})]}),(0,s.jsxs)(t.tr,{children:[(0,s.jsx)(t.td,{children:"spec.valuesContent"}),(0,s.jsx)(t.td,{}),(0,s.jsx)(t.td,{children:"Override complex default Chart values via YAML file content"}),(0,s.jsx)(t.td,{children:(0,s.jsx)(t.code,{children:"--values"})})]}),(0,s.jsxs)(t.tr,{children:[(0,s.jsx)(t.td,{children:"spec.chartContent"}),(0,s.jsx)(t.td,{}),(0,s.jsx)(t.td,{children:"Base64-encoded chart archive .tgz - overrides spec.chart"}),(0,s.jsx)(t.td,{children:"CHART"})]})]})]}),"\n",(0,s.jsxs)(t.p,{children:["Content placed in ",(0,s.jsx)(t.code,{children:"/var/lib/rancher/k3s/server/static/"})," can be accessed anonymously via the Kubernetes APIServer from within the cluster. This URL can be templated using the special variable ",(0,s.jsx)(t.code,{children:"%{KUBERNETES_API}%"})," in the ",(0,s.jsx)(t.code,{children:"spec.chart"})," field. For example, the packaged Traefik component loads its chart from ",(0,s.jsx)(t.code,{children:"https://%{KUBERNETES_API}%/static/charts/traefik-12.0.000.tgz"}),"."]}),"\n",(0,s.jsx)(t.admonition,{type:"note",children:(0,s.jsxs)(t.p,{children:["The ",(0,s.jsx)(t.code,{children:"name"})," field should follow the Helm chart naming conventions. Refer to the ",(0,s.jsx)(t.a,{href:"https://helm.sh/docs/chart_best_practices/conventions/#chart-names",children:"Helm Best Practices documentation"})," to learn more."]})}),"\n",(0,s.jsx)(t.h3,{id:"customizing-packaged-components-with-helmchartconfig",children:"Customizing Packaged Components with HelmChartConfig"}),"\n",(0,s.jsxs)(t.p,{children:["To allow overriding values for packaged components that are deployed as HelmCharts (such as Traefik), K3s supports customizing deployments via a HelmChartConfig resources. The HelmChartConfig resource must match the name and namespace of its corresponding HelmChart, and it supports providing additional ",(0,s.jsx)(t.code,{children:"valuesContent"}),", which is passed to the ",(0,s.jsx)(t.code,{children:"helm"})," command as an additional value file."]}),"\n",(0,s.jsx)(t.admonition,{type:"note",children:(0,s.jsxs)(t.p,{children:["HelmChart ",(0,s.jsx)(t.code,{children:"spec.set"})," values override HelmChart and HelmChartConfig ",(0,s.jsx)(t.code,{children:"spec.valuesContent"})," settings."]})}),"\n",(0,s.jsxs)(t.p,{children:["For example, to customize the packaged Traefik ingress configuration, you can create a file named ",(0,s.jsx)(t.code,{children:"/var/lib/rancher/k3s/server/manifests/traefik-config.yaml"})," and populate it with the following content:"]}),"\n",(0,s.jsx)(t.pre,{children:(0,s.jsx)(t.code,{className:"language-yaml",children:"apiVersion: helm.cattle.io/v1\nkind: HelmChartConfig\nmetadata:\n name: traefik\n namespace: kube-system\nspec:\n valuesContent: |-\n image:\n name: traefik\n tag: 2.9.10\n ports:\n web:\n forwardedHeaders:\n trustedIPs:\n - 10.0.0.0/8\n"})}),"\n",(0,s.jsx)(t.h3,{id:"migrating-from-helm-v2",children:"Migrating from Helm v2"}),"\n",(0,s.jsxs)(t.p,{children:["K3s can handle either Helm v2 or Helm v3. If you wish to migrate to Helm v3, ",(0,s.jsx)(t.a,{href:"https://helm.sh/blog/migrate-from-helm-v2-to-helm-v3/",children:"this"})," blog post by Helm explains how to use a plugin to successfully migrate. Refer to the official Helm 3 documentation ",(0,s.jsx)(t.a,{href:"https://helm.sh/docs/",children:"here"})," for more information. Just be sure you have properly set your kubeconfig as per the section about ",(0,s.jsx)(t.a,{href:"/cluster-access",children:"cluster access."})]}),"\n",(0,s.jsx)(t.admonition,{type:"note",children:(0,s.jsxs)(t.p,{children:["Helm 3 no longer requires Tiller and the ",(0,s.jsx)(t.code,{children:"helm init"})," command. Refer to the official documentation for details."]})})]})}function h(e={}){const{wrapper:t}={...(0,r.a)(),...e.components};return t?(0,s.jsx)(t,{...e,children:(0,s.jsx)(d,{...e})}):d(e)}},1151:(e,t,n)=>{n.d(t,{Z:()=>c,a:()=>a});var s=n(7294);const r={},i=s.createContext(r);function a(e){const t=s.useContext(i);return s.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function c(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(r):e.components||r:a(e.components),s.createElement(i.Provider,{value:t},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/10b61a3f.f8f724d1.js b/assets/js/10b61a3f.4b9b71cb.js similarity index 99% rename from assets/js/10b61a3f.f8f724d1.js rename to assets/js/10b61a3f.4b9b71cb.js index 3987e23bb..312e92c06 100644 --- a/assets/js/10b61a3f.f8f724d1.js +++ b/assets/js/10b61a3f.4b9b71cb.js @@ -1 +1 @@ -"use strict";(self.webpackChunkk_3_s_docs=self.webpackChunkk_3_s_docs||[]).push([[4902],{8040:(e,r,i)=>{i.r(r),i.d(r,{assets:()=>l,contentTitle:()=>o,default:()=>h,frontMatter:()=>s,metadata:()=>a,toc:()=>d});var t=i(5893),n=i(1151);const s={title:"Private Registry Configuration"},o=void 0,a={id:"installation/private-registry",title:"Private Registry Configuration",description:"Containerd can be configured to connect to private registries and use them to pull images as needed by the kubelet.",source:"@site/docs/installation/private-registry.md",sourceDirName:"installation",slug:"/installation/private-registry",permalink:"/installation/private-registry",draft:!1,unlisted:!1,editUrl:"https://github.com/k3s-io/docs/edit/main/docs/installation/private-registry.md",tags:[],version:"current",lastUpdatedAt:1723651727e3,frontMatter:{title:"Private Registry Configuration"},sidebar:"mySidebar",previous:{title:"Configuration Options",permalink:"/installation/configuration"},next:{title:"Embedded Registry Mirror",permalink:"/installation/registry-mirror"}},l={},d=[{value:"Default Endpoint Fallback",id:"default-endpoint-fallback",level:2},{value:"Registries Configuration File",id:"registries-configuration-file",level:2},{value:"Mirrors",id:"mirrors",level:3},{value:"Redirects",id:"redirects",level:4},{value:"Rewrites",id:"rewrites",level:4},{value:"Configs",id:"configs",level:3},{value:"Wildcard Support",id:"wildcard-support",level:3},{value:"With TLS",id:"with-tls",level:3},{value:"Without TLS",id:"without-tls",level:3},{value:"Troubleshooting Image Pulls",id:"troubleshooting-image-pulls",level:2},{value:"Adding Images to the Private Registry",id:"adding-images-to-the-private-registry",level:2}];function c(e){const r={a:"a",admonition:"admonition",blockquote:"blockquote",br:"br",code:"code",em:"em",h2:"h2",h3:"h3",h4:"h4",li:"li",ol:"ol",p:"p",pre:"pre",table:"table",tbody:"tbody",td:"td",th:"th",thead:"thead",tr:"tr",ul:"ul",...(0,n.a)(),...e.components},{TabItem:i,Tabs:s}=r;return i||p("TabItem",!0),s||p("Tabs",!0),(0,t.jsxs)(t.Fragment,{children:[(0,t.jsx)(r.p,{children:"Containerd can be configured to connect to private registries and use them to pull images as needed by the kubelet."}),"\n",(0,t.jsxs)(r.p,{children:["Upon startup, K3s will check to see if ",(0,t.jsx)(r.code,{children:"/etc/rancher/k3s/registries.yaml"})," exists. If so, the registry configuration contained in this file is used when generating the containerd configuration."]}),"\n",(0,t.jsxs)(r.ul,{children:["\n",(0,t.jsxs)(r.li,{children:["If you want to use a private registry as a mirror for a public registry such as docker.io, then you will need to configure ",(0,t.jsx)(r.code,{children:"registries.yaml"})," on each node that you want to use the mirror."]}),"\n",(0,t.jsxs)(r.li,{children:["If your private registry requires authentication, uses custom TLS certificates, or does not use TLS, you will need to configure ",(0,t.jsx)(r.code,{children:"registries.yaml"})," on each node that will pull images from your registry."]}),"\n"]}),"\n",(0,t.jsxs)(r.p,{children:["Note that server nodes are schedulable by default. If you have not tainted the server nodes and will be running workloads on them,\nplease ensure you also create the ",(0,t.jsx)(r.code,{children:"registries.yaml"})," file on each server as well."]}),"\n",(0,t.jsx)(r.h2,{id:"default-endpoint-fallback",children:"Default Endpoint Fallback"}),"\n",(0,t.jsxs)(r.p,{children:['Containerd has an implicit "default endpoint" for all registries.\nThe default endpoint is always tried as a last resort, even if there are other endpoints listed for that registry in ',(0,t.jsx)(r.code,{children:"registries.yaml"}),".\nFor example, when pulling ",(0,t.jsx)(r.code,{children:"registry.example.com:5000/rancher/mirrored-pause:3.6"}),", containerd will use a default endpoint of ",(0,t.jsx)(r.code,{children:"https://registry.example.com:5000/v2"}),"."]}),"\n",(0,t.jsxs)(r.ul,{children:["\n",(0,t.jsxs)(r.li,{children:["The default endpoint for ",(0,t.jsx)(r.code,{children:"docker.io"})," is ",(0,t.jsx)(r.code,{children:"https://index.docker.io/v2"}),"."]}),"\n",(0,t.jsxs)(r.li,{children:["The default endpoint for all other registries is ",(0,t.jsx)(r.code,{children:"https:///v2"}),", where ",(0,t.jsx)(r.code,{children:""})," is the registry hostname and optional port."]}),"\n"]}),"\n",(0,t.jsxs)(r.p,{children:["In order to be recognized as a registry, the first component of the image name must contain at least one period or colon.\nFor historical reasons, images without a registry specified in their name are implicitly identified as being from ",(0,t.jsx)(r.code,{children:"docker.io"}),"."]}),"\n",(0,t.jsx)(r.admonition,{title:"Version Gate",type:"info",children:(0,t.jsxs)(r.p,{children:["The ",(0,t.jsx)(r.code,{children:"--disable-default-registry-endpoint"})," option is available as an experimental feature as of January 2024 releases: v1.26.13+k3s1, v1.27.10+k3s1, v1.28.6+k3s1, v1.29.1+k3s1"]})}),"\n",(0,t.jsxs)(r.p,{children:["Nodes may be started with the ",(0,t.jsx)(r.code,{children:"--disable-default-registry-endpoint"})," option.\nWhen this is set, containerd will not fall back to the default registry endpoint, and will only pull from configured mirror endpoints,\nalong with the distributed registry if it is enabled."]}),"\n",(0,t.jsx)(r.p,{children:"This may be desired if your cluster is in a true air-gapped environment where the upstream registry is not available,\nor if you wish to have only some nodes pull from the upstream registry."}),"\n",(0,t.jsxs)(r.p,{children:["Disabling the default registry endpoint applies only to registries configured via ",(0,t.jsx)(r.code,{children:"registries.yaml"}),".\nIf the registry is not explicitly configured via mirror entry in ",(0,t.jsx)(r.code,{children:"registries.yaml"}),", the default fallback behavior will still be used."]}),"\n",(0,t.jsx)(r.h2,{id:"registries-configuration-file",children:"Registries Configuration File"}),"\n",(0,t.jsx)(r.p,{children:"The file consists of two top-level keys, with subkeys for each registry:"}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-yaml",children:"mirrors:\n :\n endpoint:\n - https:///v2\nconfigs:\n :\n auth:\n username: \n password: \n token: \n tls:\n ca_file: \n cert_file: \n key_file: \n insecure_skip_verify: \n"})}),"\n",(0,t.jsx)(r.h3,{id:"mirrors",children:"Mirrors"}),"\n",(0,t.jsx)(r.p,{children:"The mirrors section defines the names and endpoints of registries, for example:"}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{children:'mirrors:\n registry.example.com:\n endpoint:\n - "https://registry.example.com:5000"\n'})}),"\n",(0,t.jsx)(r.p,{children:"Each mirror must have a name and set of endpoints. When pulling an image from a registry, containerd will try these endpoint URLs, plus the default endpoint, and use the first working one."}),"\n",(0,t.jsx)(r.h4,{id:"redirects",children:"Redirects"}),"\n",(0,t.jsxs)(r.p,{children:["If the private registry is used as a mirror for another registry, such as when configuring a ",(0,t.jsx)(r.a,{href:"https://docs.docker.com/registry/recipes/mirror/",children:"pull through cache"}),",\nimages pulls are transparently redirected to the listed endpoints. The original registry name is passed to the mirror endpoint via the ",(0,t.jsx)(r.code,{children:"ns"})," query parameter."]}),"\n",(0,t.jsxs)(r.p,{children:["For example, if you have a mirror configured for ",(0,t.jsx)(r.code,{children:"docker.io"}),":"]}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-yaml",children:'mirrors:\n docker.io:\n endpoint:\n - "https://registry.example.com:5000"\n'})}),"\n",(0,t.jsxs)(r.p,{children:["Then pulling ",(0,t.jsx)(r.code,{children:"docker.io/rancher/mirrored-pause:3.6"})," will transparently pull the image as ",(0,t.jsx)(r.code,{children:"registry.example.com:5000/rancher/mirrored-pause:3.6"}),"."]}),"\n",(0,t.jsx)(r.h4,{id:"rewrites",children:"Rewrites"}),"\n",(0,t.jsx)(r.p,{children:"Each mirror can have a set of rewrites. Rewrites can change the name of an image based on regular expressions.\nThis is useful if the organization/project structure in the private registry is different than the registry it is mirroring."}),"\n",(0,t.jsxs)(r.p,{children:["For example, the following configuration would transparently pull the image ",(0,t.jsx)(r.code,{children:"docker.io/rancher/mirrored-pause:3.6"})," as ",(0,t.jsx)(r.code,{children:"registry.example.com:5000/mirrorproject/rancher-images/mirrored-pause:3.6"}),":"]}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{children:'mirrors:\n docker.io:\n endpoint:\n - "https://registry.example.com:5000"\n rewrite:\n "^rancher/(.*)": "mirrorproject/rancher-images/$1"\n'})}),"\n",(0,t.jsxs)(r.p,{children:["When using redirects and rewrites, images will still be stored under the original name.\nFor example, ",(0,t.jsx)(r.code,{children:"crictl image ls"})," will show ",(0,t.jsx)(r.code,{children:"docker.io/rancher/mirrored-pause:3.6"})," as available on the node, even though the image was pulled from the mirrored registry with a different name."]}),"\n",(0,t.jsx)(r.h3,{id:"configs",children:"Configs"}),"\n",(0,t.jsxs)(r.p,{children:["The ",(0,t.jsx)(r.code,{children:"configs"})," section defines the TLS and credential configuration for each mirror. For each mirror you can define ",(0,t.jsx)(r.code,{children:"auth"})," and/or ",(0,t.jsx)(r.code,{children:"tls"}),"."]}),"\n",(0,t.jsxs)(r.p,{children:["The ",(0,t.jsx)(r.code,{children:"tls"})," part consists of:"]}),"\n",(0,t.jsxs)(r.table,{children:[(0,t.jsx)(r.thead,{children:(0,t.jsxs)(r.tr,{children:[(0,t.jsx)(r.th,{children:"Directive"}),(0,t.jsx)(r.th,{children:"Description"})]})}),(0,t.jsxs)(r.tbody,{children:[(0,t.jsxs)(r.tr,{children:[(0,t.jsx)(r.td,{children:(0,t.jsx)(r.code,{children:"cert_file"})}),(0,t.jsx)(r.td,{children:"The client certificate path that will be used to authenticate with the registry"})]}),(0,t.jsxs)(r.tr,{children:[(0,t.jsx)(r.td,{children:(0,t.jsx)(r.code,{children:"key_file"})}),(0,t.jsx)(r.td,{children:"The client key path that will be used to authenticate with the registry"})]}),(0,t.jsxs)(r.tr,{children:[(0,t.jsx)(r.td,{children:(0,t.jsx)(r.code,{children:"ca_file"})}),(0,t.jsx)(r.td,{children:"Defines the CA certificate path to be used to verify the registry's server cert file"})]}),(0,t.jsxs)(r.tr,{children:[(0,t.jsx)(r.td,{children:(0,t.jsx)(r.code,{children:"insecure_skip_verify"})}),(0,t.jsx)(r.td,{children:"Boolean that defines if TLS verification should be skipped for the registry"})]})]})]}),"\n",(0,t.jsxs)(r.p,{children:["The ",(0,t.jsx)(r.code,{children:"auth"})," part consists of either username/password or authentication token:"]}),"\n",(0,t.jsxs)(r.table,{children:[(0,t.jsx)(r.thead,{children:(0,t.jsxs)(r.tr,{children:[(0,t.jsx)(r.th,{children:"Directive"}),(0,t.jsx)(r.th,{children:"Description"})]})}),(0,t.jsxs)(r.tbody,{children:[(0,t.jsxs)(r.tr,{children:[(0,t.jsx)(r.td,{children:(0,t.jsx)(r.code,{children:"username"})}),(0,t.jsx)(r.td,{children:"user name of the private registry basic auth"})]}),(0,t.jsxs)(r.tr,{children:[(0,t.jsx)(r.td,{children:(0,t.jsx)(r.code,{children:"password"})}),(0,t.jsx)(r.td,{children:"user password of the private registry basic auth"})]}),(0,t.jsxs)(r.tr,{children:[(0,t.jsx)(r.td,{children:(0,t.jsx)(r.code,{children:"auth"})}),(0,t.jsx)(r.td,{children:"authentication token of the private registry basic auth"})]})]})]}),"\n",(0,t.jsx)(r.p,{children:"Below are basic examples of using private registries in different modes:"}),"\n",(0,t.jsx)(r.h3,{id:"wildcard-support",children:"Wildcard Support"}),"\n",(0,t.jsx)(r.admonition,{title:"Version Gate",type:"info",children:(0,t.jsx)(r.p,{children:"Wildcard support is available as of the March 2024 releases: v1.26.15+k3s1, v1.27.12+k3s1, v1.28.8+k3s1, v1.29.3+k3s1"})}),"\n",(0,t.jsxs)(r.p,{children:["The ",(0,t.jsx)(r.code,{children:'"*"'})," wildcard entry can be used in the ",(0,t.jsx)(r.code,{children:"mirrors"})," and ",(0,t.jsx)(r.code,{children:"configs"})," sections to provide default configuration for all registries.\nThe default configuration will only be used if there is no specific entry for that registry. Note that the asterisk MUST be quoted."]}),"\n",(0,t.jsxs)(r.p,{children:["In the following example, a local registry mirror will be used for all registries. TLS verification will be disabled for all registries, except ",(0,t.jsx)(r.code,{children:"docker.io"}),"."]}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-yaml",children:'mirrors:\n "*":\n endpoint:\n - "https://registry.example.com:5000"\nconfigs:\n "docker.io":\n "*":\n tls:\n insecure_skip_verify: true\n'})}),"\n",(0,t.jsx)(r.h3,{id:"with-tls",children:"With TLS"}),"\n",(0,t.jsxs)(r.p,{children:["Below are examples showing how you may configure ",(0,t.jsx)(r.code,{children:"/etc/rancher/k3s/registries.yaml"})," on each node when using TLS."]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)(i,{value:"With Authentication",children:(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-yaml",children:'mirrors:\n docker.io:\n endpoint:\n - "https://registry.example.com:5000"\nconfigs:\n "registry.example.com:5000":\n auth:\n username: xxxxxx # this is the registry username\n password: xxxxxx # this is the registry password\n tls:\n cert_file: # path to the cert file used in the registry\n key_file: # path to the key file used in the registry\n ca_file: # path to the ca file used in the registry\n'})})}),(0,t.jsx)(i,{value:"Without Authentication",children:(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-yaml",children:'mirrors:\n docker.io:\n endpoint:\n - "https://registry.example.com:5000"\nconfigs:\n "registry.example.com:5000":\n tls:\n cert_file: # path to the cert file used in the registry\n key_file: # path to the key file used in the registry\n ca_file: # path to the ca file used in the registry\n'})})})]}),"\n",(0,t.jsx)(r.h3,{id:"without-tls",children:"Without TLS"}),"\n",(0,t.jsxs)(r.p,{children:["Below are examples showing how you may configure ",(0,t.jsx)(r.code,{children:"/etc/rancher/k3s/registries.yaml"})," on each node when ",(0,t.jsx)(r.em,{children:"not"})," using TLS."]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)(i,{value:"With Authentication",children:(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-yaml",children:'mirrors:\n docker.io:\n endpoint:\n - "http://registry.example.com:5000"\nconfigs:\n "registry.example.com:5000":\n auth:\n username: xxxxxx # this is the registry username\n password: xxxxxx # this is the registry password\n'})})}),(0,t.jsx)(i,{value:"Without Authentication",children:(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-yaml",children:'mirrors:\n docker.io:\n endpoint:\n - "http://registry.example.com:5000"\n'})})})]}),"\n",(0,t.jsxs)(r.blockquote,{children:["\n",(0,t.jsxs)(r.p,{children:["In case of no TLS communication, you need to specify ",(0,t.jsx)(r.code,{children:"http://"})," for the endpoints, otherwise it will default to https."]}),"\n"]}),"\n",(0,t.jsx)(r.p,{children:"In order for the registry changes to take effect, you need to restart K3s on each node."}),"\n",(0,t.jsx)(r.h2,{id:"troubleshooting-image-pulls",children:"Troubleshooting Image Pulls"}),"\n",(0,t.jsx)(r.p,{children:"When Kubernetes experiences problems pulling an image, the error displayed by the kubelet may only reflect the terminal error returned\nby the pull attempt made against the default endpoint, making it appear that the configured endpoints are not being used."}),"\n",(0,t.jsxs)(r.p,{children:["Check the containerd log on the node at ",(0,t.jsx)(r.code,{children:"/var/lib/rancher/k3s/agent/containerd/containerd.log"})," for detailed information on the root cause of the failure."]}),"\n",(0,t.jsx)(r.h2,{id:"adding-images-to-the-private-registry",children:"Adding Images to the Private Registry"}),"\n",(0,t.jsxs)(r.p,{children:["Mirroring images to a private registry requires a host with Docker or other 3rd party tooling that is capable of pulling and pushing images.",(0,t.jsx)(r.br,{}),"\n","The steps below assume you have a host with dockerd and the docker CLI tools, and access to both docker.io and your private registry."]}),"\n",(0,t.jsxs)(r.ol,{children:["\n",(0,t.jsxs)(r.li,{children:["Obtain the ",(0,t.jsx)(r.code,{children:"k3s-images.txt"})," file from GitHub for the release you are working with."]}),"\n",(0,t.jsxs)(r.li,{children:["Pull each of the K3s images listed on the k3s-images.txt file from docker.io.",(0,t.jsx)(r.br,{}),"\n","Example: ",(0,t.jsx)(r.code,{children:"docker pull docker.io/rancher/mirrored-pause:3.6"})]}),"\n",(0,t.jsxs)(r.li,{children:["Retag the images to the private registry.",(0,t.jsx)(r.br,{}),"\n","Example: ",(0,t.jsx)(r.code,{children:"docker tag docker.io/rancher/mirrored-pause:3.6 registry.example.com:5000/rancher/mirrored-pause:3.6"})]}),"\n",(0,t.jsxs)(r.li,{children:["Push the images to the private registry.",(0,t.jsx)(r.br,{}),"\n","Example: ",(0,t.jsx)(r.code,{children:"docker push registry.example.com:5000/rancher/mirrored-pause:3.6"})]}),"\n"]})]})}function h(e={}){const{wrapper:r}={...(0,n.a)(),...e.components};return r?(0,t.jsx)(r,{...e,children:(0,t.jsx)(c,{...e})}):c(e)}function p(e,r){throw new Error("Expected "+(r?"component":"object")+" `"+e+"` to be defined: you likely forgot to import, pass, or provide it.")}},1151:(e,r,i)=>{i.d(r,{Z:()=>a,a:()=>o});var t=i(7294);const n={},s=t.createContext(n);function o(e){const r=t.useContext(s);return t.useMemo((function(){return"function"==typeof e?e(r):{...r,...e}}),[r,e])}function a(e){let r;return r=e.disableParentContext?"function"==typeof e.components?e.components(n):e.components||n:o(e.components),t.createElement(s.Provider,{value:r},e.children)}}}]); \ No newline at end of file +"use strict";(self.webpackChunkk_3_s_docs=self.webpackChunkk_3_s_docs||[]).push([[4902],{8040:(e,r,i)=>{i.r(r),i.d(r,{assets:()=>l,contentTitle:()=>o,default:()=>h,frontMatter:()=>s,metadata:()=>a,toc:()=>d});var t=i(5893),n=i(1151);const s={title:"Private Registry Configuration"},o=void 0,a={id:"installation/private-registry",title:"Private Registry Configuration",description:"Containerd can be configured to connect to private registries and use them to pull images as needed by the kubelet.",source:"@site/docs/installation/private-registry.md",sourceDirName:"installation",slug:"/installation/private-registry",permalink:"/installation/private-registry",draft:!1,unlisted:!1,editUrl:"https://github.com/k3s-io/docs/edit/main/docs/installation/private-registry.md",tags:[],version:"current",lastUpdatedAt:1723747404e3,frontMatter:{title:"Private Registry Configuration"},sidebar:"mySidebar",previous:{title:"Configuration Options",permalink:"/installation/configuration"},next:{title:"Embedded Registry Mirror",permalink:"/installation/registry-mirror"}},l={},d=[{value:"Default Endpoint Fallback",id:"default-endpoint-fallback",level:2},{value:"Registries Configuration File",id:"registries-configuration-file",level:2},{value:"Mirrors",id:"mirrors",level:3},{value:"Redirects",id:"redirects",level:4},{value:"Rewrites",id:"rewrites",level:4},{value:"Configs",id:"configs",level:3},{value:"Wildcard Support",id:"wildcard-support",level:3},{value:"With TLS",id:"with-tls",level:3},{value:"Without TLS",id:"without-tls",level:3},{value:"Troubleshooting Image Pulls",id:"troubleshooting-image-pulls",level:2},{value:"Adding Images to the Private Registry",id:"adding-images-to-the-private-registry",level:2}];function c(e){const r={a:"a",admonition:"admonition",blockquote:"blockquote",br:"br",code:"code",em:"em",h2:"h2",h3:"h3",h4:"h4",li:"li",ol:"ol",p:"p",pre:"pre",table:"table",tbody:"tbody",td:"td",th:"th",thead:"thead",tr:"tr",ul:"ul",...(0,n.a)(),...e.components},{TabItem:i,Tabs:s}=r;return i||p("TabItem",!0),s||p("Tabs",!0),(0,t.jsxs)(t.Fragment,{children:[(0,t.jsx)(r.p,{children:"Containerd can be configured to connect to private registries and use them to pull images as needed by the kubelet."}),"\n",(0,t.jsxs)(r.p,{children:["Upon startup, K3s will check to see if ",(0,t.jsx)(r.code,{children:"/etc/rancher/k3s/registries.yaml"})," exists. If so, the registry configuration contained in this file is used when generating the containerd configuration."]}),"\n",(0,t.jsxs)(r.ul,{children:["\n",(0,t.jsxs)(r.li,{children:["If you want to use a private registry as a mirror for a public registry such as docker.io, then you will need to configure ",(0,t.jsx)(r.code,{children:"registries.yaml"})," on each node that you want to use the mirror."]}),"\n",(0,t.jsxs)(r.li,{children:["If your private registry requires authentication, uses custom TLS certificates, or does not use TLS, you will need to configure ",(0,t.jsx)(r.code,{children:"registries.yaml"})," on each node that will pull images from your registry."]}),"\n"]}),"\n",(0,t.jsxs)(r.p,{children:["Note that server nodes are schedulable by default. If you have not tainted the server nodes and will be running workloads on them,\nplease ensure you also create the ",(0,t.jsx)(r.code,{children:"registries.yaml"})," file on each server as well."]}),"\n",(0,t.jsx)(r.h2,{id:"default-endpoint-fallback",children:"Default Endpoint Fallback"}),"\n",(0,t.jsxs)(r.p,{children:['Containerd has an implicit "default endpoint" for all registries.\nThe default endpoint is always tried as a last resort, even if there are other endpoints listed for that registry in ',(0,t.jsx)(r.code,{children:"registries.yaml"}),".\nFor example, when pulling ",(0,t.jsx)(r.code,{children:"registry.example.com:5000/rancher/mirrored-pause:3.6"}),", containerd will use a default endpoint of ",(0,t.jsx)(r.code,{children:"https://registry.example.com:5000/v2"}),"."]}),"\n",(0,t.jsxs)(r.ul,{children:["\n",(0,t.jsxs)(r.li,{children:["The default endpoint for ",(0,t.jsx)(r.code,{children:"docker.io"})," is ",(0,t.jsx)(r.code,{children:"https://index.docker.io/v2"}),"."]}),"\n",(0,t.jsxs)(r.li,{children:["The default endpoint for all other registries is ",(0,t.jsx)(r.code,{children:"https:///v2"}),", where ",(0,t.jsx)(r.code,{children:""})," is the registry hostname and optional port."]}),"\n"]}),"\n",(0,t.jsxs)(r.p,{children:["In order to be recognized as a registry, the first component of the image name must contain at least one period or colon.\nFor historical reasons, images without a registry specified in their name are implicitly identified as being from ",(0,t.jsx)(r.code,{children:"docker.io"}),"."]}),"\n",(0,t.jsx)(r.admonition,{title:"Version Gate",type:"info",children:(0,t.jsxs)(r.p,{children:["The ",(0,t.jsx)(r.code,{children:"--disable-default-registry-endpoint"})," option is available as an experimental feature as of January 2024 releases: v1.26.13+k3s1, v1.27.10+k3s1, v1.28.6+k3s1, v1.29.1+k3s1"]})}),"\n",(0,t.jsxs)(r.p,{children:["Nodes may be started with the ",(0,t.jsx)(r.code,{children:"--disable-default-registry-endpoint"})," option.\nWhen this is set, containerd will not fall back to the default registry endpoint, and will only pull from configured mirror endpoints,\nalong with the distributed registry if it is enabled."]}),"\n",(0,t.jsx)(r.p,{children:"This may be desired if your cluster is in a true air-gapped environment where the upstream registry is not available,\nor if you wish to have only some nodes pull from the upstream registry."}),"\n",(0,t.jsxs)(r.p,{children:["Disabling the default registry endpoint applies only to registries configured via ",(0,t.jsx)(r.code,{children:"registries.yaml"}),".\nIf the registry is not explicitly configured via mirror entry in ",(0,t.jsx)(r.code,{children:"registries.yaml"}),", the default fallback behavior will still be used."]}),"\n",(0,t.jsx)(r.h2,{id:"registries-configuration-file",children:"Registries Configuration File"}),"\n",(0,t.jsx)(r.p,{children:"The file consists of two top-level keys, with subkeys for each registry:"}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-yaml",children:"mirrors:\n :\n endpoint:\n - https:///v2\nconfigs:\n :\n auth:\n username: \n password: \n token: \n tls:\n ca_file: \n cert_file: \n key_file: \n insecure_skip_verify: \n"})}),"\n",(0,t.jsx)(r.h3,{id:"mirrors",children:"Mirrors"}),"\n",(0,t.jsx)(r.p,{children:"The mirrors section defines the names and endpoints of registries, for example:"}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{children:'mirrors:\n registry.example.com:\n endpoint:\n - "https://registry.example.com:5000"\n'})}),"\n",(0,t.jsx)(r.p,{children:"Each mirror must have a name and set of endpoints. When pulling an image from a registry, containerd will try these endpoint URLs, plus the default endpoint, and use the first working one."}),"\n",(0,t.jsx)(r.h4,{id:"redirects",children:"Redirects"}),"\n",(0,t.jsxs)(r.p,{children:["If the private registry is used as a mirror for another registry, such as when configuring a ",(0,t.jsx)(r.a,{href:"https://docs.docker.com/registry/recipes/mirror/",children:"pull through cache"}),",\nimages pulls are transparently redirected to the listed endpoints. The original registry name is passed to the mirror endpoint via the ",(0,t.jsx)(r.code,{children:"ns"})," query parameter."]}),"\n",(0,t.jsxs)(r.p,{children:["For example, if you have a mirror configured for ",(0,t.jsx)(r.code,{children:"docker.io"}),":"]}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-yaml",children:'mirrors:\n docker.io:\n endpoint:\n - "https://registry.example.com:5000"\n'})}),"\n",(0,t.jsxs)(r.p,{children:["Then pulling ",(0,t.jsx)(r.code,{children:"docker.io/rancher/mirrored-pause:3.6"})," will transparently pull the image as ",(0,t.jsx)(r.code,{children:"registry.example.com:5000/rancher/mirrored-pause:3.6"}),"."]}),"\n",(0,t.jsx)(r.h4,{id:"rewrites",children:"Rewrites"}),"\n",(0,t.jsx)(r.p,{children:"Each mirror can have a set of rewrites. Rewrites can change the name of an image based on regular expressions.\nThis is useful if the organization/project structure in the private registry is different than the registry it is mirroring."}),"\n",(0,t.jsxs)(r.p,{children:["For example, the following configuration would transparently pull the image ",(0,t.jsx)(r.code,{children:"docker.io/rancher/mirrored-pause:3.6"})," as ",(0,t.jsx)(r.code,{children:"registry.example.com:5000/mirrorproject/rancher-images/mirrored-pause:3.6"}),":"]}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{children:'mirrors:\n docker.io:\n endpoint:\n - "https://registry.example.com:5000"\n rewrite:\n "^rancher/(.*)": "mirrorproject/rancher-images/$1"\n'})}),"\n",(0,t.jsxs)(r.p,{children:["When using redirects and rewrites, images will still be stored under the original name.\nFor example, ",(0,t.jsx)(r.code,{children:"crictl image ls"})," will show ",(0,t.jsx)(r.code,{children:"docker.io/rancher/mirrored-pause:3.6"})," as available on the node, even though the image was pulled from the mirrored registry with a different name."]}),"\n",(0,t.jsx)(r.h3,{id:"configs",children:"Configs"}),"\n",(0,t.jsxs)(r.p,{children:["The ",(0,t.jsx)(r.code,{children:"configs"})," section defines the TLS and credential configuration for each mirror. For each mirror you can define ",(0,t.jsx)(r.code,{children:"auth"})," and/or ",(0,t.jsx)(r.code,{children:"tls"}),"."]}),"\n",(0,t.jsxs)(r.p,{children:["The ",(0,t.jsx)(r.code,{children:"tls"})," part consists of:"]}),"\n",(0,t.jsxs)(r.table,{children:[(0,t.jsx)(r.thead,{children:(0,t.jsxs)(r.tr,{children:[(0,t.jsx)(r.th,{children:"Directive"}),(0,t.jsx)(r.th,{children:"Description"})]})}),(0,t.jsxs)(r.tbody,{children:[(0,t.jsxs)(r.tr,{children:[(0,t.jsx)(r.td,{children:(0,t.jsx)(r.code,{children:"cert_file"})}),(0,t.jsx)(r.td,{children:"The client certificate path that will be used to authenticate with the registry"})]}),(0,t.jsxs)(r.tr,{children:[(0,t.jsx)(r.td,{children:(0,t.jsx)(r.code,{children:"key_file"})}),(0,t.jsx)(r.td,{children:"The client key path that will be used to authenticate with the registry"})]}),(0,t.jsxs)(r.tr,{children:[(0,t.jsx)(r.td,{children:(0,t.jsx)(r.code,{children:"ca_file"})}),(0,t.jsx)(r.td,{children:"Defines the CA certificate path to be used to verify the registry's server cert file"})]}),(0,t.jsxs)(r.tr,{children:[(0,t.jsx)(r.td,{children:(0,t.jsx)(r.code,{children:"insecure_skip_verify"})}),(0,t.jsx)(r.td,{children:"Boolean that defines if TLS verification should be skipped for the registry"})]})]})]}),"\n",(0,t.jsxs)(r.p,{children:["The ",(0,t.jsx)(r.code,{children:"auth"})," part consists of either username/password or authentication token:"]}),"\n",(0,t.jsxs)(r.table,{children:[(0,t.jsx)(r.thead,{children:(0,t.jsxs)(r.tr,{children:[(0,t.jsx)(r.th,{children:"Directive"}),(0,t.jsx)(r.th,{children:"Description"})]})}),(0,t.jsxs)(r.tbody,{children:[(0,t.jsxs)(r.tr,{children:[(0,t.jsx)(r.td,{children:(0,t.jsx)(r.code,{children:"username"})}),(0,t.jsx)(r.td,{children:"user name of the private registry basic auth"})]}),(0,t.jsxs)(r.tr,{children:[(0,t.jsx)(r.td,{children:(0,t.jsx)(r.code,{children:"password"})}),(0,t.jsx)(r.td,{children:"user password of the private registry basic auth"})]}),(0,t.jsxs)(r.tr,{children:[(0,t.jsx)(r.td,{children:(0,t.jsx)(r.code,{children:"auth"})}),(0,t.jsx)(r.td,{children:"authentication token of the private registry basic auth"})]})]})]}),"\n",(0,t.jsx)(r.p,{children:"Below are basic examples of using private registries in different modes:"}),"\n",(0,t.jsx)(r.h3,{id:"wildcard-support",children:"Wildcard Support"}),"\n",(0,t.jsx)(r.admonition,{title:"Version Gate",type:"info",children:(0,t.jsx)(r.p,{children:"Wildcard support is available as of the March 2024 releases: v1.26.15+k3s1, v1.27.12+k3s1, v1.28.8+k3s1, v1.29.3+k3s1"})}),"\n",(0,t.jsxs)(r.p,{children:["The ",(0,t.jsx)(r.code,{children:'"*"'})," wildcard entry can be used in the ",(0,t.jsx)(r.code,{children:"mirrors"})," and ",(0,t.jsx)(r.code,{children:"configs"})," sections to provide default configuration for all registries.\nThe default configuration will only be used if there is no specific entry for that registry. Note that the asterisk MUST be quoted."]}),"\n",(0,t.jsxs)(r.p,{children:["In the following example, a local registry mirror will be used for all registries. TLS verification will be disabled for all registries, except ",(0,t.jsx)(r.code,{children:"docker.io"}),"."]}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-yaml",children:'mirrors:\n "*":\n endpoint:\n - "https://registry.example.com:5000"\nconfigs:\n "docker.io":\n "*":\n tls:\n insecure_skip_verify: true\n'})}),"\n",(0,t.jsx)(r.h3,{id:"with-tls",children:"With TLS"}),"\n",(0,t.jsxs)(r.p,{children:["Below are examples showing how you may configure ",(0,t.jsx)(r.code,{children:"/etc/rancher/k3s/registries.yaml"})," on each node when using TLS."]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)(i,{value:"With Authentication",children:(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-yaml",children:'mirrors:\n docker.io:\n endpoint:\n - "https://registry.example.com:5000"\nconfigs:\n "registry.example.com:5000":\n auth:\n username: xxxxxx # this is the registry username\n password: xxxxxx # this is the registry password\n tls:\n cert_file: # path to the cert file used in the registry\n key_file: # path to the key file used in the registry\n ca_file: # path to the ca file used in the registry\n'})})}),(0,t.jsx)(i,{value:"Without Authentication",children:(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-yaml",children:'mirrors:\n docker.io:\n endpoint:\n - "https://registry.example.com:5000"\nconfigs:\n "registry.example.com:5000":\n tls:\n cert_file: # path to the cert file used in the registry\n key_file: # path to the key file used in the registry\n ca_file: # path to the ca file used in the registry\n'})})})]}),"\n",(0,t.jsx)(r.h3,{id:"without-tls",children:"Without TLS"}),"\n",(0,t.jsxs)(r.p,{children:["Below are examples showing how you may configure ",(0,t.jsx)(r.code,{children:"/etc/rancher/k3s/registries.yaml"})," on each node when ",(0,t.jsx)(r.em,{children:"not"})," using TLS."]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)(i,{value:"With Authentication",children:(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-yaml",children:'mirrors:\n docker.io:\n endpoint:\n - "http://registry.example.com:5000"\nconfigs:\n "registry.example.com:5000":\n auth:\n username: xxxxxx # this is the registry username\n password: xxxxxx # this is the registry password\n'})})}),(0,t.jsx)(i,{value:"Without Authentication",children:(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-yaml",children:'mirrors:\n docker.io:\n endpoint:\n - "http://registry.example.com:5000"\n'})})})]}),"\n",(0,t.jsxs)(r.blockquote,{children:["\n",(0,t.jsxs)(r.p,{children:["In case of no TLS communication, you need to specify ",(0,t.jsx)(r.code,{children:"http://"})," for the endpoints, otherwise it will default to https."]}),"\n"]}),"\n",(0,t.jsx)(r.p,{children:"In order for the registry changes to take effect, you need to restart K3s on each node."}),"\n",(0,t.jsx)(r.h2,{id:"troubleshooting-image-pulls",children:"Troubleshooting Image Pulls"}),"\n",(0,t.jsx)(r.p,{children:"When Kubernetes experiences problems pulling an image, the error displayed by the kubelet may only reflect the terminal error returned\nby the pull attempt made against the default endpoint, making it appear that the configured endpoints are not being used."}),"\n",(0,t.jsxs)(r.p,{children:["Check the containerd log on the node at ",(0,t.jsx)(r.code,{children:"/var/lib/rancher/k3s/agent/containerd/containerd.log"})," for detailed information on the root cause of the failure."]}),"\n",(0,t.jsx)(r.h2,{id:"adding-images-to-the-private-registry",children:"Adding Images to the Private Registry"}),"\n",(0,t.jsxs)(r.p,{children:["Mirroring images to a private registry requires a host with Docker or other 3rd party tooling that is capable of pulling and pushing images.",(0,t.jsx)(r.br,{}),"\n","The steps below assume you have a host with dockerd and the docker CLI tools, and access to both docker.io and your private registry."]}),"\n",(0,t.jsxs)(r.ol,{children:["\n",(0,t.jsxs)(r.li,{children:["Obtain the ",(0,t.jsx)(r.code,{children:"k3s-images.txt"})," file from GitHub for the release you are working with."]}),"\n",(0,t.jsxs)(r.li,{children:["Pull each of the K3s images listed on the k3s-images.txt file from docker.io.",(0,t.jsx)(r.br,{}),"\n","Example: ",(0,t.jsx)(r.code,{children:"docker pull docker.io/rancher/mirrored-pause:3.6"})]}),"\n",(0,t.jsxs)(r.li,{children:["Retag the images to the private registry.",(0,t.jsx)(r.br,{}),"\n","Example: ",(0,t.jsx)(r.code,{children:"docker tag docker.io/rancher/mirrored-pause:3.6 registry.example.com:5000/rancher/mirrored-pause:3.6"})]}),"\n",(0,t.jsxs)(r.li,{children:["Push the images to the private registry.",(0,t.jsx)(r.br,{}),"\n","Example: ",(0,t.jsx)(r.code,{children:"docker push registry.example.com:5000/rancher/mirrored-pause:3.6"})]}),"\n"]})]})}function h(e={}){const{wrapper:r}={...(0,n.a)(),...e.components};return r?(0,t.jsx)(r,{...e,children:(0,t.jsx)(c,{...e})}):c(e)}function p(e,r){throw new Error("Expected "+(r?"component":"object")+" `"+e+"` to be defined: you likely forgot to import, pass, or provide it.")}},1151:(e,r,i)=>{i.d(r,{Z:()=>a,a:()=>o});var t=i(7294);const n={},s=t.createContext(n);function o(e){const r=t.useContext(s);return t.useMemo((function(){return"function"==typeof e?e(r):{...r,...e}}),[r,e])}function a(e){let r;return r=e.disableParentContext?"function"==typeof e.components?e.components(n):e.components||n:o(e.components),t.createElement(s.Provider,{value:r},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/17035653.1e012ca4.js b/assets/js/17035653.429e9619.js similarity index 99% rename from assets/js/17035653.1e012ca4.js rename to assets/js/17035653.429e9619.js index a06fa51c7..6c49ac191 100644 --- a/assets/js/17035653.1e012ca4.js +++ b/assets/js/17035653.429e9619.js @@ -1 +1 @@ -"use strict";(self.webpackChunkk_3_s_docs=self.webpackChunkk_3_s_docs||[]).push([[8380],{4877:(e,n,t)=>{t.r(n),t.d(n,{assets:()=>o,contentTitle:()=>l,default:()=>d,frontMatter:()=>r,metadata:()=>a,toc:()=>u});var s=t(5893),i=t(1151);const r={title:"Multus and IPAM plugins"},l=void 0,a={id:"networking/multus-ipams",title:"Multus and IPAM plugins",description:"Multus CNI is a CNI plugin that enables attaching multiple network interfaces to pods. Multus does not replace CNI plugins, instead it acts as a CNI plugin multiplexer. Multus is useful in certain use cases, especially when pods are network intensive and require extra network interfaces that support dataplane acceleration techniques such as SR-IOV.",source:"@site/docs/networking/multus-ipams.md",sourceDirName:"networking",slug:"/networking/multus-ipams",permalink:"/networking/multus-ipams",draft:!1,unlisted:!1,editUrl:"https://github.com/k3s-io/docs/edit/main/docs/networking/multus-ipams.md",tags:[],version:"current",lastUpdatedAt:1723651727e3,frontMatter:{title:"Multus and IPAM plugins"},sidebar:"mySidebar",previous:{title:"Distributed hybrid or multicloud cluster",permalink:"/networking/distributed-multicloud"},next:{title:"Networking Services",permalink:"/networking/networking-services"}},o={},u=[{value:"Add the Helm Repository",id:"add-the-helm-repository",level:3},{value:"Configure the IPAM plugin",id:"configure-the-ipam-plugin",level:3},{value:"Deploy Multus",id:"deploy-multus",level:3}];function c(e){const n={a:"a",code:"code",h3:"h3",p:"p",pre:"pre",...(0,i.a)(),...e.components},{TabItem:t,Tabs:r}=n;return t||h("TabItem",!0),r||h("Tabs",!0),(0,s.jsxs)(s.Fragment,{children:[(0,s.jsxs)(n.p,{children:[(0,s.jsx)(n.a,{href:"https://github.com/k8snetworkplumbingwg/multus-cni",children:"Multus CNI"})," is a CNI plugin that enables attaching multiple network interfaces to pods. Multus does not replace CNI plugins, instead it acts as a CNI plugin multiplexer. Multus is useful in certain use cases, especially when pods are network intensive and require extra network interfaces that support dataplane acceleration techniques such as SR-IOV."]}),"\n",(0,s.jsx)(n.p,{children:"Multus can not be deployed standalone. It always requires at least one conventional CNI plugin that fulfills the Kubernetes cluster network requirements. That CNI plugin becomes the default for Multus, and will be used to provide the primary interface for all pods. When deploying K3s with default options, that CNI plugin is Flannel."}),"\n",(0,s.jsx)(n.h3,{id:"add-the-helm-repository",children:"Add the Helm Repository"}),"\n",(0,s.jsx)(n.p,{children:"To deploy Multus, we recommend using the following helm repo:"}),"\n",(0,s.jsx)(n.pre,{children:(0,s.jsx)(n.code,{children:"helm repo add rke2-charts https://rke2-charts.rancher.io\nhelm repo update\n"})}),"\n",(0,s.jsx)(n.h3,{id:"configure-the-ipam-plugin",children:"Configure the IPAM plugin"}),"\n",(0,s.jsx)(n.p,{children:"An IPAM plugin is required to assign IP addresses on the extra interfaces created by Multus."}),"\n",(0,s.jsxs)(r,{groupId:"MultusIPAMplugins",children:[(0,s.jsxs)(t,{value:"host-local",default:!0,children:[(0,s.jsxs)(n.p,{children:["The host-local IPAM plugin allocates ip addresses out of a set of address ranges. It stores the state locally on the host filesystem, hence ensuring uniqueness of IP addresses on a single host. Therefore, we don't recommend it for multi-node clusters. This IPAM plugin does not require any extra deployment. For more information: ",(0,s.jsx)(n.a,{href:"https://www.cni.dev/plugins/current/ipam/host-local/",children:"https://www.cni.dev/plugins/current/ipam/host-local/"}),"."]}),(0,s.jsxs)(n.p,{children:["To use the host-local plugin, please create a file called ",(0,s.jsx)(n.code,{children:"multus-values.yaml"})," with the following content:"]}),(0,s.jsx)(n.pre,{children:(0,s.jsx)(n.code,{children:"config:\n cni_conf:\n confDir: /var/lib/rancher/k3s/agent/etc/cni/net.d\n binDir: /var/lib/rancher/k3s/data/current/bin/\n kubeconfig: /var/lib/rancher/k3s/agent/etc/cni/net.d/multus.d/multus.kubeconfig\n"})})]}),(0,s.jsxs)(t,{value:"Whereabouts",default:!0,children:[(0,s.jsxs)(n.p,{children:[(0,s.jsx)(n.a,{href:"https://github.com/k8snetworkplumbingwg/whereabouts",children:"Whereabouts"})," is an IP Address Management (IPAM) CNI plugin that assigns IP addresses cluster-wide."]}),(0,s.jsxs)(n.p,{children:["To use the Whereabouts IPAM plugin, please create a file called ",(0,s.jsx)(n.code,{children:"multus-values.yaml"})," with the following content:"]}),(0,s.jsx)(n.pre,{children:(0,s.jsx)(n.code,{children:"config:\n cni_conf:\n confDir: /var/lib/rancher/k3s/agent/etc/cni/net.d\n binDir: /var/lib/rancher/k3s/data/current/bin/\n kubeconfig: /var/lib/rancher/k3s/agent/etc/cni/net.d/multus.d/multus.kubeconfig\nrke2-whereabouts:\n fullnameOverride: whereabouts\n enabled: true\n cniConf:\n confDir: /var/lib/rancher/k3s/agent/etc/cni/net.d\n binDir: /var/lib/rancher/k3s/data/current/bin/\n"})})]}),(0,s.jsxs)(t,{value:"Multus DHCP daemon",default:!0,children:[(0,s.jsxs)(n.p,{children:["The dhcp IPAM plugin can be deployed when there is already a DHCP server running on the network. This daemonset takes care of periodically renewing the DHCP lease. For more information please check the official docs of ",(0,s.jsx)(n.a,{href:"https://www.cni.dev/plugins/current/ipam/dhcp/",children:"DHCP IPAM plugin"}),"."]}),(0,s.jsxs)(n.p,{children:["To use the DHCP plugin, please create a file called ",(0,s.jsx)(n.code,{children:"multus-values.yaml"})," with the following content:"]}),(0,s.jsx)(n.pre,{children:(0,s.jsx)(n.code,{children:"config:\n cni_conf:\n confDir: /var/lib/rancher/k3s/agent/etc/cni/net.d\n binDir: /var/lib/rancher/k3s/data/current/bin/\n kubeconfig: /var/lib/rancher/k3s/agent/etc/cni/net.d/multus.d/multus.kubeconfig\nmanifests:\n dhcpDaemonSet: true\n"})})]})]}),"\n",(0,s.jsx)(n.h3,{id:"deploy-multus",children:"Deploy Multus"}),"\n",(0,s.jsxs)(n.p,{children:["After creating the ",(0,s.jsx)(n.code,{children:"multus-values.yaml"})," file, everything is ready to install Multus:"]}),"\n",(0,s.jsx)(n.pre,{children:(0,s.jsx)(n.code,{children:"helm install multus rke2-charts/rke2-multus -n kube-system --kubeconfig /etc/rancher/k3s/k3s.yaml --values multus-values.yaml\n"})}),"\n",(0,s.jsxs)(n.p,{children:["The helm chart install will deploy a DaemonSet to create Multus pods for installing the required CNI binaries in ",(0,s.jsx)(n.code,{children:"/var/lib/rancher/k3s/data/current/"})," and Multus CNI config in ",(0,s.jsx)(n.code,{children:"/var/lib/rancher/k3s/agent/etc/cni/net.d"}),"."]}),"\n",(0,s.jsxs)(n.p,{children:["For more information about Multus, refer to the ",(0,s.jsx)(n.a,{href:"https://github.com/k8snetworkplumbingwg/multus-cni/tree/master/docs",children:"multus-cni"})," documentation."]})]})}function d(e={}){const{wrapper:n}={...(0,i.a)(),...e.components};return n?(0,s.jsx)(n,{...e,children:(0,s.jsx)(c,{...e})}):c(e)}function h(e,n){throw new Error("Expected "+(n?"component":"object")+" `"+e+"` to be defined: you likely forgot to import, pass, or provide it.")}},1151:(e,n,t)=>{t.d(n,{Z:()=>a,a:()=>l});var s=t(7294);const i={},r=s.createContext(i);function l(e){const n=s.useContext(r);return s.useMemo((function(){return"function"==typeof e?e(n):{...n,...e}}),[n,e])}function a(e){let n;return n=e.disableParentContext?"function"==typeof e.components?e.components(i):e.components||i:l(e.components),s.createElement(r.Provider,{value:n},e.children)}}}]); \ No newline at end of file +"use strict";(self.webpackChunkk_3_s_docs=self.webpackChunkk_3_s_docs||[]).push([[8380],{4877:(e,n,t)=>{t.r(n),t.d(n,{assets:()=>o,contentTitle:()=>l,default:()=>d,frontMatter:()=>r,metadata:()=>a,toc:()=>u});var s=t(5893),i=t(1151);const r={title:"Multus and IPAM plugins"},l=void 0,a={id:"networking/multus-ipams",title:"Multus and IPAM plugins",description:"Multus CNI is a CNI plugin that enables attaching multiple network interfaces to pods. Multus does not replace CNI plugins, instead it acts as a CNI plugin multiplexer. Multus is useful in certain use cases, especially when pods are network intensive and require extra network interfaces that support dataplane acceleration techniques such as SR-IOV.",source:"@site/docs/networking/multus-ipams.md",sourceDirName:"networking",slug:"/networking/multus-ipams",permalink:"/networking/multus-ipams",draft:!1,unlisted:!1,editUrl:"https://github.com/k3s-io/docs/edit/main/docs/networking/multus-ipams.md",tags:[],version:"current",lastUpdatedAt:1723747404e3,frontMatter:{title:"Multus and IPAM plugins"},sidebar:"mySidebar",previous:{title:"Distributed hybrid or multicloud cluster",permalink:"/networking/distributed-multicloud"},next:{title:"Networking Services",permalink:"/networking/networking-services"}},o={},u=[{value:"Add the Helm Repository",id:"add-the-helm-repository",level:3},{value:"Configure the IPAM plugin",id:"configure-the-ipam-plugin",level:3},{value:"Deploy Multus",id:"deploy-multus",level:3}];function c(e){const n={a:"a",code:"code",h3:"h3",p:"p",pre:"pre",...(0,i.a)(),...e.components},{TabItem:t,Tabs:r}=n;return t||h("TabItem",!0),r||h("Tabs",!0),(0,s.jsxs)(s.Fragment,{children:[(0,s.jsxs)(n.p,{children:[(0,s.jsx)(n.a,{href:"https://github.com/k8snetworkplumbingwg/multus-cni",children:"Multus CNI"})," is a CNI plugin that enables attaching multiple network interfaces to pods. Multus does not replace CNI plugins, instead it acts as a CNI plugin multiplexer. Multus is useful in certain use cases, especially when pods are network intensive and require extra network interfaces that support dataplane acceleration techniques such as SR-IOV."]}),"\n",(0,s.jsx)(n.p,{children:"Multus can not be deployed standalone. It always requires at least one conventional CNI plugin that fulfills the Kubernetes cluster network requirements. That CNI plugin becomes the default for Multus, and will be used to provide the primary interface for all pods. When deploying K3s with default options, that CNI plugin is Flannel."}),"\n",(0,s.jsx)(n.h3,{id:"add-the-helm-repository",children:"Add the Helm Repository"}),"\n",(0,s.jsx)(n.p,{children:"To deploy Multus, we recommend using the following helm repo:"}),"\n",(0,s.jsx)(n.pre,{children:(0,s.jsx)(n.code,{children:"helm repo add rke2-charts https://rke2-charts.rancher.io\nhelm repo update\n"})}),"\n",(0,s.jsx)(n.h3,{id:"configure-the-ipam-plugin",children:"Configure the IPAM plugin"}),"\n",(0,s.jsx)(n.p,{children:"An IPAM plugin is required to assign IP addresses on the extra interfaces created by Multus."}),"\n",(0,s.jsxs)(r,{groupId:"MultusIPAMplugins",children:[(0,s.jsxs)(t,{value:"host-local",default:!0,children:[(0,s.jsxs)(n.p,{children:["The host-local IPAM plugin allocates ip addresses out of a set of address ranges. It stores the state locally on the host filesystem, hence ensuring uniqueness of IP addresses on a single host. Therefore, we don't recommend it for multi-node clusters. This IPAM plugin does not require any extra deployment. For more information: ",(0,s.jsx)(n.a,{href:"https://www.cni.dev/plugins/current/ipam/host-local/",children:"https://www.cni.dev/plugins/current/ipam/host-local/"}),"."]}),(0,s.jsxs)(n.p,{children:["To use the host-local plugin, please create a file called ",(0,s.jsx)(n.code,{children:"multus-values.yaml"})," with the following content:"]}),(0,s.jsx)(n.pre,{children:(0,s.jsx)(n.code,{children:"config:\n cni_conf:\n confDir: /var/lib/rancher/k3s/agent/etc/cni/net.d\n binDir: /var/lib/rancher/k3s/data/current/bin/\n kubeconfig: /var/lib/rancher/k3s/agent/etc/cni/net.d/multus.d/multus.kubeconfig\n"})})]}),(0,s.jsxs)(t,{value:"Whereabouts",default:!0,children:[(0,s.jsxs)(n.p,{children:[(0,s.jsx)(n.a,{href:"https://github.com/k8snetworkplumbingwg/whereabouts",children:"Whereabouts"})," is an IP Address Management (IPAM) CNI plugin that assigns IP addresses cluster-wide."]}),(0,s.jsxs)(n.p,{children:["To use the Whereabouts IPAM plugin, please create a file called ",(0,s.jsx)(n.code,{children:"multus-values.yaml"})," with the following content:"]}),(0,s.jsx)(n.pre,{children:(0,s.jsx)(n.code,{children:"config:\n cni_conf:\n confDir: /var/lib/rancher/k3s/agent/etc/cni/net.d\n binDir: /var/lib/rancher/k3s/data/current/bin/\n kubeconfig: /var/lib/rancher/k3s/agent/etc/cni/net.d/multus.d/multus.kubeconfig\nrke2-whereabouts:\n fullnameOverride: whereabouts\n enabled: true\n cniConf:\n confDir: /var/lib/rancher/k3s/agent/etc/cni/net.d\n binDir: /var/lib/rancher/k3s/data/current/bin/\n"})})]}),(0,s.jsxs)(t,{value:"Multus DHCP daemon",default:!0,children:[(0,s.jsxs)(n.p,{children:["The dhcp IPAM plugin can be deployed when there is already a DHCP server running on the network. This daemonset takes care of periodically renewing the DHCP lease. For more information please check the official docs of ",(0,s.jsx)(n.a,{href:"https://www.cni.dev/plugins/current/ipam/dhcp/",children:"DHCP IPAM plugin"}),"."]}),(0,s.jsxs)(n.p,{children:["To use the DHCP plugin, please create a file called ",(0,s.jsx)(n.code,{children:"multus-values.yaml"})," with the following content:"]}),(0,s.jsx)(n.pre,{children:(0,s.jsx)(n.code,{children:"config:\n cni_conf:\n confDir: /var/lib/rancher/k3s/agent/etc/cni/net.d\n binDir: /var/lib/rancher/k3s/data/current/bin/\n kubeconfig: /var/lib/rancher/k3s/agent/etc/cni/net.d/multus.d/multus.kubeconfig\nmanifests:\n dhcpDaemonSet: true\n"})})]})]}),"\n",(0,s.jsx)(n.h3,{id:"deploy-multus",children:"Deploy Multus"}),"\n",(0,s.jsxs)(n.p,{children:["After creating the ",(0,s.jsx)(n.code,{children:"multus-values.yaml"})," file, everything is ready to install Multus:"]}),"\n",(0,s.jsx)(n.pre,{children:(0,s.jsx)(n.code,{children:"helm install multus rke2-charts/rke2-multus -n kube-system --kubeconfig /etc/rancher/k3s/k3s.yaml --values multus-values.yaml\n"})}),"\n",(0,s.jsxs)(n.p,{children:["The helm chart install will deploy a DaemonSet to create Multus pods for installing the required CNI binaries in ",(0,s.jsx)(n.code,{children:"/var/lib/rancher/k3s/data/current/"})," and Multus CNI config in ",(0,s.jsx)(n.code,{children:"/var/lib/rancher/k3s/agent/etc/cni/net.d"}),"."]}),"\n",(0,s.jsxs)(n.p,{children:["For more information about Multus, refer to the ",(0,s.jsx)(n.a,{href:"https://github.com/k8snetworkplumbingwg/multus-cni/tree/master/docs",children:"multus-cni"})," documentation."]})]})}function d(e={}){const{wrapper:n}={...(0,i.a)(),...e.components};return n?(0,s.jsx)(n,{...e,children:(0,s.jsx)(c,{...e})}):c(e)}function h(e,n){throw new Error("Expected "+(n?"component":"object")+" `"+e+"` to be defined: you likely forgot to import, pass, or provide it.")}},1151:(e,n,t)=>{t.d(n,{Z:()=>a,a:()=>l});var s=t(7294);const i={},r=s.createContext(i);function l(e){const n=s.useContext(r);return s.useMemo((function(){return"function"==typeof e?e(n):{...n,...e}}),[n,e])}function a(e){let n;return n=e.disableParentContext?"function"==typeof e.components?e.components(i):e.components||i:l(e.components),s.createElement(r.Provider,{value:n},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/179ec51e.d1de3cd3.js b/assets/js/179ec51e.9f620303.js similarity index 99% rename from assets/js/179ec51e.d1de3cd3.js rename to assets/js/179ec51e.9f620303.js index 475c87f9e..c9cc4df11 100644 --- a/assets/js/179ec51e.d1de3cd3.js +++ b/assets/js/179ec51e.9f620303.js @@ -1 +1 @@ -"use strict";(self.webpackChunkk_3_s_docs=self.webpackChunkk_3_s_docs||[]).push([[7176],{6790:(e,n,s)=>{s.r(n),s.d(n,{assets:()=>a,contentTitle:()=>c,default:()=>h,frontMatter:()=>i,metadata:()=>l,toc:()=>o});var r=s(5893),t=s(1151);const i={title:"secrets-encrypt"},c="k3s secrets-encrypt",l={id:"cli/secrets-encrypt",title:"secrets-encrypt",description:"K3s supports enabling secrets encryption at rest. For more information, see Secrets Encryption.",source:"@site/docs/cli/secrets-encrypt.md",sourceDirName:"cli",slug:"/cli/secrets-encrypt",permalink:"/cli/secrets-encrypt",draft:!1,unlisted:!1,editUrl:"https://github.com/k3s-io/docs/edit/main/docs/cli/secrets-encrypt.md",tags:[],version:"current",lastUpdatedAt:1723651727e3,frontMatter:{title:"secrets-encrypt"},sidebar:"mySidebar",previous:{title:"etcd-snapshot",permalink:"/cli/etcd-snapshot"},next:{title:"token",permalink:"/cli/token"}},a={},o=[{value:"Secrets Encryption Tool",id:"secrets-encryption-tool",level:2},{value:"New Encryption Key Rotation (Experimental)",id:"new-encryption-key-rotation-experimental",level:3},{value:"Encryption Key Rotation Classic",id:"encryption-key-rotation-classic",level:3},{value:"Secrets Encryption Disable/Re-enable",id:"secrets-encryption-disablere-enable",level:3},{value:"Secrets Encryption Status",id:"secrets-encryption-status",level:3}];function d(e){const n={a:"a",admonition:"admonition",br:"br",code:"code",em:"em",h1:"h1",h2:"h2",h3:"h3",header:"header",li:"li",mdxAdmonitionTitle:"mdxAdmonitionTitle",ol:"ol",p:"p",pre:"pre",strong:"strong",ul:"ul",...(0,t.a)(),...e.components},{TabItem:s,Tabs:i}=n;return s||p("TabItem",!0),i||p("Tabs",!0),(0,r.jsxs)(r.Fragment,{children:[(0,r.jsx)(n.header,{children:(0,r.jsx)(n.h1,{id:"k3s-secrets-encrypt",children:"k3s secrets-encrypt"})}),"\n",(0,r.jsxs)(n.p,{children:["K3s supports enabling secrets encryption at rest. For more information, see ",(0,r.jsx)(n.a,{href:"/security/secrets-encryption",children:"Secrets Encryption"}),"."]}),"\n",(0,r.jsx)(n.h2,{id:"secrets-encryption-tool",children:"Secrets Encryption Tool"}),"\n",(0,r.jsx)(n.admonition,{title:"Version Gate",type:"info",children:(0,r.jsxs)(n.p,{children:["Available as of ",(0,r.jsx)(n.a,{href:"https://github.com/k3s-io/k3s/releases/tag/v1.21.8%2Bk3s1",children:"v1.21.8+k3s1"})]})}),"\n",(0,r.jsxs)(n.p,{children:["K3s contains a CLI tool ",(0,r.jsx)(n.code,{children:"secrets-encrypt"}),", which enables automatic control over the following:"]}),"\n",(0,r.jsxs)(n.ul,{children:["\n",(0,r.jsx)(n.li,{children:"Disabling/Enabling secrets encryption"}),"\n",(0,r.jsx)(n.li,{children:"Adding new encryption keys"}),"\n",(0,r.jsx)(n.li,{children:"Rotating and deleting encryption keys"}),"\n",(0,r.jsx)(n.li,{children:"Reencrypting secrets"}),"\n"]}),"\n",(0,r.jsx)(n.admonition,{type:"warning",children:(0,r.jsx)(n.p,{children:"Failure to follow proper procedure for rotating encryption keys can leave your cluster permanently corrupted. Proceed with caution."})}),"\n",(0,r.jsx)(n.h3,{id:"new-encryption-key-rotation-experimental",children:"New Encryption Key Rotation (Experimental)"}),"\n",(0,r.jsxs)(n.admonition,{title:"Version Gate",type:"info",children:[(0,r.jsxs)(n.p,{children:["Available as of ",(0,r.jsx)(n.a,{href:"https://github.com/k3s-io/k3s/releases/tag/v1.28.1%2Bk3s1",children:"v1.28.1+k3s1"}),". This new version of the tool utilized K8s ",(0,r.jsx)(n.a,{href:"https://kubernetes.io/docs/tasks/administer-cluster/encrypt-data/#configure-automatic-reloading",children:"automatic config reloading"})," which is currently in beta. GA is expected in v1.29.0"]}),(0,r.jsxs)(n.p,{children:["For older releases, see ",(0,r.jsx)(n.a,{href:"#encryption-key-rotation-classic",children:"Encryption Key Rotation Classic"})]})]}),"\n",(0,r.jsxs)(i,{groupId:"se",queryString:!0,children:[(0,r.jsxs)(s,{value:"Single-Server",default:!0,children:[(0,r.jsx)(n.p,{children:"To rotate secrets encryption keys on a single-server cluster:"}),(0,r.jsxs)(n.ol,{children:["\n",(0,r.jsxs)(n.li,{children:["\n",(0,r.jsxs)(n.p,{children:["Start the K3s server with the flag ",(0,r.jsx)(n.code,{children:"--secrets-encryption"})]}),"\n",(0,r.jsxs)(n.admonition,{type:"note",children:[(0,r.jsx)(n.mdxAdmonitionTitle,{}),(0,r.jsxs)(n.p,{children:["Starting K3s without encryption and enabling it at a later time is currently ",(0,r.jsx)(n.em,{children:"not"})," supported."]})]}),"\n"]}),"\n",(0,r.jsxs)(n.li,{children:["\n",(0,r.jsx)(n.p,{children:"Rotate secrets encryption keys"}),"\n",(0,r.jsx)(n.pre,{children:(0,r.jsx)(n.code,{children:"k3s secrets-encrypt rotate-keys\n"})}),"\n"]}),"\n",(0,r.jsxs)(n.li,{children:["\n",(0,r.jsx)(n.p,{children:"Wait for reencryption to finish. Watch the server logs, or wait for:"}),"\n",(0,r.jsx)(n.pre,{children:(0,r.jsx)(n.code,{className:"language-bash",children:"$ k3s secrets-encrypt status\nEncryption Status: Enabled\nCurrent Rotation Stage: reencrypt_finished\n"})}),"\n"]}),"\n"]})]}),(0,r.jsxs)(s,{value:"High-Availability",children:[(0,r.jsx)(n.p,{children:"To rotate secrets encryption keys on HA setups:"}),(0,r.jsxs)(n.ol,{children:["\n",(0,r.jsxs)(n.li,{children:["\n",(0,r.jsxs)(n.p,{children:["Start up all three K3s servers with the ",(0,r.jsx)(n.code,{children:"--secrets-encryption"})," flag. For brevity, the servers will be referred to as S1, S2, S3."]}),"\n",(0,r.jsx)(n.admonition,{type:"note",children:(0,r.jsxs)(n.p,{children:["Starting K3s without encryption and enabling it at a later time is currently ",(0,r.jsx)(n.em,{children:"not"})," supported."]})}),"\n"]}),"\n",(0,r.jsxs)(n.li,{children:["\n",(0,r.jsx)(n.p,{children:"Rotate secrets encryption keys on S1"}),"\n",(0,r.jsx)(n.pre,{children:(0,r.jsx)(n.code,{className:"language-bash",children:"k3s secrets-encrypt rotate-keys\n"})}),"\n"]}),"\n",(0,r.jsxs)(n.li,{children:["\n",(0,r.jsx)(n.p,{children:"Wait for reencryption to finish. Watch the server logs, or wait for:"}),"\n",(0,r.jsx)(n.pre,{children:(0,r.jsx)(n.code,{className:"language-bash",children:"$ k3s secrets-encrypt status\nEncryption Status: Enabled\nCurrent Rotation Stage: reencrypt_finished\n"})}),"\n",(0,r.jsx)(n.admonition,{type:"info",children:(0,r.jsx)(n.p,{children:"K3s will reencrypt ~5 secrets per second. Clusters with large # of secrets can take several minutes to reencrypt. You can track progress in the server logs."})}),"\n"]}),"\n",(0,r.jsxs)(n.li,{children:["\n",(0,r.jsx)(n.p,{children:"Restart K3s on S1 with same arguments. If running K3s as a service:"}),"\n",(0,r.jsx)(n.pre,{children:(0,r.jsx)(n.code,{className:"language-bash",children:"# If using systemd\nsystemctl restart k3s\n# If using openrc\nrc-service k3s restart\n"})}),"\n"]}),"\n",(0,r.jsxs)(n.li,{children:["\n",(0,r.jsx)(n.p,{children:"Once S1 is up, restart K3s on S2 and S3"}),"\n"]}),"\n"]})]})]}),"\n",(0,r.jsx)(n.h3,{id:"encryption-key-rotation-classic",children:"Encryption Key Rotation Classic"}),"\n",(0,r.jsxs)(i,{groupId:"se",queryString:!0,children:[(0,r.jsxs)(s,{value:"Single-Server",default:!0,children:[(0,r.jsx)(n.p,{children:"To rotate secrets encryption keys on a single-server cluster:"}),(0,r.jsxs)(n.ol,{children:["\n",(0,r.jsxs)(n.li,{children:["\n",(0,r.jsxs)(n.p,{children:["Start the K3s server with the flag ",(0,r.jsx)(n.code,{children:"--secrets-encryption"})]}),"\n",(0,r.jsxs)(n.admonition,{type:"note",children:[(0,r.jsx)(n.mdxAdmonitionTitle,{}),(0,r.jsxs)(n.p,{children:["Starting K3s without encryption and enabling it at a later time is currently ",(0,r.jsx)(n.em,{children:"not"})," supported."]})]}),"\n"]}),"\n",(0,r.jsxs)(n.li,{children:["\n",(0,r.jsx)(n.p,{children:"Prepare"}),"\n",(0,r.jsx)(n.pre,{children:(0,r.jsx)(n.code,{className:"language-bash",children:"k3s secrets-encrypt prepare\n"})}),"\n"]}),"\n",(0,r.jsxs)(n.li,{children:["\n",(0,r.jsx)(n.p,{children:"Kill and restart the K3s server with same arguments. If running K3s as a service:"}),"\n",(0,r.jsx)(n.pre,{children:(0,r.jsx)(n.code,{className:"language-bash",children:"# If using systemd\nsystemctl restart k3s\n# If using openrc\nrc-service k3s restart\n"})}),"\n"]}),"\n",(0,r.jsxs)(n.li,{children:["\n",(0,r.jsx)(n.p,{children:"Rotate"}),"\n",(0,r.jsx)(n.pre,{children:(0,r.jsx)(n.code,{className:"language-bash",children:"k3s secrets-encrypt rotate\n"})}),"\n"]}),"\n",(0,r.jsxs)(n.li,{children:["\n",(0,r.jsx)(n.p,{children:"Kill and restart the K3s server with same arguments"}),"\n"]}),"\n",(0,r.jsxs)(n.li,{children:["\n",(0,r.jsx)(n.p,{children:"Reencrypt"}),"\n",(0,r.jsx)(n.admonition,{type:"info",children:(0,r.jsxs)(n.p,{children:["K3s will reencrypt ~5 secrets per second.",(0,r.jsx)(n.br,{}),"\n","Clusters with large # of secrets can take several minutes to reencrypt."]})}),"\n",(0,r.jsx)(n.pre,{children:(0,r.jsx)(n.code,{className:"language-bash",children:"k3s secrets-encrypt reencrypt\n"})}),"\n"]}),"\n"]})]}),(0,r.jsxs)(s,{value:"High-Availability",children:[(0,r.jsx)(n.p,{children:"The steps are the same for both embedded DB and external DB clusters."}),(0,r.jsx)(n.p,{children:"To rotate secrets encryption keys on HA setups:"}),(0,r.jsxs)(n.ol,{children:["\n",(0,r.jsxs)(n.li,{children:["\n",(0,r.jsxs)(n.p,{children:["Start up all three K3s servers with the ",(0,r.jsx)(n.code,{children:"--secrets-encryption"})," flag. For brevity, the servers will be referred to as S1, S2, S3."]}),"\n",(0,r.jsx)(n.admonition,{title:"Notes",type:"note",children:(0,r.jsxs)(n.ul,{children:["\n",(0,r.jsxs)(n.li,{children:["Starting K3s without encryption and enabling it at a later time is currently ",(0,r.jsx)(n.em,{children:"not"})," supported."]}),"\n",(0,r.jsxs)(n.li,{children:["While not required, it is recommended that you pick one server node from which to run the ",(0,r.jsx)(n.code,{children:"secrets-encrypt"})," commands."]}),"\n"]})}),"\n"]}),"\n",(0,r.jsxs)(n.li,{children:["\n",(0,r.jsx)(n.p,{children:"Prepare on S1"}),"\n",(0,r.jsx)(n.pre,{children:(0,r.jsx)(n.code,{className:"language-bash",children:"k3s secrets-encrypt prepare\n"})}),"\n"]}),"\n",(0,r.jsxs)(n.li,{children:["\n",(0,r.jsx)(n.p,{children:"Kill and restart S1 with same arguments. If running K3s as a service:"}),"\n",(0,r.jsx)(n.pre,{children:(0,r.jsx)(n.code,{className:"language-bash",children:"# If using systemd\nsystemctl restart k3s\n# If using openrc\nrc-service k3s restart\n"})}),"\n"]}),"\n",(0,r.jsxs)(n.li,{children:["\n",(0,r.jsx)(n.p,{children:"Once S1 is up, kill and restart the S2 and S3"}),"\n"]}),"\n",(0,r.jsxs)(n.li,{children:["\n",(0,r.jsx)(n.p,{children:"Rotate on S1"}),"\n",(0,r.jsx)(n.pre,{children:(0,r.jsx)(n.code,{className:"language-bash",children:"k3s secrets-encrypt rotate\n"})}),"\n"]}),"\n",(0,r.jsxs)(n.li,{children:["\n",(0,r.jsx)(n.p,{children:"Kill and restart S1 with same arguments"}),"\n"]}),"\n",(0,r.jsxs)(n.li,{children:["\n",(0,r.jsx)(n.p,{children:"Once S1 is up, kill and restart the S2 and S3"}),"\n"]}),"\n",(0,r.jsxs)(n.li,{children:["\n",(0,r.jsx)(n.p,{children:"Reencrypt on S1"}),"\n",(0,r.jsx)(n.admonition,{type:"info",children:(0,r.jsxs)(n.p,{children:["K3s will reencrypt ~5 secrets per second.",(0,r.jsx)(n.br,{}),"\n","Clusters with large # of secrets can take several minutes to reencrypt."]})}),"\n",(0,r.jsx)(n.pre,{children:(0,r.jsx)(n.code,{className:"language-bash",children:"k3s secrets-encrypt reencrypt\n"})}),"\n"]}),"\n",(0,r.jsxs)(n.li,{children:["\n",(0,r.jsx)(n.p,{children:"Kill and restart S1 with same arguments"}),"\n"]}),"\n",(0,r.jsxs)(n.li,{children:["\n",(0,r.jsx)(n.p,{children:"Once S1 is up, kill and restart the S2 and S3"}),"\n"]}),"\n"]})]})]}),"\n",(0,r.jsx)(n.h3,{id:"secrets-encryption-disablere-enable",children:"Secrets Encryption Disable/Re-enable"}),"\n",(0,r.jsxs)(i,{groupId:"se",queryString:!0,children:[(0,r.jsxs)(s,{value:"Single-Server",default:!0,children:[(0,r.jsxs)(n.p,{children:["After launching a server with ",(0,r.jsx)(n.code,{children:"--secrets-encryption"})," flag, secrets encryption can be disabled."]}),(0,r.jsx)(n.p,{children:"To disable secrets encryption on a single-node cluster:"}),(0,r.jsxs)(n.ol,{children:["\n",(0,r.jsxs)(n.li,{children:["\n",(0,r.jsx)(n.p,{children:"Disable"}),"\n",(0,r.jsx)(n.pre,{children:(0,r.jsx)(n.code,{className:"language-bash",children:"k3s secrets-encrypt disable\n"})}),"\n"]}),"\n",(0,r.jsxs)(n.li,{children:["\n",(0,r.jsx)(n.p,{children:"Kill and restart the K3s server with same arguments. If running K3s as a service:"}),"\n",(0,r.jsx)(n.pre,{children:(0,r.jsx)(n.code,{className:"language-bash",children:"# If using systemd\nsystemctl restart k3s\n# If using openrc\nrc-service k3s restart\n"})}),"\n"]}),"\n",(0,r.jsxs)(n.li,{children:["\n",(0,r.jsx)(n.p,{children:"Reencrypt with flags"}),"\n",(0,r.jsx)(n.pre,{children:(0,r.jsx)(n.code,{className:"language-bash",children:"k3s secrets-encrypt reencrypt --force --skip\n"})}),"\n"]}),"\n"]}),(0,r.jsx)(n.p,{children:"To re-enable secrets encryption on a single node cluster:"}),(0,r.jsxs)(n.ol,{children:["\n",(0,r.jsxs)(n.li,{children:["\n",(0,r.jsx)(n.p,{children:"Enable"}),"\n",(0,r.jsx)(n.pre,{children:(0,r.jsx)(n.code,{className:"language-bash",children:"k3s secrets-encrypt enable\n"})}),"\n"]}),"\n",(0,r.jsxs)(n.li,{children:["\n",(0,r.jsx)(n.p,{children:"Kill and restart the K3s server with same arguments"}),"\n"]}),"\n",(0,r.jsxs)(n.li,{children:["\n",(0,r.jsx)(n.p,{children:"Reencrypt with flags"}),"\n",(0,r.jsx)(n.pre,{children:(0,r.jsx)(n.code,{className:"language-bash",children:"k3s secrets-encrypt reencrypt --force --skip\n"})}),"\n"]}),"\n"]})]}),(0,r.jsxs)(s,{value:"High-Availability",children:[(0,r.jsxs)(n.p,{children:["After launching a HA cluster with ",(0,r.jsx)(n.code,{children:"--secrets-encryption"})," flags, secrets encryption can be disabled."]}),(0,r.jsx)(n.admonition,{type:"note",children:(0,r.jsxs)(n.p,{children:["While not required, it is recommended that you pick one server node from which to run the ",(0,r.jsx)(n.code,{children:"secrets-encrypt"})," commands."]})}),(0,r.jsx)(n.p,{children:"For brevity, the three servers used in this guide will be referred to as S1, S2, S3."}),(0,r.jsx)(n.p,{children:"To disable secrets encryption on a HA cluster:"}),(0,r.jsxs)(n.ol,{children:["\n",(0,r.jsxs)(n.li,{children:["\n",(0,r.jsx)(n.p,{children:"Disable on S1"}),"\n",(0,r.jsx)(n.pre,{children:(0,r.jsx)(n.code,{className:"language-bash",children:"k3s secrets-encrypt disable\n"})}),"\n"]}),"\n",(0,r.jsxs)(n.li,{children:["\n",(0,r.jsx)(n.p,{children:"Kill and restart S1 with same arguments. If running K3s as a service:"}),"\n",(0,r.jsx)(n.pre,{children:(0,r.jsx)(n.code,{className:"language-bash",children:"# If using systemd\nsystemctl restart k3s\n# If using openrc\nrc-service k3s restart\n"})}),"\n"]}),"\n",(0,r.jsxs)(n.li,{children:["\n",(0,r.jsx)(n.p,{children:"Once S1 is up, kill and restart the S2 and S3"}),"\n"]}),"\n",(0,r.jsxs)(n.li,{children:["\n",(0,r.jsx)(n.p,{children:"Reencrypt with flags on S1"}),"\n",(0,r.jsx)(n.pre,{children:(0,r.jsx)(n.code,{className:"language-bash",children:"k3s secrets-encrypt reencrypt --force --skip\n"})}),"\n"]}),"\n"]}),(0,r.jsx)(n.p,{children:"To re-enable secrets encryption on a HA cluster:"}),(0,r.jsxs)(n.ol,{children:["\n",(0,r.jsxs)(n.li,{children:["\n",(0,r.jsx)(n.p,{children:"Enable on S1"}),"\n",(0,r.jsx)(n.pre,{children:(0,r.jsx)(n.code,{className:"language-bash",children:"k3s secrets-encrypt enable\n"})}),"\n"]}),"\n",(0,r.jsxs)(n.li,{children:["\n",(0,r.jsx)(n.p,{children:"Kill and restart S1 with same arguments"}),"\n"]}),"\n",(0,r.jsxs)(n.li,{children:["\n",(0,r.jsx)(n.p,{children:"Once S1 is up, kill and restart the S2 and S3"}),"\n"]}),"\n",(0,r.jsxs)(n.li,{children:["\n",(0,r.jsx)(n.p,{children:"Reencrypt with flags on S1"}),"\n",(0,r.jsx)(n.pre,{children:(0,r.jsx)(n.code,{className:"language-bash",children:"k3s secrets-encrypt reencrypt --force --skip\n"})}),"\n"]}),"\n"]})]})]}),"\n",(0,r.jsx)(n.h3,{id:"secrets-encryption-status",children:"Secrets Encryption Status"}),"\n",(0,r.jsxs)(n.p,{children:["The secrets-encrypt tool includes a ",(0,r.jsx)(n.code,{children:"status"})," command that displays information about the current status of secrets encryption on the node."]}),"\n",(0,r.jsx)(n.p,{children:"An example of the command on a single-server node:"}),"\n",(0,r.jsx)(n.pre,{children:(0,r.jsx)(n.code,{className:"language-bash",children:"$ k3s secrets-encrypt status\nEncryption Status: Enabled\nCurrent Rotation Stage: start\nServer Encryption Hashes: All hashes match\n\nActive Key Type Name\n------ -------- ----\n * AES-CBC aescbckey\n\n"})}),"\n",(0,r.jsx)(n.p,{children:"Another example on HA cluster, after rotating the keys, but before restarting the servers:"}),"\n",(0,r.jsx)(n.pre,{children:(0,r.jsx)(n.code,{className:"language-bash",children:"$ k3s secrets-encrypt status\nEncryption Status: Enabled\nCurrent Rotation Stage: rotate\nServer Encryption Hashes: hash does not match between node-1 and node-2\n\nActive Key Type Name\n------ -------- ----\n * AES-CBC aescbckey-2021-12-10T22:54:38Z\n AES-CBC aescbckey\n\n"})}),"\n",(0,r.jsx)(n.p,{children:"Details on each section are as follows:"}),"\n",(0,r.jsxs)(n.ul,{children:["\n",(0,r.jsxs)(n.li,{children:[(0,r.jsx)(n.strong,{children:"Encryption Status"}),": Displayed whether secrets encryption is disabled or enabled on the node"]}),"\n",(0,r.jsxs)(n.li,{children:[(0,r.jsx)(n.strong,{children:"Current Rotation Stage"}),": Indicates the current rotation stage on the node.",(0,r.jsx)(n.br,{}),"\n","Stages are: ",(0,r.jsx)(n.code,{children:"start"}),", ",(0,r.jsx)(n.code,{children:"prepare"}),", ",(0,r.jsx)(n.code,{children:"rotate"}),", ",(0,r.jsx)(n.code,{children:"reencrypt_request"}),", ",(0,r.jsx)(n.code,{children:"reencrypt_active"}),", ",(0,r.jsx)(n.code,{children:"reencrypt_finished"})]}),"\n",(0,r.jsxs)(n.li,{children:[(0,r.jsx)(n.strong,{children:"Server Encryption Hashes"}),": Useful for HA clusters, this indicates whether all servers are on the same stage with their local files. This can be used to identify whether a restart of servers is required before proceeding to the next stage. In the HA example above, node-1 and node-2 have different hashes, indicating that they currently do not have the same encryption configuration. Restarting the servers will sync up their configuration."]}),"\n",(0,r.jsxs)(n.li,{children:[(0,r.jsx)(n.strong,{children:"Key Table"}),": Summarizes information about the secrets encryption keys found on the node.","\n",(0,r.jsxs)(n.ul,{children:["\n",(0,r.jsxs)(n.li,{children:[(0,r.jsx)(n.strong,{children:"Active"}),': The "*" indicates which, if any, of the keys are currently used for secrets encryption. An active key is used by Kubernetes to encrypt any new secrets.']}),"\n",(0,r.jsxs)(n.li,{children:[(0,r.jsx)(n.strong,{children:"Key Type"}),": All keys using this tool are ",(0,r.jsx)(n.code,{children:"AES-CBC"})," type. See more info ",(0,r.jsx)(n.a,{href:"https://kubernetes.io/docs/tasks/administer-cluster/encrypt-data/#providers",children:"here."})]}),"\n",(0,r.jsxs)(n.li,{children:[(0,r.jsx)(n.strong,{children:"Name"}),": Name of the encryption key."]}),"\n"]}),"\n"]}),"\n"]})]})}function h(e={}){const{wrapper:n}={...(0,t.a)(),...e.components};return n?(0,r.jsx)(n,{...e,children:(0,r.jsx)(d,{...e})}):d(e)}function p(e,n){throw new Error("Expected "+(n?"component":"object")+" `"+e+"` to be defined: you likely forgot to import, pass, or provide it.")}},1151:(e,n,s)=>{s.d(n,{Z:()=>l,a:()=>c});var r=s(7294);const t={},i=r.createContext(t);function c(e){const n=r.useContext(i);return r.useMemo((function(){return"function"==typeof e?e(n):{...n,...e}}),[n,e])}function l(e){let n;return n=e.disableParentContext?"function"==typeof e.components?e.components(t):e.components||t:c(e.components),r.createElement(i.Provider,{value:n},e.children)}}}]); \ No newline at end of file +"use strict";(self.webpackChunkk_3_s_docs=self.webpackChunkk_3_s_docs||[]).push([[7176],{6790:(e,n,s)=>{s.r(n),s.d(n,{assets:()=>a,contentTitle:()=>c,default:()=>h,frontMatter:()=>i,metadata:()=>l,toc:()=>o});var r=s(5893),t=s(1151);const i={title:"secrets-encrypt"},c="k3s secrets-encrypt",l={id:"cli/secrets-encrypt",title:"secrets-encrypt",description:"K3s supports enabling secrets encryption at rest. For more information, see Secrets Encryption.",source:"@site/docs/cli/secrets-encrypt.md",sourceDirName:"cli",slug:"/cli/secrets-encrypt",permalink:"/cli/secrets-encrypt",draft:!1,unlisted:!1,editUrl:"https://github.com/k3s-io/docs/edit/main/docs/cli/secrets-encrypt.md",tags:[],version:"current",lastUpdatedAt:1723747404e3,frontMatter:{title:"secrets-encrypt"},sidebar:"mySidebar",previous:{title:"etcd-snapshot",permalink:"/cli/etcd-snapshot"},next:{title:"token",permalink:"/cli/token"}},a={},o=[{value:"Secrets Encryption Tool",id:"secrets-encryption-tool",level:2},{value:"New Encryption Key Rotation (Experimental)",id:"new-encryption-key-rotation-experimental",level:3},{value:"Encryption Key Rotation Classic",id:"encryption-key-rotation-classic",level:3},{value:"Secrets Encryption Disable/Re-enable",id:"secrets-encryption-disablere-enable",level:3},{value:"Secrets Encryption Status",id:"secrets-encryption-status",level:3}];function d(e){const n={a:"a",admonition:"admonition",br:"br",code:"code",em:"em",h1:"h1",h2:"h2",h3:"h3",header:"header",li:"li",mdxAdmonitionTitle:"mdxAdmonitionTitle",ol:"ol",p:"p",pre:"pre",strong:"strong",ul:"ul",...(0,t.a)(),...e.components},{TabItem:s,Tabs:i}=n;return s||p("TabItem",!0),i||p("Tabs",!0),(0,r.jsxs)(r.Fragment,{children:[(0,r.jsx)(n.header,{children:(0,r.jsx)(n.h1,{id:"k3s-secrets-encrypt",children:"k3s secrets-encrypt"})}),"\n",(0,r.jsxs)(n.p,{children:["K3s supports enabling secrets encryption at rest. For more information, see ",(0,r.jsx)(n.a,{href:"/security/secrets-encryption",children:"Secrets Encryption"}),"."]}),"\n",(0,r.jsx)(n.h2,{id:"secrets-encryption-tool",children:"Secrets Encryption Tool"}),"\n",(0,r.jsx)(n.admonition,{title:"Version Gate",type:"info",children:(0,r.jsxs)(n.p,{children:["Available as of ",(0,r.jsx)(n.a,{href:"https://github.com/k3s-io/k3s/releases/tag/v1.21.8%2Bk3s1",children:"v1.21.8+k3s1"})]})}),"\n",(0,r.jsxs)(n.p,{children:["K3s contains a CLI tool ",(0,r.jsx)(n.code,{children:"secrets-encrypt"}),", which enables automatic control over the following:"]}),"\n",(0,r.jsxs)(n.ul,{children:["\n",(0,r.jsx)(n.li,{children:"Disabling/Enabling secrets encryption"}),"\n",(0,r.jsx)(n.li,{children:"Adding new encryption keys"}),"\n",(0,r.jsx)(n.li,{children:"Rotating and deleting encryption keys"}),"\n",(0,r.jsx)(n.li,{children:"Reencrypting secrets"}),"\n"]}),"\n",(0,r.jsx)(n.admonition,{type:"warning",children:(0,r.jsx)(n.p,{children:"Failure to follow proper procedure for rotating encryption keys can leave your cluster permanently corrupted. Proceed with caution."})}),"\n",(0,r.jsx)(n.h3,{id:"new-encryption-key-rotation-experimental",children:"New Encryption Key Rotation (Experimental)"}),"\n",(0,r.jsxs)(n.admonition,{title:"Version Gate",type:"info",children:[(0,r.jsxs)(n.p,{children:["Available as of ",(0,r.jsx)(n.a,{href:"https://github.com/k3s-io/k3s/releases/tag/v1.28.1%2Bk3s1",children:"v1.28.1+k3s1"}),". This new version of the tool utilized K8s ",(0,r.jsx)(n.a,{href:"https://kubernetes.io/docs/tasks/administer-cluster/encrypt-data/#configure-automatic-reloading",children:"automatic config reloading"})," which is currently in beta. GA is expected in v1.29.0"]}),(0,r.jsxs)(n.p,{children:["For older releases, see ",(0,r.jsx)(n.a,{href:"#encryption-key-rotation-classic",children:"Encryption Key Rotation Classic"})]})]}),"\n",(0,r.jsxs)(i,{groupId:"se",queryString:!0,children:[(0,r.jsxs)(s,{value:"Single-Server",default:!0,children:[(0,r.jsx)(n.p,{children:"To rotate secrets encryption keys on a single-server cluster:"}),(0,r.jsxs)(n.ol,{children:["\n",(0,r.jsxs)(n.li,{children:["\n",(0,r.jsxs)(n.p,{children:["Start the K3s server with the flag ",(0,r.jsx)(n.code,{children:"--secrets-encryption"})]}),"\n",(0,r.jsxs)(n.admonition,{type:"note",children:[(0,r.jsx)(n.mdxAdmonitionTitle,{}),(0,r.jsxs)(n.p,{children:["Starting K3s without encryption and enabling it at a later time is currently ",(0,r.jsx)(n.em,{children:"not"})," supported."]})]}),"\n"]}),"\n",(0,r.jsxs)(n.li,{children:["\n",(0,r.jsx)(n.p,{children:"Rotate secrets encryption keys"}),"\n",(0,r.jsx)(n.pre,{children:(0,r.jsx)(n.code,{children:"k3s secrets-encrypt rotate-keys\n"})}),"\n"]}),"\n",(0,r.jsxs)(n.li,{children:["\n",(0,r.jsx)(n.p,{children:"Wait for reencryption to finish. Watch the server logs, or wait for:"}),"\n",(0,r.jsx)(n.pre,{children:(0,r.jsx)(n.code,{className:"language-bash",children:"$ k3s secrets-encrypt status\nEncryption Status: Enabled\nCurrent Rotation Stage: reencrypt_finished\n"})}),"\n"]}),"\n"]})]}),(0,r.jsxs)(s,{value:"High-Availability",children:[(0,r.jsx)(n.p,{children:"To rotate secrets encryption keys on HA setups:"}),(0,r.jsxs)(n.ol,{children:["\n",(0,r.jsxs)(n.li,{children:["\n",(0,r.jsxs)(n.p,{children:["Start up all three K3s servers with the ",(0,r.jsx)(n.code,{children:"--secrets-encryption"})," flag. For brevity, the servers will be referred to as S1, S2, S3."]}),"\n",(0,r.jsx)(n.admonition,{type:"note",children:(0,r.jsxs)(n.p,{children:["Starting K3s without encryption and enabling it at a later time is currently ",(0,r.jsx)(n.em,{children:"not"})," supported."]})}),"\n"]}),"\n",(0,r.jsxs)(n.li,{children:["\n",(0,r.jsx)(n.p,{children:"Rotate secrets encryption keys on S1"}),"\n",(0,r.jsx)(n.pre,{children:(0,r.jsx)(n.code,{className:"language-bash",children:"k3s secrets-encrypt rotate-keys\n"})}),"\n"]}),"\n",(0,r.jsxs)(n.li,{children:["\n",(0,r.jsx)(n.p,{children:"Wait for reencryption to finish. Watch the server logs, or wait for:"}),"\n",(0,r.jsx)(n.pre,{children:(0,r.jsx)(n.code,{className:"language-bash",children:"$ k3s secrets-encrypt status\nEncryption Status: Enabled\nCurrent Rotation Stage: reencrypt_finished\n"})}),"\n",(0,r.jsx)(n.admonition,{type:"info",children:(0,r.jsx)(n.p,{children:"K3s will reencrypt ~5 secrets per second. Clusters with large # of secrets can take several minutes to reencrypt. You can track progress in the server logs."})}),"\n"]}),"\n",(0,r.jsxs)(n.li,{children:["\n",(0,r.jsx)(n.p,{children:"Restart K3s on S1 with same arguments. If running K3s as a service:"}),"\n",(0,r.jsx)(n.pre,{children:(0,r.jsx)(n.code,{className:"language-bash",children:"# If using systemd\nsystemctl restart k3s\n# If using openrc\nrc-service k3s restart\n"})}),"\n"]}),"\n",(0,r.jsxs)(n.li,{children:["\n",(0,r.jsx)(n.p,{children:"Once S1 is up, restart K3s on S2 and S3"}),"\n"]}),"\n"]})]})]}),"\n",(0,r.jsx)(n.h3,{id:"encryption-key-rotation-classic",children:"Encryption Key Rotation Classic"}),"\n",(0,r.jsxs)(i,{groupId:"se",queryString:!0,children:[(0,r.jsxs)(s,{value:"Single-Server",default:!0,children:[(0,r.jsx)(n.p,{children:"To rotate secrets encryption keys on a single-server cluster:"}),(0,r.jsxs)(n.ol,{children:["\n",(0,r.jsxs)(n.li,{children:["\n",(0,r.jsxs)(n.p,{children:["Start the K3s server with the flag ",(0,r.jsx)(n.code,{children:"--secrets-encryption"})]}),"\n",(0,r.jsxs)(n.admonition,{type:"note",children:[(0,r.jsx)(n.mdxAdmonitionTitle,{}),(0,r.jsxs)(n.p,{children:["Starting K3s without encryption and enabling it at a later time is currently ",(0,r.jsx)(n.em,{children:"not"})," supported."]})]}),"\n"]}),"\n",(0,r.jsxs)(n.li,{children:["\n",(0,r.jsx)(n.p,{children:"Prepare"}),"\n",(0,r.jsx)(n.pre,{children:(0,r.jsx)(n.code,{className:"language-bash",children:"k3s secrets-encrypt prepare\n"})}),"\n"]}),"\n",(0,r.jsxs)(n.li,{children:["\n",(0,r.jsx)(n.p,{children:"Kill and restart the K3s server with same arguments. If running K3s as a service:"}),"\n",(0,r.jsx)(n.pre,{children:(0,r.jsx)(n.code,{className:"language-bash",children:"# If using systemd\nsystemctl restart k3s\n# If using openrc\nrc-service k3s restart\n"})}),"\n"]}),"\n",(0,r.jsxs)(n.li,{children:["\n",(0,r.jsx)(n.p,{children:"Rotate"}),"\n",(0,r.jsx)(n.pre,{children:(0,r.jsx)(n.code,{className:"language-bash",children:"k3s secrets-encrypt rotate\n"})}),"\n"]}),"\n",(0,r.jsxs)(n.li,{children:["\n",(0,r.jsx)(n.p,{children:"Kill and restart the K3s server with same arguments"}),"\n"]}),"\n",(0,r.jsxs)(n.li,{children:["\n",(0,r.jsx)(n.p,{children:"Reencrypt"}),"\n",(0,r.jsx)(n.admonition,{type:"info",children:(0,r.jsxs)(n.p,{children:["K3s will reencrypt ~5 secrets per second.",(0,r.jsx)(n.br,{}),"\n","Clusters with large # of secrets can take several minutes to reencrypt."]})}),"\n",(0,r.jsx)(n.pre,{children:(0,r.jsx)(n.code,{className:"language-bash",children:"k3s secrets-encrypt reencrypt\n"})}),"\n"]}),"\n"]})]}),(0,r.jsxs)(s,{value:"High-Availability",children:[(0,r.jsx)(n.p,{children:"The steps are the same for both embedded DB and external DB clusters."}),(0,r.jsx)(n.p,{children:"To rotate secrets encryption keys on HA setups:"}),(0,r.jsxs)(n.ol,{children:["\n",(0,r.jsxs)(n.li,{children:["\n",(0,r.jsxs)(n.p,{children:["Start up all three K3s servers with the ",(0,r.jsx)(n.code,{children:"--secrets-encryption"})," flag. For brevity, the servers will be referred to as S1, S2, S3."]}),"\n",(0,r.jsx)(n.admonition,{title:"Notes",type:"note",children:(0,r.jsxs)(n.ul,{children:["\n",(0,r.jsxs)(n.li,{children:["Starting K3s without encryption and enabling it at a later time is currently ",(0,r.jsx)(n.em,{children:"not"})," supported."]}),"\n",(0,r.jsxs)(n.li,{children:["While not required, it is recommended that you pick one server node from which to run the ",(0,r.jsx)(n.code,{children:"secrets-encrypt"})," commands."]}),"\n"]})}),"\n"]}),"\n",(0,r.jsxs)(n.li,{children:["\n",(0,r.jsx)(n.p,{children:"Prepare on S1"}),"\n",(0,r.jsx)(n.pre,{children:(0,r.jsx)(n.code,{className:"language-bash",children:"k3s secrets-encrypt prepare\n"})}),"\n"]}),"\n",(0,r.jsxs)(n.li,{children:["\n",(0,r.jsx)(n.p,{children:"Kill and restart S1 with same arguments. If running K3s as a service:"}),"\n",(0,r.jsx)(n.pre,{children:(0,r.jsx)(n.code,{className:"language-bash",children:"# If using systemd\nsystemctl restart k3s\n# If using openrc\nrc-service k3s restart\n"})}),"\n"]}),"\n",(0,r.jsxs)(n.li,{children:["\n",(0,r.jsx)(n.p,{children:"Once S1 is up, kill and restart the S2 and S3"}),"\n"]}),"\n",(0,r.jsxs)(n.li,{children:["\n",(0,r.jsx)(n.p,{children:"Rotate on S1"}),"\n",(0,r.jsx)(n.pre,{children:(0,r.jsx)(n.code,{className:"language-bash",children:"k3s secrets-encrypt rotate\n"})}),"\n"]}),"\n",(0,r.jsxs)(n.li,{children:["\n",(0,r.jsx)(n.p,{children:"Kill and restart S1 with same arguments"}),"\n"]}),"\n",(0,r.jsxs)(n.li,{children:["\n",(0,r.jsx)(n.p,{children:"Once S1 is up, kill and restart the S2 and S3"}),"\n"]}),"\n",(0,r.jsxs)(n.li,{children:["\n",(0,r.jsx)(n.p,{children:"Reencrypt on S1"}),"\n",(0,r.jsx)(n.admonition,{type:"info",children:(0,r.jsxs)(n.p,{children:["K3s will reencrypt ~5 secrets per second.",(0,r.jsx)(n.br,{}),"\n","Clusters with large # of secrets can take several minutes to reencrypt."]})}),"\n",(0,r.jsx)(n.pre,{children:(0,r.jsx)(n.code,{className:"language-bash",children:"k3s secrets-encrypt reencrypt\n"})}),"\n"]}),"\n",(0,r.jsxs)(n.li,{children:["\n",(0,r.jsx)(n.p,{children:"Kill and restart S1 with same arguments"}),"\n"]}),"\n",(0,r.jsxs)(n.li,{children:["\n",(0,r.jsx)(n.p,{children:"Once S1 is up, kill and restart the S2 and S3"}),"\n"]}),"\n"]})]})]}),"\n",(0,r.jsx)(n.h3,{id:"secrets-encryption-disablere-enable",children:"Secrets Encryption Disable/Re-enable"}),"\n",(0,r.jsxs)(i,{groupId:"se",queryString:!0,children:[(0,r.jsxs)(s,{value:"Single-Server",default:!0,children:[(0,r.jsxs)(n.p,{children:["After launching a server with ",(0,r.jsx)(n.code,{children:"--secrets-encryption"})," flag, secrets encryption can be disabled."]}),(0,r.jsx)(n.p,{children:"To disable secrets encryption on a single-node cluster:"}),(0,r.jsxs)(n.ol,{children:["\n",(0,r.jsxs)(n.li,{children:["\n",(0,r.jsx)(n.p,{children:"Disable"}),"\n",(0,r.jsx)(n.pre,{children:(0,r.jsx)(n.code,{className:"language-bash",children:"k3s secrets-encrypt disable\n"})}),"\n"]}),"\n",(0,r.jsxs)(n.li,{children:["\n",(0,r.jsx)(n.p,{children:"Kill and restart the K3s server with same arguments. If running K3s as a service:"}),"\n",(0,r.jsx)(n.pre,{children:(0,r.jsx)(n.code,{className:"language-bash",children:"# If using systemd\nsystemctl restart k3s\n# If using openrc\nrc-service k3s restart\n"})}),"\n"]}),"\n",(0,r.jsxs)(n.li,{children:["\n",(0,r.jsx)(n.p,{children:"Reencrypt with flags"}),"\n",(0,r.jsx)(n.pre,{children:(0,r.jsx)(n.code,{className:"language-bash",children:"k3s secrets-encrypt reencrypt --force --skip\n"})}),"\n"]}),"\n"]}),(0,r.jsx)(n.p,{children:"To re-enable secrets encryption on a single node cluster:"}),(0,r.jsxs)(n.ol,{children:["\n",(0,r.jsxs)(n.li,{children:["\n",(0,r.jsx)(n.p,{children:"Enable"}),"\n",(0,r.jsx)(n.pre,{children:(0,r.jsx)(n.code,{className:"language-bash",children:"k3s secrets-encrypt enable\n"})}),"\n"]}),"\n",(0,r.jsxs)(n.li,{children:["\n",(0,r.jsx)(n.p,{children:"Kill and restart the K3s server with same arguments"}),"\n"]}),"\n",(0,r.jsxs)(n.li,{children:["\n",(0,r.jsx)(n.p,{children:"Reencrypt with flags"}),"\n",(0,r.jsx)(n.pre,{children:(0,r.jsx)(n.code,{className:"language-bash",children:"k3s secrets-encrypt reencrypt --force --skip\n"})}),"\n"]}),"\n"]})]}),(0,r.jsxs)(s,{value:"High-Availability",children:[(0,r.jsxs)(n.p,{children:["After launching a HA cluster with ",(0,r.jsx)(n.code,{children:"--secrets-encryption"})," flags, secrets encryption can be disabled."]}),(0,r.jsx)(n.admonition,{type:"note",children:(0,r.jsxs)(n.p,{children:["While not required, it is recommended that you pick one server node from which to run the ",(0,r.jsx)(n.code,{children:"secrets-encrypt"})," commands."]})}),(0,r.jsx)(n.p,{children:"For brevity, the three servers used in this guide will be referred to as S1, S2, S3."}),(0,r.jsx)(n.p,{children:"To disable secrets encryption on a HA cluster:"}),(0,r.jsxs)(n.ol,{children:["\n",(0,r.jsxs)(n.li,{children:["\n",(0,r.jsx)(n.p,{children:"Disable on S1"}),"\n",(0,r.jsx)(n.pre,{children:(0,r.jsx)(n.code,{className:"language-bash",children:"k3s secrets-encrypt disable\n"})}),"\n"]}),"\n",(0,r.jsxs)(n.li,{children:["\n",(0,r.jsx)(n.p,{children:"Kill and restart S1 with same arguments. If running K3s as a service:"}),"\n",(0,r.jsx)(n.pre,{children:(0,r.jsx)(n.code,{className:"language-bash",children:"# If using systemd\nsystemctl restart k3s\n# If using openrc\nrc-service k3s restart\n"})}),"\n"]}),"\n",(0,r.jsxs)(n.li,{children:["\n",(0,r.jsx)(n.p,{children:"Once S1 is up, kill and restart the S2 and S3"}),"\n"]}),"\n",(0,r.jsxs)(n.li,{children:["\n",(0,r.jsx)(n.p,{children:"Reencrypt with flags on S1"}),"\n",(0,r.jsx)(n.pre,{children:(0,r.jsx)(n.code,{className:"language-bash",children:"k3s secrets-encrypt reencrypt --force --skip\n"})}),"\n"]}),"\n"]}),(0,r.jsx)(n.p,{children:"To re-enable secrets encryption on a HA cluster:"}),(0,r.jsxs)(n.ol,{children:["\n",(0,r.jsxs)(n.li,{children:["\n",(0,r.jsx)(n.p,{children:"Enable on S1"}),"\n",(0,r.jsx)(n.pre,{children:(0,r.jsx)(n.code,{className:"language-bash",children:"k3s secrets-encrypt enable\n"})}),"\n"]}),"\n",(0,r.jsxs)(n.li,{children:["\n",(0,r.jsx)(n.p,{children:"Kill and restart S1 with same arguments"}),"\n"]}),"\n",(0,r.jsxs)(n.li,{children:["\n",(0,r.jsx)(n.p,{children:"Once S1 is up, kill and restart the S2 and S3"}),"\n"]}),"\n",(0,r.jsxs)(n.li,{children:["\n",(0,r.jsx)(n.p,{children:"Reencrypt with flags on S1"}),"\n",(0,r.jsx)(n.pre,{children:(0,r.jsx)(n.code,{className:"language-bash",children:"k3s secrets-encrypt reencrypt --force --skip\n"})}),"\n"]}),"\n"]})]})]}),"\n",(0,r.jsx)(n.h3,{id:"secrets-encryption-status",children:"Secrets Encryption Status"}),"\n",(0,r.jsxs)(n.p,{children:["The secrets-encrypt tool includes a ",(0,r.jsx)(n.code,{children:"status"})," command that displays information about the current status of secrets encryption on the node."]}),"\n",(0,r.jsx)(n.p,{children:"An example of the command on a single-server node:"}),"\n",(0,r.jsx)(n.pre,{children:(0,r.jsx)(n.code,{className:"language-bash",children:"$ k3s secrets-encrypt status\nEncryption Status: Enabled\nCurrent Rotation Stage: start\nServer Encryption Hashes: All hashes match\n\nActive Key Type Name\n------ -------- ----\n * AES-CBC aescbckey\n\n"})}),"\n",(0,r.jsx)(n.p,{children:"Another example on HA cluster, after rotating the keys, but before restarting the servers:"}),"\n",(0,r.jsx)(n.pre,{children:(0,r.jsx)(n.code,{className:"language-bash",children:"$ k3s secrets-encrypt status\nEncryption Status: Enabled\nCurrent Rotation Stage: rotate\nServer Encryption Hashes: hash does not match between node-1 and node-2\n\nActive Key Type Name\n------ -------- ----\n * AES-CBC aescbckey-2021-12-10T22:54:38Z\n AES-CBC aescbckey\n\n"})}),"\n",(0,r.jsx)(n.p,{children:"Details on each section are as follows:"}),"\n",(0,r.jsxs)(n.ul,{children:["\n",(0,r.jsxs)(n.li,{children:[(0,r.jsx)(n.strong,{children:"Encryption Status"}),": Displayed whether secrets encryption is disabled or enabled on the node"]}),"\n",(0,r.jsxs)(n.li,{children:[(0,r.jsx)(n.strong,{children:"Current Rotation Stage"}),": Indicates the current rotation stage on the node.",(0,r.jsx)(n.br,{}),"\n","Stages are: ",(0,r.jsx)(n.code,{children:"start"}),", ",(0,r.jsx)(n.code,{children:"prepare"}),", ",(0,r.jsx)(n.code,{children:"rotate"}),", ",(0,r.jsx)(n.code,{children:"reencrypt_request"}),", ",(0,r.jsx)(n.code,{children:"reencrypt_active"}),", ",(0,r.jsx)(n.code,{children:"reencrypt_finished"})]}),"\n",(0,r.jsxs)(n.li,{children:[(0,r.jsx)(n.strong,{children:"Server Encryption Hashes"}),": Useful for HA clusters, this indicates whether all servers are on the same stage with their local files. This can be used to identify whether a restart of servers is required before proceeding to the next stage. In the HA example above, node-1 and node-2 have different hashes, indicating that they currently do not have the same encryption configuration. Restarting the servers will sync up their configuration."]}),"\n",(0,r.jsxs)(n.li,{children:[(0,r.jsx)(n.strong,{children:"Key Table"}),": Summarizes information about the secrets encryption keys found on the node.","\n",(0,r.jsxs)(n.ul,{children:["\n",(0,r.jsxs)(n.li,{children:[(0,r.jsx)(n.strong,{children:"Active"}),': The "*" indicates which, if any, of the keys are currently used for secrets encryption. An active key is used by Kubernetes to encrypt any new secrets.']}),"\n",(0,r.jsxs)(n.li,{children:[(0,r.jsx)(n.strong,{children:"Key Type"}),": All keys using this tool are ",(0,r.jsx)(n.code,{children:"AES-CBC"})," type. See more info ",(0,r.jsx)(n.a,{href:"https://kubernetes.io/docs/tasks/administer-cluster/encrypt-data/#providers",children:"here."})]}),"\n",(0,r.jsxs)(n.li,{children:[(0,r.jsx)(n.strong,{children:"Name"}),": Name of the encryption key."]}),"\n"]}),"\n"]}),"\n"]})]})}function h(e={}){const{wrapper:n}={...(0,t.a)(),...e.components};return n?(0,r.jsx)(n,{...e,children:(0,r.jsx)(d,{...e})}):d(e)}function p(e,n){throw new Error("Expected "+(n?"component":"object")+" `"+e+"` to be defined: you likely forgot to import, pass, or provide it.")}},1151:(e,n,s)=>{s.d(n,{Z:()=>l,a:()=>c});var r=s(7294);const t={},i=r.createContext(t);function c(e){const n=r.useContext(i);return r.useMemo((function(){return"function"==typeof e?e(n):{...n,...e}}),[n,e])}function l(e){let n;return n=e.disableParentContext?"function"==typeof e.components?e.components(t):e.components||t:c(e.components),r.createElement(i.Provider,{value:n},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/1be8dcfa.2f0d0788.js b/assets/js/1be8dcfa.e2983c45.js similarity index 99% rename from assets/js/1be8dcfa.2f0d0788.js rename to assets/js/1be8dcfa.e2983c45.js index 667bbdf06..e4d10d3c7 100644 --- a/assets/js/1be8dcfa.2f0d0788.js +++ b/assets/js/1be8dcfa.e2983c45.js @@ -1 +1 @@ -"use strict";(self.webpackChunkk_3_s_docs=self.webpackChunkk_3_s_docs||[]).push([[7628],{2023:(e,n,t)=>{t.r(n),t.d(n,{assets:()=>a,contentTitle:()=>i,default:()=>h,frontMatter:()=>l,metadata:()=>s,toc:()=>o});var r=t(5893),d=t(1151);const l={title:"agent"},i="k3s agent",s={id:"cli/agent",title:"agent",description:"In this section, you'll learn how to configure the K3s agent.",source:"@site/docs/cli/agent.md",sourceDirName:"cli",slug:"/cli/agent",permalink:"/cli/agent",draft:!1,unlisted:!1,editUrl:"https://github.com/k3s-io/docs/edit/main/docs/cli/agent.md",tags:[],version:"current",lastUpdatedAt:1723651727e3,frontMatter:{title:"agent"},sidebar:"mySidebar",previous:{title:"server",permalink:"/cli/server"},next:{title:"certificate",permalink:"/cli/certificate"}},a={},o=[{value:"Logging",id:"logging",level:3},{value:"Cluster Options",id:"cluster-options",level:3},{value:"Data",id:"data",level:3},{value:"Node",id:"node",level:3},{value:"Runtime",id:"runtime",level:3},{value:"Networking",id:"networking",level:3},{value:"Customized Flags",id:"customized-flags",level:3},{value:"Experimental",id:"experimental",level:3},{value:"Deprecated",id:"deprecated",level:3},{value:"Node Labels and Taints for Agents",id:"node-labels-and-taints-for-agents",level:3},{value:"K3s Agent CLI Help",id:"k3s-agent-cli-help",level:3}];function c(e){const n={a:"a",blockquote:"blockquote",code:"code",h1:"h1",h3:"h3",header:"header",p:"p",pre:"pre",table:"table",tbody:"tbody",td:"td",th:"th",thead:"thead",tr:"tr",...(0,d.a)(),...e.components};return(0,r.jsxs)(r.Fragment,{children:[(0,r.jsx)(n.header,{children:(0,r.jsx)(n.h1,{id:"k3s-agent",children:"k3s agent"})}),"\n",(0,r.jsx)(n.p,{children:"In this section, you'll learn how to configure the K3s agent."}),"\n",(0,r.jsx)(n.p,{children:"Note that servers also run an agent, so all flags listed on this page are also valid for use on servers."}),"\n",(0,r.jsxs)(n.p,{children:["Options are documented on this page as CLI flags, but can also be passed as configuration file options. See the ",(0,r.jsx)(n.a,{href:"/installation/configuration#configuration-file",children:"Configuration File"})," documentation for more information on using YAML configuration files."]}),"\n",(0,r.jsx)(n.h3,{id:"logging",children:"Logging"}),"\n",(0,r.jsxs)(n.table,{children:[(0,r.jsx)(n.thead,{children:(0,r.jsxs)(n.tr,{children:[(0,r.jsx)(n.th,{children:"Flag"}),(0,r.jsx)(n.th,{children:"Default"}),(0,r.jsx)(n.th,{children:"Description"})]})}),(0,r.jsxs)(n.tbody,{children:[(0,r.jsxs)(n.tr,{children:[(0,r.jsxs)(n.td,{children:[(0,r.jsx)(n.code,{children:"-v"})," value"]}),(0,r.jsx)(n.td,{children:"0"}),(0,r.jsx)(n.td,{children:"Number for the log level verbosity"})]}),(0,r.jsxs)(n.tr,{children:[(0,r.jsxs)(n.td,{children:[(0,r.jsx)(n.code,{children:"--vmodule"})," value"]}),(0,r.jsx)(n.td,{children:"N/A"}),(0,r.jsx)(n.td,{children:"Comma-separated list of FILE_PATTERN=LOG_LEVEL settings for file-filtered logging"})]}),(0,r.jsxs)(n.tr,{children:[(0,r.jsxs)(n.td,{children:[(0,r.jsx)(n.code,{children:"--log value, -l"})," value"]}),(0,r.jsx)(n.td,{children:"N/A"}),(0,r.jsx)(n.td,{children:"Log to file"})]}),(0,r.jsxs)(n.tr,{children:[(0,r.jsx)(n.td,{children:(0,r.jsx)(n.code,{children:"--alsologtostderr"})}),(0,r.jsx)(n.td,{children:"N/A"}),(0,r.jsx)(n.td,{children:"Log to standard error as well as file (if set)"})]})]})]}),"\n",(0,r.jsx)(n.h3,{id:"cluster-options",children:"Cluster Options"}),"\n",(0,r.jsxs)(n.table,{children:[(0,r.jsx)(n.thead,{children:(0,r.jsxs)(n.tr,{children:[(0,r.jsx)(n.th,{children:"Flag"}),(0,r.jsx)(n.th,{children:"Environment Variable"}),(0,r.jsx)(n.th,{children:"Description"})]})}),(0,r.jsxs)(n.tbody,{children:[(0,r.jsxs)(n.tr,{children:[(0,r.jsxs)(n.td,{children:[(0,r.jsx)(n.code,{children:"--token value, -t"})," value"]}),(0,r.jsx)(n.td,{children:(0,r.jsx)(n.code,{children:"K3S_TOKEN"})}),(0,r.jsx)(n.td,{children:"Token to use for authentication"})]}),(0,r.jsxs)(n.tr,{children:[(0,r.jsxs)(n.td,{children:[(0,r.jsx)(n.code,{children:"--token-file"})," value"]}),(0,r.jsx)(n.td,{children:(0,r.jsx)(n.code,{children:"K3S_TOKEN_FILE"})}),(0,r.jsx)(n.td,{children:"Token file to use for authentication"})]}),(0,r.jsxs)(n.tr,{children:[(0,r.jsxs)(n.td,{children:[(0,r.jsx)(n.code,{children:"--server value, -s"})," value"]}),(0,r.jsx)(n.td,{children:(0,r.jsx)(n.code,{children:"K3S_URL"})}),(0,r.jsx)(n.td,{children:"Server to connect to"})]})]})]}),"\n",(0,r.jsx)(n.h3,{id:"data",children:"Data"}),"\n",(0,r.jsxs)(n.table,{children:[(0,r.jsx)(n.thead,{children:(0,r.jsxs)(n.tr,{children:[(0,r.jsx)(n.th,{children:"Flag"}),(0,r.jsx)(n.th,{children:"Default"}),(0,r.jsx)(n.th,{children:"Description"})]})}),(0,r.jsx)(n.tbody,{children:(0,r.jsxs)(n.tr,{children:[(0,r.jsxs)(n.td,{children:[(0,r.jsx)(n.code,{children:"--data-dir value, -d"})," value"]}),(0,r.jsx)(n.td,{children:'"/var/lib/rancher/k3s"'}),(0,r.jsx)(n.td,{children:"Folder to hold state"})]})})]}),"\n",(0,r.jsx)(n.h3,{id:"node",children:"Node"}),"\n",(0,r.jsxs)(n.table,{children:[(0,r.jsx)(n.thead,{children:(0,r.jsxs)(n.tr,{children:[(0,r.jsx)(n.th,{children:"Flag"}),(0,r.jsx)(n.th,{children:"Environment Variable"}),(0,r.jsx)(n.th,{children:"Description"})]})}),(0,r.jsxs)(n.tbody,{children:[(0,r.jsxs)(n.tr,{children:[(0,r.jsxs)(n.td,{children:[(0,r.jsx)(n.code,{children:"--node-name"})," value"]}),(0,r.jsx)(n.td,{children:(0,r.jsx)(n.code,{children:"K3S_NODE_NAME"})}),(0,r.jsx)(n.td,{children:"Node name"})]}),(0,r.jsxs)(n.tr,{children:[(0,r.jsx)(n.td,{children:(0,r.jsx)(n.code,{children:"--with-node-id"})}),(0,r.jsx)(n.td,{children:"N/A"}),(0,r.jsx)(n.td,{children:"Append id to node name"})]}),(0,r.jsxs)(n.tr,{children:[(0,r.jsxs)(n.td,{children:[(0,r.jsx)(n.code,{children:"--node-label"})," value"]}),(0,r.jsx)(n.td,{children:"N/A"}),(0,r.jsx)(n.td,{children:"Registering and starting kubelet with set of labels"})]}),(0,r.jsxs)(n.tr,{children:[(0,r.jsxs)(n.td,{children:[(0,r.jsx)(n.code,{children:"--node-taint"})," value"]}),(0,r.jsx)(n.td,{children:"N/A"}),(0,r.jsx)(n.td,{children:"Registering kubelet with set of taints"})]}),(0,r.jsxs)(n.tr,{children:[(0,r.jsx)(n.td,{children:(0,r.jsx)(n.code,{children:"--protect-kernel-defaults"})}),(0,r.jsx)(n.td,{children:"N/A"}),(0,r.jsx)(n.td,{children:"Kernel tuning behavior. If set, error if kernel tunables are different from kubelet defaults."})]}),(0,r.jsxs)(n.tr,{children:[(0,r.jsx)(n.td,{children:(0,r.jsx)(n.code,{children:"--selinux"})}),(0,r.jsx)(n.td,{children:(0,r.jsx)(n.code,{children:"K3S_SELINUX"})}),(0,r.jsx)(n.td,{children:"Enable SELinux in containerd"})]}),(0,r.jsxs)(n.tr,{children:[(0,r.jsxs)(n.td,{children:[(0,r.jsx)(n.code,{children:"--lb-server-port"})," value"]}),(0,r.jsx)(n.td,{children:(0,r.jsx)(n.code,{children:"K3S_LB_SERVER_PORT"})}),(0,r.jsx)(n.td,{children:"Local port for supervisor client load-balancer. If the supervisor and apiserver are not colocated an additional port 1 less than this port will also be used for the apiserver client load-balancer. (default: 6444)"})]})]})]}),"\n",(0,r.jsx)(n.h3,{id:"runtime",children:"Runtime"}),"\n",(0,r.jsxs)(n.table,{children:[(0,r.jsx)(n.thead,{children:(0,r.jsxs)(n.tr,{children:[(0,r.jsx)(n.th,{children:"Flag"}),(0,r.jsx)(n.th,{children:"Default"}),(0,r.jsx)(n.th,{children:"Description"})]})}),(0,r.jsxs)(n.tbody,{children:[(0,r.jsxs)(n.tr,{children:[(0,r.jsxs)(n.td,{children:[(0,r.jsx)(n.code,{children:"--container-runtime-endpoint"})," value"]}),(0,r.jsx)(n.td,{children:"N/A"}),(0,r.jsx)(n.td,{children:"Disable embedded containerd and use the CRI socket at the given path; when used with --docker this sets the cri-docker socket path"})]}),(0,r.jsxs)(n.tr,{children:[(0,r.jsxs)(n.td,{children:[(0,r.jsx)(n.code,{children:"--pause-image"})," value"]}),(0,r.jsx)(n.td,{children:'"docker.io/rancher/pause:3.1"'}),(0,r.jsx)(n.td,{children:"Customized pause image for containerd or docker sandbox"})]}),(0,r.jsxs)(n.tr,{children:[(0,r.jsxs)(n.td,{children:[(0,r.jsx)(n.code,{children:"--private-registry"})," value"]}),(0,r.jsx)(n.td,{children:'"/etc/rancher/k3s/registries.yaml"'}),(0,r.jsx)(n.td,{children:"Private registry configuration file"})]})]})]}),"\n",(0,r.jsx)(n.h3,{id:"networking",children:"Networking"}),"\n",(0,r.jsxs)(n.table,{children:[(0,r.jsx)(n.thead,{children:(0,r.jsxs)(n.tr,{children:[(0,r.jsx)(n.th,{children:"Flag"}),(0,r.jsx)(n.th,{children:"Environment Variable"}),(0,r.jsx)(n.th,{children:"Description"})]})}),(0,r.jsxs)(n.tbody,{children:[(0,r.jsxs)(n.tr,{children:[(0,r.jsxs)(n.td,{children:[(0,r.jsx)(n.code,{children:"--node-ip value, -i"})," value"]}),(0,r.jsx)(n.td,{children:"N/A"}),(0,r.jsx)(n.td,{children:"IP address to advertise for node"})]}),(0,r.jsxs)(n.tr,{children:[(0,r.jsxs)(n.td,{children:[(0,r.jsx)(n.code,{children:"--node-external-ip"})," value"]}),(0,r.jsx)(n.td,{children:"N/A"}),(0,r.jsx)(n.td,{children:"External IP address to advertise for node"})]}),(0,r.jsxs)(n.tr,{children:[(0,r.jsxs)(n.td,{children:[(0,r.jsx)(n.code,{children:"--resolv-conf"})," value"]}),(0,r.jsx)(n.td,{children:(0,r.jsx)(n.code,{children:"K3S_RESOLV_CONF"})}),(0,r.jsx)(n.td,{children:"Kubelet resolv.conf file"})]}),(0,r.jsxs)(n.tr,{children:[(0,r.jsxs)(n.td,{children:[(0,r.jsx)(n.code,{children:"--flannel-iface"})," value"]}),(0,r.jsx)(n.td,{children:"N/A"}),(0,r.jsx)(n.td,{children:"Override default flannel interface"})]}),(0,r.jsxs)(n.tr,{children:[(0,r.jsxs)(n.td,{children:[(0,r.jsx)(n.code,{children:"--flannel-conf"})," value"]}),(0,r.jsx)(n.td,{children:"N/A"}),(0,r.jsx)(n.td,{children:"Override default flannel config file"})]}),(0,r.jsxs)(n.tr,{children:[(0,r.jsxs)(n.td,{children:[(0,r.jsx)(n.code,{children:"--flannel-cni-conf"})," value"]}),(0,r.jsx)(n.td,{children:"N/A"}),(0,r.jsx)(n.td,{children:"Override default flannel cni config file"})]})]})]}),"\n",(0,r.jsx)(n.h3,{id:"customized-flags",children:"Customized Flags"}),"\n",(0,r.jsxs)(n.table,{children:[(0,r.jsx)(n.thead,{children:(0,r.jsxs)(n.tr,{children:[(0,r.jsx)(n.th,{children:"Flag"}),(0,r.jsx)(n.th,{children:"Description"})]})}),(0,r.jsxs)(n.tbody,{children:[(0,r.jsxs)(n.tr,{children:[(0,r.jsxs)(n.td,{children:[(0,r.jsx)(n.code,{children:"--kubelet-arg"})," value"]}),(0,r.jsx)(n.td,{children:"Customized flag for kubelet process"})]}),(0,r.jsxs)(n.tr,{children:[(0,r.jsxs)(n.td,{children:[(0,r.jsx)(n.code,{children:"--kube-proxy-arg"})," value"]}),(0,r.jsx)(n.td,{children:"Customized flag for kube-proxy process"})]})]})]}),"\n",(0,r.jsx)(n.h3,{id:"experimental",children:"Experimental"}),"\n",(0,r.jsxs)(n.table,{children:[(0,r.jsx)(n.thead,{children:(0,r.jsxs)(n.tr,{children:[(0,r.jsx)(n.th,{children:"Flag"}),(0,r.jsx)(n.th,{children:"Description"})]})}),(0,r.jsxs)(n.tbody,{children:[(0,r.jsxs)(n.tr,{children:[(0,r.jsx)(n.td,{children:(0,r.jsx)(n.code,{children:"--rootless"})}),(0,r.jsx)(n.td,{children:"Run rootless"})]}),(0,r.jsxs)(n.tr,{children:[(0,r.jsx)(n.td,{children:(0,r.jsx)(n.code,{children:"--docker"})}),(0,r.jsx)(n.td,{children:"Use cri-dockerd instead of containerd"})]}),(0,r.jsxs)(n.tr,{children:[(0,r.jsx)(n.td,{children:(0,r.jsx)(n.code,{children:"--prefer-bundled-bin"})}),(0,r.jsx)(n.td,{children:"Prefer bundled userspace binaries over host binaries"})]}),(0,r.jsxs)(n.tr,{children:[(0,r.jsx)(n.td,{children:(0,r.jsx)(n.code,{children:"--disable-default-registry-endpoint"})}),(0,r.jsxs)(n.td,{children:['See "',(0,r.jsx)(n.a,{href:"/installation/private-registry#default-endpoint-fallback",children:"Default Endpoint Fallback"}),'"']})]})]})]}),"\n",(0,r.jsx)(n.h3,{id:"deprecated",children:"Deprecated"}),"\n",(0,r.jsxs)(n.table,{children:[(0,r.jsx)(n.thead,{children:(0,r.jsxs)(n.tr,{children:[(0,r.jsx)(n.th,{children:"Flag"}),(0,r.jsx)(n.th,{children:"Environment Variable"}),(0,r.jsx)(n.th,{children:"Description"})]})}),(0,r.jsxs)(n.tbody,{children:[(0,r.jsxs)(n.tr,{children:[(0,r.jsx)(n.td,{children:(0,r.jsx)(n.code,{children:"--no-flannel"})}),(0,r.jsx)(n.td,{children:"N/A"}),(0,r.jsxs)(n.td,{children:["Use ",(0,r.jsx)(n.code,{children:"--flannel-backend=none"})]})]}),(0,r.jsxs)(n.tr,{children:[(0,r.jsxs)(n.td,{children:[(0,r.jsx)(n.code,{children:"--cluster-secret"})," value"]}),(0,r.jsx)(n.td,{children:(0,r.jsx)(n.code,{children:"K3S_CLUSTER_SECRET"})}),(0,r.jsxs)(n.td,{children:["Use ",(0,r.jsx)(n.code,{children:"--token"})]})]})]})]}),"\n",(0,r.jsx)(n.h3,{id:"node-labels-and-taints-for-agents",children:"Node Labels and Taints for Agents"}),"\n",(0,r.jsxs)(n.p,{children:["K3s agents can be configured with the options ",(0,r.jsx)(n.code,{children:"--node-label"})," and ",(0,r.jsx)(n.code,{children:"--node-taint"})," which adds a label and taint to the kubelet. The two options only add labels and/or taints at registration time, so they can only be added once and not changed after that again by running K3s commands."]}),"\n",(0,r.jsx)(n.p,{children:"Below is an example showing how to add labels and a taint:"}),"\n",(0,r.jsx)(n.pre,{children:(0,r.jsx)(n.code,{className:"language-bash",children:" --node-label foo=bar \\\n --node-label hello=world \\\n --node-taint key1=value1:NoExecute\n"})}),"\n",(0,r.jsxs)(n.p,{children:["If you want to change node labels and taints after node registration you should use ",(0,r.jsx)(n.code,{children:"kubectl"}),". Refer to the official Kubernetes documentation for details on how to add ",(0,r.jsx)(n.a,{href:"https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/",children:"taints"})," and ",(0,r.jsx)(n.a,{href:"https://kubernetes.io/docs/tasks/configure-pod-container/assign-pods-nodes/#add-a-label-to-a-node",children:"node labels."})]}),"\n",(0,r.jsx)(n.h3,{id:"k3s-agent-cli-help",children:"K3s Agent CLI Help"}),"\n",(0,r.jsxs)(n.blockquote,{children:["\n",(0,r.jsxs)(n.p,{children:["If an option appears in brackets below, for example ",(0,r.jsx)(n.code,{children:"[$K3S_URL]"}),", it means that the option can be passed in as an environment variable of that name."]}),"\n"]}),"\n",(0,r.jsx)(n.pre,{children:(0,r.jsx)(n.code,{className:"language-bash",children:'NAME:\n k3s agent - Run node agent\n\nUSAGE:\n k3s agent [OPTIONS]\n\nOPTIONS:\n --config FILE, -c FILE (config) Load configuration from FILE (default: "/etc/rancher/k3s/config.yaml") [$K3S_CONFIG_FILE]\n --debug (logging) Turn on debug logs [$K3S_DEBUG]\n -v value (logging) Number for the log level verbosity (default: 0)\n --vmodule value (logging) Comma-separated list of FILE_PATTERN=LOG_LEVEL settings for file-filtered logging\n --log value, -l value (logging) Log to file\n --alsologtostderr (logging) Log to standard error as well as file (if set)\n --token value, -t value (cluster) Token to use for authentication [$K3S_TOKEN]\n --token-file value (cluster) Token file to use for authentication [$K3S_TOKEN_FILE]\n --server value, -s value (cluster) Server to connect to [$K3S_URL]\n --data-dir value, -d value (agent/data) Folder to hold state (default: "/var/lib/rancher/k3s")\n --node-name value (agent/node) Node name [$K3S_NODE_NAME]\n --with-node-id (agent/node) Append id to node name\n --node-label value (agent/node) Registering and starting kubelet with set of labels\n --node-taint value (agent/node) Registering kubelet with set of taints\n --image-credential-provider-bin-dir value (agent/node) The path to the directory where credential provider plugin binaries are located (default: "/var/lib/rancher/credentialprovider/bin")\n --image-credential-provider-config value (agent/node) The path to the credential provider plugin config file (default: "/var/lib/rancher/credentialprovider/config.yaml")\n --selinux (agent/node) Enable SELinux in containerd [$K3S_SELINUX]\n --lb-server-port value (agent/node) Local port for supervisor client load-balancer. If the supervisor and apiserver are not colocated an additional port 1 less than this port will also be used for the apiserver client load-balancer. (default: 6444) [$K3S_LB_SERVER_PORT]\n --protect-kernel-defaults (agent/node) Kernel tuning behavior. If set, error if kernel tunables are different than kubelet defaults.\n --container-runtime-endpoint value (agent/runtime) Disable embedded containerd and use the CRI socket at the given path; when used with --docker this sets the docker socket path\n --pause-image value (agent/runtime) Customized pause image for containerd or docker sandbox (default: "rancher/mirrored-pause:3.6")\n --snapshotter value (agent/runtime) Override default containerd snapshotter (default: "overlayfs")\n --private-registry value (agent/runtime) Private registry configuration file (default: "/etc/rancher/k3s/registries.yaml")\n --node-ip value, -i value (agent/networking) IPv4/IPv6 addresses to advertise for node\n --node-external-ip value (agent/networking) IPv4/IPv6 external IP addresses to advertise for node\n --resolv-conf value (agent/networking) Kubelet resolv.conf file [$K3S_RESOLV_CONF]\n --flannel-iface value (agent/networking) Override default flannel interface\n --flannel-conf value (agent/networking) Override default flannel config file\n --flannel-cni-conf value (agent/networking) Override default flannel cni config file\n --kubelet-arg value (agent/flags) Customized flag for kubelet process\n --kube-proxy-arg value (agent/flags) Customized flag for kube-proxy process\n --rootless (experimental) Run rootless\n --prefer-bundled-bin (experimental) Prefer bundled userspace binaries over host binaries\n --docker (agent/runtime) (experimental) Use cri-dockerd instead of containerd\n'})})]})}function h(e={}){const{wrapper:n}={...(0,d.a)(),...e.components};return n?(0,r.jsx)(n,{...e,children:(0,r.jsx)(c,{...e})}):c(e)}},1151:(e,n,t)=>{t.d(n,{Z:()=>s,a:()=>i});var r=t(7294);const d={},l=r.createContext(d);function i(e){const n=r.useContext(l);return r.useMemo((function(){return"function"==typeof e?e(n):{...n,...e}}),[n,e])}function s(e){let n;return n=e.disableParentContext?"function"==typeof e.components?e.components(d):e.components||d:i(e.components),r.createElement(l.Provider,{value:n},e.children)}}}]); \ No newline at end of file +"use strict";(self.webpackChunkk_3_s_docs=self.webpackChunkk_3_s_docs||[]).push([[7628],{2023:(e,n,t)=>{t.r(n),t.d(n,{assets:()=>a,contentTitle:()=>i,default:()=>h,frontMatter:()=>l,metadata:()=>s,toc:()=>o});var r=t(5893),d=t(1151);const l={title:"agent"},i="k3s agent",s={id:"cli/agent",title:"agent",description:"In this section, you'll learn how to configure the K3s agent.",source:"@site/docs/cli/agent.md",sourceDirName:"cli",slug:"/cli/agent",permalink:"/cli/agent",draft:!1,unlisted:!1,editUrl:"https://github.com/k3s-io/docs/edit/main/docs/cli/agent.md",tags:[],version:"current",lastUpdatedAt:1723747404e3,frontMatter:{title:"agent"},sidebar:"mySidebar",previous:{title:"server",permalink:"/cli/server"},next:{title:"certificate",permalink:"/cli/certificate"}},a={},o=[{value:"Logging",id:"logging",level:3},{value:"Cluster Options",id:"cluster-options",level:3},{value:"Data",id:"data",level:3},{value:"Node",id:"node",level:3},{value:"Runtime",id:"runtime",level:3},{value:"Networking",id:"networking",level:3},{value:"Customized Flags",id:"customized-flags",level:3},{value:"Experimental",id:"experimental",level:3},{value:"Deprecated",id:"deprecated",level:3},{value:"Node Labels and Taints for Agents",id:"node-labels-and-taints-for-agents",level:3},{value:"K3s Agent CLI Help",id:"k3s-agent-cli-help",level:3}];function c(e){const n={a:"a",blockquote:"blockquote",code:"code",h1:"h1",h3:"h3",header:"header",p:"p",pre:"pre",table:"table",tbody:"tbody",td:"td",th:"th",thead:"thead",tr:"tr",...(0,d.a)(),...e.components};return(0,r.jsxs)(r.Fragment,{children:[(0,r.jsx)(n.header,{children:(0,r.jsx)(n.h1,{id:"k3s-agent",children:"k3s agent"})}),"\n",(0,r.jsx)(n.p,{children:"In this section, you'll learn how to configure the K3s agent."}),"\n",(0,r.jsx)(n.p,{children:"Note that servers also run an agent, so all flags listed on this page are also valid for use on servers."}),"\n",(0,r.jsxs)(n.p,{children:["Options are documented on this page as CLI flags, but can also be passed as configuration file options. See the ",(0,r.jsx)(n.a,{href:"/installation/configuration#configuration-file",children:"Configuration File"})," documentation for more information on using YAML configuration files."]}),"\n",(0,r.jsx)(n.h3,{id:"logging",children:"Logging"}),"\n",(0,r.jsxs)(n.table,{children:[(0,r.jsx)(n.thead,{children:(0,r.jsxs)(n.tr,{children:[(0,r.jsx)(n.th,{children:"Flag"}),(0,r.jsx)(n.th,{children:"Default"}),(0,r.jsx)(n.th,{children:"Description"})]})}),(0,r.jsxs)(n.tbody,{children:[(0,r.jsxs)(n.tr,{children:[(0,r.jsxs)(n.td,{children:[(0,r.jsx)(n.code,{children:"-v"})," value"]}),(0,r.jsx)(n.td,{children:"0"}),(0,r.jsx)(n.td,{children:"Number for the log level verbosity"})]}),(0,r.jsxs)(n.tr,{children:[(0,r.jsxs)(n.td,{children:[(0,r.jsx)(n.code,{children:"--vmodule"})," value"]}),(0,r.jsx)(n.td,{children:"N/A"}),(0,r.jsx)(n.td,{children:"Comma-separated list of FILE_PATTERN=LOG_LEVEL settings for file-filtered logging"})]}),(0,r.jsxs)(n.tr,{children:[(0,r.jsxs)(n.td,{children:[(0,r.jsx)(n.code,{children:"--log value, -l"})," value"]}),(0,r.jsx)(n.td,{children:"N/A"}),(0,r.jsx)(n.td,{children:"Log to file"})]}),(0,r.jsxs)(n.tr,{children:[(0,r.jsx)(n.td,{children:(0,r.jsx)(n.code,{children:"--alsologtostderr"})}),(0,r.jsx)(n.td,{children:"N/A"}),(0,r.jsx)(n.td,{children:"Log to standard error as well as file (if set)"})]})]})]}),"\n",(0,r.jsx)(n.h3,{id:"cluster-options",children:"Cluster Options"}),"\n",(0,r.jsxs)(n.table,{children:[(0,r.jsx)(n.thead,{children:(0,r.jsxs)(n.tr,{children:[(0,r.jsx)(n.th,{children:"Flag"}),(0,r.jsx)(n.th,{children:"Environment Variable"}),(0,r.jsx)(n.th,{children:"Description"})]})}),(0,r.jsxs)(n.tbody,{children:[(0,r.jsxs)(n.tr,{children:[(0,r.jsxs)(n.td,{children:[(0,r.jsx)(n.code,{children:"--token value, -t"})," value"]}),(0,r.jsx)(n.td,{children:(0,r.jsx)(n.code,{children:"K3S_TOKEN"})}),(0,r.jsx)(n.td,{children:"Token to use for authentication"})]}),(0,r.jsxs)(n.tr,{children:[(0,r.jsxs)(n.td,{children:[(0,r.jsx)(n.code,{children:"--token-file"})," value"]}),(0,r.jsx)(n.td,{children:(0,r.jsx)(n.code,{children:"K3S_TOKEN_FILE"})}),(0,r.jsx)(n.td,{children:"Token file to use for authentication"})]}),(0,r.jsxs)(n.tr,{children:[(0,r.jsxs)(n.td,{children:[(0,r.jsx)(n.code,{children:"--server value, -s"})," value"]}),(0,r.jsx)(n.td,{children:(0,r.jsx)(n.code,{children:"K3S_URL"})}),(0,r.jsx)(n.td,{children:"Server to connect to"})]})]})]}),"\n",(0,r.jsx)(n.h3,{id:"data",children:"Data"}),"\n",(0,r.jsxs)(n.table,{children:[(0,r.jsx)(n.thead,{children:(0,r.jsxs)(n.tr,{children:[(0,r.jsx)(n.th,{children:"Flag"}),(0,r.jsx)(n.th,{children:"Default"}),(0,r.jsx)(n.th,{children:"Description"})]})}),(0,r.jsx)(n.tbody,{children:(0,r.jsxs)(n.tr,{children:[(0,r.jsxs)(n.td,{children:[(0,r.jsx)(n.code,{children:"--data-dir value, -d"})," value"]}),(0,r.jsx)(n.td,{children:'"/var/lib/rancher/k3s"'}),(0,r.jsx)(n.td,{children:"Folder to hold state"})]})})]}),"\n",(0,r.jsx)(n.h3,{id:"node",children:"Node"}),"\n",(0,r.jsxs)(n.table,{children:[(0,r.jsx)(n.thead,{children:(0,r.jsxs)(n.tr,{children:[(0,r.jsx)(n.th,{children:"Flag"}),(0,r.jsx)(n.th,{children:"Environment Variable"}),(0,r.jsx)(n.th,{children:"Description"})]})}),(0,r.jsxs)(n.tbody,{children:[(0,r.jsxs)(n.tr,{children:[(0,r.jsxs)(n.td,{children:[(0,r.jsx)(n.code,{children:"--node-name"})," value"]}),(0,r.jsx)(n.td,{children:(0,r.jsx)(n.code,{children:"K3S_NODE_NAME"})}),(0,r.jsx)(n.td,{children:"Node name"})]}),(0,r.jsxs)(n.tr,{children:[(0,r.jsx)(n.td,{children:(0,r.jsx)(n.code,{children:"--with-node-id"})}),(0,r.jsx)(n.td,{children:"N/A"}),(0,r.jsx)(n.td,{children:"Append id to node name"})]}),(0,r.jsxs)(n.tr,{children:[(0,r.jsxs)(n.td,{children:[(0,r.jsx)(n.code,{children:"--node-label"})," value"]}),(0,r.jsx)(n.td,{children:"N/A"}),(0,r.jsx)(n.td,{children:"Registering and starting kubelet with set of labels"})]}),(0,r.jsxs)(n.tr,{children:[(0,r.jsxs)(n.td,{children:[(0,r.jsx)(n.code,{children:"--node-taint"})," value"]}),(0,r.jsx)(n.td,{children:"N/A"}),(0,r.jsx)(n.td,{children:"Registering kubelet with set of taints"})]}),(0,r.jsxs)(n.tr,{children:[(0,r.jsx)(n.td,{children:(0,r.jsx)(n.code,{children:"--protect-kernel-defaults"})}),(0,r.jsx)(n.td,{children:"N/A"}),(0,r.jsx)(n.td,{children:"Kernel tuning behavior. If set, error if kernel tunables are different from kubelet defaults."})]}),(0,r.jsxs)(n.tr,{children:[(0,r.jsx)(n.td,{children:(0,r.jsx)(n.code,{children:"--selinux"})}),(0,r.jsx)(n.td,{children:(0,r.jsx)(n.code,{children:"K3S_SELINUX"})}),(0,r.jsx)(n.td,{children:"Enable SELinux in containerd"})]}),(0,r.jsxs)(n.tr,{children:[(0,r.jsxs)(n.td,{children:[(0,r.jsx)(n.code,{children:"--lb-server-port"})," value"]}),(0,r.jsx)(n.td,{children:(0,r.jsx)(n.code,{children:"K3S_LB_SERVER_PORT"})}),(0,r.jsx)(n.td,{children:"Local port for supervisor client load-balancer. If the supervisor and apiserver are not colocated an additional port 1 less than this port will also be used for the apiserver client load-balancer. (default: 6444)"})]})]})]}),"\n",(0,r.jsx)(n.h3,{id:"runtime",children:"Runtime"}),"\n",(0,r.jsxs)(n.table,{children:[(0,r.jsx)(n.thead,{children:(0,r.jsxs)(n.tr,{children:[(0,r.jsx)(n.th,{children:"Flag"}),(0,r.jsx)(n.th,{children:"Default"}),(0,r.jsx)(n.th,{children:"Description"})]})}),(0,r.jsxs)(n.tbody,{children:[(0,r.jsxs)(n.tr,{children:[(0,r.jsxs)(n.td,{children:[(0,r.jsx)(n.code,{children:"--container-runtime-endpoint"})," value"]}),(0,r.jsx)(n.td,{children:"N/A"}),(0,r.jsx)(n.td,{children:"Disable embedded containerd and use the CRI socket at the given path; when used with --docker this sets the cri-docker socket path"})]}),(0,r.jsxs)(n.tr,{children:[(0,r.jsxs)(n.td,{children:[(0,r.jsx)(n.code,{children:"--pause-image"})," value"]}),(0,r.jsx)(n.td,{children:'"docker.io/rancher/pause:3.1"'}),(0,r.jsx)(n.td,{children:"Customized pause image for containerd or docker sandbox"})]}),(0,r.jsxs)(n.tr,{children:[(0,r.jsxs)(n.td,{children:[(0,r.jsx)(n.code,{children:"--private-registry"})," value"]}),(0,r.jsx)(n.td,{children:'"/etc/rancher/k3s/registries.yaml"'}),(0,r.jsx)(n.td,{children:"Private registry configuration file"})]})]})]}),"\n",(0,r.jsx)(n.h3,{id:"networking",children:"Networking"}),"\n",(0,r.jsxs)(n.table,{children:[(0,r.jsx)(n.thead,{children:(0,r.jsxs)(n.tr,{children:[(0,r.jsx)(n.th,{children:"Flag"}),(0,r.jsx)(n.th,{children:"Environment Variable"}),(0,r.jsx)(n.th,{children:"Description"})]})}),(0,r.jsxs)(n.tbody,{children:[(0,r.jsxs)(n.tr,{children:[(0,r.jsxs)(n.td,{children:[(0,r.jsx)(n.code,{children:"--node-ip value, -i"})," value"]}),(0,r.jsx)(n.td,{children:"N/A"}),(0,r.jsx)(n.td,{children:"IP address to advertise for node"})]}),(0,r.jsxs)(n.tr,{children:[(0,r.jsxs)(n.td,{children:[(0,r.jsx)(n.code,{children:"--node-external-ip"})," value"]}),(0,r.jsx)(n.td,{children:"N/A"}),(0,r.jsx)(n.td,{children:"External IP address to advertise for node"})]}),(0,r.jsxs)(n.tr,{children:[(0,r.jsxs)(n.td,{children:[(0,r.jsx)(n.code,{children:"--resolv-conf"})," value"]}),(0,r.jsx)(n.td,{children:(0,r.jsx)(n.code,{children:"K3S_RESOLV_CONF"})}),(0,r.jsx)(n.td,{children:"Kubelet resolv.conf file"})]}),(0,r.jsxs)(n.tr,{children:[(0,r.jsxs)(n.td,{children:[(0,r.jsx)(n.code,{children:"--flannel-iface"})," value"]}),(0,r.jsx)(n.td,{children:"N/A"}),(0,r.jsx)(n.td,{children:"Override default flannel interface"})]}),(0,r.jsxs)(n.tr,{children:[(0,r.jsxs)(n.td,{children:[(0,r.jsx)(n.code,{children:"--flannel-conf"})," value"]}),(0,r.jsx)(n.td,{children:"N/A"}),(0,r.jsx)(n.td,{children:"Override default flannel config file"})]}),(0,r.jsxs)(n.tr,{children:[(0,r.jsxs)(n.td,{children:[(0,r.jsx)(n.code,{children:"--flannel-cni-conf"})," value"]}),(0,r.jsx)(n.td,{children:"N/A"}),(0,r.jsx)(n.td,{children:"Override default flannel cni config file"})]})]})]}),"\n",(0,r.jsx)(n.h3,{id:"customized-flags",children:"Customized Flags"}),"\n",(0,r.jsxs)(n.table,{children:[(0,r.jsx)(n.thead,{children:(0,r.jsxs)(n.tr,{children:[(0,r.jsx)(n.th,{children:"Flag"}),(0,r.jsx)(n.th,{children:"Description"})]})}),(0,r.jsxs)(n.tbody,{children:[(0,r.jsxs)(n.tr,{children:[(0,r.jsxs)(n.td,{children:[(0,r.jsx)(n.code,{children:"--kubelet-arg"})," value"]}),(0,r.jsx)(n.td,{children:"Customized flag for kubelet process"})]}),(0,r.jsxs)(n.tr,{children:[(0,r.jsxs)(n.td,{children:[(0,r.jsx)(n.code,{children:"--kube-proxy-arg"})," value"]}),(0,r.jsx)(n.td,{children:"Customized flag for kube-proxy process"})]})]})]}),"\n",(0,r.jsx)(n.h3,{id:"experimental",children:"Experimental"}),"\n",(0,r.jsxs)(n.table,{children:[(0,r.jsx)(n.thead,{children:(0,r.jsxs)(n.tr,{children:[(0,r.jsx)(n.th,{children:"Flag"}),(0,r.jsx)(n.th,{children:"Description"})]})}),(0,r.jsxs)(n.tbody,{children:[(0,r.jsxs)(n.tr,{children:[(0,r.jsx)(n.td,{children:(0,r.jsx)(n.code,{children:"--rootless"})}),(0,r.jsx)(n.td,{children:"Run rootless"})]}),(0,r.jsxs)(n.tr,{children:[(0,r.jsx)(n.td,{children:(0,r.jsx)(n.code,{children:"--docker"})}),(0,r.jsx)(n.td,{children:"Use cri-dockerd instead of containerd"})]}),(0,r.jsxs)(n.tr,{children:[(0,r.jsx)(n.td,{children:(0,r.jsx)(n.code,{children:"--prefer-bundled-bin"})}),(0,r.jsx)(n.td,{children:"Prefer bundled userspace binaries over host binaries"})]}),(0,r.jsxs)(n.tr,{children:[(0,r.jsx)(n.td,{children:(0,r.jsx)(n.code,{children:"--disable-default-registry-endpoint"})}),(0,r.jsxs)(n.td,{children:['See "',(0,r.jsx)(n.a,{href:"/installation/private-registry#default-endpoint-fallback",children:"Default Endpoint Fallback"}),'"']})]})]})]}),"\n",(0,r.jsx)(n.h3,{id:"deprecated",children:"Deprecated"}),"\n",(0,r.jsxs)(n.table,{children:[(0,r.jsx)(n.thead,{children:(0,r.jsxs)(n.tr,{children:[(0,r.jsx)(n.th,{children:"Flag"}),(0,r.jsx)(n.th,{children:"Environment Variable"}),(0,r.jsx)(n.th,{children:"Description"})]})}),(0,r.jsxs)(n.tbody,{children:[(0,r.jsxs)(n.tr,{children:[(0,r.jsx)(n.td,{children:(0,r.jsx)(n.code,{children:"--no-flannel"})}),(0,r.jsx)(n.td,{children:"N/A"}),(0,r.jsxs)(n.td,{children:["Use ",(0,r.jsx)(n.code,{children:"--flannel-backend=none"})]})]}),(0,r.jsxs)(n.tr,{children:[(0,r.jsxs)(n.td,{children:[(0,r.jsx)(n.code,{children:"--cluster-secret"})," value"]}),(0,r.jsx)(n.td,{children:(0,r.jsx)(n.code,{children:"K3S_CLUSTER_SECRET"})}),(0,r.jsxs)(n.td,{children:["Use ",(0,r.jsx)(n.code,{children:"--token"})]})]})]})]}),"\n",(0,r.jsx)(n.h3,{id:"node-labels-and-taints-for-agents",children:"Node Labels and Taints for Agents"}),"\n",(0,r.jsxs)(n.p,{children:["K3s agents can be configured with the options ",(0,r.jsx)(n.code,{children:"--node-label"})," and ",(0,r.jsx)(n.code,{children:"--node-taint"})," which adds a label and taint to the kubelet. The two options only add labels and/or taints at registration time, so they can only be added once and not changed after that again by running K3s commands."]}),"\n",(0,r.jsx)(n.p,{children:"Below is an example showing how to add labels and a taint:"}),"\n",(0,r.jsx)(n.pre,{children:(0,r.jsx)(n.code,{className:"language-bash",children:" --node-label foo=bar \\\n --node-label hello=world \\\n --node-taint key1=value1:NoExecute\n"})}),"\n",(0,r.jsxs)(n.p,{children:["If you want to change node labels and taints after node registration you should use ",(0,r.jsx)(n.code,{children:"kubectl"}),". Refer to the official Kubernetes documentation for details on how to add ",(0,r.jsx)(n.a,{href:"https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/",children:"taints"})," and ",(0,r.jsx)(n.a,{href:"https://kubernetes.io/docs/tasks/configure-pod-container/assign-pods-nodes/#add-a-label-to-a-node",children:"node labels."})]}),"\n",(0,r.jsx)(n.h3,{id:"k3s-agent-cli-help",children:"K3s Agent CLI Help"}),"\n",(0,r.jsxs)(n.blockquote,{children:["\n",(0,r.jsxs)(n.p,{children:["If an option appears in brackets below, for example ",(0,r.jsx)(n.code,{children:"[$K3S_URL]"}),", it means that the option can be passed in as an environment variable of that name."]}),"\n"]}),"\n",(0,r.jsx)(n.pre,{children:(0,r.jsx)(n.code,{className:"language-bash",children:'NAME:\n k3s agent - Run node agent\n\nUSAGE:\n k3s agent [OPTIONS]\n\nOPTIONS:\n --config FILE, -c FILE (config) Load configuration from FILE (default: "/etc/rancher/k3s/config.yaml") [$K3S_CONFIG_FILE]\n --debug (logging) Turn on debug logs [$K3S_DEBUG]\n -v value (logging) Number for the log level verbosity (default: 0)\n --vmodule value (logging) Comma-separated list of FILE_PATTERN=LOG_LEVEL settings for file-filtered logging\n --log value, -l value (logging) Log to file\n --alsologtostderr (logging) Log to standard error as well as file (if set)\n --token value, -t value (cluster) Token to use for authentication [$K3S_TOKEN]\n --token-file value (cluster) Token file to use for authentication [$K3S_TOKEN_FILE]\n --server value, -s value (cluster) Server to connect to [$K3S_URL]\n --data-dir value, -d value (agent/data) Folder to hold state (default: "/var/lib/rancher/k3s")\n --node-name value (agent/node) Node name [$K3S_NODE_NAME]\n --with-node-id (agent/node) Append id to node name\n --node-label value (agent/node) Registering and starting kubelet with set of labels\n --node-taint value (agent/node) Registering kubelet with set of taints\n --image-credential-provider-bin-dir value (agent/node) The path to the directory where credential provider plugin binaries are located (default: "/var/lib/rancher/credentialprovider/bin")\n --image-credential-provider-config value (agent/node) The path to the credential provider plugin config file (default: "/var/lib/rancher/credentialprovider/config.yaml")\n --selinux (agent/node) Enable SELinux in containerd [$K3S_SELINUX]\n --lb-server-port value (agent/node) Local port for supervisor client load-balancer. If the supervisor and apiserver are not colocated an additional port 1 less than this port will also be used for the apiserver client load-balancer. (default: 6444) [$K3S_LB_SERVER_PORT]\n --protect-kernel-defaults (agent/node) Kernel tuning behavior. If set, error if kernel tunables are different than kubelet defaults.\n --container-runtime-endpoint value (agent/runtime) Disable embedded containerd and use the CRI socket at the given path; when used with --docker this sets the docker socket path\n --pause-image value (agent/runtime) Customized pause image for containerd or docker sandbox (default: "rancher/mirrored-pause:3.6")\n --snapshotter value (agent/runtime) Override default containerd snapshotter (default: "overlayfs")\n --private-registry value (agent/runtime) Private registry configuration file (default: "/etc/rancher/k3s/registries.yaml")\n --node-ip value, -i value (agent/networking) IPv4/IPv6 addresses to advertise for node\n --node-external-ip value (agent/networking) IPv4/IPv6 external IP addresses to advertise for node\n --resolv-conf value (agent/networking) Kubelet resolv.conf file [$K3S_RESOLV_CONF]\n --flannel-iface value (agent/networking) Override default flannel interface\n --flannel-conf value (agent/networking) Override default flannel config file\n --flannel-cni-conf value (agent/networking) Override default flannel cni config file\n --kubelet-arg value (agent/flags) Customized flag for kubelet process\n --kube-proxy-arg value (agent/flags) Customized flag for kube-proxy process\n --rootless (experimental) Run rootless\n --prefer-bundled-bin (experimental) Prefer bundled userspace binaries over host binaries\n --docker (agent/runtime) (experimental) Use cri-dockerd instead of containerd\n'})})]})}function h(e={}){const{wrapper:n}={...(0,d.a)(),...e.components};return n?(0,r.jsx)(n,{...e,children:(0,r.jsx)(c,{...e})}):c(e)}},1151:(e,n,t)=>{t.d(n,{Z:()=>s,a:()=>i});var r=t(7294);const d={},l=r.createContext(d);function i(e){const n=r.useContext(l);return r.useMemo((function(){return"function"==typeof e?e(n):{...n,...e}}),[n,e])}function s(e){let n;return n=e.disableParentContext?"function"==typeof e.components?e.components(d):e.components||d:i(e.components),r.createElement(l.Provider,{value:n},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/1e924268.ac2a25db.js b/assets/js/1e924268.f54cd95f.js similarity index 98% rename from assets/js/1e924268.ac2a25db.js rename to assets/js/1e924268.f54cd95f.js index dfc0e6ea1..3a4ac8c82 100644 --- a/assets/js/1e924268.ac2a25db.js +++ b/assets/js/1e924268.f54cd95f.js @@ -1 +1 @@ -"use strict";(self.webpackChunkk_3_s_docs=self.webpackChunkk_3_s_docs||[]).push([[8614],{770:(e,n,t)=>{t.r(n),t.d(n,{assets:()=>l,contentTitle:()=>a,default:()=>u,frontMatter:()=>o,metadata:()=>r,toc:()=>c});var i=t(5893),s=t(1151);const o={title:"Installation"},a=void 0,r={id:"installation/installation",title:"Installation",description:"This section contains instructions for installing K3s in various environments. Please ensure you have met the Requirements before you begin installing K3s.",source:"@site/docs/installation/installation.md",sourceDirName:"installation",slug:"/installation/",permalink:"/installation/",draft:!1,unlisted:!1,editUrl:"https://github.com/k3s-io/docs/edit/main/docs/installation/installation.md",tags:[],version:"current",lastUpdatedAt:1723651727e3,frontMatter:{title:"Installation"},sidebar:"mySidebar",previous:{title:"Quick-Start Guide",permalink:"/quick-start"},next:{title:"Requirements",permalink:"/installation/requirements"}},l={},c=[];function d(e){const n={a:"a",code:"code",p:"p",...(0,s.a)(),...e.components};return(0,i.jsxs)(i.Fragment,{children:[(0,i.jsxs)(n.p,{children:["This section contains instructions for installing K3s in various environments. Please ensure you have met the ",(0,i.jsx)(n.a,{href:"/installation/requirements",children:"Requirements"})," before you begin installing K3s."]}),"\n",(0,i.jsxs)(n.p,{children:[(0,i.jsx)(n.a,{href:"/installation/configuration",children:"Configuration Options"})," provides guidance on the options available to you when installing K3s."]}),"\n",(0,i.jsxs)(n.p,{children:[(0,i.jsx)(n.a,{href:"/installation/private-registry",children:"Private Registry Configuration"})," covers use of ",(0,i.jsx)(n.code,{children:"registries.yaml"})," to configure container image registry mirrors."]}),"\n",(0,i.jsxs)(n.p,{children:[(0,i.jsx)(n.a,{href:"/installation/registry-mirror",children:"Embedded Mirror"})," shows how to enable the embedded distributed image registry mirror."]}),"\n",(0,i.jsxs)(n.p,{children:[(0,i.jsx)(n.a,{href:"/installation/airgap",children:"Air-Gap Install"})," details how to set up K3s in environments that do not have direct access to the Internet."]}),"\n",(0,i.jsxs)(n.p,{children:[(0,i.jsx)(n.a,{href:"/installation/server-roles",children:"Managing Server Roles"})," details how to set up K3s with dedicated ",(0,i.jsx)(n.code,{children:"control-plane"})," or ",(0,i.jsx)(n.code,{children:"etcd"})," servers."]}),"\n",(0,i.jsxs)(n.p,{children:[(0,i.jsx)(n.a,{href:"/installation/packaged-components",children:"Managing Packaged Components"})," details how to disable packaged components, or install your own using auto-deploying manifests."]}),"\n",(0,i.jsxs)(n.p,{children:[(0,i.jsx)(n.a,{href:"/installation/uninstall",children:"Uninstalling K3s"})," details how to remove K3s from a host."]})]})}function u(e={}){const{wrapper:n}={...(0,s.a)(),...e.components};return n?(0,i.jsx)(n,{...e,children:(0,i.jsx)(d,{...e})}):d(e)}},1151:(e,n,t)=>{t.d(n,{Z:()=>r,a:()=>a});var i=t(7294);const s={},o=i.createContext(s);function a(e){const n=i.useContext(o);return i.useMemo((function(){return"function"==typeof e?e(n):{...n,...e}}),[n,e])}function r(e){let n;return n=e.disableParentContext?"function"==typeof e.components?e.components(s):e.components||s:a(e.components),i.createElement(o.Provider,{value:n},e.children)}}}]); \ No newline at end of file +"use strict";(self.webpackChunkk_3_s_docs=self.webpackChunkk_3_s_docs||[]).push([[8614],{770:(e,n,t)=>{t.r(n),t.d(n,{assets:()=>l,contentTitle:()=>a,default:()=>u,frontMatter:()=>o,metadata:()=>r,toc:()=>c});var i=t(5893),s=t(1151);const o={title:"Installation"},a=void 0,r={id:"installation/installation",title:"Installation",description:"This section contains instructions for installing K3s in various environments. Please ensure you have met the Requirements before you begin installing K3s.",source:"@site/docs/installation/installation.md",sourceDirName:"installation",slug:"/installation/",permalink:"/installation/",draft:!1,unlisted:!1,editUrl:"https://github.com/k3s-io/docs/edit/main/docs/installation/installation.md",tags:[],version:"current",lastUpdatedAt:1723747404e3,frontMatter:{title:"Installation"},sidebar:"mySidebar",previous:{title:"Quick-Start Guide",permalink:"/quick-start"},next:{title:"Requirements",permalink:"/installation/requirements"}},l={},c=[];function d(e){const n={a:"a",code:"code",p:"p",...(0,s.a)(),...e.components};return(0,i.jsxs)(i.Fragment,{children:[(0,i.jsxs)(n.p,{children:["This section contains instructions for installing K3s in various environments. Please ensure you have met the ",(0,i.jsx)(n.a,{href:"/installation/requirements",children:"Requirements"})," before you begin installing K3s."]}),"\n",(0,i.jsxs)(n.p,{children:[(0,i.jsx)(n.a,{href:"/installation/configuration",children:"Configuration Options"})," provides guidance on the options available to you when installing K3s."]}),"\n",(0,i.jsxs)(n.p,{children:[(0,i.jsx)(n.a,{href:"/installation/private-registry",children:"Private Registry Configuration"})," covers use of ",(0,i.jsx)(n.code,{children:"registries.yaml"})," to configure container image registry mirrors."]}),"\n",(0,i.jsxs)(n.p,{children:[(0,i.jsx)(n.a,{href:"/installation/registry-mirror",children:"Embedded Mirror"})," shows how to enable the embedded distributed image registry mirror."]}),"\n",(0,i.jsxs)(n.p,{children:[(0,i.jsx)(n.a,{href:"/installation/airgap",children:"Air-Gap Install"})," details how to set up K3s in environments that do not have direct access to the Internet."]}),"\n",(0,i.jsxs)(n.p,{children:[(0,i.jsx)(n.a,{href:"/installation/server-roles",children:"Managing Server Roles"})," details how to set up K3s with dedicated ",(0,i.jsx)(n.code,{children:"control-plane"})," or ",(0,i.jsx)(n.code,{children:"etcd"})," servers."]}),"\n",(0,i.jsxs)(n.p,{children:[(0,i.jsx)(n.a,{href:"/installation/packaged-components",children:"Managing Packaged Components"})," details how to disable packaged components, or install your own using auto-deploying manifests."]}),"\n",(0,i.jsxs)(n.p,{children:[(0,i.jsx)(n.a,{href:"/installation/uninstall",children:"Uninstalling K3s"})," details how to remove K3s from a host."]})]})}function u(e={}){const{wrapper:n}={...(0,s.a)(),...e.components};return n?(0,i.jsx)(n,{...e,children:(0,i.jsx)(d,{...e})}):d(e)}},1151:(e,n,t)=>{t.d(n,{Z:()=>r,a:()=>a});var i=t(7294);const s={},o=i.createContext(s);function a(e){const n=i.useContext(o);return i.useMemo((function(){return"function"==typeof e?e(n):{...n,...e}}),[n,e])}function r(e){let n;return n=e.disableParentContext?"function"==typeof e.components?e.components(s):e.components||s:a(e.components),i.createElement(o.Provider,{value:n},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/2a65762c.bafbe9a1.js b/assets/js/2a65762c.69a0a67c.js similarity index 99% rename from assets/js/2a65762c.bafbe9a1.js rename to assets/js/2a65762c.69a0a67c.js index f7ed9b6ec..0969c9530 100644 --- a/assets/js/2a65762c.bafbe9a1.js +++ b/assets/js/2a65762c.69a0a67c.js @@ -1 +1 @@ -"use strict";(self.webpackChunkk_3_s_docs=self.webpackChunkk_3_s_docs||[]).push([[1430],{7084:(e,t,n)=>{n.r(t),n.d(t,{assets:()=>c,contentTitle:()=>o,default:()=>h,frontMatter:()=>i,metadata:()=>d,toc:()=>l});var s=n(5893),r=n(1151);const i={title:"token"},o="k3s token",d={id:"cli/token",title:"token",description:"K3s uses tokens to secure the node join process. Tokens authenticate the cluster to the joining node, and the node to the cluster.",source:"@site/docs/cli/token.md",sourceDirName:"cli",slug:"/cli/token",permalink:"/cli/token",draft:!1,unlisted:!1,editUrl:"https://github.com/k3s-io/docs/edit/main/docs/cli/token.md",tags:[],version:"current",lastUpdatedAt:1723651727e3,frontMatter:{title:"token"},sidebar:"mySidebar",previous:{title:"secrets-encrypt",permalink:"/cli/secrets-encrypt"},next:{title:"Architecture",permalink:"/architecture"}},c={},l=[{value:"Token Format",id:"token-format",level:2},{value:"Secure",id:"secure",level:3},{value:"TLS Bootstrapping",id:"tls-bootstrapping",level:4},{value:"Short",id:"short",level:3},{value:"Token Types",id:"token-types",level:2},{value:"Server",id:"server",level:3},{value:"Agent",id:"agent",level:3},{value:"Bootstrap",id:"bootstrap",level:3},{value:"k3s token",id:"k3s-token-1",level:2},{value:"k3s token create [token]",id:"k3s-token-create-token",level:4},{value:"k3s token delete",id:"k3s-token-delete",level:4},{value:"k3s token generate",id:"k3s-token-generate",level:4},{value:"k3s token list",id:"k3s-token-list",level:4},{value:"k3s token rotate",id:"k3s-token-rotate",level:4}];function a(e){const t={a:"a",admonition:"admonition",br:"br",code:"code",h1:"h1",h2:"h2",h3:"h3",h4:"h4",header:"header",li:"li",ol:"ol",p:"p",pre:"pre",table:"table",tbody:"tbody",td:"td",th:"th",thead:"thead",tr:"tr",ul:"ul",...(0,r.a)(),...e.components};return(0,s.jsxs)(s.Fragment,{children:[(0,s.jsx)(t.header,{children:(0,s.jsx)(t.h1,{id:"k3s-token",children:"k3s token"})}),"\n",(0,s.jsx)(t.p,{children:"K3s uses tokens to secure the node join process. Tokens authenticate the cluster to the joining node, and the node to the cluster."}),"\n",(0,s.jsx)(t.h2,{id:"token-format",children:"Token Format"}),"\n",(0,s.jsx)(t.p,{children:"K3s tokens can be specified in either secure or short format. The secure format is preferred, as it enables the client to authenticate the identity of the cluster it is joining, before sending credentials."}),"\n",(0,s.jsx)(t.h3,{id:"secure",children:"Secure"}),"\n",(0,s.jsx)(t.p,{children:'The secure token format (occasionally referred to as a "full" token) contains the following parts:'}),"\n",(0,s.jsx)(t.p,{children:(0,s.jsx)(t.code,{children:"::"})}),"\n",(0,s.jsxs)(t.ul,{children:["\n",(0,s.jsxs)(t.li,{children:[(0,s.jsx)(t.code,{children:"prefix"}),": a fixed ",(0,s.jsx)(t.code,{children:"K10"})," prefix that identifies the token format"]}),"\n",(0,s.jsxs)(t.li,{children:[(0,s.jsx)(t.code,{children:"cluster CA hash"}),": The hash of the cluster's server CA certificate, used to authenticate the server to the joining node.","\n",(0,s.jsxs)(t.ul,{children:["\n",(0,s.jsx)(t.li,{children:"For self-signed CA certificates, this is the SHA256 sum of the PEM-formatted certificate, as stored on disk."}),"\n",(0,s.jsx)(t.li,{children:"For custom CA certificates, this is the SHA256 sum of the DER encoding of the root certificate; commonly known as the certificate fingerprint."}),"\n"]}),"\n"]}),"\n",(0,s.jsxs)(t.li,{children:[(0,s.jsx)(t.code,{children:"credentials"}),": The username and password, or bearer token, used to authenticate the joining node to the cluster."]}),"\n"]}),"\n",(0,s.jsx)(t.h4,{id:"tls-bootstrapping",children:"TLS Bootstrapping"}),"\n",(0,s.jsx)(t.p,{children:"When a secure token is specified, the joining node performs the following steps to validate the identity of the server it has connected to, before transmitting credentials:"}),"\n",(0,s.jsxs)(t.ol,{children:["\n",(0,s.jsxs)(t.li,{children:["With TLS verification disabled, download the CA bundle from ",(0,s.jsx)(t.code,{children:"/cacerts"})," on the server it is joining."]}),"\n",(0,s.jsx)(t.li,{children:"Calculate the SHA256 hash of the CA certificate, as described above."}),"\n",(0,s.jsx)(t.li,{children:"Compare the calculated SHA256 hash to the hash from the token."}),"\n",(0,s.jsx)(t.li,{children:"If the hash matches, validate that the certificate presented by the server can be validated by the server's CA bundle."}),"\n",(0,s.jsx)(t.li,{children:"If the server certificate is valid, present credentials to join the cluster using either basic or bearer token authentication, depending on the token type."}),"\n"]}),"\n",(0,s.jsx)(t.h3,{id:"short",children:"Short"}),"\n",(0,s.jsx)(t.p,{children:"The short token format includes only the password or bearer token used to authenticate the joining node to the cluster."}),"\n",(0,s.jsxs)(t.p,{children:["If a short token is used, the joining node implicitly trusts the CA bundle presented by the server; steps 2-4 in the TLS Bootstrapping process are skipped. The initial connection may be vulnerable to ",(0,s.jsx)(t.a,{href:"https://en.wikipedia.org/wiki/Man-in-the-middle_attack",children:"man-in-the-middle"})," attack."]}),"\n",(0,s.jsx)(t.h2,{id:"token-types",children:"Token Types"}),"\n",(0,s.jsx)(t.p,{children:"K3s supports three types of tokens. Only the server token is available by default; additional token types must be configured or created by the administrator."}),"\n",(0,s.jsxs)(t.table,{children:[(0,s.jsx)(t.thead,{children:(0,s.jsxs)(t.tr,{children:[(0,s.jsx)(t.th,{children:"Type"}),(0,s.jsx)(t.th,{children:"CLI Option"}),(0,s.jsx)(t.th,{children:"Environment Variable"})]})}),(0,s.jsxs)(t.tbody,{children:[(0,s.jsxs)(t.tr,{children:[(0,s.jsx)(t.td,{children:"Server"}),(0,s.jsx)(t.td,{children:(0,s.jsx)(t.code,{children:"--token"})}),(0,s.jsx)(t.td,{children:(0,s.jsx)(t.code,{children:"K3S_TOKEN"})})]}),(0,s.jsxs)(t.tr,{children:[(0,s.jsx)(t.td,{children:"Agent"}),(0,s.jsx)(t.td,{children:(0,s.jsx)(t.code,{children:"--agent-token"})}),(0,s.jsx)(t.td,{children:(0,s.jsx)(t.code,{children:"K3S_AGENT_TOKEN"})})]}),(0,s.jsxs)(t.tr,{children:[(0,s.jsx)(t.td,{children:"Bootstrap"}),(0,s.jsx)(t.td,{children:(0,s.jsx)(t.code,{children:"n/a"})}),(0,s.jsx)(t.td,{children:(0,s.jsx)(t.code,{children:"n/a"})})]})]})]}),"\n",(0,s.jsx)(t.h3,{id:"server",children:"Server"}),"\n",(0,s.jsxs)(t.p,{children:["If no token is provided when starting the first server in the cluster, one is created with a random password. The server token is always written to ",(0,s.jsx)(t.code,{children:"/var/lib/rancher/k3s/server/token"}),", in secure format."]}),"\n",(0,s.jsx)(t.p,{children:"The server token can be used to join both server and agent nodes to the cluster. It cannot be changed once the cluster has been created, and anyone with access to the server token essentially has full administrator access to the cluster. This token should be guarded carefully."}),"\n",(0,s.jsxs)(t.p,{children:["The server token is also used as the ",(0,s.jsx)(t.a,{href:"https://en.wikipedia.org/wiki/PBKDF2",children:"PBKDF2"})," passphrase for the key used to encrypt confidential information that is persisted to the datastore, such as the secrets-encryption configuration, wireguard keys, and private keys for cluster CA certificates and service-account tokens. For this reason, the token must be backed up alongside the cluster datastore itself."]}),"\n",(0,s.jsx)(t.admonition,{type:"warning",children:(0,s.jsx)(t.p,{children:"Unless custom CA certificates are in use, only the short (password-only) token format can be used when starting the first server in the cluster. This is because the cluster CA hash cannot be known until after the server has generated the self-signed cluster CA certificates."})}),"\n",(0,s.jsxs)(t.p,{children:["For more information on using custom CA certificates, see the ",(0,s.jsxs)(t.a,{href:"/cli/certificate",children:[(0,s.jsx)(t.code,{children:"k3s certificate"})," documentation"]}),".",(0,s.jsx)(t.br,{}),"\n","For more information on backing up your cluster, see the ",(0,s.jsx)(t.a,{href:"/datastore/backup-restore",children:"Backup and Restore"})," documentation."]}),"\n",(0,s.jsx)(t.h3,{id:"agent",children:"Agent"}),"\n",(0,s.jsx)(t.p,{children:"By default, the agent token is the same as the server token. The agent token can be set before or after the cluster has been started, by changing the CLI option or environment variable on all servers in the cluster. The agent token is similar to the server token in that is it statically configured, and does not expire."}),"\n",(0,s.jsxs)(t.p,{children:["The agent token is written to ",(0,s.jsx)(t.code,{children:"/var/lib/rancher/k3s/server/agent-token"}),", in secure format. If no agent token is specified, this file is a link to the server token."]}),"\n",(0,s.jsx)(t.h3,{id:"bootstrap",children:"Bootstrap"}),"\n",(0,s.jsx)(t.admonition,{title:"Version Gate",type:"info",children:(0,s.jsxs)(t.p,{children:["Support for the ",(0,s.jsx)(t.code,{children:"k3s token"})," command and the ability to join nodes with bootstrap tokens is available starting with the 2023-02 releases (v1.26.2+k3s1, v1.25.7+k3s1, v1.24.11+k3s1, v1.23.17+k3s1)."]})}),"\n",(0,s.jsx)(t.p,{children:"K3s supports dynamically generated, automatically expiring agent bootstrap tokens. Bootstrap tokens can only be used to join agents."}),"\n",(0,s.jsx)(t.h2,{id:"k3s-token-1",children:"k3s token"}),"\n",(0,s.jsxs)(t.p,{children:["K3s bootstrap tokens use the same generation and validation code as ",(0,s.jsx)(t.code,{children:"kubeadm token"})," bootstrap tokens, and the ",(0,s.jsx)(t.code,{children:"k3s token"})," CLI is similar."]}),"\n",(0,s.jsx)(t.pre,{children:(0,s.jsx)(t.code,{children:"NAME:\n k3s token - Manage bootstrap tokens\n\nUSAGE:\n k3s token command [command options] [arguments...]\n\nCOMMANDS:\n create Create bootstrap tokens on the server\n delete Delete bootstrap tokens on the server\n generate Generate and print a bootstrap token, but do not create it on the server\n list List bootstrap tokens on the server\n rotate Rotate original server token with a new bootstrap token\n\nOPTIONS:\n --help, -h show help\n"})}),"\n",(0,s.jsx)(t.h4,{id:"k3s-token-create-token",children:(0,s.jsx)(t.code,{children:"k3s token create [token]"})}),"\n",(0,s.jsxs)(t.p,{children:["Create a new token. The ",(0,s.jsx)(t.code,{children:"[token]"})," is the actual token to write, as generated by ",(0,s.jsx)(t.code,{children:"k3s token generate"}),". If no token is given, a random one will be generated."]}),"\n",(0,s.jsx)(t.p,{children:"A token in secure format, including the cluster CA hash, will be written to stdout. The output of this command should be saved, as the secret portion of the token cannot be shown again."}),"\n",(0,s.jsxs)(t.table,{children:[(0,s.jsx)(t.thead,{children:(0,s.jsxs)(t.tr,{children:[(0,s.jsx)(t.th,{children:"Flag"}),(0,s.jsx)(t.th,{children:"Description"})]})}),(0,s.jsxs)(t.tbody,{children:[(0,s.jsxs)(t.tr,{children:[(0,s.jsxs)(t.td,{children:[(0,s.jsx)(t.code,{children:"--data-dir"})," value"]}),(0,s.jsx)(t.td,{children:"Folder to hold state (default: /var/lib/rancher/k3s or ${HOME}/.rancher/k3s if not root)"})]}),(0,s.jsxs)(t.tr,{children:[(0,s.jsxs)(t.td,{children:[(0,s.jsx)(t.code,{children:"--kubeconfig"})," value"]}),(0,s.jsx)(t.td,{children:"Server to connect to [$KUBECONFIG]"})]}),(0,s.jsxs)(t.tr,{children:[(0,s.jsxs)(t.td,{children:[(0,s.jsx)(t.code,{children:"--description"})," value"]}),(0,s.jsx)(t.td,{children:"A human friendly description of how this token is used"})]}),(0,s.jsxs)(t.tr,{children:[(0,s.jsxs)(t.td,{children:[(0,s.jsx)(t.code,{children:"--groups"})," value"]}),(0,s.jsxs)(t.td,{children:['Extra groups that this token will authenticate as when used for authentication. (default: Default: "system:bootstrappers:k3s',":default-node-token",'")']})]}),(0,s.jsxs)(t.tr,{children:[(0,s.jsxs)(t.td,{children:[(0,s.jsx)(t.code,{children:"--ttl"})," value"]}),(0,s.jsx)(t.td,{children:"The duration before the token is automatically deleted (e.g. 1s, 2m, 3h). If set to '0', the token will never expire (default: 24h0m0s)"})]}),(0,s.jsxs)(t.tr,{children:[(0,s.jsxs)(t.td,{children:[(0,s.jsx)(t.code,{children:"--usages"})," value"]}),(0,s.jsx)(t.td,{children:'Describes the ways in which this token can be used. (default: "signing,authentication")'})]})]})]}),"\n",(0,s.jsx)(t.h4,{id:"k3s-token-delete",children:(0,s.jsx)(t.code,{children:"k3s token delete"})}),"\n",(0,s.jsx)(t.p,{children:"Delete one or more tokens. The full token can be provided, or just the token ID."}),"\n",(0,s.jsxs)(t.table,{children:[(0,s.jsx)(t.thead,{children:(0,s.jsxs)(t.tr,{children:[(0,s.jsx)(t.th,{children:"Flag"}),(0,s.jsx)(t.th,{children:"Description"})]})}),(0,s.jsxs)(t.tbody,{children:[(0,s.jsxs)(t.tr,{children:[(0,s.jsxs)(t.td,{children:[(0,s.jsx)(t.code,{children:"--data-dir"})," value"]}),(0,s.jsx)(t.td,{children:"Folder to hold state (default: /var/lib/rancher/k3s or ${HOME}/.rancher/k3s if not root)"})]}),(0,s.jsxs)(t.tr,{children:[(0,s.jsxs)(t.td,{children:[(0,s.jsx)(t.code,{children:"--kubeconfig"})," value"]}),(0,s.jsx)(t.td,{children:"Server to connect to [$KUBECONFIG]"})]})]})]}),"\n",(0,s.jsx)(t.h4,{id:"k3s-token-generate",children:(0,s.jsx)(t.code,{children:"k3s token generate"})}),"\n",(0,s.jsx)(t.p,{children:"Generate a randomly-generated bootstrap token."}),"\n",(0,s.jsxs)(t.p,{children:["You don't have to use this command in order to generate a token. You can do so yourself as long as it is in the format \"[a-z0-9]",6,".[a-z0-9]",16,'", where the first portion is the token ID, and the second portion is the secret.']}),"\n",(0,s.jsxs)(t.table,{children:[(0,s.jsx)(t.thead,{children:(0,s.jsxs)(t.tr,{children:[(0,s.jsx)(t.th,{children:"Flag"}),(0,s.jsx)(t.th,{children:"Description"})]})}),(0,s.jsxs)(t.tbody,{children:[(0,s.jsxs)(t.tr,{children:[(0,s.jsxs)(t.td,{children:[(0,s.jsx)(t.code,{children:"--data-dir"})," value"]}),(0,s.jsx)(t.td,{children:"Folder to hold state (default: /var/lib/rancher/k3s or ${HOME}/.rancher/k3s if not root)"})]}),(0,s.jsxs)(t.tr,{children:[(0,s.jsxs)(t.td,{children:[(0,s.jsx)(t.code,{children:"--kubeconfig"})," value"]}),(0,s.jsx)(t.td,{children:"Server to connect to [$KUBECONFIG]"})]})]})]}),"\n",(0,s.jsx)(t.h4,{id:"k3s-token-list",children:(0,s.jsx)(t.code,{children:"k3s token list"})}),"\n",(0,s.jsx)(t.p,{children:"List bootstrap tokens, showing their ID, description, and remaining time-to-live."}),"\n",(0,s.jsxs)(t.table,{children:[(0,s.jsx)(t.thead,{children:(0,s.jsxs)(t.tr,{children:[(0,s.jsx)(t.th,{children:"Flag"}),(0,s.jsx)(t.th,{children:"Description"})]})}),(0,s.jsxs)(t.tbody,{children:[(0,s.jsxs)(t.tr,{children:[(0,s.jsxs)(t.td,{children:[(0,s.jsx)(t.code,{children:"--data-dir"})," value"]}),(0,s.jsx)(t.td,{children:"Folder to hold state (default: /var/lib/rancher/k3s or ${HOME}/.rancher/k3s if not root)"})]}),(0,s.jsxs)(t.tr,{children:[(0,s.jsxs)(t.td,{children:[(0,s.jsx)(t.code,{children:"--kubeconfig"})," value"]}),(0,s.jsx)(t.td,{children:"Server to connect to [$KUBECONFIG]"})]}),(0,s.jsxs)(t.tr,{children:[(0,s.jsxs)(t.td,{children:[(0,s.jsx)(t.code,{children:"--output"})," value"]}),(0,s.jsx)(t.td,{children:'Output format. Valid options: text, json (default: "text")'})]})]})]}),"\n",(0,s.jsx)(t.h4,{id:"k3s-token-rotate",children:(0,s.jsx)(t.code,{children:"k3s token rotate"})}),"\n",(0,s.jsx)(t.admonition,{title:"Version Gate",type:"info",children:(0,s.jsx)(t.p,{children:"Available as of 2023-10 releases (v1.28.2+k3s1, v1.27.7+k3s1, v1.26.10+k3s1, v1.25.15+k3s1)."})}),"\n",(0,s.jsx)(t.p,{children:"Rotate original server token with a new bootstrap token. After running this command, all servers and any agents that originally joined with the old token must be restarted with the new token."}),"\n",(0,s.jsx)(t.p,{children:"If you do not specify a new token, one will be generated for you."}),"\n",(0,s.jsxs)(t.table,{children:[(0,s.jsx)(t.thead,{children:(0,s.jsxs)(t.tr,{children:[(0,s.jsx)(t.th,{children:"Flag"}),(0,s.jsx)(t.th,{children:"Description"})]})}),(0,s.jsxs)(t.tbody,{children:[(0,s.jsxs)(t.tr,{children:[(0,s.jsxs)(t.td,{children:[(0,s.jsx)(t.code,{children:"--data-dir"})," value"]}),(0,s.jsx)(t.td,{children:"Folder to hold state (default: /var/lib/rancher/k3s or ${HOME}/.rancher/k3s if not root)"})]}),(0,s.jsxs)(t.tr,{children:[(0,s.jsxs)(t.td,{children:[(0,s.jsx)(t.code,{children:"--kubeconfig"})," value"]}),(0,s.jsx)(t.td,{children:"Server to connect to [$KUBECONFIG]"})]}),(0,s.jsxs)(t.tr,{children:[(0,s.jsxs)(t.td,{children:[(0,s.jsx)(t.code,{children:"--server"})," value"]}),(0,s.jsxs)(t.td,{children:['Server to connect to (default: "',(0,s.jsx)(t.a,{href:"https://127.0.0.1:6443",children:"https://127.0.0.1:6443"}),'") [$K3S_URL]']})]}),(0,s.jsxs)(t.tr,{children:[(0,s.jsxs)(t.td,{children:[(0,s.jsx)(t.code,{children:"--token"})," value"]}),(0,s.jsx)(t.td,{children:"Existing token used to join a server or agent to a cluster [$K3S_TOKEN]"})]}),(0,s.jsxs)(t.tr,{children:[(0,s.jsxs)(t.td,{children:[(0,s.jsx)(t.code,{children:"--new-token"})," value"]}),(0,s.jsx)(t.td,{children:"New token that replaces existing token"})]})]})]})]})}function h(e={}){const{wrapper:t}={...(0,r.a)(),...e.components};return t?(0,s.jsx)(t,{...e,children:(0,s.jsx)(a,{...e})}):a(e)}},1151:(e,t,n)=>{n.d(t,{Z:()=>d,a:()=>o});var s=n(7294);const r={},i=s.createContext(r);function o(e){const t=s.useContext(i);return s.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function d(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(r):e.components||r:o(e.components),s.createElement(i.Provider,{value:t},e.children)}}}]); \ No newline at end of file +"use strict";(self.webpackChunkk_3_s_docs=self.webpackChunkk_3_s_docs||[]).push([[1430],{7084:(e,t,n)=>{n.r(t),n.d(t,{assets:()=>c,contentTitle:()=>o,default:()=>h,frontMatter:()=>i,metadata:()=>d,toc:()=>l});var s=n(5893),r=n(1151);const i={title:"token"},o="k3s token",d={id:"cli/token",title:"token",description:"K3s uses tokens to secure the node join process. Tokens authenticate the cluster to the joining node, and the node to the cluster.",source:"@site/docs/cli/token.md",sourceDirName:"cli",slug:"/cli/token",permalink:"/cli/token",draft:!1,unlisted:!1,editUrl:"https://github.com/k3s-io/docs/edit/main/docs/cli/token.md",tags:[],version:"current",lastUpdatedAt:1723747404e3,frontMatter:{title:"token"},sidebar:"mySidebar",previous:{title:"secrets-encrypt",permalink:"/cli/secrets-encrypt"},next:{title:"Architecture",permalink:"/architecture"}},c={},l=[{value:"Token Format",id:"token-format",level:2},{value:"Secure",id:"secure",level:3},{value:"TLS Bootstrapping",id:"tls-bootstrapping",level:4},{value:"Short",id:"short",level:3},{value:"Token Types",id:"token-types",level:2},{value:"Server",id:"server",level:3},{value:"Agent",id:"agent",level:3},{value:"Bootstrap",id:"bootstrap",level:3},{value:"k3s token",id:"k3s-token-1",level:2},{value:"k3s token create [token]",id:"k3s-token-create-token",level:4},{value:"k3s token delete",id:"k3s-token-delete",level:4},{value:"k3s token generate",id:"k3s-token-generate",level:4},{value:"k3s token list",id:"k3s-token-list",level:4},{value:"k3s token rotate",id:"k3s-token-rotate",level:4}];function a(e){const t={a:"a",admonition:"admonition",br:"br",code:"code",h1:"h1",h2:"h2",h3:"h3",h4:"h4",header:"header",li:"li",ol:"ol",p:"p",pre:"pre",table:"table",tbody:"tbody",td:"td",th:"th",thead:"thead",tr:"tr",ul:"ul",...(0,r.a)(),...e.components};return(0,s.jsxs)(s.Fragment,{children:[(0,s.jsx)(t.header,{children:(0,s.jsx)(t.h1,{id:"k3s-token",children:"k3s token"})}),"\n",(0,s.jsx)(t.p,{children:"K3s uses tokens to secure the node join process. Tokens authenticate the cluster to the joining node, and the node to the cluster."}),"\n",(0,s.jsx)(t.h2,{id:"token-format",children:"Token Format"}),"\n",(0,s.jsx)(t.p,{children:"K3s tokens can be specified in either secure or short format. The secure format is preferred, as it enables the client to authenticate the identity of the cluster it is joining, before sending credentials."}),"\n",(0,s.jsx)(t.h3,{id:"secure",children:"Secure"}),"\n",(0,s.jsx)(t.p,{children:'The secure token format (occasionally referred to as a "full" token) contains the following parts:'}),"\n",(0,s.jsx)(t.p,{children:(0,s.jsx)(t.code,{children:"::"})}),"\n",(0,s.jsxs)(t.ul,{children:["\n",(0,s.jsxs)(t.li,{children:[(0,s.jsx)(t.code,{children:"prefix"}),": a fixed ",(0,s.jsx)(t.code,{children:"K10"})," prefix that identifies the token format"]}),"\n",(0,s.jsxs)(t.li,{children:[(0,s.jsx)(t.code,{children:"cluster CA hash"}),": The hash of the cluster's server CA certificate, used to authenticate the server to the joining node.","\n",(0,s.jsxs)(t.ul,{children:["\n",(0,s.jsx)(t.li,{children:"For self-signed CA certificates, this is the SHA256 sum of the PEM-formatted certificate, as stored on disk."}),"\n",(0,s.jsx)(t.li,{children:"For custom CA certificates, this is the SHA256 sum of the DER encoding of the root certificate; commonly known as the certificate fingerprint."}),"\n"]}),"\n"]}),"\n",(0,s.jsxs)(t.li,{children:[(0,s.jsx)(t.code,{children:"credentials"}),": The username and password, or bearer token, used to authenticate the joining node to the cluster."]}),"\n"]}),"\n",(0,s.jsx)(t.h4,{id:"tls-bootstrapping",children:"TLS Bootstrapping"}),"\n",(0,s.jsx)(t.p,{children:"When a secure token is specified, the joining node performs the following steps to validate the identity of the server it has connected to, before transmitting credentials:"}),"\n",(0,s.jsxs)(t.ol,{children:["\n",(0,s.jsxs)(t.li,{children:["With TLS verification disabled, download the CA bundle from ",(0,s.jsx)(t.code,{children:"/cacerts"})," on the server it is joining."]}),"\n",(0,s.jsx)(t.li,{children:"Calculate the SHA256 hash of the CA certificate, as described above."}),"\n",(0,s.jsx)(t.li,{children:"Compare the calculated SHA256 hash to the hash from the token."}),"\n",(0,s.jsx)(t.li,{children:"If the hash matches, validate that the certificate presented by the server can be validated by the server's CA bundle."}),"\n",(0,s.jsx)(t.li,{children:"If the server certificate is valid, present credentials to join the cluster using either basic or bearer token authentication, depending on the token type."}),"\n"]}),"\n",(0,s.jsx)(t.h3,{id:"short",children:"Short"}),"\n",(0,s.jsx)(t.p,{children:"The short token format includes only the password or bearer token used to authenticate the joining node to the cluster."}),"\n",(0,s.jsxs)(t.p,{children:["If a short token is used, the joining node implicitly trusts the CA bundle presented by the server; steps 2-4 in the TLS Bootstrapping process are skipped. The initial connection may be vulnerable to ",(0,s.jsx)(t.a,{href:"https://en.wikipedia.org/wiki/Man-in-the-middle_attack",children:"man-in-the-middle"})," attack."]}),"\n",(0,s.jsx)(t.h2,{id:"token-types",children:"Token Types"}),"\n",(0,s.jsx)(t.p,{children:"K3s supports three types of tokens. Only the server token is available by default; additional token types must be configured or created by the administrator."}),"\n",(0,s.jsxs)(t.table,{children:[(0,s.jsx)(t.thead,{children:(0,s.jsxs)(t.tr,{children:[(0,s.jsx)(t.th,{children:"Type"}),(0,s.jsx)(t.th,{children:"CLI Option"}),(0,s.jsx)(t.th,{children:"Environment Variable"})]})}),(0,s.jsxs)(t.tbody,{children:[(0,s.jsxs)(t.tr,{children:[(0,s.jsx)(t.td,{children:"Server"}),(0,s.jsx)(t.td,{children:(0,s.jsx)(t.code,{children:"--token"})}),(0,s.jsx)(t.td,{children:(0,s.jsx)(t.code,{children:"K3S_TOKEN"})})]}),(0,s.jsxs)(t.tr,{children:[(0,s.jsx)(t.td,{children:"Agent"}),(0,s.jsx)(t.td,{children:(0,s.jsx)(t.code,{children:"--agent-token"})}),(0,s.jsx)(t.td,{children:(0,s.jsx)(t.code,{children:"K3S_AGENT_TOKEN"})})]}),(0,s.jsxs)(t.tr,{children:[(0,s.jsx)(t.td,{children:"Bootstrap"}),(0,s.jsx)(t.td,{children:(0,s.jsx)(t.code,{children:"n/a"})}),(0,s.jsx)(t.td,{children:(0,s.jsx)(t.code,{children:"n/a"})})]})]})]}),"\n",(0,s.jsx)(t.h3,{id:"server",children:"Server"}),"\n",(0,s.jsxs)(t.p,{children:["If no token is provided when starting the first server in the cluster, one is created with a random password. The server token is always written to ",(0,s.jsx)(t.code,{children:"/var/lib/rancher/k3s/server/token"}),", in secure format."]}),"\n",(0,s.jsx)(t.p,{children:"The server token can be used to join both server and agent nodes to the cluster. It cannot be changed once the cluster has been created, and anyone with access to the server token essentially has full administrator access to the cluster. This token should be guarded carefully."}),"\n",(0,s.jsxs)(t.p,{children:["The server token is also used as the ",(0,s.jsx)(t.a,{href:"https://en.wikipedia.org/wiki/PBKDF2",children:"PBKDF2"})," passphrase for the key used to encrypt confidential information that is persisted to the datastore, such as the secrets-encryption configuration, wireguard keys, and private keys for cluster CA certificates and service-account tokens. For this reason, the token must be backed up alongside the cluster datastore itself."]}),"\n",(0,s.jsx)(t.admonition,{type:"warning",children:(0,s.jsx)(t.p,{children:"Unless custom CA certificates are in use, only the short (password-only) token format can be used when starting the first server in the cluster. This is because the cluster CA hash cannot be known until after the server has generated the self-signed cluster CA certificates."})}),"\n",(0,s.jsxs)(t.p,{children:["For more information on using custom CA certificates, see the ",(0,s.jsxs)(t.a,{href:"/cli/certificate",children:[(0,s.jsx)(t.code,{children:"k3s certificate"})," documentation"]}),".",(0,s.jsx)(t.br,{}),"\n","For more information on backing up your cluster, see the ",(0,s.jsx)(t.a,{href:"/datastore/backup-restore",children:"Backup and Restore"})," documentation."]}),"\n",(0,s.jsx)(t.h3,{id:"agent",children:"Agent"}),"\n",(0,s.jsx)(t.p,{children:"By default, the agent token is the same as the server token. The agent token can be set before or after the cluster has been started, by changing the CLI option or environment variable on all servers in the cluster. The agent token is similar to the server token in that is it statically configured, and does not expire."}),"\n",(0,s.jsxs)(t.p,{children:["The agent token is written to ",(0,s.jsx)(t.code,{children:"/var/lib/rancher/k3s/server/agent-token"}),", in secure format. If no agent token is specified, this file is a link to the server token."]}),"\n",(0,s.jsx)(t.h3,{id:"bootstrap",children:"Bootstrap"}),"\n",(0,s.jsx)(t.admonition,{title:"Version Gate",type:"info",children:(0,s.jsxs)(t.p,{children:["Support for the ",(0,s.jsx)(t.code,{children:"k3s token"})," command and the ability to join nodes with bootstrap tokens is available starting with the 2023-02 releases (v1.26.2+k3s1, v1.25.7+k3s1, v1.24.11+k3s1, v1.23.17+k3s1)."]})}),"\n",(0,s.jsx)(t.p,{children:"K3s supports dynamically generated, automatically expiring agent bootstrap tokens. Bootstrap tokens can only be used to join agents."}),"\n",(0,s.jsx)(t.h2,{id:"k3s-token-1",children:"k3s token"}),"\n",(0,s.jsxs)(t.p,{children:["K3s bootstrap tokens use the same generation and validation code as ",(0,s.jsx)(t.code,{children:"kubeadm token"})," bootstrap tokens, and the ",(0,s.jsx)(t.code,{children:"k3s token"})," CLI is similar."]}),"\n",(0,s.jsx)(t.pre,{children:(0,s.jsx)(t.code,{children:"NAME:\n k3s token - Manage bootstrap tokens\n\nUSAGE:\n k3s token command [command options] [arguments...]\n\nCOMMANDS:\n create Create bootstrap tokens on the server\n delete Delete bootstrap tokens on the server\n generate Generate and print a bootstrap token, but do not create it on the server\n list List bootstrap tokens on the server\n rotate Rotate original server token with a new bootstrap token\n\nOPTIONS:\n --help, -h show help\n"})}),"\n",(0,s.jsx)(t.h4,{id:"k3s-token-create-token",children:(0,s.jsx)(t.code,{children:"k3s token create [token]"})}),"\n",(0,s.jsxs)(t.p,{children:["Create a new token. The ",(0,s.jsx)(t.code,{children:"[token]"})," is the actual token to write, as generated by ",(0,s.jsx)(t.code,{children:"k3s token generate"}),". If no token is given, a random one will be generated."]}),"\n",(0,s.jsx)(t.p,{children:"A token in secure format, including the cluster CA hash, will be written to stdout. The output of this command should be saved, as the secret portion of the token cannot be shown again."}),"\n",(0,s.jsxs)(t.table,{children:[(0,s.jsx)(t.thead,{children:(0,s.jsxs)(t.tr,{children:[(0,s.jsx)(t.th,{children:"Flag"}),(0,s.jsx)(t.th,{children:"Description"})]})}),(0,s.jsxs)(t.tbody,{children:[(0,s.jsxs)(t.tr,{children:[(0,s.jsxs)(t.td,{children:[(0,s.jsx)(t.code,{children:"--data-dir"})," value"]}),(0,s.jsx)(t.td,{children:"Folder to hold state (default: /var/lib/rancher/k3s or ${HOME}/.rancher/k3s if not root)"})]}),(0,s.jsxs)(t.tr,{children:[(0,s.jsxs)(t.td,{children:[(0,s.jsx)(t.code,{children:"--kubeconfig"})," value"]}),(0,s.jsx)(t.td,{children:"Server to connect to [$KUBECONFIG]"})]}),(0,s.jsxs)(t.tr,{children:[(0,s.jsxs)(t.td,{children:[(0,s.jsx)(t.code,{children:"--description"})," value"]}),(0,s.jsx)(t.td,{children:"A human friendly description of how this token is used"})]}),(0,s.jsxs)(t.tr,{children:[(0,s.jsxs)(t.td,{children:[(0,s.jsx)(t.code,{children:"--groups"})," value"]}),(0,s.jsxs)(t.td,{children:['Extra groups that this token will authenticate as when used for authentication. (default: Default: "system:bootstrappers:k3s',":default-node-token",'")']})]}),(0,s.jsxs)(t.tr,{children:[(0,s.jsxs)(t.td,{children:[(0,s.jsx)(t.code,{children:"--ttl"})," value"]}),(0,s.jsx)(t.td,{children:"The duration before the token is automatically deleted (e.g. 1s, 2m, 3h). If set to '0', the token will never expire (default: 24h0m0s)"})]}),(0,s.jsxs)(t.tr,{children:[(0,s.jsxs)(t.td,{children:[(0,s.jsx)(t.code,{children:"--usages"})," value"]}),(0,s.jsx)(t.td,{children:'Describes the ways in which this token can be used. (default: "signing,authentication")'})]})]})]}),"\n",(0,s.jsx)(t.h4,{id:"k3s-token-delete",children:(0,s.jsx)(t.code,{children:"k3s token delete"})}),"\n",(0,s.jsx)(t.p,{children:"Delete one or more tokens. The full token can be provided, or just the token ID."}),"\n",(0,s.jsxs)(t.table,{children:[(0,s.jsx)(t.thead,{children:(0,s.jsxs)(t.tr,{children:[(0,s.jsx)(t.th,{children:"Flag"}),(0,s.jsx)(t.th,{children:"Description"})]})}),(0,s.jsxs)(t.tbody,{children:[(0,s.jsxs)(t.tr,{children:[(0,s.jsxs)(t.td,{children:[(0,s.jsx)(t.code,{children:"--data-dir"})," value"]}),(0,s.jsx)(t.td,{children:"Folder to hold state (default: /var/lib/rancher/k3s or ${HOME}/.rancher/k3s if not root)"})]}),(0,s.jsxs)(t.tr,{children:[(0,s.jsxs)(t.td,{children:[(0,s.jsx)(t.code,{children:"--kubeconfig"})," value"]}),(0,s.jsx)(t.td,{children:"Server to connect to [$KUBECONFIG]"})]})]})]}),"\n",(0,s.jsx)(t.h4,{id:"k3s-token-generate",children:(0,s.jsx)(t.code,{children:"k3s token generate"})}),"\n",(0,s.jsx)(t.p,{children:"Generate a randomly-generated bootstrap token."}),"\n",(0,s.jsxs)(t.p,{children:["You don't have to use this command in order to generate a token. You can do so yourself as long as it is in the format \"[a-z0-9]",6,".[a-z0-9]",16,'", where the first portion is the token ID, and the second portion is the secret.']}),"\n",(0,s.jsxs)(t.table,{children:[(0,s.jsx)(t.thead,{children:(0,s.jsxs)(t.tr,{children:[(0,s.jsx)(t.th,{children:"Flag"}),(0,s.jsx)(t.th,{children:"Description"})]})}),(0,s.jsxs)(t.tbody,{children:[(0,s.jsxs)(t.tr,{children:[(0,s.jsxs)(t.td,{children:[(0,s.jsx)(t.code,{children:"--data-dir"})," value"]}),(0,s.jsx)(t.td,{children:"Folder to hold state (default: /var/lib/rancher/k3s or ${HOME}/.rancher/k3s if not root)"})]}),(0,s.jsxs)(t.tr,{children:[(0,s.jsxs)(t.td,{children:[(0,s.jsx)(t.code,{children:"--kubeconfig"})," value"]}),(0,s.jsx)(t.td,{children:"Server to connect to [$KUBECONFIG]"})]})]})]}),"\n",(0,s.jsx)(t.h4,{id:"k3s-token-list",children:(0,s.jsx)(t.code,{children:"k3s token list"})}),"\n",(0,s.jsx)(t.p,{children:"List bootstrap tokens, showing their ID, description, and remaining time-to-live."}),"\n",(0,s.jsxs)(t.table,{children:[(0,s.jsx)(t.thead,{children:(0,s.jsxs)(t.tr,{children:[(0,s.jsx)(t.th,{children:"Flag"}),(0,s.jsx)(t.th,{children:"Description"})]})}),(0,s.jsxs)(t.tbody,{children:[(0,s.jsxs)(t.tr,{children:[(0,s.jsxs)(t.td,{children:[(0,s.jsx)(t.code,{children:"--data-dir"})," value"]}),(0,s.jsx)(t.td,{children:"Folder to hold state (default: /var/lib/rancher/k3s or ${HOME}/.rancher/k3s if not root)"})]}),(0,s.jsxs)(t.tr,{children:[(0,s.jsxs)(t.td,{children:[(0,s.jsx)(t.code,{children:"--kubeconfig"})," value"]}),(0,s.jsx)(t.td,{children:"Server to connect to [$KUBECONFIG]"})]}),(0,s.jsxs)(t.tr,{children:[(0,s.jsxs)(t.td,{children:[(0,s.jsx)(t.code,{children:"--output"})," value"]}),(0,s.jsx)(t.td,{children:'Output format. Valid options: text, json (default: "text")'})]})]})]}),"\n",(0,s.jsx)(t.h4,{id:"k3s-token-rotate",children:(0,s.jsx)(t.code,{children:"k3s token rotate"})}),"\n",(0,s.jsx)(t.admonition,{title:"Version Gate",type:"info",children:(0,s.jsx)(t.p,{children:"Available as of 2023-10 releases (v1.28.2+k3s1, v1.27.7+k3s1, v1.26.10+k3s1, v1.25.15+k3s1)."})}),"\n",(0,s.jsx)(t.p,{children:"Rotate original server token with a new bootstrap token. After running this command, all servers and any agents that originally joined with the old token must be restarted with the new token."}),"\n",(0,s.jsx)(t.p,{children:"If you do not specify a new token, one will be generated for you."}),"\n",(0,s.jsxs)(t.table,{children:[(0,s.jsx)(t.thead,{children:(0,s.jsxs)(t.tr,{children:[(0,s.jsx)(t.th,{children:"Flag"}),(0,s.jsx)(t.th,{children:"Description"})]})}),(0,s.jsxs)(t.tbody,{children:[(0,s.jsxs)(t.tr,{children:[(0,s.jsxs)(t.td,{children:[(0,s.jsx)(t.code,{children:"--data-dir"})," value"]}),(0,s.jsx)(t.td,{children:"Folder to hold state (default: /var/lib/rancher/k3s or ${HOME}/.rancher/k3s if not root)"})]}),(0,s.jsxs)(t.tr,{children:[(0,s.jsxs)(t.td,{children:[(0,s.jsx)(t.code,{children:"--kubeconfig"})," value"]}),(0,s.jsx)(t.td,{children:"Server to connect to [$KUBECONFIG]"})]}),(0,s.jsxs)(t.tr,{children:[(0,s.jsxs)(t.td,{children:[(0,s.jsx)(t.code,{children:"--server"})," value"]}),(0,s.jsxs)(t.td,{children:['Server to connect to (default: "',(0,s.jsx)(t.a,{href:"https://127.0.0.1:6443",children:"https://127.0.0.1:6443"}),'") [$K3S_URL]']})]}),(0,s.jsxs)(t.tr,{children:[(0,s.jsxs)(t.td,{children:[(0,s.jsx)(t.code,{children:"--token"})," value"]}),(0,s.jsx)(t.td,{children:"Existing token used to join a server or agent to a cluster [$K3S_TOKEN]"})]}),(0,s.jsxs)(t.tr,{children:[(0,s.jsxs)(t.td,{children:[(0,s.jsx)(t.code,{children:"--new-token"})," value"]}),(0,s.jsx)(t.td,{children:"New token that replaces existing token"})]})]})]})]})}function h(e={}){const{wrapper:t}={...(0,r.a)(),...e.components};return t?(0,s.jsx)(t,{...e,children:(0,s.jsx)(a,{...e})}):a(e)}},1151:(e,t,n)=>{n.d(t,{Z:()=>d,a:()=>o});var s=n(7294);const r={},i=s.createContext(r);function o(e){const t=s.useContext(i);return s.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function d(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(r):e.components||r:o(e.components),s.createElement(i.Provider,{value:t},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/2f797aa4.ab0bed68.js b/assets/js/2f797aa4.f9dafcf2.js similarity index 99% rename from assets/js/2f797aa4.ab0bed68.js rename to assets/js/2f797aa4.f9dafcf2.js index 04c263d5c..e01ec939a 100644 --- a/assets/js/2f797aa4.ab0bed68.js +++ b/assets/js/2f797aa4.f9dafcf2.js @@ -1 +1 @@ -"use strict";(self.webpackChunkk_3_s_docs=self.webpackChunkk_3_s_docs||[]).push([[101],{3989:(e,s,i)=>{i.r(s),i.d(s,{assets:()=>c,contentTitle:()=>l,default:()=>o,frontMatter:()=>n,metadata:()=>h,toc:()=>d});var r=i(5893),t=i(1151);const n={hide_table_of_contents:!0,sidebar_position:3},l="v1.28.X",h={id:"release-notes/v1.28.X",title:"v1.28.X",description:"Before upgrading from earlier releases, be sure to read the Kubernetes Urgent Upgrade Notes.",source:"@site/docs/release-notes/v1.28.X.md",sourceDirName:"release-notes",slug:"/release-notes/v1.28.X",permalink:"/release-notes/v1.28.X",draft:!1,unlisted:!1,editUrl:"https://github.com/k3s-io/docs/edit/main/docs/release-notes/v1.28.X.md",tags:[],version:"current",lastUpdatedAt:1723651727e3,sidebarPosition:3,frontMatter:{hide_table_of_contents:!0,sidebar_position:3},sidebar:"mySidebar",previous:{title:"v1.29.X",permalink:"/release-notes/v1.29.X"},next:{title:"v1.27.X",permalink:"/release-notes/v1.27.X"}},c={},d=[{value:"Release v1.28.12+k3s1",id:"release-v12812k3s1",level:2},{value:"Changes since v1.28.11+k3s2:",id:"changes-since-v12811k3s2",level:3},{value:"Release v1.28.11+k3s2",id:"release-v12811k3s2",level:2},{value:"Changes since v1.28.11+k3s1:",id:"changes-since-v12811k3s1",level:3},{value:"Release v1.28.11+k3s1",id:"release-v12811k3s1",level:2},{value:"Changes since v1.28.10+k3s1:",id:"changes-since-v12810k3s1",level:3},{value:"Release v1.28.10+k3s1",id:"release-v12810k3s1",level:2},{value:"Changes since v1.28.9+k3s1:",id:"changes-since-v1289k3s1",level:3},{value:"Release v1.28.9+k3s1",id:"release-v1289k3s1",level:2},{value:"Changes since v1.28.8+k3s1:",id:"changes-since-v1288k3s1",level:3},{value:"Release v1.28.8+k3s1",id:"release-v1288k3s1",level:2},{value:"Changes since v1.28.7+k3s1:",id:"changes-since-v1287k3s1",level:3},{value:"Release v1.28.7+k3s1",id:"release-v1287k3s1",level:2},{value:"Changes since v1.28.6+k3s2:",id:"changes-since-v1286k3s2",level:3},{value:"Release v1.28.6+k3s2",id:"release-v1286k3s2",level:2},{value:"Changes since v1.28.5+k3s1:",id:"changes-since-v1285k3s1",level:3},{value:"Release v1.28.5+k3s1",id:"release-v1285k3s1",level:2},{value:"Changes since v1.28.4+k3s1:",id:"changes-since-v1284k3s1",level:3},{value:"Release v1.28.4+k3s2",id:"release-v1284k3s2",level:2},{value:"Changes since v1.28.3+k3s2:",id:"changes-since-v1283k3s2",level:3},{value:"Release v1.28.3+k3s2",id:"release-v1283k3s2",level:2},{value:"Changes since v1.28.3+k3s1:",id:"changes-since-v1283k3s1",level:3},{value:"Release v1.28.3+k3s1",id:"release-v1283k3s1",level:2},{value:"Changes since v1.28.2+k3s1:",id:"changes-since-v1282k3s1",level:3},{value:"Release v1.28.2+k3s1",id:"release-v1282k3s1",level:2},{value:"Changes since v1.28.1+k3s1:",id:"changes-since-v1281k3s1",level:3},{value:"Release v1.28.1+k3s1",id:"release-v1281k3s1",level:2},{value:"Changes since v1.27.5+k3s1:",id:"changes-since-v1275k3s1",level:3}];function a(e){const s={a:"a",admonition:"admonition",code:"code",h1:"h1",h2:"h2",h3:"h3",header:"header",hr:"hr",li:"li",p:"p",strong:"strong",table:"table",tbody:"tbody",td:"td",th:"th",thead:"thead",tr:"tr",ul:"ul",...(0,t.a)(),...e.components};return(0,r.jsxs)(r.Fragment,{children:[(0,r.jsx)(s.header,{children:(0,r.jsx)(s.h1,{id:"v128x",children:"v1.28.X"})}),"\n",(0,r.jsx)(s.admonition,{title:"Upgrade Notice",type:"warning",children:(0,r.jsxs)(s.p,{children:["Before upgrading from earlier releases, be sure to read the Kubernetes ",(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.28.md#urgent-upgrade-notes",children:"Urgent Upgrade Notes"}),"."]})}),"\n",(0,r.jsxs)(s.table,{children:[(0,r.jsx)(s.thead,{children:(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.th,{children:"Version"}),(0,r.jsx)(s.th,{children:"Release date"}),(0,r.jsx)(s.th,{children:"Kubernetes"}),(0,r.jsx)(s.th,{children:"Kine"}),(0,r.jsx)(s.th,{children:"SQLite"}),(0,r.jsx)(s.th,{children:"Etcd"}),(0,r.jsx)(s.th,{children:"Containerd"}),(0,r.jsx)(s.th,{children:"Runc"}),(0,r.jsx)(s.th,{children:"Flannel"}),(0,r.jsx)(s.th,{children:"Metrics-server"}),(0,r.jsx)(s.th,{children:"Traefik"}),(0,r.jsx)(s.th,{children:"CoreDNS"}),(0,r.jsx)(s.th,{children:"Helm-controller"}),(0,r.jsx)(s.th,{children:"Local-path-provisioner"})]})}),(0,r.jsxs)(s.tbody,{children:[(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"/release-notes/v1.28.X#release-v12812k3s1",children:"v1.28.12+k3s1"})}),(0,r.jsx)(s.td,{children:"Jul 31 2024"}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.28.md#v12812",children:"v1.28.12"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/kine/releases/tag/v0.11.11",children:"v0.11.11"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://sqlite.org/releaselog/3_44_0.html",children:"3.44.0"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/etcd/releases/tag/v3.5.13-k3s1",children:"v3.5.13-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/containerd/releases/tag/v1.7.17-k3s1.28",children:"v1.7.17-k3s1.28"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/opencontainers/runc/releases/tag/v1.1.12",children:"v1.1.12"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/flannel-io/flannel/releases/tag/v0.25.4",children:"v0.25.4"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.7.0",children:"v0.7.0"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/traefik/traefik/releases/tag/v2.10.7",children:"v2.10.7"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/coredns/coredns/releases/tag/v1.10.1",children:"v1.10.1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/helm-controller/releases/tag/v0.15.10",children:"v0.15.10"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/rancher/local-path-provisioner/releases/tag/v0.0.28",children:"v0.0.28"})})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"/release-notes/v1.28.X#release-v12811k3s2",children:"v1.28.11+k3s2"})}),(0,r.jsx)(s.td,{children:"Jul 03 2024"}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.28.md#v12811",children:"v1.28.11"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/kine/releases/tag/v0.11.9",children:"v0.11.9"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://sqlite.org/releaselog/3_44_0.html",children:"3.44.0"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/etcd/releases/tag/v3.5.13-k3s1",children:"v3.5.13-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/containerd/releases/tag/v1.7.17-k3s1.28",children:"v1.7.17-k3s1.28"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/opencontainers/runc/releases/tag/v1.1.12",children:"v1.1.12"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/flannel-io/flannel/releases/tag/v0.25.4",children:"v0.25.4"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.7.0",children:"v0.7.0"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/traefik/traefik/releases/tag/v2.10.7",children:"v2.10.7"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/coredns/coredns/releases/tag/v1.10.1",children:"v1.10.1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/helm-controller/releases/tag/v0.15.10",children:"v0.15.10"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/rancher/local-path-provisioner/releases/tag/v0.0.27",children:"v0.0.27"})})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"/release-notes/v1.28.X#release-v12811k3s1",children:"v1.28.11+k3s1"})}),(0,r.jsx)(s.td,{children:"Jun 25 2024"}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.28.md#v12811",children:"v1.28.11"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/kine/releases/tag/v0.11.9",children:"v0.11.9"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://sqlite.org/releaselog/3_44_0.html",children:"3.44.0"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/etcd/releases/tag/v3.5.13-k3s1",children:"v3.5.13-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/containerd/releases/tag/v1.7.17-k3s1.28",children:"v1.7.17-k3s1.28"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/opencontainers/runc/releases/tag/v1.1.12",children:"v1.1.12"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/flannel-io/flannel/releases/tag/v0.25.2",children:"v0.25.2"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.7.0",children:"v0.7.0"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/traefik/traefik/releases/tag/v2.10.7",children:"v2.10.7"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/coredns/coredns/releases/tag/v1.10.1",children:"v1.10.1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/helm-controller/releases/tag/v0.15.10",children:"v0.15.10"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/rancher/local-path-provisioner/releases/tag/v0.0.27",children:"v0.0.27"})})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"/release-notes/v1.28.X#release-v12810k3s1",children:"v1.28.10+k3s1"})}),(0,r.jsx)(s.td,{children:"May 22 2024"}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.28.md#v12810",children:"v1.28.10"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/kine/releases/tag/v0.11.7",children:"v0.11.7"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://sqlite.org/releaselog/3_44_0.html",children:"3.44.0"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/etcd/releases/tag/v3.5.9-k3s1",children:"v3.5.9-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/containerd/releases/tag/v1.7.15-k3s1",children:"v1.7.15-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/opencontainers/runc/releases/tag/v1.1.12-k3s1",children:"v1.1.12-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/flannel-io/flannel/releases/tag/v0.24.2",children:"v0.24.2"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.7.0",children:"v0.7.0"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/traefik/traefik/releases/tag/v2.10.7",children:"v2.10.7"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/coredns/coredns/releases/tag/v1.10.1",children:"v1.10.1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/helm-controller/releases/tag/v0.15.9",children:"v0.15.9"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/rancher/local-path-provisioner/releases/tag/v0.0.26",children:"v0.0.26"})})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"/release-notes/v1.28.X#release-v1289k3s1",children:"v1.28.9+k3s1"})}),(0,r.jsx)(s.td,{children:"Apr 25 2024"}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.28.md#v1289",children:"v1.28.9"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/kine/releases/tag/v0.11.7",children:"v0.11.7"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://sqlite.org/releaselog/3_44_0.html",children:"3.44.0"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/etcd/releases/tag/v3.5.9-k3s1",children:"v3.5.9-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/containerd/releases/tag/v1.7.15-k3s1",children:"v1.7.15-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/opencontainers/runc/releases/tag/v1.1.12",children:"v1.1.12"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/flannel-io/flannel/releases/tag/v0.24.2",children:"v0.24.2"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.7.0",children:"v0.7.0"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/traefik/traefik/releases/tag/v2.10.7",children:"v2.10.7"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/coredns/coredns/releases/tag/v1.10.1",children:"v1.10.1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/helm-controller/releases/tag/v0.15.9",children:"v0.15.9"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/rancher/local-path-provisioner/releases/tag/v0.0.26",children:"v0.0.26"})})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"/release-notes/v1.28.X#release-v1288k3s1",children:"v1.28.8+k3s1"})}),(0,r.jsx)(s.td,{children:"Mar 25 2024"}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.28.md#v1288",children:"v1.28.8"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/kine/releases/tag/v0.11.4",children:"v0.11.4"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://sqlite.org/releaselog/3_44_0.html",children:"3.44.0"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/etcd/releases/tag/v3.5.9-k3s1",children:"v3.5.9-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/containerd/releases/tag/v1.7.11-k3s2",children:"v1.7.11-k3s2"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/opencontainers/runc/releases/tag/v1.1.12-k3s1",children:"v1.1.12-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/flannel-io/flannel/releases/tag/v0.24.2",children:"v0.24.2"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.7.0",children:"v0.7.0"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/traefik/traefik/releases/tag/v2.10.5",children:"v2.10.5"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/coredns/coredns/releases/tag/v1.10.1",children:"v1.10.1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/helm-controller/releases/tag/v0.15.9",children:"v0.15.9"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/rancher/local-path-provisioner/releases/tag/v0.0.26",children:"v0.0.26"})})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"/release-notes/v1.28.X#release-v1287k3s1",children:"v1.28.7+k3s1"})}),(0,r.jsx)(s.td,{children:"Feb 29 2024"}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.28.md#v1287",children:"v1.28.7"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/kine/releases/tag/v0.11.4",children:"v0.11.4"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://sqlite.org/releaselog/3_44_0.html",children:"3.44.0"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/etcd/releases/tag/v3.5.9-k3s1",children:"v3.5.9-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/containerd/releases/tag/v1.7.11-k3s2",children:"v1.7.11-k3s2"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/runc/releases/tag/v1.1.12-k3s1",children:"v1.1.12-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/flannel-io/flannel/releases/tag/v0.24.2",children:"v0.24.2"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.6.3",children:"v0.6.3"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/traefik/traefik/releases/tag/v2.10.5",children:"v2.10.5"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/coredns/coredns/releases/tag/v1.10.1",children:"v1.10.1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/helm-controller/releases/tag/v0.15.8",children:"v0.15.8"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/rancher/local-path-provisioner/releases/tag/v0.0.26",children:"v0.0.26"})})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"/release-notes/v1.28.X#release-v1286k3s2",children:"v1.28.6+k3s2"})}),(0,r.jsx)(s.td,{children:"Feb 06 2024"}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.28.md#v1286",children:"v1.28.6"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/kine/releases/tag/v0.11.0",children:"v0.11.0"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://sqlite.org/releaselog/3_42_0.html",children:"3.42.0"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/etcd/releases/tag/v3.5.9-k3s1",children:"v3.5.9-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/containerd/releases/tag/v1.7.11-k3s2",children:"v1.7.11-k3s2"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/opencontainers/runc/releases/tag/v1.1.12-k3s1",children:"v1.1.12-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/flannel-io/flannel/releases/tag/v0.22.2",children:"v0.22.2"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.6.3",children:"v0.6.3"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/traefik/traefik/releases/tag/v2.10.5",children:"v2.10.5"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/coredns/coredns/releases/tag/v1.10.1",children:"v1.10.1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/helm-controller/releases/tag/v0.15.8",children:"v0.15.8"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/rancher/local-path-provisioner/releases/tag/v0.0.24",children:"v0.0.24"})})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"/release-notes/v1.28.X#release-v1285k3s1",children:"v1.28.5+k3s1"})}),(0,r.jsx)(s.td,{children:"Dec 27 2023"}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.28.md#v1285",children:"v1.28.5"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/kine/releases/tag/v0.11.0",children:"v0.11.0"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://sqlite.org/releaselog/3_42_0.html",children:"3.42.0"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/etcd/releases/tag/v3.5.9-k3s1",children:"v3.5.9-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/containerd/releases/tag/v1.7.11-k3s2",children:"v1.7.11-k3s2"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/opencontainers/runc/releases/tag/v1.1.10",children:"v1.1.10"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/flannel-io/flannel/releases/tag/v0.22.2",children:"v0.22.2"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.6.3",children:"v0.6.3"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/traefik/traefik/releases/tag/v2.10.5",children:"v2.10.5"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/coredns/coredns/releases/tag/v1.10.1",children:"v1.10.1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/helm-controller/releases/tag/v0.15.4",children:"v0.15.4"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/rancher/local-path-provisioner/releases/tag/v0.0.24",children:"v0.0.24"})})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"/release-notes/v1.28.X#release-v1284k3s2",children:"v1.28.4+k3s2"})}),(0,r.jsx)(s.td,{children:"Dec 06 2023"}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.28.md#v1284",children:"v1.28.4"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/kine/releases/tag/v0.11.0",children:"v0.11.0"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://sqlite.org/releaselog/3_42_0.html",children:"3.42.0"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/etcd/releases/tag/v3.5.9-k3s1",children:"v3.5.9-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/containerd/releases/tag/v1.7.7-k3s1",children:"v1.7.7-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/opencontainers/runc/releases/tag/v1.1.8",children:"v1.1.8"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/flannel-io/flannel/releases/tag/v0.22.2",children:"v0.22.2"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.6.3",children:"v0.6.3"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/traefik/traefik/releases/tag/v2.10.5",children:"v2.10.5"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/coredns/coredns/releases/tag/v1.10.1",children:"v1.10.1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/helm-controller/releases/tag/v0.15.4",children:"v0.15.4"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/rancher/local-path-provisioner/releases/tag/v0.0.24",children:"v0.0.24"})})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"/release-notes/v1.28.X#release-v1283k3s2",children:"v1.28.3+k3s2"})}),(0,r.jsx)(s.td,{children:"Nov 08 2023"}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.28.md#v1283",children:"v1.28.3"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/kine/releases/tag/v0.10.3",children:"v0.10.3"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://sqlite.org/releaselog/3_42_0.html",children:"3.42.0"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/etcd/releases/tag/v3.5.9-k3s1",children:"v3.5.9-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/containerd/releases/tag/v1.7.7-k3s1",children:"v1.7.7-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/opencontainers/runc/releases/tag/v1.1.8",children:"v1.1.8"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/flannel-io/flannel/releases/tag/v0.22.2",children:"v0.22.2"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.6.3",children:"v0.6.3"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/traefik/traefik/releases/tag/v2.10.5",children:"v2.10.5"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/coredns/coredns/releases/tag/v1.10.1",children:"v1.10.1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/helm-controller/releases/tag/v0.15.4",children:"v0.15.4"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/rancher/local-path-provisioner/releases/tag/v0.0.24",children:"v0.0.24"})})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"/release-notes/v1.28.X#release-v1283k3s1",children:"v1.28.3+k3s1"})}),(0,r.jsx)(s.td,{children:"Oct 30 2023"}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.28.md#v1283",children:"v1.28.3"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/kine/releases/tag/v0.10.3",children:"v0.10.3"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://sqlite.org/releaselog/3_42_0.html",children:"3.42.0"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/etcd/releases/tag/v3.5.9-k3s1",children:"v3.5.9-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/containerd/releases/tag/v1.7.7-k3s1",children:"v1.7.7-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/opencontainers/runc/releases/tag/v1.1.8",children:"v1.1.8"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/flannel-io/flannel/releases/tag/v0.22.2",children:"v0.22.2"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.6.3",children:"v0.6.3"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/traefik/traefik/releases/tag/v2.10.5",children:"v2.10.5"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/coredns/coredns/releases/tag/v1.10.1",children:"v1.10.1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/helm-controller/releases/tag/v0.15.4",children:"v0.15.4"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/rancher/local-path-provisioner/releases/tag/v0.0.24",children:"v0.0.24"})})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"/release-notes/v1.28.X#release-v1282k3s1",children:"v1.28.2+k3s1"})}),(0,r.jsx)(s.td,{children:"Sep 20 2023"}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.28.md#v1282",children:"v1.28.2"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/kine/releases/tag/v0.10.3",children:"v0.10.3"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://sqlite.org/releaselog/3_42_0.html",children:"3.42.0"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/etcd/releases/tag/v3.5.9-k3s1",children:"v3.5.9-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/containerd/releases/tag/v1.7.6-k3s1",children:"v1.7.6-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/opencontainers/runc/releases/tag/v1.1.8",children:"v1.1.8"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/flannel-io/flannel/releases/tag/v0.22.2",children:"v0.22.2"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.6.3",children:"v0.6.3"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/traefik/traefik/releases/tag/v2.9.10",children:"v2.9.10"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/coredns/coredns/releases/tag/v1.10.1",children:"v1.10.1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/helm-controller/releases/tag/v0.15.4",children:"v0.15.4"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/rancher/local-path-provisioner/releases/tag/v0.0.24",children:"v0.0.24"})})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"/release-notes/v1.28.X#release-v1281k3s1",children:"v1.28.1+k3s1"})}),(0,r.jsx)(s.td,{children:"Sep 08 2023"}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.28.md#v1281",children:"v1.28.1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/kine/releases/tag/v0.10.3",children:"v0.10.3"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://sqlite.org/releaselog/3_42_0.html",children:"3.42.0"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/etcd/releases/tag/v3.5.9-k3s1",children:"v3.5.9-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/containerd/releases/tag/v1.7.3-k3s2",children:"v1.7.3-k3s2"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/opencontainers/runc/releases/tag/v1.1.8",children:"v1.1.8"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/flannel-io/flannel/releases/tag/v0.22.2",children:"v0.22.2"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.6.3",children:"v0.6.3"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/traefik/traefik/releases/tag/v2.9.10",children:"v2.9.10"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/coredns/coredns/releases/tag/v1.10.1",children:"v1.10.1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/helm-controller/releases/tag/v0.15.4",children:"v0.15.4"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/rancher/local-path-provisioner/releases/tag/v0.0.24",children:"v0.0.24"})})]})]})]}),"\n",(0,r.jsx)("br",{}),"\n",(0,r.jsxs)(s.h2,{id:"release-v12812k3s1",children:["Release ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/releases/tag/v1.28.12+k3s1",children:"v1.28.12+k3s1"})]}),"\n",(0,r.jsx)(s.p,{children:"This release updates Kubernetes to v1.28.12, and fixes a number of issues."}),"\n",(0,r.jsxs)(s.p,{children:["For more details on what's new, see the ",(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.28.md#changelog-since-v12811",children:"Kubernetes release notes"}),"."]}),"\n",(0,r.jsx)(s.h3,{id:"changes-since-v12811k3s2",children:"Changes since v1.28.11+k3s2:"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsxs)(s.li,{children:["Backports for 2024-07 release cycle ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10499",children:"(#10499)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:"Bump k3s-root to v0.14.0"}),"\n",(0,r.jsx)(s.li,{children:"Bump github.com/hashicorp/go-retryablehttp from 0.7.4 to 0.7.7"}),"\n",(0,r.jsx)(s.li,{children:"Bump Local Path Provisioner version"}),"\n",(0,r.jsx)(s.li,{children:"Ensure remotedialer kubelet connections use kubelet bind address"}),"\n",(0,r.jsx)(s.li,{children:"Chore: Bump Trivy version"}),"\n",(0,r.jsx)(s.li,{children:"Add etcd s3 config secret implementation"}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["July Test Backports ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10509",children:"(#10509)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Update to v1.28.12-k3s1 and Go 1.22.5 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10541",children:"(#10541)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Fix issues loading data-dir value from env vars or dropping config files ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10598",children:"(#10598)"})]}),"\n"]}),"\n",(0,r.jsx)(s.hr,{}),"\n",(0,r.jsxs)(s.h2,{id:"release-v12811k3s2",children:["Release ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/releases/tag/v1.28.11+k3s2",children:"v1.28.11+k3s2"})]}),"\n",(0,r.jsx)(s.p,{children:"This release updates Kubernetes to v1.28.11, and fixes a number of issues."}),"\n",(0,r.jsxs)(s.p,{children:["For more details on what's new, see the ",(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.28.md#changelog-since-v12811",children:"Kubernetes release notes"}),"."]}),"\n",(0,r.jsx)(s.h3,{id:"changes-since-v12811k3s1",children:"Changes since v1.28.11+k3s1:"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsxs)(s.li,{children:["Update flannel to v0.25.4 and fixed issue with IPv6 mask ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10428",children:"(#10428)"})]}),"\n"]}),"\n",(0,r.jsx)(s.hr,{}),"\n",(0,r.jsxs)(s.h2,{id:"release-v12811k3s1",children:["Release ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/releases/tag/v1.28.11+k3s1",children:"v1.28.11+k3s1"})]}),"\n",(0,r.jsx)(s.p,{children:"This release updates Kubernetes to v1.28.11, and fixes a number of issues."}),"\n",(0,r.jsxs)(s.p,{children:["For more details on what's new, see the ",(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.28.md#changelog-since-v12810",children:"Kubernetes release notes"}),"."]}),"\n",(0,r.jsx)(s.h3,{id:"changes-since-v12810k3s1",children:"Changes since v1.28.10+k3s1:"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsxs)(s.li,{children:["Replace deprecated ruby function ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10090",children:"(#10090)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Fix bug when using tailscale config by file ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10144",children:"(#10144)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Bump flannel version to v0.25.2 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10221",children:"(#10221)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Update kube-router version to v2.1.2 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10182",children:"(#10182)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Improve tailscale test & add extra log in e2e tests ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10213",children:"(#10213)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Backports for 2024-06 release cycle ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10258",children:"(#10258)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:"Add WithSkipMissing to not fail import on missing blobs"}),"\n",(0,r.jsx)(s.li,{children:"Use fixed stream server bind address for cri-dockerd"}),"\n",(0,r.jsx)(s.li,{children:"Switch stargz over to cri registry config_path"}),"\n",(0,r.jsx)(s.li,{children:"Bump to containerd v1.7.17, etcd v3.5.13"}),"\n",(0,r.jsx)(s.li,{children:"Bump spegel version"}),"\n",(0,r.jsx)(s.li,{children:"Fix issue with externalTrafficPolicy: Local for single-stack services on dual-stack nodes"}),"\n",(0,r.jsxs)(s.li,{children:["ServiceLB now sets the priorityClassName on svclb pods to ",(0,r.jsx)(s.code,{children:"system-node-critical"})," by default. This can be overridden on a per-service basis via the ",(0,r.jsx)(s.code,{children:"svccontroller.k3s.cattle.io/priorityclassname"})," annotation."]}),"\n",(0,r.jsx)(s.li,{children:"Bump minio-go to v7.0.70"}),"\n",(0,r.jsx)(s.li,{children:"Bump kine to v0.11.9 to fix pagination"}),"\n",(0,r.jsx)(s.li,{children:"Update valid resolv conf"}),"\n",(0,r.jsx)(s.li,{children:"Add missing kernel config check"}),"\n",(0,r.jsx)(s.li,{children:"Symlinked sub-directories are now respected when scanning Auto-Deploying Manifests (AddOns)"}),"\n",(0,r.jsx)(s.li,{children:"Fix bug: allow helm controller set owner reference"}),"\n",(0,r.jsx)(s.li,{children:"Bump klipper-helm image for tls secret support"}),"\n",(0,r.jsx)(s.li,{children:"Fix issue with k3s-etcd informers not starting"}),"\n",(0,r.jsxs)(s.li,{children:[(0,r.jsx)(s.code,{children:"--Enable-pprof"})," can now be set on agents to enable the debug/pprof endpoints. When set, agents will listen on the supervisor port."]}),"\n",(0,r.jsxs)(s.li,{children:[(0,r.jsx)(s.code,{children:"--Supervisor-metrics"})," can now be set on servers to enable serving internal metrics on the supervisor endpoint; when set agents will listen on the supervisor port."]}),"\n",(0,r.jsx)(s.li,{children:"Fix netpol crash when node remains tainted uninitialized"}),"\n",(0,r.jsx)(s.li,{children:"The embedded load-balancer will now fall back to trying all servers with health-checks ignored, if all servers have been marked unavailable due to failed health checks."}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["More backports for 2024-06 release cycle ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10289",children:"(#10289)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Add snapshot retention etcd-s3-folder fix ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10315",children:"(#10315)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Add test for ",(0,r.jsx)(s.code,{children:"isValidResolvConf"})," (#10302) ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10331",children:"(#10331)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Fix race condition panic in loadbalancer.nextServer ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10323",children:"(#10323)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Fix typo, use ",(0,r.jsx)(s.code,{children:"rancher/permissions"})," ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10299",children:"(#10299)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Update Kubernetes to v1.28.11 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10347",children:"(#10347)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Fix agent supervisor port using apiserver port instead ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10355",children:"(#10355)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Fix issue that allowed multiple simultaneous snapshots to be allowed ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10377",children:"(#10377)"})]}),"\n"]}),"\n",(0,r.jsx)(s.hr,{}),"\n",(0,r.jsxs)(s.h2,{id:"release-v12810k3s1",children:["Release ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/releases/tag/v1.28.10+k3s1",children:"v1.28.10+k3s1"})]}),"\n",(0,r.jsx)(s.p,{children:"This release updates Kubernetes to v1.28.10, and fixes a number of issues."}),"\n",(0,r.jsxs)(s.p,{children:["For more details on what's new, see the ",(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.28.md#changelog-since-v1289",children:"Kubernetes release notes"}),"."]}),"\n",(0,r.jsx)(s.h3,{id:"changes-since-v1289k3s1",children:"Changes since v1.28.9+k3s1:"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsxs)(s.li,{children:["Bump E2E opensuse leap to 15.6, fix btrfs test ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10095",children:"(#10095)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Windows changes ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10114",children:"(#10114)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Update to v1.28.10-k3s1 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10098",children:"(#10098)"})]}),"\n"]}),"\n",(0,r.jsx)(s.hr,{}),"\n",(0,r.jsxs)(s.h2,{id:"release-v1289k3s1",children:["Release ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/releases/tag/v1.28.9+k3s1",children:"v1.28.9+k3s1"})]}),"\n",(0,r.jsx)(s.p,{children:"This release updates Kubernetes to v1.28.9, and fixes a number of issues."}),"\n",(0,r.jsxs)(s.p,{children:["For more details on what's new, see the ",(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.28.md#changelog-since-v1288",children:"Kubernetes release notes"}),"."]}),"\n",(0,r.jsx)(s.h3,{id:"changes-since-v1288k3s1",children:"Changes since v1.28.8+k3s1:"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsxs)(s.li,{children:["Add a new error when kine is with disable apiserver or disable etcd ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9804",children:"(#9804)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Remove old pinned dependencies ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9827",children:"(#9827)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Transition from deprecated pointer library to ptr ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9824",children:"(#9824)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Golang caching and E2E ubuntu 23.10 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9821",children:"(#9821)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Add tls for kine ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9849",children:"(#9849)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Bump spegel to v0.0.20-k3s1 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9880",children:"(#9880)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Backports for 2024-04 release cycle ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9911",children:"(#9911)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:"Send error response if member list cannot be retrieved"}),"\n",(0,r.jsx)(s.li,{children:"The k3s stub cloud provider now respects the kubelet's requested provider-id, instance type, and topology labels"}),"\n",(0,r.jsx)(s.li,{children:"Fix error when image has already been pulled"}),"\n",(0,r.jsx)(s.li,{children:"Add /etc/passwd and /etc/group to k3s docker image"}),"\n",(0,r.jsx)(s.li,{children:"Fix etcd snapshot reconcile for agentless servers"}),"\n",(0,r.jsx)(s.li,{children:"Add health-check support to loadbalancer"}),"\n",(0,r.jsx)(s.li,{children:"Add certificate expiry check, events, and metrics"}),"\n",(0,r.jsx)(s.li,{children:"Add workaround for containerd hosts.toml bug when passing config for default registry endpoint"}),"\n",(0,r.jsx)(s.li,{children:"Add supervisor cert/key to rotate list"}),"\n",(0,r.jsx)(s.li,{children:"The embedded containerd has been bumped to v1.7.15"}),"\n",(0,r.jsx)(s.li,{children:"The embedded cri-dockerd has been bumped to v0.3.12"}),"\n",(0,r.jsxs)(s.li,{children:["The ",(0,r.jsx)(s.code,{children:"k3s etcd-snapshot"})," command has been reworked for improved consistency. All snapshots operations are now performed by the server process, with the CLI acting as a client to initiate and report results. As a side effect, the CLI is now less noisy when managing snapshots."]}),"\n",(0,r.jsx)(s.li,{children:"Improve etcd load-balancer startup behavior"}),"\n",(0,r.jsx)(s.li,{children:"Actually fix agent certificate rotation"}),"\n",(0,r.jsx)(s.li,{children:"Traefik has been bumped to v2.10.7."}),"\n",(0,r.jsx)(s.li,{children:"Traefik pod annotations are now set properly in the default chart values."}),"\n",(0,r.jsx)(s.li,{children:"The system-default-registry value now supports RFC2732 IPv6 literals."}),"\n",(0,r.jsxs)(s.li,{children:["The local-path provisioner now defaults to creating ",(0,r.jsx)(s.code,{children:"local"})," volumes, instead of ",(0,r.jsx)(s.code,{children:"hostPath"}),"."]}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Allow LPP to read helper logs ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9938",children:"(#9938)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Update kube-router to v2.1.0 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9942",children:"(#9942)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Update to v1.28.9-k3s1 and Go 1.21.9 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9959",children:"(#9959)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Fix on-demand snapshots timing out; not honoring folder ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9994",children:"(#9994)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Make /db/info available anonymously from localhost ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10002",children:"(#10002)"})]}),"\n"]}),"\n",(0,r.jsx)(s.hr,{}),"\n",(0,r.jsxs)(s.h2,{id:"release-v1288k3s1",children:["Release ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/releases/tag/v1.28.8+k3s1",children:"v1.28.8+k3s1"})]}),"\n",(0,r.jsx)(s.p,{children:"This release updates Kubernetes to v1.28.8, and fixes a number of issues."}),"\n",(0,r.jsxs)(s.p,{children:["For more details on what's new, see the ",(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.28.md#changelog-since-v1287",children:"Kubernetes release notes"}),"."]}),"\n",(0,r.jsx)(s.h3,{id:"changes-since-v1287k3s1",children:"Changes since v1.28.7+k3s1:"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsxs)(s.li,{children:["Add an integration test for flannel-backend=none ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9608",children:"(#9608)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Install and Unit test backports ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9641",children:"(#9641)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Update klipper-lb image version ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9605",children:"(#9605)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Chore(deps): Remediating CVE-2023-45142 CVE-2023-48795 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9647",children:"(#9647)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Adjust first node-ip based on configured clusterCIDR ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9631",children:"(#9631)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Improve tailscale e2e test ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9653",children:"(#9653)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Backports for 2024-03 release cycle ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9669",children:"(#9669)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:"Fix: use correct wasm shims names"}),"\n",(0,r.jsx)(s.li,{children:"The embedded flannel cni-plugin binary is now built and versioned separate from the rest of the cni plugins and the embedded flannel controller."}),"\n",(0,r.jsx)(s.li,{children:"Bump spegel to v0.0.18-k3s3"}),"\n",(0,r.jsx)(s.li,{children:"Adds wildcard registry support"}),"\n",(0,r.jsx)(s.li,{children:"Fixes issue with excessive CPU utilization while waiting for containerd to start"}),"\n",(0,r.jsx)(s.li,{children:"Add env var to allow spegel mirroring of latest tag"}),"\n",(0,r.jsx)(s.li,{children:"Tweak netpol node wait logs"}),"\n",(0,r.jsx)(s.li,{children:"Fix coredns NodeHosts on dual-stack clusters"}),"\n",(0,r.jsx)(s.li,{children:"Bump helm-controller/klipper-helm versions"}),"\n",(0,r.jsx)(s.li,{children:"Fix snapshot prune"}),"\n",(0,r.jsx)(s.li,{children:"Fix issue with etcd node name missing hostname"}),"\n",(0,r.jsx)(s.li,{children:"Rootless mode should also bind service nodePort to host for LoadBalancer type, matching UX of rootful mode."}),"\n",(0,r.jsxs)(s.li,{children:["To enable raw output for the ",(0,r.jsx)(s.code,{children:"check-config"})," subcommand, you may now set NO_COLOR=1"]}),"\n",(0,r.jsx)(s.li,{children:"Fix additional corner cases in registries handling"}),"\n",(0,r.jsx)(s.li,{children:"Bump metrics-server to v0.7.0"}),"\n",(0,r.jsx)(s.li,{children:"K3s will now warn and suppress duplicate entries in the mirror endpoint list for a registry. Containerd does not support listing the same endpoint multiple times as a mirror for a single upstream registry."}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Docker and E2E Test Backports ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9707",children:"(#9707)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Fix wildcard entry upstream fallback ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9733",children:"(#9733)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Update to v1.28.8-k3s1 and Go 1.21.8 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9746",children:"(#9746)"})]}),"\n"]}),"\n",(0,r.jsx)(s.hr,{}),"\n",(0,r.jsxs)(s.h2,{id:"release-v1287k3s1",children:["Release ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/releases/tag/v1.28.7+k3s1",children:"v1.28.7+k3s1"})]}),"\n",(0,r.jsx)(s.p,{children:"This release updates Kubernetes to v1.28.7, and fixes a number of issues."}),"\n",(0,r.jsxs)(s.p,{children:["For more details on what's new, see the ",(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.28.md#changelog-since-v1286",children:"Kubernetes release notes"}),"."]}),"\n",(0,r.jsx)(s.h3,{id:"changes-since-v1286k3s2",children:"Changes since v1.28.6+k3s2:"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsxs)(s.li,{children:["Chore: bump Local Path Provisioner version ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9426",children:"(#9426)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Bump cri-dockerd to fix compat with Docker Engine 25 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9293",children:"(#9293)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Auto Dependency Bump ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9419",children:"(#9419)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Runtimes refactor using exec.LookPath ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9431",children:"(#9431)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:"Directories containing runtimes need to be included in the $PATH environment variable for effective runtime detection."}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Changed how lastHeartBeatTime works in the etcd condition ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9424",children:"(#9424)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Bump Flannel v0.24.2 + remove multiclustercidr ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9401",children:"(#9401)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Allow executors to define containerd and docker behavior ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9254",children:"(#9254)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Update Kube-router to v2.0.1 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9404",children:"(#9404)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Backports for 2024-02 release cycle ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9462",children:"(#9462)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Enable longer http timeout requests ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9444",children:"(#9444)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Test_UnitApplyContainerdQoSClassConfigFileIfPresent ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9440",children:"(#9440)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Support PR testing installs ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9469",children:"(#9469)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Update Kubernetes to v1.28.7 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9492",children:"(#9492)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Fix drone publish for arm ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9508",children:"(#9508)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Remove failing Drone step ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9516",children:"(#9516)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Restore original order of agent startup functions ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9545",children:"(#9545)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Fix netpol startup when flannel is disabled ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9578",children:"(#9578)"})]}),"\n"]}),"\n",(0,r.jsx)(s.hr,{}),"\n",(0,r.jsxs)(s.h2,{id:"release-v1286k3s2",children:["Release ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/releases/tag/v1.28.6+k3s2",children:"v1.28.6+k3s2"})]}),"\n",(0,r.jsx)(s.p,{children:"This release updates Kubernetes to v1.28.6, and fixes a number of issues."}),"\n",(0,r.jsxs)(s.p,{children:["For more details on what's new, see the ",(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.28.md#changelog-since-v1285",children:"Kubernetes release notes"}),"."]}),"\n",(0,r.jsx)(s.p,{children:(0,r.jsx)(s.strong,{children:"Important Notes"})}),"\n",(0,r.jsxs)(s.p,{children:["Addresses the runc CVE: ",(0,r.jsx)(s.a,{href:"https://nvd.nist.gov/vuln/detail/CVE-2024-21626",children:"CVE-2024-21626"})," by updating runc to v1.1.12."]}),"\n",(0,r.jsx)(s.h3,{id:"changes-since-v1285k3s1",children:"Changes since v1.28.5+k3s1:"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsxs)(s.li,{children:["Add a retry around updating a secrets-encrypt node annotations ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9125",children:"(#9125)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Wait for taint to be gone in the node before starting the netpol controller ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9175",children:"(#9175)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Etcd condition ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9181",children:"(#9181)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Backports for 2024-01 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9203",children:"(#9203)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Pin opa version for missing dependency chain ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9216",children:"(#9216)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Added support for env *_PROXY variables for agent loadbalancer ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9206",children:"(#9206)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Etcd node is nil ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9228",children:"(#9228)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Update to v1.28.6 and Go 1.20.13 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9260",children:"(#9260)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Use ",(0,r.jsx)(s.code,{children:"ipFamilyPolicy: RequireDualStack"})," for dual-stack kube-dns ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9269",children:"(#9269)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Backports for 2024-01 k3s2 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9336",children:"(#9336)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:"Bump runc to v1.1.12 and helm-controller to v0.15.7"}),"\n",(0,r.jsx)(s.li,{children:"Fix handling of bare hostname or IP as endpoint address in registries.yaml"}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Bump helm-controller to fix issue with ChartContent ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9346",children:"(#9346)"})]}),"\n"]}),"\n",(0,r.jsx)(s.hr,{}),"\n",(0,r.jsxs)(s.h2,{id:"release-v1285k3s1",children:["Release ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/releases/tag/v1.28.5+k3s1",children:"v1.28.5+k3s1"})]}),"\n",(0,r.jsx)(s.p,{children:"This release updates Kubernetes to v1.28.5, and fixes a number of issues."}),"\n",(0,r.jsxs)(s.p,{children:["For more details on what's new, see the ",(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.28.md#changelog-since-v1284",children:"Kubernetes release notes"}),"."]}),"\n",(0,r.jsx)(s.h3,{id:"changes-since-v1284k3s1",children:"Changes since v1.28.4+k3s1:"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsxs)(s.li,{children:["Remove s390x steps temporarily since runners are disabled ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8983",children:"(#8983)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Remove s390x from manifest ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8998",children:"(#8998)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Fix overlapping address range ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8913",children:"(#8913)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Modify CONTRIBUTING.md guide ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8954",children:"(#8954)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Nov 2023 stable channel update ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9022",children:"(#9022)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Default runtime and runtime classes for wasm/nvidia/crun ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8936",children:"(#8936)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:"Added runtime classes for wasm/nvidia/crun"}),"\n",(0,r.jsx)(s.li,{children:"Added default runtime flag for containerd"}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Bump containerd/runc to v1.7.10-k3s1/v1.1.10 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8962",children:"(#8962)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Allow setting default-runtime on servers ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9027",children:"(#9027)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Bump containerd to v1.7.11 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9040",children:"(#9040)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Update to v1.28.5-k3s1 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9081",children:"(#9081)"})]}),"\n"]}),"\n",(0,r.jsx)(s.hr,{}),"\n",(0,r.jsxs)(s.h2,{id:"release-v1284k3s2",children:["Release ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/releases/tag/v1.28.4+k3s2",children:"v1.28.4+k3s2"})]}),"\n",(0,r.jsx)(s.p,{children:"This release updates Kubernetes to v1.28.4, and fixes a number of issues."}),"\n",(0,r.jsxs)(s.p,{children:["For more details on what's new, see the ",(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.28.md#changelog-since-v1283",children:"Kubernetes release notes"}),"."]}),"\n",(0,r.jsx)(s.h3,{id:"changes-since-v1283k3s2",children:"Changes since v1.28.3+k3s2:"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsxs)(s.li,{children:["Update channels latest to v1.27.7+k3s2 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8799",children:"(#8799)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Add etcd status condition ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8724",children:"(#8724)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:"Now the user can see the etcd status from each node in a simple way"}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["ADR for etcd status ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8355",children:"(#8355)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Wasm shims detection ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8751",children:"(#8751)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:"Automatic discovery of WebAssembly runtimes"}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Add warning for removal of multiclustercidr flag ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8758",children:"(#8758)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Improve dualStack log ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8798",children:"(#8798)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Optimize: Simplify and clean up Dockerfile ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8244",children:"(#8244)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Add: timezone info in image ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8764",children:"(#8764)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsxs)(s.li,{children:["\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsxs)(s.li,{children:["New timezone info in Docker image allows the use of ",(0,r.jsx)(s.code,{children:"spec.timeZone"})," in CronJobs"]}),"\n"]}),"\n"]}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Bump kine to fix nats, postgres, and watch issues ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8778",children:"(#8778)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:"Bumped kine to v0.11.0 to resolve issues with postgres and NATS, fix performance of watch channels under heavy load, and improve compatibility with the reference implementation."}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["QoS-class resource configuration ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8726",children:"(#8726)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsxs)(s.li,{children:["Containerd may now be configured to use rdt or blockio configuration by defining ",(0,r.jsx)(s.code,{children:"rdt_config.yaml"})," or ",(0,r.jsx)(s.code,{children:"blockio_config.yaml"})," files."]}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Add agent flag disable-apiserver-lb ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8717",children:"(#8717)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:"Add agent flag disable-apiserver-lb, agent will not start load balance proxy."}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Force umount for NFS mount (like with longhorn) ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8521",children:"(#8521)"})]}),"\n",(0,r.jsxs)(s.li,{children:["General updates to README ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8786",children:"(#8786)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Fix wrong warning from restorecon in install script ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8871",children:"(#8871)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Fix issue with snapshot metadata configmap ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8835",children:"(#8835)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:"Omit snapshot list configmap entries for snapshots without extra metadata"}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Skip initial datastore reconcile during cluster-reset ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8861",children:"(#8861)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Tweaked order of ingress IPs in ServiceLB ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8711",children:"(#8711)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:"Improved ingress IP ordering from ServiceLB"}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Disable helm CRD installation for disable-helm-controller ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8702",children:"(#8702)"})]}),"\n",(0,r.jsxs)(s.li,{children:["More improves for K3s patch release docs ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8800",children:"(#8800)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Update install.sh sha256sum ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8885",children:"(#8885)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Add jitter to client config retry to avoid hammering servers when they are starting up ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8863",children:"(#8863)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Handle nil pointer when runtime core is not ready in etcd ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8886",children:"(#8886)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Bump dynamiclistener; reduce snapshot controller log spew ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8894",children:"(#8894)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:"Bumped dynamiclistener to address a race condition that could cause a server to fail to sync its certificates into the Kubernetes secret"}),"\n",(0,r.jsx)(s.li,{children:"Reduced etcd snapshot log spam during initial cluster startup"}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Remove depends_on for e2e step; fix cert rotate e2e ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8906",children:"(#8906)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Fix etcd snapshot S3 issues ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8926",children:"(#8926)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:"Don't apply S3 retention if S3 client failed to initialize"}),"\n",(0,r.jsx)(s.li,{children:"Don't request metadata when listing S3 snapshots"}),"\n",(0,r.jsx)(s.li,{children:"Print key instead of file path in snapshot metadata log message"}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Update to v1.28.4 and Go to v1.20.11 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8920",children:"(#8920)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Remove s390x steps temporarily since runners are disabled ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8983",children:"(#8983)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Remove s390x from manifest ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8998",children:"(#8998)"})]}),"\n"]}),"\n",(0,r.jsx)(s.hr,{}),"\n",(0,r.jsxs)(s.h2,{id:"release-v1283k3s2",children:["Release ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/releases/tag/v1.28.3+k3s2",children:"v1.28.3+k3s2"})]}),"\n",(0,r.jsx)(s.p,{children:"This release updates Kubernetes to v1.28.3, and fixes a number of issues."}),"\n",(0,r.jsxs)(s.p,{children:["For more details on what's new, see the ",(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.28.md#changelog-since-v1283",children:"Kubernetes release notes"}),"."]}),"\n",(0,r.jsx)(s.h3,{id:"changes-since-v1283k3s1",children:"Changes since v1.28.3+k3s1:"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsxs)(s.li,{children:["Restore selinux context systemd unit file ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8593",children:"(#8593)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Update channel to v1.27.7+k3s1 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8753",children:"(#8753)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Bump Sonobuoy version ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8710",children:"(#8710)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Bump Trivy version ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8739",children:"(#8739)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Fix: Access outer scope .SystemdCgroup ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8761",children:"(#8761)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:"Fixed failing to start with nvidia-container-runtime"}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Upgrade traefik chart to v25.0.0 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8771",children:"(#8771)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Update traefik to fix registry value ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8792",children:"(#8792)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Don't use iptables-save/iptables-restore if it will corrupt rules ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8795",children:"(#8795)"})]}),"\n"]}),"\n",(0,r.jsx)(s.hr,{}),"\n",(0,r.jsxs)(s.h2,{id:"release-v1283k3s1",children:["Release ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/releases/tag/v1.28.3+k3s1",children:"v1.28.3+k3s1"})]}),"\n",(0,r.jsx)(s.p,{children:"This release updates Kubernetes to v1.28.3, and fixes a number of issues."}),"\n",(0,r.jsxs)(s.p,{children:["For more details on what's new, see the ",(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.28.md#changelog-since-v1282",children:"Kubernetes release notes"}),"."]}),"\n",(0,r.jsx)(s.h3,{id:"changes-since-v1282k3s1",children:"Changes since v1.28.2+k3s1:"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsxs)(s.li,{children:["Fix error reporting ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8250",children:"(#8250)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Add context to flannel errors ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8284",children:"(#8284)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Update channel, September patch release ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8397",children:"(#8397)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Add missing link to drone in documentation ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8295",children:"(#8295)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Include the interface name in the error message ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8346",children:"(#8346)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Add extraArgs to vpn provider ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8354",children:"(#8354)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:"Allow to pass extra args to the vpn provider"}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Disable HTTP on main etcd client port ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8402",children:"(#8402)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsxs)(s.li,{children:["Embedded etcd no longer serves http requests on the client port, only grpc. This addresses a performance issue that could cause watch stream starvation under load. For more information, see ",(0,r.jsx)(s.a,{href:"https://github.com/etcd-io/etcd/issues/15402",children:"https://github.com/etcd-io/etcd/issues/15402"})]}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Server token rotation ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8215",children:"(#8215)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Fix issues with etcd member removal after reset ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8392",children:"(#8392)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:"Fixed an issue that could cause k3s to attempt to remove members from the etcd cluster immediately following a cluster-reset/restore, if they were queued for removal at the time the snapshot was taken."}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Fix gofmt error ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8439",children:"(#8439)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Added advertise address integration test ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8344",children:"(#8344)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Added cluster reset from non bootstrap nodes on snapshot restore e2e test ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8292",children:"(#8292)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Fix .github regex to skip drone runs on gh action bumps ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8433",children:"(#8433)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Added error when cluster reset while using server flag ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8385",children:"(#8385)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:"The user will receive a error when --cluster-reset with the --server flag"}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Update kube-router ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8423",children:"(#8423)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:"Update kube-router to v2.0.0-rc7 to fix performance issues"}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Add SHA256 signatures of the install script ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8312",children:"(#8312)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsxs)(s.li,{children:["\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:"Add SHA256 signatures of the install script."}),"\n"]}),"\n"]}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Add --image-service-endpoint flag ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8279",children:"(#8279)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsxs)(s.li,{children:["Add ",(0,r.jsx)(s.code,{children:"--image-service-endpoint"})," flag to specify an external image service socket."]}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Don't ignore assets in home dir if system assets exist ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8458",children:"(#8458)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Pass SystemdCgroup setting through to nvidia runtime options ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8470",children:"(#8470)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:"Fixed issue that would cause pods using nvidia container runtime to be killed after a few seconds, when using newer versions of nvidia-container-toolkit."}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Improve release docs - updated ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8414",children:"(#8414)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Take IPFamily precedence based on order ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8460",children:"(#8460)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Fix spellcheck problem ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8507",children:"(#8507)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Network defaults are duplicated, remove one ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8523",children:"(#8523)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Fix slemicro check for selinux ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8526",children:"(#8526)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Update install.sh.sha256sum ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8566",children:"(#8566)"})]}),"\n",(0,r.jsxs)(s.li,{children:["System agent push tags fix ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8568",children:"(#8568)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Fixed tailscale node IP dualstack mode in case of IPv4 only node ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8524",children:"(#8524)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Server Token Rotation ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8265",children:"(#8265)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsxs)(s.li,{children:["Users can now rotate the server token using ",(0,r.jsx)(s.code,{children:"k3s token rotate -t --new-token "}),". After command succeeds, all server nodes must be restarted with the new token."]}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["E2E Domain Drone Cleanup ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8579",children:"(#8579)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Bump containerd to v1.7.7-k3s1 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8604",children:"(#8604)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Bump busybox to v1.36.1 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8602",children:"(#8602)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Migrate to using custom resource to store etcd snapshot metadata ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8064",children:"(#8064)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Switch build target from main.go to a package. ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8342",children:"(#8342)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Use IPv6 in case is the first configured IP with dualstack ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8581",children:"(#8581)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Bump traefik, golang.org/x/net, google.golang.org/grpc ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8624",children:"(#8624)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Update kube-router package in build script ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8630",children:"(#8630)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Add etcd-only/control-plane-only server test and fix control-plane-only server crash ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8638",children:"(#8638)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Use ",(0,r.jsx)(s.code,{children:"version.Program"})," not K3s in token rotate logs ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8653",children:"(#8653)"})]}),"\n",(0,r.jsxs)(s.li,{children:["[Windows Port ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7259",children:"(#7259)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Fix CloudDualStackNodeIPs feature-gate inconsistency ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8667",children:"(#8667)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Re-enable etcd endpoint auto-sync ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8675",children:"(#8675)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Manually requeue configmap reconcile when no nodes have reconciled snapshots ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8683",children:"(#8683)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Update to v1.28.3 and Go to v1.20.10 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8682",children:"(#8682)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Fix s3 snapshot restore ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8729",children:"(#8729)"})]}),"\n"]}),"\n",(0,r.jsx)(s.hr,{}),"\n",(0,r.jsxs)(s.h2,{id:"release-v1282k3s1",children:["Release ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/releases/tag/v1.28.2+k3s1",children:"v1.28.2+k3s1"})]}),"\n",(0,r.jsx)(s.p,{children:"This release updates Kubernetes to v1.28.2, and fixes a number of issues."}),"\n",(0,r.jsxs)(s.p,{children:["For more details on what's new, see the ",(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.28.md#changelog-since-v1281",children:"Kubernetes release notes"}),"."]}),"\n",(0,r.jsx)(s.h3,{id:"changes-since-v1281k3s1",children:"Changes since v1.28.1+k3s1:"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsxs)(s.li,{children:["Update channel for version v1.28 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8305",children:"(#8305)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Bump kine to v0.10.3 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8323",children:"(#8323)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Update to v1.28.2 and go v1.20.8 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8364",children:"(#8364)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:"Bump embedded containerd to v1.7.6"}),"\n",(0,r.jsx)(s.li,{children:"Bump embedded stargz-snapshotter plugin to latest"}),"\n",(0,r.jsx)(s.li,{children:"Fixed intermittent drone CI failures due to race conditions in test environment setup scripts"}),"\n",(0,r.jsx)(s.li,{children:"Fixed CI failures due to changes to api discovery changes in Kubernetes 1.28"}),"\n"]}),"\n"]}),"\n"]}),"\n",(0,r.jsx)(s.hr,{}),"\n",(0,r.jsxs)(s.h2,{id:"release-v1281k3s1",children:["Release ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/releases/tag/v1.28.1+k3s1",children:"v1.28.1+k3s1"})]}),"\n",(0,r.jsx)(s.p,{children:"This release is K3S's first in the v1.28 line. This release updates Kubernetes to v1.28.1."}),"\n",(0,r.jsx)(s.admonition,{title:"Important",type:"warning",children:(0,r.jsxs)(s.p,{children:["This release includes remediation for CVE-2023-32187, a potential Denial of Service attack vector on K3s servers. See ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/security/advisories/GHSA-m4hf-6vgr-75r2",children:"https://github.com/k3s-io/k3s/security/advisories/GHSA-m4hf-6vgr-75r2"})," for more information, including documentation on changes in behavior that harden clusters against this vulnerability."]})}),"\n",(0,r.jsx)(s.admonition,{title:"Critical Regression",type:"danger",children:(0,r.jsxs)(s.p,{children:["Kubernetes v1.28 contains a critical regression (",(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/issues/120247",children:"kubernetes/kubernetes#120247"}),") that causes init containers to run at the same time as app containers following a restart of the node. This issue will be fixed in v1.28.2. We do not recommend using K3s v1.28 at this time if your application depends on init containers."]})}),"\n",(0,r.jsxs)(s.p,{children:["For more details on what's new, see the ",(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.28.md#changelog-since-v1270",children:"Kubernetes release notes"}),"."]}),"\n",(0,r.jsx)(s.h3,{id:"changes-since-v1275k3s1",children:"Changes since v1.27.5+k3s1:"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsxs)(s.li,{children:["Update to v1.28.1 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8239",children:"(#8239)"})]}),"\n",(0,r.jsxs)(s.li,{children:["CLI Removal for v1.28.0 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8203",children:"(#8203)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Secrets Encryption V3 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8111",children:"(#8111)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Add new CLI flag to disable TLS SAN CN filtering ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8252",children:"(#8252)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsxs)(s.li,{children:["Added a new ",(0,r.jsx)(s.code,{children:"--tls-san-security"})," option."]}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Add RWMutex to address controller ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8268",children:"(#8268)"})]}),"\n"]}),"\n",(0,r.jsx)(s.hr,{})]})}function o(e={}){const{wrapper:s}={...(0,t.a)(),...e.components};return s?(0,r.jsx)(s,{...e,children:(0,r.jsx)(a,{...e})}):a(e)}},1151:(e,s,i)=>{i.d(s,{Z:()=>h,a:()=>l});var r=i(7294);const t={},n=r.createContext(t);function l(e){const s=r.useContext(n);return r.useMemo((function(){return"function"==typeof e?e(s):{...s,...e}}),[s,e])}function h(e){let s;return s=e.disableParentContext?"function"==typeof e.components?e.components(t):e.components||t:l(e.components),r.createElement(n.Provider,{value:s},e.children)}}}]); \ No newline at end of file +"use strict";(self.webpackChunkk_3_s_docs=self.webpackChunkk_3_s_docs||[]).push([[101],{3989:(e,s,i)=>{i.r(s),i.d(s,{assets:()=>c,contentTitle:()=>l,default:()=>o,frontMatter:()=>n,metadata:()=>h,toc:()=>d});var r=i(5893),t=i(1151);const n={hide_table_of_contents:!0,sidebar_position:3},l="v1.28.X",h={id:"release-notes/v1.28.X",title:"v1.28.X",description:"Before upgrading from earlier releases, be sure to read the Kubernetes Urgent Upgrade Notes.",source:"@site/docs/release-notes/v1.28.X.md",sourceDirName:"release-notes",slug:"/release-notes/v1.28.X",permalink:"/release-notes/v1.28.X",draft:!1,unlisted:!1,editUrl:"https://github.com/k3s-io/docs/edit/main/docs/release-notes/v1.28.X.md",tags:[],version:"current",lastUpdatedAt:1723747404e3,sidebarPosition:3,frontMatter:{hide_table_of_contents:!0,sidebar_position:3},sidebar:"mySidebar",previous:{title:"v1.29.X",permalink:"/release-notes/v1.29.X"},next:{title:"v1.27.X",permalink:"/release-notes/v1.27.X"}},c={},d=[{value:"Release v1.28.12+k3s1",id:"release-v12812k3s1",level:2},{value:"Changes since v1.28.11+k3s2:",id:"changes-since-v12811k3s2",level:3},{value:"Release v1.28.11+k3s2",id:"release-v12811k3s2",level:2},{value:"Changes since v1.28.11+k3s1:",id:"changes-since-v12811k3s1",level:3},{value:"Release v1.28.11+k3s1",id:"release-v12811k3s1",level:2},{value:"Changes since v1.28.10+k3s1:",id:"changes-since-v12810k3s1",level:3},{value:"Release v1.28.10+k3s1",id:"release-v12810k3s1",level:2},{value:"Changes since v1.28.9+k3s1:",id:"changes-since-v1289k3s1",level:3},{value:"Release v1.28.9+k3s1",id:"release-v1289k3s1",level:2},{value:"Changes since v1.28.8+k3s1:",id:"changes-since-v1288k3s1",level:3},{value:"Release v1.28.8+k3s1",id:"release-v1288k3s1",level:2},{value:"Changes since v1.28.7+k3s1:",id:"changes-since-v1287k3s1",level:3},{value:"Release v1.28.7+k3s1",id:"release-v1287k3s1",level:2},{value:"Changes since v1.28.6+k3s2:",id:"changes-since-v1286k3s2",level:3},{value:"Release v1.28.6+k3s2",id:"release-v1286k3s2",level:2},{value:"Changes since v1.28.5+k3s1:",id:"changes-since-v1285k3s1",level:3},{value:"Release v1.28.5+k3s1",id:"release-v1285k3s1",level:2},{value:"Changes since v1.28.4+k3s1:",id:"changes-since-v1284k3s1",level:3},{value:"Release v1.28.4+k3s2",id:"release-v1284k3s2",level:2},{value:"Changes since v1.28.3+k3s2:",id:"changes-since-v1283k3s2",level:3},{value:"Release v1.28.3+k3s2",id:"release-v1283k3s2",level:2},{value:"Changes since v1.28.3+k3s1:",id:"changes-since-v1283k3s1",level:3},{value:"Release v1.28.3+k3s1",id:"release-v1283k3s1",level:2},{value:"Changes since v1.28.2+k3s1:",id:"changes-since-v1282k3s1",level:3},{value:"Release v1.28.2+k3s1",id:"release-v1282k3s1",level:2},{value:"Changes since v1.28.1+k3s1:",id:"changes-since-v1281k3s1",level:3},{value:"Release v1.28.1+k3s1",id:"release-v1281k3s1",level:2},{value:"Changes since v1.27.5+k3s1:",id:"changes-since-v1275k3s1",level:3}];function a(e){const s={a:"a",admonition:"admonition",code:"code",h1:"h1",h2:"h2",h3:"h3",header:"header",hr:"hr",li:"li",p:"p",strong:"strong",table:"table",tbody:"tbody",td:"td",th:"th",thead:"thead",tr:"tr",ul:"ul",...(0,t.a)(),...e.components};return(0,r.jsxs)(r.Fragment,{children:[(0,r.jsx)(s.header,{children:(0,r.jsx)(s.h1,{id:"v128x",children:"v1.28.X"})}),"\n",(0,r.jsx)(s.admonition,{title:"Upgrade Notice",type:"warning",children:(0,r.jsxs)(s.p,{children:["Before upgrading from earlier releases, be sure to read the Kubernetes ",(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.28.md#urgent-upgrade-notes",children:"Urgent Upgrade Notes"}),"."]})}),"\n",(0,r.jsxs)(s.table,{children:[(0,r.jsx)(s.thead,{children:(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.th,{children:"Version"}),(0,r.jsx)(s.th,{children:"Release date"}),(0,r.jsx)(s.th,{children:"Kubernetes"}),(0,r.jsx)(s.th,{children:"Kine"}),(0,r.jsx)(s.th,{children:"SQLite"}),(0,r.jsx)(s.th,{children:"Etcd"}),(0,r.jsx)(s.th,{children:"Containerd"}),(0,r.jsx)(s.th,{children:"Runc"}),(0,r.jsx)(s.th,{children:"Flannel"}),(0,r.jsx)(s.th,{children:"Metrics-server"}),(0,r.jsx)(s.th,{children:"Traefik"}),(0,r.jsx)(s.th,{children:"CoreDNS"}),(0,r.jsx)(s.th,{children:"Helm-controller"}),(0,r.jsx)(s.th,{children:"Local-path-provisioner"})]})}),(0,r.jsxs)(s.tbody,{children:[(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"/release-notes/v1.28.X#release-v12812k3s1",children:"v1.28.12+k3s1"})}),(0,r.jsx)(s.td,{children:"Jul 31 2024"}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.28.md#v12812",children:"v1.28.12"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/kine/releases/tag/v0.11.11",children:"v0.11.11"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://sqlite.org/releaselog/3_44_0.html",children:"3.44.0"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/etcd/releases/tag/v3.5.13-k3s1",children:"v3.5.13-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/containerd/releases/tag/v1.7.17-k3s1.28",children:"v1.7.17-k3s1.28"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/opencontainers/runc/releases/tag/v1.1.12",children:"v1.1.12"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/flannel-io/flannel/releases/tag/v0.25.4",children:"v0.25.4"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.7.0",children:"v0.7.0"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/traefik/traefik/releases/tag/v2.10.7",children:"v2.10.7"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/coredns/coredns/releases/tag/v1.10.1",children:"v1.10.1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/helm-controller/releases/tag/v0.15.10",children:"v0.15.10"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/rancher/local-path-provisioner/releases/tag/v0.0.28",children:"v0.0.28"})})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"/release-notes/v1.28.X#release-v12811k3s2",children:"v1.28.11+k3s2"})}),(0,r.jsx)(s.td,{children:"Jul 03 2024"}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.28.md#v12811",children:"v1.28.11"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/kine/releases/tag/v0.11.9",children:"v0.11.9"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://sqlite.org/releaselog/3_44_0.html",children:"3.44.0"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/etcd/releases/tag/v3.5.13-k3s1",children:"v3.5.13-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/containerd/releases/tag/v1.7.17-k3s1.28",children:"v1.7.17-k3s1.28"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/opencontainers/runc/releases/tag/v1.1.12",children:"v1.1.12"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/flannel-io/flannel/releases/tag/v0.25.4",children:"v0.25.4"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.7.0",children:"v0.7.0"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/traefik/traefik/releases/tag/v2.10.7",children:"v2.10.7"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/coredns/coredns/releases/tag/v1.10.1",children:"v1.10.1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/helm-controller/releases/tag/v0.15.10",children:"v0.15.10"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/rancher/local-path-provisioner/releases/tag/v0.0.27",children:"v0.0.27"})})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"/release-notes/v1.28.X#release-v12811k3s1",children:"v1.28.11+k3s1"})}),(0,r.jsx)(s.td,{children:"Jun 25 2024"}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.28.md#v12811",children:"v1.28.11"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/kine/releases/tag/v0.11.9",children:"v0.11.9"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://sqlite.org/releaselog/3_44_0.html",children:"3.44.0"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/etcd/releases/tag/v3.5.13-k3s1",children:"v3.5.13-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/containerd/releases/tag/v1.7.17-k3s1.28",children:"v1.7.17-k3s1.28"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/opencontainers/runc/releases/tag/v1.1.12",children:"v1.1.12"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/flannel-io/flannel/releases/tag/v0.25.2",children:"v0.25.2"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.7.0",children:"v0.7.0"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/traefik/traefik/releases/tag/v2.10.7",children:"v2.10.7"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/coredns/coredns/releases/tag/v1.10.1",children:"v1.10.1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/helm-controller/releases/tag/v0.15.10",children:"v0.15.10"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/rancher/local-path-provisioner/releases/tag/v0.0.27",children:"v0.0.27"})})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"/release-notes/v1.28.X#release-v12810k3s1",children:"v1.28.10+k3s1"})}),(0,r.jsx)(s.td,{children:"May 22 2024"}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.28.md#v12810",children:"v1.28.10"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/kine/releases/tag/v0.11.7",children:"v0.11.7"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://sqlite.org/releaselog/3_44_0.html",children:"3.44.0"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/etcd/releases/tag/v3.5.9-k3s1",children:"v3.5.9-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/containerd/releases/tag/v1.7.15-k3s1",children:"v1.7.15-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/opencontainers/runc/releases/tag/v1.1.12-k3s1",children:"v1.1.12-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/flannel-io/flannel/releases/tag/v0.24.2",children:"v0.24.2"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.7.0",children:"v0.7.0"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/traefik/traefik/releases/tag/v2.10.7",children:"v2.10.7"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/coredns/coredns/releases/tag/v1.10.1",children:"v1.10.1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/helm-controller/releases/tag/v0.15.9",children:"v0.15.9"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/rancher/local-path-provisioner/releases/tag/v0.0.26",children:"v0.0.26"})})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"/release-notes/v1.28.X#release-v1289k3s1",children:"v1.28.9+k3s1"})}),(0,r.jsx)(s.td,{children:"Apr 25 2024"}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.28.md#v1289",children:"v1.28.9"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/kine/releases/tag/v0.11.7",children:"v0.11.7"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://sqlite.org/releaselog/3_44_0.html",children:"3.44.0"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/etcd/releases/tag/v3.5.9-k3s1",children:"v3.5.9-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/containerd/releases/tag/v1.7.15-k3s1",children:"v1.7.15-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/opencontainers/runc/releases/tag/v1.1.12",children:"v1.1.12"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/flannel-io/flannel/releases/tag/v0.24.2",children:"v0.24.2"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.7.0",children:"v0.7.0"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/traefik/traefik/releases/tag/v2.10.7",children:"v2.10.7"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/coredns/coredns/releases/tag/v1.10.1",children:"v1.10.1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/helm-controller/releases/tag/v0.15.9",children:"v0.15.9"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/rancher/local-path-provisioner/releases/tag/v0.0.26",children:"v0.0.26"})})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"/release-notes/v1.28.X#release-v1288k3s1",children:"v1.28.8+k3s1"})}),(0,r.jsx)(s.td,{children:"Mar 25 2024"}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.28.md#v1288",children:"v1.28.8"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/kine/releases/tag/v0.11.4",children:"v0.11.4"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://sqlite.org/releaselog/3_44_0.html",children:"3.44.0"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/etcd/releases/tag/v3.5.9-k3s1",children:"v3.5.9-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/containerd/releases/tag/v1.7.11-k3s2",children:"v1.7.11-k3s2"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/opencontainers/runc/releases/tag/v1.1.12-k3s1",children:"v1.1.12-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/flannel-io/flannel/releases/tag/v0.24.2",children:"v0.24.2"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.7.0",children:"v0.7.0"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/traefik/traefik/releases/tag/v2.10.5",children:"v2.10.5"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/coredns/coredns/releases/tag/v1.10.1",children:"v1.10.1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/helm-controller/releases/tag/v0.15.9",children:"v0.15.9"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/rancher/local-path-provisioner/releases/tag/v0.0.26",children:"v0.0.26"})})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"/release-notes/v1.28.X#release-v1287k3s1",children:"v1.28.7+k3s1"})}),(0,r.jsx)(s.td,{children:"Feb 29 2024"}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.28.md#v1287",children:"v1.28.7"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/kine/releases/tag/v0.11.4",children:"v0.11.4"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://sqlite.org/releaselog/3_44_0.html",children:"3.44.0"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/etcd/releases/tag/v3.5.9-k3s1",children:"v3.5.9-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/containerd/releases/tag/v1.7.11-k3s2",children:"v1.7.11-k3s2"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/runc/releases/tag/v1.1.12-k3s1",children:"v1.1.12-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/flannel-io/flannel/releases/tag/v0.24.2",children:"v0.24.2"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.6.3",children:"v0.6.3"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/traefik/traefik/releases/tag/v2.10.5",children:"v2.10.5"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/coredns/coredns/releases/tag/v1.10.1",children:"v1.10.1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/helm-controller/releases/tag/v0.15.8",children:"v0.15.8"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/rancher/local-path-provisioner/releases/tag/v0.0.26",children:"v0.0.26"})})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"/release-notes/v1.28.X#release-v1286k3s2",children:"v1.28.6+k3s2"})}),(0,r.jsx)(s.td,{children:"Feb 06 2024"}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.28.md#v1286",children:"v1.28.6"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/kine/releases/tag/v0.11.0",children:"v0.11.0"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://sqlite.org/releaselog/3_42_0.html",children:"3.42.0"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/etcd/releases/tag/v3.5.9-k3s1",children:"v3.5.9-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/containerd/releases/tag/v1.7.11-k3s2",children:"v1.7.11-k3s2"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/opencontainers/runc/releases/tag/v1.1.12-k3s1",children:"v1.1.12-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/flannel-io/flannel/releases/tag/v0.22.2",children:"v0.22.2"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.6.3",children:"v0.6.3"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/traefik/traefik/releases/tag/v2.10.5",children:"v2.10.5"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/coredns/coredns/releases/tag/v1.10.1",children:"v1.10.1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/helm-controller/releases/tag/v0.15.8",children:"v0.15.8"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/rancher/local-path-provisioner/releases/tag/v0.0.24",children:"v0.0.24"})})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"/release-notes/v1.28.X#release-v1285k3s1",children:"v1.28.5+k3s1"})}),(0,r.jsx)(s.td,{children:"Dec 27 2023"}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.28.md#v1285",children:"v1.28.5"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/kine/releases/tag/v0.11.0",children:"v0.11.0"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://sqlite.org/releaselog/3_42_0.html",children:"3.42.0"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/etcd/releases/tag/v3.5.9-k3s1",children:"v3.5.9-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/containerd/releases/tag/v1.7.11-k3s2",children:"v1.7.11-k3s2"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/opencontainers/runc/releases/tag/v1.1.10",children:"v1.1.10"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/flannel-io/flannel/releases/tag/v0.22.2",children:"v0.22.2"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.6.3",children:"v0.6.3"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/traefik/traefik/releases/tag/v2.10.5",children:"v2.10.5"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/coredns/coredns/releases/tag/v1.10.1",children:"v1.10.1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/helm-controller/releases/tag/v0.15.4",children:"v0.15.4"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/rancher/local-path-provisioner/releases/tag/v0.0.24",children:"v0.0.24"})})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"/release-notes/v1.28.X#release-v1284k3s2",children:"v1.28.4+k3s2"})}),(0,r.jsx)(s.td,{children:"Dec 06 2023"}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.28.md#v1284",children:"v1.28.4"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/kine/releases/tag/v0.11.0",children:"v0.11.0"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://sqlite.org/releaselog/3_42_0.html",children:"3.42.0"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/etcd/releases/tag/v3.5.9-k3s1",children:"v3.5.9-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/containerd/releases/tag/v1.7.7-k3s1",children:"v1.7.7-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/opencontainers/runc/releases/tag/v1.1.8",children:"v1.1.8"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/flannel-io/flannel/releases/tag/v0.22.2",children:"v0.22.2"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.6.3",children:"v0.6.3"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/traefik/traefik/releases/tag/v2.10.5",children:"v2.10.5"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/coredns/coredns/releases/tag/v1.10.1",children:"v1.10.1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/helm-controller/releases/tag/v0.15.4",children:"v0.15.4"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/rancher/local-path-provisioner/releases/tag/v0.0.24",children:"v0.0.24"})})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"/release-notes/v1.28.X#release-v1283k3s2",children:"v1.28.3+k3s2"})}),(0,r.jsx)(s.td,{children:"Nov 08 2023"}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.28.md#v1283",children:"v1.28.3"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/kine/releases/tag/v0.10.3",children:"v0.10.3"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://sqlite.org/releaselog/3_42_0.html",children:"3.42.0"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/etcd/releases/tag/v3.5.9-k3s1",children:"v3.5.9-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/containerd/releases/tag/v1.7.7-k3s1",children:"v1.7.7-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/opencontainers/runc/releases/tag/v1.1.8",children:"v1.1.8"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/flannel-io/flannel/releases/tag/v0.22.2",children:"v0.22.2"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.6.3",children:"v0.6.3"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/traefik/traefik/releases/tag/v2.10.5",children:"v2.10.5"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/coredns/coredns/releases/tag/v1.10.1",children:"v1.10.1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/helm-controller/releases/tag/v0.15.4",children:"v0.15.4"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/rancher/local-path-provisioner/releases/tag/v0.0.24",children:"v0.0.24"})})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"/release-notes/v1.28.X#release-v1283k3s1",children:"v1.28.3+k3s1"})}),(0,r.jsx)(s.td,{children:"Oct 30 2023"}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.28.md#v1283",children:"v1.28.3"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/kine/releases/tag/v0.10.3",children:"v0.10.3"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://sqlite.org/releaselog/3_42_0.html",children:"3.42.0"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/etcd/releases/tag/v3.5.9-k3s1",children:"v3.5.9-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/containerd/releases/tag/v1.7.7-k3s1",children:"v1.7.7-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/opencontainers/runc/releases/tag/v1.1.8",children:"v1.1.8"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/flannel-io/flannel/releases/tag/v0.22.2",children:"v0.22.2"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.6.3",children:"v0.6.3"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/traefik/traefik/releases/tag/v2.10.5",children:"v2.10.5"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/coredns/coredns/releases/tag/v1.10.1",children:"v1.10.1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/helm-controller/releases/tag/v0.15.4",children:"v0.15.4"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/rancher/local-path-provisioner/releases/tag/v0.0.24",children:"v0.0.24"})})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"/release-notes/v1.28.X#release-v1282k3s1",children:"v1.28.2+k3s1"})}),(0,r.jsx)(s.td,{children:"Sep 20 2023"}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.28.md#v1282",children:"v1.28.2"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/kine/releases/tag/v0.10.3",children:"v0.10.3"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://sqlite.org/releaselog/3_42_0.html",children:"3.42.0"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/etcd/releases/tag/v3.5.9-k3s1",children:"v3.5.9-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/containerd/releases/tag/v1.7.6-k3s1",children:"v1.7.6-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/opencontainers/runc/releases/tag/v1.1.8",children:"v1.1.8"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/flannel-io/flannel/releases/tag/v0.22.2",children:"v0.22.2"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.6.3",children:"v0.6.3"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/traefik/traefik/releases/tag/v2.9.10",children:"v2.9.10"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/coredns/coredns/releases/tag/v1.10.1",children:"v1.10.1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/helm-controller/releases/tag/v0.15.4",children:"v0.15.4"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/rancher/local-path-provisioner/releases/tag/v0.0.24",children:"v0.0.24"})})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"/release-notes/v1.28.X#release-v1281k3s1",children:"v1.28.1+k3s1"})}),(0,r.jsx)(s.td,{children:"Sep 08 2023"}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.28.md#v1281",children:"v1.28.1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/kine/releases/tag/v0.10.3",children:"v0.10.3"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://sqlite.org/releaselog/3_42_0.html",children:"3.42.0"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/etcd/releases/tag/v3.5.9-k3s1",children:"v3.5.9-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/containerd/releases/tag/v1.7.3-k3s2",children:"v1.7.3-k3s2"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/opencontainers/runc/releases/tag/v1.1.8",children:"v1.1.8"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/flannel-io/flannel/releases/tag/v0.22.2",children:"v0.22.2"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.6.3",children:"v0.6.3"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/traefik/traefik/releases/tag/v2.9.10",children:"v2.9.10"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/coredns/coredns/releases/tag/v1.10.1",children:"v1.10.1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/helm-controller/releases/tag/v0.15.4",children:"v0.15.4"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/rancher/local-path-provisioner/releases/tag/v0.0.24",children:"v0.0.24"})})]})]})]}),"\n",(0,r.jsx)("br",{}),"\n",(0,r.jsxs)(s.h2,{id:"release-v12812k3s1",children:["Release ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/releases/tag/v1.28.12+k3s1",children:"v1.28.12+k3s1"})]}),"\n",(0,r.jsx)(s.p,{children:"This release updates Kubernetes to v1.28.12, and fixes a number of issues."}),"\n",(0,r.jsxs)(s.p,{children:["For more details on what's new, see the ",(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.28.md#changelog-since-v12811",children:"Kubernetes release notes"}),"."]}),"\n",(0,r.jsx)(s.h3,{id:"changes-since-v12811k3s2",children:"Changes since v1.28.11+k3s2:"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsxs)(s.li,{children:["Backports for 2024-07 release cycle ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10499",children:"(#10499)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:"Bump k3s-root to v0.14.0"}),"\n",(0,r.jsx)(s.li,{children:"Bump github.com/hashicorp/go-retryablehttp from 0.7.4 to 0.7.7"}),"\n",(0,r.jsx)(s.li,{children:"Bump Local Path Provisioner version"}),"\n",(0,r.jsx)(s.li,{children:"Ensure remotedialer kubelet connections use kubelet bind address"}),"\n",(0,r.jsx)(s.li,{children:"Chore: Bump Trivy version"}),"\n",(0,r.jsx)(s.li,{children:"Add etcd s3 config secret implementation"}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["July Test Backports ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10509",children:"(#10509)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Update to v1.28.12-k3s1 and Go 1.22.5 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10541",children:"(#10541)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Fix issues loading data-dir value from env vars or dropping config files ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10598",children:"(#10598)"})]}),"\n"]}),"\n",(0,r.jsx)(s.hr,{}),"\n",(0,r.jsxs)(s.h2,{id:"release-v12811k3s2",children:["Release ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/releases/tag/v1.28.11+k3s2",children:"v1.28.11+k3s2"})]}),"\n",(0,r.jsx)(s.p,{children:"This release updates Kubernetes to v1.28.11, and fixes a number of issues."}),"\n",(0,r.jsxs)(s.p,{children:["For more details on what's new, see the ",(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.28.md#changelog-since-v12811",children:"Kubernetes release notes"}),"."]}),"\n",(0,r.jsx)(s.h3,{id:"changes-since-v12811k3s1",children:"Changes since v1.28.11+k3s1:"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsxs)(s.li,{children:["Update flannel to v0.25.4 and fixed issue with IPv6 mask ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10428",children:"(#10428)"})]}),"\n"]}),"\n",(0,r.jsx)(s.hr,{}),"\n",(0,r.jsxs)(s.h2,{id:"release-v12811k3s1",children:["Release ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/releases/tag/v1.28.11+k3s1",children:"v1.28.11+k3s1"})]}),"\n",(0,r.jsx)(s.p,{children:"This release updates Kubernetes to v1.28.11, and fixes a number of issues."}),"\n",(0,r.jsxs)(s.p,{children:["For more details on what's new, see the ",(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.28.md#changelog-since-v12810",children:"Kubernetes release notes"}),"."]}),"\n",(0,r.jsx)(s.h3,{id:"changes-since-v12810k3s1",children:"Changes since v1.28.10+k3s1:"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsxs)(s.li,{children:["Replace deprecated ruby function ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10090",children:"(#10090)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Fix bug when using tailscale config by file ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10144",children:"(#10144)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Bump flannel version to v0.25.2 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10221",children:"(#10221)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Update kube-router version to v2.1.2 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10182",children:"(#10182)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Improve tailscale test & add extra log in e2e tests ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10213",children:"(#10213)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Backports for 2024-06 release cycle ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10258",children:"(#10258)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:"Add WithSkipMissing to not fail import on missing blobs"}),"\n",(0,r.jsx)(s.li,{children:"Use fixed stream server bind address for cri-dockerd"}),"\n",(0,r.jsx)(s.li,{children:"Switch stargz over to cri registry config_path"}),"\n",(0,r.jsx)(s.li,{children:"Bump to containerd v1.7.17, etcd v3.5.13"}),"\n",(0,r.jsx)(s.li,{children:"Bump spegel version"}),"\n",(0,r.jsx)(s.li,{children:"Fix issue with externalTrafficPolicy: Local for single-stack services on dual-stack nodes"}),"\n",(0,r.jsxs)(s.li,{children:["ServiceLB now sets the priorityClassName on svclb pods to ",(0,r.jsx)(s.code,{children:"system-node-critical"})," by default. This can be overridden on a per-service basis via the ",(0,r.jsx)(s.code,{children:"svccontroller.k3s.cattle.io/priorityclassname"})," annotation."]}),"\n",(0,r.jsx)(s.li,{children:"Bump minio-go to v7.0.70"}),"\n",(0,r.jsx)(s.li,{children:"Bump kine to v0.11.9 to fix pagination"}),"\n",(0,r.jsx)(s.li,{children:"Update valid resolv conf"}),"\n",(0,r.jsx)(s.li,{children:"Add missing kernel config check"}),"\n",(0,r.jsx)(s.li,{children:"Symlinked sub-directories are now respected when scanning Auto-Deploying Manifests (AddOns)"}),"\n",(0,r.jsx)(s.li,{children:"Fix bug: allow helm controller set owner reference"}),"\n",(0,r.jsx)(s.li,{children:"Bump klipper-helm image for tls secret support"}),"\n",(0,r.jsx)(s.li,{children:"Fix issue with k3s-etcd informers not starting"}),"\n",(0,r.jsxs)(s.li,{children:[(0,r.jsx)(s.code,{children:"--Enable-pprof"})," can now be set on agents to enable the debug/pprof endpoints. When set, agents will listen on the supervisor port."]}),"\n",(0,r.jsxs)(s.li,{children:[(0,r.jsx)(s.code,{children:"--Supervisor-metrics"})," can now be set on servers to enable serving internal metrics on the supervisor endpoint; when set agents will listen on the supervisor port."]}),"\n",(0,r.jsx)(s.li,{children:"Fix netpol crash when node remains tainted uninitialized"}),"\n",(0,r.jsx)(s.li,{children:"The embedded load-balancer will now fall back to trying all servers with health-checks ignored, if all servers have been marked unavailable due to failed health checks."}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["More backports for 2024-06 release cycle ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10289",children:"(#10289)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Add snapshot retention etcd-s3-folder fix ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10315",children:"(#10315)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Add test for ",(0,r.jsx)(s.code,{children:"isValidResolvConf"})," (#10302) ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10331",children:"(#10331)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Fix race condition panic in loadbalancer.nextServer ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10323",children:"(#10323)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Fix typo, use ",(0,r.jsx)(s.code,{children:"rancher/permissions"})," ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10299",children:"(#10299)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Update Kubernetes to v1.28.11 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10347",children:"(#10347)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Fix agent supervisor port using apiserver port instead ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10355",children:"(#10355)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Fix issue that allowed multiple simultaneous snapshots to be allowed ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10377",children:"(#10377)"})]}),"\n"]}),"\n",(0,r.jsx)(s.hr,{}),"\n",(0,r.jsxs)(s.h2,{id:"release-v12810k3s1",children:["Release ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/releases/tag/v1.28.10+k3s1",children:"v1.28.10+k3s1"})]}),"\n",(0,r.jsx)(s.p,{children:"This release updates Kubernetes to v1.28.10, and fixes a number of issues."}),"\n",(0,r.jsxs)(s.p,{children:["For more details on what's new, see the ",(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.28.md#changelog-since-v1289",children:"Kubernetes release notes"}),"."]}),"\n",(0,r.jsx)(s.h3,{id:"changes-since-v1289k3s1",children:"Changes since v1.28.9+k3s1:"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsxs)(s.li,{children:["Bump E2E opensuse leap to 15.6, fix btrfs test ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10095",children:"(#10095)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Windows changes ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10114",children:"(#10114)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Update to v1.28.10-k3s1 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10098",children:"(#10098)"})]}),"\n"]}),"\n",(0,r.jsx)(s.hr,{}),"\n",(0,r.jsxs)(s.h2,{id:"release-v1289k3s1",children:["Release ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/releases/tag/v1.28.9+k3s1",children:"v1.28.9+k3s1"})]}),"\n",(0,r.jsx)(s.p,{children:"This release updates Kubernetes to v1.28.9, and fixes a number of issues."}),"\n",(0,r.jsxs)(s.p,{children:["For more details on what's new, see the ",(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.28.md#changelog-since-v1288",children:"Kubernetes release notes"}),"."]}),"\n",(0,r.jsx)(s.h3,{id:"changes-since-v1288k3s1",children:"Changes since v1.28.8+k3s1:"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsxs)(s.li,{children:["Add a new error when kine is with disable apiserver or disable etcd ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9804",children:"(#9804)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Remove old pinned dependencies ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9827",children:"(#9827)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Transition from deprecated pointer library to ptr ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9824",children:"(#9824)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Golang caching and E2E ubuntu 23.10 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9821",children:"(#9821)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Add tls for kine ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9849",children:"(#9849)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Bump spegel to v0.0.20-k3s1 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9880",children:"(#9880)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Backports for 2024-04 release cycle ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9911",children:"(#9911)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:"Send error response if member list cannot be retrieved"}),"\n",(0,r.jsx)(s.li,{children:"The k3s stub cloud provider now respects the kubelet's requested provider-id, instance type, and topology labels"}),"\n",(0,r.jsx)(s.li,{children:"Fix error when image has already been pulled"}),"\n",(0,r.jsx)(s.li,{children:"Add /etc/passwd and /etc/group to k3s docker image"}),"\n",(0,r.jsx)(s.li,{children:"Fix etcd snapshot reconcile for agentless servers"}),"\n",(0,r.jsx)(s.li,{children:"Add health-check support to loadbalancer"}),"\n",(0,r.jsx)(s.li,{children:"Add certificate expiry check, events, and metrics"}),"\n",(0,r.jsx)(s.li,{children:"Add workaround for containerd hosts.toml bug when passing config for default registry endpoint"}),"\n",(0,r.jsx)(s.li,{children:"Add supervisor cert/key to rotate list"}),"\n",(0,r.jsx)(s.li,{children:"The embedded containerd has been bumped to v1.7.15"}),"\n",(0,r.jsx)(s.li,{children:"The embedded cri-dockerd has been bumped to v0.3.12"}),"\n",(0,r.jsxs)(s.li,{children:["The ",(0,r.jsx)(s.code,{children:"k3s etcd-snapshot"})," command has been reworked for improved consistency. All snapshots operations are now performed by the server process, with the CLI acting as a client to initiate and report results. As a side effect, the CLI is now less noisy when managing snapshots."]}),"\n",(0,r.jsx)(s.li,{children:"Improve etcd load-balancer startup behavior"}),"\n",(0,r.jsx)(s.li,{children:"Actually fix agent certificate rotation"}),"\n",(0,r.jsx)(s.li,{children:"Traefik has been bumped to v2.10.7."}),"\n",(0,r.jsx)(s.li,{children:"Traefik pod annotations are now set properly in the default chart values."}),"\n",(0,r.jsx)(s.li,{children:"The system-default-registry value now supports RFC2732 IPv6 literals."}),"\n",(0,r.jsxs)(s.li,{children:["The local-path provisioner now defaults to creating ",(0,r.jsx)(s.code,{children:"local"})," volumes, instead of ",(0,r.jsx)(s.code,{children:"hostPath"}),"."]}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Allow LPP to read helper logs ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9938",children:"(#9938)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Update kube-router to v2.1.0 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9942",children:"(#9942)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Update to v1.28.9-k3s1 and Go 1.21.9 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9959",children:"(#9959)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Fix on-demand snapshots timing out; not honoring folder ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9994",children:"(#9994)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Make /db/info available anonymously from localhost ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10002",children:"(#10002)"})]}),"\n"]}),"\n",(0,r.jsx)(s.hr,{}),"\n",(0,r.jsxs)(s.h2,{id:"release-v1288k3s1",children:["Release ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/releases/tag/v1.28.8+k3s1",children:"v1.28.8+k3s1"})]}),"\n",(0,r.jsx)(s.p,{children:"This release updates Kubernetes to v1.28.8, and fixes a number of issues."}),"\n",(0,r.jsxs)(s.p,{children:["For more details on what's new, see the ",(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.28.md#changelog-since-v1287",children:"Kubernetes release notes"}),"."]}),"\n",(0,r.jsx)(s.h3,{id:"changes-since-v1287k3s1",children:"Changes since v1.28.7+k3s1:"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsxs)(s.li,{children:["Add an integration test for flannel-backend=none ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9608",children:"(#9608)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Install and Unit test backports ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9641",children:"(#9641)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Update klipper-lb image version ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9605",children:"(#9605)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Chore(deps): Remediating CVE-2023-45142 CVE-2023-48795 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9647",children:"(#9647)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Adjust first node-ip based on configured clusterCIDR ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9631",children:"(#9631)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Improve tailscale e2e test ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9653",children:"(#9653)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Backports for 2024-03 release cycle ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9669",children:"(#9669)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:"Fix: use correct wasm shims names"}),"\n",(0,r.jsx)(s.li,{children:"The embedded flannel cni-plugin binary is now built and versioned separate from the rest of the cni plugins and the embedded flannel controller."}),"\n",(0,r.jsx)(s.li,{children:"Bump spegel to v0.0.18-k3s3"}),"\n",(0,r.jsx)(s.li,{children:"Adds wildcard registry support"}),"\n",(0,r.jsx)(s.li,{children:"Fixes issue with excessive CPU utilization while waiting for containerd to start"}),"\n",(0,r.jsx)(s.li,{children:"Add env var to allow spegel mirroring of latest tag"}),"\n",(0,r.jsx)(s.li,{children:"Tweak netpol node wait logs"}),"\n",(0,r.jsx)(s.li,{children:"Fix coredns NodeHosts on dual-stack clusters"}),"\n",(0,r.jsx)(s.li,{children:"Bump helm-controller/klipper-helm versions"}),"\n",(0,r.jsx)(s.li,{children:"Fix snapshot prune"}),"\n",(0,r.jsx)(s.li,{children:"Fix issue with etcd node name missing hostname"}),"\n",(0,r.jsx)(s.li,{children:"Rootless mode should also bind service nodePort to host for LoadBalancer type, matching UX of rootful mode."}),"\n",(0,r.jsxs)(s.li,{children:["To enable raw output for the ",(0,r.jsx)(s.code,{children:"check-config"})," subcommand, you may now set NO_COLOR=1"]}),"\n",(0,r.jsx)(s.li,{children:"Fix additional corner cases in registries handling"}),"\n",(0,r.jsx)(s.li,{children:"Bump metrics-server to v0.7.0"}),"\n",(0,r.jsx)(s.li,{children:"K3s will now warn and suppress duplicate entries in the mirror endpoint list for a registry. Containerd does not support listing the same endpoint multiple times as a mirror for a single upstream registry."}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Docker and E2E Test Backports ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9707",children:"(#9707)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Fix wildcard entry upstream fallback ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9733",children:"(#9733)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Update to v1.28.8-k3s1 and Go 1.21.8 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9746",children:"(#9746)"})]}),"\n"]}),"\n",(0,r.jsx)(s.hr,{}),"\n",(0,r.jsxs)(s.h2,{id:"release-v1287k3s1",children:["Release ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/releases/tag/v1.28.7+k3s1",children:"v1.28.7+k3s1"})]}),"\n",(0,r.jsx)(s.p,{children:"This release updates Kubernetes to v1.28.7, and fixes a number of issues."}),"\n",(0,r.jsxs)(s.p,{children:["For more details on what's new, see the ",(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.28.md#changelog-since-v1286",children:"Kubernetes release notes"}),"."]}),"\n",(0,r.jsx)(s.h3,{id:"changes-since-v1286k3s2",children:"Changes since v1.28.6+k3s2:"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsxs)(s.li,{children:["Chore: bump Local Path Provisioner version ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9426",children:"(#9426)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Bump cri-dockerd to fix compat with Docker Engine 25 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9293",children:"(#9293)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Auto Dependency Bump ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9419",children:"(#9419)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Runtimes refactor using exec.LookPath ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9431",children:"(#9431)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:"Directories containing runtimes need to be included in the $PATH environment variable for effective runtime detection."}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Changed how lastHeartBeatTime works in the etcd condition ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9424",children:"(#9424)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Bump Flannel v0.24.2 + remove multiclustercidr ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9401",children:"(#9401)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Allow executors to define containerd and docker behavior ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9254",children:"(#9254)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Update Kube-router to v2.0.1 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9404",children:"(#9404)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Backports for 2024-02 release cycle ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9462",children:"(#9462)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Enable longer http timeout requests ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9444",children:"(#9444)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Test_UnitApplyContainerdQoSClassConfigFileIfPresent ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9440",children:"(#9440)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Support PR testing installs ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9469",children:"(#9469)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Update Kubernetes to v1.28.7 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9492",children:"(#9492)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Fix drone publish for arm ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9508",children:"(#9508)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Remove failing Drone step ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9516",children:"(#9516)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Restore original order of agent startup functions ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9545",children:"(#9545)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Fix netpol startup when flannel is disabled ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9578",children:"(#9578)"})]}),"\n"]}),"\n",(0,r.jsx)(s.hr,{}),"\n",(0,r.jsxs)(s.h2,{id:"release-v1286k3s2",children:["Release ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/releases/tag/v1.28.6+k3s2",children:"v1.28.6+k3s2"})]}),"\n",(0,r.jsx)(s.p,{children:"This release updates Kubernetes to v1.28.6, and fixes a number of issues."}),"\n",(0,r.jsxs)(s.p,{children:["For more details on what's new, see the ",(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.28.md#changelog-since-v1285",children:"Kubernetes release notes"}),"."]}),"\n",(0,r.jsx)(s.p,{children:(0,r.jsx)(s.strong,{children:"Important Notes"})}),"\n",(0,r.jsxs)(s.p,{children:["Addresses the runc CVE: ",(0,r.jsx)(s.a,{href:"https://nvd.nist.gov/vuln/detail/CVE-2024-21626",children:"CVE-2024-21626"})," by updating runc to v1.1.12."]}),"\n",(0,r.jsx)(s.h3,{id:"changes-since-v1285k3s1",children:"Changes since v1.28.5+k3s1:"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsxs)(s.li,{children:["Add a retry around updating a secrets-encrypt node annotations ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9125",children:"(#9125)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Wait for taint to be gone in the node before starting the netpol controller ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9175",children:"(#9175)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Etcd condition ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9181",children:"(#9181)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Backports for 2024-01 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9203",children:"(#9203)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Pin opa version for missing dependency chain ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9216",children:"(#9216)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Added support for env *_PROXY variables for agent loadbalancer ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9206",children:"(#9206)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Etcd node is nil ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9228",children:"(#9228)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Update to v1.28.6 and Go 1.20.13 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9260",children:"(#9260)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Use ",(0,r.jsx)(s.code,{children:"ipFamilyPolicy: RequireDualStack"})," for dual-stack kube-dns ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9269",children:"(#9269)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Backports for 2024-01 k3s2 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9336",children:"(#9336)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:"Bump runc to v1.1.12 and helm-controller to v0.15.7"}),"\n",(0,r.jsx)(s.li,{children:"Fix handling of bare hostname or IP as endpoint address in registries.yaml"}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Bump helm-controller to fix issue with ChartContent ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9346",children:"(#9346)"})]}),"\n"]}),"\n",(0,r.jsx)(s.hr,{}),"\n",(0,r.jsxs)(s.h2,{id:"release-v1285k3s1",children:["Release ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/releases/tag/v1.28.5+k3s1",children:"v1.28.5+k3s1"})]}),"\n",(0,r.jsx)(s.p,{children:"This release updates Kubernetes to v1.28.5, and fixes a number of issues."}),"\n",(0,r.jsxs)(s.p,{children:["For more details on what's new, see the ",(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.28.md#changelog-since-v1284",children:"Kubernetes release notes"}),"."]}),"\n",(0,r.jsx)(s.h3,{id:"changes-since-v1284k3s1",children:"Changes since v1.28.4+k3s1:"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsxs)(s.li,{children:["Remove s390x steps temporarily since runners are disabled ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8983",children:"(#8983)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Remove s390x from manifest ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8998",children:"(#8998)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Fix overlapping address range ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8913",children:"(#8913)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Modify CONTRIBUTING.md guide ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8954",children:"(#8954)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Nov 2023 stable channel update ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9022",children:"(#9022)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Default runtime and runtime classes for wasm/nvidia/crun ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8936",children:"(#8936)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:"Added runtime classes for wasm/nvidia/crun"}),"\n",(0,r.jsx)(s.li,{children:"Added default runtime flag for containerd"}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Bump containerd/runc to v1.7.10-k3s1/v1.1.10 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8962",children:"(#8962)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Allow setting default-runtime on servers ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9027",children:"(#9027)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Bump containerd to v1.7.11 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9040",children:"(#9040)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Update to v1.28.5-k3s1 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9081",children:"(#9081)"})]}),"\n"]}),"\n",(0,r.jsx)(s.hr,{}),"\n",(0,r.jsxs)(s.h2,{id:"release-v1284k3s2",children:["Release ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/releases/tag/v1.28.4+k3s2",children:"v1.28.4+k3s2"})]}),"\n",(0,r.jsx)(s.p,{children:"This release updates Kubernetes to v1.28.4, and fixes a number of issues."}),"\n",(0,r.jsxs)(s.p,{children:["For more details on what's new, see the ",(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.28.md#changelog-since-v1283",children:"Kubernetes release notes"}),"."]}),"\n",(0,r.jsx)(s.h3,{id:"changes-since-v1283k3s2",children:"Changes since v1.28.3+k3s2:"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsxs)(s.li,{children:["Update channels latest to v1.27.7+k3s2 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8799",children:"(#8799)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Add etcd status condition ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8724",children:"(#8724)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:"Now the user can see the etcd status from each node in a simple way"}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["ADR for etcd status ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8355",children:"(#8355)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Wasm shims detection ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8751",children:"(#8751)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:"Automatic discovery of WebAssembly runtimes"}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Add warning for removal of multiclustercidr flag ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8758",children:"(#8758)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Improve dualStack log ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8798",children:"(#8798)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Optimize: Simplify and clean up Dockerfile ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8244",children:"(#8244)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Add: timezone info in image ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8764",children:"(#8764)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsxs)(s.li,{children:["\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsxs)(s.li,{children:["New timezone info in Docker image allows the use of ",(0,r.jsx)(s.code,{children:"spec.timeZone"})," in CronJobs"]}),"\n"]}),"\n"]}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Bump kine to fix nats, postgres, and watch issues ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8778",children:"(#8778)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:"Bumped kine to v0.11.0 to resolve issues with postgres and NATS, fix performance of watch channels under heavy load, and improve compatibility with the reference implementation."}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["QoS-class resource configuration ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8726",children:"(#8726)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsxs)(s.li,{children:["Containerd may now be configured to use rdt or blockio configuration by defining ",(0,r.jsx)(s.code,{children:"rdt_config.yaml"})," or ",(0,r.jsx)(s.code,{children:"blockio_config.yaml"})," files."]}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Add agent flag disable-apiserver-lb ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8717",children:"(#8717)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:"Add agent flag disable-apiserver-lb, agent will not start load balance proxy."}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Force umount for NFS mount (like with longhorn) ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8521",children:"(#8521)"})]}),"\n",(0,r.jsxs)(s.li,{children:["General updates to README ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8786",children:"(#8786)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Fix wrong warning from restorecon in install script ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8871",children:"(#8871)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Fix issue with snapshot metadata configmap ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8835",children:"(#8835)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:"Omit snapshot list configmap entries for snapshots without extra metadata"}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Skip initial datastore reconcile during cluster-reset ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8861",children:"(#8861)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Tweaked order of ingress IPs in ServiceLB ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8711",children:"(#8711)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:"Improved ingress IP ordering from ServiceLB"}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Disable helm CRD installation for disable-helm-controller ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8702",children:"(#8702)"})]}),"\n",(0,r.jsxs)(s.li,{children:["More improves for K3s patch release docs ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8800",children:"(#8800)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Update install.sh sha256sum ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8885",children:"(#8885)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Add jitter to client config retry to avoid hammering servers when they are starting up ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8863",children:"(#8863)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Handle nil pointer when runtime core is not ready in etcd ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8886",children:"(#8886)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Bump dynamiclistener; reduce snapshot controller log spew ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8894",children:"(#8894)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:"Bumped dynamiclistener to address a race condition that could cause a server to fail to sync its certificates into the Kubernetes secret"}),"\n",(0,r.jsx)(s.li,{children:"Reduced etcd snapshot log spam during initial cluster startup"}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Remove depends_on for e2e step; fix cert rotate e2e ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8906",children:"(#8906)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Fix etcd snapshot S3 issues ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8926",children:"(#8926)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:"Don't apply S3 retention if S3 client failed to initialize"}),"\n",(0,r.jsx)(s.li,{children:"Don't request metadata when listing S3 snapshots"}),"\n",(0,r.jsx)(s.li,{children:"Print key instead of file path in snapshot metadata log message"}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Update to v1.28.4 and Go to v1.20.11 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8920",children:"(#8920)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Remove s390x steps temporarily since runners are disabled ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8983",children:"(#8983)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Remove s390x from manifest ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8998",children:"(#8998)"})]}),"\n"]}),"\n",(0,r.jsx)(s.hr,{}),"\n",(0,r.jsxs)(s.h2,{id:"release-v1283k3s2",children:["Release ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/releases/tag/v1.28.3+k3s2",children:"v1.28.3+k3s2"})]}),"\n",(0,r.jsx)(s.p,{children:"This release updates Kubernetes to v1.28.3, and fixes a number of issues."}),"\n",(0,r.jsxs)(s.p,{children:["For more details on what's new, see the ",(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.28.md#changelog-since-v1283",children:"Kubernetes release notes"}),"."]}),"\n",(0,r.jsx)(s.h3,{id:"changes-since-v1283k3s1",children:"Changes since v1.28.3+k3s1:"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsxs)(s.li,{children:["Restore selinux context systemd unit file ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8593",children:"(#8593)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Update channel to v1.27.7+k3s1 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8753",children:"(#8753)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Bump Sonobuoy version ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8710",children:"(#8710)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Bump Trivy version ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8739",children:"(#8739)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Fix: Access outer scope .SystemdCgroup ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8761",children:"(#8761)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:"Fixed failing to start with nvidia-container-runtime"}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Upgrade traefik chart to v25.0.0 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8771",children:"(#8771)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Update traefik to fix registry value ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8792",children:"(#8792)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Don't use iptables-save/iptables-restore if it will corrupt rules ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8795",children:"(#8795)"})]}),"\n"]}),"\n",(0,r.jsx)(s.hr,{}),"\n",(0,r.jsxs)(s.h2,{id:"release-v1283k3s1",children:["Release ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/releases/tag/v1.28.3+k3s1",children:"v1.28.3+k3s1"})]}),"\n",(0,r.jsx)(s.p,{children:"This release updates Kubernetes to v1.28.3, and fixes a number of issues."}),"\n",(0,r.jsxs)(s.p,{children:["For more details on what's new, see the ",(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.28.md#changelog-since-v1282",children:"Kubernetes release notes"}),"."]}),"\n",(0,r.jsx)(s.h3,{id:"changes-since-v1282k3s1",children:"Changes since v1.28.2+k3s1:"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsxs)(s.li,{children:["Fix error reporting ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8250",children:"(#8250)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Add context to flannel errors ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8284",children:"(#8284)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Update channel, September patch release ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8397",children:"(#8397)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Add missing link to drone in documentation ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8295",children:"(#8295)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Include the interface name in the error message ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8346",children:"(#8346)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Add extraArgs to vpn provider ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8354",children:"(#8354)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:"Allow to pass extra args to the vpn provider"}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Disable HTTP on main etcd client port ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8402",children:"(#8402)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsxs)(s.li,{children:["Embedded etcd no longer serves http requests on the client port, only grpc. This addresses a performance issue that could cause watch stream starvation under load. For more information, see ",(0,r.jsx)(s.a,{href:"https://github.com/etcd-io/etcd/issues/15402",children:"https://github.com/etcd-io/etcd/issues/15402"})]}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Server token rotation ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8215",children:"(#8215)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Fix issues with etcd member removal after reset ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8392",children:"(#8392)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:"Fixed an issue that could cause k3s to attempt to remove members from the etcd cluster immediately following a cluster-reset/restore, if they were queued for removal at the time the snapshot was taken."}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Fix gofmt error ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8439",children:"(#8439)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Added advertise address integration test ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8344",children:"(#8344)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Added cluster reset from non bootstrap nodes on snapshot restore e2e test ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8292",children:"(#8292)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Fix .github regex to skip drone runs on gh action bumps ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8433",children:"(#8433)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Added error when cluster reset while using server flag ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8385",children:"(#8385)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:"The user will receive a error when --cluster-reset with the --server flag"}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Update kube-router ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8423",children:"(#8423)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:"Update kube-router to v2.0.0-rc7 to fix performance issues"}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Add SHA256 signatures of the install script ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8312",children:"(#8312)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsxs)(s.li,{children:["\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:"Add SHA256 signatures of the install script."}),"\n"]}),"\n"]}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Add --image-service-endpoint flag ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8279",children:"(#8279)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsxs)(s.li,{children:["Add ",(0,r.jsx)(s.code,{children:"--image-service-endpoint"})," flag to specify an external image service socket."]}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Don't ignore assets in home dir if system assets exist ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8458",children:"(#8458)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Pass SystemdCgroup setting through to nvidia runtime options ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8470",children:"(#8470)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:"Fixed issue that would cause pods using nvidia container runtime to be killed after a few seconds, when using newer versions of nvidia-container-toolkit."}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Improve release docs - updated ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8414",children:"(#8414)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Take IPFamily precedence based on order ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8460",children:"(#8460)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Fix spellcheck problem ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8507",children:"(#8507)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Network defaults are duplicated, remove one ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8523",children:"(#8523)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Fix slemicro check for selinux ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8526",children:"(#8526)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Update install.sh.sha256sum ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8566",children:"(#8566)"})]}),"\n",(0,r.jsxs)(s.li,{children:["System agent push tags fix ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8568",children:"(#8568)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Fixed tailscale node IP dualstack mode in case of IPv4 only node ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8524",children:"(#8524)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Server Token Rotation ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8265",children:"(#8265)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsxs)(s.li,{children:["Users can now rotate the server token using ",(0,r.jsx)(s.code,{children:"k3s token rotate -t --new-token "}),". After command succeeds, all server nodes must be restarted with the new token."]}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["E2E Domain Drone Cleanup ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8579",children:"(#8579)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Bump containerd to v1.7.7-k3s1 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8604",children:"(#8604)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Bump busybox to v1.36.1 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8602",children:"(#8602)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Migrate to using custom resource to store etcd snapshot metadata ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8064",children:"(#8064)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Switch build target from main.go to a package. ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8342",children:"(#8342)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Use IPv6 in case is the first configured IP with dualstack ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8581",children:"(#8581)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Bump traefik, golang.org/x/net, google.golang.org/grpc ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8624",children:"(#8624)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Update kube-router package in build script ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8630",children:"(#8630)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Add etcd-only/control-plane-only server test and fix control-plane-only server crash ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8638",children:"(#8638)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Use ",(0,r.jsx)(s.code,{children:"version.Program"})," not K3s in token rotate logs ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8653",children:"(#8653)"})]}),"\n",(0,r.jsxs)(s.li,{children:["[Windows Port ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7259",children:"(#7259)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Fix CloudDualStackNodeIPs feature-gate inconsistency ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8667",children:"(#8667)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Re-enable etcd endpoint auto-sync ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8675",children:"(#8675)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Manually requeue configmap reconcile when no nodes have reconciled snapshots ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8683",children:"(#8683)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Update to v1.28.3 and Go to v1.20.10 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8682",children:"(#8682)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Fix s3 snapshot restore ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8729",children:"(#8729)"})]}),"\n"]}),"\n",(0,r.jsx)(s.hr,{}),"\n",(0,r.jsxs)(s.h2,{id:"release-v1282k3s1",children:["Release ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/releases/tag/v1.28.2+k3s1",children:"v1.28.2+k3s1"})]}),"\n",(0,r.jsx)(s.p,{children:"This release updates Kubernetes to v1.28.2, and fixes a number of issues."}),"\n",(0,r.jsxs)(s.p,{children:["For more details on what's new, see the ",(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.28.md#changelog-since-v1281",children:"Kubernetes release notes"}),"."]}),"\n",(0,r.jsx)(s.h3,{id:"changes-since-v1281k3s1",children:"Changes since v1.28.1+k3s1:"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsxs)(s.li,{children:["Update channel for version v1.28 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8305",children:"(#8305)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Bump kine to v0.10.3 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8323",children:"(#8323)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Update to v1.28.2 and go v1.20.8 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8364",children:"(#8364)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:"Bump embedded containerd to v1.7.6"}),"\n",(0,r.jsx)(s.li,{children:"Bump embedded stargz-snapshotter plugin to latest"}),"\n",(0,r.jsx)(s.li,{children:"Fixed intermittent drone CI failures due to race conditions in test environment setup scripts"}),"\n",(0,r.jsx)(s.li,{children:"Fixed CI failures due to changes to api discovery changes in Kubernetes 1.28"}),"\n"]}),"\n"]}),"\n"]}),"\n",(0,r.jsx)(s.hr,{}),"\n",(0,r.jsxs)(s.h2,{id:"release-v1281k3s1",children:["Release ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/releases/tag/v1.28.1+k3s1",children:"v1.28.1+k3s1"})]}),"\n",(0,r.jsx)(s.p,{children:"This release is K3S's first in the v1.28 line. This release updates Kubernetes to v1.28.1."}),"\n",(0,r.jsx)(s.admonition,{title:"Important",type:"warning",children:(0,r.jsxs)(s.p,{children:["This release includes remediation for CVE-2023-32187, a potential Denial of Service attack vector on K3s servers. See ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/security/advisories/GHSA-m4hf-6vgr-75r2",children:"https://github.com/k3s-io/k3s/security/advisories/GHSA-m4hf-6vgr-75r2"})," for more information, including documentation on changes in behavior that harden clusters against this vulnerability."]})}),"\n",(0,r.jsx)(s.admonition,{title:"Critical Regression",type:"danger",children:(0,r.jsxs)(s.p,{children:["Kubernetes v1.28 contains a critical regression (",(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/issues/120247",children:"kubernetes/kubernetes#120247"}),") that causes init containers to run at the same time as app containers following a restart of the node. This issue will be fixed in v1.28.2. We do not recommend using K3s v1.28 at this time if your application depends on init containers."]})}),"\n",(0,r.jsxs)(s.p,{children:["For more details on what's new, see the ",(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.28.md#changelog-since-v1270",children:"Kubernetes release notes"}),"."]}),"\n",(0,r.jsx)(s.h3,{id:"changes-since-v1275k3s1",children:"Changes since v1.27.5+k3s1:"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsxs)(s.li,{children:["Update to v1.28.1 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8239",children:"(#8239)"})]}),"\n",(0,r.jsxs)(s.li,{children:["CLI Removal for v1.28.0 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8203",children:"(#8203)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Secrets Encryption V3 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8111",children:"(#8111)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Add new CLI flag to disable TLS SAN CN filtering ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8252",children:"(#8252)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsxs)(s.li,{children:["Added a new ",(0,r.jsx)(s.code,{children:"--tls-san-security"})," option."]}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Add RWMutex to address controller ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8268",children:"(#8268)"})]}),"\n"]}),"\n",(0,r.jsx)(s.hr,{})]})}function o(e={}){const{wrapper:s}={...(0,t.a)(),...e.components};return s?(0,r.jsx)(s,{...e,children:(0,r.jsx)(a,{...e})}):a(e)}},1151:(e,s,i)=>{i.d(s,{Z:()=>h,a:()=>l});var r=i(7294);const t={},n=r.createContext(t);function l(e){const s=r.useContext(n);return r.useMemo((function(){return"function"==typeof e?e(s):{...s,...e}}),[s,e])}function h(e){let s;return s=e.disableParentContext?"function"==typeof e.components?e.components(t):e.components||t:l(e.components),r.createElement(n.Provider,{value:s},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/36f34ab4.42c51523.js b/assets/js/36f34ab4.6a6dd1ec.js similarity index 99% rename from assets/js/36f34ab4.42c51523.js rename to assets/js/36f34ab4.6a6dd1ec.js index 0b4c7db75..7b3844812 100644 --- a/assets/js/36f34ab4.42c51523.js +++ b/assets/js/36f34ab4.6a6dd1ec.js @@ -1 +1 @@ -"use strict";(self.webpackChunkk_3_s_docs=self.webpackChunkk_3_s_docs||[]).push([[6155],{7406:(e,s,t)=>{t.r(s),t.d(s,{assets:()=>o,contentTitle:()=>c,default:()=>h,frontMatter:()=>d,metadata:()=>i,toc:()=>a});var n=t(5893),r=t(1151);const d={title:"etcd-snapshot"},c="k3s etcd-snapshot",i={id:"cli/etcd-snapshot",title:"etcd-snapshot",description:"Available as of v1.19.1+k3s1",source:"@site/docs/cli/etcd-snapshot.md",sourceDirName:"cli",slug:"/cli/etcd-snapshot",permalink:"/cli/etcd-snapshot",draft:!1,unlisted:!1,editUrl:"https://github.com/k3s-io/docs/edit/main/docs/cli/etcd-snapshot.md",tags:[],version:"current",lastUpdatedAt:1723651727e3,frontMatter:{title:"etcd-snapshot"},sidebar:"mySidebar",previous:{title:"certificate",permalink:"/cli/certificate"},next:{title:"secrets-encrypt",permalink:"/cli/secrets-encrypt"}},o={},a=[{value:"Creating Snapshots",id:"creating-snapshots",level:4},{value:"Restoring a Cluster from a Snapshot",id:"restoring-a-cluster-from-a-snapshot",level:4},{value:"Options",id:"options",level:4},{value:"S3 Compatible API Support",id:"s3-compatible-api-support",level:4},{value:"Etcd Snapshot and Restore Subcommands",id:"etcd-snapshot-and-restore-subcommands",level:4}];function l(e){const s={a:"a",admonition:"admonition",code:"code",h1:"h1",h4:"h4",header:"header",li:"li",ol:"ol",p:"p",pre:"pre",strong:"strong",table:"table",tbody:"tbody",td:"td",th:"th",thead:"thead",tr:"tr",...(0,r.a)(),...e.components},{TabItem:t,Tabs:d}=s;return t||p("TabItem",!0),d||p("Tabs",!0),(0,n.jsxs)(n.Fragment,{children:[(0,n.jsx)(s.header,{children:(0,n.jsx)(s.h1,{id:"k3s-etcd-snapshot",children:"k3s etcd-snapshot"})}),"\n",(0,n.jsx)(s.admonition,{title:"Version Gate",type:"info",children:(0,n.jsxs)(s.p,{children:["Available as of ",(0,n.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/releases/tag/v1.19.1%2Bk3s1",children:"v1.19.1+k3s1"})]})}),"\n",(0,n.jsx)(s.p,{children:"In this section, you'll learn how to create backups of the K3s embedded etcd datastore, and to restore the cluster from backup."}),"\n",(0,n.jsx)(s.h4,{id:"creating-snapshots",children:"Creating Snapshots"}),"\n",(0,n.jsxs)(s.p,{children:["Snapshots are enabled by default, at 00:00 and 12:00 system time, with 5 snapshots retained. To configure the snapshot interval or the number of retained snapshots, refer to the ",(0,n.jsx)(s.a,{href:"#options",children:"options"}),"."]}),"\n",(0,n.jsxs)(s.p,{children:["The snapshot directory defaults to ",(0,n.jsx)(s.code,{children:"${data-dir}/server/db/snapshots"}),". The data-dir value defaults to ",(0,n.jsx)(s.code,{children:"/var/lib/rancher/k3s"})," and can be changed by setting the ",(0,n.jsx)(s.code,{children:"--data-dir"})," flag."]}),"\n",(0,n.jsx)(s.h4,{id:"restoring-a-cluster-from-a-snapshot",children:"Restoring a Cluster from a Snapshot"}),"\n",(0,n.jsxs)(s.p,{children:["When K3s is restored from backup, the old data directory will be moved to ",(0,n.jsx)(s.code,{children:"${data-dir}/server/db/etcd-old/"}),". Then K3s will attempt to restore the snapshot by creating a new data directory, then starting etcd with a new K3s cluster with one etcd member."]}),"\n",(0,n.jsx)(s.p,{children:"To restore the cluster from backup:"}),"\n",(0,n.jsxs)(d,{queryString:"etcdsnap",children:[(0,n.jsxs)(t,{value:"Single Server",children:[(0,n.jsxs)(s.p,{children:["Run K3s with the ",(0,n.jsx)(s.code,{children:"--cluster-reset"})," option, with the ",(0,n.jsx)(s.code,{children:"--cluster-reset-restore-path"})," also given:"]}),(0,n.jsx)(s.pre,{children:(0,n.jsx)(s.code,{className:"language-bash",children:"k3s server \\\n --cluster-reset \\\n --cluster-reset-restore-path=\n"})}),(0,n.jsxs)(s.p,{children:[(0,n.jsx)(s.strong,{children:"Result:"})," A message in the logs says that K3s can be restarted without the flags. Start k3s again and should run successfully and be restored from the specified snapshot."]})]}),(0,n.jsxs)(t,{value:"High Availability",children:[(0,n.jsxs)(s.p,{children:["In this example there are 3 servers, ",(0,n.jsx)(s.code,{children:"S1"}),", ",(0,n.jsx)(s.code,{children:"S2"}),", and ",(0,n.jsx)(s.code,{children:"S3"}),". The snapshot is located on ",(0,n.jsx)(s.code,{children:"S1"}),"."]}),(0,n.jsxs)(s.ol,{children:["\n",(0,n.jsxs)(s.li,{children:["\n",(0,n.jsxs)(s.p,{children:["On S1, start K3s with the ",(0,n.jsx)(s.code,{children:"--cluster-reset"})," option, with the ",(0,n.jsx)(s.code,{children:"--cluster-reset-restore-path"})," also given:"]}),"\n",(0,n.jsx)(s.pre,{children:(0,n.jsx)(s.code,{className:"language-bash",children:"k3s server \\\n --cluster-reset \\\n --cluster-reset-restore-path=\n"})}),"\n",(0,n.jsxs)(s.p,{children:[(0,n.jsx)(s.strong,{children:"Result:"})," A message in the logs says that K3s can be restarted without the flags."]}),"\n"]}),"\n",(0,n.jsxs)(s.li,{children:["\n",(0,n.jsxs)(s.p,{children:["On S2 and S3, stop K3s. Then delete the data directory, ",(0,n.jsx)(s.code,{children:"/var/lib/rancher/k3s/server/db/"}),":"]}),"\n",(0,n.jsx)(s.pre,{children:(0,n.jsx)(s.code,{className:"language-bash",children:"systemctl stop k3s\nrm -rf /var/lib/rancher/k3s/server/db/\n"})}),"\n"]}),"\n",(0,n.jsxs)(s.li,{children:["\n",(0,n.jsx)(s.p,{children:"On S1, start K3s again:"}),"\n",(0,n.jsx)(s.pre,{children:(0,n.jsx)(s.code,{className:"language-bash",children:"systemctl start k3s\n"})}),"\n"]}),"\n",(0,n.jsxs)(s.li,{children:["\n",(0,n.jsx)(s.p,{children:"On S2 and S3, start K3s again to join the restored cluster:"}),"\n",(0,n.jsx)(s.pre,{children:(0,n.jsx)(s.code,{className:"language-bash",children:"systemctl start k3s\n"})}),"\n"]}),"\n"]})]})]}),"\n",(0,n.jsx)(s.h4,{id:"options",children:"Options"}),"\n",(0,n.jsxs)(s.p,{children:["These options can be passed in with the command line, or in the ",(0,n.jsx)(s.a,{href:"/installation/configuration#configuration-file",children:"configuration file,"})," which may be easier to use."]}),"\n",(0,n.jsxs)(s.table,{children:[(0,n.jsx)(s.thead,{children:(0,n.jsxs)(s.tr,{children:[(0,n.jsx)(s.th,{children:"Options"}),(0,n.jsx)(s.th,{children:"Description"})]})}),(0,n.jsxs)(s.tbody,{children:[(0,n.jsxs)(s.tr,{children:[(0,n.jsx)(s.td,{children:(0,n.jsx)(s.code,{children:"--etcd-disable-snapshots"})}),(0,n.jsx)(s.td,{children:"Disable automatic etcd snapshots"})]}),(0,n.jsxs)(s.tr,{children:[(0,n.jsxs)(s.td,{children:[(0,n.jsx)(s.code,{children:"--etcd-snapshot-schedule-cron"})," value"]}),(0,n.jsxs)(s.td,{children:["Snapshot interval time in cron spec. eg. every 5 hours ",(0,n.jsx)(s.code,{children:"0 */5 * * *"}),"(default: ",(0,n.jsx)(s.code,{children:"0 */12 * * *"}),")"]})]}),(0,n.jsxs)(s.tr,{children:[(0,n.jsxs)(s.td,{children:[(0,n.jsx)(s.code,{children:"--etcd-snapshot-retention"})," value"]}),(0,n.jsx)(s.td,{children:"Number of snapshots to retain (default: 5)"})]}),(0,n.jsxs)(s.tr,{children:[(0,n.jsxs)(s.td,{children:[(0,n.jsx)(s.code,{children:"--etcd-snapshot-dir"})," value"]}),(0,n.jsxs)(s.td,{children:["Directory to save db snapshots. (Default location: ",(0,n.jsx)(s.code,{children:"${data-dir}/db/snapshots"}),")"]})]}),(0,n.jsxs)(s.tr,{children:[(0,n.jsx)(s.td,{children:(0,n.jsx)(s.code,{children:"--cluster-reset"})}),(0,n.jsxs)(s.td,{children:["Forget all peers and become sole member of a new cluster. This can also be set with the environment variable ",(0,n.jsx)(s.code,{children:"[$K3S_CLUSTER_RESET]"}),"."]})]}),(0,n.jsxs)(s.tr,{children:[(0,n.jsxs)(s.td,{children:[(0,n.jsx)(s.code,{children:"--cluster-reset-restore-path"})," value"]}),(0,n.jsx)(s.td,{children:"Path to snapshot file to be restored"})]})]})]}),"\n",(0,n.jsx)(s.h4,{id:"s3-compatible-api-support",children:"S3 Compatible API Support"}),"\n",(0,n.jsx)(s.p,{children:"K3s supports writing etcd snapshots to and restoring etcd snapshots from systems with S3-compatible APIs. S3 support is available for both on-demand and scheduled snapshots."}),"\n",(0,n.jsxs)(s.p,{children:["The arguments below have been added to the ",(0,n.jsx)(s.code,{children:"server"})," subcommand. These flags exist for the ",(0,n.jsx)(s.code,{children:"etcd-snapshot"})," subcommand as well however the ",(0,n.jsx)(s.code,{children:"--etcd-s3"})," portion is removed to avoid redundancy."]}),"\n",(0,n.jsxs)(s.table,{children:[(0,n.jsx)(s.thead,{children:(0,n.jsxs)(s.tr,{children:[(0,n.jsx)(s.th,{children:"Options"}),(0,n.jsx)(s.th,{children:"Description"})]})}),(0,n.jsxs)(s.tbody,{children:[(0,n.jsxs)(s.tr,{children:[(0,n.jsx)(s.td,{children:(0,n.jsx)(s.code,{children:"--etcd-s3"})}),(0,n.jsx)(s.td,{children:"Enable backup to S3"})]}),(0,n.jsxs)(s.tr,{children:[(0,n.jsx)(s.td,{children:(0,n.jsx)(s.code,{children:"--etcd-s3-endpoint"})}),(0,n.jsx)(s.td,{children:"S3 endpoint url"})]}),(0,n.jsxs)(s.tr,{children:[(0,n.jsx)(s.td,{children:(0,n.jsx)(s.code,{children:"--etcd-s3-endpoint-ca"})}),(0,n.jsx)(s.td,{children:"S3 custom CA cert to connect to S3 endpoint"})]}),(0,n.jsxs)(s.tr,{children:[(0,n.jsx)(s.td,{children:(0,n.jsx)(s.code,{children:"--etcd-s3-skip-ssl-verify"})}),(0,n.jsx)(s.td,{children:"Disables S3 SSL certificate validation"})]}),(0,n.jsxs)(s.tr,{children:[(0,n.jsx)(s.td,{children:(0,n.jsx)(s.code,{children:"--etcd-s3-access-key"})}),(0,n.jsx)(s.td,{children:"S3 access key"})]}),(0,n.jsxs)(s.tr,{children:[(0,n.jsx)(s.td,{children:(0,n.jsx)(s.code,{children:"--etcd-s3-secret-key"})}),(0,n.jsx)(s.td,{children:"S3 secret key"})]}),(0,n.jsxs)(s.tr,{children:[(0,n.jsx)(s.td,{children:(0,n.jsx)(s.code,{children:"--etcd-s3-bucket"})}),(0,n.jsx)(s.td,{children:"S3 bucket name"})]}),(0,n.jsxs)(s.tr,{children:[(0,n.jsx)(s.td,{children:(0,n.jsx)(s.code,{children:"--etcd-s3-region"})}),(0,n.jsx)(s.td,{children:"S3 region / bucket location (optional). defaults to us-east-1"})]}),(0,n.jsxs)(s.tr,{children:[(0,n.jsx)(s.td,{children:(0,n.jsx)(s.code,{children:"--etcd-s3-folder"})}),(0,n.jsx)(s.td,{children:"S3 folder"})]})]})]}),"\n",(0,n.jsx)(s.p,{children:"To perform an on-demand etcd snapshot and save it to S3:"}),"\n",(0,n.jsx)(s.pre,{children:(0,n.jsx)(s.code,{className:"language-bash",children:"k3s etcd-snapshot save \\\n --s3 \\\n --s3-bucket= \\\n --s3-access-key= \\\n --s3-secret-key=\n"})}),"\n",(0,n.jsx)(s.p,{children:"To perform an on-demand etcd snapshot restore from S3, first make sure that K3s isn't running. Then run the following commands:"}),"\n",(0,n.jsx)(s.pre,{children:(0,n.jsx)(s.code,{className:"language-bash",children:"k3s server \\\n --cluster-init \\\n --cluster-reset \\\n --etcd-s3 \\\n --cluster-reset-restore-path= \\\n --etcd-s3-bucket= \\\n --etcd-s3-access-key= \\\n --etcd-s3-secret-key=\n"})}),"\n",(0,n.jsx)(s.h4,{id:"etcd-snapshot-and-restore-subcommands",children:"Etcd Snapshot and Restore Subcommands"}),"\n",(0,n.jsx)(s.p,{children:"k3s supports a set of subcommands for working with your etcd snapshots."}),"\n",(0,n.jsxs)(s.table,{children:[(0,n.jsx)(s.thead,{children:(0,n.jsxs)(s.tr,{children:[(0,n.jsx)(s.th,{children:"Subcommand"}),(0,n.jsx)(s.th,{children:"Description"})]})}),(0,n.jsxs)(s.tbody,{children:[(0,n.jsxs)(s.tr,{children:[(0,n.jsx)(s.td,{children:"delete"}),(0,n.jsx)(s.td,{children:"Delete given snapshot(s)"})]}),(0,n.jsxs)(s.tr,{children:[(0,n.jsx)(s.td,{children:"ls, list, l"}),(0,n.jsx)(s.td,{children:"List snapshots"})]}),(0,n.jsxs)(s.tr,{children:[(0,n.jsx)(s.td,{children:"prune"}),(0,n.jsx)(s.td,{children:"Remove snapshots that exceed the configured retention count"})]}),(0,n.jsxs)(s.tr,{children:[(0,n.jsx)(s.td,{children:"save"}),(0,n.jsx)(s.td,{children:"Trigger an immediate etcd snapshot"})]})]})]}),"\n",(0,n.jsx)(s.admonition,{type:"note",children:(0,n.jsxs)(s.p,{children:["The ",(0,n.jsx)(s.code,{children:"save"})," subcommand is the same as ",(0,n.jsx)(s.code,{children:"k3s etcd-snapshot"}),". The latter will eventually be deprecated in favor of the former."]})}),"\n",(0,n.jsx)(s.p,{children:"These commands will perform as expected whether the etcd snapshots are stored locally or in an S3 compatible object store."}),"\n",(0,n.jsxs)(s.p,{children:["For additional information on the etcd snapshot subcommands, run ",(0,n.jsx)(s.code,{children:"k3s etcd-snapshot"}),"."]}),"\n",(0,n.jsx)(s.p,{children:"Delete a snapshot from S3."}),"\n",(0,n.jsx)(s.pre,{children:(0,n.jsx)(s.code,{className:"language-bash",children:"k3s etcd-snapshot delete \\\n --s3 \\\n --s3-bucket= \\\n --s3-access-key= \\\n --s3-secret-key= \\\n \n"})}),"\n",(0,n.jsxs)(s.p,{children:["Prune local snapshots with the default retention policy (5). The ",(0,n.jsx)(s.code,{children:"prune"})," subcommand takes an additional flag ",(0,n.jsx)(s.code,{children:"--snapshot-retention"})," that allows for overriding the default retention policy."]}),"\n",(0,n.jsx)(s.pre,{children:(0,n.jsx)(s.code,{className:"language-bash",children:"k3s etcd-snapshot prune\n"})}),"\n",(0,n.jsx)(s.pre,{children:(0,n.jsx)(s.code,{className:"language-bash",children:"k3s etcd-snapshot prune --snapshot-retention 10\n"})})]})}function h(e={}){const{wrapper:s}={...(0,r.a)(),...e.components};return s?(0,n.jsx)(s,{...e,children:(0,n.jsx)(l,{...e})}):l(e)}function p(e,s){throw new Error("Expected "+(s?"component":"object")+" `"+e+"` to be defined: you likely forgot to import, pass, or provide it.")}},1151:(e,s,t)=>{t.d(s,{Z:()=>i,a:()=>c});var n=t(7294);const r={},d=n.createContext(r);function c(e){const s=n.useContext(d);return n.useMemo((function(){return"function"==typeof e?e(s):{...s,...e}}),[s,e])}function i(e){let s;return s=e.disableParentContext?"function"==typeof e.components?e.components(r):e.components||r:c(e.components),n.createElement(d.Provider,{value:s},e.children)}}}]); \ No newline at end of file +"use strict";(self.webpackChunkk_3_s_docs=self.webpackChunkk_3_s_docs||[]).push([[6155],{7406:(e,s,t)=>{t.r(s),t.d(s,{assets:()=>o,contentTitle:()=>c,default:()=>h,frontMatter:()=>d,metadata:()=>i,toc:()=>a});var n=t(5893),r=t(1151);const d={title:"etcd-snapshot"},c="k3s etcd-snapshot",i={id:"cli/etcd-snapshot",title:"etcd-snapshot",description:"Available as of v1.19.1+k3s1",source:"@site/docs/cli/etcd-snapshot.md",sourceDirName:"cli",slug:"/cli/etcd-snapshot",permalink:"/cli/etcd-snapshot",draft:!1,unlisted:!1,editUrl:"https://github.com/k3s-io/docs/edit/main/docs/cli/etcd-snapshot.md",tags:[],version:"current",lastUpdatedAt:1723747404e3,frontMatter:{title:"etcd-snapshot"},sidebar:"mySidebar",previous:{title:"certificate",permalink:"/cli/certificate"},next:{title:"secrets-encrypt",permalink:"/cli/secrets-encrypt"}},o={},a=[{value:"Creating Snapshots",id:"creating-snapshots",level:4},{value:"Restoring a Cluster from a Snapshot",id:"restoring-a-cluster-from-a-snapshot",level:4},{value:"Options",id:"options",level:4},{value:"S3 Compatible API Support",id:"s3-compatible-api-support",level:4},{value:"Etcd Snapshot and Restore Subcommands",id:"etcd-snapshot-and-restore-subcommands",level:4}];function l(e){const s={a:"a",admonition:"admonition",code:"code",h1:"h1",h4:"h4",header:"header",li:"li",ol:"ol",p:"p",pre:"pre",strong:"strong",table:"table",tbody:"tbody",td:"td",th:"th",thead:"thead",tr:"tr",...(0,r.a)(),...e.components},{TabItem:t,Tabs:d}=s;return t||p("TabItem",!0),d||p("Tabs",!0),(0,n.jsxs)(n.Fragment,{children:[(0,n.jsx)(s.header,{children:(0,n.jsx)(s.h1,{id:"k3s-etcd-snapshot",children:"k3s etcd-snapshot"})}),"\n",(0,n.jsx)(s.admonition,{title:"Version Gate",type:"info",children:(0,n.jsxs)(s.p,{children:["Available as of ",(0,n.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/releases/tag/v1.19.1%2Bk3s1",children:"v1.19.1+k3s1"})]})}),"\n",(0,n.jsx)(s.p,{children:"In this section, you'll learn how to create backups of the K3s embedded etcd datastore, and to restore the cluster from backup."}),"\n",(0,n.jsx)(s.h4,{id:"creating-snapshots",children:"Creating Snapshots"}),"\n",(0,n.jsxs)(s.p,{children:["Snapshots are enabled by default, at 00:00 and 12:00 system time, with 5 snapshots retained. To configure the snapshot interval or the number of retained snapshots, refer to the ",(0,n.jsx)(s.a,{href:"#options",children:"options"}),"."]}),"\n",(0,n.jsxs)(s.p,{children:["The snapshot directory defaults to ",(0,n.jsx)(s.code,{children:"${data-dir}/server/db/snapshots"}),". The data-dir value defaults to ",(0,n.jsx)(s.code,{children:"/var/lib/rancher/k3s"})," and can be changed by setting the ",(0,n.jsx)(s.code,{children:"--data-dir"})," flag."]}),"\n",(0,n.jsx)(s.h4,{id:"restoring-a-cluster-from-a-snapshot",children:"Restoring a Cluster from a Snapshot"}),"\n",(0,n.jsxs)(s.p,{children:["When K3s is restored from backup, the old data directory will be moved to ",(0,n.jsx)(s.code,{children:"${data-dir}/server/db/etcd-old/"}),". Then K3s will attempt to restore the snapshot by creating a new data directory, then starting etcd with a new K3s cluster with one etcd member."]}),"\n",(0,n.jsx)(s.p,{children:"To restore the cluster from backup:"}),"\n",(0,n.jsxs)(d,{queryString:"etcdsnap",children:[(0,n.jsxs)(t,{value:"Single Server",children:[(0,n.jsxs)(s.p,{children:["Run K3s with the ",(0,n.jsx)(s.code,{children:"--cluster-reset"})," option, with the ",(0,n.jsx)(s.code,{children:"--cluster-reset-restore-path"})," also given:"]}),(0,n.jsx)(s.pre,{children:(0,n.jsx)(s.code,{className:"language-bash",children:"k3s server \\\n --cluster-reset \\\n --cluster-reset-restore-path=\n"})}),(0,n.jsxs)(s.p,{children:[(0,n.jsx)(s.strong,{children:"Result:"})," A message in the logs says that K3s can be restarted without the flags. Start k3s again and should run successfully and be restored from the specified snapshot."]})]}),(0,n.jsxs)(t,{value:"High Availability",children:[(0,n.jsxs)(s.p,{children:["In this example there are 3 servers, ",(0,n.jsx)(s.code,{children:"S1"}),", ",(0,n.jsx)(s.code,{children:"S2"}),", and ",(0,n.jsx)(s.code,{children:"S3"}),". The snapshot is located on ",(0,n.jsx)(s.code,{children:"S1"}),"."]}),(0,n.jsxs)(s.ol,{children:["\n",(0,n.jsxs)(s.li,{children:["\n",(0,n.jsxs)(s.p,{children:["On S1, start K3s with the ",(0,n.jsx)(s.code,{children:"--cluster-reset"})," option, with the ",(0,n.jsx)(s.code,{children:"--cluster-reset-restore-path"})," also given:"]}),"\n",(0,n.jsx)(s.pre,{children:(0,n.jsx)(s.code,{className:"language-bash",children:"k3s server \\\n --cluster-reset \\\n --cluster-reset-restore-path=\n"})}),"\n",(0,n.jsxs)(s.p,{children:[(0,n.jsx)(s.strong,{children:"Result:"})," A message in the logs says that K3s can be restarted without the flags."]}),"\n"]}),"\n",(0,n.jsxs)(s.li,{children:["\n",(0,n.jsxs)(s.p,{children:["On S2 and S3, stop K3s. Then delete the data directory, ",(0,n.jsx)(s.code,{children:"/var/lib/rancher/k3s/server/db/"}),":"]}),"\n",(0,n.jsx)(s.pre,{children:(0,n.jsx)(s.code,{className:"language-bash",children:"systemctl stop k3s\nrm -rf /var/lib/rancher/k3s/server/db/\n"})}),"\n"]}),"\n",(0,n.jsxs)(s.li,{children:["\n",(0,n.jsx)(s.p,{children:"On S1, start K3s again:"}),"\n",(0,n.jsx)(s.pre,{children:(0,n.jsx)(s.code,{className:"language-bash",children:"systemctl start k3s\n"})}),"\n"]}),"\n",(0,n.jsxs)(s.li,{children:["\n",(0,n.jsx)(s.p,{children:"On S2 and S3, start K3s again to join the restored cluster:"}),"\n",(0,n.jsx)(s.pre,{children:(0,n.jsx)(s.code,{className:"language-bash",children:"systemctl start k3s\n"})}),"\n"]}),"\n"]})]})]}),"\n",(0,n.jsx)(s.h4,{id:"options",children:"Options"}),"\n",(0,n.jsxs)(s.p,{children:["These options can be passed in with the command line, or in the ",(0,n.jsx)(s.a,{href:"/installation/configuration#configuration-file",children:"configuration file,"})," which may be easier to use."]}),"\n",(0,n.jsxs)(s.table,{children:[(0,n.jsx)(s.thead,{children:(0,n.jsxs)(s.tr,{children:[(0,n.jsx)(s.th,{children:"Options"}),(0,n.jsx)(s.th,{children:"Description"})]})}),(0,n.jsxs)(s.tbody,{children:[(0,n.jsxs)(s.tr,{children:[(0,n.jsx)(s.td,{children:(0,n.jsx)(s.code,{children:"--etcd-disable-snapshots"})}),(0,n.jsx)(s.td,{children:"Disable automatic etcd snapshots"})]}),(0,n.jsxs)(s.tr,{children:[(0,n.jsxs)(s.td,{children:[(0,n.jsx)(s.code,{children:"--etcd-snapshot-schedule-cron"})," value"]}),(0,n.jsxs)(s.td,{children:["Snapshot interval time in cron spec. eg. every 5 hours ",(0,n.jsx)(s.code,{children:"0 */5 * * *"}),"(default: ",(0,n.jsx)(s.code,{children:"0 */12 * * *"}),")"]})]}),(0,n.jsxs)(s.tr,{children:[(0,n.jsxs)(s.td,{children:[(0,n.jsx)(s.code,{children:"--etcd-snapshot-retention"})," value"]}),(0,n.jsx)(s.td,{children:"Number of snapshots to retain (default: 5)"})]}),(0,n.jsxs)(s.tr,{children:[(0,n.jsxs)(s.td,{children:[(0,n.jsx)(s.code,{children:"--etcd-snapshot-dir"})," value"]}),(0,n.jsxs)(s.td,{children:["Directory to save db snapshots. (Default location: ",(0,n.jsx)(s.code,{children:"${data-dir}/db/snapshots"}),")"]})]}),(0,n.jsxs)(s.tr,{children:[(0,n.jsx)(s.td,{children:(0,n.jsx)(s.code,{children:"--cluster-reset"})}),(0,n.jsxs)(s.td,{children:["Forget all peers and become sole member of a new cluster. This can also be set with the environment variable ",(0,n.jsx)(s.code,{children:"[$K3S_CLUSTER_RESET]"}),"."]})]}),(0,n.jsxs)(s.tr,{children:[(0,n.jsxs)(s.td,{children:[(0,n.jsx)(s.code,{children:"--cluster-reset-restore-path"})," value"]}),(0,n.jsx)(s.td,{children:"Path to snapshot file to be restored"})]})]})]}),"\n",(0,n.jsx)(s.h4,{id:"s3-compatible-api-support",children:"S3 Compatible API Support"}),"\n",(0,n.jsx)(s.p,{children:"K3s supports writing etcd snapshots to and restoring etcd snapshots from systems with S3-compatible APIs. S3 support is available for both on-demand and scheduled snapshots."}),"\n",(0,n.jsxs)(s.p,{children:["The arguments below have been added to the ",(0,n.jsx)(s.code,{children:"server"})," subcommand. These flags exist for the ",(0,n.jsx)(s.code,{children:"etcd-snapshot"})," subcommand as well however the ",(0,n.jsx)(s.code,{children:"--etcd-s3"})," portion is removed to avoid redundancy."]}),"\n",(0,n.jsxs)(s.table,{children:[(0,n.jsx)(s.thead,{children:(0,n.jsxs)(s.tr,{children:[(0,n.jsx)(s.th,{children:"Options"}),(0,n.jsx)(s.th,{children:"Description"})]})}),(0,n.jsxs)(s.tbody,{children:[(0,n.jsxs)(s.tr,{children:[(0,n.jsx)(s.td,{children:(0,n.jsx)(s.code,{children:"--etcd-s3"})}),(0,n.jsx)(s.td,{children:"Enable backup to S3"})]}),(0,n.jsxs)(s.tr,{children:[(0,n.jsx)(s.td,{children:(0,n.jsx)(s.code,{children:"--etcd-s3-endpoint"})}),(0,n.jsx)(s.td,{children:"S3 endpoint url"})]}),(0,n.jsxs)(s.tr,{children:[(0,n.jsx)(s.td,{children:(0,n.jsx)(s.code,{children:"--etcd-s3-endpoint-ca"})}),(0,n.jsx)(s.td,{children:"S3 custom CA cert to connect to S3 endpoint"})]}),(0,n.jsxs)(s.tr,{children:[(0,n.jsx)(s.td,{children:(0,n.jsx)(s.code,{children:"--etcd-s3-skip-ssl-verify"})}),(0,n.jsx)(s.td,{children:"Disables S3 SSL certificate validation"})]}),(0,n.jsxs)(s.tr,{children:[(0,n.jsx)(s.td,{children:(0,n.jsx)(s.code,{children:"--etcd-s3-access-key"})}),(0,n.jsx)(s.td,{children:"S3 access key"})]}),(0,n.jsxs)(s.tr,{children:[(0,n.jsx)(s.td,{children:(0,n.jsx)(s.code,{children:"--etcd-s3-secret-key"})}),(0,n.jsx)(s.td,{children:"S3 secret key"})]}),(0,n.jsxs)(s.tr,{children:[(0,n.jsx)(s.td,{children:(0,n.jsx)(s.code,{children:"--etcd-s3-bucket"})}),(0,n.jsx)(s.td,{children:"S3 bucket name"})]}),(0,n.jsxs)(s.tr,{children:[(0,n.jsx)(s.td,{children:(0,n.jsx)(s.code,{children:"--etcd-s3-region"})}),(0,n.jsx)(s.td,{children:"S3 region / bucket location (optional). defaults to us-east-1"})]}),(0,n.jsxs)(s.tr,{children:[(0,n.jsx)(s.td,{children:(0,n.jsx)(s.code,{children:"--etcd-s3-folder"})}),(0,n.jsx)(s.td,{children:"S3 folder"})]})]})]}),"\n",(0,n.jsx)(s.p,{children:"To perform an on-demand etcd snapshot and save it to S3:"}),"\n",(0,n.jsx)(s.pre,{children:(0,n.jsx)(s.code,{className:"language-bash",children:"k3s etcd-snapshot save \\\n --s3 \\\n --s3-bucket= \\\n --s3-access-key= \\\n --s3-secret-key=\n"})}),"\n",(0,n.jsx)(s.p,{children:"To perform an on-demand etcd snapshot restore from S3, first make sure that K3s isn't running. Then run the following commands:"}),"\n",(0,n.jsx)(s.pre,{children:(0,n.jsx)(s.code,{className:"language-bash",children:"k3s server \\\n --cluster-init \\\n --cluster-reset \\\n --etcd-s3 \\\n --cluster-reset-restore-path= \\\n --etcd-s3-bucket= \\\n --etcd-s3-access-key= \\\n --etcd-s3-secret-key=\n"})}),"\n",(0,n.jsx)(s.h4,{id:"etcd-snapshot-and-restore-subcommands",children:"Etcd Snapshot and Restore Subcommands"}),"\n",(0,n.jsx)(s.p,{children:"k3s supports a set of subcommands for working with your etcd snapshots."}),"\n",(0,n.jsxs)(s.table,{children:[(0,n.jsx)(s.thead,{children:(0,n.jsxs)(s.tr,{children:[(0,n.jsx)(s.th,{children:"Subcommand"}),(0,n.jsx)(s.th,{children:"Description"})]})}),(0,n.jsxs)(s.tbody,{children:[(0,n.jsxs)(s.tr,{children:[(0,n.jsx)(s.td,{children:"delete"}),(0,n.jsx)(s.td,{children:"Delete given snapshot(s)"})]}),(0,n.jsxs)(s.tr,{children:[(0,n.jsx)(s.td,{children:"ls, list, l"}),(0,n.jsx)(s.td,{children:"List snapshots"})]}),(0,n.jsxs)(s.tr,{children:[(0,n.jsx)(s.td,{children:"prune"}),(0,n.jsx)(s.td,{children:"Remove snapshots that exceed the configured retention count"})]}),(0,n.jsxs)(s.tr,{children:[(0,n.jsx)(s.td,{children:"save"}),(0,n.jsx)(s.td,{children:"Trigger an immediate etcd snapshot"})]})]})]}),"\n",(0,n.jsx)(s.admonition,{type:"note",children:(0,n.jsxs)(s.p,{children:["The ",(0,n.jsx)(s.code,{children:"save"})," subcommand is the same as ",(0,n.jsx)(s.code,{children:"k3s etcd-snapshot"}),". The latter will eventually be deprecated in favor of the former."]})}),"\n",(0,n.jsx)(s.p,{children:"These commands will perform as expected whether the etcd snapshots are stored locally or in an S3 compatible object store."}),"\n",(0,n.jsxs)(s.p,{children:["For additional information on the etcd snapshot subcommands, run ",(0,n.jsx)(s.code,{children:"k3s etcd-snapshot"}),"."]}),"\n",(0,n.jsx)(s.p,{children:"Delete a snapshot from S3."}),"\n",(0,n.jsx)(s.pre,{children:(0,n.jsx)(s.code,{className:"language-bash",children:"k3s etcd-snapshot delete \\\n --s3 \\\n --s3-bucket= \\\n --s3-access-key= \\\n --s3-secret-key= \\\n \n"})}),"\n",(0,n.jsxs)(s.p,{children:["Prune local snapshots with the default retention policy (5). The ",(0,n.jsx)(s.code,{children:"prune"})," subcommand takes an additional flag ",(0,n.jsx)(s.code,{children:"--snapshot-retention"})," that allows for overriding the default retention policy."]}),"\n",(0,n.jsx)(s.pre,{children:(0,n.jsx)(s.code,{className:"language-bash",children:"k3s etcd-snapshot prune\n"})}),"\n",(0,n.jsx)(s.pre,{children:(0,n.jsx)(s.code,{className:"language-bash",children:"k3s etcd-snapshot prune --snapshot-retention 10\n"})})]})}function h(e={}){const{wrapper:s}={...(0,r.a)(),...e.components};return s?(0,n.jsx)(s,{...e,children:(0,n.jsx)(l,{...e})}):l(e)}function p(e,s){throw new Error("Expected "+(s?"component":"object")+" `"+e+"` to be defined: you likely forgot to import, pass, or provide it.")}},1151:(e,s,t)=>{t.d(s,{Z:()=>i,a:()=>c});var n=t(7294);const r={},d=n.createContext(r);function c(e){const s=n.useContext(d);return n.useMemo((function(){return"function"==typeof e?e(s):{...s,...e}}),[s,e])}function i(e){let s;return s=e.disableParentContext?"function"==typeof e.components?e.components(r):e.components||r:c(e.components),n.createElement(d.Provider,{value:s},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/395f47e2.a4943a3b.js b/assets/js/395f47e2.ee4b1037.js similarity index 99% rename from assets/js/395f47e2.a4943a3b.js rename to assets/js/395f47e2.ee4b1037.js index 7256065bb..c50e958f0 100644 --- a/assets/js/395f47e2.a4943a3b.js +++ b/assets/js/395f47e2.ee4b1037.js @@ -1 +1 @@ -"use strict";(self.webpackChunkk_3_s_docs=self.webpackChunkk_3_s_docs||[]).push([[6801],{793:(e,n,t)=>{t.r(n),t.d(n,{assets:()=>l,contentTitle:()=>o,default:()=>h,frontMatter:()=>r,metadata:()=>a,toc:()=>c});var s=t(5893),i=t(1151);const r={title:"Advanced Options / Configuration"},o=void 0,a={id:"advanced",title:"Advanced Options / Configuration",description:"This section contains advanced information describing the different ways you can run and manage K3s, as well as steps necessary to prepare the host OS for K3s use.",source:"@site/docs/advanced.md",sourceDirName:".",slug:"/advanced",permalink:"/advanced",draft:!1,unlisted:!1,editUrl:"https://github.com/k3s-io/docs/edit/main/docs/advanced.md",tags:[],version:"current",lastUpdatedAt:1723651727e3,frontMatter:{title:"Advanced Options / Configuration"},sidebar:"mySidebar",previous:{title:"Helm",permalink:"/helm"},next:{title:"Environment Variables",permalink:"/reference/env-variables"}},l={},c=[{value:"Certificate Management",id:"certificate-management",level:2},{value:"Certificate Authority Certificates",id:"certificate-authority-certificates",level:3},{value:"Client and Server certificates",id:"client-and-server-certificates",level:3},{value:"Token Management",id:"token-management",level:2},{value:"Configuring an HTTP proxy",id:"configuring-an-http-proxy",level:2},{value:"Using Docker as the Container Runtime",id:"using-docker-as-the-container-runtime",level:2},{value:"Using etcdctl",id:"using-etcdctl",level:2},{value:"Configuring containerd",id:"configuring-containerd",level:2},{value:"Base template",id:"base-template",level:3},{value:"NVIDIA Container Runtime Support",id:"nvidia-container-runtime-support",level:2},{value:"Running Agentless Servers (Experimental)",id:"running-agentless-servers-experimental",level:2},{value:"Running Rootless Servers (Experimental)",id:"running-rootless-servers-experimental",level:2},{value:"Known Issues with Rootless mode",id:"known-issues-with-rootless-mode",level:3},{value:"Starting Rootless Servers",id:"starting-rootless-servers",level:3},{value:"Advanced Rootless Configuration",id:"advanced-rootless-configuration",level:3},{value:"Troubleshooting Rootless",id:"troubleshooting-rootless",level:3},{value:"Node Labels and Taints",id:"node-labels-and-taints",level:2},{value:"Starting the Service with the Installation Script",id:"starting-the-service-with-the-installation-script",level:2},{value:"Running K3s in Docker",id:"running-k3s-in-docker",level:2},{value:"SELinux Support",id:"selinux-support",level:2},{value:"Enabling SELinux Enforcement",id:"enabling-selinux-enforcement",level:3},{value:"Enabling Lazy Pulling of eStargz (Experimental)",id:"enabling-lazy-pulling-of-estargz-experimental",level:2},{value:"What's lazy pulling and eStargz?",id:"whats-lazy-pulling-and-estargz",level:3},{value:"Configure k3s for lazy pulling of eStargz",id:"configure-k3s-for-lazy-pulling-of-estargz",level:3},{value:"Additional Logging Sources",id:"additional-logging-sources",level:2},{value:"Additional Network Policy Logging",id:"additional-network-policy-logging",level:2}];function d(e){const n={a:"a",admonition:"admonition",blockquote:"blockquote",br:"br",code:"code",em:"em",h2:"h2",h3:"h3",li:"li",ol:"ol",p:"p",pre:"pre",strong:"strong",table:"table",tbody:"tbody",td:"td",th:"th",thead:"thead",tr:"tr",ul:"ul",...(0,i.a)(),...e.components},{TabItem:t,Tabs:r}=n;return t||u("TabItem",!0),r||u("Tabs",!0),(0,s.jsxs)(s.Fragment,{children:[(0,s.jsx)(n.p,{children:"This section contains advanced information describing the different ways you can run and manage K3s, as well as steps necessary to prepare the host OS for K3s use."}),"\n",(0,s.jsx)(n.h2,{id:"certificate-management",children:"Certificate Management"}),"\n",(0,s.jsx)(n.h3,{id:"certificate-authority-certificates",children:"Certificate Authority Certificates"}),"\n",(0,s.jsx)(n.p,{children:"K3s generates self-signed Certificate Authority (CA) Certificates during startup of the first server node. These CA certificates are valid for 10 years, and are not automatically renewed."}),"\n",(0,s.jsxs)(n.p,{children:["For information on using custom CA certificates, or renewing the self-signed CA certificates, see the ",(0,s.jsxs)(n.a,{href:"/cli/certificate#certificate-authority-ca-certificates",children:[(0,s.jsx)(n.code,{children:"k3s certificate rotate-ca"})," command documentation"]}),"."]}),"\n",(0,s.jsx)(n.h3,{id:"client-and-server-certificates",children:"Client and Server certificates"}),"\n",(0,s.jsx)(n.p,{children:"K3s client and server certificates are valid for 365 days from their date of issuance. Any certificates that are expired, or within 90 days of expiring, are automatically renewed every time K3s starts."}),"\n",(0,s.jsxs)(n.p,{children:["For information on manually rotating client and server certificates, see the ",(0,s.jsxs)(n.a,{href:"/cli/certificate#client-and-server-certificates",children:[(0,s.jsx)(n.code,{children:"k3s certificate rotate"})," command documentation"]}),"."]}),"\n",(0,s.jsx)(n.h2,{id:"token-management",children:"Token Management"}),"\n",(0,s.jsxs)(n.p,{children:["By default, K3s uses a single static token for both servers and agents. This token cannot be changed once the cluster has been created.\nIt is possible to enable a second static token that can only be used to join agents, or to create temporary ",(0,s.jsx)(n.code,{children:"kubeadm"})," style join tokens that expire automatically.\nFor more information, see the ",(0,s.jsxs)(n.a,{href:"/cli/token",children:[(0,s.jsx)(n.code,{children:"k3s token"})," command documentation"]}),"."]}),"\n",(0,s.jsx)(n.h2,{id:"configuring-an-http-proxy",children:"Configuring an HTTP proxy"}),"\n",(0,s.jsx)(n.p,{children:"If you are running K3s in an environment, which only has external connectivity through an HTTP proxy, you can configure your proxy settings on the K3s systemd service. These proxy settings will then be used in K3s and passed down to the embedded containerd and kubelet."}),"\n",(0,s.jsxs)(n.p,{children:["The K3s installation script will automatically take the ",(0,s.jsx)(n.code,{children:"HTTP_PROXY"}),", ",(0,s.jsx)(n.code,{children:"HTTPS_PROXY"})," and ",(0,s.jsx)(n.code,{children:"NO_PROXY"}),", as well as the ",(0,s.jsx)(n.code,{children:"CONTAINERD_HTTP_PROXY"}),", ",(0,s.jsx)(n.code,{children:"CONTAINERD_HTTPS_PROXY"})," and ",(0,s.jsx)(n.code,{children:"CONTAINERD_NO_PROXY"})," variables from the current shell, if they are present, and write them to the environment file of your systemd service, usually:"]}),"\n",(0,s.jsxs)(n.ul,{children:["\n",(0,s.jsx)(n.li,{children:(0,s.jsx)(n.code,{children:"/etc/systemd/system/k3s.service.env"})}),"\n",(0,s.jsx)(n.li,{children:(0,s.jsx)(n.code,{children:"/etc/systemd/system/k3s-agent.service.env"})}),"\n"]}),"\n",(0,s.jsx)(n.p,{children:"Of course, you can also configure the proxy by editing these files."}),"\n",(0,s.jsxs)(n.p,{children:["K3s will automatically add the cluster internal Pod and Service IP ranges and cluster DNS domain to the list of ",(0,s.jsx)(n.code,{children:"NO_PROXY"})," entries. You should ensure that the IP address ranges used by the Kubernetes nodes themselves (i.e. the public and private IPs of the nodes) are included in the ",(0,s.jsx)(n.code,{children:"NO_PROXY"})," list, or that the nodes can be reached through the proxy."]}),"\n",(0,s.jsx)(n.pre,{children:(0,s.jsx)(n.code,{children:"HTTP_PROXY=http://your-proxy.example.com:8888\nHTTPS_PROXY=http://your-proxy.example.com:8888\nNO_PROXY=127.0.0.0/8,10.0.0.0/8,172.16.0.0/12,192.168.0.0/16\n"})}),"\n",(0,s.jsxs)(n.p,{children:["If you want to configure the proxy settings for containerd without affecting K3s and the Kubelet, you can prefix the variables with ",(0,s.jsx)(n.code,{children:"CONTAINERD_"}),":"]}),"\n",(0,s.jsx)(n.pre,{children:(0,s.jsx)(n.code,{children:"CONTAINERD_HTTP_PROXY=http://your-proxy.example.com:8888\nCONTAINERD_HTTPS_PROXY=http://your-proxy.example.com:8888\nCONTAINERD_NO_PROXY=127.0.0.0/8,10.0.0.0/8,172.16.0.0/12,192.168.0.0/16\n"})}),"\n",(0,s.jsx)(n.h2,{id:"using-docker-as-the-container-runtime",children:"Using Docker as the Container Runtime"}),"\n",(0,s.jsxs)(n.p,{children:["K3s includes and defaults to ",(0,s.jsx)(n.a,{href:"https://containerd.io/",children:"containerd"}),", an industry-standard container runtime.\nAs of Kubernetes 1.24, the Kubelet no longer includes dockershim, the component that allows the kubelet to communicate with dockerd.\nK3s 1.24 and higher include ",(0,s.jsx)(n.a,{href:"https://github.com/Mirantis/cri-dockerd",children:"cri-dockerd"}),", which allows seamless upgrade from prior releases of K3s while continuing to use the Docker container runtime."]}),"\n",(0,s.jsx)(n.p,{children:"To use Docker instead of containerd:"}),"\n",(0,s.jsxs)(n.ol,{children:["\n",(0,s.jsxs)(n.li,{children:["\n",(0,s.jsxs)(n.p,{children:["Install Docker on the K3s node. One of Rancher's ",(0,s.jsx)(n.a,{href:"https://github.com/rancher/install-docker",children:"Docker installation scripts"})," can be used to install Docker:"]}),"\n",(0,s.jsx)(n.pre,{children:(0,s.jsx)(n.code,{className:"language-bash",children:"curl https://releases.rancher.com/install-docker/20.10.sh | sh\n"})}),"\n"]}),"\n",(0,s.jsxs)(n.li,{children:["\n",(0,s.jsxs)(n.p,{children:["Install K3s using the ",(0,s.jsx)(n.code,{children:"--docker"})," option:"]}),"\n",(0,s.jsx)(n.pre,{children:(0,s.jsx)(n.code,{className:"language-bash",children:"curl -sfL https://get.k3s.io | sh -s - --docker\n"})}),"\n"]}),"\n",(0,s.jsxs)(n.li,{children:["\n",(0,s.jsx)(n.p,{children:"Confirm that the cluster is available:"}),"\n",(0,s.jsx)(n.pre,{children:(0,s.jsx)(n.code,{className:"language-bash",children:"$ sudo k3s kubectl get pods --all-namespaces\nNAMESPACE NAME READY STATUS RESTARTS AGE\nkube-system local-path-provisioner-6d59f47c7-lncxn 1/1 Running 0 51s\nkube-system metrics-server-7566d596c8-9tnck 1/1 Running 0 51s\nkube-system helm-install-traefik-mbkn9 0/1 Completed 1 51s\nkube-system coredns-8655855d6-rtbnb 1/1 Running 0 51s\nkube-system svclb-traefik-jbmvl 2/2 Running 0 43s\nkube-system traefik-758cd5fc85-2wz97 1/1 Running 0 43s\n"})}),"\n"]}),"\n",(0,s.jsxs)(n.li,{children:["\n",(0,s.jsx)(n.p,{children:"Confirm that the Docker containers are running:"}),"\n",(0,s.jsx)(n.pre,{children:(0,s.jsx)(n.code,{className:"language-bash",children:'$ sudo docker ps\nCONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES\n3e4d34729602 897ce3c5fc8f "entry" About a minute ago Up About a minute k8s_lb-port-443_svclb-traefik-jbmvl_kube-system_d46f10c6-073f-4c7e-8d7a-8e7ac18f9cb0_0\nbffdc9d7a65f rancher/klipper-lb "entry" About a minute ago Up About a minute k8s_lb-port-80_svclb-traefik-jbmvl_kube-system_d46f10c6-073f-4c7e-8d7a-8e7ac18f9cb0_0\n436b85c5e38d rancher/library-traefik "/traefik --configfi\u2026" About a minute ago Up About a minute k8s_traefik_traefik-758cd5fc85-2wz97_kube-system_07abe831-ffd6-4206-bfa1-7c9ca4fb39e7_0\nde8fded06188 rancher/pause:3.1 "/pause" About a minute ago Up About a minute k8s_POD_svclb-traefik-jbmvl_kube-system_d46f10c6-073f-4c7e-8d7a-8e7ac18f9cb0_0\n7c6a30aeeb2f rancher/pause:3.1 "/pause" About a minute ago Up About a minute k8s_POD_traefik-758cd5fc85-2wz97_kube-system_07abe831-ffd6-4206-bfa1-7c9ca4fb39e7_0\nae6c58cab4a7 9d12f9848b99 "local-path-provisio\u2026" About a minute ago Up About a minute k8s_local-path-provisioner_local-path-provisioner-6d59f47c7-lncxn_kube-system_2dbd22bf-6ad9-4bea-a73d-620c90a6c1c1_0\nbe1450e1a11e 9dd718864ce6 "/metrics-server" About a minute ago Up About a minute k8s_metrics-server_metrics-server-7566d596c8-9tnck_kube-system_031e74b5-e9ef-47ef-a88d-fbf3f726cbc6_0\n4454d14e4d3f c4d3d16fe508 "/coredns -conf /etc\u2026" About a minute ago Up About a minute k8s_coredns_coredns-8655855d6-rtbnb_kube-system_d05725df-4fb1-410a-8e82-2b1c8278a6a1_0\nc3675b87f96c rancher/pause:3.1 "/pause" About a minute ago Up About a minute k8s_POD_coredns-8655855d6-rtbnb_kube-system_d05725df-4fb1-410a-8e82-2b1c8278a6a1_0\n4b1fddbe6ca6 rancher/pause:3.1 "/pause" About a minute ago Up About a minute k8s_POD_local-path-provisioner-6d59f47c7-lncxn_kube-system_2dbd22bf-6ad9-4bea-a73d-620c90a6c1c1_0\n64d3517d4a95 rancher/pause:3.1 "/pause"\n'})}),"\n"]}),"\n"]}),"\n",(0,s.jsx)(n.h2,{id:"using-etcdctl",children:"Using etcdctl"}),"\n",(0,s.jsx)(n.p,{children:"etcdctl provides a CLI for interacting with etcd servers. K3s does not bundle etcdctl."}),"\n",(0,s.jsxs)(n.p,{children:["If you would like to use etcdctl to interact with K3s's embedded etcd, install etcdctl using the ",(0,s.jsx)(n.a,{href:"https://etcd.io/docs/latest/install/",children:"official documentation"}),"."]}),"\n",(0,s.jsx)(n.pre,{children:(0,s.jsx)(n.code,{className:"language-bash",children:'ETCD_VERSION="v3.5.5"\nETCD_URL="https://github.com/etcd-io/etcd/releases/download/${ETCD_VERSION}/etcd-${ETCD_VERSION}-linux-amd64.tar.gz"\ncurl -sL ${ETCD_URL} | sudo tar -zxv --strip-components=1 -C /usr/local/bin\n'})}),"\n",(0,s.jsx)(n.p,{children:"You may then use etcdctl by configuring it to use the K3s-managed certificates and keys for authentication:"}),"\n",(0,s.jsx)(n.pre,{children:(0,s.jsx)(n.code,{className:"language-bash",children:"sudo etcdctl version \\\n --cacert=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt \\\n --cert=/var/lib/rancher/k3s/server/tls/etcd/client.crt \\\n --key=/var/lib/rancher/k3s/server/tls/etcd/client.key\n"})}),"\n",(0,s.jsx)(n.h2,{id:"configuring-containerd",children:"Configuring containerd"}),"\n",(0,s.jsxs)(n.p,{children:["K3s will generate config.toml for containerd in ",(0,s.jsx)(n.code,{children:"/var/lib/rancher/k3s/agent/etc/containerd/config.toml"}),"."]}),"\n",(0,s.jsxs)(n.p,{children:["For advanced customization for this file you can create another file called ",(0,s.jsx)(n.code,{children:"config.toml.tmpl"})," in the same directory, and it will be used instead."]}),"\n",(0,s.jsxs)(n.p,{children:["The ",(0,s.jsx)(n.code,{children:"config.toml.tmpl"})," will be treated as a Go template file, and the ",(0,s.jsx)(n.code,{children:"config.Node"})," structure is being passed to the template. See ",(0,s.jsx)(n.a,{href:"https://github.com/k3s-io/k3s/blob/master/pkg/agent/templates",children:"this folder"})," for Linux and Windows examples on how to use the structure to customize the configuration file.\nThe config.Node golang struct is defined ",(0,s.jsx)(n.a,{href:"https://github.com/k3s-io/k3s/blob/master/pkg/daemons/config/types.go#L37",children:"here"})]}),"\n",(0,s.jsx)(n.h3,{id:"base-template",children:"Base template"}),"\n",(0,s.jsx)(n.admonition,{title:"Version Gate",type:"info",children:(0,s.jsx)(n.p,{children:"Available as of September 2023 releases: v1.24.17+k3s1, v1.25.13+k3s1, v1.26.8+k3s1, v1.27.5+k3s1, v1.28.1+k3s1"})}),"\n",(0,s.jsx)(n.p,{children:"You can extend the K3s base template instead of copy-pasting the complete stock template out of the K3s source code. This is useful if you need to build on the existing configuration, and add a few extra lines at the end."}),"\n",(0,s.jsx)(n.pre,{children:(0,s.jsx)(n.code,{className:"language-toml",children:'#/var/lib/rancher/k3s/agent/etc/containerd/config.toml.tmpl\n\n{{ template "base" . }}\n\n[plugins."io.containerd.grpc.v1.cri".containerd.runtimes."custom"]\n runtime_type = "io.containerd.runc.v2"\n[plugins."io.containerd.grpc.v1.cri".containerd.runtimes."custom".options]\n BinaryName = "/usr/bin/custom-container-runtime"\n\n'})}),"\n",(0,s.jsx)(n.h2,{id:"nvidia-container-runtime-support",children:"NVIDIA Container Runtime Support"}),"\n",(0,s.jsx)(n.p,{children:"K3s will automatically detect and configure the NVIDIA container runtime if it is present when K3s starts."}),"\n",(0,s.jsxs)(n.ol,{children:["\n",(0,s.jsxs)(n.li,{children:["Install the nvidia-container package repository on the node by following the instructions at:\n",(0,s.jsx)(n.a,{href:"https://nvidia.github.io/libnvidia-container/",children:"https://nvidia.github.io/libnvidia-container/"})]}),"\n",(0,s.jsxs)(n.li,{children:["Install the nvidia container runtime packages. For example:\n",(0,s.jsx)(n.code,{children:"apt install -y nvidia-container-runtime cuda-drivers-fabricmanager-515 nvidia-headless-515-server"})]}),"\n",(0,s.jsxs)(n.li,{children:["Install K3s, or restart it if already installed:\n",(0,s.jsx)(n.code,{children:"curl -ksL get.k3s.io | sh -"})]}),"\n",(0,s.jsxs)(n.li,{children:["Confirm that the nvidia container runtime has been found by k3s:\n",(0,s.jsx)(n.code,{children:"grep nvidia /var/lib/rancher/k3s/agent/etc/containerd/config.toml"})]}),"\n"]}),"\n",(0,s.jsxs)(n.p,{children:["This will automatically add ",(0,s.jsx)(n.code,{children:"nvidia"})," and/or ",(0,s.jsx)(n.code,{children:"nvidia-experimental"})," runtimes to the containerd configuration, depending on what runtime executables are found.\nYou must still add a RuntimeClass definition to your cluster, and deploy Pods that explicitly request the appropriate runtime by setting ",(0,s.jsx)(n.code,{children:"runtimeClassName: nvidia"})," in the Pod spec:"]}),"\n",(0,s.jsx)(n.pre,{children:(0,s.jsx)(n.code,{className:"language-yaml",children:'apiVersion: node.k8s.io/v1\nkind: RuntimeClass\nmetadata:\n name: nvidia\nhandler: nvidia\n---\napiVersion: v1\nkind: Pod\nmetadata:\n name: nbody-gpu-benchmark\n namespace: default\nspec:\n restartPolicy: OnFailure\n runtimeClassName: nvidia\n containers:\n - name: cuda-container\n image: nvcr.io/nvidia/k8s/cuda-sample:nbody\n args: ["nbody", "-gpu", "-benchmark"]\n resources:\n limits:\n nvidia.com/gpu: 1\n env:\n - name: NVIDIA_VISIBLE_DEVICES\n value: all\n - name: NVIDIA_DRIVER_CAPABILITIES\n value: all\n'})}),"\n",(0,s.jsxs)(n.p,{children:["Note that the NVIDIA Container Runtime is also frequently used with ",(0,s.jsx)(n.a,{href:"https://github.com/NVIDIA/k8s-device-plugin/",children:"NVIDIA Device Plugin"}),", with modifications to ensure that pod specs include ",(0,s.jsx)(n.code,{children:"runtimeClassName: nvidia"}),", as mentioned above."]}),"\n",(0,s.jsx)(n.h2,{id:"running-agentless-servers-experimental",children:"Running Agentless Servers (Experimental)"}),"\n",(0,s.jsxs)(n.blockquote,{children:["\n",(0,s.jsxs)(n.p,{children:[(0,s.jsx)(n.strong,{children:"Warning:"})," This feature is experimental."]}),"\n"]}),"\n",(0,s.jsxs)(n.p,{children:["When started with the ",(0,s.jsx)(n.code,{children:"--disable-agent"})," flag, servers do not run the kubelet, container runtime, or CNI. They do not register a Node resource in the cluster, and will not appear in ",(0,s.jsx)(n.code,{children:"kubectl get nodes"})," output.\nBecause they do not host a kubelet, they cannot run pods or be managed by operators that rely on enumerating cluster nodes, including the embedded etcd controller and the system upgrade controller."]}),"\n",(0,s.jsx)(n.p,{children:"Running agentless servers may be advantageous if you want to obscure your control-plane nodes from discovery by agents and workloads, at the cost of increased administrative overhead caused by lack of cluster operator support."}),"\n",(0,s.jsxs)(n.p,{children:["By default, the apiserver on agentless servers will not be able to make outgoing connections to admission webhooks or aggregated apiservices running within the cluster. To remedy this, set the ",(0,s.jsx)(n.code,{children:"--egress-selector-mode"})," server flag to either ",(0,s.jsx)(n.code,{children:"pod"})," or ",(0,s.jsx)(n.code,{children:"cluster"}),". If you are changing this flag on an existing cluster, you'll need to restart all nodes in the cluster for the option to take effect."]}),"\n",(0,s.jsx)(n.h2,{id:"running-rootless-servers-experimental",children:"Running Rootless Servers (Experimental)"}),"\n",(0,s.jsxs)(n.blockquote,{children:["\n",(0,s.jsxs)(n.p,{children:[(0,s.jsx)(n.strong,{children:"Warning:"})," This feature is experimental."]}),"\n"]}),"\n",(0,s.jsx)(n.p,{children:"Rootless mode allows running K3s servers as an unprivileged user, so as to protect the real root on the host from potential container-breakout attacks."}),"\n",(0,s.jsxs)(n.p,{children:["See ",(0,s.jsx)(n.a,{href:"https://rootlesscontaine.rs/",children:"https://rootlesscontaine.rs/"})," to learn more about Rootless Kubernetes."]}),"\n",(0,s.jsx)(n.h3,{id:"known-issues-with-rootless-mode",children:"Known Issues with Rootless mode"}),"\n",(0,s.jsxs)(n.ul,{children:["\n",(0,s.jsxs)(n.li,{children:["\n",(0,s.jsx)(n.p,{children:(0,s.jsx)(n.strong,{children:"Ports"})}),"\n",(0,s.jsx)(n.p,{children:"When running rootless a new network namespace is created. This means that K3s instance is running with networking fairly detached from the host.\nThe only way to access Services run in K3s from the host is to set up port forwards to the K3s network namespace.\nRootless K3s includes controller that will automatically bind 6443 and service ports below 1024 to the host with an offset of 10000."}),"\n",(0,s.jsx)(n.p,{children:"For example, a Service on port 80 will become 10080 on the host, but 8080 will become 8080 without any offset. Currently, only LoadBalancer Services are automatically bound."}),"\n"]}),"\n",(0,s.jsxs)(n.li,{children:["\n",(0,s.jsx)(n.p,{children:(0,s.jsx)(n.strong,{children:"Cgroups"})}),"\n",(0,s.jsx)(n.p,{children:'Cgroup v1 and Hybrid v1/v2 are not supported; only pure Cgroup v2 is supported. If K3s fails to start due to missing cgroups when running rootless, it is likely that your node is in Hybrid mode, and the "missing" cgroups are still bound to a v1 controller.'}),"\n"]}),"\n",(0,s.jsxs)(n.li,{children:["\n",(0,s.jsx)(n.p,{children:(0,s.jsx)(n.strong,{children:"Multi-node/multi-process cluster"})}),"\n",(0,s.jsxs)(n.p,{children:["Multi-node rootless clusters, or multiple rootless k3s processes on the same node, are not currently supported. See ",(0,s.jsx)(n.a,{href:"https://github.com/k3s-io/k3s/issues/6488#issuecomment-1314998091",children:"#6488"})," for more details."]}),"\n"]}),"\n"]}),"\n",(0,s.jsx)(n.h3,{id:"starting-rootless-servers",children:"Starting Rootless Servers"}),"\n",(0,s.jsxs)(n.ul,{children:["\n",(0,s.jsxs)(n.li,{children:["\n",(0,s.jsxs)(n.p,{children:["Enable cgroup v2 delegation, see ",(0,s.jsx)(n.a,{href:"https://rootlesscontaine.rs/getting-started/common/cgroup2/",children:"https://rootlesscontaine.rs/getting-started/common/cgroup2/"})," .\nThis step is required; the rootless kubelet will fail to start without the proper cgroups delegated."]}),"\n"]}),"\n",(0,s.jsxs)(n.li,{children:["\n",(0,s.jsxs)(n.p,{children:["Download ",(0,s.jsx)(n.code,{children:"k3s-rootless.service"})," from ",(0,s.jsx)(n.a,{href:"https://github.com/k3s-io/k3s/blob/master/k3s-rootless.service",children:(0,s.jsx)(n.code,{children:"https://github.com/k3s-io/k3s/blob//k3s-rootless.service"})}),".\nMake sure to use the same version of ",(0,s.jsx)(n.code,{children:"k3s-rootless.service"})," and ",(0,s.jsx)(n.code,{children:"k3s"}),"."]}),"\n"]}),"\n",(0,s.jsxs)(n.li,{children:["\n",(0,s.jsxs)(n.p,{children:["Install ",(0,s.jsx)(n.code,{children:"k3s-rootless.service"})," to ",(0,s.jsx)(n.code,{children:"~/.config/systemd/user/k3s-rootless.service"}),".\nInstalling this file as a system-wide service (",(0,s.jsx)(n.code,{children:"/etc/systemd/..."}),") is not supported.\nDepending on the path of ",(0,s.jsx)(n.code,{children:"k3s"})," binary, you might need to modify the ",(0,s.jsx)(n.code,{children:"ExecStart=/usr/local/bin/k3s ..."})," line of the file."]}),"\n"]}),"\n",(0,s.jsxs)(n.li,{children:["\n",(0,s.jsxs)(n.p,{children:["Run ",(0,s.jsx)(n.code,{children:"systemctl --user daemon-reload"})]}),"\n"]}),"\n",(0,s.jsxs)(n.li,{children:["\n",(0,s.jsxs)(n.p,{children:["Run ",(0,s.jsx)(n.code,{children:"systemctl --user enable --now k3s-rootless"})]}),"\n"]}),"\n",(0,s.jsxs)(n.li,{children:["\n",(0,s.jsxs)(n.p,{children:["Run ",(0,s.jsx)(n.code,{children:"KUBECONFIG=~/.kube/k3s.yaml kubectl get pods -A"}),", and make sure the pods are running."]}),"\n"]}),"\n"]}),"\n",(0,s.jsxs)(n.blockquote,{children:["\n",(0,s.jsxs)(n.p,{children:[(0,s.jsx)(n.strong,{children:"Note:"})," Don't try to run ",(0,s.jsx)(n.code,{children:"k3s server --rootless"})," on a terminal, as terminal sessions do not allow cgroup v2 delegation.\nIf you really need to try it on a terminal, use ",(0,s.jsx)(n.code,{children:"systemd-run --user -p Delegate=yes --tty k3s server --rootless"})," to wrap it in a systemd scope."]}),"\n"]}),"\n",(0,s.jsx)(n.h3,{id:"advanced-rootless-configuration",children:"Advanced Rootless Configuration"}),"\n",(0,s.jsxs)(n.p,{children:["Rootless K3s uses ",(0,s.jsx)(n.a,{href:"https://github.com/rootless-containers/rootlesskit",children:"rootlesskit"})," and ",(0,s.jsx)(n.a,{href:"https://github.com/rootless-containers/slirp4netns",children:"slirp4netns"})," to communicate between host and user network namespaces.\nSome of the configuration used by rootlesskit and slirp4nets can be set by environment variables. The best way to set these is to add them to the ",(0,s.jsx)(n.code,{children:"Environment"})," field of the k3s-rootless systemd unit."]}),"\n",(0,s.jsxs)(n.table,{children:[(0,s.jsx)(n.thead,{children:(0,s.jsxs)(n.tr,{children:[(0,s.jsx)(n.th,{children:"Variable"}),(0,s.jsx)(n.th,{children:"Default"}),(0,s.jsx)(n.th,{children:"Description"})]})}),(0,s.jsxs)(n.tbody,{children:[(0,s.jsxs)(n.tr,{children:[(0,s.jsx)(n.td,{children:(0,s.jsx)(n.code,{children:"K3S_ROOTLESS_MTU"})}),(0,s.jsx)(n.td,{children:"1500"}),(0,s.jsx)(n.td,{children:"Sets the MTU for the slirp4netns virtual interfaces."})]}),(0,s.jsxs)(n.tr,{children:[(0,s.jsx)(n.td,{children:(0,s.jsx)(n.code,{children:"K3S_ROOTLESS_CIDR"})}),(0,s.jsx)(n.td,{children:"10.41.0.0/16"}),(0,s.jsx)(n.td,{children:"Sets the CIDR used by slirp4netns virtual interfaces."})]}),(0,s.jsxs)(n.tr,{children:[(0,s.jsx)(n.td,{children:(0,s.jsx)(n.code,{children:"K3S_ROOTLESS_ENABLE_IPV6"})}),(0,s.jsx)(n.td,{children:"autotedected"}),(0,s.jsx)(n.td,{children:"Enables slirp4netns IPv6 support. If not specified, it is automatically enabled if K3s is configured for dual-stack operation."})]}),(0,s.jsxs)(n.tr,{children:[(0,s.jsx)(n.td,{children:(0,s.jsx)(n.code,{children:"K3S_ROOTLESS_PORT_DRIVER"})}),(0,s.jsx)(n.td,{children:"builtin"}),(0,s.jsxs)(n.td,{children:["Selects the rootless port driver; either ",(0,s.jsx)(n.code,{children:"builtin"})," or ",(0,s.jsx)(n.code,{children:"slirp4netns"}),". Builtin is faster, but masquerades the original source address of inbound packets."]})]}),(0,s.jsxs)(n.tr,{children:[(0,s.jsx)(n.td,{children:(0,s.jsx)(n.code,{children:"K3S_ROOTLESS_DISABLE_HOST_LOOPBACK"})}),(0,s.jsx)(n.td,{children:"true"}),(0,s.jsx)(n.td,{children:"Controls whether or not access to the hosts's loopback address via the gateway interface is enabled. It is recommended that this not be changed, for security reasons."})]})]})]}),"\n",(0,s.jsx)(n.h3,{id:"troubleshooting-rootless",children:"Troubleshooting Rootless"}),"\n",(0,s.jsxs)(n.ul,{children:["\n",(0,s.jsxs)(n.li,{children:["Run ",(0,s.jsx)(n.code,{children:"systemctl --user status k3s-rootless"})," to check the daemon status"]}),"\n",(0,s.jsxs)(n.li,{children:["Run ",(0,s.jsx)(n.code,{children:"journalctl --user -f -u k3s-rootless"})," to see the daemon log"]}),"\n",(0,s.jsxs)(n.li,{children:["See also ",(0,s.jsx)(n.a,{href:"https://rootlesscontaine.rs/",children:"https://rootlesscontaine.rs/"})]}),"\n"]}),"\n",(0,s.jsx)(n.h2,{id:"node-labels-and-taints",children:"Node Labels and Taints"}),"\n",(0,s.jsxs)(n.p,{children:["K3s agents can be configured with the options ",(0,s.jsx)(n.code,{children:"--node-label"})," and ",(0,s.jsx)(n.code,{children:"--node-taint"})," which adds a label and taint to the kubelet. The two options only add labels and/or taints ",(0,s.jsx)(n.a,{href:"/cli/agent#node-labels-and-taints-for-agents",children:"at registration time"}),", so they can only be set when the node is first joined to the cluster."]}),"\n",(0,s.jsxs)(n.p,{children:["All current versions of Kubernetes restrict nodes from registering with most labels with ",(0,s.jsx)(n.code,{children:"kubernetes.io"})," and ",(0,s.jsx)(n.code,{children:"k8s.io"})," prefixes, specifically including the ",(0,s.jsx)(n.code,{children:"kubernetes.io/role"})," label. If you attempt to start a node with a disallowed label, K3s will fail to start. As stated by the Kubernetes authors:"]}),"\n",(0,s.jsxs)(n.blockquote,{children:["\n",(0,s.jsx)(n.p,{children:"Nodes are not permitted to assert their own role labels. Node roles are typically used to identify privileged or control plane types of nodes, and allowing nodes to label themselves into that pool allows a compromised node to trivially attract workloads (like control plane daemonsets) that confer access to higher privilege credentials."}),"\n"]}),"\n",(0,s.jsxs)(n.p,{children:["See ",(0,s.jsx)(n.a,{href:"https://github.com/kubernetes/enhancements/blob/master/keps/sig-auth/279-limit-node-access/README.md#proposal",children:"SIG-Auth KEP 279"})," for more information."]}),"\n",(0,s.jsxs)(n.p,{children:["If you want to change node labels and taints after node registration, or add reserved labels, you should use ",(0,s.jsx)(n.code,{children:"kubectl"}),". Refer to the official Kubernetes documentation for details on how to add ",(0,s.jsx)(n.a,{href:"https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/",children:"taints"})," and ",(0,s.jsx)(n.a,{href:"https://kubernetes.io/docs/tasks/configure-pod-container/assign-pods-nodes/#add-a-label-to-a-node",children:"node labels."})]}),"\n",(0,s.jsx)(n.h2,{id:"starting-the-service-with-the-installation-script",children:"Starting the Service with the Installation Script"}),"\n",(0,s.jsx)(n.p,{children:"The installation script will auto-detect if your OS is using systemd or openrc and enable and start the service as part of the installation process."}),"\n",(0,s.jsxs)(n.ul,{children:["\n",(0,s.jsxs)(n.li,{children:["When running with openrc, logs will be created at ",(0,s.jsx)(n.code,{children:"/var/log/k3s.log"}),"."]}),"\n",(0,s.jsxs)(n.li,{children:["When running with systemd, logs will be created in ",(0,s.jsx)(n.code,{children:"/var/log/syslog"})," and viewed using ",(0,s.jsx)(n.code,{children:"journalctl -u k3s"})," (or ",(0,s.jsx)(n.code,{children:"journalctl -u k3s-agent"})," on agents)."]}),"\n"]}),"\n",(0,s.jsx)(n.p,{children:"An example of disabling auto-starting and service enablement with the install script:"}),"\n",(0,s.jsx)(n.pre,{children:(0,s.jsx)(n.code,{className:"language-bash",children:"curl -sfL https://get.k3s.io | INSTALL_K3S_SKIP_START=true INSTALL_K3S_SKIP_ENABLE=true sh -\n"})}),"\n",(0,s.jsx)(n.h2,{id:"running-k3s-in-docker",children:"Running K3s in Docker"}),"\n",(0,s.jsx)(n.p,{children:"There are several ways to run K3s in Docker:"}),"\n",(0,s.jsxs)(r,{children:[(0,s.jsxs)(t,{value:"K3d",default:!0,children:[(0,s.jsxs)(n.p,{children:[(0,s.jsx)(n.a,{href:"https://github.com/k3d-io/k3d",children:"k3d"})," is a utility designed to easily run multi-node K3s clusters in Docker."]}),(0,s.jsx)(n.p,{children:"k3d makes it very easy to create single- and multi-node k3s clusters in docker, e.g. for local development on Kubernetes."}),(0,s.jsxs)(n.p,{children:["See the ",(0,s.jsx)(n.a,{href:"https://k3d.io/#installation",children:"Installation"})," documentation for more information on how to install and use k3d."]})]}),(0,s.jsxs)(t,{value:"Docker",children:[(0,s.jsxs)(n.p,{children:["To use Docker, ",(0,s.jsx)(n.code,{children:"rancher/k3s"})," images are also available to run the K3s server and agent.\nUsing the ",(0,s.jsx)(n.code,{children:"docker run"})," command:"]}),(0,s.jsx)(n.pre,{children:(0,s.jsx)(n.code,{className:"language-bash",children:"sudo docker run \\\n --privileged \\\n --name k3s-server-1 \\\n --hostname k3s-server-1 \\\n -p 6443:6443 \\\n -d rancher/k3s:v1.24.10-k3s1 \\\n server\n"})}),(0,s.jsx)(n.admonition,{type:"note",children:(0,s.jsxs)(n.p,{children:["You must specify a valid K3s version as the tag; the ",(0,s.jsx)(n.code,{children:"latest"})," tag is not maintained.",(0,s.jsx)(n.br,{}),"\n","Docker images do not allow a ",(0,s.jsx)(n.code,{children:"+"})," sign in tags, use a ",(0,s.jsx)(n.code,{children:"-"})," in the tag instead."]})}),(0,s.jsx)(n.p,{children:"Once K3s is up and running, you can copy the admin kubeconfig out of the Docker container for use:"}),(0,s.jsx)(n.pre,{children:(0,s.jsx)(n.code,{className:"language-bash",children:"sudo docker cp k3s-server-1:/etc/rancher/k3s/k3s.yaml ~/.kube/config\n"})})]})]}),"\n",(0,s.jsx)(n.h2,{id:"selinux-support",children:"SELinux Support"}),"\n",(0,s.jsx)(n.admonition,{title:"Version Gate",type:"info",children:(0,s.jsx)(n.p,{children:"Available as of v1.19.4+k3s1"})}),"\n",(0,s.jsx)(n.p,{children:"If you are installing K3s on a system where SELinux is enabled by default (such as CentOS), you must ensure the proper SELinux policies have been installed."}),"\n",(0,s.jsxs)(r,{children:[(0,s.jsx)(t,{value:"Automatic Installation",default:!0,children:(0,s.jsxs)(n.p,{children:["The ",(0,s.jsx)(n.a,{href:"/installation/configuration#configuration-with-install-script",children:"install script"})," will automatically install the SELinux RPM from the Rancher RPM repository if on a compatible system if not performing an air-gapped install. Automatic installation can be skipped by setting ",(0,s.jsx)(n.code,{children:"INSTALL_K3S_SKIP_SELINUX_RPM=true"}),"."]})}),(0,s.jsxs)(t,{value:"Manual Installation",default:!0,children:[(0,s.jsx)(n.p,{children:"The necessary policies can be installed with the following commands:"}),(0,s.jsx)(n.pre,{children:(0,s.jsx)(n.code,{className:"language-bash",children:"yum install -y container-selinux selinux-policy-base\nyum install -y https://rpm.rancher.io/k3s/latest/common/centos/7/noarch/k3s-selinux-1.4-1.el7.noarch.rpm\n"})}),(0,s.jsxs)(n.p,{children:["To force the install script to log a warning rather than fail, you can set the following environment variable: ",(0,s.jsx)(n.code,{children:"INSTALL_K3S_SELINUX_WARN=true"}),"."]})]})]}),"\n",(0,s.jsx)(n.h3,{id:"enabling-selinux-enforcement",children:"Enabling SELinux Enforcement"}),"\n",(0,s.jsxs)(n.p,{children:["To leverage SELinux, specify the ",(0,s.jsx)(n.code,{children:"--selinux"})," flag when starting K3s servers and agents."]}),"\n",(0,s.jsxs)(n.p,{children:["This option can also be specified in the K3s ",(0,s.jsx)(n.a,{href:"/installation/configuration#configuration-file",children:"configuration file"}),"."]}),"\n",(0,s.jsx)(n.pre,{children:(0,s.jsx)(n.code,{children:"selinux: true\n"})}),"\n",(0,s.jsxs)(n.p,{children:["Using a custom ",(0,s.jsx)(n.code,{children:"--data-dir"})," under SELinux is not supported. To customize it, you would most likely need to write your own custom policy. For guidance, you could refer to the ",(0,s.jsx)(n.a,{href:"https://github.com/containers/container-selinux",children:"containers/container-selinux"})," repository, which contains the SELinux policy files for Container Runtimes, and the ",(0,s.jsx)(n.a,{href:"https://github.com/k3s-io/k3s-selinux",children:"k3s-io/k3s-selinux"})," repository, which contains the SELinux policy for K3s."]}),"\n",(0,s.jsx)(n.h2,{id:"enabling-lazy-pulling-of-estargz-experimental",children:"Enabling Lazy Pulling of eStargz (Experimental)"}),"\n",(0,s.jsx)(n.h3,{id:"whats-lazy-pulling-and-estargz",children:"What's lazy pulling and eStargz?"}),"\n",(0,s.jsxs)(n.p,{children:["Pulling images is known as one of the time-consuming steps in the container lifecycle.\nAccording to ",(0,s.jsx)(n.a,{href:"https://www.usenix.org/conference/fast16/technical-sessions/presentation/harter",children:"Harter, et al."}),","]}),"\n",(0,s.jsxs)(n.blockquote,{children:["\n",(0,s.jsx)(n.p,{children:"pulling packages accounts for 76% of container start time, but only 6.4% of that data is read"}),"\n"]}),"\n",(0,s.jsxs)(n.p,{children:["To address this issue, k3s experimentally supports ",(0,s.jsx)(n.em,{children:"lazy pulling"})," of image contents.\nThis allows k3s to start a container before the entire image has been pulled.\nInstead, the necessary chunks of contents (e.g. individual files) are fetched on-demand.\nEspecially for large images, this technique can shorten the container startup latency."]}),"\n",(0,s.jsxs)(n.p,{children:["To enable lazy pulling, the target image needs to be formatted as ",(0,s.jsx)(n.a,{href:"https://github.com/containerd/stargz-snapshotter/blob/main/docs/stargz-estargz.md",children:(0,s.jsx)(n.em,{children:"eStargz"})}),".\nThis is an OCI-alternative but 100% OCI-compatible image format for lazy pulling.\nBecause of the compatibility, eStargz can be pushed to standard container registries (e.g. ghcr.io) as well as this is ",(0,s.jsx)(n.em,{children:"still runnable"})," even on eStargz-agnostic runtimes."]}),"\n",(0,s.jsxs)(n.p,{children:["eStargz is developed based on the ",(0,s.jsx)(n.a,{href:"https://github.com/google/crfs",children:"stargz format proposed by Google CRFS project"})," but comes with practical features including content verification and performance optimization.\nFor more details about lazy pulling and eStargz, please refer to ",(0,s.jsx)(n.a,{href:"https://github.com/containerd/stargz-snapshotter",children:"Stargz Snapshotter project repository"}),"."]}),"\n",(0,s.jsx)(n.h3,{id:"configure-k3s-for-lazy-pulling-of-estargz",children:"Configure k3s for lazy pulling of eStargz"}),"\n",(0,s.jsxs)(n.p,{children:["As shown in the following, ",(0,s.jsx)(n.code,{children:"--snapshotter=stargz"})," option is needed for k3s server and agent."]}),"\n",(0,s.jsx)(n.pre,{children:(0,s.jsx)(n.code,{className:"language-bash",children:"k3s server --snapshotter=stargz\n"})}),"\n",(0,s.jsxs)(n.p,{children:["With this configuration, you can perform lazy pulling for eStargz-formatted images.\nThe following example Pod manifest uses eStargz-formatted ",(0,s.jsx)(n.code,{children:"node:13.13.0"})," image (",(0,s.jsx)(n.code,{children:"ghcr.io/stargz-containers/node:13.13.0-esgz"}),").\nWhen the stargz snapshotter is enabled, K3s performs lazy pulling for this image."]}),"\n",(0,s.jsx)(n.pre,{children:(0,s.jsx)(n.code,{className:"language-yaml",children:"apiVersion: v1\nkind: Pod\nmetadata:\n name: nodejs\nspec:\n containers:\n - name: nodejs-estargz\n image: ghcr.io/stargz-containers/node:13.13.0-esgz\n command: [\"node\"]\n args:\n - -e\n - var http = require('http');\n http.createServer(function(req, res) {\n res.writeHead(200);\n res.end('Hello World!\\n');\n }).listen(80);\n ports:\n - containerPort: 80\n"})}),"\n",(0,s.jsx)(n.h2,{id:"additional-logging-sources",children:"Additional Logging Sources"}),"\n",(0,s.jsxs)(n.p,{children:[(0,s.jsx)(n.a,{href:"https://rancher.com/docs/rancher/v2.6/en/logging/helm-chart-options/",children:"Rancher logging"})," for K3s can be installed without using Rancher. The following instructions should be executed to do so:"]}),"\n",(0,s.jsx)(n.pre,{children:(0,s.jsx)(n.code,{className:"language-bash",children:"helm repo add rancher-charts https://charts.rancher.io\nhelm repo update\nhelm install --create-namespace -n cattle-logging-system rancher-logging-crd rancher-charts/rancher-logging-crd\nhelm install --create-namespace -n cattle-logging-system rancher-logging --set additionalLoggingSources.k3s.enabled=true rancher-charts/rancher-logging\n"})}),"\n",(0,s.jsx)(n.h2,{id:"additional-network-policy-logging",children:"Additional Network Policy Logging"}),"\n",(0,s.jsx)(n.p,{children:"Packets dropped by network policies can be logged. The packet is sent to the iptables NFLOG action, which shows the packet details, including the network policy that blocked it."}),"\n",(0,s.jsxs)(n.p,{children:["If there is a lot of traffic, the number of log messages could be very high. To control the log rate on a per-policy basis, set the ",(0,s.jsx)(n.code,{children:"limit"})," and ",(0,s.jsx)(n.code,{children:"limit-burst"})," iptables parameters by adding the following annotations to the network policy in question:"]}),"\n",(0,s.jsxs)(n.ul,{children:["\n",(0,s.jsx)(n.li,{children:(0,s.jsx)(n.code,{children:"kube-router.io/netpol-nflog-limit="})}),"\n",(0,s.jsx)(n.li,{children:(0,s.jsx)(n.code,{children:"kube-router.io/netpol-nflog-limit-burst="})}),"\n"]}),"\n",(0,s.jsxs)(n.p,{children:["Default values are ",(0,s.jsx)(n.code,{children:"limit=10/minute"})," and ",(0,s.jsx)(n.code,{children:"limit-burst=10"}),". Check the ",(0,s.jsx)(n.a,{href:"https://www.netfilter.org/documentation/HOWTO/packet-filtering-HOWTO-7.html#:~:text=restrict%20the%20rate%20of%20matches",children:"iptables manual"})," for more information on the format and possible values for these fields."]}),"\n",(0,s.jsxs)(n.p,{children:["To convert NFLOG packets to log entries, install ulogd2 and configure ",(0,s.jsx)(n.code,{children:"[log1]"})," to read on ",(0,s.jsx)(n.code,{children:"group=100"}),". Then, restart the ulogd2 service for the new config to be committed.\nWhen a packet is blocked by network policy rules, a log message will appear in ",(0,s.jsx)(n.code,{children:"/var/log/ulog/syslogemu.log"}),"."]}),"\n",(0,s.jsx)(n.p,{children:"Packets sent to the NFLOG netlink socket can also be read by using command-line tools like tcpdump or tshark:"}),"\n",(0,s.jsx)(n.pre,{children:(0,s.jsx)(n.code,{className:"language-bash",children:"tcpdump -ni nflog:100\n"})}),"\n",(0,s.jsxs)(n.p,{children:["While more readily available, tcpdump will not show the name of the network policy that blocked the packet. Use wireshark's tshark command instead to display the full NFLOG packet header, including the ",(0,s.jsx)(n.code,{children:"nflog.prefix"})," field that contains the policy name."]})]})}function h(e={}){const{wrapper:n}={...(0,i.a)(),...e.components};return n?(0,s.jsx)(n,{...e,children:(0,s.jsx)(d,{...e})}):d(e)}function u(e,n){throw new Error("Expected "+(n?"component":"object")+" `"+e+"` to be defined: you likely forgot to import, pass, or provide it.")}},1151:(e,n,t)=>{t.d(n,{Z:()=>a,a:()=>o});var s=t(7294);const i={},r=s.createContext(i);function o(e){const n=s.useContext(r);return s.useMemo((function(){return"function"==typeof e?e(n):{...n,...e}}),[n,e])}function a(e){let n;return n=e.disableParentContext?"function"==typeof e.components?e.components(i):e.components||i:o(e.components),s.createElement(r.Provider,{value:n},e.children)}}}]); \ No newline at end of file +"use strict";(self.webpackChunkk_3_s_docs=self.webpackChunkk_3_s_docs||[]).push([[6801],{793:(e,n,t)=>{t.r(n),t.d(n,{assets:()=>l,contentTitle:()=>o,default:()=>h,frontMatter:()=>r,metadata:()=>a,toc:()=>c});var s=t(5893),i=t(1151);const r={title:"Advanced Options / Configuration"},o=void 0,a={id:"advanced",title:"Advanced Options / Configuration",description:"This section contains advanced information describing the different ways you can run and manage K3s, as well as steps necessary to prepare the host OS for K3s use.",source:"@site/docs/advanced.md",sourceDirName:".",slug:"/advanced",permalink:"/advanced",draft:!1,unlisted:!1,editUrl:"https://github.com/k3s-io/docs/edit/main/docs/advanced.md",tags:[],version:"current",lastUpdatedAt:1723747404e3,frontMatter:{title:"Advanced Options / Configuration"},sidebar:"mySidebar",previous:{title:"Helm",permalink:"/helm"},next:{title:"Environment Variables",permalink:"/reference/env-variables"}},l={},c=[{value:"Certificate Management",id:"certificate-management",level:2},{value:"Certificate Authority Certificates",id:"certificate-authority-certificates",level:3},{value:"Client and Server certificates",id:"client-and-server-certificates",level:3},{value:"Token Management",id:"token-management",level:2},{value:"Configuring an HTTP proxy",id:"configuring-an-http-proxy",level:2},{value:"Using Docker as the Container Runtime",id:"using-docker-as-the-container-runtime",level:2},{value:"Using etcdctl",id:"using-etcdctl",level:2},{value:"Configuring containerd",id:"configuring-containerd",level:2},{value:"Base template",id:"base-template",level:3},{value:"NVIDIA Container Runtime Support",id:"nvidia-container-runtime-support",level:2},{value:"Running Agentless Servers (Experimental)",id:"running-agentless-servers-experimental",level:2},{value:"Running Rootless Servers (Experimental)",id:"running-rootless-servers-experimental",level:2},{value:"Known Issues with Rootless mode",id:"known-issues-with-rootless-mode",level:3},{value:"Starting Rootless Servers",id:"starting-rootless-servers",level:3},{value:"Advanced Rootless Configuration",id:"advanced-rootless-configuration",level:3},{value:"Troubleshooting Rootless",id:"troubleshooting-rootless",level:3},{value:"Node Labels and Taints",id:"node-labels-and-taints",level:2},{value:"Starting the Service with the Installation Script",id:"starting-the-service-with-the-installation-script",level:2},{value:"Running K3s in Docker",id:"running-k3s-in-docker",level:2},{value:"SELinux Support",id:"selinux-support",level:2},{value:"Enabling SELinux Enforcement",id:"enabling-selinux-enforcement",level:3},{value:"Enabling Lazy Pulling of eStargz (Experimental)",id:"enabling-lazy-pulling-of-estargz-experimental",level:2},{value:"What's lazy pulling and eStargz?",id:"whats-lazy-pulling-and-estargz",level:3},{value:"Configure k3s for lazy pulling of eStargz",id:"configure-k3s-for-lazy-pulling-of-estargz",level:3},{value:"Additional Logging Sources",id:"additional-logging-sources",level:2},{value:"Additional Network Policy Logging",id:"additional-network-policy-logging",level:2}];function d(e){const n={a:"a",admonition:"admonition",blockquote:"blockquote",br:"br",code:"code",em:"em",h2:"h2",h3:"h3",li:"li",ol:"ol",p:"p",pre:"pre",strong:"strong",table:"table",tbody:"tbody",td:"td",th:"th",thead:"thead",tr:"tr",ul:"ul",...(0,i.a)(),...e.components},{TabItem:t,Tabs:r}=n;return t||u("TabItem",!0),r||u("Tabs",!0),(0,s.jsxs)(s.Fragment,{children:[(0,s.jsx)(n.p,{children:"This section contains advanced information describing the different ways you can run and manage K3s, as well as steps necessary to prepare the host OS for K3s use."}),"\n",(0,s.jsx)(n.h2,{id:"certificate-management",children:"Certificate Management"}),"\n",(0,s.jsx)(n.h3,{id:"certificate-authority-certificates",children:"Certificate Authority Certificates"}),"\n",(0,s.jsx)(n.p,{children:"K3s generates self-signed Certificate Authority (CA) Certificates during startup of the first server node. These CA certificates are valid for 10 years, and are not automatically renewed."}),"\n",(0,s.jsxs)(n.p,{children:["For information on using custom CA certificates, or renewing the self-signed CA certificates, see the ",(0,s.jsxs)(n.a,{href:"/cli/certificate#certificate-authority-ca-certificates",children:[(0,s.jsx)(n.code,{children:"k3s certificate rotate-ca"})," command documentation"]}),"."]}),"\n",(0,s.jsx)(n.h3,{id:"client-and-server-certificates",children:"Client and Server certificates"}),"\n",(0,s.jsx)(n.p,{children:"K3s client and server certificates are valid for 365 days from their date of issuance. Any certificates that are expired, or within 90 days of expiring, are automatically renewed every time K3s starts."}),"\n",(0,s.jsxs)(n.p,{children:["For information on manually rotating client and server certificates, see the ",(0,s.jsxs)(n.a,{href:"/cli/certificate#client-and-server-certificates",children:[(0,s.jsx)(n.code,{children:"k3s certificate rotate"})," command documentation"]}),"."]}),"\n",(0,s.jsx)(n.h2,{id:"token-management",children:"Token Management"}),"\n",(0,s.jsxs)(n.p,{children:["By default, K3s uses a single static token for both servers and agents. This token cannot be changed once the cluster has been created.\nIt is possible to enable a second static token that can only be used to join agents, or to create temporary ",(0,s.jsx)(n.code,{children:"kubeadm"})," style join tokens that expire automatically.\nFor more information, see the ",(0,s.jsxs)(n.a,{href:"/cli/token",children:[(0,s.jsx)(n.code,{children:"k3s token"})," command documentation"]}),"."]}),"\n",(0,s.jsx)(n.h2,{id:"configuring-an-http-proxy",children:"Configuring an HTTP proxy"}),"\n",(0,s.jsx)(n.p,{children:"If you are running K3s in an environment, which only has external connectivity through an HTTP proxy, you can configure your proxy settings on the K3s systemd service. These proxy settings will then be used in K3s and passed down to the embedded containerd and kubelet."}),"\n",(0,s.jsxs)(n.p,{children:["The K3s installation script will automatically take the ",(0,s.jsx)(n.code,{children:"HTTP_PROXY"}),", ",(0,s.jsx)(n.code,{children:"HTTPS_PROXY"})," and ",(0,s.jsx)(n.code,{children:"NO_PROXY"}),", as well as the ",(0,s.jsx)(n.code,{children:"CONTAINERD_HTTP_PROXY"}),", ",(0,s.jsx)(n.code,{children:"CONTAINERD_HTTPS_PROXY"})," and ",(0,s.jsx)(n.code,{children:"CONTAINERD_NO_PROXY"})," variables from the current shell, if they are present, and write them to the environment file of your systemd service, usually:"]}),"\n",(0,s.jsxs)(n.ul,{children:["\n",(0,s.jsx)(n.li,{children:(0,s.jsx)(n.code,{children:"/etc/systemd/system/k3s.service.env"})}),"\n",(0,s.jsx)(n.li,{children:(0,s.jsx)(n.code,{children:"/etc/systemd/system/k3s-agent.service.env"})}),"\n"]}),"\n",(0,s.jsx)(n.p,{children:"Of course, you can also configure the proxy by editing these files."}),"\n",(0,s.jsxs)(n.p,{children:["K3s will automatically add the cluster internal Pod and Service IP ranges and cluster DNS domain to the list of ",(0,s.jsx)(n.code,{children:"NO_PROXY"})," entries. You should ensure that the IP address ranges used by the Kubernetes nodes themselves (i.e. the public and private IPs of the nodes) are included in the ",(0,s.jsx)(n.code,{children:"NO_PROXY"})," list, or that the nodes can be reached through the proxy."]}),"\n",(0,s.jsx)(n.pre,{children:(0,s.jsx)(n.code,{children:"HTTP_PROXY=http://your-proxy.example.com:8888\nHTTPS_PROXY=http://your-proxy.example.com:8888\nNO_PROXY=127.0.0.0/8,10.0.0.0/8,172.16.0.0/12,192.168.0.0/16\n"})}),"\n",(0,s.jsxs)(n.p,{children:["If you want to configure the proxy settings for containerd without affecting K3s and the Kubelet, you can prefix the variables with ",(0,s.jsx)(n.code,{children:"CONTAINERD_"}),":"]}),"\n",(0,s.jsx)(n.pre,{children:(0,s.jsx)(n.code,{children:"CONTAINERD_HTTP_PROXY=http://your-proxy.example.com:8888\nCONTAINERD_HTTPS_PROXY=http://your-proxy.example.com:8888\nCONTAINERD_NO_PROXY=127.0.0.0/8,10.0.0.0/8,172.16.0.0/12,192.168.0.0/16\n"})}),"\n",(0,s.jsx)(n.h2,{id:"using-docker-as-the-container-runtime",children:"Using Docker as the Container Runtime"}),"\n",(0,s.jsxs)(n.p,{children:["K3s includes and defaults to ",(0,s.jsx)(n.a,{href:"https://containerd.io/",children:"containerd"}),", an industry-standard container runtime.\nAs of Kubernetes 1.24, the Kubelet no longer includes dockershim, the component that allows the kubelet to communicate with dockerd.\nK3s 1.24 and higher include ",(0,s.jsx)(n.a,{href:"https://github.com/Mirantis/cri-dockerd",children:"cri-dockerd"}),", which allows seamless upgrade from prior releases of K3s while continuing to use the Docker container runtime."]}),"\n",(0,s.jsx)(n.p,{children:"To use Docker instead of containerd:"}),"\n",(0,s.jsxs)(n.ol,{children:["\n",(0,s.jsxs)(n.li,{children:["\n",(0,s.jsxs)(n.p,{children:["Install Docker on the K3s node. One of Rancher's ",(0,s.jsx)(n.a,{href:"https://github.com/rancher/install-docker",children:"Docker installation scripts"})," can be used to install Docker:"]}),"\n",(0,s.jsx)(n.pre,{children:(0,s.jsx)(n.code,{className:"language-bash",children:"curl https://releases.rancher.com/install-docker/20.10.sh | sh\n"})}),"\n"]}),"\n",(0,s.jsxs)(n.li,{children:["\n",(0,s.jsxs)(n.p,{children:["Install K3s using the ",(0,s.jsx)(n.code,{children:"--docker"})," option:"]}),"\n",(0,s.jsx)(n.pre,{children:(0,s.jsx)(n.code,{className:"language-bash",children:"curl -sfL https://get.k3s.io | sh -s - --docker\n"})}),"\n"]}),"\n",(0,s.jsxs)(n.li,{children:["\n",(0,s.jsx)(n.p,{children:"Confirm that the cluster is available:"}),"\n",(0,s.jsx)(n.pre,{children:(0,s.jsx)(n.code,{className:"language-bash",children:"$ sudo k3s kubectl get pods --all-namespaces\nNAMESPACE NAME READY STATUS RESTARTS AGE\nkube-system local-path-provisioner-6d59f47c7-lncxn 1/1 Running 0 51s\nkube-system metrics-server-7566d596c8-9tnck 1/1 Running 0 51s\nkube-system helm-install-traefik-mbkn9 0/1 Completed 1 51s\nkube-system coredns-8655855d6-rtbnb 1/1 Running 0 51s\nkube-system svclb-traefik-jbmvl 2/2 Running 0 43s\nkube-system traefik-758cd5fc85-2wz97 1/1 Running 0 43s\n"})}),"\n"]}),"\n",(0,s.jsxs)(n.li,{children:["\n",(0,s.jsx)(n.p,{children:"Confirm that the Docker containers are running:"}),"\n",(0,s.jsx)(n.pre,{children:(0,s.jsx)(n.code,{className:"language-bash",children:'$ sudo docker ps\nCONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES\n3e4d34729602 897ce3c5fc8f "entry" About a minute ago Up About a minute k8s_lb-port-443_svclb-traefik-jbmvl_kube-system_d46f10c6-073f-4c7e-8d7a-8e7ac18f9cb0_0\nbffdc9d7a65f rancher/klipper-lb "entry" About a minute ago Up About a minute k8s_lb-port-80_svclb-traefik-jbmvl_kube-system_d46f10c6-073f-4c7e-8d7a-8e7ac18f9cb0_0\n436b85c5e38d rancher/library-traefik "/traefik --configfi\u2026" About a minute ago Up About a minute k8s_traefik_traefik-758cd5fc85-2wz97_kube-system_07abe831-ffd6-4206-bfa1-7c9ca4fb39e7_0\nde8fded06188 rancher/pause:3.1 "/pause" About a minute ago Up About a minute k8s_POD_svclb-traefik-jbmvl_kube-system_d46f10c6-073f-4c7e-8d7a-8e7ac18f9cb0_0\n7c6a30aeeb2f rancher/pause:3.1 "/pause" About a minute ago Up About a minute k8s_POD_traefik-758cd5fc85-2wz97_kube-system_07abe831-ffd6-4206-bfa1-7c9ca4fb39e7_0\nae6c58cab4a7 9d12f9848b99 "local-path-provisio\u2026" About a minute ago Up About a minute k8s_local-path-provisioner_local-path-provisioner-6d59f47c7-lncxn_kube-system_2dbd22bf-6ad9-4bea-a73d-620c90a6c1c1_0\nbe1450e1a11e 9dd718864ce6 "/metrics-server" About a minute ago Up About a minute k8s_metrics-server_metrics-server-7566d596c8-9tnck_kube-system_031e74b5-e9ef-47ef-a88d-fbf3f726cbc6_0\n4454d14e4d3f c4d3d16fe508 "/coredns -conf /etc\u2026" About a minute ago Up About a minute k8s_coredns_coredns-8655855d6-rtbnb_kube-system_d05725df-4fb1-410a-8e82-2b1c8278a6a1_0\nc3675b87f96c rancher/pause:3.1 "/pause" About a minute ago Up About a minute k8s_POD_coredns-8655855d6-rtbnb_kube-system_d05725df-4fb1-410a-8e82-2b1c8278a6a1_0\n4b1fddbe6ca6 rancher/pause:3.1 "/pause" About a minute ago Up About a minute k8s_POD_local-path-provisioner-6d59f47c7-lncxn_kube-system_2dbd22bf-6ad9-4bea-a73d-620c90a6c1c1_0\n64d3517d4a95 rancher/pause:3.1 "/pause"\n'})}),"\n"]}),"\n"]}),"\n",(0,s.jsx)(n.h2,{id:"using-etcdctl",children:"Using etcdctl"}),"\n",(0,s.jsx)(n.p,{children:"etcdctl provides a CLI for interacting with etcd servers. K3s does not bundle etcdctl."}),"\n",(0,s.jsxs)(n.p,{children:["If you would like to use etcdctl to interact with K3s's embedded etcd, install etcdctl using the ",(0,s.jsx)(n.a,{href:"https://etcd.io/docs/latest/install/",children:"official documentation"}),"."]}),"\n",(0,s.jsx)(n.pre,{children:(0,s.jsx)(n.code,{className:"language-bash",children:'ETCD_VERSION="v3.5.5"\nETCD_URL="https://github.com/etcd-io/etcd/releases/download/${ETCD_VERSION}/etcd-${ETCD_VERSION}-linux-amd64.tar.gz"\ncurl -sL ${ETCD_URL} | sudo tar -zxv --strip-components=1 -C /usr/local/bin\n'})}),"\n",(0,s.jsx)(n.p,{children:"You may then use etcdctl by configuring it to use the K3s-managed certificates and keys for authentication:"}),"\n",(0,s.jsx)(n.pre,{children:(0,s.jsx)(n.code,{className:"language-bash",children:"sudo etcdctl version \\\n --cacert=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt \\\n --cert=/var/lib/rancher/k3s/server/tls/etcd/client.crt \\\n --key=/var/lib/rancher/k3s/server/tls/etcd/client.key\n"})}),"\n",(0,s.jsx)(n.h2,{id:"configuring-containerd",children:"Configuring containerd"}),"\n",(0,s.jsxs)(n.p,{children:["K3s will generate config.toml for containerd in ",(0,s.jsx)(n.code,{children:"/var/lib/rancher/k3s/agent/etc/containerd/config.toml"}),"."]}),"\n",(0,s.jsxs)(n.p,{children:["For advanced customization for this file you can create another file called ",(0,s.jsx)(n.code,{children:"config.toml.tmpl"})," in the same directory, and it will be used instead."]}),"\n",(0,s.jsxs)(n.p,{children:["The ",(0,s.jsx)(n.code,{children:"config.toml.tmpl"})," will be treated as a Go template file, and the ",(0,s.jsx)(n.code,{children:"config.Node"})," structure is being passed to the template. See ",(0,s.jsx)(n.a,{href:"https://github.com/k3s-io/k3s/blob/master/pkg/agent/templates",children:"this folder"})," for Linux and Windows examples on how to use the structure to customize the configuration file.\nThe config.Node golang struct is defined ",(0,s.jsx)(n.a,{href:"https://github.com/k3s-io/k3s/blob/master/pkg/daemons/config/types.go#L37",children:"here"})]}),"\n",(0,s.jsx)(n.h3,{id:"base-template",children:"Base template"}),"\n",(0,s.jsx)(n.admonition,{title:"Version Gate",type:"info",children:(0,s.jsx)(n.p,{children:"Available as of September 2023 releases: v1.24.17+k3s1, v1.25.13+k3s1, v1.26.8+k3s1, v1.27.5+k3s1, v1.28.1+k3s1"})}),"\n",(0,s.jsx)(n.p,{children:"You can extend the K3s base template instead of copy-pasting the complete stock template out of the K3s source code. This is useful if you need to build on the existing configuration, and add a few extra lines at the end."}),"\n",(0,s.jsx)(n.pre,{children:(0,s.jsx)(n.code,{className:"language-toml",children:'#/var/lib/rancher/k3s/agent/etc/containerd/config.toml.tmpl\n\n{{ template "base" . }}\n\n[plugins."io.containerd.grpc.v1.cri".containerd.runtimes."custom"]\n runtime_type = "io.containerd.runc.v2"\n[plugins."io.containerd.grpc.v1.cri".containerd.runtimes."custom".options]\n BinaryName = "/usr/bin/custom-container-runtime"\n\n'})}),"\n",(0,s.jsx)(n.h2,{id:"nvidia-container-runtime-support",children:"NVIDIA Container Runtime Support"}),"\n",(0,s.jsx)(n.p,{children:"K3s will automatically detect and configure the NVIDIA container runtime if it is present when K3s starts."}),"\n",(0,s.jsxs)(n.ol,{children:["\n",(0,s.jsxs)(n.li,{children:["Install the nvidia-container package repository on the node by following the instructions at:\n",(0,s.jsx)(n.a,{href:"https://nvidia.github.io/libnvidia-container/",children:"https://nvidia.github.io/libnvidia-container/"})]}),"\n",(0,s.jsxs)(n.li,{children:["Install the nvidia container runtime packages. For example:\n",(0,s.jsx)(n.code,{children:"apt install -y nvidia-container-runtime cuda-drivers-fabricmanager-515 nvidia-headless-515-server"})]}),"\n",(0,s.jsxs)(n.li,{children:["Install K3s, or restart it if already installed:\n",(0,s.jsx)(n.code,{children:"curl -ksL get.k3s.io | sh -"})]}),"\n",(0,s.jsxs)(n.li,{children:["Confirm that the nvidia container runtime has been found by k3s:\n",(0,s.jsx)(n.code,{children:"grep nvidia /var/lib/rancher/k3s/agent/etc/containerd/config.toml"})]}),"\n"]}),"\n",(0,s.jsxs)(n.p,{children:["This will automatically add ",(0,s.jsx)(n.code,{children:"nvidia"})," and/or ",(0,s.jsx)(n.code,{children:"nvidia-experimental"})," runtimes to the containerd configuration, depending on what runtime executables are found.\nYou must still add a RuntimeClass definition to your cluster, and deploy Pods that explicitly request the appropriate runtime by setting ",(0,s.jsx)(n.code,{children:"runtimeClassName: nvidia"})," in the Pod spec:"]}),"\n",(0,s.jsx)(n.pre,{children:(0,s.jsx)(n.code,{className:"language-yaml",children:'apiVersion: node.k8s.io/v1\nkind: RuntimeClass\nmetadata:\n name: nvidia\nhandler: nvidia\n---\napiVersion: v1\nkind: Pod\nmetadata:\n name: nbody-gpu-benchmark\n namespace: default\nspec:\n restartPolicy: OnFailure\n runtimeClassName: nvidia\n containers:\n - name: cuda-container\n image: nvcr.io/nvidia/k8s/cuda-sample:nbody\n args: ["nbody", "-gpu", "-benchmark"]\n resources:\n limits:\n nvidia.com/gpu: 1\n env:\n - name: NVIDIA_VISIBLE_DEVICES\n value: all\n - name: NVIDIA_DRIVER_CAPABILITIES\n value: all\n'})}),"\n",(0,s.jsxs)(n.p,{children:["Note that the NVIDIA Container Runtime is also frequently used with ",(0,s.jsx)(n.a,{href:"https://github.com/NVIDIA/k8s-device-plugin/",children:"NVIDIA Device Plugin"}),", with modifications to ensure that pod specs include ",(0,s.jsx)(n.code,{children:"runtimeClassName: nvidia"}),", as mentioned above."]}),"\n",(0,s.jsx)(n.h2,{id:"running-agentless-servers-experimental",children:"Running Agentless Servers (Experimental)"}),"\n",(0,s.jsxs)(n.blockquote,{children:["\n",(0,s.jsxs)(n.p,{children:[(0,s.jsx)(n.strong,{children:"Warning:"})," This feature is experimental."]}),"\n"]}),"\n",(0,s.jsxs)(n.p,{children:["When started with the ",(0,s.jsx)(n.code,{children:"--disable-agent"})," flag, servers do not run the kubelet, container runtime, or CNI. They do not register a Node resource in the cluster, and will not appear in ",(0,s.jsx)(n.code,{children:"kubectl get nodes"})," output.\nBecause they do not host a kubelet, they cannot run pods or be managed by operators that rely on enumerating cluster nodes, including the embedded etcd controller and the system upgrade controller."]}),"\n",(0,s.jsx)(n.p,{children:"Running agentless servers may be advantageous if you want to obscure your control-plane nodes from discovery by agents and workloads, at the cost of increased administrative overhead caused by lack of cluster operator support."}),"\n",(0,s.jsxs)(n.p,{children:["By default, the apiserver on agentless servers will not be able to make outgoing connections to admission webhooks or aggregated apiservices running within the cluster. To remedy this, set the ",(0,s.jsx)(n.code,{children:"--egress-selector-mode"})," server flag to either ",(0,s.jsx)(n.code,{children:"pod"})," or ",(0,s.jsx)(n.code,{children:"cluster"}),". If you are changing this flag on an existing cluster, you'll need to restart all nodes in the cluster for the option to take effect."]}),"\n",(0,s.jsx)(n.h2,{id:"running-rootless-servers-experimental",children:"Running Rootless Servers (Experimental)"}),"\n",(0,s.jsxs)(n.blockquote,{children:["\n",(0,s.jsxs)(n.p,{children:[(0,s.jsx)(n.strong,{children:"Warning:"})," This feature is experimental."]}),"\n"]}),"\n",(0,s.jsx)(n.p,{children:"Rootless mode allows running K3s servers as an unprivileged user, so as to protect the real root on the host from potential container-breakout attacks."}),"\n",(0,s.jsxs)(n.p,{children:["See ",(0,s.jsx)(n.a,{href:"https://rootlesscontaine.rs/",children:"https://rootlesscontaine.rs/"})," to learn more about Rootless Kubernetes."]}),"\n",(0,s.jsx)(n.h3,{id:"known-issues-with-rootless-mode",children:"Known Issues with Rootless mode"}),"\n",(0,s.jsxs)(n.ul,{children:["\n",(0,s.jsxs)(n.li,{children:["\n",(0,s.jsx)(n.p,{children:(0,s.jsx)(n.strong,{children:"Ports"})}),"\n",(0,s.jsx)(n.p,{children:"When running rootless a new network namespace is created. This means that K3s instance is running with networking fairly detached from the host.\nThe only way to access Services run in K3s from the host is to set up port forwards to the K3s network namespace.\nRootless K3s includes controller that will automatically bind 6443 and service ports below 1024 to the host with an offset of 10000."}),"\n",(0,s.jsx)(n.p,{children:"For example, a Service on port 80 will become 10080 on the host, but 8080 will become 8080 without any offset. Currently, only LoadBalancer Services are automatically bound."}),"\n"]}),"\n",(0,s.jsxs)(n.li,{children:["\n",(0,s.jsx)(n.p,{children:(0,s.jsx)(n.strong,{children:"Cgroups"})}),"\n",(0,s.jsx)(n.p,{children:'Cgroup v1 and Hybrid v1/v2 are not supported; only pure Cgroup v2 is supported. If K3s fails to start due to missing cgroups when running rootless, it is likely that your node is in Hybrid mode, and the "missing" cgroups are still bound to a v1 controller.'}),"\n"]}),"\n",(0,s.jsxs)(n.li,{children:["\n",(0,s.jsx)(n.p,{children:(0,s.jsx)(n.strong,{children:"Multi-node/multi-process cluster"})}),"\n",(0,s.jsxs)(n.p,{children:["Multi-node rootless clusters, or multiple rootless k3s processes on the same node, are not currently supported. See ",(0,s.jsx)(n.a,{href:"https://github.com/k3s-io/k3s/issues/6488#issuecomment-1314998091",children:"#6488"})," for more details."]}),"\n"]}),"\n"]}),"\n",(0,s.jsx)(n.h3,{id:"starting-rootless-servers",children:"Starting Rootless Servers"}),"\n",(0,s.jsxs)(n.ul,{children:["\n",(0,s.jsxs)(n.li,{children:["\n",(0,s.jsxs)(n.p,{children:["Enable cgroup v2 delegation, see ",(0,s.jsx)(n.a,{href:"https://rootlesscontaine.rs/getting-started/common/cgroup2/",children:"https://rootlesscontaine.rs/getting-started/common/cgroup2/"})," .\nThis step is required; the rootless kubelet will fail to start without the proper cgroups delegated."]}),"\n"]}),"\n",(0,s.jsxs)(n.li,{children:["\n",(0,s.jsxs)(n.p,{children:["Download ",(0,s.jsx)(n.code,{children:"k3s-rootless.service"})," from ",(0,s.jsx)(n.a,{href:"https://github.com/k3s-io/k3s/blob/master/k3s-rootless.service",children:(0,s.jsx)(n.code,{children:"https://github.com/k3s-io/k3s/blob//k3s-rootless.service"})}),".\nMake sure to use the same version of ",(0,s.jsx)(n.code,{children:"k3s-rootless.service"})," and ",(0,s.jsx)(n.code,{children:"k3s"}),"."]}),"\n"]}),"\n",(0,s.jsxs)(n.li,{children:["\n",(0,s.jsxs)(n.p,{children:["Install ",(0,s.jsx)(n.code,{children:"k3s-rootless.service"})," to ",(0,s.jsx)(n.code,{children:"~/.config/systemd/user/k3s-rootless.service"}),".\nInstalling this file as a system-wide service (",(0,s.jsx)(n.code,{children:"/etc/systemd/..."}),") is not supported.\nDepending on the path of ",(0,s.jsx)(n.code,{children:"k3s"})," binary, you might need to modify the ",(0,s.jsx)(n.code,{children:"ExecStart=/usr/local/bin/k3s ..."})," line of the file."]}),"\n"]}),"\n",(0,s.jsxs)(n.li,{children:["\n",(0,s.jsxs)(n.p,{children:["Run ",(0,s.jsx)(n.code,{children:"systemctl --user daemon-reload"})]}),"\n"]}),"\n",(0,s.jsxs)(n.li,{children:["\n",(0,s.jsxs)(n.p,{children:["Run ",(0,s.jsx)(n.code,{children:"systemctl --user enable --now k3s-rootless"})]}),"\n"]}),"\n",(0,s.jsxs)(n.li,{children:["\n",(0,s.jsxs)(n.p,{children:["Run ",(0,s.jsx)(n.code,{children:"KUBECONFIG=~/.kube/k3s.yaml kubectl get pods -A"}),", and make sure the pods are running."]}),"\n"]}),"\n"]}),"\n",(0,s.jsxs)(n.blockquote,{children:["\n",(0,s.jsxs)(n.p,{children:[(0,s.jsx)(n.strong,{children:"Note:"})," Don't try to run ",(0,s.jsx)(n.code,{children:"k3s server --rootless"})," on a terminal, as terminal sessions do not allow cgroup v2 delegation.\nIf you really need to try it on a terminal, use ",(0,s.jsx)(n.code,{children:"systemd-run --user -p Delegate=yes --tty k3s server --rootless"})," to wrap it in a systemd scope."]}),"\n"]}),"\n",(0,s.jsx)(n.h3,{id:"advanced-rootless-configuration",children:"Advanced Rootless Configuration"}),"\n",(0,s.jsxs)(n.p,{children:["Rootless K3s uses ",(0,s.jsx)(n.a,{href:"https://github.com/rootless-containers/rootlesskit",children:"rootlesskit"})," and ",(0,s.jsx)(n.a,{href:"https://github.com/rootless-containers/slirp4netns",children:"slirp4netns"})," to communicate between host and user network namespaces.\nSome of the configuration used by rootlesskit and slirp4nets can be set by environment variables. The best way to set these is to add them to the ",(0,s.jsx)(n.code,{children:"Environment"})," field of the k3s-rootless systemd unit."]}),"\n",(0,s.jsxs)(n.table,{children:[(0,s.jsx)(n.thead,{children:(0,s.jsxs)(n.tr,{children:[(0,s.jsx)(n.th,{children:"Variable"}),(0,s.jsx)(n.th,{children:"Default"}),(0,s.jsx)(n.th,{children:"Description"})]})}),(0,s.jsxs)(n.tbody,{children:[(0,s.jsxs)(n.tr,{children:[(0,s.jsx)(n.td,{children:(0,s.jsx)(n.code,{children:"K3S_ROOTLESS_MTU"})}),(0,s.jsx)(n.td,{children:"1500"}),(0,s.jsx)(n.td,{children:"Sets the MTU for the slirp4netns virtual interfaces."})]}),(0,s.jsxs)(n.tr,{children:[(0,s.jsx)(n.td,{children:(0,s.jsx)(n.code,{children:"K3S_ROOTLESS_CIDR"})}),(0,s.jsx)(n.td,{children:"10.41.0.0/16"}),(0,s.jsx)(n.td,{children:"Sets the CIDR used by slirp4netns virtual interfaces."})]}),(0,s.jsxs)(n.tr,{children:[(0,s.jsx)(n.td,{children:(0,s.jsx)(n.code,{children:"K3S_ROOTLESS_ENABLE_IPV6"})}),(0,s.jsx)(n.td,{children:"autotedected"}),(0,s.jsx)(n.td,{children:"Enables slirp4netns IPv6 support. If not specified, it is automatically enabled if K3s is configured for dual-stack operation."})]}),(0,s.jsxs)(n.tr,{children:[(0,s.jsx)(n.td,{children:(0,s.jsx)(n.code,{children:"K3S_ROOTLESS_PORT_DRIVER"})}),(0,s.jsx)(n.td,{children:"builtin"}),(0,s.jsxs)(n.td,{children:["Selects the rootless port driver; either ",(0,s.jsx)(n.code,{children:"builtin"})," or ",(0,s.jsx)(n.code,{children:"slirp4netns"}),". Builtin is faster, but masquerades the original source address of inbound packets."]})]}),(0,s.jsxs)(n.tr,{children:[(0,s.jsx)(n.td,{children:(0,s.jsx)(n.code,{children:"K3S_ROOTLESS_DISABLE_HOST_LOOPBACK"})}),(0,s.jsx)(n.td,{children:"true"}),(0,s.jsx)(n.td,{children:"Controls whether or not access to the hosts's loopback address via the gateway interface is enabled. It is recommended that this not be changed, for security reasons."})]})]})]}),"\n",(0,s.jsx)(n.h3,{id:"troubleshooting-rootless",children:"Troubleshooting Rootless"}),"\n",(0,s.jsxs)(n.ul,{children:["\n",(0,s.jsxs)(n.li,{children:["Run ",(0,s.jsx)(n.code,{children:"systemctl --user status k3s-rootless"})," to check the daemon status"]}),"\n",(0,s.jsxs)(n.li,{children:["Run ",(0,s.jsx)(n.code,{children:"journalctl --user -f -u k3s-rootless"})," to see the daemon log"]}),"\n",(0,s.jsxs)(n.li,{children:["See also ",(0,s.jsx)(n.a,{href:"https://rootlesscontaine.rs/",children:"https://rootlesscontaine.rs/"})]}),"\n"]}),"\n",(0,s.jsx)(n.h2,{id:"node-labels-and-taints",children:"Node Labels and Taints"}),"\n",(0,s.jsxs)(n.p,{children:["K3s agents can be configured with the options ",(0,s.jsx)(n.code,{children:"--node-label"})," and ",(0,s.jsx)(n.code,{children:"--node-taint"})," which adds a label and taint to the kubelet. The two options only add labels and/or taints ",(0,s.jsx)(n.a,{href:"/cli/agent#node-labels-and-taints-for-agents",children:"at registration time"}),", so they can only be set when the node is first joined to the cluster."]}),"\n",(0,s.jsxs)(n.p,{children:["All current versions of Kubernetes restrict nodes from registering with most labels with ",(0,s.jsx)(n.code,{children:"kubernetes.io"})," and ",(0,s.jsx)(n.code,{children:"k8s.io"})," prefixes, specifically including the ",(0,s.jsx)(n.code,{children:"kubernetes.io/role"})," label. If you attempt to start a node with a disallowed label, K3s will fail to start. As stated by the Kubernetes authors:"]}),"\n",(0,s.jsxs)(n.blockquote,{children:["\n",(0,s.jsx)(n.p,{children:"Nodes are not permitted to assert their own role labels. Node roles are typically used to identify privileged or control plane types of nodes, and allowing nodes to label themselves into that pool allows a compromised node to trivially attract workloads (like control plane daemonsets) that confer access to higher privilege credentials."}),"\n"]}),"\n",(0,s.jsxs)(n.p,{children:["See ",(0,s.jsx)(n.a,{href:"https://github.com/kubernetes/enhancements/blob/master/keps/sig-auth/279-limit-node-access/README.md#proposal",children:"SIG-Auth KEP 279"})," for more information."]}),"\n",(0,s.jsxs)(n.p,{children:["If you want to change node labels and taints after node registration, or add reserved labels, you should use ",(0,s.jsx)(n.code,{children:"kubectl"}),". Refer to the official Kubernetes documentation for details on how to add ",(0,s.jsx)(n.a,{href:"https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/",children:"taints"})," and ",(0,s.jsx)(n.a,{href:"https://kubernetes.io/docs/tasks/configure-pod-container/assign-pods-nodes/#add-a-label-to-a-node",children:"node labels."})]}),"\n",(0,s.jsx)(n.h2,{id:"starting-the-service-with-the-installation-script",children:"Starting the Service with the Installation Script"}),"\n",(0,s.jsx)(n.p,{children:"The installation script will auto-detect if your OS is using systemd or openrc and enable and start the service as part of the installation process."}),"\n",(0,s.jsxs)(n.ul,{children:["\n",(0,s.jsxs)(n.li,{children:["When running with openrc, logs will be created at ",(0,s.jsx)(n.code,{children:"/var/log/k3s.log"}),"."]}),"\n",(0,s.jsxs)(n.li,{children:["When running with systemd, logs will be created in ",(0,s.jsx)(n.code,{children:"/var/log/syslog"})," and viewed using ",(0,s.jsx)(n.code,{children:"journalctl -u k3s"})," (or ",(0,s.jsx)(n.code,{children:"journalctl -u k3s-agent"})," on agents)."]}),"\n"]}),"\n",(0,s.jsx)(n.p,{children:"An example of disabling auto-starting and service enablement with the install script:"}),"\n",(0,s.jsx)(n.pre,{children:(0,s.jsx)(n.code,{className:"language-bash",children:"curl -sfL https://get.k3s.io | INSTALL_K3S_SKIP_START=true INSTALL_K3S_SKIP_ENABLE=true sh -\n"})}),"\n",(0,s.jsx)(n.h2,{id:"running-k3s-in-docker",children:"Running K3s in Docker"}),"\n",(0,s.jsx)(n.p,{children:"There are several ways to run K3s in Docker:"}),"\n",(0,s.jsxs)(r,{children:[(0,s.jsxs)(t,{value:"K3d",default:!0,children:[(0,s.jsxs)(n.p,{children:[(0,s.jsx)(n.a,{href:"https://github.com/k3d-io/k3d",children:"k3d"})," is a utility designed to easily run multi-node K3s clusters in Docker."]}),(0,s.jsx)(n.p,{children:"k3d makes it very easy to create single- and multi-node k3s clusters in docker, e.g. for local development on Kubernetes."}),(0,s.jsxs)(n.p,{children:["See the ",(0,s.jsx)(n.a,{href:"https://k3d.io/#installation",children:"Installation"})," documentation for more information on how to install and use k3d."]})]}),(0,s.jsxs)(t,{value:"Docker",children:[(0,s.jsxs)(n.p,{children:["To use Docker, ",(0,s.jsx)(n.code,{children:"rancher/k3s"})," images are also available to run the K3s server and agent.\nUsing the ",(0,s.jsx)(n.code,{children:"docker run"})," command:"]}),(0,s.jsx)(n.pre,{children:(0,s.jsx)(n.code,{className:"language-bash",children:"sudo docker run \\\n --privileged \\\n --name k3s-server-1 \\\n --hostname k3s-server-1 \\\n -p 6443:6443 \\\n -d rancher/k3s:v1.24.10-k3s1 \\\n server\n"})}),(0,s.jsx)(n.admonition,{type:"note",children:(0,s.jsxs)(n.p,{children:["You must specify a valid K3s version as the tag; the ",(0,s.jsx)(n.code,{children:"latest"})," tag is not maintained.",(0,s.jsx)(n.br,{}),"\n","Docker images do not allow a ",(0,s.jsx)(n.code,{children:"+"})," sign in tags, use a ",(0,s.jsx)(n.code,{children:"-"})," in the tag instead."]})}),(0,s.jsx)(n.p,{children:"Once K3s is up and running, you can copy the admin kubeconfig out of the Docker container for use:"}),(0,s.jsx)(n.pre,{children:(0,s.jsx)(n.code,{className:"language-bash",children:"sudo docker cp k3s-server-1:/etc/rancher/k3s/k3s.yaml ~/.kube/config\n"})})]})]}),"\n",(0,s.jsx)(n.h2,{id:"selinux-support",children:"SELinux Support"}),"\n",(0,s.jsx)(n.admonition,{title:"Version Gate",type:"info",children:(0,s.jsx)(n.p,{children:"Available as of v1.19.4+k3s1"})}),"\n",(0,s.jsx)(n.p,{children:"If you are installing K3s on a system where SELinux is enabled by default (such as CentOS), you must ensure the proper SELinux policies have been installed."}),"\n",(0,s.jsxs)(r,{children:[(0,s.jsx)(t,{value:"Automatic Installation",default:!0,children:(0,s.jsxs)(n.p,{children:["The ",(0,s.jsx)(n.a,{href:"/installation/configuration#configuration-with-install-script",children:"install script"})," will automatically install the SELinux RPM from the Rancher RPM repository if on a compatible system if not performing an air-gapped install. Automatic installation can be skipped by setting ",(0,s.jsx)(n.code,{children:"INSTALL_K3S_SKIP_SELINUX_RPM=true"}),"."]})}),(0,s.jsxs)(t,{value:"Manual Installation",default:!0,children:[(0,s.jsx)(n.p,{children:"The necessary policies can be installed with the following commands:"}),(0,s.jsx)(n.pre,{children:(0,s.jsx)(n.code,{className:"language-bash",children:"yum install -y container-selinux selinux-policy-base\nyum install -y https://rpm.rancher.io/k3s/latest/common/centos/7/noarch/k3s-selinux-1.4-1.el7.noarch.rpm\n"})}),(0,s.jsxs)(n.p,{children:["To force the install script to log a warning rather than fail, you can set the following environment variable: ",(0,s.jsx)(n.code,{children:"INSTALL_K3S_SELINUX_WARN=true"}),"."]})]})]}),"\n",(0,s.jsx)(n.h3,{id:"enabling-selinux-enforcement",children:"Enabling SELinux Enforcement"}),"\n",(0,s.jsxs)(n.p,{children:["To leverage SELinux, specify the ",(0,s.jsx)(n.code,{children:"--selinux"})," flag when starting K3s servers and agents."]}),"\n",(0,s.jsxs)(n.p,{children:["This option can also be specified in the K3s ",(0,s.jsx)(n.a,{href:"/installation/configuration#configuration-file",children:"configuration file"}),"."]}),"\n",(0,s.jsx)(n.pre,{children:(0,s.jsx)(n.code,{children:"selinux: true\n"})}),"\n",(0,s.jsxs)(n.p,{children:["Using a custom ",(0,s.jsx)(n.code,{children:"--data-dir"})," under SELinux is not supported. To customize it, you would most likely need to write your own custom policy. For guidance, you could refer to the ",(0,s.jsx)(n.a,{href:"https://github.com/containers/container-selinux",children:"containers/container-selinux"})," repository, which contains the SELinux policy files for Container Runtimes, and the ",(0,s.jsx)(n.a,{href:"https://github.com/k3s-io/k3s-selinux",children:"k3s-io/k3s-selinux"})," repository, which contains the SELinux policy for K3s."]}),"\n",(0,s.jsx)(n.h2,{id:"enabling-lazy-pulling-of-estargz-experimental",children:"Enabling Lazy Pulling of eStargz (Experimental)"}),"\n",(0,s.jsx)(n.h3,{id:"whats-lazy-pulling-and-estargz",children:"What's lazy pulling and eStargz?"}),"\n",(0,s.jsxs)(n.p,{children:["Pulling images is known as one of the time-consuming steps in the container lifecycle.\nAccording to ",(0,s.jsx)(n.a,{href:"https://www.usenix.org/conference/fast16/technical-sessions/presentation/harter",children:"Harter, et al."}),","]}),"\n",(0,s.jsxs)(n.blockquote,{children:["\n",(0,s.jsx)(n.p,{children:"pulling packages accounts for 76% of container start time, but only 6.4% of that data is read"}),"\n"]}),"\n",(0,s.jsxs)(n.p,{children:["To address this issue, k3s experimentally supports ",(0,s.jsx)(n.em,{children:"lazy pulling"})," of image contents.\nThis allows k3s to start a container before the entire image has been pulled.\nInstead, the necessary chunks of contents (e.g. individual files) are fetched on-demand.\nEspecially for large images, this technique can shorten the container startup latency."]}),"\n",(0,s.jsxs)(n.p,{children:["To enable lazy pulling, the target image needs to be formatted as ",(0,s.jsx)(n.a,{href:"https://github.com/containerd/stargz-snapshotter/blob/main/docs/stargz-estargz.md",children:(0,s.jsx)(n.em,{children:"eStargz"})}),".\nThis is an OCI-alternative but 100% OCI-compatible image format for lazy pulling.\nBecause of the compatibility, eStargz can be pushed to standard container registries (e.g. ghcr.io) as well as this is ",(0,s.jsx)(n.em,{children:"still runnable"})," even on eStargz-agnostic runtimes."]}),"\n",(0,s.jsxs)(n.p,{children:["eStargz is developed based on the ",(0,s.jsx)(n.a,{href:"https://github.com/google/crfs",children:"stargz format proposed by Google CRFS project"})," but comes with practical features including content verification and performance optimization.\nFor more details about lazy pulling and eStargz, please refer to ",(0,s.jsx)(n.a,{href:"https://github.com/containerd/stargz-snapshotter",children:"Stargz Snapshotter project repository"}),"."]}),"\n",(0,s.jsx)(n.h3,{id:"configure-k3s-for-lazy-pulling-of-estargz",children:"Configure k3s for lazy pulling of eStargz"}),"\n",(0,s.jsxs)(n.p,{children:["As shown in the following, ",(0,s.jsx)(n.code,{children:"--snapshotter=stargz"})," option is needed for k3s server and agent."]}),"\n",(0,s.jsx)(n.pre,{children:(0,s.jsx)(n.code,{className:"language-bash",children:"k3s server --snapshotter=stargz\n"})}),"\n",(0,s.jsxs)(n.p,{children:["With this configuration, you can perform lazy pulling for eStargz-formatted images.\nThe following example Pod manifest uses eStargz-formatted ",(0,s.jsx)(n.code,{children:"node:13.13.0"})," image (",(0,s.jsx)(n.code,{children:"ghcr.io/stargz-containers/node:13.13.0-esgz"}),").\nWhen the stargz snapshotter is enabled, K3s performs lazy pulling for this image."]}),"\n",(0,s.jsx)(n.pre,{children:(0,s.jsx)(n.code,{className:"language-yaml",children:"apiVersion: v1\nkind: Pod\nmetadata:\n name: nodejs\nspec:\n containers:\n - name: nodejs-estargz\n image: ghcr.io/stargz-containers/node:13.13.0-esgz\n command: [\"node\"]\n args:\n - -e\n - var http = require('http');\n http.createServer(function(req, res) {\n res.writeHead(200);\n res.end('Hello World!\\n');\n }).listen(80);\n ports:\n - containerPort: 80\n"})}),"\n",(0,s.jsx)(n.h2,{id:"additional-logging-sources",children:"Additional Logging Sources"}),"\n",(0,s.jsxs)(n.p,{children:[(0,s.jsx)(n.a,{href:"https://rancher.com/docs/rancher/v2.6/en/logging/helm-chart-options/",children:"Rancher logging"})," for K3s can be installed without using Rancher. The following instructions should be executed to do so:"]}),"\n",(0,s.jsx)(n.pre,{children:(0,s.jsx)(n.code,{className:"language-bash",children:"helm repo add rancher-charts https://charts.rancher.io\nhelm repo update\nhelm install --create-namespace -n cattle-logging-system rancher-logging-crd rancher-charts/rancher-logging-crd\nhelm install --create-namespace -n cattle-logging-system rancher-logging --set additionalLoggingSources.k3s.enabled=true rancher-charts/rancher-logging\n"})}),"\n",(0,s.jsx)(n.h2,{id:"additional-network-policy-logging",children:"Additional Network Policy Logging"}),"\n",(0,s.jsx)(n.p,{children:"Packets dropped by network policies can be logged. The packet is sent to the iptables NFLOG action, which shows the packet details, including the network policy that blocked it."}),"\n",(0,s.jsxs)(n.p,{children:["If there is a lot of traffic, the number of log messages could be very high. To control the log rate on a per-policy basis, set the ",(0,s.jsx)(n.code,{children:"limit"})," and ",(0,s.jsx)(n.code,{children:"limit-burst"})," iptables parameters by adding the following annotations to the network policy in question:"]}),"\n",(0,s.jsxs)(n.ul,{children:["\n",(0,s.jsx)(n.li,{children:(0,s.jsx)(n.code,{children:"kube-router.io/netpol-nflog-limit="})}),"\n",(0,s.jsx)(n.li,{children:(0,s.jsx)(n.code,{children:"kube-router.io/netpol-nflog-limit-burst="})}),"\n"]}),"\n",(0,s.jsxs)(n.p,{children:["Default values are ",(0,s.jsx)(n.code,{children:"limit=10/minute"})," and ",(0,s.jsx)(n.code,{children:"limit-burst=10"}),". Check the ",(0,s.jsx)(n.a,{href:"https://www.netfilter.org/documentation/HOWTO/packet-filtering-HOWTO-7.html#:~:text=restrict%20the%20rate%20of%20matches",children:"iptables manual"})," for more information on the format and possible values for these fields."]}),"\n",(0,s.jsxs)(n.p,{children:["To convert NFLOG packets to log entries, install ulogd2 and configure ",(0,s.jsx)(n.code,{children:"[log1]"})," to read on ",(0,s.jsx)(n.code,{children:"group=100"}),". Then, restart the ulogd2 service for the new config to be committed.\nWhen a packet is blocked by network policy rules, a log message will appear in ",(0,s.jsx)(n.code,{children:"/var/log/ulog/syslogemu.log"}),"."]}),"\n",(0,s.jsx)(n.p,{children:"Packets sent to the NFLOG netlink socket can also be read by using command-line tools like tcpdump or tshark:"}),"\n",(0,s.jsx)(n.pre,{children:(0,s.jsx)(n.code,{className:"language-bash",children:"tcpdump -ni nflog:100\n"})}),"\n",(0,s.jsxs)(n.p,{children:["While more readily available, tcpdump will not show the name of the network policy that blocked the packet. Use wireshark's tshark command instead to display the full NFLOG packet header, including the ",(0,s.jsx)(n.code,{children:"nflog.prefix"})," field that contains the policy name."]})]})}function h(e={}){const{wrapper:n}={...(0,i.a)(),...e.components};return n?(0,s.jsx)(n,{...e,children:(0,s.jsx)(d,{...e})}):d(e)}function u(e,n){throw new Error("Expected "+(n?"component":"object")+" `"+e+"` to be defined: you likely forgot to import, pass, or provide it.")}},1151:(e,n,t)=>{t.d(n,{Z:()=>a,a:()=>o});var s=t(7294);const i={},r=s.createContext(i);function o(e){const n=s.useContext(r);return s.useMemo((function(){return"function"==typeof e?e(n):{...n,...e}}),[n,e])}function a(e){let n;return n=e.disableParentContext?"function"==typeof e.components?e.components(i):e.components||i:o(e.components),s.createElement(r.Provider,{value:n},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/41765d36.ed40d505.js b/assets/js/41765d36.d40b96ba.js similarity index 99% rename from assets/js/41765d36.ed40d505.js rename to assets/js/41765d36.d40b96ba.js index 13a323a9a..a5a4f549e 100644 --- a/assets/js/41765d36.ed40d505.js +++ b/assets/js/41765d36.d40b96ba.js @@ -1 +1 @@ -"use strict";(self.webpackChunkk_3_s_docs=self.webpackChunkk_3_s_docs||[]).push([[1615],{99:(e,n,t)=>{t.r(n),t.d(n,{assets:()=>i,contentTitle:()=>r,default:()=>h,frontMatter:()=>s,metadata:()=>l,toc:()=>c});var a=t(5893),o=t(1151);const s={title:"Volumes and Storage"},r=void 0,l={id:"storage",title:"Volumes and Storage",description:"When deploying an application that needs to retain data, you\u2019ll need to create persistent storage. Persistent storage allows you to store application data external from the pod running your application. This storage practice allows you to maintain application data, even if the application\u2019s pod fails.",source:"@site/docs/storage.md",sourceDirName:".",slug:"/storage",permalink:"/storage",draft:!1,unlisted:!1,editUrl:"https://github.com/k3s-io/docs/edit/main/docs/storage.md",tags:[],version:"current",lastUpdatedAt:1723651727e3,frontMatter:{title:"Volumes and Storage"},sidebar:"mySidebar",previous:{title:"Cluster Access",permalink:"/cluster-access"},next:{title:"Networking",permalink:"/networking/"}},i={},c=[{value:"What's different about K3s storage?",id:"whats-different-about-k3s-storage",level:2},{value:"Setting up the Local Storage Provider",id:"setting-up-the-local-storage-provider",level:2},{value:"pvc.yaml",id:"pvcyaml",level:3},{value:"pod.yaml",id:"podyaml",level:3},{value:"Setting up Longhorn",id:"setting-up-longhorn",level:2},{value:"pvc.yaml",id:"pvcyaml-1",level:3},{value:"pod.yaml",id:"podyaml-1",level:3}];function d(e){const n={a:"a",admonition:"admonition",code:"code",h2:"h2",h3:"h3",li:"li",p:"p",pre:"pre",ul:"ul",...(0,o.a)(),...e.components};return(0,a.jsxs)(a.Fragment,{children:[(0,a.jsx)(n.p,{children:"When deploying an application that needs to retain data, you\u2019ll need to create persistent storage. Persistent storage allows you to store application data external from the pod running your application. This storage practice allows you to maintain application data, even if the application\u2019s pod fails."}),"\n",(0,a.jsxs)(n.p,{children:["A persistent volume (PV) is a piece of storage in the Kubernetes cluster, while a persistent volume claim (PVC) is a request for storage. For details on how PVs and PVCs work, refer to the official Kubernetes documentation on ",(0,a.jsx)(n.a,{href:"https://kubernetes.io/docs/concepts/storage/volumes/",children:"storage."})]}),"\n",(0,a.jsxs)(n.p,{children:["This page describes how to set up persistent storage with a local storage provider, or with ",(0,a.jsx)(n.a,{href:"#setting-up-longhorn",children:"Longhorn."})]}),"\n",(0,a.jsx)(n.h2,{id:"whats-different-about-k3s-storage",children:"What's different about K3s storage?"}),"\n",(0,a.jsx)(n.p,{children:'K3s removes several optional volume plugins and all built-in (sometimes referred to as "in-tree") cloud providers. We do this in order to achieve a smaller binary size and to avoid dependence on third-party cloud or data center technologies and services, which may not be available in many K3s use cases. We are able to do this because their removal affects neither core Kubernetes functionality nor conformance.'}),"\n",(0,a.jsx)(n.p,{children:"The following volume plugins have been removed from K3s:"}),"\n",(0,a.jsxs)(n.ul,{children:["\n",(0,a.jsx)(n.li,{children:"cephfs"}),"\n",(0,a.jsx)(n.li,{children:"fc"}),"\n",(0,a.jsx)(n.li,{children:"flocker"}),"\n",(0,a.jsx)(n.li,{children:"git_repo"}),"\n",(0,a.jsx)(n.li,{children:"glusterfs"}),"\n",(0,a.jsx)(n.li,{children:"portworx"}),"\n",(0,a.jsx)(n.li,{children:"quobyte"}),"\n",(0,a.jsx)(n.li,{children:"rbd"}),"\n",(0,a.jsx)(n.li,{children:"storageos"}),"\n"]}),"\n",(0,a.jsxs)(n.p,{children:["Both components have out-of-tree alternatives that can be used with K3s: The Kubernetes ",(0,a.jsx)(n.a,{href:"https://github.com/container-storage-interface/spec/blob/master/spec.md",children:"Container Storage Interface (CSI)"})," and ",(0,a.jsx)(n.a,{href:"https://kubernetes.io/docs/tasks/administer-cluster/running-cloud-controller/",children:"Cloud Provider Interface (CPI)"}),"."]}),"\n",(0,a.jsxs)(n.p,{children:["Kubernetes maintainers are actively migrating in-tree volume plugins to CSI drivers. For more information on this migration, please refer ",(0,a.jsx)(n.a,{href:"https://kubernetes.io/blog/2021/12/10/storage-in-tree-to-csi-migration-status-update/",children:"here"}),"."]}),"\n",(0,a.jsx)(n.h2,{id:"setting-up-the-local-storage-provider",children:"Setting up the Local Storage Provider"}),"\n",(0,a.jsxs)(n.p,{children:["K3s comes with Rancher's Local Path Provisioner and this enables the ability to create persistent volume claims out of the box using local storage on the respective node. Below we cover a simple example. For more information please reference the official documentation ",(0,a.jsx)(n.a,{href:"https://github.com/rancher/local-path-provisioner/blob/master/README.md#usage",children:"here"}),"."]}),"\n",(0,a.jsx)(n.p,{children:"Create a hostPath backed persistent volume claim and a pod to utilize it:"}),"\n",(0,a.jsx)(n.h3,{id:"pvcyaml",children:"pvc.yaml"}),"\n",(0,a.jsx)(n.pre,{children:(0,a.jsx)(n.code,{className:"language-yaml",children:"apiVersion: v1\nkind: PersistentVolumeClaim\nmetadata:\n name: local-path-pvc\n namespace: default\nspec:\n accessModes:\n - ReadWriteOnce\n storageClassName: local-path\n resources:\n requests:\n storage: 2Gi\n"})}),"\n",(0,a.jsx)(n.h3,{id:"podyaml",children:"pod.yaml"}),"\n",(0,a.jsx)(n.pre,{children:(0,a.jsx)(n.code,{className:"language-yaml",children:"apiVersion: v1\nkind: Pod\nmetadata:\n name: volume-test\n namespace: default\nspec:\n containers:\n - name: volume-test\n image: nginx:stable-alpine\n imagePullPolicy: IfNotPresent\n volumeMounts:\n - name: volv\n mountPath: /data\n ports:\n - containerPort: 80\n volumes:\n - name: volv\n persistentVolumeClaim:\n claimName: local-path-pvc\n"})}),"\n",(0,a.jsx)(n.p,{children:"Apply the yaml:"}),"\n",(0,a.jsx)(n.pre,{children:(0,a.jsx)(n.code,{className:"language-bash",children:"kubectl create -f pvc.yaml\nkubectl create -f pod.yaml\n"})}),"\n",(0,a.jsx)(n.p,{children:"Confirm the PV and PVC are created:"}),"\n",(0,a.jsx)(n.pre,{children:(0,a.jsx)(n.code,{className:"language-bash",children:"kubectl get pv\nkubectl get pvc\n"})}),"\n",(0,a.jsx)(n.p,{children:"The status should be Bound for each."}),"\n",(0,a.jsx)(n.h2,{id:"setting-up-longhorn",children:"Setting up Longhorn"}),"\n",(0,a.jsx)(n.admonition,{type:"warning",children:(0,a.jsx)(n.p,{children:"Longhorn does not support ARM32."})}),"\n",(0,a.jsxs)(n.p,{children:["K3s supports ",(0,a.jsx)(n.a,{href:"https://github.com/longhorn/longhorn",children:"Longhorn"}),", an open-source distributed block storage system for Kubernetes."]}),"\n",(0,a.jsxs)(n.p,{children:["Below we cover a simple example. For more information, refer to the ",(0,a.jsx)(n.a,{href:"https://longhorn.io/docs/latest/",children:"official documentation"}),"."]}),"\n",(0,a.jsx)(n.p,{children:"Apply the longhorn.yaml to install Longhorn:"}),"\n",(0,a.jsx)(n.pre,{children:(0,a.jsx)(n.code,{className:"language-bash",children:"kubectl apply -f https://raw.githubusercontent.com/longhorn/longhorn/v1.6.0/deploy/longhorn.yaml\n"})}),"\n",(0,a.jsxs)(n.p,{children:["Longhorn will be installed in the namespace ",(0,a.jsx)(n.code,{children:"longhorn-system"}),"."]}),"\n",(0,a.jsx)(n.p,{children:"Apply the yaml to create the PVC and pod:"}),"\n",(0,a.jsx)(n.pre,{children:(0,a.jsx)(n.code,{className:"language-bash",children:"kubectl create -f pvc.yaml\nkubectl create -f pod.yaml\n"})}),"\n",(0,a.jsx)(n.h3,{id:"pvcyaml-1",children:"pvc.yaml"}),"\n",(0,a.jsx)(n.pre,{children:(0,a.jsx)(n.code,{className:"language-yaml",children:"apiVersion: v1\nkind: PersistentVolumeClaim\nmetadata:\n name: longhorn-volv-pvc\nspec:\n accessModes:\n - ReadWriteOnce\n storageClassName: longhorn\n resources:\n requests:\n storage: 2Gi\n"})}),"\n",(0,a.jsx)(n.h3,{id:"podyaml-1",children:"pod.yaml"}),"\n",(0,a.jsx)(n.pre,{children:(0,a.jsx)(n.code,{className:"language-yaml",children:"apiVersion: v1\nkind: Pod\nmetadata:\n name: volume-test\n namespace: default\nspec:\n containers:\n - name: volume-test\n image: nginx:stable-alpine\n imagePullPolicy: IfNotPresent\n volumeMounts:\n - name: volv\n mountPath: /data\n ports:\n - containerPort: 80\n volumes:\n - name: volv\n persistentVolumeClaim:\n claimName: longhorn-volv-pvc\n"})}),"\n",(0,a.jsx)(n.p,{children:"Confirm the PV and PVC are created:"}),"\n",(0,a.jsx)(n.pre,{children:(0,a.jsx)(n.code,{className:"language-bash",children:"kubectl get pv\nkubectl get pvc\n"})}),"\n",(0,a.jsx)(n.p,{children:"The status should be Bound for each."})]})}function h(e={}){const{wrapper:n}={...(0,o.a)(),...e.components};return n?(0,a.jsx)(n,{...e,children:(0,a.jsx)(d,{...e})}):d(e)}},1151:(e,n,t)=>{t.d(n,{Z:()=>l,a:()=>r});var a=t(7294);const o={},s=a.createContext(o);function r(e){const n=a.useContext(s);return a.useMemo((function(){return"function"==typeof e?e(n):{...n,...e}}),[n,e])}function l(e){let n;return n=e.disableParentContext?"function"==typeof e.components?e.components(o):e.components||o:r(e.components),a.createElement(s.Provider,{value:n},e.children)}}}]); \ No newline at end of file +"use strict";(self.webpackChunkk_3_s_docs=self.webpackChunkk_3_s_docs||[]).push([[1615],{99:(e,n,t)=>{t.r(n),t.d(n,{assets:()=>i,contentTitle:()=>r,default:()=>h,frontMatter:()=>s,metadata:()=>l,toc:()=>c});var a=t(5893),o=t(1151);const s={title:"Volumes and Storage"},r=void 0,l={id:"storage",title:"Volumes and Storage",description:"When deploying an application that needs to retain data, you\u2019ll need to create persistent storage. Persistent storage allows you to store application data external from the pod running your application. This storage practice allows you to maintain application data, even if the application\u2019s pod fails.",source:"@site/docs/storage.md",sourceDirName:".",slug:"/storage",permalink:"/storage",draft:!1,unlisted:!1,editUrl:"https://github.com/k3s-io/docs/edit/main/docs/storage.md",tags:[],version:"current",lastUpdatedAt:1723747404e3,frontMatter:{title:"Volumes and Storage"},sidebar:"mySidebar",previous:{title:"Cluster Access",permalink:"/cluster-access"},next:{title:"Networking",permalink:"/networking/"}},i={},c=[{value:"What's different about K3s storage?",id:"whats-different-about-k3s-storage",level:2},{value:"Setting up the Local Storage Provider",id:"setting-up-the-local-storage-provider",level:2},{value:"pvc.yaml",id:"pvcyaml",level:3},{value:"pod.yaml",id:"podyaml",level:3},{value:"Setting up Longhorn",id:"setting-up-longhorn",level:2},{value:"pvc.yaml",id:"pvcyaml-1",level:3},{value:"pod.yaml",id:"podyaml-1",level:3}];function d(e){const n={a:"a",admonition:"admonition",code:"code",h2:"h2",h3:"h3",li:"li",p:"p",pre:"pre",ul:"ul",...(0,o.a)(),...e.components};return(0,a.jsxs)(a.Fragment,{children:[(0,a.jsx)(n.p,{children:"When deploying an application that needs to retain data, you\u2019ll need to create persistent storage. Persistent storage allows you to store application data external from the pod running your application. This storage practice allows you to maintain application data, even if the application\u2019s pod fails."}),"\n",(0,a.jsxs)(n.p,{children:["A persistent volume (PV) is a piece of storage in the Kubernetes cluster, while a persistent volume claim (PVC) is a request for storage. For details on how PVs and PVCs work, refer to the official Kubernetes documentation on ",(0,a.jsx)(n.a,{href:"https://kubernetes.io/docs/concepts/storage/volumes/",children:"storage."})]}),"\n",(0,a.jsxs)(n.p,{children:["This page describes how to set up persistent storage with a local storage provider, or with ",(0,a.jsx)(n.a,{href:"#setting-up-longhorn",children:"Longhorn."})]}),"\n",(0,a.jsx)(n.h2,{id:"whats-different-about-k3s-storage",children:"What's different about K3s storage?"}),"\n",(0,a.jsx)(n.p,{children:'K3s removes several optional volume plugins and all built-in (sometimes referred to as "in-tree") cloud providers. We do this in order to achieve a smaller binary size and to avoid dependence on third-party cloud or data center technologies and services, which may not be available in many K3s use cases. We are able to do this because their removal affects neither core Kubernetes functionality nor conformance.'}),"\n",(0,a.jsx)(n.p,{children:"The following volume plugins have been removed from K3s:"}),"\n",(0,a.jsxs)(n.ul,{children:["\n",(0,a.jsx)(n.li,{children:"cephfs"}),"\n",(0,a.jsx)(n.li,{children:"fc"}),"\n",(0,a.jsx)(n.li,{children:"flocker"}),"\n",(0,a.jsx)(n.li,{children:"git_repo"}),"\n",(0,a.jsx)(n.li,{children:"glusterfs"}),"\n",(0,a.jsx)(n.li,{children:"portworx"}),"\n",(0,a.jsx)(n.li,{children:"quobyte"}),"\n",(0,a.jsx)(n.li,{children:"rbd"}),"\n",(0,a.jsx)(n.li,{children:"storageos"}),"\n"]}),"\n",(0,a.jsxs)(n.p,{children:["Both components have out-of-tree alternatives that can be used with K3s: The Kubernetes ",(0,a.jsx)(n.a,{href:"https://github.com/container-storage-interface/spec/blob/master/spec.md",children:"Container Storage Interface (CSI)"})," and ",(0,a.jsx)(n.a,{href:"https://kubernetes.io/docs/tasks/administer-cluster/running-cloud-controller/",children:"Cloud Provider Interface (CPI)"}),"."]}),"\n",(0,a.jsxs)(n.p,{children:["Kubernetes maintainers are actively migrating in-tree volume plugins to CSI drivers. For more information on this migration, please refer ",(0,a.jsx)(n.a,{href:"https://kubernetes.io/blog/2021/12/10/storage-in-tree-to-csi-migration-status-update/",children:"here"}),"."]}),"\n",(0,a.jsx)(n.h2,{id:"setting-up-the-local-storage-provider",children:"Setting up the Local Storage Provider"}),"\n",(0,a.jsxs)(n.p,{children:["K3s comes with Rancher's Local Path Provisioner and this enables the ability to create persistent volume claims out of the box using local storage on the respective node. Below we cover a simple example. For more information please reference the official documentation ",(0,a.jsx)(n.a,{href:"https://github.com/rancher/local-path-provisioner/blob/master/README.md#usage",children:"here"}),"."]}),"\n",(0,a.jsx)(n.p,{children:"Create a hostPath backed persistent volume claim and a pod to utilize it:"}),"\n",(0,a.jsx)(n.h3,{id:"pvcyaml",children:"pvc.yaml"}),"\n",(0,a.jsx)(n.pre,{children:(0,a.jsx)(n.code,{className:"language-yaml",children:"apiVersion: v1\nkind: PersistentVolumeClaim\nmetadata:\n name: local-path-pvc\n namespace: default\nspec:\n accessModes:\n - ReadWriteOnce\n storageClassName: local-path\n resources:\n requests:\n storage: 2Gi\n"})}),"\n",(0,a.jsx)(n.h3,{id:"podyaml",children:"pod.yaml"}),"\n",(0,a.jsx)(n.pre,{children:(0,a.jsx)(n.code,{className:"language-yaml",children:"apiVersion: v1\nkind: Pod\nmetadata:\n name: volume-test\n namespace: default\nspec:\n containers:\n - name: volume-test\n image: nginx:stable-alpine\n imagePullPolicy: IfNotPresent\n volumeMounts:\n - name: volv\n mountPath: /data\n ports:\n - containerPort: 80\n volumes:\n - name: volv\n persistentVolumeClaim:\n claimName: local-path-pvc\n"})}),"\n",(0,a.jsx)(n.p,{children:"Apply the yaml:"}),"\n",(0,a.jsx)(n.pre,{children:(0,a.jsx)(n.code,{className:"language-bash",children:"kubectl create -f pvc.yaml\nkubectl create -f pod.yaml\n"})}),"\n",(0,a.jsx)(n.p,{children:"Confirm the PV and PVC are created:"}),"\n",(0,a.jsx)(n.pre,{children:(0,a.jsx)(n.code,{className:"language-bash",children:"kubectl get pv\nkubectl get pvc\n"})}),"\n",(0,a.jsx)(n.p,{children:"The status should be Bound for each."}),"\n",(0,a.jsx)(n.h2,{id:"setting-up-longhorn",children:"Setting up Longhorn"}),"\n",(0,a.jsx)(n.admonition,{type:"warning",children:(0,a.jsx)(n.p,{children:"Longhorn does not support ARM32."})}),"\n",(0,a.jsxs)(n.p,{children:["K3s supports ",(0,a.jsx)(n.a,{href:"https://github.com/longhorn/longhorn",children:"Longhorn"}),", an open-source distributed block storage system for Kubernetes."]}),"\n",(0,a.jsxs)(n.p,{children:["Below we cover a simple example. For more information, refer to the ",(0,a.jsx)(n.a,{href:"https://longhorn.io/docs/latest/",children:"official documentation"}),"."]}),"\n",(0,a.jsx)(n.p,{children:"Apply the longhorn.yaml to install Longhorn:"}),"\n",(0,a.jsx)(n.pre,{children:(0,a.jsx)(n.code,{className:"language-bash",children:"kubectl apply -f https://raw.githubusercontent.com/longhorn/longhorn/v1.6.0/deploy/longhorn.yaml\n"})}),"\n",(0,a.jsxs)(n.p,{children:["Longhorn will be installed in the namespace ",(0,a.jsx)(n.code,{children:"longhorn-system"}),"."]}),"\n",(0,a.jsx)(n.p,{children:"Apply the yaml to create the PVC and pod:"}),"\n",(0,a.jsx)(n.pre,{children:(0,a.jsx)(n.code,{className:"language-bash",children:"kubectl create -f pvc.yaml\nkubectl create -f pod.yaml\n"})}),"\n",(0,a.jsx)(n.h3,{id:"pvcyaml-1",children:"pvc.yaml"}),"\n",(0,a.jsx)(n.pre,{children:(0,a.jsx)(n.code,{className:"language-yaml",children:"apiVersion: v1\nkind: PersistentVolumeClaim\nmetadata:\n name: longhorn-volv-pvc\nspec:\n accessModes:\n - ReadWriteOnce\n storageClassName: longhorn\n resources:\n requests:\n storage: 2Gi\n"})}),"\n",(0,a.jsx)(n.h3,{id:"podyaml-1",children:"pod.yaml"}),"\n",(0,a.jsx)(n.pre,{children:(0,a.jsx)(n.code,{className:"language-yaml",children:"apiVersion: v1\nkind: Pod\nmetadata:\n name: volume-test\n namespace: default\nspec:\n containers:\n - name: volume-test\n image: nginx:stable-alpine\n imagePullPolicy: IfNotPresent\n volumeMounts:\n - name: volv\n mountPath: /data\n ports:\n - containerPort: 80\n volumes:\n - name: volv\n persistentVolumeClaim:\n claimName: longhorn-volv-pvc\n"})}),"\n",(0,a.jsx)(n.p,{children:"Confirm the PV and PVC are created:"}),"\n",(0,a.jsx)(n.pre,{children:(0,a.jsx)(n.code,{className:"language-bash",children:"kubectl get pv\nkubectl get pvc\n"})}),"\n",(0,a.jsx)(n.p,{children:"The status should be Bound for each."})]})}function h(e={}){const{wrapper:n}={...(0,o.a)(),...e.components};return n?(0,a.jsx)(n,{...e,children:(0,a.jsx)(d,{...e})}):d(e)}},1151:(e,n,t)=>{t.d(n,{Z:()=>l,a:()=>r});var a=t(7294);const o={},s=a.createContext(o);function r(e){const n=a.useContext(s);return a.useMemo((function(){return"function"==typeof e?e(n):{...n,...e}}),[n,e])}function l(e){let n;return n=e.disableParentContext?"function"==typeof e.components?e.components(o):e.components||o:r(e.components),a.createElement(s.Provider,{value:n},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/43077f1d.87f5351e.js b/assets/js/43077f1d.c8371153.js similarity index 98% rename from assets/js/43077f1d.87f5351e.js rename to assets/js/43077f1d.c8371153.js index d72056c88..2486af5fa 100644 --- a/assets/js/43077f1d.87f5351e.js +++ b/assets/js/43077f1d.c8371153.js @@ -1 +1 @@ -"use strict";(self.webpackChunkk_3_s_docs=self.webpackChunkk_3_s_docs||[]).push([[8397],{8104:(e,t,s)=>{s.r(t),s.d(t,{assets:()=>i,contentTitle:()=>o,default:()=>h,frontMatter:()=>r,metadata:()=>l,toc:()=>a});var c=s(5893),n=s(1151);const r={title:"Cluster Access"},o=void 0,l={id:"cluster-access",title:"Cluster Access",description:"The kubeconfig file stored at /etc/rancher/k3s/k3s.yaml is used to configure access to the Kubernetes cluster. If you have installed upstream Kubernetes command line tools such as kubectl or helm you will need to configure them with the correct kubeconfig path. This can be done by either exporting the KUBECONFIG environment variable or by invoking the --kubeconfig command line flag. Refer to the examples below for details.",source:"@site/docs/cluster-access.md",sourceDirName:".",slug:"/cluster-access",permalink:"/cluster-access",draft:!1,unlisted:!1,editUrl:"https://github.com/k3s-io/docs/edit/main/docs/cluster-access.md",tags:[],version:"current",lastUpdatedAt:1723651727e3,frontMatter:{title:"Cluster Access"},sidebar:"mySidebar",previous:{title:"Architecture",permalink:"/architecture"},next:{title:"Volumes and Storage",permalink:"/storage"}},i={},a=[{value:"Accessing the Cluster from Outside with kubectl",id:"accessing-the-cluster-from-outside-with-kubectl",level:3}];function u(e){const t={code:"code",h3:"h3",p:"p",pre:"pre",...(0,n.a)(),...e.components};return(0,c.jsxs)(c.Fragment,{children:[(0,c.jsxs)(t.p,{children:["The kubeconfig file stored at ",(0,c.jsx)(t.code,{children:"/etc/rancher/k3s/k3s.yaml"})," is used to configure access to the Kubernetes cluster. If you have installed upstream Kubernetes command line tools such as kubectl or helm you will need to configure them with the correct kubeconfig path. This can be done by either exporting the ",(0,c.jsx)(t.code,{children:"KUBECONFIG"})," environment variable or by invoking the ",(0,c.jsx)(t.code,{children:"--kubeconfig"})," command line flag. Refer to the examples below for details."]}),"\n",(0,c.jsx)(t.p,{children:"Leverage the KUBECONFIG environment variable:"}),"\n",(0,c.jsx)(t.pre,{children:(0,c.jsx)(t.code,{className:"language-bash",children:"export KUBECONFIG=/etc/rancher/k3s/k3s.yaml\nkubectl get pods --all-namespaces\nhelm ls --all-namespaces\n"})}),"\n",(0,c.jsx)(t.p,{children:"Or specify the location of the kubeconfig file in the command:"}),"\n",(0,c.jsx)(t.pre,{children:(0,c.jsx)(t.code,{className:"language-bash",children:"kubectl --kubeconfig /etc/rancher/k3s/k3s.yaml get pods --all-namespaces\nhelm --kubeconfig /etc/rancher/k3s/k3s.yaml ls --all-namespaces\n"})}),"\n",(0,c.jsx)(t.h3,{id:"accessing-the-cluster-from-outside-with-kubectl",children:"Accessing the Cluster from Outside with kubectl"}),"\n",(0,c.jsxs)(t.p,{children:["Copy ",(0,c.jsx)(t.code,{children:"/etc/rancher/k3s/k3s.yaml"})," on your machine located outside the cluster as ",(0,c.jsx)(t.code,{children:"~/.kube/config"}),". Then replace the value of the ",(0,c.jsx)(t.code,{children:"server"})," field with the IP or name of your K3s server. ",(0,c.jsx)(t.code,{children:"kubectl"})," can now manage your K3s cluster."]})]})}function h(e={}){const{wrapper:t}={...(0,n.a)(),...e.components};return t?(0,c.jsx)(t,{...e,children:(0,c.jsx)(u,{...e})}):u(e)}},1151:(e,t,s)=>{s.d(t,{Z:()=>l,a:()=>o});var c=s(7294);const n={},r=c.createContext(n);function o(e){const t=c.useContext(r);return c.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function l(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(n):e.components||n:o(e.components),c.createElement(r.Provider,{value:t},e.children)}}}]); \ No newline at end of file +"use strict";(self.webpackChunkk_3_s_docs=self.webpackChunkk_3_s_docs||[]).push([[8397],{8104:(e,t,s)=>{s.r(t),s.d(t,{assets:()=>i,contentTitle:()=>o,default:()=>h,frontMatter:()=>r,metadata:()=>l,toc:()=>a});var c=s(5893),n=s(1151);const r={title:"Cluster Access"},o=void 0,l={id:"cluster-access",title:"Cluster Access",description:"The kubeconfig file stored at /etc/rancher/k3s/k3s.yaml is used to configure access to the Kubernetes cluster. If you have installed upstream Kubernetes command line tools such as kubectl or helm you will need to configure them with the correct kubeconfig path. This can be done by either exporting the KUBECONFIG environment variable or by invoking the --kubeconfig command line flag. Refer to the examples below for details.",source:"@site/docs/cluster-access.md",sourceDirName:".",slug:"/cluster-access",permalink:"/cluster-access",draft:!1,unlisted:!1,editUrl:"https://github.com/k3s-io/docs/edit/main/docs/cluster-access.md",tags:[],version:"current",lastUpdatedAt:1723747404e3,frontMatter:{title:"Cluster Access"},sidebar:"mySidebar",previous:{title:"Architecture",permalink:"/architecture"},next:{title:"Volumes and Storage",permalink:"/storage"}},i={},a=[{value:"Accessing the Cluster from Outside with kubectl",id:"accessing-the-cluster-from-outside-with-kubectl",level:3}];function u(e){const t={code:"code",h3:"h3",p:"p",pre:"pre",...(0,n.a)(),...e.components};return(0,c.jsxs)(c.Fragment,{children:[(0,c.jsxs)(t.p,{children:["The kubeconfig file stored at ",(0,c.jsx)(t.code,{children:"/etc/rancher/k3s/k3s.yaml"})," is used to configure access to the Kubernetes cluster. If you have installed upstream Kubernetes command line tools such as kubectl or helm you will need to configure them with the correct kubeconfig path. This can be done by either exporting the ",(0,c.jsx)(t.code,{children:"KUBECONFIG"})," environment variable or by invoking the ",(0,c.jsx)(t.code,{children:"--kubeconfig"})," command line flag. Refer to the examples below for details."]}),"\n",(0,c.jsx)(t.p,{children:"Leverage the KUBECONFIG environment variable:"}),"\n",(0,c.jsx)(t.pre,{children:(0,c.jsx)(t.code,{className:"language-bash",children:"export KUBECONFIG=/etc/rancher/k3s/k3s.yaml\nkubectl get pods --all-namespaces\nhelm ls --all-namespaces\n"})}),"\n",(0,c.jsx)(t.p,{children:"Or specify the location of the kubeconfig file in the command:"}),"\n",(0,c.jsx)(t.pre,{children:(0,c.jsx)(t.code,{className:"language-bash",children:"kubectl --kubeconfig /etc/rancher/k3s/k3s.yaml get pods --all-namespaces\nhelm --kubeconfig /etc/rancher/k3s/k3s.yaml ls --all-namespaces\n"})}),"\n",(0,c.jsx)(t.h3,{id:"accessing-the-cluster-from-outside-with-kubectl",children:"Accessing the Cluster from Outside with kubectl"}),"\n",(0,c.jsxs)(t.p,{children:["Copy ",(0,c.jsx)(t.code,{children:"/etc/rancher/k3s/k3s.yaml"})," on your machine located outside the cluster as ",(0,c.jsx)(t.code,{children:"~/.kube/config"}),". Then replace the value of the ",(0,c.jsx)(t.code,{children:"server"})," field with the IP or name of your K3s server. ",(0,c.jsx)(t.code,{children:"kubectl"})," can now manage your K3s cluster."]})]})}function h(e={}){const{wrapper:t}={...(0,n.a)(),...e.components};return t?(0,c.jsx)(t,{...e,children:(0,c.jsx)(u,{...e})}):u(e)}},1151:(e,t,s)=>{s.d(t,{Z:()=>l,a:()=>o});var c=s(7294);const n={},r=c.createContext(n);function o(e){const t=c.useContext(r);return c.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function l(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(n):e.components||n:o(e.components),c.createElement(r.Provider,{value:t},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/43e5cb58.d45b37d4.js b/assets/js/43e5cb58.6e3a902c.js similarity index 99% rename from assets/js/43e5cb58.d45b37d4.js rename to assets/js/43e5cb58.6e3a902c.js index 3f73da3e0..d016fe3c5 100644 --- a/assets/js/43e5cb58.d45b37d4.js +++ b/assets/js/43e5cb58.6e3a902c.js @@ -1 +1 @@ -"use strict";(self.webpackChunkk_3_s_docs=self.webpackChunkk_3_s_docs||[]).push([[4804],{8446:(e,n,r)=>{r.r(n),r.d(n,{assets:()=>a,contentTitle:()=>l,default:()=>h,frontMatter:()=>t,metadata:()=>s,toc:()=>d});var o=r(5893),i=r(1151);const t={title:"Networking Services"},l=void 0,s={id:"networking/networking-services",title:"Networking Services",description:"This page explains how CoreDNS, Traefik Ingress controller, Network Policy controller, and ServiceLB load balancer controller work within K3s.",source:"@site/docs/networking/networking-services.md",sourceDirName:"networking",slug:"/networking/networking-services",permalink:"/networking/networking-services",draft:!1,unlisted:!1,editUrl:"https://github.com/k3s-io/docs/edit/main/docs/networking/networking-services.md",tags:[],version:"current",lastUpdatedAt:1723651727e3,frontMatter:{title:"Networking Services"},sidebar:"mySidebar",previous:{title:"Multus and IPAM plugins",permalink:"/networking/multus-ipams"},next:{title:"Helm",permalink:"/helm"}},a={},d=[{value:"CoreDNS",id:"coredns",level:2},{value:"Traefik Ingress Controller",id:"traefik-ingress-controller",level:2},{value:"Network Policy Controller",id:"network-policy-controller",level:2},{value:"Service Load Balancer",id:"service-load-balancer",level:2},{value:"How ServiceLB Works",id:"how-servicelb-works",level:3},{value:"Usage",id:"usage",level:3},{value:"Controlling ServiceLB Node Selection",id:"controlling-servicelb-node-selection",level:3},{value:"Creating ServiceLB Node Pools",id:"creating-servicelb-node-pools",level:3},{value:"Disabling ServiceLB",id:"disabling-servicelb",level:3},{value:"Deploying an External Cloud Controller Manager",id:"deploying-an-external-cloud-controller-manager",level:2}];function c(e){const n={a:"a",admonition:"admonition",code:"code",h2:"h2",h3:"h3",li:"li",ol:"ol",p:"p",pre:"pre",ul:"ul",...(0,i.a)(),...e.components};return(0,o.jsxs)(o.Fragment,{children:[(0,o.jsx)(n.p,{children:"This page explains how CoreDNS, Traefik Ingress controller, Network Policy controller, and ServiceLB load balancer controller work within K3s."}),"\n",(0,o.jsxs)(n.p,{children:["Refer to the ",(0,o.jsx)(n.a,{href:"/networking/basic-network-options",children:"Installation Network Options"})," page for details on Flannel configuration options and backend selection, or how to set up your own CNI."]}),"\n",(0,o.jsxs)(n.p,{children:["For information on which ports need to be opened for K3s, refer to the ",(0,o.jsx)(n.a,{href:"/installation/requirements#networking",children:"Networking Requirements"}),"."]}),"\n",(0,o.jsx)(n.h2,{id:"coredns",children:"CoreDNS"}),"\n",(0,o.jsxs)(n.p,{children:["CoreDNS is deployed automatically on server startup. To disable it, configure all servers in the cluster with the ",(0,o.jsx)(n.code,{children:"--disable=coredns"})," option."]}),"\n",(0,o.jsx)(n.p,{children:"If you don't install CoreDNS, you will need to install a cluster DNS provider yourself."}),"\n",(0,o.jsx)(n.h2,{id:"traefik-ingress-controller",children:"Traefik Ingress Controller"}),"\n",(0,o.jsxs)(n.p,{children:[(0,o.jsx)(n.a,{href:"https://traefik.io/",children:"Traefik"})," is a modern HTTP reverse proxy and load balancer made to deploy microservices with ease. It simplifies networking complexity while designing, deploying, and running applications."]}),"\n",(0,o.jsx)(n.p,{children:"The Traefik ingress controller deploys a LoadBalancer Service that uses ports 80 and 443, advertises the LoadBalancer Service's External IPs in the Status of Ingress resources it manages."}),"\n",(0,o.jsx)(n.p,{children:"By default, ServiceLB will use all nodes in the cluster to host the Traefik LoadBalancer Service, meaning ports 80 and 443 will not be usable for other HostPort or NodePort pods, and Ingress resources' Status will show all cluster members' node IPs."}),"\n",(0,o.jsxs)(n.p,{children:["To restrict the nodes used by Traefik, and by extension the node IPs advertised in the Ingress Status, you can follow the instructions in the ",(0,o.jsx)(n.a,{href:"#controlling-servicelb-node-selection",children:"Controlling ServiceLB Node Selection"})," section below to limit what nodes ServiceLB runs on, or by adding some nodes to a LoadBalancer pool and restricting the Traefik Service to that pool by setting matching labels in the Traefik HelmChartConfig."]}),"\n",(0,o.jsxs)(n.p,{children:["Traefik is deployed by default when starting the server. For more information see ",(0,o.jsx)(n.a,{href:"/installation/packaged-components",children:"Managing Packaged Components"}),". The default config file is found in ",(0,o.jsx)(n.code,{children:"/var/lib/rancher/k3s/server/manifests/traefik.yaml"}),"."]}),"\n",(0,o.jsxs)(n.p,{children:["The ",(0,o.jsx)(n.code,{children:"traefik.yaml"})," file should not be edited manually, as K3s will replace the file with defaults at startup. Instead, you should customize Traefik by creating an additional ",(0,o.jsx)(n.code,{children:"HelmChartConfig"})," manifest in ",(0,o.jsx)(n.code,{children:"/var/lib/rancher/k3s/server/manifests"}),". For more details and an example see ",(0,o.jsx)(n.a,{href:"/helm#customizing-packaged-components-with-helmchartconfig",children:"Customizing Packaged Components with HelmChartConfig"}),". For more information on the possible configuration values, refer to the official ",(0,o.jsx)(n.a,{href:"https://github.com/traefik/traefik-helm-chart/tree/master/traefik",children:"Traefik Helm Configuration Parameters."}),"."]}),"\n",(0,o.jsxs)(n.p,{children:["To remove Traefik from your cluster, start all servers with the ",(0,o.jsx)(n.code,{children:"--disable=traefik"})," flag."]}),"\n",(0,o.jsx)(n.p,{children:"K3s includes Traefik v2. K3s versions 1.21 through 1.30 install Traefik v2, unless an existing installation of Traefik v1 is found, in which case Traefik is not upgraded to v2. K3s versions 1.20 and earlier include Traefik v1. For more information on the specific version of Traefik included with K3s, consult the Release Notes for your version."}),"\n",(0,o.jsxs)(n.p,{children:["To migrate from an older Traefik v1 instance please refer to the ",(0,o.jsx)(n.a,{href:"https://doc.traefik.io/traefik/migration/v1-to-v2/",children:"Traefik documentation"})," and ",(0,o.jsx)(n.a,{href:"https://github.com/traefik/traefik-migration-tool",children:"migration tool"}),"."]}),"\n",(0,o.jsx)(n.h2,{id:"network-policy-controller",children:"Network Policy Controller"}),"\n",(0,o.jsxs)(n.p,{children:["K3s includes an embedded network policy controller. The underlying implementation is ",(0,o.jsx)(n.a,{href:"https://github.com/cloudnativelabs/kube-router",children:"kube-router's"})," netpol controller library (no other kube-router functionality is present) and can be found ",(0,o.jsx)(n.a,{href:"https://github.com/k3s-io/k3s/tree/master/pkg/agent/netpol",children:"here"}),"."]}),"\n",(0,o.jsxs)(n.p,{children:["To disable it, start each server with the ",(0,o.jsx)(n.code,{children:"--disable-network-policy"})," flag."]}),"\n",(0,o.jsxs)(n.admonition,{type:"note",children:[(0,o.jsxs)(n.p,{children:["Network policy iptables rules are not removed if the K3s configuration is changed to disable the network policy controller. To clean up the configured kube-router network policy rules after disabling the network policy controller, use the ",(0,o.jsx)(n.code,{children:"k3s-killall.sh"})," script, or clean them using ",(0,o.jsx)(n.code,{children:"iptables-save"})," and ",(0,o.jsx)(n.code,{children:"iptables-restore"}),". These steps must be run manually on all nodes in the cluster."]}),(0,o.jsx)(n.pre,{children:(0,o.jsx)(n.code,{children:"iptables-save | grep -v KUBE-ROUTER | iptables-restore\nip6tables-save | grep -v KUBE-ROUTER | ip6tables-restore\n"})})]}),"\n",(0,o.jsx)(n.h2,{id:"service-load-balancer",children:"Service Load Balancer"}),"\n",(0,o.jsxs)(n.p,{children:["Any LoadBalancer controller can be deployed to your K3s cluster. By default, K3s provides a load balancer known as ",(0,o.jsx)(n.a,{href:"https://github.com/k3s-io/klipper-lb",children:"ServiceLB"})," (formerly Klipper LoadBalancer) that uses available host ports."]}),"\n",(0,o.jsxs)(n.p,{children:["Upstream Kubernetes allows Services of type LoadBalancer to be created, but doesn't include a default load balancer implementation, so these services will remain ",(0,o.jsx)(n.code,{children:"pending"})," until one is installed. Many hosted services require a cloud provider such as Amazon EC2 or Microsoft Azure to offer an external load balancer implementation. By contrast, the K3s ServiceLB makes it possible to use LoadBalancer Services without a cloud provider or any additional configuration."]}),"\n",(0,o.jsx)(n.h3,{id:"how-servicelb-works",children:"How ServiceLB Works"}),"\n",(0,o.jsxs)(n.p,{children:["The ServiceLB controller watches Kubernetes ",(0,o.jsx)(n.a,{href:"https://kubernetes.io/docs/concepts/services-networking/service/",children:"Services"})," with the ",(0,o.jsx)(n.code,{children:"spec.type"})," field set to ",(0,o.jsx)(n.code,{children:"LoadBalancer"}),"."]}),"\n",(0,o.jsxs)(n.p,{children:["For each LoadBalancer Service, a ",(0,o.jsx)(n.a,{href:"https://kubernetes.io/docs/concepts/workloads/controllers/daemonset/",children:"DaemonSet"})," is created in the ",(0,o.jsx)(n.code,{children:"kube-system"})," namespace. This DaemonSet in turn creates Pods with a ",(0,o.jsx)(n.code,{children:"svc-"})," prefix, on each node. These Pods use iptables to forward traffic from the Pod's NodePort, to the Service's ClusterIP address and port."]}),"\n",(0,o.jsxs)(n.p,{children:["If the ServiceLB Pod runs on a node that has an external IP configured, the node's external IP is populated into the Service's ",(0,o.jsx)(n.code,{children:"status.loadBalancer.ingress"})," address list. Otherwise, the node's internal IP is used."]}),"\n",(0,o.jsx)(n.p,{children:"If multiple LoadBalancer Services are created, a separate DaemonSet is created for each Service."}),"\n",(0,o.jsx)(n.p,{children:"It is possible to expose multiple Services on the same node, as long as they use different ports."}),"\n",(0,o.jsx)(n.p,{children:"If you try to create a LoadBalancer Service that listens on port 80, the ServiceLB will try to find a free host in the cluster for port 80. If no host with that port is available, the LB will remain Pending."}),"\n",(0,o.jsx)(n.h3,{id:"usage",children:"Usage"}),"\n",(0,o.jsxs)(n.p,{children:["Create a ",(0,o.jsx)(n.a,{href:"https://kubernetes.io/docs/concepts/services-networking/service/#loadbalancer",children:"Service of type LoadBalancer"})," in K3s."]}),"\n",(0,o.jsx)(n.h3,{id:"controlling-servicelb-node-selection",children:"Controlling ServiceLB Node Selection"}),"\n",(0,o.jsxs)(n.p,{children:["Adding the ",(0,o.jsx)(n.code,{children:"svccontroller.k3s.cattle.io/enablelb=true"})," label to one or more nodes switches the ServiceLB controller into allow-list mode, where only nodes with the label are eligible to host LoadBalancer pods. Nodes that remain unlabeled will be excluded from use by ServiceLB."]}),"\n",(0,o.jsx)(n.admonition,{type:"note",children:(0,o.jsx)(n.p,{children:"By default, nodes are not labeled. As long as all nodes remain unlabeled, all nodes with ports available will be used by ServiceLB."})}),"\n",(0,o.jsx)(n.h3,{id:"creating-servicelb-node-pools",children:"Creating ServiceLB Node Pools"}),"\n",(0,o.jsxs)(n.p,{children:["To select a particular subset of nodes to host pods for a LoadBalancer, add the ",(0,o.jsx)(n.code,{children:"enablelb"})," label to the desired nodes, and set matching ",(0,o.jsx)(n.code,{children:"lbpool"})," label values on the Nodes and Services. For example:"]}),"\n",(0,o.jsxs)(n.ol,{children:["\n",(0,o.jsxs)(n.li,{children:["Label Node A and Node B with ",(0,o.jsx)(n.code,{children:"svccontroller.k3s.cattle.io/lbpool=pool1"})," and ",(0,o.jsx)(n.code,{children:"svccontroller.k3s.cattle.io/enablelb=true"})]}),"\n",(0,o.jsxs)(n.li,{children:["Label Node C and Node D with ",(0,o.jsx)(n.code,{children:"svccontroller.k3s.cattle.io/lbpool=pool2"})," and ",(0,o.jsx)(n.code,{children:"svccontroller.k3s.cattle.io/enablelb=true"})]}),"\n",(0,o.jsxs)(n.li,{children:["Create one LoadBalancer Service on port 443 with label ",(0,o.jsx)(n.code,{children:"svccontroller.k3s.cattle.io/lbpool=pool1"}),". The DaemonSet for this service only deploy Pods to Node A and Node B."]}),"\n",(0,o.jsxs)(n.li,{children:["Create another LoadBalancer Service on port 443 with label ",(0,o.jsx)(n.code,{children:"svccontroller.k3s.cattle.io/lbpool=pool2"}),". The DaemonSet will only deploy Pods to Node C and Node D."]}),"\n"]}),"\n",(0,o.jsx)(n.h3,{id:"disabling-servicelb",children:"Disabling ServiceLB"}),"\n",(0,o.jsxs)(n.p,{children:["To disable ServiceLB, configure all servers in the cluster with the ",(0,o.jsx)(n.code,{children:"--disable=servicelb"})," flag."]}),"\n",(0,o.jsx)(n.p,{children:"This is necessary if you wish to run a different LB, such as MetalLB."}),"\n",(0,o.jsx)(n.h2,{id:"deploying-an-external-cloud-controller-manager",children:"Deploying an External Cloud Controller Manager"}),"\n",(0,o.jsx)(n.p,{children:'In order to reduce binary size, K3s removes all "in-tree" (built-in) cloud providers. Instead, K3s provides an embedded Cloud Controller Manager (CCM) stub that does the following:'}),"\n",(0,o.jsxs)(n.ul,{children:["\n",(0,o.jsxs)(n.li,{children:["Sets node InternalIP and ExternalIP address fields based on the ",(0,o.jsx)(n.code,{children:"--node-ip"})," and ",(0,o.jsx)(n.code,{children:"--node-external-ip"})," flags."]}),"\n",(0,o.jsx)(n.li,{children:"Hosts the ServiceLB LoadBalancer controller."}),"\n",(0,o.jsxs)(n.li,{children:["Clears the ",(0,o.jsx)(n.code,{children:"node.cloudprovider.kubernetes.io/uninitialized"})," taint that is present when the cloud-provider is set to ",(0,o.jsx)(n.code,{children:"external"})]}),"\n"]}),"\n",(0,o.jsxs)(n.p,{children:["Before deploying an external CCM, you must start all K3s servers with the ",(0,o.jsx)(n.code,{children:"--disable-cloud-controller"})," flag to disable to embedded CCM."]}),"\n",(0,o.jsx)(n.admonition,{type:"note",children:(0,o.jsx)(n.p,{children:"If you disable the built-in CCM and do not deploy and properly configure an external substitute, nodes will remain tainted and unschedulable."})})]})}function h(e={}){const{wrapper:n}={...(0,i.a)(),...e.components};return n?(0,o.jsx)(n,{...e,children:(0,o.jsx)(c,{...e})}):c(e)}},1151:(e,n,r)=>{r.d(n,{Z:()=>s,a:()=>l});var o=r(7294);const i={},t=o.createContext(i);function l(e){const n=o.useContext(t);return o.useMemo((function(){return"function"==typeof e?e(n):{...n,...e}}),[n,e])}function s(e){let n;return n=e.disableParentContext?"function"==typeof e.components?e.components(i):e.components||i:l(e.components),o.createElement(t.Provider,{value:n},e.children)}}}]); \ No newline at end of file +"use strict";(self.webpackChunkk_3_s_docs=self.webpackChunkk_3_s_docs||[]).push([[4804],{8446:(e,n,r)=>{r.r(n),r.d(n,{assets:()=>a,contentTitle:()=>l,default:()=>h,frontMatter:()=>t,metadata:()=>s,toc:()=>d});var o=r(5893),i=r(1151);const t={title:"Networking Services"},l=void 0,s={id:"networking/networking-services",title:"Networking Services",description:"This page explains how CoreDNS, Traefik Ingress controller, Network Policy controller, and ServiceLB load balancer controller work within K3s.",source:"@site/docs/networking/networking-services.md",sourceDirName:"networking",slug:"/networking/networking-services",permalink:"/networking/networking-services",draft:!1,unlisted:!1,editUrl:"https://github.com/k3s-io/docs/edit/main/docs/networking/networking-services.md",tags:[],version:"current",lastUpdatedAt:1723747404e3,frontMatter:{title:"Networking Services"},sidebar:"mySidebar",previous:{title:"Multus and IPAM plugins",permalink:"/networking/multus-ipams"},next:{title:"Helm",permalink:"/helm"}},a={},d=[{value:"CoreDNS",id:"coredns",level:2},{value:"Traefik Ingress Controller",id:"traefik-ingress-controller",level:2},{value:"Network Policy Controller",id:"network-policy-controller",level:2},{value:"Service Load Balancer",id:"service-load-balancer",level:2},{value:"How ServiceLB Works",id:"how-servicelb-works",level:3},{value:"Usage",id:"usage",level:3},{value:"Controlling ServiceLB Node Selection",id:"controlling-servicelb-node-selection",level:3},{value:"Creating ServiceLB Node Pools",id:"creating-servicelb-node-pools",level:3},{value:"Disabling ServiceLB",id:"disabling-servicelb",level:3},{value:"Deploying an External Cloud Controller Manager",id:"deploying-an-external-cloud-controller-manager",level:2}];function c(e){const n={a:"a",admonition:"admonition",code:"code",h2:"h2",h3:"h3",li:"li",ol:"ol",p:"p",pre:"pre",ul:"ul",...(0,i.a)(),...e.components};return(0,o.jsxs)(o.Fragment,{children:[(0,o.jsx)(n.p,{children:"This page explains how CoreDNS, Traefik Ingress controller, Network Policy controller, and ServiceLB load balancer controller work within K3s."}),"\n",(0,o.jsxs)(n.p,{children:["Refer to the ",(0,o.jsx)(n.a,{href:"/networking/basic-network-options",children:"Installation Network Options"})," page for details on Flannel configuration options and backend selection, or how to set up your own CNI."]}),"\n",(0,o.jsxs)(n.p,{children:["For information on which ports need to be opened for K3s, refer to the ",(0,o.jsx)(n.a,{href:"/installation/requirements#networking",children:"Networking Requirements"}),"."]}),"\n",(0,o.jsx)(n.h2,{id:"coredns",children:"CoreDNS"}),"\n",(0,o.jsxs)(n.p,{children:["CoreDNS is deployed automatically on server startup. To disable it, configure all servers in the cluster with the ",(0,o.jsx)(n.code,{children:"--disable=coredns"})," option."]}),"\n",(0,o.jsx)(n.p,{children:"If you don't install CoreDNS, you will need to install a cluster DNS provider yourself."}),"\n",(0,o.jsx)(n.h2,{id:"traefik-ingress-controller",children:"Traefik Ingress Controller"}),"\n",(0,o.jsxs)(n.p,{children:[(0,o.jsx)(n.a,{href:"https://traefik.io/",children:"Traefik"})," is a modern HTTP reverse proxy and load balancer made to deploy microservices with ease. It simplifies networking complexity while designing, deploying, and running applications."]}),"\n",(0,o.jsx)(n.p,{children:"The Traefik ingress controller deploys a LoadBalancer Service that uses ports 80 and 443, advertises the LoadBalancer Service's External IPs in the Status of Ingress resources it manages."}),"\n",(0,o.jsx)(n.p,{children:"By default, ServiceLB will use all nodes in the cluster to host the Traefik LoadBalancer Service, meaning ports 80 and 443 will not be usable for other HostPort or NodePort pods, and Ingress resources' Status will show all cluster members' node IPs."}),"\n",(0,o.jsxs)(n.p,{children:["To restrict the nodes used by Traefik, and by extension the node IPs advertised in the Ingress Status, you can follow the instructions in the ",(0,o.jsx)(n.a,{href:"#controlling-servicelb-node-selection",children:"Controlling ServiceLB Node Selection"})," section below to limit what nodes ServiceLB runs on, or by adding some nodes to a LoadBalancer pool and restricting the Traefik Service to that pool by setting matching labels in the Traefik HelmChartConfig."]}),"\n",(0,o.jsxs)(n.p,{children:["Traefik is deployed by default when starting the server. For more information see ",(0,o.jsx)(n.a,{href:"/installation/packaged-components",children:"Managing Packaged Components"}),". The default config file is found in ",(0,o.jsx)(n.code,{children:"/var/lib/rancher/k3s/server/manifests/traefik.yaml"}),"."]}),"\n",(0,o.jsxs)(n.p,{children:["The ",(0,o.jsx)(n.code,{children:"traefik.yaml"})," file should not be edited manually, as K3s will replace the file with defaults at startup. Instead, you should customize Traefik by creating an additional ",(0,o.jsx)(n.code,{children:"HelmChartConfig"})," manifest in ",(0,o.jsx)(n.code,{children:"/var/lib/rancher/k3s/server/manifests"}),". For more details and an example see ",(0,o.jsx)(n.a,{href:"/helm#customizing-packaged-components-with-helmchartconfig",children:"Customizing Packaged Components with HelmChartConfig"}),". For more information on the possible configuration values, refer to the official ",(0,o.jsx)(n.a,{href:"https://github.com/traefik/traefik-helm-chart/tree/master/traefik",children:"Traefik Helm Configuration Parameters."}),"."]}),"\n",(0,o.jsxs)(n.p,{children:["To remove Traefik from your cluster, start all servers with the ",(0,o.jsx)(n.code,{children:"--disable=traefik"})," flag."]}),"\n",(0,o.jsx)(n.p,{children:"K3s includes Traefik v2. K3s versions 1.21 through 1.30 install Traefik v2, unless an existing installation of Traefik v1 is found, in which case Traefik is not upgraded to v2. K3s versions 1.20 and earlier include Traefik v1. For more information on the specific version of Traefik included with K3s, consult the Release Notes for your version."}),"\n",(0,o.jsxs)(n.p,{children:["To migrate from an older Traefik v1 instance please refer to the ",(0,o.jsx)(n.a,{href:"https://doc.traefik.io/traefik/migration/v1-to-v2/",children:"Traefik documentation"})," and ",(0,o.jsx)(n.a,{href:"https://github.com/traefik/traefik-migration-tool",children:"migration tool"}),"."]}),"\n",(0,o.jsx)(n.h2,{id:"network-policy-controller",children:"Network Policy Controller"}),"\n",(0,o.jsxs)(n.p,{children:["K3s includes an embedded network policy controller. The underlying implementation is ",(0,o.jsx)(n.a,{href:"https://github.com/cloudnativelabs/kube-router",children:"kube-router's"})," netpol controller library (no other kube-router functionality is present) and can be found ",(0,o.jsx)(n.a,{href:"https://github.com/k3s-io/k3s/tree/master/pkg/agent/netpol",children:"here"}),"."]}),"\n",(0,o.jsxs)(n.p,{children:["To disable it, start each server with the ",(0,o.jsx)(n.code,{children:"--disable-network-policy"})," flag."]}),"\n",(0,o.jsxs)(n.admonition,{type:"note",children:[(0,o.jsxs)(n.p,{children:["Network policy iptables rules are not removed if the K3s configuration is changed to disable the network policy controller. To clean up the configured kube-router network policy rules after disabling the network policy controller, use the ",(0,o.jsx)(n.code,{children:"k3s-killall.sh"})," script, or clean them using ",(0,o.jsx)(n.code,{children:"iptables-save"})," and ",(0,o.jsx)(n.code,{children:"iptables-restore"}),". These steps must be run manually on all nodes in the cluster."]}),(0,o.jsx)(n.pre,{children:(0,o.jsx)(n.code,{children:"iptables-save | grep -v KUBE-ROUTER | iptables-restore\nip6tables-save | grep -v KUBE-ROUTER | ip6tables-restore\n"})})]}),"\n",(0,o.jsx)(n.h2,{id:"service-load-balancer",children:"Service Load Balancer"}),"\n",(0,o.jsxs)(n.p,{children:["Any LoadBalancer controller can be deployed to your K3s cluster. By default, K3s provides a load balancer known as ",(0,o.jsx)(n.a,{href:"https://github.com/k3s-io/klipper-lb",children:"ServiceLB"})," (formerly Klipper LoadBalancer) that uses available host ports."]}),"\n",(0,o.jsxs)(n.p,{children:["Upstream Kubernetes allows Services of type LoadBalancer to be created, but doesn't include a default load balancer implementation, so these services will remain ",(0,o.jsx)(n.code,{children:"pending"})," until one is installed. Many hosted services require a cloud provider such as Amazon EC2 or Microsoft Azure to offer an external load balancer implementation. By contrast, the K3s ServiceLB makes it possible to use LoadBalancer Services without a cloud provider or any additional configuration."]}),"\n",(0,o.jsx)(n.h3,{id:"how-servicelb-works",children:"How ServiceLB Works"}),"\n",(0,o.jsxs)(n.p,{children:["The ServiceLB controller watches Kubernetes ",(0,o.jsx)(n.a,{href:"https://kubernetes.io/docs/concepts/services-networking/service/",children:"Services"})," with the ",(0,o.jsx)(n.code,{children:"spec.type"})," field set to ",(0,o.jsx)(n.code,{children:"LoadBalancer"}),"."]}),"\n",(0,o.jsxs)(n.p,{children:["For each LoadBalancer Service, a ",(0,o.jsx)(n.a,{href:"https://kubernetes.io/docs/concepts/workloads/controllers/daemonset/",children:"DaemonSet"})," is created in the ",(0,o.jsx)(n.code,{children:"kube-system"})," namespace. This DaemonSet in turn creates Pods with a ",(0,o.jsx)(n.code,{children:"svc-"})," prefix, on each node. These Pods use iptables to forward traffic from the Pod's NodePort, to the Service's ClusterIP address and port."]}),"\n",(0,o.jsxs)(n.p,{children:["If the ServiceLB Pod runs on a node that has an external IP configured, the node's external IP is populated into the Service's ",(0,o.jsx)(n.code,{children:"status.loadBalancer.ingress"})," address list. Otherwise, the node's internal IP is used."]}),"\n",(0,o.jsx)(n.p,{children:"If multiple LoadBalancer Services are created, a separate DaemonSet is created for each Service."}),"\n",(0,o.jsx)(n.p,{children:"It is possible to expose multiple Services on the same node, as long as they use different ports."}),"\n",(0,o.jsx)(n.p,{children:"If you try to create a LoadBalancer Service that listens on port 80, the ServiceLB will try to find a free host in the cluster for port 80. If no host with that port is available, the LB will remain Pending."}),"\n",(0,o.jsx)(n.h3,{id:"usage",children:"Usage"}),"\n",(0,o.jsxs)(n.p,{children:["Create a ",(0,o.jsx)(n.a,{href:"https://kubernetes.io/docs/concepts/services-networking/service/#loadbalancer",children:"Service of type LoadBalancer"})," in K3s."]}),"\n",(0,o.jsx)(n.h3,{id:"controlling-servicelb-node-selection",children:"Controlling ServiceLB Node Selection"}),"\n",(0,o.jsxs)(n.p,{children:["Adding the ",(0,o.jsx)(n.code,{children:"svccontroller.k3s.cattle.io/enablelb=true"})," label to one or more nodes switches the ServiceLB controller into allow-list mode, where only nodes with the label are eligible to host LoadBalancer pods. Nodes that remain unlabeled will be excluded from use by ServiceLB."]}),"\n",(0,o.jsx)(n.admonition,{type:"note",children:(0,o.jsx)(n.p,{children:"By default, nodes are not labeled. As long as all nodes remain unlabeled, all nodes with ports available will be used by ServiceLB."})}),"\n",(0,o.jsx)(n.h3,{id:"creating-servicelb-node-pools",children:"Creating ServiceLB Node Pools"}),"\n",(0,o.jsxs)(n.p,{children:["To select a particular subset of nodes to host pods for a LoadBalancer, add the ",(0,o.jsx)(n.code,{children:"enablelb"})," label to the desired nodes, and set matching ",(0,o.jsx)(n.code,{children:"lbpool"})," label values on the Nodes and Services. For example:"]}),"\n",(0,o.jsxs)(n.ol,{children:["\n",(0,o.jsxs)(n.li,{children:["Label Node A and Node B with ",(0,o.jsx)(n.code,{children:"svccontroller.k3s.cattle.io/lbpool=pool1"})," and ",(0,o.jsx)(n.code,{children:"svccontroller.k3s.cattle.io/enablelb=true"})]}),"\n",(0,o.jsxs)(n.li,{children:["Label Node C and Node D with ",(0,o.jsx)(n.code,{children:"svccontroller.k3s.cattle.io/lbpool=pool2"})," and ",(0,o.jsx)(n.code,{children:"svccontroller.k3s.cattle.io/enablelb=true"})]}),"\n",(0,o.jsxs)(n.li,{children:["Create one LoadBalancer Service on port 443 with label ",(0,o.jsx)(n.code,{children:"svccontroller.k3s.cattle.io/lbpool=pool1"}),". The DaemonSet for this service only deploy Pods to Node A and Node B."]}),"\n",(0,o.jsxs)(n.li,{children:["Create another LoadBalancer Service on port 443 with label ",(0,o.jsx)(n.code,{children:"svccontroller.k3s.cattle.io/lbpool=pool2"}),". The DaemonSet will only deploy Pods to Node C and Node D."]}),"\n"]}),"\n",(0,o.jsx)(n.h3,{id:"disabling-servicelb",children:"Disabling ServiceLB"}),"\n",(0,o.jsxs)(n.p,{children:["To disable ServiceLB, configure all servers in the cluster with the ",(0,o.jsx)(n.code,{children:"--disable=servicelb"})," flag."]}),"\n",(0,o.jsx)(n.p,{children:"This is necessary if you wish to run a different LB, such as MetalLB."}),"\n",(0,o.jsx)(n.h2,{id:"deploying-an-external-cloud-controller-manager",children:"Deploying an External Cloud Controller Manager"}),"\n",(0,o.jsx)(n.p,{children:'In order to reduce binary size, K3s removes all "in-tree" (built-in) cloud providers. Instead, K3s provides an embedded Cloud Controller Manager (CCM) stub that does the following:'}),"\n",(0,o.jsxs)(n.ul,{children:["\n",(0,o.jsxs)(n.li,{children:["Sets node InternalIP and ExternalIP address fields based on the ",(0,o.jsx)(n.code,{children:"--node-ip"})," and ",(0,o.jsx)(n.code,{children:"--node-external-ip"})," flags."]}),"\n",(0,o.jsx)(n.li,{children:"Hosts the ServiceLB LoadBalancer controller."}),"\n",(0,o.jsxs)(n.li,{children:["Clears the ",(0,o.jsx)(n.code,{children:"node.cloudprovider.kubernetes.io/uninitialized"})," taint that is present when the cloud-provider is set to ",(0,o.jsx)(n.code,{children:"external"})]}),"\n"]}),"\n",(0,o.jsxs)(n.p,{children:["Before deploying an external CCM, you must start all K3s servers with the ",(0,o.jsx)(n.code,{children:"--disable-cloud-controller"})," flag to disable to embedded CCM."]}),"\n",(0,o.jsx)(n.admonition,{type:"note",children:(0,o.jsx)(n.p,{children:"If you disable the built-in CCM and do not deploy and properly configure an external substitute, nodes will remain tainted and unschedulable."})})]})}function h(e={}){const{wrapper:n}={...(0,i.a)(),...e.components};return n?(0,o.jsx)(n,{...e,children:(0,o.jsx)(c,{...e})}):c(e)}},1151:(e,n,r)=>{r.d(n,{Z:()=>s,a:()=>l});var o=r(7294);const i={},t=o.createContext(i);function l(e){const n=o.useContext(t);return o.useMemo((function(){return"function"==typeof e?e(n):{...n,...e}}),[n,e])}function s(e){let n;return n=e.disableParentContext?"function"==typeof e.components?e.components(i):e.components||i:l(e.components),o.createElement(t.Provider,{value:n},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/4455f95b.44f701eb.js b/assets/js/4455f95b.f2e4ed70.js similarity index 99% rename from assets/js/4455f95b.44f701eb.js rename to assets/js/4455f95b.f2e4ed70.js index 1b83e9b8e..fded9fae1 100644 --- a/assets/js/4455f95b.44f701eb.js +++ b/assets/js/4455f95b.f2e4ed70.js @@ -1 +1 @@ -"use strict";(self.webpackChunkk_3_s_docs=self.webpackChunkk_3_s_docs||[]).push([[1340],{2644:(e,s,n)=>{n.r(s),n.d(s,{assets:()=>c,contentTitle:()=>l,default:()=>h,frontMatter:()=>d,metadata:()=>i,toc:()=>o});var r=n(5893),t=n(1151);const d={title:"server"},l="k3s server",i={id:"cli/server",title:"server",description:"In this section, you'll learn how to configure the K3s server.",source:"@site/docs/cli/server.md",sourceDirName:"cli",slug:"/cli/server",permalink:"/cli/server",draft:!1,unlisted:!1,editUrl:"https://github.com/k3s-io/docs/edit/main/docs/cli/server.md",tags:[],version:"current",lastUpdatedAt:1723651727e3,frontMatter:{title:"server"},sidebar:"mySidebar",previous:{title:"CLI Tools",permalink:"/cli/"},next:{title:"agent",permalink:"/cli/agent"}},c={},o=[{value:"Critical Configuration Values",id:"critical-configuration-values",level:2},{value:"Commonly Used Options",id:"commonly-used-options",level:2},{value:"Database",id:"database",level:3},{value:"Cluster Options",id:"cluster-options",level:3},{value:"Admin Kubeconfig Options",id:"admin-kubeconfig-options",level:3},{value:"Advanced Options",id:"advanced-options",level:2},{value:"Logging",id:"logging",level:3},{value:"Listeners",id:"listeners",level:3},{value:"Data",id:"data",level:3},{value:"Secrets Encryption",id:"secrets-encryption",level:3},{value:"Networking",id:"networking",level:3},{value:"Storage Class",id:"storage-class",level:3},{value:"Kubernetes Components",id:"kubernetes-components",level:3},{value:"Customized Flags for Kubernetes Processes",id:"customized-flags-for-kubernetes-processes",level:3},{value:"Experimental Options",id:"experimental-options",level:3},{value:"Deprecated Options",id:"deprecated-options",level:3},{value:"K3s Server CLI Help",id:"k3s-server-cli-help",level:2}];function a(e){const s={a:"a",blockquote:"blockquote",code:"code",em:"em",h1:"h1",h2:"h2",h3:"h3",header:"header",li:"li",p:"p",pre:"pre",table:"table",tbody:"tbody",td:"td",th:"th",thead:"thead",tr:"tr",ul:"ul",...(0,t.a)(),...e.components};return(0,r.jsxs)(r.Fragment,{children:[(0,r.jsx)(s.header,{children:(0,r.jsx)(s.h1,{id:"k3s-server",children:"k3s server"})}),"\n",(0,r.jsx)(s.p,{children:"In this section, you'll learn how to configure the K3s server."}),"\n",(0,r.jsxs)(s.p,{children:["Note that servers also run an agent, so all of the configuration options listed in the ",(0,r.jsxs)(s.a,{href:"/cli/agent",children:[(0,r.jsx)(s.code,{children:"k3s agent"})," documentation"]})," are also supported on servers."]}),"\n",(0,r.jsxs)(s.p,{children:["Options are documented on this page as CLI flags, but can also be passed as configuration file options. See the ",(0,r.jsx)(s.a,{href:"/installation/configuration#configuration-file",children:"Configuration File"})," documentation for more information on using YAML configuration files."]}),"\n",(0,r.jsx)(s.h2,{id:"critical-configuration-values",children:"Critical Configuration Values"}),"\n",(0,r.jsx)(s.p,{children:"The following options must be set to the same value on all servers in the cluster. Failure to do so will cause new servers to fail to join the cluster when using embedded etcd, or incorrect operation of the cluster when using an external datastore."}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:(0,r.jsx)(s.code,{children:"--agent-token"})}),"\n",(0,r.jsx)(s.li,{children:(0,r.jsx)(s.code,{children:"--cluster-cidr"})}),"\n",(0,r.jsx)(s.li,{children:(0,r.jsx)(s.code,{children:"--cluster-dns"})}),"\n",(0,r.jsx)(s.li,{children:(0,r.jsx)(s.code,{children:"--cluster-domain"})}),"\n",(0,r.jsx)(s.li,{children:(0,r.jsx)(s.code,{children:"--disable-cloud-controller"})}),"\n",(0,r.jsx)(s.li,{children:(0,r.jsx)(s.code,{children:"--disable-helm-controller"})}),"\n",(0,r.jsx)(s.li,{children:(0,r.jsx)(s.code,{children:"--disable-network-policy"})}),"\n",(0,r.jsxs)(s.li,{children:[(0,r.jsx)(s.code,{children:"--disable=servicelb"})," ",(0,r.jsx)(s.em,{children:"note: other packaged components may be disabled on a per-server basis"})]}),"\n",(0,r.jsx)(s.li,{children:(0,r.jsx)(s.code,{children:"--egress-selector-mode"})}),"\n",(0,r.jsx)(s.li,{children:(0,r.jsx)(s.code,{children:"--embedded-registry"})}),"\n",(0,r.jsx)(s.li,{children:(0,r.jsx)(s.code,{children:"--flannel-backend"})}),"\n",(0,r.jsx)(s.li,{children:(0,r.jsx)(s.code,{children:"--flannel-external-ip"})}),"\n",(0,r.jsx)(s.li,{children:(0,r.jsx)(s.code,{children:"--flannel-ipv6-masq"})}),"\n",(0,r.jsx)(s.li,{children:(0,r.jsx)(s.code,{children:"--secrets-encryption"})}),"\n",(0,r.jsx)(s.li,{children:(0,r.jsx)(s.code,{children:"--service-cidr"})}),"\n"]}),"\n",(0,r.jsx)(s.h2,{id:"commonly-used-options",children:"Commonly Used Options"}),"\n",(0,r.jsx)(s.h3,{id:"database",children:"Database"}),"\n",(0,r.jsxs)(s.table,{children:[(0,r.jsx)(s.thead,{children:(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.th,{children:"Flag"}),(0,r.jsx)(s.th,{children:"Environment Variable"}),(0,r.jsx)(s.th,{children:"Default"}),(0,r.jsx)(s.th,{children:"Description"})]})}),(0,r.jsxs)(s.tbody,{children:[(0,r.jsxs)(s.tr,{children:[(0,r.jsxs)(s.td,{children:[(0,r.jsx)(s.code,{children:"--datastore-endpoint"})," value"]}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.code,{children:"K3S_DATASTORE_ENDPOINT"})}),(0,r.jsx)(s.td,{}),(0,r.jsx)(s.td,{children:"Specify etcd, Mysql, Postgres, or Sqlite data source name"})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsxs)(s.td,{children:[(0,r.jsx)(s.code,{children:"--datastore-cafile"})," value"]}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.code,{children:"K3S_DATASTORE_CAFILE"})}),(0,r.jsx)(s.td,{}),(0,r.jsx)(s.td,{children:"TLS Certificate Authority file used to secure datastore backend communication"})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsxs)(s.td,{children:[(0,r.jsx)(s.code,{children:"--datastore-certfile"})," value"]}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.code,{children:"K3S_DATASTORE_CERTFILE"})}),(0,r.jsx)(s.td,{}),(0,r.jsx)(s.td,{children:"TLS certification file used to secure datastore backend communication"})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsxs)(s.td,{children:[(0,r.jsx)(s.code,{children:"--datastore-keyfile"})," value"]}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.code,{children:"K3S_DATASTORE_KEYFILE"})}),(0,r.jsx)(s.td,{}),(0,r.jsx)(s.td,{children:"TLS key file used to secure datastore backend communication"})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:(0,r.jsx)(s.code,{children:"--etcd-expose-metrics"})}),(0,r.jsx)(s.td,{}),(0,r.jsx)(s.td,{children:"false"}),(0,r.jsx)(s.td,{children:"Expose etcd metrics to client interface"})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:(0,r.jsx)(s.code,{children:"--etcd-disable-snapshots"})}),(0,r.jsx)(s.td,{}),(0,r.jsx)(s.td,{children:"false"}),(0,r.jsx)(s.td,{children:"Disable automatic etcd snapshots"})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsxs)(s.td,{children:[(0,r.jsx)(s.code,{children:"--etcd-snapshot-name"})," value"]}),(0,r.jsx)(s.td,{}),(0,r.jsx)(s.td,{children:'"etcd-snapshot-"'}),(0,r.jsx)(s.td,{children:"Set the base name of etcd snapshots."})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsxs)(s.td,{children:[(0,r.jsx)(s.code,{children:"--etcd-snapshot-schedule-cron"})," value"]}),(0,r.jsx)(s.td,{}),(0,r.jsx)(s.td,{children:'"0 */12 * * *"'}),(0,r.jsx)(s.td,{children:"Snapshot interval time in cron spec. eg. every 5 hours '0 */5 _ * _'"})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsxs)(s.td,{children:[(0,r.jsx)(s.code,{children:"--etcd-snapshot-retention"})," value"]}),(0,r.jsx)(s.td,{}),(0,r.jsx)(s.td,{children:"5"}),(0,r.jsx)(s.td,{children:"Number of snapshots to retain"})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsxs)(s.td,{children:[(0,r.jsx)(s.code,{children:"--etcd-snapshot-dir"})," value"]}),(0,r.jsx)(s.td,{}),(0,r.jsx)(s.td,{children:"${data-dir}/db/snapshots"}),(0,r.jsx)(s.td,{children:"Directory to save db snapshots"})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:(0,r.jsx)(s.code,{children:"--etcd-s3"})}),(0,r.jsx)(s.td,{}),(0,r.jsx)(s.td,{}),(0,r.jsx)(s.td,{children:"Enable backup to S3"})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsxs)(s.td,{children:[(0,r.jsx)(s.code,{children:"--etcd-s3-endpoint"})," value"]}),(0,r.jsx)(s.td,{}),(0,r.jsx)(s.td,{children:'"s3.amazonaws.com"'}),(0,r.jsx)(s.td,{children:"S3 endpoint url"})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsxs)(s.td,{children:[(0,r.jsx)(s.code,{children:"--etcd-s3-endpoint-ca"})," value"]}),(0,r.jsx)(s.td,{}),(0,r.jsx)(s.td,{}),(0,r.jsx)(s.td,{children:"S3 custom CA cert to connect to S3 endpoint"})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:(0,r.jsx)(s.code,{children:"--etcd-s3-skip-ssl-verify"})}),(0,r.jsx)(s.td,{}),(0,r.jsx)(s.td,{}),(0,r.jsx)(s.td,{children:"Disables S3 SSL certificate validation"})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsxs)(s.td,{children:[(0,r.jsx)(s.code,{children:"--etcd-s3-access-key"})," value"]}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.code,{children:"AWS_ACCESS_KEY_ID"})}),(0,r.jsx)(s.td,{}),(0,r.jsx)(s.td,{children:"S3 access key"})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsxs)(s.td,{children:[(0,r.jsx)(s.code,{children:"--etcd-s3-secret-key"})," value"]}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.code,{children:"AWS_SECRET_ACCESS_KEY"})}),(0,r.jsx)(s.td,{}),(0,r.jsx)(s.td,{children:"S3 secret key"})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsxs)(s.td,{children:[(0,r.jsx)(s.code,{children:"--etcd-s3-bucket"})," value"]}),(0,r.jsx)(s.td,{}),(0,r.jsx)(s.td,{}),(0,r.jsx)(s.td,{children:"S3 bucket name"})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsxs)(s.td,{children:[(0,r.jsx)(s.code,{children:"--etcd-s3-region"})," value"]}),(0,r.jsx)(s.td,{}),(0,r.jsx)(s.td,{children:'"us-east-1"'}),(0,r.jsx)(s.td,{children:"S3 region / bucket location (optional)"})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsxs)(s.td,{children:[(0,r.jsx)(s.code,{children:"--etcd-s3-folder"})," value"]}),(0,r.jsx)(s.td,{}),(0,r.jsx)(s.td,{}),(0,r.jsx)(s.td,{children:"S3 folder"})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:(0,r.jsx)(s.code,{children:"--etcd-s3-insecure"})}),(0,r.jsx)(s.td,{}),(0,r.jsx)(s.td,{}),(0,r.jsx)(s.td,{children:"Disables S3 over HTTPS"})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsxs)(s.td,{children:[(0,r.jsx)(s.code,{children:"--etcd-s3-timeout"})," value"]}),(0,r.jsx)(s.td,{}),(0,r.jsx)(s.td,{children:"5m0s"}),(0,r.jsx)(s.td,{children:"S3 timeout (default: 5m0s)"})]})]})]}),"\n",(0,r.jsx)(s.h3,{id:"cluster-options",children:"Cluster Options"}),"\n",(0,r.jsxs)(s.table,{children:[(0,r.jsx)(s.thead,{children:(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.th,{children:"Flag"}),(0,r.jsx)(s.th,{children:"Environment Variable"}),(0,r.jsx)(s.th,{children:"Description"})]})}),(0,r.jsxs)(s.tbody,{children:[(0,r.jsxs)(s.tr,{children:[(0,r.jsxs)(s.td,{children:[(0,r.jsx)(s.code,{children:"--token"})," value, ",(0,r.jsx)(s.code,{children:"-t"})," value"]}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.code,{children:"K3S_TOKEN"})}),(0,r.jsx)(s.td,{children:"Shared secret used to join a server or agent to a cluster"})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsxs)(s.td,{children:[(0,r.jsx)(s.code,{children:"--token-file"})," value"]}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.code,{children:"K3S_TOKEN_FILE"})}),(0,r.jsx)(s.td,{children:"File containing the cluster-secret/token"})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsxs)(s.td,{children:[(0,r.jsx)(s.code,{children:"--agent-token"})," value"]}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.code,{children:"K3S_AGENT_TOKEN"})}),(0,r.jsx)(s.td,{children:"Shared secret used to join agents to the cluster, but not servers"})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsxs)(s.td,{children:[(0,r.jsx)(s.code,{children:"--agent-token-file"})," value"]}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.code,{children:"K3S_AGENT_TOKEN_FILE"})}),(0,r.jsx)(s.td,{children:"File containing the agent secret"})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsxs)(s.td,{children:[(0,r.jsx)(s.code,{children:"--server"})," value"]}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.code,{children:"K3S_URL"})}),(0,r.jsx)(s.td,{children:"Server to connect to, used to join a cluster"})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:(0,r.jsx)(s.code,{children:"--cluster-init"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.code,{children:"K3S_CLUSTER_INIT"})}),(0,r.jsx)(s.td,{children:"Initialize a new cluster using embedded Etcd"})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:(0,r.jsx)(s.code,{children:"--cluster-reset"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.code,{children:"K3S_CLUSTER_RESET"})}),(0,r.jsx)(s.td,{children:"Forget all peers and become sole member of a new cluster"})]})]})]}),"\n",(0,r.jsx)(s.h3,{id:"admin-kubeconfig-options",children:"Admin Kubeconfig Options"}),"\n",(0,r.jsxs)(s.table,{children:[(0,r.jsx)(s.thead,{children:(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.th,{children:"Flag"}),(0,r.jsx)(s.th,{children:"Environment Variable"}),(0,r.jsx)(s.th,{children:"Description"})]})}),(0,r.jsxs)(s.tbody,{children:[(0,r.jsxs)(s.tr,{children:[(0,r.jsxs)(s.td,{children:[(0,r.jsx)(s.code,{children:"--write-kubeconfig value, -o"})," value"]}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.code,{children:"K3S_KUBECONFIG_OUTPUT"})}),(0,r.jsx)(s.td,{children:"Write kubeconfig for admin client to this file"})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsxs)(s.td,{children:[(0,r.jsx)(s.code,{children:"--write-kubeconfig-mode"})," value"]}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.code,{children:"K3S_KUBECONFIG_MODE"})}),(0,r.jsxs)(s.td,{children:["Write kubeconfig with this ",(0,r.jsx)(s.a,{href:"https://en.wikipedia.org/wiki/Chmod",children:"mode."})," The kubeconfig file is owned by root, and written with a default mode of 600. Changing the mode to 644 will allow it to be read by other unprivileged users on the host."]})]})]})]}),"\n",(0,r.jsx)(s.h2,{id:"advanced-options",children:"Advanced Options"}),"\n",(0,r.jsx)(s.h3,{id:"logging",children:"Logging"}),"\n",(0,r.jsxs)(s.table,{children:[(0,r.jsx)(s.thead,{children:(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.th,{children:"Flag"}),(0,r.jsx)(s.th,{children:"Default"}),(0,r.jsx)(s.th,{children:"Description"})]})}),(0,r.jsxs)(s.tbody,{children:[(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:(0,r.jsx)(s.code,{children:"--debug"})}),(0,r.jsx)(s.td,{children:"N/A"}),(0,r.jsx)(s.td,{children:"Turn on debug logs"})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsxs)(s.td,{children:[(0,r.jsx)(s.code,{children:"-v"})," value"]}),(0,r.jsx)(s.td,{children:"0"}),(0,r.jsx)(s.td,{children:"Number for the log level verbosity"})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsxs)(s.td,{children:[(0,r.jsx)(s.code,{children:"--vmodule"})," value"]}),(0,r.jsx)(s.td,{children:"N/A"}),(0,r.jsx)(s.td,{children:"Comma-separated list of FILE_PATTERN=LOG_LEVEL settings for file-filtered logging"})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsxs)(s.td,{children:[(0,r.jsx)(s.code,{children:"--log value, -l"})," value"]}),(0,r.jsx)(s.td,{children:"N/A"}),(0,r.jsx)(s.td,{children:"Log to file"})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:(0,r.jsx)(s.code,{children:"--alsologtostderr"})}),(0,r.jsx)(s.td,{children:"N/A"}),(0,r.jsx)(s.td,{children:"Log to standard error as well as file (if set)"})]})]})]}),"\n",(0,r.jsx)(s.h3,{id:"listeners",children:"Listeners"}),"\n",(0,r.jsxs)(s.table,{children:[(0,r.jsx)(s.thead,{children:(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.th,{children:"Flag"}),(0,r.jsx)(s.th,{children:"Default"}),(0,r.jsx)(s.th,{children:"Description"})]})}),(0,r.jsxs)(s.tbody,{children:[(0,r.jsxs)(s.tr,{children:[(0,r.jsxs)(s.td,{children:[(0,r.jsx)(s.code,{children:"--bind-address"})," value"]}),(0,r.jsx)(s.td,{children:"0.0.0.0"}),(0,r.jsx)(s.td,{children:"k3s bind address"})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsxs)(s.td,{children:[(0,r.jsx)(s.code,{children:"--https-listen-port"})," value"]}),(0,r.jsx)(s.td,{children:"6443"}),(0,r.jsx)(s.td,{children:"HTTPS listen port"})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsxs)(s.td,{children:[(0,r.jsx)(s.code,{children:"--advertise-address"})," value"]}),(0,r.jsx)(s.td,{children:"node-external-ip/node-ip"}),(0,r.jsxs)(s.td,{children:["IPv4/IPv6 address that apiserver advertises for its service endpoint",(0,r.jsx)("br",{}),"Note that the primary ",(0,r.jsx)(s.code,{children:"service-cidr"})," IP range must be of the same address family as the advertised address"]})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsxs)(s.td,{children:[(0,r.jsx)(s.code,{children:"--advertise-port"})," value"]}),(0,r.jsx)(s.td,{children:"listen-port/0"}),(0,r.jsx)(s.td,{children:"Port that apiserver uses to advertise to members of the cluster"})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsxs)(s.td,{children:[(0,r.jsx)(s.code,{children:"--tls-san"})," value"]}),(0,r.jsx)(s.td,{children:"N/A"}),(0,r.jsx)(s.td,{children:"Add additional hostnames or IPv4/IPv6 addresses as Subject Alternative Names on the TLS cert"})]})]})]}),"\n",(0,r.jsx)(s.h3,{id:"data",children:"Data"}),"\n",(0,r.jsxs)(s.table,{children:[(0,r.jsx)(s.thead,{children:(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.th,{children:"Flag"}),(0,r.jsx)(s.th,{children:"Default"}),(0,r.jsx)(s.th,{children:"Description"})]})}),(0,r.jsx)(s.tbody,{children:(0,r.jsxs)(s.tr,{children:[(0,r.jsxs)(s.td,{children:[(0,r.jsx)(s.code,{children:"--data-dir value, -d"})," value"]}),(0,r.jsxs)(s.td,{children:[(0,r.jsx)(s.code,{children:"/var/lib/rancher/k3s"})," or ",(0,r.jsx)(s.code,{children:"${HOME}/.rancher/k3s"})," if not root"]}),(0,r.jsx)(s.td,{children:"Folder to hold state"})]})})]}),"\n",(0,r.jsx)(s.h3,{id:"secrets-encryption",children:"Secrets Encryption"}),"\n",(0,r.jsxs)(s.table,{children:[(0,r.jsx)(s.thead,{children:(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.th,{children:"Flag"}),(0,r.jsx)(s.th,{children:"Default"}),(0,r.jsx)(s.th,{children:"Description"})]})}),(0,r.jsx)(s.tbody,{children:(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:(0,r.jsx)(s.code,{children:"--secrets-encryption"})}),(0,r.jsx)(s.td,{children:"false"}),(0,r.jsx)(s.td,{children:"Enable Secret encryption at rest"})]})})]}),"\n",(0,r.jsx)(s.h3,{id:"networking",children:"Networking"}),"\n",(0,r.jsxs)(s.table,{children:[(0,r.jsx)(s.thead,{children:(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.th,{children:"Flag"}),(0,r.jsx)(s.th,{children:"Default"}),(0,r.jsx)(s.th,{children:"Description"})]})}),(0,r.jsxs)(s.tbody,{children:[(0,r.jsxs)(s.tr,{children:[(0,r.jsxs)(s.td,{children:[(0,r.jsx)(s.code,{children:"--cluster-cidr"})," value"]}),(0,r.jsx)(s.td,{children:'"10.42.0.0/16"'}),(0,r.jsx)(s.td,{children:"IPv4/IPv6 network CIDRs to use for pod IPs"})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsxs)(s.td,{children:[(0,r.jsx)(s.code,{children:"--service-cidr"})," value"]}),(0,r.jsx)(s.td,{children:'"10.43.0.0/16"'}),(0,r.jsx)(s.td,{children:"IPv4/IPv6 network CIDRs to use for service IPs"})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsxs)(s.td,{children:[(0,r.jsx)(s.code,{children:"--service-node-port-range"})," value"]}),(0,r.jsx)(s.td,{children:'"30000-32767"'}),(0,r.jsx)(s.td,{children:"Port range to reserve for services with NodePort visibility"})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsxs)(s.td,{children:[(0,r.jsx)(s.code,{children:"--cluster-dns"})," value"]}),(0,r.jsx)(s.td,{children:'"10.43.0.10"'}),(0,r.jsx)(s.td,{children:"IPv4 Cluster IP for coredns service. Should be in your service-cidr range"})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsxs)(s.td,{children:[(0,r.jsx)(s.code,{children:"--cluster-domain"})," value"]}),(0,r.jsx)(s.td,{children:'"cluster.local"'}),(0,r.jsx)(s.td,{children:"Cluster Domain"})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsxs)(s.td,{children:[(0,r.jsx)(s.code,{children:"--flannel-backend"})," value"]}),(0,r.jsx)(s.td,{children:'"vxlan"'}),(0,r.jsx)(s.td,{children:"One of 'none', 'vxlan', 'ipsec'(deprecated), 'host-gw', 'wireguard-native', or 'wireguard'(deprecated)"})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:(0,r.jsx)(s.code,{children:"--flannel-ipv6-masq"})}),(0,r.jsx)(s.td,{children:'"N/A"'}),(0,r.jsx)(s.td,{children:"Enable IPv6 masquerading for pod"})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:(0,r.jsx)(s.code,{children:"--flannel-external-ip"})}),(0,r.jsx)(s.td,{children:'"N/A"'}),(0,r.jsx)(s.td,{children:"Use node external IP addresses for Flannel traffic"})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsxs)(s.td,{children:[(0,r.jsx)(s.code,{children:"--servicelb-namespace"})," value"]}),(0,r.jsx)(s.td,{children:'"kube-system"'}),(0,r.jsx)(s.td,{children:"Namespace of the pods for the servicelb component"})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsxs)(s.td,{children:[(0,r.jsx)(s.code,{children:"--egress-selector-mode"})," value"]}),(0,r.jsx)(s.td,{children:'"agent"'}),(0,r.jsxs)(s.td,{children:["Must be one of the following: ",(0,r.jsxs)("ul",{children:[(0,r.jsx)("li",{children:"disabled: The apiserver does not use agent tunnels to communicate with nodes. Requires that servers run agents, and have direct connectivity to the kubelet on agents, or the apiserver will not be able to function access service endpoints or perform kubectl exec and kubectl logs."}),(0,r.jsx)("li",{children:"agent: The apiserver uses agent tunnels to communicate with nodes. Nodes allow the tunnel connection from loopback addresses. Requires that servers also run agents, or the apiserver will not be able to access service endpoints. The historical default for k3s."}),(0,r.jsx)("li",{children:" pod: The apiserver uses agent tunnels to communicate with nodes and service endpoints, routing endpoint connections to the correct agent by watching Nodes. Nodes allow the tunnel connection from loopback addresses, or a CIDR assigned to their node."}),(0,r.jsx)("li",{children:" cluster: The apiserver uses agent tunnels to communicate with nodes and service endpoints, routing endpoint connections to the correct agent by watching Endpoints. Nodes allow the tunnel connection from loopback addresses, or the configured cluster CIDR range."})]})]})]})]})]}),"\n",(0,r.jsx)(s.h3,{id:"storage-class",children:"Storage Class"}),"\n",(0,r.jsxs)(s.table,{children:[(0,r.jsx)(s.thead,{children:(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.th,{children:"Flag"}),(0,r.jsx)(s.th,{children:"Description"})]})}),(0,r.jsx)(s.tbody,{children:(0,r.jsxs)(s.tr,{children:[(0,r.jsxs)(s.td,{children:[(0,r.jsx)(s.code,{children:"--default-local-storage-path"})," value"]}),(0,r.jsx)(s.td,{children:"Default local storage path for local provisioner storage class"})]})})]}),"\n",(0,r.jsx)(s.h3,{id:"kubernetes-components",children:"Kubernetes Components"}),"\n",(0,r.jsxs)(s.table,{children:[(0,r.jsx)(s.thead,{children:(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.th,{children:"Flag"}),(0,r.jsx)(s.th,{children:"Description"})]})}),(0,r.jsxs)(s.tbody,{children:[(0,r.jsxs)(s.tr,{children:[(0,r.jsxs)(s.td,{children:[(0,r.jsx)(s.code,{children:"--disable"})," value"]}),(0,r.jsxs)(s.td,{children:['See "',(0,r.jsxs)(s.a,{href:"/installation/packaged-components#using-the---disable-flag",children:["Using the ",(0,r.jsx)(s.code,{children:"--disable"})," flag"]}),'"']})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:(0,r.jsx)(s.code,{children:"--disable-scheduler"})}),(0,r.jsx)(s.td,{children:"Disable Kubernetes default scheduler"})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:(0,r.jsx)(s.code,{children:"--disable-cloud-controller"})}),(0,r.jsx)(s.td,{children:"Disable k3s default cloud controller manager"})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:(0,r.jsx)(s.code,{children:"--disable-kube-proxy"})}),(0,r.jsx)(s.td,{children:"Disable running kube-proxy"})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:(0,r.jsx)(s.code,{children:"--disable-network-policy"})}),(0,r.jsx)(s.td,{children:"Disable k3s default network policy controller"})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:(0,r.jsx)(s.code,{children:"--disable-helm-controller"})}),(0,r.jsx)(s.td,{children:"Disable Helm controller"})]})]})]}),"\n",(0,r.jsx)(s.h3,{id:"customized-flags-for-kubernetes-processes",children:"Customized Flags for Kubernetes Processes"}),"\n",(0,r.jsxs)(s.table,{children:[(0,r.jsx)(s.thead,{children:(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.th,{children:"Flag"}),(0,r.jsx)(s.th,{children:"Description"})]})}),(0,r.jsxs)(s.tbody,{children:[(0,r.jsxs)(s.tr,{children:[(0,r.jsxs)(s.td,{children:[(0,r.jsx)(s.code,{children:"--etcd-arg"})," value"]}),(0,r.jsx)(s.td,{children:"Customized flag for etcd process"})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsxs)(s.td,{children:[(0,r.jsx)(s.code,{children:"--kube-apiserver-arg"})," value"]}),(0,r.jsx)(s.td,{children:"Customized flag for kube-apiserver process"})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsxs)(s.td,{children:[(0,r.jsx)(s.code,{children:"--kube-scheduler-arg"})," value"]}),(0,r.jsx)(s.td,{children:"Customized flag for kube-scheduler process"})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsxs)(s.td,{children:[(0,r.jsx)(s.code,{children:"--kube-controller-manager-arg"})," value"]}),(0,r.jsx)(s.td,{children:"Customized flag for kube-controller-manager process"})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsxs)(s.td,{children:[(0,r.jsx)(s.code,{children:"--kube-cloud-controller-manager-arg"})," value"]}),(0,r.jsx)(s.td,{children:"Customized flag for kube-cloud-controller-manager process"})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsxs)(s.td,{children:[(0,r.jsx)(s.code,{children:"--kubelet-arg"})," value"]}),(0,r.jsx)(s.td,{children:"Customized flag for kubelet process"})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsxs)(s.td,{children:[(0,r.jsx)(s.code,{children:"--kube-proxy-arg"})," value"]}),(0,r.jsx)(s.td,{children:"Customized flag for kube-proxy process"})]})]})]}),"\n",(0,r.jsx)(s.h3,{id:"experimental-options",children:"Experimental Options"}),"\n",(0,r.jsxs)(s.table,{children:[(0,r.jsx)(s.thead,{children:(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.th,{children:"Flag"}),(0,r.jsx)(s.th,{children:"Description"})]})}),(0,r.jsxs)(s.tbody,{children:[(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:(0,r.jsx)(s.code,{children:"--rootless"})}),(0,r.jsx)(s.td,{children:"Run rootless"})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:(0,r.jsx)(s.code,{children:"--enable-pprof"})}),(0,r.jsx)(s.td,{children:"Enable pprof endpoint on supervisor port"})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:(0,r.jsx)(s.code,{children:"--docker"})}),(0,r.jsx)(s.td,{children:"Use cri-dockerd instead of containerd"})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:(0,r.jsx)(s.code,{children:"--prefer-bundled-bin"})}),(0,r.jsx)(s.td,{children:"Prefer bundled userspace binaries over host binaries"})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:(0,r.jsx)(s.code,{children:"--disable-agent"})}),(0,r.jsxs)(s.td,{children:['See "',(0,r.jsx)(s.a,{href:"/advanced#running-agentless-servers-experimental",children:"Running Agentless Servers (Experimental)"}),'"']})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:(0,r.jsx)(s.code,{children:"--embedded-registry"})}),(0,r.jsxs)(s.td,{children:['See "',(0,r.jsx)(s.a,{href:"/installation/registry-mirror",children:"Embedded Registry Mirror"}),'"']})]})]})]}),"\n",(0,r.jsx)(s.h3,{id:"deprecated-options",children:"Deprecated Options"}),"\n",(0,r.jsxs)(s.table,{children:[(0,r.jsx)(s.thead,{children:(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.th,{children:"Flag"}),(0,r.jsx)(s.th,{children:"Environment Variable"}),(0,r.jsx)(s.th,{children:"Description"})]})}),(0,r.jsxs)(s.tbody,{children:[(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:(0,r.jsx)(s.code,{children:"--no-flannel"})}),(0,r.jsx)(s.td,{children:"N/A"}),(0,r.jsxs)(s.td,{children:["Use ",(0,r.jsx)(s.code,{children:"--flannel-backend=none"})]})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsxs)(s.td,{children:[(0,r.jsx)(s.code,{children:"--no-deploy"})," value"]}),(0,r.jsx)(s.td,{children:"N/A"}),(0,r.jsxs)(s.td,{children:["Use ",(0,r.jsx)(s.code,{children:"--disable"})]})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsxs)(s.td,{children:[(0,r.jsx)(s.code,{children:"--cluster-secret"})," value"]}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.code,{children:"K3S_CLUSTER_SECRET"})}),(0,r.jsxs)(s.td,{children:["Use ",(0,r.jsx)(s.code,{children:"--token"})]})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsxs)(s.td,{children:[(0,r.jsx)(s.code,{children:"--flannel-backend"})," wireguard"]}),(0,r.jsx)(s.td,{children:"N/A"}),(0,r.jsxs)(s.td,{children:["Use ",(0,r.jsx)(s.code,{children:"--flannel-backend=wireguard-native"})]})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsxs)(s.td,{children:[(0,r.jsx)(s.code,{children:"--flannel-backend"})," value=option1=value"]}),(0,r.jsx)(s.td,{children:"N/A"}),(0,r.jsxs)(s.td,{children:["Use ",(0,r.jsx)(s.code,{children:"--flannel-conf"})," to specify the flannel config file with the backend config"]})]})]})]}),"\n",(0,r.jsx)(s.h2,{id:"k3s-server-cli-help",children:"K3s Server CLI Help"}),"\n",(0,r.jsxs)(s.blockquote,{children:["\n",(0,r.jsxs)(s.p,{children:["If an option appears in brackets below, for example ",(0,r.jsx)(s.code,{children:"[$K3S_TOKEN]"}),", it means that the option can be passed in as an environment variable of that name."]}),"\n"]}),"\n",(0,r.jsx)(s.pre,{children:(0,r.jsx)(s.code,{className:"language-bash",children:'NAME:\n k3s server - Run management server\n\nUSAGE:\n k3s server [OPTIONS]\n\nOPTIONS:\n --config FILE, -c FILE (config) Load configuration from FILE (default: "/etc/rancher/k3s/config.yaml") [$K3S_CONFIG_FILE]\n --debug (logging) Turn on debug logs [$K3S_DEBUG]\n -v value (logging) Number for the log level verbosity (default: 0)\n --vmodule value (logging) Comma-separated list of FILE_PATTERN=LOG_LEVEL settings for file-filtered logging\n --log value, -l value (logging) Log to file\n --alsologtostderr (logging) Log to standard error as well as file (if set)\n --bind-address value (listener) k3s bind address (default: 0.0.0.0)\n --https-listen-port value (listener) HTTPS listen port (default: 6443)\n --advertise-address value (listener) IPv4 address that apiserver uses to advertise to members of the cluster (default: node-external-ip/node-ip)\n --advertise-port value (listener) Port that apiserver uses to advertise to members of the cluster (default: listen-port) (default: 0)\n --tls-san value (listener) Add additional hostnames or IPv4/IPv6 addresses as Subject Alternative Names on the server TLS cert\n --data-dir value, -d value (data) Folder to hold state (default: /var/lib/rancher/k3s or ${HOME}/.rancher/k3s if not root)\n --cluster-cidr value (networking) IPv4/IPv6 network CIDRs to use for pod IPs (default: 10.42.0.0/16)\n --service-cidr value (networking) IPv4/IPv6 network CIDRs to use for service IPs (default: 10.43.0.0/16)\n --service-node-port-range value (networking) Port range to reserve for services with NodePort visibility (default: "30000-32767")\n --cluster-dns value (networking) IPv4 Cluster IP for coredns service. Should be in your service-cidr range (default: 10.43.0.10)\n --cluster-domain value (networking) Cluster Domain (default: "cluster.local")\n --flannel-backend value (networking) backend<=option1=val1,option2=val2> where backend is one of \'none\', \'vxlan\', \'ipsec\' (deprecated), \'host-gw\', \'wireguard-native\', \'wireguard\' (deprecated) (default: "vxlan")\n --flannel-ipv6-masq (networking) Enable IPv6 masquerading for pod\n --flannel-external-ip (networking) Use node external IP addresses for Flannel traffic\n --egress-selector-mode value (networking) One of \'agent\', \'cluster\', \'pod\', \'disabled\' (default: "agent")\n --servicelb-namespace value (networking) Namespace of the pods for the servicelb component (default: "kube-system")\n --write-kubeconfig value, -o value (client) Write kubeconfig for admin client to this file [$K3S_KUBECONFIG_OUTPUT]\n --write-kubeconfig-mode value (client) Write kubeconfig with this mode [$K3S_KUBECONFIG_MODE]\n --token value, -t value (cluster) Shared secret used to join a server or agent to a cluster [$K3S_TOKEN]\n --token-file value (cluster) File containing the token [$K3S_TOKEN_FILE]\n --agent-token value (cluster) Shared secret used to join agents to the cluster, but not servers [$K3S_AGENT_TOKEN]\n --agent-token-file value (cluster) File containing the agent secret [$K3S_AGENT_TOKEN_FILE]\n --server value, -s value (cluster) Server to connect to, used to join a cluster [$K3S_URL]\n --cluster-init (cluster) Initialize a new cluster using embedded Etcd [$K3S_CLUSTER_INIT]\n --cluster-reset (cluster) Forget all peers and become sole member of a new cluster [$K3S_CLUSTER_RESET]\n --cluster-reset-restore-path value (db) Path to snapshot file to be restored\n --kube-apiserver-arg value (flags) Customized flag for kube-apiserver process\n --etcd-arg value (flags) Customized flag for etcd process\n --kube-controller-manager-arg value (flags) Customized flag for kube-controller-manager process\n --kube-scheduler-arg value (flags) Customized flag for kube-scheduler process\n --kube-cloud-controller-manager-arg value (flags) Customized flag for kube-cloud-controller-manager process\n --datastore-endpoint value (db) Specify etcd, Mysql, Postgres, or Sqlite (default) data source name [$K3S_DATASTORE_ENDPOINT]\n --datastore-cafile value (db) TLS Certificate Authority file used to secure datastore backend communication [$K3S_DATASTORE_CAFILE]\n --datastore-certfile value (db) TLS certification file used to secure datastore backend communication [$K3S_DATASTORE_CERTFILE]\n --datastore-keyfile value (db) TLS key file used to secure datastore backend communication [$K3S_DATASTORE_KEYFILE]\n --etcd-expose-metrics (db) Expose etcd metrics to client interface. (default: false)\n --etcd-disable-snapshots (db) Disable automatic etcd snapshots\n --etcd-snapshot-name value (db) Set the base name of etcd snapshots (default: etcd-snapshot-) (default: "etcd-snapshot")\n --etcd-snapshot-schedule-cron value (db) Snapshot interval time in cron spec. eg. every 5 hours \'* */5 * * *\' (default: "0 */12 * * *")\n --etcd-snapshot-retention value (db) Number of snapshots to retain (default: 5)\n --etcd-snapshot-dir value (db) Directory to save db snapshots. (default: ${data-dir}/db/snapshots)\n --etcd-snapshot-compress (db) Compress etcd snapshot\n --etcd-s3 (db) Enable backup to S3\n --etcd-s3-endpoint value (db) S3 endpoint url (default: "s3.amazonaws.com")\n --etcd-s3-endpoint-ca value (db) S3 custom CA cert to connect to S3 endpoint\n --etcd-s3-skip-ssl-verify (db) Disables S3 SSL certificate validation\n --etcd-s3-access-key value (db) S3 access key [$AWS_ACCESS_KEY_ID]\n --etcd-s3-secret-key value (db) S3 secret key [$AWS_SECRET_ACCESS_KEY]\n --etcd-s3-bucket value (db) S3 bucket name\n --etcd-s3-region value (db) S3 region / bucket location (optional) (default: "us-east-1")\n --etcd-s3-folder value (db) S3 folder\n --etcd-s3-insecure (db) Disables S3 over HTTPS\n --etcd-s3-timeout value (db) S3 timeout (default: 5m0s)\n --default-local-storage-path value (storage) Default local storage path for local provisioner storage class\n --disable value (components) Do not deploy packaged components and delete any deployed components (valid items: coredns, servicelb, traefik, local-storage, metrics-server)\n --disable-scheduler (components) Disable Kubernetes default scheduler\n --disable-cloud-controller (components) Disable k3s default cloud controller manager\n --disable-kube-proxy (components) Disable running kube-proxy\n --disable-network-policy (components) Disable k3s default network policy controller\n --disable-helm-controller (components) Disable Helm controller\n --node-name value (agent/node) Node name [$K3S_NODE_NAME]\n --with-node-id (agent/node) Append id to node name\n --node-label value (agent/node) Registering and starting kubelet with set of labels\n --node-taint value (agent/node) Registering kubelet with set of taints\n --image-credential-provider-bin-dir value (agent/node) The path to the directory where credential provider plugin binaries are located (default: "/var/lib/rancher/credentialprovider/bin")\n --image-credential-provider-config value (agent/node) The path to the credential provider plugin config file (default: "/var/lib/rancher/credentialprovider/config.yaml")\n --docker (agent/runtime) (experimental) Use cri-dockerd instead of containerd\n --container-runtime-endpoint value (agent/runtime) Disable embedded containerd and use the CRI socket at the given path; when used with --docker this sets the docker socket path\n --pause-image value (agent/runtime) Customized pause image for containerd or docker sandbox (default: "rancher/mirrored-pause:3.6")\n --snapshotter value (agent/runtime) Override default containerd snapshotter (default: "overlayfs")\n --private-registry value (agent/runtime) Private registry configuration file (default: "/etc/rancher/k3s/registries.yaml")\n --system-default-registry value (agent/runtime) Private registry to be used for all system images [$K3S_SYSTEM_DEFAULT_REGISTRY]\n --node-ip value, -i value (agent/networking) IPv4/IPv6 addresses to advertise for node\n --node-external-ip value (agent/networking) IPv4/IPv6 external IP addresses to advertise for node\n --resolv-conf value (agent/networking) Kubelet resolv.conf file [$K3S_RESOLV_CONF]\n --flannel-iface value (agent/networking) Override default flannel interface\n --flannel-conf value (agent/networking) Override default flannel config file\n --flannel-cni-conf value (agent/networking) Override default flannel cni config file\n --kubelet-arg value (agent/flags) Customized flag for kubelet process\n --kube-proxy-arg value (agent/flags) Customized flag for kube-proxy process\n --protect-kernel-defaults (agent/node) Kernel tuning behavior. If set, error if kernel tunables are different than kubelet defaults.\n --secrets-encryption Enable secret encryption at rest\n --enable-pprof (experimental) Enable pprof endpoint on supervisor port\n --rootless (experimental) Run rootless\n --prefer-bundled-bin (experimental) Prefer bundled userspace binaries over host binaries\n --selinux (agent/node) Enable SELinux in containerd [$K3S_SELINUX]\n --lb-server-port value (agent/node) Local port for supervisor client load-balancer. If the supervisor and apiserver are not colocated an additional port 1 less than this port will also be used for the apiserver client load-balancer. (default: 6444) [$K3S_LB_SERVER_PORT]\n'})})]})}function h(e={}){const{wrapper:s}={...(0,t.a)(),...e.components};return s?(0,r.jsx)(s,{...e,children:(0,r.jsx)(a,{...e})}):a(e)}},1151:(e,s,n)=>{n.d(s,{Z:()=>i,a:()=>l});var r=n(7294);const t={},d=r.createContext(t);function l(e){const s=r.useContext(d);return r.useMemo((function(){return"function"==typeof e?e(s):{...s,...e}}),[s,e])}function i(e){let s;return s=e.disableParentContext?"function"==typeof e.components?e.components(t):e.components||t:l(e.components),r.createElement(d.Provider,{value:s},e.children)}}}]); \ No newline at end of file +"use strict";(self.webpackChunkk_3_s_docs=self.webpackChunkk_3_s_docs||[]).push([[1340],{2644:(e,s,n)=>{n.r(s),n.d(s,{assets:()=>c,contentTitle:()=>l,default:()=>h,frontMatter:()=>d,metadata:()=>i,toc:()=>o});var r=n(5893),t=n(1151);const d={title:"server"},l="k3s server",i={id:"cli/server",title:"server",description:"In this section, you'll learn how to configure the K3s server.",source:"@site/docs/cli/server.md",sourceDirName:"cli",slug:"/cli/server",permalink:"/cli/server",draft:!1,unlisted:!1,editUrl:"https://github.com/k3s-io/docs/edit/main/docs/cli/server.md",tags:[],version:"current",lastUpdatedAt:1723747404e3,frontMatter:{title:"server"},sidebar:"mySidebar",previous:{title:"CLI Tools",permalink:"/cli/"},next:{title:"agent",permalink:"/cli/agent"}},c={},o=[{value:"Critical Configuration Values",id:"critical-configuration-values",level:2},{value:"Commonly Used Options",id:"commonly-used-options",level:2},{value:"Database",id:"database",level:3},{value:"Cluster Options",id:"cluster-options",level:3},{value:"Admin Kubeconfig Options",id:"admin-kubeconfig-options",level:3},{value:"Advanced Options",id:"advanced-options",level:2},{value:"Logging",id:"logging",level:3},{value:"Listeners",id:"listeners",level:3},{value:"Data",id:"data",level:3},{value:"Secrets Encryption",id:"secrets-encryption",level:3},{value:"Networking",id:"networking",level:3},{value:"Storage Class",id:"storage-class",level:3},{value:"Kubernetes Components",id:"kubernetes-components",level:3},{value:"Customized Flags for Kubernetes Processes",id:"customized-flags-for-kubernetes-processes",level:3},{value:"Experimental Options",id:"experimental-options",level:3},{value:"Deprecated Options",id:"deprecated-options",level:3},{value:"K3s Server CLI Help",id:"k3s-server-cli-help",level:2}];function a(e){const s={a:"a",blockquote:"blockquote",code:"code",em:"em",h1:"h1",h2:"h2",h3:"h3",header:"header",li:"li",p:"p",pre:"pre",table:"table",tbody:"tbody",td:"td",th:"th",thead:"thead",tr:"tr",ul:"ul",...(0,t.a)(),...e.components};return(0,r.jsxs)(r.Fragment,{children:[(0,r.jsx)(s.header,{children:(0,r.jsx)(s.h1,{id:"k3s-server",children:"k3s server"})}),"\n",(0,r.jsx)(s.p,{children:"In this section, you'll learn how to configure the K3s server."}),"\n",(0,r.jsxs)(s.p,{children:["Note that servers also run an agent, so all of the configuration options listed in the ",(0,r.jsxs)(s.a,{href:"/cli/agent",children:[(0,r.jsx)(s.code,{children:"k3s agent"})," documentation"]})," are also supported on servers."]}),"\n",(0,r.jsxs)(s.p,{children:["Options are documented on this page as CLI flags, but can also be passed as configuration file options. See the ",(0,r.jsx)(s.a,{href:"/installation/configuration#configuration-file",children:"Configuration File"})," documentation for more information on using YAML configuration files."]}),"\n",(0,r.jsx)(s.h2,{id:"critical-configuration-values",children:"Critical Configuration Values"}),"\n",(0,r.jsx)(s.p,{children:"The following options must be set to the same value on all servers in the cluster. Failure to do so will cause new servers to fail to join the cluster when using embedded etcd, or incorrect operation of the cluster when using an external datastore."}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:(0,r.jsx)(s.code,{children:"--agent-token"})}),"\n",(0,r.jsx)(s.li,{children:(0,r.jsx)(s.code,{children:"--cluster-cidr"})}),"\n",(0,r.jsx)(s.li,{children:(0,r.jsx)(s.code,{children:"--cluster-dns"})}),"\n",(0,r.jsx)(s.li,{children:(0,r.jsx)(s.code,{children:"--cluster-domain"})}),"\n",(0,r.jsx)(s.li,{children:(0,r.jsx)(s.code,{children:"--disable-cloud-controller"})}),"\n",(0,r.jsx)(s.li,{children:(0,r.jsx)(s.code,{children:"--disable-helm-controller"})}),"\n",(0,r.jsx)(s.li,{children:(0,r.jsx)(s.code,{children:"--disable-network-policy"})}),"\n",(0,r.jsxs)(s.li,{children:[(0,r.jsx)(s.code,{children:"--disable=servicelb"})," ",(0,r.jsx)(s.em,{children:"note: other packaged components may be disabled on a per-server basis"})]}),"\n",(0,r.jsx)(s.li,{children:(0,r.jsx)(s.code,{children:"--egress-selector-mode"})}),"\n",(0,r.jsx)(s.li,{children:(0,r.jsx)(s.code,{children:"--embedded-registry"})}),"\n",(0,r.jsx)(s.li,{children:(0,r.jsx)(s.code,{children:"--flannel-backend"})}),"\n",(0,r.jsx)(s.li,{children:(0,r.jsx)(s.code,{children:"--flannel-external-ip"})}),"\n",(0,r.jsx)(s.li,{children:(0,r.jsx)(s.code,{children:"--flannel-ipv6-masq"})}),"\n",(0,r.jsx)(s.li,{children:(0,r.jsx)(s.code,{children:"--secrets-encryption"})}),"\n",(0,r.jsx)(s.li,{children:(0,r.jsx)(s.code,{children:"--service-cidr"})}),"\n"]}),"\n",(0,r.jsx)(s.h2,{id:"commonly-used-options",children:"Commonly Used Options"}),"\n",(0,r.jsx)(s.h3,{id:"database",children:"Database"}),"\n",(0,r.jsxs)(s.table,{children:[(0,r.jsx)(s.thead,{children:(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.th,{children:"Flag"}),(0,r.jsx)(s.th,{children:"Environment Variable"}),(0,r.jsx)(s.th,{children:"Default"}),(0,r.jsx)(s.th,{children:"Description"})]})}),(0,r.jsxs)(s.tbody,{children:[(0,r.jsxs)(s.tr,{children:[(0,r.jsxs)(s.td,{children:[(0,r.jsx)(s.code,{children:"--datastore-endpoint"})," value"]}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.code,{children:"K3S_DATASTORE_ENDPOINT"})}),(0,r.jsx)(s.td,{}),(0,r.jsx)(s.td,{children:"Specify etcd, Mysql, Postgres, or Sqlite data source name"})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsxs)(s.td,{children:[(0,r.jsx)(s.code,{children:"--datastore-cafile"})," value"]}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.code,{children:"K3S_DATASTORE_CAFILE"})}),(0,r.jsx)(s.td,{}),(0,r.jsx)(s.td,{children:"TLS Certificate Authority file used to secure datastore backend communication"})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsxs)(s.td,{children:[(0,r.jsx)(s.code,{children:"--datastore-certfile"})," value"]}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.code,{children:"K3S_DATASTORE_CERTFILE"})}),(0,r.jsx)(s.td,{}),(0,r.jsx)(s.td,{children:"TLS certification file used to secure datastore backend communication"})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsxs)(s.td,{children:[(0,r.jsx)(s.code,{children:"--datastore-keyfile"})," value"]}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.code,{children:"K3S_DATASTORE_KEYFILE"})}),(0,r.jsx)(s.td,{}),(0,r.jsx)(s.td,{children:"TLS key file used to secure datastore backend communication"})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:(0,r.jsx)(s.code,{children:"--etcd-expose-metrics"})}),(0,r.jsx)(s.td,{}),(0,r.jsx)(s.td,{children:"false"}),(0,r.jsx)(s.td,{children:"Expose etcd metrics to client interface"})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:(0,r.jsx)(s.code,{children:"--etcd-disable-snapshots"})}),(0,r.jsx)(s.td,{}),(0,r.jsx)(s.td,{children:"false"}),(0,r.jsx)(s.td,{children:"Disable automatic etcd snapshots"})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsxs)(s.td,{children:[(0,r.jsx)(s.code,{children:"--etcd-snapshot-name"})," value"]}),(0,r.jsx)(s.td,{}),(0,r.jsx)(s.td,{children:'"etcd-snapshot-"'}),(0,r.jsx)(s.td,{children:"Set the base name of etcd snapshots."})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsxs)(s.td,{children:[(0,r.jsx)(s.code,{children:"--etcd-snapshot-schedule-cron"})," value"]}),(0,r.jsx)(s.td,{}),(0,r.jsx)(s.td,{children:'"0 */12 * * *"'}),(0,r.jsx)(s.td,{children:"Snapshot interval time in cron spec. eg. every 5 hours '0 */5 _ * _'"})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsxs)(s.td,{children:[(0,r.jsx)(s.code,{children:"--etcd-snapshot-retention"})," value"]}),(0,r.jsx)(s.td,{}),(0,r.jsx)(s.td,{children:"5"}),(0,r.jsx)(s.td,{children:"Number of snapshots to retain"})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsxs)(s.td,{children:[(0,r.jsx)(s.code,{children:"--etcd-snapshot-dir"})," value"]}),(0,r.jsx)(s.td,{}),(0,r.jsx)(s.td,{children:"${data-dir}/db/snapshots"}),(0,r.jsx)(s.td,{children:"Directory to save db snapshots"})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:(0,r.jsx)(s.code,{children:"--etcd-s3"})}),(0,r.jsx)(s.td,{}),(0,r.jsx)(s.td,{}),(0,r.jsx)(s.td,{children:"Enable backup to S3"})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsxs)(s.td,{children:[(0,r.jsx)(s.code,{children:"--etcd-s3-endpoint"})," value"]}),(0,r.jsx)(s.td,{}),(0,r.jsx)(s.td,{children:'"s3.amazonaws.com"'}),(0,r.jsx)(s.td,{children:"S3 endpoint url"})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsxs)(s.td,{children:[(0,r.jsx)(s.code,{children:"--etcd-s3-endpoint-ca"})," value"]}),(0,r.jsx)(s.td,{}),(0,r.jsx)(s.td,{}),(0,r.jsx)(s.td,{children:"S3 custom CA cert to connect to S3 endpoint"})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:(0,r.jsx)(s.code,{children:"--etcd-s3-skip-ssl-verify"})}),(0,r.jsx)(s.td,{}),(0,r.jsx)(s.td,{}),(0,r.jsx)(s.td,{children:"Disables S3 SSL certificate validation"})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsxs)(s.td,{children:[(0,r.jsx)(s.code,{children:"--etcd-s3-access-key"})," value"]}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.code,{children:"AWS_ACCESS_KEY_ID"})}),(0,r.jsx)(s.td,{}),(0,r.jsx)(s.td,{children:"S3 access key"})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsxs)(s.td,{children:[(0,r.jsx)(s.code,{children:"--etcd-s3-secret-key"})," value"]}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.code,{children:"AWS_SECRET_ACCESS_KEY"})}),(0,r.jsx)(s.td,{}),(0,r.jsx)(s.td,{children:"S3 secret key"})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsxs)(s.td,{children:[(0,r.jsx)(s.code,{children:"--etcd-s3-bucket"})," value"]}),(0,r.jsx)(s.td,{}),(0,r.jsx)(s.td,{}),(0,r.jsx)(s.td,{children:"S3 bucket name"})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsxs)(s.td,{children:[(0,r.jsx)(s.code,{children:"--etcd-s3-region"})," value"]}),(0,r.jsx)(s.td,{}),(0,r.jsx)(s.td,{children:'"us-east-1"'}),(0,r.jsx)(s.td,{children:"S3 region / bucket location (optional)"})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsxs)(s.td,{children:[(0,r.jsx)(s.code,{children:"--etcd-s3-folder"})," value"]}),(0,r.jsx)(s.td,{}),(0,r.jsx)(s.td,{}),(0,r.jsx)(s.td,{children:"S3 folder"})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:(0,r.jsx)(s.code,{children:"--etcd-s3-insecure"})}),(0,r.jsx)(s.td,{}),(0,r.jsx)(s.td,{}),(0,r.jsx)(s.td,{children:"Disables S3 over HTTPS"})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsxs)(s.td,{children:[(0,r.jsx)(s.code,{children:"--etcd-s3-timeout"})," value"]}),(0,r.jsx)(s.td,{}),(0,r.jsx)(s.td,{children:"5m0s"}),(0,r.jsx)(s.td,{children:"S3 timeout (default: 5m0s)"})]})]})]}),"\n",(0,r.jsx)(s.h3,{id:"cluster-options",children:"Cluster Options"}),"\n",(0,r.jsxs)(s.table,{children:[(0,r.jsx)(s.thead,{children:(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.th,{children:"Flag"}),(0,r.jsx)(s.th,{children:"Environment Variable"}),(0,r.jsx)(s.th,{children:"Description"})]})}),(0,r.jsxs)(s.tbody,{children:[(0,r.jsxs)(s.tr,{children:[(0,r.jsxs)(s.td,{children:[(0,r.jsx)(s.code,{children:"--token"})," value, ",(0,r.jsx)(s.code,{children:"-t"})," value"]}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.code,{children:"K3S_TOKEN"})}),(0,r.jsx)(s.td,{children:"Shared secret used to join a server or agent to a cluster"})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsxs)(s.td,{children:[(0,r.jsx)(s.code,{children:"--token-file"})," value"]}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.code,{children:"K3S_TOKEN_FILE"})}),(0,r.jsx)(s.td,{children:"File containing the cluster-secret/token"})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsxs)(s.td,{children:[(0,r.jsx)(s.code,{children:"--agent-token"})," value"]}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.code,{children:"K3S_AGENT_TOKEN"})}),(0,r.jsx)(s.td,{children:"Shared secret used to join agents to the cluster, but not servers"})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsxs)(s.td,{children:[(0,r.jsx)(s.code,{children:"--agent-token-file"})," value"]}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.code,{children:"K3S_AGENT_TOKEN_FILE"})}),(0,r.jsx)(s.td,{children:"File containing the agent secret"})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsxs)(s.td,{children:[(0,r.jsx)(s.code,{children:"--server"})," value"]}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.code,{children:"K3S_URL"})}),(0,r.jsx)(s.td,{children:"Server to connect to, used to join a cluster"})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:(0,r.jsx)(s.code,{children:"--cluster-init"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.code,{children:"K3S_CLUSTER_INIT"})}),(0,r.jsx)(s.td,{children:"Initialize a new cluster using embedded Etcd"})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:(0,r.jsx)(s.code,{children:"--cluster-reset"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.code,{children:"K3S_CLUSTER_RESET"})}),(0,r.jsx)(s.td,{children:"Forget all peers and become sole member of a new cluster"})]})]})]}),"\n",(0,r.jsx)(s.h3,{id:"admin-kubeconfig-options",children:"Admin Kubeconfig Options"}),"\n",(0,r.jsxs)(s.table,{children:[(0,r.jsx)(s.thead,{children:(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.th,{children:"Flag"}),(0,r.jsx)(s.th,{children:"Environment Variable"}),(0,r.jsx)(s.th,{children:"Description"})]})}),(0,r.jsxs)(s.tbody,{children:[(0,r.jsxs)(s.tr,{children:[(0,r.jsxs)(s.td,{children:[(0,r.jsx)(s.code,{children:"--write-kubeconfig value, -o"})," value"]}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.code,{children:"K3S_KUBECONFIG_OUTPUT"})}),(0,r.jsx)(s.td,{children:"Write kubeconfig for admin client to this file"})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsxs)(s.td,{children:[(0,r.jsx)(s.code,{children:"--write-kubeconfig-mode"})," value"]}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.code,{children:"K3S_KUBECONFIG_MODE"})}),(0,r.jsxs)(s.td,{children:["Write kubeconfig with this ",(0,r.jsx)(s.a,{href:"https://en.wikipedia.org/wiki/Chmod",children:"mode."})," The kubeconfig file is owned by root, and written with a default mode of 600. Changing the mode to 644 will allow it to be read by other unprivileged users on the host."]})]})]})]}),"\n",(0,r.jsx)(s.h2,{id:"advanced-options",children:"Advanced Options"}),"\n",(0,r.jsx)(s.h3,{id:"logging",children:"Logging"}),"\n",(0,r.jsxs)(s.table,{children:[(0,r.jsx)(s.thead,{children:(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.th,{children:"Flag"}),(0,r.jsx)(s.th,{children:"Default"}),(0,r.jsx)(s.th,{children:"Description"})]})}),(0,r.jsxs)(s.tbody,{children:[(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:(0,r.jsx)(s.code,{children:"--debug"})}),(0,r.jsx)(s.td,{children:"N/A"}),(0,r.jsx)(s.td,{children:"Turn on debug logs"})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsxs)(s.td,{children:[(0,r.jsx)(s.code,{children:"-v"})," value"]}),(0,r.jsx)(s.td,{children:"0"}),(0,r.jsx)(s.td,{children:"Number for the log level verbosity"})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsxs)(s.td,{children:[(0,r.jsx)(s.code,{children:"--vmodule"})," value"]}),(0,r.jsx)(s.td,{children:"N/A"}),(0,r.jsx)(s.td,{children:"Comma-separated list of FILE_PATTERN=LOG_LEVEL settings for file-filtered logging"})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsxs)(s.td,{children:[(0,r.jsx)(s.code,{children:"--log value, -l"})," value"]}),(0,r.jsx)(s.td,{children:"N/A"}),(0,r.jsx)(s.td,{children:"Log to file"})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:(0,r.jsx)(s.code,{children:"--alsologtostderr"})}),(0,r.jsx)(s.td,{children:"N/A"}),(0,r.jsx)(s.td,{children:"Log to standard error as well as file (if set)"})]})]})]}),"\n",(0,r.jsx)(s.h3,{id:"listeners",children:"Listeners"}),"\n",(0,r.jsxs)(s.table,{children:[(0,r.jsx)(s.thead,{children:(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.th,{children:"Flag"}),(0,r.jsx)(s.th,{children:"Default"}),(0,r.jsx)(s.th,{children:"Description"})]})}),(0,r.jsxs)(s.tbody,{children:[(0,r.jsxs)(s.tr,{children:[(0,r.jsxs)(s.td,{children:[(0,r.jsx)(s.code,{children:"--bind-address"})," value"]}),(0,r.jsx)(s.td,{children:"0.0.0.0"}),(0,r.jsx)(s.td,{children:"k3s bind address"})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsxs)(s.td,{children:[(0,r.jsx)(s.code,{children:"--https-listen-port"})," value"]}),(0,r.jsx)(s.td,{children:"6443"}),(0,r.jsx)(s.td,{children:"HTTPS listen port"})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsxs)(s.td,{children:[(0,r.jsx)(s.code,{children:"--advertise-address"})," value"]}),(0,r.jsx)(s.td,{children:"node-external-ip/node-ip"}),(0,r.jsxs)(s.td,{children:["IPv4/IPv6 address that apiserver advertises for its service endpoint",(0,r.jsx)("br",{}),"Note that the primary ",(0,r.jsx)(s.code,{children:"service-cidr"})," IP range must be of the same address family as the advertised address"]})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsxs)(s.td,{children:[(0,r.jsx)(s.code,{children:"--advertise-port"})," value"]}),(0,r.jsx)(s.td,{children:"listen-port/0"}),(0,r.jsx)(s.td,{children:"Port that apiserver uses to advertise to members of the cluster"})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsxs)(s.td,{children:[(0,r.jsx)(s.code,{children:"--tls-san"})," value"]}),(0,r.jsx)(s.td,{children:"N/A"}),(0,r.jsx)(s.td,{children:"Add additional hostnames or IPv4/IPv6 addresses as Subject Alternative Names on the TLS cert"})]})]})]}),"\n",(0,r.jsx)(s.h3,{id:"data",children:"Data"}),"\n",(0,r.jsxs)(s.table,{children:[(0,r.jsx)(s.thead,{children:(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.th,{children:"Flag"}),(0,r.jsx)(s.th,{children:"Default"}),(0,r.jsx)(s.th,{children:"Description"})]})}),(0,r.jsx)(s.tbody,{children:(0,r.jsxs)(s.tr,{children:[(0,r.jsxs)(s.td,{children:[(0,r.jsx)(s.code,{children:"--data-dir value, -d"})," value"]}),(0,r.jsxs)(s.td,{children:[(0,r.jsx)(s.code,{children:"/var/lib/rancher/k3s"})," or ",(0,r.jsx)(s.code,{children:"${HOME}/.rancher/k3s"})," if not root"]}),(0,r.jsx)(s.td,{children:"Folder to hold state"})]})})]}),"\n",(0,r.jsx)(s.h3,{id:"secrets-encryption",children:"Secrets Encryption"}),"\n",(0,r.jsxs)(s.table,{children:[(0,r.jsx)(s.thead,{children:(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.th,{children:"Flag"}),(0,r.jsx)(s.th,{children:"Default"}),(0,r.jsx)(s.th,{children:"Description"})]})}),(0,r.jsx)(s.tbody,{children:(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:(0,r.jsx)(s.code,{children:"--secrets-encryption"})}),(0,r.jsx)(s.td,{children:"false"}),(0,r.jsx)(s.td,{children:"Enable Secret encryption at rest"})]})})]}),"\n",(0,r.jsx)(s.h3,{id:"networking",children:"Networking"}),"\n",(0,r.jsxs)(s.table,{children:[(0,r.jsx)(s.thead,{children:(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.th,{children:"Flag"}),(0,r.jsx)(s.th,{children:"Default"}),(0,r.jsx)(s.th,{children:"Description"})]})}),(0,r.jsxs)(s.tbody,{children:[(0,r.jsxs)(s.tr,{children:[(0,r.jsxs)(s.td,{children:[(0,r.jsx)(s.code,{children:"--cluster-cidr"})," value"]}),(0,r.jsx)(s.td,{children:'"10.42.0.0/16"'}),(0,r.jsx)(s.td,{children:"IPv4/IPv6 network CIDRs to use for pod IPs"})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsxs)(s.td,{children:[(0,r.jsx)(s.code,{children:"--service-cidr"})," value"]}),(0,r.jsx)(s.td,{children:'"10.43.0.0/16"'}),(0,r.jsx)(s.td,{children:"IPv4/IPv6 network CIDRs to use for service IPs"})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsxs)(s.td,{children:[(0,r.jsx)(s.code,{children:"--service-node-port-range"})," value"]}),(0,r.jsx)(s.td,{children:'"30000-32767"'}),(0,r.jsx)(s.td,{children:"Port range to reserve for services with NodePort visibility"})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsxs)(s.td,{children:[(0,r.jsx)(s.code,{children:"--cluster-dns"})," value"]}),(0,r.jsx)(s.td,{children:'"10.43.0.10"'}),(0,r.jsx)(s.td,{children:"IPv4 Cluster IP for coredns service. Should be in your service-cidr range"})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsxs)(s.td,{children:[(0,r.jsx)(s.code,{children:"--cluster-domain"})," value"]}),(0,r.jsx)(s.td,{children:'"cluster.local"'}),(0,r.jsx)(s.td,{children:"Cluster Domain"})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsxs)(s.td,{children:[(0,r.jsx)(s.code,{children:"--flannel-backend"})," value"]}),(0,r.jsx)(s.td,{children:'"vxlan"'}),(0,r.jsx)(s.td,{children:"One of 'none', 'vxlan', 'ipsec'(deprecated), 'host-gw', 'wireguard-native', or 'wireguard'(deprecated)"})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:(0,r.jsx)(s.code,{children:"--flannel-ipv6-masq"})}),(0,r.jsx)(s.td,{children:'"N/A"'}),(0,r.jsx)(s.td,{children:"Enable IPv6 masquerading for pod"})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:(0,r.jsx)(s.code,{children:"--flannel-external-ip"})}),(0,r.jsx)(s.td,{children:'"N/A"'}),(0,r.jsx)(s.td,{children:"Use node external IP addresses for Flannel traffic"})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsxs)(s.td,{children:[(0,r.jsx)(s.code,{children:"--servicelb-namespace"})," value"]}),(0,r.jsx)(s.td,{children:'"kube-system"'}),(0,r.jsx)(s.td,{children:"Namespace of the pods for the servicelb component"})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsxs)(s.td,{children:[(0,r.jsx)(s.code,{children:"--egress-selector-mode"})," value"]}),(0,r.jsx)(s.td,{children:'"agent"'}),(0,r.jsxs)(s.td,{children:["Must be one of the following: ",(0,r.jsxs)("ul",{children:[(0,r.jsx)("li",{children:"disabled: The apiserver does not use agent tunnels to communicate with nodes. Requires that servers run agents, and have direct connectivity to the kubelet on agents, or the apiserver will not be able to function access service endpoints or perform kubectl exec and kubectl logs."}),(0,r.jsx)("li",{children:"agent: The apiserver uses agent tunnels to communicate with nodes. Nodes allow the tunnel connection from loopback addresses. Requires that servers also run agents, or the apiserver will not be able to access service endpoints. The historical default for k3s."}),(0,r.jsx)("li",{children:" pod: The apiserver uses agent tunnels to communicate with nodes and service endpoints, routing endpoint connections to the correct agent by watching Nodes. Nodes allow the tunnel connection from loopback addresses, or a CIDR assigned to their node."}),(0,r.jsx)("li",{children:" cluster: The apiserver uses agent tunnels to communicate with nodes and service endpoints, routing endpoint connections to the correct agent by watching Endpoints. Nodes allow the tunnel connection from loopback addresses, or the configured cluster CIDR range."})]})]})]})]})]}),"\n",(0,r.jsx)(s.h3,{id:"storage-class",children:"Storage Class"}),"\n",(0,r.jsxs)(s.table,{children:[(0,r.jsx)(s.thead,{children:(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.th,{children:"Flag"}),(0,r.jsx)(s.th,{children:"Description"})]})}),(0,r.jsx)(s.tbody,{children:(0,r.jsxs)(s.tr,{children:[(0,r.jsxs)(s.td,{children:[(0,r.jsx)(s.code,{children:"--default-local-storage-path"})," value"]}),(0,r.jsx)(s.td,{children:"Default local storage path for local provisioner storage class"})]})})]}),"\n",(0,r.jsx)(s.h3,{id:"kubernetes-components",children:"Kubernetes Components"}),"\n",(0,r.jsxs)(s.table,{children:[(0,r.jsx)(s.thead,{children:(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.th,{children:"Flag"}),(0,r.jsx)(s.th,{children:"Description"})]})}),(0,r.jsxs)(s.tbody,{children:[(0,r.jsxs)(s.tr,{children:[(0,r.jsxs)(s.td,{children:[(0,r.jsx)(s.code,{children:"--disable"})," value"]}),(0,r.jsxs)(s.td,{children:['See "',(0,r.jsxs)(s.a,{href:"/installation/packaged-components#using-the---disable-flag",children:["Using the ",(0,r.jsx)(s.code,{children:"--disable"})," flag"]}),'"']})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:(0,r.jsx)(s.code,{children:"--disable-scheduler"})}),(0,r.jsx)(s.td,{children:"Disable Kubernetes default scheduler"})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:(0,r.jsx)(s.code,{children:"--disable-cloud-controller"})}),(0,r.jsx)(s.td,{children:"Disable k3s default cloud controller manager"})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:(0,r.jsx)(s.code,{children:"--disable-kube-proxy"})}),(0,r.jsx)(s.td,{children:"Disable running kube-proxy"})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:(0,r.jsx)(s.code,{children:"--disable-network-policy"})}),(0,r.jsx)(s.td,{children:"Disable k3s default network policy controller"})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:(0,r.jsx)(s.code,{children:"--disable-helm-controller"})}),(0,r.jsx)(s.td,{children:"Disable Helm controller"})]})]})]}),"\n",(0,r.jsx)(s.h3,{id:"customized-flags-for-kubernetes-processes",children:"Customized Flags for Kubernetes Processes"}),"\n",(0,r.jsxs)(s.table,{children:[(0,r.jsx)(s.thead,{children:(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.th,{children:"Flag"}),(0,r.jsx)(s.th,{children:"Description"})]})}),(0,r.jsxs)(s.tbody,{children:[(0,r.jsxs)(s.tr,{children:[(0,r.jsxs)(s.td,{children:[(0,r.jsx)(s.code,{children:"--etcd-arg"})," value"]}),(0,r.jsx)(s.td,{children:"Customized flag for etcd process"})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsxs)(s.td,{children:[(0,r.jsx)(s.code,{children:"--kube-apiserver-arg"})," value"]}),(0,r.jsx)(s.td,{children:"Customized flag for kube-apiserver process"})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsxs)(s.td,{children:[(0,r.jsx)(s.code,{children:"--kube-scheduler-arg"})," value"]}),(0,r.jsx)(s.td,{children:"Customized flag for kube-scheduler process"})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsxs)(s.td,{children:[(0,r.jsx)(s.code,{children:"--kube-controller-manager-arg"})," value"]}),(0,r.jsx)(s.td,{children:"Customized flag for kube-controller-manager process"})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsxs)(s.td,{children:[(0,r.jsx)(s.code,{children:"--kube-cloud-controller-manager-arg"})," value"]}),(0,r.jsx)(s.td,{children:"Customized flag for kube-cloud-controller-manager process"})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsxs)(s.td,{children:[(0,r.jsx)(s.code,{children:"--kubelet-arg"})," value"]}),(0,r.jsx)(s.td,{children:"Customized flag for kubelet process"})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsxs)(s.td,{children:[(0,r.jsx)(s.code,{children:"--kube-proxy-arg"})," value"]}),(0,r.jsx)(s.td,{children:"Customized flag for kube-proxy process"})]})]})]}),"\n",(0,r.jsx)(s.h3,{id:"experimental-options",children:"Experimental Options"}),"\n",(0,r.jsxs)(s.table,{children:[(0,r.jsx)(s.thead,{children:(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.th,{children:"Flag"}),(0,r.jsx)(s.th,{children:"Description"})]})}),(0,r.jsxs)(s.tbody,{children:[(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:(0,r.jsx)(s.code,{children:"--rootless"})}),(0,r.jsx)(s.td,{children:"Run rootless"})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:(0,r.jsx)(s.code,{children:"--enable-pprof"})}),(0,r.jsx)(s.td,{children:"Enable pprof endpoint on supervisor port"})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:(0,r.jsx)(s.code,{children:"--docker"})}),(0,r.jsx)(s.td,{children:"Use cri-dockerd instead of containerd"})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:(0,r.jsx)(s.code,{children:"--prefer-bundled-bin"})}),(0,r.jsx)(s.td,{children:"Prefer bundled userspace binaries over host binaries"})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:(0,r.jsx)(s.code,{children:"--disable-agent"})}),(0,r.jsxs)(s.td,{children:['See "',(0,r.jsx)(s.a,{href:"/advanced#running-agentless-servers-experimental",children:"Running Agentless Servers (Experimental)"}),'"']})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:(0,r.jsx)(s.code,{children:"--embedded-registry"})}),(0,r.jsxs)(s.td,{children:['See "',(0,r.jsx)(s.a,{href:"/installation/registry-mirror",children:"Embedded Registry Mirror"}),'"']})]})]})]}),"\n",(0,r.jsx)(s.h3,{id:"deprecated-options",children:"Deprecated Options"}),"\n",(0,r.jsxs)(s.table,{children:[(0,r.jsx)(s.thead,{children:(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.th,{children:"Flag"}),(0,r.jsx)(s.th,{children:"Environment Variable"}),(0,r.jsx)(s.th,{children:"Description"})]})}),(0,r.jsxs)(s.tbody,{children:[(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:(0,r.jsx)(s.code,{children:"--no-flannel"})}),(0,r.jsx)(s.td,{children:"N/A"}),(0,r.jsxs)(s.td,{children:["Use ",(0,r.jsx)(s.code,{children:"--flannel-backend=none"})]})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsxs)(s.td,{children:[(0,r.jsx)(s.code,{children:"--no-deploy"})," value"]}),(0,r.jsx)(s.td,{children:"N/A"}),(0,r.jsxs)(s.td,{children:["Use ",(0,r.jsx)(s.code,{children:"--disable"})]})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsxs)(s.td,{children:[(0,r.jsx)(s.code,{children:"--cluster-secret"})," value"]}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.code,{children:"K3S_CLUSTER_SECRET"})}),(0,r.jsxs)(s.td,{children:["Use ",(0,r.jsx)(s.code,{children:"--token"})]})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsxs)(s.td,{children:[(0,r.jsx)(s.code,{children:"--flannel-backend"})," wireguard"]}),(0,r.jsx)(s.td,{children:"N/A"}),(0,r.jsxs)(s.td,{children:["Use ",(0,r.jsx)(s.code,{children:"--flannel-backend=wireguard-native"})]})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsxs)(s.td,{children:[(0,r.jsx)(s.code,{children:"--flannel-backend"})," value=option1=value"]}),(0,r.jsx)(s.td,{children:"N/A"}),(0,r.jsxs)(s.td,{children:["Use ",(0,r.jsx)(s.code,{children:"--flannel-conf"})," to specify the flannel config file with the backend config"]})]})]})]}),"\n",(0,r.jsx)(s.h2,{id:"k3s-server-cli-help",children:"K3s Server CLI Help"}),"\n",(0,r.jsxs)(s.blockquote,{children:["\n",(0,r.jsxs)(s.p,{children:["If an option appears in brackets below, for example ",(0,r.jsx)(s.code,{children:"[$K3S_TOKEN]"}),", it means that the option can be passed in as an environment variable of that name."]}),"\n"]}),"\n",(0,r.jsx)(s.pre,{children:(0,r.jsx)(s.code,{className:"language-bash",children:'NAME:\n k3s server - Run management server\n\nUSAGE:\n k3s server [OPTIONS]\n\nOPTIONS:\n --config FILE, -c FILE (config) Load configuration from FILE (default: "/etc/rancher/k3s/config.yaml") [$K3S_CONFIG_FILE]\n --debug (logging) Turn on debug logs [$K3S_DEBUG]\n -v value (logging) Number for the log level verbosity (default: 0)\n --vmodule value (logging) Comma-separated list of FILE_PATTERN=LOG_LEVEL settings for file-filtered logging\n --log value, -l value (logging) Log to file\n --alsologtostderr (logging) Log to standard error as well as file (if set)\n --bind-address value (listener) k3s bind address (default: 0.0.0.0)\n --https-listen-port value (listener) HTTPS listen port (default: 6443)\n --advertise-address value (listener) IPv4 address that apiserver uses to advertise to members of the cluster (default: node-external-ip/node-ip)\n --advertise-port value (listener) Port that apiserver uses to advertise to members of the cluster (default: listen-port) (default: 0)\n --tls-san value (listener) Add additional hostnames or IPv4/IPv6 addresses as Subject Alternative Names on the server TLS cert\n --data-dir value, -d value (data) Folder to hold state (default: /var/lib/rancher/k3s or ${HOME}/.rancher/k3s if not root)\n --cluster-cidr value (networking) IPv4/IPv6 network CIDRs to use for pod IPs (default: 10.42.0.0/16)\n --service-cidr value (networking) IPv4/IPv6 network CIDRs to use for service IPs (default: 10.43.0.0/16)\n --service-node-port-range value (networking) Port range to reserve for services with NodePort visibility (default: "30000-32767")\n --cluster-dns value (networking) IPv4 Cluster IP for coredns service. Should be in your service-cidr range (default: 10.43.0.10)\n --cluster-domain value (networking) Cluster Domain (default: "cluster.local")\n --flannel-backend value (networking) backend<=option1=val1,option2=val2> where backend is one of \'none\', \'vxlan\', \'ipsec\' (deprecated), \'host-gw\', \'wireguard-native\', \'wireguard\' (deprecated) (default: "vxlan")\n --flannel-ipv6-masq (networking) Enable IPv6 masquerading for pod\n --flannel-external-ip (networking) Use node external IP addresses for Flannel traffic\n --egress-selector-mode value (networking) One of \'agent\', \'cluster\', \'pod\', \'disabled\' (default: "agent")\n --servicelb-namespace value (networking) Namespace of the pods for the servicelb component (default: "kube-system")\n --write-kubeconfig value, -o value (client) Write kubeconfig for admin client to this file [$K3S_KUBECONFIG_OUTPUT]\n --write-kubeconfig-mode value (client) Write kubeconfig with this mode [$K3S_KUBECONFIG_MODE]\n --token value, -t value (cluster) Shared secret used to join a server or agent to a cluster [$K3S_TOKEN]\n --token-file value (cluster) File containing the token [$K3S_TOKEN_FILE]\n --agent-token value (cluster) Shared secret used to join agents to the cluster, but not servers [$K3S_AGENT_TOKEN]\n --agent-token-file value (cluster) File containing the agent secret [$K3S_AGENT_TOKEN_FILE]\n --server value, -s value (cluster) Server to connect to, used to join a cluster [$K3S_URL]\n --cluster-init (cluster) Initialize a new cluster using embedded Etcd [$K3S_CLUSTER_INIT]\n --cluster-reset (cluster) Forget all peers and become sole member of a new cluster [$K3S_CLUSTER_RESET]\n --cluster-reset-restore-path value (db) Path to snapshot file to be restored\n --kube-apiserver-arg value (flags) Customized flag for kube-apiserver process\n --etcd-arg value (flags) Customized flag for etcd process\n --kube-controller-manager-arg value (flags) Customized flag for kube-controller-manager process\n --kube-scheduler-arg value (flags) Customized flag for kube-scheduler process\n --kube-cloud-controller-manager-arg value (flags) Customized flag for kube-cloud-controller-manager process\n --datastore-endpoint value (db) Specify etcd, Mysql, Postgres, or Sqlite (default) data source name [$K3S_DATASTORE_ENDPOINT]\n --datastore-cafile value (db) TLS Certificate Authority file used to secure datastore backend communication [$K3S_DATASTORE_CAFILE]\n --datastore-certfile value (db) TLS certification file used to secure datastore backend communication [$K3S_DATASTORE_CERTFILE]\n --datastore-keyfile value (db) TLS key file used to secure datastore backend communication [$K3S_DATASTORE_KEYFILE]\n --etcd-expose-metrics (db) Expose etcd metrics to client interface. (default: false)\n --etcd-disable-snapshots (db) Disable automatic etcd snapshots\n --etcd-snapshot-name value (db) Set the base name of etcd snapshots (default: etcd-snapshot-) (default: "etcd-snapshot")\n --etcd-snapshot-schedule-cron value (db) Snapshot interval time in cron spec. eg. every 5 hours \'* */5 * * *\' (default: "0 */12 * * *")\n --etcd-snapshot-retention value (db) Number of snapshots to retain (default: 5)\n --etcd-snapshot-dir value (db) Directory to save db snapshots. (default: ${data-dir}/db/snapshots)\n --etcd-snapshot-compress (db) Compress etcd snapshot\n --etcd-s3 (db) Enable backup to S3\n --etcd-s3-endpoint value (db) S3 endpoint url (default: "s3.amazonaws.com")\n --etcd-s3-endpoint-ca value (db) S3 custom CA cert to connect to S3 endpoint\n --etcd-s3-skip-ssl-verify (db) Disables S3 SSL certificate validation\n --etcd-s3-access-key value (db) S3 access key [$AWS_ACCESS_KEY_ID]\n --etcd-s3-secret-key value (db) S3 secret key [$AWS_SECRET_ACCESS_KEY]\n --etcd-s3-bucket value (db) S3 bucket name\n --etcd-s3-region value (db) S3 region / bucket location (optional) (default: "us-east-1")\n --etcd-s3-folder value (db) S3 folder\n --etcd-s3-insecure (db) Disables S3 over HTTPS\n --etcd-s3-timeout value (db) S3 timeout (default: 5m0s)\n --default-local-storage-path value (storage) Default local storage path for local provisioner storage class\n --disable value (components) Do not deploy packaged components and delete any deployed components (valid items: coredns, servicelb, traefik, local-storage, metrics-server)\n --disable-scheduler (components) Disable Kubernetes default scheduler\n --disable-cloud-controller (components) Disable k3s default cloud controller manager\n --disable-kube-proxy (components) Disable running kube-proxy\n --disable-network-policy (components) Disable k3s default network policy controller\n --disable-helm-controller (components) Disable Helm controller\n --node-name value (agent/node) Node name [$K3S_NODE_NAME]\n --with-node-id (agent/node) Append id to node name\n --node-label value (agent/node) Registering and starting kubelet with set of labels\n --node-taint value (agent/node) Registering kubelet with set of taints\n --image-credential-provider-bin-dir value (agent/node) The path to the directory where credential provider plugin binaries are located (default: "/var/lib/rancher/credentialprovider/bin")\n --image-credential-provider-config value (agent/node) The path to the credential provider plugin config file (default: "/var/lib/rancher/credentialprovider/config.yaml")\n --docker (agent/runtime) (experimental) Use cri-dockerd instead of containerd\n --container-runtime-endpoint value (agent/runtime) Disable embedded containerd and use the CRI socket at the given path; when used with --docker this sets the docker socket path\n --pause-image value (agent/runtime) Customized pause image for containerd or docker sandbox (default: "rancher/mirrored-pause:3.6")\n --snapshotter value (agent/runtime) Override default containerd snapshotter (default: "overlayfs")\n --private-registry value (agent/runtime) Private registry configuration file (default: "/etc/rancher/k3s/registries.yaml")\n --system-default-registry value (agent/runtime) Private registry to be used for all system images [$K3S_SYSTEM_DEFAULT_REGISTRY]\n --node-ip value, -i value (agent/networking) IPv4/IPv6 addresses to advertise for node\n --node-external-ip value (agent/networking) IPv4/IPv6 external IP addresses to advertise for node\n --resolv-conf value (agent/networking) Kubelet resolv.conf file [$K3S_RESOLV_CONF]\n --flannel-iface value (agent/networking) Override default flannel interface\n --flannel-conf value (agent/networking) Override default flannel config file\n --flannel-cni-conf value (agent/networking) Override default flannel cni config file\n --kubelet-arg value (agent/flags) Customized flag for kubelet process\n --kube-proxy-arg value (agent/flags) Customized flag for kube-proxy process\n --protect-kernel-defaults (agent/node) Kernel tuning behavior. If set, error if kernel tunables are different than kubelet defaults.\n --secrets-encryption Enable secret encryption at rest\n --enable-pprof (experimental) Enable pprof endpoint on supervisor port\n --rootless (experimental) Run rootless\n --prefer-bundled-bin (experimental) Prefer bundled userspace binaries over host binaries\n --selinux (agent/node) Enable SELinux in containerd [$K3S_SELINUX]\n --lb-server-port value (agent/node) Local port for supervisor client load-balancer. If the supervisor and apiserver are not colocated an additional port 1 less than this port will also be used for the apiserver client load-balancer. (default: 6444) [$K3S_LB_SERVER_PORT]\n'})})]})}function h(e={}){const{wrapper:s}={...(0,t.a)(),...e.components};return s?(0,r.jsx)(s,{...e,children:(0,r.jsx)(a,{...e})}):a(e)}},1151:(e,s,n)=>{n.d(s,{Z:()=>i,a:()=>l});var r=n(7294);const t={},d=r.createContext(t);function l(e){const s=r.useContext(d);return r.useMemo((function(){return"function"==typeof e?e(s):{...s,...e}}),[s,e])}function i(e){let s;return s=e.disableParentContext?"function"==typeof e.components?e.components(t):e.components||t:l(e.components),r.createElement(d.Provider,{value:s},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/4a667cf9.133a6c6e.js b/assets/js/4a667cf9.3b4b3fbd.js similarity index 99% rename from assets/js/4a667cf9.133a6c6e.js rename to assets/js/4a667cf9.3b4b3fbd.js index 4dfeafa65..05f20452f 100644 --- a/assets/js/4a667cf9.133a6c6e.js +++ b/assets/js/4a667cf9.3b4b3fbd.js @@ -1 +1 @@ -"use strict";(self.webpackChunkk_3_s_docs=self.webpackChunkk_3_s_docs||[]).push([[9477],{8676:(e,n,s)=>{s.r(n),s.d(n,{assets:()=>i,contentTitle:()=>t,default:()=>h,frontMatter:()=>l,metadata:()=>o,toc:()=>d});var r=s(5893),a=s(1151);const l={title:"Cluster Load Balancer"},t=void 0,o={id:"datastore/cluster-loadbalancer",title:"Cluster Load Balancer",description:"This section describes how to install an external load balancer in front of a High Availability (HA) K3s cluster's server nodes. Two examples are provided: Nginx and HAProxy.",source:"@site/docs/datastore/cluster-loadbalancer.md",sourceDirName:"datastore",slug:"/datastore/cluster-loadbalancer",permalink:"/datastore/cluster-loadbalancer",draft:!1,unlisted:!1,editUrl:"https://github.com/k3s-io/docs/edit/main/docs/datastore/cluster-loadbalancer.md",tags:[],version:"current",lastUpdatedAt:1723651727e3,frontMatter:{title:"Cluster Load Balancer"},sidebar:"mySidebar",previous:{title:"High Availability External DB",permalink:"/datastore/ha"},next:{title:"Upgrades",permalink:"/upgrades/"}},i={},d=[{value:"Prerequisites",id:"prerequisites",level:2},{value:"Setup Load Balancer",id:"setup-load-balancer",level:2},{value:"Nginx Load Balancer",id:"nginx-load-balancer",level:2}];function c(e){const n={a:"a",admonition:"admonition",code:"code",h2:"h2",li:"li",ol:"ol",p:"p",pre:"pre",ul:"ul",...(0,a.a)(),...e.components},{TabItem:s,Tabs:l}=n;return s||x("TabItem",!0),l||x("Tabs",!0),(0,r.jsxs)(r.Fragment,{children:[(0,r.jsx)(n.p,{children:"This section describes how to install an external load balancer in front of a High Availability (HA) K3s cluster's server nodes. Two examples are provided: Nginx and HAProxy."}),"\n",(0,r.jsxs)(n.admonition,{type:"tip",children:[(0,r.jsxs)(n.p,{children:["External load-balancers should not be confused with the embedded ServiceLB, which is an embedded controller that allows for use of Kubernetes LoadBalancer Services without deploying a third-party load-balancer controller. For more details, see ",(0,r.jsx)(n.a,{href:"/networking/networking-services#service-load-balancer",children:"Service Load Balancer"}),"."]}),(0,r.jsx)(n.p,{children:"External load-balancers can be used to provide a fixed registration address for registering nodes, or for external access to the Kubernetes API Server. For exposing LoadBalancer Services, external load-balancers can be used alongside or instead of ServiceLB, but in most cases, replacement load-balancer controllers such as MetalLB or Kube-VIP are a better choice."})]}),"\n",(0,r.jsx)(n.h2,{id:"prerequisites",children:"Prerequisites"}),"\n",(0,r.jsx)(n.p,{children:"All nodes in this example are running Ubuntu 20.04."}),"\n",(0,r.jsxs)(n.p,{children:["For both examples, assume that a ",(0,r.jsx)(n.a,{href:"/datastore/ha-embedded",children:"HA K3s cluster with embedded etcd"})," has been installed on 3 nodes."]}),"\n",(0,r.jsx)(n.p,{children:"Each k3s server is configured with:"}),"\n",(0,r.jsx)(n.pre,{children:(0,r.jsx)(n.code,{className:"language-yaml",children:"# /etc/rancher/k3s/config.yaml\ntoken: lb-cluster-gd\ntls-san: 10.10.10.100\n"})}),"\n",(0,r.jsx)(n.p,{children:"The nodes have hostnames and IPs of:"}),"\n",(0,r.jsxs)(n.ul,{children:["\n",(0,r.jsxs)(n.li,{children:["server-1: ",(0,r.jsx)(n.code,{children:"10.10.10.50"})]}),"\n",(0,r.jsxs)(n.li,{children:["server-2: ",(0,r.jsx)(n.code,{children:"10.10.10.51"})]}),"\n",(0,r.jsxs)(n.li,{children:["server-3: ",(0,r.jsx)(n.code,{children:"10.10.10.52"})]}),"\n"]}),"\n",(0,r.jsx)(n.p,{children:"Two additional nodes for load balancing are configured with hostnames and IPs of:"}),"\n",(0,r.jsxs)(n.ul,{children:["\n",(0,r.jsxs)(n.li,{children:["lb-1: ",(0,r.jsx)(n.code,{children:"10.10.10.98"})]}),"\n",(0,r.jsxs)(n.li,{children:["lb-2: ",(0,r.jsx)(n.code,{children:"10.10.10.99"})]}),"\n"]}),"\n",(0,r.jsx)(n.p,{children:"Three additional nodes exist with hostnames and IPs of:"}),"\n",(0,r.jsxs)(n.ul,{children:["\n",(0,r.jsxs)(n.li,{children:["agent-1: ",(0,r.jsx)(n.code,{children:"10.10.10.101"})]}),"\n",(0,r.jsxs)(n.li,{children:["agent-2: ",(0,r.jsx)(n.code,{children:"10.10.10.102"})]}),"\n",(0,r.jsxs)(n.li,{children:["agent-3: ",(0,r.jsx)(n.code,{children:"10.10.10.103"})]}),"\n"]}),"\n",(0,r.jsx)(n.h2,{id:"setup-load-balancer",children:"Setup Load Balancer"}),"\n",(0,r.jsxs)(l,{queryString:"ext-load-balancer",children:[(0,r.jsxs)(s,{value:"HAProxy",default:!0,children:[(0,r.jsxs)(n.p,{children:[(0,r.jsx)(n.a,{href:"http://www.haproxy.org/",children:"HAProxy"})," is an open source option that provides a TCP load balancer. It also supports HA for the load balancer itself, ensuring redundancy at all levels. See ",(0,r.jsx)(n.a,{href:"http://docs.haproxy.org/2.8/intro.html",children:"HAProxy Documentation"})," for more info."]}),(0,r.jsxs)(n.p,{children:["Additionally, we will use KeepAlived to generate a virtual IP (VIP) that will be used to access the cluster. See ",(0,r.jsx)(n.a,{href:"https://www.keepalived.org/manpage.html",children:"KeepAlived Documentation"})," for more info."]}),(0,r.jsxs)(n.ol,{children:["\n",(0,r.jsx)(n.li,{children:"Install HAProxy and KeepAlived:"}),"\n"]}),(0,r.jsx)(n.pre,{children:(0,r.jsx)(n.code,{className:"language-bash",children:"sudo apt-get install haproxy keepalived\n"})}),(0,r.jsxs)(n.ol,{start:"2",children:["\n",(0,r.jsxs)(n.li,{children:["Add the following to ",(0,r.jsx)(n.code,{children:"/etc/haproxy/haproxy.cfg"})," on lb-1 and lb-2:"]}),"\n"]}),(0,r.jsx)(n.pre,{children:(0,r.jsx)(n.code,{children:"frontend k3s-frontend\n bind *:6443\n mode tcp\n option tcplog\n default_backend k3s-backend\n\nbackend k3s-backend\n mode tcp\n option tcp-check\n balance roundrobin\n default-server inter 10s downinter 5s\n server server-1 10.10.10.50:6443 check\n server server-2 10.10.10.51:6443 check\n server server-3 10.10.10.52:6443 check\n"})}),(0,r.jsxs)(n.ol,{start:"3",children:["\n",(0,r.jsxs)(n.li,{children:["Add the following to ",(0,r.jsx)(n.code,{children:"/etc/keepalived/keepalived.conf"})," on lb-1 and lb-2:"]}),"\n"]}),(0,r.jsx)(n.pre,{children:(0,r.jsx)(n.code,{children:"global_defs {\n enable_script_security\n script_user root\n}\n\nvrrp_script chk_haproxy {\n script 'killall -0 haproxy' # faster than pidof\n interval 2\n}\n\nvrrp_instance haproxy-vip {\n interface eth1\n state # MASTER on lb-1, BACKUP on lb-2\n priority # 200 on lb-1, 100 on lb-2\n\n virtual_router_id 51\n\n virtual_ipaddress {\n 10.10.10.100/24\n }\n\n track_script {\n chk_haproxy\n }\n}\n"})}),(0,r.jsxs)(n.ol,{start:"6",children:["\n",(0,r.jsx)(n.li,{children:"Restart HAProxy and KeepAlived on lb-1 and lb-2:"}),"\n"]}),(0,r.jsx)(n.pre,{children:(0,r.jsx)(n.code,{className:"language-bash",children:"systemctl restart haproxy\nsystemctl restart keepalived\n"})}),(0,r.jsxs)(n.ol,{start:"5",children:["\n",(0,r.jsx)(n.li,{children:"On agent-1, agent-2, and agent-3, run the following command to install k3s and join the cluster:"}),"\n"]}),(0,r.jsx)(n.pre,{children:(0,r.jsx)(n.code,{className:"language-bash",children:"curl -sfL https://get.k3s.io | K3S_TOKEN=lb-cluster-gd sh -s - agent --server https://10.10.10.100:6443\n"})}),(0,r.jsxs)(n.p,{children:["You can now use ",(0,r.jsx)(n.code,{children:"kubectl"})," from server node to interact with the cluster."]}),(0,r.jsx)(n.pre,{children:(0,r.jsx)(n.code,{className:"language-bash",children:"root@server-1 $ k3s kubectl get nodes -A\nNAME STATUS ROLES AGE VERSION\nagent-1 Ready 32s v1.27.3+k3s1\nagent-2 Ready 20s v1.27.3+k3s1\nagent-3 Ready 9s v1.27.3+k3s1\nserver-1 Ready control-plane,etcd,master 4m22s v1.27.3+k3s1\nserver-2 Ready control-plane,etcd,master 3m58s v1.27.3+k3s1\nserver-3 Ready control-plane,etcd,master 3m12s v1.27.3+k3s1\n"})})]}),(0,r.jsxs)(s,{value:"Nginx",children:[(0,r.jsx)(n.h2,{id:"nginx-load-balancer",children:"Nginx Load Balancer"}),(0,r.jsx)(n.admonition,{type:"danger",children:(0,r.jsx)(n.p,{children:"Nginx does not natively support a High Availability (HA) configuration. If setting up an HA cluster, having a single load balancer in front of K3s will reintroduce a single point of failure."})}),(0,r.jsxs)(n.p,{children:[(0,r.jsx)(n.a,{href:"http://nginx.org/",children:"Nginx Open Source"})," provides a TCP load balancer. See ",(0,r.jsx)(n.a,{href:"https://nginx.org/en/docs/http/load_balancing.html",children:"Using nginx as HTTP load balancer"})," for more info."]}),(0,r.jsxs)(n.ol,{children:["\n",(0,r.jsxs)(n.li,{children:["Create a ",(0,r.jsx)(n.code,{children:"nginx.conf"})," file on lb-1 with the following contents:"]}),"\n"]}),(0,r.jsx)(n.pre,{children:(0,r.jsx)(n.code,{children:"events {}\n\nstream {\n upstream k3s_servers {\n server 10.10.10.50:6443;\n server 10.10.10.51:6443;\n server 10.10.10.52:6443;\n }\n\n server {\n listen 6443;\n proxy_pass k3s_servers;\n }\n}\n"})}),(0,r.jsxs)(n.ol,{start:"2",children:["\n",(0,r.jsx)(n.li,{children:"Run the Nginx load balancer on lb-1:"}),"\n"]}),(0,r.jsx)(n.p,{children:"Using docker:"}),(0,r.jsx)(n.pre,{children:(0,r.jsx)(n.code,{className:"language-bash",children:"docker run -d --restart unless-stopped \\\n -v ${PWD}/nginx.conf:/etc/nginx/nginx.conf \\\n -p 6443:6443 \\\n nginx:stable\n"})}),(0,r.jsxs)(n.p,{children:["Or ",(0,r.jsx)(n.a,{href:"https://docs.nginx.com/nginx/admin-guide/installing-nginx/installing-nginx-open-source/",children:"install nginx"})," and then run:"]}),(0,r.jsx)(n.pre,{children:(0,r.jsx)(n.code,{className:"language-bash",children:"cp nginx.conf /etc/nginx/nginx.conf\nsystemctl start nginx\n"})}),(0,r.jsxs)(n.ol,{start:"3",children:["\n",(0,r.jsx)(n.li,{children:"On agent-1, agent-2, and agent-3, run the following command to install k3s and join the cluster:"}),"\n"]}),(0,r.jsx)(n.pre,{children:(0,r.jsx)(n.code,{className:"language-bash",children:"curl -sfL https://get.k3s.io | K3S_TOKEN=lb-cluster-gd sh -s - agent --server https://10.10.10.98:6443\n"})}),(0,r.jsxs)(n.p,{children:["You can now use ",(0,r.jsx)(n.code,{children:"kubectl"})," from server node to interact with the cluster."]}),(0,r.jsx)(n.pre,{children:(0,r.jsx)(n.code,{className:"language-bash",children:"root@server1 $ k3s kubectl get nodes -A\nNAME STATUS ROLES AGE VERSION\nagent-1 Ready 30s v1.27.3+k3s1\nagent-2 Ready 22s v1.27.3+k3s1\nagent-3 Ready 13s v1.27.3+k3s1\nserver-1 Ready control-plane,etcd,master 4m49s v1.27.3+k3s1\nserver-2 Ready control-plane,etcd,master 3m58s v1.27.3+k3s1\nserver-3 Ready control-plane,etcd,master 3m16s v1.27.3+k3s1\n"})})]})]})]})}function h(e={}){const{wrapper:n}={...(0,a.a)(),...e.components};return n?(0,r.jsx)(n,{...e,children:(0,r.jsx)(c,{...e})}):c(e)}function x(e,n){throw new Error("Expected "+(n?"component":"object")+" `"+e+"` to be defined: you likely forgot to import, pass, or provide it.")}},1151:(e,n,s)=>{s.d(n,{Z:()=>o,a:()=>t});var r=s(7294);const a={},l=r.createContext(a);function t(e){const n=r.useContext(l);return r.useMemo((function(){return"function"==typeof e?e(n):{...n,...e}}),[n,e])}function o(e){let n;return n=e.disableParentContext?"function"==typeof e.components?e.components(a):e.components||a:t(e.components),r.createElement(l.Provider,{value:n},e.children)}}}]); \ No newline at end of file +"use strict";(self.webpackChunkk_3_s_docs=self.webpackChunkk_3_s_docs||[]).push([[9477],{8676:(e,n,s)=>{s.r(n),s.d(n,{assets:()=>i,contentTitle:()=>t,default:()=>h,frontMatter:()=>l,metadata:()=>o,toc:()=>d});var r=s(5893),a=s(1151);const l={title:"Cluster Load Balancer"},t=void 0,o={id:"datastore/cluster-loadbalancer",title:"Cluster Load Balancer",description:"This section describes how to install an external load balancer in front of a High Availability (HA) K3s cluster's server nodes. Two examples are provided: Nginx and HAProxy.",source:"@site/docs/datastore/cluster-loadbalancer.md",sourceDirName:"datastore",slug:"/datastore/cluster-loadbalancer",permalink:"/datastore/cluster-loadbalancer",draft:!1,unlisted:!1,editUrl:"https://github.com/k3s-io/docs/edit/main/docs/datastore/cluster-loadbalancer.md",tags:[],version:"current",lastUpdatedAt:1723747404e3,frontMatter:{title:"Cluster Load Balancer"},sidebar:"mySidebar",previous:{title:"High Availability External DB",permalink:"/datastore/ha"},next:{title:"Upgrades",permalink:"/upgrades/"}},i={},d=[{value:"Prerequisites",id:"prerequisites",level:2},{value:"Setup Load Balancer",id:"setup-load-balancer",level:2},{value:"Nginx Load Balancer",id:"nginx-load-balancer",level:2}];function c(e){const n={a:"a",admonition:"admonition",code:"code",h2:"h2",li:"li",ol:"ol",p:"p",pre:"pre",ul:"ul",...(0,a.a)(),...e.components},{TabItem:s,Tabs:l}=n;return s||x("TabItem",!0),l||x("Tabs",!0),(0,r.jsxs)(r.Fragment,{children:[(0,r.jsx)(n.p,{children:"This section describes how to install an external load balancer in front of a High Availability (HA) K3s cluster's server nodes. Two examples are provided: Nginx and HAProxy."}),"\n",(0,r.jsxs)(n.admonition,{type:"tip",children:[(0,r.jsxs)(n.p,{children:["External load-balancers should not be confused with the embedded ServiceLB, which is an embedded controller that allows for use of Kubernetes LoadBalancer Services without deploying a third-party load-balancer controller. For more details, see ",(0,r.jsx)(n.a,{href:"/networking/networking-services#service-load-balancer",children:"Service Load Balancer"}),"."]}),(0,r.jsx)(n.p,{children:"External load-balancers can be used to provide a fixed registration address for registering nodes, or for external access to the Kubernetes API Server. For exposing LoadBalancer Services, external load-balancers can be used alongside or instead of ServiceLB, but in most cases, replacement load-balancer controllers such as MetalLB or Kube-VIP are a better choice."})]}),"\n",(0,r.jsx)(n.h2,{id:"prerequisites",children:"Prerequisites"}),"\n",(0,r.jsx)(n.p,{children:"All nodes in this example are running Ubuntu 20.04."}),"\n",(0,r.jsxs)(n.p,{children:["For both examples, assume that a ",(0,r.jsx)(n.a,{href:"/datastore/ha-embedded",children:"HA K3s cluster with embedded etcd"})," has been installed on 3 nodes."]}),"\n",(0,r.jsx)(n.p,{children:"Each k3s server is configured with:"}),"\n",(0,r.jsx)(n.pre,{children:(0,r.jsx)(n.code,{className:"language-yaml",children:"# /etc/rancher/k3s/config.yaml\ntoken: lb-cluster-gd\ntls-san: 10.10.10.100\n"})}),"\n",(0,r.jsx)(n.p,{children:"The nodes have hostnames and IPs of:"}),"\n",(0,r.jsxs)(n.ul,{children:["\n",(0,r.jsxs)(n.li,{children:["server-1: ",(0,r.jsx)(n.code,{children:"10.10.10.50"})]}),"\n",(0,r.jsxs)(n.li,{children:["server-2: ",(0,r.jsx)(n.code,{children:"10.10.10.51"})]}),"\n",(0,r.jsxs)(n.li,{children:["server-3: ",(0,r.jsx)(n.code,{children:"10.10.10.52"})]}),"\n"]}),"\n",(0,r.jsx)(n.p,{children:"Two additional nodes for load balancing are configured with hostnames and IPs of:"}),"\n",(0,r.jsxs)(n.ul,{children:["\n",(0,r.jsxs)(n.li,{children:["lb-1: ",(0,r.jsx)(n.code,{children:"10.10.10.98"})]}),"\n",(0,r.jsxs)(n.li,{children:["lb-2: ",(0,r.jsx)(n.code,{children:"10.10.10.99"})]}),"\n"]}),"\n",(0,r.jsx)(n.p,{children:"Three additional nodes exist with hostnames and IPs of:"}),"\n",(0,r.jsxs)(n.ul,{children:["\n",(0,r.jsxs)(n.li,{children:["agent-1: ",(0,r.jsx)(n.code,{children:"10.10.10.101"})]}),"\n",(0,r.jsxs)(n.li,{children:["agent-2: ",(0,r.jsx)(n.code,{children:"10.10.10.102"})]}),"\n",(0,r.jsxs)(n.li,{children:["agent-3: ",(0,r.jsx)(n.code,{children:"10.10.10.103"})]}),"\n"]}),"\n",(0,r.jsx)(n.h2,{id:"setup-load-balancer",children:"Setup Load Balancer"}),"\n",(0,r.jsxs)(l,{queryString:"ext-load-balancer",children:[(0,r.jsxs)(s,{value:"HAProxy",default:!0,children:[(0,r.jsxs)(n.p,{children:[(0,r.jsx)(n.a,{href:"http://www.haproxy.org/",children:"HAProxy"})," is an open source option that provides a TCP load balancer. It also supports HA for the load balancer itself, ensuring redundancy at all levels. See ",(0,r.jsx)(n.a,{href:"http://docs.haproxy.org/2.8/intro.html",children:"HAProxy Documentation"})," for more info."]}),(0,r.jsxs)(n.p,{children:["Additionally, we will use KeepAlived to generate a virtual IP (VIP) that will be used to access the cluster. See ",(0,r.jsx)(n.a,{href:"https://www.keepalived.org/manpage.html",children:"KeepAlived Documentation"})," for more info."]}),(0,r.jsxs)(n.ol,{children:["\n",(0,r.jsx)(n.li,{children:"Install HAProxy and KeepAlived:"}),"\n"]}),(0,r.jsx)(n.pre,{children:(0,r.jsx)(n.code,{className:"language-bash",children:"sudo apt-get install haproxy keepalived\n"})}),(0,r.jsxs)(n.ol,{start:"2",children:["\n",(0,r.jsxs)(n.li,{children:["Add the following to ",(0,r.jsx)(n.code,{children:"/etc/haproxy/haproxy.cfg"})," on lb-1 and lb-2:"]}),"\n"]}),(0,r.jsx)(n.pre,{children:(0,r.jsx)(n.code,{children:"frontend k3s-frontend\n bind *:6443\n mode tcp\n option tcplog\n default_backend k3s-backend\n\nbackend k3s-backend\n mode tcp\n option tcp-check\n balance roundrobin\n default-server inter 10s downinter 5s\n server server-1 10.10.10.50:6443 check\n server server-2 10.10.10.51:6443 check\n server server-3 10.10.10.52:6443 check\n"})}),(0,r.jsxs)(n.ol,{start:"3",children:["\n",(0,r.jsxs)(n.li,{children:["Add the following to ",(0,r.jsx)(n.code,{children:"/etc/keepalived/keepalived.conf"})," on lb-1 and lb-2:"]}),"\n"]}),(0,r.jsx)(n.pre,{children:(0,r.jsx)(n.code,{children:"global_defs {\n enable_script_security\n script_user root\n}\n\nvrrp_script chk_haproxy {\n script 'killall -0 haproxy' # faster than pidof\n interval 2\n}\n\nvrrp_instance haproxy-vip {\n interface eth1\n state # MASTER on lb-1, BACKUP on lb-2\n priority # 200 on lb-1, 100 on lb-2\n\n virtual_router_id 51\n\n virtual_ipaddress {\n 10.10.10.100/24\n }\n\n track_script {\n chk_haproxy\n }\n}\n"})}),(0,r.jsxs)(n.ol,{start:"6",children:["\n",(0,r.jsx)(n.li,{children:"Restart HAProxy and KeepAlived on lb-1 and lb-2:"}),"\n"]}),(0,r.jsx)(n.pre,{children:(0,r.jsx)(n.code,{className:"language-bash",children:"systemctl restart haproxy\nsystemctl restart keepalived\n"})}),(0,r.jsxs)(n.ol,{start:"5",children:["\n",(0,r.jsx)(n.li,{children:"On agent-1, agent-2, and agent-3, run the following command to install k3s and join the cluster:"}),"\n"]}),(0,r.jsx)(n.pre,{children:(0,r.jsx)(n.code,{className:"language-bash",children:"curl -sfL https://get.k3s.io | K3S_TOKEN=lb-cluster-gd sh -s - agent --server https://10.10.10.100:6443\n"})}),(0,r.jsxs)(n.p,{children:["You can now use ",(0,r.jsx)(n.code,{children:"kubectl"})," from server node to interact with the cluster."]}),(0,r.jsx)(n.pre,{children:(0,r.jsx)(n.code,{className:"language-bash",children:"root@server-1 $ k3s kubectl get nodes -A\nNAME STATUS ROLES AGE VERSION\nagent-1 Ready 32s v1.27.3+k3s1\nagent-2 Ready 20s v1.27.3+k3s1\nagent-3 Ready 9s v1.27.3+k3s1\nserver-1 Ready control-plane,etcd,master 4m22s v1.27.3+k3s1\nserver-2 Ready control-plane,etcd,master 3m58s v1.27.3+k3s1\nserver-3 Ready control-plane,etcd,master 3m12s v1.27.3+k3s1\n"})})]}),(0,r.jsxs)(s,{value:"Nginx",children:[(0,r.jsx)(n.h2,{id:"nginx-load-balancer",children:"Nginx Load Balancer"}),(0,r.jsx)(n.admonition,{type:"danger",children:(0,r.jsx)(n.p,{children:"Nginx does not natively support a High Availability (HA) configuration. If setting up an HA cluster, having a single load balancer in front of K3s will reintroduce a single point of failure."})}),(0,r.jsxs)(n.p,{children:[(0,r.jsx)(n.a,{href:"http://nginx.org/",children:"Nginx Open Source"})," provides a TCP load balancer. See ",(0,r.jsx)(n.a,{href:"https://nginx.org/en/docs/http/load_balancing.html",children:"Using nginx as HTTP load balancer"})," for more info."]}),(0,r.jsxs)(n.ol,{children:["\n",(0,r.jsxs)(n.li,{children:["Create a ",(0,r.jsx)(n.code,{children:"nginx.conf"})," file on lb-1 with the following contents:"]}),"\n"]}),(0,r.jsx)(n.pre,{children:(0,r.jsx)(n.code,{children:"events {}\n\nstream {\n upstream k3s_servers {\n server 10.10.10.50:6443;\n server 10.10.10.51:6443;\n server 10.10.10.52:6443;\n }\n\n server {\n listen 6443;\n proxy_pass k3s_servers;\n }\n}\n"})}),(0,r.jsxs)(n.ol,{start:"2",children:["\n",(0,r.jsx)(n.li,{children:"Run the Nginx load balancer on lb-1:"}),"\n"]}),(0,r.jsx)(n.p,{children:"Using docker:"}),(0,r.jsx)(n.pre,{children:(0,r.jsx)(n.code,{className:"language-bash",children:"docker run -d --restart unless-stopped \\\n -v ${PWD}/nginx.conf:/etc/nginx/nginx.conf \\\n -p 6443:6443 \\\n nginx:stable\n"})}),(0,r.jsxs)(n.p,{children:["Or ",(0,r.jsx)(n.a,{href:"https://docs.nginx.com/nginx/admin-guide/installing-nginx/installing-nginx-open-source/",children:"install nginx"})," and then run:"]}),(0,r.jsx)(n.pre,{children:(0,r.jsx)(n.code,{className:"language-bash",children:"cp nginx.conf /etc/nginx/nginx.conf\nsystemctl start nginx\n"})}),(0,r.jsxs)(n.ol,{start:"3",children:["\n",(0,r.jsx)(n.li,{children:"On agent-1, agent-2, and agent-3, run the following command to install k3s and join the cluster:"}),"\n"]}),(0,r.jsx)(n.pre,{children:(0,r.jsx)(n.code,{className:"language-bash",children:"curl -sfL https://get.k3s.io | K3S_TOKEN=lb-cluster-gd sh -s - agent --server https://10.10.10.98:6443\n"})}),(0,r.jsxs)(n.p,{children:["You can now use ",(0,r.jsx)(n.code,{children:"kubectl"})," from server node to interact with the cluster."]}),(0,r.jsx)(n.pre,{children:(0,r.jsx)(n.code,{className:"language-bash",children:"root@server1 $ k3s kubectl get nodes -A\nNAME STATUS ROLES AGE VERSION\nagent-1 Ready 30s v1.27.3+k3s1\nagent-2 Ready 22s v1.27.3+k3s1\nagent-3 Ready 13s v1.27.3+k3s1\nserver-1 Ready control-plane,etcd,master 4m49s v1.27.3+k3s1\nserver-2 Ready control-plane,etcd,master 3m58s v1.27.3+k3s1\nserver-3 Ready control-plane,etcd,master 3m16s v1.27.3+k3s1\n"})})]})]})]})}function h(e={}){const{wrapper:n}={...(0,a.a)(),...e.components};return n?(0,r.jsx)(n,{...e,children:(0,r.jsx)(c,{...e})}):c(e)}function x(e,n){throw new Error("Expected "+(n?"component":"object")+" `"+e+"` to be defined: you likely forgot to import, pass, or provide it.")}},1151:(e,n,s)=>{s.d(n,{Z:()=>o,a:()=>t});var r=s(7294);const a={},l=r.createContext(a);function t(e){const n=r.useContext(l);return r.useMemo((function(){return"function"==typeof e?e(n):{...n,...e}}),[n,e])}function o(e){let n;return n=e.disableParentContext?"function"==typeof e.components?e.components(a):e.components||a:t(e.components),r.createElement(l.Provider,{value:n},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/4aae9e46.aa17d933.js b/assets/js/4aae9e46.88170da1.js similarity index 98% rename from assets/js/4aae9e46.aa17d933.js rename to assets/js/4aae9e46.88170da1.js index 6ab33e56c..0f628f08e 100644 --- a/assets/js/4aae9e46.aa17d933.js +++ b/assets/js/4aae9e46.88170da1.js @@ -1 +1 @@ -"use strict";(self.webpackChunkk_3_s_docs=self.webpackChunkk_3_s_docs||[]).push([[4443],{557:(e,s,n)=>{n.r(s),n.d(s,{assets:()=>c,contentTitle:()=>a,default:()=>p,frontMatter:()=>l,metadata:()=>i,toc:()=>o});var t=n(5893),r=n(1151);const l={title:"Stopping K3s"},a=void 0,i={id:"upgrades/killall",title:"Stopping K3s",description:"To allow high availability during upgrades, the K3s containers continue running when the K3s service is stopped.",source:"@site/docs/upgrades/killall.md",sourceDirName:"upgrades",slug:"/upgrades/killall",permalink:"/upgrades/killall",draft:!1,unlisted:!1,editUrl:"https://github.com/k3s-io/docs/edit/main/docs/upgrades/killall.md",tags:[],version:"current",lastUpdatedAt:1723651727e3,frontMatter:{title:"Stopping K3s"},sidebar:"mySidebar",previous:{title:"Upgrades",permalink:"/upgrades/"},next:{title:"Manual Upgrades",permalink:"/upgrades/manual"}},c={},o=[{value:"K3s Service",id:"k3s-service",level:2},{value:"Killall Script",id:"killall-script",level:2}];function d(e){const s={code:"code",h2:"h2",p:"p",pre:"pre",...(0,r.a)(),...e.components},{TabItem:n,Tabs:l}=s;return n||h("TabItem",!0),l||h("Tabs",!0),(0,t.jsxs)(t.Fragment,{children:[(0,t.jsx)(s.p,{children:"To allow high availability during upgrades, the K3s containers continue running when the K3s service is stopped."}),"\n",(0,t.jsx)(s.h2,{id:"k3s-service",children:"K3s Service"}),"\n",(0,t.jsx)(s.p,{children:"Stopping and restarting K3s is supported by the installation script for systemd and OpenRC."}),"\n",(0,t.jsxs)(l,{children:[(0,t.jsxs)(n,{value:"systemd",children:[(0,t.jsx)(s.p,{children:"To stop servers:"}),(0,t.jsx)(s.pre,{children:(0,t.jsx)(s.code,{className:"language-sh",children:"sudo systemctl stop k3s\n"})}),(0,t.jsx)(s.p,{children:"To restart servers:"}),(0,t.jsx)(s.pre,{children:(0,t.jsx)(s.code,{className:"language-sh",children:"sudo systemctl start k3s\n"})}),(0,t.jsx)(s.p,{children:"To stop agents:"}),(0,t.jsx)(s.pre,{children:(0,t.jsx)(s.code,{className:"language-sh",children:"sudo systemctl stop k3s-agent\n"})}),(0,t.jsx)(s.p,{children:"To restart agents:"}),(0,t.jsx)(s.pre,{children:(0,t.jsx)(s.code,{className:"language-sh",children:"sudo systemctl start k3s-agent\n"})})]}),(0,t.jsxs)(n,{value:"OpenRC",children:[(0,t.jsx)(s.p,{children:"To stop servers:"}),(0,t.jsx)(s.pre,{children:(0,t.jsx)(s.code,{className:"language-sh",children:"sudo rc-service k3s stop\n"})}),(0,t.jsx)(s.p,{children:"To restart servers:"}),(0,t.jsx)(s.pre,{children:(0,t.jsx)(s.code,{className:"language-sh",children:"sudo rc-service k3s restart\n"})}),(0,t.jsx)(s.p,{children:"To stop agents:"}),(0,t.jsx)(s.pre,{children:(0,t.jsx)(s.code,{className:"language-sh",children:"sudo rc-service k3s-agent stop\n"})}),(0,t.jsx)(s.p,{children:"To restart agents:"}),(0,t.jsx)(s.pre,{children:(0,t.jsx)(s.code,{className:"language-sh",children:"sudo rc-service k3s-agent restart\n"})})]})]}),"\n",(0,t.jsx)(s.h2,{id:"killall-script",children:"Killall Script"}),"\n",(0,t.jsxs)(s.p,{children:["To stop all of the K3s containers and reset the containerd state, the ",(0,t.jsx)(s.code,{children:"k3s-killall.sh"})," script can be used."]}),"\n",(0,t.jsx)(s.p,{children:"The killall script cleans up containers, K3s directories, and networking components while also removing the iptables chain with all the associated rules. The cluster data will not be deleted."}),"\n",(0,t.jsx)(s.p,{children:"To run the killall script from a server node, run:"}),"\n",(0,t.jsx)(s.pre,{children:(0,t.jsx)(s.code,{className:"language-bash",children:"/usr/local/bin/k3s-killall.sh\n"})})]})}function p(e={}){const{wrapper:s}={...(0,r.a)(),...e.components};return s?(0,t.jsx)(s,{...e,children:(0,t.jsx)(d,{...e})}):d(e)}function h(e,s){throw new Error("Expected "+(s?"component":"object")+" `"+e+"` to be defined: you likely forgot to import, pass, or provide it.")}},1151:(e,s,n)=>{n.d(s,{Z:()=>i,a:()=>a});var t=n(7294);const r={},l=t.createContext(r);function a(e){const s=t.useContext(l);return t.useMemo((function(){return"function"==typeof e?e(s):{...s,...e}}),[s,e])}function i(e){let s;return s=e.disableParentContext?"function"==typeof e.components?e.components(r):e.components||r:a(e.components),t.createElement(l.Provider,{value:s},e.children)}}}]); \ No newline at end of file +"use strict";(self.webpackChunkk_3_s_docs=self.webpackChunkk_3_s_docs||[]).push([[4443],{557:(e,s,n)=>{n.r(s),n.d(s,{assets:()=>c,contentTitle:()=>a,default:()=>p,frontMatter:()=>l,metadata:()=>i,toc:()=>o});var t=n(5893),r=n(1151);const l={title:"Stopping K3s"},a=void 0,i={id:"upgrades/killall",title:"Stopping K3s",description:"To allow high availability during upgrades, the K3s containers continue running when the K3s service is stopped.",source:"@site/docs/upgrades/killall.md",sourceDirName:"upgrades",slug:"/upgrades/killall",permalink:"/upgrades/killall",draft:!1,unlisted:!1,editUrl:"https://github.com/k3s-io/docs/edit/main/docs/upgrades/killall.md",tags:[],version:"current",lastUpdatedAt:1723747404e3,frontMatter:{title:"Stopping K3s"},sidebar:"mySidebar",previous:{title:"Upgrades",permalink:"/upgrades/"},next:{title:"Manual Upgrades",permalink:"/upgrades/manual"}},c={},o=[{value:"K3s Service",id:"k3s-service",level:2},{value:"Killall Script",id:"killall-script",level:2}];function d(e){const s={code:"code",h2:"h2",p:"p",pre:"pre",...(0,r.a)(),...e.components},{TabItem:n,Tabs:l}=s;return n||h("TabItem",!0),l||h("Tabs",!0),(0,t.jsxs)(t.Fragment,{children:[(0,t.jsx)(s.p,{children:"To allow high availability during upgrades, the K3s containers continue running when the K3s service is stopped."}),"\n",(0,t.jsx)(s.h2,{id:"k3s-service",children:"K3s Service"}),"\n",(0,t.jsx)(s.p,{children:"Stopping and restarting K3s is supported by the installation script for systemd and OpenRC."}),"\n",(0,t.jsxs)(l,{children:[(0,t.jsxs)(n,{value:"systemd",children:[(0,t.jsx)(s.p,{children:"To stop servers:"}),(0,t.jsx)(s.pre,{children:(0,t.jsx)(s.code,{className:"language-sh",children:"sudo systemctl stop k3s\n"})}),(0,t.jsx)(s.p,{children:"To restart servers:"}),(0,t.jsx)(s.pre,{children:(0,t.jsx)(s.code,{className:"language-sh",children:"sudo systemctl start k3s\n"})}),(0,t.jsx)(s.p,{children:"To stop agents:"}),(0,t.jsx)(s.pre,{children:(0,t.jsx)(s.code,{className:"language-sh",children:"sudo systemctl stop k3s-agent\n"})}),(0,t.jsx)(s.p,{children:"To restart agents:"}),(0,t.jsx)(s.pre,{children:(0,t.jsx)(s.code,{className:"language-sh",children:"sudo systemctl start k3s-agent\n"})})]}),(0,t.jsxs)(n,{value:"OpenRC",children:[(0,t.jsx)(s.p,{children:"To stop servers:"}),(0,t.jsx)(s.pre,{children:(0,t.jsx)(s.code,{className:"language-sh",children:"sudo rc-service k3s stop\n"})}),(0,t.jsx)(s.p,{children:"To restart servers:"}),(0,t.jsx)(s.pre,{children:(0,t.jsx)(s.code,{className:"language-sh",children:"sudo rc-service k3s restart\n"})}),(0,t.jsx)(s.p,{children:"To stop agents:"}),(0,t.jsx)(s.pre,{children:(0,t.jsx)(s.code,{className:"language-sh",children:"sudo rc-service k3s-agent stop\n"})}),(0,t.jsx)(s.p,{children:"To restart agents:"}),(0,t.jsx)(s.pre,{children:(0,t.jsx)(s.code,{className:"language-sh",children:"sudo rc-service k3s-agent restart\n"})})]})]}),"\n",(0,t.jsx)(s.h2,{id:"killall-script",children:"Killall Script"}),"\n",(0,t.jsxs)(s.p,{children:["To stop all of the K3s containers and reset the containerd state, the ",(0,t.jsx)(s.code,{children:"k3s-killall.sh"})," script can be used."]}),"\n",(0,t.jsx)(s.p,{children:"The killall script cleans up containers, K3s directories, and networking components while also removing the iptables chain with all the associated rules. The cluster data will not be deleted."}),"\n",(0,t.jsx)(s.p,{children:"To run the killall script from a server node, run:"}),"\n",(0,t.jsx)(s.pre,{children:(0,t.jsx)(s.code,{className:"language-bash",children:"/usr/local/bin/k3s-killall.sh\n"})})]})}function p(e={}){const{wrapper:s}={...(0,r.a)(),...e.components};return s?(0,t.jsx)(s,{...e,children:(0,t.jsx)(d,{...e})}):d(e)}function h(e,s){throw new Error("Expected "+(s?"component":"object")+" `"+e+"` to be defined: you likely forgot to import, pass, or provide it.")}},1151:(e,s,n)=>{n.d(s,{Z:()=>i,a:()=>a});var t=n(7294);const r={},l=t.createContext(r);function a(e){const s=t.useContext(l);return t.useMemo((function(){return"function"==typeof e?e(s):{...s,...e}}),[s,e])}function i(e){let s;return s=e.disableParentContext?"function"==typeof e.components?e.components(r):e.components||r:a(e.components),t.createElement(l.Provider,{value:s},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/4e366d5e.7072c3bd.js b/assets/js/4e366d5e.4b1c1293.js similarity index 98% rename from assets/js/4e366d5e.7072c3bd.js rename to assets/js/4e366d5e.4b1c1293.js index 9412c89c2..9ae721864 100644 --- a/assets/js/4e366d5e.7072c3bd.js +++ b/assets/js/4e366d5e.4b1c1293.js @@ -1 +1 @@ -"use strict";(self.webpackChunkk_3_s_docs=self.webpackChunkk_3_s_docs||[]).push([[3595],{882:(e,r,s)=>{s.r(r),s.d(r,{assets:()=>l,contentTitle:()=>i,default:()=>u,frontMatter:()=>a,metadata:()=>o,toc:()=>d});var t=s(5893),n=s(1151);const a={title:"Upgrades"},i=void 0,o={id:"upgrades/upgrades",title:"Upgrades",description:"Upgrading your K3s cluster",source:"@site/docs/upgrades/upgrades.md",sourceDirName:"upgrades",slug:"/upgrades/",permalink:"/upgrades/",draft:!1,unlisted:!1,editUrl:"https://github.com/k3s-io/docs/edit/main/docs/upgrades/upgrades.md",tags:[],version:"current",lastUpdatedAt:1723651727e3,frontMatter:{title:"Upgrades"},sidebar:"mySidebar",previous:{title:"Cluster Load Balancer",permalink:"/datastore/cluster-loadbalancer"},next:{title:"Stopping K3s",permalink:"/upgrades/killall"}},l={},d=[{value:"Upgrading your K3s cluster",id:"upgrading-your-k3s-cluster",level:3},{value:"Version-specific caveats",id:"version-specific-caveats",level:3}];function c(e){const r={a:"a",code:"code",h3:"h3",li:"li",p:"p",pre:"pre",strong:"strong",ul:"ul",...(0,n.a)(),...e.components};return(0,t.jsxs)(t.Fragment,{children:[(0,t.jsx)(r.h3,{id:"upgrading-your-k3s-cluster",children:"Upgrading your K3s cluster"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.a,{href:"/upgrades/manual",children:"Manual Upgrades"})," describes several techniques for upgrading your cluster manually. It can also be used as a basis for upgrading through third-party Infrastructure-as-Code tools like ",(0,t.jsx)(r.a,{href:"https://www.terraform.io/",children:"Terraform"}),"."]}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.a,{href:"/upgrades/automated",children:"Automated Upgrades"})," describes how to perform Kubernetes-native automated upgrades using Rancher's ",(0,t.jsx)(r.a,{href:"https://github.com/rancher/system-upgrade-controller",children:"system-upgrade-controller"}),"."]}),"\n",(0,t.jsx)(r.h3,{id:"version-specific-caveats",children:"Version-specific caveats"}),"\n",(0,t.jsxs)(r.ul,{children:["\n",(0,t.jsxs)(r.li,{children:["\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Traefik:"})," If Traefik is not disabled, K3s versions 1.20 and earlier will install Traefik v1, while K3s versions 1.21 and later will install Traefik v2, if v1 is not already present. To upgrade from the older Traefik v1 to Traefik v2, please refer to the ",(0,t.jsx)(r.a,{href:"https://doc.traefik.io/traefik/migration/v1-to-v2/",children:"Traefik documentation"})," and use the ",(0,t.jsx)(r.a,{href:"https://github.com/traefik/traefik-migration-tool",children:"migration tool"}),"."]}),"\n"]}),"\n",(0,t.jsxs)(r.li,{children:["\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"K3s bootstrap data:"})," If you are using K3s in an HA configuration with an external SQL datastore, and your server (control-plane) nodes were not started with the ",(0,t.jsx)(r.code,{children:"--token"})," CLI flag, you will no longer be able to add additional K3s servers to the cluster without specifying the token. Ensure that you retain a copy of this token, as it is required when restoring from backup. Previously, K3s did not enforce the use of a token when using external SQL datastores."]}),"\n",(0,t.jsxs)(r.ul,{children:["\n",(0,t.jsxs)(r.li,{children:["\n",(0,t.jsx)(r.p,{children:"The affected versions are <= v1.19.12+k3s1, v1.20.8+k3s1, v1.21.2+k3s1; the patched versions are v1.19.13+k3s1, v1.20.9+k3s1, v1.21.3+k3s1."}),"\n"]}),"\n",(0,t.jsxs)(r.li,{children:["\n",(0,t.jsx)(r.p,{children:"You may retrieve the token value from any server already joined to the cluster as follows:"}),"\n"]}),"\n"]}),"\n"]}),"\n"]}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"cat /var/lib/rancher/k3s/server/token\n"})})]})}function u(e={}){const{wrapper:r}={...(0,n.a)(),...e.components};return r?(0,t.jsx)(r,{...e,children:(0,t.jsx)(c,{...e})}):c(e)}},1151:(e,r,s)=>{s.d(r,{Z:()=>o,a:()=>i});var t=s(7294);const n={},a=t.createContext(n);function i(e){const r=t.useContext(a);return t.useMemo((function(){return"function"==typeof e?e(r):{...r,...e}}),[r,e])}function o(e){let r;return r=e.disableParentContext?"function"==typeof e.components?e.components(n):e.components||n:i(e.components),t.createElement(a.Provider,{value:r},e.children)}}}]); \ No newline at end of file +"use strict";(self.webpackChunkk_3_s_docs=self.webpackChunkk_3_s_docs||[]).push([[3595],{882:(e,r,s)=>{s.r(r),s.d(r,{assets:()=>l,contentTitle:()=>i,default:()=>u,frontMatter:()=>a,metadata:()=>o,toc:()=>d});var t=s(5893),n=s(1151);const a={title:"Upgrades"},i=void 0,o={id:"upgrades/upgrades",title:"Upgrades",description:"Upgrading your K3s cluster",source:"@site/docs/upgrades/upgrades.md",sourceDirName:"upgrades",slug:"/upgrades/",permalink:"/upgrades/",draft:!1,unlisted:!1,editUrl:"https://github.com/k3s-io/docs/edit/main/docs/upgrades/upgrades.md",tags:[],version:"current",lastUpdatedAt:1723747404e3,frontMatter:{title:"Upgrades"},sidebar:"mySidebar",previous:{title:"Cluster Load Balancer",permalink:"/datastore/cluster-loadbalancer"},next:{title:"Stopping K3s",permalink:"/upgrades/killall"}},l={},d=[{value:"Upgrading your K3s cluster",id:"upgrading-your-k3s-cluster",level:3},{value:"Version-specific caveats",id:"version-specific-caveats",level:3}];function c(e){const r={a:"a",code:"code",h3:"h3",li:"li",p:"p",pre:"pre",strong:"strong",ul:"ul",...(0,n.a)(),...e.components};return(0,t.jsxs)(t.Fragment,{children:[(0,t.jsx)(r.h3,{id:"upgrading-your-k3s-cluster",children:"Upgrading your K3s cluster"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.a,{href:"/upgrades/manual",children:"Manual Upgrades"})," describes several techniques for upgrading your cluster manually. It can also be used as a basis for upgrading through third-party Infrastructure-as-Code tools like ",(0,t.jsx)(r.a,{href:"https://www.terraform.io/",children:"Terraform"}),"."]}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.a,{href:"/upgrades/automated",children:"Automated Upgrades"})," describes how to perform Kubernetes-native automated upgrades using Rancher's ",(0,t.jsx)(r.a,{href:"https://github.com/rancher/system-upgrade-controller",children:"system-upgrade-controller"}),"."]}),"\n",(0,t.jsx)(r.h3,{id:"version-specific-caveats",children:"Version-specific caveats"}),"\n",(0,t.jsxs)(r.ul,{children:["\n",(0,t.jsxs)(r.li,{children:["\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Traefik:"})," If Traefik is not disabled, K3s versions 1.20 and earlier will install Traefik v1, while K3s versions 1.21 and later will install Traefik v2, if v1 is not already present. To upgrade from the older Traefik v1 to Traefik v2, please refer to the ",(0,t.jsx)(r.a,{href:"https://doc.traefik.io/traefik/migration/v1-to-v2/",children:"Traefik documentation"})," and use the ",(0,t.jsx)(r.a,{href:"https://github.com/traefik/traefik-migration-tool",children:"migration tool"}),"."]}),"\n"]}),"\n",(0,t.jsxs)(r.li,{children:["\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"K3s bootstrap data:"})," If you are using K3s in an HA configuration with an external SQL datastore, and your server (control-plane) nodes were not started with the ",(0,t.jsx)(r.code,{children:"--token"})," CLI flag, you will no longer be able to add additional K3s servers to the cluster without specifying the token. Ensure that you retain a copy of this token, as it is required when restoring from backup. Previously, K3s did not enforce the use of a token when using external SQL datastores."]}),"\n",(0,t.jsxs)(r.ul,{children:["\n",(0,t.jsxs)(r.li,{children:["\n",(0,t.jsx)(r.p,{children:"The affected versions are <= v1.19.12+k3s1, v1.20.8+k3s1, v1.21.2+k3s1; the patched versions are v1.19.13+k3s1, v1.20.9+k3s1, v1.21.3+k3s1."}),"\n"]}),"\n",(0,t.jsxs)(r.li,{children:["\n",(0,t.jsx)(r.p,{children:"You may retrieve the token value from any server already joined to the cluster as follows:"}),"\n"]}),"\n"]}),"\n"]}),"\n"]}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"cat /var/lib/rancher/k3s/server/token\n"})})]})}function u(e={}){const{wrapper:r}={...(0,n.a)(),...e.components};return r?(0,t.jsx)(r,{...e,children:(0,t.jsx)(c,{...e})}):c(e)}},1151:(e,r,s)=>{s.d(r,{Z:()=>o,a:()=>i});var t=s(7294);const n={},a=t.createContext(n);function i(e){const r=t.useContext(a);return t.useMemo((function(){return"function"==typeof e?e(r):{...r,...e}}),[r,e])}function o(e){let r;return r=e.disableParentContext?"function"==typeof e.components?e.components(n):e.components||n:i(e.components),t.createElement(a.Provider,{value:r},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/4fea1ac4.97fc9d89.js b/assets/js/4fea1ac4.2c8d5f94.js similarity index 98% rename from assets/js/4fea1ac4.97fc9d89.js rename to assets/js/4fea1ac4.2c8d5f94.js index 0c6fc83d4..55c471612 100644 --- a/assets/js/4fea1ac4.97fc9d89.js +++ b/assets/js/4fea1ac4.2c8d5f94.js @@ -1 +1 @@ -"use strict";(self.webpackChunkk_3_s_docs=self.webpackChunkk_3_s_docs||[]).push([[1073],{8544:(n,e,t)=>{t.r(e),t.d(e,{assets:()=>r,contentTitle:()=>l,default:()=>u,frontMatter:()=>i,metadata:()=>o,toc:()=>d});var s=t(5893),a=t(1151);const i={title:"Uninstalling K3s"},l=void 0,o={id:"installation/uninstall",title:"Uninstalling K3s",description:"Uninstalling K3s deletes the local cluster data, configuration, and all of the scripts and CLI tools.",source:"@site/docs/installation/uninstall.md",sourceDirName:"installation",slug:"/installation/uninstall",permalink:"/installation/uninstall",draft:!1,unlisted:!1,editUrl:"https://github.com/k3s-io/docs/edit/main/docs/installation/uninstall.md",tags:[],version:"current",lastUpdatedAt:1723651727e3,frontMatter:{title:"Uninstalling K3s"},sidebar:"mySidebar",previous:{title:"Managing Packaged Components",permalink:"/installation/packaged-components"},next:{title:"Cluster Datastore",permalink:"/datastore/"}},r={},d=[{value:"Uninstalling Servers",id:"uninstalling-servers",level:3},{value:"Uninstalling Agents",id:"uninstalling-agents",level:3}];function c(n){const e={a:"a",admonition:"admonition",br:"br",code:"code",h3:"h3",p:"p",pre:"pre",...(0,a.a)(),...n.components};return(0,s.jsxs)(s.Fragment,{children:[(0,s.jsx)(e.admonition,{type:"warning",children:(0,s.jsxs)(e.p,{children:["Uninstalling K3s deletes the local cluster data, configuration, and all of the scripts and CLI tools.",(0,s.jsx)(e.br,{}),"\n","It does not remove any data from external datastores, or created by pods using external Kubernetes storage volumes."]})}),"\n",(0,s.jsx)(e.p,{children:"If you installed K3s using the installation script, a script to uninstall K3s was generated during installation."}),"\n",(0,s.jsxs)(e.p,{children:["If you are planning on rejoining a node to an existing cluster after uninstalling and reinstalling, be sure to delete the node from the cluster to ensure that the node password secret is removed. See the ",(0,s.jsx)(e.a,{href:"/architecture#how-agent-node-registration-works",children:"Node Registration"})," documentation for more information."]}),"\n",(0,s.jsx)(e.h3,{id:"uninstalling-servers",children:"Uninstalling Servers"}),"\n",(0,s.jsx)(e.p,{children:"To uninstall K3s from a server node, run:"}),"\n",(0,s.jsx)(e.pre,{children:(0,s.jsx)(e.code,{className:"language-bash",children:"/usr/local/bin/k3s-uninstall.sh\n"})}),"\n",(0,s.jsx)(e.h3,{id:"uninstalling-agents",children:"Uninstalling Agents"}),"\n",(0,s.jsx)(e.p,{children:"To uninstall K3s from an agent node, run:"}),"\n",(0,s.jsx)(e.pre,{children:(0,s.jsx)(e.code,{className:"language-bash",children:"/usr/local/bin/k3s-agent-uninstall.sh\n"})})]})}function u(n={}){const{wrapper:e}={...(0,a.a)(),...n.components};return e?(0,s.jsx)(e,{...n,children:(0,s.jsx)(c,{...n})}):c(n)}},1151:(n,e,t)=>{t.d(e,{Z:()=>o,a:()=>l});var s=t(7294);const a={},i=s.createContext(a);function l(n){const e=s.useContext(i);return s.useMemo((function(){return"function"==typeof n?n(e):{...e,...n}}),[e,n])}function o(n){let e;return e=n.disableParentContext?"function"==typeof n.components?n.components(a):n.components||a:l(n.components),s.createElement(i.Provider,{value:e},n.children)}}}]); \ No newline at end of file +"use strict";(self.webpackChunkk_3_s_docs=self.webpackChunkk_3_s_docs||[]).push([[1073],{8544:(n,e,t)=>{t.r(e),t.d(e,{assets:()=>r,contentTitle:()=>l,default:()=>u,frontMatter:()=>i,metadata:()=>o,toc:()=>d});var s=t(5893),a=t(1151);const i={title:"Uninstalling K3s"},l=void 0,o={id:"installation/uninstall",title:"Uninstalling K3s",description:"Uninstalling K3s deletes the local cluster data, configuration, and all of the scripts and CLI tools.",source:"@site/docs/installation/uninstall.md",sourceDirName:"installation",slug:"/installation/uninstall",permalink:"/installation/uninstall",draft:!1,unlisted:!1,editUrl:"https://github.com/k3s-io/docs/edit/main/docs/installation/uninstall.md",tags:[],version:"current",lastUpdatedAt:1723747404e3,frontMatter:{title:"Uninstalling K3s"},sidebar:"mySidebar",previous:{title:"Managing Packaged Components",permalink:"/installation/packaged-components"},next:{title:"Cluster Datastore",permalink:"/datastore/"}},r={},d=[{value:"Uninstalling Servers",id:"uninstalling-servers",level:3},{value:"Uninstalling Agents",id:"uninstalling-agents",level:3}];function c(n){const e={a:"a",admonition:"admonition",br:"br",code:"code",h3:"h3",p:"p",pre:"pre",...(0,a.a)(),...n.components};return(0,s.jsxs)(s.Fragment,{children:[(0,s.jsx)(e.admonition,{type:"warning",children:(0,s.jsxs)(e.p,{children:["Uninstalling K3s deletes the local cluster data, configuration, and all of the scripts and CLI tools.",(0,s.jsx)(e.br,{}),"\n","It does not remove any data from external datastores, or created by pods using external Kubernetes storage volumes."]})}),"\n",(0,s.jsx)(e.p,{children:"If you installed K3s using the installation script, a script to uninstall K3s was generated during installation."}),"\n",(0,s.jsxs)(e.p,{children:["If you are planning on rejoining a node to an existing cluster after uninstalling and reinstalling, be sure to delete the node from the cluster to ensure that the node password secret is removed. See the ",(0,s.jsx)(e.a,{href:"/architecture#how-agent-node-registration-works",children:"Node Registration"})," documentation for more information."]}),"\n",(0,s.jsx)(e.h3,{id:"uninstalling-servers",children:"Uninstalling Servers"}),"\n",(0,s.jsx)(e.p,{children:"To uninstall K3s from a server node, run:"}),"\n",(0,s.jsx)(e.pre,{children:(0,s.jsx)(e.code,{className:"language-bash",children:"/usr/local/bin/k3s-uninstall.sh\n"})}),"\n",(0,s.jsx)(e.h3,{id:"uninstalling-agents",children:"Uninstalling Agents"}),"\n",(0,s.jsx)(e.p,{children:"To uninstall K3s from an agent node, run:"}),"\n",(0,s.jsx)(e.pre,{children:(0,s.jsx)(e.code,{className:"language-bash",children:"/usr/local/bin/k3s-agent-uninstall.sh\n"})})]})}function u(n={}){const{wrapper:e}={...(0,a.a)(),...n.components};return e?(0,s.jsx)(e,{...n,children:(0,s.jsx)(c,{...n})}):c(n)}},1151:(n,e,t)=>{t.d(e,{Z:()=>o,a:()=>l});var s=t(7294);const a={},i=s.createContext(a);function l(n){const e=s.useContext(i);return s.useMemo((function(){return"function"==typeof n?n(e):{...e,...n}}),[e,n])}function o(n){let e;return e=n.disableParentContext?"function"==typeof n.components?n.components(a):n.components||a:l(n.components),s.createElement(i.Provider,{value:e},n.children)}}}]); \ No newline at end of file diff --git a/assets/js/5159b4a0.867ebed5.js b/assets/js/5159b4a0.7ab186e2.js similarity index 99% rename from assets/js/5159b4a0.867ebed5.js rename to assets/js/5159b4a0.7ab186e2.js index de0a7b074..5c374cf1f 100644 --- a/assets/js/5159b4a0.867ebed5.js +++ b/assets/js/5159b4a0.7ab186e2.js @@ -1 +1 @@ -"use strict";(self.webpackChunkk_3_s_docs=self.webpackChunkk_3_s_docs||[]).push([[9478],{7477:(e,r,i)=>{i.r(r),i.d(r,{assets:()=>l,contentTitle:()=>a,default:()=>h,frontMatter:()=>s,metadata:()=>o,toc:()=>d});var t=i(5893),n=i(1151);const s={title:"Embedded Registry Mirror"},a=void 0,o={id:"installation/registry-mirror",title:"Embedded Registry Mirror",description:"The Embedded Registry Mirror is available as an experimental feature as of January 2024 releases: v1.26.13+k3s1, v1.27.10+k3s1, v1.28.6+k3s1, v1.29.1+k3s1",source:"@site/docs/installation/registry-mirror.md",sourceDirName:"installation",slug:"/installation/registry-mirror",permalink:"/installation/registry-mirror",draft:!1,unlisted:!1,editUrl:"https://github.com/k3s-io/docs/edit/main/docs/installation/registry-mirror.md",tags:[],version:"current",lastUpdatedAt:1723651727e3,frontMatter:{title:"Embedded Registry Mirror"},sidebar:"mySidebar",previous:{title:"Private Registry Configuration",permalink:"/installation/private-registry"},next:{title:"Air-Gap Install",permalink:"/installation/airgap"}},l={},d=[{value:"Enabling The Distributed OCI Registry Mirror",id:"enabling-the-distributed-oci-registry-mirror",level:2},{value:"Requirements",id:"requirements",level:3},{value:"Enabling Registry Mirroring",id:"enabling-registry-mirroring",level:2},{value:"Default Endpoint Fallback",id:"default-endpoint-fallback",level:3},{value:"Latest Tag",id:"latest-tag",level:3},{value:"Security",id:"security",level:2},{value:"Authentication",id:"authentication",level:3},{value:"Potential Concerns",id:"potential-concerns",level:3},{value:"Sharing Air-gap or Manually Loaded Images",id:"sharing-air-gap-or-manually-loaded-images",level:2},{value:"Pushing Images",id:"pushing-images",level:2}];function c(e){const r={a:"a",admonition:"admonition",code:"code",h2:"h2",h3:"h3",p:"p",pre:"pre",strong:"strong",...(0,n.a)(),...e.components};return(0,t.jsxs)(t.Fragment,{children:[(0,t.jsx)(r.admonition,{title:"Version Gate",type:"info",children:(0,t.jsx)(r.p,{children:"The Embedded Registry Mirror is available as an experimental feature as of January 2024 releases: v1.26.13+k3s1, v1.27.10+k3s1, v1.28.6+k3s1, v1.29.1+k3s1"})}),"\n",(0,t.jsxs)(r.p,{children:["K3s embeds ",(0,t.jsx)(r.a,{href:"https://github.com/XenitAB/spegel",children:"Spegel"}),", a stateless distributed OCI registry mirror that allows peer-to-peer sharing of container images between nodes in a Kubernetes cluster.\nThe distributed registry mirror is disabled by default."]}),"\n",(0,t.jsx)(r.h2,{id:"enabling-the-distributed-oci-registry-mirror",children:"Enabling The Distributed OCI Registry Mirror"}),"\n",(0,t.jsxs)(r.p,{children:["In order to enable the embedded registry mirror, server nodes must be started with the ",(0,t.jsx)(r.code,{children:"--embedded-registry"})," flag, or with ",(0,t.jsx)(r.code,{children:"embedded-registry: true"})," in the configuration file.\nThis option enables the embedded mirror for use on all nodes in the cluster."]}),"\n",(0,t.jsxs)(r.p,{children:["When enabled at a cluster level, all nodes will host a local OCI registry on port 6443,\nand publish a list of available images via a peer to peer network on port 5001.\nAny image available in the containerd image store on any node, can be pulled by other cluster members without access to an external registry.\nImages imported via ",(0,t.jsx)(r.a,{href:"/installation/airgap#manually-deploy-images-method",children:"air-gap image tar files"})," are pinned in containerd to\nensure that they remain available and are not pruned by Kubelet garbage collection."]}),"\n",(0,t.jsxs)(r.p,{children:["The peer to peer port can changed from 5001 by setting the ",(0,t.jsx)(r.code,{children:"K3S_P2P_PORT"})," environment variable for the K3s service. The port must be set to the same value on all nodes.\nChanging the port is unsupported and not recommended."]}),"\n",(0,t.jsx)(r.h3,{id:"requirements",children:"Requirements"}),"\n",(0,t.jsx)(r.p,{children:"When the embedded registry mirror is enabled, all nodes must be able to reach each other via their internal IP addresses, on TCP ports 5001 and 6443.\nIf nodes cannot reach each other, it may take longer for images to be pulled, as the distributed registry will be tried first by containerd, before it falls back to other endpoints."}),"\n",(0,t.jsx)(r.h2,{id:"enabling-registry-mirroring",children:"Enabling Registry Mirroring"}),"\n",(0,t.jsx)(r.p,{children:"Enabling mirroring for a registry allows a node to both pull images from that registry from other nodes, and share the registry's images with other nodes.\nIf a registry is enabled for mirroring on some nodes, but not on others, only the nodes with the registry enabled will exchange images from that registry."}),"\n",(0,t.jsxs)(r.p,{children:["In order to enable mirroring of images from an upstream container registry, nodes must have an entry in the ",(0,t.jsx)(r.code,{children:"mirrors"})," section of ",(0,t.jsx)(r.code,{children:"registries.yaml"})," for that registry.\nThe registry does not need to have any endpoints listed, it just needs to be present.\nFor example, to enable distributed mirroring of images from ",(0,t.jsx)(r.code,{children:"docker.io"})," and ",(0,t.jsx)(r.code,{children:"registry.k8s.io"}),", configure ",(0,t.jsx)(r.code,{children:"registries.yaml"})," with the following content on all cluster nodes:"]}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-yaml",children:"mirrors:\n docker.io:\n registry.k8s.io:\n"})}),"\n",(0,t.jsxs)(r.p,{children:["Endpoints for registry mirrors may also be added as usual.\nIn the following configuration, images pull attempts will first try the embedded mirror, then ",(0,t.jsx)(r.code,{children:"mirror.example.com"}),", then finally ",(0,t.jsx)(r.code,{children:"docker.io"}),":"]}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-yaml",children:"mirrors:\n docker.io:\n endpoint:\n - https://mirror.example.com\n"})}),"\n",(0,t.jsx)(r.p,{children:"If you are using a private registry directly, instead of as a mirror for an upstream registry, you may enable distributed mirroring in the same way public\nregistries are enabled - by listing it in the mirrors section:"}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-yaml",children:"mirrors:\n mirror.example.com:\n"})}),"\n",(0,t.jsx)(r.admonition,{title:"Version Gate",type:"info",children:(0,t.jsx)(r.p,{children:"Wildcard support is available as of the March 2024 releases: v1.26.15+k3s1, v1.27.12+k3s1, v1.28.8+k3s1, v1.29.3+k3s1"})}),"\n",(0,t.jsxs)(r.p,{children:["The ",(0,t.jsx)(r.code,{children:'"*"'})," wildcard mirror entry can be used to enable distributed mirroring of all registries. Note that the asterisk MUST be quoted:"]}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-yaml",children:'mirrors:\n "*":\n'})}),"\n",(0,t.jsx)(r.p,{children:"If no registries are enabled for mirroring on a node, that node does not participate in the distributed registry in any capacity."}),"\n",(0,t.jsxs)(r.p,{children:["For more information on the structure of the ",(0,t.jsx)(r.code,{children:"registries.yaml"})," file, see ",(0,t.jsx)(r.a,{href:"/installation/private-registry",children:"Private Registry Configuration"}),"."]}),"\n",(0,t.jsx)(r.h3,{id:"default-endpoint-fallback",children:"Default Endpoint Fallback"}),"\n",(0,t.jsxs)(r.p,{children:["By default, containerd will fall back to the default endpoint when pulling from registries with mirror endpoints configured. If you want to disable this,\nand only pull images from the configured mirrors and/or the embedded mirror, see the ",(0,t.jsx)(r.a,{href:"/installation/private-registry#default-endpoint-fallback",children:"Default Endpoint Fallback"}),"\nsection of the Private Registry Configuration documentation."]}),"\n",(0,t.jsxs)(r.p,{children:["Note that if you are using the ",(0,t.jsx)(r.code,{children:"--disable-default-endpoint"})," option and want to allow pulling directly from a particular registry, while disallowing the rest,\nyou can explicitly provide an endpoint in order to allow the image pull to fall back to the registry itself:"]}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-yaml",children:"mirrors:\n docker.io: # no default endpoint, pulls will fail if not available on a node\n registry.k8s.io: # no default endpoint, pulls will fail if not available on a node\n mirror.example.com: # explicit default endpoint, can pull from upstream if not available on a node\n endpoint:\n - https://mirror.example.com\n"})}),"\n",(0,t.jsx)(r.h3,{id:"latest-tag",children:"Latest Tag"}),"\n",(0,t.jsxs)(r.p,{children:["When no tag is specified for a container image, the implicit default tag is ",(0,t.jsx)(r.code,{children:"latest"}),". This tag is frequently\nupdated to point at the most recent version of the image. Because this tag will point at a different revisions\nof an image depending on when it is pulled, the distributed registry ",(0,t.jsx)(r.strong,{children:"will not"})," pull the ",(0,t.jsx)(r.code,{children:"latest"})," tag from\nother nodes. This forces containerd go out to an upstream registry or registry mirror to ensure a consistent\nview of what the ",(0,t.jsx)(r.code,{children:"latest"})," tag refers to."]}),"\n",(0,t.jsxs)(r.p,{children:["This aligns with the ",(0,t.jsxs)(r.a,{href:"https://kubernetes.io/docs/concepts/containers/images/#imagepullpolicy-defaulting",children:["special ",(0,t.jsx)(r.code,{children:"imagePullPolicy"})," defaulting"]}),"\nobserved by Kubernetes when using the ",(0,t.jsx)(r.code,{children:"latest"})," tag for a container image."]}),"\n",(0,t.jsxs)(r.p,{children:["Mirroring the ",(0,t.jsx)(r.code,{children:"latest"})," tag can be enabled by setting the ",(0,t.jsx)(r.code,{children:"K3S_P2P_ENABLE_LATEST=true"})," environment variable for the K3s service.\nThis is unsupported and not recommended, for the reasons discussed above."]}),"\n",(0,t.jsx)(r.h2,{id:"security",children:"Security"}),"\n",(0,t.jsx)(r.h3,{id:"authentication",children:"Authentication"}),"\n",(0,t.jsx)(r.p,{children:"Access to the embedded mirror's registry API requires a valid client certificate, signed by the cluster's client certificate authority."}),"\n",(0,t.jsx)(r.p,{children:"Access to the distributed hash table's peer-to-peer network requires a preshared key that is controlled by server nodes.\nNodes authenticate each other using both the preshared key, and a certificate signed by the cluster certificate authority."}),"\n",(0,t.jsx)(r.h3,{id:"potential-concerns",children:"Potential Concerns"}),"\n",(0,t.jsx)(r.admonition,{type:"warning",children:(0,t.jsx)(r.p,{children:"The distributed registry is built on peer-to-peer principles, and assumes an equal level of privilege and trust between all cluster members.\nIf this does not match your cluster's security posture, you should not enable the embedded distributed registry."})}),"\n",(0,t.jsxs)(r.p,{children:["The embedded registry may make available images that a node may not otherwise have access to.\nFor example, if some of your images are pulled from a registry, project, or repository that requires authentication via Kubernetes Image Pull Secrets, or credentials in ",(0,t.jsx)(r.code,{children:"registries.yaml"}),",\nthe distributed registry will allow other nodes to share those images without providing any credentials to the upstream registry."]}),"\n",(0,t.jsx)(r.p,{children:"Users with access to push images into the containerd image store on one node may be able to use this to 'poison' the image for other cluster nodes,\nas other nodes will trust the tag advertised by the node, and use it without checking with the upstream registry.\nIf image integrity is important, you should use image digests instead of tags, as the digest cannot be poisoned in this manner."}),"\n",(0,t.jsx)(r.h2,{id:"sharing-air-gap-or-manually-loaded-images",children:"Sharing Air-gap or Manually Loaded Images"}),"\n",(0,t.jsxs)(r.p,{children:["Images sharing is controlled based on the source registry.\nImages loaded directly into containerd via air-gap tarballs, or loaded directly into containerd's image store using the ",(0,t.jsx)(r.code,{children:"ctr"})," command line tool,\nwill be shared between nodes if they are tagged as being from a registry that is enabled for mirroring."]}),"\n",(0,t.jsxs)(r.p,{children:["Note that the upstream registry that the images appear to come from does not actually have to exist or be reachable.\nFor example, you could tag images as being from a fictitious upstream registry, and import those images into containerd's image store.\nYou would then be able to pull those images from all cluster members, as long as that registry is listed in ",(0,t.jsx)(r.code,{children:"registries.yaml"})]}),"\n",(0,t.jsx)(r.h2,{id:"pushing-images",children:"Pushing Images"}),"\n",(0,t.jsxs)(r.p,{children:["The embedded registry is read-only, and cannot be pushed to directly using ",(0,t.jsx)(r.code,{children:"docker push"})," or other common tools that interact with OCI registries."]}),"\n",(0,t.jsxs)(r.p,{children:["Images can be manually made available via the embedded registry by running ",(0,t.jsx)(r.code,{children:"ctr -n k8s.io image pull"})," to pull an image,\nor by loading image archives created by ",(0,t.jsx)(r.code,{children:"docker save"})," via the ",(0,t.jsx)(r.code,{children:"ctr -n k8s.io image import"})," command.\nNote that the ",(0,t.jsx)(r.code,{children:"k8s.io"})," namespace must be specified when managing images via ",(0,t.jsx)(r.code,{children:"ctr"})," in order for them to be visible to the kubelet."]})]})}function h(e={}){const{wrapper:r}={...(0,n.a)(),...e.components};return r?(0,t.jsx)(r,{...e,children:(0,t.jsx)(c,{...e})}):c(e)}},1151:(e,r,i)=>{i.d(r,{Z:()=>o,a:()=>a});var t=i(7294);const n={},s=t.createContext(n);function a(e){const r=t.useContext(s);return t.useMemo((function(){return"function"==typeof e?e(r):{...r,...e}}),[r,e])}function o(e){let r;return r=e.disableParentContext?"function"==typeof e.components?e.components(n):e.components||n:a(e.components),t.createElement(s.Provider,{value:r},e.children)}}}]); \ No newline at end of file +"use strict";(self.webpackChunkk_3_s_docs=self.webpackChunkk_3_s_docs||[]).push([[9478],{7477:(e,r,i)=>{i.r(r),i.d(r,{assets:()=>l,contentTitle:()=>a,default:()=>h,frontMatter:()=>s,metadata:()=>o,toc:()=>d});var t=i(5893),n=i(1151);const s={title:"Embedded Registry Mirror"},a=void 0,o={id:"installation/registry-mirror",title:"Embedded Registry Mirror",description:"The Embedded Registry Mirror is available as an experimental feature as of January 2024 releases: v1.26.13+k3s1, v1.27.10+k3s1, v1.28.6+k3s1, v1.29.1+k3s1",source:"@site/docs/installation/registry-mirror.md",sourceDirName:"installation",slug:"/installation/registry-mirror",permalink:"/installation/registry-mirror",draft:!1,unlisted:!1,editUrl:"https://github.com/k3s-io/docs/edit/main/docs/installation/registry-mirror.md",tags:[],version:"current",lastUpdatedAt:1723747404e3,frontMatter:{title:"Embedded Registry Mirror"},sidebar:"mySidebar",previous:{title:"Private Registry Configuration",permalink:"/installation/private-registry"},next:{title:"Air-Gap Install",permalink:"/installation/airgap"}},l={},d=[{value:"Enabling The Distributed OCI Registry Mirror",id:"enabling-the-distributed-oci-registry-mirror",level:2},{value:"Requirements",id:"requirements",level:3},{value:"Enabling Registry Mirroring",id:"enabling-registry-mirroring",level:2},{value:"Default Endpoint Fallback",id:"default-endpoint-fallback",level:3},{value:"Latest Tag",id:"latest-tag",level:3},{value:"Security",id:"security",level:2},{value:"Authentication",id:"authentication",level:3},{value:"Potential Concerns",id:"potential-concerns",level:3},{value:"Sharing Air-gap or Manually Loaded Images",id:"sharing-air-gap-or-manually-loaded-images",level:2},{value:"Pushing Images",id:"pushing-images",level:2}];function c(e){const r={a:"a",admonition:"admonition",code:"code",h2:"h2",h3:"h3",p:"p",pre:"pre",strong:"strong",...(0,n.a)(),...e.components};return(0,t.jsxs)(t.Fragment,{children:[(0,t.jsx)(r.admonition,{title:"Version Gate",type:"info",children:(0,t.jsx)(r.p,{children:"The Embedded Registry Mirror is available as an experimental feature as of January 2024 releases: v1.26.13+k3s1, v1.27.10+k3s1, v1.28.6+k3s1, v1.29.1+k3s1"})}),"\n",(0,t.jsxs)(r.p,{children:["K3s embeds ",(0,t.jsx)(r.a,{href:"https://github.com/XenitAB/spegel",children:"Spegel"}),", a stateless distributed OCI registry mirror that allows peer-to-peer sharing of container images between nodes in a Kubernetes cluster.\nThe distributed registry mirror is disabled by default."]}),"\n",(0,t.jsx)(r.h2,{id:"enabling-the-distributed-oci-registry-mirror",children:"Enabling The Distributed OCI Registry Mirror"}),"\n",(0,t.jsxs)(r.p,{children:["In order to enable the embedded registry mirror, server nodes must be started with the ",(0,t.jsx)(r.code,{children:"--embedded-registry"})," flag, or with ",(0,t.jsx)(r.code,{children:"embedded-registry: true"})," in the configuration file.\nThis option enables the embedded mirror for use on all nodes in the cluster."]}),"\n",(0,t.jsxs)(r.p,{children:["When enabled at a cluster level, all nodes will host a local OCI registry on port 6443,\nand publish a list of available images via a peer to peer network on port 5001.\nAny image available in the containerd image store on any node, can be pulled by other cluster members without access to an external registry.\nImages imported via ",(0,t.jsx)(r.a,{href:"/installation/airgap#manually-deploy-images-method",children:"air-gap image tar files"})," are pinned in containerd to\nensure that they remain available and are not pruned by Kubelet garbage collection."]}),"\n",(0,t.jsxs)(r.p,{children:["The peer to peer port can changed from 5001 by setting the ",(0,t.jsx)(r.code,{children:"K3S_P2P_PORT"})," environment variable for the K3s service. The port must be set to the same value on all nodes.\nChanging the port is unsupported and not recommended."]}),"\n",(0,t.jsx)(r.h3,{id:"requirements",children:"Requirements"}),"\n",(0,t.jsx)(r.p,{children:"When the embedded registry mirror is enabled, all nodes must be able to reach each other via their internal IP addresses, on TCP ports 5001 and 6443.\nIf nodes cannot reach each other, it may take longer for images to be pulled, as the distributed registry will be tried first by containerd, before it falls back to other endpoints."}),"\n",(0,t.jsx)(r.h2,{id:"enabling-registry-mirroring",children:"Enabling Registry Mirroring"}),"\n",(0,t.jsx)(r.p,{children:"Enabling mirroring for a registry allows a node to both pull images from that registry from other nodes, and share the registry's images with other nodes.\nIf a registry is enabled for mirroring on some nodes, but not on others, only the nodes with the registry enabled will exchange images from that registry."}),"\n",(0,t.jsxs)(r.p,{children:["In order to enable mirroring of images from an upstream container registry, nodes must have an entry in the ",(0,t.jsx)(r.code,{children:"mirrors"})," section of ",(0,t.jsx)(r.code,{children:"registries.yaml"})," for that registry.\nThe registry does not need to have any endpoints listed, it just needs to be present.\nFor example, to enable distributed mirroring of images from ",(0,t.jsx)(r.code,{children:"docker.io"})," and ",(0,t.jsx)(r.code,{children:"registry.k8s.io"}),", configure ",(0,t.jsx)(r.code,{children:"registries.yaml"})," with the following content on all cluster nodes:"]}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-yaml",children:"mirrors:\n docker.io:\n registry.k8s.io:\n"})}),"\n",(0,t.jsxs)(r.p,{children:["Endpoints for registry mirrors may also be added as usual.\nIn the following configuration, images pull attempts will first try the embedded mirror, then ",(0,t.jsx)(r.code,{children:"mirror.example.com"}),", then finally ",(0,t.jsx)(r.code,{children:"docker.io"}),":"]}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-yaml",children:"mirrors:\n docker.io:\n endpoint:\n - https://mirror.example.com\n"})}),"\n",(0,t.jsx)(r.p,{children:"If you are using a private registry directly, instead of as a mirror for an upstream registry, you may enable distributed mirroring in the same way public\nregistries are enabled - by listing it in the mirrors section:"}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-yaml",children:"mirrors:\n mirror.example.com:\n"})}),"\n",(0,t.jsx)(r.admonition,{title:"Version Gate",type:"info",children:(0,t.jsx)(r.p,{children:"Wildcard support is available as of the March 2024 releases: v1.26.15+k3s1, v1.27.12+k3s1, v1.28.8+k3s1, v1.29.3+k3s1"})}),"\n",(0,t.jsxs)(r.p,{children:["The ",(0,t.jsx)(r.code,{children:'"*"'})," wildcard mirror entry can be used to enable distributed mirroring of all registries. Note that the asterisk MUST be quoted:"]}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-yaml",children:'mirrors:\n "*":\n'})}),"\n",(0,t.jsx)(r.p,{children:"If no registries are enabled for mirroring on a node, that node does not participate in the distributed registry in any capacity."}),"\n",(0,t.jsxs)(r.p,{children:["For more information on the structure of the ",(0,t.jsx)(r.code,{children:"registries.yaml"})," file, see ",(0,t.jsx)(r.a,{href:"/installation/private-registry",children:"Private Registry Configuration"}),"."]}),"\n",(0,t.jsx)(r.h3,{id:"default-endpoint-fallback",children:"Default Endpoint Fallback"}),"\n",(0,t.jsxs)(r.p,{children:["By default, containerd will fall back to the default endpoint when pulling from registries with mirror endpoints configured. If you want to disable this,\nand only pull images from the configured mirrors and/or the embedded mirror, see the ",(0,t.jsx)(r.a,{href:"/installation/private-registry#default-endpoint-fallback",children:"Default Endpoint Fallback"}),"\nsection of the Private Registry Configuration documentation."]}),"\n",(0,t.jsxs)(r.p,{children:["Note that if you are using the ",(0,t.jsx)(r.code,{children:"--disable-default-endpoint"})," option and want to allow pulling directly from a particular registry, while disallowing the rest,\nyou can explicitly provide an endpoint in order to allow the image pull to fall back to the registry itself:"]}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-yaml",children:"mirrors:\n docker.io: # no default endpoint, pulls will fail if not available on a node\n registry.k8s.io: # no default endpoint, pulls will fail if not available on a node\n mirror.example.com: # explicit default endpoint, can pull from upstream if not available on a node\n endpoint:\n - https://mirror.example.com\n"})}),"\n",(0,t.jsx)(r.h3,{id:"latest-tag",children:"Latest Tag"}),"\n",(0,t.jsxs)(r.p,{children:["When no tag is specified for a container image, the implicit default tag is ",(0,t.jsx)(r.code,{children:"latest"}),". This tag is frequently\nupdated to point at the most recent version of the image. Because this tag will point at a different revisions\nof an image depending on when it is pulled, the distributed registry ",(0,t.jsx)(r.strong,{children:"will not"})," pull the ",(0,t.jsx)(r.code,{children:"latest"})," tag from\nother nodes. This forces containerd go out to an upstream registry or registry mirror to ensure a consistent\nview of what the ",(0,t.jsx)(r.code,{children:"latest"})," tag refers to."]}),"\n",(0,t.jsxs)(r.p,{children:["This aligns with the ",(0,t.jsxs)(r.a,{href:"https://kubernetes.io/docs/concepts/containers/images/#imagepullpolicy-defaulting",children:["special ",(0,t.jsx)(r.code,{children:"imagePullPolicy"})," defaulting"]}),"\nobserved by Kubernetes when using the ",(0,t.jsx)(r.code,{children:"latest"})," tag for a container image."]}),"\n",(0,t.jsxs)(r.p,{children:["Mirroring the ",(0,t.jsx)(r.code,{children:"latest"})," tag can be enabled by setting the ",(0,t.jsx)(r.code,{children:"K3S_P2P_ENABLE_LATEST=true"})," environment variable for the K3s service.\nThis is unsupported and not recommended, for the reasons discussed above."]}),"\n",(0,t.jsx)(r.h2,{id:"security",children:"Security"}),"\n",(0,t.jsx)(r.h3,{id:"authentication",children:"Authentication"}),"\n",(0,t.jsx)(r.p,{children:"Access to the embedded mirror's registry API requires a valid client certificate, signed by the cluster's client certificate authority."}),"\n",(0,t.jsx)(r.p,{children:"Access to the distributed hash table's peer-to-peer network requires a preshared key that is controlled by server nodes.\nNodes authenticate each other using both the preshared key, and a certificate signed by the cluster certificate authority."}),"\n",(0,t.jsx)(r.h3,{id:"potential-concerns",children:"Potential Concerns"}),"\n",(0,t.jsx)(r.admonition,{type:"warning",children:(0,t.jsx)(r.p,{children:"The distributed registry is built on peer-to-peer principles, and assumes an equal level of privilege and trust between all cluster members.\nIf this does not match your cluster's security posture, you should not enable the embedded distributed registry."})}),"\n",(0,t.jsxs)(r.p,{children:["The embedded registry may make available images that a node may not otherwise have access to.\nFor example, if some of your images are pulled from a registry, project, or repository that requires authentication via Kubernetes Image Pull Secrets, or credentials in ",(0,t.jsx)(r.code,{children:"registries.yaml"}),",\nthe distributed registry will allow other nodes to share those images without providing any credentials to the upstream registry."]}),"\n",(0,t.jsx)(r.p,{children:"Users with access to push images into the containerd image store on one node may be able to use this to 'poison' the image for other cluster nodes,\nas other nodes will trust the tag advertised by the node, and use it without checking with the upstream registry.\nIf image integrity is important, you should use image digests instead of tags, as the digest cannot be poisoned in this manner."}),"\n",(0,t.jsx)(r.h2,{id:"sharing-air-gap-or-manually-loaded-images",children:"Sharing Air-gap or Manually Loaded Images"}),"\n",(0,t.jsxs)(r.p,{children:["Images sharing is controlled based on the source registry.\nImages loaded directly into containerd via air-gap tarballs, or loaded directly into containerd's image store using the ",(0,t.jsx)(r.code,{children:"ctr"})," command line tool,\nwill be shared between nodes if they are tagged as being from a registry that is enabled for mirroring."]}),"\n",(0,t.jsxs)(r.p,{children:["Note that the upstream registry that the images appear to come from does not actually have to exist or be reachable.\nFor example, you could tag images as being from a fictitious upstream registry, and import those images into containerd's image store.\nYou would then be able to pull those images from all cluster members, as long as that registry is listed in ",(0,t.jsx)(r.code,{children:"registries.yaml"})]}),"\n",(0,t.jsx)(r.h2,{id:"pushing-images",children:"Pushing Images"}),"\n",(0,t.jsxs)(r.p,{children:["The embedded registry is read-only, and cannot be pushed to directly using ",(0,t.jsx)(r.code,{children:"docker push"})," or other common tools that interact with OCI registries."]}),"\n",(0,t.jsxs)(r.p,{children:["Images can be manually made available via the embedded registry by running ",(0,t.jsx)(r.code,{children:"ctr -n k8s.io image pull"})," to pull an image,\nor by loading image archives created by ",(0,t.jsx)(r.code,{children:"docker save"})," via the ",(0,t.jsx)(r.code,{children:"ctr -n k8s.io image import"})," command.\nNote that the ",(0,t.jsx)(r.code,{children:"k8s.io"})," namespace must be specified when managing images via ",(0,t.jsx)(r.code,{children:"ctr"})," in order for them to be visible to the kubelet."]})]})}function h(e={}){const{wrapper:r}={...(0,n.a)(),...e.components};return r?(0,t.jsx)(r,{...e,children:(0,t.jsx)(c,{...e})}):c(e)}},1151:(e,r,i)=>{i.d(r,{Z:()=>o,a:()=>a});var t=i(7294);const n={},s=t.createContext(n);function a(e){const r=t.useContext(s);return t.useMemo((function(){return"function"==typeof e?e(r):{...r,...e}}),[r,e])}function o(e){let r;return r=e.disableParentContext?"function"==typeof e.components?e.components(n):e.components||n:a(e.components),t.createElement(s.Provider,{value:r},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/5281b7a2.5f842cca.js b/assets/js/5281b7a2.81ae9cfc.js similarity index 99% rename from assets/js/5281b7a2.5f842cca.js rename to assets/js/5281b7a2.81ae9cfc.js index 8488c47b7..f702e2f12 100644 --- a/assets/js/5281b7a2.5f842cca.js +++ b/assets/js/5281b7a2.81ae9cfc.js @@ -1 +1 @@ -"use strict";(self.webpackChunkk_3_s_docs=self.webpackChunkk_3_s_docs||[]).push([[5927],{6506:(e,t,s)=>{s.r(t),s.d(t,{assets:()=>l,contentTitle:()=>d,default:()=>g,frontMatter:()=>o,metadata:()=>c,toc:()=>h});var n=s(5893),r=s(1151),i=s(9965),a=s(4996);const o={title:"Architecture"},d=void 0,c={id:"architecture",title:"Architecture",description:"Servers and Agents",source:"@site/docs/architecture.md",sourceDirName:".",slug:"/architecture",permalink:"/architecture",draft:!1,unlisted:!1,editUrl:"https://github.com/k3s-io/docs/edit/main/docs/architecture.md",tags:[],version:"current",lastUpdatedAt:1723651727e3,frontMatter:{title:"Architecture"},sidebar:"mySidebar",previous:{title:"token",permalink:"/cli/token"},next:{title:"Cluster Access",permalink:"/cluster-access"}},l={},h=[{value:"Servers and Agents",id:"servers-and-agents",level:3},{value:"Single-server Setup with an Embedded DB",id:"single-server-setup-with-an-embedded-db",level:3},{value:"High-Availability K3s",id:"high-availability-k3s",level:3},{value:"Fixed Registration Address for Agent Nodes",id:"fixed-registration-address-for-agent-nodes",level:3},{value:"How Agent Node Registration Works",id:"how-agent-node-registration-works",level:3}];function u(e){const t={a:"a",code:"code",h3:"h3",img:"img",li:"li",p:"p",strong:"strong",ul:"ul",...(0,r.a)(),...e.components},{TabItem:o,Tabs:d}=t;return o||v("TabItem",!0),d||v("Tabs",!0),(0,n.jsxs)(n.Fragment,{children:[(0,n.jsx)(t.h3,{id:"servers-and-agents",children:"Servers and Agents"}),"\n",(0,n.jsxs)(t.ul,{children:["\n",(0,n.jsxs)(t.li,{children:["A server node is defined as a host running the ",(0,n.jsx)(t.code,{children:"k3s server"})," command, with control-plane and datastore components managed by K3s."]}),"\n",(0,n.jsxs)(t.li,{children:["An agent node is defined as a host running the ",(0,n.jsx)(t.code,{children:"k3s agent"})," command, without any datastore or control-plane components."]}),"\n",(0,n.jsxs)(t.li,{children:["Both servers and agents run the kubelet, container runtime, and CNI. See the ",(0,n.jsx)(t.a,{href:"/advanced#running-agentless-servers-experimental",children:"Advanced Options"})," documentation for more information on running agentless servers."]}),"\n"]}),"\n",(0,n.jsx)(t.p,{children:(0,n.jsx)(t.img,{src:s(4530).Z+"",width:"1562",height:"898"})}),"\n",(0,n.jsx)(t.h3,{id:"single-server-setup-with-an-embedded-db",children:"Single-server Setup with an Embedded DB"}),"\n",(0,n.jsx)(t.p,{children:"The following diagram shows an example of a cluster that has a single-node K3s server with an embedded SQLite database."}),"\n",(0,n.jsx)(t.p,{children:"In this configuration, each agent node is registered to the same server node. A K3s user can manipulate Kubernetes resources by calling the K3s API on the server node."}),"\n",(0,n.jsx)(i.Z,{alt:"K3s Architecture with a Single Server",sources:{light:(0,a.ZP)("/img/k3s-architecture-single-server.svg"),dark:(0,a.ZP)("/img/k3s-architecture-single-server-dark.svg")}}),"\n",(0,n.jsx)(t.h3,{id:"high-availability-k3s",children:"High-Availability K3s"}),"\n",(0,n.jsx)(t.p,{children:"Single server clusters can meet a variety of use cases, but for environments where uptime of the Kubernetes control plane is critical, you can run K3s in an HA configuration. An HA K3s cluster comprises:"}),"\n",(0,n.jsxs)(d,{children:[(0,n.jsxs)(o,{value:"Embedded DB",children:[(0,n.jsxs)(t.ul,{children:["\n",(0,n.jsxs)(t.li,{children:["Three or more ",(0,n.jsx)(t.strong,{children:"server nodes"})," that will serve the Kubernetes API and run other control plane services"]}),"\n",(0,n.jsxs)(t.li,{children:["An ",(0,n.jsx)(t.strong,{children:"embedded etcd datastore"})," (as opposed to the embedded SQLite datastore used in single-server setups)"]}),"\n"]}),(0,n.jsx)(i.Z,{alt:"K3s Architecture with High-availability Servers",sources:{light:(0,a.ZP)("/img/k3s-architecture-ha-embedded.svg"),dark:(0,a.ZP)("/img/k3s-architecture-ha-embedded-dark.svg")}})]}),(0,n.jsxs)(o,{value:"External DB",children:[(0,n.jsxs)(t.ul,{children:["\n",(0,n.jsxs)(t.li,{children:["Two or more ",(0,n.jsx)(t.strong,{children:"server nodes"})," that will serve the Kubernetes API and run other control plane services"]}),"\n",(0,n.jsxs)(t.li,{children:["An ",(0,n.jsx)(t.strong,{children:"external datastore"})," (such as MySQL, PostgreSQL, or etcd)"]}),"\n"]}),(0,n.jsx)(i.Z,{alt:"K3s Architecture with High-availability Servers and an External DB",sources:{light:(0,a.ZP)("/img/k3s-architecture-ha-external.svg"),dark:(0,a.ZP)("/img/k3s-architecture-ha-external-dark.svg")}})]})]}),"\n",(0,n.jsx)(t.h3,{id:"fixed-registration-address-for-agent-nodes",children:"Fixed Registration Address for Agent Nodes"}),"\n",(0,n.jsx)(t.p,{children:"In the high-availability server configuration, each node can also register with the Kubernetes API by using a fixed registration address, as shown in the diagram below."}),"\n",(0,n.jsx)(t.p,{children:"After registration, the agent nodes establish a connection directly to one of the server nodes."}),"\n",(0,n.jsx)(i.Z,{alt:"Agent Registration HA",sources:{light:(0,a.ZP)("/img/k3s-production-setup.svg"),dark:(0,a.ZP)("/img/k3s-production-setup-dark.svg")}}),"\n",(0,n.jsx)(t.h3,{id:"how-agent-node-registration-works",children:"How Agent Node Registration Works"}),"\n",(0,n.jsxs)(t.p,{children:["Agent nodes are registered with a websocket connection initiated by the ",(0,n.jsx)(t.code,{children:"k3s agent"})," process, and the connection is maintained by a client-side load balancer running as part of the agent process. Initially, the agent connects to the supervisor (and kube-apiserver) via the local load-balancer on port 6443. The load-balancer maintains a list of available endpoints to connect to. The default (and initially only) endpoint is seeded by the hostname from the ",(0,n.jsx)(t.code,{children:"--server"})," address. Once it connects to the cluster, the agent retrieves a list of kube-apiserver addresses from the Kubernetes service endpoint list in the default namespace. Those endpoints are added to the load balancer, which then maintains stable connections to all servers in the cluster, providing a connection to the kube-apiserver that tolerates outages of individual servers."]}),"\n",(0,n.jsxs)(t.p,{children:["Agents will register with the server using the node cluster secret along with a randomly generated password for the node, stored at ",(0,n.jsx)(t.code,{children:"/etc/rancher/node/password"}),". The server will store the passwords for individual nodes as Kubernetes secrets, and any subsequent attempts must use the same password. Node password secrets are stored in the ",(0,n.jsx)(t.code,{children:"kube-system"})," namespace with names using the template ",(0,n.jsx)(t.code,{children:".node-password.k3s"}),". This is done to protect the integrity of node IDs."]}),"\n",(0,n.jsxs)(t.p,{children:["If the ",(0,n.jsx)(t.code,{children:"/etc/rancher/node"})," directory of an agent is removed, or you wish to rejoin a node using an existing name, the node should be deleted from the cluster. This will clean up both the old node entry, and the node password secret, and allow the node to (re)join the cluster."]}),"\n",(0,n.jsxs)(t.p,{children:["If you frequently reuse hostnames, but are unable to remove the node password secrets, a unique node ID can be automatically appended to the hostname by launching K3s servers or agents using the ",(0,n.jsx)(t.code,{children:"--with-node-id"})," flag. When enabled, the node ID is also stored in ",(0,n.jsx)(t.code,{children:"/etc/rancher/node/"}),"."]})]})}function g(e={}){const{wrapper:t}={...(0,r.a)(),...e.components};return t?(0,n.jsx)(t,{...e,children:(0,n.jsx)(u,{...e})}):u(e)}function v(e,t){throw new Error("Expected "+(t?"component":"object")+" `"+e+"` to be defined: you likely forgot to import, pass, or provide it.")}},4530:(e,t,s)=>{s.d(t,{Z:()=>n});const n=s.p+"assets/images/how-it-works-k3s-revised-9c025ef482404bca2e53a89a0ba7a3c5.svg"},1151:(e,t,s)=>{s.d(t,{Z:()=>o,a:()=>a});var n=s(7294);const r={},i=n.createContext(r);function a(e){const t=n.useContext(i);return n.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function o(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(r):e.components||r:a(e.components),n.createElement(i.Provider,{value:t},e.children)}}}]); \ No newline at end of file +"use strict";(self.webpackChunkk_3_s_docs=self.webpackChunkk_3_s_docs||[]).push([[5927],{6506:(e,t,s)=>{s.r(t),s.d(t,{assets:()=>l,contentTitle:()=>d,default:()=>g,frontMatter:()=>o,metadata:()=>c,toc:()=>h});var n=s(5893),r=s(1151),i=s(9965),a=s(4996);const o={title:"Architecture"},d=void 0,c={id:"architecture",title:"Architecture",description:"Servers and Agents",source:"@site/docs/architecture.md",sourceDirName:".",slug:"/architecture",permalink:"/architecture",draft:!1,unlisted:!1,editUrl:"https://github.com/k3s-io/docs/edit/main/docs/architecture.md",tags:[],version:"current",lastUpdatedAt:1723747404e3,frontMatter:{title:"Architecture"},sidebar:"mySidebar",previous:{title:"token",permalink:"/cli/token"},next:{title:"Cluster Access",permalink:"/cluster-access"}},l={},h=[{value:"Servers and Agents",id:"servers-and-agents",level:3},{value:"Single-server Setup with an Embedded DB",id:"single-server-setup-with-an-embedded-db",level:3},{value:"High-Availability K3s",id:"high-availability-k3s",level:3},{value:"Fixed Registration Address for Agent Nodes",id:"fixed-registration-address-for-agent-nodes",level:3},{value:"How Agent Node Registration Works",id:"how-agent-node-registration-works",level:3}];function u(e){const t={a:"a",code:"code",h3:"h3",img:"img",li:"li",p:"p",strong:"strong",ul:"ul",...(0,r.a)(),...e.components},{TabItem:o,Tabs:d}=t;return o||v("TabItem",!0),d||v("Tabs",!0),(0,n.jsxs)(n.Fragment,{children:[(0,n.jsx)(t.h3,{id:"servers-and-agents",children:"Servers and Agents"}),"\n",(0,n.jsxs)(t.ul,{children:["\n",(0,n.jsxs)(t.li,{children:["A server node is defined as a host running the ",(0,n.jsx)(t.code,{children:"k3s server"})," command, with control-plane and datastore components managed by K3s."]}),"\n",(0,n.jsxs)(t.li,{children:["An agent node is defined as a host running the ",(0,n.jsx)(t.code,{children:"k3s agent"})," command, without any datastore or control-plane components."]}),"\n",(0,n.jsxs)(t.li,{children:["Both servers and agents run the kubelet, container runtime, and CNI. See the ",(0,n.jsx)(t.a,{href:"/advanced#running-agentless-servers-experimental",children:"Advanced Options"})," documentation for more information on running agentless servers."]}),"\n"]}),"\n",(0,n.jsx)(t.p,{children:(0,n.jsx)(t.img,{src:s(4530).Z+"",width:"1562",height:"898"})}),"\n",(0,n.jsx)(t.h3,{id:"single-server-setup-with-an-embedded-db",children:"Single-server Setup with an Embedded DB"}),"\n",(0,n.jsx)(t.p,{children:"The following diagram shows an example of a cluster that has a single-node K3s server with an embedded SQLite database."}),"\n",(0,n.jsx)(t.p,{children:"In this configuration, each agent node is registered to the same server node. A K3s user can manipulate Kubernetes resources by calling the K3s API on the server node."}),"\n",(0,n.jsx)(i.Z,{alt:"K3s Architecture with a Single Server",sources:{light:(0,a.ZP)("/img/k3s-architecture-single-server.svg"),dark:(0,a.ZP)("/img/k3s-architecture-single-server-dark.svg")}}),"\n",(0,n.jsx)(t.h3,{id:"high-availability-k3s",children:"High-Availability K3s"}),"\n",(0,n.jsx)(t.p,{children:"Single server clusters can meet a variety of use cases, but for environments where uptime of the Kubernetes control plane is critical, you can run K3s in an HA configuration. An HA K3s cluster comprises:"}),"\n",(0,n.jsxs)(d,{children:[(0,n.jsxs)(o,{value:"Embedded DB",children:[(0,n.jsxs)(t.ul,{children:["\n",(0,n.jsxs)(t.li,{children:["Three or more ",(0,n.jsx)(t.strong,{children:"server nodes"})," that will serve the Kubernetes API and run other control plane services"]}),"\n",(0,n.jsxs)(t.li,{children:["An ",(0,n.jsx)(t.strong,{children:"embedded etcd datastore"})," (as opposed to the embedded SQLite datastore used in single-server setups)"]}),"\n"]}),(0,n.jsx)(i.Z,{alt:"K3s Architecture with High-availability Servers",sources:{light:(0,a.ZP)("/img/k3s-architecture-ha-embedded.svg"),dark:(0,a.ZP)("/img/k3s-architecture-ha-embedded-dark.svg")}})]}),(0,n.jsxs)(o,{value:"External DB",children:[(0,n.jsxs)(t.ul,{children:["\n",(0,n.jsxs)(t.li,{children:["Two or more ",(0,n.jsx)(t.strong,{children:"server nodes"})," that will serve the Kubernetes API and run other control plane services"]}),"\n",(0,n.jsxs)(t.li,{children:["An ",(0,n.jsx)(t.strong,{children:"external datastore"})," (such as MySQL, PostgreSQL, or etcd)"]}),"\n"]}),(0,n.jsx)(i.Z,{alt:"K3s Architecture with High-availability Servers and an External DB",sources:{light:(0,a.ZP)("/img/k3s-architecture-ha-external.svg"),dark:(0,a.ZP)("/img/k3s-architecture-ha-external-dark.svg")}})]})]}),"\n",(0,n.jsx)(t.h3,{id:"fixed-registration-address-for-agent-nodes",children:"Fixed Registration Address for Agent Nodes"}),"\n",(0,n.jsx)(t.p,{children:"In the high-availability server configuration, each node can also register with the Kubernetes API by using a fixed registration address, as shown in the diagram below."}),"\n",(0,n.jsx)(t.p,{children:"After registration, the agent nodes establish a connection directly to one of the server nodes."}),"\n",(0,n.jsx)(i.Z,{alt:"Agent Registration HA",sources:{light:(0,a.ZP)("/img/k3s-production-setup.svg"),dark:(0,a.ZP)("/img/k3s-production-setup-dark.svg")}}),"\n",(0,n.jsx)(t.h3,{id:"how-agent-node-registration-works",children:"How Agent Node Registration Works"}),"\n",(0,n.jsxs)(t.p,{children:["Agent nodes are registered with a websocket connection initiated by the ",(0,n.jsx)(t.code,{children:"k3s agent"})," process, and the connection is maintained by a client-side load balancer running as part of the agent process. Initially, the agent connects to the supervisor (and kube-apiserver) via the local load-balancer on port 6443. The load-balancer maintains a list of available endpoints to connect to. The default (and initially only) endpoint is seeded by the hostname from the ",(0,n.jsx)(t.code,{children:"--server"})," address. Once it connects to the cluster, the agent retrieves a list of kube-apiserver addresses from the Kubernetes service endpoint list in the default namespace. Those endpoints are added to the load balancer, which then maintains stable connections to all servers in the cluster, providing a connection to the kube-apiserver that tolerates outages of individual servers."]}),"\n",(0,n.jsxs)(t.p,{children:["Agents will register with the server using the node cluster secret along with a randomly generated password for the node, stored at ",(0,n.jsx)(t.code,{children:"/etc/rancher/node/password"}),". The server will store the passwords for individual nodes as Kubernetes secrets, and any subsequent attempts must use the same password. Node password secrets are stored in the ",(0,n.jsx)(t.code,{children:"kube-system"})," namespace with names using the template ",(0,n.jsx)(t.code,{children:".node-password.k3s"}),". This is done to protect the integrity of node IDs."]}),"\n",(0,n.jsxs)(t.p,{children:["If the ",(0,n.jsx)(t.code,{children:"/etc/rancher/node"})," directory of an agent is removed, or you wish to rejoin a node using an existing name, the node should be deleted from the cluster. This will clean up both the old node entry, and the node password secret, and allow the node to (re)join the cluster."]}),"\n",(0,n.jsxs)(t.p,{children:["If you frequently reuse hostnames, but are unable to remove the node password secrets, a unique node ID can be automatically appended to the hostname by launching K3s servers or agents using the ",(0,n.jsx)(t.code,{children:"--with-node-id"})," flag. When enabled, the node ID is also stored in ",(0,n.jsx)(t.code,{children:"/etc/rancher/node/"}),"."]})]})}function g(e={}){const{wrapper:t}={...(0,r.a)(),...e.components};return t?(0,n.jsx)(t,{...e,children:(0,n.jsx)(u,{...e})}):u(e)}function v(e,t){throw new Error("Expected "+(t?"component":"object")+" `"+e+"` to be defined: you likely forgot to import, pass, or provide it.")}},4530:(e,t,s)=>{s.d(t,{Z:()=>n});const n=s.p+"assets/images/how-it-works-k3s-revised-9c025ef482404bca2e53a89a0ba7a3c5.svg"},1151:(e,t,s)=>{s.d(t,{Z:()=>o,a:()=>a});var n=s(7294);const r={},i=n.createContext(r);function a(e){const t=n.useContext(i);return n.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function o(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(r):e.components||r:a(e.components),n.createElement(i.Provider,{value:t},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/57d35c99.870237be.js b/assets/js/57d35c99.2f1debc1.js similarity index 98% rename from assets/js/57d35c99.870237be.js rename to assets/js/57d35c99.2f1debc1.js index 64e1e1c15..2b42afeca 100644 --- a/assets/js/57d35c99.870237be.js +++ b/assets/js/57d35c99.2f1debc1.js @@ -1 +1 @@ -"use strict";(self.webpackChunkk_3_s_docs=self.webpackChunkk_3_s_docs||[]).push([[8005],{3548:(e,n,t)=>{t.r(n),t.d(n,{assets:()=>l,contentTitle:()=>c,default:()=>p,frontMatter:()=>s,metadata:()=>o,toc:()=>a});var i=t(5893),r=t(1151);const s={title:"Secrets Encryption"},c="Secrets Encryption Config",o={id:"security/secrets-encryption",title:"Secrets Encryption",description:"K3s supports enabling secrets encryption at rest. When first starting the server, passing the flag --secrets-encryption will do the following automatically:",source:"@site/docs/security/secrets-encryption.md",sourceDirName:"security",slug:"/security/secrets-encryption",permalink:"/security/secrets-encryption",draft:!1,unlisted:!1,editUrl:"https://github.com/k3s-io/docs/edit/main/docs/security/secrets-encryption.md",tags:[],version:"current",lastUpdatedAt:1723651727e3,frontMatter:{title:"Secrets Encryption"},sidebar:"mySidebar",previous:{title:"Security",permalink:"/security/"},next:{title:"CIS Hardening Guide",permalink:"/security/hardening-guide"}},l={},a=[{value:"Secrets Encryption Tool",id:"secrets-encryption-tool",level:2}];function d(e){const n={a:"a",admonition:"admonition",br:"br",code:"code",h1:"h1",h2:"h2",header:"header",li:"li",mdxAdmonitionTitle:"mdxAdmonitionTitle",p:"p",pre:"pre",ul:"ul",...(0,r.a)(),...e.components};return(0,i.jsxs)(i.Fragment,{children:[(0,i.jsx)(n.header,{children:(0,i.jsx)(n.h1,{id:"secrets-encryption-config",children:"Secrets Encryption Config"})}),"\n",(0,i.jsxs)(n.p,{children:["K3s supports enabling secrets encryption at rest. When first starting the server, passing the flag ",(0,i.jsx)(n.code,{children:"--secrets-encryption"})," will do the following automatically:"]}),"\n",(0,i.jsxs)(n.ul,{children:["\n",(0,i.jsx)(n.li,{children:"Generate an AES-CBC key"}),"\n",(0,i.jsx)(n.li,{children:"Generate an encryption config file with the generated key"}),"\n",(0,i.jsx)(n.li,{children:"Pass the config to the KubeAPI as encryption-provider-config"}),"\n"]}),"\n",(0,i.jsxs)(n.admonition,{type:"tip",children:[(0,i.jsx)(n.mdxAdmonitionTitle,{}),(0,i.jsxs)(n.p,{children:["Secrets-encryption cannot be enabled on an existing server without restarting it.",(0,i.jsx)(n.br,{}),"\n","Use ",(0,i.jsx)(n.code,{children:"curl -sfL https://get.k3s.io | sh -s - server --secrets-encryption"})," if installing from script, or other methods described in ",(0,i.jsx)(n.a,{href:"/installation/configuration#configuration-with-install-script",children:"Configuration Options"}),"."]})]}),"\n",(0,i.jsx)(n.p,{children:"Example of the encryption config file:"}),"\n",(0,i.jsx)(n.pre,{children:(0,i.jsx)(n.code,{className:"language-json",children:'{\n "kind": "EncryptionConfiguration",\n "apiVersion": "apiserver.config.k8s.io/v1",\n "resources": [\n {\n "resources": [\n "secrets"\n ],\n "providers": [\n {\n "aescbc": {\n "keys": [\n {\n "name": "aescbckey",\n "secret": "xxxxxxxxxxxxxxxxxxx"\n }\n ]\n }\n },\n {\n "identity": {}\n }\n ]\n }\n ]\n}\n'})}),"\n",(0,i.jsx)(n.h2,{id:"secrets-encryption-tool",children:"Secrets Encryption Tool"}),"\n",(0,i.jsxs)(n.p,{children:["K3s contains a utility tool ",(0,i.jsx)(n.code,{children:"secrets-encrypt"}),", which enables automatic control over the following:"]}),"\n",(0,i.jsxs)(n.ul,{children:["\n",(0,i.jsx)(n.li,{children:"Disabling/Enabling secrets encryption"}),"\n",(0,i.jsx)(n.li,{children:"Adding new encryption keys"}),"\n",(0,i.jsx)(n.li,{children:"Rotating and deleting encryption keys"}),"\n",(0,i.jsx)(n.li,{children:"Reencrypting secrets"}),"\n"]}),"\n",(0,i.jsxs)(n.p,{children:["For more information, see the ",(0,i.jsxs)(n.a,{href:"/cli/secrets-encrypt",children:[(0,i.jsx)(n.code,{children:"k3s secrets-encrypt"})," command documentation"]}),"."]})]})}function p(e={}){const{wrapper:n}={...(0,r.a)(),...e.components};return n?(0,i.jsx)(n,{...e,children:(0,i.jsx)(d,{...e})}):d(e)}},1151:(e,n,t)=>{t.d(n,{Z:()=>o,a:()=>c});var i=t(7294);const r={},s=i.createContext(r);function c(e){const n=i.useContext(s);return i.useMemo((function(){return"function"==typeof e?e(n):{...n,...e}}),[n,e])}function o(e){let n;return n=e.disableParentContext?"function"==typeof e.components?e.components(r):e.components||r:c(e.components),i.createElement(s.Provider,{value:n},e.children)}}}]); \ No newline at end of file +"use strict";(self.webpackChunkk_3_s_docs=self.webpackChunkk_3_s_docs||[]).push([[8005],{3548:(e,n,t)=>{t.r(n),t.d(n,{assets:()=>l,contentTitle:()=>c,default:()=>p,frontMatter:()=>s,metadata:()=>o,toc:()=>a});var i=t(5893),r=t(1151);const s={title:"Secrets Encryption"},c="Secrets Encryption Config",o={id:"security/secrets-encryption",title:"Secrets Encryption",description:"K3s supports enabling secrets encryption at rest. When first starting the server, passing the flag --secrets-encryption will do the following automatically:",source:"@site/docs/security/secrets-encryption.md",sourceDirName:"security",slug:"/security/secrets-encryption",permalink:"/security/secrets-encryption",draft:!1,unlisted:!1,editUrl:"https://github.com/k3s-io/docs/edit/main/docs/security/secrets-encryption.md",tags:[],version:"current",lastUpdatedAt:1723747404e3,frontMatter:{title:"Secrets Encryption"},sidebar:"mySidebar",previous:{title:"Security",permalink:"/security/"},next:{title:"CIS Hardening Guide",permalink:"/security/hardening-guide"}},l={},a=[{value:"Secrets Encryption Tool",id:"secrets-encryption-tool",level:2}];function d(e){const n={a:"a",admonition:"admonition",br:"br",code:"code",h1:"h1",h2:"h2",header:"header",li:"li",mdxAdmonitionTitle:"mdxAdmonitionTitle",p:"p",pre:"pre",ul:"ul",...(0,r.a)(),...e.components};return(0,i.jsxs)(i.Fragment,{children:[(0,i.jsx)(n.header,{children:(0,i.jsx)(n.h1,{id:"secrets-encryption-config",children:"Secrets Encryption Config"})}),"\n",(0,i.jsxs)(n.p,{children:["K3s supports enabling secrets encryption at rest. When first starting the server, passing the flag ",(0,i.jsx)(n.code,{children:"--secrets-encryption"})," will do the following automatically:"]}),"\n",(0,i.jsxs)(n.ul,{children:["\n",(0,i.jsx)(n.li,{children:"Generate an AES-CBC key"}),"\n",(0,i.jsx)(n.li,{children:"Generate an encryption config file with the generated key"}),"\n",(0,i.jsx)(n.li,{children:"Pass the config to the KubeAPI as encryption-provider-config"}),"\n"]}),"\n",(0,i.jsxs)(n.admonition,{type:"tip",children:[(0,i.jsx)(n.mdxAdmonitionTitle,{}),(0,i.jsxs)(n.p,{children:["Secrets-encryption cannot be enabled on an existing server without restarting it.",(0,i.jsx)(n.br,{}),"\n","Use ",(0,i.jsx)(n.code,{children:"curl -sfL https://get.k3s.io | sh -s - server --secrets-encryption"})," if installing from script, or other methods described in ",(0,i.jsx)(n.a,{href:"/installation/configuration#configuration-with-install-script",children:"Configuration Options"}),"."]})]}),"\n",(0,i.jsx)(n.p,{children:"Example of the encryption config file:"}),"\n",(0,i.jsx)(n.pre,{children:(0,i.jsx)(n.code,{className:"language-json",children:'{\n "kind": "EncryptionConfiguration",\n "apiVersion": "apiserver.config.k8s.io/v1",\n "resources": [\n {\n "resources": [\n "secrets"\n ],\n "providers": [\n {\n "aescbc": {\n "keys": [\n {\n "name": "aescbckey",\n "secret": "xxxxxxxxxxxxxxxxxxx"\n }\n ]\n }\n },\n {\n "identity": {}\n }\n ]\n }\n ]\n}\n'})}),"\n",(0,i.jsx)(n.h2,{id:"secrets-encryption-tool",children:"Secrets Encryption Tool"}),"\n",(0,i.jsxs)(n.p,{children:["K3s contains a utility tool ",(0,i.jsx)(n.code,{children:"secrets-encrypt"}),", which enables automatic control over the following:"]}),"\n",(0,i.jsxs)(n.ul,{children:["\n",(0,i.jsx)(n.li,{children:"Disabling/Enabling secrets encryption"}),"\n",(0,i.jsx)(n.li,{children:"Adding new encryption keys"}),"\n",(0,i.jsx)(n.li,{children:"Rotating and deleting encryption keys"}),"\n",(0,i.jsx)(n.li,{children:"Reencrypting secrets"}),"\n"]}),"\n",(0,i.jsxs)(n.p,{children:["For more information, see the ",(0,i.jsxs)(n.a,{href:"/cli/secrets-encrypt",children:[(0,i.jsx)(n.code,{children:"k3s secrets-encrypt"})," command documentation"]}),"."]})]})}function p(e={}){const{wrapper:n}={...(0,r.a)(),...e.components};return n?(0,i.jsx)(n,{...e,children:(0,i.jsx)(d,{...e})}):d(e)}},1151:(e,n,t)=>{t.d(n,{Z:()=>o,a:()=>c});var i=t(7294);const r={},s=i.createContext(r);function c(e){const n=i.useContext(s);return i.useMemo((function(){return"function"==typeof e?e(n):{...n,...e}}),[n,e])}function o(e){let n;return n=e.disableParentContext?"function"==typeof e.components?e.components(r):e.components||r:c(e.components),i.createElement(s.Provider,{value:n},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/5ea4afd8.6ab4e106.js b/assets/js/5ea4afd8.8740e93a.js similarity index 99% rename from assets/js/5ea4afd8.6ab4e106.js rename to assets/js/5ea4afd8.8740e93a.js index b916b4514..5dd63d214 100644 --- a/assets/js/5ea4afd8.6ab4e106.js +++ b/assets/js/5ea4afd8.8740e93a.js @@ -1 +1 @@ -"use strict";(self.webpackChunkk_3_s_docs=self.webpackChunkk_3_s_docs||[]).push([[9075],{7902:(e,r,s)=>{s.r(r),s.d(r,{assets:()=>c,contentTitle:()=>a,default:()=>u,frontMatter:()=>i,metadata:()=>l,toc:()=>o});var t=s(5893),n=s(1151);const i={title:"CIS 1.7 Self Assessment Guide"},a=void 0,l={id:"security/self-assessment-1.7",title:"CIS 1.7 Self Assessment Guide",description:"Overview",source:"@site/docs/security/self-assessment-1.7.md",sourceDirName:"security",slug:"/security/self-assessment-1.7",permalink:"/security/self-assessment-1.7",draft:!1,unlisted:!1,editUrl:"https://github.com/k3s-io/docs/edit/main/docs/security/self-assessment-1.7.md",tags:[],version:"current",lastUpdatedAt:1723651727e3,frontMatter:{title:"CIS 1.7 Self Assessment Guide"},sidebar:"mySidebar",previous:{title:"CIS 1.8 Self Assessment Guide",permalink:"/security/self-assessment-1.8"},next:{title:"CIS 1.24 Self Assessment Guide",permalink:"/security/self-assessment-1.24"}},c={},o=[{value:"Overview",id:"overview",level:2},{value:"Testing controls methodology",id:"testing-controls-methodology",level:3},{value:"1.1 Control Plane Node Configuration Files",id:"11-control-plane-node-configuration-files",level:2},{value:"1.1.1 Ensure that the API server pod specification file permissions are set to 600 or more restrictive (Automated)",id:"111-ensure-that-the-api-server-pod-specification-file-permissions-are-set-to-600-or-more-restrictive-automated",level:3},{value:"1.1.2 Ensure that the API server pod specification file ownership is set to root (Automated)",id:"112-ensure-that-the-api-server-pod-specification-file-ownership-is-set-to-root-automated",level:3},{value:"1.1.3 Ensure that the controller manager pod specification file permissions are set to 600 or more restrictive (Automated)",id:"113-ensure-that-the-controller-manager-pod-specification-file-permissions-are-set-to-600-or-more-restrictive-automated",level:3},{value:"1.1.4 Ensure that the controller manager pod specification file ownership is set to root (Automated)",id:"114-ensure-that-the-controller-manager-pod-specification-file-ownership-is-set-to-root-automated",level:3},{value:"1.1.5 Ensure that the scheduler pod specification file permissions are set to 600 or more restrictive (Automated)",id:"115-ensure-that-the-scheduler-pod-specification-file-permissions-are-set-to-600-or-more-restrictive-automated",level:3},{value:"1.1.6 Ensure that the scheduler pod specification file ownership is set to root (Automated)",id:"116-ensure-that-the-scheduler-pod-specification-file-ownership-is-set-to-root-automated",level:3},{value:"1.1.7 Ensure that the etcd pod specification file permissions are set to 600 or more restrictive (Automated)",id:"117-ensure-that-the-etcd-pod-specification-file-permissions-are-set-to-600-or-more-restrictive-automated",level:3},{value:"1.1.8 Ensure that the etcd pod specification file ownership is set to root (Automated)",id:"118-ensure-that-the-etcd-pod-specification-file-ownership-is-set-to-root-automated",level:3},{value:"1.1.9 Ensure that the Container Network Interface file permissions are set to 600 or more restrictive (Manual)",id:"119-ensure-that-the-container-network-interface-file-permissions-are-set-to-600-or-more-restrictive-manual",level:3},{value:"1.1.10 Ensure that the Container Network Interface file ownership is set to root (Automated)",id:"1110-ensure-that-the-container-network-interface-file-ownership-is-set-to-root-automated",level:3},{value:"1.1.11 Ensure that the etcd data directory permissions are set to 700 or more restrictive (Automated)",id:"1111-ensure-that-the-etcd-data-directory-permissions-are-set-to-700-or-more-restrictive-automated",level:3},{value:"1.1.12 Ensure that the etcd data directory ownership is set to etcd (Automated)",id:"1112-ensure-that-the-etcd-data-directory-ownership-is-set-to-etcd-automated",level:3},{value:"1.1.13 Ensure that the admin.conf file permissions are set to 600 or more restrictive (Automated)",id:"1113-ensure-that-the-adminconf-file-permissions-are-set-to-600-or-more-restrictive-automated",level:3},{value:"1.1.14 Ensure that the admin.conf file ownership is set to root (Automated)",id:"1114-ensure-that-the-adminconf-file-ownership-is-set-to-root-automated",level:3},{value:"1.1.15 Ensure that the scheduler.conf file permissions are set to 600 or more restrictive (Automated)",id:"1115-ensure-that-the-schedulerconf-file-permissions-are-set-to-600-or-more-restrictive-automated",level:3},{value:"1.1.16 Ensure that the scheduler.conf file ownership is set to root (Automated)",id:"1116-ensure-that-the-schedulerconf-file-ownership-is-set-to-root-automated",level:3},{value:"1.1.17 Ensure that the controller-manager.conf file permissions are set to 600 or more restrictive (Automated)",id:"1117-ensure-that-the-controller-managerconf-file-permissions-are-set-to-600-or-more-restrictive-automated",level:3},{value:"1.1.18 Ensure that the controller-manager.conf file ownership is set to root (Automated)",id:"1118-ensure-that-the-controller-managerconf-file-ownership-is-set-to-root-automated",level:3},{value:"1.1.19 Ensure that the Kubernetes PKI directory and file ownership is set to root (Automated)",id:"1119-ensure-that-the-kubernetes-pki-directory-and-file-ownership-is-set-to-root-automated",level:3},{value:"1.1.20 Ensure that the Kubernetes PKI certificate file permissions are set to 600 or more restrictive (Manual)",id:"1120-ensure-that-the-kubernetes-pki-certificate-file-permissions-are-set-to-600-or-more-restrictive-manual",level:3},{value:"1.1.21 Ensure that the Kubernetes PKI key file permissions are set to 600 (Automated)",id:"1121-ensure-that-the-kubernetes-pki-key-file-permissions-are-set-to-600-automated",level:3},{value:"1.2 API Server",id:"12-api-server",level:2},{value:"1.2.1 Ensure that the --anonymous-auth argument is set to false (Automated)",id:"121-ensure-that-the---anonymous-auth-argument-is-set-to-false-automated",level:3},{value:"1.2.2 Ensure that the --token-auth-file parameter is not set (Automated)",id:"122-ensure-that-the---token-auth-file-parameter-is-not-set-automated",level:3},{value:"1.2.3 Ensure that the --DenyServiceExternalIPs is not set (Automated)",id:"123-ensure-that-the---denyserviceexternalips-is-not-set-automated",level:3},{value:"1.2.4 Ensure that the --kubelet-client-certificate and --kubelet-client-key arguments are set as appropriate (Automated)",id:"124-ensure-that-the---kubelet-client-certificate-and---kubelet-client-key-arguments-are-set-as-appropriate-automated",level:3},{value:"1.2.5 Ensure that the --kubelet-certificate-authority argument is set as appropriate (Automated)",id:"125-ensure-that-the---kubelet-certificate-authority-argument-is-set-as-appropriate-automated",level:3},{value:"1.2.6 Ensure that the --authorization-mode argument is not set to AlwaysAllow (Automated)",id:"126-ensure-that-the---authorization-mode-argument-is-not-set-to-alwaysallow-automated",level:3},{value:"1.2.7 Ensure that the --authorization-mode argument includes Node (Automated)",id:"127-ensure-that-the---authorization-mode-argument-includes-node-automated",level:3},{value:"1.2.8 Ensure that the --authorization-mode argument includes RBAC (Automated)",id:"128-ensure-that-the---authorization-mode-argument-includes-rbac-automated",level:3},{value:"1.2.9 Ensure that the admission control plugin EventRateLimit is set (Manual)",id:"129-ensure-that-the-admission-control-plugin-eventratelimit-is-set-manual",level:3},{value:"1.2.10 Ensure that the admission control plugin AlwaysAdmit is not set (Automated)",id:"1210-ensure-that-the-admission-control-plugin-alwaysadmit-is-not-set-automated",level:3},{value:"1.2.11 Ensure that the admission control plugin AlwaysPullImages is set (Manual)",id:"1211-ensure-that-the-admission-control-plugin-alwayspullimages-is-set-manual",level:3},{value:"1.2.12 Ensure that the admission control plugin SecurityContextDeny is set if PodSecurityPolicy is not used (Manual)",id:"1212-ensure-that-the-admission-control-plugin-securitycontextdeny-is-set-if-podsecuritypolicy-is-not-used-manual",level:3},{value:"1.2.13 Ensure that the admission control plugin ServiceAccount is set (Automated)",id:"1213-ensure-that-the-admission-control-plugin-serviceaccount-is-set-automated",level:3},{value:"1.2.14 Ensure that the admission control plugin NamespaceLifecycle is set (Automated)",id:"1214-ensure-that-the-admission-control-plugin-namespacelifecycle-is-set-automated",level:3},{value:"1.2.15 Ensure that the admission control plugin NodeRestriction is set (Automated)",id:"1215-ensure-that-the-admission-control-plugin-noderestriction-is-set-automated",level:3},{value:"1.2.16 Ensure that the --secure-port argument is not set to 0 - NoteThis recommendation is obsolete and will be deleted per the consensus process (Automated)",id:"1216-ensure-that-the---secure-port-argument-is-not-set-to-0---notethis-recommendation-is-obsolete-and-will-be-deleted-per-the-consensus-process-automated",level:3},{value:"1.2.17 Ensure that the --profiling argument is set to false (Automated)",id:"1217-ensure-that-the---profiling-argument-is-set-to-false-automated",level:3},{value:"1.2.18 Ensure that the --audit-log-path argument is set (Manual)",id:"1218-ensure-that-the---audit-log-path-argument-is-set-manual",level:3},{value:"1.2.19 Ensure that the --audit-log-maxage argument is set to 30 or as appropriate (Manual)",id:"1219-ensure-that-the---audit-log-maxage-argument-is-set-to-30-or-as-appropriate-manual",level:3},{value:"1.2.20 Ensure that the --audit-log-maxbackup argument is set to 10 or as appropriate (Manual)",id:"1220-ensure-that-the---audit-log-maxbackup-argument-is-set-to-10-or-as-appropriate-manual",level:3},{value:"1.2.21 Ensure that the --audit-log-maxsize argument is set to 100 or as appropriate (Manual)",id:"1221-ensure-that-the---audit-log-maxsize-argument-is-set-to-100-or-as-appropriate-manual",level:3},{value:"1.2.22 Ensure that the --request-timeout argument is set as appropriate (Manual)",id:"1222-ensure-that-the---request-timeout-argument-is-set-as-appropriate-manual",level:3},{value:"1.2.23 Ensure that the --service-account-lookup argument is set to true (Automated)",id:"1223-ensure-that-the---service-account-lookup-argument-is-set-to-true-automated",level:3},{value:"1.2.24 Ensure that the --service-account-key-file argument is set as appropriate (Automated)",id:"1224-ensure-that-the---service-account-key-file-argument-is-set-as-appropriate-automated",level:3},{value:"1.2.25 Ensure that the --etcd-certfile and --etcd-keyfile arguments are set as appropriate (Automated)",id:"1225-ensure-that-the---etcd-certfile-and---etcd-keyfile-arguments-are-set-as-appropriate-automated",level:3},{value:"1.2.26 Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate (Automated)",id:"1226-ensure-that-the---tls-cert-file-and---tls-private-key-file-arguments-are-set-as-appropriate-automated",level:3},{value:"1.2.27 Ensure that the --client-ca-file argument is set as appropriate (Automated)",id:"1227-ensure-that-the---client-ca-file-argument-is-set-as-appropriate-automated",level:3},{value:"1.2.28 Ensure that the --etcd-cafile argument is set as appropriate (Automated)",id:"1228-ensure-that-the---etcd-cafile-argument-is-set-as-appropriate-automated",level:3},{value:"1.2.29 Ensure that the --encryption-provider-config argument is set as appropriate (Manual)",id:"1229-ensure-that-the---encryption-provider-config-argument-is-set-as-appropriate-manual",level:3},{value:"1.2.30 Ensure that encryption providers are appropriately configured (Manual)",id:"1230-ensure-that-encryption-providers-are-appropriately-configured-manual",level:3},{value:"1.2.31 Ensure that the API Server only makes use of Strong Cryptographic Ciphers (Automated)",id:"1231-ensure-that-the-api-server-only-makes-use-of-strong-cryptographic-ciphers-automated",level:3},{value:"1.3 Controller Manager",id:"13-controller-manager",level:2},{value:"1.3.1 Ensure that the --terminated-pod-gc-threshold argument is set as appropriate (Manual)",id:"131-ensure-that-the---terminated-pod-gc-threshold-argument-is-set-as-appropriate-manual",level:3},{value:"1.3.2 Ensure that the --profiling argument is set to false (Automated)",id:"132-ensure-that-the---profiling-argument-is-set-to-false-automated",level:3},{value:"1.3.3 Ensure that the --use-service-account-credentials argument is set to true (Automated)",id:"133-ensure-that-the---use-service-account-credentials-argument-is-set-to-true-automated",level:3},{value:"1.3.4 Ensure that the --service-account-private-key-file argument is set as appropriate (Automated)",id:"134-ensure-that-the---service-account-private-key-file-argument-is-set-as-appropriate-automated",level:3},{value:"1.3.5 Ensure that the --root-ca-file argument is set as appropriate (Automated)",id:"135-ensure-that-the---root-ca-file-argument-is-set-as-appropriate-automated",level:3},{value:"1.3.6 Ensure that the RotateKubeletServerCertificate argument is set to true (Automated)",id:"136-ensure-that-the-rotatekubeletservercertificate-argument-is-set-to-true-automated",level:3},{value:"1.3.7 Ensure that the --bind-address argument is set to 127.0.0.1 (Automated)",id:"137-ensure-that-the---bind-address-argument-is-set-to-127001-automated",level:3},{value:"1.4 Scheduler",id:"14-scheduler",level:2},{value:"1.4.1 Ensure that the --profiling argument is set to false (Automated)",id:"141-ensure-that-the---profiling-argument-is-set-to-false-automated",level:3},{value:"1.4.2 Ensure that the --bind-address argument is set to 127.0.0.1 (Automated)",id:"142-ensure-that-the---bind-address-argument-is-set-to-127001-automated",level:3},{value:"2 Etcd Node Configuration",id:"2-etcd-node-configuration",level:2},{value:"2.1 Ensure that the --cert-file and --key-file arguments are set as appropriate (Automated)",id:"21-ensure-that-the---cert-file-and---key-file-arguments-are-set-as-appropriate-automated",level:3},{value:"2.2 Ensure that the --client-cert-auth argument is set to true (Automated)",id:"22-ensure-that-the---client-cert-auth-argument-is-set-to-true-automated",level:3},{value:"2.3 Ensure that the --auto-tls argument is not set to true (Automated)",id:"23-ensure-that-the---auto-tls-argument-is-not-set-to-true-automated",level:3},{value:"2.4 Ensure that the --peer-cert-file and --peer-key-file arguments are set as appropriate (Automated)",id:"24-ensure-that-the---peer-cert-file-and---peer-key-file-arguments-are-set-as-appropriate-automated",level:3},{value:"2.5 Ensure that the --peer-client-cert-auth argument is set to true (Automated)",id:"25-ensure-that-the---peer-client-cert-auth-argument-is-set-to-true-automated",level:3},{value:"2.6 Ensure that the --peer-auto-tls argument is not set to true (Automated)",id:"26-ensure-that-the---peer-auto-tls-argument-is-not-set-to-true-automated",level:3},{value:"2.7 Ensure that a unique Certificate Authority is used for etcd (Automated)",id:"27-ensure-that-a-unique-certificate-authority-is-used-for-etcd-automated",level:3},{value:"4.1 Worker Node Configuration Files",id:"41-worker-node-configuration-files",level:2},{value:"4.1.1 Ensure that the kubelet service file permissions are set to 600 or more restrictive (Automated)",id:"411-ensure-that-the-kubelet-service-file-permissions-are-set-to-600-or-more-restrictive-automated",level:3},{value:"4.1.2 Ensure that the kubelet service file ownership is set to root (Automated)",id:"412-ensure-that-the-kubelet-service-file-ownership-is-set-to-root-automated",level:3},{value:"4.1.3 If proxy kubeconfig file exists ensure permissions are set to 600 or more restrictive (Automated)",id:"413-if-proxy-kubeconfig-file-exists-ensure-permissions-are-set-to-600-or-more-restrictive-automated",level:3},{value:"4.1.4 If proxy kubeconfig file exists ensure ownership is set to root (Automated)",id:"414-if-proxy-kubeconfig-file-exists-ensure-ownership-is-set-to-root-automated",level:3},{value:"4.1.5 Ensure that the --kubeconfig kubelet.conf file permissions are set to 600 or more restrictive (Automated)",id:"415-ensure-that-the---kubeconfig-kubeletconf-file-permissions-are-set-to-600-or-more-restrictive-automated",level:3},{value:"4.1.6 Ensure that the --kubeconfig kubelet.conf file ownership is set to root (Automated)",id:"416-ensure-that-the---kubeconfig-kubeletconf-file-ownership-is-set-to-root-automated",level:3},{value:"4.1.7 Ensure that the certificate authorities file permissions are set to 600 or more restrictive (Automated)",id:"417-ensure-that-the-certificate-authorities-file-permissions-are-set-to-600-or-more-restrictive-automated",level:3},{value:"4.1.8 Ensure that the client certificate authorities file ownership is set to root (Automated)",id:"418-ensure-that-the-client-certificate-authorities-file-ownership-is-set-to-root-automated",level:3},{value:"4.1.9 Ensure that the kubelet --config configuration file has permissions set to 600 or more restrictive (Automated)",id:"419-ensure-that-the-kubelet---config-configuration-file-has-permissions-set-to-600-or-more-restrictive-automated",level:3},{value:"4.1.10 Ensure that the kubelet --config configuration file ownership is set to root (Automated)",id:"4110-ensure-that-the-kubelet---config-configuration-file-ownership-is-set-to-root-automated",level:3},{value:"4.2 Kubelet",id:"42-kubelet",level:2},{value:"4.2.1 Ensure that the --anonymous-auth argument is set to false (Automated)",id:"421-ensure-that-the---anonymous-auth-argument-is-set-to-false-automated",level:3},{value:"4.2.2 Ensure that the --authorization-mode argument is not set to AlwaysAllow (Automated)",id:"422-ensure-that-the---authorization-mode-argument-is-not-set-to-alwaysallow-automated",level:3},{value:"4.2.3 Ensure that the --client-ca-file argument is set as appropriate (Automated)",id:"423-ensure-that-the---client-ca-file-argument-is-set-as-appropriate-automated",level:3},{value:"4.2.4 Verify that the --read-only-port argument is set to 0 (Automated)",id:"424-verify-that-the---read-only-port-argument-is-set-to-0-automated",level:3},{value:"4.2.5 Ensure that the --streaming-connection-idle-timeout argument is not set to 0 (Manual)",id:"425-ensure-that-the---streaming-connection-idle-timeout-argument-is-not-set-to-0-manual",level:3},{value:"4.2.6 Ensure that the --make-iptables-util-chains argument is set to true (Automated)",id:"426-ensure-that-the---make-iptables-util-chains-argument-is-set-to-true-automated",level:3},{value:"4.2.7 Ensure that the --hostname-override argument is not set (Automated)",id:"427-ensure-that-the---hostname-override-argument-is-not-set-automated",level:3},{value:"4.2.8 Ensure that the eventRecordQPS argument is set to a level which ensures appropriate event capture (Manual)",id:"428-ensure-that-the-eventrecordqps-argument-is-set-to-a-level-which-ensures-appropriate-event-capture-manual",level:3},{value:"4.2.9 Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate (Automated)",id:"429-ensure-that-the---tls-cert-file-and---tls-private-key-file-arguments-are-set-as-appropriate-automated",level:3},{value:"4.2.10 Ensure that the --rotate-certificates argument is not set to false (Automated)",id:"4210-ensure-that-the---rotate-certificates-argument-is-not-set-to-false-automated",level:3},{value:"4.2.11 Verify that the RotateKubeletServerCertificate argument is set to true (Automated)",id:"4211-verify-that-the-rotatekubeletservercertificate-argument-is-set-to-true-automated",level:3},{value:"4.2.12 Ensure that the Kubelet only makes use of Strong Cryptographic Ciphers (Manual)",id:"4212-ensure-that-the-kubelet-only-makes-use-of-strong-cryptographic-ciphers-manual",level:3},{value:"4.2.13 Ensure that a limit is set on pod PIDs (Manual)",id:"4213-ensure-that-a-limit-is-set-on-pod-pids-manual",level:3},{value:"5.1 RBAC and Service Accounts",id:"51-rbac-and-service-accounts",level:2},{value:"5.1.1 Ensure that the cluster-admin role is only used where required (Manual)",id:"511-ensure-that-the-cluster-admin-role-is-only-used-where-required-manual",level:3},{value:"5.1.2 Minimize access to secrets (Manual)",id:"512-minimize-access-to-secrets-manual",level:3},{value:"5.1.3 Minimize wildcard use in Roles and ClusterRoles (Manual)",id:"513-minimize-wildcard-use-in-roles-and-clusterroles-manual",level:3},{value:"5.1.4 Minimize access to create pods (Manual)",id:"514-minimize-access-to-create-pods-manual",level:3},{value:"5.1.5 Ensure that default service accounts are not actively used. (Manual)",id:"515-ensure-that-default-service-accounts-are-not-actively-used-manual",level:3},{value:"5.1.6 Ensure that Service Account Tokens are only mounted where necessary (Manual)",id:"516-ensure-that-service-account-tokens-are-only-mounted-where-necessary-manual",level:3},{value:"5.1.7 Avoid use of system group (Manual)",id:"517-avoid-use-of-system-group-manual",level:3},{value:"5.1.8 Limit use of the Bind, Impersonate and Escalate permissions in the Kubernetes cluster (Manual)",id:"518-limit-use-of-the-bind-impersonate-and-escalate-permissions-in-the-kubernetes-cluster-manual",level:3},{value:"5.1.9 Minimize access to create persistent volumes (Manual)",id:"519-minimize-access-to-create-persistent-volumes-manual",level:3},{value:"5.1.10 Minimize access to the proxy sub-resource of nodes (Manual)",id:"5110-minimize-access-to-the-proxy-sub-resource-of-nodes-manual",level:3},{value:"5.1.11 Minimize access to the approval sub-resource of certificatesigningrequests objects (Manual)",id:"5111-minimize-access-to-the-approval-sub-resource-of-certificatesigningrequests-objects-manual",level:3},{value:"5.1.12 Minimize access to webhook configuration objects (Manual)",id:"5112-minimize-access-to-webhook-configuration-objects-manual",level:3},{value:"5.1.13 Minimize access to the service account token creation (Manual)",id:"5113-minimize-access-to-the-service-account-token-creation-manual",level:3},{value:"5.2 Pod Security Standards",id:"52-pod-security-standards",level:2},{value:"5.2.1 Ensure that the cluster has at least one active policy control mechanism in place (Manual)",id:"521-ensure-that-the-cluster-has-at-least-one-active-policy-control-mechanism-in-place-manual",level:3},{value:"5.2.2 Minimize the admission of privileged containers (Manual)",id:"522-minimize-the-admission-of-privileged-containers-manual",level:3},{value:"5.2.3 Minimize the admission of containers wishing to share the host process ID namespace (Automated)",id:"523-minimize-the-admission-of-containers-wishing-to-share-the-host-process-id-namespace-automated",level:3},{value:"5.2.4 Minimize the admission of containers wishing to share the host IPC namespace (Automated)",id:"524-minimize-the-admission-of-containers-wishing-to-share-the-host-ipc-namespace-automated",level:3},{value:"5.2.5 Minimize the admission of containers wishing to share the host network namespace (Automated)",id:"525-minimize-the-admission-of-containers-wishing-to-share-the-host-network-namespace-automated",level:3},{value:"5.2.6 Minimize the admission of containers with allowPrivilegeEscalation (Automated)",id:"526-minimize-the-admission-of-containers-with-allowprivilegeescalation-automated",level:3},{value:"5.2.7 Minimize the admission of root containers (Automated)",id:"527-minimize-the-admission-of-root-containers-automated",level:3},{value:"5.2.8 Minimize the admission of containers with the NET_RAW capability (Automated)",id:"528-minimize-the-admission-of-containers-with-the-net_raw-capability-automated",level:3},{value:"5.2.9 Minimize the admission of containers with added capabilities (Automated)",id:"529-minimize-the-admission-of-containers-with-added-capabilities-automated",level:3},{value:"5.2.10 Minimize the admission of containers with capabilities assigned (Manual)",id:"5210-minimize-the-admission-of-containers-with-capabilities-assigned-manual",level:3},{value:"5.2.11 Minimize the admission of Windows HostProcess containers (Manual)",id:"5211-minimize-the-admission-of-windows-hostprocess-containers-manual",level:3},{value:"5.2.12 Minimize the admission of HostPath volumes (Manual)",id:"5212-minimize-the-admission-of-hostpath-volumes-manual",level:3},{value:"5.2.13 Minimize the admission of containers which use HostPorts (Manual)",id:"5213-minimize-the-admission-of-containers-which-use-hostports-manual",level:3},{value:"5.3 Network Policies and CNI",id:"53-network-policies-and-cni",level:2},{value:"5.3.1 Ensure that the CNI in use supports NetworkPolicies (Manual)",id:"531-ensure-that-the-cni-in-use-supports-networkpolicies-manual",level:3},{value:"5.3.2 Ensure that all Namespaces have NetworkPolicies defined (Manual)",id:"532-ensure-that-all-namespaces-have-networkpolicies-defined-manual",level:3},{value:"5.4 Secrets Management",id:"54-secrets-management",level:2},{value:"5.4.1 Prefer using Secrets as files over Secrets as environment variables (Manual)",id:"541-prefer-using-secrets-as-files-over-secrets-as-environment-variables-manual",level:3},{value:"5.4.2 Consider external secret storage (Manual)",id:"542-consider-external-secret-storage-manual",level:3},{value:"5.5 Extensible Admission Control",id:"55-extensible-admission-control",level:2},{value:"5.5.1 Configure Image Provenance using ImagePolicyWebhook admission controller (Manual)",id:"551-configure-image-provenance-using-imagepolicywebhook-admission-controller-manual",level:3},{value:"5.7 General Policies",id:"57-general-policies",level:2},{value:"5.7.1 Create administrative boundaries between resources using namespaces (Manual)",id:"571-create-administrative-boundaries-between-resources-using-namespaces-manual",level:3},{value:"5.7.2 Ensure that the seccomp profile is set to docker/default in your Pod definitions (Manual)",id:"572-ensure-that-the-seccomp-profile-is-set-to-dockerdefault-in-your-pod-definitions-manual",level:3},{value:"5.7.3 Apply SecurityContext to your Pods and Containers (Manual)",id:"573-apply-securitycontext-to-your-pods-and-containers-manual",level:3},{value:"5.7.4 The default namespace should not be used (Manual)",id:"574-the-default-namespace-should-not-be-used-manual",level:3}];function d(e){const r={a:"a",admonition:"admonition",code:"code",h2:"h2",h3:"h3",li:"li",p:"p",pre:"pre",strong:"strong",ul:"ul",...(0,n.a)(),...e.components},{Details:s}=r;return s||function(e,r){throw new Error("Expected "+(r?"component":"object")+" `"+e+"` to be defined: you likely forgot to import, pass, or provide it.")}("Details",!0),(0,t.jsxs)(t.Fragment,{children:[(0,t.jsx)(r.h2,{id:"overview",children:"Overview"}),"\n",(0,t.jsxs)(r.p,{children:["This document is a companion to the ",(0,t.jsx)(r.a,{href:"/security/hardening-guide",children:"K3s security hardening guide"}),". The hardening guide provides prescriptive guidance for hardening a production installation of K3s, and this benchmark guide is meant to help you evaluate the level of security of the hardened cluster against each control in the CIS Kubernetes Benchmark. It is to be used by K3s operators, security teams, auditors, and decision-makers."]}),"\n",(0,t.jsxs)(r.p,{children:["This guide is specific to the ",(0,t.jsx)(r.strong,{children:"v1.25"})," release line of K3s and the ",(0,t.jsx)(r.strong,{children:"v1.7.1"})," release of the CIS Kubernetes Benchmark."]}),"\n",(0,t.jsxs)(r.p,{children:["For more information about each control, including detailed descriptions and remediations for failing tests, you can refer to the corresponding section of the CIS Kubernetes Benchmark v1.7.1. You can download the benchmark, after creating a free account, in ",(0,t.jsx)(r.a,{href:"https://www.cisecurity.org/benchmark/kubernetes/",children:"Center for Internet Security (CIS)"}),"."]}),"\n",(0,t.jsx)(r.h3,{id:"testing-controls-methodology",children:"Testing controls methodology"}),"\n",(0,t.jsx)(r.p,{children:"Each control in the CIS Kubernetes Benchmark was evaluated against a K3s cluster that was configured according to the accompanying hardening guide."}),"\n",(0,t.jsx)(r.p,{children:"Where control audits differ from the original CIS benchmark, the audit commands specific to K3s are provided for testing."}),"\n",(0,t.jsx)(r.p,{children:"These are the possible results for each control:"}),"\n",(0,t.jsxs)(r.ul,{children:["\n",(0,t.jsxs)(r.li,{children:[(0,t.jsx)(r.strong,{children:"Pass"})," - The K3s cluster under test passed the audit outlined in the benchmark."]}),"\n",(0,t.jsxs)(r.li,{children:[(0,t.jsx)(r.strong,{children:"Not Applicable"})," - The control is not applicable to K3s because of how it is designed to operate. The remediation section will explain why this is so."]}),"\n",(0,t.jsxs)(r.li,{children:[(0,t.jsx)(r.strong,{children:"Warn"})," - The control is manual in the CIS benchmark and it depends on the cluster's use case or some other factor that must be determined by the cluster operator. These controls have been evaluated to ensure K3s does not prevent their implementation, but no further configuration or auditing of the cluster under test has been performed."]}),"\n"]}),"\n",(0,t.jsx)(r.p,{children:'This guide makes the assumption that K3s is running as a Systemd unit. Your installation may vary and will require you to adjust the "audit" commands to fit your scenario.'}),"\n",(0,t.jsx)(r.admonition,{type:"note",children:(0,t.jsxs)(r.p,{children:["Only ",(0,t.jsx)(r.code,{children:"scored"})," test, also know as ",(0,t.jsx)(r.code,{children:"automated"})," tests are covered in this guide."]})}),"\n",(0,t.jsx)(r.h2,{id:"11-control-plane-node-configuration-files",children:"1.1 Control Plane Node Configuration Files"}),"\n",(0,t.jsx)(r.h3,{id:"111-ensure-that-the-api-server-pod-specification-file-permissions-are-set-to-600-or-more-restrictive-automated",children:"1.1.1 Ensure that the API server pod specification file permissions are set to 600 or more restrictive (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," Not Applicable"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Rationale:"})}),"\n",(0,t.jsx)(r.p,{children:"By default, K3s embeds the api server within the k3s process. There is no API server pod specification file."}),"\n",(0,t.jsxs)(r.h3,{id:"112-ensure-that-the-api-server-pod-specification-file-ownership-is-set-to-root-automated",children:["1.1.2 Ensure that the API server pod specification file ownership is set to root",":root"," (Automated)"]}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," Not Applicable"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Rationale:"})}),"\n",(0,t.jsx)(r.p,{children:"By default, K3s embeds the api server within the k3s process. There is no API server pod specification file."}),"\n",(0,t.jsx)(r.h3,{id:"113-ensure-that-the-controller-manager-pod-specification-file-permissions-are-set-to-600-or-more-restrictive-automated",children:"1.1.3 Ensure that the controller manager pod specification file permissions are set to 600 or more restrictive (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," Not Applicable"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Rationale:"})}),"\n",(0,t.jsx)(r.p,{children:"By default, K3s embeds the controller manager within the k3s process. There is no controller manager pod specification file."}),"\n",(0,t.jsxs)(r.h3,{id:"114-ensure-that-the-controller-manager-pod-specification-file-ownership-is-set-to-root-automated",children:["1.1.4 Ensure that the controller manager pod specification file ownership is set to root",":root"," (Automated)"]}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," Not Applicable"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Rationale:"})}),"\n",(0,t.jsx)(r.p,{children:"By default, K3s embeds the controller manager within the k3s process. There is no controller manager pod specification file."}),"\n",(0,t.jsx)(r.h3,{id:"115-ensure-that-the-scheduler-pod-specification-file-permissions-are-set-to-600-or-more-restrictive-automated",children:"1.1.5 Ensure that the scheduler pod specification file permissions are set to 600 or more restrictive (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," Not Applicable"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Rationale:"})}),"\n",(0,t.jsx)(r.p,{children:"By default, K3s embeds the scheduler within the k3s process. There is no scheduler pod specification file."}),"\n",(0,t.jsxs)(r.h3,{id:"116-ensure-that-the-scheduler-pod-specification-file-ownership-is-set-to-root-automated",children:["1.1.6 Ensure that the scheduler pod specification file ownership is set to root",":root"," (Automated)"]}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," Not Applicable"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Rationale:"})}),"\n",(0,t.jsx)(r.p,{children:"By default, K3s embeds the scheduler within the k3s process. There is no scheduler pod specification file."}),"\n",(0,t.jsx)(r.h3,{id:"117-ensure-that-the-etcd-pod-specification-file-permissions-are-set-to-600-or-more-restrictive-automated",children:"1.1.7 Ensure that the etcd pod specification file permissions are set to 600 or more restrictive (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," Not Applicable"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Rationale:"})}),"\n",(0,t.jsx)(r.p,{children:"By default, K3s embeds etcd within the k3s process. There is no etcd pod specification file."}),"\n",(0,t.jsxs)(r.h3,{id:"118-ensure-that-the-etcd-pod-specification-file-ownership-is-set-to-root-automated",children:["1.1.8 Ensure that the etcd pod specification file ownership is set to root",":root"," (Automated)"]}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," Not Applicable"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Rationale:"})}),"\n",(0,t.jsx)(r.p,{children:"By default, K3s embeds etcd within the k3s process. There is no etcd pod specification file."}),"\n",(0,t.jsx)(r.h3,{id:"119-ensure-that-the-container-network-interface-file-permissions-are-set-to-600-or-more-restrictive-manual",children:"1.1.9 Ensure that the Container Network Interface file permissions are set to 600 or more restrictive (Manual)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Remediation:"}),"\nBy default, K3s sets the CNI file permissions to 644.\nNote that for many CNIs, a lock file is created with permissions 750. This is expected and can be ignored.\nIf you modify your CNI configuration, ensure that the permissions are set to 600.\nFor example, ",(0,t.jsx)(r.code,{children:"chmod 600 /var/lib/cni/networks/"})]}),"\n",(0,t.jsxs)(r.h3,{id:"1110-ensure-that-the-container-network-interface-file-ownership-is-set-to-root-automated",children:["1.1.10 Ensure that the Container Network Interface file ownership is set to root",":root"," (Automated)"]}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"ps -ef | grep containerd | grep -- --cni-conf-dir | sed 's%.*cni-conf-dir[= ]\\([^ ]*\\).*%\\1%' | xargs -I{} find {} -mindepth 1 | xargs --no-run-if-empty stat -c %U:%G\nfind /var/lib/cni/networks -type f 2> /dev/null | xargs --no-run-if-empty stat -c %U:%G\n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," 'root",":root","' is present"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:"root:root\nroot:root\nroot:root\nroot:root\nroot:root\nroot:root\nroot:root\n"})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsxs)(r.p,{children:["Run the below command (based on the file location on your system) on the control plane node.\nFor example,\n",(0,t.jsx)(r.code,{children:"chown root:root "})]})]}),"\n",(0,t.jsx)(r.h3,{id:"1111-ensure-that-the-etcd-data-directory-permissions-are-set-to-700-or-more-restrictive-automated",children:"1.1.11 Ensure that the etcd data directory permissions are set to 700 or more restrictive (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:'if [ "$(journalctl -u k3s | grep -m1 \'Managed etcd cluster\' | wc -l)" -gt 0 ]; then\n stat -c permissions=%a /var/lib/rancher/k3s/server/db/etcd\nelse\n echo "permissions=700"\nfi\n'})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," permissions has permissions 700, expected 700 or more restrictive"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:"permissions=700\n"})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsxs)(r.p,{children:["On the etcd server node, get the etcd data directory, passed as an argument --data-dir,\nfrom the command 'ps -ef | grep etcd'.\nRun the below command (based on the etcd data directory found above). For example,\n",(0,t.jsx)(r.code,{children:"chmod 700 /var/lib/rancher/k3s/server/db/etcd"})]})]}),"\n",(0,t.jsxs)(r.h3,{id:"1112-ensure-that-the-etcd-data-directory-ownership-is-set-to-etcd-automated",children:["1.1.12 Ensure that the etcd data directory ownership is set to etcd",":etcd"," (Automated)"]}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," Not Applicable"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Rationale:"})}),"\n",(0,t.jsxs)(r.p,{children:["For K3s, etcd is embedded within the k3s process. There is no separate etcd process.\nTherefore the etcd data directory ownership is managed by the k3s process and should be root",":root","."]}),"\n",(0,t.jsx)(r.h3,{id:"1113-ensure-that-the-adminconf-file-permissions-are-set-to-600-or-more-restrictive-automated",children:"1.1.13 Ensure that the admin.conf file permissions are set to 600 or more restrictive (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"/bin/sh -c 'if test -e /var/lib/rancher/k3s/server/cred/admin.kubeconfig; then stat -c permissions=%a /var/lib/rancher/k3s/server/cred/admin.kubeconfig; fi'\n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," permissions has permissions 600, expected 600 or more restrictive"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:"permissions=600\n"})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsxs)(r.p,{children:["Run the below command (based on the file location on your system) on the control plane node.\nFor example, ",(0,t.jsx)(r.code,{children:"chmod 600 /var/lib/rancher/k3s/server/cred/admin.kubeconfig"})]})]}),"\n",(0,t.jsxs)(r.h3,{id:"1114-ensure-that-the-adminconf-file-ownership-is-set-to-root-automated",children:["1.1.14 Ensure that the admin.conf file ownership is set to root",":root"," (Automated)"]}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"/bin/sh -c 'if test -e /var/lib/rancher/k3s/server/cred/admin.kubeconfig; then stat -c %U:%G /var/lib/rancher/k3s/server/cred/admin.kubeconfig; fi'\n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," 'root",":root","' is equal to 'root",":root","'"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:"root:root\n"})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsxs)(r.p,{children:["Run the below command (based on the file location on your system) on the control plane node.\nFor example, ",(0,t.jsx)(r.code,{children:"chown root:root /var/lib/rancher/k3s/server/cred/admin.kubeconfig"})]})]}),"\n",(0,t.jsx)(r.h3,{id:"1115-ensure-that-the-schedulerconf-file-permissions-are-set-to-600-or-more-restrictive-automated",children:"1.1.15 Ensure that the scheduler.conf file permissions are set to 600 or more restrictive (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"/bin/sh -c 'if test -e /var/lib/rancher/k3s/server/cred/scheduler.kubeconfig; then stat -c permissions=%a /var/lib/rancher/k3s/server/cred/scheduler.kubeconfig; fi'\n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," permissions has permissions 600, expected 600 or more restrictive"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:"permissions=600\n"})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsxs)(r.p,{children:["Run the below command (based on the file location on your system) on the control plane node.\nFor example,\n",(0,t.jsx)(r.code,{children:"chmod 600 /var/lib/rancher/k3s/server/cred/scheduler.kubeconfig"})]})]}),"\n",(0,t.jsxs)(r.h3,{id:"1116-ensure-that-the-schedulerconf-file-ownership-is-set-to-root-automated",children:["1.1.16 Ensure that the scheduler.conf file ownership is set to root",":root"," (Automated)"]}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"/bin/sh -c 'if test -e /var/lib/rancher/k3s/server/cred/scheduler.kubeconfig; then stat -c %U:%G /var/lib/rancher/k3s/server/cred/scheduler.kubeconfig; fi'\n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," 'root",":root","' is present"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:"root:root\n"})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsxs)(r.p,{children:["Run the below command (based on the file location on your system) on the control plane node.\nFor example,\n",(0,t.jsx)(r.code,{children:"chown root:root /var/lib/rancher/k3s/server/cred/scheduler.kubeconfig"})]})]}),"\n",(0,t.jsx)(r.h3,{id:"1117-ensure-that-the-controller-managerconf-file-permissions-are-set-to-600-or-more-restrictive-automated",children:"1.1.17 Ensure that the controller-manager.conf file permissions are set to 600 or more restrictive (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"/bin/sh -c 'if test -e /var/lib/rancher/k3s/server/cred/controller.kubeconfig; then stat -c permissions=%a /var/lib/rancher/k3s/server/cred/controller.kubeconfig; fi'\n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," permissions has permissions 600, expected 600 or more restrictive"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:"permissions=600\n"})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsxs)(r.p,{children:["Run the below command (based on the file location on your system) on the control plane node.\nFor example,\n",(0,t.jsx)(r.code,{children:"chmod 600 /var/lib/rancher/k3s/server/cred/controller.kubeconfig"})]})]}),"\n",(0,t.jsxs)(r.h3,{id:"1118-ensure-that-the-controller-managerconf-file-ownership-is-set-to-root-automated",children:["1.1.18 Ensure that the controller-manager.conf file ownership is set to root",":root"," (Automated)"]}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"stat -c %U:%G /var/lib/rancher/k3s/server/cred/controller.kubeconfig\n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," 'root",":root","' is equal to 'root",":root","'"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:"root:root\n"})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsxs)(r.p,{children:["Run the below command (based on the file location on your system) on the control plane node.\nFor example,\n",(0,t.jsx)(r.code,{children:"chown root:root /var/lib/rancher/k3s/server/cred/controller.kubeconfig"})]})]}),"\n",(0,t.jsxs)(r.h3,{id:"1119-ensure-that-the-kubernetes-pki-directory-and-file-ownership-is-set-to-root-automated",children:["1.1.19 Ensure that the Kubernetes PKI directory and file ownership is set to root",":root"," (Automated)"]}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"stat -c %U:%G /var/lib/rancher/k3s/server/tls\n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," 'root",":root","' is present"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:"root:root\n"})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsxs)(r.p,{children:["Run the below command (based on the file location on your system) on the control plane node.\nFor example,\n",(0,t.jsx)(r.code,{children:"chown -R root:root /var/lib/rancher/k3s/server/tls"})]})]}),"\n",(0,t.jsx)(r.h3,{id:"1120-ensure-that-the-kubernetes-pki-certificate-file-permissions-are-set-to-600-or-more-restrictive-manual",children:"1.1.20 Ensure that the Kubernetes PKI certificate file permissions are set to 600 or more restrictive (Manual)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Remediation:"}),"\nRun the below command (based on the file location on your system) on the master node.\nFor example,\n",(0,t.jsx)(r.code,{children:"chmod -R 600 /var/lib/rancher/k3s/server/tls/*.crt"})]}),"\n",(0,t.jsx)(r.h3,{id:"1121-ensure-that-the-kubernetes-pki-key-file-permissions-are-set-to-600-automated",children:"1.1.21 Ensure that the Kubernetes PKI key file permissions are set to 600 (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"/bin/sh -c 'stat -c permissions=%a /var/lib/rancher/k3s/server/tls/*.key'\n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," permissions has permissions 600, expected 600 or more restrictive"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:"permissions=600\npermissions=600\npermissions=600\npermissions=600\npermissions=600\npermissions=600\npermissions=600\npermissions=600\npermissions=600\npermissions=600\npermissions=600\npermissions=600\npermissions=600\npermissions=600\npermissions=600\npermissions=600\npermissions=600\n"})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsxs)(r.p,{children:["Run the below command (based on the file location on your system) on the master node.\nFor example,\n",(0,t.jsx)(r.code,{children:"chmod -R 600 /var/lib/rancher/k3s/server/tls/*.key"})]})]}),"\n",(0,t.jsx)(r.h2,{id:"12-api-server",children:"1.2 API Server"}),"\n",(0,t.jsx)(r.h3,{id:"121-ensure-that-the---anonymous-auth-argument-is-set-to-false-automated",children:"1.2.1 Ensure that the --anonymous-auth argument is set to false (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'anonymous-auth'\n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," '--anonymous-auth' is equal to 'false'"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:'Aug 09 19:01:28 server-0 k3s[2354]: time="2024-08-09T19:01:28Z" level=info msg="Running kube-apiserver --admission-control-config-file=/var/lib/rancher/k3s/server/psa.yaml --advertise-address=10.10.10.100 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsx)(r.p,{children:"By default, K3s sets the --anonymous-auth argument to false. If it is set to true,\nedit the K3s config file /etc/rancher/k3s/config.yaml and remove anything similar to below."}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{children:'kube-apiserver-arg:\n - "anonymous-auth=true"\n'})})]}),"\n",(0,t.jsx)(r.h3,{id:"122-ensure-that-the---token-auth-file-parameter-is-not-set-automated",children:"1.2.2 Ensure that the --token-auth-file parameter is not set (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s | grep 'Running kube-apiserver' | tail -n1\n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," '--token-auth-file' is not present"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:'Aug 09 19:01:28 server-0 k3s[2354]: time="2024-08-09T19:01:28Z" level=info msg="Running kube-apiserver --admission-control-config-file=/var/lib/rancher/k3s/server/psa.yaml --advertise-address=10.10.10.100 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsx)(r.p,{children:"Follow the documentation and configure alternate mechanisms for authentication.\nIf this check fails, edit the K3s config file /etc/rancher/k3s/config.yaml and remove anything similar to below."}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{children:'kube-apiserver-arg:\n - "token-auth-file="\n'})})]}),"\n",(0,t.jsx)(r.h3,{id:"123-ensure-that-the---denyserviceexternalips-is-not-set-automated",children:"1.2.3 Ensure that the --DenyServiceExternalIPs is not set (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s | grep 'Running kube-apiserver' | tail -n1\n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," '--enable-admission-plugins' does not have 'DenyServiceExternalIPs' OR '--enable-admission-plugins' is not present"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:'Aug 09 19:01:28 server-0 k3s[2354]: time="2024-08-09T19:01:28Z" level=info msg="Running kube-apiserver --admission-control-config-file=/var/lib/rancher/k3s/server/psa.yaml --advertise-address=10.10.10.100 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsx)(r.p,{children:"By default, K3s does not set DenyServiceExternalIPs.\nIf this check fails, edit the K3s config file /etc/rancher/k3s/config.yaml, remove any lines like below."}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{children:'kube-apiserver-arg:\n - "enable-admission-plugins=DenyServiceExternalIPs"\n'})})]}),"\n",(0,t.jsx)(r.h3,{id:"124-ensure-that-the---kubelet-client-certificate-and---kubelet-client-key-arguments-are-set-as-appropriate-automated",children:"1.2.4 Ensure that the --kubelet-client-certificate and --kubelet-client-key arguments are set as appropriate (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'kubelet-certificate-authority'\n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," '--kubelet-client-certificate' is present AND '--kubelet-client-key' is present"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:'Aug 09 19:01:28 server-0 k3s[2354]: time="2024-08-09T19:01:28Z" level=info msg="Running kube-apiserver --admission-control-config-file=/var/lib/rancher/k3s/server/psa.yaml --advertise-address=10.10.10.100 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsx)(r.p,{children:"By default, K3s automatically provides the kubelet client certificate and key.\nThey are generated and located at /var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt and /var/lib/rancher/k3s/server/tls/client-kube-apiserver.key\nIf for some reason you need to provide your own certificate and key, you can set the\nbelow parameters in the K3s config file /etc/rancher/k3s/config.yaml."}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{children:'kube-apiserver-arg:\n - "kubelet-client-certificate="\n - "kubelet-client-key="\n'})})]}),"\n",(0,t.jsx)(r.h3,{id:"125-ensure-that-the---kubelet-certificate-authority-argument-is-set-as-appropriate-automated",children:"1.2.5 Ensure that the --kubelet-certificate-authority argument is set as appropriate (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'kubelet-certificate-authority'\n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," '--kubelet-certificate-authority' is present"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:'Aug 09 19:01:28 server-0 k3s[2354]: time="2024-08-09T19:01:28Z" level=info msg="Running kube-apiserver --admission-control-config-file=/var/lib/rancher/k3s/server/psa.yaml --advertise-address=10.10.10.100 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsx)(r.p,{children:"By default, K3s automatically provides the kubelet CA cert file, at /var/lib/rancher/k3s/server/tls/server-ca.crt.\nIf this check fails, edit the K3s config file /etc/rancher/k3s/config.yaml and remove any lines like below."}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{children:'kube-apiserver-arg:\n - "kubelet-certificate-authority="\n'})})]}),"\n",(0,t.jsx)(r.h3,{id:"126-ensure-that-the---authorization-mode-argument-is-not-set-to-alwaysallow-automated",children:"1.2.6 Ensure that the --authorization-mode argument is not set to AlwaysAllow (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'authorization-mode'\n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," '--authorization-mode' does not have 'AlwaysAllow'"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:'Aug 09 19:01:28 server-0 k3s[2354]: time="2024-08-09T19:01:28Z" level=info msg="Running kube-apiserver --admission-control-config-file=/var/lib/rancher/k3s/server/psa.yaml --advertise-address=10.10.10.100 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsx)(r.p,{children:"By default, K3s does not set the --authorization-mode to AlwaysAllow.\nIf this check fails, edit K3s config file /etc/rancher/k3s/config.yaml, remove any lines like below."}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{children:'kube-apiserver-arg:\n - "authorization-mode=AlwaysAllow"\n'})})]}),"\n",(0,t.jsx)(r.h3,{id:"127-ensure-that-the---authorization-mode-argument-includes-node-automated",children:"1.2.7 Ensure that the --authorization-mode argument includes Node (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'authorization-mode'\n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," '--authorization-mode' has 'Node'"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:'Aug 09 19:01:28 server-0 k3s[2354]: time="2024-08-09T19:01:28Z" level=info msg="Running kube-apiserver --admission-control-config-file=/var/lib/rancher/k3s/server/psa.yaml --advertise-address=10.10.10.100 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsx)(r.p,{children:"By default, K3s sets the --authorization-mode to Node and RBAC.\nIf this check fails, edit the K3s config file /etc/rancher/k3s/config.yaml,\nensure that you are not overriding authorization-mode."})]}),"\n",(0,t.jsx)(r.h3,{id:"128-ensure-that-the---authorization-mode-argument-includes-rbac-automated",children:"1.2.8 Ensure that the --authorization-mode argument includes RBAC (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'authorization-mode'\n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," '--authorization-mode' has 'RBAC'"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:'Aug 09 19:01:28 server-0 k3s[2354]: time="2024-08-09T19:01:28Z" level=info msg="Running kube-apiserver --admission-control-config-file=/var/lib/rancher/k3s/server/psa.yaml --advertise-address=10.10.10.100 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsx)(r.p,{children:"By default, K3s sets the --authorization-mode to Node and RBAC.\nIf this check fails, edit the K3s config file /etc/rancher/k3s/config.yaml,\nensure that you are not overriding authorization-mode."})]}),"\n",(0,t.jsx)(r.h3,{id:"129-ensure-that-the-admission-control-plugin-eventratelimit-is-set-manual",children:"1.2.9 Ensure that the admission control plugin EventRateLimit is set (Manual)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Remediation:"}),"\nFollow the Kubernetes documentation and set the desired limits in a configuration file.\nThen, edit the K3s config file /etc/rancher/k3s/config.yaml and set the below parameters."]}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{children:'kube-apiserver-arg:\n - "enable-admission-plugins=...,EventRateLimit,..."\n - "admission-control-config-file="\n'})}),"\n",(0,t.jsx)(r.h3,{id:"1210-ensure-that-the-admission-control-plugin-alwaysadmit-is-not-set-automated",children:"1.2.10 Ensure that the admission control plugin AlwaysAdmit is not set (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'enable-admission-plugins'\n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," '--enable-admission-plugins' does not have 'AlwaysAdmit' OR '--enable-admission-plugins' is not present"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:'Aug 09 19:01:28 server-0 k3s[2354]: time="2024-08-09T19:01:28Z" level=info msg="Running kube-apiserver --admission-control-config-file=/var/lib/rancher/k3s/server/psa.yaml --advertise-address=10.10.10.100 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsx)(r.p,{children:"By default, K3s does not set the --enable-admission-plugins to AlwaysAdmit.\nIf this check fails, edit K3s config file /etc/rancher/k3s/config.yaml, remove any lines like below."}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{children:'kube-apiserver-arg:\n - "enable-admission-plugins=AlwaysAdmit"\n'})})]}),"\n",(0,t.jsx)(r.h3,{id:"1211-ensure-that-the-admission-control-plugin-alwayspullimages-is-set-manual",children:"1.2.11 Ensure that the admission control plugin AlwaysPullImages is set (Manual)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Remediation:"}),'\nPermissive, per CIS guidelines,\n"This setting could impact offline or isolated clusters, which have images pre-loaded and\ndo not have access to a registry to pull in-use images. This setting is not appropriate for\nclusters which use this configuration."\nEdit the K3s config file /etc/rancher/k3s/config.yaml and set the below parameter.']}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{children:'kube-apiserver-arg:\n - "enable-admission-plugins=...,AlwaysPullImages,..."\n'})}),"\n",(0,t.jsx)(r.h3,{id:"1212-ensure-that-the-admission-control-plugin-securitycontextdeny-is-set-if-podsecuritypolicy-is-not-used-manual",children:"1.2.12 Ensure that the admission control plugin SecurityContextDeny is set if PodSecurityPolicy is not used (Manual)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," Not Applicable"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Rationale:"})}),"\n",(0,t.jsx)(r.p,{children:"Enabling Pod Security Policy is no longer supported on K3s v1.25+ and will cause applications to unexpectedly fail."}),"\n",(0,t.jsx)(r.h3,{id:"1213-ensure-that-the-admission-control-plugin-serviceaccount-is-set-automated",children:"1.2.13 Ensure that the admission control plugin ServiceAccount is set (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s | grep 'Running kube-apiserver' | tail -n1\n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," '--disable-admission-plugins' is present OR '--disable-admission-plugins' is not present"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:'Aug 09 19:01:28 server-0 k3s[2354]: time="2024-08-09T19:01:28Z" level=info msg="Running kube-apiserver --admission-control-config-file=/var/lib/rancher/k3s/server/psa.yaml --advertise-address=10.10.10.100 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsx)(r.p,{children:"By default, K3s does not set the --disable-admission-plugins to anything.\nFollow the documentation and create ServiceAccount objects as per your environment.\nIf this check fails, edit the K3s config file /etc/rancher/k3s/config.yaml and remove any lines like below."}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{children:'kube-apiserver-arg:\n - "disable-admission-plugins=ServiceAccount"\n'})})]}),"\n",(0,t.jsx)(r.h3,{id:"1214-ensure-that-the-admission-control-plugin-namespacelifecycle-is-set-automated",children:"1.2.14 Ensure that the admission control plugin NamespaceLifecycle is set (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s | grep 'Running kube-apiserver' | tail -n1\n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," '--disable-admission-plugins' is present OR '--disable-admission-plugins' is not present"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:'Aug 09 19:01:28 server-0 k3s[2354]: time="2024-08-09T19:01:28Z" level=info msg="Running kube-apiserver --admission-control-config-file=/var/lib/rancher/k3s/server/psa.yaml --advertise-address=10.10.10.100 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsx)(r.p,{children:"By default, K3s does not set the --disable-admission-plugins to anything.\nIf this check fails, edit the K3s config file /etc/rancher/k3s/config.yaml and remove any lines like below."}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{children:'kube-apiserver-arg:\n - "disable-admission-plugins=...,NamespaceLifecycle,..."\n'})})]}),"\n",(0,t.jsx)(r.h3,{id:"1215-ensure-that-the-admission-control-plugin-noderestriction-is-set-automated",children:"1.2.15 Ensure that the admission control plugin NodeRestriction is set (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'enable-admission-plugins'\n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," '--enable-admission-plugins' has 'NodeRestriction'"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:'Aug 09 19:01:28 server-0 k3s[2354]: time="2024-08-09T19:01:28Z" level=info msg="Running kube-apiserver --admission-control-config-file=/var/lib/rancher/k3s/server/psa.yaml --advertise-address=10.10.10.100 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsx)(r.p,{children:"By default, K3s sets the --enable-admission-plugins to NodeRestriction.\nIf using the K3s config file /etc/rancher/k3s/config.yaml, check that you are not overriding the admission plugins.\nIf you are, include NodeRestriction in the list."}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{children:'kube-apiserver-arg:\n - "enable-admission-plugins=...,NodeRestriction,..."\n'})})]}),"\n",(0,t.jsx)(r.h3,{id:"1216-ensure-that-the---secure-port-argument-is-not-set-to-0---notethis-recommendation-is-obsolete-and-will-be-deleted-per-the-consensus-process-automated",children:"1.2.16 Ensure that the --secure-port argument is not set to 0 - NoteThis recommendation is obsolete and will be deleted per the consensus process (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'secure-port'\n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," '--secure-port' is greater than 0 OR '--secure-port' is not present"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:'Aug 09 19:01:28 server-0 k3s[2354]: time="2024-08-09T19:01:28Z" level=info msg="Running kube-apiserver --admission-control-config-file=/var/lib/rancher/k3s/server/psa.yaml --advertise-address=10.10.10.100 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsx)(r.p,{children:"By default, K3s sets the secure port to 6444.\nIf this check fails, edit the K3s config file /etc/rancher/k3s/config.yaml and remove any lines like below."}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{children:'kube-apiserver-arg:\n - "secure-port="\n'})})]}),"\n",(0,t.jsx)(r.h3,{id:"1217-ensure-that-the---profiling-argument-is-set-to-false-automated",children:"1.2.17 Ensure that the --profiling argument is set to false (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'profiling'\n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," '--profiling' is equal to 'false'"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:'Aug 09 19:01:28 server-0 k3s[2354]: time="2024-08-09T19:01:28Z" level=info msg="Running kube-apiserver --admission-control-config-file=/var/lib/rancher/k3s/server/psa.yaml --advertise-address=10.10.10.100 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsx)(r.p,{children:"By default, K3s sets the --profiling argument to false.\nIf this check fails, edit the K3s config file /etc/rancher/k3s/config.yaml and remove any lines like below."}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{children:'kube-apiserver-arg:\n - "profiling=true"\n'})})]}),"\n",(0,t.jsx)(r.h3,{id:"1218-ensure-that-the---audit-log-path-argument-is-set-manual",children:"1.2.18 Ensure that the --audit-log-path argument is set (Manual)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s | grep 'Running kube-apiserver' | tail -n1\n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," '--audit-log-path' is present"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:'Aug 09 19:01:28 server-0 k3s[2354]: time="2024-08-09T19:01:28Z" level=info msg="Running kube-apiserver --admission-control-config-file=/var/lib/rancher/k3s/server/psa.yaml --advertise-address=10.10.10.100 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsx)(r.p,{children:"Edit the K3s config file /etc/rancher/k3s/config.yaml and set the audit-log-path parameter to a suitable path and\nfile where you would like audit logs to be written, for example,"}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{children:'kube-apiserver-arg:\n - "audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log"\n'})})]}),"\n",(0,t.jsx)(r.h3,{id:"1219-ensure-that-the---audit-log-maxage-argument-is-set-to-30-or-as-appropriate-manual",children:"1.2.19 Ensure that the --audit-log-maxage argument is set to 30 or as appropriate (Manual)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s | grep 'Running kube-apiserver' | tail -n1\n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," '--audit-log-maxage' is greater or equal to 30"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:'Aug 09 19:01:28 server-0 k3s[2354]: time="2024-08-09T19:01:28Z" level=info msg="Running kube-apiserver --admission-control-config-file=/var/lib/rancher/k3s/server/psa.yaml --advertise-address=10.10.10.100 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsx)(r.p,{children:"Edit the K3s config file /etc/rancher/k3s/config.yaml on the control plane node and\nset the audit-log-maxage parameter to 30 or as an appropriate number of days, for example,"}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{children:'kube-apiserver-arg:\n - "audit-log-maxage=30"\n'})})]}),"\n",(0,t.jsx)(r.h3,{id:"1220-ensure-that-the---audit-log-maxbackup-argument-is-set-to-10-or-as-appropriate-manual",children:"1.2.20 Ensure that the --audit-log-maxbackup argument is set to 10 or as appropriate (Manual)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s | grep 'Running kube-apiserver' | tail -n1\n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," '--audit-log-maxbackup' is greater or equal to 10"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:'Aug 09 19:01:28 server-0 k3s[2354]: time="2024-08-09T19:01:28Z" level=info msg="Running kube-apiserver --admission-control-config-file=/var/lib/rancher/k3s/server/psa.yaml --advertise-address=10.10.10.100 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsx)(r.p,{children:"Edit the K3s config file /etc/rancher/k3s/config.yaml on the control plane node and\nset the audit-log-maxbackup parameter to 10 or to an appropriate value. For example,"}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{children:'kube-apiserver-arg:\n - "audit-log-maxbackup=10"\n'})})]}),"\n",(0,t.jsx)(r.h3,{id:"1221-ensure-that-the---audit-log-maxsize-argument-is-set-to-100-or-as-appropriate-manual",children:"1.2.21 Ensure that the --audit-log-maxsize argument is set to 100 or as appropriate (Manual)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s | grep 'Running kube-apiserver' | tail -n1\n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," '--audit-log-maxsize' is greater or equal to 100"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:'Aug 09 19:01:28 server-0 k3s[2354]: time="2024-08-09T19:01:28Z" level=info msg="Running kube-apiserver --admission-control-config-file=/var/lib/rancher/k3s/server/psa.yaml --advertise-address=10.10.10.100 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsx)(r.p,{children:"Edit the K3s config file /etc/rancher/k3s/config.yaml on the control plane node and\nset the audit-log-maxsize parameter to an appropriate size in MB. For example,"}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{children:'kube-apiserver-arg:\n - "audit-log-maxsize=100"\n'})})]}),"\n",(0,t.jsx)(r.h3,{id:"1222-ensure-that-the---request-timeout-argument-is-set-as-appropriate-manual",children:"1.2.22 Ensure that the --request-timeout argument is set as appropriate (Manual)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Remediation:"}),'\nPermissive, per CIS guidelines,\n"it is recommended to set this limit as appropriate and change the default limit of 60 seconds only if needed".\nEdit the K3s config file /etc/rancher/k3s/config.yaml\nand set the below parameter if needed. For example,']}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{children:'kube-apiserver-arg:\n - "request-timeout=300s"\n'})}),"\n",(0,t.jsx)(r.h3,{id:"1223-ensure-that-the---service-account-lookup-argument-is-set-to-true-automated",children:"1.2.23 Ensure that the --service-account-lookup argument is set to true (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s | grep 'Running kube-apiserver' | tail -n1\n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," '--service-account-lookup' is not present OR '--service-account-lookup' is present"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:'Aug 09 19:01:28 server-0 k3s[2354]: time="2024-08-09T19:01:28Z" level=info msg="Running kube-apiserver --admission-control-config-file=/var/lib/rancher/k3s/server/psa.yaml --advertise-address=10.10.10.100 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsx)(r.p,{children:"By default, K3s does not set the --service-account-lookup argument.\nEdit the K3s config file /etc/rancher/k3s/config.yaml and set the service-account-lookup. For example,"}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{children:'kube-apiserver-arg:\n - "service-account-lookup=true"\n'})}),(0,t.jsx)(r.p,{children:"Alternatively, you can delete the service-account-lookup parameter from this file so\nthat the default takes effect."})]}),"\n",(0,t.jsx)(r.h3,{id:"1224-ensure-that-the---service-account-key-file-argument-is-set-as-appropriate-automated",children:"1.2.24 Ensure that the --service-account-key-file argument is set as appropriate (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s | grep 'Running kube-apiserver' | tail -n1\n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," '--service-account-key-file' is present"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:'Aug 09 19:01:28 server-0 k3s[2354]: time="2024-08-09T19:01:28Z" level=info msg="Running kube-apiserver --admission-control-config-file=/var/lib/rancher/k3s/server/psa.yaml --advertise-address=10.10.10.100 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsx)(r.p,{children:"K3s automatically generates and sets the service account key file.\nIt is located at /var/lib/rancher/k3s/server/tls/service.key.\nIf this check fails, edit K3s config file /etc/rancher/k3s/config.yaml and remove any lines like below."}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{children:'kube-apiserver-arg:\n - "service-account-key-file="\n'})})]}),"\n",(0,t.jsx)(r.h3,{id:"1225-ensure-that-the---etcd-certfile-and---etcd-keyfile-arguments-are-set-as-appropriate-automated",children:"1.2.25 Ensure that the --etcd-certfile and --etcd-keyfile arguments are set as appropriate (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"if [ \"$(journalctl -u k3s | grep -m1 'Managed etcd cluster' | wc -l)\" -gt 0 ]; then\n journalctl -D /var/log/journal -u k3s | grep -m1 'Running kube-apiserver' | tail -n1\nelse\n echo \"--etcd-certfile AND --etcd-keyfile\"\nfi\n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," '--etcd-certfile' is present AND '--etcd-keyfile' is present"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:'Aug 09 19:01:28 server-0 k3s[2354]: time="2024-08-09T19:01:28Z" level=info msg="Running kube-apiserver --admission-control-config-file=/var/lib/rancher/k3s/server/psa.yaml --advertise-address=10.10.10.100 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsx)(r.p,{children:"K3s automatically generates and sets the etcd certificate and key files.\nThey are located at /var/lib/rancher/k3s/server/tls/etcd/client.crt and /var/lib/rancher/k3s/server/tls/etcd/client.key.\nIf this check fails, edit the K3s config file /etc/rancher/k3s/config.yaml and remove any lines like below."}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{children:'kube-apiserver-arg:\n - "etcd-certfile="\n - "etcd-keyfile="\n'})})]}),"\n",(0,t.jsx)(r.h3,{id:"1226-ensure-that-the---tls-cert-file-and---tls-private-key-file-arguments-are-set-as-appropriate-automated",children:"1.2.26 Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"journalctl -D /var/log/journal -u k3s | grep -A1 'Running kube-apiserver' | tail -n2\n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," '--tls-cert-file' is present AND '--tls-private-key-file' is present"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:'Aug 09 19:01:28 server-0 k3s[2354]: time="2024-08-09T19:01:28Z" level=info msg="Running kube-apiserver --admission-control-config-file=/var/lib/rancher/k3s/server/psa.yaml --advertise-address=10.10.10.100 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\nAug 09 19:01:28 server-0 k3s[2354]: time="2024-08-09T19:01:28Z" level=info msg="Running kube-scheduler --authentication-kubeconfig=/var/lib/rancher/k3s/server/cred/scheduler.kubeconfig --authorization-kubeconfig=/var/lib/rancher/k3s/server/cred/scheduler.kubeconfig --bind-address=127.0.0.1 --kubeconfig=/var/lib/rancher/k3s/server/cred/scheduler.kubeconfig --profiling=false --secure-port=10259"\n'})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsx)(r.p,{children:"By default, K3s automatically generates and provides the TLS certificate and private key for the apiserver.\nThey are generated and located at /var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt and /var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key\nIf this check fails, edit the K3s config file /etc/rancher/k3s/config.yaml and remove any lines like below."}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{children:'kube-apiserver-arg:\n - "tls-cert-file="\n - "tls-private-key-file="\n'})})]}),"\n",(0,t.jsx)(r.h3,{id:"1227-ensure-that-the---client-ca-file-argument-is-set-as-appropriate-automated",children:"1.2.27 Ensure that the --client-ca-file argument is set as appropriate (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'client-ca-file'\n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," '--client-ca-file' is present"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:'Aug 09 19:01:28 server-0 k3s[2354]: time="2024-08-09T19:01:28Z" level=info msg="Running kube-apiserver --admission-control-config-file=/var/lib/rancher/k3s/server/psa.yaml --advertise-address=10.10.10.100 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsx)(r.p,{children:"By default, K3s automatically provides the client certificate authority file.\nIt is generated and located at /var/lib/rancher/k3s/server/tls/client-ca.crt.\nIf this check fails, edit the K3s config file /etc/rancher/k3s/config.yaml and remove any lines like below."}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{children:'kube-apiserver-arg:\n - "client-ca-file="\n'})})]}),"\n",(0,t.jsx)(r.h3,{id:"1228-ensure-that-the---etcd-cafile-argument-is-set-as-appropriate-automated",children:"1.2.28 Ensure that the --etcd-cafile argument is set as appropriate (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'etcd-cafile'\n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," '--etcd-cafile' is present"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:'Aug 09 19:01:28 server-0 k3s[2354]: time="2024-08-09T19:01:28Z" level=info msg="Running kube-apiserver --admission-control-config-file=/var/lib/rancher/k3s/server/psa.yaml --advertise-address=10.10.10.100 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsx)(r.p,{children:"By default, K3s automatically provides the etcd certificate authority file.\nIt is generated and located at /var/lib/rancher/k3s/server/tls/client-ca.crt.\nIf this check fails, edit the K3s config file /etc/rancher/k3s/config.yaml and remove any lines like below."}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{children:'kube-apiserver-arg:\n - "etcd-cafile="\n'})})]}),"\n",(0,t.jsx)(r.h3,{id:"1229-ensure-that-the---encryption-provider-config-argument-is-set-as-appropriate-manual",children:"1.2.29 Ensure that the --encryption-provider-config argument is set as appropriate (Manual)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'encryption-provider-config'\n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," '--encryption-provider-config' is present"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:'Aug 09 19:01:28 server-0 k3s[2354]: time="2024-08-09T19:01:28Z" level=info msg="Running kube-apiserver --admission-control-config-file=/var/lib/rancher/k3s/server/psa.yaml --advertise-address=10.10.10.100 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsx)(r.p,{children:"K3s can be configured to use encryption providers to encrypt secrets at rest.\nEdit the K3s config file /etc/rancher/k3s/config.yaml on the control plane node and set the below parameter.\nsecrets-encryption: true\nSecrets encryption can then be managed with the k3s secrets-encrypt command line tool.\nIf needed, you can find the generated encryption config at /var/lib/rancher/k3s/server/cred/encryption-config.json."})]}),"\n",(0,t.jsx)(r.h3,{id:"1230-ensure-that-encryption-providers-are-appropriately-configured-manual",children:"1.2.30 Ensure that encryption providers are appropriately configured (Manual)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"ENCRYPTION_PROVIDER_CONFIG=$(journalctl -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep -- --encryption-provider-config | sed 's%.*encryption-provider-config[= ]\\([^ ]*\\).*%\\1%')\nif test -e $ENCRYPTION_PROVIDER_CONFIG; then grep -o 'providers\\\"\\:\\[.*\\]' $ENCRYPTION_PROVIDER_CONFIG | grep -o \"[A-Za-z]*\" | head -2 | tail -1 | sed 's/^/provider=/'; fi\n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," 'provider' contains valid elements from 'aescbc,kms,secretbox'"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:"provider=aescbc\n"})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsx)(r.p,{children:"K3s can be configured to use encryption providers to encrypt secrets at rest. K3s will utilize the aescbc provider.\nEdit the K3s config file /etc/rancher/k3s/config.yaml on the control plane node and set the below parameter.\nsecrets-encryption: true\nSecrets encryption can then be managed with the k3s secrets-encrypt command line tool.\nIf needed, you can find the generated encryption config at /var/lib/rancher/k3s/server/cred/encryption-config.json"})]}),"\n",(0,t.jsx)(r.h3,{id:"1231-ensure-that-the-api-server-only-makes-use-of-strong-cryptographic-ciphers-automated",children:"1.2.31 Ensure that the API Server only makes use of Strong Cryptographic Ciphers (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'tls-cipher-suites'\n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," '--tls-cipher-suites' contains valid elements from 'TLS_AES_128_GCM_SHA256,TLS_AES_256_GCM_SHA384,TLS_CHACHA20_POLY1305_SHA256,TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256,TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256,TLS_RSA_WITH_3DES_EDE_CBC_SHA,TLS_RSA_WITH_AES_128_CBC_SHA,TLS_RSA_WITH_AES_128_GCM_SHA256,TLS_RSA_WITH_AES_256_CBC_SHA,TLS_RSA_WITH_AES_256_GCM_SHA384'"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:'Aug 09 19:01:28 server-0 k3s[2354]: time="2024-08-09T19:01:28Z" level=info msg="Running kube-apiserver --admission-control-config-file=/var/lib/rancher/k3s/server/psa.yaml --advertise-address=10.10.10.100 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsxs)(r.p,{children:["By default, the K3s kube-apiserver complies with this test. Changes to these values may cause regression, therefore ensure that all apiserver clients support the new TLS configuration before applying it in production deployments.\nIf a custom TLS configuration is required, consider also creating a custom version of this rule that aligns with your requirements.\nIf this check fails, remove any custom configuration around ",(0,t.jsx)(r.code,{children:"tls-cipher-suites"})," or update the /etc/rancher/k3s/config.yaml file to match the default by adding the following:"]}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{children:'kube-apiserver-arg:\n - "tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305"\n'})})]}),"\n",(0,t.jsx)(r.h2,{id:"13-controller-manager",children:"1.3 Controller Manager"}),"\n",(0,t.jsx)(r.h3,{id:"131-ensure-that-the---terminated-pod-gc-threshold-argument-is-set-as-appropriate-manual",children:"1.3.1 Ensure that the --terminated-pod-gc-threshold argument is set as appropriate (Manual)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s | grep 'Running kube-controller-manager' | tail -n1 | grep 'terminated-pod-gc-threshold'\n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," '--terminated-pod-gc-threshold' is present"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:'Aug 09 19:01:28 server-0 k3s[2354]: time="2024-08-09T19:01:28Z" level=info msg="Running kube-controller-manager --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/k3s/server/tls/client-ca.nochain.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/k3s/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/k3s/server/tls/client-ca.nochain.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/k3s/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/k3s/server/tls/server-ca.nochain.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/k3s/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/k3s/server/tls/server-ca.nochain.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/k3s/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,tokencleaner,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/k3s/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --terminated-pod-gc-threshold=10 --use-service-account-credentials=true"\n'})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsx)(r.p,{children:"Edit the K3s config file /etc/rancher/k3s/config.yaml on the control plane node\nand set the --terminated-pod-gc-threshold to an appropriate threshold,"}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{children:'kube-controller-manager-arg:\n - "terminated-pod-gc-threshold=10"\n'})})]}),"\n",(0,t.jsx)(r.h3,{id:"132-ensure-that-the---profiling-argument-is-set-to-false-automated",children:"1.3.2 Ensure that the --profiling argument is set to false (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s | grep 'Running kube-controller-manager' | tail -n1 | grep 'profiling'\n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," '--profiling' is equal to 'false'"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:'Aug 09 19:01:28 server-0 k3s[2354]: time="2024-08-09T19:01:28Z" level=info msg="Running kube-controller-manager --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/k3s/server/tls/client-ca.nochain.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/k3s/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/k3s/server/tls/client-ca.nochain.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/k3s/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/k3s/server/tls/server-ca.nochain.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/k3s/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/k3s/server/tls/server-ca.nochain.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/k3s/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,tokencleaner,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/k3s/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --terminated-pod-gc-threshold=10 --use-service-account-credentials=true"\n'})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsx)(r.p,{children:"By default, K3s sets the --profiling argument to false.\nIf this check fails, edit the K3s config file /etc/rancher/k3s/config.yaml and remove any lines like below."}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{children:'kube-controller-manager-arg:\n - "profiling=true"\n'})})]}),"\n",(0,t.jsx)(r.h3,{id:"133-ensure-that-the---use-service-account-credentials-argument-is-set-to-true-automated",children:"1.3.3 Ensure that the --use-service-account-credentials argument is set to true (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s | grep 'Running kube-controller-manager' | tail -n1 | grep 'use-service-account-credentials'\n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," '--use-service-account-credentials' is not equal to 'false'"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:'Aug 09 19:01:28 server-0 k3s[2354]: time="2024-08-09T19:01:28Z" level=info msg="Running kube-controller-manager --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/k3s/server/tls/client-ca.nochain.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/k3s/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/k3s/server/tls/client-ca.nochain.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/k3s/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/k3s/server/tls/server-ca.nochain.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/k3s/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/k3s/server/tls/server-ca.nochain.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/k3s/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,tokencleaner,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/k3s/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --terminated-pod-gc-threshold=10 --use-service-account-credentials=true"\n'})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsx)(r.p,{children:"By default, K3s sets the --use-service-account-credentials argument to true.\nIf this check fails, edit the K3s config file /etc/rancher/k3s/config.yaml and remove any lines like below."}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{children:'kube-controller-manager-arg:\n - "use-service-account-credentials=false"\n'})})]}),"\n",(0,t.jsx)(r.h3,{id:"134-ensure-that-the---service-account-private-key-file-argument-is-set-as-appropriate-automated",children:"1.3.4 Ensure that the --service-account-private-key-file argument is set as appropriate (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s | grep 'Running kube-controller-manager' | tail -n1 | grep 'service-account-private-key-file'\n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," '--service-account-private-key-file' is present"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:'Aug 09 19:01:28 server-0 k3s[2354]: time="2024-08-09T19:01:28Z" level=info msg="Running kube-controller-manager --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/k3s/server/tls/client-ca.nochain.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/k3s/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/k3s/server/tls/client-ca.nochain.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/k3s/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/k3s/server/tls/server-ca.nochain.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/k3s/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/k3s/server/tls/server-ca.nochain.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/k3s/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,tokencleaner,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/k3s/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --terminated-pod-gc-threshold=10 --use-service-account-credentials=true"\n'})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsx)(r.p,{children:"By default, K3s automatically provides the service account private key file.\nIt is generated and located at /var/lib/rancher/k3s/server/tls/service.current.key.\nIf this check fails, edit the K3s config file /etc/rancher/k3s/config.yaml and remove any lines like below."}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{children:'kube-controller-manager-arg:\n - "service-account-private-key-file="\n'})})]}),"\n",(0,t.jsx)(r.h3,{id:"135-ensure-that-the---root-ca-file-argument-is-set-as-appropriate-automated",children:"1.3.5 Ensure that the --root-ca-file argument is set as appropriate (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s | grep 'Running kube-controller-manager' | tail -n1 | grep 'root-ca-file'\n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," '--root-ca-file' is present"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:'Aug 09 19:01:28 server-0 k3s[2354]: time="2024-08-09T19:01:28Z" level=info msg="Running kube-controller-manager --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/k3s/server/tls/client-ca.nochain.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/k3s/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/k3s/server/tls/client-ca.nochain.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/k3s/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/k3s/server/tls/server-ca.nochain.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/k3s/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/k3s/server/tls/server-ca.nochain.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/k3s/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,tokencleaner,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/k3s/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --terminated-pod-gc-threshold=10 --use-service-account-credentials=true"\n'})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsx)(r.p,{children:"By default, K3s automatically provides the root CA file.\nIt is generated and located at /var/lib/rancher/k3s/server/tls/server-ca.crt.\nIf this check fails, edit the K3s config file /etc/rancher/k3s/config.yaml and remove any lines like below."}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{children:'kube-controller-manager-arg:\n - "root-ca-file="\n'})})]}),"\n",(0,t.jsx)(r.h3,{id:"136-ensure-that-the-rotatekubeletservercertificate-argument-is-set-to-true-automated",children:"1.3.6 Ensure that the RotateKubeletServerCertificate argument is set to true (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s | grep 'Running kube-controller-manager' | tail -n1\n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," '--feature-gates' does not have 'RotateKubeletServerCertificate=false' OR '--feature-gates' is not present"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:'Aug 09 19:01:28 server-0 k3s[2354]: time="2024-08-09T19:01:28Z" level=info msg="Running kube-controller-manager --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/k3s/server/tls/client-ca.nochain.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/k3s/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/k3s/server/tls/client-ca.nochain.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/k3s/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/k3s/server/tls/server-ca.nochain.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/k3s/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/k3s/server/tls/server-ca.nochain.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/k3s/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,tokencleaner,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/k3s/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --terminated-pod-gc-threshold=10 --use-service-account-credentials=true"\n'})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsx)(r.p,{children:"By default, K3s does not set the RotateKubeletServerCertificate feature gate.\nIf you have enabled this feature gate, you should remove it.\nIf this check fails, edit the K3s config file /etc/rancher/k3s/config.yaml, remove any lines like below."}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{children:'kube-controller-manager-arg:\n - "feature-gate=RotateKubeletServerCertificate"\n'})})]}),"\n",(0,t.jsx)(r.h3,{id:"137-ensure-that-the---bind-address-argument-is-set-to-127001-automated",children:"1.3.7 Ensure that the --bind-address argument is set to 127.0.0.1 (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"/bin/ps -ef | grep containerd | grep -v grep\n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," '--bind-address' is present OR '--bind-address' is not present"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:"root 2372 2354 4 19:01 ? 00:00:05 containerd -c /var/lib/rancher/k3s/agent/etc/containerd/config.toml -a /run/k3s/containerd/containerd.sock --state /run/k3s/containerd --root /var/lib/rancher/k3s/agent/containerd\nroot 3128 1 0 19:01 ? 00:00:00 /var/lib/rancher/k3s/data/0f1a87835be3817408b496b439fddb9ea54cab4298db472792bb1b1cbdc210bc/bin/containerd-shim-runc-v2 -namespace k8s.io -id 878d74b0d77d904ec40cd1db71956f2edeb68ab420227a5a42e6d25f249a140a -address /run/k3s/containerd/containerd.sock\nroot 3239 1 0 19:01 ? 00:00:00 /var/lib/rancher/k3s/data/0f1a87835be3817408b496b439fddb9ea54cab4298db472792bb1b1cbdc210bc/bin/containerd-shim-runc-v2 -namespace k8s.io -id d00cc363af40aee36210e396597e4c02712ae99535be21d204849dc33a22af88 -address /run/k3s/containerd/containerd.sock\nroot 3293 1 0 19:01 ? 00:00:00 /var/lib/rancher/k3s/data/0f1a87835be3817408b496b439fddb9ea54cab4298db472792bb1b1cbdc210bc/bin/containerd-shim-runc-v2 -namespace k8s.io -id 5df076fa9547c555a2231b9a9a7cbb44021eaa1ab68c9b59b13da960697143f6 -address /run/k3s/containerd/containerd.sock\nroot 4557 1 0 19:02 ? 00:00:00 /var/lib/rancher/k3s/data/0f1a87835be3817408b496b439fddb9ea54cab4298db472792bb1b1cbdc210bc/bin/containerd-shim-runc-v2 -namespace k8s.io -id f6483b71bcb7ea23356003921a7d90cf638b8f9e473728f3b28dc67163e0fa2d -address /run/k3s/containerd/containerd.sock\nroot 4644 1 0 19:02 ? 00:00:00 /var/lib/rancher/k3s/data/0f1a87835be3817408b496b439fddb9ea54cab4298db472792bb1b1cbdc210bc/bin/containerd-shim-runc-v2 -namespace k8s.io -id 4d8ceb2620c4e0501a49dc9192fc56d035e76bc79a2c6072fee8619730006233 -address /run/k3s/containerd/containerd.sock\n"})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsx)(r.p,{children:"By default, K3s sets the --bind-address argument to 127.0.0.1\nIf this check fails, edit the K3s config file /etc/rancher/k3s/config.yaml and remove any lines like below."}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{children:'kube-controller-manager-arg:\n - "bind-address="\n'})})]}),"\n",(0,t.jsx)(r.h2,{id:"14-scheduler",children:"1.4 Scheduler"}),"\n",(0,t.jsx)(r.h3,{id:"141-ensure-that-the---profiling-argument-is-set-to-false-automated",children:"1.4.1 Ensure that the --profiling argument is set to false (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"journalctl -D /var/log/journal -u k3s | grep 'Running kube-scheduler' | tail -n1\n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," '--profiling' is equal to 'false'"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:'Aug 09 19:01:28 server-0 k3s[2354]: time="2024-08-09T19:01:28Z" level=info msg="Running kube-scheduler --authentication-kubeconfig=/var/lib/rancher/k3s/server/cred/scheduler.kubeconfig --authorization-kubeconfig=/var/lib/rancher/k3s/server/cred/scheduler.kubeconfig --bind-address=127.0.0.1 --kubeconfig=/var/lib/rancher/k3s/server/cred/scheduler.kubeconfig --profiling=false --secure-port=10259"\n'})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsx)(r.p,{children:"By default, K3s sets the --profiling argument to false.\nIf this check fails, edit the K3s config file /etc/rancher/k3s/config.yaml and remove any lines like below."}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{children:'kube-scheduler-arg:\n - "profiling=true"\n'})})]}),"\n",(0,t.jsx)(r.h3,{id:"142-ensure-that-the---bind-address-argument-is-set-to-127001-automated",children:"1.4.2 Ensure that the --bind-address argument is set to 127.0.0.1 (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s | grep 'Running kube-scheduler' | tail -n1 | grep 'bind-address'\n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," '--bind-address' is equal to '127.0.0.1' OR '--bind-address' is not present"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:'Aug 09 19:01:28 server-0 k3s[2354]: time="2024-08-09T19:01:28Z" level=info msg="Running kube-scheduler --authentication-kubeconfig=/var/lib/rancher/k3s/server/cred/scheduler.kubeconfig --authorization-kubeconfig=/var/lib/rancher/k3s/server/cred/scheduler.kubeconfig --bind-address=127.0.0.1 --kubeconfig=/var/lib/rancher/k3s/server/cred/scheduler.kubeconfig --profiling=false --secure-port=10259"\n'})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsx)(r.p,{children:"By default, K3s sets the --bind-address argument to 127.0.0.1\nIf this check fails, edit the K3s config file /etc/rancher/k3s/config.yaml and remove any lines like below."}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{children:'kube-scheduler-arg:\n - "bind-address="\n'})})]}),"\n",(0,t.jsx)(r.h2,{id:"2-etcd-node-configuration",children:"2 Etcd Node Configuration"}),"\n",(0,t.jsx)(r.h3,{id:"21-ensure-that-the---cert-file-and---key-file-arguments-are-set-as-appropriate-automated",children:"2.1 Ensure that the --cert-file and --key-file arguments are set as appropriate (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," '.client-transport-security.cert-file' is equal to '/var/lib/rancher/k3s/server/tls/etcd/server-client.crt' AND '.client-transport-security.key-file' is equal to '/var/lib/rancher/k3s/server/tls/etcd/server-client.key'"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:"advertise-client-urls: https://10.10.10.100:2379\nclient-transport-security:\n cert-file: /var/lib/rancher/k3s/server/tls/etcd/server-client.crt\n client-cert-auth: true\n key-file: /var/lib/rancher/k3s/server/tls/etcd/server-client.key\n trusted-ca-file: /var/lib/rancher/k3s/server/tls/etcd/server-ca.crt\ndata-dir: /var/lib/rancher/k3s/server/db/etcd\nelection-timeout: 5000\nexperimental-initial-corrupt-check: true\nheartbeat-interval: 500\ninitial-advertise-peer-urls: https://10.10.10.100:2380\ninitial-cluster: server-0-4a89bd20=https://10.10.10.100:2380\ninitial-cluster-state: new\nlisten-client-http-urls: https://127.0.0.1:2382\nlisten-client-urls: https://127.0.0.1:2379,https://10.10.10.100:2379\nlisten-metrics-urls: http://127.0.0.1:2381\nlisten-peer-urls: https://127.0.0.1:2380,https://10.10.10.100:2380\nlog-outputs:\n- stderr\nlogger: zap\nname: server-0-4a89bd20\npeer-transport-security:\n cert-file: /var/lib/rancher/k3s/server/tls/etcd/peer-server-client.crt\n client-cert-auth: true\n key-file: /var/lib/rancher/k3s/server/tls/etcd/peer-server-client.key\n trusted-ca-file: /var/lib/rancher/k3s/server/tls/etcd/peer-ca.crt\nsnapshot-count: 10000\n"})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsx)(r.p,{children:"If running on with sqlite or a external DB, etcd checks are Not Applicable.\nWhen running with embedded-etcd, K3s generates cert and key files for etcd.\nThese are located in /var/lib/rancher/k3s/server/tls/etcd/.\nIf this check fails, ensure that the configuration file /var/lib/rancher/k3s/server/db/etcd/config\nhas not been modified to use custom cert and key files."})]}),"\n",(0,t.jsx)(r.h3,{id:"22-ensure-that-the---client-cert-auth-argument-is-set-to-true-automated",children:"2.2 Ensure that the --client-cert-auth argument is set to true (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," '.client-transport-security.client-cert-auth' is equal to 'true'"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:"advertise-client-urls: https://10.10.10.100:2379\nclient-transport-security:\n cert-file: /var/lib/rancher/k3s/server/tls/etcd/server-client.crt\n client-cert-auth: true\n key-file: /var/lib/rancher/k3s/server/tls/etcd/server-client.key\n trusted-ca-file: /var/lib/rancher/k3s/server/tls/etcd/server-ca.crt\ndata-dir: /var/lib/rancher/k3s/server/db/etcd\nelection-timeout: 5000\nexperimental-initial-corrupt-check: true\nheartbeat-interval: 500\ninitial-advertise-peer-urls: https://10.10.10.100:2380\ninitial-cluster: server-0-4a89bd20=https://10.10.10.100:2380\ninitial-cluster-state: new\nlisten-client-http-urls: https://127.0.0.1:2382\nlisten-client-urls: https://127.0.0.1:2379,https://10.10.10.100:2379\nlisten-metrics-urls: http://127.0.0.1:2381\nlisten-peer-urls: https://127.0.0.1:2380,https://10.10.10.100:2380\nlog-outputs:\n- stderr\nlogger: zap\nname: server-0-4a89bd20\npeer-transport-security:\n cert-file: /var/lib/rancher/k3s/server/tls/etcd/peer-server-client.crt\n client-cert-auth: true\n key-file: /var/lib/rancher/k3s/server/tls/etcd/peer-server-client.key\n trusted-ca-file: /var/lib/rancher/k3s/server/tls/etcd/peer-ca.crt\nsnapshot-count: 10000\n"})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsx)(r.p,{children:"If running on with sqlite or a external DB, etcd checks are Not Applicable.\nWhen running with embedded-etcd, K3s sets the --client-cert-auth parameter to true.\nIf this check fails, ensure that the configuration file /var/lib/rancher/k3s/server/db/etcd/config\nhas not been modified to disable client certificate authentication."})]}),"\n",(0,t.jsx)(r.h3,{id:"23-ensure-that-the---auto-tls-argument-is-not-set-to-true-automated",children:"2.3 Ensure that the --auto-tls argument is not set to true (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," '.client-transport-security.auto-tls' is present OR '.client-transport-security.auto-tls' is not present"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:"advertise-client-urls: https://10.10.10.100:2379\nclient-transport-security:\n cert-file: /var/lib/rancher/k3s/server/tls/etcd/server-client.crt\n client-cert-auth: true\n key-file: /var/lib/rancher/k3s/server/tls/etcd/server-client.key\n trusted-ca-file: /var/lib/rancher/k3s/server/tls/etcd/server-ca.crt\ndata-dir: /var/lib/rancher/k3s/server/db/etcd\nelection-timeout: 5000\nexperimental-initial-corrupt-check: true\nheartbeat-interval: 500\ninitial-advertise-peer-urls: https://10.10.10.100:2380\ninitial-cluster: server-0-4a89bd20=https://10.10.10.100:2380\ninitial-cluster-state: new\nlisten-client-http-urls: https://127.0.0.1:2382\nlisten-client-urls: https://127.0.0.1:2379,https://10.10.10.100:2379\nlisten-metrics-urls: http://127.0.0.1:2381\nlisten-peer-urls: https://127.0.0.1:2380,https://10.10.10.100:2380\nlog-outputs:\n- stderr\nlogger: zap\nname: server-0-4a89bd20\npeer-transport-security:\n cert-file: /var/lib/rancher/k3s/server/tls/etcd/peer-server-client.crt\n client-cert-auth: true\n key-file: /var/lib/rancher/k3s/server/tls/etcd/peer-server-client.key\n trusted-ca-file: /var/lib/rancher/k3s/server/tls/etcd/peer-ca.crt\nsnapshot-count: 10000\n"})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsx)(r.p,{children:"If running on with sqlite or a external DB, etcd checks are Not Applicable.\nWhen running with embedded-etcd, K3s does not set the --auto-tls parameter.\nIf this check fails, edit the etcd pod specification file /var/lib/rancher/k3s/server/db/etcd/config on the master\nnode and either remove the --auto-tls parameter or set it to false.\nclient-transport-security:\nauto-tls: false"})]}),"\n",(0,t.jsx)(r.h3,{id:"24-ensure-that-the---peer-cert-file-and---peer-key-file-arguments-are-set-as-appropriate-automated",children:"2.4 Ensure that the --peer-cert-file and --peer-key-file arguments are set as appropriate (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," '.peer-transport-security.cert-file' is equal to '/var/lib/rancher/k3s/server/tls/etcd/peer-server-client.crt' AND '.peer-transport-security.key-file' is equal to '/var/lib/rancher/k3s/server/tls/etcd/peer-server-client.key'"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:"advertise-client-urls: https://10.10.10.100:2379\nclient-transport-security:\n cert-file: /var/lib/rancher/k3s/server/tls/etcd/server-client.crt\n client-cert-auth: true\n key-file: /var/lib/rancher/k3s/server/tls/etcd/server-client.key\n trusted-ca-file: /var/lib/rancher/k3s/server/tls/etcd/server-ca.crt\ndata-dir: /var/lib/rancher/k3s/server/db/etcd\nelection-timeout: 5000\nexperimental-initial-corrupt-check: true\nheartbeat-interval: 500\ninitial-advertise-peer-urls: https://10.10.10.100:2380\ninitial-cluster: server-0-4a89bd20=https://10.10.10.100:2380\ninitial-cluster-state: new\nlisten-client-http-urls: https://127.0.0.1:2382\nlisten-client-urls: https://127.0.0.1:2379,https://10.10.10.100:2379\nlisten-metrics-urls: http://127.0.0.1:2381\nlisten-peer-urls: https://127.0.0.1:2380,https://10.10.10.100:2380\nlog-outputs:\n- stderr\nlogger: zap\nname: server-0-4a89bd20\npeer-transport-security:\n cert-file: /var/lib/rancher/k3s/server/tls/etcd/peer-server-client.crt\n client-cert-auth: true\n key-file: /var/lib/rancher/k3s/server/tls/etcd/peer-server-client.key\n trusted-ca-file: /var/lib/rancher/k3s/server/tls/etcd/peer-ca.crt\nsnapshot-count: 10000\n"})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsx)(r.p,{children:"If running on with sqlite or a external DB, etcd checks are Not Applicable.\nWhen running with embedded-etcd, K3s generates peer cert and key files for etcd.\nThese are located in /var/lib/rancher/k3s/server/tls/etcd/.\nIf this check fails, ensure that the configuration file /var/lib/rancher/k3s/server/db/etcd/config\nhas not been modified to use custom peer cert and key files."})]}),"\n",(0,t.jsx)(r.h3,{id:"25-ensure-that-the---peer-client-cert-auth-argument-is-set-to-true-automated",children:"2.5 Ensure that the --peer-client-cert-auth argument is set to true (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," '.peer-transport-security.client-cert-auth' is equal to 'true'"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:"advertise-client-urls: https://10.10.10.100:2379\nclient-transport-security:\n cert-file: /var/lib/rancher/k3s/server/tls/etcd/server-client.crt\n client-cert-auth: true\n key-file: /var/lib/rancher/k3s/server/tls/etcd/server-client.key\n trusted-ca-file: /var/lib/rancher/k3s/server/tls/etcd/server-ca.crt\ndata-dir: /var/lib/rancher/k3s/server/db/etcd\nelection-timeout: 5000\nexperimental-initial-corrupt-check: true\nheartbeat-interval: 500\ninitial-advertise-peer-urls: https://10.10.10.100:2380\ninitial-cluster: server-0-4a89bd20=https://10.10.10.100:2380\ninitial-cluster-state: new\nlisten-client-http-urls: https://127.0.0.1:2382\nlisten-client-urls: https://127.0.0.1:2379,https://10.10.10.100:2379\nlisten-metrics-urls: http://127.0.0.1:2381\nlisten-peer-urls: https://127.0.0.1:2380,https://10.10.10.100:2380\nlog-outputs:\n- stderr\nlogger: zap\nname: server-0-4a89bd20\npeer-transport-security:\n cert-file: /var/lib/rancher/k3s/server/tls/etcd/peer-server-client.crt\n client-cert-auth: true\n key-file: /var/lib/rancher/k3s/server/tls/etcd/peer-server-client.key\n trusted-ca-file: /var/lib/rancher/k3s/server/tls/etcd/peer-ca.crt\nsnapshot-count: 10000\n"})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsx)(r.p,{children:"If running on with sqlite or a external DB, etcd checks are Not Applicable.\nWhen running with embedded-etcd, K3s sets the --peer-cert-auth parameter to true.\nIf this check fails, ensure that the configuration file /var/lib/rancher/k3s/server/db/etcd/config\nhas not been modified to disable peer client certificate authentication."})]}),"\n",(0,t.jsx)(r.h3,{id:"26-ensure-that-the---peer-auto-tls-argument-is-not-set-to-true-automated",children:"2.6 Ensure that the --peer-auto-tls argument is not set to true (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," '.peer-transport-security.auto-tls' is present OR '.peer-transport-security.auto-tls' is not present"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:"advertise-client-urls: https://10.10.10.100:2379\nclient-transport-security:\n cert-file: /var/lib/rancher/k3s/server/tls/etcd/server-client.crt\n client-cert-auth: true\n key-file: /var/lib/rancher/k3s/server/tls/etcd/server-client.key\n trusted-ca-file: /var/lib/rancher/k3s/server/tls/etcd/server-ca.crt\ndata-dir: /var/lib/rancher/k3s/server/db/etcd\nelection-timeout: 5000\nexperimental-initial-corrupt-check: true\nheartbeat-interval: 500\ninitial-advertise-peer-urls: https://10.10.10.100:2380\ninitial-cluster: server-0-4a89bd20=https://10.10.10.100:2380\ninitial-cluster-state: new\nlisten-client-http-urls: https://127.0.0.1:2382\nlisten-client-urls: https://127.0.0.1:2379,https://10.10.10.100:2379\nlisten-metrics-urls: http://127.0.0.1:2381\nlisten-peer-urls: https://127.0.0.1:2380,https://10.10.10.100:2380\nlog-outputs:\n- stderr\nlogger: zap\nname: server-0-4a89bd20\npeer-transport-security:\n cert-file: /var/lib/rancher/k3s/server/tls/etcd/peer-server-client.crt\n client-cert-auth: true\n key-file: /var/lib/rancher/k3s/server/tls/etcd/peer-server-client.key\n trusted-ca-file: /var/lib/rancher/k3s/server/tls/etcd/peer-ca.crt\nsnapshot-count: 10000\n"})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsx)(r.p,{children:"If running on with sqlite or a external DB, etcd checks are Not Applicable.\nWhen running with embedded-etcd, K3s does not set the --peer-auto-tls parameter.\nIf this check fails, edit the etcd pod specification file /var/lib/rancher/k3s/server/db/etcd/config on the master\nnode and either remove the --peer-auto-tls parameter or set it to false.\npeer-transport-security:\nauto-tls: false"})]}),"\n",(0,t.jsx)(r.h3,{id:"27-ensure-that-a-unique-certificate-authority-is-used-for-etcd-automated",children:"2.7 Ensure that a unique Certificate Authority is used for etcd (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," '.peer-transport-security.trusted-ca-file' is equal to '/var/lib/rancher/k3s/server/tls/etcd/peer-ca.crt'"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:"advertise-client-urls: https://10.10.10.100:2379\nclient-transport-security:\n cert-file: /var/lib/rancher/k3s/server/tls/etcd/server-client.crt\n client-cert-auth: true\n key-file: /var/lib/rancher/k3s/server/tls/etcd/server-client.key\n trusted-ca-file: /var/lib/rancher/k3s/server/tls/etcd/server-ca.crt\ndata-dir: /var/lib/rancher/k3s/server/db/etcd\nelection-timeout: 5000\nexperimental-initial-corrupt-check: true\nheartbeat-interval: 500\ninitial-advertise-peer-urls: https://10.10.10.100:2380\ninitial-cluster: server-0-4a89bd20=https://10.10.10.100:2380\ninitial-cluster-state: new\nlisten-client-http-urls: https://127.0.0.1:2382\nlisten-client-urls: https://127.0.0.1:2379,https://10.10.10.100:2379\nlisten-metrics-urls: http://127.0.0.1:2381\nlisten-peer-urls: https://127.0.0.1:2380,https://10.10.10.100:2380\nlog-outputs:\n- stderr\nlogger: zap\nname: server-0-4a89bd20\npeer-transport-security:\n cert-file: /var/lib/rancher/k3s/server/tls/etcd/peer-server-client.crt\n client-cert-auth: true\n key-file: /var/lib/rancher/k3s/server/tls/etcd/peer-server-client.key\n trusted-ca-file: /var/lib/rancher/k3s/server/tls/etcd/peer-ca.crt\nsnapshot-count: 10000\n"})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsx)(r.p,{children:"If running on with sqlite or a external DB, etcd checks are Not Applicable.\nWhen running with embedded-etcd, K3s generates a unique certificate authority for etcd.\nThis is located at /var/lib/rancher/k3s/server/tls/etcd/peer-ca.crt.\nIf this check fails, ensure that the configuration file /var/lib/rancher/k3s/server/db/etcd/config\nhas not been modified to use a shared certificate authority."})]}),"\n",(0,t.jsx)(r.h2,{id:"41-worker-node-configuration-files",children:"4.1 Worker Node Configuration Files"}),"\n",(0,t.jsx)(r.h3,{id:"411-ensure-that-the-kubelet-service-file-permissions-are-set-to-600-or-more-restrictive-automated",children:"4.1.1 Ensure that the kubelet service file permissions are set to 600 or more restrictive (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," Not Applicable"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Rationale:"})}),"\n",(0,t.jsx)(r.p,{children:"The kubelet is embedded in the k3s process. There is no kubelet service file, all configuration is passed in as arguments at runtime."}),"\n",(0,t.jsxs)(r.h3,{id:"412-ensure-that-the-kubelet-service-file-ownership-is-set-to-root-automated",children:["4.1.2 Ensure that the kubelet service file ownership is set to root",":root"," (Automated)"]}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," Not Applicable"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Rationale:"})}),"\n",(0,t.jsx)(r.p,{children:"The kubelet is embedded in the k3s process. There is no kubelet service file, all configuration is passed in as arguments at runtime."}),"\n",(0,t.jsx)(r.p,{children:"All configuration is passed in as arguments at container run time."}),"\n",(0,t.jsx)(r.h3,{id:"413-if-proxy-kubeconfig-file-exists-ensure-permissions-are-set-to-600-or-more-restrictive-automated",children:"4.1.3 If proxy kubeconfig file exists ensure permissions are set to 600 or more restrictive (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"/bin/sh -c 'if test -e /var/lib/rancher/k3s/agent/kubeproxy.kubeconfig; then stat -c permissions=%a /var/lib/rancher/k3s/agent/kubeproxy.kubeconfig; fi' \n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," permissions has permissions 600, expected 600 or more restrictive"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:"permissions=600\n"})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsxs)(r.p,{children:["Run the below command (based on the file location on your system) on the each worker node.\nFor example,\n",(0,t.jsx)(r.code,{children:"chmod 600 /var/lib/rancher/k3s/agent/kubeproxy.kubeconfig"})]})]}),"\n",(0,t.jsxs)(r.h3,{id:"414-if-proxy-kubeconfig-file-exists-ensure-ownership-is-set-to-root-automated",children:["4.1.4 If proxy kubeconfig file exists ensure ownership is set to root",":root"," (Automated)"]}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"/bin/sh -c 'if test -e /var/lib/rancher/k3s/agent/kubeproxy.kubeconfig; then stat -c %U:%G /var/lib/rancher/k3s/agent/kubeproxy.kubeconfig; fi' \n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," 'root",":root","' is present"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:"root:root\n"})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsxs)(r.p,{children:["Run the below command (based on the file location on your system) on the each worker node.\nFor example, ",(0,t.jsx)(r.code,{children:"chown root:root /var/lib/rancher/k3s/agent/kubeproxy.kubeconfig"})]})]}),"\n",(0,t.jsx)(r.h3,{id:"415-ensure-that-the---kubeconfig-kubeletconf-file-permissions-are-set-to-600-or-more-restrictive-automated",children:"4.1.5 Ensure that the --kubeconfig kubelet.conf file permissions are set to 600 or more restrictive (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"/bin/sh -c 'if test -e /var/lib/rancher/k3s/agent/kubelet.kubeconfig; then stat -c permissions=%a /var/lib/rancher/k3s/agent/kubelet.kubeconfig; fi' \n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," permissions has permissions 600, expected 600 or more restrictive"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:"permissions=600\n"})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsxs)(r.p,{children:["Run the below command (based on the file location on your system) on the each worker node.\nFor example,\n",(0,t.jsx)(r.code,{children:"chmod 600 /var/lib/rancher/k3s/agent/kubelet.kubeconfig"})]})]}),"\n",(0,t.jsxs)(r.h3,{id:"416-ensure-that-the---kubeconfig-kubeletconf-file-ownership-is-set-to-root-automated",children:["4.1.6 Ensure that the --kubeconfig kubelet.conf file ownership is set to root",":root"," (Automated)"]}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"stat -c %U:%G /var/lib/rancher/k3s/agent/kubelet.kubeconfig\n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," 'root",":root","' is present"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:"root:root\n"})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsxs)(r.p,{children:["Run the below command (based on the file location on your system) on the each worker node.\nFor example,\n",(0,t.jsx)(r.code,{children:"chown root:root /var/lib/rancher/k3s/agent/kubelet.kubeconfig"})]})]}),"\n",(0,t.jsx)(r.h3,{id:"417-ensure-that-the-certificate-authorities-file-permissions-are-set-to-600-or-more-restrictive-automated",children:"4.1.7 Ensure that the certificate authorities file permissions are set to 600 or more restrictive (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"stat -c permissions=%a /var/lib/rancher/k3s/agent/client-ca.crt\n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," permissions has permissions 600, expected 600 or more restrictive"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:"permissions=600\n"})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsxs)(r.p,{children:["Run the following command to modify the file permissions of the\n--client-ca-file ",(0,t.jsx)(r.code,{children:"chmod 600 /var/lib/rancher/k3s/agent/client-ca.crt"})]})]}),"\n",(0,t.jsxs)(r.h3,{id:"418-ensure-that-the-client-certificate-authorities-file-ownership-is-set-to-root-automated",children:["4.1.8 Ensure that the client certificate authorities file ownership is set to root",":root"," (Automated)"]}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"stat -c %U:%G /var/lib/rancher/k3s/agent/client-ca.crt\n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," 'root",":root","' is equal to 'root",":root","'"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:"root:root\n"})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsxs)(r.p,{children:["Run the following command to modify the ownership of the --client-ca-file.\n",(0,t.jsx)(r.code,{children:"chown root:root /var/lib/rancher/k3s/agent/client-ca.crt"})]})]}),"\n",(0,t.jsx)(r.h3,{id:"419-ensure-that-the-kubelet---config-configuration-file-has-permissions-set-to-600-or-more-restrictive-automated",children:"4.1.9 Ensure that the kubelet --config configuration file has permissions set to 600 or more restrictive (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," Not Applicable"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Rationale:"})}),"\n",(0,t.jsx)(r.p,{children:"The kubelet is embedded in the k3s process. There is no kubelet config file, all configuration is passed in as arguments at runtime."}),"\n",(0,t.jsxs)(r.h3,{id:"4110-ensure-that-the-kubelet---config-configuration-file-ownership-is-set-to-root-automated",children:["4.1.10 Ensure that the kubelet --config configuration file ownership is set to root",":root"," (Automated)"]}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," Not Applicable"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Rationale:"})}),"\n",(0,t.jsx)(r.p,{children:"The kubelet is embedded in the k3s process. There is no kubelet config file, all configuration is passed in as arguments at runtime."}),"\n",(0,t.jsx)(r.h2,{id:"42-kubelet",children:"4.2 Kubelet"}),"\n",(0,t.jsx)(r.h3,{id:"421-ensure-that-the---anonymous-auth-argument-is-set-to-false-automated",children:"4.2.1 Ensure that the --anonymous-auth argument is set to false (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:'/bin/sh -c \'if test $(journalctl -D /var/log/journal -u k3s | grep "Running kube-apiserver" | wc -l) -gt 0; then journalctl -D /var/log/journal -u k3s | grep "Running kube-apiserver" | tail -n1 | grep "anonymous-auth" | grep -v grep; else echo "--anonymous-auth=false"; fi\' \n'})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," '--anonymous-auth' is equal to 'false'"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:'Aug 09 19:01:28 server-0 k3s[2354]: time="2024-08-09T19:01:28Z" level=info msg="Running kube-apiserver --admission-control-config-file=/var/lib/rancher/k3s/server/psa.yaml --advertise-address=10.10.10.100 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsx)(r.p,{children:"By default, K3s sets the --anonymous-auth to false. If you have set this to a different value, you\nshould set it back to false. If using the K3s config file /etc/rancher/k3s/config.yaml, remove any lines similar to below."}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{children:'kubelet-arg:\n - "anonymous-auth=true"\n'})}),(0,t.jsx)(r.p,{children:'If using the command line, edit the K3s service file and remove the below argument.\n--kubelet-arg="anonymous-auth=true"\nBased on your system, restart the k3s service. For example,\nsystemctl daemon-reload\nsystemctl restart k3s.service'})]}),"\n",(0,t.jsx)(r.h3,{id:"422-ensure-that-the---authorization-mode-argument-is-not-set-to-alwaysallow-automated",children:"4.2.2 Ensure that the --authorization-mode argument is not set to AlwaysAllow (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:'/bin/sh -c \'if test $(journalctl -D /var/log/journal -u k3s | grep "Running kube-apiserver" | wc -l) -gt 0; then journalctl -D /var/log/journal -u k3s | grep "Running kube-apiserver" | tail -n1 | grep "authorization-mode"; else echo "--authorization-mode=Webhook"; fi\' \n'})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," '--authorization-mode' does not have 'AlwaysAllow'"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:'Aug 09 19:01:28 server-0 k3s[2354]: time="2024-08-09T19:01:28Z" level=info msg="Running kube-apiserver --admission-control-config-file=/var/lib/rancher/k3s/server/psa.yaml --advertise-address=10.10.10.100 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsx)(r.p,{children:"By default, K3s does not set the --authorization-mode to AlwaysAllow.\nIf using the K3s config file /etc/rancher/k3s/config.yaml, remove any lines similar to below."}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{children:'kubelet-arg:\n - "authorization-mode=AlwaysAllow"\n'})}),(0,t.jsx)(r.p,{children:'If using the command line, edit the K3s service file and remove the below argument.\n--kubelet-arg="authorization-mode=AlwaysAllow"\nBased on your system, restart the k3s service. For example,\nsystemctl daemon-reload\nsystemctl restart k3s.service'})]}),"\n",(0,t.jsx)(r.h3,{id:"423-ensure-that-the---client-ca-file-argument-is-set-as-appropriate-automated",children:"4.2.3 Ensure that the --client-ca-file argument is set as appropriate (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:'/bin/sh -c \'if test $(journalctl -D /var/log/journal -u k3s | grep "Running kube-apiserver" | wc -l) -gt 0; then journalctl -D /var/log/journal -u k3s | grep "Running kube-apiserver" | tail -n1 | grep "client-ca-file"; else echo "--client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt"; fi\' \n'})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," '--client-ca-file' is present"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:'Aug 09 19:01:28 server-0 k3s[2354]: time="2024-08-09T19:01:28Z" level=info msg="Running kube-apiserver --admission-control-config-file=/var/lib/rancher/k3s/server/psa.yaml --advertise-address=10.10.10.100 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsx)(r.p,{children:"By default, K3s automatically provides the client ca certificate for the Kubelet.\nIt is generated and located at /var/lib/rancher/k3s/agent/client-ca.crt"})]}),"\n",(0,t.jsx)(r.h3,{id:"424-verify-that-the---read-only-port-argument-is-set-to-0-automated",children:"4.2.4 Verify that the --read-only-port argument is set to 0 (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s -u k3s-agent | grep 'Running kubelet' | tail -n1\n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," '--read-only-port' is equal to '0' OR '--read-only-port' is not present"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:'Aug 09 19:01:30 server-0 k3s[2354]: time="2024-08-09T19:01:30Z" level=info msg="Running kubelet --address=0.0.0.0 --allowed-unsafe-sysctls=net.ipv4.ip_forward,net.ipv6.conf.all.forwarding --anonymous-auth=false --authentication-token-webhook=true --authorization-mode=Webhook --cgroup-driver=systemd --client-ca-file=/var/lib/rancher/k3s/agent/client-ca.crt --cloud-provider=external --cluster-dns=10.43.0.10 --cluster-domain=cluster.local --container-runtime-endpoint=unix:///run/k3s/containerd/containerd.sock --containerd=/run/k3s/containerd/containerd.sock --event-qps=0 --eviction-hard=imagefs.available<5%,nodefs.available<5% --eviction-minimum-reclaim=imagefs.available=10%,nodefs.available=10% --fail-swap-on=false --healthz-bind-address=127.0.0.1 --hostname-override=server-0 --kubeconfig=/var/lib/rancher/k3s/agent/kubelet.kubeconfig --make-iptables-util-chains=true --node-ip=10.10.10.100 --node-labels= --pod-infra-container-image=rancher/mirrored-pause:3.6 --pod-manifest-path=/var/lib/rancher/k3s/agent/pod-manifests --protect-kernel-defaults=true --read-only-port=0 --resolv-conf=/run/systemd/resolve/resolv.conf --serialize-image-pulls=false --streaming-connection-idle-timeout=5m --tls-cert-file=/var/lib/rancher/k3s/agent/serving-kubelet.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/agent/serving-kubelet.key"\n'})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsx)(r.p,{children:"By default, K3s sets the --read-only-port to 0. If you have set this to a different value, you\nshould set it back to 0. If using the K3s config file /etc/rancher/k3s/config.yaml, remove any lines similar to below."}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{children:'kubelet-arg:\n - "read-only-port=XXXX"\n'})}),(0,t.jsx)(r.p,{children:'If using the command line, edit the K3s service file and remove the below argument.\n--kubelet-arg="read-only-port=XXXX"\nBased on your system, restart the k3s service. For example,\nsystemctl daemon-reload\nsystemctl restart k3s.service'})]}),"\n",(0,t.jsx)(r.h3,{id:"425-ensure-that-the---streaming-connection-idle-timeout-argument-is-not-set-to-0-manual",children:"4.2.5 Ensure that the --streaming-connection-idle-timeout argument is not set to 0 (Manual)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s -u k3s-agent | grep 'Running kubelet' | tail -n1\n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," '--streaming-connection-idle-timeout' is not equal to '0' OR '--streaming-connection-idle-timeout' is not present"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:'Aug 09 19:01:30 server-0 k3s[2354]: time="2024-08-09T19:01:30Z" level=info msg="Running kubelet --address=0.0.0.0 --allowed-unsafe-sysctls=net.ipv4.ip_forward,net.ipv6.conf.all.forwarding --anonymous-auth=false --authentication-token-webhook=true --authorization-mode=Webhook --cgroup-driver=systemd --client-ca-file=/var/lib/rancher/k3s/agent/client-ca.crt --cloud-provider=external --cluster-dns=10.43.0.10 --cluster-domain=cluster.local --container-runtime-endpoint=unix:///run/k3s/containerd/containerd.sock --containerd=/run/k3s/containerd/containerd.sock --event-qps=0 --eviction-hard=imagefs.available<5%,nodefs.available<5% --eviction-minimum-reclaim=imagefs.available=10%,nodefs.available=10% --fail-swap-on=false --healthz-bind-address=127.0.0.1 --hostname-override=server-0 --kubeconfig=/var/lib/rancher/k3s/agent/kubelet.kubeconfig --make-iptables-util-chains=true --node-ip=10.10.10.100 --node-labels= --pod-infra-container-image=rancher/mirrored-pause:3.6 --pod-manifest-path=/var/lib/rancher/k3s/agent/pod-manifests --protect-kernel-defaults=true --read-only-port=0 --resolv-conf=/run/systemd/resolve/resolv.conf --serialize-image-pulls=false --streaming-connection-idle-timeout=5m --tls-cert-file=/var/lib/rancher/k3s/agent/serving-kubelet.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/agent/serving-kubelet.key"\n'})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsx)(r.p,{children:"If using the K3s config file /etc/rancher/k3s/config.yaml, set the following parameter to an appropriate value."}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{children:'kubelet-arg:\n - "streaming-connection-idle-timeout=5m"\n'})}),(0,t.jsx)(r.p,{children:'If using the command line, run K3s with --kubelet-arg="streaming-connection-idle-timeout=5m".\nBased on your system, restart the k3s service. For example,\nsystemctl restart k3s.service'})]}),"\n",(0,t.jsx)(r.h3,{id:"426-ensure-that-the---make-iptables-util-chains-argument-is-set-to-true-automated",children:"4.2.6 Ensure that the --make-iptables-util-chains argument is set to true (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s -u k3s-agent | grep 'Running kubelet' | tail -n1\n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," '--make-iptables-util-chains' is equal to 'true' OR '--make-iptables-util-chains' is not present"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:'Aug 09 19:01:30 server-0 k3s[2354]: time="2024-08-09T19:01:30Z" level=info msg="Running kubelet --address=0.0.0.0 --allowed-unsafe-sysctls=net.ipv4.ip_forward,net.ipv6.conf.all.forwarding --anonymous-auth=false --authentication-token-webhook=true --authorization-mode=Webhook --cgroup-driver=systemd --client-ca-file=/var/lib/rancher/k3s/agent/client-ca.crt --cloud-provider=external --cluster-dns=10.43.0.10 --cluster-domain=cluster.local --container-runtime-endpoint=unix:///run/k3s/containerd/containerd.sock --containerd=/run/k3s/containerd/containerd.sock --event-qps=0 --eviction-hard=imagefs.available<5%,nodefs.available<5% --eviction-minimum-reclaim=imagefs.available=10%,nodefs.available=10% --fail-swap-on=false --healthz-bind-address=127.0.0.1 --hostname-override=server-0 --kubeconfig=/var/lib/rancher/k3s/agent/kubelet.kubeconfig --make-iptables-util-chains=true --node-ip=10.10.10.100 --node-labels= --pod-infra-container-image=rancher/mirrored-pause:3.6 --pod-manifest-path=/var/lib/rancher/k3s/agent/pod-manifests --protect-kernel-defaults=true --read-only-port=0 --resolv-conf=/run/systemd/resolve/resolv.conf --serialize-image-pulls=false --streaming-connection-idle-timeout=5m --tls-cert-file=/var/lib/rancher/k3s/agent/serving-kubelet.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/agent/serving-kubelet.key"\n'})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsx)(r.p,{children:"If using the K3s config file /etc/rancher/k3s/config.yaml, set the following parameter."}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{children:'kubelet-arg:\n - "make-iptables-util-chains=true"\n'})}),(0,t.jsx)(r.p,{children:'If using the command line, run K3s with --kubelet-arg="make-iptables-util-chains=true".\nBased on your system, restart the k3s service. For example,\nsystemctl restart k3s.service'})]}),"\n",(0,t.jsx)(r.h3,{id:"427-ensure-that-the---hostname-override-argument-is-not-set-automated",children:"4.2.7 Ensure that the --hostname-override argument is not set (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," Not Applicable"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Rationale:"})}),"\n",(0,t.jsx)(r.p,{children:"By default, K3s does set the --hostname-override argument. Per CIS guidelines, this is to comply\nwith cloud providers that require this flag to ensure that hostname matches node names."}),"\n",(0,t.jsx)(r.h3,{id:"428-ensure-that-the-eventrecordqps-argument-is-set-to-a-level-which-ensures-appropriate-event-capture-manual",children:"4.2.8 Ensure that the eventRecordQPS argument is set to a level which ensures appropriate event capture (Manual)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s -u k3s-agent | grep 'Running kubelet' | tail -n1\n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," '--event-qps' is greater or equal to 0 OR '--event-qps' is not present"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:'Aug 09 19:01:30 server-0 k3s[2354]: time="2024-08-09T19:01:30Z" level=info msg="Running kubelet --address=0.0.0.0 --allowed-unsafe-sysctls=net.ipv4.ip_forward,net.ipv6.conf.all.forwarding --anonymous-auth=false --authentication-token-webhook=true --authorization-mode=Webhook --cgroup-driver=systemd --client-ca-file=/var/lib/rancher/k3s/agent/client-ca.crt --cloud-provider=external --cluster-dns=10.43.0.10 --cluster-domain=cluster.local --container-runtime-endpoint=unix:///run/k3s/containerd/containerd.sock --containerd=/run/k3s/containerd/containerd.sock --event-qps=0 --eviction-hard=imagefs.available<5%,nodefs.available<5% --eviction-minimum-reclaim=imagefs.available=10%,nodefs.available=10% --fail-swap-on=false --healthz-bind-address=127.0.0.1 --hostname-override=server-0 --kubeconfig=/var/lib/rancher/k3s/agent/kubelet.kubeconfig --make-iptables-util-chains=true --node-ip=10.10.10.100 --node-labels= --pod-infra-container-image=rancher/mirrored-pause:3.6 --pod-manifest-path=/var/lib/rancher/k3s/agent/pod-manifests --protect-kernel-defaults=true --read-only-port=0 --resolv-conf=/run/systemd/resolve/resolv.conf --serialize-image-pulls=false --streaming-connection-idle-timeout=5m --tls-cert-file=/var/lib/rancher/k3s/agent/serving-kubelet.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/agent/serving-kubelet.key"\n'})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsx)(r.p,{children:"By default, K3s sets the event-qps to 0. Should you wish to change this,\nIf using the K3s config file /etc/rancher/k3s/config.yaml, set the following parameter to an appropriate value."}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{children:'kubelet-arg:\n - "event-qps="\n'})}),(0,t.jsx)(r.p,{children:'If using the command line, run K3s with --kubelet-arg="event-qps=".\nBased on your system, restart the k3s service. For example,\nsystemctl restart k3s.service'})]}),"\n",(0,t.jsx)(r.h3,{id:"429-ensure-that-the---tls-cert-file-and---tls-private-key-file-arguments-are-set-as-appropriate-automated",children:"4.2.9 Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s -u k3s-agent | grep 'Running kubelet' | tail -n1\n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," '--tls-cert-file' is present AND '--tls-private-key-file' is present"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:'Aug 09 19:01:30 server-0 k3s[2354]: time="2024-08-09T19:01:30Z" level=info msg="Running kubelet --address=0.0.0.0 --allowed-unsafe-sysctls=net.ipv4.ip_forward,net.ipv6.conf.all.forwarding --anonymous-auth=false --authentication-token-webhook=true --authorization-mode=Webhook --cgroup-driver=systemd --client-ca-file=/var/lib/rancher/k3s/agent/client-ca.crt --cloud-provider=external --cluster-dns=10.43.0.10 --cluster-domain=cluster.local --container-runtime-endpoint=unix:///run/k3s/containerd/containerd.sock --containerd=/run/k3s/containerd/containerd.sock --event-qps=0 --eviction-hard=imagefs.available<5%,nodefs.available<5% --eviction-minimum-reclaim=imagefs.available=10%,nodefs.available=10% --fail-swap-on=false --healthz-bind-address=127.0.0.1 --hostname-override=server-0 --kubeconfig=/var/lib/rancher/k3s/agent/kubelet.kubeconfig --make-iptables-util-chains=true --node-ip=10.10.10.100 --node-labels= --pod-infra-container-image=rancher/mirrored-pause:3.6 --pod-manifest-path=/var/lib/rancher/k3s/agent/pod-manifests --protect-kernel-defaults=true --read-only-port=0 --resolv-conf=/run/systemd/resolve/resolv.conf --serialize-image-pulls=false --streaming-connection-idle-timeout=5m --tls-cert-file=/var/lib/rancher/k3s/agent/serving-kubelet.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/agent/serving-kubelet.key"\n'})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsx)(r.p,{children:"By default, K3s automatically provides the TLS certificate and private key for the Kubelet.\nThey are generated and located at /var/lib/rancher/k3s/agent/serving-kubelet.crt and /var/lib/rancher/k3s/agent/serving-kubelet.key\nIf for some reason you need to provide your own certificate and key, you can set the\nthe below parameters in the K3s config file /etc/rancher/k3s/config.yaml."}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{children:'kubelet-arg:\n - "tls-cert-file="\n - "tls-private-key-file="\n'})})]}),"\n",(0,t.jsx)(r.h3,{id:"4210-ensure-that-the---rotate-certificates-argument-is-not-set-to-false-automated",children:"4.2.10 Ensure that the --rotate-certificates argument is not set to false (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s -u k3s-agent | grep 'Running kubelet' | tail -n1\n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," '--rotate-certificates' is present OR '--rotate-certificates' is not present"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:'Aug 09 19:01:30 server-0 k3s[2354]: time="2024-08-09T19:01:30Z" level=info msg="Running kubelet --address=0.0.0.0 --allowed-unsafe-sysctls=net.ipv4.ip_forward,net.ipv6.conf.all.forwarding --anonymous-auth=false --authentication-token-webhook=true --authorization-mode=Webhook --cgroup-driver=systemd --client-ca-file=/var/lib/rancher/k3s/agent/client-ca.crt --cloud-provider=external --cluster-dns=10.43.0.10 --cluster-domain=cluster.local --container-runtime-endpoint=unix:///run/k3s/containerd/containerd.sock --containerd=/run/k3s/containerd/containerd.sock --event-qps=0 --eviction-hard=imagefs.available<5%,nodefs.available<5% --eviction-minimum-reclaim=imagefs.available=10%,nodefs.available=10% --fail-swap-on=false --healthz-bind-address=127.0.0.1 --hostname-override=server-0 --kubeconfig=/var/lib/rancher/k3s/agent/kubelet.kubeconfig --make-iptables-util-chains=true --node-ip=10.10.10.100 --node-labels= --pod-infra-container-image=rancher/mirrored-pause:3.6 --pod-manifest-path=/var/lib/rancher/k3s/agent/pod-manifests --protect-kernel-defaults=true --read-only-port=0 --resolv-conf=/run/systemd/resolve/resolv.conf --serialize-image-pulls=false --streaming-connection-idle-timeout=5m --tls-cert-file=/var/lib/rancher/k3s/agent/serving-kubelet.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/agent/serving-kubelet.key"\n'})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsxs)(r.p,{children:["By default, K3s does not set the --rotate-certificates argument. If you have set this flag with a value of ",(0,t.jsx)(r.code,{children:"false"}),", you should either set it to ",(0,t.jsx)(r.code,{children:"true"}),' or completely remove the flag.\nIf using the K3s config file /etc/rancher/k3s/config.yaml, remove any rotate-certificates parameter.\nIf using the command line, remove the K3s flag --kubelet-arg="rotate-certificates".\nBased on your system, restart the k3s service. For example,\nsystemctl restart k3s.service']})]}),"\n",(0,t.jsx)(r.h3,{id:"4211-verify-that-the-rotatekubeletservercertificate-argument-is-set-to-true-automated",children:"4.2.11 Verify that the RotateKubeletServerCertificate argument is set to true (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s -u k3s-agent | grep 'Running kubelet' | tail -n1\n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," 'RotateKubeletServerCertificate' is present OR 'RotateKubeletServerCertificate' is not present"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:'Aug 09 19:01:30 server-0 k3s[2354]: time="2024-08-09T19:01:30Z" level=info msg="Running kubelet --address=0.0.0.0 --allowed-unsafe-sysctls=net.ipv4.ip_forward,net.ipv6.conf.all.forwarding --anonymous-auth=false --authentication-token-webhook=true --authorization-mode=Webhook --cgroup-driver=systemd --client-ca-file=/var/lib/rancher/k3s/agent/client-ca.crt --cloud-provider=external --cluster-dns=10.43.0.10 --cluster-domain=cluster.local --container-runtime-endpoint=unix:///run/k3s/containerd/containerd.sock --containerd=/run/k3s/containerd/containerd.sock --event-qps=0 --eviction-hard=imagefs.available<5%,nodefs.available<5% --eviction-minimum-reclaim=imagefs.available=10%,nodefs.available=10% --fail-swap-on=false --healthz-bind-address=127.0.0.1 --hostname-override=server-0 --kubeconfig=/var/lib/rancher/k3s/agent/kubelet.kubeconfig --make-iptables-util-chains=true --node-ip=10.10.10.100 --node-labels= --pod-infra-container-image=rancher/mirrored-pause:3.6 --pod-manifest-path=/var/lib/rancher/k3s/agent/pod-manifests --protect-kernel-defaults=true --read-only-port=0 --resolv-conf=/run/systemd/resolve/resolv.conf --serialize-image-pulls=false --streaming-connection-idle-timeout=5m --tls-cert-file=/var/lib/rancher/k3s/agent/serving-kubelet.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/agent/serving-kubelet.key"\n'})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsx)(r.p,{children:'By default, K3s does not set the RotateKubeletServerCertificate feature gate.\nIf you have enabled this feature gate, you should remove it.\nIf using the K3s config file /etc/rancher/k3s/config.yaml, remove any feature-gate=RotateKubeletServerCertificate parameter.\nIf using the command line, remove the K3s flag --kubelet-arg="feature-gate=RotateKubeletServerCertificate".\nBased on your system, restart the k3s service. For example,\nsystemctl restart k3s.service'})]}),"\n",(0,t.jsx)(r.h3,{id:"4212-ensure-that-the-kubelet-only-makes-use-of-strong-cryptographic-ciphers-manual",children:"4.2.12 Ensure that the Kubelet only makes use of Strong Cryptographic Ciphers (Manual)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s -u k3s-agent | grep 'Running kubelet' | tail -n1\n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," '--tls-cipher-suites' contains valid elements from 'TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256'"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:'Aug 09 19:01:30 server-0 k3s[2354]: time="2024-08-09T19:01:30Z" level=info msg="Running kubelet --address=0.0.0.0 --allowed-unsafe-sysctls=net.ipv4.ip_forward,net.ipv6.conf.all.forwarding --anonymous-auth=false --authentication-token-webhook=true --authorization-mode=Webhook --cgroup-driver=systemd --client-ca-file=/var/lib/rancher/k3s/agent/client-ca.crt --cloud-provider=external --cluster-dns=10.43.0.10 --cluster-domain=cluster.local --container-runtime-endpoint=unix:///run/k3s/containerd/containerd.sock --containerd=/run/k3s/containerd/containerd.sock --event-qps=0 --eviction-hard=imagefs.available<5%,nodefs.available<5% --eviction-minimum-reclaim=imagefs.available=10%,nodefs.available=10% --fail-swap-on=false --healthz-bind-address=127.0.0.1 --hostname-override=server-0 --kubeconfig=/var/lib/rancher/k3s/agent/kubelet.kubeconfig --make-iptables-util-chains=true --node-ip=10.10.10.100 --node-labels= --pod-infra-container-image=rancher/mirrored-pause:3.6 --pod-manifest-path=/var/lib/rancher/k3s/agent/pod-manifests --protect-kernel-defaults=true --read-only-port=0 --resolv-conf=/run/systemd/resolve/resolv.conf --serialize-image-pulls=false --streaming-connection-idle-timeout=5m --tls-cert-file=/var/lib/rancher/k3s/agent/serving-kubelet.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/agent/serving-kubelet.key"\n'})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsxs)(r.p,{children:["If using a K3s config file /etc/rancher/k3s/config.yaml, edit the file to set ",(0,t.jsx)(r.code,{children:"TLSCipherSuites"})," to"]}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{children:'kubelet-arg:\n - "tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305"\n'})}),(0,t.jsx)(r.p,{children:'or to a subset of these values.\nIf using the command line, add the K3s flag --kubelet-arg="tls-cipher-suites="\nBased on your system, restart the k3s service. For example,\nsystemctl restart k3s.service'})]}),"\n",(0,t.jsx)(r.h3,{id:"4213-ensure-that-a-limit-is-set-on-pod-pids-manual",children:"4.2.13 Ensure that a limit is set on pod PIDs (Manual)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Remediation:"}),"\nDecide on an appropriate level for this parameter and set it,\nIf using a K3s config file /etc/rancher/k3s/config.yaml, edit the file to set ",(0,t.jsx)(r.code,{children:"podPidsLimit"})," to"]}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{children:'kubelet-arg:\n - "pod-max-pids="\n'})}),"\n",(0,t.jsx)(r.h2,{id:"51-rbac-and-service-accounts",children:"5.1 RBAC and Service Accounts"}),"\n",(0,t.jsx)(r.h3,{id:"511-ensure-that-the-cluster-admin-role-is-only-used-where-required-manual",children:"5.1.1 Ensure that the cluster-admin role is only used where required (Manual)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Remediation:"}),"\nIdentify all clusterrolebindings to the cluster-admin role. Check if they are used and\nif they need this role or if they could use a role with fewer privileges.\nWhere possible, first bind users to a lower privileged role and then remove the\nclusterrolebinding to the cluster-admin role :\nkubectl delete clusterrolebinding [name]"]}),"\n",(0,t.jsx)(r.h3,{id:"512-minimize-access-to-secrets-manual",children:"5.1.2 Minimize access to secrets (Manual)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Remediation:"}),"\nWhere possible, remove get, list and watch access to Secret objects in the cluster."]}),"\n",(0,t.jsx)(r.h3,{id:"513-minimize-wildcard-use-in-roles-and-clusterroles-manual",children:"5.1.3 Minimize wildcard use in Roles and ClusterRoles (Manual)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Remediation:"}),"\nWhere possible replace any use of wildcards in clusterroles and roles with specific\nobjects or actions."]}),"\n",(0,t.jsx)(r.h3,{id:"514-minimize-access-to-create-pods-manual",children:"5.1.4 Minimize access to create pods (Manual)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Remediation:"}),"\nWhere possible, remove create access to pod objects in the cluster."]}),"\n",(0,t.jsx)(r.h3,{id:"515-ensure-that-default-service-accounts-are-not-actively-used-manual",children:"5.1.5 Ensure that default service accounts are not actively used. (Manual)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Remediation:"}),"\nCreate explicit service accounts wherever a Kubernetes workload requires specific access\nto the Kubernetes API server.\nModify the configuration of each default service account to include this value\nautomountServiceAccountToken: false"]}),"\n",(0,t.jsx)(r.h3,{id:"516-ensure-that-service-account-tokens-are-only-mounted-where-necessary-manual",children:"5.1.6 Ensure that Service Account Tokens are only mounted where necessary (Manual)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Remediation:"}),"\nModify the definition of pods and service accounts which do not need to mount service\naccount tokens to disable it."]}),"\n",(0,t.jsxs)(r.h3,{id:"517-avoid-use-of-system-group-manual",children:["5.1.7 Avoid use of system",":masters"," group (Manual)"]}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Remediation:"}),"\nRemove the system",":masters"," group from all users in the cluster."]}),"\n",(0,t.jsx)(r.h3,{id:"518-limit-use-of-the-bind-impersonate-and-escalate-permissions-in-the-kubernetes-cluster-manual",children:"5.1.8 Limit use of the Bind, Impersonate and Escalate permissions in the Kubernetes cluster (Manual)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Remediation:"}),"\nWhere possible, remove the impersonate, bind and escalate rights from subjects."]}),"\n",(0,t.jsx)(r.h3,{id:"519-minimize-access-to-create-persistent-volumes-manual",children:"5.1.9 Minimize access to create persistent volumes (Manual)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Remediation:"}),"\nWhere possible, remove create access to PersistentVolume objects in the cluster."]}),"\n",(0,t.jsx)(r.h3,{id:"5110-minimize-access-to-the-proxy-sub-resource-of-nodes-manual",children:"5.1.10 Minimize access to the proxy sub-resource of nodes (Manual)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Remediation:"}),"\nWhere possible, remove access to the proxy sub-resource of node objects."]}),"\n",(0,t.jsx)(r.h3,{id:"5111-minimize-access-to-the-approval-sub-resource-of-certificatesigningrequests-objects-manual",children:"5.1.11 Minimize access to the approval sub-resource of certificatesigningrequests objects (Manual)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Remediation:"}),"\nWhere possible, remove access to the approval sub-resource of certificatesigningrequest objects."]}),"\n",(0,t.jsx)(r.h3,{id:"5112-minimize-access-to-webhook-configuration-objects-manual",children:"5.1.12 Minimize access to webhook configuration objects (Manual)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Remediation:"}),"\nWhere possible, remove access to the validatingwebhookconfigurations or mutatingwebhookconfigurations objects"]}),"\n",(0,t.jsx)(r.h3,{id:"5113-minimize-access-to-the-service-account-token-creation-manual",children:"5.1.13 Minimize access to the service account token creation (Manual)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Remediation:"}),"\nWhere possible, remove access to the token sub-resource of serviceaccount objects."]}),"\n",(0,t.jsx)(r.h2,{id:"52-pod-security-standards",children:"5.2 Pod Security Standards"}),"\n",(0,t.jsx)(r.h3,{id:"521-ensure-that-the-cluster-has-at-least-one-active-policy-control-mechanism-in-place-manual",children:"5.2.1 Ensure that the cluster has at least one active policy control mechanism in place (Manual)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Remediation:"}),"\nEnsure that either Pod Security Admission or an external policy control system is in place\nfor every namespace which contains user workloads."]}),"\n",(0,t.jsx)(r.h3,{id:"522-minimize-the-admission-of-privileged-containers-manual",children:"5.2.2 Minimize the admission of privileged containers (Manual)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Remediation:"}),"\nAdd policies to each namespace in the cluster which has user workloads to restrict the\nadmission of privileged containers."]}),"\n",(0,t.jsx)(r.h3,{id:"523-minimize-the-admission-of-containers-wishing-to-share-the-host-process-id-namespace-automated",children:"5.2.3 Minimize the admission of containers wishing to share the host process ID namespace (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Remediation:"}),"\nAdd policies to each namespace in the cluster which has user workloads to restrict the\nadmission of ",(0,t.jsx)(r.code,{children:"hostPID"})," containers."]}),"\n",(0,t.jsx)(r.h3,{id:"524-minimize-the-admission-of-containers-wishing-to-share-the-host-ipc-namespace-automated",children:"5.2.4 Minimize the admission of containers wishing to share the host IPC namespace (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Remediation:"}),"\nAdd policies to each namespace in the cluster which has user workloads to restrict the\nadmission of ",(0,t.jsx)(r.code,{children:"hostIPC"})," containers."]}),"\n",(0,t.jsx)(r.h3,{id:"525-minimize-the-admission-of-containers-wishing-to-share-the-host-network-namespace-automated",children:"5.2.5 Minimize the admission of containers wishing to share the host network namespace (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Remediation:"}),"\nAdd policies to each namespace in the cluster which has user workloads to restrict the\nadmission of ",(0,t.jsx)(r.code,{children:"hostNetwork"})," containers."]}),"\n",(0,t.jsx)(r.h3,{id:"526-minimize-the-admission-of-containers-with-allowprivilegeescalation-automated",children:"5.2.6 Minimize the admission of containers with allowPrivilegeEscalation (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Remediation:"}),"\nAdd policies to each namespace in the cluster which has user workloads to restrict the\nadmission of containers with ",(0,t.jsx)(r.code,{children:".spec.allowPrivilegeEscalation"})," set to ",(0,t.jsx)(r.code,{children:"true"}),"."]}),"\n",(0,t.jsx)(r.h3,{id:"527-minimize-the-admission-of-root-containers-automated",children:"5.2.7 Minimize the admission of root containers (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Remediation:"}),"\nCreate a policy for each namespace in the cluster, ensuring that either ",(0,t.jsx)(r.code,{children:"MustRunAsNonRoot"}),"\nor ",(0,t.jsx)(r.code,{children:"MustRunAs"})," with the range of UIDs not including 0, is set."]}),"\n",(0,t.jsx)(r.h3,{id:"528-minimize-the-admission-of-containers-with-the-net_raw-capability-automated",children:"5.2.8 Minimize the admission of containers with the NET_RAW capability (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Remediation:"}),"\nAdd policies to each namespace in the cluster which has user workloads to restrict the\nadmission of containers with the ",(0,t.jsx)(r.code,{children:"NET_RAW"})," capability."]}),"\n",(0,t.jsx)(r.h3,{id:"529-minimize-the-admission-of-containers-with-added-capabilities-automated",children:"5.2.9 Minimize the admission of containers with added capabilities (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Remediation:"}),"\nEnsure that ",(0,t.jsx)(r.code,{children:"allowedCapabilities"})," is not present in policies for the cluster unless\nit is set to an empty array."]}),"\n",(0,t.jsx)(r.h3,{id:"5210-minimize-the-admission-of-containers-with-capabilities-assigned-manual",children:"5.2.10 Minimize the admission of containers with capabilities assigned (Manual)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Remediation:"}),"\nReview the use of capabilities in applications running on your cluster. Where a namespace\ncontains applications which do not require any Linux capabities to operate consider adding\na PSP which forbids the admission of containers which do not drop all capabilities."]}),"\n",(0,t.jsx)(r.h3,{id:"5211-minimize-the-admission-of-windows-hostprocess-containers-manual",children:"5.2.11 Minimize the admission of Windows HostProcess containers (Manual)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Remediation:"}),"\nAdd policies to each namespace in the cluster which has user workloads to restrict the\nadmission of containers that have ",(0,t.jsx)(r.code,{children:".securityContext.windowsOptions.hostProcess"})," set to ",(0,t.jsx)(r.code,{children:"true"}),"."]}),"\n",(0,t.jsx)(r.h3,{id:"5212-minimize-the-admission-of-hostpath-volumes-manual",children:"5.2.12 Minimize the admission of HostPath volumes (Manual)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Remediation:"}),"\nAdd policies to each namespace in the cluster which has user workloads to restrict the\nadmission of containers with ",(0,t.jsx)(r.code,{children:"hostPath"})," volumes."]}),"\n",(0,t.jsx)(r.h3,{id:"5213-minimize-the-admission-of-containers-which-use-hostports-manual",children:"5.2.13 Minimize the admission of containers which use HostPorts (Manual)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Remediation:"}),"\nAdd policies to each namespace in the cluster which has user workloads to restrict the\nadmission of containers which use ",(0,t.jsx)(r.code,{children:"hostPort"})," sections."]}),"\n",(0,t.jsx)(r.h2,{id:"53-network-policies-and-cni",children:"5.3 Network Policies and CNI"}),"\n",(0,t.jsx)(r.h3,{id:"531-ensure-that-the-cni-in-use-supports-networkpolicies-manual",children:"5.3.1 Ensure that the CNI in use supports NetworkPolicies (Manual)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Remediation:"}),"\nIf the CNI plugin in use does not support network policies, consideration should be given to\nmaking use of a different plugin, or finding an alternate mechanism for restricting traffic\nin the Kubernetes cluster."]}),"\n",(0,t.jsx)(r.h3,{id:"532-ensure-that-all-namespaces-have-networkpolicies-defined-manual",children:"5.3.2 Ensure that all Namespaces have NetworkPolicies defined (Manual)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Remediation:"}),"\nFollow the documentation and create NetworkPolicy objects as you need them."]}),"\n",(0,t.jsx)(r.h2,{id:"54-secrets-management",children:"5.4 Secrets Management"}),"\n",(0,t.jsx)(r.h3,{id:"541-prefer-using-secrets-as-files-over-secrets-as-environment-variables-manual",children:"5.4.1 Prefer using Secrets as files over Secrets as environment variables (Manual)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Remediation:"}),"\nIf possible, rewrite application code to read Secrets from mounted secret files, rather than\nfrom environment variables."]}),"\n",(0,t.jsx)(r.h3,{id:"542-consider-external-secret-storage-manual",children:"5.4.2 Consider external secret storage (Manual)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Remediation:"}),"\nRefer to the Secrets management options offered by your cloud provider or a third-party\nsecrets management solution."]}),"\n",(0,t.jsx)(r.h2,{id:"55-extensible-admission-control",children:"5.5 Extensible Admission Control"}),"\n",(0,t.jsx)(r.h3,{id:"551-configure-image-provenance-using-imagepolicywebhook-admission-controller-manual",children:"5.5.1 Configure Image Provenance using ImagePolicyWebhook admission controller (Manual)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Remediation:"}),"\nFollow the Kubernetes documentation and setup image provenance."]}),"\n",(0,t.jsx)(r.h2,{id:"57-general-policies",children:"5.7 General Policies"}),"\n",(0,t.jsx)(r.h3,{id:"571-create-administrative-boundaries-between-resources-using-namespaces-manual",children:"5.7.1 Create administrative boundaries between resources using namespaces (Manual)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Remediation:"}),"\nFollow the documentation and create namespaces for objects in your deployment as you need\nthem."]}),"\n",(0,t.jsx)(r.h3,{id:"572-ensure-that-the-seccomp-profile-is-set-to-dockerdefault-in-your-pod-definitions-manual",children:"5.7.2 Ensure that the seccomp profile is set to docker/default in your Pod definitions (Manual)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Remediation:"}),"\nUse ",(0,t.jsx)(r.code,{children:"securityContext"})," to enable the docker/default seccomp profile in your pod definitions.\nAn example is as below:\nsecurityContext:\nseccompProfile:\ntype: RuntimeDefault"]}),"\n",(0,t.jsx)(r.h3,{id:"573-apply-securitycontext-to-your-pods-and-containers-manual",children:"5.7.3 Apply SecurityContext to your Pods and Containers (Manual)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Remediation:"}),"\nFollow the Kubernetes documentation and apply SecurityContexts to your Pods. For a\nsuggested list of SecurityContexts, you may refer to the CIS Security Benchmark for Docker\nContainers."]}),"\n",(0,t.jsx)(r.h3,{id:"574-the-default-namespace-should-not-be-used-manual",children:"5.7.4 The default namespace should not be used (Manual)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Remediation:"}),"\nEnsure that namespaces are created to allow for appropriate segregation of Kubernetes\nresources and that all new resources are created in a specific namespace."]})]})}function u(e={}){const{wrapper:r}={...(0,n.a)(),...e.components};return r?(0,t.jsx)(r,{...e,children:(0,t.jsx)(d,{...e})}):d(e)}},1151:(e,r,s)=>{s.d(r,{Z:()=>l,a:()=>a});var t=s(7294);const n={},i=t.createContext(n);function a(e){const r=t.useContext(i);return t.useMemo((function(){return"function"==typeof e?e(r):{...r,...e}}),[r,e])}function l(e){let r;return r=e.disableParentContext?"function"==typeof e.components?e.components(n):e.components||n:a(e.components),t.createElement(i.Provider,{value:r},e.children)}}}]); \ No newline at end of file +"use strict";(self.webpackChunkk_3_s_docs=self.webpackChunkk_3_s_docs||[]).push([[9075],{7902:(e,r,s)=>{s.r(r),s.d(r,{assets:()=>c,contentTitle:()=>a,default:()=>u,frontMatter:()=>i,metadata:()=>l,toc:()=>o});var t=s(5893),n=s(1151);const i={title:"CIS 1.7 Self Assessment Guide"},a=void 0,l={id:"security/self-assessment-1.7",title:"CIS 1.7 Self Assessment Guide",description:"Overview",source:"@site/docs/security/self-assessment-1.7.md",sourceDirName:"security",slug:"/security/self-assessment-1.7",permalink:"/security/self-assessment-1.7",draft:!1,unlisted:!1,editUrl:"https://github.com/k3s-io/docs/edit/main/docs/security/self-assessment-1.7.md",tags:[],version:"current",lastUpdatedAt:1723747404e3,frontMatter:{title:"CIS 1.7 Self Assessment Guide"},sidebar:"mySidebar",previous:{title:"CIS 1.8 Self Assessment Guide",permalink:"/security/self-assessment-1.8"},next:{title:"CIS 1.24 Self Assessment Guide",permalink:"/security/self-assessment-1.24"}},c={},o=[{value:"Overview",id:"overview",level:2},{value:"Testing controls methodology",id:"testing-controls-methodology",level:3},{value:"1.1 Control Plane Node Configuration Files",id:"11-control-plane-node-configuration-files",level:2},{value:"1.1.1 Ensure that the API server pod specification file permissions are set to 600 or more restrictive (Automated)",id:"111-ensure-that-the-api-server-pod-specification-file-permissions-are-set-to-600-or-more-restrictive-automated",level:3},{value:"1.1.2 Ensure that the API server pod specification file ownership is set to root (Automated)",id:"112-ensure-that-the-api-server-pod-specification-file-ownership-is-set-to-root-automated",level:3},{value:"1.1.3 Ensure that the controller manager pod specification file permissions are set to 600 or more restrictive (Automated)",id:"113-ensure-that-the-controller-manager-pod-specification-file-permissions-are-set-to-600-or-more-restrictive-automated",level:3},{value:"1.1.4 Ensure that the controller manager pod specification file ownership is set to root (Automated)",id:"114-ensure-that-the-controller-manager-pod-specification-file-ownership-is-set-to-root-automated",level:3},{value:"1.1.5 Ensure that the scheduler pod specification file permissions are set to 600 or more restrictive (Automated)",id:"115-ensure-that-the-scheduler-pod-specification-file-permissions-are-set-to-600-or-more-restrictive-automated",level:3},{value:"1.1.6 Ensure that the scheduler pod specification file ownership is set to root (Automated)",id:"116-ensure-that-the-scheduler-pod-specification-file-ownership-is-set-to-root-automated",level:3},{value:"1.1.7 Ensure that the etcd pod specification file permissions are set to 600 or more restrictive (Automated)",id:"117-ensure-that-the-etcd-pod-specification-file-permissions-are-set-to-600-or-more-restrictive-automated",level:3},{value:"1.1.8 Ensure that the etcd pod specification file ownership is set to root (Automated)",id:"118-ensure-that-the-etcd-pod-specification-file-ownership-is-set-to-root-automated",level:3},{value:"1.1.9 Ensure that the Container Network Interface file permissions are set to 600 or more restrictive (Manual)",id:"119-ensure-that-the-container-network-interface-file-permissions-are-set-to-600-or-more-restrictive-manual",level:3},{value:"1.1.10 Ensure that the Container Network Interface file ownership is set to root (Automated)",id:"1110-ensure-that-the-container-network-interface-file-ownership-is-set-to-root-automated",level:3},{value:"1.1.11 Ensure that the etcd data directory permissions are set to 700 or more restrictive (Automated)",id:"1111-ensure-that-the-etcd-data-directory-permissions-are-set-to-700-or-more-restrictive-automated",level:3},{value:"1.1.12 Ensure that the etcd data directory ownership is set to etcd (Automated)",id:"1112-ensure-that-the-etcd-data-directory-ownership-is-set-to-etcd-automated",level:3},{value:"1.1.13 Ensure that the admin.conf file permissions are set to 600 or more restrictive (Automated)",id:"1113-ensure-that-the-adminconf-file-permissions-are-set-to-600-or-more-restrictive-automated",level:3},{value:"1.1.14 Ensure that the admin.conf file ownership is set to root (Automated)",id:"1114-ensure-that-the-adminconf-file-ownership-is-set-to-root-automated",level:3},{value:"1.1.15 Ensure that the scheduler.conf file permissions are set to 600 or more restrictive (Automated)",id:"1115-ensure-that-the-schedulerconf-file-permissions-are-set-to-600-or-more-restrictive-automated",level:3},{value:"1.1.16 Ensure that the scheduler.conf file ownership is set to root (Automated)",id:"1116-ensure-that-the-schedulerconf-file-ownership-is-set-to-root-automated",level:3},{value:"1.1.17 Ensure that the controller-manager.conf file permissions are set to 600 or more restrictive (Automated)",id:"1117-ensure-that-the-controller-managerconf-file-permissions-are-set-to-600-or-more-restrictive-automated",level:3},{value:"1.1.18 Ensure that the controller-manager.conf file ownership is set to root (Automated)",id:"1118-ensure-that-the-controller-managerconf-file-ownership-is-set-to-root-automated",level:3},{value:"1.1.19 Ensure that the Kubernetes PKI directory and file ownership is set to root (Automated)",id:"1119-ensure-that-the-kubernetes-pki-directory-and-file-ownership-is-set-to-root-automated",level:3},{value:"1.1.20 Ensure that the Kubernetes PKI certificate file permissions are set to 600 or more restrictive (Manual)",id:"1120-ensure-that-the-kubernetes-pki-certificate-file-permissions-are-set-to-600-or-more-restrictive-manual",level:3},{value:"1.1.21 Ensure that the Kubernetes PKI key file permissions are set to 600 (Automated)",id:"1121-ensure-that-the-kubernetes-pki-key-file-permissions-are-set-to-600-automated",level:3},{value:"1.2 API Server",id:"12-api-server",level:2},{value:"1.2.1 Ensure that the --anonymous-auth argument is set to false (Automated)",id:"121-ensure-that-the---anonymous-auth-argument-is-set-to-false-automated",level:3},{value:"1.2.2 Ensure that the --token-auth-file parameter is not set (Automated)",id:"122-ensure-that-the---token-auth-file-parameter-is-not-set-automated",level:3},{value:"1.2.3 Ensure that the --DenyServiceExternalIPs is not set (Automated)",id:"123-ensure-that-the---denyserviceexternalips-is-not-set-automated",level:3},{value:"1.2.4 Ensure that the --kubelet-client-certificate and --kubelet-client-key arguments are set as appropriate (Automated)",id:"124-ensure-that-the---kubelet-client-certificate-and---kubelet-client-key-arguments-are-set-as-appropriate-automated",level:3},{value:"1.2.5 Ensure that the --kubelet-certificate-authority argument is set as appropriate (Automated)",id:"125-ensure-that-the---kubelet-certificate-authority-argument-is-set-as-appropriate-automated",level:3},{value:"1.2.6 Ensure that the --authorization-mode argument is not set to AlwaysAllow (Automated)",id:"126-ensure-that-the---authorization-mode-argument-is-not-set-to-alwaysallow-automated",level:3},{value:"1.2.7 Ensure that the --authorization-mode argument includes Node (Automated)",id:"127-ensure-that-the---authorization-mode-argument-includes-node-automated",level:3},{value:"1.2.8 Ensure that the --authorization-mode argument includes RBAC (Automated)",id:"128-ensure-that-the---authorization-mode-argument-includes-rbac-automated",level:3},{value:"1.2.9 Ensure that the admission control plugin EventRateLimit is set (Manual)",id:"129-ensure-that-the-admission-control-plugin-eventratelimit-is-set-manual",level:3},{value:"1.2.10 Ensure that the admission control plugin AlwaysAdmit is not set (Automated)",id:"1210-ensure-that-the-admission-control-plugin-alwaysadmit-is-not-set-automated",level:3},{value:"1.2.11 Ensure that the admission control plugin AlwaysPullImages is set (Manual)",id:"1211-ensure-that-the-admission-control-plugin-alwayspullimages-is-set-manual",level:3},{value:"1.2.12 Ensure that the admission control plugin SecurityContextDeny is set if PodSecurityPolicy is not used (Manual)",id:"1212-ensure-that-the-admission-control-plugin-securitycontextdeny-is-set-if-podsecuritypolicy-is-not-used-manual",level:3},{value:"1.2.13 Ensure that the admission control plugin ServiceAccount is set (Automated)",id:"1213-ensure-that-the-admission-control-plugin-serviceaccount-is-set-automated",level:3},{value:"1.2.14 Ensure that the admission control plugin NamespaceLifecycle is set (Automated)",id:"1214-ensure-that-the-admission-control-plugin-namespacelifecycle-is-set-automated",level:3},{value:"1.2.15 Ensure that the admission control plugin NodeRestriction is set (Automated)",id:"1215-ensure-that-the-admission-control-plugin-noderestriction-is-set-automated",level:3},{value:"1.2.16 Ensure that the --secure-port argument is not set to 0 - NoteThis recommendation is obsolete and will be deleted per the consensus process (Automated)",id:"1216-ensure-that-the---secure-port-argument-is-not-set-to-0---notethis-recommendation-is-obsolete-and-will-be-deleted-per-the-consensus-process-automated",level:3},{value:"1.2.17 Ensure that the --profiling argument is set to false (Automated)",id:"1217-ensure-that-the---profiling-argument-is-set-to-false-automated",level:3},{value:"1.2.18 Ensure that the --audit-log-path argument is set (Manual)",id:"1218-ensure-that-the---audit-log-path-argument-is-set-manual",level:3},{value:"1.2.19 Ensure that the --audit-log-maxage argument is set to 30 or as appropriate (Manual)",id:"1219-ensure-that-the---audit-log-maxage-argument-is-set-to-30-or-as-appropriate-manual",level:3},{value:"1.2.20 Ensure that the --audit-log-maxbackup argument is set to 10 or as appropriate (Manual)",id:"1220-ensure-that-the---audit-log-maxbackup-argument-is-set-to-10-or-as-appropriate-manual",level:3},{value:"1.2.21 Ensure that the --audit-log-maxsize argument is set to 100 or as appropriate (Manual)",id:"1221-ensure-that-the---audit-log-maxsize-argument-is-set-to-100-or-as-appropriate-manual",level:3},{value:"1.2.22 Ensure that the --request-timeout argument is set as appropriate (Manual)",id:"1222-ensure-that-the---request-timeout-argument-is-set-as-appropriate-manual",level:3},{value:"1.2.23 Ensure that the --service-account-lookup argument is set to true (Automated)",id:"1223-ensure-that-the---service-account-lookup-argument-is-set-to-true-automated",level:3},{value:"1.2.24 Ensure that the --service-account-key-file argument is set as appropriate (Automated)",id:"1224-ensure-that-the---service-account-key-file-argument-is-set-as-appropriate-automated",level:3},{value:"1.2.25 Ensure that the --etcd-certfile and --etcd-keyfile arguments are set as appropriate (Automated)",id:"1225-ensure-that-the---etcd-certfile-and---etcd-keyfile-arguments-are-set-as-appropriate-automated",level:3},{value:"1.2.26 Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate (Automated)",id:"1226-ensure-that-the---tls-cert-file-and---tls-private-key-file-arguments-are-set-as-appropriate-automated",level:3},{value:"1.2.27 Ensure that the --client-ca-file argument is set as appropriate (Automated)",id:"1227-ensure-that-the---client-ca-file-argument-is-set-as-appropriate-automated",level:3},{value:"1.2.28 Ensure that the --etcd-cafile argument is set as appropriate (Automated)",id:"1228-ensure-that-the---etcd-cafile-argument-is-set-as-appropriate-automated",level:3},{value:"1.2.29 Ensure that the --encryption-provider-config argument is set as appropriate (Manual)",id:"1229-ensure-that-the---encryption-provider-config-argument-is-set-as-appropriate-manual",level:3},{value:"1.2.30 Ensure that encryption providers are appropriately configured (Manual)",id:"1230-ensure-that-encryption-providers-are-appropriately-configured-manual",level:3},{value:"1.2.31 Ensure that the API Server only makes use of Strong Cryptographic Ciphers (Automated)",id:"1231-ensure-that-the-api-server-only-makes-use-of-strong-cryptographic-ciphers-automated",level:3},{value:"1.3 Controller Manager",id:"13-controller-manager",level:2},{value:"1.3.1 Ensure that the --terminated-pod-gc-threshold argument is set as appropriate (Manual)",id:"131-ensure-that-the---terminated-pod-gc-threshold-argument-is-set-as-appropriate-manual",level:3},{value:"1.3.2 Ensure that the --profiling argument is set to false (Automated)",id:"132-ensure-that-the---profiling-argument-is-set-to-false-automated",level:3},{value:"1.3.3 Ensure that the --use-service-account-credentials argument is set to true (Automated)",id:"133-ensure-that-the---use-service-account-credentials-argument-is-set-to-true-automated",level:3},{value:"1.3.4 Ensure that the --service-account-private-key-file argument is set as appropriate (Automated)",id:"134-ensure-that-the---service-account-private-key-file-argument-is-set-as-appropriate-automated",level:3},{value:"1.3.5 Ensure that the --root-ca-file argument is set as appropriate (Automated)",id:"135-ensure-that-the---root-ca-file-argument-is-set-as-appropriate-automated",level:3},{value:"1.3.6 Ensure that the RotateKubeletServerCertificate argument is set to true (Automated)",id:"136-ensure-that-the-rotatekubeletservercertificate-argument-is-set-to-true-automated",level:3},{value:"1.3.7 Ensure that the --bind-address argument is set to 127.0.0.1 (Automated)",id:"137-ensure-that-the---bind-address-argument-is-set-to-127001-automated",level:3},{value:"1.4 Scheduler",id:"14-scheduler",level:2},{value:"1.4.1 Ensure that the --profiling argument is set to false (Automated)",id:"141-ensure-that-the---profiling-argument-is-set-to-false-automated",level:3},{value:"1.4.2 Ensure that the --bind-address argument is set to 127.0.0.1 (Automated)",id:"142-ensure-that-the---bind-address-argument-is-set-to-127001-automated",level:3},{value:"2 Etcd Node Configuration",id:"2-etcd-node-configuration",level:2},{value:"2.1 Ensure that the --cert-file and --key-file arguments are set as appropriate (Automated)",id:"21-ensure-that-the---cert-file-and---key-file-arguments-are-set-as-appropriate-automated",level:3},{value:"2.2 Ensure that the --client-cert-auth argument is set to true (Automated)",id:"22-ensure-that-the---client-cert-auth-argument-is-set-to-true-automated",level:3},{value:"2.3 Ensure that the --auto-tls argument is not set to true (Automated)",id:"23-ensure-that-the---auto-tls-argument-is-not-set-to-true-automated",level:3},{value:"2.4 Ensure that the --peer-cert-file and --peer-key-file arguments are set as appropriate (Automated)",id:"24-ensure-that-the---peer-cert-file-and---peer-key-file-arguments-are-set-as-appropriate-automated",level:3},{value:"2.5 Ensure that the --peer-client-cert-auth argument is set to true (Automated)",id:"25-ensure-that-the---peer-client-cert-auth-argument-is-set-to-true-automated",level:3},{value:"2.6 Ensure that the --peer-auto-tls argument is not set to true (Automated)",id:"26-ensure-that-the---peer-auto-tls-argument-is-not-set-to-true-automated",level:3},{value:"2.7 Ensure that a unique Certificate Authority is used for etcd (Automated)",id:"27-ensure-that-a-unique-certificate-authority-is-used-for-etcd-automated",level:3},{value:"4.1 Worker Node Configuration Files",id:"41-worker-node-configuration-files",level:2},{value:"4.1.1 Ensure that the kubelet service file permissions are set to 600 or more restrictive (Automated)",id:"411-ensure-that-the-kubelet-service-file-permissions-are-set-to-600-or-more-restrictive-automated",level:3},{value:"4.1.2 Ensure that the kubelet service file ownership is set to root (Automated)",id:"412-ensure-that-the-kubelet-service-file-ownership-is-set-to-root-automated",level:3},{value:"4.1.3 If proxy kubeconfig file exists ensure permissions are set to 600 or more restrictive (Automated)",id:"413-if-proxy-kubeconfig-file-exists-ensure-permissions-are-set-to-600-or-more-restrictive-automated",level:3},{value:"4.1.4 If proxy kubeconfig file exists ensure ownership is set to root (Automated)",id:"414-if-proxy-kubeconfig-file-exists-ensure-ownership-is-set-to-root-automated",level:3},{value:"4.1.5 Ensure that the --kubeconfig kubelet.conf file permissions are set to 600 or more restrictive (Automated)",id:"415-ensure-that-the---kubeconfig-kubeletconf-file-permissions-are-set-to-600-or-more-restrictive-automated",level:3},{value:"4.1.6 Ensure that the --kubeconfig kubelet.conf file ownership is set to root (Automated)",id:"416-ensure-that-the---kubeconfig-kubeletconf-file-ownership-is-set-to-root-automated",level:3},{value:"4.1.7 Ensure that the certificate authorities file permissions are set to 600 or more restrictive (Automated)",id:"417-ensure-that-the-certificate-authorities-file-permissions-are-set-to-600-or-more-restrictive-automated",level:3},{value:"4.1.8 Ensure that the client certificate authorities file ownership is set to root (Automated)",id:"418-ensure-that-the-client-certificate-authorities-file-ownership-is-set-to-root-automated",level:3},{value:"4.1.9 Ensure that the kubelet --config configuration file has permissions set to 600 or more restrictive (Automated)",id:"419-ensure-that-the-kubelet---config-configuration-file-has-permissions-set-to-600-or-more-restrictive-automated",level:3},{value:"4.1.10 Ensure that the kubelet --config configuration file ownership is set to root (Automated)",id:"4110-ensure-that-the-kubelet---config-configuration-file-ownership-is-set-to-root-automated",level:3},{value:"4.2 Kubelet",id:"42-kubelet",level:2},{value:"4.2.1 Ensure that the --anonymous-auth argument is set to false (Automated)",id:"421-ensure-that-the---anonymous-auth-argument-is-set-to-false-automated",level:3},{value:"4.2.2 Ensure that the --authorization-mode argument is not set to AlwaysAllow (Automated)",id:"422-ensure-that-the---authorization-mode-argument-is-not-set-to-alwaysallow-automated",level:3},{value:"4.2.3 Ensure that the --client-ca-file argument is set as appropriate (Automated)",id:"423-ensure-that-the---client-ca-file-argument-is-set-as-appropriate-automated",level:3},{value:"4.2.4 Verify that the --read-only-port argument is set to 0 (Automated)",id:"424-verify-that-the---read-only-port-argument-is-set-to-0-automated",level:3},{value:"4.2.5 Ensure that the --streaming-connection-idle-timeout argument is not set to 0 (Manual)",id:"425-ensure-that-the---streaming-connection-idle-timeout-argument-is-not-set-to-0-manual",level:3},{value:"4.2.6 Ensure that the --make-iptables-util-chains argument is set to true (Automated)",id:"426-ensure-that-the---make-iptables-util-chains-argument-is-set-to-true-automated",level:3},{value:"4.2.7 Ensure that the --hostname-override argument is not set (Automated)",id:"427-ensure-that-the---hostname-override-argument-is-not-set-automated",level:3},{value:"4.2.8 Ensure that the eventRecordQPS argument is set to a level which ensures appropriate event capture (Manual)",id:"428-ensure-that-the-eventrecordqps-argument-is-set-to-a-level-which-ensures-appropriate-event-capture-manual",level:3},{value:"4.2.9 Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate (Automated)",id:"429-ensure-that-the---tls-cert-file-and---tls-private-key-file-arguments-are-set-as-appropriate-automated",level:3},{value:"4.2.10 Ensure that the --rotate-certificates argument is not set to false (Automated)",id:"4210-ensure-that-the---rotate-certificates-argument-is-not-set-to-false-automated",level:3},{value:"4.2.11 Verify that the RotateKubeletServerCertificate argument is set to true (Automated)",id:"4211-verify-that-the-rotatekubeletservercertificate-argument-is-set-to-true-automated",level:3},{value:"4.2.12 Ensure that the Kubelet only makes use of Strong Cryptographic Ciphers (Manual)",id:"4212-ensure-that-the-kubelet-only-makes-use-of-strong-cryptographic-ciphers-manual",level:3},{value:"4.2.13 Ensure that a limit is set on pod PIDs (Manual)",id:"4213-ensure-that-a-limit-is-set-on-pod-pids-manual",level:3},{value:"5.1 RBAC and Service Accounts",id:"51-rbac-and-service-accounts",level:2},{value:"5.1.1 Ensure that the cluster-admin role is only used where required (Manual)",id:"511-ensure-that-the-cluster-admin-role-is-only-used-where-required-manual",level:3},{value:"5.1.2 Minimize access to secrets (Manual)",id:"512-minimize-access-to-secrets-manual",level:3},{value:"5.1.3 Minimize wildcard use in Roles and ClusterRoles (Manual)",id:"513-minimize-wildcard-use-in-roles-and-clusterroles-manual",level:3},{value:"5.1.4 Minimize access to create pods (Manual)",id:"514-minimize-access-to-create-pods-manual",level:3},{value:"5.1.5 Ensure that default service accounts are not actively used. (Manual)",id:"515-ensure-that-default-service-accounts-are-not-actively-used-manual",level:3},{value:"5.1.6 Ensure that Service Account Tokens are only mounted where necessary (Manual)",id:"516-ensure-that-service-account-tokens-are-only-mounted-where-necessary-manual",level:3},{value:"5.1.7 Avoid use of system group (Manual)",id:"517-avoid-use-of-system-group-manual",level:3},{value:"5.1.8 Limit use of the Bind, Impersonate and Escalate permissions in the Kubernetes cluster (Manual)",id:"518-limit-use-of-the-bind-impersonate-and-escalate-permissions-in-the-kubernetes-cluster-manual",level:3},{value:"5.1.9 Minimize access to create persistent volumes (Manual)",id:"519-minimize-access-to-create-persistent-volumes-manual",level:3},{value:"5.1.10 Minimize access to the proxy sub-resource of nodes (Manual)",id:"5110-minimize-access-to-the-proxy-sub-resource-of-nodes-manual",level:3},{value:"5.1.11 Minimize access to the approval sub-resource of certificatesigningrequests objects (Manual)",id:"5111-minimize-access-to-the-approval-sub-resource-of-certificatesigningrequests-objects-manual",level:3},{value:"5.1.12 Minimize access to webhook configuration objects (Manual)",id:"5112-minimize-access-to-webhook-configuration-objects-manual",level:3},{value:"5.1.13 Minimize access to the service account token creation (Manual)",id:"5113-minimize-access-to-the-service-account-token-creation-manual",level:3},{value:"5.2 Pod Security Standards",id:"52-pod-security-standards",level:2},{value:"5.2.1 Ensure that the cluster has at least one active policy control mechanism in place (Manual)",id:"521-ensure-that-the-cluster-has-at-least-one-active-policy-control-mechanism-in-place-manual",level:3},{value:"5.2.2 Minimize the admission of privileged containers (Manual)",id:"522-minimize-the-admission-of-privileged-containers-manual",level:3},{value:"5.2.3 Minimize the admission of containers wishing to share the host process ID namespace (Automated)",id:"523-minimize-the-admission-of-containers-wishing-to-share-the-host-process-id-namespace-automated",level:3},{value:"5.2.4 Minimize the admission of containers wishing to share the host IPC namespace (Automated)",id:"524-minimize-the-admission-of-containers-wishing-to-share-the-host-ipc-namespace-automated",level:3},{value:"5.2.5 Minimize the admission of containers wishing to share the host network namespace (Automated)",id:"525-minimize-the-admission-of-containers-wishing-to-share-the-host-network-namespace-automated",level:3},{value:"5.2.6 Minimize the admission of containers with allowPrivilegeEscalation (Automated)",id:"526-minimize-the-admission-of-containers-with-allowprivilegeescalation-automated",level:3},{value:"5.2.7 Minimize the admission of root containers (Automated)",id:"527-minimize-the-admission-of-root-containers-automated",level:3},{value:"5.2.8 Minimize the admission of containers with the NET_RAW capability (Automated)",id:"528-minimize-the-admission-of-containers-with-the-net_raw-capability-automated",level:3},{value:"5.2.9 Minimize the admission of containers with added capabilities (Automated)",id:"529-minimize-the-admission-of-containers-with-added-capabilities-automated",level:3},{value:"5.2.10 Minimize the admission of containers with capabilities assigned (Manual)",id:"5210-minimize-the-admission-of-containers-with-capabilities-assigned-manual",level:3},{value:"5.2.11 Minimize the admission of Windows HostProcess containers (Manual)",id:"5211-minimize-the-admission-of-windows-hostprocess-containers-manual",level:3},{value:"5.2.12 Minimize the admission of HostPath volumes (Manual)",id:"5212-minimize-the-admission-of-hostpath-volumes-manual",level:3},{value:"5.2.13 Minimize the admission of containers which use HostPorts (Manual)",id:"5213-minimize-the-admission-of-containers-which-use-hostports-manual",level:3},{value:"5.3 Network Policies and CNI",id:"53-network-policies-and-cni",level:2},{value:"5.3.1 Ensure that the CNI in use supports NetworkPolicies (Manual)",id:"531-ensure-that-the-cni-in-use-supports-networkpolicies-manual",level:3},{value:"5.3.2 Ensure that all Namespaces have NetworkPolicies defined (Manual)",id:"532-ensure-that-all-namespaces-have-networkpolicies-defined-manual",level:3},{value:"5.4 Secrets Management",id:"54-secrets-management",level:2},{value:"5.4.1 Prefer using Secrets as files over Secrets as environment variables (Manual)",id:"541-prefer-using-secrets-as-files-over-secrets-as-environment-variables-manual",level:3},{value:"5.4.2 Consider external secret storage (Manual)",id:"542-consider-external-secret-storage-manual",level:3},{value:"5.5 Extensible Admission Control",id:"55-extensible-admission-control",level:2},{value:"5.5.1 Configure Image Provenance using ImagePolicyWebhook admission controller (Manual)",id:"551-configure-image-provenance-using-imagepolicywebhook-admission-controller-manual",level:3},{value:"5.7 General Policies",id:"57-general-policies",level:2},{value:"5.7.1 Create administrative boundaries between resources using namespaces (Manual)",id:"571-create-administrative-boundaries-between-resources-using-namespaces-manual",level:3},{value:"5.7.2 Ensure that the seccomp profile is set to docker/default in your Pod definitions (Manual)",id:"572-ensure-that-the-seccomp-profile-is-set-to-dockerdefault-in-your-pod-definitions-manual",level:3},{value:"5.7.3 Apply SecurityContext to your Pods and Containers (Manual)",id:"573-apply-securitycontext-to-your-pods-and-containers-manual",level:3},{value:"5.7.4 The default namespace should not be used (Manual)",id:"574-the-default-namespace-should-not-be-used-manual",level:3}];function d(e){const r={a:"a",admonition:"admonition",code:"code",h2:"h2",h3:"h3",li:"li",p:"p",pre:"pre",strong:"strong",ul:"ul",...(0,n.a)(),...e.components},{Details:s}=r;return s||function(e,r){throw new Error("Expected "+(r?"component":"object")+" `"+e+"` to be defined: you likely forgot to import, pass, or provide it.")}("Details",!0),(0,t.jsxs)(t.Fragment,{children:[(0,t.jsx)(r.h2,{id:"overview",children:"Overview"}),"\n",(0,t.jsxs)(r.p,{children:["This document is a companion to the ",(0,t.jsx)(r.a,{href:"/security/hardening-guide",children:"K3s security hardening guide"}),". The hardening guide provides prescriptive guidance for hardening a production installation of K3s, and this benchmark guide is meant to help you evaluate the level of security of the hardened cluster against each control in the CIS Kubernetes Benchmark. It is to be used by K3s operators, security teams, auditors, and decision-makers."]}),"\n",(0,t.jsxs)(r.p,{children:["This guide is specific to the ",(0,t.jsx)(r.strong,{children:"v1.25"})," release line of K3s and the ",(0,t.jsx)(r.strong,{children:"v1.7.1"})," release of the CIS Kubernetes Benchmark."]}),"\n",(0,t.jsxs)(r.p,{children:["For more information about each control, including detailed descriptions and remediations for failing tests, you can refer to the corresponding section of the CIS Kubernetes Benchmark v1.7.1. You can download the benchmark, after creating a free account, in ",(0,t.jsx)(r.a,{href:"https://www.cisecurity.org/benchmark/kubernetes/",children:"Center for Internet Security (CIS)"}),"."]}),"\n",(0,t.jsx)(r.h3,{id:"testing-controls-methodology",children:"Testing controls methodology"}),"\n",(0,t.jsx)(r.p,{children:"Each control in the CIS Kubernetes Benchmark was evaluated against a K3s cluster that was configured according to the accompanying hardening guide."}),"\n",(0,t.jsx)(r.p,{children:"Where control audits differ from the original CIS benchmark, the audit commands specific to K3s are provided for testing."}),"\n",(0,t.jsx)(r.p,{children:"These are the possible results for each control:"}),"\n",(0,t.jsxs)(r.ul,{children:["\n",(0,t.jsxs)(r.li,{children:[(0,t.jsx)(r.strong,{children:"Pass"})," - The K3s cluster under test passed the audit outlined in the benchmark."]}),"\n",(0,t.jsxs)(r.li,{children:[(0,t.jsx)(r.strong,{children:"Not Applicable"})," - The control is not applicable to K3s because of how it is designed to operate. The remediation section will explain why this is so."]}),"\n",(0,t.jsxs)(r.li,{children:[(0,t.jsx)(r.strong,{children:"Warn"})," - The control is manual in the CIS benchmark and it depends on the cluster's use case or some other factor that must be determined by the cluster operator. These controls have been evaluated to ensure K3s does not prevent their implementation, but no further configuration or auditing of the cluster under test has been performed."]}),"\n"]}),"\n",(0,t.jsx)(r.p,{children:'This guide makes the assumption that K3s is running as a Systemd unit. Your installation may vary and will require you to adjust the "audit" commands to fit your scenario.'}),"\n",(0,t.jsx)(r.admonition,{type:"note",children:(0,t.jsxs)(r.p,{children:["Only ",(0,t.jsx)(r.code,{children:"scored"})," test, also know as ",(0,t.jsx)(r.code,{children:"automated"})," tests are covered in this guide."]})}),"\n",(0,t.jsx)(r.h2,{id:"11-control-plane-node-configuration-files",children:"1.1 Control Plane Node Configuration Files"}),"\n",(0,t.jsx)(r.h3,{id:"111-ensure-that-the-api-server-pod-specification-file-permissions-are-set-to-600-or-more-restrictive-automated",children:"1.1.1 Ensure that the API server pod specification file permissions are set to 600 or more restrictive (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," Not Applicable"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Rationale:"})}),"\n",(0,t.jsx)(r.p,{children:"By default, K3s embeds the api server within the k3s process. There is no API server pod specification file."}),"\n",(0,t.jsxs)(r.h3,{id:"112-ensure-that-the-api-server-pod-specification-file-ownership-is-set-to-root-automated",children:["1.1.2 Ensure that the API server pod specification file ownership is set to root",":root"," (Automated)"]}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," Not Applicable"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Rationale:"})}),"\n",(0,t.jsx)(r.p,{children:"By default, K3s embeds the api server within the k3s process. There is no API server pod specification file."}),"\n",(0,t.jsx)(r.h3,{id:"113-ensure-that-the-controller-manager-pod-specification-file-permissions-are-set-to-600-or-more-restrictive-automated",children:"1.1.3 Ensure that the controller manager pod specification file permissions are set to 600 or more restrictive (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," Not Applicable"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Rationale:"})}),"\n",(0,t.jsx)(r.p,{children:"By default, K3s embeds the controller manager within the k3s process. There is no controller manager pod specification file."}),"\n",(0,t.jsxs)(r.h3,{id:"114-ensure-that-the-controller-manager-pod-specification-file-ownership-is-set-to-root-automated",children:["1.1.4 Ensure that the controller manager pod specification file ownership is set to root",":root"," (Automated)"]}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," Not Applicable"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Rationale:"})}),"\n",(0,t.jsx)(r.p,{children:"By default, K3s embeds the controller manager within the k3s process. There is no controller manager pod specification file."}),"\n",(0,t.jsx)(r.h3,{id:"115-ensure-that-the-scheduler-pod-specification-file-permissions-are-set-to-600-or-more-restrictive-automated",children:"1.1.5 Ensure that the scheduler pod specification file permissions are set to 600 or more restrictive (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," Not Applicable"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Rationale:"})}),"\n",(0,t.jsx)(r.p,{children:"By default, K3s embeds the scheduler within the k3s process. There is no scheduler pod specification file."}),"\n",(0,t.jsxs)(r.h3,{id:"116-ensure-that-the-scheduler-pod-specification-file-ownership-is-set-to-root-automated",children:["1.1.6 Ensure that the scheduler pod specification file ownership is set to root",":root"," (Automated)"]}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," Not Applicable"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Rationale:"})}),"\n",(0,t.jsx)(r.p,{children:"By default, K3s embeds the scheduler within the k3s process. There is no scheduler pod specification file."}),"\n",(0,t.jsx)(r.h3,{id:"117-ensure-that-the-etcd-pod-specification-file-permissions-are-set-to-600-or-more-restrictive-automated",children:"1.1.7 Ensure that the etcd pod specification file permissions are set to 600 or more restrictive (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," Not Applicable"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Rationale:"})}),"\n",(0,t.jsx)(r.p,{children:"By default, K3s embeds etcd within the k3s process. There is no etcd pod specification file."}),"\n",(0,t.jsxs)(r.h3,{id:"118-ensure-that-the-etcd-pod-specification-file-ownership-is-set-to-root-automated",children:["1.1.8 Ensure that the etcd pod specification file ownership is set to root",":root"," (Automated)"]}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," Not Applicable"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Rationale:"})}),"\n",(0,t.jsx)(r.p,{children:"By default, K3s embeds etcd within the k3s process. There is no etcd pod specification file."}),"\n",(0,t.jsx)(r.h3,{id:"119-ensure-that-the-container-network-interface-file-permissions-are-set-to-600-or-more-restrictive-manual",children:"1.1.9 Ensure that the Container Network Interface file permissions are set to 600 or more restrictive (Manual)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Remediation:"}),"\nBy default, K3s sets the CNI file permissions to 644.\nNote that for many CNIs, a lock file is created with permissions 750. This is expected and can be ignored.\nIf you modify your CNI configuration, ensure that the permissions are set to 600.\nFor example, ",(0,t.jsx)(r.code,{children:"chmod 600 /var/lib/cni/networks/"})]}),"\n",(0,t.jsxs)(r.h3,{id:"1110-ensure-that-the-container-network-interface-file-ownership-is-set-to-root-automated",children:["1.1.10 Ensure that the Container Network Interface file ownership is set to root",":root"," (Automated)"]}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"ps -ef | grep containerd | grep -- --cni-conf-dir | sed 's%.*cni-conf-dir[= ]\\([^ ]*\\).*%\\1%' | xargs -I{} find {} -mindepth 1 | xargs --no-run-if-empty stat -c %U:%G\nfind /var/lib/cni/networks -type f 2> /dev/null | xargs --no-run-if-empty stat -c %U:%G\n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," 'root",":root","' is present"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:"root:root\nroot:root\nroot:root\nroot:root\nroot:root\nroot:root\nroot:root\n"})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsxs)(r.p,{children:["Run the below command (based on the file location on your system) on the control plane node.\nFor example,\n",(0,t.jsx)(r.code,{children:"chown root:root "})]})]}),"\n",(0,t.jsx)(r.h3,{id:"1111-ensure-that-the-etcd-data-directory-permissions-are-set-to-700-or-more-restrictive-automated",children:"1.1.11 Ensure that the etcd data directory permissions are set to 700 or more restrictive (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:'if [ "$(journalctl -u k3s | grep -m1 \'Managed etcd cluster\' | wc -l)" -gt 0 ]; then\n stat -c permissions=%a /var/lib/rancher/k3s/server/db/etcd\nelse\n echo "permissions=700"\nfi\n'})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," permissions has permissions 700, expected 700 or more restrictive"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:"permissions=700\n"})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsxs)(r.p,{children:["On the etcd server node, get the etcd data directory, passed as an argument --data-dir,\nfrom the command 'ps -ef | grep etcd'.\nRun the below command (based on the etcd data directory found above). For example,\n",(0,t.jsx)(r.code,{children:"chmod 700 /var/lib/rancher/k3s/server/db/etcd"})]})]}),"\n",(0,t.jsxs)(r.h3,{id:"1112-ensure-that-the-etcd-data-directory-ownership-is-set-to-etcd-automated",children:["1.1.12 Ensure that the etcd data directory ownership is set to etcd",":etcd"," (Automated)"]}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," Not Applicable"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Rationale:"})}),"\n",(0,t.jsxs)(r.p,{children:["For K3s, etcd is embedded within the k3s process. There is no separate etcd process.\nTherefore the etcd data directory ownership is managed by the k3s process and should be root",":root","."]}),"\n",(0,t.jsx)(r.h3,{id:"1113-ensure-that-the-adminconf-file-permissions-are-set-to-600-or-more-restrictive-automated",children:"1.1.13 Ensure that the admin.conf file permissions are set to 600 or more restrictive (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"/bin/sh -c 'if test -e /var/lib/rancher/k3s/server/cred/admin.kubeconfig; then stat -c permissions=%a /var/lib/rancher/k3s/server/cred/admin.kubeconfig; fi'\n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," permissions has permissions 600, expected 600 or more restrictive"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:"permissions=600\n"})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsxs)(r.p,{children:["Run the below command (based on the file location on your system) on the control plane node.\nFor example, ",(0,t.jsx)(r.code,{children:"chmod 600 /var/lib/rancher/k3s/server/cred/admin.kubeconfig"})]})]}),"\n",(0,t.jsxs)(r.h3,{id:"1114-ensure-that-the-adminconf-file-ownership-is-set-to-root-automated",children:["1.1.14 Ensure that the admin.conf file ownership is set to root",":root"," (Automated)"]}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"/bin/sh -c 'if test -e /var/lib/rancher/k3s/server/cred/admin.kubeconfig; then stat -c %U:%G /var/lib/rancher/k3s/server/cred/admin.kubeconfig; fi'\n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," 'root",":root","' is equal to 'root",":root","'"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:"root:root\n"})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsxs)(r.p,{children:["Run the below command (based on the file location on your system) on the control plane node.\nFor example, ",(0,t.jsx)(r.code,{children:"chown root:root /var/lib/rancher/k3s/server/cred/admin.kubeconfig"})]})]}),"\n",(0,t.jsx)(r.h3,{id:"1115-ensure-that-the-schedulerconf-file-permissions-are-set-to-600-or-more-restrictive-automated",children:"1.1.15 Ensure that the scheduler.conf file permissions are set to 600 or more restrictive (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"/bin/sh -c 'if test -e /var/lib/rancher/k3s/server/cred/scheduler.kubeconfig; then stat -c permissions=%a /var/lib/rancher/k3s/server/cred/scheduler.kubeconfig; fi'\n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," permissions has permissions 600, expected 600 or more restrictive"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:"permissions=600\n"})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsxs)(r.p,{children:["Run the below command (based on the file location on your system) on the control plane node.\nFor example,\n",(0,t.jsx)(r.code,{children:"chmod 600 /var/lib/rancher/k3s/server/cred/scheduler.kubeconfig"})]})]}),"\n",(0,t.jsxs)(r.h3,{id:"1116-ensure-that-the-schedulerconf-file-ownership-is-set-to-root-automated",children:["1.1.16 Ensure that the scheduler.conf file ownership is set to root",":root"," (Automated)"]}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"/bin/sh -c 'if test -e /var/lib/rancher/k3s/server/cred/scheduler.kubeconfig; then stat -c %U:%G /var/lib/rancher/k3s/server/cred/scheduler.kubeconfig; fi'\n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," 'root",":root","' is present"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:"root:root\n"})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsxs)(r.p,{children:["Run the below command (based on the file location on your system) on the control plane node.\nFor example,\n",(0,t.jsx)(r.code,{children:"chown root:root /var/lib/rancher/k3s/server/cred/scheduler.kubeconfig"})]})]}),"\n",(0,t.jsx)(r.h3,{id:"1117-ensure-that-the-controller-managerconf-file-permissions-are-set-to-600-or-more-restrictive-automated",children:"1.1.17 Ensure that the controller-manager.conf file permissions are set to 600 or more restrictive (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"/bin/sh -c 'if test -e /var/lib/rancher/k3s/server/cred/controller.kubeconfig; then stat -c permissions=%a /var/lib/rancher/k3s/server/cred/controller.kubeconfig; fi'\n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," permissions has permissions 600, expected 600 or more restrictive"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:"permissions=600\n"})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsxs)(r.p,{children:["Run the below command (based on the file location on your system) on the control plane node.\nFor example,\n",(0,t.jsx)(r.code,{children:"chmod 600 /var/lib/rancher/k3s/server/cred/controller.kubeconfig"})]})]}),"\n",(0,t.jsxs)(r.h3,{id:"1118-ensure-that-the-controller-managerconf-file-ownership-is-set-to-root-automated",children:["1.1.18 Ensure that the controller-manager.conf file ownership is set to root",":root"," (Automated)"]}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"stat -c %U:%G /var/lib/rancher/k3s/server/cred/controller.kubeconfig\n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," 'root",":root","' is equal to 'root",":root","'"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:"root:root\n"})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsxs)(r.p,{children:["Run the below command (based on the file location on your system) on the control plane node.\nFor example,\n",(0,t.jsx)(r.code,{children:"chown root:root /var/lib/rancher/k3s/server/cred/controller.kubeconfig"})]})]}),"\n",(0,t.jsxs)(r.h3,{id:"1119-ensure-that-the-kubernetes-pki-directory-and-file-ownership-is-set-to-root-automated",children:["1.1.19 Ensure that the Kubernetes PKI directory and file ownership is set to root",":root"," (Automated)"]}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"stat -c %U:%G /var/lib/rancher/k3s/server/tls\n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," 'root",":root","' is present"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:"root:root\n"})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsxs)(r.p,{children:["Run the below command (based on the file location on your system) on the control plane node.\nFor example,\n",(0,t.jsx)(r.code,{children:"chown -R root:root /var/lib/rancher/k3s/server/tls"})]})]}),"\n",(0,t.jsx)(r.h3,{id:"1120-ensure-that-the-kubernetes-pki-certificate-file-permissions-are-set-to-600-or-more-restrictive-manual",children:"1.1.20 Ensure that the Kubernetes PKI certificate file permissions are set to 600 or more restrictive (Manual)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Remediation:"}),"\nRun the below command (based on the file location on your system) on the master node.\nFor example,\n",(0,t.jsx)(r.code,{children:"chmod -R 600 /var/lib/rancher/k3s/server/tls/*.crt"})]}),"\n",(0,t.jsx)(r.h3,{id:"1121-ensure-that-the-kubernetes-pki-key-file-permissions-are-set-to-600-automated",children:"1.1.21 Ensure that the Kubernetes PKI key file permissions are set to 600 (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"/bin/sh -c 'stat -c permissions=%a /var/lib/rancher/k3s/server/tls/*.key'\n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," permissions has permissions 600, expected 600 or more restrictive"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:"permissions=600\npermissions=600\npermissions=600\npermissions=600\npermissions=600\npermissions=600\npermissions=600\npermissions=600\npermissions=600\npermissions=600\npermissions=600\npermissions=600\npermissions=600\npermissions=600\npermissions=600\npermissions=600\npermissions=600\n"})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsxs)(r.p,{children:["Run the below command (based on the file location on your system) on the master node.\nFor example,\n",(0,t.jsx)(r.code,{children:"chmod -R 600 /var/lib/rancher/k3s/server/tls/*.key"})]})]}),"\n",(0,t.jsx)(r.h2,{id:"12-api-server",children:"1.2 API Server"}),"\n",(0,t.jsx)(r.h3,{id:"121-ensure-that-the---anonymous-auth-argument-is-set-to-false-automated",children:"1.2.1 Ensure that the --anonymous-auth argument is set to false (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'anonymous-auth'\n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," '--anonymous-auth' is equal to 'false'"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:'Aug 09 19:01:28 server-0 k3s[2354]: time="2024-08-09T19:01:28Z" level=info msg="Running kube-apiserver --admission-control-config-file=/var/lib/rancher/k3s/server/psa.yaml --advertise-address=10.10.10.100 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsx)(r.p,{children:"By default, K3s sets the --anonymous-auth argument to false. If it is set to true,\nedit the K3s config file /etc/rancher/k3s/config.yaml and remove anything similar to below."}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{children:'kube-apiserver-arg:\n - "anonymous-auth=true"\n'})})]}),"\n",(0,t.jsx)(r.h3,{id:"122-ensure-that-the---token-auth-file-parameter-is-not-set-automated",children:"1.2.2 Ensure that the --token-auth-file parameter is not set (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s | grep 'Running kube-apiserver' | tail -n1\n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," '--token-auth-file' is not present"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:'Aug 09 19:01:28 server-0 k3s[2354]: time="2024-08-09T19:01:28Z" level=info msg="Running kube-apiserver --admission-control-config-file=/var/lib/rancher/k3s/server/psa.yaml --advertise-address=10.10.10.100 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsx)(r.p,{children:"Follow the documentation and configure alternate mechanisms for authentication.\nIf this check fails, edit the K3s config file /etc/rancher/k3s/config.yaml and remove anything similar to below."}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{children:'kube-apiserver-arg:\n - "token-auth-file="\n'})})]}),"\n",(0,t.jsx)(r.h3,{id:"123-ensure-that-the---denyserviceexternalips-is-not-set-automated",children:"1.2.3 Ensure that the --DenyServiceExternalIPs is not set (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s | grep 'Running kube-apiserver' | tail -n1\n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," '--enable-admission-plugins' does not have 'DenyServiceExternalIPs' OR '--enable-admission-plugins' is not present"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:'Aug 09 19:01:28 server-0 k3s[2354]: time="2024-08-09T19:01:28Z" level=info msg="Running kube-apiserver --admission-control-config-file=/var/lib/rancher/k3s/server/psa.yaml --advertise-address=10.10.10.100 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsx)(r.p,{children:"By default, K3s does not set DenyServiceExternalIPs.\nIf this check fails, edit the K3s config file /etc/rancher/k3s/config.yaml, remove any lines like below."}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{children:'kube-apiserver-arg:\n - "enable-admission-plugins=DenyServiceExternalIPs"\n'})})]}),"\n",(0,t.jsx)(r.h3,{id:"124-ensure-that-the---kubelet-client-certificate-and---kubelet-client-key-arguments-are-set-as-appropriate-automated",children:"1.2.4 Ensure that the --kubelet-client-certificate and --kubelet-client-key arguments are set as appropriate (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'kubelet-certificate-authority'\n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," '--kubelet-client-certificate' is present AND '--kubelet-client-key' is present"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:'Aug 09 19:01:28 server-0 k3s[2354]: time="2024-08-09T19:01:28Z" level=info msg="Running kube-apiserver --admission-control-config-file=/var/lib/rancher/k3s/server/psa.yaml --advertise-address=10.10.10.100 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsx)(r.p,{children:"By default, K3s automatically provides the kubelet client certificate and key.\nThey are generated and located at /var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt and /var/lib/rancher/k3s/server/tls/client-kube-apiserver.key\nIf for some reason you need to provide your own certificate and key, you can set the\nbelow parameters in the K3s config file /etc/rancher/k3s/config.yaml."}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{children:'kube-apiserver-arg:\n - "kubelet-client-certificate="\n - "kubelet-client-key="\n'})})]}),"\n",(0,t.jsx)(r.h3,{id:"125-ensure-that-the---kubelet-certificate-authority-argument-is-set-as-appropriate-automated",children:"1.2.5 Ensure that the --kubelet-certificate-authority argument is set as appropriate (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'kubelet-certificate-authority'\n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," '--kubelet-certificate-authority' is present"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:'Aug 09 19:01:28 server-0 k3s[2354]: time="2024-08-09T19:01:28Z" level=info msg="Running kube-apiserver --admission-control-config-file=/var/lib/rancher/k3s/server/psa.yaml --advertise-address=10.10.10.100 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsx)(r.p,{children:"By default, K3s automatically provides the kubelet CA cert file, at /var/lib/rancher/k3s/server/tls/server-ca.crt.\nIf this check fails, edit the K3s config file /etc/rancher/k3s/config.yaml and remove any lines like below."}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{children:'kube-apiserver-arg:\n - "kubelet-certificate-authority="\n'})})]}),"\n",(0,t.jsx)(r.h3,{id:"126-ensure-that-the---authorization-mode-argument-is-not-set-to-alwaysallow-automated",children:"1.2.6 Ensure that the --authorization-mode argument is not set to AlwaysAllow (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'authorization-mode'\n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," '--authorization-mode' does not have 'AlwaysAllow'"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:'Aug 09 19:01:28 server-0 k3s[2354]: time="2024-08-09T19:01:28Z" level=info msg="Running kube-apiserver --admission-control-config-file=/var/lib/rancher/k3s/server/psa.yaml --advertise-address=10.10.10.100 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsx)(r.p,{children:"By default, K3s does not set the --authorization-mode to AlwaysAllow.\nIf this check fails, edit K3s config file /etc/rancher/k3s/config.yaml, remove any lines like below."}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{children:'kube-apiserver-arg:\n - "authorization-mode=AlwaysAllow"\n'})})]}),"\n",(0,t.jsx)(r.h3,{id:"127-ensure-that-the---authorization-mode-argument-includes-node-automated",children:"1.2.7 Ensure that the --authorization-mode argument includes Node (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'authorization-mode'\n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," '--authorization-mode' has 'Node'"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:'Aug 09 19:01:28 server-0 k3s[2354]: time="2024-08-09T19:01:28Z" level=info msg="Running kube-apiserver --admission-control-config-file=/var/lib/rancher/k3s/server/psa.yaml --advertise-address=10.10.10.100 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsx)(r.p,{children:"By default, K3s sets the --authorization-mode to Node and RBAC.\nIf this check fails, edit the K3s config file /etc/rancher/k3s/config.yaml,\nensure that you are not overriding authorization-mode."})]}),"\n",(0,t.jsx)(r.h3,{id:"128-ensure-that-the---authorization-mode-argument-includes-rbac-automated",children:"1.2.8 Ensure that the --authorization-mode argument includes RBAC (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'authorization-mode'\n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," '--authorization-mode' has 'RBAC'"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:'Aug 09 19:01:28 server-0 k3s[2354]: time="2024-08-09T19:01:28Z" level=info msg="Running kube-apiserver --admission-control-config-file=/var/lib/rancher/k3s/server/psa.yaml --advertise-address=10.10.10.100 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsx)(r.p,{children:"By default, K3s sets the --authorization-mode to Node and RBAC.\nIf this check fails, edit the K3s config file /etc/rancher/k3s/config.yaml,\nensure that you are not overriding authorization-mode."})]}),"\n",(0,t.jsx)(r.h3,{id:"129-ensure-that-the-admission-control-plugin-eventratelimit-is-set-manual",children:"1.2.9 Ensure that the admission control plugin EventRateLimit is set (Manual)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Remediation:"}),"\nFollow the Kubernetes documentation and set the desired limits in a configuration file.\nThen, edit the K3s config file /etc/rancher/k3s/config.yaml and set the below parameters."]}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{children:'kube-apiserver-arg:\n - "enable-admission-plugins=...,EventRateLimit,..."\n - "admission-control-config-file="\n'})}),"\n",(0,t.jsx)(r.h3,{id:"1210-ensure-that-the-admission-control-plugin-alwaysadmit-is-not-set-automated",children:"1.2.10 Ensure that the admission control plugin AlwaysAdmit is not set (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'enable-admission-plugins'\n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," '--enable-admission-plugins' does not have 'AlwaysAdmit' OR '--enable-admission-plugins' is not present"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:'Aug 09 19:01:28 server-0 k3s[2354]: time="2024-08-09T19:01:28Z" level=info msg="Running kube-apiserver --admission-control-config-file=/var/lib/rancher/k3s/server/psa.yaml --advertise-address=10.10.10.100 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsx)(r.p,{children:"By default, K3s does not set the --enable-admission-plugins to AlwaysAdmit.\nIf this check fails, edit K3s config file /etc/rancher/k3s/config.yaml, remove any lines like below."}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{children:'kube-apiserver-arg:\n - "enable-admission-plugins=AlwaysAdmit"\n'})})]}),"\n",(0,t.jsx)(r.h3,{id:"1211-ensure-that-the-admission-control-plugin-alwayspullimages-is-set-manual",children:"1.2.11 Ensure that the admission control plugin AlwaysPullImages is set (Manual)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Remediation:"}),'\nPermissive, per CIS guidelines,\n"This setting could impact offline or isolated clusters, which have images pre-loaded and\ndo not have access to a registry to pull in-use images. This setting is not appropriate for\nclusters which use this configuration."\nEdit the K3s config file /etc/rancher/k3s/config.yaml and set the below parameter.']}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{children:'kube-apiserver-arg:\n - "enable-admission-plugins=...,AlwaysPullImages,..."\n'})}),"\n",(0,t.jsx)(r.h3,{id:"1212-ensure-that-the-admission-control-plugin-securitycontextdeny-is-set-if-podsecuritypolicy-is-not-used-manual",children:"1.2.12 Ensure that the admission control plugin SecurityContextDeny is set if PodSecurityPolicy is not used (Manual)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," Not Applicable"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Rationale:"})}),"\n",(0,t.jsx)(r.p,{children:"Enabling Pod Security Policy is no longer supported on K3s v1.25+ and will cause applications to unexpectedly fail."}),"\n",(0,t.jsx)(r.h3,{id:"1213-ensure-that-the-admission-control-plugin-serviceaccount-is-set-automated",children:"1.2.13 Ensure that the admission control plugin ServiceAccount is set (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s | grep 'Running kube-apiserver' | tail -n1\n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," '--disable-admission-plugins' is present OR '--disable-admission-plugins' is not present"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:'Aug 09 19:01:28 server-0 k3s[2354]: time="2024-08-09T19:01:28Z" level=info msg="Running kube-apiserver --admission-control-config-file=/var/lib/rancher/k3s/server/psa.yaml --advertise-address=10.10.10.100 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsx)(r.p,{children:"By default, K3s does not set the --disable-admission-plugins to anything.\nFollow the documentation and create ServiceAccount objects as per your environment.\nIf this check fails, edit the K3s config file /etc/rancher/k3s/config.yaml and remove any lines like below."}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{children:'kube-apiserver-arg:\n - "disable-admission-plugins=ServiceAccount"\n'})})]}),"\n",(0,t.jsx)(r.h3,{id:"1214-ensure-that-the-admission-control-plugin-namespacelifecycle-is-set-automated",children:"1.2.14 Ensure that the admission control plugin NamespaceLifecycle is set (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s | grep 'Running kube-apiserver' | tail -n1\n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," '--disable-admission-plugins' is present OR '--disable-admission-plugins' is not present"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:'Aug 09 19:01:28 server-0 k3s[2354]: time="2024-08-09T19:01:28Z" level=info msg="Running kube-apiserver --admission-control-config-file=/var/lib/rancher/k3s/server/psa.yaml --advertise-address=10.10.10.100 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsx)(r.p,{children:"By default, K3s does not set the --disable-admission-plugins to anything.\nIf this check fails, edit the K3s config file /etc/rancher/k3s/config.yaml and remove any lines like below."}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{children:'kube-apiserver-arg:\n - "disable-admission-plugins=...,NamespaceLifecycle,..."\n'})})]}),"\n",(0,t.jsx)(r.h3,{id:"1215-ensure-that-the-admission-control-plugin-noderestriction-is-set-automated",children:"1.2.15 Ensure that the admission control plugin NodeRestriction is set (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'enable-admission-plugins'\n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," '--enable-admission-plugins' has 'NodeRestriction'"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:'Aug 09 19:01:28 server-0 k3s[2354]: time="2024-08-09T19:01:28Z" level=info msg="Running kube-apiserver --admission-control-config-file=/var/lib/rancher/k3s/server/psa.yaml --advertise-address=10.10.10.100 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsx)(r.p,{children:"By default, K3s sets the --enable-admission-plugins to NodeRestriction.\nIf using the K3s config file /etc/rancher/k3s/config.yaml, check that you are not overriding the admission plugins.\nIf you are, include NodeRestriction in the list."}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{children:'kube-apiserver-arg:\n - "enable-admission-plugins=...,NodeRestriction,..."\n'})})]}),"\n",(0,t.jsx)(r.h3,{id:"1216-ensure-that-the---secure-port-argument-is-not-set-to-0---notethis-recommendation-is-obsolete-and-will-be-deleted-per-the-consensus-process-automated",children:"1.2.16 Ensure that the --secure-port argument is not set to 0 - NoteThis recommendation is obsolete and will be deleted per the consensus process (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'secure-port'\n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," '--secure-port' is greater than 0 OR '--secure-port' is not present"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:'Aug 09 19:01:28 server-0 k3s[2354]: time="2024-08-09T19:01:28Z" level=info msg="Running kube-apiserver --admission-control-config-file=/var/lib/rancher/k3s/server/psa.yaml --advertise-address=10.10.10.100 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsx)(r.p,{children:"By default, K3s sets the secure port to 6444.\nIf this check fails, edit the K3s config file /etc/rancher/k3s/config.yaml and remove any lines like below."}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{children:'kube-apiserver-arg:\n - "secure-port="\n'})})]}),"\n",(0,t.jsx)(r.h3,{id:"1217-ensure-that-the---profiling-argument-is-set-to-false-automated",children:"1.2.17 Ensure that the --profiling argument is set to false (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'profiling'\n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," '--profiling' is equal to 'false'"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:'Aug 09 19:01:28 server-0 k3s[2354]: time="2024-08-09T19:01:28Z" level=info msg="Running kube-apiserver --admission-control-config-file=/var/lib/rancher/k3s/server/psa.yaml --advertise-address=10.10.10.100 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsx)(r.p,{children:"By default, K3s sets the --profiling argument to false.\nIf this check fails, edit the K3s config file /etc/rancher/k3s/config.yaml and remove any lines like below."}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{children:'kube-apiserver-arg:\n - "profiling=true"\n'})})]}),"\n",(0,t.jsx)(r.h3,{id:"1218-ensure-that-the---audit-log-path-argument-is-set-manual",children:"1.2.18 Ensure that the --audit-log-path argument is set (Manual)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s | grep 'Running kube-apiserver' | tail -n1\n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," '--audit-log-path' is present"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:'Aug 09 19:01:28 server-0 k3s[2354]: time="2024-08-09T19:01:28Z" level=info msg="Running kube-apiserver --admission-control-config-file=/var/lib/rancher/k3s/server/psa.yaml --advertise-address=10.10.10.100 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsx)(r.p,{children:"Edit the K3s config file /etc/rancher/k3s/config.yaml and set the audit-log-path parameter to a suitable path and\nfile where you would like audit logs to be written, for example,"}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{children:'kube-apiserver-arg:\n - "audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log"\n'})})]}),"\n",(0,t.jsx)(r.h3,{id:"1219-ensure-that-the---audit-log-maxage-argument-is-set-to-30-or-as-appropriate-manual",children:"1.2.19 Ensure that the --audit-log-maxage argument is set to 30 or as appropriate (Manual)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s | grep 'Running kube-apiserver' | tail -n1\n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," '--audit-log-maxage' is greater or equal to 30"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:'Aug 09 19:01:28 server-0 k3s[2354]: time="2024-08-09T19:01:28Z" level=info msg="Running kube-apiserver --admission-control-config-file=/var/lib/rancher/k3s/server/psa.yaml --advertise-address=10.10.10.100 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsx)(r.p,{children:"Edit the K3s config file /etc/rancher/k3s/config.yaml on the control plane node and\nset the audit-log-maxage parameter to 30 or as an appropriate number of days, for example,"}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{children:'kube-apiserver-arg:\n - "audit-log-maxage=30"\n'})})]}),"\n",(0,t.jsx)(r.h3,{id:"1220-ensure-that-the---audit-log-maxbackup-argument-is-set-to-10-or-as-appropriate-manual",children:"1.2.20 Ensure that the --audit-log-maxbackup argument is set to 10 or as appropriate (Manual)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s | grep 'Running kube-apiserver' | tail -n1\n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," '--audit-log-maxbackup' is greater or equal to 10"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:'Aug 09 19:01:28 server-0 k3s[2354]: time="2024-08-09T19:01:28Z" level=info msg="Running kube-apiserver --admission-control-config-file=/var/lib/rancher/k3s/server/psa.yaml --advertise-address=10.10.10.100 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsx)(r.p,{children:"Edit the K3s config file /etc/rancher/k3s/config.yaml on the control plane node and\nset the audit-log-maxbackup parameter to 10 or to an appropriate value. For example,"}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{children:'kube-apiserver-arg:\n - "audit-log-maxbackup=10"\n'})})]}),"\n",(0,t.jsx)(r.h3,{id:"1221-ensure-that-the---audit-log-maxsize-argument-is-set-to-100-or-as-appropriate-manual",children:"1.2.21 Ensure that the --audit-log-maxsize argument is set to 100 or as appropriate (Manual)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s | grep 'Running kube-apiserver' | tail -n1\n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," '--audit-log-maxsize' is greater or equal to 100"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:'Aug 09 19:01:28 server-0 k3s[2354]: time="2024-08-09T19:01:28Z" level=info msg="Running kube-apiserver --admission-control-config-file=/var/lib/rancher/k3s/server/psa.yaml --advertise-address=10.10.10.100 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsx)(r.p,{children:"Edit the K3s config file /etc/rancher/k3s/config.yaml on the control plane node and\nset the audit-log-maxsize parameter to an appropriate size in MB. For example,"}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{children:'kube-apiserver-arg:\n - "audit-log-maxsize=100"\n'})})]}),"\n",(0,t.jsx)(r.h3,{id:"1222-ensure-that-the---request-timeout-argument-is-set-as-appropriate-manual",children:"1.2.22 Ensure that the --request-timeout argument is set as appropriate (Manual)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Remediation:"}),'\nPermissive, per CIS guidelines,\n"it is recommended to set this limit as appropriate and change the default limit of 60 seconds only if needed".\nEdit the K3s config file /etc/rancher/k3s/config.yaml\nand set the below parameter if needed. For example,']}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{children:'kube-apiserver-arg:\n - "request-timeout=300s"\n'})}),"\n",(0,t.jsx)(r.h3,{id:"1223-ensure-that-the---service-account-lookup-argument-is-set-to-true-automated",children:"1.2.23 Ensure that the --service-account-lookup argument is set to true (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s | grep 'Running kube-apiserver' | tail -n1\n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," '--service-account-lookup' is not present OR '--service-account-lookup' is present"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:'Aug 09 19:01:28 server-0 k3s[2354]: time="2024-08-09T19:01:28Z" level=info msg="Running kube-apiserver --admission-control-config-file=/var/lib/rancher/k3s/server/psa.yaml --advertise-address=10.10.10.100 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsx)(r.p,{children:"By default, K3s does not set the --service-account-lookup argument.\nEdit the K3s config file /etc/rancher/k3s/config.yaml and set the service-account-lookup. For example,"}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{children:'kube-apiserver-arg:\n - "service-account-lookup=true"\n'})}),(0,t.jsx)(r.p,{children:"Alternatively, you can delete the service-account-lookup parameter from this file so\nthat the default takes effect."})]}),"\n",(0,t.jsx)(r.h3,{id:"1224-ensure-that-the---service-account-key-file-argument-is-set-as-appropriate-automated",children:"1.2.24 Ensure that the --service-account-key-file argument is set as appropriate (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s | grep 'Running kube-apiserver' | tail -n1\n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," '--service-account-key-file' is present"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:'Aug 09 19:01:28 server-0 k3s[2354]: time="2024-08-09T19:01:28Z" level=info msg="Running kube-apiserver --admission-control-config-file=/var/lib/rancher/k3s/server/psa.yaml --advertise-address=10.10.10.100 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsx)(r.p,{children:"K3s automatically generates and sets the service account key file.\nIt is located at /var/lib/rancher/k3s/server/tls/service.key.\nIf this check fails, edit K3s config file /etc/rancher/k3s/config.yaml and remove any lines like below."}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{children:'kube-apiserver-arg:\n - "service-account-key-file="\n'})})]}),"\n",(0,t.jsx)(r.h3,{id:"1225-ensure-that-the---etcd-certfile-and---etcd-keyfile-arguments-are-set-as-appropriate-automated",children:"1.2.25 Ensure that the --etcd-certfile and --etcd-keyfile arguments are set as appropriate (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"if [ \"$(journalctl -u k3s | grep -m1 'Managed etcd cluster' | wc -l)\" -gt 0 ]; then\n journalctl -D /var/log/journal -u k3s | grep -m1 'Running kube-apiserver' | tail -n1\nelse\n echo \"--etcd-certfile AND --etcd-keyfile\"\nfi\n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," '--etcd-certfile' is present AND '--etcd-keyfile' is present"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:'Aug 09 19:01:28 server-0 k3s[2354]: time="2024-08-09T19:01:28Z" level=info msg="Running kube-apiserver --admission-control-config-file=/var/lib/rancher/k3s/server/psa.yaml --advertise-address=10.10.10.100 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsx)(r.p,{children:"K3s automatically generates and sets the etcd certificate and key files.\nThey are located at /var/lib/rancher/k3s/server/tls/etcd/client.crt and /var/lib/rancher/k3s/server/tls/etcd/client.key.\nIf this check fails, edit the K3s config file /etc/rancher/k3s/config.yaml and remove any lines like below."}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{children:'kube-apiserver-arg:\n - "etcd-certfile="\n - "etcd-keyfile="\n'})})]}),"\n",(0,t.jsx)(r.h3,{id:"1226-ensure-that-the---tls-cert-file-and---tls-private-key-file-arguments-are-set-as-appropriate-automated",children:"1.2.26 Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"journalctl -D /var/log/journal -u k3s | grep -A1 'Running kube-apiserver' | tail -n2\n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," '--tls-cert-file' is present AND '--tls-private-key-file' is present"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:'Aug 09 19:01:28 server-0 k3s[2354]: time="2024-08-09T19:01:28Z" level=info msg="Running kube-apiserver --admission-control-config-file=/var/lib/rancher/k3s/server/psa.yaml --advertise-address=10.10.10.100 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\nAug 09 19:01:28 server-0 k3s[2354]: time="2024-08-09T19:01:28Z" level=info msg="Running kube-scheduler --authentication-kubeconfig=/var/lib/rancher/k3s/server/cred/scheduler.kubeconfig --authorization-kubeconfig=/var/lib/rancher/k3s/server/cred/scheduler.kubeconfig --bind-address=127.0.0.1 --kubeconfig=/var/lib/rancher/k3s/server/cred/scheduler.kubeconfig --profiling=false --secure-port=10259"\n'})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsx)(r.p,{children:"By default, K3s automatically generates and provides the TLS certificate and private key for the apiserver.\nThey are generated and located at /var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt and /var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key\nIf this check fails, edit the K3s config file /etc/rancher/k3s/config.yaml and remove any lines like below."}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{children:'kube-apiserver-arg:\n - "tls-cert-file="\n - "tls-private-key-file="\n'})})]}),"\n",(0,t.jsx)(r.h3,{id:"1227-ensure-that-the---client-ca-file-argument-is-set-as-appropriate-automated",children:"1.2.27 Ensure that the --client-ca-file argument is set as appropriate (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'client-ca-file'\n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," '--client-ca-file' is present"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:'Aug 09 19:01:28 server-0 k3s[2354]: time="2024-08-09T19:01:28Z" level=info msg="Running kube-apiserver --admission-control-config-file=/var/lib/rancher/k3s/server/psa.yaml --advertise-address=10.10.10.100 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsx)(r.p,{children:"By default, K3s automatically provides the client certificate authority file.\nIt is generated and located at /var/lib/rancher/k3s/server/tls/client-ca.crt.\nIf this check fails, edit the K3s config file /etc/rancher/k3s/config.yaml and remove any lines like below."}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{children:'kube-apiserver-arg:\n - "client-ca-file="\n'})})]}),"\n",(0,t.jsx)(r.h3,{id:"1228-ensure-that-the---etcd-cafile-argument-is-set-as-appropriate-automated",children:"1.2.28 Ensure that the --etcd-cafile argument is set as appropriate (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'etcd-cafile'\n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," '--etcd-cafile' is present"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:'Aug 09 19:01:28 server-0 k3s[2354]: time="2024-08-09T19:01:28Z" level=info msg="Running kube-apiserver --admission-control-config-file=/var/lib/rancher/k3s/server/psa.yaml --advertise-address=10.10.10.100 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsx)(r.p,{children:"By default, K3s automatically provides the etcd certificate authority file.\nIt is generated and located at /var/lib/rancher/k3s/server/tls/client-ca.crt.\nIf this check fails, edit the K3s config file /etc/rancher/k3s/config.yaml and remove any lines like below."}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{children:'kube-apiserver-arg:\n - "etcd-cafile="\n'})})]}),"\n",(0,t.jsx)(r.h3,{id:"1229-ensure-that-the---encryption-provider-config-argument-is-set-as-appropriate-manual",children:"1.2.29 Ensure that the --encryption-provider-config argument is set as appropriate (Manual)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'encryption-provider-config'\n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," '--encryption-provider-config' is present"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:'Aug 09 19:01:28 server-0 k3s[2354]: time="2024-08-09T19:01:28Z" level=info msg="Running kube-apiserver --admission-control-config-file=/var/lib/rancher/k3s/server/psa.yaml --advertise-address=10.10.10.100 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsx)(r.p,{children:"K3s can be configured to use encryption providers to encrypt secrets at rest.\nEdit the K3s config file /etc/rancher/k3s/config.yaml on the control plane node and set the below parameter.\nsecrets-encryption: true\nSecrets encryption can then be managed with the k3s secrets-encrypt command line tool.\nIf needed, you can find the generated encryption config at /var/lib/rancher/k3s/server/cred/encryption-config.json."})]}),"\n",(0,t.jsx)(r.h3,{id:"1230-ensure-that-encryption-providers-are-appropriately-configured-manual",children:"1.2.30 Ensure that encryption providers are appropriately configured (Manual)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"ENCRYPTION_PROVIDER_CONFIG=$(journalctl -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep -- --encryption-provider-config | sed 's%.*encryption-provider-config[= ]\\([^ ]*\\).*%\\1%')\nif test -e $ENCRYPTION_PROVIDER_CONFIG; then grep -o 'providers\\\"\\:\\[.*\\]' $ENCRYPTION_PROVIDER_CONFIG | grep -o \"[A-Za-z]*\" | head -2 | tail -1 | sed 's/^/provider=/'; fi\n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," 'provider' contains valid elements from 'aescbc,kms,secretbox'"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:"provider=aescbc\n"})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsx)(r.p,{children:"K3s can be configured to use encryption providers to encrypt secrets at rest. K3s will utilize the aescbc provider.\nEdit the K3s config file /etc/rancher/k3s/config.yaml on the control plane node and set the below parameter.\nsecrets-encryption: true\nSecrets encryption can then be managed with the k3s secrets-encrypt command line tool.\nIf needed, you can find the generated encryption config at /var/lib/rancher/k3s/server/cred/encryption-config.json"})]}),"\n",(0,t.jsx)(r.h3,{id:"1231-ensure-that-the-api-server-only-makes-use-of-strong-cryptographic-ciphers-automated",children:"1.2.31 Ensure that the API Server only makes use of Strong Cryptographic Ciphers (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'tls-cipher-suites'\n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," '--tls-cipher-suites' contains valid elements from 'TLS_AES_128_GCM_SHA256,TLS_AES_256_GCM_SHA384,TLS_CHACHA20_POLY1305_SHA256,TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256,TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256,TLS_RSA_WITH_3DES_EDE_CBC_SHA,TLS_RSA_WITH_AES_128_CBC_SHA,TLS_RSA_WITH_AES_128_GCM_SHA256,TLS_RSA_WITH_AES_256_CBC_SHA,TLS_RSA_WITH_AES_256_GCM_SHA384'"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:'Aug 09 19:01:28 server-0 k3s[2354]: time="2024-08-09T19:01:28Z" level=info msg="Running kube-apiserver --admission-control-config-file=/var/lib/rancher/k3s/server/psa.yaml --advertise-address=10.10.10.100 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsxs)(r.p,{children:["By default, the K3s kube-apiserver complies with this test. Changes to these values may cause regression, therefore ensure that all apiserver clients support the new TLS configuration before applying it in production deployments.\nIf a custom TLS configuration is required, consider also creating a custom version of this rule that aligns with your requirements.\nIf this check fails, remove any custom configuration around ",(0,t.jsx)(r.code,{children:"tls-cipher-suites"})," or update the /etc/rancher/k3s/config.yaml file to match the default by adding the following:"]}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{children:'kube-apiserver-arg:\n - "tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305"\n'})})]}),"\n",(0,t.jsx)(r.h2,{id:"13-controller-manager",children:"1.3 Controller Manager"}),"\n",(0,t.jsx)(r.h3,{id:"131-ensure-that-the---terminated-pod-gc-threshold-argument-is-set-as-appropriate-manual",children:"1.3.1 Ensure that the --terminated-pod-gc-threshold argument is set as appropriate (Manual)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s | grep 'Running kube-controller-manager' | tail -n1 | grep 'terminated-pod-gc-threshold'\n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," '--terminated-pod-gc-threshold' is present"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:'Aug 09 19:01:28 server-0 k3s[2354]: time="2024-08-09T19:01:28Z" level=info msg="Running kube-controller-manager --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/k3s/server/tls/client-ca.nochain.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/k3s/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/k3s/server/tls/client-ca.nochain.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/k3s/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/k3s/server/tls/server-ca.nochain.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/k3s/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/k3s/server/tls/server-ca.nochain.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/k3s/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,tokencleaner,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/k3s/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --terminated-pod-gc-threshold=10 --use-service-account-credentials=true"\n'})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsx)(r.p,{children:"Edit the K3s config file /etc/rancher/k3s/config.yaml on the control plane node\nand set the --terminated-pod-gc-threshold to an appropriate threshold,"}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{children:'kube-controller-manager-arg:\n - "terminated-pod-gc-threshold=10"\n'})})]}),"\n",(0,t.jsx)(r.h3,{id:"132-ensure-that-the---profiling-argument-is-set-to-false-automated",children:"1.3.2 Ensure that the --profiling argument is set to false (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s | grep 'Running kube-controller-manager' | tail -n1 | grep 'profiling'\n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," '--profiling' is equal to 'false'"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:'Aug 09 19:01:28 server-0 k3s[2354]: time="2024-08-09T19:01:28Z" level=info msg="Running kube-controller-manager --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/k3s/server/tls/client-ca.nochain.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/k3s/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/k3s/server/tls/client-ca.nochain.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/k3s/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/k3s/server/tls/server-ca.nochain.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/k3s/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/k3s/server/tls/server-ca.nochain.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/k3s/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,tokencleaner,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/k3s/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --terminated-pod-gc-threshold=10 --use-service-account-credentials=true"\n'})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsx)(r.p,{children:"By default, K3s sets the --profiling argument to false.\nIf this check fails, edit the K3s config file /etc/rancher/k3s/config.yaml and remove any lines like below."}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{children:'kube-controller-manager-arg:\n - "profiling=true"\n'})})]}),"\n",(0,t.jsx)(r.h3,{id:"133-ensure-that-the---use-service-account-credentials-argument-is-set-to-true-automated",children:"1.3.3 Ensure that the --use-service-account-credentials argument is set to true (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s | grep 'Running kube-controller-manager' | tail -n1 | grep 'use-service-account-credentials'\n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," '--use-service-account-credentials' is not equal to 'false'"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:'Aug 09 19:01:28 server-0 k3s[2354]: time="2024-08-09T19:01:28Z" level=info msg="Running kube-controller-manager --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/k3s/server/tls/client-ca.nochain.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/k3s/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/k3s/server/tls/client-ca.nochain.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/k3s/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/k3s/server/tls/server-ca.nochain.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/k3s/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/k3s/server/tls/server-ca.nochain.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/k3s/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,tokencleaner,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/k3s/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --terminated-pod-gc-threshold=10 --use-service-account-credentials=true"\n'})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsx)(r.p,{children:"By default, K3s sets the --use-service-account-credentials argument to true.\nIf this check fails, edit the K3s config file /etc/rancher/k3s/config.yaml and remove any lines like below."}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{children:'kube-controller-manager-arg:\n - "use-service-account-credentials=false"\n'})})]}),"\n",(0,t.jsx)(r.h3,{id:"134-ensure-that-the---service-account-private-key-file-argument-is-set-as-appropriate-automated",children:"1.3.4 Ensure that the --service-account-private-key-file argument is set as appropriate (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s | grep 'Running kube-controller-manager' | tail -n1 | grep 'service-account-private-key-file'\n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," '--service-account-private-key-file' is present"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:'Aug 09 19:01:28 server-0 k3s[2354]: time="2024-08-09T19:01:28Z" level=info msg="Running kube-controller-manager --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/k3s/server/tls/client-ca.nochain.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/k3s/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/k3s/server/tls/client-ca.nochain.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/k3s/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/k3s/server/tls/server-ca.nochain.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/k3s/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/k3s/server/tls/server-ca.nochain.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/k3s/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,tokencleaner,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/k3s/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --terminated-pod-gc-threshold=10 --use-service-account-credentials=true"\n'})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsx)(r.p,{children:"By default, K3s automatically provides the service account private key file.\nIt is generated and located at /var/lib/rancher/k3s/server/tls/service.current.key.\nIf this check fails, edit the K3s config file /etc/rancher/k3s/config.yaml and remove any lines like below."}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{children:'kube-controller-manager-arg:\n - "service-account-private-key-file="\n'})})]}),"\n",(0,t.jsx)(r.h3,{id:"135-ensure-that-the---root-ca-file-argument-is-set-as-appropriate-automated",children:"1.3.5 Ensure that the --root-ca-file argument is set as appropriate (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s | grep 'Running kube-controller-manager' | tail -n1 | grep 'root-ca-file'\n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," '--root-ca-file' is present"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:'Aug 09 19:01:28 server-0 k3s[2354]: time="2024-08-09T19:01:28Z" level=info msg="Running kube-controller-manager --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/k3s/server/tls/client-ca.nochain.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/k3s/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/k3s/server/tls/client-ca.nochain.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/k3s/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/k3s/server/tls/server-ca.nochain.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/k3s/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/k3s/server/tls/server-ca.nochain.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/k3s/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,tokencleaner,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/k3s/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --terminated-pod-gc-threshold=10 --use-service-account-credentials=true"\n'})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsx)(r.p,{children:"By default, K3s automatically provides the root CA file.\nIt is generated and located at /var/lib/rancher/k3s/server/tls/server-ca.crt.\nIf this check fails, edit the K3s config file /etc/rancher/k3s/config.yaml and remove any lines like below."}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{children:'kube-controller-manager-arg:\n - "root-ca-file="\n'})})]}),"\n",(0,t.jsx)(r.h3,{id:"136-ensure-that-the-rotatekubeletservercertificate-argument-is-set-to-true-automated",children:"1.3.6 Ensure that the RotateKubeletServerCertificate argument is set to true (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s | grep 'Running kube-controller-manager' | tail -n1\n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," '--feature-gates' does not have 'RotateKubeletServerCertificate=false' OR '--feature-gates' is not present"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:'Aug 09 19:01:28 server-0 k3s[2354]: time="2024-08-09T19:01:28Z" level=info msg="Running kube-controller-manager --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/k3s/server/tls/client-ca.nochain.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/k3s/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/k3s/server/tls/client-ca.nochain.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/k3s/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/k3s/server/tls/server-ca.nochain.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/k3s/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/k3s/server/tls/server-ca.nochain.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/k3s/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,tokencleaner,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/k3s/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --terminated-pod-gc-threshold=10 --use-service-account-credentials=true"\n'})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsx)(r.p,{children:"By default, K3s does not set the RotateKubeletServerCertificate feature gate.\nIf you have enabled this feature gate, you should remove it.\nIf this check fails, edit the K3s config file /etc/rancher/k3s/config.yaml, remove any lines like below."}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{children:'kube-controller-manager-arg:\n - "feature-gate=RotateKubeletServerCertificate"\n'})})]}),"\n",(0,t.jsx)(r.h3,{id:"137-ensure-that-the---bind-address-argument-is-set-to-127001-automated",children:"1.3.7 Ensure that the --bind-address argument is set to 127.0.0.1 (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"/bin/ps -ef | grep containerd | grep -v grep\n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," '--bind-address' is present OR '--bind-address' is not present"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:"root 2372 2354 4 19:01 ? 00:00:05 containerd -c /var/lib/rancher/k3s/agent/etc/containerd/config.toml -a /run/k3s/containerd/containerd.sock --state /run/k3s/containerd --root /var/lib/rancher/k3s/agent/containerd\nroot 3128 1 0 19:01 ? 00:00:00 /var/lib/rancher/k3s/data/0f1a87835be3817408b496b439fddb9ea54cab4298db472792bb1b1cbdc210bc/bin/containerd-shim-runc-v2 -namespace k8s.io -id 878d74b0d77d904ec40cd1db71956f2edeb68ab420227a5a42e6d25f249a140a -address /run/k3s/containerd/containerd.sock\nroot 3239 1 0 19:01 ? 00:00:00 /var/lib/rancher/k3s/data/0f1a87835be3817408b496b439fddb9ea54cab4298db472792bb1b1cbdc210bc/bin/containerd-shim-runc-v2 -namespace k8s.io -id d00cc363af40aee36210e396597e4c02712ae99535be21d204849dc33a22af88 -address /run/k3s/containerd/containerd.sock\nroot 3293 1 0 19:01 ? 00:00:00 /var/lib/rancher/k3s/data/0f1a87835be3817408b496b439fddb9ea54cab4298db472792bb1b1cbdc210bc/bin/containerd-shim-runc-v2 -namespace k8s.io -id 5df076fa9547c555a2231b9a9a7cbb44021eaa1ab68c9b59b13da960697143f6 -address /run/k3s/containerd/containerd.sock\nroot 4557 1 0 19:02 ? 00:00:00 /var/lib/rancher/k3s/data/0f1a87835be3817408b496b439fddb9ea54cab4298db472792bb1b1cbdc210bc/bin/containerd-shim-runc-v2 -namespace k8s.io -id f6483b71bcb7ea23356003921a7d90cf638b8f9e473728f3b28dc67163e0fa2d -address /run/k3s/containerd/containerd.sock\nroot 4644 1 0 19:02 ? 00:00:00 /var/lib/rancher/k3s/data/0f1a87835be3817408b496b439fddb9ea54cab4298db472792bb1b1cbdc210bc/bin/containerd-shim-runc-v2 -namespace k8s.io -id 4d8ceb2620c4e0501a49dc9192fc56d035e76bc79a2c6072fee8619730006233 -address /run/k3s/containerd/containerd.sock\n"})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsx)(r.p,{children:"By default, K3s sets the --bind-address argument to 127.0.0.1\nIf this check fails, edit the K3s config file /etc/rancher/k3s/config.yaml and remove any lines like below."}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{children:'kube-controller-manager-arg:\n - "bind-address="\n'})})]}),"\n",(0,t.jsx)(r.h2,{id:"14-scheduler",children:"1.4 Scheduler"}),"\n",(0,t.jsx)(r.h3,{id:"141-ensure-that-the---profiling-argument-is-set-to-false-automated",children:"1.4.1 Ensure that the --profiling argument is set to false (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"journalctl -D /var/log/journal -u k3s | grep 'Running kube-scheduler' | tail -n1\n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," '--profiling' is equal to 'false'"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:'Aug 09 19:01:28 server-0 k3s[2354]: time="2024-08-09T19:01:28Z" level=info msg="Running kube-scheduler --authentication-kubeconfig=/var/lib/rancher/k3s/server/cred/scheduler.kubeconfig --authorization-kubeconfig=/var/lib/rancher/k3s/server/cred/scheduler.kubeconfig --bind-address=127.0.0.1 --kubeconfig=/var/lib/rancher/k3s/server/cred/scheduler.kubeconfig --profiling=false --secure-port=10259"\n'})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsx)(r.p,{children:"By default, K3s sets the --profiling argument to false.\nIf this check fails, edit the K3s config file /etc/rancher/k3s/config.yaml and remove any lines like below."}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{children:'kube-scheduler-arg:\n - "profiling=true"\n'})})]}),"\n",(0,t.jsx)(r.h3,{id:"142-ensure-that-the---bind-address-argument-is-set-to-127001-automated",children:"1.4.2 Ensure that the --bind-address argument is set to 127.0.0.1 (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s | grep 'Running kube-scheduler' | tail -n1 | grep 'bind-address'\n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," '--bind-address' is equal to '127.0.0.1' OR '--bind-address' is not present"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:'Aug 09 19:01:28 server-0 k3s[2354]: time="2024-08-09T19:01:28Z" level=info msg="Running kube-scheduler --authentication-kubeconfig=/var/lib/rancher/k3s/server/cred/scheduler.kubeconfig --authorization-kubeconfig=/var/lib/rancher/k3s/server/cred/scheduler.kubeconfig --bind-address=127.0.0.1 --kubeconfig=/var/lib/rancher/k3s/server/cred/scheduler.kubeconfig --profiling=false --secure-port=10259"\n'})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsx)(r.p,{children:"By default, K3s sets the --bind-address argument to 127.0.0.1\nIf this check fails, edit the K3s config file /etc/rancher/k3s/config.yaml and remove any lines like below."}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{children:'kube-scheduler-arg:\n - "bind-address="\n'})})]}),"\n",(0,t.jsx)(r.h2,{id:"2-etcd-node-configuration",children:"2 Etcd Node Configuration"}),"\n",(0,t.jsx)(r.h3,{id:"21-ensure-that-the---cert-file-and---key-file-arguments-are-set-as-appropriate-automated",children:"2.1 Ensure that the --cert-file and --key-file arguments are set as appropriate (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," '.client-transport-security.cert-file' is equal to '/var/lib/rancher/k3s/server/tls/etcd/server-client.crt' AND '.client-transport-security.key-file' is equal to '/var/lib/rancher/k3s/server/tls/etcd/server-client.key'"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:"advertise-client-urls: https://10.10.10.100:2379\nclient-transport-security:\n cert-file: /var/lib/rancher/k3s/server/tls/etcd/server-client.crt\n client-cert-auth: true\n key-file: /var/lib/rancher/k3s/server/tls/etcd/server-client.key\n trusted-ca-file: /var/lib/rancher/k3s/server/tls/etcd/server-ca.crt\ndata-dir: /var/lib/rancher/k3s/server/db/etcd\nelection-timeout: 5000\nexperimental-initial-corrupt-check: true\nheartbeat-interval: 500\ninitial-advertise-peer-urls: https://10.10.10.100:2380\ninitial-cluster: server-0-4a89bd20=https://10.10.10.100:2380\ninitial-cluster-state: new\nlisten-client-http-urls: https://127.0.0.1:2382\nlisten-client-urls: https://127.0.0.1:2379,https://10.10.10.100:2379\nlisten-metrics-urls: http://127.0.0.1:2381\nlisten-peer-urls: https://127.0.0.1:2380,https://10.10.10.100:2380\nlog-outputs:\n- stderr\nlogger: zap\nname: server-0-4a89bd20\npeer-transport-security:\n cert-file: /var/lib/rancher/k3s/server/tls/etcd/peer-server-client.crt\n client-cert-auth: true\n key-file: /var/lib/rancher/k3s/server/tls/etcd/peer-server-client.key\n trusted-ca-file: /var/lib/rancher/k3s/server/tls/etcd/peer-ca.crt\nsnapshot-count: 10000\n"})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsx)(r.p,{children:"If running on with sqlite or a external DB, etcd checks are Not Applicable.\nWhen running with embedded-etcd, K3s generates cert and key files for etcd.\nThese are located in /var/lib/rancher/k3s/server/tls/etcd/.\nIf this check fails, ensure that the configuration file /var/lib/rancher/k3s/server/db/etcd/config\nhas not been modified to use custom cert and key files."})]}),"\n",(0,t.jsx)(r.h3,{id:"22-ensure-that-the---client-cert-auth-argument-is-set-to-true-automated",children:"2.2 Ensure that the --client-cert-auth argument is set to true (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," '.client-transport-security.client-cert-auth' is equal to 'true'"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:"advertise-client-urls: https://10.10.10.100:2379\nclient-transport-security:\n cert-file: /var/lib/rancher/k3s/server/tls/etcd/server-client.crt\n client-cert-auth: true\n key-file: /var/lib/rancher/k3s/server/tls/etcd/server-client.key\n trusted-ca-file: /var/lib/rancher/k3s/server/tls/etcd/server-ca.crt\ndata-dir: /var/lib/rancher/k3s/server/db/etcd\nelection-timeout: 5000\nexperimental-initial-corrupt-check: true\nheartbeat-interval: 500\ninitial-advertise-peer-urls: https://10.10.10.100:2380\ninitial-cluster: server-0-4a89bd20=https://10.10.10.100:2380\ninitial-cluster-state: new\nlisten-client-http-urls: https://127.0.0.1:2382\nlisten-client-urls: https://127.0.0.1:2379,https://10.10.10.100:2379\nlisten-metrics-urls: http://127.0.0.1:2381\nlisten-peer-urls: https://127.0.0.1:2380,https://10.10.10.100:2380\nlog-outputs:\n- stderr\nlogger: zap\nname: server-0-4a89bd20\npeer-transport-security:\n cert-file: /var/lib/rancher/k3s/server/tls/etcd/peer-server-client.crt\n client-cert-auth: true\n key-file: /var/lib/rancher/k3s/server/tls/etcd/peer-server-client.key\n trusted-ca-file: /var/lib/rancher/k3s/server/tls/etcd/peer-ca.crt\nsnapshot-count: 10000\n"})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsx)(r.p,{children:"If running on with sqlite or a external DB, etcd checks are Not Applicable.\nWhen running with embedded-etcd, K3s sets the --client-cert-auth parameter to true.\nIf this check fails, ensure that the configuration file /var/lib/rancher/k3s/server/db/etcd/config\nhas not been modified to disable client certificate authentication."})]}),"\n",(0,t.jsx)(r.h3,{id:"23-ensure-that-the---auto-tls-argument-is-not-set-to-true-automated",children:"2.3 Ensure that the --auto-tls argument is not set to true (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," '.client-transport-security.auto-tls' is present OR '.client-transport-security.auto-tls' is not present"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:"advertise-client-urls: https://10.10.10.100:2379\nclient-transport-security:\n cert-file: /var/lib/rancher/k3s/server/tls/etcd/server-client.crt\n client-cert-auth: true\n key-file: /var/lib/rancher/k3s/server/tls/etcd/server-client.key\n trusted-ca-file: /var/lib/rancher/k3s/server/tls/etcd/server-ca.crt\ndata-dir: /var/lib/rancher/k3s/server/db/etcd\nelection-timeout: 5000\nexperimental-initial-corrupt-check: true\nheartbeat-interval: 500\ninitial-advertise-peer-urls: https://10.10.10.100:2380\ninitial-cluster: server-0-4a89bd20=https://10.10.10.100:2380\ninitial-cluster-state: new\nlisten-client-http-urls: https://127.0.0.1:2382\nlisten-client-urls: https://127.0.0.1:2379,https://10.10.10.100:2379\nlisten-metrics-urls: http://127.0.0.1:2381\nlisten-peer-urls: https://127.0.0.1:2380,https://10.10.10.100:2380\nlog-outputs:\n- stderr\nlogger: zap\nname: server-0-4a89bd20\npeer-transport-security:\n cert-file: /var/lib/rancher/k3s/server/tls/etcd/peer-server-client.crt\n client-cert-auth: true\n key-file: /var/lib/rancher/k3s/server/tls/etcd/peer-server-client.key\n trusted-ca-file: /var/lib/rancher/k3s/server/tls/etcd/peer-ca.crt\nsnapshot-count: 10000\n"})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsx)(r.p,{children:"If running on with sqlite or a external DB, etcd checks are Not Applicable.\nWhen running with embedded-etcd, K3s does not set the --auto-tls parameter.\nIf this check fails, edit the etcd pod specification file /var/lib/rancher/k3s/server/db/etcd/config on the master\nnode and either remove the --auto-tls parameter or set it to false.\nclient-transport-security:\nauto-tls: false"})]}),"\n",(0,t.jsx)(r.h3,{id:"24-ensure-that-the---peer-cert-file-and---peer-key-file-arguments-are-set-as-appropriate-automated",children:"2.4 Ensure that the --peer-cert-file and --peer-key-file arguments are set as appropriate (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," '.peer-transport-security.cert-file' is equal to '/var/lib/rancher/k3s/server/tls/etcd/peer-server-client.crt' AND '.peer-transport-security.key-file' is equal to '/var/lib/rancher/k3s/server/tls/etcd/peer-server-client.key'"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:"advertise-client-urls: https://10.10.10.100:2379\nclient-transport-security:\n cert-file: /var/lib/rancher/k3s/server/tls/etcd/server-client.crt\n client-cert-auth: true\n key-file: /var/lib/rancher/k3s/server/tls/etcd/server-client.key\n trusted-ca-file: /var/lib/rancher/k3s/server/tls/etcd/server-ca.crt\ndata-dir: /var/lib/rancher/k3s/server/db/etcd\nelection-timeout: 5000\nexperimental-initial-corrupt-check: true\nheartbeat-interval: 500\ninitial-advertise-peer-urls: https://10.10.10.100:2380\ninitial-cluster: server-0-4a89bd20=https://10.10.10.100:2380\ninitial-cluster-state: new\nlisten-client-http-urls: https://127.0.0.1:2382\nlisten-client-urls: https://127.0.0.1:2379,https://10.10.10.100:2379\nlisten-metrics-urls: http://127.0.0.1:2381\nlisten-peer-urls: https://127.0.0.1:2380,https://10.10.10.100:2380\nlog-outputs:\n- stderr\nlogger: zap\nname: server-0-4a89bd20\npeer-transport-security:\n cert-file: /var/lib/rancher/k3s/server/tls/etcd/peer-server-client.crt\n client-cert-auth: true\n key-file: /var/lib/rancher/k3s/server/tls/etcd/peer-server-client.key\n trusted-ca-file: /var/lib/rancher/k3s/server/tls/etcd/peer-ca.crt\nsnapshot-count: 10000\n"})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsx)(r.p,{children:"If running on with sqlite or a external DB, etcd checks are Not Applicable.\nWhen running with embedded-etcd, K3s generates peer cert and key files for etcd.\nThese are located in /var/lib/rancher/k3s/server/tls/etcd/.\nIf this check fails, ensure that the configuration file /var/lib/rancher/k3s/server/db/etcd/config\nhas not been modified to use custom peer cert and key files."})]}),"\n",(0,t.jsx)(r.h3,{id:"25-ensure-that-the---peer-client-cert-auth-argument-is-set-to-true-automated",children:"2.5 Ensure that the --peer-client-cert-auth argument is set to true (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," '.peer-transport-security.client-cert-auth' is equal to 'true'"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:"advertise-client-urls: https://10.10.10.100:2379\nclient-transport-security:\n cert-file: /var/lib/rancher/k3s/server/tls/etcd/server-client.crt\n client-cert-auth: true\n key-file: /var/lib/rancher/k3s/server/tls/etcd/server-client.key\n trusted-ca-file: /var/lib/rancher/k3s/server/tls/etcd/server-ca.crt\ndata-dir: /var/lib/rancher/k3s/server/db/etcd\nelection-timeout: 5000\nexperimental-initial-corrupt-check: true\nheartbeat-interval: 500\ninitial-advertise-peer-urls: https://10.10.10.100:2380\ninitial-cluster: server-0-4a89bd20=https://10.10.10.100:2380\ninitial-cluster-state: new\nlisten-client-http-urls: https://127.0.0.1:2382\nlisten-client-urls: https://127.0.0.1:2379,https://10.10.10.100:2379\nlisten-metrics-urls: http://127.0.0.1:2381\nlisten-peer-urls: https://127.0.0.1:2380,https://10.10.10.100:2380\nlog-outputs:\n- stderr\nlogger: zap\nname: server-0-4a89bd20\npeer-transport-security:\n cert-file: /var/lib/rancher/k3s/server/tls/etcd/peer-server-client.crt\n client-cert-auth: true\n key-file: /var/lib/rancher/k3s/server/tls/etcd/peer-server-client.key\n trusted-ca-file: /var/lib/rancher/k3s/server/tls/etcd/peer-ca.crt\nsnapshot-count: 10000\n"})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsx)(r.p,{children:"If running on with sqlite or a external DB, etcd checks are Not Applicable.\nWhen running with embedded-etcd, K3s sets the --peer-cert-auth parameter to true.\nIf this check fails, ensure that the configuration file /var/lib/rancher/k3s/server/db/etcd/config\nhas not been modified to disable peer client certificate authentication."})]}),"\n",(0,t.jsx)(r.h3,{id:"26-ensure-that-the---peer-auto-tls-argument-is-not-set-to-true-automated",children:"2.6 Ensure that the --peer-auto-tls argument is not set to true (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," '.peer-transport-security.auto-tls' is present OR '.peer-transport-security.auto-tls' is not present"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:"advertise-client-urls: https://10.10.10.100:2379\nclient-transport-security:\n cert-file: /var/lib/rancher/k3s/server/tls/etcd/server-client.crt\n client-cert-auth: true\n key-file: /var/lib/rancher/k3s/server/tls/etcd/server-client.key\n trusted-ca-file: /var/lib/rancher/k3s/server/tls/etcd/server-ca.crt\ndata-dir: /var/lib/rancher/k3s/server/db/etcd\nelection-timeout: 5000\nexperimental-initial-corrupt-check: true\nheartbeat-interval: 500\ninitial-advertise-peer-urls: https://10.10.10.100:2380\ninitial-cluster: server-0-4a89bd20=https://10.10.10.100:2380\ninitial-cluster-state: new\nlisten-client-http-urls: https://127.0.0.1:2382\nlisten-client-urls: https://127.0.0.1:2379,https://10.10.10.100:2379\nlisten-metrics-urls: http://127.0.0.1:2381\nlisten-peer-urls: https://127.0.0.1:2380,https://10.10.10.100:2380\nlog-outputs:\n- stderr\nlogger: zap\nname: server-0-4a89bd20\npeer-transport-security:\n cert-file: /var/lib/rancher/k3s/server/tls/etcd/peer-server-client.crt\n client-cert-auth: true\n key-file: /var/lib/rancher/k3s/server/tls/etcd/peer-server-client.key\n trusted-ca-file: /var/lib/rancher/k3s/server/tls/etcd/peer-ca.crt\nsnapshot-count: 10000\n"})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsx)(r.p,{children:"If running on with sqlite or a external DB, etcd checks are Not Applicable.\nWhen running with embedded-etcd, K3s does not set the --peer-auto-tls parameter.\nIf this check fails, edit the etcd pod specification file /var/lib/rancher/k3s/server/db/etcd/config on the master\nnode and either remove the --peer-auto-tls parameter or set it to false.\npeer-transport-security:\nauto-tls: false"})]}),"\n",(0,t.jsx)(r.h3,{id:"27-ensure-that-a-unique-certificate-authority-is-used-for-etcd-automated",children:"2.7 Ensure that a unique Certificate Authority is used for etcd (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," '.peer-transport-security.trusted-ca-file' is equal to '/var/lib/rancher/k3s/server/tls/etcd/peer-ca.crt'"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:"advertise-client-urls: https://10.10.10.100:2379\nclient-transport-security:\n cert-file: /var/lib/rancher/k3s/server/tls/etcd/server-client.crt\n client-cert-auth: true\n key-file: /var/lib/rancher/k3s/server/tls/etcd/server-client.key\n trusted-ca-file: /var/lib/rancher/k3s/server/tls/etcd/server-ca.crt\ndata-dir: /var/lib/rancher/k3s/server/db/etcd\nelection-timeout: 5000\nexperimental-initial-corrupt-check: true\nheartbeat-interval: 500\ninitial-advertise-peer-urls: https://10.10.10.100:2380\ninitial-cluster: server-0-4a89bd20=https://10.10.10.100:2380\ninitial-cluster-state: new\nlisten-client-http-urls: https://127.0.0.1:2382\nlisten-client-urls: https://127.0.0.1:2379,https://10.10.10.100:2379\nlisten-metrics-urls: http://127.0.0.1:2381\nlisten-peer-urls: https://127.0.0.1:2380,https://10.10.10.100:2380\nlog-outputs:\n- stderr\nlogger: zap\nname: server-0-4a89bd20\npeer-transport-security:\n cert-file: /var/lib/rancher/k3s/server/tls/etcd/peer-server-client.crt\n client-cert-auth: true\n key-file: /var/lib/rancher/k3s/server/tls/etcd/peer-server-client.key\n trusted-ca-file: /var/lib/rancher/k3s/server/tls/etcd/peer-ca.crt\nsnapshot-count: 10000\n"})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsx)(r.p,{children:"If running on with sqlite or a external DB, etcd checks are Not Applicable.\nWhen running with embedded-etcd, K3s generates a unique certificate authority for etcd.\nThis is located at /var/lib/rancher/k3s/server/tls/etcd/peer-ca.crt.\nIf this check fails, ensure that the configuration file /var/lib/rancher/k3s/server/db/etcd/config\nhas not been modified to use a shared certificate authority."})]}),"\n",(0,t.jsx)(r.h2,{id:"41-worker-node-configuration-files",children:"4.1 Worker Node Configuration Files"}),"\n",(0,t.jsx)(r.h3,{id:"411-ensure-that-the-kubelet-service-file-permissions-are-set-to-600-or-more-restrictive-automated",children:"4.1.1 Ensure that the kubelet service file permissions are set to 600 or more restrictive (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," Not Applicable"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Rationale:"})}),"\n",(0,t.jsx)(r.p,{children:"The kubelet is embedded in the k3s process. There is no kubelet service file, all configuration is passed in as arguments at runtime."}),"\n",(0,t.jsxs)(r.h3,{id:"412-ensure-that-the-kubelet-service-file-ownership-is-set-to-root-automated",children:["4.1.2 Ensure that the kubelet service file ownership is set to root",":root"," (Automated)"]}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," Not Applicable"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Rationale:"})}),"\n",(0,t.jsx)(r.p,{children:"The kubelet is embedded in the k3s process. There is no kubelet service file, all configuration is passed in as arguments at runtime."}),"\n",(0,t.jsx)(r.p,{children:"All configuration is passed in as arguments at container run time."}),"\n",(0,t.jsx)(r.h3,{id:"413-if-proxy-kubeconfig-file-exists-ensure-permissions-are-set-to-600-or-more-restrictive-automated",children:"4.1.3 If proxy kubeconfig file exists ensure permissions are set to 600 or more restrictive (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"/bin/sh -c 'if test -e /var/lib/rancher/k3s/agent/kubeproxy.kubeconfig; then stat -c permissions=%a /var/lib/rancher/k3s/agent/kubeproxy.kubeconfig; fi' \n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," permissions has permissions 600, expected 600 or more restrictive"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:"permissions=600\n"})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsxs)(r.p,{children:["Run the below command (based on the file location on your system) on the each worker node.\nFor example,\n",(0,t.jsx)(r.code,{children:"chmod 600 /var/lib/rancher/k3s/agent/kubeproxy.kubeconfig"})]})]}),"\n",(0,t.jsxs)(r.h3,{id:"414-if-proxy-kubeconfig-file-exists-ensure-ownership-is-set-to-root-automated",children:["4.1.4 If proxy kubeconfig file exists ensure ownership is set to root",":root"," (Automated)"]}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"/bin/sh -c 'if test -e /var/lib/rancher/k3s/agent/kubeproxy.kubeconfig; then stat -c %U:%G /var/lib/rancher/k3s/agent/kubeproxy.kubeconfig; fi' \n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," 'root",":root","' is present"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:"root:root\n"})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsxs)(r.p,{children:["Run the below command (based on the file location on your system) on the each worker node.\nFor example, ",(0,t.jsx)(r.code,{children:"chown root:root /var/lib/rancher/k3s/agent/kubeproxy.kubeconfig"})]})]}),"\n",(0,t.jsx)(r.h3,{id:"415-ensure-that-the---kubeconfig-kubeletconf-file-permissions-are-set-to-600-or-more-restrictive-automated",children:"4.1.5 Ensure that the --kubeconfig kubelet.conf file permissions are set to 600 or more restrictive (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"/bin/sh -c 'if test -e /var/lib/rancher/k3s/agent/kubelet.kubeconfig; then stat -c permissions=%a /var/lib/rancher/k3s/agent/kubelet.kubeconfig; fi' \n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," permissions has permissions 600, expected 600 or more restrictive"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:"permissions=600\n"})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsxs)(r.p,{children:["Run the below command (based on the file location on your system) on the each worker node.\nFor example,\n",(0,t.jsx)(r.code,{children:"chmod 600 /var/lib/rancher/k3s/agent/kubelet.kubeconfig"})]})]}),"\n",(0,t.jsxs)(r.h3,{id:"416-ensure-that-the---kubeconfig-kubeletconf-file-ownership-is-set-to-root-automated",children:["4.1.6 Ensure that the --kubeconfig kubelet.conf file ownership is set to root",":root"," (Automated)"]}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"stat -c %U:%G /var/lib/rancher/k3s/agent/kubelet.kubeconfig\n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," 'root",":root","' is present"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:"root:root\n"})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsxs)(r.p,{children:["Run the below command (based on the file location on your system) on the each worker node.\nFor example,\n",(0,t.jsx)(r.code,{children:"chown root:root /var/lib/rancher/k3s/agent/kubelet.kubeconfig"})]})]}),"\n",(0,t.jsx)(r.h3,{id:"417-ensure-that-the-certificate-authorities-file-permissions-are-set-to-600-or-more-restrictive-automated",children:"4.1.7 Ensure that the certificate authorities file permissions are set to 600 or more restrictive (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"stat -c permissions=%a /var/lib/rancher/k3s/agent/client-ca.crt\n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," permissions has permissions 600, expected 600 or more restrictive"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:"permissions=600\n"})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsxs)(r.p,{children:["Run the following command to modify the file permissions of the\n--client-ca-file ",(0,t.jsx)(r.code,{children:"chmod 600 /var/lib/rancher/k3s/agent/client-ca.crt"})]})]}),"\n",(0,t.jsxs)(r.h3,{id:"418-ensure-that-the-client-certificate-authorities-file-ownership-is-set-to-root-automated",children:["4.1.8 Ensure that the client certificate authorities file ownership is set to root",":root"," (Automated)"]}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"stat -c %U:%G /var/lib/rancher/k3s/agent/client-ca.crt\n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," 'root",":root","' is equal to 'root",":root","'"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:"root:root\n"})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsxs)(r.p,{children:["Run the following command to modify the ownership of the --client-ca-file.\n",(0,t.jsx)(r.code,{children:"chown root:root /var/lib/rancher/k3s/agent/client-ca.crt"})]})]}),"\n",(0,t.jsx)(r.h3,{id:"419-ensure-that-the-kubelet---config-configuration-file-has-permissions-set-to-600-or-more-restrictive-automated",children:"4.1.9 Ensure that the kubelet --config configuration file has permissions set to 600 or more restrictive (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," Not Applicable"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Rationale:"})}),"\n",(0,t.jsx)(r.p,{children:"The kubelet is embedded in the k3s process. There is no kubelet config file, all configuration is passed in as arguments at runtime."}),"\n",(0,t.jsxs)(r.h3,{id:"4110-ensure-that-the-kubelet---config-configuration-file-ownership-is-set-to-root-automated",children:["4.1.10 Ensure that the kubelet --config configuration file ownership is set to root",":root"," (Automated)"]}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," Not Applicable"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Rationale:"})}),"\n",(0,t.jsx)(r.p,{children:"The kubelet is embedded in the k3s process. There is no kubelet config file, all configuration is passed in as arguments at runtime."}),"\n",(0,t.jsx)(r.h2,{id:"42-kubelet",children:"4.2 Kubelet"}),"\n",(0,t.jsx)(r.h3,{id:"421-ensure-that-the---anonymous-auth-argument-is-set-to-false-automated",children:"4.2.1 Ensure that the --anonymous-auth argument is set to false (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:'/bin/sh -c \'if test $(journalctl -D /var/log/journal -u k3s | grep "Running kube-apiserver" | wc -l) -gt 0; then journalctl -D /var/log/journal -u k3s | grep "Running kube-apiserver" | tail -n1 | grep "anonymous-auth" | grep -v grep; else echo "--anonymous-auth=false"; fi\' \n'})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," '--anonymous-auth' is equal to 'false'"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:'Aug 09 19:01:28 server-0 k3s[2354]: time="2024-08-09T19:01:28Z" level=info msg="Running kube-apiserver --admission-control-config-file=/var/lib/rancher/k3s/server/psa.yaml --advertise-address=10.10.10.100 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsx)(r.p,{children:"By default, K3s sets the --anonymous-auth to false. If you have set this to a different value, you\nshould set it back to false. If using the K3s config file /etc/rancher/k3s/config.yaml, remove any lines similar to below."}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{children:'kubelet-arg:\n - "anonymous-auth=true"\n'})}),(0,t.jsx)(r.p,{children:'If using the command line, edit the K3s service file and remove the below argument.\n--kubelet-arg="anonymous-auth=true"\nBased on your system, restart the k3s service. For example,\nsystemctl daemon-reload\nsystemctl restart k3s.service'})]}),"\n",(0,t.jsx)(r.h3,{id:"422-ensure-that-the---authorization-mode-argument-is-not-set-to-alwaysallow-automated",children:"4.2.2 Ensure that the --authorization-mode argument is not set to AlwaysAllow (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:'/bin/sh -c \'if test $(journalctl -D /var/log/journal -u k3s | grep "Running kube-apiserver" | wc -l) -gt 0; then journalctl -D /var/log/journal -u k3s | grep "Running kube-apiserver" | tail -n1 | grep "authorization-mode"; else echo "--authorization-mode=Webhook"; fi\' \n'})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," '--authorization-mode' does not have 'AlwaysAllow'"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:'Aug 09 19:01:28 server-0 k3s[2354]: time="2024-08-09T19:01:28Z" level=info msg="Running kube-apiserver --admission-control-config-file=/var/lib/rancher/k3s/server/psa.yaml --advertise-address=10.10.10.100 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsx)(r.p,{children:"By default, K3s does not set the --authorization-mode to AlwaysAllow.\nIf using the K3s config file /etc/rancher/k3s/config.yaml, remove any lines similar to below."}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{children:'kubelet-arg:\n - "authorization-mode=AlwaysAllow"\n'})}),(0,t.jsx)(r.p,{children:'If using the command line, edit the K3s service file and remove the below argument.\n--kubelet-arg="authorization-mode=AlwaysAllow"\nBased on your system, restart the k3s service. For example,\nsystemctl daemon-reload\nsystemctl restart k3s.service'})]}),"\n",(0,t.jsx)(r.h3,{id:"423-ensure-that-the---client-ca-file-argument-is-set-as-appropriate-automated",children:"4.2.3 Ensure that the --client-ca-file argument is set as appropriate (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:'/bin/sh -c \'if test $(journalctl -D /var/log/journal -u k3s | grep "Running kube-apiserver" | wc -l) -gt 0; then journalctl -D /var/log/journal -u k3s | grep "Running kube-apiserver" | tail -n1 | grep "client-ca-file"; else echo "--client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt"; fi\' \n'})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," '--client-ca-file' is present"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:'Aug 09 19:01:28 server-0 k3s[2354]: time="2024-08-09T19:01:28Z" level=info msg="Running kube-apiserver --admission-control-config-file=/var/lib/rancher/k3s/server/psa.yaml --advertise-address=10.10.10.100 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsx)(r.p,{children:"By default, K3s automatically provides the client ca certificate for the Kubelet.\nIt is generated and located at /var/lib/rancher/k3s/agent/client-ca.crt"})]}),"\n",(0,t.jsx)(r.h3,{id:"424-verify-that-the---read-only-port-argument-is-set-to-0-automated",children:"4.2.4 Verify that the --read-only-port argument is set to 0 (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s -u k3s-agent | grep 'Running kubelet' | tail -n1\n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," '--read-only-port' is equal to '0' OR '--read-only-port' is not present"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:'Aug 09 19:01:30 server-0 k3s[2354]: time="2024-08-09T19:01:30Z" level=info msg="Running kubelet --address=0.0.0.0 --allowed-unsafe-sysctls=net.ipv4.ip_forward,net.ipv6.conf.all.forwarding --anonymous-auth=false --authentication-token-webhook=true --authorization-mode=Webhook --cgroup-driver=systemd --client-ca-file=/var/lib/rancher/k3s/agent/client-ca.crt --cloud-provider=external --cluster-dns=10.43.0.10 --cluster-domain=cluster.local --container-runtime-endpoint=unix:///run/k3s/containerd/containerd.sock --containerd=/run/k3s/containerd/containerd.sock --event-qps=0 --eviction-hard=imagefs.available<5%,nodefs.available<5% --eviction-minimum-reclaim=imagefs.available=10%,nodefs.available=10% --fail-swap-on=false --healthz-bind-address=127.0.0.1 --hostname-override=server-0 --kubeconfig=/var/lib/rancher/k3s/agent/kubelet.kubeconfig --make-iptables-util-chains=true --node-ip=10.10.10.100 --node-labels= --pod-infra-container-image=rancher/mirrored-pause:3.6 --pod-manifest-path=/var/lib/rancher/k3s/agent/pod-manifests --protect-kernel-defaults=true --read-only-port=0 --resolv-conf=/run/systemd/resolve/resolv.conf --serialize-image-pulls=false --streaming-connection-idle-timeout=5m --tls-cert-file=/var/lib/rancher/k3s/agent/serving-kubelet.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/agent/serving-kubelet.key"\n'})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsx)(r.p,{children:"By default, K3s sets the --read-only-port to 0. If you have set this to a different value, you\nshould set it back to 0. If using the K3s config file /etc/rancher/k3s/config.yaml, remove any lines similar to below."}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{children:'kubelet-arg:\n - "read-only-port=XXXX"\n'})}),(0,t.jsx)(r.p,{children:'If using the command line, edit the K3s service file and remove the below argument.\n--kubelet-arg="read-only-port=XXXX"\nBased on your system, restart the k3s service. For example,\nsystemctl daemon-reload\nsystemctl restart k3s.service'})]}),"\n",(0,t.jsx)(r.h3,{id:"425-ensure-that-the---streaming-connection-idle-timeout-argument-is-not-set-to-0-manual",children:"4.2.5 Ensure that the --streaming-connection-idle-timeout argument is not set to 0 (Manual)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s -u k3s-agent | grep 'Running kubelet' | tail -n1\n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," '--streaming-connection-idle-timeout' is not equal to '0' OR '--streaming-connection-idle-timeout' is not present"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:'Aug 09 19:01:30 server-0 k3s[2354]: time="2024-08-09T19:01:30Z" level=info msg="Running kubelet --address=0.0.0.0 --allowed-unsafe-sysctls=net.ipv4.ip_forward,net.ipv6.conf.all.forwarding --anonymous-auth=false --authentication-token-webhook=true --authorization-mode=Webhook --cgroup-driver=systemd --client-ca-file=/var/lib/rancher/k3s/agent/client-ca.crt --cloud-provider=external --cluster-dns=10.43.0.10 --cluster-domain=cluster.local --container-runtime-endpoint=unix:///run/k3s/containerd/containerd.sock --containerd=/run/k3s/containerd/containerd.sock --event-qps=0 --eviction-hard=imagefs.available<5%,nodefs.available<5% --eviction-minimum-reclaim=imagefs.available=10%,nodefs.available=10% --fail-swap-on=false --healthz-bind-address=127.0.0.1 --hostname-override=server-0 --kubeconfig=/var/lib/rancher/k3s/agent/kubelet.kubeconfig --make-iptables-util-chains=true --node-ip=10.10.10.100 --node-labels= --pod-infra-container-image=rancher/mirrored-pause:3.6 --pod-manifest-path=/var/lib/rancher/k3s/agent/pod-manifests --protect-kernel-defaults=true --read-only-port=0 --resolv-conf=/run/systemd/resolve/resolv.conf --serialize-image-pulls=false --streaming-connection-idle-timeout=5m --tls-cert-file=/var/lib/rancher/k3s/agent/serving-kubelet.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/agent/serving-kubelet.key"\n'})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsx)(r.p,{children:"If using the K3s config file /etc/rancher/k3s/config.yaml, set the following parameter to an appropriate value."}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{children:'kubelet-arg:\n - "streaming-connection-idle-timeout=5m"\n'})}),(0,t.jsx)(r.p,{children:'If using the command line, run K3s with --kubelet-arg="streaming-connection-idle-timeout=5m".\nBased on your system, restart the k3s service. For example,\nsystemctl restart k3s.service'})]}),"\n",(0,t.jsx)(r.h3,{id:"426-ensure-that-the---make-iptables-util-chains-argument-is-set-to-true-automated",children:"4.2.6 Ensure that the --make-iptables-util-chains argument is set to true (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s -u k3s-agent | grep 'Running kubelet' | tail -n1\n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," '--make-iptables-util-chains' is equal to 'true' OR '--make-iptables-util-chains' is not present"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:'Aug 09 19:01:30 server-0 k3s[2354]: time="2024-08-09T19:01:30Z" level=info msg="Running kubelet --address=0.0.0.0 --allowed-unsafe-sysctls=net.ipv4.ip_forward,net.ipv6.conf.all.forwarding --anonymous-auth=false --authentication-token-webhook=true --authorization-mode=Webhook --cgroup-driver=systemd --client-ca-file=/var/lib/rancher/k3s/agent/client-ca.crt --cloud-provider=external --cluster-dns=10.43.0.10 --cluster-domain=cluster.local --container-runtime-endpoint=unix:///run/k3s/containerd/containerd.sock --containerd=/run/k3s/containerd/containerd.sock --event-qps=0 --eviction-hard=imagefs.available<5%,nodefs.available<5% --eviction-minimum-reclaim=imagefs.available=10%,nodefs.available=10% --fail-swap-on=false --healthz-bind-address=127.0.0.1 --hostname-override=server-0 --kubeconfig=/var/lib/rancher/k3s/agent/kubelet.kubeconfig --make-iptables-util-chains=true --node-ip=10.10.10.100 --node-labels= --pod-infra-container-image=rancher/mirrored-pause:3.6 --pod-manifest-path=/var/lib/rancher/k3s/agent/pod-manifests --protect-kernel-defaults=true --read-only-port=0 --resolv-conf=/run/systemd/resolve/resolv.conf --serialize-image-pulls=false --streaming-connection-idle-timeout=5m --tls-cert-file=/var/lib/rancher/k3s/agent/serving-kubelet.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/agent/serving-kubelet.key"\n'})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsx)(r.p,{children:"If using the K3s config file /etc/rancher/k3s/config.yaml, set the following parameter."}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{children:'kubelet-arg:\n - "make-iptables-util-chains=true"\n'})}),(0,t.jsx)(r.p,{children:'If using the command line, run K3s with --kubelet-arg="make-iptables-util-chains=true".\nBased on your system, restart the k3s service. For example,\nsystemctl restart k3s.service'})]}),"\n",(0,t.jsx)(r.h3,{id:"427-ensure-that-the---hostname-override-argument-is-not-set-automated",children:"4.2.7 Ensure that the --hostname-override argument is not set (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," Not Applicable"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Rationale:"})}),"\n",(0,t.jsx)(r.p,{children:"By default, K3s does set the --hostname-override argument. Per CIS guidelines, this is to comply\nwith cloud providers that require this flag to ensure that hostname matches node names."}),"\n",(0,t.jsx)(r.h3,{id:"428-ensure-that-the-eventrecordqps-argument-is-set-to-a-level-which-ensures-appropriate-event-capture-manual",children:"4.2.8 Ensure that the eventRecordQPS argument is set to a level which ensures appropriate event capture (Manual)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s -u k3s-agent | grep 'Running kubelet' | tail -n1\n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," '--event-qps' is greater or equal to 0 OR '--event-qps' is not present"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:'Aug 09 19:01:30 server-0 k3s[2354]: time="2024-08-09T19:01:30Z" level=info msg="Running kubelet --address=0.0.0.0 --allowed-unsafe-sysctls=net.ipv4.ip_forward,net.ipv6.conf.all.forwarding --anonymous-auth=false --authentication-token-webhook=true --authorization-mode=Webhook --cgroup-driver=systemd --client-ca-file=/var/lib/rancher/k3s/agent/client-ca.crt --cloud-provider=external --cluster-dns=10.43.0.10 --cluster-domain=cluster.local --container-runtime-endpoint=unix:///run/k3s/containerd/containerd.sock --containerd=/run/k3s/containerd/containerd.sock --event-qps=0 --eviction-hard=imagefs.available<5%,nodefs.available<5% --eviction-minimum-reclaim=imagefs.available=10%,nodefs.available=10% --fail-swap-on=false --healthz-bind-address=127.0.0.1 --hostname-override=server-0 --kubeconfig=/var/lib/rancher/k3s/agent/kubelet.kubeconfig --make-iptables-util-chains=true --node-ip=10.10.10.100 --node-labels= --pod-infra-container-image=rancher/mirrored-pause:3.6 --pod-manifest-path=/var/lib/rancher/k3s/agent/pod-manifests --protect-kernel-defaults=true --read-only-port=0 --resolv-conf=/run/systemd/resolve/resolv.conf --serialize-image-pulls=false --streaming-connection-idle-timeout=5m --tls-cert-file=/var/lib/rancher/k3s/agent/serving-kubelet.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/agent/serving-kubelet.key"\n'})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsx)(r.p,{children:"By default, K3s sets the event-qps to 0. Should you wish to change this,\nIf using the K3s config file /etc/rancher/k3s/config.yaml, set the following parameter to an appropriate value."}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{children:'kubelet-arg:\n - "event-qps="\n'})}),(0,t.jsx)(r.p,{children:'If using the command line, run K3s with --kubelet-arg="event-qps=".\nBased on your system, restart the k3s service. For example,\nsystemctl restart k3s.service'})]}),"\n",(0,t.jsx)(r.h3,{id:"429-ensure-that-the---tls-cert-file-and---tls-private-key-file-arguments-are-set-as-appropriate-automated",children:"4.2.9 Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s -u k3s-agent | grep 'Running kubelet' | tail -n1\n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," '--tls-cert-file' is present AND '--tls-private-key-file' is present"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:'Aug 09 19:01:30 server-0 k3s[2354]: time="2024-08-09T19:01:30Z" level=info msg="Running kubelet --address=0.0.0.0 --allowed-unsafe-sysctls=net.ipv4.ip_forward,net.ipv6.conf.all.forwarding --anonymous-auth=false --authentication-token-webhook=true --authorization-mode=Webhook --cgroup-driver=systemd --client-ca-file=/var/lib/rancher/k3s/agent/client-ca.crt --cloud-provider=external --cluster-dns=10.43.0.10 --cluster-domain=cluster.local --container-runtime-endpoint=unix:///run/k3s/containerd/containerd.sock --containerd=/run/k3s/containerd/containerd.sock --event-qps=0 --eviction-hard=imagefs.available<5%,nodefs.available<5% --eviction-minimum-reclaim=imagefs.available=10%,nodefs.available=10% --fail-swap-on=false --healthz-bind-address=127.0.0.1 --hostname-override=server-0 --kubeconfig=/var/lib/rancher/k3s/agent/kubelet.kubeconfig --make-iptables-util-chains=true --node-ip=10.10.10.100 --node-labels= --pod-infra-container-image=rancher/mirrored-pause:3.6 --pod-manifest-path=/var/lib/rancher/k3s/agent/pod-manifests --protect-kernel-defaults=true --read-only-port=0 --resolv-conf=/run/systemd/resolve/resolv.conf --serialize-image-pulls=false --streaming-connection-idle-timeout=5m --tls-cert-file=/var/lib/rancher/k3s/agent/serving-kubelet.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/agent/serving-kubelet.key"\n'})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsx)(r.p,{children:"By default, K3s automatically provides the TLS certificate and private key for the Kubelet.\nThey are generated and located at /var/lib/rancher/k3s/agent/serving-kubelet.crt and /var/lib/rancher/k3s/agent/serving-kubelet.key\nIf for some reason you need to provide your own certificate and key, you can set the\nthe below parameters in the K3s config file /etc/rancher/k3s/config.yaml."}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{children:'kubelet-arg:\n - "tls-cert-file="\n - "tls-private-key-file="\n'})})]}),"\n",(0,t.jsx)(r.h3,{id:"4210-ensure-that-the---rotate-certificates-argument-is-not-set-to-false-automated",children:"4.2.10 Ensure that the --rotate-certificates argument is not set to false (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s -u k3s-agent | grep 'Running kubelet' | tail -n1\n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," '--rotate-certificates' is present OR '--rotate-certificates' is not present"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:'Aug 09 19:01:30 server-0 k3s[2354]: time="2024-08-09T19:01:30Z" level=info msg="Running kubelet --address=0.0.0.0 --allowed-unsafe-sysctls=net.ipv4.ip_forward,net.ipv6.conf.all.forwarding --anonymous-auth=false --authentication-token-webhook=true --authorization-mode=Webhook --cgroup-driver=systemd --client-ca-file=/var/lib/rancher/k3s/agent/client-ca.crt --cloud-provider=external --cluster-dns=10.43.0.10 --cluster-domain=cluster.local --container-runtime-endpoint=unix:///run/k3s/containerd/containerd.sock --containerd=/run/k3s/containerd/containerd.sock --event-qps=0 --eviction-hard=imagefs.available<5%,nodefs.available<5% --eviction-minimum-reclaim=imagefs.available=10%,nodefs.available=10% --fail-swap-on=false --healthz-bind-address=127.0.0.1 --hostname-override=server-0 --kubeconfig=/var/lib/rancher/k3s/agent/kubelet.kubeconfig --make-iptables-util-chains=true --node-ip=10.10.10.100 --node-labels= --pod-infra-container-image=rancher/mirrored-pause:3.6 --pod-manifest-path=/var/lib/rancher/k3s/agent/pod-manifests --protect-kernel-defaults=true --read-only-port=0 --resolv-conf=/run/systemd/resolve/resolv.conf --serialize-image-pulls=false --streaming-connection-idle-timeout=5m --tls-cert-file=/var/lib/rancher/k3s/agent/serving-kubelet.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/agent/serving-kubelet.key"\n'})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsxs)(r.p,{children:["By default, K3s does not set the --rotate-certificates argument. If you have set this flag with a value of ",(0,t.jsx)(r.code,{children:"false"}),", you should either set it to ",(0,t.jsx)(r.code,{children:"true"}),' or completely remove the flag.\nIf using the K3s config file /etc/rancher/k3s/config.yaml, remove any rotate-certificates parameter.\nIf using the command line, remove the K3s flag --kubelet-arg="rotate-certificates".\nBased on your system, restart the k3s service. For example,\nsystemctl restart k3s.service']})]}),"\n",(0,t.jsx)(r.h3,{id:"4211-verify-that-the-rotatekubeletservercertificate-argument-is-set-to-true-automated",children:"4.2.11 Verify that the RotateKubeletServerCertificate argument is set to true (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s -u k3s-agent | grep 'Running kubelet' | tail -n1\n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," 'RotateKubeletServerCertificate' is present OR 'RotateKubeletServerCertificate' is not present"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:'Aug 09 19:01:30 server-0 k3s[2354]: time="2024-08-09T19:01:30Z" level=info msg="Running kubelet --address=0.0.0.0 --allowed-unsafe-sysctls=net.ipv4.ip_forward,net.ipv6.conf.all.forwarding --anonymous-auth=false --authentication-token-webhook=true --authorization-mode=Webhook --cgroup-driver=systemd --client-ca-file=/var/lib/rancher/k3s/agent/client-ca.crt --cloud-provider=external --cluster-dns=10.43.0.10 --cluster-domain=cluster.local --container-runtime-endpoint=unix:///run/k3s/containerd/containerd.sock --containerd=/run/k3s/containerd/containerd.sock --event-qps=0 --eviction-hard=imagefs.available<5%,nodefs.available<5% --eviction-minimum-reclaim=imagefs.available=10%,nodefs.available=10% --fail-swap-on=false --healthz-bind-address=127.0.0.1 --hostname-override=server-0 --kubeconfig=/var/lib/rancher/k3s/agent/kubelet.kubeconfig --make-iptables-util-chains=true --node-ip=10.10.10.100 --node-labels= --pod-infra-container-image=rancher/mirrored-pause:3.6 --pod-manifest-path=/var/lib/rancher/k3s/agent/pod-manifests --protect-kernel-defaults=true --read-only-port=0 --resolv-conf=/run/systemd/resolve/resolv.conf --serialize-image-pulls=false --streaming-connection-idle-timeout=5m --tls-cert-file=/var/lib/rancher/k3s/agent/serving-kubelet.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/agent/serving-kubelet.key"\n'})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsx)(r.p,{children:'By default, K3s does not set the RotateKubeletServerCertificate feature gate.\nIf you have enabled this feature gate, you should remove it.\nIf using the K3s config file /etc/rancher/k3s/config.yaml, remove any feature-gate=RotateKubeletServerCertificate parameter.\nIf using the command line, remove the K3s flag --kubelet-arg="feature-gate=RotateKubeletServerCertificate".\nBased on your system, restart the k3s service. For example,\nsystemctl restart k3s.service'})]}),"\n",(0,t.jsx)(r.h3,{id:"4212-ensure-that-the-kubelet-only-makes-use-of-strong-cryptographic-ciphers-manual",children:"4.2.12 Ensure that the Kubelet only makes use of Strong Cryptographic Ciphers (Manual)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s -u k3s-agent | grep 'Running kubelet' | tail -n1\n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," '--tls-cipher-suites' contains valid elements from 'TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256'"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:'Aug 09 19:01:30 server-0 k3s[2354]: time="2024-08-09T19:01:30Z" level=info msg="Running kubelet --address=0.0.0.0 --allowed-unsafe-sysctls=net.ipv4.ip_forward,net.ipv6.conf.all.forwarding --anonymous-auth=false --authentication-token-webhook=true --authorization-mode=Webhook --cgroup-driver=systemd --client-ca-file=/var/lib/rancher/k3s/agent/client-ca.crt --cloud-provider=external --cluster-dns=10.43.0.10 --cluster-domain=cluster.local --container-runtime-endpoint=unix:///run/k3s/containerd/containerd.sock --containerd=/run/k3s/containerd/containerd.sock --event-qps=0 --eviction-hard=imagefs.available<5%,nodefs.available<5% --eviction-minimum-reclaim=imagefs.available=10%,nodefs.available=10% --fail-swap-on=false --healthz-bind-address=127.0.0.1 --hostname-override=server-0 --kubeconfig=/var/lib/rancher/k3s/agent/kubelet.kubeconfig --make-iptables-util-chains=true --node-ip=10.10.10.100 --node-labels= --pod-infra-container-image=rancher/mirrored-pause:3.6 --pod-manifest-path=/var/lib/rancher/k3s/agent/pod-manifests --protect-kernel-defaults=true --read-only-port=0 --resolv-conf=/run/systemd/resolve/resolv.conf --serialize-image-pulls=false --streaming-connection-idle-timeout=5m --tls-cert-file=/var/lib/rancher/k3s/agent/serving-kubelet.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/agent/serving-kubelet.key"\n'})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsxs)(r.p,{children:["If using a K3s config file /etc/rancher/k3s/config.yaml, edit the file to set ",(0,t.jsx)(r.code,{children:"TLSCipherSuites"})," to"]}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{children:'kubelet-arg:\n - "tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305"\n'})}),(0,t.jsx)(r.p,{children:'or to a subset of these values.\nIf using the command line, add the K3s flag --kubelet-arg="tls-cipher-suites="\nBased on your system, restart the k3s service. For example,\nsystemctl restart k3s.service'})]}),"\n",(0,t.jsx)(r.h3,{id:"4213-ensure-that-a-limit-is-set-on-pod-pids-manual",children:"4.2.13 Ensure that a limit is set on pod PIDs (Manual)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Remediation:"}),"\nDecide on an appropriate level for this parameter and set it,\nIf using a K3s config file /etc/rancher/k3s/config.yaml, edit the file to set ",(0,t.jsx)(r.code,{children:"podPidsLimit"})," to"]}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{children:'kubelet-arg:\n - "pod-max-pids="\n'})}),"\n",(0,t.jsx)(r.h2,{id:"51-rbac-and-service-accounts",children:"5.1 RBAC and Service Accounts"}),"\n",(0,t.jsx)(r.h3,{id:"511-ensure-that-the-cluster-admin-role-is-only-used-where-required-manual",children:"5.1.1 Ensure that the cluster-admin role is only used where required (Manual)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Remediation:"}),"\nIdentify all clusterrolebindings to the cluster-admin role. Check if they are used and\nif they need this role or if they could use a role with fewer privileges.\nWhere possible, first bind users to a lower privileged role and then remove the\nclusterrolebinding to the cluster-admin role :\nkubectl delete clusterrolebinding [name]"]}),"\n",(0,t.jsx)(r.h3,{id:"512-minimize-access-to-secrets-manual",children:"5.1.2 Minimize access to secrets (Manual)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Remediation:"}),"\nWhere possible, remove get, list and watch access to Secret objects in the cluster."]}),"\n",(0,t.jsx)(r.h3,{id:"513-minimize-wildcard-use-in-roles-and-clusterroles-manual",children:"5.1.3 Minimize wildcard use in Roles and ClusterRoles (Manual)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Remediation:"}),"\nWhere possible replace any use of wildcards in clusterroles and roles with specific\nobjects or actions."]}),"\n",(0,t.jsx)(r.h3,{id:"514-minimize-access-to-create-pods-manual",children:"5.1.4 Minimize access to create pods (Manual)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Remediation:"}),"\nWhere possible, remove create access to pod objects in the cluster."]}),"\n",(0,t.jsx)(r.h3,{id:"515-ensure-that-default-service-accounts-are-not-actively-used-manual",children:"5.1.5 Ensure that default service accounts are not actively used. (Manual)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Remediation:"}),"\nCreate explicit service accounts wherever a Kubernetes workload requires specific access\nto the Kubernetes API server.\nModify the configuration of each default service account to include this value\nautomountServiceAccountToken: false"]}),"\n",(0,t.jsx)(r.h3,{id:"516-ensure-that-service-account-tokens-are-only-mounted-where-necessary-manual",children:"5.1.6 Ensure that Service Account Tokens are only mounted where necessary (Manual)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Remediation:"}),"\nModify the definition of pods and service accounts which do not need to mount service\naccount tokens to disable it."]}),"\n",(0,t.jsxs)(r.h3,{id:"517-avoid-use-of-system-group-manual",children:["5.1.7 Avoid use of system",":masters"," group (Manual)"]}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Remediation:"}),"\nRemove the system",":masters"," group from all users in the cluster."]}),"\n",(0,t.jsx)(r.h3,{id:"518-limit-use-of-the-bind-impersonate-and-escalate-permissions-in-the-kubernetes-cluster-manual",children:"5.1.8 Limit use of the Bind, Impersonate and Escalate permissions in the Kubernetes cluster (Manual)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Remediation:"}),"\nWhere possible, remove the impersonate, bind and escalate rights from subjects."]}),"\n",(0,t.jsx)(r.h3,{id:"519-minimize-access-to-create-persistent-volumes-manual",children:"5.1.9 Minimize access to create persistent volumes (Manual)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Remediation:"}),"\nWhere possible, remove create access to PersistentVolume objects in the cluster."]}),"\n",(0,t.jsx)(r.h3,{id:"5110-minimize-access-to-the-proxy-sub-resource-of-nodes-manual",children:"5.1.10 Minimize access to the proxy sub-resource of nodes (Manual)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Remediation:"}),"\nWhere possible, remove access to the proxy sub-resource of node objects."]}),"\n",(0,t.jsx)(r.h3,{id:"5111-minimize-access-to-the-approval-sub-resource-of-certificatesigningrequests-objects-manual",children:"5.1.11 Minimize access to the approval sub-resource of certificatesigningrequests objects (Manual)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Remediation:"}),"\nWhere possible, remove access to the approval sub-resource of certificatesigningrequest objects."]}),"\n",(0,t.jsx)(r.h3,{id:"5112-minimize-access-to-webhook-configuration-objects-manual",children:"5.1.12 Minimize access to webhook configuration objects (Manual)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Remediation:"}),"\nWhere possible, remove access to the validatingwebhookconfigurations or mutatingwebhookconfigurations objects"]}),"\n",(0,t.jsx)(r.h3,{id:"5113-minimize-access-to-the-service-account-token-creation-manual",children:"5.1.13 Minimize access to the service account token creation (Manual)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Remediation:"}),"\nWhere possible, remove access to the token sub-resource of serviceaccount objects."]}),"\n",(0,t.jsx)(r.h2,{id:"52-pod-security-standards",children:"5.2 Pod Security Standards"}),"\n",(0,t.jsx)(r.h3,{id:"521-ensure-that-the-cluster-has-at-least-one-active-policy-control-mechanism-in-place-manual",children:"5.2.1 Ensure that the cluster has at least one active policy control mechanism in place (Manual)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Remediation:"}),"\nEnsure that either Pod Security Admission or an external policy control system is in place\nfor every namespace which contains user workloads."]}),"\n",(0,t.jsx)(r.h3,{id:"522-minimize-the-admission-of-privileged-containers-manual",children:"5.2.2 Minimize the admission of privileged containers (Manual)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Remediation:"}),"\nAdd policies to each namespace in the cluster which has user workloads to restrict the\nadmission of privileged containers."]}),"\n",(0,t.jsx)(r.h3,{id:"523-minimize-the-admission-of-containers-wishing-to-share-the-host-process-id-namespace-automated",children:"5.2.3 Minimize the admission of containers wishing to share the host process ID namespace (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Remediation:"}),"\nAdd policies to each namespace in the cluster which has user workloads to restrict the\nadmission of ",(0,t.jsx)(r.code,{children:"hostPID"})," containers."]}),"\n",(0,t.jsx)(r.h3,{id:"524-minimize-the-admission-of-containers-wishing-to-share-the-host-ipc-namespace-automated",children:"5.2.4 Minimize the admission of containers wishing to share the host IPC namespace (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Remediation:"}),"\nAdd policies to each namespace in the cluster which has user workloads to restrict the\nadmission of ",(0,t.jsx)(r.code,{children:"hostIPC"})," containers."]}),"\n",(0,t.jsx)(r.h3,{id:"525-minimize-the-admission-of-containers-wishing-to-share-the-host-network-namespace-automated",children:"5.2.5 Minimize the admission of containers wishing to share the host network namespace (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Remediation:"}),"\nAdd policies to each namespace in the cluster which has user workloads to restrict the\nadmission of ",(0,t.jsx)(r.code,{children:"hostNetwork"})," containers."]}),"\n",(0,t.jsx)(r.h3,{id:"526-minimize-the-admission-of-containers-with-allowprivilegeescalation-automated",children:"5.2.6 Minimize the admission of containers with allowPrivilegeEscalation (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Remediation:"}),"\nAdd policies to each namespace in the cluster which has user workloads to restrict the\nadmission of containers with ",(0,t.jsx)(r.code,{children:".spec.allowPrivilegeEscalation"})," set to ",(0,t.jsx)(r.code,{children:"true"}),"."]}),"\n",(0,t.jsx)(r.h3,{id:"527-minimize-the-admission-of-root-containers-automated",children:"5.2.7 Minimize the admission of root containers (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Remediation:"}),"\nCreate a policy for each namespace in the cluster, ensuring that either ",(0,t.jsx)(r.code,{children:"MustRunAsNonRoot"}),"\nor ",(0,t.jsx)(r.code,{children:"MustRunAs"})," with the range of UIDs not including 0, is set."]}),"\n",(0,t.jsx)(r.h3,{id:"528-minimize-the-admission-of-containers-with-the-net_raw-capability-automated",children:"5.2.8 Minimize the admission of containers with the NET_RAW capability (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Remediation:"}),"\nAdd policies to each namespace in the cluster which has user workloads to restrict the\nadmission of containers with the ",(0,t.jsx)(r.code,{children:"NET_RAW"})," capability."]}),"\n",(0,t.jsx)(r.h3,{id:"529-minimize-the-admission-of-containers-with-added-capabilities-automated",children:"5.2.9 Minimize the admission of containers with added capabilities (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Remediation:"}),"\nEnsure that ",(0,t.jsx)(r.code,{children:"allowedCapabilities"})," is not present in policies for the cluster unless\nit is set to an empty array."]}),"\n",(0,t.jsx)(r.h3,{id:"5210-minimize-the-admission-of-containers-with-capabilities-assigned-manual",children:"5.2.10 Minimize the admission of containers with capabilities assigned (Manual)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Remediation:"}),"\nReview the use of capabilities in applications running on your cluster. Where a namespace\ncontains applications which do not require any Linux capabities to operate consider adding\na PSP which forbids the admission of containers which do not drop all capabilities."]}),"\n",(0,t.jsx)(r.h3,{id:"5211-minimize-the-admission-of-windows-hostprocess-containers-manual",children:"5.2.11 Minimize the admission of Windows HostProcess containers (Manual)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Remediation:"}),"\nAdd policies to each namespace in the cluster which has user workloads to restrict the\nadmission of containers that have ",(0,t.jsx)(r.code,{children:".securityContext.windowsOptions.hostProcess"})," set to ",(0,t.jsx)(r.code,{children:"true"}),"."]}),"\n",(0,t.jsx)(r.h3,{id:"5212-minimize-the-admission-of-hostpath-volumes-manual",children:"5.2.12 Minimize the admission of HostPath volumes (Manual)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Remediation:"}),"\nAdd policies to each namespace in the cluster which has user workloads to restrict the\nadmission of containers with ",(0,t.jsx)(r.code,{children:"hostPath"})," volumes."]}),"\n",(0,t.jsx)(r.h3,{id:"5213-minimize-the-admission-of-containers-which-use-hostports-manual",children:"5.2.13 Minimize the admission of containers which use HostPorts (Manual)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Remediation:"}),"\nAdd policies to each namespace in the cluster which has user workloads to restrict the\nadmission of containers which use ",(0,t.jsx)(r.code,{children:"hostPort"})," sections."]}),"\n",(0,t.jsx)(r.h2,{id:"53-network-policies-and-cni",children:"5.3 Network Policies and CNI"}),"\n",(0,t.jsx)(r.h3,{id:"531-ensure-that-the-cni-in-use-supports-networkpolicies-manual",children:"5.3.1 Ensure that the CNI in use supports NetworkPolicies (Manual)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Remediation:"}),"\nIf the CNI plugin in use does not support network policies, consideration should be given to\nmaking use of a different plugin, or finding an alternate mechanism for restricting traffic\nin the Kubernetes cluster."]}),"\n",(0,t.jsx)(r.h3,{id:"532-ensure-that-all-namespaces-have-networkpolicies-defined-manual",children:"5.3.2 Ensure that all Namespaces have NetworkPolicies defined (Manual)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Remediation:"}),"\nFollow the documentation and create NetworkPolicy objects as you need them."]}),"\n",(0,t.jsx)(r.h2,{id:"54-secrets-management",children:"5.4 Secrets Management"}),"\n",(0,t.jsx)(r.h3,{id:"541-prefer-using-secrets-as-files-over-secrets-as-environment-variables-manual",children:"5.4.1 Prefer using Secrets as files over Secrets as environment variables (Manual)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Remediation:"}),"\nIf possible, rewrite application code to read Secrets from mounted secret files, rather than\nfrom environment variables."]}),"\n",(0,t.jsx)(r.h3,{id:"542-consider-external-secret-storage-manual",children:"5.4.2 Consider external secret storage (Manual)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Remediation:"}),"\nRefer to the Secrets management options offered by your cloud provider or a third-party\nsecrets management solution."]}),"\n",(0,t.jsx)(r.h2,{id:"55-extensible-admission-control",children:"5.5 Extensible Admission Control"}),"\n",(0,t.jsx)(r.h3,{id:"551-configure-image-provenance-using-imagepolicywebhook-admission-controller-manual",children:"5.5.1 Configure Image Provenance using ImagePolicyWebhook admission controller (Manual)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Remediation:"}),"\nFollow the Kubernetes documentation and setup image provenance."]}),"\n",(0,t.jsx)(r.h2,{id:"57-general-policies",children:"5.7 General Policies"}),"\n",(0,t.jsx)(r.h3,{id:"571-create-administrative-boundaries-between-resources-using-namespaces-manual",children:"5.7.1 Create administrative boundaries between resources using namespaces (Manual)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Remediation:"}),"\nFollow the documentation and create namespaces for objects in your deployment as you need\nthem."]}),"\n",(0,t.jsx)(r.h3,{id:"572-ensure-that-the-seccomp-profile-is-set-to-dockerdefault-in-your-pod-definitions-manual",children:"5.7.2 Ensure that the seccomp profile is set to docker/default in your Pod definitions (Manual)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Remediation:"}),"\nUse ",(0,t.jsx)(r.code,{children:"securityContext"})," to enable the docker/default seccomp profile in your pod definitions.\nAn example is as below:\nsecurityContext:\nseccompProfile:\ntype: RuntimeDefault"]}),"\n",(0,t.jsx)(r.h3,{id:"573-apply-securitycontext-to-your-pods-and-containers-manual",children:"5.7.3 Apply SecurityContext to your Pods and Containers (Manual)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Remediation:"}),"\nFollow the Kubernetes documentation and apply SecurityContexts to your Pods. For a\nsuggested list of SecurityContexts, you may refer to the CIS Security Benchmark for Docker\nContainers."]}),"\n",(0,t.jsx)(r.h3,{id:"574-the-default-namespace-should-not-be-used-manual",children:"5.7.4 The default namespace should not be used (Manual)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Remediation:"}),"\nEnsure that namespaces are created to allow for appropriate segregation of Kubernetes\nresources and that all new resources are created in a specific namespace."]})]})}function u(e={}){const{wrapper:r}={...(0,n.a)(),...e.components};return r?(0,t.jsx)(r,{...e,children:(0,t.jsx)(d,{...e})}):d(e)}},1151:(e,r,s)=>{s.d(r,{Z:()=>l,a:()=>a});var t=s(7294);const n={},i=t.createContext(n);function a(e){const r=t.useContext(i);return t.useMemo((function(){return"function"==typeof e?e(r):{...r,...e}}),[r,e])}function l(e){let r;return r=e.disableParentContext?"function"==typeof e.components?e.components(n):e.components||n:a(e.components),t.createElement(i.Provider,{value:r},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/65c5030c.fd25ad71.js b/assets/js/65c5030c.e1e06803.js similarity index 99% rename from assets/js/65c5030c.fd25ad71.js rename to assets/js/65c5030c.e1e06803.js index e7593c8bd..aa5d69026 100644 --- a/assets/js/65c5030c.fd25ad71.js +++ b/assets/js/65c5030c.e1e06803.js @@ -1 +1 @@ -"use strict";(self.webpackChunkk_3_s_docs=self.webpackChunkk_3_s_docs||[]).push([[7733],{215:(e,n,s)=>{s.r(n),s.d(n,{assets:()=>d,contentTitle:()=>o,default:()=>h,frontMatter:()=>a,metadata:()=>r,toc:()=>l});var i=s(5893),t=s(1151);const a={title:"Managing Packaged Components"},o=void 0,r={id:"installation/packaged-components",title:"Managing Packaged Components",description:"Auto-Deploying Manifests (AddOns)",source:"@site/docs/installation/packaged-components.md",sourceDirName:"installation",slug:"/installation/packaged-components",permalink:"/installation/packaged-components",draft:!1,unlisted:!1,editUrl:"https://github.com/k3s-io/docs/edit/main/docs/installation/packaged-components.md",tags:[],version:"current",lastUpdatedAt:1723651727e3,frontMatter:{title:"Managing Packaged Components"},sidebar:"mySidebar",previous:{title:"Managing Server Roles",permalink:"/installation/server-roles"},next:{title:"Uninstalling K3s",permalink:"/installation/uninstall"}},d={},l=[{value:"Auto-Deploying Manifests (AddOns)",id:"auto-deploying-manifests-addons",level:2},{value:"Packaged Components",id:"packaged-components",level:3},{value:"User AddOns",id:"user-addons",level:3},{value:"File Naming Requirements",id:"file-naming-requirements",level:4},{value:"Disabling Manifests",id:"disabling-manifests",level:2},{value:"Using the --disable flag",id:"using-the---disable-flag",level:3},{value:"Using .skip files",id:"using-skip-files",level:3},{value:"Helm AddOns",id:"helm-addons",level:2}];function c(e){const n={a:"a",admonition:"admonition",blockquote:"blockquote",code:"code",h2:"h2",h3:"h3",h4:"h4",p:"p",pre:"pre",...(0,t.a)(),...e.components};return(0,i.jsxs)(i.Fragment,{children:[(0,i.jsx)(n.h2,{id:"auto-deploying-manifests-addons",children:"Auto-Deploying Manifests (AddOns)"}),"\n",(0,i.jsxs)(n.p,{children:["On server nodes, any file found in ",(0,i.jsx)(n.code,{children:"/var/lib/rancher/k3s/server/manifests"})," will automatically be deployed to Kubernetes in a manner similar to ",(0,i.jsx)(n.code,{children:"kubectl apply"}),", both on startup and when the file is changed on disk. Deleting files out of this directory will not delete the corresponding resources from the cluster."]}),"\n",(0,i.jsxs)(n.p,{children:["Manifests are tracked as ",(0,i.jsx)(n.code,{children:"AddOn"})," custom resources in the ",(0,i.jsx)(n.code,{children:"kube-system"})," namespace. Any errors or warnings encountered when applying the manifest file may seen by using ",(0,i.jsx)(n.code,{children:"kubectl describe"})," on the corresponding ",(0,i.jsx)(n.code,{children:"AddOn"}),", or by using ",(0,i.jsx)(n.code,{children:"kubectl get event -n kube-system"})," to view all events for that namespace, including those from the deploy controller."]}),"\n",(0,i.jsx)(n.h3,{id:"packaged-components",children:"Packaged Components"}),"\n",(0,i.jsxs)(n.p,{children:["K3s comes with a number of packaged components that are deployed as AddOns via the manifests directory: ",(0,i.jsx)(n.code,{children:"coredns"}),", ",(0,i.jsx)(n.code,{children:"traefik"}),", ",(0,i.jsx)(n.code,{children:"local-storage"}),", and ",(0,i.jsx)(n.code,{children:"metrics-server"}),". The embedded ",(0,i.jsx)(n.code,{children:"servicelb"})," LoadBalancer controller does not have a manifest file, but can be disabled as if it were an ",(0,i.jsx)(n.code,{children:"AddOn"})," for historical reasons."]}),"\n",(0,i.jsx)(n.p,{children:"Manifests for packaged components are managed by K3s, and should not be altered. The files are re-written to disk whenever K3s is started, in order to ensure their integrity."}),"\n",(0,i.jsx)(n.h3,{id:"user-addons",children:"User AddOns"}),"\n",(0,i.jsxs)(n.p,{children:["You may place additional files in the manifests directory for deployment as an ",(0,i.jsx)(n.code,{children:"AddOn"}),". Each file may contain multiple Kubernetes resources, delmited by the ",(0,i.jsx)(n.code,{children:"---"})," YAML document separator. For more information on organizing resources in manifests, see the ",(0,i.jsx)(n.a,{href:"https://kubernetes.io/docs/concepts/cluster-administration/manage-deployment/",children:"Managing Resources"})," section of the Kubernetes documentation."]}),"\n",(0,i.jsx)(n.h4,{id:"file-naming-requirements",children:"File Naming Requirements"}),"\n",(0,i.jsxs)(n.p,{children:["The ",(0,i.jsx)(n.code,{children:"AddOn"})," name for each file in the manifest directory is derived from the file basename.\nEnsure that all files within the manifests directory (or within any subdirectories) have names that are unique, and adhere to Kubernetes ",(0,i.jsx)(n.a,{href:"https://kubernetes.io/docs/concepts/overview/working-with-objects/names/",children:"object naming restrictions"}),".\nCare should also be taken not to conflict with names in use by the default K3s packaged components, even if those components are disabled."]}),"\n",(0,i.jsx)(n.p,{children:"Here is en example of an error that would be reported if the file name contains underscores:"}),"\n",(0,i.jsxs)(n.blockquote,{children:["\n",(0,i.jsx)(n.p,{children:(0,i.jsx)(n.code,{children:"Failed to process config: failed to process /var/lib/rancher/k3s/server/manifests/example_manifest.yaml: Addon.k3s.cattle.io \"example_manifest\" is invalid: metadata.name: Invalid value: \"example_manifest\": a lowercase RFC 1123 subdomain must consist of lower case alphanumeric characters, '-' or '.', and must start and end with an alphanumeric character (e.g. 'example.com', regex used for validation is '[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*')"})}),"\n"]}),"\n",(0,i.jsx)(n.admonition,{type:"danger",children:(0,i.jsx)(n.p,{children:"If you have multiple server nodes, and place additional AddOn manifests on more than one server, it is your responsibility to ensure that files stay in sync across those nodes. K3s does not sync AddOn content between nodes, and cannot guarantee correct behavior if different servers attempt to deploy conflicting manifests."})}),"\n",(0,i.jsx)(n.h2,{id:"disabling-manifests",children:"Disabling Manifests"}),"\n",(0,i.jsx)(n.p,{children:"There are two ways to disable deployment of specific content from the manifests directory."}),"\n",(0,i.jsxs)(n.h3,{id:"using-the---disable-flag",children:["Using the ",(0,i.jsx)(n.code,{children:"--disable"})," flag"]}),"\n",(0,i.jsxs)(n.p,{children:["The AddOns for packaged components listed above, in addition to AddOns for any additional manifests placed in the ",(0,i.jsx)(n.code,{children:"manifests"})," directory, can be disabled with the ",(0,i.jsx)(n.code,{children:"--disable"})," flag. Disabled AddOns are actively uninstalled from the cluster, and the source files deleted from the ",(0,i.jsx)(n.code,{children:"manifests"})," directory."]}),"\n",(0,i.jsxs)(n.p,{children:["For example, to disable traefik from being installed on a new cluster, or to uninstall it and remove the manifest from an existing cluster, you can start K3s with ",(0,i.jsx)(n.code,{children:"--disable=traefik"}),". Multiple items can be disabled by separating their names with commas, or by repeating the flag."]}),"\n",(0,i.jsx)(n.h3,{id:"using-skip-files",children:"Using .skip files"}),"\n",(0,i.jsxs)(n.p,{children:["For any file under ",(0,i.jsx)(n.code,{children:"/var/lib/rancher/k3s/server/manifests"}),", you can create a ",(0,i.jsx)(n.code,{children:".skip"})," file which will cause K3s to ignore the corresponding manifest. The contents of the ",(0,i.jsx)(n.code,{children:".skip"})," file do not matter, only its existence is checked. Note that creating a ",(0,i.jsx)(n.code,{children:".skip"})," file after an AddOn has already been created will not remove or otherwise modify it or the resources it created; the file is simply treated as if it did not exist."]}),"\n",(0,i.jsxs)(n.p,{children:["For example, creating an empty ",(0,i.jsx)(n.code,{children:"traefik.yaml.skip"})," file in the manifests directory before K3s is started the first time, will cause K3s to skip deploying ",(0,i.jsx)(n.code,{children:"traefik.yaml"}),":"]}),"\n",(0,i.jsx)(n.pre,{children:(0,i.jsx)(n.code,{className:"language-bash",children:"$ ls /var/lib/rancher/k3s/server/manifests\nccm.yaml local-storage.yaml rolebindings.yaml traefik.yaml.skip\ncoredns.yaml traefik.yaml\n\n$ kubectl get pods -A\nNAMESPACE NAME READY STATUS RESTARTS AGE\nkube-system local-path-provisioner-64ffb68fd-xx98j 1/1 Running 0 74s\nkube-system metrics-server-5489f84d5d-7zwkt 1/1 Running 0 74s\nkube-system coredns-85cb69466-vcq7j 1/1 Running 0 74s\n"})}),"\n",(0,i.jsxs)(n.p,{children:["If Traefik had already been deployed prior to creating the ",(0,i.jsx)(n.code,{children:"traefik.skip"})," file, Traefik would stay as-is, and would not be affected by future updates when K3s is upgraded."]}),"\n",(0,i.jsx)(n.h2,{id:"helm-addons",children:"Helm AddOns"}),"\n",(0,i.jsxs)(n.p,{children:["For information about managing Helm charts via auto-deploying manifests, refer to the section about ",(0,i.jsx)(n.a,{href:"/helm",children:"Helm."})]})]})}function h(e={}){const{wrapper:n}={...(0,t.a)(),...e.components};return n?(0,i.jsx)(n,{...e,children:(0,i.jsx)(c,{...e})}):c(e)}},1151:(e,n,s)=>{s.d(n,{Z:()=>r,a:()=>o});var i=s(7294);const t={},a=i.createContext(t);function o(e){const n=i.useContext(a);return i.useMemo((function(){return"function"==typeof e?e(n):{...n,...e}}),[n,e])}function r(e){let n;return n=e.disableParentContext?"function"==typeof e.components?e.components(t):e.components||t:o(e.components),i.createElement(a.Provider,{value:n},e.children)}}}]); \ No newline at end of file +"use strict";(self.webpackChunkk_3_s_docs=self.webpackChunkk_3_s_docs||[]).push([[7733],{215:(e,n,s)=>{s.r(n),s.d(n,{assets:()=>d,contentTitle:()=>o,default:()=>h,frontMatter:()=>a,metadata:()=>r,toc:()=>l});var i=s(5893),t=s(1151);const a={title:"Managing Packaged Components"},o=void 0,r={id:"installation/packaged-components",title:"Managing Packaged Components",description:"Auto-Deploying Manifests (AddOns)",source:"@site/docs/installation/packaged-components.md",sourceDirName:"installation",slug:"/installation/packaged-components",permalink:"/installation/packaged-components",draft:!1,unlisted:!1,editUrl:"https://github.com/k3s-io/docs/edit/main/docs/installation/packaged-components.md",tags:[],version:"current",lastUpdatedAt:1723747404e3,frontMatter:{title:"Managing Packaged Components"},sidebar:"mySidebar",previous:{title:"Managing Server Roles",permalink:"/installation/server-roles"},next:{title:"Uninstalling K3s",permalink:"/installation/uninstall"}},d={},l=[{value:"Auto-Deploying Manifests (AddOns)",id:"auto-deploying-manifests-addons",level:2},{value:"Packaged Components",id:"packaged-components",level:3},{value:"User AddOns",id:"user-addons",level:3},{value:"File Naming Requirements",id:"file-naming-requirements",level:4},{value:"Disabling Manifests",id:"disabling-manifests",level:2},{value:"Using the --disable flag",id:"using-the---disable-flag",level:3},{value:"Using .skip files",id:"using-skip-files",level:3},{value:"Helm AddOns",id:"helm-addons",level:2}];function c(e){const n={a:"a",admonition:"admonition",blockquote:"blockquote",code:"code",h2:"h2",h3:"h3",h4:"h4",p:"p",pre:"pre",...(0,t.a)(),...e.components};return(0,i.jsxs)(i.Fragment,{children:[(0,i.jsx)(n.h2,{id:"auto-deploying-manifests-addons",children:"Auto-Deploying Manifests (AddOns)"}),"\n",(0,i.jsxs)(n.p,{children:["On server nodes, any file found in ",(0,i.jsx)(n.code,{children:"/var/lib/rancher/k3s/server/manifests"})," will automatically be deployed to Kubernetes in a manner similar to ",(0,i.jsx)(n.code,{children:"kubectl apply"}),", both on startup and when the file is changed on disk. Deleting files out of this directory will not delete the corresponding resources from the cluster."]}),"\n",(0,i.jsxs)(n.p,{children:["Manifests are tracked as ",(0,i.jsx)(n.code,{children:"AddOn"})," custom resources in the ",(0,i.jsx)(n.code,{children:"kube-system"})," namespace. Any errors or warnings encountered when applying the manifest file may seen by using ",(0,i.jsx)(n.code,{children:"kubectl describe"})," on the corresponding ",(0,i.jsx)(n.code,{children:"AddOn"}),", or by using ",(0,i.jsx)(n.code,{children:"kubectl get event -n kube-system"})," to view all events for that namespace, including those from the deploy controller."]}),"\n",(0,i.jsx)(n.h3,{id:"packaged-components",children:"Packaged Components"}),"\n",(0,i.jsxs)(n.p,{children:["K3s comes with a number of packaged components that are deployed as AddOns via the manifests directory: ",(0,i.jsx)(n.code,{children:"coredns"}),", ",(0,i.jsx)(n.code,{children:"traefik"}),", ",(0,i.jsx)(n.code,{children:"local-storage"}),", and ",(0,i.jsx)(n.code,{children:"metrics-server"}),". The embedded ",(0,i.jsx)(n.code,{children:"servicelb"})," LoadBalancer controller does not have a manifest file, but can be disabled as if it were an ",(0,i.jsx)(n.code,{children:"AddOn"})," for historical reasons."]}),"\n",(0,i.jsx)(n.p,{children:"Manifests for packaged components are managed by K3s, and should not be altered. The files are re-written to disk whenever K3s is started, in order to ensure their integrity."}),"\n",(0,i.jsx)(n.h3,{id:"user-addons",children:"User AddOns"}),"\n",(0,i.jsxs)(n.p,{children:["You may place additional files in the manifests directory for deployment as an ",(0,i.jsx)(n.code,{children:"AddOn"}),". Each file may contain multiple Kubernetes resources, delmited by the ",(0,i.jsx)(n.code,{children:"---"})," YAML document separator. For more information on organizing resources in manifests, see the ",(0,i.jsx)(n.a,{href:"https://kubernetes.io/docs/concepts/cluster-administration/manage-deployment/",children:"Managing Resources"})," section of the Kubernetes documentation."]}),"\n",(0,i.jsx)(n.h4,{id:"file-naming-requirements",children:"File Naming Requirements"}),"\n",(0,i.jsxs)(n.p,{children:["The ",(0,i.jsx)(n.code,{children:"AddOn"})," name for each file in the manifest directory is derived from the file basename.\nEnsure that all files within the manifests directory (or within any subdirectories) have names that are unique, and adhere to Kubernetes ",(0,i.jsx)(n.a,{href:"https://kubernetes.io/docs/concepts/overview/working-with-objects/names/",children:"object naming restrictions"}),".\nCare should also be taken not to conflict with names in use by the default K3s packaged components, even if those components are disabled."]}),"\n",(0,i.jsx)(n.p,{children:"Here is en example of an error that would be reported if the file name contains underscores:"}),"\n",(0,i.jsxs)(n.blockquote,{children:["\n",(0,i.jsx)(n.p,{children:(0,i.jsx)(n.code,{children:"Failed to process config: failed to process /var/lib/rancher/k3s/server/manifests/example_manifest.yaml: Addon.k3s.cattle.io \"example_manifest\" is invalid: metadata.name: Invalid value: \"example_manifest\": a lowercase RFC 1123 subdomain must consist of lower case alphanumeric characters, '-' or '.', and must start and end with an alphanumeric character (e.g. 'example.com', regex used for validation is '[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*')"})}),"\n"]}),"\n",(0,i.jsx)(n.admonition,{type:"danger",children:(0,i.jsx)(n.p,{children:"If you have multiple server nodes, and place additional AddOn manifests on more than one server, it is your responsibility to ensure that files stay in sync across those nodes. K3s does not sync AddOn content between nodes, and cannot guarantee correct behavior if different servers attempt to deploy conflicting manifests."})}),"\n",(0,i.jsx)(n.h2,{id:"disabling-manifests",children:"Disabling Manifests"}),"\n",(0,i.jsx)(n.p,{children:"There are two ways to disable deployment of specific content from the manifests directory."}),"\n",(0,i.jsxs)(n.h3,{id:"using-the---disable-flag",children:["Using the ",(0,i.jsx)(n.code,{children:"--disable"})," flag"]}),"\n",(0,i.jsxs)(n.p,{children:["The AddOns for packaged components listed above, in addition to AddOns for any additional manifests placed in the ",(0,i.jsx)(n.code,{children:"manifests"})," directory, can be disabled with the ",(0,i.jsx)(n.code,{children:"--disable"})," flag. Disabled AddOns are actively uninstalled from the cluster, and the source files deleted from the ",(0,i.jsx)(n.code,{children:"manifests"})," directory."]}),"\n",(0,i.jsxs)(n.p,{children:["For example, to disable traefik from being installed on a new cluster, or to uninstall it and remove the manifest from an existing cluster, you can start K3s with ",(0,i.jsx)(n.code,{children:"--disable=traefik"}),". Multiple items can be disabled by separating their names with commas, or by repeating the flag."]}),"\n",(0,i.jsx)(n.h3,{id:"using-skip-files",children:"Using .skip files"}),"\n",(0,i.jsxs)(n.p,{children:["For any file under ",(0,i.jsx)(n.code,{children:"/var/lib/rancher/k3s/server/manifests"}),", you can create a ",(0,i.jsx)(n.code,{children:".skip"})," file which will cause K3s to ignore the corresponding manifest. The contents of the ",(0,i.jsx)(n.code,{children:".skip"})," file do not matter, only its existence is checked. Note that creating a ",(0,i.jsx)(n.code,{children:".skip"})," file after an AddOn has already been created will not remove or otherwise modify it or the resources it created; the file is simply treated as if it did not exist."]}),"\n",(0,i.jsxs)(n.p,{children:["For example, creating an empty ",(0,i.jsx)(n.code,{children:"traefik.yaml.skip"})," file in the manifests directory before K3s is started the first time, will cause K3s to skip deploying ",(0,i.jsx)(n.code,{children:"traefik.yaml"}),":"]}),"\n",(0,i.jsx)(n.pre,{children:(0,i.jsx)(n.code,{className:"language-bash",children:"$ ls /var/lib/rancher/k3s/server/manifests\nccm.yaml local-storage.yaml rolebindings.yaml traefik.yaml.skip\ncoredns.yaml traefik.yaml\n\n$ kubectl get pods -A\nNAMESPACE NAME READY STATUS RESTARTS AGE\nkube-system local-path-provisioner-64ffb68fd-xx98j 1/1 Running 0 74s\nkube-system metrics-server-5489f84d5d-7zwkt 1/1 Running 0 74s\nkube-system coredns-85cb69466-vcq7j 1/1 Running 0 74s\n"})}),"\n",(0,i.jsxs)(n.p,{children:["If Traefik had already been deployed prior to creating the ",(0,i.jsx)(n.code,{children:"traefik.skip"})," file, Traefik would stay as-is, and would not be affected by future updates when K3s is upgraded."]}),"\n",(0,i.jsx)(n.h2,{id:"helm-addons",children:"Helm AddOns"}),"\n",(0,i.jsxs)(n.p,{children:["For information about managing Helm charts via auto-deploying manifests, refer to the section about ",(0,i.jsx)(n.a,{href:"/helm",children:"Helm."})]})]})}function h(e={}){const{wrapper:n}={...(0,t.a)(),...e.components};return n?(0,i.jsx)(n,{...e,children:(0,i.jsx)(c,{...e})}):c(e)}},1151:(e,n,s)=>{s.d(n,{Z:()=>r,a:()=>o});var i=s(7294);const t={},a=i.createContext(t);function o(e){const n=i.useContext(a);return i.useMemo((function(){return"function"==typeof e?e(n):{...n,...e}}),[n,e])}function r(e){let n;return n=e.disableParentContext?"function"==typeof e.components?e.components(t):e.components||t:o(e.components),i.createElement(a.Provider,{value:n},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/6ab2c2e0.06c8b0e2.js b/assets/js/6ab2c2e0.31c46199.js similarity index 99% rename from assets/js/6ab2c2e0.06c8b0e2.js rename to assets/js/6ab2c2e0.31c46199.js index ca986b9e4..3e7894bb6 100644 --- a/assets/js/6ab2c2e0.06c8b0e2.js +++ b/assets/js/6ab2c2e0.31c46199.js @@ -1 +1 @@ -"use strict";(self.webpackChunkk_3_s_docs=self.webpackChunkk_3_s_docs||[]).push([[981],{9414:(e,t,s)=>{s.r(t),s.d(t,{assets:()=>c,contentTitle:()=>d,default:()=>h,frontMatter:()=>r,metadata:()=>l,toc:()=>o});var n=s(5893),i=s(1151);const r={title:"Environment Variables"},d=void 0,l={id:"reference/env-variables",title:"Environment Variables",description:"As mentioned in the Quick-Start Guide, you can use the installation script available at https://get.k3s.io to install K3s as a service on systemd and openrc based systems.",source:"@site/docs/reference/env-variables.md",sourceDirName:"reference",slug:"/reference/env-variables",permalink:"/reference/env-variables",draft:!1,unlisted:!1,editUrl:"https://github.com/k3s-io/docs/edit/main/docs/reference/env-variables.md",tags:[],version:"current",lastUpdatedAt:1723651727e3,frontMatter:{title:"Environment Variables"},sidebar:"mySidebar",previous:{title:"Advanced Options / Configuration",permalink:"/advanced"},next:{title:"Flag Deprecation",permalink:"/reference/flag-deprecation"}},c={},o=[];function a(e){const t={a:"a",code:"code",p:"p",pre:"pre",table:"table",tbody:"tbody",td:"td",th:"th",thead:"thead",tr:"tr",...(0,i.a)(),...e.components};return(0,n.jsxs)(n.Fragment,{children:[(0,n.jsxs)(t.p,{children:["As mentioned in the ",(0,n.jsx)(t.a,{href:"/quick-start",children:"Quick-Start Guide"}),", you can use the installation script available at ",(0,n.jsx)(t.a,{href:"https://get.k3s.io",children:"https://get.k3s.io"})," to install K3s as a service on systemd and openrc based systems."]}),"\n",(0,n.jsx)(t.p,{children:"The simplest form of this command is as follows:"}),"\n",(0,n.jsx)(t.pre,{children:(0,n.jsx)(t.code,{className:"language-bash",children:"curl -sfL https://get.k3s.io | sh -\n"})}),"\n",(0,n.jsx)(t.p,{children:"When using this method to install K3s, the following environment variables can be used to configure the installation:"}),"\n",(0,n.jsxs)(t.table,{children:[(0,n.jsx)(t.thead,{children:(0,n.jsxs)(t.tr,{children:[(0,n.jsx)(t.th,{children:"Environment Variable"}),(0,n.jsx)(t.th,{children:"Description"})]})}),(0,n.jsxs)(t.tbody,{children:[(0,n.jsxs)(t.tr,{children:[(0,n.jsx)(t.td,{children:(0,n.jsx)(t.code,{children:"INSTALL_K3S_SKIP_DOWNLOAD"})}),(0,n.jsx)(t.td,{children:"If set to true will not download K3s hash or binary."})]}),(0,n.jsxs)(t.tr,{children:[(0,n.jsx)(t.td,{children:(0,n.jsx)(t.code,{children:"INSTALL_K3S_SYMLINK"})}),(0,n.jsx)(t.td,{children:"By default will create symlinks for the kubectl, crictl, and ctr binaries if the commands do not already exist in path. If set to 'skip' will not create symlinks and 'force' will overwrite."})]}),(0,n.jsxs)(t.tr,{children:[(0,n.jsx)(t.td,{children:(0,n.jsx)(t.code,{children:"INSTALL_K3S_SKIP_ENABLE"})}),(0,n.jsx)(t.td,{children:"If set to true will not enable or start K3s service."})]}),(0,n.jsxs)(t.tr,{children:[(0,n.jsx)(t.td,{children:(0,n.jsx)(t.code,{children:"INSTALL_K3S_SKIP_START"})}),(0,n.jsx)(t.td,{children:"If set to true will not start K3s service."})]}),(0,n.jsxs)(t.tr,{children:[(0,n.jsx)(t.td,{children:(0,n.jsx)(t.code,{children:"INSTALL_K3S_VERSION"})}),(0,n.jsx)(t.td,{children:"Version of K3s to download from Github. Will attempt to download from the stable channel if not specified."})]}),(0,n.jsxs)(t.tr,{children:[(0,n.jsx)(t.td,{children:(0,n.jsx)(t.code,{children:"INSTALL_K3S_BIN_DIR"})}),(0,n.jsxs)(t.td,{children:["Directory to install K3s binary, links, and uninstall script to, or use ",(0,n.jsx)(t.code,{children:"/usr/local/bin"})," as the default."]})]}),(0,n.jsxs)(t.tr,{children:[(0,n.jsx)(t.td,{children:(0,n.jsx)(t.code,{children:"INSTALL_K3S_BIN_DIR_READ_ONLY"})}),(0,n.jsxs)(t.td,{children:["If set to true will not write files to ",(0,n.jsx)(t.code,{children:"INSTALL_K3S_BIN_DIR"}),", forces setting ",(0,n.jsx)(t.code,{children:"INSTALL_K3S_SKIP_DOWNLOAD=true"}),"."]})]}),(0,n.jsxs)(t.tr,{children:[(0,n.jsx)(t.td,{children:(0,n.jsx)(t.code,{children:"INSTALL_K3S_SYSTEMD_DIR"})}),(0,n.jsxs)(t.td,{children:["Directory to install systemd service and environment files to, or use ",(0,n.jsx)(t.code,{children:"/etc/systemd/system"})," as the default."]})]}),(0,n.jsxs)(t.tr,{children:[(0,n.jsx)(t.td,{children:(0,n.jsx)(t.code,{children:"INSTALL_K3S_EXEC"})}),(0,n.jsxs)(t.td,{children:["Command with flags to use for launching K3s in the service. If the command is not specified, and the ",(0,n.jsx)(t.code,{children:"K3S_URL"}),' is set, it will default to "agent." If ',(0,n.jsx)(t.code,{children:"K3S_URL"}),' not set, it will default to "server." For help, refer to ',(0,n.jsx)(t.a,{href:"/installation/configuration#configuration-with-install-script",children:"this example."})]})]}),(0,n.jsxs)(t.tr,{children:[(0,n.jsx)(t.td,{children:(0,n.jsx)(t.code,{children:"INSTALL_K3S_NAME"})}),(0,n.jsx)(t.td,{children:"Name of systemd service to create, will default to 'k3s' if running k3s as a server and 'k3s-agent' if running k3s as an agent. If specified the name will be prefixed with 'k3s-'."})]}),(0,n.jsxs)(t.tr,{children:[(0,n.jsx)(t.td,{children:(0,n.jsx)(t.code,{children:"INSTALL_K3S_TYPE"})}),(0,n.jsx)(t.td,{children:"Type of systemd service to create, will default from the K3s exec command if not specified."})]}),(0,n.jsxs)(t.tr,{children:[(0,n.jsx)(t.td,{children:(0,n.jsx)(t.code,{children:"INSTALL_K3S_SELINUX_WARN"})}),(0,n.jsx)(t.td,{children:"If set to true will continue if k3s-selinux policy is not found."})]}),(0,n.jsxs)(t.tr,{children:[(0,n.jsx)(t.td,{children:(0,n.jsx)(t.code,{children:"INSTALL_K3S_SKIP_SELINUX_RPM"})}),(0,n.jsx)(t.td,{children:"If set to true will skip automatic installation of the k3s RPM."})]}),(0,n.jsxs)(t.tr,{children:[(0,n.jsx)(t.td,{children:(0,n.jsx)(t.code,{children:"INSTALL_K3S_CHANNEL_URL"})}),(0,n.jsxs)(t.td,{children:["Channel URL for fetching K3s download URL. Defaults to ",(0,n.jsx)(t.a,{href:"https://update.k3s.io/v1-release/channels",children:"https://update.k3s.io/v1-release/channels"}),"."]})]}),(0,n.jsxs)(t.tr,{children:[(0,n.jsx)(t.td,{children:(0,n.jsx)(t.code,{children:"INSTALL_K3S_CHANNEL"})}),(0,n.jsxs)(t.td,{children:['Channel to use for fetching K3s download URL. Defaults to "stable". Options include: ',(0,n.jsx)(t.code,{children:"stable"}),", ",(0,n.jsx)(t.code,{children:"latest"}),", ",(0,n.jsx)(t.code,{children:"testing"}),"."]})]})]})]}),"\n",(0,n.jsx)(t.p,{children:"This example shows where to place aforementioned environment variables as options (after the pipe):"}),"\n",(0,n.jsx)(t.pre,{children:(0,n.jsx)(t.code,{className:"language-bash",children:"curl -sfL https://get.k3s.io | INSTALL_K3S_CHANNEL=latest sh -\n"})}),"\n",(0,n.jsxs)(t.p,{children:["Environment variables which begin with ",(0,n.jsx)(t.code,{children:"K3S_"})," will be preserved for the systemd and openrc services to use."]}),"\n",(0,n.jsxs)(t.p,{children:["Setting ",(0,n.jsx)(t.code,{children:"K3S_URL"}),' without explicitly setting an exec command will default the command to "agent".']}),"\n",(0,n.jsxs)(t.p,{children:["When running the agent, ",(0,n.jsx)(t.code,{children:"K3S_TOKEN"})," must also be set."]})]})}function h(e={}){const{wrapper:t}={...(0,i.a)(),...e.components};return t?(0,n.jsx)(t,{...e,children:(0,n.jsx)(a,{...e})}):a(e)}},1151:(e,t,s)=>{s.d(t,{Z:()=>l,a:()=>d});var n=s(7294);const i={},r=n.createContext(i);function d(e){const t=n.useContext(r);return n.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function l(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(i):e.components||i:d(e.components),n.createElement(r.Provider,{value:t},e.children)}}}]); \ No newline at end of file +"use strict";(self.webpackChunkk_3_s_docs=self.webpackChunkk_3_s_docs||[]).push([[981],{9414:(e,t,s)=>{s.r(t),s.d(t,{assets:()=>c,contentTitle:()=>d,default:()=>h,frontMatter:()=>r,metadata:()=>l,toc:()=>o});var n=s(5893),i=s(1151);const r={title:"Environment Variables"},d=void 0,l={id:"reference/env-variables",title:"Environment Variables",description:"As mentioned in the Quick-Start Guide, you can use the installation script available at https://get.k3s.io to install K3s as a service on systemd and openrc based systems.",source:"@site/docs/reference/env-variables.md",sourceDirName:"reference",slug:"/reference/env-variables",permalink:"/reference/env-variables",draft:!1,unlisted:!1,editUrl:"https://github.com/k3s-io/docs/edit/main/docs/reference/env-variables.md",tags:[],version:"current",lastUpdatedAt:1723747404e3,frontMatter:{title:"Environment Variables"},sidebar:"mySidebar",previous:{title:"Advanced Options / Configuration",permalink:"/advanced"},next:{title:"Flag Deprecation",permalink:"/reference/flag-deprecation"}},c={},o=[];function a(e){const t={a:"a",code:"code",p:"p",pre:"pre",table:"table",tbody:"tbody",td:"td",th:"th",thead:"thead",tr:"tr",...(0,i.a)(),...e.components};return(0,n.jsxs)(n.Fragment,{children:[(0,n.jsxs)(t.p,{children:["As mentioned in the ",(0,n.jsx)(t.a,{href:"/quick-start",children:"Quick-Start Guide"}),", you can use the installation script available at ",(0,n.jsx)(t.a,{href:"https://get.k3s.io",children:"https://get.k3s.io"})," to install K3s as a service on systemd and openrc based systems."]}),"\n",(0,n.jsx)(t.p,{children:"The simplest form of this command is as follows:"}),"\n",(0,n.jsx)(t.pre,{children:(0,n.jsx)(t.code,{className:"language-bash",children:"curl -sfL https://get.k3s.io | sh -\n"})}),"\n",(0,n.jsx)(t.p,{children:"When using this method to install K3s, the following environment variables can be used to configure the installation:"}),"\n",(0,n.jsxs)(t.table,{children:[(0,n.jsx)(t.thead,{children:(0,n.jsxs)(t.tr,{children:[(0,n.jsx)(t.th,{children:"Environment Variable"}),(0,n.jsx)(t.th,{children:"Description"})]})}),(0,n.jsxs)(t.tbody,{children:[(0,n.jsxs)(t.tr,{children:[(0,n.jsx)(t.td,{children:(0,n.jsx)(t.code,{children:"INSTALL_K3S_SKIP_DOWNLOAD"})}),(0,n.jsx)(t.td,{children:"If set to true will not download K3s hash or binary."})]}),(0,n.jsxs)(t.tr,{children:[(0,n.jsx)(t.td,{children:(0,n.jsx)(t.code,{children:"INSTALL_K3S_SYMLINK"})}),(0,n.jsx)(t.td,{children:"By default will create symlinks for the kubectl, crictl, and ctr binaries if the commands do not already exist in path. If set to 'skip' will not create symlinks and 'force' will overwrite."})]}),(0,n.jsxs)(t.tr,{children:[(0,n.jsx)(t.td,{children:(0,n.jsx)(t.code,{children:"INSTALL_K3S_SKIP_ENABLE"})}),(0,n.jsx)(t.td,{children:"If set to true will not enable or start K3s service."})]}),(0,n.jsxs)(t.tr,{children:[(0,n.jsx)(t.td,{children:(0,n.jsx)(t.code,{children:"INSTALL_K3S_SKIP_START"})}),(0,n.jsx)(t.td,{children:"If set to true will not start K3s service."})]}),(0,n.jsxs)(t.tr,{children:[(0,n.jsx)(t.td,{children:(0,n.jsx)(t.code,{children:"INSTALL_K3S_VERSION"})}),(0,n.jsx)(t.td,{children:"Version of K3s to download from Github. Will attempt to download from the stable channel if not specified."})]}),(0,n.jsxs)(t.tr,{children:[(0,n.jsx)(t.td,{children:(0,n.jsx)(t.code,{children:"INSTALL_K3S_BIN_DIR"})}),(0,n.jsxs)(t.td,{children:["Directory to install K3s binary, links, and uninstall script to, or use ",(0,n.jsx)(t.code,{children:"/usr/local/bin"})," as the default."]})]}),(0,n.jsxs)(t.tr,{children:[(0,n.jsx)(t.td,{children:(0,n.jsx)(t.code,{children:"INSTALL_K3S_BIN_DIR_READ_ONLY"})}),(0,n.jsxs)(t.td,{children:["If set to true will not write files to ",(0,n.jsx)(t.code,{children:"INSTALL_K3S_BIN_DIR"}),", forces setting ",(0,n.jsx)(t.code,{children:"INSTALL_K3S_SKIP_DOWNLOAD=true"}),"."]})]}),(0,n.jsxs)(t.tr,{children:[(0,n.jsx)(t.td,{children:(0,n.jsx)(t.code,{children:"INSTALL_K3S_SYSTEMD_DIR"})}),(0,n.jsxs)(t.td,{children:["Directory to install systemd service and environment files to, or use ",(0,n.jsx)(t.code,{children:"/etc/systemd/system"})," as the default."]})]}),(0,n.jsxs)(t.tr,{children:[(0,n.jsx)(t.td,{children:(0,n.jsx)(t.code,{children:"INSTALL_K3S_EXEC"})}),(0,n.jsxs)(t.td,{children:["Command with flags to use for launching K3s in the service. If the command is not specified, and the ",(0,n.jsx)(t.code,{children:"K3S_URL"}),' is set, it will default to "agent." If ',(0,n.jsx)(t.code,{children:"K3S_URL"}),' not set, it will default to "server." For help, refer to ',(0,n.jsx)(t.a,{href:"/installation/configuration#configuration-with-install-script",children:"this example."})]})]}),(0,n.jsxs)(t.tr,{children:[(0,n.jsx)(t.td,{children:(0,n.jsx)(t.code,{children:"INSTALL_K3S_NAME"})}),(0,n.jsx)(t.td,{children:"Name of systemd service to create, will default to 'k3s' if running k3s as a server and 'k3s-agent' if running k3s as an agent. If specified the name will be prefixed with 'k3s-'."})]}),(0,n.jsxs)(t.tr,{children:[(0,n.jsx)(t.td,{children:(0,n.jsx)(t.code,{children:"INSTALL_K3S_TYPE"})}),(0,n.jsx)(t.td,{children:"Type of systemd service to create, will default from the K3s exec command if not specified."})]}),(0,n.jsxs)(t.tr,{children:[(0,n.jsx)(t.td,{children:(0,n.jsx)(t.code,{children:"INSTALL_K3S_SELINUX_WARN"})}),(0,n.jsx)(t.td,{children:"If set to true will continue if k3s-selinux policy is not found."})]}),(0,n.jsxs)(t.tr,{children:[(0,n.jsx)(t.td,{children:(0,n.jsx)(t.code,{children:"INSTALL_K3S_SKIP_SELINUX_RPM"})}),(0,n.jsx)(t.td,{children:"If set to true will skip automatic installation of the k3s RPM."})]}),(0,n.jsxs)(t.tr,{children:[(0,n.jsx)(t.td,{children:(0,n.jsx)(t.code,{children:"INSTALL_K3S_CHANNEL_URL"})}),(0,n.jsxs)(t.td,{children:["Channel URL for fetching K3s download URL. Defaults to ",(0,n.jsx)(t.a,{href:"https://update.k3s.io/v1-release/channels",children:"https://update.k3s.io/v1-release/channels"}),"."]})]}),(0,n.jsxs)(t.tr,{children:[(0,n.jsx)(t.td,{children:(0,n.jsx)(t.code,{children:"INSTALL_K3S_CHANNEL"})}),(0,n.jsxs)(t.td,{children:['Channel to use for fetching K3s download URL. Defaults to "stable". Options include: ',(0,n.jsx)(t.code,{children:"stable"}),", ",(0,n.jsx)(t.code,{children:"latest"}),", ",(0,n.jsx)(t.code,{children:"testing"}),"."]})]})]})]}),"\n",(0,n.jsx)(t.p,{children:"This example shows where to place aforementioned environment variables as options (after the pipe):"}),"\n",(0,n.jsx)(t.pre,{children:(0,n.jsx)(t.code,{className:"language-bash",children:"curl -sfL https://get.k3s.io | INSTALL_K3S_CHANNEL=latest sh -\n"})}),"\n",(0,n.jsxs)(t.p,{children:["Environment variables which begin with ",(0,n.jsx)(t.code,{children:"K3S_"})," will be preserved for the systemd and openrc services to use."]}),"\n",(0,n.jsxs)(t.p,{children:["Setting ",(0,n.jsx)(t.code,{children:"K3S_URL"}),' without explicitly setting an exec command will default the command to "agent".']}),"\n",(0,n.jsxs)(t.p,{children:["When running the agent, ",(0,n.jsx)(t.code,{children:"K3S_TOKEN"})," must also be set."]})]})}function h(e={}){const{wrapper:t}={...(0,i.a)(),...e.components};return t?(0,n.jsx)(t,{...e,children:(0,n.jsx)(a,{...e})}):a(e)}},1151:(e,t,s)=>{s.d(t,{Z:()=>l,a:()=>d});var n=s(7294);const i={},r=n.createContext(i);function d(e){const t=n.useContext(r);return n.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function l(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(i):e.components||i:d(e.components),n.createElement(r.Provider,{value:t},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/6e9804bc.3146c892.js b/assets/js/6e9804bc.0dc8e83c.js similarity index 99% rename from assets/js/6e9804bc.3146c892.js rename to assets/js/6e9804bc.0dc8e83c.js index 7bb09f711..848a582cc 100644 --- a/assets/js/6e9804bc.3146c892.js +++ b/assets/js/6e9804bc.0dc8e83c.js @@ -1 +1 @@ -"use strict";(self.webpackChunkk_3_s_docs=self.webpackChunkk_3_s_docs||[]).push([[393],{1218:(e,t,r)=>{r.r(t),r.d(t,{assets:()=>o,contentTitle:()=>c,default:()=>h,frontMatter:()=>i,metadata:()=>a,toc:()=>d});var s=r(5893),n=r(1151);const i={title:"certificate"},c="k3s certificate",a={id:"cli/certificate",title:"certificate",description:"Client and Server Certificates",source:"@site/docs/cli/certificate.md",sourceDirName:"cli",slug:"/cli/certificate",permalink:"/cli/certificate",draft:!1,unlisted:!1,editUrl:"https://github.com/k3s-io/docs/edit/main/docs/cli/certificate.md",tags:[],version:"current",lastUpdatedAt:1723651727e3,frontMatter:{title:"certificate"},sidebar:"mySidebar",previous:{title:"agent",permalink:"/cli/agent"},next:{title:"etcd-snapshot",permalink:"/cli/etcd-snapshot"}},o={},d=[{value:"Client and Server Certificates",id:"client-and-server-certificates",level:2},{value:"Rotating Client and Server Certificates",id:"rotating-client-and-server-certificates",level:3},{value:"Certificate Authority (CA) Certificates",id:"certificate-authority-ca-certificates",level:2},{value:"Using Custom CA Certificates",id:"using-custom-ca-certificates",level:3},{value:"Custom CA Topology",id:"custom-ca-topology",level:4},{value:"Using the Example Script",id:"using-the-example-script",level:4},{value:"Rotating Custom CA Certificates",id:"rotating-custom-ca-certificates",level:3},{value:"Using the Example Script",id:"using-the-example-script-1",level:4},{value:"Rotating Self-Signed CA Certificates",id:"rotating-self-signed-ca-certificates",level:3},{value:"Default CA Topology",id:"default-ca-topology",level:4},{value:"Using The Example Script",id:"using-the-example-script-2",level:4},{value:"Service-Account Issuer Key Rotation",id:"service-account-issuer-key-rotation",level:2}];function l(e){const t={a:"a",admonition:"admonition",br:"br",code:"code",em:"em",h1:"h1",h2:"h2",h3:"h3",h4:"h4",header:"header",li:"li",mermaid:"mermaid",p:"p",pre:"pre",ul:"ul",...(0,n.a)(),...e.components};return(0,s.jsxs)(s.Fragment,{children:[(0,s.jsx)(t.header,{children:(0,s.jsx)(t.h1,{id:"k3s-certificate",children:"k3s certificate"})}),"\n",(0,s.jsx)(t.h2,{id:"client-and-server-certificates",children:"Client and Server Certificates"}),"\n",(0,s.jsx)(t.p,{children:"K3s client and server certificates are valid for 365 days from their date of issuance. Any certificates that are expired, or within 90 days of expiring, are automatically renewed every time K3s starts."}),"\n",(0,s.jsx)(t.h3,{id:"rotating-client-and-server-certificates",children:"Rotating Client and Server Certificates"}),"\n",(0,s.jsxs)(t.p,{children:["To rotate client and server certificates manually, use the ",(0,s.jsx)(t.code,{children:"k3s certificate rotate"})," subcommand:"]}),"\n",(0,s.jsx)(t.pre,{children:(0,s.jsx)(t.code,{className:"language-bash",children:"# Stop K3s\nsystemctl stop k3s\n\n# Rotate certificates\nk3s certificate rotate\n\n# Start K3s\nsystemctl start k3s\n"})}),"\n",(0,s.jsx)(t.p,{children:"Individual or lists of certificates can be rotated by specifying the certificate name:"}),"\n",(0,s.jsx)(t.pre,{children:(0,s.jsx)(t.code,{className:"language-bash",children:"k3s certificate rotate --service ,\n"})}),"\n",(0,s.jsxs)(t.p,{children:["The following certificates can be rotated: ",(0,s.jsx)(t.code,{children:"admin"}),", ",(0,s.jsx)(t.code,{children:"api-server"}),", ",(0,s.jsx)(t.code,{children:"controller-manager"}),", ",(0,s.jsx)(t.code,{children:"scheduler"}),", ",(0,s.jsx)(t.code,{children:"k3s-controller"}),", ",(0,s.jsx)(t.code,{children:"k3s-server"}),", ",(0,s.jsx)(t.code,{children:"cloud-controller"}),", ",(0,s.jsx)(t.code,{children:"etcd"}),", ",(0,s.jsx)(t.code,{children:"auth-proxy"}),", ",(0,s.jsx)(t.code,{children:"kubelet"}),", ",(0,s.jsx)(t.code,{children:"kube-proxy"}),"."]}),"\n",(0,s.jsx)(t.h2,{id:"certificate-authority-ca-certificates",children:"Certificate Authority (CA) Certificates"}),"\n",(0,s.jsxs)(t.p,{children:["Kubernetes requires a number of CA certificates for proper operation. For more information on how Kubernetes uses CA certificates, see the Kubernetes ",(0,s.jsx)(t.a,{href:"https://kubernetes.io/docs/setup/best-practices/certificates/#all-certificates",children:"PKI Certificates and Requirements"})," documentation."]}),"\n",(0,s.jsx)(t.p,{children:"By default, K3s generates self-signed CA certificates during startup of the first server node. These CA certificates are valid for 10 years from date of issuance, and are not automatically renewed."}),"\n",(0,s.jsxs)(t.p,{children:["The authoritative CA certificates and keys are stored within the datastore's bootstrap key, encrypted using the ",(0,s.jsx)(t.a,{href:"/cli/token#server",children:"server token"})," as the PBKDF2 passphrase with AES256-GCM and HMAC-SHA1.\nCopies of the CA certificates and keys are extracted to disk during K3s server startup.\nAny server may generate leaf certificates for nodes as they join the cluster, and the Kubernetes ",(0,s.jsx)(t.a,{href:"https://kubernetes.io/docs/reference/access-authn-authz/certificate-signing-requests/",children:"Certificates API"})," controllers may issue additional certificates at runtime."]}),"\n",(0,s.jsxs)(t.p,{children:["To rotate CA certificates and keys, use the ",(0,s.jsx)(t.code,{children:"k3s certificate rotate-ca"})," command.\nThe command performs integrity checks to confirm that the updated certificates and keys are usable.\nIf the updated data is acceptable, the datastore's encrypted bootstrap key is updated, and the new certificates and keys will be used the next time K3s starts.\nIf problems are encountered while validating the certificates and keys, an error is reported to the system log and the operation is cancelled without changes."]}),"\n",(0,s.jsx)(t.admonition,{title:"Version Gate",type:"info",children:(0,s.jsxs)(t.p,{children:["Support for the ",(0,s.jsx)(t.code,{children:"k3s certificate rotate-ca"})," command and the ability to use CA certificates signed by an external CA is available starting with the 2023-02 releases (v1.26.2+k3s1, v1.25.7+k3s1, v1.24.11+k3s1, v1.23.17+k3s1)."]})}),"\n",(0,s.jsx)(t.h3,{id:"using-custom-ca-certificates",children:"Using Custom CA Certificates"}),"\n",(0,s.jsx)(t.p,{children:"If CA certificates and keys are found the correct location during initial startup of the first server in the cluster, automatic generation of CA certificates will be bypassed."}),"\n",(0,s.jsxs)(t.p,{children:["An example script to pre-create the appropriate certificates and keys is available ",(0,s.jsxs)(t.a,{href:"https://github.com/k3s-io/k3s/blob/master/contrib/util/generate-custom-ca-certs.sh",children:["in the K3s repo at ",(0,s.jsx)(t.code,{children:"contrib/util/generate-custom-ca-certs.sh"})]}),".\nThis script should be run prior to starting K3s for the first time, and will create a full set of leaf CA certificates signed by common Root and Intermediate CA certificates.\nIf you have an existing Root or Intermediate CA, this script can be used (or used as a starting point) to create the correct CA certificates to provision a K3s cluster with PKI rooted in an existing authority."]}),"\n",(0,s.jsxs)(t.p,{children:["Custom Certificate Authority files must be placed in ",(0,s.jsx)(t.code,{children:"/var/lib/rancher/k3s/server/tls"}),". The following files are required:"]}),"\n",(0,s.jsxs)(t.ul,{children:["\n",(0,s.jsx)(t.li,{children:(0,s.jsx)(t.code,{children:"server-ca.crt"})}),"\n",(0,s.jsx)(t.li,{children:(0,s.jsx)(t.code,{children:"server-ca.key"})}),"\n",(0,s.jsx)(t.li,{children:(0,s.jsx)(t.code,{children:"client-ca.crt"})}),"\n",(0,s.jsx)(t.li,{children:(0,s.jsx)(t.code,{children:"client-ca.key"})}),"\n",(0,s.jsx)(t.li,{children:(0,s.jsx)(t.code,{children:"request-header-ca.crt"})}),"\n",(0,s.jsxs)(t.li,{children:[(0,s.jsx)(t.code,{children:"request-header-ca.key"}),(0,s.jsx)(t.br,{}),"\n",(0,s.jsx)(t.em,{children:"// note: etcd files are required even if embedded etcd is not in use."})]}),"\n",(0,s.jsx)(t.li,{children:(0,s.jsx)(t.code,{children:"etcd/peer-ca.crt"})}),"\n",(0,s.jsx)(t.li,{children:(0,s.jsx)(t.code,{children:"etcd/peer-ca.key"})}),"\n",(0,s.jsx)(t.li,{children:(0,s.jsx)(t.code,{children:"etcd/server-ca.crt"})}),"\n",(0,s.jsxs)(t.li,{children:[(0,s.jsx)(t.code,{children:"etcd/server-ca.key"}),(0,s.jsx)(t.br,{}),"\n",(0,s.jsx)(t.em,{children:"// note: This is the private key used to sign service-account tokens. It does not have a corresponding certificate."})]}),"\n",(0,s.jsx)(t.li,{children:(0,s.jsx)(t.code,{children:"service.key"})}),"\n"]}),"\n",(0,s.jsx)(t.h4,{id:"custom-ca-topology",children:"Custom CA Topology"}),"\n",(0,s.jsx)(t.p,{children:"Custom CA Certificates should observe the following topology:"}),"\n",(0,s.jsx)(t.mermaid,{value:'graph TD\n root("Root CA")\n intermediate("Intermediate CA")\n server-ca("Server CA")\n client-ca("Client CA")\n request-header-ca("API Aggregation CA")\n etcd-peer-ca("etcd Peer CA")\n etcd-server-ca("etcd Server CA")\n\n root-hash>"Join token CA hash"]\n\n kube-server-certs[["Kubernetes servers
(control-plane and kubelet listeners)"]]\n kube-client-certs[["Kubernetes clients
(apiserver and kubelet clients)"]]\n request-header-certs[["Kubernetes API aggregation
(apiserver proxy client)"]]\n etcd-peer-certs[["etcd peer client/server
(etcd replication)"]]\n etcd-server-certs[["etcd client/server certificates
(Kubernetes <-> etcd)"]]\n\n root -.-|SHA256| root-hash\n root ---\x3e intermediate\n intermediate --\x3e server-ca ==> kube-server-certs\n intermediate --\x3e client-ca ==> kube-client-certs\n intermediate --\x3e request-header-ca ==> request-header-certs\n intermediate --\x3e etcd-peer-ca ==> etcd-peer-certs\n intermediate --\x3e etcd-server-ca ==> etcd-server-certs'}),"\n",(0,s.jsx)(t.h4,{id:"using-the-example-script",children:"Using the Example Script"}),"\n",(0,s.jsx)(t.admonition,{title:"Important",type:"info",children:(0,s.jsx)(t.p,{children:"If you want to sign the cluster CA certificates with an existing root CA using the example script, you must place the root and intermediate files in the target directory prior to running the script.\nIf the files do not exist, the script will create new root and intermediate CA certificates."})}),"\n",(0,s.jsx)(t.p,{children:"If you want to use only an existing root CA certificate, provide the following files:"}),"\n",(0,s.jsxs)(t.ul,{children:["\n",(0,s.jsx)(t.li,{children:(0,s.jsx)(t.code,{children:"root-ca.pem"})}),"\n",(0,s.jsx)(t.li,{children:(0,s.jsx)(t.code,{children:"root-ca.key"})}),"\n"]}),"\n",(0,s.jsx)(t.p,{children:"If you want to use existing root and intermediate CA certificates, provide the following files:"}),"\n",(0,s.jsxs)(t.ul,{children:["\n",(0,s.jsx)(t.li,{children:(0,s.jsx)(t.code,{children:"root-ca.pem"})}),"\n",(0,s.jsx)(t.li,{children:(0,s.jsx)(t.code,{children:"intermediate-ca.pem"})}),"\n",(0,s.jsx)(t.li,{children:(0,s.jsx)(t.code,{children:"intermediate-ca.key"})}),"\n"]}),"\n",(0,s.jsx)(t.p,{children:"To use the example script to generate custom certs and keys before starting K3s, run the following commands:"}),"\n",(0,s.jsx)(t.pre,{children:(0,s.jsx)(t.code,{className:"language-bash",children:"# Create the target directory for cert generation.\nmkdir -p /var/lib/rancher/k3s/server/tls\n\n# Copy your root CA cert and intermediate CA cert+key into the correct location for the script.\n# For the purposes of this example, we assume you have existing root and intermediate CA files in /etc/ssl.\n# If you do not have an existing root and/or intermediate CA, the script will generate them for you.\ncp /etc/ssl/certs/root-ca.pem /etc/ssl/certs/intermediate-ca.pem /etc/ssl/private/intermediate-ca.key /var/lib/rancher/k3s/server/tls\n\n# Generate custom CA certs and keys.\ncurl -sL https://github.com/k3s-io/k3s/raw/master/contrib/util/generate-custom-ca-certs.sh | bash -\n"})}),"\n",(0,s.jsx)(t.p,{children:"If the command completes successfully, you may install and/or start K3s for the first time.\nIf the script generated root and/or intermediate CA files, you should back up these files so that they can be reused if it is necessary to rotate the CA certificates at a later date."}),"\n",(0,s.jsx)(t.h3,{id:"rotating-custom-ca-certificates",children:"Rotating Custom CA Certificates"}),"\n",(0,s.jsxs)(t.p,{children:["To rotate custom CA certificates, use the ",(0,s.jsx)(t.code,{children:"k3s certificate rotate-ca"})," subcommand.\nUpdated files must be staged into a temporary directory, loaded into the datastore, and k3s must be restarted on all nodes to use the updated certificates."]}),"\n",(0,s.jsx)(t.admonition,{type:"warning",children:(0,s.jsxs)(t.p,{children:["You must not overwrite the currently in-use data in ",(0,s.jsx)(t.code,{children:"/var/lib/rancher/k3s/server/tls"}),".",(0,s.jsx)(t.br,{}),"\n","Stage the updated certificates and keys into a separate directory."]})}),"\n",(0,s.jsx)(t.p,{children:"A cluster that has been started with custom CA certificates can renew or rotate the CA certificates and keys non-disruptively, as long as the same root CA is used."}),"\n",(0,s.jsxs)(t.p,{children:["If a new root CA is required, the rotation will be disruptive. The ",(0,s.jsx)(t.code,{children:"k3s certificate rotate-ca --force"})," option must be used, all nodes that were joined with a ",(0,s.jsx)(t.a,{href:"/cli/token#secure",children:"secure token"})," (including servers) will need to be reconfigured to use the new token value, and pods will need to be restarted to trust the new root CA."]}),"\n",(0,s.jsx)(t.h4,{id:"using-the-example-script-1",children:"Using the Example Script"}),"\n",(0,s.jsxs)(t.p,{children:["The example ",(0,s.jsx)(t.code,{children:"generate-custom-ca-certs.sh"})," script linked above can also be used to generate updated certs in a new temporary directory, by copying files into the correct location and setting the ",(0,s.jsx)(t.code,{children:"DATA_DIR"})," environment variable.\nTo use the example script to generate updated certs and keys, run the following commands:"]}),"\n",(0,s.jsx)(t.pre,{children:(0,s.jsx)(t.code,{className:"language-bash",children:"# Create a temporary directory for cert generation.\nmkdir -p /opt/k3s/server/tls\n\n# Copy your root CA cert and intermediate CA cert+key into the correct location for the script.\n# Non-disruptive rotation requires the same root CA that was used to generate the original certificates.\n# If the original files are still in the data directory, you can just run:\ncp /var/lib/rancher/k3s/server/tls/root-ca.* /var/lib/rancher/k3s/server/tls/intermediate-ca.* /opt/k3s/server/tls\n\n# Copy the current service-account signing key, so that existing service-account tokens are not invalidated.\ncp /var/lib/rancher/k3s/server/tls/service.key /opt/k3s/server/tls\n\n# Generate updated custom CA certs and keys.\ncurl -sL https://github.com/k3s-io/k3s/raw/master/contrib/util/generate-custom-ca-certs.sh | DATA_DIR=/opt/k3s bash -\n\n# Load the updated CA certs and keys into the datastore.\nk3s certificate rotate-ca --path=/opt/k3s/server\n"})}),"\n",(0,s.jsxs)(t.p,{children:["If the ",(0,s.jsx)(t.code,{children:"rotate-ca"})," command returns an error, check the service log for errors.\nIf the command completes successfully, restart K3s on all nodes in the cluster - servers first, then agents."]}),"\n",(0,s.jsxs)(t.p,{children:["If you used the ",(0,s.jsx)(t.code,{children:"--force"})," option or changed the root CA, ensure that any nodes that were joined with a ",(0,s.jsx)(t.a,{href:"/cli/token#secure",children:"secure token"})," are reconfigured to use the new token value, prior to being restarted.\nThe token may be stored in a ",(0,s.jsx)(t.code,{children:".env"})," file, systemd unit, or config.yaml, depending on how the node was configured during initial installation."]}),"\n",(0,s.jsx)(t.h3,{id:"rotating-self-signed-ca-certificates",children:"Rotating Self-Signed CA Certificates"}),"\n",(0,s.jsxs)(t.p,{children:["To rotate the K3s-generated self-signed CA certificates, use the ",(0,s.jsx)(t.code,{children:"k3s certificate rotate-ca"})," subcommand.\nUpdated files must be staged into a temporary directory, loaded into the datastore, and k3s must be restarted on all nodes to use the updated certificates."]}),"\n",(0,s.jsx)(t.admonition,{type:"warning",children:(0,s.jsxs)(t.p,{children:["You must not overwrite the currently in-use data in ",(0,s.jsx)(t.code,{children:"/var/lib/rancher/k3s/server/tls"}),".",(0,s.jsx)(t.br,{}),"\n","Stage the updated certificates and keys into a separate directory."]})}),"\n",(0,s.jsxs)(t.p,{children:["If the cluster has been started with default self-signed CA certificates, rotation will be disruptive. All nodes that were joined with a ",(0,s.jsx)(t.a,{href:"/cli/token#secure",children:"secure token"})," will need to be reconfigured to trust the new CA hash.\nIf the new CA certificates are not cross-signed by the old CA certificates, you will need to use the ",(0,s.jsx)(t.code,{children:"--force"})," option to bypass integrity checks, and pods will need to be restarted to trust the new root CA."]}),"\n",(0,s.jsx)(t.h4,{id:"default-ca-topology",children:"Default CA Topology"}),"\n",(0,s.jsx)(t.p,{children:"The default self-signed CA certificates have the following topology:"}),"\n",(0,s.jsx)(t.mermaid,{value:'graph TD\n server-ca("Server CA")\n client-ca("Client CA")\n request-header-ca("API Aggregation CA")\n etcd-peer-ca("etcd Peer CA")\n etcd-server-ca("etcd Server CA")\n\n root-hash>"Join token CA hash"]\n\n kube-server-certs[["Kubernetes servers
(control-plane and kubelet listeners)"]]\n kube-client-certs[["Kubernetes clients
(apiserver and kubelet clients)"]]\n request-header-certs[["Kubernetes API aggregation
(apiserver proxy client)"]]\n etcd-peer-certs[["etcd peer client/server
(etcd replication)"]]\n etcd-server-certs[["etcd client/server certificates
(Kubernetes <-> etcd)"]]\n\n server-ca -.-|SHA256| root-hash\n server-ca ===> kube-server-certs\n client-ca ===> kube-client-certs\n request-header-ca ===> request-header-certs\n etcd-peer-ca ===> etcd-peer-certs\n etcd-server-ca ===> etcd-server-certs'}),"\n",(0,s.jsx)(t.p,{children:"When rotating the default self-signed CAs, a modified certificate topology with intermediate CAs and a new root CA cross-signed by the old CA can be used so that there is a continuous chain of trust between the old and new CAs:"}),"\n",(0,s.jsx)(t.mermaid,{value:'graph TD\n server-ca-old("Server CA
(old)")\n client-ca-old("Client CA
(old)")\n request-header-ca-old("API Aggregation CA
(old)")\n etcd-peer-ca-old("etcd Peer CA
(old)")\n etcd-server-ca-old("etcd Server CA
(old)")\n\n root-hash>"Join token CA hash"]\n\n server-ca-xsigned("Server CA
(cross-signed)")\n client-ca-xsigned("Client CA
(cross-signed)")\n request-header-ca-xsigned("API Aggregation CA
(cross-signed)")\n etcd-peer-ca-xsigned("etcd Peer CA
(cross-signed)")\n etcd-server-ca-xsigned("etcd Server CA
(cross-signed)")\n\n server-ca-ssigned("Server CA
(self-signed)")\n client-ca-ssigned("Client CA
(self-signed)")\n request-header-ca-ssigned("API Aggregation CA
(self-signed)")\n etcd-peer-ca-ssigned("etcd Peer CA
(self-signed)")\n etcd-server-ca-ssigned("etcd Server CA
(self-signed)")\n\n server-ca("Intermediate
Server CA")\n client-ca("Intermediate
Client CA")\n request-header-ca("Intermediate
API Aggregation CA")\n etcd-peer-ca("Intermediate
etcd Peer CA")\n etcd-server-ca("Intermediate
etcd Server CA")\n\n kube-server-certs[["Kubernetes servers
(control-plane and kubelet listeners)"]]\n kube-client-certs[["Kubernetes clients
(apiserver and kubelet clients)"]]\n request-header-certs[["Kubernetes API aggregation
(apiserver proxy client)"]]\n etcd-peer-certs[["etcd peer client/server
(etcd replication)"]]\n etcd-server-certs[["etcd client/server certificates
(Kubernetes <-> etcd)"]]\n\n server-ca-ssigned -.-|SHA256| root-hash\n server-ca-ssigned --\x3e server-ca ==> kube-server-certs\n server-ca-old --\x3e server-ca-xsigned --\x3e server-ca\n client-ca-ssigned --\x3e client-ca ==> kube-client-certs\n client-ca-old --\x3e client-ca-xsigned --\x3e client-ca\n request-header-ca-ssigned --\x3e request-header-ca ==> request-header-certs\n request-header-ca-old --\x3e request-header-ca-xsigned --\x3e request-header-ca\n etcd-peer-ca-ssigned --\x3e etcd-peer-ca ==> etcd-peer-certs\n etcd-peer-ca-old --\x3e etcd-peer-ca-xsigned --\x3e etcd-peer-ca\n etcd-server-ca-ssigned --\x3e etcd-server-ca ==> etcd-server-certs\n etcd-server-ca-old --\x3e etcd-server-ca-xsigned --\x3e etcd-server-ca'}),"\n",(0,s.jsx)(t.h4,{id:"using-the-example-script-2",children:"Using The Example Script"}),"\n",(0,s.jsxs)(t.p,{children:["An example script to create updated CA certificates and keys cross-signed by the existing CAs is available ",(0,s.jsxs)(t.a,{href:"https://github.com/k3s-io/k3s/blob/master/contrib/util/rotate-default-ca-certs.sh",children:["in the K3s repo at ",(0,s.jsx)(t.code,{children:"contrib/util/rotate-default-ca-certs.sh"})]}),"."]}),"\n",(0,s.jsx)(t.p,{children:"To use the example script to generate updated self-signed certificates that are cross-signed by the existing CAs, run the following commands:"}),"\n",(0,s.jsx)(t.pre,{children:(0,s.jsx)(t.code,{className:"language-bash",children:"# Create updated CA certs and keys, cross-signed by the current CAs.\n# This script will create a new temporary directory containing the updated certs, and output the new token values.\ncurl -sL https://github.com/k3s-io/k3s/raw/master/contrib/util/rotate-default-ca-certs.sh | bash -\n\n# Load the updated certs into the datastore; see the script output for the updated token values.\nk3s certificate rotate-ca --path=/var/lib/rancher/k3s/server/rotate-ca\n"})}),"\n",(0,s.jsxs)(t.p,{children:["If the ",(0,s.jsx)(t.code,{children:"rotate-ca"})," command returns an error, check the service log for errors.\nIf the command completes successfully, restart K3s on all nodes in the cluster - servers first, then agents."]}),"\n",(0,s.jsxs)(t.p,{children:["Ensure that any nodes that were joined with a ",(0,s.jsx)(t.a,{href:"/cli/token#secure",children:"secure token"}),", including other server nodes, are reconfigured to use the new token value prior to being restarted.\nThe token may be stored in a ",(0,s.jsx)(t.code,{children:".env"})," file, systemd unit, or config.yaml, depending on how the node was configured during initial installation."]}),"\n",(0,s.jsx)(t.h2,{id:"service-account-issuer-key-rotation",children:"Service-Account Issuer Key Rotation"}),"\n",(0,s.jsxs)(t.p,{children:["The service-account issuer key is an RSA private key used to sign service-account tokens.\nWhen rotating the service-account issuer key, at least one old key should be retained in the file so that existing service-account tokens are not invalidated.\nIt can be rotated independent of the cluster CAs by using the ",(0,s.jsx)(t.code,{children:"k3s certificate rotate-ca"})," to install only an updated ",(0,s.jsx)(t.code,{children:"service.key"})," file that includes both the new and old keys."]}),"\n",(0,s.jsx)(t.admonition,{type:"warning",children:(0,s.jsxs)(t.p,{children:["You must not overwrite the currently in-use data in ",(0,s.jsx)(t.code,{children:"/var/lib/rancher/k3s/server/tls"}),".",(0,s.jsx)(t.br,{}),"\n","Stage the updated key into a separate directory."]})}),"\n",(0,s.jsx)(t.p,{children:"For example, to rotate only the service-account issuer key, run the following commands:"}),"\n",(0,s.jsx)(t.pre,{children:(0,s.jsx)(t.code,{className:"language-bash",children:"# Create a temporary directory for cert generation\nmkdir -p /opt/k3s/server/tls\n\n# Check OpenSSL version\nopenssl version | grep -qF 'OpenSSL 3' && OPENSSL_GENRSA_FLAGS=-traditional\n\n# Generate a new key\nopenssl genrsa ${OPENSSL_GENRSA_FLAGS:-} -out /opt/k3s/server/tls/service.key 2048\n\n# Append the existing key to avoid invalidating current tokens\ncat /var/lib/rancher/k3s/server/tls/service.key >> /opt/k3s/server/tls/service.key\n\n# Load the updated key into the datastore\nk3s certificate rotate-ca --path=/opt/k3s/server\n"})}),"\n",(0,s.jsxs)(t.p,{children:["It is normal to see warnings for files that are not being updated. If the ",(0,s.jsx)(t.code,{children:"rotate-ca"})," command returns an error, check the service log for errors.\nIf the command completes successfully, restart K3s on all servers in the cluster. It is not necessary to restart agents or restart any pods."]})]})}function h(e={}){const{wrapper:t}={...(0,n.a)(),...e.components};return t?(0,s.jsx)(t,{...e,children:(0,s.jsx)(l,{...e})}):l(e)}},1151:(e,t,r)=>{r.d(t,{Z:()=>a,a:()=>c});var s=r(7294);const n={},i=s.createContext(n);function c(e){const t=s.useContext(i);return s.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function a(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(n):e.components||n:c(e.components),s.createElement(i.Provider,{value:t},e.children)}}}]); \ No newline at end of file +"use strict";(self.webpackChunkk_3_s_docs=self.webpackChunkk_3_s_docs||[]).push([[393],{1218:(e,t,r)=>{r.r(t),r.d(t,{assets:()=>o,contentTitle:()=>c,default:()=>h,frontMatter:()=>i,metadata:()=>a,toc:()=>d});var s=r(5893),n=r(1151);const i={title:"certificate"},c="k3s certificate",a={id:"cli/certificate",title:"certificate",description:"Client and Server Certificates",source:"@site/docs/cli/certificate.md",sourceDirName:"cli",slug:"/cli/certificate",permalink:"/cli/certificate",draft:!1,unlisted:!1,editUrl:"https://github.com/k3s-io/docs/edit/main/docs/cli/certificate.md",tags:[],version:"current",lastUpdatedAt:1723747404e3,frontMatter:{title:"certificate"},sidebar:"mySidebar",previous:{title:"agent",permalink:"/cli/agent"},next:{title:"etcd-snapshot",permalink:"/cli/etcd-snapshot"}},o={},d=[{value:"Client and Server Certificates",id:"client-and-server-certificates",level:2},{value:"Rotating Client and Server Certificates",id:"rotating-client-and-server-certificates",level:3},{value:"Certificate Authority (CA) Certificates",id:"certificate-authority-ca-certificates",level:2},{value:"Using Custom CA Certificates",id:"using-custom-ca-certificates",level:3},{value:"Custom CA Topology",id:"custom-ca-topology",level:4},{value:"Using the Example Script",id:"using-the-example-script",level:4},{value:"Rotating Custom CA Certificates",id:"rotating-custom-ca-certificates",level:3},{value:"Using the Example Script",id:"using-the-example-script-1",level:4},{value:"Rotating Self-Signed CA Certificates",id:"rotating-self-signed-ca-certificates",level:3},{value:"Default CA Topology",id:"default-ca-topology",level:4},{value:"Using The Example Script",id:"using-the-example-script-2",level:4},{value:"Service-Account Issuer Key Rotation",id:"service-account-issuer-key-rotation",level:2}];function l(e){const t={a:"a",admonition:"admonition",br:"br",code:"code",em:"em",h1:"h1",h2:"h2",h3:"h3",h4:"h4",header:"header",li:"li",mermaid:"mermaid",p:"p",pre:"pre",ul:"ul",...(0,n.a)(),...e.components};return(0,s.jsxs)(s.Fragment,{children:[(0,s.jsx)(t.header,{children:(0,s.jsx)(t.h1,{id:"k3s-certificate",children:"k3s certificate"})}),"\n",(0,s.jsx)(t.h2,{id:"client-and-server-certificates",children:"Client and Server Certificates"}),"\n",(0,s.jsx)(t.p,{children:"K3s client and server certificates are valid for 365 days from their date of issuance. Any certificates that are expired, or within 90 days of expiring, are automatically renewed every time K3s starts."}),"\n",(0,s.jsx)(t.h3,{id:"rotating-client-and-server-certificates",children:"Rotating Client and Server Certificates"}),"\n",(0,s.jsxs)(t.p,{children:["To rotate client and server certificates manually, use the ",(0,s.jsx)(t.code,{children:"k3s certificate rotate"})," subcommand:"]}),"\n",(0,s.jsx)(t.pre,{children:(0,s.jsx)(t.code,{className:"language-bash",children:"# Stop K3s\nsystemctl stop k3s\n\n# Rotate certificates\nk3s certificate rotate\n\n# Start K3s\nsystemctl start k3s\n"})}),"\n",(0,s.jsx)(t.p,{children:"Individual or lists of certificates can be rotated by specifying the certificate name:"}),"\n",(0,s.jsx)(t.pre,{children:(0,s.jsx)(t.code,{className:"language-bash",children:"k3s certificate rotate --service ,\n"})}),"\n",(0,s.jsxs)(t.p,{children:["The following certificates can be rotated: ",(0,s.jsx)(t.code,{children:"admin"}),", ",(0,s.jsx)(t.code,{children:"api-server"}),", ",(0,s.jsx)(t.code,{children:"controller-manager"}),", ",(0,s.jsx)(t.code,{children:"scheduler"}),", ",(0,s.jsx)(t.code,{children:"k3s-controller"}),", ",(0,s.jsx)(t.code,{children:"k3s-server"}),", ",(0,s.jsx)(t.code,{children:"cloud-controller"}),", ",(0,s.jsx)(t.code,{children:"etcd"}),", ",(0,s.jsx)(t.code,{children:"auth-proxy"}),", ",(0,s.jsx)(t.code,{children:"kubelet"}),", ",(0,s.jsx)(t.code,{children:"kube-proxy"}),"."]}),"\n",(0,s.jsx)(t.h2,{id:"certificate-authority-ca-certificates",children:"Certificate Authority (CA) Certificates"}),"\n",(0,s.jsxs)(t.p,{children:["Kubernetes requires a number of CA certificates for proper operation. For more information on how Kubernetes uses CA certificates, see the Kubernetes ",(0,s.jsx)(t.a,{href:"https://kubernetes.io/docs/setup/best-practices/certificates/#all-certificates",children:"PKI Certificates and Requirements"})," documentation."]}),"\n",(0,s.jsx)(t.p,{children:"By default, K3s generates self-signed CA certificates during startup of the first server node. These CA certificates are valid for 10 years from date of issuance, and are not automatically renewed."}),"\n",(0,s.jsxs)(t.p,{children:["The authoritative CA certificates and keys are stored within the datastore's bootstrap key, encrypted using the ",(0,s.jsx)(t.a,{href:"/cli/token#server",children:"server token"})," as the PBKDF2 passphrase with AES256-GCM and HMAC-SHA1.\nCopies of the CA certificates and keys are extracted to disk during K3s server startup.\nAny server may generate leaf certificates for nodes as they join the cluster, and the Kubernetes ",(0,s.jsx)(t.a,{href:"https://kubernetes.io/docs/reference/access-authn-authz/certificate-signing-requests/",children:"Certificates API"})," controllers may issue additional certificates at runtime."]}),"\n",(0,s.jsxs)(t.p,{children:["To rotate CA certificates and keys, use the ",(0,s.jsx)(t.code,{children:"k3s certificate rotate-ca"})," command.\nThe command performs integrity checks to confirm that the updated certificates and keys are usable.\nIf the updated data is acceptable, the datastore's encrypted bootstrap key is updated, and the new certificates and keys will be used the next time K3s starts.\nIf problems are encountered while validating the certificates and keys, an error is reported to the system log and the operation is cancelled without changes."]}),"\n",(0,s.jsx)(t.admonition,{title:"Version Gate",type:"info",children:(0,s.jsxs)(t.p,{children:["Support for the ",(0,s.jsx)(t.code,{children:"k3s certificate rotate-ca"})," command and the ability to use CA certificates signed by an external CA is available starting with the 2023-02 releases (v1.26.2+k3s1, v1.25.7+k3s1, v1.24.11+k3s1, v1.23.17+k3s1)."]})}),"\n",(0,s.jsx)(t.h3,{id:"using-custom-ca-certificates",children:"Using Custom CA Certificates"}),"\n",(0,s.jsx)(t.p,{children:"If CA certificates and keys are found the correct location during initial startup of the first server in the cluster, automatic generation of CA certificates will be bypassed."}),"\n",(0,s.jsxs)(t.p,{children:["An example script to pre-create the appropriate certificates and keys is available ",(0,s.jsxs)(t.a,{href:"https://github.com/k3s-io/k3s/blob/master/contrib/util/generate-custom-ca-certs.sh",children:["in the K3s repo at ",(0,s.jsx)(t.code,{children:"contrib/util/generate-custom-ca-certs.sh"})]}),".\nThis script should be run prior to starting K3s for the first time, and will create a full set of leaf CA certificates signed by common Root and Intermediate CA certificates.\nIf you have an existing Root or Intermediate CA, this script can be used (or used as a starting point) to create the correct CA certificates to provision a K3s cluster with PKI rooted in an existing authority."]}),"\n",(0,s.jsxs)(t.p,{children:["Custom Certificate Authority files must be placed in ",(0,s.jsx)(t.code,{children:"/var/lib/rancher/k3s/server/tls"}),". The following files are required:"]}),"\n",(0,s.jsxs)(t.ul,{children:["\n",(0,s.jsx)(t.li,{children:(0,s.jsx)(t.code,{children:"server-ca.crt"})}),"\n",(0,s.jsx)(t.li,{children:(0,s.jsx)(t.code,{children:"server-ca.key"})}),"\n",(0,s.jsx)(t.li,{children:(0,s.jsx)(t.code,{children:"client-ca.crt"})}),"\n",(0,s.jsx)(t.li,{children:(0,s.jsx)(t.code,{children:"client-ca.key"})}),"\n",(0,s.jsx)(t.li,{children:(0,s.jsx)(t.code,{children:"request-header-ca.crt"})}),"\n",(0,s.jsxs)(t.li,{children:[(0,s.jsx)(t.code,{children:"request-header-ca.key"}),(0,s.jsx)(t.br,{}),"\n",(0,s.jsx)(t.em,{children:"// note: etcd files are required even if embedded etcd is not in use."})]}),"\n",(0,s.jsx)(t.li,{children:(0,s.jsx)(t.code,{children:"etcd/peer-ca.crt"})}),"\n",(0,s.jsx)(t.li,{children:(0,s.jsx)(t.code,{children:"etcd/peer-ca.key"})}),"\n",(0,s.jsx)(t.li,{children:(0,s.jsx)(t.code,{children:"etcd/server-ca.crt"})}),"\n",(0,s.jsxs)(t.li,{children:[(0,s.jsx)(t.code,{children:"etcd/server-ca.key"}),(0,s.jsx)(t.br,{}),"\n",(0,s.jsx)(t.em,{children:"// note: This is the private key used to sign service-account tokens. It does not have a corresponding certificate."})]}),"\n",(0,s.jsx)(t.li,{children:(0,s.jsx)(t.code,{children:"service.key"})}),"\n"]}),"\n",(0,s.jsx)(t.h4,{id:"custom-ca-topology",children:"Custom CA Topology"}),"\n",(0,s.jsx)(t.p,{children:"Custom CA Certificates should observe the following topology:"}),"\n",(0,s.jsx)(t.mermaid,{value:'graph TD\n root("Root CA")\n intermediate("Intermediate CA")\n server-ca("Server CA")\n client-ca("Client CA")\n request-header-ca("API Aggregation CA")\n etcd-peer-ca("etcd Peer CA")\n etcd-server-ca("etcd Server CA")\n\n root-hash>"Join token CA hash"]\n\n kube-server-certs[["Kubernetes servers
(control-plane and kubelet listeners)"]]\n kube-client-certs[["Kubernetes clients
(apiserver and kubelet clients)"]]\n request-header-certs[["Kubernetes API aggregation
(apiserver proxy client)"]]\n etcd-peer-certs[["etcd peer client/server
(etcd replication)"]]\n etcd-server-certs[["etcd client/server certificates
(Kubernetes <-> etcd)"]]\n\n root -.-|SHA256| root-hash\n root ---\x3e intermediate\n intermediate --\x3e server-ca ==> kube-server-certs\n intermediate --\x3e client-ca ==> kube-client-certs\n intermediate --\x3e request-header-ca ==> request-header-certs\n intermediate --\x3e etcd-peer-ca ==> etcd-peer-certs\n intermediate --\x3e etcd-server-ca ==> etcd-server-certs'}),"\n",(0,s.jsx)(t.h4,{id:"using-the-example-script",children:"Using the Example Script"}),"\n",(0,s.jsx)(t.admonition,{title:"Important",type:"info",children:(0,s.jsx)(t.p,{children:"If you want to sign the cluster CA certificates with an existing root CA using the example script, you must place the root and intermediate files in the target directory prior to running the script.\nIf the files do not exist, the script will create new root and intermediate CA certificates."})}),"\n",(0,s.jsx)(t.p,{children:"If you want to use only an existing root CA certificate, provide the following files:"}),"\n",(0,s.jsxs)(t.ul,{children:["\n",(0,s.jsx)(t.li,{children:(0,s.jsx)(t.code,{children:"root-ca.pem"})}),"\n",(0,s.jsx)(t.li,{children:(0,s.jsx)(t.code,{children:"root-ca.key"})}),"\n"]}),"\n",(0,s.jsx)(t.p,{children:"If you want to use existing root and intermediate CA certificates, provide the following files:"}),"\n",(0,s.jsxs)(t.ul,{children:["\n",(0,s.jsx)(t.li,{children:(0,s.jsx)(t.code,{children:"root-ca.pem"})}),"\n",(0,s.jsx)(t.li,{children:(0,s.jsx)(t.code,{children:"intermediate-ca.pem"})}),"\n",(0,s.jsx)(t.li,{children:(0,s.jsx)(t.code,{children:"intermediate-ca.key"})}),"\n"]}),"\n",(0,s.jsx)(t.p,{children:"To use the example script to generate custom certs and keys before starting K3s, run the following commands:"}),"\n",(0,s.jsx)(t.pre,{children:(0,s.jsx)(t.code,{className:"language-bash",children:"# Create the target directory for cert generation.\nmkdir -p /var/lib/rancher/k3s/server/tls\n\n# Copy your root CA cert and intermediate CA cert+key into the correct location for the script.\n# For the purposes of this example, we assume you have existing root and intermediate CA files in /etc/ssl.\n# If you do not have an existing root and/or intermediate CA, the script will generate them for you.\ncp /etc/ssl/certs/root-ca.pem /etc/ssl/certs/intermediate-ca.pem /etc/ssl/private/intermediate-ca.key /var/lib/rancher/k3s/server/tls\n\n# Generate custom CA certs and keys.\ncurl -sL https://github.com/k3s-io/k3s/raw/master/contrib/util/generate-custom-ca-certs.sh | bash -\n"})}),"\n",(0,s.jsx)(t.p,{children:"If the command completes successfully, you may install and/or start K3s for the first time.\nIf the script generated root and/or intermediate CA files, you should back up these files so that they can be reused if it is necessary to rotate the CA certificates at a later date."}),"\n",(0,s.jsx)(t.h3,{id:"rotating-custom-ca-certificates",children:"Rotating Custom CA Certificates"}),"\n",(0,s.jsxs)(t.p,{children:["To rotate custom CA certificates, use the ",(0,s.jsx)(t.code,{children:"k3s certificate rotate-ca"})," subcommand.\nUpdated files must be staged into a temporary directory, loaded into the datastore, and k3s must be restarted on all nodes to use the updated certificates."]}),"\n",(0,s.jsx)(t.admonition,{type:"warning",children:(0,s.jsxs)(t.p,{children:["You must not overwrite the currently in-use data in ",(0,s.jsx)(t.code,{children:"/var/lib/rancher/k3s/server/tls"}),".",(0,s.jsx)(t.br,{}),"\n","Stage the updated certificates and keys into a separate directory."]})}),"\n",(0,s.jsx)(t.p,{children:"A cluster that has been started with custom CA certificates can renew or rotate the CA certificates and keys non-disruptively, as long as the same root CA is used."}),"\n",(0,s.jsxs)(t.p,{children:["If a new root CA is required, the rotation will be disruptive. The ",(0,s.jsx)(t.code,{children:"k3s certificate rotate-ca --force"})," option must be used, all nodes that were joined with a ",(0,s.jsx)(t.a,{href:"/cli/token#secure",children:"secure token"})," (including servers) will need to be reconfigured to use the new token value, and pods will need to be restarted to trust the new root CA."]}),"\n",(0,s.jsx)(t.h4,{id:"using-the-example-script-1",children:"Using the Example Script"}),"\n",(0,s.jsxs)(t.p,{children:["The example ",(0,s.jsx)(t.code,{children:"generate-custom-ca-certs.sh"})," script linked above can also be used to generate updated certs in a new temporary directory, by copying files into the correct location and setting the ",(0,s.jsx)(t.code,{children:"DATA_DIR"})," environment variable.\nTo use the example script to generate updated certs and keys, run the following commands:"]}),"\n",(0,s.jsx)(t.pre,{children:(0,s.jsx)(t.code,{className:"language-bash",children:"# Create a temporary directory for cert generation.\nmkdir -p /opt/k3s/server/tls\n\n# Copy your root CA cert and intermediate CA cert+key into the correct location for the script.\n# Non-disruptive rotation requires the same root CA that was used to generate the original certificates.\n# If the original files are still in the data directory, you can just run:\ncp /var/lib/rancher/k3s/server/tls/root-ca.* /var/lib/rancher/k3s/server/tls/intermediate-ca.* /opt/k3s/server/tls\n\n# Copy the current service-account signing key, so that existing service-account tokens are not invalidated.\ncp /var/lib/rancher/k3s/server/tls/service.key /opt/k3s/server/tls\n\n# Generate updated custom CA certs and keys.\ncurl -sL https://github.com/k3s-io/k3s/raw/master/contrib/util/generate-custom-ca-certs.sh | DATA_DIR=/opt/k3s bash -\n\n# Load the updated CA certs and keys into the datastore.\nk3s certificate rotate-ca --path=/opt/k3s/server\n"})}),"\n",(0,s.jsxs)(t.p,{children:["If the ",(0,s.jsx)(t.code,{children:"rotate-ca"})," command returns an error, check the service log for errors.\nIf the command completes successfully, restart K3s on all nodes in the cluster - servers first, then agents."]}),"\n",(0,s.jsxs)(t.p,{children:["If you used the ",(0,s.jsx)(t.code,{children:"--force"})," option or changed the root CA, ensure that any nodes that were joined with a ",(0,s.jsx)(t.a,{href:"/cli/token#secure",children:"secure token"})," are reconfigured to use the new token value, prior to being restarted.\nThe token may be stored in a ",(0,s.jsx)(t.code,{children:".env"})," file, systemd unit, or config.yaml, depending on how the node was configured during initial installation."]}),"\n",(0,s.jsx)(t.h3,{id:"rotating-self-signed-ca-certificates",children:"Rotating Self-Signed CA Certificates"}),"\n",(0,s.jsxs)(t.p,{children:["To rotate the K3s-generated self-signed CA certificates, use the ",(0,s.jsx)(t.code,{children:"k3s certificate rotate-ca"})," subcommand.\nUpdated files must be staged into a temporary directory, loaded into the datastore, and k3s must be restarted on all nodes to use the updated certificates."]}),"\n",(0,s.jsx)(t.admonition,{type:"warning",children:(0,s.jsxs)(t.p,{children:["You must not overwrite the currently in-use data in ",(0,s.jsx)(t.code,{children:"/var/lib/rancher/k3s/server/tls"}),".",(0,s.jsx)(t.br,{}),"\n","Stage the updated certificates and keys into a separate directory."]})}),"\n",(0,s.jsxs)(t.p,{children:["If the cluster has been started with default self-signed CA certificates, rotation will be disruptive. All nodes that were joined with a ",(0,s.jsx)(t.a,{href:"/cli/token#secure",children:"secure token"})," will need to be reconfigured to trust the new CA hash.\nIf the new CA certificates are not cross-signed by the old CA certificates, you will need to use the ",(0,s.jsx)(t.code,{children:"--force"})," option to bypass integrity checks, and pods will need to be restarted to trust the new root CA."]}),"\n",(0,s.jsx)(t.h4,{id:"default-ca-topology",children:"Default CA Topology"}),"\n",(0,s.jsx)(t.p,{children:"The default self-signed CA certificates have the following topology:"}),"\n",(0,s.jsx)(t.mermaid,{value:'graph TD\n server-ca("Server CA")\n client-ca("Client CA")\n request-header-ca("API Aggregation CA")\n etcd-peer-ca("etcd Peer CA")\n etcd-server-ca("etcd Server CA")\n\n root-hash>"Join token CA hash"]\n\n kube-server-certs[["Kubernetes servers
(control-plane and kubelet listeners)"]]\n kube-client-certs[["Kubernetes clients
(apiserver and kubelet clients)"]]\n request-header-certs[["Kubernetes API aggregation
(apiserver proxy client)"]]\n etcd-peer-certs[["etcd peer client/server
(etcd replication)"]]\n etcd-server-certs[["etcd client/server certificates
(Kubernetes <-> etcd)"]]\n\n server-ca -.-|SHA256| root-hash\n server-ca ===> kube-server-certs\n client-ca ===> kube-client-certs\n request-header-ca ===> request-header-certs\n etcd-peer-ca ===> etcd-peer-certs\n etcd-server-ca ===> etcd-server-certs'}),"\n",(0,s.jsx)(t.p,{children:"When rotating the default self-signed CAs, a modified certificate topology with intermediate CAs and a new root CA cross-signed by the old CA can be used so that there is a continuous chain of trust between the old and new CAs:"}),"\n",(0,s.jsx)(t.mermaid,{value:'graph TD\n server-ca-old("Server CA
(old)")\n client-ca-old("Client CA
(old)")\n request-header-ca-old("API Aggregation CA
(old)")\n etcd-peer-ca-old("etcd Peer CA
(old)")\n etcd-server-ca-old("etcd Server CA
(old)")\n\n root-hash>"Join token CA hash"]\n\n server-ca-xsigned("Server CA
(cross-signed)")\n client-ca-xsigned("Client CA
(cross-signed)")\n request-header-ca-xsigned("API Aggregation CA
(cross-signed)")\n etcd-peer-ca-xsigned("etcd Peer CA
(cross-signed)")\n etcd-server-ca-xsigned("etcd Server CA
(cross-signed)")\n\n server-ca-ssigned("Server CA
(self-signed)")\n client-ca-ssigned("Client CA
(self-signed)")\n request-header-ca-ssigned("API Aggregation CA
(self-signed)")\n etcd-peer-ca-ssigned("etcd Peer CA
(self-signed)")\n etcd-server-ca-ssigned("etcd Server CA
(self-signed)")\n\n server-ca("Intermediate
Server CA")\n client-ca("Intermediate
Client CA")\n request-header-ca("Intermediate
API Aggregation CA")\n etcd-peer-ca("Intermediate
etcd Peer CA")\n etcd-server-ca("Intermediate
etcd Server CA")\n\n kube-server-certs[["Kubernetes servers
(control-plane and kubelet listeners)"]]\n kube-client-certs[["Kubernetes clients
(apiserver and kubelet clients)"]]\n request-header-certs[["Kubernetes API aggregation
(apiserver proxy client)"]]\n etcd-peer-certs[["etcd peer client/server
(etcd replication)"]]\n etcd-server-certs[["etcd client/server certificates
(Kubernetes <-> etcd)"]]\n\n server-ca-ssigned -.-|SHA256| root-hash\n server-ca-ssigned --\x3e server-ca ==> kube-server-certs\n server-ca-old --\x3e server-ca-xsigned --\x3e server-ca\n client-ca-ssigned --\x3e client-ca ==> kube-client-certs\n client-ca-old --\x3e client-ca-xsigned --\x3e client-ca\n request-header-ca-ssigned --\x3e request-header-ca ==> request-header-certs\n request-header-ca-old --\x3e request-header-ca-xsigned --\x3e request-header-ca\n etcd-peer-ca-ssigned --\x3e etcd-peer-ca ==> etcd-peer-certs\n etcd-peer-ca-old --\x3e etcd-peer-ca-xsigned --\x3e etcd-peer-ca\n etcd-server-ca-ssigned --\x3e etcd-server-ca ==> etcd-server-certs\n etcd-server-ca-old --\x3e etcd-server-ca-xsigned --\x3e etcd-server-ca'}),"\n",(0,s.jsx)(t.h4,{id:"using-the-example-script-2",children:"Using The Example Script"}),"\n",(0,s.jsxs)(t.p,{children:["An example script to create updated CA certificates and keys cross-signed by the existing CAs is available ",(0,s.jsxs)(t.a,{href:"https://github.com/k3s-io/k3s/blob/master/contrib/util/rotate-default-ca-certs.sh",children:["in the K3s repo at ",(0,s.jsx)(t.code,{children:"contrib/util/rotate-default-ca-certs.sh"})]}),"."]}),"\n",(0,s.jsx)(t.p,{children:"To use the example script to generate updated self-signed certificates that are cross-signed by the existing CAs, run the following commands:"}),"\n",(0,s.jsx)(t.pre,{children:(0,s.jsx)(t.code,{className:"language-bash",children:"# Create updated CA certs and keys, cross-signed by the current CAs.\n# This script will create a new temporary directory containing the updated certs, and output the new token values.\ncurl -sL https://github.com/k3s-io/k3s/raw/master/contrib/util/rotate-default-ca-certs.sh | bash -\n\n# Load the updated certs into the datastore; see the script output for the updated token values.\nk3s certificate rotate-ca --path=/var/lib/rancher/k3s/server/rotate-ca\n"})}),"\n",(0,s.jsxs)(t.p,{children:["If the ",(0,s.jsx)(t.code,{children:"rotate-ca"})," command returns an error, check the service log for errors.\nIf the command completes successfully, restart K3s on all nodes in the cluster - servers first, then agents."]}),"\n",(0,s.jsxs)(t.p,{children:["Ensure that any nodes that were joined with a ",(0,s.jsx)(t.a,{href:"/cli/token#secure",children:"secure token"}),", including other server nodes, are reconfigured to use the new token value prior to being restarted.\nThe token may be stored in a ",(0,s.jsx)(t.code,{children:".env"})," file, systemd unit, or config.yaml, depending on how the node was configured during initial installation."]}),"\n",(0,s.jsx)(t.h2,{id:"service-account-issuer-key-rotation",children:"Service-Account Issuer Key Rotation"}),"\n",(0,s.jsxs)(t.p,{children:["The service-account issuer key is an RSA private key used to sign service-account tokens.\nWhen rotating the service-account issuer key, at least one old key should be retained in the file so that existing service-account tokens are not invalidated.\nIt can be rotated independent of the cluster CAs by using the ",(0,s.jsx)(t.code,{children:"k3s certificate rotate-ca"})," to install only an updated ",(0,s.jsx)(t.code,{children:"service.key"})," file that includes both the new and old keys."]}),"\n",(0,s.jsx)(t.admonition,{type:"warning",children:(0,s.jsxs)(t.p,{children:["You must not overwrite the currently in-use data in ",(0,s.jsx)(t.code,{children:"/var/lib/rancher/k3s/server/tls"}),".",(0,s.jsx)(t.br,{}),"\n","Stage the updated key into a separate directory."]})}),"\n",(0,s.jsx)(t.p,{children:"For example, to rotate only the service-account issuer key, run the following commands:"}),"\n",(0,s.jsx)(t.pre,{children:(0,s.jsx)(t.code,{className:"language-bash",children:"# Create a temporary directory for cert generation\nmkdir -p /opt/k3s/server/tls\n\n# Check OpenSSL version\nopenssl version | grep -qF 'OpenSSL 3' && OPENSSL_GENRSA_FLAGS=-traditional\n\n# Generate a new key\nopenssl genrsa ${OPENSSL_GENRSA_FLAGS:-} -out /opt/k3s/server/tls/service.key 2048\n\n# Append the existing key to avoid invalidating current tokens\ncat /var/lib/rancher/k3s/server/tls/service.key >> /opt/k3s/server/tls/service.key\n\n# Load the updated key into the datastore\nk3s certificate rotate-ca --path=/opt/k3s/server\n"})}),"\n",(0,s.jsxs)(t.p,{children:["It is normal to see warnings for files that are not being updated. If the ",(0,s.jsx)(t.code,{children:"rotate-ca"})," command returns an error, check the service log for errors.\nIf the command completes successfully, restart K3s on all servers in the cluster. It is not necessary to restart agents or restart any pods."]})]})}function h(e={}){const{wrapper:t}={...(0,n.a)(),...e.components};return t?(0,s.jsx)(t,{...e,children:(0,s.jsx)(l,{...e})}):l(e)}},1151:(e,t,r)=>{r.d(t,{Z:()=>a,a:()=>c});var s=r(7294);const n={},i=s.createContext(n);function c(e){const t=s.useContext(i);return s.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function a(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(n):e.components||n:c(e.components),s.createElement(i.Provider,{value:t},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/72e14192.552d72fe.js b/assets/js/72e14192.b0908381.js similarity index 98% rename from assets/js/72e14192.552d72fe.js rename to assets/js/72e14192.b0908381.js index 4ef578e42..9ab3ff8ca 100644 --- a/assets/js/72e14192.552d72fe.js +++ b/assets/js/72e14192.b0908381.js @@ -1 +1 @@ -"use strict";(self.webpackChunkk_3_s_docs=self.webpackChunkk_3_s_docs||[]).push([[7239],{1658:(e,t,n)=>{n.r(t),n.d(t,{assets:()=>l,contentTitle:()=>a,default:()=>h,frontMatter:()=>r,metadata:()=>o,toc:()=>c});var s=n(5893),i=n(1151);const r={title:"Quick-Start Guide"},a=void 0,o={id:"quick-start",title:"Quick-Start Guide",description:"This guide will help you quickly launch a cluster with default options. The installation section covers in greater detail how K3s can be set up.",source:"@site/docs/quick-start.md",sourceDirName:".",slug:"/quick-start",permalink:"/quick-start",draft:!1,unlisted:!1,editUrl:"https://github.com/k3s-io/docs/edit/main/docs/quick-start.md",tags:[],version:"current",lastUpdatedAt:1723651727e3,frontMatter:{title:"Quick-Start Guide"},sidebar:"mySidebar",previous:{title:"K3s - Lightweight Kubernetes",permalink:"/"},next:{title:"Installation",permalink:"/installation/"}},l={},c=[{value:"Install Script",id:"install-script",level:2}];function d(e){const t={a:"a",admonition:"admonition",code:"code",h2:"h2",li:"li",p:"p",pre:"pre",ul:"ul",...(0,i.a)(),...e.components};return(0,s.jsxs)(s.Fragment,{children:[(0,s.jsxs)(t.p,{children:["This guide will help you quickly launch a cluster with default options. The ",(0,s.jsx)(t.a,{href:"/installation/",children:"installation section"})," covers in greater detail how K3s can be set up."]}),"\n",(0,s.jsxs)(t.p,{children:["Make sure your nodes meet the ",(0,s.jsx)(t.a,{href:"/installation/requirements",children:"requirements"})," before proceeding."]}),"\n",(0,s.jsxs)(t.p,{children:["For information on how K3s components work together, refer to the ",(0,s.jsx)(t.a,{href:"/architecture",children:"architecture section."})]}),"\n",(0,s.jsx)(t.admonition,{type:"info",children:(0,s.jsxs)(t.p,{children:["New to Kubernetes? The official Kubernetes docs already have some great tutorials outlining the basics ",(0,s.jsx)(t.a,{href:"https://kubernetes.io/docs/tutorials/kubernetes-basics/",children:"here"}),"."]})}),"\n",(0,s.jsx)(t.h2,{id:"install-script",children:"Install Script"}),"\n",(0,s.jsxs)(t.p,{children:["K3s provides an installation script that is a convenient way to install it as a service on systemd or openrc based systems. This script is available at ",(0,s.jsx)(t.a,{href:"https://get.k3s.io",children:"https://get.k3s.io"}),". To install K3s using this method, just run:"]}),"\n",(0,s.jsx)(t.pre,{children:(0,s.jsx)(t.code,{className:"language-bash",children:"curl -sfL https://get.k3s.io | sh -\n"})}),"\n",(0,s.jsx)(t.p,{children:"After running this installation:"}),"\n",(0,s.jsxs)(t.ul,{children:["\n",(0,s.jsx)(t.li,{children:"The K3s service will be configured to automatically restart after node reboots or if the process crashes or is killed"}),"\n",(0,s.jsxs)(t.li,{children:["Additional utilities will be installed, including ",(0,s.jsx)(t.code,{children:"kubectl"}),", ",(0,s.jsx)(t.code,{children:"crictl"}),", ",(0,s.jsx)(t.code,{children:"ctr"}),", ",(0,s.jsx)(t.code,{children:"k3s-killall.sh"}),", and ",(0,s.jsx)(t.code,{children:"k3s-uninstall.sh"})]}),"\n",(0,s.jsxs)(t.li,{children:["A ",(0,s.jsx)(t.a,{href:"https://kubernetes.io/docs/concepts/configuration/organize-cluster-access-kubeconfig/",children:"kubeconfig"})," file will be written to ",(0,s.jsx)(t.code,{children:"/etc/rancher/k3s/k3s.yaml"})," and the kubectl installed by K3s will automatically use it"]}),"\n"]}),"\n",(0,s.jsx)(t.p,{children:"A single-node server installation is a fully-functional Kubernetes cluster, including all the datastore, control-plane, kubelet, and container runtime components necessary to host workload pods. It is not necessary to add additional server or agents nodes, but you may want to do so to add additional capacity or redundancy to your cluster."}),"\n",(0,s.jsxs)(t.p,{children:["To install additional agent nodes and add them to the cluster, run the installation script with the ",(0,s.jsx)(t.code,{children:"K3S_URL"})," and ",(0,s.jsx)(t.code,{children:"K3S_TOKEN"})," environment variables. Here is an example showing how to join an agent:"]}),"\n",(0,s.jsx)(t.pre,{children:(0,s.jsx)(t.code,{className:"language-bash",children:"curl -sfL https://get.k3s.io | K3S_URL=https://myserver:6443 K3S_TOKEN=mynodetoken sh -\n"})}),"\n",(0,s.jsxs)(t.p,{children:["Setting the ",(0,s.jsx)(t.code,{children:"K3S_URL"})," parameter causes the installer to configure K3s as an agent, instead of a server. The K3s agent will register with the K3s server listening at the supplied URL. The value to use for ",(0,s.jsx)(t.code,{children:"K3S_TOKEN"})," is stored at ",(0,s.jsx)(t.code,{children:"/var/lib/rancher/k3s/server/node-token"})," on your server node."]}),"\n",(0,s.jsx)(t.admonition,{type:"note",children:(0,s.jsxs)(t.p,{children:["Each machine must have a unique hostname. If your machines do not have unique hostnames, pass the ",(0,s.jsx)(t.code,{children:"K3S_NODE_NAME"})," environment variable and provide a value with a valid and unique hostname for each node."]})}),"\n",(0,s.jsxs)(t.p,{children:["If interested in having more server nodes, see ",(0,s.jsx)(t.a,{href:"/datastore/ha-embedded",children:"High Availability Embedded etcd"})," and ",(0,s.jsx)(t.a,{href:"/datastore/ha",children:"High Availability External DB"})," pages for more information."]})]})}function h(e={}){const{wrapper:t}={...(0,i.a)(),...e.components};return t?(0,s.jsx)(t,{...e,children:(0,s.jsx)(d,{...e})}):d(e)}},1151:(e,t,n)=>{n.d(t,{Z:()=>o,a:()=>a});var s=n(7294);const i={},r=s.createContext(i);function a(e){const t=s.useContext(r);return s.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function o(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(i):e.components||i:a(e.components),s.createElement(r.Provider,{value:t},e.children)}}}]); \ No newline at end of file +"use strict";(self.webpackChunkk_3_s_docs=self.webpackChunkk_3_s_docs||[]).push([[7239],{1658:(e,t,n)=>{n.r(t),n.d(t,{assets:()=>l,contentTitle:()=>a,default:()=>h,frontMatter:()=>r,metadata:()=>o,toc:()=>c});var s=n(5893),i=n(1151);const r={title:"Quick-Start Guide"},a=void 0,o={id:"quick-start",title:"Quick-Start Guide",description:"This guide will help you quickly launch a cluster with default options. The installation section covers in greater detail how K3s can be set up.",source:"@site/docs/quick-start.md",sourceDirName:".",slug:"/quick-start",permalink:"/quick-start",draft:!1,unlisted:!1,editUrl:"https://github.com/k3s-io/docs/edit/main/docs/quick-start.md",tags:[],version:"current",lastUpdatedAt:1723747404e3,frontMatter:{title:"Quick-Start Guide"},sidebar:"mySidebar",previous:{title:"K3s - Lightweight Kubernetes",permalink:"/"},next:{title:"Installation",permalink:"/installation/"}},l={},c=[{value:"Install Script",id:"install-script",level:2}];function d(e){const t={a:"a",admonition:"admonition",code:"code",h2:"h2",li:"li",p:"p",pre:"pre",ul:"ul",...(0,i.a)(),...e.components};return(0,s.jsxs)(s.Fragment,{children:[(0,s.jsxs)(t.p,{children:["This guide will help you quickly launch a cluster with default options. The ",(0,s.jsx)(t.a,{href:"/installation/",children:"installation section"})," covers in greater detail how K3s can be set up."]}),"\n",(0,s.jsxs)(t.p,{children:["Make sure your nodes meet the ",(0,s.jsx)(t.a,{href:"/installation/requirements",children:"requirements"})," before proceeding."]}),"\n",(0,s.jsxs)(t.p,{children:["For information on how K3s components work together, refer to the ",(0,s.jsx)(t.a,{href:"/architecture",children:"architecture section."})]}),"\n",(0,s.jsx)(t.admonition,{type:"info",children:(0,s.jsxs)(t.p,{children:["New to Kubernetes? The official Kubernetes docs already have some great tutorials outlining the basics ",(0,s.jsx)(t.a,{href:"https://kubernetes.io/docs/tutorials/kubernetes-basics/",children:"here"}),"."]})}),"\n",(0,s.jsx)(t.h2,{id:"install-script",children:"Install Script"}),"\n",(0,s.jsxs)(t.p,{children:["K3s provides an installation script that is a convenient way to install it as a service on systemd or openrc based systems. This script is available at ",(0,s.jsx)(t.a,{href:"https://get.k3s.io",children:"https://get.k3s.io"}),". To install K3s using this method, just run:"]}),"\n",(0,s.jsx)(t.pre,{children:(0,s.jsx)(t.code,{className:"language-bash",children:"curl -sfL https://get.k3s.io | sh -\n"})}),"\n",(0,s.jsx)(t.p,{children:"After running this installation:"}),"\n",(0,s.jsxs)(t.ul,{children:["\n",(0,s.jsx)(t.li,{children:"The K3s service will be configured to automatically restart after node reboots or if the process crashes or is killed"}),"\n",(0,s.jsxs)(t.li,{children:["Additional utilities will be installed, including ",(0,s.jsx)(t.code,{children:"kubectl"}),", ",(0,s.jsx)(t.code,{children:"crictl"}),", ",(0,s.jsx)(t.code,{children:"ctr"}),", ",(0,s.jsx)(t.code,{children:"k3s-killall.sh"}),", and ",(0,s.jsx)(t.code,{children:"k3s-uninstall.sh"})]}),"\n",(0,s.jsxs)(t.li,{children:["A ",(0,s.jsx)(t.a,{href:"https://kubernetes.io/docs/concepts/configuration/organize-cluster-access-kubeconfig/",children:"kubeconfig"})," file will be written to ",(0,s.jsx)(t.code,{children:"/etc/rancher/k3s/k3s.yaml"})," and the kubectl installed by K3s will automatically use it"]}),"\n"]}),"\n",(0,s.jsx)(t.p,{children:"A single-node server installation is a fully-functional Kubernetes cluster, including all the datastore, control-plane, kubelet, and container runtime components necessary to host workload pods. It is not necessary to add additional server or agents nodes, but you may want to do so to add additional capacity or redundancy to your cluster."}),"\n",(0,s.jsxs)(t.p,{children:["To install additional agent nodes and add them to the cluster, run the installation script with the ",(0,s.jsx)(t.code,{children:"K3S_URL"})," and ",(0,s.jsx)(t.code,{children:"K3S_TOKEN"})," environment variables. Here is an example showing how to join an agent:"]}),"\n",(0,s.jsx)(t.pre,{children:(0,s.jsx)(t.code,{className:"language-bash",children:"curl -sfL https://get.k3s.io | K3S_URL=https://myserver:6443 K3S_TOKEN=mynodetoken sh -\n"})}),"\n",(0,s.jsxs)(t.p,{children:["Setting the ",(0,s.jsx)(t.code,{children:"K3S_URL"})," parameter causes the installer to configure K3s as an agent, instead of a server. The K3s agent will register with the K3s server listening at the supplied URL. The value to use for ",(0,s.jsx)(t.code,{children:"K3S_TOKEN"})," is stored at ",(0,s.jsx)(t.code,{children:"/var/lib/rancher/k3s/server/node-token"})," on your server node."]}),"\n",(0,s.jsx)(t.admonition,{type:"note",children:(0,s.jsxs)(t.p,{children:["Each machine must have a unique hostname. If your machines do not have unique hostnames, pass the ",(0,s.jsx)(t.code,{children:"K3S_NODE_NAME"})," environment variable and provide a value with a valid and unique hostname for each node."]})}),"\n",(0,s.jsxs)(t.p,{children:["If interested in having more server nodes, see ",(0,s.jsx)(t.a,{href:"/datastore/ha-embedded",children:"High Availability Embedded etcd"})," and ",(0,s.jsx)(t.a,{href:"/datastore/ha",children:"High Availability External DB"})," pages for more information."]})]})}function h(e={}){const{wrapper:t}={...(0,i.a)(),...e.components};return t?(0,s.jsx)(t,{...e,children:(0,s.jsx)(d,{...e})}):d(e)}},1151:(e,t,n)=>{n.d(t,{Z:()=>o,a:()=>a});var s=n(7294);const i={},r=s.createContext(i);function a(e){const t=s.useContext(r);return s.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function o(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(i):e.components||i:a(e.components),s.createElement(r.Provider,{value:t},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/7b8e2475.3fac7c8a.js b/assets/js/7b8e2475.4a4bd37f.js similarity index 97% rename from assets/js/7b8e2475.3fac7c8a.js rename to assets/js/7b8e2475.4a4bd37f.js index 06ee98a2b..07269abb0 100644 --- a/assets/js/7b8e2475.3fac7c8a.js +++ b/assets/js/7b8e2475.4a4bd37f.js @@ -1 +1 @@ -"use strict";(self.webpackChunkk_3_s_docs=self.webpackChunkk_3_s_docs||[]).push([[79],{6498:(e,s,t)=>{t.r(s),t.d(s,{assets:()=>d,contentTitle:()=>c,default:()=>l,frontMatter:()=>r,metadata:()=>o,toc:()=>a});var n=t(5893),i=t(1151);const r={title:"Security"},c=void 0,o={id:"security/security",title:"Security",description:"This section describes the methodology and means of securing a K3s cluster. It's broken into 2 sections. These guides assume k3s is running with embedded etcd.",source:"@site/docs/security/security.md",sourceDirName:"security",slug:"/security/",permalink:"/security/",draft:!1,unlisted:!1,editUrl:"https://github.com/k3s-io/docs/edit/main/docs/security/security.md",tags:[],version:"current",lastUpdatedAt:1723651727e3,frontMatter:{title:"Security"},sidebar:"mySidebar",previous:{title:"Automated Upgrades",permalink:"/upgrades/automated"},next:{title:"Secrets Encryption",permalink:"/security/secrets-encryption"}},d={},a=[];function u(e){const s={a:"a",li:"li",p:"p",ul:"ul",...(0,i.a)(),...e.components};return(0,n.jsxs)(n.Fragment,{children:[(0,n.jsx)(s.p,{children:"This section describes the methodology and means of securing a K3s cluster. It's broken into 2 sections. These guides assume k3s is running with embedded etcd."}),"\n",(0,n.jsx)(s.p,{children:"First the hardening guide provides a list of security best practices to secure a K3s cluster."}),"\n",(0,n.jsxs)(s.ul,{children:["\n",(0,n.jsx)(s.li,{children:(0,n.jsx)(s.a,{href:"/security/hardening-guide",children:"Hardening Guide"})}),"\n"]}),"\n",(0,n.jsx)(s.p,{children:"Second, is the self assessment to validate a hardened cluster. We currently have two different assessments available:"}),"\n",(0,n.jsxs)(s.ul,{children:["\n",(0,n.jsxs)(s.li,{children:["\n",(0,n.jsxs)(s.p,{children:[(0,n.jsx)(s.a,{href:"/security/self-assessment-1.24",children:"CIS 1.24 Benchmark Self-Assessment Guide"}),", for K3s version v1.24"]}),"\n"]}),"\n",(0,n.jsxs)(s.li,{children:["\n",(0,n.jsxs)(s.p,{children:[(0,n.jsx)(s.a,{href:"/security/self-assessment-1.7",children:"CIS 1.7 Benchmark Self-Assessment Guide"}),", for K3s version v1.25"]}),"\n"]}),"\n",(0,n.jsxs)(s.li,{children:["\n",(0,n.jsxs)(s.p,{children:[(0,n.jsx)(s.a,{href:"/security/self-assessment-1.8",children:"CIS 1.8 Benchmark Self-Assessment Guide"}),", for K3s version v1.26-v1.29"]}),"\n"]}),"\n"]})]})}function l(e={}){const{wrapper:s}={...(0,i.a)(),...e.components};return s?(0,n.jsx)(s,{...e,children:(0,n.jsx)(u,{...e})}):u(e)}},1151:(e,s,t)=>{t.d(s,{Z:()=>o,a:()=>c});var n=t(7294);const i={},r=n.createContext(i);function c(e){const s=n.useContext(r);return n.useMemo((function(){return"function"==typeof e?e(s):{...s,...e}}),[s,e])}function o(e){let s;return s=e.disableParentContext?"function"==typeof e.components?e.components(i):e.components||i:c(e.components),n.createElement(r.Provider,{value:s},e.children)}}}]); \ No newline at end of file +"use strict";(self.webpackChunkk_3_s_docs=self.webpackChunkk_3_s_docs||[]).push([[79],{6498:(e,s,t)=>{t.r(s),t.d(s,{assets:()=>d,contentTitle:()=>c,default:()=>l,frontMatter:()=>r,metadata:()=>o,toc:()=>a});var n=t(5893),i=t(1151);const r={title:"Security"},c=void 0,o={id:"security/security",title:"Security",description:"This section describes the methodology and means of securing a K3s cluster. It's broken into 2 sections. These guides assume k3s is running with embedded etcd.",source:"@site/docs/security/security.md",sourceDirName:"security",slug:"/security/",permalink:"/security/",draft:!1,unlisted:!1,editUrl:"https://github.com/k3s-io/docs/edit/main/docs/security/security.md",tags:[],version:"current",lastUpdatedAt:1723747404e3,frontMatter:{title:"Security"},sidebar:"mySidebar",previous:{title:"Automated Upgrades",permalink:"/upgrades/automated"},next:{title:"Secrets Encryption",permalink:"/security/secrets-encryption"}},d={},a=[];function u(e){const s={a:"a",li:"li",p:"p",ul:"ul",...(0,i.a)(),...e.components};return(0,n.jsxs)(n.Fragment,{children:[(0,n.jsx)(s.p,{children:"This section describes the methodology and means of securing a K3s cluster. It's broken into 2 sections. These guides assume k3s is running with embedded etcd."}),"\n",(0,n.jsx)(s.p,{children:"First the hardening guide provides a list of security best practices to secure a K3s cluster."}),"\n",(0,n.jsxs)(s.ul,{children:["\n",(0,n.jsx)(s.li,{children:(0,n.jsx)(s.a,{href:"/security/hardening-guide",children:"Hardening Guide"})}),"\n"]}),"\n",(0,n.jsx)(s.p,{children:"Second, is the self assessment to validate a hardened cluster. We currently have two different assessments available:"}),"\n",(0,n.jsxs)(s.ul,{children:["\n",(0,n.jsxs)(s.li,{children:["\n",(0,n.jsxs)(s.p,{children:[(0,n.jsx)(s.a,{href:"/security/self-assessment-1.24",children:"CIS 1.24 Benchmark Self-Assessment Guide"}),", for K3s version v1.24"]}),"\n"]}),"\n",(0,n.jsxs)(s.li,{children:["\n",(0,n.jsxs)(s.p,{children:[(0,n.jsx)(s.a,{href:"/security/self-assessment-1.7",children:"CIS 1.7 Benchmark Self-Assessment Guide"}),", for K3s version v1.25"]}),"\n"]}),"\n",(0,n.jsxs)(s.li,{children:["\n",(0,n.jsxs)(s.p,{children:[(0,n.jsx)(s.a,{href:"/security/self-assessment-1.8",children:"CIS 1.8 Benchmark Self-Assessment Guide"}),", for K3s version v1.26-v1.29"]}),"\n"]}),"\n"]})]})}function l(e={}){const{wrapper:s}={...(0,i.a)(),...e.components};return s?(0,n.jsx)(s,{...e,children:(0,n.jsx)(u,{...e})}):u(e)}},1151:(e,s,t)=>{t.d(s,{Z:()=>o,a:()=>c});var n=t(7294);const i={},r=n.createContext(i);function c(e){const s=n.useContext(r);return n.useMemo((function(){return"function"==typeof e?e(s):{...s,...e}}),[s,e])}function o(e){let s;return s=e.disableParentContext?"function"==typeof e.components?e.components(i):e.components||i:c(e.components),n.createElement(r.Provider,{value:s},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/82406859.cc46603b.js b/assets/js/82406859.038c619c.js similarity index 99% rename from assets/js/82406859.cc46603b.js rename to assets/js/82406859.038c619c.js index c789878e3..b81890f42 100644 --- a/assets/js/82406859.cc46603b.js +++ b/assets/js/82406859.038c619c.js @@ -1 +1 @@ -"use strict";(self.webpackChunkk_3_s_docs=self.webpackChunkk_3_s_docs||[]).push([[3319],{6758:(e,n,s)=>{s.r(n),s.d(n,{assets:()=>i,contentTitle:()=>o,default:()=>h,frontMatter:()=>a,metadata:()=>l,toc:()=>d});var t=s(5893),r=s(1151);const a={title:"Automated Upgrades"},o=void 0,l={id:"upgrades/automated",title:"Automated Upgrades",description:"Overview",source:"@site/docs/upgrades/automated.md",sourceDirName:"upgrades",slug:"/upgrades/automated",permalink:"/upgrades/automated",draft:!1,unlisted:!1,editUrl:"https://github.com/k3s-io/docs/edit/main/docs/upgrades/automated.md",tags:[],version:"current",lastUpdatedAt:1723651727e3,frontMatter:{title:"Automated Upgrades"},sidebar:"mySidebar",previous:{title:"Manual Upgrades",permalink:"/upgrades/manual"},next:{title:"Security",permalink:"/security/"}},i={},d=[{value:"Overview",id:"overview",level:3},{value:"Install the system-upgrade-controller",id:"install-the-system-upgrade-controller",level:3},{value:"Configure plans",id:"configure-plans",level:3},{value:"Downgrade Prevention",id:"downgrade-prevention",level:2}];function c(e){const n={a:"a",admonition:"admonition",code:"code",em:"em",h2:"h2",h3:"h3",li:"li",mdxAdmonitionTitle:"mdxAdmonitionTitle",ol:"ol",p:"p",pre:"pre",ul:"ul",...(0,r.a)(),...e.components};return(0,t.jsxs)(t.Fragment,{children:[(0,t.jsx)(n.h3,{id:"overview",children:"Overview"}),"\n",(0,t.jsxs)(n.p,{children:["You can manage K3s cluster upgrades using Rancher's system-upgrade-controller. This is a Kubernetes-native approach to cluster upgrades. It leverages a ",(0,t.jsx)(n.a,{href:"https://kubernetes.io/docs/concepts/extend-kubernetes/api-extension/custom-resources/#custom-resources",children:"custom resource definition (CRD)"}),", a ",(0,t.jsx)(n.code,{children:"plan"}),", and a ",(0,t.jsx)(n.a,{href:"https://kubernetes.io/docs/concepts/architecture/controller/",children:"controller"}),"."]}),"\n",(0,t.jsxs)(n.p,{children:["The plan defines upgrade policies and requirements. It also defines which nodes should be upgraded through a ",(0,t.jsx)(n.a,{href:"https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/",children:"label selector"}),". See below for plans with defaults appropriate for upgrading a K3s cluster. For more advanced plan configuration options, please review the ",(0,t.jsx)(n.a,{href:"https://github.com/rancher/system-upgrade-controller/blob/master/pkg/apis/upgrade.cattle.io/v1/types.go",children:"CRD"}),"."]}),"\n",(0,t.jsxs)(n.p,{children:["The controller schedules upgrades by monitoring plans and selecting nodes to run upgrade ",(0,t.jsx)(n.a,{href:"https://kubernetes.io/docs/concepts/workloads/controllers/jobs-run-to-completion/",children:"jobs"})," on. When a job has run to completion successfully, the controller will label the node on which it ran accordingly."]}),"\n",(0,t.jsxs)(n.admonition,{type:"note",children:[(0,t.jsx)(n.mdxAdmonitionTitle,{}),(0,t.jsx)(n.p,{children:"The upgrade job that is launched must be highly privileged. It is configured with the following:"}),(0,t.jsxs)(n.ul,{children:["\n",(0,t.jsxs)(n.li,{children:["Host ",(0,t.jsx)(n.code,{children:"IPC"}),", ",(0,t.jsx)(n.code,{children:"NET"}),", and ",(0,t.jsx)(n.code,{children:"PID"})," namespaces"]}),"\n",(0,t.jsxs)(n.li,{children:["The ",(0,t.jsx)(n.code,{children:"CAP_SYS_BOOT"})," capability"]}),"\n",(0,t.jsxs)(n.li,{children:["Host root mounted at ",(0,t.jsx)(n.code,{children:"/host"})," with read and write permissions"]}),"\n"]})]}),"\n",(0,t.jsx)(n.p,{children:"To automate upgrades in this manner, you must do the following:"}),"\n",(0,t.jsxs)(n.ol,{children:["\n",(0,t.jsx)(n.li,{children:"Install the system-upgrade-controller into your cluster"}),"\n",(0,t.jsx)(n.li,{children:"Configure plans"}),"\n"]}),"\n",(0,t.jsxs)(n.admonition,{type:"warning",children:[(0,t.jsx)(n.p,{children:"If the K3s cluster is managed by Rancher, you should use the Rancher UI to manage upgrades."}),(0,t.jsxs)(n.ul,{children:["\n",(0,t.jsx)(n.li,{children:"If the K3s cluster was imported into Rancher, Rancher will manage the system-upgrade-controller deployment and plans. Do not follow the steps on this page."}),"\n",(0,t.jsx)(n.li,{children:"If the K3s cluster was provisioned by Rancher, Rancher will use system agent to manage version upgrades. Do not follow the steps on this page."}),"\n",(0,t.jsxs)(n.li,{children:["If the K3s cluster is ",(0,t.jsx)(n.em,{children:"not"})," managed Rancher, you may follow the steps below."]}),"\n"]})]}),"\n",(0,t.jsx)(n.p,{children:"For more details on the design and architecture of the system-upgrade-controller or its integration with K3s, see the following Git repositories:"}),"\n",(0,t.jsxs)(n.ul,{children:["\n",(0,t.jsx)(n.li,{children:(0,t.jsx)(n.a,{href:"https://github.com/rancher/system-upgrade-controller",children:"system-upgrade-controller"})}),"\n",(0,t.jsx)(n.li,{children:(0,t.jsx)(n.a,{href:"https://github.com/k3s-io/k3s-upgrade",children:"k3s-upgrade"})}),"\n"]}),"\n",(0,t.jsx)(n.admonition,{type:"tip",children:(0,t.jsxs)(n.p,{children:["When attempting to upgrade to a new version of K3s, the ",(0,t.jsx)(n.a,{href:"https://kubernetes.io/docs/setup/release/version-skew-policy/",children:"Kubernetes version skew policy"})," applies. Ensure that your plan does not skip intermediate minor versions when upgrading. The system-upgrade-controller itself will not protect against unsupported changes to the Kubernetes version."]})}),"\n",(0,t.jsx)(n.h3,{id:"install-the-system-upgrade-controller",children:"Install the system-upgrade-controller"}),"\n",(0,t.jsx)(n.p,{children:"The system-upgrade-controller can be installed as a deployment into your cluster. The deployment requires a service-account, clusterRoleBinding, and a configmap. To install these components, run the following command:"}),"\n",(0,t.jsx)(n.pre,{children:(0,t.jsx)(n.code,{className:"language-bash",children:"kubectl apply -f https://github.com/rancher/system-upgrade-controller/releases/latest/download/system-upgrade-controller.yaml\n"})}),"\n",(0,t.jsx)(n.p,{children:"The controller can be configured and customized via the previously mentioned configmap, but the controller must be redeployed for the changes to be applied."}),"\n",(0,t.jsx)(n.p,{children:"To be able to apply plans, the system-upgrade-controller CRD has to be deployed:"}),"\n",(0,t.jsx)(n.pre,{children:(0,t.jsx)(n.code,{className:"language-bash",children:"kubectl apply -f https://github.com/rancher/system-upgrade-controller/releases/latest/download/crd.yaml\n"})}),"\n",(0,t.jsx)(n.h3,{id:"configure-plans",children:"Configure plans"}),"\n",(0,t.jsx)(n.p,{children:"It is recommended you create at least two plans: a plan for upgrading server (control-plane) nodes and a plan for upgrading agent nodes. You can create additional plans as needed to control the rollout of the upgrade across nodes. Once the plans are created, the controller will pick them up and begin to upgrade your cluster."}),"\n",(0,t.jsx)(n.p,{children:"The following two example plans will upgrade your cluster to K3s v1.24.6+k3s1:"}),"\n",(0,t.jsx)(n.pre,{children:(0,t.jsx)(n.code,{className:"language-yaml",children:'# Server plan\napiVersion: upgrade.cattle.io/v1\nkind: Plan\nmetadata:\n name: server-plan\n namespace: system-upgrade\nspec:\n concurrency: 1\n cordon: true\n nodeSelector:\n matchExpressions:\n - key: node-role.kubernetes.io/control-plane\n operator: In\n values:\n - "true"\n serviceAccountName: system-upgrade\n upgrade:\n image: rancher/k3s-upgrade\n version: v1.24.6+k3s1\n---\n# Agent plan\napiVersion: upgrade.cattle.io/v1\nkind: Plan\nmetadata:\n name: agent-plan\n namespace: system-upgrade\nspec:\n concurrency: 1\n cordon: true\n nodeSelector:\n matchExpressions:\n - key: node-role.kubernetes.io/control-plane\n operator: DoesNotExist\n prepare:\n args:\n - prepare\n - server-plan\n image: rancher/k3s-upgrade\n serviceAccountName: system-upgrade\n upgrade:\n image: rancher/k3s-upgrade\n version: v1.24.6+k3s1\n'})}),"\n",(0,t.jsx)(n.p,{children:"There are a few important things to call out regarding these plans:"}),"\n",(0,t.jsxs)(n.ol,{children:["\n",(0,t.jsxs)(n.li,{children:["\n",(0,t.jsx)(n.p,{children:"The plans must be created in the same namespace where the controller was deployed."}),"\n"]}),"\n",(0,t.jsxs)(n.li,{children:["\n",(0,t.jsxs)(n.p,{children:["The ",(0,t.jsx)(n.code,{children:"concurrency"})," field indicates how many nodes can be upgraded at the same time."]}),"\n"]}),"\n",(0,t.jsxs)(n.li,{children:["\n",(0,t.jsxs)(n.p,{children:["The server-plan targets server nodes by specifying a label selector that selects nodes with the ",(0,t.jsx)(n.code,{children:"node-role.kubernetes.io/control-plane"})," label. The agent-plan targets agent nodes by specifying a label selector that select nodes without that label."]}),"\n"]}),"\n",(0,t.jsxs)(n.li,{children:["\n",(0,t.jsxs)(n.p,{children:["The ",(0,t.jsx)(n.code,{children:"prepare"})," step in the agent-plan will cause upgrade jobs for that plan to wait for the server-plan to complete before they execute."]}),"\n"]}),"\n",(0,t.jsxs)(n.li,{children:["\n",(0,t.jsxs)(n.p,{children:["Both plans have the ",(0,t.jsx)(n.code,{children:"version"})," field set to v1.24.6+k3s1. Alternatively, you can omit the ",(0,t.jsx)(n.code,{children:"version"})," field and set the ",(0,t.jsx)(n.code,{children:"channel"})," field to a URL that resolves to a release of K3s. This will cause the controller to monitor that URL and upgrade the cluster any time it resolves to a new release. This works well with the ",(0,t.jsx)(n.a,{href:"/upgrades/manual#release-channels",children:"release channels"}),". Thus, you can configure your plans with the following channel to ensure your cluster is always automatically upgraded to the newest stable release of K3s:"]}),"\n"]}),"\n"]}),"\n",(0,t.jsx)(n.pre,{children:(0,t.jsx)(n.code,{className:"language-yaml",children:"apiVersion: upgrade.cattle.io/v1\nkind: Plan\n...\nspec:\n ...\n channel: https://update.k3s.io/v1-release/channels/stable\n\n"})}),"\n",(0,t.jsx)(n.p,{children:"As stated, the upgrade will begin as soon as the controller detects that a plan was created. Updating a plan will cause the controller to re-evaluate the plan and determine if another upgrade is needed."}),"\n",(0,t.jsx)(n.p,{children:"You can monitor the progress of an upgrade by viewing the plan and jobs via kubectl:"}),"\n",(0,t.jsx)(n.pre,{children:(0,t.jsx)(n.code,{className:"language-bash",children:"kubectl -n system-upgrade get plans -o yaml\nkubectl -n system-upgrade get jobs -o yaml\n"})}),"\n",(0,t.jsx)(n.h2,{id:"downgrade-prevention",children:"Downgrade Prevention"}),"\n",(0,t.jsx)(n.admonition,{title:"Version Gate",type:"info",children:(0,t.jsxs)(n.p,{children:["Starting with the 2023-07 releases (",(0,t.jsx)(n.a,{href:"https://github.com/k3s-io/k3s-upgrade/releases/tag/v1.27.4%2Bk3s1",children:"v1.27.4+k3s1"}),", ",(0,t.jsx)(n.a,{href:"https://github.com/k3s-io/k3s-upgrade/releases/tag/v1.26.7%2Bk3s1",children:"v1.26.7+k3s1"}),", ",(0,t.jsx)(n.a,{href:"https://github.com/k3s-io/k3s-upgrade/releases/tag/v1.25.12%2Bk3s1",children:"v1.25.12+k3s1"}),", ",(0,t.jsx)(n.a,{href:"https://github.com/k3s-io/k3s-upgrade/releases/tag/v1.24.16%2Bk3s1",children:"v1.24.16+k3s1"}),")"]})}),"\n",(0,t.jsx)(n.p,{children:"Kubernetes does not support downgrades of control-plane components. The k3s-upgrade image used by upgrade plans will refuse to downgrade K3s, failing the plan and leaving your nodes cordoned."}),"\n",(0,t.jsx)(n.p,{children:"Here is an example cluster, showing failed upgrade pods and cordoned nodes:"}),"\n",(0,t.jsx)(n.pre,{children:(0,t.jsx)(n.code,{className:"language-console",children:"ubuntu@user:~$ kubectl get pods -n system-upgrade\nNAME READY STATUS RESTARTS AGE\napply-k3s-server-on-ip-172-31-0-16-with-7af95590a5af8e8c3-2cdc6 0/1 Error 0 9m25s\napply-k3s-server-on-ip-172-31-10-23-with-7af95590a5af8e8c-9xvwg 0/1 Error 0 14m\napply-k3s-server-on-ip-172-31-13-213-with-7af95590a5af8e8-8j72v 0/1 Error 0 18m\nsystem-upgrade-controller-7c4b84d5d9-kkzr6 1/1 Running 0 20m\nubuntu@user:~$ kubectl get nodes\nNAME STATUS ROLES AGE VERSION\nip-172-31-0-16 Ready,SchedulingDisabled control-plane,etcd,master 19h v1.27.4+k3s1\nip-172-31-10-23 Ready,SchedulingDisabled control-plane,etcd,master 19h v1.27.4+k3s1\nip-172-31-13-213 Ready,SchedulingDisabled control-plane,etcd,master 19h v1.27.4+k3s1\nip-172-31-2-13 Ready 19h v1.27.4+k3s1\n"})}),"\n",(0,t.jsx)(n.p,{children:"You can return your cordoned nodes to service by either of the following methods:"}),"\n",(0,t.jsxs)(n.ul,{children:["\n",(0,t.jsx)(n.li,{children:"Change the version or channel on your plan to target a release that is the same or newer than what is currently running on the cluster, so that the plan succeeds."}),"\n",(0,t.jsxs)(n.li,{children:["Delete the plan and manually uncordon the nodes.\nUse ",(0,t.jsx)(n.code,{children:"kubectl get plan -n system-upgrade"})," to find the plan name, then ",(0,t.jsx)(n.code,{children:"kubectl delete plan -n system-upgrade PLAN_NAME"})," to delete it. Once the plan has been deleted, use ",(0,t.jsx)(n.code,{children:"kubectl uncordon NODE_NAME"})," to uncordon each of the nodes."]}),"\n"]})]})}function h(e={}){const{wrapper:n}={...(0,r.a)(),...e.components};return n?(0,t.jsx)(n,{...e,children:(0,t.jsx)(c,{...e})}):c(e)}},1151:(e,n,s)=>{s.d(n,{Z:()=>l,a:()=>o});var t=s(7294);const r={},a=t.createContext(r);function o(e){const n=t.useContext(a);return t.useMemo((function(){return"function"==typeof e?e(n):{...n,...e}}),[n,e])}function l(e){let n;return n=e.disableParentContext?"function"==typeof e.components?e.components(r):e.components||r:o(e.components),t.createElement(a.Provider,{value:n},e.children)}}}]); \ No newline at end of file +"use strict";(self.webpackChunkk_3_s_docs=self.webpackChunkk_3_s_docs||[]).push([[3319],{6758:(e,n,s)=>{s.r(n),s.d(n,{assets:()=>i,contentTitle:()=>o,default:()=>h,frontMatter:()=>a,metadata:()=>l,toc:()=>d});var t=s(5893),r=s(1151);const a={title:"Automated Upgrades"},o=void 0,l={id:"upgrades/automated",title:"Automated Upgrades",description:"Overview",source:"@site/docs/upgrades/automated.md",sourceDirName:"upgrades",slug:"/upgrades/automated",permalink:"/upgrades/automated",draft:!1,unlisted:!1,editUrl:"https://github.com/k3s-io/docs/edit/main/docs/upgrades/automated.md",tags:[],version:"current",lastUpdatedAt:1723747404e3,frontMatter:{title:"Automated Upgrades"},sidebar:"mySidebar",previous:{title:"Manual Upgrades",permalink:"/upgrades/manual"},next:{title:"Security",permalink:"/security/"}},i={},d=[{value:"Overview",id:"overview",level:3},{value:"Install the system-upgrade-controller",id:"install-the-system-upgrade-controller",level:3},{value:"Configure plans",id:"configure-plans",level:3},{value:"Downgrade Prevention",id:"downgrade-prevention",level:2}];function c(e){const n={a:"a",admonition:"admonition",code:"code",em:"em",h2:"h2",h3:"h3",li:"li",mdxAdmonitionTitle:"mdxAdmonitionTitle",ol:"ol",p:"p",pre:"pre",ul:"ul",...(0,r.a)(),...e.components};return(0,t.jsxs)(t.Fragment,{children:[(0,t.jsx)(n.h3,{id:"overview",children:"Overview"}),"\n",(0,t.jsxs)(n.p,{children:["You can manage K3s cluster upgrades using Rancher's system-upgrade-controller. This is a Kubernetes-native approach to cluster upgrades. It leverages a ",(0,t.jsx)(n.a,{href:"https://kubernetes.io/docs/concepts/extend-kubernetes/api-extension/custom-resources/#custom-resources",children:"custom resource definition (CRD)"}),", a ",(0,t.jsx)(n.code,{children:"plan"}),", and a ",(0,t.jsx)(n.a,{href:"https://kubernetes.io/docs/concepts/architecture/controller/",children:"controller"}),"."]}),"\n",(0,t.jsxs)(n.p,{children:["The plan defines upgrade policies and requirements. It also defines which nodes should be upgraded through a ",(0,t.jsx)(n.a,{href:"https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/",children:"label selector"}),". See below for plans with defaults appropriate for upgrading a K3s cluster. For more advanced plan configuration options, please review the ",(0,t.jsx)(n.a,{href:"https://github.com/rancher/system-upgrade-controller/blob/master/pkg/apis/upgrade.cattle.io/v1/types.go",children:"CRD"}),"."]}),"\n",(0,t.jsxs)(n.p,{children:["The controller schedules upgrades by monitoring plans and selecting nodes to run upgrade ",(0,t.jsx)(n.a,{href:"https://kubernetes.io/docs/concepts/workloads/controllers/jobs-run-to-completion/",children:"jobs"})," on. When a job has run to completion successfully, the controller will label the node on which it ran accordingly."]}),"\n",(0,t.jsxs)(n.admonition,{type:"note",children:[(0,t.jsx)(n.mdxAdmonitionTitle,{}),(0,t.jsx)(n.p,{children:"The upgrade job that is launched must be highly privileged. It is configured with the following:"}),(0,t.jsxs)(n.ul,{children:["\n",(0,t.jsxs)(n.li,{children:["Host ",(0,t.jsx)(n.code,{children:"IPC"}),", ",(0,t.jsx)(n.code,{children:"NET"}),", and ",(0,t.jsx)(n.code,{children:"PID"})," namespaces"]}),"\n",(0,t.jsxs)(n.li,{children:["The ",(0,t.jsx)(n.code,{children:"CAP_SYS_BOOT"})," capability"]}),"\n",(0,t.jsxs)(n.li,{children:["Host root mounted at ",(0,t.jsx)(n.code,{children:"/host"})," with read and write permissions"]}),"\n"]})]}),"\n",(0,t.jsx)(n.p,{children:"To automate upgrades in this manner, you must do the following:"}),"\n",(0,t.jsxs)(n.ol,{children:["\n",(0,t.jsx)(n.li,{children:"Install the system-upgrade-controller into your cluster"}),"\n",(0,t.jsx)(n.li,{children:"Configure plans"}),"\n"]}),"\n",(0,t.jsxs)(n.admonition,{type:"warning",children:[(0,t.jsx)(n.p,{children:"If the K3s cluster is managed by Rancher, you should use the Rancher UI to manage upgrades."}),(0,t.jsxs)(n.ul,{children:["\n",(0,t.jsx)(n.li,{children:"If the K3s cluster was imported into Rancher, Rancher will manage the system-upgrade-controller deployment and plans. Do not follow the steps on this page."}),"\n",(0,t.jsx)(n.li,{children:"If the K3s cluster was provisioned by Rancher, Rancher will use system agent to manage version upgrades. Do not follow the steps on this page."}),"\n",(0,t.jsxs)(n.li,{children:["If the K3s cluster is ",(0,t.jsx)(n.em,{children:"not"})," managed Rancher, you may follow the steps below."]}),"\n"]})]}),"\n",(0,t.jsx)(n.p,{children:"For more details on the design and architecture of the system-upgrade-controller or its integration with K3s, see the following Git repositories:"}),"\n",(0,t.jsxs)(n.ul,{children:["\n",(0,t.jsx)(n.li,{children:(0,t.jsx)(n.a,{href:"https://github.com/rancher/system-upgrade-controller",children:"system-upgrade-controller"})}),"\n",(0,t.jsx)(n.li,{children:(0,t.jsx)(n.a,{href:"https://github.com/k3s-io/k3s-upgrade",children:"k3s-upgrade"})}),"\n"]}),"\n",(0,t.jsx)(n.admonition,{type:"tip",children:(0,t.jsxs)(n.p,{children:["When attempting to upgrade to a new version of K3s, the ",(0,t.jsx)(n.a,{href:"https://kubernetes.io/docs/setup/release/version-skew-policy/",children:"Kubernetes version skew policy"})," applies. Ensure that your plan does not skip intermediate minor versions when upgrading. The system-upgrade-controller itself will not protect against unsupported changes to the Kubernetes version."]})}),"\n",(0,t.jsx)(n.h3,{id:"install-the-system-upgrade-controller",children:"Install the system-upgrade-controller"}),"\n",(0,t.jsx)(n.p,{children:"The system-upgrade-controller can be installed as a deployment into your cluster. The deployment requires a service-account, clusterRoleBinding, and a configmap. To install these components, run the following command:"}),"\n",(0,t.jsx)(n.pre,{children:(0,t.jsx)(n.code,{className:"language-bash",children:"kubectl apply -f https://github.com/rancher/system-upgrade-controller/releases/latest/download/system-upgrade-controller.yaml\n"})}),"\n",(0,t.jsx)(n.p,{children:"The controller can be configured and customized via the previously mentioned configmap, but the controller must be redeployed for the changes to be applied."}),"\n",(0,t.jsx)(n.p,{children:"To be able to apply plans, the system-upgrade-controller CRD has to be deployed:"}),"\n",(0,t.jsx)(n.pre,{children:(0,t.jsx)(n.code,{className:"language-bash",children:"kubectl apply -f https://github.com/rancher/system-upgrade-controller/releases/latest/download/crd.yaml\n"})}),"\n",(0,t.jsx)(n.h3,{id:"configure-plans",children:"Configure plans"}),"\n",(0,t.jsx)(n.p,{children:"It is recommended you create at least two plans: a plan for upgrading server (control-plane) nodes and a plan for upgrading agent nodes. You can create additional plans as needed to control the rollout of the upgrade across nodes. Once the plans are created, the controller will pick them up and begin to upgrade your cluster."}),"\n",(0,t.jsx)(n.p,{children:"The following two example plans will upgrade your cluster to K3s v1.24.6+k3s1:"}),"\n",(0,t.jsx)(n.pre,{children:(0,t.jsx)(n.code,{className:"language-yaml",children:'# Server plan\napiVersion: upgrade.cattle.io/v1\nkind: Plan\nmetadata:\n name: server-plan\n namespace: system-upgrade\nspec:\n concurrency: 1\n cordon: true\n nodeSelector:\n matchExpressions:\n - key: node-role.kubernetes.io/control-plane\n operator: In\n values:\n - "true"\n serviceAccountName: system-upgrade\n upgrade:\n image: rancher/k3s-upgrade\n version: v1.24.6+k3s1\n---\n# Agent plan\napiVersion: upgrade.cattle.io/v1\nkind: Plan\nmetadata:\n name: agent-plan\n namespace: system-upgrade\nspec:\n concurrency: 1\n cordon: true\n nodeSelector:\n matchExpressions:\n - key: node-role.kubernetes.io/control-plane\n operator: DoesNotExist\n prepare:\n args:\n - prepare\n - server-plan\n image: rancher/k3s-upgrade\n serviceAccountName: system-upgrade\n upgrade:\n image: rancher/k3s-upgrade\n version: v1.24.6+k3s1\n'})}),"\n",(0,t.jsx)(n.p,{children:"There are a few important things to call out regarding these plans:"}),"\n",(0,t.jsxs)(n.ol,{children:["\n",(0,t.jsxs)(n.li,{children:["\n",(0,t.jsx)(n.p,{children:"The plans must be created in the same namespace where the controller was deployed."}),"\n"]}),"\n",(0,t.jsxs)(n.li,{children:["\n",(0,t.jsxs)(n.p,{children:["The ",(0,t.jsx)(n.code,{children:"concurrency"})," field indicates how many nodes can be upgraded at the same time."]}),"\n"]}),"\n",(0,t.jsxs)(n.li,{children:["\n",(0,t.jsxs)(n.p,{children:["The server-plan targets server nodes by specifying a label selector that selects nodes with the ",(0,t.jsx)(n.code,{children:"node-role.kubernetes.io/control-plane"})," label. The agent-plan targets agent nodes by specifying a label selector that select nodes without that label."]}),"\n"]}),"\n",(0,t.jsxs)(n.li,{children:["\n",(0,t.jsxs)(n.p,{children:["The ",(0,t.jsx)(n.code,{children:"prepare"})," step in the agent-plan will cause upgrade jobs for that plan to wait for the server-plan to complete before they execute."]}),"\n"]}),"\n",(0,t.jsxs)(n.li,{children:["\n",(0,t.jsxs)(n.p,{children:["Both plans have the ",(0,t.jsx)(n.code,{children:"version"})," field set to v1.24.6+k3s1. Alternatively, you can omit the ",(0,t.jsx)(n.code,{children:"version"})," field and set the ",(0,t.jsx)(n.code,{children:"channel"})," field to a URL that resolves to a release of K3s. This will cause the controller to monitor that URL and upgrade the cluster any time it resolves to a new release. This works well with the ",(0,t.jsx)(n.a,{href:"/upgrades/manual#release-channels",children:"release channels"}),". Thus, you can configure your plans with the following channel to ensure your cluster is always automatically upgraded to the newest stable release of K3s:"]}),"\n"]}),"\n"]}),"\n",(0,t.jsx)(n.pre,{children:(0,t.jsx)(n.code,{className:"language-yaml",children:"apiVersion: upgrade.cattle.io/v1\nkind: Plan\n...\nspec:\n ...\n channel: https://update.k3s.io/v1-release/channels/stable\n\n"})}),"\n",(0,t.jsx)(n.p,{children:"As stated, the upgrade will begin as soon as the controller detects that a plan was created. Updating a plan will cause the controller to re-evaluate the plan and determine if another upgrade is needed."}),"\n",(0,t.jsx)(n.p,{children:"You can monitor the progress of an upgrade by viewing the plan and jobs via kubectl:"}),"\n",(0,t.jsx)(n.pre,{children:(0,t.jsx)(n.code,{className:"language-bash",children:"kubectl -n system-upgrade get plans -o yaml\nkubectl -n system-upgrade get jobs -o yaml\n"})}),"\n",(0,t.jsx)(n.h2,{id:"downgrade-prevention",children:"Downgrade Prevention"}),"\n",(0,t.jsx)(n.admonition,{title:"Version Gate",type:"info",children:(0,t.jsxs)(n.p,{children:["Starting with the 2023-07 releases (",(0,t.jsx)(n.a,{href:"https://github.com/k3s-io/k3s-upgrade/releases/tag/v1.27.4%2Bk3s1",children:"v1.27.4+k3s1"}),", ",(0,t.jsx)(n.a,{href:"https://github.com/k3s-io/k3s-upgrade/releases/tag/v1.26.7%2Bk3s1",children:"v1.26.7+k3s1"}),", ",(0,t.jsx)(n.a,{href:"https://github.com/k3s-io/k3s-upgrade/releases/tag/v1.25.12%2Bk3s1",children:"v1.25.12+k3s1"}),", ",(0,t.jsx)(n.a,{href:"https://github.com/k3s-io/k3s-upgrade/releases/tag/v1.24.16%2Bk3s1",children:"v1.24.16+k3s1"}),")"]})}),"\n",(0,t.jsx)(n.p,{children:"Kubernetes does not support downgrades of control-plane components. The k3s-upgrade image used by upgrade plans will refuse to downgrade K3s, failing the plan and leaving your nodes cordoned."}),"\n",(0,t.jsx)(n.p,{children:"Here is an example cluster, showing failed upgrade pods and cordoned nodes:"}),"\n",(0,t.jsx)(n.pre,{children:(0,t.jsx)(n.code,{className:"language-console",children:"ubuntu@user:~$ kubectl get pods -n system-upgrade\nNAME READY STATUS RESTARTS AGE\napply-k3s-server-on-ip-172-31-0-16-with-7af95590a5af8e8c3-2cdc6 0/1 Error 0 9m25s\napply-k3s-server-on-ip-172-31-10-23-with-7af95590a5af8e8c-9xvwg 0/1 Error 0 14m\napply-k3s-server-on-ip-172-31-13-213-with-7af95590a5af8e8-8j72v 0/1 Error 0 18m\nsystem-upgrade-controller-7c4b84d5d9-kkzr6 1/1 Running 0 20m\nubuntu@user:~$ kubectl get nodes\nNAME STATUS ROLES AGE VERSION\nip-172-31-0-16 Ready,SchedulingDisabled control-plane,etcd,master 19h v1.27.4+k3s1\nip-172-31-10-23 Ready,SchedulingDisabled control-plane,etcd,master 19h v1.27.4+k3s1\nip-172-31-13-213 Ready,SchedulingDisabled control-plane,etcd,master 19h v1.27.4+k3s1\nip-172-31-2-13 Ready 19h v1.27.4+k3s1\n"})}),"\n",(0,t.jsx)(n.p,{children:"You can return your cordoned nodes to service by either of the following methods:"}),"\n",(0,t.jsxs)(n.ul,{children:["\n",(0,t.jsx)(n.li,{children:"Change the version or channel on your plan to target a release that is the same or newer than what is currently running on the cluster, so that the plan succeeds."}),"\n",(0,t.jsxs)(n.li,{children:["Delete the plan and manually uncordon the nodes.\nUse ",(0,t.jsx)(n.code,{children:"kubectl get plan -n system-upgrade"})," to find the plan name, then ",(0,t.jsx)(n.code,{children:"kubectl delete plan -n system-upgrade PLAN_NAME"})," to delete it. Once the plan has been deleted, use ",(0,t.jsx)(n.code,{children:"kubectl uncordon NODE_NAME"})," to uncordon each of the nodes."]}),"\n"]})]})}function h(e={}){const{wrapper:n}={...(0,r.a)(),...e.components};return n?(0,t.jsx)(n,{...e,children:(0,t.jsx)(c,{...e})}):c(e)}},1151:(e,n,s)=>{s.d(n,{Z:()=>l,a:()=>o});var t=s(7294);const r={},a=t.createContext(r);function o(e){const n=t.useContext(a);return t.useMemo((function(){return"function"==typeof e?e(n):{...n,...e}}),[n,e])}function l(e){let n;return n=e.disableParentContext?"function"==typeof e.components?e.components(r):e.components||r:o(e.components),t.createElement(a.Provider,{value:n},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/82f1aa93.c65b3b6e.js b/assets/js/82f1aa93.20fca2c7.js similarity index 99% rename from assets/js/82f1aa93.c65b3b6e.js rename to assets/js/82f1aa93.20fca2c7.js index d2d9089b9..88bdcdb82 100644 --- a/assets/js/82f1aa93.c65b3b6e.js +++ b/assets/js/82f1aa93.20fca2c7.js @@ -1 +1 @@ -"use strict";(self.webpackChunkk_3_s_docs=self.webpackChunkk_3_s_docs||[]).push([[7709],{1587:(e,n,s)=>{s.r(n),s.d(n,{assets:()=>l,contentTitle:()=>a,default:()=>u,frontMatter:()=>t,metadata:()=>o,toc:()=>c});var i=s(5893),r=s(1151);const t={title:"CIS Hardening Guide"},a=void 0,o={id:"security/hardening-guide",title:"CIS Hardening Guide",description:"This document provides prescriptive guidance for hardening a production installation of K3s. It outlines the configurations and controls required to address Kubernetes benchmark controls from the Center for Internet Security (CIS).",source:"@site/docs/security/hardening-guide.md",sourceDirName:"security",slug:"/security/hardening-guide",permalink:"/security/hardening-guide",draft:!1,unlisted:!1,editUrl:"https://github.com/k3s-io/docs/edit/main/docs/security/hardening-guide.md",tags:[],version:"current",lastUpdatedAt:1723651727e3,frontMatter:{title:"CIS Hardening Guide"},sidebar:"mySidebar",previous:{title:"Secrets Encryption",permalink:"/security/secrets-encryption"},next:{title:"CIS 1.8 Self Assessment Guide",permalink:"/security/self-assessment-1.8"}},l={},c=[{value:"Host-level Requirements",id:"host-level-requirements",level:2},{value:"Ensure protect-kernel-defaults is set",id:"ensure-protect-kernel-defaults-is-set",level:3},{value:"Set kernel parameters",id:"set-kernel-parameters",level:4},{value:"Kubernetes Runtime Requirements",id:"kubernetes-runtime-requirements",level:2},{value:"Pod Security",id:"pod-security",level:3},{value:"NetworkPolicies",id:"networkpolicies",level:3},{value:"API Server audit configuration",id:"api-server-audit-configuration",level:3},{value:"Configuration for Kubernetes Components",id:"configuration-for-kubernetes-components",level:2},{value:"Manual Operations",id:"manual-operations",level:2},{value:"Control 1.1.20",id:"control-1120",level:3},{value:"Control 1.2.9",id:"control-129",level:3},{value:"Control 1.2.11",id:"control-1211",level:3},{value:"Control 1.2.21",id:"control-1221",level:3},{value:"Control 4.2.13",id:"control-4213",level:3},{value:"Control 5.X",id:"control-5x",level:3},{value:"Conclusion",id:"conclusion",level:2}];function d(e){const n={a:"a",admonition:"admonition",blockquote:"blockquote",code:"code",h2:"h2",h3:"h3",h4:"h4",li:"li",ol:"ol",p:"p",pre:"pre",strong:"strong",...(0,r.a)(),...e.components},{Details:s,TabItem:t,Tabs:a}=n;return s||p("Details",!0),t||p("TabItem",!0),a||p("Tabs",!0),(0,i.jsxs)(i.Fragment,{children:[(0,i.jsx)(n.p,{children:"This document provides prescriptive guidance for hardening a production installation of K3s. It outlines the configurations and controls required to address Kubernetes benchmark controls from the Center for Internet Security (CIS)."}),"\n",(0,i.jsx)(n.p,{children:"K3s has a number of security mitigations applied and turned on by default and will pass a number of the Kubernetes CIS controls without modification. There are some notable exceptions to this that require manual intervention to fully comply with the CIS Benchmark:"}),"\n",(0,i.jsxs)(n.ol,{children:["\n",(0,i.jsx)(n.li,{children:"K3s will not modify the host operating system. Any host-level modifications will need to be done manually."}),"\n",(0,i.jsxs)(n.li,{children:["Certain CIS policy controls for ",(0,i.jsx)(n.code,{children:"NetworkPolicies"})," and ",(0,i.jsx)(n.code,{children:"PodSecurityStandards"})," (",(0,i.jsx)(n.code,{children:"PodSecurityPolicies"})," on v1.24 and older) will restrict the functionality of the cluster. You must opt into having K3s configure these by adding the appropriate options (enabling of admission plugins) to your command-line flags or configuration file as well as manually applying appropriate policies. Further details are presented in the sections below."]}),"\n"]}),"\n",(0,i.jsx)(n.p,{children:"The first section (1.1) of the CIS Benchmark concerns itself primarily with pod manifest permissions and ownership. K3s doesn't utilize these for the core components since everything is packaged into a single binary."}),"\n",(0,i.jsx)(n.h2,{id:"host-level-requirements",children:"Host-level Requirements"}),"\n",(0,i.jsx)(n.p,{children:"There are two areas of host-level requirements: kernel parameters and etcd process/directory configuration. These are outlined in this section."}),"\n",(0,i.jsxs)(n.h3,{id:"ensure-protect-kernel-defaults-is-set",children:["Ensure ",(0,i.jsx)(n.code,{children:"protect-kernel-defaults"})," is set"]}),"\n",(0,i.jsx)(n.p,{children:"This is a kubelet flag that will cause the kubelet to exit if the required kernel parameters are unset or are set to values that are different from the kubelet's defaults."}),"\n",(0,i.jsxs)(n.blockquote,{children:["\n",(0,i.jsxs)(n.p,{children:[(0,i.jsx)(n.strong,{children:"Note:"})," ",(0,i.jsx)(n.code,{children:"protect-kernel-defaults"})," is exposed as a top-level flag for K3s."]}),"\n"]}),"\n",(0,i.jsx)(n.h4,{id:"set-kernel-parameters",children:"Set kernel parameters"}),"\n",(0,i.jsxs)(n.p,{children:["Create a file called ",(0,i.jsx)(n.code,{children:"/etc/sysctl.d/90-kubelet.conf"})," and add the snippet below. Then run ",(0,i.jsx)(n.code,{children:"sysctl -p /etc/sysctl.d/90-kubelet.conf"}),"."]}),"\n",(0,i.jsx)(n.pre,{children:(0,i.jsx)(n.code,{className:"language-bash",children:"vm.panic_on_oom=0\nvm.overcommit_memory=1\nkernel.panic=10\nkernel.panic_on_oops=1\n"})}),"\n",(0,i.jsx)(n.h2,{id:"kubernetes-runtime-requirements",children:"Kubernetes Runtime Requirements"}),"\n",(0,i.jsx)(n.p,{children:"The runtime requirements to comply with the CIS Benchmark are centered around pod security (via PSP or PSA), network policies and API Server auditing logs. These are outlined in this section."}),"\n",(0,i.jsxs)(n.p,{children:["By default, K3s does not include any pod security or network policies. However, K3s ships with a controller that will enforce network policies, if any are created. K3s doesn't enable auditing by default, so audit log configuration and audit policy must be created manually. By default, K3s runs with the both the ",(0,i.jsx)(n.code,{children:"PodSecurity"})," and ",(0,i.jsx)(n.code,{children:"NodeRestriction"})," admission controllers enabled, among others."]}),"\n",(0,i.jsx)(n.h3,{id:"pod-security",children:"Pod Security"}),"\n",(0,i.jsxs)(a,{groupId:"pod-sec",queryString:!0,children:[(0,i.jsxs)(t,{value:"v1.25 and Newer",default:!0,children:[(0,i.jsxs)(n.p,{children:["K3s v1.25 and newer support ",(0,i.jsx)(n.a,{href:"https://kubernetes.io/docs/concepts/security/pod-security-admission/",children:"Pod Security Admissions (PSAs)"})," for controlling pod security. PSAs are enabled by passing the following flag to the K3s server:"]}),(0,i.jsx)(n.pre,{children:(0,i.jsx)(n.code,{children:'--kube-apiserver-arg="admission-control-config-file=/var/lib/rancher/k3s/server/psa.yaml"\n'})}),(0,i.jsxs)(n.p,{children:["The policy should be written to a file named ",(0,i.jsx)(n.code,{children:"psa.yaml"})," in ",(0,i.jsx)(n.code,{children:"/var/lib/rancher/k3s/server"})," directory."]}),(0,i.jsx)(n.p,{children:"Here is an example of a compliant PSA:"}),(0,i.jsx)(n.pre,{children:(0,i.jsx)(n.code,{className:"language-yaml",children:'apiVersion: apiserver.config.k8s.io/v1\nkind: AdmissionConfiguration\nplugins:\n- name: PodSecurity\n configuration:\n apiVersion: pod-security.admission.config.k8s.io/v1beta1\n kind: PodSecurityConfiguration\n defaults:\n enforce: "restricted"\n enforce-version: "latest"\n audit: "restricted"\n audit-version: "latest"\n warn: "restricted"\n warn-version: "latest"\n exemptions:\n usernames: []\n runtimeClasses: []\n namespaces: [kube-system, cis-operator-system]\n'})})]}),(0,i.jsxs)(t,{value:"v1.24 and Older",default:!0,children:[(0,i.jsxs)(n.p,{children:["K3s v1.24 and older support ",(0,i.jsx)(n.a,{href:"https://kubernetes.io/docs/concepts/security/pod-security-policy/",children:"Pod Security Policies (PSPs)"})," for controlling pod security. PSPs are enabled by passing the following flag to the K3s server:"]}),(0,i.jsx)(n.pre,{children:(0,i.jsx)(n.code,{children:'--kube-apiserver-arg="enable-admission-plugins=NodeRestriction,PodSecurityPolicy"\n'})}),(0,i.jsxs)(n.p,{children:["This will have the effect of maintaining the ",(0,i.jsx)(n.code,{children:"NodeRestriction"})," plugin as well as enabling the ",(0,i.jsx)(n.code,{children:"PodSecurityPolicy"}),"."]}),(0,i.jsx)(n.p,{children:"When PSPs are enabled, a policy can be applied to satisfy the necessary controls described in section 5.2 of the CIS Benchmark."}),(0,i.jsx)(n.p,{children:"Here is an example of a compliant PSP:"}),(0,i.jsx)(n.pre,{children:(0,i.jsx)(n.code,{className:"language-yaml",children:"apiVersion: policy/v1beta1\nkind: PodSecurityPolicy\nmetadata:\n name: restricted-psp\nspec:\n privileged: false # CIS - 5.2.1\n allowPrivilegeEscalation: false # CIS - 5.2.5\n requiredDropCapabilities: # CIS - 5.2.7/8/9\n - ALL\n volumes:\n - 'configMap'\n - 'emptyDir'\n - 'projected'\n - 'secret'\n - 'downwardAPI'\n - 'csi'\n - 'persistentVolumeClaim'\n - 'ephemeral'\n hostNetwork: false # CIS - 5.2.4\n hostIPC: false # CIS - 5.2.3\n hostPID: false # CIS - 5.2.2\n runAsUser:\n rule: 'MustRunAsNonRoot' # CIS - 5.2.6\n seLinux:\n rule: 'RunAsAny'\n supplementalGroups:\n rule: 'MustRunAs'\n ranges:\n - min: 1\n max: 65535\n fsGroup:\n rule: 'MustRunAs'\n ranges:\n - min: 1\n max: 65535\n readOnlyRootFilesystem: false\n"})}),(0,i.jsx)(n.p,{children:'For the above PSP to be effective, we need to create a ClusterRole and a ClusterRoleBinding. We also need to include a "system unrestricted policy" which is needed for system-level pods that require additional privileges, and an additional policy that allows sysctls necessary for servicelb to function properly.'}),(0,i.jsxs)(n.p,{children:["Combining the configuration above with the ",(0,i.jsx)(n.a,{href:"#networkpolicies",children:"Network Policy"})," described in the next section, a single file can be placed in the ",(0,i.jsx)(n.code,{children:"/var/lib/rancher/k3s/server/manifests"})," directory. Here is an example of a ",(0,i.jsx)(n.code,{children:"policy.yaml"})," file:"]}),(0,i.jsx)(n.pre,{children:(0,i.jsx)(n.code,{className:"language-yaml",children:"apiVersion: policy/v1beta1\nkind: PodSecurityPolicy\nmetadata:\n name: restricted-psp\nspec:\n privileged: false\n allowPrivilegeEscalation: false\n requiredDropCapabilities:\n - ALL\n volumes:\n - 'configMap'\n - 'emptyDir'\n - 'projected'\n - 'secret'\n - 'downwardAPI'\n - 'csi'\n - 'persistentVolumeClaim'\n - 'ephemeral'\n hostNetwork: false\n hostIPC: false\n hostPID: false\n runAsUser:\n rule: 'MustRunAsNonRoot'\n seLinux:\n rule: 'RunAsAny'\n supplementalGroups:\n rule: 'MustRunAs'\n ranges:\n - min: 1\n max: 65535\n fsGroup:\n rule: 'MustRunAs'\n ranges:\n - min: 1\n max: 65535\n readOnlyRootFilesystem: false\n---\napiVersion: policy/v1beta1\nkind: PodSecurityPolicy\nmetadata:\n name: system-unrestricted-psp\n annotations:\n seccomp.security.alpha.kubernetes.io/allowedProfileNames: '*'\nspec:\n allowPrivilegeEscalation: true\n allowedCapabilities:\n - '*'\n fsGroup:\n rule: RunAsAny\n hostIPC: true\n hostNetwork: true\n hostPID: true\n hostPorts:\n - max: 65535\n min: 0\n privileged: true\n runAsUser:\n rule: RunAsAny\n seLinux:\n rule: RunAsAny\n supplementalGroups:\n rule: RunAsAny\n volumes:\n - '*'\n---\napiVersion: policy/v1beta1\nkind: PodSecurityPolicy\nmetadata:\n name: svclb-psp\n annotations:\n seccomp.security.alpha.kubernetes.io/allowedProfileNames: '*'\nspec:\n allowPrivilegeEscalation: false\n allowedCapabilities:\n - NET_ADMIN\n allowedUnsafeSysctls:\n - net.ipv4.ip_forward\n - net.ipv6.conf.all.forwarding\n fsGroup:\n rule: RunAsAny\n hostPorts:\n - max: 65535\n min: 0\n runAsUser:\n rule: RunAsAny\n seLinux:\n rule: RunAsAny\n supplementalGroups:\n rule: RunAsAny\n---\napiVersion: rbac.authorization.k8s.io/v1\nkind: ClusterRole\nmetadata:\n name: psp:restricted-psp\nrules:\n- apiGroups:\n - policy\n resources:\n - podsecuritypolicies\n verbs:\n - use\n resourceNames:\n - restricted-psp\n---\napiVersion: rbac.authorization.k8s.io/v1\nkind: ClusterRole\nmetadata:\n name: psp:system-unrestricted-psp\nrules:\n- apiGroups:\n - policy\n resources:\n - podsecuritypolicies\n resourceNames:\n - system-unrestricted-psp\n verbs:\n - use\n---\napiVersion: rbac.authorization.k8s.io/v1\nkind: ClusterRole\nmetadata:\n name: psp:svclb-psp\nrules:\n- apiGroups:\n - policy\n resources:\n - podsecuritypolicies\n resourceNames:\n - svclb-psp\n verbs:\n - use\n---\napiVersion: rbac.authorization.k8s.io/v1\nkind: ClusterRoleBinding\nmetadata:\n name: default:restricted-psp\nroleRef:\n apiGroup: rbac.authorization.k8s.io\n kind: ClusterRole\n name: psp:restricted-psp\nsubjects:\n- kind: Group\n name: system:authenticated\n apiGroup: rbac.authorization.k8s.io\n---\napiVersion: rbac.authorization.k8s.io/v1\nkind: ClusterRoleBinding\nmetadata:\n name: system-unrestricted-node-psp-rolebinding\nroleRef:\n apiGroup: rbac.authorization.k8s.io\n kind: ClusterRole\n name: psp:system-unrestricted-psp\nsubjects:\n- apiGroup: rbac.authorization.k8s.io\n kind: Group\n name: system:nodes\n---\napiVersion: rbac.authorization.k8s.io/v1\nkind: RoleBinding\nmetadata:\n name: system-unrestricted-svc-acct-psp-rolebinding\n namespace: kube-system\nroleRef:\n apiGroup: rbac.authorization.k8s.io\n kind: ClusterRole\n name: psp:system-unrestricted-psp\nsubjects:\n- apiGroup: rbac.authorization.k8s.io\n kind: Group\n name: system:serviceaccounts\n---\napiVersion: rbac.authorization.k8s.io/v1\nkind: RoleBinding\nmetadata:\n name: svclb-psp-rolebinding\n namespace: kube-system\nroleRef:\n apiGroup: rbac.authorization.k8s.io\n kind: ClusterRole\n name: psp:svclb-psp\nsubjects:\n- kind: ServiceAccount\n name: svclb\n---\nkind: NetworkPolicy\napiVersion: networking.k8s.io/v1\nmetadata:\n name: intra-namespace\n namespace: kube-system\nspec:\n podSelector: {}\n ingress:\n - from:\n - namespaceSelector:\n matchLabels:\n name: kube-system\n---\nkind: NetworkPolicy\napiVersion: networking.k8s.io/v1\nmetadata:\n name: intra-namespace\n namespace: default\nspec:\n podSelector: {}\n ingress:\n - from:\n - namespaceSelector:\n matchLabels:\n name: default\n---\nkind: NetworkPolicy\napiVersion: networking.k8s.io/v1\nmetadata:\n name: intra-namespace\n namespace: kube-public\nspec:\n podSelector: {}\n ingress:\n - from:\n - namespaceSelector:\n matchLabels:\n name: kube-public\n"})})]})]}),"\n",(0,i.jsxs)(n.blockquote,{children:["\n",(0,i.jsxs)(n.p,{children:[(0,i.jsx)(n.strong,{children:"Note:"})," The Kubernetes critical additions such as CNI, DNS, and Ingress are run as pods in the ",(0,i.jsx)(n.code,{children:"kube-system"})," namespace. Therefore, this namespace will have a policy that is less restrictive so that these components can run properly."]}),"\n"]}),"\n",(0,i.jsx)(n.h3,{id:"networkpolicies",children:"NetworkPolicies"}),"\n",(0,i.jsx)(n.p,{children:"CIS requires that all namespaces have a network policy applied that reasonably limits traffic into namespaces and pods."}),"\n",(0,i.jsxs)(n.p,{children:["Network policies should be placed the ",(0,i.jsx)(n.code,{children:"/var/lib/rancher/k3s/server/manifests"})," directory, where they will automatically be deployed on startup."]}),"\n",(0,i.jsx)(n.p,{children:"Here is an example of a compliant network policy."}),"\n",(0,i.jsx)(n.pre,{children:(0,i.jsx)(n.code,{className:"language-yaml",children:"kind: NetworkPolicy\napiVersion: networking.k8s.io/v1\nmetadata:\n name: intra-namespace\n namespace: kube-system\nspec:\n podSelector: {}\n ingress:\n - from:\n - namespaceSelector:\n matchLabels:\n name: kube-system\n"})}),"\n",(0,i.jsx)(n.p,{children:"With the applied restrictions, DNS will be blocked unless purposely allowed. Below is a network policy that will allow for traffic to exist for DNS."}),"\n",(0,i.jsx)(n.pre,{children:(0,i.jsx)(n.code,{className:"language-yaml",children:"apiVersion: networking.k8s.io/v1\nkind: NetworkPolicy\nmetadata:\n name: default-network-dns-policy\n namespace: \nspec:\n ingress:\n - ports:\n - port: 53\n protocol: TCP\n - port: 53\n protocol: UDP\n podSelector:\n matchLabels:\n k8s-app: kube-dns\n policyTypes:\n - Ingress\n"})}),"\n",(0,i.jsx)(n.p,{children:"The metrics-server and Traefik ingress controller will be blocked by default if network policies are not created to allow access. Traefik v1 as packaged in K3s version 1.20 and below uses different labels than Traefik v2. Ensure that you only use the sample yaml below that is associated with the version of Traefik present on your cluster."}),"\n",(0,i.jsxs)(a,{children:[(0,i.jsx)(t,{value:"v1.21 and Newer",default:!0,children:(0,i.jsx)(n.pre,{children:(0,i.jsx)(n.code,{className:"language-yaml",children:"apiVersion: networking.k8s.io/v1\nkind: NetworkPolicy\nmetadata:\n name: allow-all-metrics-server\n namespace: kube-system\nspec:\n podSelector:\n matchLabels:\n k8s-app: metrics-server\n ingress:\n - {}\n policyTypes:\n - Ingress\n---\napiVersion: networking.k8s.io/v1\nkind: NetworkPolicy\nmetadata:\n name: allow-all-svclbtraefik-ingress\n namespace: kube-system\nspec:\n podSelector: \n matchLabels:\n svccontroller.k3s.cattle.io/svcname: traefik\n ingress:\n - {}\n policyTypes:\n - Ingress\n---\napiVersion: networking.k8s.io/v1\nkind: NetworkPolicy\nmetadata:\n name: allow-all-traefik-v121-ingress\n namespace: kube-system\nspec:\n podSelector:\n matchLabels:\n app.kubernetes.io/name: traefik\n ingress:\n - {}\n policyTypes:\n - Ingress\n---\n\n"})})}),(0,i.jsx)(t,{value:"v1.20 and Older",default:!0,children:(0,i.jsx)(n.pre,{children:(0,i.jsx)(n.code,{className:"language-yaml",children:"apiVersion: networking.k8s.io/v1\nkind: NetworkPolicy\nmetadata:\n name: allow-all-metrics-server\n namespace: kube-system\nspec:\n podSelector:\n matchLabels:\n k8s-app: metrics-server\n ingress:\n - {}\n policyTypes:\n - Ingress\n---\napiVersion: networking.k8s.io/v1\nkind: NetworkPolicy\nmetadata:\n name: allow-all-svclbtraefik-ingress\n namespace: kube-system\nspec:\n podSelector: \n matchLabels:\n svccontroller.k3s.cattle.io/svcname: traefik\n ingress:\n - {}\n policyTypes:\n - Ingress\n---\napiVersion: networking.k8s.io/v1\nkind: NetworkPolicy\nmetadata:\n name: allow-all-traefik-v120-ingress\n namespace: kube-system\nspec:\n podSelector:\n matchLabels:\n app: traefik\n ingress:\n - {}\n policyTypes:\n - Ingress\n---\n\n"})})})]}),"\n",(0,i.jsx)(n.admonition,{type:"info",children:(0,i.jsx)(n.p,{children:"Operators must manage network policies as normal for additional namespaces that are created."})}),"\n",(0,i.jsx)(n.h3,{id:"api-server-audit-configuration",children:"API Server audit configuration"}),"\n",(0,i.jsx)(n.p,{children:"CIS requirements 1.2.22 to 1.2.25 are related to configuring audit logs for the API Server. K3s doesn't create by default the log directory and audit policy, as auditing requirements are specific to each user's policies and environment."}),"\n",(0,i.jsx)(n.p,{children:"The log directory, ideally, must be created before starting K3s. A restrictive access permission is recommended to avoid leaking potential sensitive information."}),"\n",(0,i.jsx)(n.pre,{children:(0,i.jsx)(n.code,{className:"language-bash",children:"sudo mkdir -p -m 700 /var/lib/rancher/k3s/server/logs\n"})}),"\n",(0,i.jsxs)(n.p,{children:["A starter audit policy to log request metadata is provided below. The policy should be written to a file named ",(0,i.jsx)(n.code,{children:"audit.yaml"})," in ",(0,i.jsx)(n.code,{children:"/var/lib/rancher/k3s/server"})," directory. Detailed information about policy configuration for the API server can be found in the Kubernetes ",(0,i.jsx)(n.a,{href:"https://kubernetes.io/docs/tasks/debug-application-cluster/audit/",children:"documentation"}),"."]}),"\n",(0,i.jsx)(n.pre,{children:(0,i.jsx)(n.code,{className:"language-yaml",children:"apiVersion: audit.k8s.io/v1\nkind: Policy\nrules:\n- level: Metadata\n"})}),"\n",(0,i.jsx)(n.p,{children:"Both configurations must be passed as arguments to the API Server as:"}),"\n",(0,i.jsxs)(a,{children:[(0,i.jsx)(t,{value:"config",children:(0,i.jsx)(n.pre,{children:(0,i.jsx)(n.code,{className:"language-yaml",children:"kube-apiserver-arg:\n - 'admission-control-config-file=/var/lib/rancher/k3s/server/psa.yaml'\n - 'audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log'\n - 'audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml'\n - 'audit-log-maxage=30'\n - 'audit-log-maxbackup=10'\n - 'audit-log-maxsize=100'\n"})})}),(0,i.jsx)(t,{value:"cmdline",children:(0,i.jsx)(n.pre,{children:(0,i.jsx)(n.code,{className:"language-bash",children:"--kube-apiserver-arg='audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log'\n--kube-apiserver-arg='audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml'\n"})})})]}),"\n",(0,i.jsx)(n.p,{children:"K3s must be restarted to load the new configuration."}),"\n",(0,i.jsx)(n.pre,{children:(0,i.jsx)(n.code,{className:"language-bash",children:"sudo systemctl daemon-reload\nsudo systemctl restart k3s.service\n"})}),"\n",(0,i.jsx)(n.h2,{id:"configuration-for-kubernetes-components",children:"Configuration for Kubernetes Components"}),"\n",(0,i.jsxs)(n.p,{children:["The configuration below should be placed in the ",(0,i.jsx)(n.a,{href:"/installation/configuration#configuration-file",children:"configuration file"}),", and contains all the necessary remediations to harden the Kubernetes components."]}),"\n",(0,i.jsxs)(a,{groupId:"pod-sec",queryString:!0,children:[(0,i.jsx)(t,{value:"v1.25 and Newer",default:!0,children:(0,i.jsx)(n.pre,{children:(0,i.jsx)(n.code,{className:"language-yaml",children:"protect-kernel-defaults: true\nsecrets-encryption: true\nkube-apiserver-arg:\n - \"enable-admission-plugins=NodeRestriction,EventRateLimit\"\n - 'admission-control-config-file=/var/lib/rancher/k3s/server/psa.yaml'\n - 'audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log'\n - 'audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml'\n - 'audit-log-maxage=30'\n - 'audit-log-maxbackup=10'\n - 'audit-log-maxsize=100'\nkube-controller-manager-arg:\n - 'terminated-pod-gc-threshold=10'\nkubelet-arg:\n - 'streaming-connection-idle-timeout=5m'\n - \"tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305\"\n"})})}),(0,i.jsx)(t,{value:"v1.24 and Older",default:!0,children:(0,i.jsx)(n.pre,{children:(0,i.jsx)(n.code,{className:"language-yaml",children:"protect-kernel-defaults: true\nsecrets-encryption: true\nkube-apiserver-arg:\n - 'enable-admission-plugins=NodeRestriction,PodSecurityPolicy,NamespaceLifecycle,ServiceAccount'\n - 'audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log'\n - 'audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml'\n - 'audit-log-maxage=30'\n - 'audit-log-maxbackup=10'\n - 'audit-log-maxsize=100'\nkube-controller-manager-arg:\n - 'terminated-pod-gc-threshold=10'\nkubelet-arg:\n - 'streaming-connection-idle-timeout=5m'\n - 'make-iptables-util-chains=true'\n - \"tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305\"\n"})})})]}),"\n",(0,i.jsx)(n.h2,{id:"manual-operations",children:"Manual Operations"}),"\n",(0,i.jsx)(n.p,{children:"The following are controls that K3s currently does not pass by with the above configuration applied. These controls require manual intervention to fully comply with the CIS Benchmark."}),"\n",(0,i.jsx)(n.h3,{id:"control-1120",children:"Control 1.1.20"}),"\n",(0,i.jsx)(n.p,{children:"Ensure that the Kubernetes PKI certificate file permissions are set to 600 or more restrictive (Manual)"}),"\n",(0,i.jsxs)(s,{children:[(0,i.jsxs)(n.p,{children:[(0,i.jsx)("summary",{children:"Remediation"}),"\nK3s PKI certificate files are stored in ",(0,i.jsx)(n.code,{children:"/var/lib/rancher/k3s/server/tls/"})," with permission 644.\nTo remediate, run the following command:"]}),(0,i.jsx)(n.pre,{children:(0,i.jsx)(n.code,{className:"language-bash",children:"chmod -R 600 /var/lib/rancher/k3s/server/tls/*.crt\n"})})]}),"\n",(0,i.jsx)(n.h3,{id:"control-129",children:"Control 1.2.9"}),"\n",(0,i.jsx)(n.p,{children:"Ensure that the admission control plugin EventRateLimit is set"}),"\n",(0,i.jsxs)(s,{children:[(0,i.jsxs)(n.p,{children:[(0,i.jsx)("summary",{children:"Remediation"}),"\nFollow the ",(0,i.jsx)(n.a,{href:"https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/#eventratelimit",children:"Kubernetes documentation"})," and set the desired limits in a configuration file.\nFor this and other psa configuration, this documentation uses /var/lib/rancher/k3s/server/psa.yaml.\nThen, edit the K3s config file /etc/rancher/k3s/config.yaml and set the below parameters."]}),(0,i.jsx)(n.pre,{children:(0,i.jsx)(n.code,{className:"language-yaml",children:'kube-apiserver-arg:\n - "enable-admission-plugins=NodeRestriction,EventRateLimit"\n - "admission-control-config-file=/var/lib/rancher/k3s/server/psa.yaml"\n'})})]}),"\n",(0,i.jsx)(n.h3,{id:"control-1211",children:"Control 1.2.11"}),"\n",(0,i.jsx)(n.p,{children:"Ensure that the admission control plugin AlwaysPullImages is set"}),"\n",(0,i.jsxs)(s,{children:[(0,i.jsxs)(n.p,{children:[(0,i.jsx)("summary",{children:"Remediation"}),'\nPermissive, per CIS guidelines,\n"This setting could impact offline or isolated clusters, which have images pre-loaded and\ndo not have access to a registry to pull in-use images. This setting is not appropriate for\nclusters which use this configuration."\nEdit the K3s config file /etc/rancher/k3s/config.yaml and set the below parameter.']}),(0,i.jsx)(n.pre,{children:(0,i.jsx)(n.code,{className:"language-yaml",children:'kube-apiserver-arg:\n - "enable-admission-plugins=...,AlwaysPullImages,..."\n'})})]}),"\n",(0,i.jsx)(n.h3,{id:"control-1221",children:"Control 1.2.21"}),"\n",(0,i.jsx)(n.p,{children:"Ensure that the --request-timeout argument is set as appropriate"}),"\n",(0,i.jsxs)(s,{children:[(0,i.jsxs)(n.p,{children:[(0,i.jsx)("summary",{children:"Remediation"}),'\nPermissive, per CIS guidelines,\n"it is recommended to set this limit as appropriate and change the default limit of 60 seconds only if needed".\nEdit the K3s config file /etc/rancher/k3s/config.yaml\nand set the below parameter if needed. For example,']}),(0,i.jsx)(n.pre,{children:(0,i.jsx)(n.code,{className:"language-yaml",children:'kube-apiserver-arg:\n - "request-timeout=300s"\n'})})]}),"\n",(0,i.jsx)(n.h3,{id:"control-4213",children:"Control 4.2.13"}),"\n",(0,i.jsx)(n.p,{children:"Ensure that a limit is set on pod PIDs"}),"\n",(0,i.jsxs)(s,{children:[(0,i.jsxs)(n.p,{children:[(0,i.jsx)("summary",{children:"Remediation"}),"\nDecide on an appropriate level for this parameter and set it,\nIf using a K3s config file /etc/rancher/k3s/config.yaml, edit the file to set ",(0,i.jsx)(n.code,{children:"podPidsLimit"})," to"]}),(0,i.jsx)(n.pre,{children:(0,i.jsx)(n.code,{className:"language-yaml",children:'kubelet-arg:\n - "pod-max-pids="\n'})})]}),"\n",(0,i.jsx)(n.h3,{id:"control-5x",children:"Control 5.X"}),"\n",(0,i.jsx)(n.p,{children:"All the 5.X Controls are related to Kubernetes policy configuration. These controls are not enforced by K3s by default."}),"\n",(0,i.jsxs)(n.p,{children:["Refer to ",(0,i.jsx)(n.a,{href:"/security/self-assessment-1.8#51-rbac-and-service-accounts",children:"CIS 1.8 Section 5"})," for more information on how to create and apply these policies."]}),"\n",(0,i.jsx)(n.h2,{id:"conclusion",children:"Conclusion"}),"\n",(0,i.jsxs)(n.p,{children:["If you have followed this guide, your K3s cluster will be configured to comply with the CIS Kubernetes Benchmark. You can review the ",(0,i.jsx)(n.a,{href:"/security/self-assessment-1.8",children:"CIS 1.8 Self-Assessment Guide"})," to understand the expectations of each of the benchmark's checks and how you can do the same on your cluster."]})]})}function u(e={}){const{wrapper:n}={...(0,r.a)(),...e.components};return n?(0,i.jsx)(n,{...e,children:(0,i.jsx)(d,{...e})}):d(e)}function p(e,n){throw new Error("Expected "+(n?"component":"object")+" `"+e+"` to be defined: you likely forgot to import, pass, or provide it.")}},1151:(e,n,s)=>{s.d(n,{Z:()=>o,a:()=>a});var i=s(7294);const r={},t=i.createContext(r);function a(e){const n=i.useContext(t);return i.useMemo((function(){return"function"==typeof e?e(n):{...n,...e}}),[n,e])}function o(e){let n;return n=e.disableParentContext?"function"==typeof e.components?e.components(r):e.components||r:a(e.components),i.createElement(t.Provider,{value:n},e.children)}}}]); \ No newline at end of file +"use strict";(self.webpackChunkk_3_s_docs=self.webpackChunkk_3_s_docs||[]).push([[7709],{1587:(e,n,s)=>{s.r(n),s.d(n,{assets:()=>l,contentTitle:()=>a,default:()=>u,frontMatter:()=>t,metadata:()=>o,toc:()=>c});var i=s(5893),r=s(1151);const t={title:"CIS Hardening Guide"},a=void 0,o={id:"security/hardening-guide",title:"CIS Hardening Guide",description:"This document provides prescriptive guidance for hardening a production installation of K3s. It outlines the configurations and controls required to address Kubernetes benchmark controls from the Center for Internet Security (CIS).",source:"@site/docs/security/hardening-guide.md",sourceDirName:"security",slug:"/security/hardening-guide",permalink:"/security/hardening-guide",draft:!1,unlisted:!1,editUrl:"https://github.com/k3s-io/docs/edit/main/docs/security/hardening-guide.md",tags:[],version:"current",lastUpdatedAt:1723747404e3,frontMatter:{title:"CIS Hardening Guide"},sidebar:"mySidebar",previous:{title:"Secrets Encryption",permalink:"/security/secrets-encryption"},next:{title:"CIS 1.8 Self Assessment Guide",permalink:"/security/self-assessment-1.8"}},l={},c=[{value:"Host-level Requirements",id:"host-level-requirements",level:2},{value:"Ensure protect-kernel-defaults is set",id:"ensure-protect-kernel-defaults-is-set",level:3},{value:"Set kernel parameters",id:"set-kernel-parameters",level:4},{value:"Kubernetes Runtime Requirements",id:"kubernetes-runtime-requirements",level:2},{value:"Pod Security",id:"pod-security",level:3},{value:"NetworkPolicies",id:"networkpolicies",level:3},{value:"API Server audit configuration",id:"api-server-audit-configuration",level:3},{value:"Configuration for Kubernetes Components",id:"configuration-for-kubernetes-components",level:2},{value:"Manual Operations",id:"manual-operations",level:2},{value:"Control 1.1.20",id:"control-1120",level:3},{value:"Control 1.2.9",id:"control-129",level:3},{value:"Control 1.2.11",id:"control-1211",level:3},{value:"Control 1.2.21",id:"control-1221",level:3},{value:"Control 4.2.13",id:"control-4213",level:3},{value:"Control 5.X",id:"control-5x",level:3},{value:"Conclusion",id:"conclusion",level:2}];function d(e){const n={a:"a",admonition:"admonition",blockquote:"blockquote",code:"code",h2:"h2",h3:"h3",h4:"h4",li:"li",ol:"ol",p:"p",pre:"pre",strong:"strong",...(0,r.a)(),...e.components},{Details:s,TabItem:t,Tabs:a}=n;return s||p("Details",!0),t||p("TabItem",!0),a||p("Tabs",!0),(0,i.jsxs)(i.Fragment,{children:[(0,i.jsx)(n.p,{children:"This document provides prescriptive guidance for hardening a production installation of K3s. It outlines the configurations and controls required to address Kubernetes benchmark controls from the Center for Internet Security (CIS)."}),"\n",(0,i.jsx)(n.p,{children:"K3s has a number of security mitigations applied and turned on by default and will pass a number of the Kubernetes CIS controls without modification. There are some notable exceptions to this that require manual intervention to fully comply with the CIS Benchmark:"}),"\n",(0,i.jsxs)(n.ol,{children:["\n",(0,i.jsx)(n.li,{children:"K3s will not modify the host operating system. Any host-level modifications will need to be done manually."}),"\n",(0,i.jsxs)(n.li,{children:["Certain CIS policy controls for ",(0,i.jsx)(n.code,{children:"NetworkPolicies"})," and ",(0,i.jsx)(n.code,{children:"PodSecurityStandards"})," (",(0,i.jsx)(n.code,{children:"PodSecurityPolicies"})," on v1.24 and older) will restrict the functionality of the cluster. You must opt into having K3s configure these by adding the appropriate options (enabling of admission plugins) to your command-line flags or configuration file as well as manually applying appropriate policies. Further details are presented in the sections below."]}),"\n"]}),"\n",(0,i.jsx)(n.p,{children:"The first section (1.1) of the CIS Benchmark concerns itself primarily with pod manifest permissions and ownership. K3s doesn't utilize these for the core components since everything is packaged into a single binary."}),"\n",(0,i.jsx)(n.h2,{id:"host-level-requirements",children:"Host-level Requirements"}),"\n",(0,i.jsx)(n.p,{children:"There are two areas of host-level requirements: kernel parameters and etcd process/directory configuration. These are outlined in this section."}),"\n",(0,i.jsxs)(n.h3,{id:"ensure-protect-kernel-defaults-is-set",children:["Ensure ",(0,i.jsx)(n.code,{children:"protect-kernel-defaults"})," is set"]}),"\n",(0,i.jsx)(n.p,{children:"This is a kubelet flag that will cause the kubelet to exit if the required kernel parameters are unset or are set to values that are different from the kubelet's defaults."}),"\n",(0,i.jsxs)(n.blockquote,{children:["\n",(0,i.jsxs)(n.p,{children:[(0,i.jsx)(n.strong,{children:"Note:"})," ",(0,i.jsx)(n.code,{children:"protect-kernel-defaults"})," is exposed as a top-level flag for K3s."]}),"\n"]}),"\n",(0,i.jsx)(n.h4,{id:"set-kernel-parameters",children:"Set kernel parameters"}),"\n",(0,i.jsxs)(n.p,{children:["Create a file called ",(0,i.jsx)(n.code,{children:"/etc/sysctl.d/90-kubelet.conf"})," and add the snippet below. Then run ",(0,i.jsx)(n.code,{children:"sysctl -p /etc/sysctl.d/90-kubelet.conf"}),"."]}),"\n",(0,i.jsx)(n.pre,{children:(0,i.jsx)(n.code,{className:"language-bash",children:"vm.panic_on_oom=0\nvm.overcommit_memory=1\nkernel.panic=10\nkernel.panic_on_oops=1\n"})}),"\n",(0,i.jsx)(n.h2,{id:"kubernetes-runtime-requirements",children:"Kubernetes Runtime Requirements"}),"\n",(0,i.jsx)(n.p,{children:"The runtime requirements to comply with the CIS Benchmark are centered around pod security (via PSP or PSA), network policies and API Server auditing logs. These are outlined in this section."}),"\n",(0,i.jsxs)(n.p,{children:["By default, K3s does not include any pod security or network policies. However, K3s ships with a controller that will enforce network policies, if any are created. K3s doesn't enable auditing by default, so audit log configuration and audit policy must be created manually. By default, K3s runs with the both the ",(0,i.jsx)(n.code,{children:"PodSecurity"})," and ",(0,i.jsx)(n.code,{children:"NodeRestriction"})," admission controllers enabled, among others."]}),"\n",(0,i.jsx)(n.h3,{id:"pod-security",children:"Pod Security"}),"\n",(0,i.jsxs)(a,{groupId:"pod-sec",queryString:!0,children:[(0,i.jsxs)(t,{value:"v1.25 and Newer",default:!0,children:[(0,i.jsxs)(n.p,{children:["K3s v1.25 and newer support ",(0,i.jsx)(n.a,{href:"https://kubernetes.io/docs/concepts/security/pod-security-admission/",children:"Pod Security Admissions (PSAs)"})," for controlling pod security. PSAs are enabled by passing the following flag to the K3s server:"]}),(0,i.jsx)(n.pre,{children:(0,i.jsx)(n.code,{children:'--kube-apiserver-arg="admission-control-config-file=/var/lib/rancher/k3s/server/psa.yaml"\n'})}),(0,i.jsxs)(n.p,{children:["The policy should be written to a file named ",(0,i.jsx)(n.code,{children:"psa.yaml"})," in ",(0,i.jsx)(n.code,{children:"/var/lib/rancher/k3s/server"})," directory."]}),(0,i.jsx)(n.p,{children:"Here is an example of a compliant PSA:"}),(0,i.jsx)(n.pre,{children:(0,i.jsx)(n.code,{className:"language-yaml",children:'apiVersion: apiserver.config.k8s.io/v1\nkind: AdmissionConfiguration\nplugins:\n- name: PodSecurity\n configuration:\n apiVersion: pod-security.admission.config.k8s.io/v1beta1\n kind: PodSecurityConfiguration\n defaults:\n enforce: "restricted"\n enforce-version: "latest"\n audit: "restricted"\n audit-version: "latest"\n warn: "restricted"\n warn-version: "latest"\n exemptions:\n usernames: []\n runtimeClasses: []\n namespaces: [kube-system, cis-operator-system]\n'})})]}),(0,i.jsxs)(t,{value:"v1.24 and Older",default:!0,children:[(0,i.jsxs)(n.p,{children:["K3s v1.24 and older support ",(0,i.jsx)(n.a,{href:"https://kubernetes.io/docs/concepts/security/pod-security-policy/",children:"Pod Security Policies (PSPs)"})," for controlling pod security. PSPs are enabled by passing the following flag to the K3s server:"]}),(0,i.jsx)(n.pre,{children:(0,i.jsx)(n.code,{children:'--kube-apiserver-arg="enable-admission-plugins=NodeRestriction,PodSecurityPolicy"\n'})}),(0,i.jsxs)(n.p,{children:["This will have the effect of maintaining the ",(0,i.jsx)(n.code,{children:"NodeRestriction"})," plugin as well as enabling the ",(0,i.jsx)(n.code,{children:"PodSecurityPolicy"}),"."]}),(0,i.jsx)(n.p,{children:"When PSPs are enabled, a policy can be applied to satisfy the necessary controls described in section 5.2 of the CIS Benchmark."}),(0,i.jsx)(n.p,{children:"Here is an example of a compliant PSP:"}),(0,i.jsx)(n.pre,{children:(0,i.jsx)(n.code,{className:"language-yaml",children:"apiVersion: policy/v1beta1\nkind: PodSecurityPolicy\nmetadata:\n name: restricted-psp\nspec:\n privileged: false # CIS - 5.2.1\n allowPrivilegeEscalation: false # CIS - 5.2.5\n requiredDropCapabilities: # CIS - 5.2.7/8/9\n - ALL\n volumes:\n - 'configMap'\n - 'emptyDir'\n - 'projected'\n - 'secret'\n - 'downwardAPI'\n - 'csi'\n - 'persistentVolumeClaim'\n - 'ephemeral'\n hostNetwork: false # CIS - 5.2.4\n hostIPC: false # CIS - 5.2.3\n hostPID: false # CIS - 5.2.2\n runAsUser:\n rule: 'MustRunAsNonRoot' # CIS - 5.2.6\n seLinux:\n rule: 'RunAsAny'\n supplementalGroups:\n rule: 'MustRunAs'\n ranges:\n - min: 1\n max: 65535\n fsGroup:\n rule: 'MustRunAs'\n ranges:\n - min: 1\n max: 65535\n readOnlyRootFilesystem: false\n"})}),(0,i.jsx)(n.p,{children:'For the above PSP to be effective, we need to create a ClusterRole and a ClusterRoleBinding. We also need to include a "system unrestricted policy" which is needed for system-level pods that require additional privileges, and an additional policy that allows sysctls necessary for servicelb to function properly.'}),(0,i.jsxs)(n.p,{children:["Combining the configuration above with the ",(0,i.jsx)(n.a,{href:"#networkpolicies",children:"Network Policy"})," described in the next section, a single file can be placed in the ",(0,i.jsx)(n.code,{children:"/var/lib/rancher/k3s/server/manifests"})," directory. Here is an example of a ",(0,i.jsx)(n.code,{children:"policy.yaml"})," file:"]}),(0,i.jsx)(n.pre,{children:(0,i.jsx)(n.code,{className:"language-yaml",children:"apiVersion: policy/v1beta1\nkind: PodSecurityPolicy\nmetadata:\n name: restricted-psp\nspec:\n privileged: false\n allowPrivilegeEscalation: false\n requiredDropCapabilities:\n - ALL\n volumes:\n - 'configMap'\n - 'emptyDir'\n - 'projected'\n - 'secret'\n - 'downwardAPI'\n - 'csi'\n - 'persistentVolumeClaim'\n - 'ephemeral'\n hostNetwork: false\n hostIPC: false\n hostPID: false\n runAsUser:\n rule: 'MustRunAsNonRoot'\n seLinux:\n rule: 'RunAsAny'\n supplementalGroups:\n rule: 'MustRunAs'\n ranges:\n - min: 1\n max: 65535\n fsGroup:\n rule: 'MustRunAs'\n ranges:\n - min: 1\n max: 65535\n readOnlyRootFilesystem: false\n---\napiVersion: policy/v1beta1\nkind: PodSecurityPolicy\nmetadata:\n name: system-unrestricted-psp\n annotations:\n seccomp.security.alpha.kubernetes.io/allowedProfileNames: '*'\nspec:\n allowPrivilegeEscalation: true\n allowedCapabilities:\n - '*'\n fsGroup:\n rule: RunAsAny\n hostIPC: true\n hostNetwork: true\n hostPID: true\n hostPorts:\n - max: 65535\n min: 0\n privileged: true\n runAsUser:\n rule: RunAsAny\n seLinux:\n rule: RunAsAny\n supplementalGroups:\n rule: RunAsAny\n volumes:\n - '*'\n---\napiVersion: policy/v1beta1\nkind: PodSecurityPolicy\nmetadata:\n name: svclb-psp\n annotations:\n seccomp.security.alpha.kubernetes.io/allowedProfileNames: '*'\nspec:\n allowPrivilegeEscalation: false\n allowedCapabilities:\n - NET_ADMIN\n allowedUnsafeSysctls:\n - net.ipv4.ip_forward\n - net.ipv6.conf.all.forwarding\n fsGroup:\n rule: RunAsAny\n hostPorts:\n - max: 65535\n min: 0\n runAsUser:\n rule: RunAsAny\n seLinux:\n rule: RunAsAny\n supplementalGroups:\n rule: RunAsAny\n---\napiVersion: rbac.authorization.k8s.io/v1\nkind: ClusterRole\nmetadata:\n name: psp:restricted-psp\nrules:\n- apiGroups:\n - policy\n resources:\n - podsecuritypolicies\n verbs:\n - use\n resourceNames:\n - restricted-psp\n---\napiVersion: rbac.authorization.k8s.io/v1\nkind: ClusterRole\nmetadata:\n name: psp:system-unrestricted-psp\nrules:\n- apiGroups:\n - policy\n resources:\n - podsecuritypolicies\n resourceNames:\n - system-unrestricted-psp\n verbs:\n - use\n---\napiVersion: rbac.authorization.k8s.io/v1\nkind: ClusterRole\nmetadata:\n name: psp:svclb-psp\nrules:\n- apiGroups:\n - policy\n resources:\n - podsecuritypolicies\n resourceNames:\n - svclb-psp\n verbs:\n - use\n---\napiVersion: rbac.authorization.k8s.io/v1\nkind: ClusterRoleBinding\nmetadata:\n name: default:restricted-psp\nroleRef:\n apiGroup: rbac.authorization.k8s.io\n kind: ClusterRole\n name: psp:restricted-psp\nsubjects:\n- kind: Group\n name: system:authenticated\n apiGroup: rbac.authorization.k8s.io\n---\napiVersion: rbac.authorization.k8s.io/v1\nkind: ClusterRoleBinding\nmetadata:\n name: system-unrestricted-node-psp-rolebinding\nroleRef:\n apiGroup: rbac.authorization.k8s.io\n kind: ClusterRole\n name: psp:system-unrestricted-psp\nsubjects:\n- apiGroup: rbac.authorization.k8s.io\n kind: Group\n name: system:nodes\n---\napiVersion: rbac.authorization.k8s.io/v1\nkind: RoleBinding\nmetadata:\n name: system-unrestricted-svc-acct-psp-rolebinding\n namespace: kube-system\nroleRef:\n apiGroup: rbac.authorization.k8s.io\n kind: ClusterRole\n name: psp:system-unrestricted-psp\nsubjects:\n- apiGroup: rbac.authorization.k8s.io\n kind: Group\n name: system:serviceaccounts\n---\napiVersion: rbac.authorization.k8s.io/v1\nkind: RoleBinding\nmetadata:\n name: svclb-psp-rolebinding\n namespace: kube-system\nroleRef:\n apiGroup: rbac.authorization.k8s.io\n kind: ClusterRole\n name: psp:svclb-psp\nsubjects:\n- kind: ServiceAccount\n name: svclb\n---\nkind: NetworkPolicy\napiVersion: networking.k8s.io/v1\nmetadata:\n name: intra-namespace\n namespace: kube-system\nspec:\n podSelector: {}\n ingress:\n - from:\n - namespaceSelector:\n matchLabels:\n name: kube-system\n---\nkind: NetworkPolicy\napiVersion: networking.k8s.io/v1\nmetadata:\n name: intra-namespace\n namespace: default\nspec:\n podSelector: {}\n ingress:\n - from:\n - namespaceSelector:\n matchLabels:\n name: default\n---\nkind: NetworkPolicy\napiVersion: networking.k8s.io/v1\nmetadata:\n name: intra-namespace\n namespace: kube-public\nspec:\n podSelector: {}\n ingress:\n - from:\n - namespaceSelector:\n matchLabels:\n name: kube-public\n"})})]})]}),"\n",(0,i.jsxs)(n.blockquote,{children:["\n",(0,i.jsxs)(n.p,{children:[(0,i.jsx)(n.strong,{children:"Note:"})," The Kubernetes critical additions such as CNI, DNS, and Ingress are run as pods in the ",(0,i.jsx)(n.code,{children:"kube-system"})," namespace. Therefore, this namespace will have a policy that is less restrictive so that these components can run properly."]}),"\n"]}),"\n",(0,i.jsx)(n.h3,{id:"networkpolicies",children:"NetworkPolicies"}),"\n",(0,i.jsx)(n.p,{children:"CIS requires that all namespaces have a network policy applied that reasonably limits traffic into namespaces and pods."}),"\n",(0,i.jsxs)(n.p,{children:["Network policies should be placed the ",(0,i.jsx)(n.code,{children:"/var/lib/rancher/k3s/server/manifests"})," directory, where they will automatically be deployed on startup."]}),"\n",(0,i.jsx)(n.p,{children:"Here is an example of a compliant network policy."}),"\n",(0,i.jsx)(n.pre,{children:(0,i.jsx)(n.code,{className:"language-yaml",children:"kind: NetworkPolicy\napiVersion: networking.k8s.io/v1\nmetadata:\n name: intra-namespace\n namespace: kube-system\nspec:\n podSelector: {}\n ingress:\n - from:\n - namespaceSelector:\n matchLabels:\n name: kube-system\n"})}),"\n",(0,i.jsx)(n.p,{children:"With the applied restrictions, DNS will be blocked unless purposely allowed. Below is a network policy that will allow for traffic to exist for DNS."}),"\n",(0,i.jsx)(n.pre,{children:(0,i.jsx)(n.code,{className:"language-yaml",children:"apiVersion: networking.k8s.io/v1\nkind: NetworkPolicy\nmetadata:\n name: default-network-dns-policy\n namespace: \nspec:\n ingress:\n - ports:\n - port: 53\n protocol: TCP\n - port: 53\n protocol: UDP\n podSelector:\n matchLabels:\n k8s-app: kube-dns\n policyTypes:\n - Ingress\n"})}),"\n",(0,i.jsx)(n.p,{children:"The metrics-server and Traefik ingress controller will be blocked by default if network policies are not created to allow access. Traefik v1 as packaged in K3s version 1.20 and below uses different labels than Traefik v2. Ensure that you only use the sample yaml below that is associated with the version of Traefik present on your cluster."}),"\n",(0,i.jsxs)(a,{children:[(0,i.jsx)(t,{value:"v1.21 and Newer",default:!0,children:(0,i.jsx)(n.pre,{children:(0,i.jsx)(n.code,{className:"language-yaml",children:"apiVersion: networking.k8s.io/v1\nkind: NetworkPolicy\nmetadata:\n name: allow-all-metrics-server\n namespace: kube-system\nspec:\n podSelector:\n matchLabels:\n k8s-app: metrics-server\n ingress:\n - {}\n policyTypes:\n - Ingress\n---\napiVersion: networking.k8s.io/v1\nkind: NetworkPolicy\nmetadata:\n name: allow-all-svclbtraefik-ingress\n namespace: kube-system\nspec:\n podSelector: \n matchLabels:\n svccontroller.k3s.cattle.io/svcname: traefik\n ingress:\n - {}\n policyTypes:\n - Ingress\n---\napiVersion: networking.k8s.io/v1\nkind: NetworkPolicy\nmetadata:\n name: allow-all-traefik-v121-ingress\n namespace: kube-system\nspec:\n podSelector:\n matchLabels:\n app.kubernetes.io/name: traefik\n ingress:\n - {}\n policyTypes:\n - Ingress\n---\n\n"})})}),(0,i.jsx)(t,{value:"v1.20 and Older",default:!0,children:(0,i.jsx)(n.pre,{children:(0,i.jsx)(n.code,{className:"language-yaml",children:"apiVersion: networking.k8s.io/v1\nkind: NetworkPolicy\nmetadata:\n name: allow-all-metrics-server\n namespace: kube-system\nspec:\n podSelector:\n matchLabels:\n k8s-app: metrics-server\n ingress:\n - {}\n policyTypes:\n - Ingress\n---\napiVersion: networking.k8s.io/v1\nkind: NetworkPolicy\nmetadata:\n name: allow-all-svclbtraefik-ingress\n namespace: kube-system\nspec:\n podSelector: \n matchLabels:\n svccontroller.k3s.cattle.io/svcname: traefik\n ingress:\n - {}\n policyTypes:\n - Ingress\n---\napiVersion: networking.k8s.io/v1\nkind: NetworkPolicy\nmetadata:\n name: allow-all-traefik-v120-ingress\n namespace: kube-system\nspec:\n podSelector:\n matchLabels:\n app: traefik\n ingress:\n - {}\n policyTypes:\n - Ingress\n---\n\n"})})})]}),"\n",(0,i.jsx)(n.admonition,{type:"info",children:(0,i.jsx)(n.p,{children:"Operators must manage network policies as normal for additional namespaces that are created."})}),"\n",(0,i.jsx)(n.h3,{id:"api-server-audit-configuration",children:"API Server audit configuration"}),"\n",(0,i.jsx)(n.p,{children:"CIS requirements 1.2.22 to 1.2.25 are related to configuring audit logs for the API Server. K3s doesn't create by default the log directory and audit policy, as auditing requirements are specific to each user's policies and environment."}),"\n",(0,i.jsx)(n.p,{children:"The log directory, ideally, must be created before starting K3s. A restrictive access permission is recommended to avoid leaking potential sensitive information."}),"\n",(0,i.jsx)(n.pre,{children:(0,i.jsx)(n.code,{className:"language-bash",children:"sudo mkdir -p -m 700 /var/lib/rancher/k3s/server/logs\n"})}),"\n",(0,i.jsxs)(n.p,{children:["A starter audit policy to log request metadata is provided below. The policy should be written to a file named ",(0,i.jsx)(n.code,{children:"audit.yaml"})," in ",(0,i.jsx)(n.code,{children:"/var/lib/rancher/k3s/server"})," directory. Detailed information about policy configuration for the API server can be found in the Kubernetes ",(0,i.jsx)(n.a,{href:"https://kubernetes.io/docs/tasks/debug-application-cluster/audit/",children:"documentation"}),"."]}),"\n",(0,i.jsx)(n.pre,{children:(0,i.jsx)(n.code,{className:"language-yaml",children:"apiVersion: audit.k8s.io/v1\nkind: Policy\nrules:\n- level: Metadata\n"})}),"\n",(0,i.jsx)(n.p,{children:"Both configurations must be passed as arguments to the API Server as:"}),"\n",(0,i.jsxs)(a,{children:[(0,i.jsx)(t,{value:"config",children:(0,i.jsx)(n.pre,{children:(0,i.jsx)(n.code,{className:"language-yaml",children:"kube-apiserver-arg:\n - 'admission-control-config-file=/var/lib/rancher/k3s/server/psa.yaml'\n - 'audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log'\n - 'audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml'\n - 'audit-log-maxage=30'\n - 'audit-log-maxbackup=10'\n - 'audit-log-maxsize=100'\n"})})}),(0,i.jsx)(t,{value:"cmdline",children:(0,i.jsx)(n.pre,{children:(0,i.jsx)(n.code,{className:"language-bash",children:"--kube-apiserver-arg='audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log'\n--kube-apiserver-arg='audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml'\n"})})})]}),"\n",(0,i.jsx)(n.p,{children:"K3s must be restarted to load the new configuration."}),"\n",(0,i.jsx)(n.pre,{children:(0,i.jsx)(n.code,{className:"language-bash",children:"sudo systemctl daemon-reload\nsudo systemctl restart k3s.service\n"})}),"\n",(0,i.jsx)(n.h2,{id:"configuration-for-kubernetes-components",children:"Configuration for Kubernetes Components"}),"\n",(0,i.jsxs)(n.p,{children:["The configuration below should be placed in the ",(0,i.jsx)(n.a,{href:"/installation/configuration#configuration-file",children:"configuration file"}),", and contains all the necessary remediations to harden the Kubernetes components."]}),"\n",(0,i.jsxs)(a,{groupId:"pod-sec",queryString:!0,children:[(0,i.jsx)(t,{value:"v1.25 and Newer",default:!0,children:(0,i.jsx)(n.pre,{children:(0,i.jsx)(n.code,{className:"language-yaml",children:"protect-kernel-defaults: true\nsecrets-encryption: true\nkube-apiserver-arg:\n - \"enable-admission-plugins=NodeRestriction,EventRateLimit\"\n - 'admission-control-config-file=/var/lib/rancher/k3s/server/psa.yaml'\n - 'audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log'\n - 'audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml'\n - 'audit-log-maxage=30'\n - 'audit-log-maxbackup=10'\n - 'audit-log-maxsize=100'\nkube-controller-manager-arg:\n - 'terminated-pod-gc-threshold=10'\nkubelet-arg:\n - 'streaming-connection-idle-timeout=5m'\n - \"tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305\"\n"})})}),(0,i.jsx)(t,{value:"v1.24 and Older",default:!0,children:(0,i.jsx)(n.pre,{children:(0,i.jsx)(n.code,{className:"language-yaml",children:"protect-kernel-defaults: true\nsecrets-encryption: true\nkube-apiserver-arg:\n - 'enable-admission-plugins=NodeRestriction,PodSecurityPolicy,NamespaceLifecycle,ServiceAccount'\n - 'audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log'\n - 'audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml'\n - 'audit-log-maxage=30'\n - 'audit-log-maxbackup=10'\n - 'audit-log-maxsize=100'\nkube-controller-manager-arg:\n - 'terminated-pod-gc-threshold=10'\nkubelet-arg:\n - 'streaming-connection-idle-timeout=5m'\n - 'make-iptables-util-chains=true'\n - \"tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305\"\n"})})})]}),"\n",(0,i.jsx)(n.h2,{id:"manual-operations",children:"Manual Operations"}),"\n",(0,i.jsx)(n.p,{children:"The following are controls that K3s currently does not pass by with the above configuration applied. These controls require manual intervention to fully comply with the CIS Benchmark."}),"\n",(0,i.jsx)(n.h3,{id:"control-1120",children:"Control 1.1.20"}),"\n",(0,i.jsx)(n.p,{children:"Ensure that the Kubernetes PKI certificate file permissions are set to 600 or more restrictive (Manual)"}),"\n",(0,i.jsxs)(s,{children:[(0,i.jsxs)(n.p,{children:[(0,i.jsx)("summary",{children:"Remediation"}),"\nK3s PKI certificate files are stored in ",(0,i.jsx)(n.code,{children:"/var/lib/rancher/k3s/server/tls/"})," with permission 644.\nTo remediate, run the following command:"]}),(0,i.jsx)(n.pre,{children:(0,i.jsx)(n.code,{className:"language-bash",children:"chmod -R 600 /var/lib/rancher/k3s/server/tls/*.crt\n"})})]}),"\n",(0,i.jsx)(n.h3,{id:"control-129",children:"Control 1.2.9"}),"\n",(0,i.jsx)(n.p,{children:"Ensure that the admission control plugin EventRateLimit is set"}),"\n",(0,i.jsxs)(s,{children:[(0,i.jsxs)(n.p,{children:[(0,i.jsx)("summary",{children:"Remediation"}),"\nFollow the ",(0,i.jsx)(n.a,{href:"https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/#eventratelimit",children:"Kubernetes documentation"})," and set the desired limits in a configuration file.\nFor this and other psa configuration, this documentation uses /var/lib/rancher/k3s/server/psa.yaml.\nThen, edit the K3s config file /etc/rancher/k3s/config.yaml and set the below parameters."]}),(0,i.jsx)(n.pre,{children:(0,i.jsx)(n.code,{className:"language-yaml",children:'kube-apiserver-arg:\n - "enable-admission-plugins=NodeRestriction,EventRateLimit"\n - "admission-control-config-file=/var/lib/rancher/k3s/server/psa.yaml"\n'})})]}),"\n",(0,i.jsx)(n.h3,{id:"control-1211",children:"Control 1.2.11"}),"\n",(0,i.jsx)(n.p,{children:"Ensure that the admission control plugin AlwaysPullImages is set"}),"\n",(0,i.jsxs)(s,{children:[(0,i.jsxs)(n.p,{children:[(0,i.jsx)("summary",{children:"Remediation"}),'\nPermissive, per CIS guidelines,\n"This setting could impact offline or isolated clusters, which have images pre-loaded and\ndo not have access to a registry to pull in-use images. This setting is not appropriate for\nclusters which use this configuration."\nEdit the K3s config file /etc/rancher/k3s/config.yaml and set the below parameter.']}),(0,i.jsx)(n.pre,{children:(0,i.jsx)(n.code,{className:"language-yaml",children:'kube-apiserver-arg:\n - "enable-admission-plugins=...,AlwaysPullImages,..."\n'})})]}),"\n",(0,i.jsx)(n.h3,{id:"control-1221",children:"Control 1.2.21"}),"\n",(0,i.jsx)(n.p,{children:"Ensure that the --request-timeout argument is set as appropriate"}),"\n",(0,i.jsxs)(s,{children:[(0,i.jsxs)(n.p,{children:[(0,i.jsx)("summary",{children:"Remediation"}),'\nPermissive, per CIS guidelines,\n"it is recommended to set this limit as appropriate and change the default limit of 60 seconds only if needed".\nEdit the K3s config file /etc/rancher/k3s/config.yaml\nand set the below parameter if needed. For example,']}),(0,i.jsx)(n.pre,{children:(0,i.jsx)(n.code,{className:"language-yaml",children:'kube-apiserver-arg:\n - "request-timeout=300s"\n'})})]}),"\n",(0,i.jsx)(n.h3,{id:"control-4213",children:"Control 4.2.13"}),"\n",(0,i.jsx)(n.p,{children:"Ensure that a limit is set on pod PIDs"}),"\n",(0,i.jsxs)(s,{children:[(0,i.jsxs)(n.p,{children:[(0,i.jsx)("summary",{children:"Remediation"}),"\nDecide on an appropriate level for this parameter and set it,\nIf using a K3s config file /etc/rancher/k3s/config.yaml, edit the file to set ",(0,i.jsx)(n.code,{children:"podPidsLimit"})," to"]}),(0,i.jsx)(n.pre,{children:(0,i.jsx)(n.code,{className:"language-yaml",children:'kubelet-arg:\n - "pod-max-pids="\n'})})]}),"\n",(0,i.jsx)(n.h3,{id:"control-5x",children:"Control 5.X"}),"\n",(0,i.jsx)(n.p,{children:"All the 5.X Controls are related to Kubernetes policy configuration. These controls are not enforced by K3s by default."}),"\n",(0,i.jsxs)(n.p,{children:["Refer to ",(0,i.jsx)(n.a,{href:"/security/self-assessment-1.8#51-rbac-and-service-accounts",children:"CIS 1.8 Section 5"})," for more information on how to create and apply these policies."]}),"\n",(0,i.jsx)(n.h2,{id:"conclusion",children:"Conclusion"}),"\n",(0,i.jsxs)(n.p,{children:["If you have followed this guide, your K3s cluster will be configured to comply with the CIS Kubernetes Benchmark. You can review the ",(0,i.jsx)(n.a,{href:"/security/self-assessment-1.8",children:"CIS 1.8 Self-Assessment Guide"})," to understand the expectations of each of the benchmark's checks and how you can do the same on your cluster."]})]})}function u(e={}){const{wrapper:n}={...(0,r.a)(),...e.components};return n?(0,i.jsx)(n,{...e,children:(0,i.jsx)(d,{...e})}):d(e)}function p(e,n){throw new Error("Expected "+(n?"component":"object")+" `"+e+"` to be defined: you likely forgot to import, pass, or provide it.")}},1151:(e,n,s)=>{s.d(n,{Z:()=>o,a:()=>a});var i=s(7294);const r={},t=i.createContext(r);function a(e){const n=i.useContext(t);return i.useMemo((function(){return"function"==typeof e?e(n):{...n,...e}}),[n,e])}function o(e){let n;return n=e.disableParentContext?"function"==typeof e.components?e.components(r):e.components||r:a(e.components),i.createElement(t.Provider,{value:n},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/914a16f4.c42ed805.js b/assets/js/914a16f4.5cd97920.js similarity index 98% rename from assets/js/914a16f4.c42ed805.js rename to assets/js/914a16f4.5cd97920.js index 3b9150886..259354162 100644 --- a/assets/js/914a16f4.c42ed805.js +++ b/assets/js/914a16f4.5cd97920.js @@ -1 +1 @@ -"use strict";(self.webpackChunkk_3_s_docs=self.webpackChunkk_3_s_docs||[]).push([[7626],{6050:(e,n,o)=>{o.r(n),o.d(n,{assets:()=>l,contentTitle:()=>s,default:()=>p,frontMatter:()=>i,metadata:()=>a,toc:()=>c});var r=o(5893),t=o(1151);const i={title:"Flag Deprecation"},s=void 0,a={id:"reference/flag-deprecation",title:"Flag Deprecation",description:"K3s is a fast-moving project, and as such, we need a way to deprecate flags and configuration options. This page outlines the process for deprecating flags and configuration options. In order to ensure that users are not surprised by the removal of flags, the process is similar to the Kubernetes Deprecation Policy.",source:"@site/docs/reference/flag-deprecation.md",sourceDirName:"reference",slug:"/reference/flag-deprecation",permalink:"/reference/flag-deprecation",draft:!1,unlisted:!1,editUrl:"https://github.com/k3s-io/docs/edit/main/docs/reference/flag-deprecation.md",tags:[],version:"current",lastUpdatedAt:1723651727e3,frontMatter:{title:"Flag Deprecation"},sidebar:"mySidebar",previous:{title:"Environment Variables",permalink:"/reference/env-variables"},next:{title:"Resource Profiling",permalink:"/reference/resource-profiling"}},l={},c=[{value:"Process",id:"process",level:2},{value:"Example",id:"example",level:2}];function d(e){const n={a:"a",code:"code",h2:"h2",li:"li",ol:"ol",p:"p",pre:"pre",ul:"ul",...(0,t.a)(),...e.components};return(0,r.jsxs)(r.Fragment,{children:[(0,r.jsxs)(n.p,{children:["K3s is a fast-moving project, and as such, we need a way to deprecate flags and configuration options. This page outlines the process for deprecating flags and configuration options. In order to ensure that users are not surprised by the removal of flags, the process is similar to the ",(0,r.jsx)(n.a,{href:"https://kubernetes.io/docs/reference/using-api/deprecation-policy/",children:"Kubernetes Deprecation Policy"}),"."]}),"\n",(0,r.jsx)(n.h2,{id:"process",children:"Process"}),"\n",(0,r.jsxs)(n.ol,{children:["\n",(0,r.jsx)(n.li,{children:'Flags can be declared as "To Be Deprecated" at any time.'}),"\n",(0,r.jsx)(n.li,{children:'Flags that are "To Be Deprecated" must be labeled as such on the next patch of all currently supported releases. Additionally, the flag will begin to warn users that it is going to be deprecated in the next minor release.'}),"\n",(0,r.jsx)(n.li,{children:"On the next minor release, a flag will be marked as deprecated in the documentation and converted to a hidden flag in code. The flag will continue to operate and give warnings to users."}),"\n",(0,r.jsx)(n.li,{children:'In the following minor release branch, deprecated flags will become "nonoperational", causing a fatal error if used. This error must explain to the user any new flags or configuration that replace this flag.'}),"\n",(0,r.jsx)(n.li,{children:"In the next minor release, the nonoperational flags will be removed from documentation and code."}),"\n"]}),"\n",(0,r.jsx)(n.h2,{id:"example",children:"Example"}),"\n",(0,r.jsx)(n.p,{children:"An example of the process:"}),"\n",(0,r.jsxs)(n.ul,{children:["\n",(0,r.jsxs)(n.li,{children:[(0,r.jsx)(n.code,{children:"--foo"})," exists in v1.22.14, v1.23.10, and v1.24.2."]}),"\n",(0,r.jsxs)(n.li,{children:["After the v1.24.2 release, it is decided to deprecate ",(0,r.jsx)(n.code,{children:"--foo"})," in favor of ",(0,r.jsx)(n.code,{children:"--new-foo"}),"."]}),"\n",(0,r.jsxs)(n.li,{children:["In v1.22.15, v1.23.11, and v1.24.3, ",(0,r.jsx)(n.code,{children:"--foo"})," continues to exist, but will warn users:","\n",(0,r.jsx)(n.pre,{children:(0,r.jsx)(n.code,{children:"[Warning] --foo will be deprecated in v1.25.0, use `--new-foo` instead\n"})}),"\n",(0,r.jsx)(n.code,{children:"--foo"})," will continue to exist as an operational flag for the life of v1.22, v1.23 and v1.24."]}),"\n",(0,r.jsxs)(n.li,{children:["In v1.25.0, ",(0,r.jsx)(n.code,{children:"--foo"})," is marked as deprecated in documentation and will be hidden in code. It will continue to work and warn users to move to ",(0,r.jsx)(n.code,{children:"--new-foo"}),"."]}),"\n",(0,r.jsxs)(n.li,{children:["In v1.26.0, ",(0,r.jsx)(n.code,{children:"--foo"})," will cause a fatal error if used. The error message will say:","\n",(0,r.jsx)(n.pre,{children:(0,r.jsx)(n.code,{children:"[Fatal] exit 1: --foo is no longer supported, use --new-foo instead\n"})}),"\n"]}),"\n",(0,r.jsxs)(n.li,{children:["In v1.27.0, ",(0,r.jsx)(n.code,{children:"--foo"})," will be removed completely from all code and documentation."]}),"\n"]})]})}function p(e={}){const{wrapper:n}={...(0,t.a)(),...e.components};return n?(0,r.jsx)(n,{...e,children:(0,r.jsx)(d,{...e})}):d(e)}},1151:(e,n,o)=>{o.d(n,{Z:()=>a,a:()=>s});var r=o(7294);const t={},i=r.createContext(t);function s(e){const n=r.useContext(i);return r.useMemo((function(){return"function"==typeof e?e(n):{...n,...e}}),[n,e])}function a(e){let n;return n=e.disableParentContext?"function"==typeof e.components?e.components(t):e.components||t:s(e.components),r.createElement(i.Provider,{value:n},e.children)}}}]); \ No newline at end of file +"use strict";(self.webpackChunkk_3_s_docs=self.webpackChunkk_3_s_docs||[]).push([[7626],{6050:(e,n,o)=>{o.r(n),o.d(n,{assets:()=>l,contentTitle:()=>s,default:()=>p,frontMatter:()=>i,metadata:()=>a,toc:()=>c});var r=o(5893),t=o(1151);const i={title:"Flag Deprecation"},s=void 0,a={id:"reference/flag-deprecation",title:"Flag Deprecation",description:"K3s is a fast-moving project, and as such, we need a way to deprecate flags and configuration options. This page outlines the process for deprecating flags and configuration options. In order to ensure that users are not surprised by the removal of flags, the process is similar to the Kubernetes Deprecation Policy.",source:"@site/docs/reference/flag-deprecation.md",sourceDirName:"reference",slug:"/reference/flag-deprecation",permalink:"/reference/flag-deprecation",draft:!1,unlisted:!1,editUrl:"https://github.com/k3s-io/docs/edit/main/docs/reference/flag-deprecation.md",tags:[],version:"current",lastUpdatedAt:1723747404e3,frontMatter:{title:"Flag Deprecation"},sidebar:"mySidebar",previous:{title:"Environment Variables",permalink:"/reference/env-variables"},next:{title:"Resource Profiling",permalink:"/reference/resource-profiling"}},l={},c=[{value:"Process",id:"process",level:2},{value:"Example",id:"example",level:2}];function d(e){const n={a:"a",code:"code",h2:"h2",li:"li",ol:"ol",p:"p",pre:"pre",ul:"ul",...(0,t.a)(),...e.components};return(0,r.jsxs)(r.Fragment,{children:[(0,r.jsxs)(n.p,{children:["K3s is a fast-moving project, and as such, we need a way to deprecate flags and configuration options. This page outlines the process for deprecating flags and configuration options. In order to ensure that users are not surprised by the removal of flags, the process is similar to the ",(0,r.jsx)(n.a,{href:"https://kubernetes.io/docs/reference/using-api/deprecation-policy/",children:"Kubernetes Deprecation Policy"}),"."]}),"\n",(0,r.jsx)(n.h2,{id:"process",children:"Process"}),"\n",(0,r.jsxs)(n.ol,{children:["\n",(0,r.jsx)(n.li,{children:'Flags can be declared as "To Be Deprecated" at any time.'}),"\n",(0,r.jsx)(n.li,{children:'Flags that are "To Be Deprecated" must be labeled as such on the next patch of all currently supported releases. Additionally, the flag will begin to warn users that it is going to be deprecated in the next minor release.'}),"\n",(0,r.jsx)(n.li,{children:"On the next minor release, a flag will be marked as deprecated in the documentation and converted to a hidden flag in code. The flag will continue to operate and give warnings to users."}),"\n",(0,r.jsx)(n.li,{children:'In the following minor release branch, deprecated flags will become "nonoperational", causing a fatal error if used. This error must explain to the user any new flags or configuration that replace this flag.'}),"\n",(0,r.jsx)(n.li,{children:"In the next minor release, the nonoperational flags will be removed from documentation and code."}),"\n"]}),"\n",(0,r.jsx)(n.h2,{id:"example",children:"Example"}),"\n",(0,r.jsx)(n.p,{children:"An example of the process:"}),"\n",(0,r.jsxs)(n.ul,{children:["\n",(0,r.jsxs)(n.li,{children:[(0,r.jsx)(n.code,{children:"--foo"})," exists in v1.22.14, v1.23.10, and v1.24.2."]}),"\n",(0,r.jsxs)(n.li,{children:["After the v1.24.2 release, it is decided to deprecate ",(0,r.jsx)(n.code,{children:"--foo"})," in favor of ",(0,r.jsx)(n.code,{children:"--new-foo"}),"."]}),"\n",(0,r.jsxs)(n.li,{children:["In v1.22.15, v1.23.11, and v1.24.3, ",(0,r.jsx)(n.code,{children:"--foo"})," continues to exist, but will warn users:","\n",(0,r.jsx)(n.pre,{children:(0,r.jsx)(n.code,{children:"[Warning] --foo will be deprecated in v1.25.0, use `--new-foo` instead\n"})}),"\n",(0,r.jsx)(n.code,{children:"--foo"})," will continue to exist as an operational flag for the life of v1.22, v1.23 and v1.24."]}),"\n",(0,r.jsxs)(n.li,{children:["In v1.25.0, ",(0,r.jsx)(n.code,{children:"--foo"})," is marked as deprecated in documentation and will be hidden in code. It will continue to work and warn users to move to ",(0,r.jsx)(n.code,{children:"--new-foo"}),"."]}),"\n",(0,r.jsxs)(n.li,{children:["In v1.26.0, ",(0,r.jsx)(n.code,{children:"--foo"})," will cause a fatal error if used. The error message will say:","\n",(0,r.jsx)(n.pre,{children:(0,r.jsx)(n.code,{children:"[Fatal] exit 1: --foo is no longer supported, use --new-foo instead\n"})}),"\n"]}),"\n",(0,r.jsxs)(n.li,{children:["In v1.27.0, ",(0,r.jsx)(n.code,{children:"--foo"})," will be removed completely from all code and documentation."]}),"\n"]})]})}function p(e={}){const{wrapper:n}={...(0,t.a)(),...e.components};return n?(0,r.jsx)(n,{...e,children:(0,r.jsx)(d,{...e})}):d(e)}},1151:(e,n,o)=>{o.d(n,{Z:()=>a,a:()=>s});var r=o(7294);const t={},i=r.createContext(t);function s(e){const n=r.useContext(i);return r.useMemo((function(){return"function"==typeof e?e(n):{...n,...e}}),[n,e])}function a(e){let n;return n=e.disableParentContext?"function"==typeof e.components?e.components(t):e.components||t:s(e.components),r.createElement(i.Provider,{value:n},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/97c4f258.0be8a102.js b/assets/js/97c4f258.8622c9bc.js similarity index 99% rename from assets/js/97c4f258.0be8a102.js rename to assets/js/97c4f258.8622c9bc.js index 67b92f9e7..702f1bbeb 100644 --- a/assets/js/97c4f258.0be8a102.js +++ b/assets/js/97c4f258.8622c9bc.js @@ -1 +1 @@ -"use strict";(self.webpackChunkk_3_s_docs=self.webpackChunkk_3_s_docs||[]).push([[305],{8486:(e,n,i)=>{i.r(n),i.d(n,{assets:()=>l,contentTitle:()=>o,default:()=>h,frontMatter:()=>a,metadata:()=>r,toc:()=>c});var s=i(5893),t=i(1151);const a={title:"Configuration Options"},o=void 0,r={id:"installation/configuration",title:"Configuration Options",description:"This page focuses on the options that are commonly used when setting up K3s for the first time. Refer to the documentation on Advanced Options and Configuration and the server and agent command documentation for more in-depth coverage.",source:"@site/docs/installation/configuration.md",sourceDirName:"installation",slug:"/installation/configuration",permalink:"/installation/configuration",draft:!1,unlisted:!1,editUrl:"https://github.com/k3s-io/docs/edit/main/docs/installation/configuration.md",tags:[],version:"current",lastUpdatedAt:1723651727e3,frontMatter:{title:"Configuration Options"},sidebar:"mySidebar",previous:{title:"Requirements",permalink:"/installation/requirements"},next:{title:"Private Registry Configuration",permalink:"/installation/private-registry"}},l={},c=[{value:"Configuration with install script",id:"configuration-with-install-script",level:2},{value:"Configuration with binary",id:"configuration-with-binary",level:2},{value:"Configuration File",id:"configuration-file",level:2},{value:"Multiple Config Files",id:"multiple-config-files",level:3},{value:"Putting it all together",id:"putting-it-all-together",level:2}];function d(e){const n={a:"a",admonition:"admonition",br:"br",code:"code",h2:"h2",h3:"h3",li:"li",p:"p",pre:"pre",ul:"ul",...(0,t.a)(),...e.components};return(0,s.jsxs)(s.Fragment,{children:[(0,s.jsxs)(n.p,{children:["This page focuses on the options that are commonly used when setting up K3s for the first time. Refer to the documentation on ",(0,s.jsx)(n.a,{href:"/advanced",children:"Advanced Options and Configuration"})," and the ",(0,s.jsx)(n.a,{href:"/cli/server",children:"server"})," and ",(0,s.jsx)(n.a,{href:"/cli/agent",children:"agent"})," command documentation for more in-depth coverage."]}),"\n",(0,s.jsx)(n.h2,{id:"configuration-with-install-script",children:"Configuration with install script"}),"\n",(0,s.jsxs)(n.p,{children:["As mentioned in the ",(0,s.jsx)(n.a,{href:"/quick-start",children:"Quick-Start Guide"}),", you can use the installation script available at ",(0,s.jsx)(n.a,{href:"https://get.k3s.io",children:"https://get.k3s.io"})," to install K3s as a service on systemd and openrc based systems."]}),"\n",(0,s.jsxs)(n.p,{children:["You can use a combination of ",(0,s.jsx)(n.code,{children:"INSTALL_K3S_EXEC"}),", ",(0,s.jsx)(n.code,{children:"K3S_"})," environment variables, and command flags to pass configuration to the service configuration.\nThe prefixed environment variables, ",(0,s.jsx)(n.code,{children:"INSTALL_K3S_EXEC"})," value, and trailing shell arguments are all persisted into the service configuration.\nAfter installation, configuration may be altered by editing the environment file, editing the service configuration, or simply re-running the installer with new options."]}),"\n",(0,s.jsx)(n.p,{children:"To illustrate this, the following commands all result in the same behavior of registering a server without flannel and with a token:"}),"\n",(0,s.jsx)(n.pre,{children:(0,s.jsx)(n.code,{className:"language-bash",children:'curl -sfL https://get.k3s.io | INSTALL_K3S_EXEC="server" sh -s - --flannel-backend none --token 12345\ncurl -sfL https://get.k3s.io | INSTALL_K3S_EXEC="server --flannel-backend none" K3S_TOKEN=12345 sh -s -\ncurl -sfL https://get.k3s.io | K3S_TOKEN=12345 sh -s - server --flannel-backend none\n# server is assumed below because there is no K3S_URL\ncurl -sfL https://get.k3s.io | INSTALL_K3S_EXEC="--flannel-backend none --token 12345" sh -s - \ncurl -sfL https://get.k3s.io | sh -s - --flannel-backend none --token 12345\n'})}),"\n",(0,s.jsx)(n.p,{children:"When registering an agent, the following commands all result in the same behavior:"}),"\n",(0,s.jsx)(n.pre,{children:(0,s.jsx)(n.code,{className:"language-bash",children:'curl -sfL https://get.k3s.io | INSTALL_K3S_EXEC="agent --server https://k3s.example.com --token mypassword" sh -s -\ncurl -sfL https://get.k3s.io | INSTALL_K3S_EXEC="agent" K3S_TOKEN="mypassword" sh -s - --server https://k3s.example.com\ncurl -sfL https://get.k3s.io | K3S_URL=https://k3s.example.com sh -s - agent --token mypassword\ncurl -sfL https://get.k3s.io | K3S_URL=https://k3s.example.com K3S_TOKEN=mypassword sh -s - # agent is assumed because of K3S_URL\n'})}),"\n",(0,s.jsxs)(n.p,{children:["For details on all environment variables, see ",(0,s.jsx)(n.a,{href:"/reference/env-variables",children:"Environment Variables."})]}),"\n",(0,s.jsxs)(n.admonition,{title:"Note",type:"info",children:[(0,s.jsx)(n.p,{children:"If you set configuration when running the install script, but do not set it again when re-running the install script, the original values will be lost."}),(0,s.jsxs)(n.p,{children:["The contents of the ",(0,s.jsx)(n.a,{href:"#configuration-file",children:"configuration file"})," are not managed by the install script.\nIf you want your configuration to be independent from the install script, you should use a configuration file instead of passing environment variables or arguments to the install script."]})]}),"\n",(0,s.jsx)(n.h2,{id:"configuration-with-binary",children:"Configuration with binary"}),"\n",(0,s.jsxs)(n.p,{children:["As stated, the installation script is primarily concerned with configuring K3s to run as a service.",(0,s.jsx)(n.br,{}),"\n","If you choose to not use the script, you can run K3s simply by downloading the binary from our ",(0,s.jsx)(n.a,{href:"https://github.com/k3s-io/k3s/releases/latest",children:"release page"}),", placing it on your path, and executing it. This is not particularly useful for permanent installations, but may be useful when performing quick tests that do not merit managing K3s as a system service."]}),"\n",(0,s.jsx)(n.pre,{children:(0,s.jsx)(n.code,{className:"language-bash",children:"curl -Lo /usr/local/bin/k3s https://github.com/k3s-io/k3s/releases/download/v1.26.5+k3s1/k3s; chmod a+x /usr/local/bin/k3s\n"})}),"\n",(0,s.jsxs)(n.p,{children:["You can pass configuration by setting ",(0,s.jsx)(n.code,{children:"K3S_"})," environment variables:"]}),"\n",(0,s.jsx)(n.pre,{children:(0,s.jsx)(n.code,{className:"language-bash",children:'K3S_KUBECONFIG_MODE="644" k3s server\n'})}),"\n",(0,s.jsx)(n.p,{children:"Or command flags:"}),"\n",(0,s.jsx)(n.pre,{children:(0,s.jsx)(n.code,{className:"language-bash",children:"k3s server --write-kubeconfig-mode=644\n"})}),"\n",(0,s.jsx)(n.p,{children:"The k3s agent can also be configured this way:"}),"\n",(0,s.jsx)(n.pre,{children:(0,s.jsx)(n.code,{className:"language-bash",children:"k3s agent --server https://k3s.example.com --token mypassword\n"})}),"\n",(0,s.jsxs)(n.p,{children:["For details on configuring the K3s server, see the ",(0,s.jsxs)(n.a,{href:"/cli/server",children:[(0,s.jsx)(n.code,{children:"k3s server"})," documentation"]}),".",(0,s.jsx)(n.br,{}),"\n","For details on configuring the K3s agent, see the ",(0,s.jsxs)(n.a,{href:"/cli/agent",children:[(0,s.jsx)(n.code,{children:"k3s agent"})," documentation"]}),".",(0,s.jsx)(n.br,{}),"\n","You can also use the ",(0,s.jsx)(n.code,{children:"--help"})," flag to see a list of all available options, and their corresponding environment variables."]}),"\n",(0,s.jsx)(n.admonition,{title:"Matching Flags",type:"info",children:(0,s.jsxs)(n.p,{children:["It is important to match critical flags on your server nodes. For example, if you use the flag\n",(0,s.jsx)(n.code,{children:"--disable servicelb"})," or ",(0,s.jsx)(n.code,{children:"--cluster-cidr=10.200.0.0/16"})," on your master node, but don't set it on other server nodes, the nodes will fail to join. They will print errors such as:\n",(0,s.jsx)(n.code,{children:"failed to validate server configuration: critical configuration value mismatch."}),"\nSee the Server Configuration documentation (linked above) for more information on which flags must be set identically on server nodes."]})}),"\n",(0,s.jsx)(n.h2,{id:"configuration-file",children:"Configuration File"}),"\n",(0,s.jsx)(n.admonition,{title:"Version Gate",type:"info",children:(0,s.jsxs)(n.p,{children:["Available as of ",(0,s.jsx)(n.a,{href:"https://github.com/k3s-io/k3s/releases/tag/v1.19.1%2Bk3s1",children:"v1.19.1+k3s1"})]})}),"\n",(0,s.jsx)(n.p,{children:"In addition to configuring K3s with environment variables and CLI arguments, K3s can also use a config file."}),"\n",(0,s.jsxs)(n.p,{children:["By default, values present in a YAML file located at ",(0,s.jsx)(n.code,{children:"/etc/rancher/k3s/config.yaml"})," will be used on install."]}),"\n",(0,s.jsxs)(n.p,{children:["An example of a basic ",(0,s.jsx)(n.code,{children:"server"})," config file is below:"]}),"\n",(0,s.jsx)(n.pre,{children:(0,s.jsx)(n.code,{className:"language-yaml",children:'write-kubeconfig-mode: "0644"\ntls-san:\n - "foo.local"\nnode-label:\n - "foo=bar"\n - "something=amazing"\ncluster-init: true\n'})}),"\n",(0,s.jsx)(n.p,{children:"This is equivalent to the following CLI arguments:"}),"\n",(0,s.jsx)(n.pre,{children:(0,s.jsx)(n.code,{className:"language-bash",children:'k3s server \\\n --write-kubeconfig-mode "0644" \\\n --tls-san "foo.local" \\\n --node-label "foo=bar" \\\n --node-label "something=amazing" \\\n --cluster-init\n'})}),"\n",(0,s.jsxs)(n.p,{children:["In general, CLI arguments map to their respective YAML key, with repeatable CLI arguments being represented as YAML lists. Boolean flags are represented as ",(0,s.jsx)(n.code,{children:"true"})," or ",(0,s.jsx)(n.code,{children:"false"})," in the YAML file."]}),"\n",(0,s.jsxs)(n.p,{children:["It is also possible to use both a configuration file and CLI arguments. In these situations, values will be loaded from both sources, but CLI arguments will take precedence. For repeatable arguments such as ",(0,s.jsx)(n.code,{children:"--node-label"}),", the CLI arguments will overwrite all values in the list."]}),"\n",(0,s.jsxs)(n.p,{children:["Finally, the location of the config file can be changed either through the CLI argument ",(0,s.jsx)(n.code,{children:"--config FILE, -c FILE"}),", or the environment variable ",(0,s.jsx)(n.code,{children:"$K3S_CONFIG_FILE"}),"."]}),"\n",(0,s.jsx)(n.h3,{id:"multiple-config-files",children:"Multiple Config Files"}),"\n",(0,s.jsx)(n.admonition,{title:"Version Gate",type:"info",children:(0,s.jsxs)(n.p,{children:["Available as of ",(0,s.jsx)(n.a,{href:"https://github.com/k3s-io/k3s/releases/tag/v1.21.0%2Bk3s1",children:"v1.21.0+k3s1"})]})}),"\n",(0,s.jsxs)(n.p,{children:["Multiple configuration files are supported. By default, configuration files are read from ",(0,s.jsx)(n.code,{children:"/etc/rancher/k3s/config.yaml"})," and ",(0,s.jsx)(n.code,{children:"/etc/rancher/k3s/config.yaml.d/*.yaml"})," in alphabetical order."]}),"\n",(0,s.jsxs)(n.p,{children:["By default, the last value found for a given key will be used. A ",(0,s.jsx)(n.code,{children:"+"})," can be appended to the key to append the value to the existing string or slice, instead of replacing it. All occurrences of this key in subsequent files will also require a ",(0,s.jsx)(n.code,{children:"+"})," to prevent overwriting the accumulated value."]}),"\n",(0,s.jsx)(n.p,{children:"An example of multiple config files is below:"}),"\n",(0,s.jsx)(n.pre,{children:(0,s.jsx)(n.code,{className:"language-yaml",children:"# config.yaml\ntoken: boop\nnode-label:\n - foo=bar\n - bar=baz\n\n\n# config.yaml.d/test1.yaml\nwrite-kubeconfig-mode: 600\nnode-taint:\n - alice=bob:NoExecute\n\n# config.yaml.d/test2.yaml\nwrite-kubeconfig-mode: 777\nnode-label:\n - other=what\n - foo=three\nnode-taint+:\n - charlie=delta:NoSchedule\n\n"})}),"\n",(0,s.jsx)(n.p,{children:"This results in a final configuration of:"}),"\n",(0,s.jsx)(n.pre,{children:(0,s.jsx)(n.code,{className:"language-yaml",children:"write-kubeconfig-mode: 777\ntoken: boop\nnode-label:\n - other=what\n - foo=three\nnode-taint:\n - alice=bob:NoExecute\n - charlie=delta:NoSchedule\n"})}),"\n",(0,s.jsx)(n.h2,{id:"putting-it-all-together",children:"Putting it all together"}),"\n",(0,s.jsx)(n.p,{children:"All of the above options can be combined into a single example."}),"\n",(0,s.jsxs)(n.p,{children:["A ",(0,s.jsx)(n.code,{children:"config.yaml"})," file is created at ",(0,s.jsx)(n.code,{children:"/etc/rancher/k3s/config.yaml"}),":"]}),"\n",(0,s.jsx)(n.pre,{children:(0,s.jsx)(n.code,{className:"language-yaml",children:'token: "secret"\ndebug: true\n'})}),"\n",(0,s.jsx)(n.p,{children:"Then the installation script is run with a combination of environment variables and flags:"}),"\n",(0,s.jsx)(n.pre,{children:(0,s.jsx)(n.code,{className:"language-bash",children:'curl -sfL https://get.k3s.io | K3S_KUBECONFIG_MODE="644" INSTALL_K3S_EXEC="server" sh -s - --flannel-backend none\n'})}),"\n",(0,s.jsx)(n.p,{children:"Or if you have already installed the K3s Binary:"}),"\n",(0,s.jsx)(n.pre,{children:(0,s.jsx)(n.code,{className:"language-bash",children:'K3S_KUBECONFIG_MODE="644" k3s server --flannel-backend none\n'})}),"\n",(0,s.jsx)(n.p,{children:"This results in a server with:"}),"\n",(0,s.jsxs)(n.ul,{children:["\n",(0,s.jsxs)(n.li,{children:["A kubeconfig file with permissions ",(0,s.jsx)(n.code,{children:"644"})]}),"\n",(0,s.jsxs)(n.li,{children:["Flannel backend set to ",(0,s.jsx)(n.code,{children:"none"})]}),"\n",(0,s.jsxs)(n.li,{children:["The token set to ",(0,s.jsx)(n.code,{children:"secret"})]}),"\n",(0,s.jsx)(n.li,{children:"Debug logging enabled"}),"\n"]})]})}function h(e={}){const{wrapper:n}={...(0,t.a)(),...e.components};return n?(0,s.jsx)(n,{...e,children:(0,s.jsx)(d,{...e})}):d(e)}},1151:(e,n,i)=>{i.d(n,{Z:()=>r,a:()=>o});var s=i(7294);const t={},a=s.createContext(t);function o(e){const n=s.useContext(a);return s.useMemo((function(){return"function"==typeof e?e(n):{...n,...e}}),[n,e])}function r(e){let n;return n=e.disableParentContext?"function"==typeof e.components?e.components(t):e.components||t:o(e.components),s.createElement(a.Provider,{value:n},e.children)}}}]); \ No newline at end of file +"use strict";(self.webpackChunkk_3_s_docs=self.webpackChunkk_3_s_docs||[]).push([[305],{8486:(e,n,i)=>{i.r(n),i.d(n,{assets:()=>l,contentTitle:()=>o,default:()=>h,frontMatter:()=>a,metadata:()=>r,toc:()=>c});var s=i(5893),t=i(1151);const a={title:"Configuration Options"},o=void 0,r={id:"installation/configuration",title:"Configuration Options",description:"This page focuses on the options that are commonly used when setting up K3s for the first time. Refer to the documentation on Advanced Options and Configuration and the server and agent command documentation for more in-depth coverage.",source:"@site/docs/installation/configuration.md",sourceDirName:"installation",slug:"/installation/configuration",permalink:"/installation/configuration",draft:!1,unlisted:!1,editUrl:"https://github.com/k3s-io/docs/edit/main/docs/installation/configuration.md",tags:[],version:"current",lastUpdatedAt:1723747404e3,frontMatter:{title:"Configuration Options"},sidebar:"mySidebar",previous:{title:"Requirements",permalink:"/installation/requirements"},next:{title:"Private Registry Configuration",permalink:"/installation/private-registry"}},l={},c=[{value:"Configuration with install script",id:"configuration-with-install-script",level:2},{value:"Configuration with binary",id:"configuration-with-binary",level:2},{value:"Configuration File",id:"configuration-file",level:2},{value:"Multiple Config Files",id:"multiple-config-files",level:3},{value:"Putting it all together",id:"putting-it-all-together",level:2}];function d(e){const n={a:"a",admonition:"admonition",br:"br",code:"code",h2:"h2",h3:"h3",li:"li",p:"p",pre:"pre",ul:"ul",...(0,t.a)(),...e.components};return(0,s.jsxs)(s.Fragment,{children:[(0,s.jsxs)(n.p,{children:["This page focuses on the options that are commonly used when setting up K3s for the first time. Refer to the documentation on ",(0,s.jsx)(n.a,{href:"/advanced",children:"Advanced Options and Configuration"})," and the ",(0,s.jsx)(n.a,{href:"/cli/server",children:"server"})," and ",(0,s.jsx)(n.a,{href:"/cli/agent",children:"agent"})," command documentation for more in-depth coverage."]}),"\n",(0,s.jsx)(n.h2,{id:"configuration-with-install-script",children:"Configuration with install script"}),"\n",(0,s.jsxs)(n.p,{children:["As mentioned in the ",(0,s.jsx)(n.a,{href:"/quick-start",children:"Quick-Start Guide"}),", you can use the installation script available at ",(0,s.jsx)(n.a,{href:"https://get.k3s.io",children:"https://get.k3s.io"})," to install K3s as a service on systemd and openrc based systems."]}),"\n",(0,s.jsxs)(n.p,{children:["You can use a combination of ",(0,s.jsx)(n.code,{children:"INSTALL_K3S_EXEC"}),", ",(0,s.jsx)(n.code,{children:"K3S_"})," environment variables, and command flags to pass configuration to the service configuration.\nThe prefixed environment variables, ",(0,s.jsx)(n.code,{children:"INSTALL_K3S_EXEC"})," value, and trailing shell arguments are all persisted into the service configuration.\nAfter installation, configuration may be altered by editing the environment file, editing the service configuration, or simply re-running the installer with new options."]}),"\n",(0,s.jsx)(n.p,{children:"To illustrate this, the following commands all result in the same behavior of registering a server without flannel and with a token:"}),"\n",(0,s.jsx)(n.pre,{children:(0,s.jsx)(n.code,{className:"language-bash",children:'curl -sfL https://get.k3s.io | INSTALL_K3S_EXEC="server" sh -s - --flannel-backend none --token 12345\ncurl -sfL https://get.k3s.io | INSTALL_K3S_EXEC="server --flannel-backend none" K3S_TOKEN=12345 sh -s -\ncurl -sfL https://get.k3s.io | K3S_TOKEN=12345 sh -s - server --flannel-backend none\n# server is assumed below because there is no K3S_URL\ncurl -sfL https://get.k3s.io | INSTALL_K3S_EXEC="--flannel-backend none --token 12345" sh -s - \ncurl -sfL https://get.k3s.io | sh -s - --flannel-backend none --token 12345\n'})}),"\n",(0,s.jsx)(n.p,{children:"When registering an agent, the following commands all result in the same behavior:"}),"\n",(0,s.jsx)(n.pre,{children:(0,s.jsx)(n.code,{className:"language-bash",children:'curl -sfL https://get.k3s.io | INSTALL_K3S_EXEC="agent --server https://k3s.example.com --token mypassword" sh -s -\ncurl -sfL https://get.k3s.io | INSTALL_K3S_EXEC="agent" K3S_TOKEN="mypassword" sh -s - --server https://k3s.example.com\ncurl -sfL https://get.k3s.io | K3S_URL=https://k3s.example.com sh -s - agent --token mypassword\ncurl -sfL https://get.k3s.io | K3S_URL=https://k3s.example.com K3S_TOKEN=mypassword sh -s - # agent is assumed because of K3S_URL\n'})}),"\n",(0,s.jsxs)(n.p,{children:["For details on all environment variables, see ",(0,s.jsx)(n.a,{href:"/reference/env-variables",children:"Environment Variables."})]}),"\n",(0,s.jsxs)(n.admonition,{title:"Note",type:"info",children:[(0,s.jsx)(n.p,{children:"If you set configuration when running the install script, but do not set it again when re-running the install script, the original values will be lost."}),(0,s.jsxs)(n.p,{children:["The contents of the ",(0,s.jsx)(n.a,{href:"#configuration-file",children:"configuration file"})," are not managed by the install script.\nIf you want your configuration to be independent from the install script, you should use a configuration file instead of passing environment variables or arguments to the install script."]})]}),"\n",(0,s.jsx)(n.h2,{id:"configuration-with-binary",children:"Configuration with binary"}),"\n",(0,s.jsxs)(n.p,{children:["As stated, the installation script is primarily concerned with configuring K3s to run as a service.",(0,s.jsx)(n.br,{}),"\n","If you choose to not use the script, you can run K3s simply by downloading the binary from our ",(0,s.jsx)(n.a,{href:"https://github.com/k3s-io/k3s/releases/latest",children:"release page"}),", placing it on your path, and executing it. This is not particularly useful for permanent installations, but may be useful when performing quick tests that do not merit managing K3s as a system service."]}),"\n",(0,s.jsx)(n.pre,{children:(0,s.jsx)(n.code,{className:"language-bash",children:"curl -Lo /usr/local/bin/k3s https://github.com/k3s-io/k3s/releases/download/v1.26.5+k3s1/k3s; chmod a+x /usr/local/bin/k3s\n"})}),"\n",(0,s.jsxs)(n.p,{children:["You can pass configuration by setting ",(0,s.jsx)(n.code,{children:"K3S_"})," environment variables:"]}),"\n",(0,s.jsx)(n.pre,{children:(0,s.jsx)(n.code,{className:"language-bash",children:'K3S_KUBECONFIG_MODE="644" k3s server\n'})}),"\n",(0,s.jsx)(n.p,{children:"Or command flags:"}),"\n",(0,s.jsx)(n.pre,{children:(0,s.jsx)(n.code,{className:"language-bash",children:"k3s server --write-kubeconfig-mode=644\n"})}),"\n",(0,s.jsx)(n.p,{children:"The k3s agent can also be configured this way:"}),"\n",(0,s.jsx)(n.pre,{children:(0,s.jsx)(n.code,{className:"language-bash",children:"k3s agent --server https://k3s.example.com --token mypassword\n"})}),"\n",(0,s.jsxs)(n.p,{children:["For details on configuring the K3s server, see the ",(0,s.jsxs)(n.a,{href:"/cli/server",children:[(0,s.jsx)(n.code,{children:"k3s server"})," documentation"]}),".",(0,s.jsx)(n.br,{}),"\n","For details on configuring the K3s agent, see the ",(0,s.jsxs)(n.a,{href:"/cli/agent",children:[(0,s.jsx)(n.code,{children:"k3s agent"})," documentation"]}),".",(0,s.jsx)(n.br,{}),"\n","You can also use the ",(0,s.jsx)(n.code,{children:"--help"})," flag to see a list of all available options, and their corresponding environment variables."]}),"\n",(0,s.jsx)(n.admonition,{title:"Matching Flags",type:"info",children:(0,s.jsxs)(n.p,{children:["It is important to match critical flags on your server nodes. For example, if you use the flag\n",(0,s.jsx)(n.code,{children:"--disable servicelb"})," or ",(0,s.jsx)(n.code,{children:"--cluster-cidr=10.200.0.0/16"})," on your master node, but don't set it on other server nodes, the nodes will fail to join. They will print errors such as:\n",(0,s.jsx)(n.code,{children:"failed to validate server configuration: critical configuration value mismatch."}),"\nSee the Server Configuration documentation (linked above) for more information on which flags must be set identically on server nodes."]})}),"\n",(0,s.jsx)(n.h2,{id:"configuration-file",children:"Configuration File"}),"\n",(0,s.jsx)(n.admonition,{title:"Version Gate",type:"info",children:(0,s.jsxs)(n.p,{children:["Available as of ",(0,s.jsx)(n.a,{href:"https://github.com/k3s-io/k3s/releases/tag/v1.19.1%2Bk3s1",children:"v1.19.1+k3s1"})]})}),"\n",(0,s.jsx)(n.p,{children:"In addition to configuring K3s with environment variables and CLI arguments, K3s can also use a config file."}),"\n",(0,s.jsxs)(n.p,{children:["By default, values present in a YAML file located at ",(0,s.jsx)(n.code,{children:"/etc/rancher/k3s/config.yaml"})," will be used on install."]}),"\n",(0,s.jsxs)(n.p,{children:["An example of a basic ",(0,s.jsx)(n.code,{children:"server"})," config file is below:"]}),"\n",(0,s.jsx)(n.pre,{children:(0,s.jsx)(n.code,{className:"language-yaml",children:'write-kubeconfig-mode: "0644"\ntls-san:\n - "foo.local"\nnode-label:\n - "foo=bar"\n - "something=amazing"\ncluster-init: true\n'})}),"\n",(0,s.jsx)(n.p,{children:"This is equivalent to the following CLI arguments:"}),"\n",(0,s.jsx)(n.pre,{children:(0,s.jsx)(n.code,{className:"language-bash",children:'k3s server \\\n --write-kubeconfig-mode "0644" \\\n --tls-san "foo.local" \\\n --node-label "foo=bar" \\\n --node-label "something=amazing" \\\n --cluster-init\n'})}),"\n",(0,s.jsxs)(n.p,{children:["In general, CLI arguments map to their respective YAML key, with repeatable CLI arguments being represented as YAML lists. Boolean flags are represented as ",(0,s.jsx)(n.code,{children:"true"})," or ",(0,s.jsx)(n.code,{children:"false"})," in the YAML file."]}),"\n",(0,s.jsxs)(n.p,{children:["It is also possible to use both a configuration file and CLI arguments. In these situations, values will be loaded from both sources, but CLI arguments will take precedence. For repeatable arguments such as ",(0,s.jsx)(n.code,{children:"--node-label"}),", the CLI arguments will overwrite all values in the list."]}),"\n",(0,s.jsxs)(n.p,{children:["Finally, the location of the config file can be changed either through the CLI argument ",(0,s.jsx)(n.code,{children:"--config FILE, -c FILE"}),", or the environment variable ",(0,s.jsx)(n.code,{children:"$K3S_CONFIG_FILE"}),"."]}),"\n",(0,s.jsx)(n.h3,{id:"multiple-config-files",children:"Multiple Config Files"}),"\n",(0,s.jsx)(n.admonition,{title:"Version Gate",type:"info",children:(0,s.jsxs)(n.p,{children:["Available as of ",(0,s.jsx)(n.a,{href:"https://github.com/k3s-io/k3s/releases/tag/v1.21.0%2Bk3s1",children:"v1.21.0+k3s1"})]})}),"\n",(0,s.jsxs)(n.p,{children:["Multiple configuration files are supported. By default, configuration files are read from ",(0,s.jsx)(n.code,{children:"/etc/rancher/k3s/config.yaml"})," and ",(0,s.jsx)(n.code,{children:"/etc/rancher/k3s/config.yaml.d/*.yaml"})," in alphabetical order."]}),"\n",(0,s.jsxs)(n.p,{children:["By default, the last value found for a given key will be used. A ",(0,s.jsx)(n.code,{children:"+"})," can be appended to the key to append the value to the existing string or slice, instead of replacing it. All occurrences of this key in subsequent files will also require a ",(0,s.jsx)(n.code,{children:"+"})," to prevent overwriting the accumulated value."]}),"\n",(0,s.jsx)(n.p,{children:"An example of multiple config files is below:"}),"\n",(0,s.jsx)(n.pre,{children:(0,s.jsx)(n.code,{className:"language-yaml",children:"# config.yaml\ntoken: boop\nnode-label:\n - foo=bar\n - bar=baz\n\n\n# config.yaml.d/test1.yaml\nwrite-kubeconfig-mode: 600\nnode-taint:\n - alice=bob:NoExecute\n\n# config.yaml.d/test2.yaml\nwrite-kubeconfig-mode: 777\nnode-label:\n - other=what\n - foo=three\nnode-taint+:\n - charlie=delta:NoSchedule\n\n"})}),"\n",(0,s.jsx)(n.p,{children:"This results in a final configuration of:"}),"\n",(0,s.jsx)(n.pre,{children:(0,s.jsx)(n.code,{className:"language-yaml",children:"write-kubeconfig-mode: 777\ntoken: boop\nnode-label:\n - other=what\n - foo=three\nnode-taint:\n - alice=bob:NoExecute\n - charlie=delta:NoSchedule\n"})}),"\n",(0,s.jsx)(n.h2,{id:"putting-it-all-together",children:"Putting it all together"}),"\n",(0,s.jsx)(n.p,{children:"All of the above options can be combined into a single example."}),"\n",(0,s.jsxs)(n.p,{children:["A ",(0,s.jsx)(n.code,{children:"config.yaml"})," file is created at ",(0,s.jsx)(n.code,{children:"/etc/rancher/k3s/config.yaml"}),":"]}),"\n",(0,s.jsx)(n.pre,{children:(0,s.jsx)(n.code,{className:"language-yaml",children:'token: "secret"\ndebug: true\n'})}),"\n",(0,s.jsx)(n.p,{children:"Then the installation script is run with a combination of environment variables and flags:"}),"\n",(0,s.jsx)(n.pre,{children:(0,s.jsx)(n.code,{className:"language-bash",children:'curl -sfL https://get.k3s.io | K3S_KUBECONFIG_MODE="644" INSTALL_K3S_EXEC="server" sh -s - --flannel-backend none\n'})}),"\n",(0,s.jsx)(n.p,{children:"Or if you have already installed the K3s Binary:"}),"\n",(0,s.jsx)(n.pre,{children:(0,s.jsx)(n.code,{className:"language-bash",children:'K3S_KUBECONFIG_MODE="644" k3s server --flannel-backend none\n'})}),"\n",(0,s.jsx)(n.p,{children:"This results in a server with:"}),"\n",(0,s.jsxs)(n.ul,{children:["\n",(0,s.jsxs)(n.li,{children:["A kubeconfig file with permissions ",(0,s.jsx)(n.code,{children:"644"})]}),"\n",(0,s.jsxs)(n.li,{children:["Flannel backend set to ",(0,s.jsx)(n.code,{children:"none"})]}),"\n",(0,s.jsxs)(n.li,{children:["The token set to ",(0,s.jsx)(n.code,{children:"secret"})]}),"\n",(0,s.jsx)(n.li,{children:"Debug logging enabled"}),"\n"]})]})}function h(e={}){const{wrapper:n}={...(0,t.a)(),...e.components};return n?(0,s.jsx)(n,{...e,children:(0,s.jsx)(d,{...e})}):d(e)}},1151:(e,n,i)=>{i.d(n,{Z:()=>r,a:()=>o});var s=i(7294);const t={},a=s.createContext(t);function o(e){const n=s.useContext(a);return s.useMemo((function(){return"function"==typeof e?e(n):{...n,...e}}),[n,e])}function r(e){let n;return n=e.disableParentContext?"function"==typeof e.components?e.components(t):e.components||t:o(e.components),s.createElement(a.Provider,{value:n},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/9e39b1cd.e1d0f21d.js b/assets/js/9e39b1cd.b5cf9394.js similarity index 98% rename from assets/js/9e39b1cd.e1d0f21d.js rename to assets/js/9e39b1cd.b5cf9394.js index 2108f3357..7d1993456 100644 --- a/assets/js/9e39b1cd.e1d0f21d.js +++ b/assets/js/9e39b1cd.b5cf9394.js @@ -1 +1 @@ -"use strict";(self.webpackChunkk_3_s_docs=self.webpackChunkk_3_s_docs||[]).push([[7813],{4016:(e,t,n)=>{n.r(t),n.d(t,{assets:()=>i,contentTitle:()=>d,default:()=>a,frontMatter:()=>c,metadata:()=>o,toc:()=>l});var s=n(5893),r=n(1151);const c={title:"CLI Tools"},d=void 0,o={id:"cli/cli",title:"CLI Tools",description:"The K3s binary contains a number of additional tools the help you manage your cluster.",source:"@site/docs/cli/cli.md",sourceDirName:"cli",slug:"/cli/",permalink:"/cli/",draft:!1,unlisted:!1,editUrl:"https://github.com/k3s-io/docs/edit/main/docs/cli/cli.md",tags:[],version:"current",lastUpdatedAt:1723651727e3,frontMatter:{title:"CLI Tools"},sidebar:"mySidebar",previous:{title:"CIS 1.24 Self Assessment Guide",permalink:"/security/self-assessment-1.24"},next:{title:"server",permalink:"/cli/server"}},i={},l=[];function h(e){const t={a:"a",code:"code",p:"p",table:"table",tbody:"tbody",td:"td",th:"th",thead:"thead",tr:"tr",...(0,r.a)(),...e.components};return(0,s.jsxs)(s.Fragment,{children:[(0,s.jsx)(t.p,{children:"The K3s binary contains a number of additional tools the help you manage your cluster."}),"\n",(0,s.jsxs)(t.table,{children:[(0,s.jsx)(t.thead,{children:(0,s.jsxs)(t.tr,{children:[(0,s.jsx)(t.th,{children:"Command"}),(0,s.jsx)(t.th,{children:"Description"})]})}),(0,s.jsxs)(t.tbody,{children:[(0,s.jsxs)(t.tr,{children:[(0,s.jsx)(t.td,{children:(0,s.jsx)(t.code,{children:"k3s server"})}),(0,s.jsxs)(t.td,{children:["Run a K3s server node, which launches the Kubernetes ",(0,s.jsx)(t.code,{children:"apiserver"}),", ",(0,s.jsx)(t.code,{children:"scheduler"}),", ",(0,s.jsx)(t.code,{children:"controller-manager"}),", and ",(0,s.jsx)(t.code,{children:"cloud-controller-manager"})," components, in addition a datastore and the agent components. See the ",(0,s.jsxs)(t.a,{href:"/cli/server",children:[(0,s.jsx)(t.code,{children:"k3s server"})," command documentation"]})," for more information."]})]}),(0,s.jsxs)(t.tr,{children:[(0,s.jsx)(t.td,{children:(0,s.jsx)(t.code,{children:"k3s agent"})}),(0,s.jsxs)(t.td,{children:["Run the K3s agent node, which launches ",(0,s.jsx)(t.code,{children:"containerd"}),", ",(0,s.jsx)(t.code,{children:"flannel"}),", ",(0,s.jsx)(t.code,{children:"kube-router"})," network policy controller, and the Kubernetes ",(0,s.jsx)(t.code,{children:"kubelet"})," and ",(0,s.jsx)(t.code,{children:"kube-proxy"})," components. See the ",(0,s.jsxs)(t.a,{href:"/cli/agent",children:[(0,s.jsx)(t.code,{children:"k3s agent"})," command documentation"]})," for more information."]})]}),(0,s.jsxs)(t.tr,{children:[(0,s.jsx)(t.td,{children:(0,s.jsx)(t.code,{children:"k3s kubectl"})}),(0,s.jsxs)(t.td,{children:["Run the embedded ",(0,s.jsxs)(t.a,{href:"https://kubernetes.io/docs/reference/kubectl",children:[(0,s.jsx)(t.code,{children:"kubectl"})," command"]}),". This is a CLI for interacting with the Kubernetes apiserver. If the ",(0,s.jsx)(t.code,{children:"KUBECONFIG"})," environment variable is not set, this will automatically attempt to use the kubeconfig at ",(0,s.jsx)(t.code,{children:"/etc/rancher/k3s/k3s.yaml"}),"."]})]}),(0,s.jsxs)(t.tr,{children:[(0,s.jsx)(t.td,{children:(0,s.jsx)(t.code,{children:"k3s crictl"})}),(0,s.jsxs)(t.td,{children:["Run the embedded ",(0,s.jsxs)(t.a,{href:"https://github.com/kubernetes-sigs/cri-tools/blob/master/docs/crictl.md",children:[(0,s.jsx)(t.code,{children:"crictl"})," command"]}),". This is a CLI for interacting with Kubernetes's container runtime interface (CRI). Useful for debugging."]})]}),(0,s.jsxs)(t.tr,{children:[(0,s.jsx)(t.td,{children:(0,s.jsx)(t.code,{children:"k3s ctr"})}),(0,s.jsxs)(t.td,{children:["Run the embedded ",(0,s.jsxs)(t.a,{href:"https://github.com/projectatomic/containerd/blob/master/docs/cli.md",children:[(0,s.jsx)(t.code,{children:"ctr"})," command"]}),". This is a CLI for containerd, the container daemon used by K3s. Useful for debugging."]})]}),(0,s.jsxs)(t.tr,{children:[(0,s.jsx)(t.td,{children:(0,s.jsx)(t.code,{children:"k3s token"})}),(0,s.jsxs)(t.td,{children:["Manage bootstrap tokens. See the ",(0,s.jsxs)(t.a,{href:"/cli/token",children:[(0,s.jsx)(t.code,{children:"k3s token"})," command documentation"]})," for more information."]})]}),(0,s.jsxs)(t.tr,{children:[(0,s.jsx)(t.td,{children:(0,s.jsx)(t.code,{children:"k3s etcd-snapshot"})}),(0,s.jsxs)(t.td,{children:["Perform on demand backups of the K3s cluster data and upload to S3. See the ",(0,s.jsxs)(t.a,{href:"/cli/etcd-snapshot",children:[(0,s.jsx)(t.code,{children:"k3s etcd-snapshot"})," command documentation"]})," for more information."]})]}),(0,s.jsxs)(t.tr,{children:[(0,s.jsx)(t.td,{children:(0,s.jsx)(t.code,{children:"k3s secrets-encrypt"})}),(0,s.jsxs)(t.td,{children:["Configure K3s to encrypt secrets when storing them in the cluster. See the ",(0,s.jsxs)(t.a,{href:"/cli/secrets-encrypt",children:[(0,s.jsx)(t.code,{children:"k3s secrets-encrypt"})," command documentation"]})," for more information."]})]}),(0,s.jsxs)(t.tr,{children:[(0,s.jsx)(t.td,{children:(0,s.jsx)(t.code,{children:"k3s certificate"})}),(0,s.jsxs)(t.td,{children:["Manage K3s certificates. See the ",(0,s.jsxs)(t.a,{href:"/cli/certificate",children:[(0,s.jsx)(t.code,{children:"k3s certificate"})," command documentation"]})," for more information."]})]}),(0,s.jsxs)(t.tr,{children:[(0,s.jsx)(t.td,{children:(0,s.jsx)(t.code,{children:"k3s completion"})}),(0,s.jsx)(t.td,{children:"Generate shell completion scripts for k3s"})]}),(0,s.jsxs)(t.tr,{children:[(0,s.jsx)(t.td,{children:(0,s.jsx)(t.code,{children:"k3s help"})}),(0,s.jsx)(t.td,{children:"Shows a list of commands or help for one command"})]})]})]})]})}function a(e={}){const{wrapper:t}={...(0,r.a)(),...e.components};return t?(0,s.jsx)(t,{...e,children:(0,s.jsx)(h,{...e})}):h(e)}},1151:(e,t,n)=>{n.d(t,{Z:()=>o,a:()=>d});var s=n(7294);const r={},c=s.createContext(r);function d(e){const t=s.useContext(c);return s.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function o(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(r):e.components||r:d(e.components),s.createElement(c.Provider,{value:t},e.children)}}}]); \ No newline at end of file +"use strict";(self.webpackChunkk_3_s_docs=self.webpackChunkk_3_s_docs||[]).push([[7813],{4016:(e,t,n)=>{n.r(t),n.d(t,{assets:()=>i,contentTitle:()=>d,default:()=>a,frontMatter:()=>c,metadata:()=>o,toc:()=>l});var s=n(5893),r=n(1151);const c={title:"CLI Tools"},d=void 0,o={id:"cli/cli",title:"CLI Tools",description:"The K3s binary contains a number of additional tools the help you manage your cluster.",source:"@site/docs/cli/cli.md",sourceDirName:"cli",slug:"/cli/",permalink:"/cli/",draft:!1,unlisted:!1,editUrl:"https://github.com/k3s-io/docs/edit/main/docs/cli/cli.md",tags:[],version:"current",lastUpdatedAt:1723747404e3,frontMatter:{title:"CLI Tools"},sidebar:"mySidebar",previous:{title:"CIS 1.24 Self Assessment Guide",permalink:"/security/self-assessment-1.24"},next:{title:"server",permalink:"/cli/server"}},i={},l=[];function h(e){const t={a:"a",code:"code",p:"p",table:"table",tbody:"tbody",td:"td",th:"th",thead:"thead",tr:"tr",...(0,r.a)(),...e.components};return(0,s.jsxs)(s.Fragment,{children:[(0,s.jsx)(t.p,{children:"The K3s binary contains a number of additional tools the help you manage your cluster."}),"\n",(0,s.jsxs)(t.table,{children:[(0,s.jsx)(t.thead,{children:(0,s.jsxs)(t.tr,{children:[(0,s.jsx)(t.th,{children:"Command"}),(0,s.jsx)(t.th,{children:"Description"})]})}),(0,s.jsxs)(t.tbody,{children:[(0,s.jsxs)(t.tr,{children:[(0,s.jsx)(t.td,{children:(0,s.jsx)(t.code,{children:"k3s server"})}),(0,s.jsxs)(t.td,{children:["Run a K3s server node, which launches the Kubernetes ",(0,s.jsx)(t.code,{children:"apiserver"}),", ",(0,s.jsx)(t.code,{children:"scheduler"}),", ",(0,s.jsx)(t.code,{children:"controller-manager"}),", and ",(0,s.jsx)(t.code,{children:"cloud-controller-manager"})," components, in addition a datastore and the agent components. See the ",(0,s.jsxs)(t.a,{href:"/cli/server",children:[(0,s.jsx)(t.code,{children:"k3s server"})," command documentation"]})," for more information."]})]}),(0,s.jsxs)(t.tr,{children:[(0,s.jsx)(t.td,{children:(0,s.jsx)(t.code,{children:"k3s agent"})}),(0,s.jsxs)(t.td,{children:["Run the K3s agent node, which launches ",(0,s.jsx)(t.code,{children:"containerd"}),", ",(0,s.jsx)(t.code,{children:"flannel"}),", ",(0,s.jsx)(t.code,{children:"kube-router"})," network policy controller, and the Kubernetes ",(0,s.jsx)(t.code,{children:"kubelet"})," and ",(0,s.jsx)(t.code,{children:"kube-proxy"})," components. See the ",(0,s.jsxs)(t.a,{href:"/cli/agent",children:[(0,s.jsx)(t.code,{children:"k3s agent"})," command documentation"]})," for more information."]})]}),(0,s.jsxs)(t.tr,{children:[(0,s.jsx)(t.td,{children:(0,s.jsx)(t.code,{children:"k3s kubectl"})}),(0,s.jsxs)(t.td,{children:["Run the embedded ",(0,s.jsxs)(t.a,{href:"https://kubernetes.io/docs/reference/kubectl",children:[(0,s.jsx)(t.code,{children:"kubectl"})," command"]}),". This is a CLI for interacting with the Kubernetes apiserver. If the ",(0,s.jsx)(t.code,{children:"KUBECONFIG"})," environment variable is not set, this will automatically attempt to use the kubeconfig at ",(0,s.jsx)(t.code,{children:"/etc/rancher/k3s/k3s.yaml"}),"."]})]}),(0,s.jsxs)(t.tr,{children:[(0,s.jsx)(t.td,{children:(0,s.jsx)(t.code,{children:"k3s crictl"})}),(0,s.jsxs)(t.td,{children:["Run the embedded ",(0,s.jsxs)(t.a,{href:"https://github.com/kubernetes-sigs/cri-tools/blob/master/docs/crictl.md",children:[(0,s.jsx)(t.code,{children:"crictl"})," command"]}),". This is a CLI for interacting with Kubernetes's container runtime interface (CRI). Useful for debugging."]})]}),(0,s.jsxs)(t.tr,{children:[(0,s.jsx)(t.td,{children:(0,s.jsx)(t.code,{children:"k3s ctr"})}),(0,s.jsxs)(t.td,{children:["Run the embedded ",(0,s.jsxs)(t.a,{href:"https://github.com/projectatomic/containerd/blob/master/docs/cli.md",children:[(0,s.jsx)(t.code,{children:"ctr"})," command"]}),". This is a CLI for containerd, the container daemon used by K3s. Useful for debugging."]})]}),(0,s.jsxs)(t.tr,{children:[(0,s.jsx)(t.td,{children:(0,s.jsx)(t.code,{children:"k3s token"})}),(0,s.jsxs)(t.td,{children:["Manage bootstrap tokens. See the ",(0,s.jsxs)(t.a,{href:"/cli/token",children:[(0,s.jsx)(t.code,{children:"k3s token"})," command documentation"]})," for more information."]})]}),(0,s.jsxs)(t.tr,{children:[(0,s.jsx)(t.td,{children:(0,s.jsx)(t.code,{children:"k3s etcd-snapshot"})}),(0,s.jsxs)(t.td,{children:["Perform on demand backups of the K3s cluster data and upload to S3. See the ",(0,s.jsxs)(t.a,{href:"/cli/etcd-snapshot",children:[(0,s.jsx)(t.code,{children:"k3s etcd-snapshot"})," command documentation"]})," for more information."]})]}),(0,s.jsxs)(t.tr,{children:[(0,s.jsx)(t.td,{children:(0,s.jsx)(t.code,{children:"k3s secrets-encrypt"})}),(0,s.jsxs)(t.td,{children:["Configure K3s to encrypt secrets when storing them in the cluster. See the ",(0,s.jsxs)(t.a,{href:"/cli/secrets-encrypt",children:[(0,s.jsx)(t.code,{children:"k3s secrets-encrypt"})," command documentation"]})," for more information."]})]}),(0,s.jsxs)(t.tr,{children:[(0,s.jsx)(t.td,{children:(0,s.jsx)(t.code,{children:"k3s certificate"})}),(0,s.jsxs)(t.td,{children:["Manage K3s certificates. See the ",(0,s.jsxs)(t.a,{href:"/cli/certificate",children:[(0,s.jsx)(t.code,{children:"k3s certificate"})," command documentation"]})," for more information."]})]}),(0,s.jsxs)(t.tr,{children:[(0,s.jsx)(t.td,{children:(0,s.jsx)(t.code,{children:"k3s completion"})}),(0,s.jsx)(t.td,{children:"Generate shell completion scripts for k3s"})]}),(0,s.jsxs)(t.tr,{children:[(0,s.jsx)(t.td,{children:(0,s.jsx)(t.code,{children:"k3s help"})}),(0,s.jsx)(t.td,{children:"Shows a list of commands or help for one command"})]})]})]})]})}function a(e={}){const{wrapper:t}={...(0,r.a)(),...e.components};return t?(0,s.jsx)(t,{...e,children:(0,s.jsx)(h,{...e})}):h(e)}},1151:(e,t,n)=>{n.d(t,{Z:()=>o,a:()=>d});var s=n(7294);const r={},c=s.createContext(r);function d(e){const t=s.useContext(c);return s.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function o(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(r):e.components||r:d(e.components),s.createElement(c.Provider,{value:t},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/9e7a009d.c32e204e.js b/assets/js/9e7a009d.32e63337.js similarity index 99% rename from assets/js/9e7a009d.c32e204e.js rename to assets/js/9e7a009d.32e63337.js index 71ec1eef0..2b8413d01 100644 --- a/assets/js/9e7a009d.c32e204e.js +++ b/assets/js/9e7a009d.32e63337.js @@ -1 +1 @@ -"use strict";(self.webpackChunkk_3_s_docs=self.webpackChunkk_3_s_docs||[]).push([[7251],{6253:(e,s,t)=>{t.r(s),t.d(s,{assets:()=>c,contentTitle:()=>l,default:()=>o,frontMatter:()=>n,metadata:()=>h,toc:()=>d});var i=t(5893),r=t(1151);const n={hide_table_of_contents:!0,sidebar_position:6},l="v1.25.X",h={id:"release-notes/v1.25.X",title:"v1.25.X",description:"Before upgrading from earlier releases, be sure to read the Kubernetes Urgent Upgrade Notes.",source:"@site/docs/release-notes/v1.25.X.md",sourceDirName:"release-notes",slug:"/release-notes/v1.25.X",permalink:"/release-notes/v1.25.X",draft:!1,unlisted:!1,editUrl:"https://github.com/k3s-io/docs/edit/main/docs/release-notes/v1.25.X.md",tags:[],version:"current",lastUpdatedAt:1723651727e3,sidebarPosition:6,frontMatter:{hide_table_of_contents:!0,sidebar_position:6},sidebar:"mySidebar",previous:{title:"v1.26.X",permalink:"/release-notes/v1.26.X"},next:{title:"v1.24.X",permalink:"/release-notes/v1.24.X"}},c={},d=[{value:"Release v1.25.16+k3s4",id:"release-v12516k3s4",level:2},{value:"Changes since v1.25.15+k3s2:",id:"changes-since-v12515k3s2",level:3},{value:"Release v1.25.15+k3s2",id:"release-v12515k3s2",level:2},{value:"Changes since v1.25.15+k3s1:",id:"changes-since-v12515k3s1",level:3},{value:"Release v1.25.15+k3s1",id:"release-v12515k3s1",level:2},{value:"Changes since v1.25.14+k3s1:",id:"changes-since-v12514k3s1",level:3},{value:"Release v1.25.14+k3s1",id:"release-v12514k3s1",level:2},{value:"Changes since v1.25.13+k3s1:",id:"changes-since-v12513k3s1",level:3},{value:"Release v1.25.13+k3s1",id:"release-v12513k3s1",level:2},{value:"Changes since v1.25.12+k3s1:",id:"changes-since-v12512k3s1",level:3},{value:"Release v1.25.12+k3s1",id:"release-v12512k3s1",level:2},{value:"Changes since v1.25.11+k3s1:",id:"changes-since-v12511k3s1",level:3},{value:"Release v1.25.11+k3s1",id:"release-v12511k3s1",level:2},{value:"Changes since v1.25.10+k3s1:",id:"changes-since-v12510k3s1",level:3},{value:"Release v1.25.10+k3s1",id:"release-v12510k3s1",level:2},{value:"Changes since v1.25.9+k3s1:",id:"changes-since-v1259k3s1",level:3},{value:"Release v1.25.9+k3s1",id:"release-v1259k3s1",level:2},{value:"Changes since v1.25.8+k3s1:",id:"changes-since-v1258k3s1",level:3},{value:"Release v1.25.8+k3s1",id:"release-v1258k3s1",level:2},{value:"Changes since v1.25.7+k3s1:",id:"changes-since-v1257k3s1",level:3},{value:"Release v1.25.7+k3s1",id:"release-v1257k3s1",level:2},{value:"Changes since v1.25.6+k3s1:",id:"changes-since-v1256k3s1",level:3},{value:"Release v1.25.6+k3s1",id:"release-v1256k3s1",level:2},{value:"Changes since v1.25.5+k3s2:",id:"changes-since-v1255k3s2",level:3},{value:"Release v1.25.5+k3s2",id:"release-v1255k3s2",level:2},{value:"Changes since v1.25.5+k3s1:",id:"changes-since-v1255k3s1",level:3},{value:"Release v1.25.5+k3s1",id:"release-v1255k3s1",level:2},{value:"\u26a0\ufe0f WARNING",id:"\ufe0f-warning",level:2},{value:"Changes since v1.25.4+k3s1:",id:"changes-since-v1254k3s1",level:3},{value:"Release v1.25.4+k3s1",id:"release-v1254k3s1",level:2},{value:"Changes since v1.25.3+k3s1:",id:"changes-since-v1253k3s1",level:3},{value:"Release v1.25.3+k3s1",id:"release-v1253k3s1",level:2},{value:"Changes since v1.25.2+k3s1:",id:"changes-since-v1252k3s1",level:3},{value:"Release v1.25.2+k3s1",id:"release-v1252k3s1",level:2},{value:"Changes since v1.25.0+k3s1:",id:"changes-since-v1250k3s1",level:3},{value:"Release v1.25.0+k3s1",id:"release-v1250k3s1",level:2},{value:"Changes since v1.24.4+k3s1:",id:"changes-since-v1244k3s1",level:3}];function a(e){const s={a:"a",admonition:"admonition",blockquote:"blockquote",br:"br",code:"code",h1:"h1",h2:"h2",h3:"h3",header:"header",hr:"hr",li:"li",p:"p",strong:"strong",table:"table",tbody:"tbody",td:"td",th:"th",thead:"thead",tr:"tr",ul:"ul",...(0,r.a)(),...e.components};return(0,i.jsxs)(i.Fragment,{children:[(0,i.jsx)(s.header,{children:(0,i.jsx)(s.h1,{id:"v125x",children:"v1.25.X"})}),"\n",(0,i.jsx)(s.admonition,{title:"Upgrade Notice",type:"warning",children:(0,i.jsxs)(s.p,{children:["Before upgrading from earlier releases, be sure to read the Kubernetes ",(0,i.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.25.md#urgent-upgrade-notes",children:"Urgent Upgrade Notes"}),"."]})}),"\n",(0,i.jsxs)(s.table,{children:[(0,i.jsx)(s.thead,{children:(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.th,{children:"Version"}),(0,i.jsx)(s.th,{children:"Release date"}),(0,i.jsx)(s.th,{children:"Kubernetes"}),(0,i.jsx)(s.th,{children:"Kine"}),(0,i.jsx)(s.th,{children:"SQLite"}),(0,i.jsx)(s.th,{children:"Etcd"}),(0,i.jsx)(s.th,{children:"Containerd"}),(0,i.jsx)(s.th,{children:"Runc"}),(0,i.jsx)(s.th,{children:"Flannel"}),(0,i.jsx)(s.th,{children:"Metrics-server"}),(0,i.jsx)(s.th,{children:"Traefik"}),(0,i.jsx)(s.th,{children:"CoreDNS"}),(0,i.jsx)(s.th,{children:"Helm-controller"}),(0,i.jsx)(s.th,{children:"Local-path-provisioner"})]})}),(0,i.jsxs)(s.tbody,{children:[(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"/release-notes/v1.25.X#release-v12516k3s4",children:"v1.25.16+k3s4"})}),(0,i.jsx)(s.td,{children:"Dec 07 2023"}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.25.md#v12516",children:"v1.25.16"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/kine/releases/tag/v0.11.0",children:"v0.11.0"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://sqlite.org/releaselog/3_42_0.html",children:"3.42.0"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/etcd/releases/tag/v3.5.3-k3s1",children:"v3.5.3-k3s1"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/containerd/releases/tag/v1.7.7-k3s1",children:"v1.7.7-k3s1"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/opencontainers/runc/releases/tag/v1.1.8",children:"v1.1.8"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/flannel-io/flannel/releases/tag/v0.22.2",children:"v0.22.2"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.6.3",children:"v0.6.3"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/traefik/traefik/releases/tag/v2.10.5",children:"v2.10.5"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/coredns/coredns/releases/tag/v1.10.1",children:"v1.10.1"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/helm-controller/releases/tag/v0.15.4",children:"v0.15.4"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/rancher/local-path-provisioner/releases/tag/v0.0.24",children:"v0.0.24"})})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"/release-notes/v1.25.X#release-v12515k3s2",children:"v1.25.15+k3s2"})}),(0,i.jsx)(s.td,{children:"Nov 08 2023"}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.25.md#v12515",children:"v1.25.15"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/kine/releases/tag/v0.10.3",children:"v0.10.3"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://sqlite.org/releaselog/3_42_0.html",children:"3.42.0"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/etcd/releases/tag/v3.5.3-k3s1",children:"v3.5.3-k3s1"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/containerd/releases/tag/v1.7.7-k3s1",children:"v1.7.7-k3s1"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/opencontainers/runc/releases/tag/v1.1.8",children:"v1.1.8"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/flannel-io/flannel/releases/tag/v0.22.2",children:"v0.22.2"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.6.3",children:"v0.6.3"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/traefik/traefik/releases/tag/v2.10.5",children:"v2.10.5"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/coredns/coredns/releases/tag/v1.10.1",children:"v1.10.1"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/helm-controller/releases/tag/v0.15.4",children:"v0.15.4"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/rancher/local-path-provisioner/releases/tag/v0.0.24",children:"v0.0.24"})})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"/release-notes/v1.25.X#release-v12515k3s1",children:"v1.25.15+k3s1"})}),(0,i.jsx)(s.td,{children:"Oct 30 2023"}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.25.md#v12515",children:"v1.25.15"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/kine/releases/tag/v0.10.3",children:"v0.10.3"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://sqlite.org/releaselog/3_42_0.html",children:"3.42.0"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/etcd/releases/tag/v3.5.3-k3s1",children:"v3.5.3-k3s1"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/containerd/releases/tag/v1.7.7-k3s1",children:"v1.7.7-k3s1"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/opencontainers/runc/releases/tag/v1.1.8",children:"v1.1.8"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/flannel-io/flannel/releases/tag/v0.22.2",children:"v0.22.2"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.6.3",children:"v0.6.3"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/traefik/traefik/releases/tag/v2.10.5",children:"v2.10.5"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/coredns/coredns/releases/tag/v1.10.1",children:"v1.10.1"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/helm-controller/releases/tag/v0.15.4",children:"v0.15.4"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/rancher/local-path-provisioner/releases/tag/v0.0.24",children:"v0.0.24"})})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"/release-notes/v1.25.X#release-v12514k3s1",children:"v1.25.14+k3s1"})}),(0,i.jsx)(s.td,{children:"Sep 20 2023"}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.25.md#v12514",children:"v1.25.14"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/kine/releases/tag/v0.10.3",children:"v0.10.3"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://sqlite.org/releaselog/3_42_0.html",children:"3.42.0"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/etcd/releases/tag/v3.5.3-k3s1",children:"v3.5.3-k3s1"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/containerd/releases/tag/v1.7.6-k3s1",children:"v1.7.6-k3s1"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/opencontainers/runc/releases/tag/v1.1.8",children:"v1.1.8"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/flannel-io/flannel/releases/tag/v0.22.2",children:"v0.22.2"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.6.3",children:"v0.6.3"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/traefik/traefik/releases/tag/v2.9.10",children:"v2.9.10"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/coredns/coredns/releases/tag/v1.10.1",children:"v1.10.1"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/helm-controller/releases/tag/v0.15.4",children:"v0.15.4"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/rancher/local-path-provisioner/releases/tag/v0.0.24",children:"v0.0.24"})})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"/release-notes/v1.25.X#release-v12513k3s1",children:"v1.25.13+k3s1"})}),(0,i.jsx)(s.td,{children:"Sep 05 2023"}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.25.md#v12513",children:"v1.25.13"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/kine/releases/tag/v0.10.2",children:"v0.10.2"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://sqlite.org/releaselog/3_42_0.html",children:"3.42.0"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/etcd/releases/tag/v3.5.3-k3s1",children:"v3.5.3-k3s1"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/containerd/releases/tag/v1.7.3-k3s1",children:"v1.7.3-k3s1"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/opencontainers/runc/releases/tag/v1.1.8",children:"v1.1.8"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/flannel-io/flannel/releases/tag/v0.22.2",children:"v0.22.2"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.6.3",children:"v0.6.3"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/traefik/traefik/releases/tag/v2.9.10",children:"v2.9.10"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/coredns/coredns/releases/tag/v1.10.1",children:"v1.10.1"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/helm-controller/releases/tag/v0.15.4",children:"v0.15.4"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/rancher/local-path-provisioner/releases/tag/v0.0.24",children:"v0.0.24"})})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"/release-notes/v1.25.X#release-v12512k3s1",children:"v1.25.12+k3s1"})}),(0,i.jsx)(s.td,{children:"Jul 27 2023"}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.25.md#v12512",children:"v1.25.12"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/kine/releases/tag/v0.10.1",children:"v0.10.1"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://sqlite.org/releaselog/3_39_2.html",children:"3.39.2"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/etcd/releases/tag/v3.5.3-k3s1",children:"v3.5.3-k3s1"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/containerd/releases/tag/v1.7.1-k3s1",children:"v1.7.1-k3s1"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/opencontainers/runc/releases/tag/v1.1.7",children:"v1.1.7"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/flannel-io/flannel/releases/tag/v0.22.0",children:"v0.22.0"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.6.3",children:"v0.6.3"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/traefik/traefik/releases/tag/v2.9.10",children:"v2.9.10"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/coredns/coredns/releases/tag/v1.10.1",children:"v1.10.1"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/helm-controller/releases/tag/v0.15.2",children:"v0.15.2"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/rancher/local-path-provisioner/releases/tag/v0.0.24",children:"v0.0.24"})})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"/release-notes/v1.25.X#release-v12511k3s1",children:"v1.25.11+k3s1"})}),(0,i.jsx)(s.td,{children:"Jun 26 2023"}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.25.md#v12511",children:"v1.25.11"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/kine/releases/tag/v0.10.1",children:"v0.10.1"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://sqlite.org/releaselog/3_39_2.html",children:"3.39.2"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/etcd/releases/tag/v3.5.3-k3s1",children:"v3.5.3-k3s1"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/containerd/releases/tag/v1.7.1-k3s1",children:"v1.7.1-k3s1"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/opencontainers/runc/releases/tag/v1.1.7",children:"v1.1.7"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/flannel-io/flannel/releases/tag/v0.22.0",children:"v0.22.0"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.6.3",children:"v0.6.3"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/traefik/traefik/releases/tag/v2.9.10",children:"v2.9.10"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/coredns/coredns/releases/tag/v1.10.1",children:"v1.10.1"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/helm-controller/releases/tag/v0.15.0",children:"v0.15.0"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/rancher/local-path-provisioner/releases/tag/v0.0.24",children:"v0.0.24"})})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"/release-notes/v1.25.X#release-v12510k3s1",children:"v1.25.10+k3s1"})}),(0,i.jsx)(s.td,{children:"May 26 2023"}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.25.md#v12510",children:"v1.25.10"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/kine/releases/tag/v0.10.1",children:"v0.10.1"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://sqlite.org/releaselog/3_39_2.html",children:"3.39.2"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/etcd/releases/tag/v3.5.3-k3s1",children:"v3.5.3-k3s1"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/containerd/releases/tag/v1.7.1-k3s1",children:"v1.7.1-k3s1"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/opencontainers/runc/releases/tag/v1.1.7",children:"v1.1.7"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/flannel-io/flannel/releases/tag/v0.21.4",children:"v0.21.4"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.6.2",children:"v0.6.2"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/traefik/traefik/releases/tag/v2.9.10",children:"v2.9.10"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/coredns/coredns/releases/tag/v1.10.1",children:"v1.10.1"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/helm-controller/releases/tag/v0.14.0",children:"v0.14.0"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/rancher/local-path-provisioner/releases/tag/v0.0.24",children:"v0.0.24"})})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"/release-notes/v1.25.X#release-v1259k3s1",children:"v1.25.9+k3s1"})}),(0,i.jsx)(s.td,{children:"Apr 20 2023"}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.25.md#v1259",children:"v1.25.9"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/kine/releases/tag/v0.9.9",children:"v0.9.9"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://sqlite.org/releaselog/3_39_2.html",children:"3.39.2"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/etcd/releases/tag/v3.5.3-k3s1",children:"v3.5.3-k3s1"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/containerd/releases/tag/v1.6.19-k3s1",children:"v1.6.19-k3s1"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/opencontainers/runc/releases/tag/v1.1.5",children:"v1.1.5"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/flannel-io/flannel/releases/tag/v0.21.4",children:"v0.21.4"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.6.2",children:"v0.6.2"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/traefik/traefik/releases/tag/v2.9.4",children:"v2.9.4"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/coredns/coredns/releases/tag/v1.10.1",children:"v1.10.1"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/helm-controller/releases/tag/v0.13.3",children:"v0.13.3"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/rancher/local-path-provisioner/releases/tag/v0.0.24",children:"v0.0.24"})})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"/release-notes/v1.25.X#release-v1258k3s1",children:"v1.25.8+k3s1"})}),(0,i.jsx)(s.td,{children:"Mar 27 2023"}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.25.md#v1258",children:"v1.25.8"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/kine/releases/tag/v0.9.9",children:"v0.9.9"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://sqlite.org/releaselog/3_39_2.html",children:"3.39.2"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/etcd/releases/tag/v3.5.3-k3s1",children:"v3.5.3-k3s1"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/containerd/releases/tag/v1.6.19-k3s1",children:"v1.6.19-k3s1"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/opencontainers/runc/releases/tag/v1.1.4",children:"v1.1.4"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/flannel-io/flannel/releases/tag/v0.21.4",children:"v0.21.4"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.6.2",children:"v0.6.2"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/traefik/traefik/releases/tag/v2.9.4",children:"v2.9.4"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/coredns/coredns/releases/tag/v1.9.4",children:"v1.9.4"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/helm-controller/releases/tag/v0.13.1",children:"v0.13.1"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/rancher/local-path-provisioner/releases/tag/v0.0.23",children:"v0.0.23"})})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"/release-notes/v1.25.X#release-v1257k3s1",children:"v1.25.7+k3s1"})}),(0,i.jsx)(s.td,{children:"Mar 10 2023"}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.25.md#v1257",children:"v1.25.7"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/kine/releases/tag/v0.9.9",children:"v0.9.9"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://sqlite.org/releaselog/3_39_2.html",children:"3.39.2"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/etcd/releases/tag/v3.5.3-k3s1",children:"v3.5.3-k3s1"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/containerd/releases/tag/v1.6.15-k3s1",children:"v1.6.15-k3s1"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/opencontainers/runc/releases/tag/v1.1.4",children:"v1.1.4"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/flannel-io/flannel/releases/tag/v0.21.1",children:"v0.21.1"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.6.2",children:"v0.6.2"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/traefik/traefik/releases/tag/v2.9.4",children:"v2.9.4"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/coredns/coredns/releases/tag/v1.9.4",children:"v1.9.4"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/helm-controller/releases/tag/v0.13.1",children:"v0.13.1"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/rancher/local-path-provisioner/releases/tag/v0.0.23",children:"v0.0.23"})})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"/release-notes/v1.25.X#release-v1256k3s1",children:"v1.25.6+k3s1"})}),(0,i.jsx)(s.td,{children:"Jan 26 2023"}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.25.md#v1256",children:"v1.25.6"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/kine/releases/tag/v0.9.6",children:"v0.9.6"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://sqlite.org/releaselog/3_39_2.html",children:"3.39.2"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/etcd/releases/tag/v3.5.3-k3s1",children:"v3.5.3-k3s1"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/containerd/releases/tag/v1.6.15-k3s1",children:"v1.6.15-k3s1"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/opencontainers/runc/releases/tag/v1.1.4",children:"v1.1.4"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/flannel-io/flannel/releases/tag/v0.20.2",children:"v0.20.2"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.6.2",children:"v0.6.2"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/traefik/traefik/releases/tag/v2.9.4",children:"v2.9.4"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/coredns/coredns/releases/tag/v1.9.4",children:"v1.9.4"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/helm-controller/releases/tag/v0.13.1",children:"v0.13.1"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/rancher/local-path-provisioner/releases/tag/v0.0.23",children:"v0.0.23"})})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"/release-notes/v1.25.X#release-v1255k3s2",children:"v1.25.5+k3s2"})}),(0,i.jsx)(s.td,{children:"Jan 11 2023"}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.25.md#v1255",children:"v1.25.5"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/kine/releases/tag/v0.9.6",children:"v0.9.6"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://sqlite.org/releaselog/3_39_2.html",children:"3.39.2"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/etcd/releases/tag/v3.5.3-k3s1",children:"v3.5.3-k3s1"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/containerd/releases/tag/v1.6.14-k3s1",children:"v1.6.14-k3s1"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/opencontainers/runc/releases/tag/v1.1.4",children:"v1.1.4"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/flannel-io/flannel/releases/tag/v0.20.2",children:"v0.20.2"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.6.2",children:"v0.6.2"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/traefik/traefik/releases/tag/v2.9.4",children:"v2.9.4"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/coredns/coredns/releases/tag/v1.9.4",children:"v1.9.4"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/helm-controller/releases/tag/v0.13.1",children:"v0.13.1"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/rancher/local-path-provisioner/releases/tag/v0.0.23",children:"v0.0.23"})})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"/release-notes/v1.25.X#release-v1255k3s1",children:"v1.25.5+k3s1"})}),(0,i.jsx)(s.td,{children:"Dec 20 2022"}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.25.md#v1255",children:"v1.25.5"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/kine/releases/tag/v0.9.6",children:"v0.9.6"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://sqlite.org/releaselog/3_39_2.html",children:"3.39.2"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/etcd/releases/tag/v3.5.3-k3s1",children:"v3.5.3-k3s1"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/containerd/releases/tag/v1.6.12-k3s1",children:"v1.6.12-k3s1"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/opencontainers/runc/releases/tag/v1.1.4",children:"v1.1.4"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/flannel-io/flannel/releases/tag/v0.20.2",children:"v0.20.2"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.6.2",children:"v0.6.2"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/traefik/traefik/releases/tag/v2.9.4",children:"v2.9.4"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/coredns/coredns/releases/tag/v1.9.4",children:"v1.9.4"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/helm-controller/releases/tag/v0.13.1",children:"v0.13.1"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/rancher/local-path-provisioner/releases/tag/v0.0.23",children:"v0.0.23"})})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"/release-notes/v1.25.X#release-v1254k3s1",children:"v1.25.4+k3s1"})}),(0,i.jsx)(s.td,{children:"Nov 18 2022"}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.25.md#v1254",children:"v1.25.4"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/kine/releases/tag/v0.9.6",children:"v0.9.6"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://sqlite.org/releaselog/3_39_2.html",children:"3.39.2"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/etcd/releases/tag/v3.5.3-k3s1",children:"v3.5.3-k3s1"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/containerd/releases/tag/v1.6.8-k3s1",children:"v1.6.8-k3s1"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/opencontainers/runc/releases/tag/v1.1.4",children:"v1.1.4"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/flannel-io/flannel/releases/tag/v0.20.1",children:"v0.20.1"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.6.1",children:"v0.6.1"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/traefik/traefik/releases/tag/v2.9.4",children:"v2.9.4"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/coredns/coredns/releases/tag/v1.9.4",children:"v1.9.4"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/helm-controller/releases/tag/v0.13.0",children:"v0.13.0"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/rancher/local-path-provisioner/releases/tag/v0.0.23",children:"v0.0.23"})})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"/release-notes/v1.25.X#release-v1253k3s1",children:"v1.25.3+k3s1"})}),(0,i.jsx)(s.td,{children:"Oct 25 2022"}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.25.md#v1253",children:"v1.25.3"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/kine/releases/tag/v0.9.3",children:"v0.9.3"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://sqlite.org/releaselog/3_36_0.html",children:"3.36.0"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/etcd/releases/tag/v3.5.3-k3s1",children:"v3.5.3-k3s1"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/containerd/releases/tag/v1.6.8-k3s1",children:"v1.6.8-k3s1"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/opencontainers/runc/releases/tag/v1.1.4",children:"v1.1.4"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/flannel-io/flannel/releases/tag/v0.19.2",children:"v0.19.2"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.6.1",children:"v0.6.1"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/traefik/traefik/releases/tag/v2.9.1",children:"v2.9.1"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/coredns/coredns/releases/tag/v1.9.1",children:"v1.9.1"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/helm-controller/releases/tag/v0.12.3",children:"v0.12.3"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/rancher/local-path-provisioner/releases/tag/v0.0.21",children:"v0.0.21"})})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"/release-notes/v1.25.X#release-v1252k3s1",children:"v1.25.2+k3s1"})}),(0,i.jsx)(s.td,{children:"Sep 28 2022"}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.25.md#v1252",children:"v1.25.2"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/kine/releases/tag/v0.9.3",children:"v0.9.3"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://sqlite.org/releaselog/3_36_0.html",children:"3.36.0"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/etcd/releases/tag/v3.5.3-k3s1",children:"v3.5.3-k3s1"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/containerd/releases/tag/v1.6.8-k3s1",children:"v1.6.8-k3s1"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/opencontainers/runc/releases/tag/v1.1.4",children:"v1.1.4"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/flannel-io/flannel/releases/tag/v0.19.2",children:"v0.19.2"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.5.2",children:"v0.5.2"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/traefik/traefik/releases/tag/v2.6.2",children:"v2.6.2"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/coredns/coredns/releases/tag/v1.9.1",children:"v1.9.1"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/helm-controller/releases/tag/v0.12.3",children:"v0.12.3"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/rancher/local-path-provisioner/releases/tag/v0.0.21",children:"v0.0.21"})})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"/release-notes/v1.25.X#release-v1250k3s1",children:"v1.25.0+k3s1"})}),(0,i.jsx)(s.td,{children:"Sep 12 2022"}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.25.md#v1250",children:"v1.25.0"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/kine/releases/tag/v0.9.3",children:"v0.9.3"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://sqlite.org/releaselog/3_36_0.html",children:"3.36.0"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/etcd/releases/tag/v3.5.3-k3s1",children:"v3.5.3-k3s1"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/containerd/releases/tag/v1.5.13-k3s2",children:"v1.5.13-k3s2"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/opencontainers/runc/releases/tag/v1.1.3",children:"v1.1.3"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/flannel-io/flannel/releases/tag/v0.19.1",children:"v0.19.1"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.5.2",children:"v0.5.2"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/traefik/traefik/releases/tag/v2.6.2",children:"v2.6.2"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/coredns/coredns/releases/tag/v1.9.1",children:"v1.9.1"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/helm-controller/releases/tag/v0.12.3",children:"v0.12.3"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/rancher/local-path-provisioner/releases/tag/v0.0.21",children:"v0.0.21"})})]})]})]}),"\n",(0,i.jsx)("br",{}),"\n",(0,i.jsxs)(s.h2,{id:"release-v12516k3s4",children:["Release ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/releases/tag/v1.25.16+k3s4",children:"v1.25.16+k3s4"})]}),"\n",(0,i.jsx)(s.p,{children:"This release updates Kubernetes to v1.25.16, and fixes a number of issues."}),"\n",(0,i.jsxs)(s.p,{children:["For more details on what's new, see the ",(0,i.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.25.md#changelog-since-v12515",children:"Kubernetes release notes"}),"."]}),"\n",(0,i.jsx)(s.h3,{id:"changes-since-v12515k3s2",children:"Changes since v1.25.15+k3s2:"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsxs)(s.li,{children:["Etcd status condition ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8819",children:"(#8819)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Backports for 2023-11 release ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8880",children:"(#8880)"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsxs)(s.li,{children:["New timezone info in Docker image allows the use of ",(0,i.jsx)(s.code,{children:"spec.timeZone"})," in CronJobs"]}),"\n",(0,i.jsx)(s.li,{children:"Bumped kine to v0.11.0 to resolve issues with postgres and NATS, fix performance of watch channels under heavy load, and improve compatibility with the reference implementation."}),"\n",(0,i.jsxs)(s.li,{children:["Containerd may now be configured to use rdt or blockio configuration by defining ",(0,i.jsx)(s.code,{children:"rdt_config.yaml"})," or ",(0,i.jsx)(s.code,{children:"blockio_config.yaml"})," files."]}),"\n",(0,i.jsx)(s.li,{children:"Add agent flag disable-apiserver-lb, agent will not start load balance proxy."}),"\n",(0,i.jsx)(s.li,{children:"Improved ingress IP ordering from ServiceLB"}),"\n",(0,i.jsx)(s.li,{children:"Disable helm CRD installation for disable-helm-controller"}),"\n",(0,i.jsx)(s.li,{children:"Omit snapshot list configmap entries for snapshots without extra metadata"}),"\n",(0,i.jsx)(s.li,{children:"Add jitter to client config retry to avoid hammering servers when they are starting up"}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(s.li,{children:["Handle nil pointer when runtime core is not ready in etcd ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8889",children:"(#8889)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Improve dualStack log ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8867",children:"(#8867)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Bump dynamiclistener; reduce snapshot controller log spew ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8904",children:"(#8904)"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsx)(s.li,{children:"Bumped dynamiclistener to address a race condition that could cause a server to fail to sync its certificates into the Kubernetes secret"}),"\n",(0,i.jsx)(s.li,{children:"Reduced etcd snapshot log spam during initial cluster startup"}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(s.li,{children:["Fix etcd snapshot S3 issues ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8939",children:"(#8939)"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsx)(s.li,{children:"Don't apply S3 retention if S3 client failed to initialize"}),"\n",(0,i.jsx)(s.li,{children:"Don't request metadata when listing S3 snapshots"}),"\n",(0,i.jsx)(s.li,{children:"Print key instead of file path in snapshot metadata log message"}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(s.li,{children:["Update to v1.25.16 ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8923",children:"(#8923)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Remove s390x steps temporarily since runners are disabled ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8993",children:"(#8993)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Remove s390x from manifest script ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8994",children:"(#8994)"})]}),"\n"]}),"\n",(0,i.jsx)(s.hr,{}),"\n",(0,i.jsxs)(s.h2,{id:"release-v12515k3s2",children:["Release ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/releases/tag/v1.25.15+k3s2",children:"v1.25.15+k3s2"})]}),"\n",(0,i.jsx)(s.p,{children:"This release updates Kubernetes to v1.25.15, and fixes a number of issues."}),"\n",(0,i.jsxs)(s.p,{children:["For more details on what's new, see the ",(0,i.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.25.md#changelog-since-v12515",children:"Kubernetes release notes"}),"."]}),"\n",(0,i.jsx)(s.h3,{id:"changes-since-v12515k3s1",children:"Changes since v1.25.15+k3s1:"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsxs)(s.li,{children:["E2E Domain Drone Cleanup ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8584",children:"(#8584)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Fix SystemdCgroup in templates_linux.go ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8767",children:"(#8767)"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsx)(s.li,{children:"Fixed an issue with identifying additional container runtimes"}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(s.li,{children:["Update traefik chart to v25.0.0 ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8777",children:"(#8777)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Update traefik to fix registry value ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8791",children:"(#8791)"})]}),"\n"]}),"\n",(0,i.jsx)(s.hr,{}),"\n",(0,i.jsxs)(s.h2,{id:"release-v12515k3s1",children:["Release ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/releases/tag/v1.25.15+k3s1",children:"v1.25.15+k3s1"})]}),"\n",(0,i.jsx)(s.p,{children:"This release updates Kubernetes to v1.25.15, and fixes a number of issues."}),"\n",(0,i.jsxs)(s.p,{children:["For more details on what's new, see the ",(0,i.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.25.md#changelog-since-v12514",children:"Kubernetes release notes"}),"."]}),"\n",(0,i.jsx)(s.h3,{id:"changes-since-v12514k3s1",children:"Changes since v1.25.14+k3s1:"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsxs)(s.li,{children:["Fix error reporting ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8413",children:"(#8413)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Add context to flannel errors ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8421",children:"(#8421)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Testing Backports for September ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8301",children:"(#8301)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Include the interface name in the error message ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8437",children:"(#8437)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Add extraArgs to tailscale ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8466",children:"(#8466)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Update kube-router ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8445",children:"(#8445)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Added error when cluster reset while using server flag ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8457",children:"(#8457)"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsx)(s.li,{children:"The user will receive a error when --cluster-reset with the --server flag"}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(s.li,{children:["Cluster reset from non bootstrap nodes ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8454",children:"(#8454)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Fix spellcheck problem ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8511",children:"(#8511)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Take IPFamily precedence based on order ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8506",children:"(#8506)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Network defaults are duplicated, remove one ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8553",children:"(#8553)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Advertise address integration test ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8518",children:"(#8518)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Fixed tailscale node IP dualstack mode in case of IPv4 only node ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8560",children:"(#8560)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Server Token Rotation ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8578",children:"(#8578)"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsxs)(s.li,{children:["Users can now rotate the server token using ",(0,i.jsx)(s.code,{children:"k3s token rotate -t --new-token "}),". After command succeeds, all server nodes must be restarted with the new token."]}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(s.li,{children:["Clear remove annotations on cluster reset ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8589",children:"(#8589)"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsx)(s.li,{children:"Fixed an issue that could cause k3s to attempt to remove members from the etcd cluster immediately following a cluster-reset/restore, if they were queued for removal at the time the snapshot was taken."}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(s.li,{children:["Use IPv6 in case is the first configured IP with dualstack ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8599",children:"(#8599)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Backports for 2023-10 release ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8617",children:"(#8617)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Update kube-router package in build script ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8636",children:"(#8636)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Add etcd-only/control-plane-only server test and fix control-plane-only server crash ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8644",children:"(#8644)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Windows agent support ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8646",children:"(#8646)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Use ",(0,i.jsx)(s.code,{children:"version.Program"})," not K3s in token rotate logs ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8654",children:"(#8654)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Add --image-service-endpoint flag (#8279) ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8664",children:"(#8664)"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsxs)(s.li,{children:["Add ",(0,i.jsx)(s.code,{children:"--image-service-endpoint"})," flag to specify an external image service socket."]}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(s.li,{children:["Backport etcd fixes ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8692",children:"(#8692)"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsx)(s.li,{children:"Re-enable etcd endpoint auto-sync"}),"\n",(0,i.jsx)(s.li,{children:"Manually requeue configmap reconcile when no nodes have reconciled snapshots"}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(s.li,{children:["Update to v1.25.15 and Go to v1.20.10 ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8679",children:"(#8679)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Fix s3 snapshot restore ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8735",children:"(#8735)"})]}),"\n"]}),"\n",(0,i.jsx)(s.hr,{}),"\n",(0,i.jsxs)(s.h2,{id:"release-v12514k3s1",children:["Release ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/releases/tag/v1.25.14+k3s1",children:"v1.25.14+k3s1"})]}),"\n",(0,i.jsx)(s.p,{children:"This release updates Kubernetes to v1.25.14, and fixes a number of issues."}),"\n",(0,i.jsxs)(s.p,{children:["For more details on what's new, see the ",(0,i.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.25.md#changelog-since-v12513",children:"Kubernetes release notes"}),"."]}),"\n",(0,i.jsx)(s.h3,{id:"changes-since-v12513k3s1",children:"Changes since v1.25.13+k3s1:"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsxs)(s.li,{children:["Bump kine to v0.10.3 ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8326",children:"(#8326)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Update Kubernetes to v1.25.14 and go to 1.20.8 ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8350",children:"(#8350)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Backport containerd bump and and test fixes ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8384",children:"(#8384)"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsx)(s.li,{children:"Bump embedded containerd to v1.7.6"}),"\n",(0,i.jsx)(s.li,{children:"Bump embedded stargz-snapshotter plugin to latest"}),"\n",(0,i.jsx)(s.li,{children:"Fixed intermittent drone CI failures due to race conditions in test environment setup scripts"}),"\n",(0,i.jsx)(s.li,{children:"Fixed CI failures due to changes to api discovery changes in Kubernetes 1.28"}),"\n"]}),"\n"]}),"\n"]}),"\n",(0,i.jsx)(s.hr,{}),"\n",(0,i.jsxs)(s.h2,{id:"release-v12513k3s1",children:["Release ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/releases/tag/v1.25.13+k3s1",children:"v1.25.13+k3s1"})]}),"\n",(0,i.jsx)(s.p,{children:"This release updates Kubernetes to v1.25.13, and fixes a number of issues."}),"\n",(0,i.jsx)(s.admonition,{title:"Important",type:"warning",children:(0,i.jsxs)(s.p,{children:["This release includes support for remediating CVE-2023-32187, a potential Denial of Service attack vector on K3s servers. See ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/security/advisories/GHSA-m4hf-6vgr-75r2",children:"https://github.com/k3s-io/k3s/security/advisories/GHSA-m4hf-6vgr-75r2"})," for more information, including mandatory steps necessary to harden clusters against this vulnerability."]})}),"\n",(0,i.jsxs)(s.p,{children:["For more details on what's new, see the ",(0,i.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.25.md#changelog-since-v12512",children:"Kubernetes release notes"}),"."]}),"\n",(0,i.jsx)(s.h3,{id:"changes-since-v12512k3s1",children:"Changes since v1.25.12+k3s1:"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsxs)(s.li,{children:["Update flannel and plugins ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8076",children:"(#8076)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Fix tailscale bug with ip modes ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8098",children:"(#8098)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Etcd snapshots retention when node name changes ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8123",children:"(#8123)"})]}),"\n",(0,i.jsxs)(s.li,{children:["August Test Backports ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8127",children:"(#8127)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Backports for 2023-08 release ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8132",children:"(#8132)"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsx)(s.li,{children:"K3s's external apiserver listener now declines to add to its certificate any subject names not associated with the kubernetes apiserver service, server nodes, or values of the --tls-san option. This prevents the certificate's SAN list from being filled with unwanted entries."}),"\n",(0,i.jsxs)(s.li,{children:["K3s no longer enables the apiserver's ",(0,i.jsx)(s.code,{children:"enable-aggregator-routing"})," flag when the egress proxy is not being used to route connections to in-cluster endpoints."]}),"\n",(0,i.jsx)(s.li,{children:"Updated the embedded containerd to v1.7.3+k3s1"}),"\n",(0,i.jsx)(s.li,{children:"Updated the embedded runc to v1.1.8"}),"\n",(0,i.jsxs)(s.li,{children:["User-provided containerd config templates may now use ",(0,i.jsx)(s.code,{children:'{{ template "base" . }}'})," to include the default K3s template content. This makes it easier to maintain user configuration if the only need is to add additional sections to the file."]}),"\n",(0,i.jsx)(s.li,{children:"Bump docker/docker module version to fix issues with cri-dockerd caused by recent releases of golang rejecting invalid host headers sent by the docker client."}),"\n",(0,i.jsx)(s.li,{children:"Updated kine to v0.10.2"}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(s.li,{children:["K3s etcd-snapshot delete fail to delete local file when called with s3 flag ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8145",children:"(#8145)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Fix for cluster-reset backup from s3 when etcd snapshots are disabled ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8169",children:"(#8169)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Fixed the etcd retention to delete orphaned snapshots based on the date ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8190",children:"(#8190)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Additional backports for 2023-08 release ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8213",children:"(#8213)"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsxs)(s.li,{children:["The version of ",(0,i.jsx)(s.code,{children:"helm"})," used by the bundled helm controller's job image has been updated to v3.12.3"]}),"\n",(0,i.jsx)(s.li,{children:"Bumped dynamiclistener to address an issue that could cause the apiserver/supervisor listener on 6443 to stop serving requests on etcd-only nodes."}),"\n",(0,i.jsx)(s.li,{children:"The K3s external apiserver/supervisor listener on 6443 now sends a complete certificate chain in the TLS handshake."}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(s.li,{children:["Move flannel to 0.22.2 ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8223",children:"(#8223)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Update to v1.25.13 ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8241",children:"(#8241)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Fix runc version bump ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8246",children:"(#8246)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Add new CLI flag to enable TLS SAN CN filtering ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8259",children:"(#8259)"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsxs)(s.li,{children:["Added a new ",(0,i.jsx)(s.code,{children:"--tls-san-security"})," option. This flag defaults to false, but can be set to true to disable automatically adding SANs to the server's TLS certificate to satisfy any hostname requested by a client."]}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(s.li,{children:["Add RWMutex to address controller ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8275",children:"(#8275)"})]}),"\n"]}),"\n",(0,i.jsx)(s.hr,{}),"\n",(0,i.jsxs)(s.h2,{id:"release-v12512k3s1",children:["Release ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/releases/tag/v1.25.12+k3s1",children:"v1.25.12+k3s1"})]}),"\n",(0,i.jsxs)(s.p,{children:["This release updates Kubernetes to v1.25.12, and fixes a number of issues.",(0,i.jsx)(s.br,{}),"\n","\u200b\r\nFor more details on what's new, see the ",(0,i.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.25.md#changelog-since-v12511",children:"Kubernetes release notes"}),".\r\n\u200b"]}),"\n",(0,i.jsx)(s.h3,{id:"changes-since-v12511k3s1",children:"Changes since v1.25.11+k3s1:"}),"\n",(0,i.jsx)(s.p,{children:"\u200b"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsxs)(s.li,{children:["Remove file_windows.go ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7856",children:"(#7856)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Fix code spell check ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7860",children:"(#7860)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Allow k3s to customize apiServerPort on helm-controller ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7873",children:"(#7873)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Check if we are on ipv4, ipv6 or dualStack when doing tailscale ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7883",children:"(#7883)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Support setting control server URL for Tailscale. ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7894",children:"(#7894)"})]}),"\n",(0,i.jsxs)(s.li,{children:["S3 and Startup tests ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7886",children:"(#7886)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Fix rootless node password ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7900",children:"(#7900)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Backports for 2023-07 release ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7909",children:"(#7909)"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsx)(s.li,{children:"Resolved an issue that caused agents joined with kubeadm-style bootstrap tokens to fail to rejoin the cluster when their node object is deleted."}),"\n",(0,i.jsxs)(s.li,{children:["The ",(0,i.jsx)(s.code,{children:"k3s certificate rotate-ca"})," command now supports the data-dir flag."]}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(s.li,{children:["Adding cli to custom klipper helm image ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7915",children:"(#7915)"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsx)(s.li,{children:"The default helm-controller job image can now be overridden with the --helm-job-image CLI flag"}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(s.li,{children:["Generation of certs and keys for etcd gated if etcd is disabled ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7945",children:"(#7945)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Don't use zgrep in ",(0,i.jsx)(s.code,{children:"check-config"})," if apparmor profile is enforced ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7954",children:"(#7954)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Fix image_scan.sh script and download trivy version (#7950) ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7969",children:"(#7969)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Adjust default kubeconfig file permissions ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7984",children:"(#7984)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Update to v1.25.12 ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8021",children:"(#8021)"}),"\r\n\u200b"]}),"\n"]}),"\n",(0,i.jsx)(s.hr,{}),"\n",(0,i.jsxs)(s.h2,{id:"release-v12511k3s1",children:["Release ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/releases/tag/v1.25.11+k3s1",children:"v1.25.11+k3s1"})]}),"\n",(0,i.jsx)(s.p,{children:"This release updates Kubernetes to v1.25.11, and fixes a number of issues."}),"\n",(0,i.jsxs)(s.p,{children:["For more details on what's new, see the ",(0,i.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.25.md#changelog-since-v12510",children:"Kubernetes release notes"}),"."]}),"\n",(0,i.jsx)(s.h3,{id:"changes-since-v12510k3s1",children:"Changes since v1.25.10+k3s1:"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsxs)(s.li,{children:["Update flannel version ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7649",children:"(#7649)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Bump vagrant libvirt with fix for plugin installs ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7659",children:"(#7659)"})]}),"\n",(0,i.jsxs)(s.li,{children:["E2E Backports - June ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7705",children:"(#7705)"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsx)(s.li,{children:"Shortcircuit commands with version or help flags #7683"}),"\n",(0,i.jsx)(s.li,{children:"Add Rotation certification Check, remove func to restart agents #7097"}),"\n",(0,i.jsx)(s.li,{children:"E2E: Sudo for RunCmdOnNode #7686"}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(s.li,{children:["Add private registry e2e test ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7722",children:"(#7722)"})]}),"\n",(0,i.jsxs)(s.li,{children:["VPN integration ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7728",children:"(#7728)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Fix spelling test ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7752",children:"(#7752)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Remove unused libvirt config ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7758",children:"(#7758)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Backport version bumps and bugfixes ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7718",children:"(#7718)"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsx)(s.li,{children:"The bundled metrics-server has been bumped to v0.6.3, and now uses only secure TLS ciphers by default."}),"\n",(0,i.jsxs)(s.li,{children:["The ",(0,i.jsx)(s.code,{children:"coredns-custom"})," ConfigMap now allows for ",(0,i.jsx)(s.code,{children:"*.override"})," sections to be included in the ",(0,i.jsx)(s.code,{children:".:53"})," default server block."]}),"\n",(0,i.jsx)(s.li,{children:"The K3s core controllers (supervisor, deploy, and helm) no longer use the admin kubeconfig. This makes it easier to determine from access and audit logs which actions are performed by the system, and which are performed by an administrative user."}),"\n",(0,i.jsx)(s.li,{children:"Bumped klipper-lb image to v0.4.4 to resolve an issue that prevented access to ServiceLB ports from localhost when the Service ExternalTrafficPolicy was set to Local."}),"\n",(0,i.jsx)(s.li,{children:"Make LB image configurable when compiling k3s"}),"\n",(0,i.jsx)(s.li,{children:"K3s now allows nodes to join the cluster even if the node password secret cannot be created at the time the node joins. The secret create will be retried in the background. This resolves a potential deadlock created by fail-closed validating webhooks that block secret creation, where the webhook is unavailable until new nodes join the cluster to run the webhook pod."}),"\n",(0,i.jsx)(s.li,{children:"The bundled containerd's aufs/devmapper/zfs snapshotter plugins have been restored. These were unintentionally omitted when moving containerd back into the k3s multicall binary in the previous release."}),"\n",(0,i.jsx)(s.li,{children:"The embedded helm controller has been bumped to v0.15.0, and now supports creating the chart's target namespace if it does not exist."}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(s.li,{children:["Add format command on Makefile ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7763",children:"(#7763)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Fix logging and cleanup in Tailscale ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7784",children:"(#7784)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Update Kubernetes to v1.25.11 ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7788",children:"(#7788)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Path normalization affecting kubectl proxy conformance test for /api endpoint ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7818",children:"(#7818)"})]}),"\n"]}),"\n",(0,i.jsx)(s.hr,{}),"\n",(0,i.jsxs)(s.h2,{id:"release-v12510k3s1",children:["Release ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/releases/tag/v1.25.10+k3s1",children:"v1.25.10+k3s1"})]}),"\n",(0,i.jsx)(s.p,{children:"This release updates Kubernetes to v1.25.10, and fixes a number of issues."}),"\n",(0,i.jsxs)(s.p,{children:["For more details on what's new, see the ",(0,i.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.25.md#changelog-since-v1259",children:"Kubernetes release notes"}),"."]}),"\n",(0,i.jsx)(s.h3,{id:"changes-since-v1259k3s1",children:"Changes since v1.25.9+k3s1:"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsxs)(s.li,{children:["Ensure that klog verbosity is set to the same level as logrus ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7361",children:"(#7361)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Add E2E testing in Drone ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7375",children:"(#7375)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Add integration tests for etc-snapshot server flags #7377 ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7378",children:"(#7378)"})]}),"\n",(0,i.jsxs)(s.li,{children:["CLI + Config Enhancement ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7404",children:"(#7404)"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsxs)(s.li,{children:[(0,i.jsx)(s.code,{children:"--Tls-sans"})," now accepts multiple arguments: ",(0,i.jsx)(s.code,{children:'--tls-sans="foo,bar"'})]}),"\n",(0,i.jsxs)(s.li,{children:[(0,i.jsx)(s.code,{children:"Prefer-bundled-bin: true"})," now works properly when set in ",(0,i.jsx)(s.code,{children:"config.yaml.d"})," files"]}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(s.li,{children:["Migrate netutil methods into /utils/net.go ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7433",children:"(#7433)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Bump Runc + Containerd + Docker for CVE fixes ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7452",children:"(#7452)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Bump kube-router version to fix a bug when a port name is used ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7461",children:"(#7461)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Kube flags and longhorn storage tests 1.25 ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7466",children:"(#7466)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Local-storage: Fix permission ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7473",children:"(#7473)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Backport version bumps and bugfixes ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7515",children:"(#7515)"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsx)(s.li,{children:'K3s now retries the cluster join operation when receiving a "too many learners" error from etcd. This most frequently occurred when attempting to add multiple servers at the same time.'}),"\n",(0,i.jsx)(s.li,{children:"K3s once again supports aarch64 nodes with page size > 4k"}),"\n",(0,i.jsx)(s.li,{children:"The packaged Traefik version has been bumped to v2.9.10 / chart 21.2.0"}),"\n",(0,i.jsxs)(s.li,{children:["K3s now prints a more meaningful error when attempting to run from a filesystem mounted ",(0,i.jsx)(s.code,{children:"noexec"}),"."]}),"\n",(0,i.jsxs)(s.li,{children:["K3s now exits with a proper error message when the server token uses a bootstrap token ",(0,i.jsx)(s.code,{children:"id.secret"})," format."]}),"\n",(0,i.jsx)(s.li,{children:"Fixed an issue where Addon, HelmChart, and HelmChartConfig CRDs were created without structural schema, allowing the creation of custom resources of these types with invalid content."}),"\n",(0,i.jsx)(s.li,{children:"Servers started with the (experimental) --disable-agent flag no longer attempt to run the tunnel authorizer agent component."}),"\n",(0,i.jsx)(s.li,{children:"Fixed an regression that prevented the pod and cluster egress-selector modes from working properly."}),"\n",(0,i.jsx)(s.li,{children:"K3s now correctly passes through etcd-args to the temporary etcd that is used to extract cluster bootstrap data when restarting managed etcd nodes."}),"\n",(0,i.jsx)(s.li,{children:"K3s now properly handles errors obtaining the current etcd cluster member list when a new server is joining the managed etcd cluster."}),"\n",(0,i.jsxs)(s.li,{children:["The embedded kine version has been bumped to v0.10.1. This replaces the legacy ",(0,i.jsx)(s.code,{children:"lib/pq"})," postgres driver with ",(0,i.jsx)(s.code,{children:"pgx"}),"."]}),"\n",(0,i.jsx)(s.li,{children:"The bundled CNI plugins have been upgraded to v1.2.0-k3s1. The bandwidth and firewall plugins are now included in the bundle."}),"\n",(0,i.jsx)(s.li,{children:"The embedded Helm controller now supports authenticating to chart repositories via credentials stored in a Secret, as well as passing repo CAs via ConfigMap."}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(s.li,{children:["Bump containerd/runc to v1.7.1-k3s1/v1.1.7 ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7535",children:"(#7535)"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsx)(s.li,{children:"The bundled containerd and runc versions have been bumped to v1.7.1-k3s1/v1.1.7"}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(s.li,{children:["Wrap error stating that it is coming from netpol ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7548",children:"(#7548)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Add '-all' flag to apply to inactive units ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7574",children:"(#7574)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Update to v1.25.10-k3s1 ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7582",children:"(#7582)"})]}),"\n"]}),"\n",(0,i.jsx)(s.hr,{}),"\n",(0,i.jsxs)(s.h2,{id:"release-v1259k3s1",children:["Release ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/releases/tag/v1.25.9+k3s1",children:"v1.25.9+k3s1"})]}),"\n",(0,i.jsx)(s.p,{children:"This release updates Kubernetes to v1.25.9, and fixes a number of issues."}),"\n",(0,i.jsxs)(s.p,{children:["For more details on what's new, see the ",(0,i.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.25.md#changelog-since-v1258",children:"Kubernetes release notes"}),"."]}),"\n",(0,i.jsx)(s.h3,{id:"changes-since-v1258k3s1",children:"Changes since v1.25.8+k3s1:"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsxs)(s.li,{children:["Enhance ",(0,i.jsx)(s.code,{children:"check-config"})," ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7164",children:"(#7164)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Remove deprecated nodeSelector label beta.kubernetes.io/os (#6970) ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7121",children:"(#7121)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Backport version bumps and bugfixes ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7228",children:"(#7228)"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsx)(s.li,{children:"The bundled local-path-provisioner version has been bumped to v0.0.24"}),"\n",(0,i.jsx)(s.li,{children:"The bundled runc version has been bumped to v1.1.5"}),"\n",(0,i.jsx)(s.li,{children:"The bundled coredns version has been bumped to v1.10.1"}),"\n",(0,i.jsx)(s.li,{children:"When using an external datastore, K3s now locks the bootstrap key while creating initial cluster bootstrap data, preventing a race condition when multiple servers attempted to initialize the cluster simultaneously."}),"\n",(0,i.jsx)(s.li,{children:"The client load-balancer that maintains connections to active server nodes now closes connections to servers when they are removed from the cluster. This ensures that agent components immediately reconnect to a current cluster member."}),"\n",(0,i.jsx)(s.li,{children:"Fixed a race condition during cluster reset that could cause the operation to hang and time out."}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(s.li,{children:["Updated kube-router to move the default ACCEPT rule at the end of the chain ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7221",children:"(#7221)"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsx)(s.li,{children:"The embedded kube-router controller has been updated to fix a regression that caused traffic from pods to be blocked by any default drop/deny rules present on the host. Users should still confirm that any externally-managed firewall rules explicitly allow traffic to/from pod and service networks, but this returns the old behavior that was relied upon by some users."}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(s.li,{children:["Update klipper lb and helm-controller ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7240",children:"(#7240)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Update Kube-router ACCEPT rule insertion and install script to clean rules before start ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7276",children:"(#7276)"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsx)(s.li,{children:"The embedded kube-router controller has been updated to fix a regression that caused traffic from pods to be blocked by any default drop/deny rules present on the host. Users should still confirm that any externally-managed firewall rules explicitly allow traffic to/from pod and service networks, but this returns the old behavior that was relied upon by some users."}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(s.li,{children:["Update to v1.25.9-k3s1 ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7283",children:"(#7283)"})]}),"\n"]}),"\n",(0,i.jsx)(s.hr,{}),"\n",(0,i.jsxs)(s.h2,{id:"release-v1258k3s1",children:["Release ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/releases/tag/v1.25.8+k3s1",children:"v1.25.8+k3s1"})]}),"\n",(0,i.jsx)(s.p,{children:"This release updates Kubernetes to v1.25.8, and fixes a number of issues."}),"\n",(0,i.jsxs)(s.p,{children:["For more details on what's new, see the ",(0,i.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.25.md#changelog-since-v1257",children:"Kubernetes release notes"}),"."]}),"\n",(0,i.jsx)(s.h3,{id:"changes-since-v1257k3s1",children:"Changes since v1.25.7+k3s1:"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsxs)(s.li,{children:["Update flannel and kube-router ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7061",children:"(#7061)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Bump various dependencies for CVEs ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7043",children:"(#7043)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Enable dependabot ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7045",children:"(#7045)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Wait for kubelet port to be ready before setting ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7064",children:"(#7064)"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsx)(s.li,{children:"The agent tunnel authorizer now waits for the kubelet to be ready before reading the kubelet port from the node object."}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(s.li,{children:["Adds a warning about editing to the containerd config.toml file ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7075",children:"(#7075)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Improve support for rotating the default self-signed certs ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7079",children:"(#7079)"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsxs)(s.li,{children:["The ",(0,i.jsx)(s.code,{children:"k3s certificate rotate-ca"})," checks now support rotating self-signed certificates without the ",(0,i.jsx)(s.code,{children:"--force"})," option."]}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(s.li,{children:["Update to v1.25.8-k3s1 ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7106",children:"(#7106)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Update flannel to fix NAT issue with old iptables version ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7138",children:"(#7138)"})]}),"\n"]}),"\n",(0,i.jsx)(s.hr,{}),"\n",(0,i.jsxs)(s.h2,{id:"release-v1257k3s1",children:["Release ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/releases/tag/v1.25.7+k3s1",children:"v1.25.7+k3s1"})]}),"\n",(0,i.jsx)(s.p,{children:"This release updates Kubernetes to v1.25.7, and fixes a number of issues."}),"\n",(0,i.jsxs)(s.p,{children:["For more details on what's new, see the ",(0,i.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.25.md#changelog-since-v1256",children:"Kubernetes release notes"}),"."]}),"\n",(0,i.jsx)(s.h3,{id:"changes-since-v1256k3s1",children:"Changes since v1.25.6+k3s1:"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsxs)(s.li,{children:["Add jitter to scheduled snapshots and retry harder on conflicts ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6782",children:"(#6782)"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsx)(s.li,{children:"Scheduled etcd snapshots are now offset by a short random delay of up to several seconds. This should prevent multi-server clusters from executing pathological behavior when attempting to simultaneously update the snapshot list ConfigMap. The snapshot controller will also be more persistent in attempting to update the snapshot list."}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(s.li,{children:["Bump cri-dockerd ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6798",children:"(#6798)"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsx)(s.li,{children:"The embedded cri-dockerd has been updated to v0.3.1"}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(s.li,{children:["Bugfix: do not break cert-manager when pprof is enabled ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6837",children:"(#6837)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Wait for cri-dockerd socket ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6853",children:"(#6853)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Bump vagrant boxes to fedora37 ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6858",children:"(#6858)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Fix cronjob example ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6864",children:"(#6864)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Ensure flag type consistency ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6867",children:"(#6867)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Consolidate E2E tests ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6887",children:"(#6887)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Ignore value conflicts when reencrypting secrets ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6919",children:"(#6919)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Use default address family when adding kubernetes service address to SAN list ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6904",children:"(#6904)"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsx)(s.li,{children:"The apiserver advertised address and IP SAN entry are now set correctly on clusters that use IPv6 as the default IP family."}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(s.li,{children:["Allow ServiceLB to honor ",(0,i.jsx)(s.code,{children:"ExternalTrafficPolicy=Local"})," ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6907",children:"(#6907)"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsx)(s.li,{children:"ServiceLB now honors the Service's ExternalTrafficPolicy. When set to Local, the LoadBalancer will only advertise addresses of Nodes with a Pod for the Service, and will not forward traffic to other cluster members."}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(s.li,{children:["Fix issue with servicelb startup failure when validating webhooks block creation ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6916",children:"(#6916)"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsx)(s.li,{children:"The embedded cloud controller manager will no longer attempt to unconditionally re-create its namespace and serviceaccount on startup. This resolves an issue that could cause a deadlocked cluster when fail-closed webhooks are in use."}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(s.li,{children:["Backport user-provided CA cert and ",(0,i.jsx)(s.code,{children:"kubeadm"})," bootstrap token support ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6929",children:"(#6929)"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsxs)(s.li,{children:["K3s now functions properly when the cluster CA certificates are signed by an existing root or intermediate CA. You can find a sample script for generating such certificates before K3s starts in the github repo at ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/blob/master/contrib/util/certs.sh",children:"contrib/util/certs.sh"}),"."]}),"\n",(0,i.jsxs)(s.li,{children:["K3s now supports ",(0,i.jsx)(s.code,{children:"kubeadm"})," style join tokens. ",(0,i.jsx)(s.code,{children:"k3s token create"})," now creates join token secrets, optionally with a limited TTL."]}),"\n",(0,i.jsx)(s.li,{children:"K3s agents joined with an expired or deleted token stay in the cluster using existing client certificates via the NodeAuthorization admission plugin, unless their Node object is deleted from the cluster."}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(s.li,{children:["Fix access to hostNetwork port on NodeIP when egress-selector-mode=agent ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6936",children:"(#6936)"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsx)(s.li,{children:"Fixed an issue that would cause the apiserver egress proxy to attempt to use the agent tunnel to connect to service endpoints even in agent or disabled mode."}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(s.li,{children:["Updated flannel version to v0.21.1 ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6915",children:"(#6915)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Allow for multiple sets of leader-elected controllers ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6941",children:"(#6941)"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsx)(s.li,{children:"Fixed an issue where leader-elected controllers for managed etcd did not run on etcd-only nodes"}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(s.li,{children:["Fix etcd and ca-cert rotate issues ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6954",children:"(#6954)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Fix ServiceLB dual-stack ingress IP listing ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6987",children:"(#6987)"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsx)(s.li,{children:"Resolved an issue with ServiceLB that would cause it to advertise node IPv6 addresses, even if the cluster or service was not enabled for dual-stack operation."}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(s.li,{children:["Bump kine to v0.9.9 ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6975",children:"(#6975)"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsxs)(s.li,{children:["The embedded kine version has been bumped to v0.9.9. Compaction log messages are now omitted at ",(0,i.jsx)(s.code,{children:"info"})," level for increased visibility."]}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(s.li,{children:["Update to v1.25.7-k3s1 ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7010",children:"(#7010)"})]}),"\n"]}),"\n",(0,i.jsx)(s.hr,{}),"\n",(0,i.jsxs)(s.h2,{id:"release-v1256k3s1",children:["Release ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/releases/tag/v1.25.6+k3s1",children:"v1.25.6+k3s1"})]}),"\n",(0,i.jsx)(s.p,{children:"This release updates Kubernetes to v1.25.6, and fixes a number of issues."}),"\n",(0,i.jsxs)(s.p,{children:["For more details on what's new, see the ",(0,i.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.25.md#changelog-since-v1255",children:"Kubernetes release notes"}),"."]}),"\n",(0,i.jsx)(s.h3,{id:"changes-since-v1255k3s2",children:"Changes since v1.25.5+k3s2:"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsxs)(s.li,{children:["Pass through default tls-cipher-suites ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6730",children:"(#6730)"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsx)(s.li,{children:"The K3s default cipher suites are now explicitly passed in to kube-apiserver, ensuring that all listeners use these values."}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(s.li,{children:["Bump containerd to v1.6.15-k3s1 ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6735",children:"(#6735)"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsx)(s.li,{children:"The embedded containerd version has been bumped to v1.6.15-k3s1"}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(s.li,{children:["Bump action/download-artifact to v3 ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6747",children:"(#6747)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Backport dependabot/updatecli updates ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6761",children:"(#6761)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Fix Drone plugins/docker tag for 32 bit arm ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6768",children:"(#6768)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Update to v1.25.6+k3s1 ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6775",children:"(#6775)"})]}),"\n"]}),"\n",(0,i.jsx)(s.hr,{}),"\n",(0,i.jsxs)(s.h2,{id:"release-v1255k3s2",children:["Release ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/releases/tag/v1.25.5+k3s2",children:"v1.25.5+k3s2"})]}),"\n",(0,i.jsx)(s.p,{children:"This release updates containerd to v1.6.14 to resolve an issue where pods would lose their CNI information when containerd was restarted."}),"\n",(0,i.jsx)(s.h3,{id:"changes-since-v1255k3s1",children:"Changes since v1.25.5+k3s1:"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsxs)(s.li,{children:["Bump containerd to v1.6.14-k3s1 ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6694",children:"(#6694)"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsxs)(s.li,{children:["The embedded containerd version has been bumped to v1.6.14-k3s1. This includes a backported fix for ",(0,i.jsx)(s.a,{href:"https://github.com/containerd/containerd/issues/7843",children:"containerd/7843"})," which caused pods to lose their CNI info when containerd was restarted, which in turn caused the kubelet to recreate the pod."]}),"\n"]}),"\n"]}),"\n"]}),"\n",(0,i.jsx)(s.hr,{}),"\n",(0,i.jsxs)(s.h2,{id:"release-v1255k3s1",children:["Release ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/releases/tag/v1.25.5+k3s1",children:"v1.25.5+k3s1"})]}),"\n",(0,i.jsxs)(s.blockquote,{children:["\n",(0,i.jsx)(s.h2,{id:"\ufe0f-warning",children:"\u26a0\ufe0f WARNING"}),"\n",(0,i.jsxs)(s.p,{children:["This release is affected by ",(0,i.jsx)(s.a,{href:"https://github.com/containerd/containerd/issues/7843",children:"https://github.com/containerd/containerd/issues/7843"}),", which causes the kubelet to restart all pods whenever K3s is restarted. For this reason, we have removed this K3s release from the channel server. Please use ",(0,i.jsx)(s.code,{children:"v1.25.5+k3s2"})," instead."]}),"\n"]}),"\n",(0,i.jsx)(s.p,{children:"This release updates Kubernetes to v1.25.5, and fixes a number of issues."}),"\n",(0,i.jsxs)(s.p,{children:[(0,i.jsx)(s.strong,{children:"Breaking Change:"})," K3s no longer includes ",(0,i.jsx)(s.code,{children:"swanctl"})," and ",(0,i.jsx)(s.code,{children:"charon"})," binaries. If you are using the ipsec flannel backend, please ensure that the strongswan ",(0,i.jsx)(s.code,{children:"swanctl"})," and ",(0,i.jsx)(s.code,{children:"charon"})," packages are installed on your node before upgrading K3s to this release."]}),"\n",(0,i.jsxs)(s.p,{children:["For more details on what's new, see the ",(0,i.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.25.md#changelog-since-v1254",children:"Kubernetes release notes"}),"."]}),"\n",(0,i.jsx)(s.h3,{id:"changes-since-v1254k3s1",children:"Changes since v1.25.4+k3s1:"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsxs)(s.li,{children:["Fix log for flannelExternalIP use case ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6531",children:"(#6531)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Fix Carolines github id ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6464",children:"(#6464)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Github CI Updates ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6522",children:"(#6522)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Add new ",(0,i.jsx)(s.code,{children:"prefer-bundled-bin"})," experimental flag ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6420",children:"(#6420)"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsx)(s.li,{children:"Added new prefer-bundled-bin flag which force K3s to use its bundle binaries over that of the host tools"}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(s.li,{children:["Bump containerd to v1.6.10 ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6512",children:"(#6512)"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsx)(s.li,{children:"The embedded containerd version has been updated to v1.6.10-k3s1"}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(s.li,{children:["Stage the Traefik charts through k3s-charts ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6519",children:"(#6519)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Make rootless settings configurable ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6498",children:"(#6498)"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsxs)(s.li,{children:["The rootless ",(0,i.jsx)(s.code,{children:"port-driver"}),", ",(0,i.jsx)(s.code,{children:"cidr"}),", ",(0,i.jsx)(s.code,{children:"mtu"}),", ",(0,i.jsx)(s.code,{children:"enable-ipv6"}),", and ",(0,i.jsx)(s.code,{children:"disable-host-loopback"})," settings can now be configured via environment variables."]}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(s.li,{children:["Remove stuff which belongs in the windows executor implementation ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6517",children:"(#6517)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Mark v1.25.4+k3s1 as stable ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6534",children:"(#6534)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Add ",(0,i.jsx)(s.code,{children:"prefer-bundled-bin"})," as an agent flag ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6545",children:"(#6545)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Bump klipper-helm and klipper-lb versions ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6549",children:"(#6549)"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsxs)(s.li,{children:["The embedded Load-Balancer controller image has been bumped to klipper-lb",":v0",".4.0, which includes support for the ",(0,i.jsx)(s.a,{href:"https://kubernetes.io/docs/reference/kubernetes-api/service-resources/service-v1/#:~:text=loadBalancerSourceRanges",children:"LoadBalancerSourceRanges"})," field."]}),"\n",(0,i.jsxs)(s.li,{children:["The embedded Helm controller image has been bumped to klipper-helm",":v0",".7.4-build20221121"]}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(s.li,{children:["Switch from Google Buckets to AWS S3 Buckets ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6497",children:"(#6497)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Fix passing AWS creds through Dapper ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6567",children:"(#6567)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Fix artifact upload with ",(0,i.jsx)(s.code,{children:"aws s3 cp"})," ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6568",children:"(#6568)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Disable CCM metrics port when legacy CCM functionality is disabled ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6572",children:"(#6572)"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsxs)(s.li,{children:["The embedded cloud-controller-manager's metrics listener on port 10258 is now disabled when the ",(0,i.jsx)(s.code,{children:"--disable-cloud-controller"})," flag is set."]}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(s.li,{children:["Sync packaged component Deployment config ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6552",children:"(#6552)"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsx)(s.li,{children:"Deployments for K3s packaged components now have consistent upgrade strategy and revisionHistoryLimit settings, and will not override scaling decisions by hardcoding the replica count."}),"\n",(0,i.jsx)(s.li,{children:"The packaged metrics-server has been bumped to v0.6.2"}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(s.li,{children:["Mark secrets-encryption flag as GA ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6582",children:"(#6582)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Bump k3s root to v0.12.0 and remove strongswan binaries ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6400",children:"(#6400)"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsx)(s.li,{children:"The embedded k3s-root version has been bumped to v0.12.0, based on buildroot 2022.08.1."}),"\n",(0,i.jsxs)(s.li,{children:["The embedded swanctl and charon binaries have been removed. If you are using the ipsec flannel backend, please ensure that the strongswan ",(0,i.jsx)(s.code,{children:"swanctl"})," and ",(0,i.jsx)(s.code,{children:"charon"})," packages are installed on your node before upgrading k3s."]}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(s.li,{children:["Update flannel to v0.20.2 ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6588",children:"(#6588)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Add ADR for security bumps automation ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6559",children:"(#6559)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Update node12->node16 based GH actions ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6593",children:"(#6593)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Updating rel docs ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6237",children:"(#6237)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Update install.sh to recommend current version of k3s-selinux ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6453",children:"(#6453)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Update to v1.25.5-k3s1 ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6622",children:"(#6622)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Bump containerd to v1.6.12-k3s1 ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6631",children:"(#6631)"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsx)(s.li,{children:"The embedded containerd version has been bumped to v1.6.12"}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(s.li,{children:["Preload iptable_filter/ip6table_filter ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6646",children:"(#6646)"})]}),"\n"]}),"\n",(0,i.jsx)(s.hr,{}),"\n",(0,i.jsxs)(s.h2,{id:"release-v1254k3s1",children:["Release ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/releases/tag/v1.25.4+k3s1",children:"v1.25.4+k3s1"})]}),"\n",(0,i.jsx)(s.p,{children:"This release updates Kubernetes to v1.25.4, and fixes a number of issues."}),"\n",(0,i.jsxs)(s.p,{children:["For more details on what's new, see the ",(0,i.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.25.md#changelog-since-v1253",children:"Kubernetes release notes"}),"."]}),"\n",(0,i.jsx)(s.h3,{id:"changes-since-v1253k3s1",children:"Changes since v1.25.3+k3s1:"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsxs)(s.li,{children:["Add the gateway parameter in netplan ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6292",children:"(#6292)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Bumped dynamiclistener library to v0.3.5 ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6300",children:"(#6300)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Update kube-router to v1.5.1 with extra logging ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6345",children:"(#6345)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Update maintainers ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6298",children:"(#6298)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Bump testing to opensuse Leap 15.4 ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6337",children:"(#6337)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Update E2E docs with more info on ubuntu 22.04 ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6316",children:"(#6316)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Netpol test for podSelector & ingress ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6247",children:"(#6247)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Bump all alpine images to 3.16 ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6334",children:"(#6334)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Bump kine to v0.9.6 / sqlite3 v3.39.2 (",(0,i.jsx)(s.a,{href:"https://nvd.nist.gov/vuln/detail/CVE-2022-35737",children:"CVE-2022-35737"}),") ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6317",children:"(#6317)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Add hardened cluster and upgrade tests ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6320",children:"(#6320)"})]}),"\n",(0,i.jsxs)(s.li,{children:["The bundled Traefik helm chart has been updated to v18.0.0 ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6353",children:"(#6353)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Mark v1.25.3+k3s1 as stable ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6338",children:"(#6338)"})]}),"\n",(0,i.jsxs)(s.li,{children:["The embedded helm controller has been bumped to v0.13.0 ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6294",children:"(#6294)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Fixed an issue that would prevent the deploy controller from handling manifests that include resource types that are no longer supported by the apiserver. ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6295",children:"(#6295)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Replace fedora-coreos with fedora 36 for install tests ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6315",children:"(#6315)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Convert containerd config.toml.tmpl Linux template to v2 syntax ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6267",children:"(#6267)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Add test for node-external-ip config parameter ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6359",children:"(#6359)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Use debugger-friendly compile settings if DEBUG is set ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6147",children:"(#6147)"})]}),"\n",(0,i.jsxs)(s.li,{children:["update e2e tests ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6354",children:"(#6354)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Remove unused vagrant development scripts ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6395",children:"(#6395)"})]}),"\n",(0,i.jsxs)(s.li,{children:["The bundled Traefik has been updated to v2.9.4 / helm chart v18.3.0 ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6397",children:"(#6397)"})]}),"\n",(0,i.jsxs)(s.li,{children:["None ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6371",children:"(#6371)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Fix incorrect defer usage ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6296",children:"(#6296)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Add snapshot restore e2e test ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6396",children:"(#6396)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Fix sonobouy tests on v1.25 ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6399",children:"(#6399)"})]}),"\n",(0,i.jsx)(s.li,{children:"Bump packaged component versions"}),"\n",(0,i.jsx)(s.li,{children:"The packaged traefik helm chart has been bumped to v19.0.0, enabling ingressClass support by default."}),"\n",(0,i.jsx)(s.li,{children:"The packaged local-path-provisioner has been bumped to v0.0.23"}),"\n",(0,i.jsxs)(s.li,{children:["The packaged coredns has been bumped to v1.9.4 ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6408",children:"(#6408)"})]}),"\n",(0,i.jsxs)(s.li,{children:["log kube-router version when starting netpol controller ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6405",children:"(#6405)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Add Kairos to ADOPTERS ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6417",children:"(#6417)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Update Flannel to 0.20.1 ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6388",children:"(#6388)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Avoid wrong config for ",(0,i.jsx)(s.code,{children:"flannel-external-ip"})," and add warning if unencrypted backend ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6403",children:"(#6403)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Fix test-mods to allow for pinning version from k8s.io ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6413",children:"(#6413)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Fix for metrics-server in the multi-cloud cluster env ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6386",children:"(#6386)"})]}),"\n",(0,i.jsxs)(s.li,{children:["K3s now indicates specifically which cluster-level configuration flags are out of sync when critical configuration differs between server nodes. ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6409",children:"(#6409)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Convert test output to JSON format ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6410",children:"(#6410)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Pull traefik helm chart directly from GH ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6468",children:"(#6468)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Nightly test fix ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6475",children:"(#6475)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Update to v1.25.4 ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6477",children:"(#6477)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Remove stuff which belongs in the windows executor implementation ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6492",children:"(#6492)"})]}),"\n",(0,i.jsxs)(s.li,{children:["The packaged traefik helm chart has been bumped to 19.0.4 ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6494",children:"(#6494)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Move traefik chart repo again ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6508",children:"(#6508)"})]}),"\n"]}),"\n",(0,i.jsx)(s.hr,{}),"\n",(0,i.jsxs)(s.h2,{id:"release-v1253k3s1",children:["Release ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/releases/tag/v1.25.3+k3s1",children:"v1.25.3+k3s1"})]}),"\n",(0,i.jsx)(s.p,{children:"This release updates Kubernetes to v1.25.3, and fixes a number of issues."}),"\n",(0,i.jsxs)(s.p,{children:["For more details on what's new, see the ",(0,i.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.25.md#changelog-since-v1252",children:"Kubernetes release notes"}),"."]}),"\n",(0,i.jsx)(s.h3,{id:"changes-since-v1252k3s1",children:"Changes since v1.25.2+k3s1:"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsxs)(s.li,{children:["E2E: Groundwork for PR runs ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6131",children:"(#6131)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Fix flannel for deployments of nodes which do not belong to the same network and connect using their public IP ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6180",children:"(#6180)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Mark v1.24.6+k3s1 as stable ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6193",children:"(#6193)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Add cluster reset test ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6161",children:"(#6161)"})]}),"\n",(0,i.jsxs)(s.li,{children:["The embedded metrics-server version has been bumped to v0.6.1 ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6151",children:"(#6151)"})]}),"\n",(0,i.jsxs)(s.li,{children:["The ServiceLB (klipper-lb) service controller is now integrated into the K3s stub cloud controller manager. ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6181",children:"(#6181)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Events recorded to the cluster by embedded controllers are now properly formatted in the service logs. ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6203",children:"(#6203)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Fix ",(0,i.jsx)(s.code,{children:"error dialing backend"})," errors in apiserver network proxy ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6216",children:"(#6216)"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsxs)(s.li,{children:["Fixed an issue with the apiserver network proxy that caused ",(0,i.jsx)(s.code,{children:"kubectl exec"})," to occasionally fail with ",(0,i.jsx)(s.code,{children:"error dialing backend: EOF"})]}),"\n",(0,i.jsxs)(s.li,{children:["Fixed an issue with the apiserver network proxy that caused ",(0,i.jsx)(s.code,{children:"kubectl exec"})," and ",(0,i.jsx)(s.code,{children:"kubectl logs"})," to fail when a custom kubelet port was used, and the custom port was blocked by firewall or security group rules."]}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(s.li,{children:["Fix the typo in the test ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6183",children:"(#6183)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Use setup-go action to cache dependencies ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6220",children:"(#6220)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Add journalctl logs to E2E tests ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6224",children:"(#6224)"})]}),"\n",(0,i.jsxs)(s.li,{children:["The embedded Traefik version has been bumped to v2.9.1 / chart 12.0.0 ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6223",children:"(#6223)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Fix flakey etcd test ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6232",children:"(#6232)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Replace deprecated ioutil package ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6230",children:"(#6230)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Fix dualStack test ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6245",children:"(#6245)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Add ServiceAccount for svclb pods ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6253",children:"(#6253)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Update to v1.25.3-k3s1 ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6269",children:"(#6269)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Return ProviderID in URI format ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6284",children:"(#6284)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Corrected CCM RBAC to allow for removal of legacy service finalizer during upgrades. ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6306",children:"(#6306)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Added a new --flannel-external-ip flag. ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6321",children:"(#6321)"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsx)(s.li,{children:"When enabled, Flannel traffic will now use the nodes external IPs, instead of internal."}),"\n",(0,i.jsx)(s.li,{children:"This is meant for use with distributed clusters that are not all on the same local network."}),"\n"]}),"\n"]}),"\n"]}),"\n",(0,i.jsx)(s.hr,{}),"\n",(0,i.jsxs)(s.h2,{id:"release-v1252k3s1",children:["Release ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/releases/tag/v1.25.2+k3s1",children:"v1.25.2+k3s1"})]}),"\n",(0,i.jsx)(s.p,{children:"This release updates Kubernetes to v1.25.2, and fixes a number of issues."}),"\n",(0,i.jsxs)(s.p,{children:["For more details on what's new, see the ",(0,i.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.25.md#changelog-since-v1250",children:"Kubernetes release notes"}),"."]}),"\n",(0,i.jsx)(s.h3,{id:"changes-since-v1250k3s1",children:"Changes since v1.25.0+k3s1:"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsxs)(s.li,{children:["Add k3s v1.25 to the release channel ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6129",children:"(#6129)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Restore original INSTALL_K3S_SKIP_DOWNLOAD behavior ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6130",children:"(#6130)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Add K3S Release Documentation ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6135",children:"(#6135)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Update to v1.25.1 ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6140",children:"(#6140)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Update to v1.25.2-k3s1 ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6168",children:"(#6168)"})]}),"\n"]}),"\n",(0,i.jsx)(s.hr,{}),"\n",(0,i.jsxs)(s.h2,{id:"release-v1250k3s1",children:["Release ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/releases/tag/v1.25.0+k3s1",children:"v1.25.0+k3s1"})]}),"\n",(0,i.jsx)(s.p,{children:"This release is K3S's first in the v1.25 line. This release updates Kubernetes to v1.25.0."}),"\n",(0,i.jsxs)(s.p,{children:["Before upgrading from earlier releases, be sure to read the Kubernetes ",(0,i.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.25.md#urgent-upgrade-notes",children:"Urgent Upgrade Notes"}),"."]}),"\n",(0,i.jsxs)(s.p,{children:[(0,i.jsx)(s.strong,{children:"Important Note:"})," Kubernetes v1.25 removes the beta ",(0,i.jsx)(s.code,{children:"PodSecurityPolicy"})," admission plugin. Please follow the ",(0,i.jsx)(s.a,{href:"https://kubernetes.io/docs/tasks/configure-pod-container/migrate-from-psp/",children:"upstream documentation"})," to migrate from PSP if using the built-in PodSecurity Admission Plugin, prior to upgrading to v1.25.0+k3s1."]}),"\n",(0,i.jsx)(s.h3,{id:"changes-since-v1244k3s1",children:"Changes since v1.24.4+k3s1:"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsxs)(s.li,{children:["Update Kubernetes to v1.25.0 ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6040",children:"(#6040)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Remove ",(0,i.jsx)(s.code,{children:"--containerd"})," flag from windows kubelet args ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6028",children:"(#6028)"})]}),"\n",(0,i.jsxs)(s.li,{children:["E2E: Add support for CentOS 7 and Rocky 8 ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6015",children:"(#6015)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Convert install tests to run PR build of k3s ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6003",children:"(#6003)"})]}),"\n",(0,i.jsxs)(s.li,{children:["CI: update Fedora 34 -> 35 ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/5996",children:"(#5996)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Fix dualStack test and change ipv6 network prefix ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6023",children:"(#6023)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Fix e2e tests ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6018",children:"(#6018)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Update README.md ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6048",children:"(#6048)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Remove wireguard interfaces when deleting the cluster ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6055",children:"(#6055)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Add validation check to confirm correct golang version for Kubernetes ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6050",children:"(#6050)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Expand startup integration test ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6030",children:"(#6030)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Update go.mod version to 1.19 ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6049",children:"(#6049)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Usage of ",(0,i.jsx)(s.code,{children:"--cluster-secret"}),", ",(0,i.jsx)(s.code,{children:"--no-deploy"}),", and ",(0,i.jsx)(s.code,{children:"--no-flannel"})," is no longer supported. Attempts to use these flags will cause fatal errors. See ",(0,i.jsx)(s.a,{href:"https://k3s-io.github.io/docs/reference/server-config#deprecated-options",children:"the docs"})," for their replacement. ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6069",children:"(#6069)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Update Flannel version to fix older iptables version issue. ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6090",children:"(#6090)"})]}),"\n",(0,i.jsxs)(s.li,{children:["The bundled version of runc has been bumped to v1.1.4 ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6071",children:"(#6071)"})]}),"\n",(0,i.jsxs)(s.li,{children:["The embedded containerd version has been bumped to v1.6.8-k3s1 ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6078",children:"(#6078)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Fix deprecation message ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6112",children:"(#6112)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Added warning message for flannel backend additional options deprecation ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6111",children:"(#6111)"})]}),"\n"]}),"\n",(0,i.jsx)(s.hr,{})]})}function o(e={}){const{wrapper:s}={...(0,r.a)(),...e.components};return s?(0,i.jsx)(s,{...e,children:(0,i.jsx)(a,{...e})}):a(e)}},1151:(e,s,t)=>{t.d(s,{Z:()=>h,a:()=>l});var i=t(7294);const r={},n=i.createContext(r);function l(e){const s=i.useContext(n);return i.useMemo((function(){return"function"==typeof e?e(s):{...s,...e}}),[s,e])}function h(e){let s;return s=e.disableParentContext?"function"==typeof e.components?e.components(r):e.components||r:l(e.components),i.createElement(n.Provider,{value:s},e.children)}}}]); \ No newline at end of file +"use strict";(self.webpackChunkk_3_s_docs=self.webpackChunkk_3_s_docs||[]).push([[7251],{6253:(e,s,t)=>{t.r(s),t.d(s,{assets:()=>c,contentTitle:()=>l,default:()=>o,frontMatter:()=>n,metadata:()=>h,toc:()=>d});var i=t(5893),r=t(1151);const n={hide_table_of_contents:!0,sidebar_position:6},l="v1.25.X",h={id:"release-notes/v1.25.X",title:"v1.25.X",description:"Before upgrading from earlier releases, be sure to read the Kubernetes Urgent Upgrade Notes.",source:"@site/docs/release-notes/v1.25.X.md",sourceDirName:"release-notes",slug:"/release-notes/v1.25.X",permalink:"/release-notes/v1.25.X",draft:!1,unlisted:!1,editUrl:"https://github.com/k3s-io/docs/edit/main/docs/release-notes/v1.25.X.md",tags:[],version:"current",lastUpdatedAt:1723747404e3,sidebarPosition:6,frontMatter:{hide_table_of_contents:!0,sidebar_position:6},sidebar:"mySidebar",previous:{title:"v1.26.X",permalink:"/release-notes/v1.26.X"},next:{title:"v1.24.X",permalink:"/release-notes/v1.24.X"}},c={},d=[{value:"Release v1.25.16+k3s4",id:"release-v12516k3s4",level:2},{value:"Changes since v1.25.15+k3s2:",id:"changes-since-v12515k3s2",level:3},{value:"Release v1.25.15+k3s2",id:"release-v12515k3s2",level:2},{value:"Changes since v1.25.15+k3s1:",id:"changes-since-v12515k3s1",level:3},{value:"Release v1.25.15+k3s1",id:"release-v12515k3s1",level:2},{value:"Changes since v1.25.14+k3s1:",id:"changes-since-v12514k3s1",level:3},{value:"Release v1.25.14+k3s1",id:"release-v12514k3s1",level:2},{value:"Changes since v1.25.13+k3s1:",id:"changes-since-v12513k3s1",level:3},{value:"Release v1.25.13+k3s1",id:"release-v12513k3s1",level:2},{value:"Changes since v1.25.12+k3s1:",id:"changes-since-v12512k3s1",level:3},{value:"Release v1.25.12+k3s1",id:"release-v12512k3s1",level:2},{value:"Changes since v1.25.11+k3s1:",id:"changes-since-v12511k3s1",level:3},{value:"Release v1.25.11+k3s1",id:"release-v12511k3s1",level:2},{value:"Changes since v1.25.10+k3s1:",id:"changes-since-v12510k3s1",level:3},{value:"Release v1.25.10+k3s1",id:"release-v12510k3s1",level:2},{value:"Changes since v1.25.9+k3s1:",id:"changes-since-v1259k3s1",level:3},{value:"Release v1.25.9+k3s1",id:"release-v1259k3s1",level:2},{value:"Changes since v1.25.8+k3s1:",id:"changes-since-v1258k3s1",level:3},{value:"Release v1.25.8+k3s1",id:"release-v1258k3s1",level:2},{value:"Changes since v1.25.7+k3s1:",id:"changes-since-v1257k3s1",level:3},{value:"Release v1.25.7+k3s1",id:"release-v1257k3s1",level:2},{value:"Changes since v1.25.6+k3s1:",id:"changes-since-v1256k3s1",level:3},{value:"Release v1.25.6+k3s1",id:"release-v1256k3s1",level:2},{value:"Changes since v1.25.5+k3s2:",id:"changes-since-v1255k3s2",level:3},{value:"Release v1.25.5+k3s2",id:"release-v1255k3s2",level:2},{value:"Changes since v1.25.5+k3s1:",id:"changes-since-v1255k3s1",level:3},{value:"Release v1.25.5+k3s1",id:"release-v1255k3s1",level:2},{value:"\u26a0\ufe0f WARNING",id:"\ufe0f-warning",level:2},{value:"Changes since v1.25.4+k3s1:",id:"changes-since-v1254k3s1",level:3},{value:"Release v1.25.4+k3s1",id:"release-v1254k3s1",level:2},{value:"Changes since v1.25.3+k3s1:",id:"changes-since-v1253k3s1",level:3},{value:"Release v1.25.3+k3s1",id:"release-v1253k3s1",level:2},{value:"Changes since v1.25.2+k3s1:",id:"changes-since-v1252k3s1",level:3},{value:"Release v1.25.2+k3s1",id:"release-v1252k3s1",level:2},{value:"Changes since v1.25.0+k3s1:",id:"changes-since-v1250k3s1",level:3},{value:"Release v1.25.0+k3s1",id:"release-v1250k3s1",level:2},{value:"Changes since v1.24.4+k3s1:",id:"changes-since-v1244k3s1",level:3}];function a(e){const s={a:"a",admonition:"admonition",blockquote:"blockquote",br:"br",code:"code",h1:"h1",h2:"h2",h3:"h3",header:"header",hr:"hr",li:"li",p:"p",strong:"strong",table:"table",tbody:"tbody",td:"td",th:"th",thead:"thead",tr:"tr",ul:"ul",...(0,r.a)(),...e.components};return(0,i.jsxs)(i.Fragment,{children:[(0,i.jsx)(s.header,{children:(0,i.jsx)(s.h1,{id:"v125x",children:"v1.25.X"})}),"\n",(0,i.jsx)(s.admonition,{title:"Upgrade Notice",type:"warning",children:(0,i.jsxs)(s.p,{children:["Before upgrading from earlier releases, be sure to read the Kubernetes ",(0,i.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.25.md#urgent-upgrade-notes",children:"Urgent Upgrade Notes"}),"."]})}),"\n",(0,i.jsxs)(s.table,{children:[(0,i.jsx)(s.thead,{children:(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.th,{children:"Version"}),(0,i.jsx)(s.th,{children:"Release date"}),(0,i.jsx)(s.th,{children:"Kubernetes"}),(0,i.jsx)(s.th,{children:"Kine"}),(0,i.jsx)(s.th,{children:"SQLite"}),(0,i.jsx)(s.th,{children:"Etcd"}),(0,i.jsx)(s.th,{children:"Containerd"}),(0,i.jsx)(s.th,{children:"Runc"}),(0,i.jsx)(s.th,{children:"Flannel"}),(0,i.jsx)(s.th,{children:"Metrics-server"}),(0,i.jsx)(s.th,{children:"Traefik"}),(0,i.jsx)(s.th,{children:"CoreDNS"}),(0,i.jsx)(s.th,{children:"Helm-controller"}),(0,i.jsx)(s.th,{children:"Local-path-provisioner"})]})}),(0,i.jsxs)(s.tbody,{children:[(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"/release-notes/v1.25.X#release-v12516k3s4",children:"v1.25.16+k3s4"})}),(0,i.jsx)(s.td,{children:"Dec 07 2023"}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.25.md#v12516",children:"v1.25.16"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/kine/releases/tag/v0.11.0",children:"v0.11.0"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://sqlite.org/releaselog/3_42_0.html",children:"3.42.0"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/etcd/releases/tag/v3.5.3-k3s1",children:"v3.5.3-k3s1"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/containerd/releases/tag/v1.7.7-k3s1",children:"v1.7.7-k3s1"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/opencontainers/runc/releases/tag/v1.1.8",children:"v1.1.8"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/flannel-io/flannel/releases/tag/v0.22.2",children:"v0.22.2"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.6.3",children:"v0.6.3"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/traefik/traefik/releases/tag/v2.10.5",children:"v2.10.5"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/coredns/coredns/releases/tag/v1.10.1",children:"v1.10.1"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/helm-controller/releases/tag/v0.15.4",children:"v0.15.4"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/rancher/local-path-provisioner/releases/tag/v0.0.24",children:"v0.0.24"})})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"/release-notes/v1.25.X#release-v12515k3s2",children:"v1.25.15+k3s2"})}),(0,i.jsx)(s.td,{children:"Nov 08 2023"}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.25.md#v12515",children:"v1.25.15"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/kine/releases/tag/v0.10.3",children:"v0.10.3"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://sqlite.org/releaselog/3_42_0.html",children:"3.42.0"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/etcd/releases/tag/v3.5.3-k3s1",children:"v3.5.3-k3s1"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/containerd/releases/tag/v1.7.7-k3s1",children:"v1.7.7-k3s1"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/opencontainers/runc/releases/tag/v1.1.8",children:"v1.1.8"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/flannel-io/flannel/releases/tag/v0.22.2",children:"v0.22.2"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.6.3",children:"v0.6.3"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/traefik/traefik/releases/tag/v2.10.5",children:"v2.10.5"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/coredns/coredns/releases/tag/v1.10.1",children:"v1.10.1"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/helm-controller/releases/tag/v0.15.4",children:"v0.15.4"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/rancher/local-path-provisioner/releases/tag/v0.0.24",children:"v0.0.24"})})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"/release-notes/v1.25.X#release-v12515k3s1",children:"v1.25.15+k3s1"})}),(0,i.jsx)(s.td,{children:"Oct 30 2023"}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.25.md#v12515",children:"v1.25.15"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/kine/releases/tag/v0.10.3",children:"v0.10.3"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://sqlite.org/releaselog/3_42_0.html",children:"3.42.0"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/etcd/releases/tag/v3.5.3-k3s1",children:"v3.5.3-k3s1"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/containerd/releases/tag/v1.7.7-k3s1",children:"v1.7.7-k3s1"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/opencontainers/runc/releases/tag/v1.1.8",children:"v1.1.8"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/flannel-io/flannel/releases/tag/v0.22.2",children:"v0.22.2"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.6.3",children:"v0.6.3"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/traefik/traefik/releases/tag/v2.10.5",children:"v2.10.5"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/coredns/coredns/releases/tag/v1.10.1",children:"v1.10.1"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/helm-controller/releases/tag/v0.15.4",children:"v0.15.4"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/rancher/local-path-provisioner/releases/tag/v0.0.24",children:"v0.0.24"})})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"/release-notes/v1.25.X#release-v12514k3s1",children:"v1.25.14+k3s1"})}),(0,i.jsx)(s.td,{children:"Sep 20 2023"}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.25.md#v12514",children:"v1.25.14"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/kine/releases/tag/v0.10.3",children:"v0.10.3"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://sqlite.org/releaselog/3_42_0.html",children:"3.42.0"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/etcd/releases/tag/v3.5.3-k3s1",children:"v3.5.3-k3s1"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/containerd/releases/tag/v1.7.6-k3s1",children:"v1.7.6-k3s1"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/opencontainers/runc/releases/tag/v1.1.8",children:"v1.1.8"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/flannel-io/flannel/releases/tag/v0.22.2",children:"v0.22.2"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.6.3",children:"v0.6.3"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/traefik/traefik/releases/tag/v2.9.10",children:"v2.9.10"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/coredns/coredns/releases/tag/v1.10.1",children:"v1.10.1"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/helm-controller/releases/tag/v0.15.4",children:"v0.15.4"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/rancher/local-path-provisioner/releases/tag/v0.0.24",children:"v0.0.24"})})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"/release-notes/v1.25.X#release-v12513k3s1",children:"v1.25.13+k3s1"})}),(0,i.jsx)(s.td,{children:"Sep 05 2023"}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.25.md#v12513",children:"v1.25.13"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/kine/releases/tag/v0.10.2",children:"v0.10.2"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://sqlite.org/releaselog/3_42_0.html",children:"3.42.0"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/etcd/releases/tag/v3.5.3-k3s1",children:"v3.5.3-k3s1"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/containerd/releases/tag/v1.7.3-k3s1",children:"v1.7.3-k3s1"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/opencontainers/runc/releases/tag/v1.1.8",children:"v1.1.8"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/flannel-io/flannel/releases/tag/v0.22.2",children:"v0.22.2"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.6.3",children:"v0.6.3"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/traefik/traefik/releases/tag/v2.9.10",children:"v2.9.10"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/coredns/coredns/releases/tag/v1.10.1",children:"v1.10.1"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/helm-controller/releases/tag/v0.15.4",children:"v0.15.4"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/rancher/local-path-provisioner/releases/tag/v0.0.24",children:"v0.0.24"})})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"/release-notes/v1.25.X#release-v12512k3s1",children:"v1.25.12+k3s1"})}),(0,i.jsx)(s.td,{children:"Jul 27 2023"}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.25.md#v12512",children:"v1.25.12"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/kine/releases/tag/v0.10.1",children:"v0.10.1"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://sqlite.org/releaselog/3_39_2.html",children:"3.39.2"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/etcd/releases/tag/v3.5.3-k3s1",children:"v3.5.3-k3s1"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/containerd/releases/tag/v1.7.1-k3s1",children:"v1.7.1-k3s1"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/opencontainers/runc/releases/tag/v1.1.7",children:"v1.1.7"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/flannel-io/flannel/releases/tag/v0.22.0",children:"v0.22.0"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.6.3",children:"v0.6.3"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/traefik/traefik/releases/tag/v2.9.10",children:"v2.9.10"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/coredns/coredns/releases/tag/v1.10.1",children:"v1.10.1"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/helm-controller/releases/tag/v0.15.2",children:"v0.15.2"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/rancher/local-path-provisioner/releases/tag/v0.0.24",children:"v0.0.24"})})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"/release-notes/v1.25.X#release-v12511k3s1",children:"v1.25.11+k3s1"})}),(0,i.jsx)(s.td,{children:"Jun 26 2023"}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.25.md#v12511",children:"v1.25.11"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/kine/releases/tag/v0.10.1",children:"v0.10.1"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://sqlite.org/releaselog/3_39_2.html",children:"3.39.2"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/etcd/releases/tag/v3.5.3-k3s1",children:"v3.5.3-k3s1"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/containerd/releases/tag/v1.7.1-k3s1",children:"v1.7.1-k3s1"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/opencontainers/runc/releases/tag/v1.1.7",children:"v1.1.7"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/flannel-io/flannel/releases/tag/v0.22.0",children:"v0.22.0"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.6.3",children:"v0.6.3"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/traefik/traefik/releases/tag/v2.9.10",children:"v2.9.10"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/coredns/coredns/releases/tag/v1.10.1",children:"v1.10.1"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/helm-controller/releases/tag/v0.15.0",children:"v0.15.0"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/rancher/local-path-provisioner/releases/tag/v0.0.24",children:"v0.0.24"})})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"/release-notes/v1.25.X#release-v12510k3s1",children:"v1.25.10+k3s1"})}),(0,i.jsx)(s.td,{children:"May 26 2023"}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.25.md#v12510",children:"v1.25.10"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/kine/releases/tag/v0.10.1",children:"v0.10.1"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://sqlite.org/releaselog/3_39_2.html",children:"3.39.2"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/etcd/releases/tag/v3.5.3-k3s1",children:"v3.5.3-k3s1"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/containerd/releases/tag/v1.7.1-k3s1",children:"v1.7.1-k3s1"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/opencontainers/runc/releases/tag/v1.1.7",children:"v1.1.7"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/flannel-io/flannel/releases/tag/v0.21.4",children:"v0.21.4"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.6.2",children:"v0.6.2"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/traefik/traefik/releases/tag/v2.9.10",children:"v2.9.10"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/coredns/coredns/releases/tag/v1.10.1",children:"v1.10.1"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/helm-controller/releases/tag/v0.14.0",children:"v0.14.0"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/rancher/local-path-provisioner/releases/tag/v0.0.24",children:"v0.0.24"})})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"/release-notes/v1.25.X#release-v1259k3s1",children:"v1.25.9+k3s1"})}),(0,i.jsx)(s.td,{children:"Apr 20 2023"}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.25.md#v1259",children:"v1.25.9"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/kine/releases/tag/v0.9.9",children:"v0.9.9"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://sqlite.org/releaselog/3_39_2.html",children:"3.39.2"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/etcd/releases/tag/v3.5.3-k3s1",children:"v3.5.3-k3s1"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/containerd/releases/tag/v1.6.19-k3s1",children:"v1.6.19-k3s1"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/opencontainers/runc/releases/tag/v1.1.5",children:"v1.1.5"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/flannel-io/flannel/releases/tag/v0.21.4",children:"v0.21.4"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.6.2",children:"v0.6.2"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/traefik/traefik/releases/tag/v2.9.4",children:"v2.9.4"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/coredns/coredns/releases/tag/v1.10.1",children:"v1.10.1"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/helm-controller/releases/tag/v0.13.3",children:"v0.13.3"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/rancher/local-path-provisioner/releases/tag/v0.0.24",children:"v0.0.24"})})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"/release-notes/v1.25.X#release-v1258k3s1",children:"v1.25.8+k3s1"})}),(0,i.jsx)(s.td,{children:"Mar 27 2023"}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.25.md#v1258",children:"v1.25.8"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/kine/releases/tag/v0.9.9",children:"v0.9.9"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://sqlite.org/releaselog/3_39_2.html",children:"3.39.2"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/etcd/releases/tag/v3.5.3-k3s1",children:"v3.5.3-k3s1"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/containerd/releases/tag/v1.6.19-k3s1",children:"v1.6.19-k3s1"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/opencontainers/runc/releases/tag/v1.1.4",children:"v1.1.4"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/flannel-io/flannel/releases/tag/v0.21.4",children:"v0.21.4"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.6.2",children:"v0.6.2"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/traefik/traefik/releases/tag/v2.9.4",children:"v2.9.4"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/coredns/coredns/releases/tag/v1.9.4",children:"v1.9.4"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/helm-controller/releases/tag/v0.13.1",children:"v0.13.1"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/rancher/local-path-provisioner/releases/tag/v0.0.23",children:"v0.0.23"})})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"/release-notes/v1.25.X#release-v1257k3s1",children:"v1.25.7+k3s1"})}),(0,i.jsx)(s.td,{children:"Mar 10 2023"}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.25.md#v1257",children:"v1.25.7"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/kine/releases/tag/v0.9.9",children:"v0.9.9"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://sqlite.org/releaselog/3_39_2.html",children:"3.39.2"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/etcd/releases/tag/v3.5.3-k3s1",children:"v3.5.3-k3s1"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/containerd/releases/tag/v1.6.15-k3s1",children:"v1.6.15-k3s1"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/opencontainers/runc/releases/tag/v1.1.4",children:"v1.1.4"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/flannel-io/flannel/releases/tag/v0.21.1",children:"v0.21.1"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.6.2",children:"v0.6.2"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/traefik/traefik/releases/tag/v2.9.4",children:"v2.9.4"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/coredns/coredns/releases/tag/v1.9.4",children:"v1.9.4"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/helm-controller/releases/tag/v0.13.1",children:"v0.13.1"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/rancher/local-path-provisioner/releases/tag/v0.0.23",children:"v0.0.23"})})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"/release-notes/v1.25.X#release-v1256k3s1",children:"v1.25.6+k3s1"})}),(0,i.jsx)(s.td,{children:"Jan 26 2023"}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.25.md#v1256",children:"v1.25.6"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/kine/releases/tag/v0.9.6",children:"v0.9.6"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://sqlite.org/releaselog/3_39_2.html",children:"3.39.2"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/etcd/releases/tag/v3.5.3-k3s1",children:"v3.5.3-k3s1"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/containerd/releases/tag/v1.6.15-k3s1",children:"v1.6.15-k3s1"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/opencontainers/runc/releases/tag/v1.1.4",children:"v1.1.4"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/flannel-io/flannel/releases/tag/v0.20.2",children:"v0.20.2"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.6.2",children:"v0.6.2"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/traefik/traefik/releases/tag/v2.9.4",children:"v2.9.4"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/coredns/coredns/releases/tag/v1.9.4",children:"v1.9.4"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/helm-controller/releases/tag/v0.13.1",children:"v0.13.1"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/rancher/local-path-provisioner/releases/tag/v0.0.23",children:"v0.0.23"})})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"/release-notes/v1.25.X#release-v1255k3s2",children:"v1.25.5+k3s2"})}),(0,i.jsx)(s.td,{children:"Jan 11 2023"}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.25.md#v1255",children:"v1.25.5"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/kine/releases/tag/v0.9.6",children:"v0.9.6"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://sqlite.org/releaselog/3_39_2.html",children:"3.39.2"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/etcd/releases/tag/v3.5.3-k3s1",children:"v3.5.3-k3s1"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/containerd/releases/tag/v1.6.14-k3s1",children:"v1.6.14-k3s1"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/opencontainers/runc/releases/tag/v1.1.4",children:"v1.1.4"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/flannel-io/flannel/releases/tag/v0.20.2",children:"v0.20.2"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.6.2",children:"v0.6.2"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/traefik/traefik/releases/tag/v2.9.4",children:"v2.9.4"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/coredns/coredns/releases/tag/v1.9.4",children:"v1.9.4"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/helm-controller/releases/tag/v0.13.1",children:"v0.13.1"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/rancher/local-path-provisioner/releases/tag/v0.0.23",children:"v0.0.23"})})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"/release-notes/v1.25.X#release-v1255k3s1",children:"v1.25.5+k3s1"})}),(0,i.jsx)(s.td,{children:"Dec 20 2022"}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.25.md#v1255",children:"v1.25.5"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/kine/releases/tag/v0.9.6",children:"v0.9.6"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://sqlite.org/releaselog/3_39_2.html",children:"3.39.2"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/etcd/releases/tag/v3.5.3-k3s1",children:"v3.5.3-k3s1"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/containerd/releases/tag/v1.6.12-k3s1",children:"v1.6.12-k3s1"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/opencontainers/runc/releases/tag/v1.1.4",children:"v1.1.4"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/flannel-io/flannel/releases/tag/v0.20.2",children:"v0.20.2"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.6.2",children:"v0.6.2"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/traefik/traefik/releases/tag/v2.9.4",children:"v2.9.4"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/coredns/coredns/releases/tag/v1.9.4",children:"v1.9.4"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/helm-controller/releases/tag/v0.13.1",children:"v0.13.1"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/rancher/local-path-provisioner/releases/tag/v0.0.23",children:"v0.0.23"})})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"/release-notes/v1.25.X#release-v1254k3s1",children:"v1.25.4+k3s1"})}),(0,i.jsx)(s.td,{children:"Nov 18 2022"}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.25.md#v1254",children:"v1.25.4"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/kine/releases/tag/v0.9.6",children:"v0.9.6"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://sqlite.org/releaselog/3_39_2.html",children:"3.39.2"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/etcd/releases/tag/v3.5.3-k3s1",children:"v3.5.3-k3s1"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/containerd/releases/tag/v1.6.8-k3s1",children:"v1.6.8-k3s1"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/opencontainers/runc/releases/tag/v1.1.4",children:"v1.1.4"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/flannel-io/flannel/releases/tag/v0.20.1",children:"v0.20.1"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.6.1",children:"v0.6.1"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/traefik/traefik/releases/tag/v2.9.4",children:"v2.9.4"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/coredns/coredns/releases/tag/v1.9.4",children:"v1.9.4"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/helm-controller/releases/tag/v0.13.0",children:"v0.13.0"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/rancher/local-path-provisioner/releases/tag/v0.0.23",children:"v0.0.23"})})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"/release-notes/v1.25.X#release-v1253k3s1",children:"v1.25.3+k3s1"})}),(0,i.jsx)(s.td,{children:"Oct 25 2022"}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.25.md#v1253",children:"v1.25.3"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/kine/releases/tag/v0.9.3",children:"v0.9.3"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://sqlite.org/releaselog/3_36_0.html",children:"3.36.0"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/etcd/releases/tag/v3.5.3-k3s1",children:"v3.5.3-k3s1"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/containerd/releases/tag/v1.6.8-k3s1",children:"v1.6.8-k3s1"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/opencontainers/runc/releases/tag/v1.1.4",children:"v1.1.4"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/flannel-io/flannel/releases/tag/v0.19.2",children:"v0.19.2"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.6.1",children:"v0.6.1"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/traefik/traefik/releases/tag/v2.9.1",children:"v2.9.1"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/coredns/coredns/releases/tag/v1.9.1",children:"v1.9.1"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/helm-controller/releases/tag/v0.12.3",children:"v0.12.3"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/rancher/local-path-provisioner/releases/tag/v0.0.21",children:"v0.0.21"})})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"/release-notes/v1.25.X#release-v1252k3s1",children:"v1.25.2+k3s1"})}),(0,i.jsx)(s.td,{children:"Sep 28 2022"}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.25.md#v1252",children:"v1.25.2"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/kine/releases/tag/v0.9.3",children:"v0.9.3"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://sqlite.org/releaselog/3_36_0.html",children:"3.36.0"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/etcd/releases/tag/v3.5.3-k3s1",children:"v3.5.3-k3s1"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/containerd/releases/tag/v1.6.8-k3s1",children:"v1.6.8-k3s1"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/opencontainers/runc/releases/tag/v1.1.4",children:"v1.1.4"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/flannel-io/flannel/releases/tag/v0.19.2",children:"v0.19.2"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.5.2",children:"v0.5.2"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/traefik/traefik/releases/tag/v2.6.2",children:"v2.6.2"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/coredns/coredns/releases/tag/v1.9.1",children:"v1.9.1"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/helm-controller/releases/tag/v0.12.3",children:"v0.12.3"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/rancher/local-path-provisioner/releases/tag/v0.0.21",children:"v0.0.21"})})]}),(0,i.jsxs)(s.tr,{children:[(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"/release-notes/v1.25.X#release-v1250k3s1",children:"v1.25.0+k3s1"})}),(0,i.jsx)(s.td,{children:"Sep 12 2022"}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.25.md#v1250",children:"v1.25.0"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/kine/releases/tag/v0.9.3",children:"v0.9.3"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://sqlite.org/releaselog/3_36_0.html",children:"3.36.0"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/etcd/releases/tag/v3.5.3-k3s1",children:"v3.5.3-k3s1"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/containerd/releases/tag/v1.5.13-k3s2",children:"v1.5.13-k3s2"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/opencontainers/runc/releases/tag/v1.1.3",children:"v1.1.3"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/flannel-io/flannel/releases/tag/v0.19.1",children:"v0.19.1"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.5.2",children:"v0.5.2"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/traefik/traefik/releases/tag/v2.6.2",children:"v2.6.2"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/coredns/coredns/releases/tag/v1.9.1",children:"v1.9.1"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/helm-controller/releases/tag/v0.12.3",children:"v0.12.3"})}),(0,i.jsx)(s.td,{children:(0,i.jsx)(s.a,{href:"https://github.com/rancher/local-path-provisioner/releases/tag/v0.0.21",children:"v0.0.21"})})]})]})]}),"\n",(0,i.jsx)("br",{}),"\n",(0,i.jsxs)(s.h2,{id:"release-v12516k3s4",children:["Release ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/releases/tag/v1.25.16+k3s4",children:"v1.25.16+k3s4"})]}),"\n",(0,i.jsx)(s.p,{children:"This release updates Kubernetes to v1.25.16, and fixes a number of issues."}),"\n",(0,i.jsxs)(s.p,{children:["For more details on what's new, see the ",(0,i.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.25.md#changelog-since-v12515",children:"Kubernetes release notes"}),"."]}),"\n",(0,i.jsx)(s.h3,{id:"changes-since-v12515k3s2",children:"Changes since v1.25.15+k3s2:"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsxs)(s.li,{children:["Etcd status condition ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8819",children:"(#8819)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Backports for 2023-11 release ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8880",children:"(#8880)"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsxs)(s.li,{children:["New timezone info in Docker image allows the use of ",(0,i.jsx)(s.code,{children:"spec.timeZone"})," in CronJobs"]}),"\n",(0,i.jsx)(s.li,{children:"Bumped kine to v0.11.0 to resolve issues with postgres and NATS, fix performance of watch channels under heavy load, and improve compatibility with the reference implementation."}),"\n",(0,i.jsxs)(s.li,{children:["Containerd may now be configured to use rdt or blockio configuration by defining ",(0,i.jsx)(s.code,{children:"rdt_config.yaml"})," or ",(0,i.jsx)(s.code,{children:"blockio_config.yaml"})," files."]}),"\n",(0,i.jsx)(s.li,{children:"Add agent flag disable-apiserver-lb, agent will not start load balance proxy."}),"\n",(0,i.jsx)(s.li,{children:"Improved ingress IP ordering from ServiceLB"}),"\n",(0,i.jsx)(s.li,{children:"Disable helm CRD installation for disable-helm-controller"}),"\n",(0,i.jsx)(s.li,{children:"Omit snapshot list configmap entries for snapshots without extra metadata"}),"\n",(0,i.jsx)(s.li,{children:"Add jitter to client config retry to avoid hammering servers when they are starting up"}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(s.li,{children:["Handle nil pointer when runtime core is not ready in etcd ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8889",children:"(#8889)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Improve dualStack log ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8867",children:"(#8867)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Bump dynamiclistener; reduce snapshot controller log spew ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8904",children:"(#8904)"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsx)(s.li,{children:"Bumped dynamiclistener to address a race condition that could cause a server to fail to sync its certificates into the Kubernetes secret"}),"\n",(0,i.jsx)(s.li,{children:"Reduced etcd snapshot log spam during initial cluster startup"}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(s.li,{children:["Fix etcd snapshot S3 issues ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8939",children:"(#8939)"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsx)(s.li,{children:"Don't apply S3 retention if S3 client failed to initialize"}),"\n",(0,i.jsx)(s.li,{children:"Don't request metadata when listing S3 snapshots"}),"\n",(0,i.jsx)(s.li,{children:"Print key instead of file path in snapshot metadata log message"}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(s.li,{children:["Update to v1.25.16 ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8923",children:"(#8923)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Remove s390x steps temporarily since runners are disabled ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8993",children:"(#8993)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Remove s390x from manifest script ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8994",children:"(#8994)"})]}),"\n"]}),"\n",(0,i.jsx)(s.hr,{}),"\n",(0,i.jsxs)(s.h2,{id:"release-v12515k3s2",children:["Release ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/releases/tag/v1.25.15+k3s2",children:"v1.25.15+k3s2"})]}),"\n",(0,i.jsx)(s.p,{children:"This release updates Kubernetes to v1.25.15, and fixes a number of issues."}),"\n",(0,i.jsxs)(s.p,{children:["For more details on what's new, see the ",(0,i.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.25.md#changelog-since-v12515",children:"Kubernetes release notes"}),"."]}),"\n",(0,i.jsx)(s.h3,{id:"changes-since-v12515k3s1",children:"Changes since v1.25.15+k3s1:"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsxs)(s.li,{children:["E2E Domain Drone Cleanup ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8584",children:"(#8584)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Fix SystemdCgroup in templates_linux.go ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8767",children:"(#8767)"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsx)(s.li,{children:"Fixed an issue with identifying additional container runtimes"}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(s.li,{children:["Update traefik chart to v25.0.0 ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8777",children:"(#8777)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Update traefik to fix registry value ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8791",children:"(#8791)"})]}),"\n"]}),"\n",(0,i.jsx)(s.hr,{}),"\n",(0,i.jsxs)(s.h2,{id:"release-v12515k3s1",children:["Release ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/releases/tag/v1.25.15+k3s1",children:"v1.25.15+k3s1"})]}),"\n",(0,i.jsx)(s.p,{children:"This release updates Kubernetes to v1.25.15, and fixes a number of issues."}),"\n",(0,i.jsxs)(s.p,{children:["For more details on what's new, see the ",(0,i.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.25.md#changelog-since-v12514",children:"Kubernetes release notes"}),"."]}),"\n",(0,i.jsx)(s.h3,{id:"changes-since-v12514k3s1",children:"Changes since v1.25.14+k3s1:"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsxs)(s.li,{children:["Fix error reporting ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8413",children:"(#8413)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Add context to flannel errors ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8421",children:"(#8421)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Testing Backports for September ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8301",children:"(#8301)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Include the interface name in the error message ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8437",children:"(#8437)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Add extraArgs to tailscale ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8466",children:"(#8466)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Update kube-router ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8445",children:"(#8445)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Added error when cluster reset while using server flag ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8457",children:"(#8457)"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsx)(s.li,{children:"The user will receive a error when --cluster-reset with the --server flag"}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(s.li,{children:["Cluster reset from non bootstrap nodes ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8454",children:"(#8454)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Fix spellcheck problem ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8511",children:"(#8511)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Take IPFamily precedence based on order ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8506",children:"(#8506)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Network defaults are duplicated, remove one ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8553",children:"(#8553)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Advertise address integration test ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8518",children:"(#8518)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Fixed tailscale node IP dualstack mode in case of IPv4 only node ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8560",children:"(#8560)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Server Token Rotation ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8578",children:"(#8578)"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsxs)(s.li,{children:["Users can now rotate the server token using ",(0,i.jsx)(s.code,{children:"k3s token rotate -t --new-token "}),". After command succeeds, all server nodes must be restarted with the new token."]}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(s.li,{children:["Clear remove annotations on cluster reset ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8589",children:"(#8589)"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsx)(s.li,{children:"Fixed an issue that could cause k3s to attempt to remove members from the etcd cluster immediately following a cluster-reset/restore, if they were queued for removal at the time the snapshot was taken."}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(s.li,{children:["Use IPv6 in case is the first configured IP with dualstack ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8599",children:"(#8599)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Backports for 2023-10 release ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8617",children:"(#8617)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Update kube-router package in build script ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8636",children:"(#8636)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Add etcd-only/control-plane-only server test and fix control-plane-only server crash ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8644",children:"(#8644)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Windows agent support ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8646",children:"(#8646)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Use ",(0,i.jsx)(s.code,{children:"version.Program"})," not K3s in token rotate logs ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8654",children:"(#8654)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Add --image-service-endpoint flag (#8279) ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8664",children:"(#8664)"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsxs)(s.li,{children:["Add ",(0,i.jsx)(s.code,{children:"--image-service-endpoint"})," flag to specify an external image service socket."]}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(s.li,{children:["Backport etcd fixes ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8692",children:"(#8692)"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsx)(s.li,{children:"Re-enable etcd endpoint auto-sync"}),"\n",(0,i.jsx)(s.li,{children:"Manually requeue configmap reconcile when no nodes have reconciled snapshots"}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(s.li,{children:["Update to v1.25.15 and Go to v1.20.10 ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8679",children:"(#8679)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Fix s3 snapshot restore ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8735",children:"(#8735)"})]}),"\n"]}),"\n",(0,i.jsx)(s.hr,{}),"\n",(0,i.jsxs)(s.h2,{id:"release-v12514k3s1",children:["Release ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/releases/tag/v1.25.14+k3s1",children:"v1.25.14+k3s1"})]}),"\n",(0,i.jsx)(s.p,{children:"This release updates Kubernetes to v1.25.14, and fixes a number of issues."}),"\n",(0,i.jsxs)(s.p,{children:["For more details on what's new, see the ",(0,i.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.25.md#changelog-since-v12513",children:"Kubernetes release notes"}),"."]}),"\n",(0,i.jsx)(s.h3,{id:"changes-since-v12513k3s1",children:"Changes since v1.25.13+k3s1:"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsxs)(s.li,{children:["Bump kine to v0.10.3 ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8326",children:"(#8326)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Update Kubernetes to v1.25.14 and go to 1.20.8 ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8350",children:"(#8350)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Backport containerd bump and and test fixes ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8384",children:"(#8384)"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsx)(s.li,{children:"Bump embedded containerd to v1.7.6"}),"\n",(0,i.jsx)(s.li,{children:"Bump embedded stargz-snapshotter plugin to latest"}),"\n",(0,i.jsx)(s.li,{children:"Fixed intermittent drone CI failures due to race conditions in test environment setup scripts"}),"\n",(0,i.jsx)(s.li,{children:"Fixed CI failures due to changes to api discovery changes in Kubernetes 1.28"}),"\n"]}),"\n"]}),"\n"]}),"\n",(0,i.jsx)(s.hr,{}),"\n",(0,i.jsxs)(s.h2,{id:"release-v12513k3s1",children:["Release ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/releases/tag/v1.25.13+k3s1",children:"v1.25.13+k3s1"})]}),"\n",(0,i.jsx)(s.p,{children:"This release updates Kubernetes to v1.25.13, and fixes a number of issues."}),"\n",(0,i.jsx)(s.admonition,{title:"Important",type:"warning",children:(0,i.jsxs)(s.p,{children:["This release includes support for remediating CVE-2023-32187, a potential Denial of Service attack vector on K3s servers. See ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/security/advisories/GHSA-m4hf-6vgr-75r2",children:"https://github.com/k3s-io/k3s/security/advisories/GHSA-m4hf-6vgr-75r2"})," for more information, including mandatory steps necessary to harden clusters against this vulnerability."]})}),"\n",(0,i.jsxs)(s.p,{children:["For more details on what's new, see the ",(0,i.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.25.md#changelog-since-v12512",children:"Kubernetes release notes"}),"."]}),"\n",(0,i.jsx)(s.h3,{id:"changes-since-v12512k3s1",children:"Changes since v1.25.12+k3s1:"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsxs)(s.li,{children:["Update flannel and plugins ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8076",children:"(#8076)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Fix tailscale bug with ip modes ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8098",children:"(#8098)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Etcd snapshots retention when node name changes ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8123",children:"(#8123)"})]}),"\n",(0,i.jsxs)(s.li,{children:["August Test Backports ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8127",children:"(#8127)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Backports for 2023-08 release ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8132",children:"(#8132)"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsx)(s.li,{children:"K3s's external apiserver listener now declines to add to its certificate any subject names not associated with the kubernetes apiserver service, server nodes, or values of the --tls-san option. This prevents the certificate's SAN list from being filled with unwanted entries."}),"\n",(0,i.jsxs)(s.li,{children:["K3s no longer enables the apiserver's ",(0,i.jsx)(s.code,{children:"enable-aggregator-routing"})," flag when the egress proxy is not being used to route connections to in-cluster endpoints."]}),"\n",(0,i.jsx)(s.li,{children:"Updated the embedded containerd to v1.7.3+k3s1"}),"\n",(0,i.jsx)(s.li,{children:"Updated the embedded runc to v1.1.8"}),"\n",(0,i.jsxs)(s.li,{children:["User-provided containerd config templates may now use ",(0,i.jsx)(s.code,{children:'{{ template "base" . }}'})," to include the default K3s template content. This makes it easier to maintain user configuration if the only need is to add additional sections to the file."]}),"\n",(0,i.jsx)(s.li,{children:"Bump docker/docker module version to fix issues with cri-dockerd caused by recent releases of golang rejecting invalid host headers sent by the docker client."}),"\n",(0,i.jsx)(s.li,{children:"Updated kine to v0.10.2"}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(s.li,{children:["K3s etcd-snapshot delete fail to delete local file when called with s3 flag ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8145",children:"(#8145)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Fix for cluster-reset backup from s3 when etcd snapshots are disabled ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8169",children:"(#8169)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Fixed the etcd retention to delete orphaned snapshots based on the date ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8190",children:"(#8190)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Additional backports for 2023-08 release ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8213",children:"(#8213)"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsxs)(s.li,{children:["The version of ",(0,i.jsx)(s.code,{children:"helm"})," used by the bundled helm controller's job image has been updated to v3.12.3"]}),"\n",(0,i.jsx)(s.li,{children:"Bumped dynamiclistener to address an issue that could cause the apiserver/supervisor listener on 6443 to stop serving requests on etcd-only nodes."}),"\n",(0,i.jsx)(s.li,{children:"The K3s external apiserver/supervisor listener on 6443 now sends a complete certificate chain in the TLS handshake."}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(s.li,{children:["Move flannel to 0.22.2 ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8223",children:"(#8223)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Update to v1.25.13 ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8241",children:"(#8241)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Fix runc version bump ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8246",children:"(#8246)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Add new CLI flag to enable TLS SAN CN filtering ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8259",children:"(#8259)"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsxs)(s.li,{children:["Added a new ",(0,i.jsx)(s.code,{children:"--tls-san-security"})," option. This flag defaults to false, but can be set to true to disable automatically adding SANs to the server's TLS certificate to satisfy any hostname requested by a client."]}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(s.li,{children:["Add RWMutex to address controller ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8275",children:"(#8275)"})]}),"\n"]}),"\n",(0,i.jsx)(s.hr,{}),"\n",(0,i.jsxs)(s.h2,{id:"release-v12512k3s1",children:["Release ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/releases/tag/v1.25.12+k3s1",children:"v1.25.12+k3s1"})]}),"\n",(0,i.jsxs)(s.p,{children:["This release updates Kubernetes to v1.25.12, and fixes a number of issues.",(0,i.jsx)(s.br,{}),"\n","\u200b\r\nFor more details on what's new, see the ",(0,i.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.25.md#changelog-since-v12511",children:"Kubernetes release notes"}),".\r\n\u200b"]}),"\n",(0,i.jsx)(s.h3,{id:"changes-since-v12511k3s1",children:"Changes since v1.25.11+k3s1:"}),"\n",(0,i.jsx)(s.p,{children:"\u200b"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsxs)(s.li,{children:["Remove file_windows.go ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7856",children:"(#7856)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Fix code spell check ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7860",children:"(#7860)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Allow k3s to customize apiServerPort on helm-controller ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7873",children:"(#7873)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Check if we are on ipv4, ipv6 or dualStack when doing tailscale ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7883",children:"(#7883)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Support setting control server URL for Tailscale. ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7894",children:"(#7894)"})]}),"\n",(0,i.jsxs)(s.li,{children:["S3 and Startup tests ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7886",children:"(#7886)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Fix rootless node password ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7900",children:"(#7900)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Backports for 2023-07 release ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7909",children:"(#7909)"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsx)(s.li,{children:"Resolved an issue that caused agents joined with kubeadm-style bootstrap tokens to fail to rejoin the cluster when their node object is deleted."}),"\n",(0,i.jsxs)(s.li,{children:["The ",(0,i.jsx)(s.code,{children:"k3s certificate rotate-ca"})," command now supports the data-dir flag."]}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(s.li,{children:["Adding cli to custom klipper helm image ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7915",children:"(#7915)"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsx)(s.li,{children:"The default helm-controller job image can now be overridden with the --helm-job-image CLI flag"}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(s.li,{children:["Generation of certs and keys for etcd gated if etcd is disabled ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7945",children:"(#7945)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Don't use zgrep in ",(0,i.jsx)(s.code,{children:"check-config"})," if apparmor profile is enforced ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7954",children:"(#7954)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Fix image_scan.sh script and download trivy version (#7950) ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7969",children:"(#7969)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Adjust default kubeconfig file permissions ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7984",children:"(#7984)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Update to v1.25.12 ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8021",children:"(#8021)"}),"\r\n\u200b"]}),"\n"]}),"\n",(0,i.jsx)(s.hr,{}),"\n",(0,i.jsxs)(s.h2,{id:"release-v12511k3s1",children:["Release ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/releases/tag/v1.25.11+k3s1",children:"v1.25.11+k3s1"})]}),"\n",(0,i.jsx)(s.p,{children:"This release updates Kubernetes to v1.25.11, and fixes a number of issues."}),"\n",(0,i.jsxs)(s.p,{children:["For more details on what's new, see the ",(0,i.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.25.md#changelog-since-v12510",children:"Kubernetes release notes"}),"."]}),"\n",(0,i.jsx)(s.h3,{id:"changes-since-v12510k3s1",children:"Changes since v1.25.10+k3s1:"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsxs)(s.li,{children:["Update flannel version ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7649",children:"(#7649)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Bump vagrant libvirt with fix for plugin installs ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7659",children:"(#7659)"})]}),"\n",(0,i.jsxs)(s.li,{children:["E2E Backports - June ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7705",children:"(#7705)"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsx)(s.li,{children:"Shortcircuit commands with version or help flags #7683"}),"\n",(0,i.jsx)(s.li,{children:"Add Rotation certification Check, remove func to restart agents #7097"}),"\n",(0,i.jsx)(s.li,{children:"E2E: Sudo for RunCmdOnNode #7686"}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(s.li,{children:["Add private registry e2e test ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7722",children:"(#7722)"})]}),"\n",(0,i.jsxs)(s.li,{children:["VPN integration ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7728",children:"(#7728)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Fix spelling test ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7752",children:"(#7752)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Remove unused libvirt config ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7758",children:"(#7758)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Backport version bumps and bugfixes ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7718",children:"(#7718)"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsx)(s.li,{children:"The bundled metrics-server has been bumped to v0.6.3, and now uses only secure TLS ciphers by default."}),"\n",(0,i.jsxs)(s.li,{children:["The ",(0,i.jsx)(s.code,{children:"coredns-custom"})," ConfigMap now allows for ",(0,i.jsx)(s.code,{children:"*.override"})," sections to be included in the ",(0,i.jsx)(s.code,{children:".:53"})," default server block."]}),"\n",(0,i.jsx)(s.li,{children:"The K3s core controllers (supervisor, deploy, and helm) no longer use the admin kubeconfig. This makes it easier to determine from access and audit logs which actions are performed by the system, and which are performed by an administrative user."}),"\n",(0,i.jsx)(s.li,{children:"Bumped klipper-lb image to v0.4.4 to resolve an issue that prevented access to ServiceLB ports from localhost when the Service ExternalTrafficPolicy was set to Local."}),"\n",(0,i.jsx)(s.li,{children:"Make LB image configurable when compiling k3s"}),"\n",(0,i.jsx)(s.li,{children:"K3s now allows nodes to join the cluster even if the node password secret cannot be created at the time the node joins. The secret create will be retried in the background. This resolves a potential deadlock created by fail-closed validating webhooks that block secret creation, where the webhook is unavailable until new nodes join the cluster to run the webhook pod."}),"\n",(0,i.jsx)(s.li,{children:"The bundled containerd's aufs/devmapper/zfs snapshotter plugins have been restored. These were unintentionally omitted when moving containerd back into the k3s multicall binary in the previous release."}),"\n",(0,i.jsx)(s.li,{children:"The embedded helm controller has been bumped to v0.15.0, and now supports creating the chart's target namespace if it does not exist."}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(s.li,{children:["Add format command on Makefile ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7763",children:"(#7763)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Fix logging and cleanup in Tailscale ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7784",children:"(#7784)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Update Kubernetes to v1.25.11 ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7788",children:"(#7788)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Path normalization affecting kubectl proxy conformance test for /api endpoint ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7818",children:"(#7818)"})]}),"\n"]}),"\n",(0,i.jsx)(s.hr,{}),"\n",(0,i.jsxs)(s.h2,{id:"release-v12510k3s1",children:["Release ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/releases/tag/v1.25.10+k3s1",children:"v1.25.10+k3s1"})]}),"\n",(0,i.jsx)(s.p,{children:"This release updates Kubernetes to v1.25.10, and fixes a number of issues."}),"\n",(0,i.jsxs)(s.p,{children:["For more details on what's new, see the ",(0,i.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.25.md#changelog-since-v1259",children:"Kubernetes release notes"}),"."]}),"\n",(0,i.jsx)(s.h3,{id:"changes-since-v1259k3s1",children:"Changes since v1.25.9+k3s1:"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsxs)(s.li,{children:["Ensure that klog verbosity is set to the same level as logrus ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7361",children:"(#7361)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Add E2E testing in Drone ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7375",children:"(#7375)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Add integration tests for etc-snapshot server flags #7377 ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7378",children:"(#7378)"})]}),"\n",(0,i.jsxs)(s.li,{children:["CLI + Config Enhancement ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7404",children:"(#7404)"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsxs)(s.li,{children:[(0,i.jsx)(s.code,{children:"--Tls-sans"})," now accepts multiple arguments: ",(0,i.jsx)(s.code,{children:'--tls-sans="foo,bar"'})]}),"\n",(0,i.jsxs)(s.li,{children:[(0,i.jsx)(s.code,{children:"Prefer-bundled-bin: true"})," now works properly when set in ",(0,i.jsx)(s.code,{children:"config.yaml.d"})," files"]}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(s.li,{children:["Migrate netutil methods into /utils/net.go ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7433",children:"(#7433)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Bump Runc + Containerd + Docker for CVE fixes ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7452",children:"(#7452)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Bump kube-router version to fix a bug when a port name is used ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7461",children:"(#7461)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Kube flags and longhorn storage tests 1.25 ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7466",children:"(#7466)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Local-storage: Fix permission ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7473",children:"(#7473)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Backport version bumps and bugfixes ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7515",children:"(#7515)"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsx)(s.li,{children:'K3s now retries the cluster join operation when receiving a "too many learners" error from etcd. This most frequently occurred when attempting to add multiple servers at the same time.'}),"\n",(0,i.jsx)(s.li,{children:"K3s once again supports aarch64 nodes with page size > 4k"}),"\n",(0,i.jsx)(s.li,{children:"The packaged Traefik version has been bumped to v2.9.10 / chart 21.2.0"}),"\n",(0,i.jsxs)(s.li,{children:["K3s now prints a more meaningful error when attempting to run from a filesystem mounted ",(0,i.jsx)(s.code,{children:"noexec"}),"."]}),"\n",(0,i.jsxs)(s.li,{children:["K3s now exits with a proper error message when the server token uses a bootstrap token ",(0,i.jsx)(s.code,{children:"id.secret"})," format."]}),"\n",(0,i.jsx)(s.li,{children:"Fixed an issue where Addon, HelmChart, and HelmChartConfig CRDs were created without structural schema, allowing the creation of custom resources of these types with invalid content."}),"\n",(0,i.jsx)(s.li,{children:"Servers started with the (experimental) --disable-agent flag no longer attempt to run the tunnel authorizer agent component."}),"\n",(0,i.jsx)(s.li,{children:"Fixed an regression that prevented the pod and cluster egress-selector modes from working properly."}),"\n",(0,i.jsx)(s.li,{children:"K3s now correctly passes through etcd-args to the temporary etcd that is used to extract cluster bootstrap data when restarting managed etcd nodes."}),"\n",(0,i.jsx)(s.li,{children:"K3s now properly handles errors obtaining the current etcd cluster member list when a new server is joining the managed etcd cluster."}),"\n",(0,i.jsxs)(s.li,{children:["The embedded kine version has been bumped to v0.10.1. This replaces the legacy ",(0,i.jsx)(s.code,{children:"lib/pq"})," postgres driver with ",(0,i.jsx)(s.code,{children:"pgx"}),"."]}),"\n",(0,i.jsx)(s.li,{children:"The bundled CNI plugins have been upgraded to v1.2.0-k3s1. The bandwidth and firewall plugins are now included in the bundle."}),"\n",(0,i.jsx)(s.li,{children:"The embedded Helm controller now supports authenticating to chart repositories via credentials stored in a Secret, as well as passing repo CAs via ConfigMap."}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(s.li,{children:["Bump containerd/runc to v1.7.1-k3s1/v1.1.7 ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7535",children:"(#7535)"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsx)(s.li,{children:"The bundled containerd and runc versions have been bumped to v1.7.1-k3s1/v1.1.7"}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(s.li,{children:["Wrap error stating that it is coming from netpol ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7548",children:"(#7548)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Add '-all' flag to apply to inactive units ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7574",children:"(#7574)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Update to v1.25.10-k3s1 ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7582",children:"(#7582)"})]}),"\n"]}),"\n",(0,i.jsx)(s.hr,{}),"\n",(0,i.jsxs)(s.h2,{id:"release-v1259k3s1",children:["Release ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/releases/tag/v1.25.9+k3s1",children:"v1.25.9+k3s1"})]}),"\n",(0,i.jsx)(s.p,{children:"This release updates Kubernetes to v1.25.9, and fixes a number of issues."}),"\n",(0,i.jsxs)(s.p,{children:["For more details on what's new, see the ",(0,i.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.25.md#changelog-since-v1258",children:"Kubernetes release notes"}),"."]}),"\n",(0,i.jsx)(s.h3,{id:"changes-since-v1258k3s1",children:"Changes since v1.25.8+k3s1:"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsxs)(s.li,{children:["Enhance ",(0,i.jsx)(s.code,{children:"check-config"})," ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7164",children:"(#7164)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Remove deprecated nodeSelector label beta.kubernetes.io/os (#6970) ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7121",children:"(#7121)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Backport version bumps and bugfixes ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7228",children:"(#7228)"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsx)(s.li,{children:"The bundled local-path-provisioner version has been bumped to v0.0.24"}),"\n",(0,i.jsx)(s.li,{children:"The bundled runc version has been bumped to v1.1.5"}),"\n",(0,i.jsx)(s.li,{children:"The bundled coredns version has been bumped to v1.10.1"}),"\n",(0,i.jsx)(s.li,{children:"When using an external datastore, K3s now locks the bootstrap key while creating initial cluster bootstrap data, preventing a race condition when multiple servers attempted to initialize the cluster simultaneously."}),"\n",(0,i.jsx)(s.li,{children:"The client load-balancer that maintains connections to active server nodes now closes connections to servers when they are removed from the cluster. This ensures that agent components immediately reconnect to a current cluster member."}),"\n",(0,i.jsx)(s.li,{children:"Fixed a race condition during cluster reset that could cause the operation to hang and time out."}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(s.li,{children:["Updated kube-router to move the default ACCEPT rule at the end of the chain ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7221",children:"(#7221)"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsx)(s.li,{children:"The embedded kube-router controller has been updated to fix a regression that caused traffic from pods to be blocked by any default drop/deny rules present on the host. Users should still confirm that any externally-managed firewall rules explicitly allow traffic to/from pod and service networks, but this returns the old behavior that was relied upon by some users."}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(s.li,{children:["Update klipper lb and helm-controller ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7240",children:"(#7240)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Update Kube-router ACCEPT rule insertion and install script to clean rules before start ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7276",children:"(#7276)"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsx)(s.li,{children:"The embedded kube-router controller has been updated to fix a regression that caused traffic from pods to be blocked by any default drop/deny rules present on the host. Users should still confirm that any externally-managed firewall rules explicitly allow traffic to/from pod and service networks, but this returns the old behavior that was relied upon by some users."}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(s.li,{children:["Update to v1.25.9-k3s1 ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7283",children:"(#7283)"})]}),"\n"]}),"\n",(0,i.jsx)(s.hr,{}),"\n",(0,i.jsxs)(s.h2,{id:"release-v1258k3s1",children:["Release ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/releases/tag/v1.25.8+k3s1",children:"v1.25.8+k3s1"})]}),"\n",(0,i.jsx)(s.p,{children:"This release updates Kubernetes to v1.25.8, and fixes a number of issues."}),"\n",(0,i.jsxs)(s.p,{children:["For more details on what's new, see the ",(0,i.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.25.md#changelog-since-v1257",children:"Kubernetes release notes"}),"."]}),"\n",(0,i.jsx)(s.h3,{id:"changes-since-v1257k3s1",children:"Changes since v1.25.7+k3s1:"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsxs)(s.li,{children:["Update flannel and kube-router ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7061",children:"(#7061)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Bump various dependencies for CVEs ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7043",children:"(#7043)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Enable dependabot ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7045",children:"(#7045)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Wait for kubelet port to be ready before setting ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7064",children:"(#7064)"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsx)(s.li,{children:"The agent tunnel authorizer now waits for the kubelet to be ready before reading the kubelet port from the node object."}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(s.li,{children:["Adds a warning about editing to the containerd config.toml file ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7075",children:"(#7075)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Improve support for rotating the default self-signed certs ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7079",children:"(#7079)"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsxs)(s.li,{children:["The ",(0,i.jsx)(s.code,{children:"k3s certificate rotate-ca"})," checks now support rotating self-signed certificates without the ",(0,i.jsx)(s.code,{children:"--force"})," option."]}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(s.li,{children:["Update to v1.25.8-k3s1 ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7106",children:"(#7106)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Update flannel to fix NAT issue with old iptables version ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7138",children:"(#7138)"})]}),"\n"]}),"\n",(0,i.jsx)(s.hr,{}),"\n",(0,i.jsxs)(s.h2,{id:"release-v1257k3s1",children:["Release ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/releases/tag/v1.25.7+k3s1",children:"v1.25.7+k3s1"})]}),"\n",(0,i.jsx)(s.p,{children:"This release updates Kubernetes to v1.25.7, and fixes a number of issues."}),"\n",(0,i.jsxs)(s.p,{children:["For more details on what's new, see the ",(0,i.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.25.md#changelog-since-v1256",children:"Kubernetes release notes"}),"."]}),"\n",(0,i.jsx)(s.h3,{id:"changes-since-v1256k3s1",children:"Changes since v1.25.6+k3s1:"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsxs)(s.li,{children:["Add jitter to scheduled snapshots and retry harder on conflicts ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6782",children:"(#6782)"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsx)(s.li,{children:"Scheduled etcd snapshots are now offset by a short random delay of up to several seconds. This should prevent multi-server clusters from executing pathological behavior when attempting to simultaneously update the snapshot list ConfigMap. The snapshot controller will also be more persistent in attempting to update the snapshot list."}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(s.li,{children:["Bump cri-dockerd ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6798",children:"(#6798)"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsx)(s.li,{children:"The embedded cri-dockerd has been updated to v0.3.1"}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(s.li,{children:["Bugfix: do not break cert-manager when pprof is enabled ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6837",children:"(#6837)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Wait for cri-dockerd socket ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6853",children:"(#6853)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Bump vagrant boxes to fedora37 ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6858",children:"(#6858)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Fix cronjob example ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6864",children:"(#6864)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Ensure flag type consistency ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6867",children:"(#6867)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Consolidate E2E tests ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6887",children:"(#6887)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Ignore value conflicts when reencrypting secrets ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6919",children:"(#6919)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Use default address family when adding kubernetes service address to SAN list ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6904",children:"(#6904)"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsx)(s.li,{children:"The apiserver advertised address and IP SAN entry are now set correctly on clusters that use IPv6 as the default IP family."}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(s.li,{children:["Allow ServiceLB to honor ",(0,i.jsx)(s.code,{children:"ExternalTrafficPolicy=Local"})," ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6907",children:"(#6907)"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsx)(s.li,{children:"ServiceLB now honors the Service's ExternalTrafficPolicy. When set to Local, the LoadBalancer will only advertise addresses of Nodes with a Pod for the Service, and will not forward traffic to other cluster members."}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(s.li,{children:["Fix issue with servicelb startup failure when validating webhooks block creation ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6916",children:"(#6916)"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsx)(s.li,{children:"The embedded cloud controller manager will no longer attempt to unconditionally re-create its namespace and serviceaccount on startup. This resolves an issue that could cause a deadlocked cluster when fail-closed webhooks are in use."}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(s.li,{children:["Backport user-provided CA cert and ",(0,i.jsx)(s.code,{children:"kubeadm"})," bootstrap token support ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6929",children:"(#6929)"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsxs)(s.li,{children:["K3s now functions properly when the cluster CA certificates are signed by an existing root or intermediate CA. You can find a sample script for generating such certificates before K3s starts in the github repo at ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/blob/master/contrib/util/certs.sh",children:"contrib/util/certs.sh"}),"."]}),"\n",(0,i.jsxs)(s.li,{children:["K3s now supports ",(0,i.jsx)(s.code,{children:"kubeadm"})," style join tokens. ",(0,i.jsx)(s.code,{children:"k3s token create"})," now creates join token secrets, optionally with a limited TTL."]}),"\n",(0,i.jsx)(s.li,{children:"K3s agents joined with an expired or deleted token stay in the cluster using existing client certificates via the NodeAuthorization admission plugin, unless their Node object is deleted from the cluster."}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(s.li,{children:["Fix access to hostNetwork port on NodeIP when egress-selector-mode=agent ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6936",children:"(#6936)"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsx)(s.li,{children:"Fixed an issue that would cause the apiserver egress proxy to attempt to use the agent tunnel to connect to service endpoints even in agent or disabled mode."}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(s.li,{children:["Updated flannel version to v0.21.1 ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6915",children:"(#6915)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Allow for multiple sets of leader-elected controllers ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6941",children:"(#6941)"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsx)(s.li,{children:"Fixed an issue where leader-elected controllers for managed etcd did not run on etcd-only nodes"}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(s.li,{children:["Fix etcd and ca-cert rotate issues ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6954",children:"(#6954)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Fix ServiceLB dual-stack ingress IP listing ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6987",children:"(#6987)"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsx)(s.li,{children:"Resolved an issue with ServiceLB that would cause it to advertise node IPv6 addresses, even if the cluster or service was not enabled for dual-stack operation."}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(s.li,{children:["Bump kine to v0.9.9 ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6975",children:"(#6975)"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsxs)(s.li,{children:["The embedded kine version has been bumped to v0.9.9. Compaction log messages are now omitted at ",(0,i.jsx)(s.code,{children:"info"})," level for increased visibility."]}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(s.li,{children:["Update to v1.25.7-k3s1 ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7010",children:"(#7010)"})]}),"\n"]}),"\n",(0,i.jsx)(s.hr,{}),"\n",(0,i.jsxs)(s.h2,{id:"release-v1256k3s1",children:["Release ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/releases/tag/v1.25.6+k3s1",children:"v1.25.6+k3s1"})]}),"\n",(0,i.jsx)(s.p,{children:"This release updates Kubernetes to v1.25.6, and fixes a number of issues."}),"\n",(0,i.jsxs)(s.p,{children:["For more details on what's new, see the ",(0,i.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.25.md#changelog-since-v1255",children:"Kubernetes release notes"}),"."]}),"\n",(0,i.jsx)(s.h3,{id:"changes-since-v1255k3s2",children:"Changes since v1.25.5+k3s2:"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsxs)(s.li,{children:["Pass through default tls-cipher-suites ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6730",children:"(#6730)"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsx)(s.li,{children:"The K3s default cipher suites are now explicitly passed in to kube-apiserver, ensuring that all listeners use these values."}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(s.li,{children:["Bump containerd to v1.6.15-k3s1 ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6735",children:"(#6735)"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsx)(s.li,{children:"The embedded containerd version has been bumped to v1.6.15-k3s1"}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(s.li,{children:["Bump action/download-artifact to v3 ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6747",children:"(#6747)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Backport dependabot/updatecli updates ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6761",children:"(#6761)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Fix Drone plugins/docker tag for 32 bit arm ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6768",children:"(#6768)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Update to v1.25.6+k3s1 ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6775",children:"(#6775)"})]}),"\n"]}),"\n",(0,i.jsx)(s.hr,{}),"\n",(0,i.jsxs)(s.h2,{id:"release-v1255k3s2",children:["Release ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/releases/tag/v1.25.5+k3s2",children:"v1.25.5+k3s2"})]}),"\n",(0,i.jsx)(s.p,{children:"This release updates containerd to v1.6.14 to resolve an issue where pods would lose their CNI information when containerd was restarted."}),"\n",(0,i.jsx)(s.h3,{id:"changes-since-v1255k3s1",children:"Changes since v1.25.5+k3s1:"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsxs)(s.li,{children:["Bump containerd to v1.6.14-k3s1 ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6694",children:"(#6694)"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsxs)(s.li,{children:["The embedded containerd version has been bumped to v1.6.14-k3s1. This includes a backported fix for ",(0,i.jsx)(s.a,{href:"https://github.com/containerd/containerd/issues/7843",children:"containerd/7843"})," which caused pods to lose their CNI info when containerd was restarted, which in turn caused the kubelet to recreate the pod."]}),"\n"]}),"\n"]}),"\n"]}),"\n",(0,i.jsx)(s.hr,{}),"\n",(0,i.jsxs)(s.h2,{id:"release-v1255k3s1",children:["Release ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/releases/tag/v1.25.5+k3s1",children:"v1.25.5+k3s1"})]}),"\n",(0,i.jsxs)(s.blockquote,{children:["\n",(0,i.jsx)(s.h2,{id:"\ufe0f-warning",children:"\u26a0\ufe0f WARNING"}),"\n",(0,i.jsxs)(s.p,{children:["This release is affected by ",(0,i.jsx)(s.a,{href:"https://github.com/containerd/containerd/issues/7843",children:"https://github.com/containerd/containerd/issues/7843"}),", which causes the kubelet to restart all pods whenever K3s is restarted. For this reason, we have removed this K3s release from the channel server. Please use ",(0,i.jsx)(s.code,{children:"v1.25.5+k3s2"})," instead."]}),"\n"]}),"\n",(0,i.jsx)(s.p,{children:"This release updates Kubernetes to v1.25.5, and fixes a number of issues."}),"\n",(0,i.jsxs)(s.p,{children:[(0,i.jsx)(s.strong,{children:"Breaking Change:"})," K3s no longer includes ",(0,i.jsx)(s.code,{children:"swanctl"})," and ",(0,i.jsx)(s.code,{children:"charon"})," binaries. If you are using the ipsec flannel backend, please ensure that the strongswan ",(0,i.jsx)(s.code,{children:"swanctl"})," and ",(0,i.jsx)(s.code,{children:"charon"})," packages are installed on your node before upgrading K3s to this release."]}),"\n",(0,i.jsxs)(s.p,{children:["For more details on what's new, see the ",(0,i.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.25.md#changelog-since-v1254",children:"Kubernetes release notes"}),"."]}),"\n",(0,i.jsx)(s.h3,{id:"changes-since-v1254k3s1",children:"Changes since v1.25.4+k3s1:"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsxs)(s.li,{children:["Fix log for flannelExternalIP use case ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6531",children:"(#6531)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Fix Carolines github id ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6464",children:"(#6464)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Github CI Updates ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6522",children:"(#6522)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Add new ",(0,i.jsx)(s.code,{children:"prefer-bundled-bin"})," experimental flag ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6420",children:"(#6420)"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsx)(s.li,{children:"Added new prefer-bundled-bin flag which force K3s to use its bundle binaries over that of the host tools"}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(s.li,{children:["Bump containerd to v1.6.10 ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6512",children:"(#6512)"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsx)(s.li,{children:"The embedded containerd version has been updated to v1.6.10-k3s1"}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(s.li,{children:["Stage the Traefik charts through k3s-charts ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6519",children:"(#6519)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Make rootless settings configurable ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6498",children:"(#6498)"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsxs)(s.li,{children:["The rootless ",(0,i.jsx)(s.code,{children:"port-driver"}),", ",(0,i.jsx)(s.code,{children:"cidr"}),", ",(0,i.jsx)(s.code,{children:"mtu"}),", ",(0,i.jsx)(s.code,{children:"enable-ipv6"}),", and ",(0,i.jsx)(s.code,{children:"disable-host-loopback"})," settings can now be configured via environment variables."]}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(s.li,{children:["Remove stuff which belongs in the windows executor implementation ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6517",children:"(#6517)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Mark v1.25.4+k3s1 as stable ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6534",children:"(#6534)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Add ",(0,i.jsx)(s.code,{children:"prefer-bundled-bin"})," as an agent flag ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6545",children:"(#6545)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Bump klipper-helm and klipper-lb versions ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6549",children:"(#6549)"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsxs)(s.li,{children:["The embedded Load-Balancer controller image has been bumped to klipper-lb",":v0",".4.0, which includes support for the ",(0,i.jsx)(s.a,{href:"https://kubernetes.io/docs/reference/kubernetes-api/service-resources/service-v1/#:~:text=loadBalancerSourceRanges",children:"LoadBalancerSourceRanges"})," field."]}),"\n",(0,i.jsxs)(s.li,{children:["The embedded Helm controller image has been bumped to klipper-helm",":v0",".7.4-build20221121"]}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(s.li,{children:["Switch from Google Buckets to AWS S3 Buckets ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6497",children:"(#6497)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Fix passing AWS creds through Dapper ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6567",children:"(#6567)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Fix artifact upload with ",(0,i.jsx)(s.code,{children:"aws s3 cp"})," ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6568",children:"(#6568)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Disable CCM metrics port when legacy CCM functionality is disabled ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6572",children:"(#6572)"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsxs)(s.li,{children:["The embedded cloud-controller-manager's metrics listener on port 10258 is now disabled when the ",(0,i.jsx)(s.code,{children:"--disable-cloud-controller"})," flag is set."]}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(s.li,{children:["Sync packaged component Deployment config ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6552",children:"(#6552)"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsx)(s.li,{children:"Deployments for K3s packaged components now have consistent upgrade strategy and revisionHistoryLimit settings, and will not override scaling decisions by hardcoding the replica count."}),"\n",(0,i.jsx)(s.li,{children:"The packaged metrics-server has been bumped to v0.6.2"}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(s.li,{children:["Mark secrets-encryption flag as GA ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6582",children:"(#6582)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Bump k3s root to v0.12.0 and remove strongswan binaries ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6400",children:"(#6400)"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsx)(s.li,{children:"The embedded k3s-root version has been bumped to v0.12.0, based on buildroot 2022.08.1."}),"\n",(0,i.jsxs)(s.li,{children:["The embedded swanctl and charon binaries have been removed. If you are using the ipsec flannel backend, please ensure that the strongswan ",(0,i.jsx)(s.code,{children:"swanctl"})," and ",(0,i.jsx)(s.code,{children:"charon"})," packages are installed on your node before upgrading k3s."]}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(s.li,{children:["Update flannel to v0.20.2 ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6588",children:"(#6588)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Add ADR for security bumps automation ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6559",children:"(#6559)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Update node12->node16 based GH actions ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6593",children:"(#6593)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Updating rel docs ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6237",children:"(#6237)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Update install.sh to recommend current version of k3s-selinux ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6453",children:"(#6453)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Update to v1.25.5-k3s1 ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6622",children:"(#6622)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Bump containerd to v1.6.12-k3s1 ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6631",children:"(#6631)"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsx)(s.li,{children:"The embedded containerd version has been bumped to v1.6.12"}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(s.li,{children:["Preload iptable_filter/ip6table_filter ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6646",children:"(#6646)"})]}),"\n"]}),"\n",(0,i.jsx)(s.hr,{}),"\n",(0,i.jsxs)(s.h2,{id:"release-v1254k3s1",children:["Release ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/releases/tag/v1.25.4+k3s1",children:"v1.25.4+k3s1"})]}),"\n",(0,i.jsx)(s.p,{children:"This release updates Kubernetes to v1.25.4, and fixes a number of issues."}),"\n",(0,i.jsxs)(s.p,{children:["For more details on what's new, see the ",(0,i.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.25.md#changelog-since-v1253",children:"Kubernetes release notes"}),"."]}),"\n",(0,i.jsx)(s.h3,{id:"changes-since-v1253k3s1",children:"Changes since v1.25.3+k3s1:"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsxs)(s.li,{children:["Add the gateway parameter in netplan ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6292",children:"(#6292)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Bumped dynamiclistener library to v0.3.5 ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6300",children:"(#6300)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Update kube-router to v1.5.1 with extra logging ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6345",children:"(#6345)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Update maintainers ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6298",children:"(#6298)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Bump testing to opensuse Leap 15.4 ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6337",children:"(#6337)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Update E2E docs with more info on ubuntu 22.04 ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6316",children:"(#6316)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Netpol test for podSelector & ingress ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6247",children:"(#6247)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Bump all alpine images to 3.16 ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6334",children:"(#6334)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Bump kine to v0.9.6 / sqlite3 v3.39.2 (",(0,i.jsx)(s.a,{href:"https://nvd.nist.gov/vuln/detail/CVE-2022-35737",children:"CVE-2022-35737"}),") ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6317",children:"(#6317)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Add hardened cluster and upgrade tests ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6320",children:"(#6320)"})]}),"\n",(0,i.jsxs)(s.li,{children:["The bundled Traefik helm chart has been updated to v18.0.0 ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6353",children:"(#6353)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Mark v1.25.3+k3s1 as stable ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6338",children:"(#6338)"})]}),"\n",(0,i.jsxs)(s.li,{children:["The embedded helm controller has been bumped to v0.13.0 ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6294",children:"(#6294)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Fixed an issue that would prevent the deploy controller from handling manifests that include resource types that are no longer supported by the apiserver. ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6295",children:"(#6295)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Replace fedora-coreos with fedora 36 for install tests ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6315",children:"(#6315)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Convert containerd config.toml.tmpl Linux template to v2 syntax ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6267",children:"(#6267)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Add test for node-external-ip config parameter ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6359",children:"(#6359)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Use debugger-friendly compile settings if DEBUG is set ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6147",children:"(#6147)"})]}),"\n",(0,i.jsxs)(s.li,{children:["update e2e tests ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6354",children:"(#6354)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Remove unused vagrant development scripts ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6395",children:"(#6395)"})]}),"\n",(0,i.jsxs)(s.li,{children:["The bundled Traefik has been updated to v2.9.4 / helm chart v18.3.0 ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6397",children:"(#6397)"})]}),"\n",(0,i.jsxs)(s.li,{children:["None ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6371",children:"(#6371)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Fix incorrect defer usage ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6296",children:"(#6296)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Add snapshot restore e2e test ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6396",children:"(#6396)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Fix sonobouy tests on v1.25 ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6399",children:"(#6399)"})]}),"\n",(0,i.jsx)(s.li,{children:"Bump packaged component versions"}),"\n",(0,i.jsx)(s.li,{children:"The packaged traefik helm chart has been bumped to v19.0.0, enabling ingressClass support by default."}),"\n",(0,i.jsx)(s.li,{children:"The packaged local-path-provisioner has been bumped to v0.0.23"}),"\n",(0,i.jsxs)(s.li,{children:["The packaged coredns has been bumped to v1.9.4 ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6408",children:"(#6408)"})]}),"\n",(0,i.jsxs)(s.li,{children:["log kube-router version when starting netpol controller ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6405",children:"(#6405)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Add Kairos to ADOPTERS ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6417",children:"(#6417)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Update Flannel to 0.20.1 ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6388",children:"(#6388)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Avoid wrong config for ",(0,i.jsx)(s.code,{children:"flannel-external-ip"})," and add warning if unencrypted backend ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6403",children:"(#6403)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Fix test-mods to allow for pinning version from k8s.io ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6413",children:"(#6413)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Fix for metrics-server in the multi-cloud cluster env ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6386",children:"(#6386)"})]}),"\n",(0,i.jsxs)(s.li,{children:["K3s now indicates specifically which cluster-level configuration flags are out of sync when critical configuration differs between server nodes. ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6409",children:"(#6409)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Convert test output to JSON format ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6410",children:"(#6410)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Pull traefik helm chart directly from GH ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6468",children:"(#6468)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Nightly test fix ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6475",children:"(#6475)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Update to v1.25.4 ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6477",children:"(#6477)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Remove stuff which belongs in the windows executor implementation ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6492",children:"(#6492)"})]}),"\n",(0,i.jsxs)(s.li,{children:["The packaged traefik helm chart has been bumped to 19.0.4 ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6494",children:"(#6494)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Move traefik chart repo again ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6508",children:"(#6508)"})]}),"\n"]}),"\n",(0,i.jsx)(s.hr,{}),"\n",(0,i.jsxs)(s.h2,{id:"release-v1253k3s1",children:["Release ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/releases/tag/v1.25.3+k3s1",children:"v1.25.3+k3s1"})]}),"\n",(0,i.jsx)(s.p,{children:"This release updates Kubernetes to v1.25.3, and fixes a number of issues."}),"\n",(0,i.jsxs)(s.p,{children:["For more details on what's new, see the ",(0,i.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.25.md#changelog-since-v1252",children:"Kubernetes release notes"}),"."]}),"\n",(0,i.jsx)(s.h3,{id:"changes-since-v1252k3s1",children:"Changes since v1.25.2+k3s1:"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsxs)(s.li,{children:["E2E: Groundwork for PR runs ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6131",children:"(#6131)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Fix flannel for deployments of nodes which do not belong to the same network and connect using their public IP ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6180",children:"(#6180)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Mark v1.24.6+k3s1 as stable ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6193",children:"(#6193)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Add cluster reset test ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6161",children:"(#6161)"})]}),"\n",(0,i.jsxs)(s.li,{children:["The embedded metrics-server version has been bumped to v0.6.1 ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6151",children:"(#6151)"})]}),"\n",(0,i.jsxs)(s.li,{children:["The ServiceLB (klipper-lb) service controller is now integrated into the K3s stub cloud controller manager. ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6181",children:"(#6181)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Events recorded to the cluster by embedded controllers are now properly formatted in the service logs. ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6203",children:"(#6203)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Fix ",(0,i.jsx)(s.code,{children:"error dialing backend"})," errors in apiserver network proxy ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6216",children:"(#6216)"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsxs)(s.li,{children:["Fixed an issue with the apiserver network proxy that caused ",(0,i.jsx)(s.code,{children:"kubectl exec"})," to occasionally fail with ",(0,i.jsx)(s.code,{children:"error dialing backend: EOF"})]}),"\n",(0,i.jsxs)(s.li,{children:["Fixed an issue with the apiserver network proxy that caused ",(0,i.jsx)(s.code,{children:"kubectl exec"})," and ",(0,i.jsx)(s.code,{children:"kubectl logs"})," to fail when a custom kubelet port was used, and the custom port was blocked by firewall or security group rules."]}),"\n"]}),"\n"]}),"\n",(0,i.jsxs)(s.li,{children:["Fix the typo in the test ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6183",children:"(#6183)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Use setup-go action to cache dependencies ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6220",children:"(#6220)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Add journalctl logs to E2E tests ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6224",children:"(#6224)"})]}),"\n",(0,i.jsxs)(s.li,{children:["The embedded Traefik version has been bumped to v2.9.1 / chart 12.0.0 ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6223",children:"(#6223)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Fix flakey etcd test ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6232",children:"(#6232)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Replace deprecated ioutil package ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6230",children:"(#6230)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Fix dualStack test ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6245",children:"(#6245)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Add ServiceAccount for svclb pods ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6253",children:"(#6253)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Update to v1.25.3-k3s1 ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6269",children:"(#6269)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Return ProviderID in URI format ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6284",children:"(#6284)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Corrected CCM RBAC to allow for removal of legacy service finalizer during upgrades. ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6306",children:"(#6306)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Added a new --flannel-external-ip flag. ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6321",children:"(#6321)"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsx)(s.li,{children:"When enabled, Flannel traffic will now use the nodes external IPs, instead of internal."}),"\n",(0,i.jsx)(s.li,{children:"This is meant for use with distributed clusters that are not all on the same local network."}),"\n"]}),"\n"]}),"\n"]}),"\n",(0,i.jsx)(s.hr,{}),"\n",(0,i.jsxs)(s.h2,{id:"release-v1252k3s1",children:["Release ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/releases/tag/v1.25.2+k3s1",children:"v1.25.2+k3s1"})]}),"\n",(0,i.jsx)(s.p,{children:"This release updates Kubernetes to v1.25.2, and fixes a number of issues."}),"\n",(0,i.jsxs)(s.p,{children:["For more details on what's new, see the ",(0,i.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.25.md#changelog-since-v1250",children:"Kubernetes release notes"}),"."]}),"\n",(0,i.jsx)(s.h3,{id:"changes-since-v1250k3s1",children:"Changes since v1.25.0+k3s1:"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsxs)(s.li,{children:["Add k3s v1.25 to the release channel ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6129",children:"(#6129)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Restore original INSTALL_K3S_SKIP_DOWNLOAD behavior ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6130",children:"(#6130)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Add K3S Release Documentation ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6135",children:"(#6135)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Update to v1.25.1 ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6140",children:"(#6140)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Update to v1.25.2-k3s1 ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6168",children:"(#6168)"})]}),"\n"]}),"\n",(0,i.jsx)(s.hr,{}),"\n",(0,i.jsxs)(s.h2,{id:"release-v1250k3s1",children:["Release ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/releases/tag/v1.25.0+k3s1",children:"v1.25.0+k3s1"})]}),"\n",(0,i.jsx)(s.p,{children:"This release is K3S's first in the v1.25 line. This release updates Kubernetes to v1.25.0."}),"\n",(0,i.jsxs)(s.p,{children:["Before upgrading from earlier releases, be sure to read the Kubernetes ",(0,i.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.25.md#urgent-upgrade-notes",children:"Urgent Upgrade Notes"}),"."]}),"\n",(0,i.jsxs)(s.p,{children:[(0,i.jsx)(s.strong,{children:"Important Note:"})," Kubernetes v1.25 removes the beta ",(0,i.jsx)(s.code,{children:"PodSecurityPolicy"})," admission plugin. Please follow the ",(0,i.jsx)(s.a,{href:"https://kubernetes.io/docs/tasks/configure-pod-container/migrate-from-psp/",children:"upstream documentation"})," to migrate from PSP if using the built-in PodSecurity Admission Plugin, prior to upgrading to v1.25.0+k3s1."]}),"\n",(0,i.jsx)(s.h3,{id:"changes-since-v1244k3s1",children:"Changes since v1.24.4+k3s1:"}),"\n",(0,i.jsxs)(s.ul,{children:["\n",(0,i.jsxs)(s.li,{children:["Update Kubernetes to v1.25.0 ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6040",children:"(#6040)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Remove ",(0,i.jsx)(s.code,{children:"--containerd"})," flag from windows kubelet args ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6028",children:"(#6028)"})]}),"\n",(0,i.jsxs)(s.li,{children:["E2E: Add support for CentOS 7 and Rocky 8 ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6015",children:"(#6015)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Convert install tests to run PR build of k3s ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6003",children:"(#6003)"})]}),"\n",(0,i.jsxs)(s.li,{children:["CI: update Fedora 34 -> 35 ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/5996",children:"(#5996)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Fix dualStack test and change ipv6 network prefix ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6023",children:"(#6023)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Fix e2e tests ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6018",children:"(#6018)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Update README.md ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6048",children:"(#6048)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Remove wireguard interfaces when deleting the cluster ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6055",children:"(#6055)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Add validation check to confirm correct golang version for Kubernetes ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6050",children:"(#6050)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Expand startup integration test ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6030",children:"(#6030)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Update go.mod version to 1.19 ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6049",children:"(#6049)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Usage of ",(0,i.jsx)(s.code,{children:"--cluster-secret"}),", ",(0,i.jsx)(s.code,{children:"--no-deploy"}),", and ",(0,i.jsx)(s.code,{children:"--no-flannel"})," is no longer supported. Attempts to use these flags will cause fatal errors. See ",(0,i.jsx)(s.a,{href:"https://k3s-io.github.io/docs/reference/server-config#deprecated-options",children:"the docs"})," for their replacement. ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6069",children:"(#6069)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Update Flannel version to fix older iptables version issue. ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6090",children:"(#6090)"})]}),"\n",(0,i.jsxs)(s.li,{children:["The bundled version of runc has been bumped to v1.1.4 ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6071",children:"(#6071)"})]}),"\n",(0,i.jsxs)(s.li,{children:["The embedded containerd version has been bumped to v1.6.8-k3s1 ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6078",children:"(#6078)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Fix deprecation message ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6112",children:"(#6112)"})]}),"\n",(0,i.jsxs)(s.li,{children:["Added warning message for flannel backend additional options deprecation ",(0,i.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6111",children:"(#6111)"})]}),"\n"]}),"\n",(0,i.jsx)(s.hr,{})]})}function o(e={}){const{wrapper:s}={...(0,r.a)(),...e.components};return s?(0,i.jsx)(s,{...e,children:(0,i.jsx)(a,{...e})}):a(e)}},1151:(e,s,t)=>{t.d(s,{Z:()=>h,a:()=>l});var i=t(7294);const r={},n=i.createContext(r);function l(e){const s=i.useContext(n);return i.useMemo((function(){return"function"==typeof e?e(s):{...s,...e}}),[s,e])}function h(e){let s;return s=e.disableParentContext?"function"==typeof e.components?e.components(r):e.components||r:l(e.components),i.createElement(n.Provider,{value:s},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/9f491e05.37cd3ff8.js b/assets/js/9f491e05.3075f29e.js similarity index 99% rename from assets/js/9f491e05.37cd3ff8.js rename to assets/js/9f491e05.3075f29e.js index b2141bedf..d2765c171 100644 --- a/assets/js/9f491e05.37cd3ff8.js +++ b/assets/js/9f491e05.3075f29e.js @@ -1 +1 @@ -"use strict";(self.webpackChunkk_3_s_docs=self.webpackChunkk_3_s_docs||[]).push([[3189],{9297:(e,r,t)=>{t.r(r),t.d(r,{assets:()=>l,contentTitle:()=>i,default:()=>h,frontMatter:()=>a,metadata:()=>c,toc:()=>o});var s=t(5893),n=t(1151);const a={title:"CIS 1.23 Self Assessment Guide"},i=void 0,c={id:"security/self-assessment-1.23",title:"CIS 1.23 Self Assessment Guide",description:"Overview",source:"@site/docs/security/self-assessment-1.23.md",sourceDirName:"security",slug:"/security/self-assessment-1.23",permalink:"/security/self-assessment-1.23",draft:!1,unlisted:!1,editUrl:"https://github.com/k3s-io/docs/edit/main/docs/security/self-assessment-1.23.md",tags:[],version:"current",lastUpdatedAt:1723651727e3,frontMatter:{title:"CIS 1.23 Self Assessment Guide"}},l={},o=[{value:"Overview",id:"overview",level:2},{value:"Testing controls methodology",id:"testing-controls-methodology",level:3},{value:"1.1 Control Plane Node Configuration Files",id:"11-control-plane-node-configuration-files",level:2},{value:"1.1.1 Ensure that the API server pod specification file permissions are set to 644 or more restrictive (Automated)",id:"111-ensure-that-the-api-server-pod-specification-file-permissions-are-set-to-644-or-more-restrictive-automated",level:3},{value:"1.1.2 Ensure that the API server pod specification file ownership is set to root (Automated)",id:"112-ensure-that-the-api-server-pod-specification-file-ownership-is-set-to-root-automated",level:3},{value:"1.1.3 Ensure that the controller manager pod specification file permissions are set to 644 or more restrictive (Automated)",id:"113-ensure-that-the-controller-manager-pod-specification-file-permissions-are-set-to-644-or-more-restrictive-automated",level:3},{value:"1.1.4 Ensure that the controller manager pod specification file ownership is set to root (Automated)",id:"114-ensure-that-the-controller-manager-pod-specification-file-ownership-is-set-to-root-automated",level:3},{value:"1.1.5 Ensure that the scheduler pod specification file permissions are set to 644 or more restrictive (Automated)",id:"115-ensure-that-the-scheduler-pod-specification-file-permissions-are-set-to-644-or-more-restrictive-automated",level:3},{value:"1.1.6 Ensure that the scheduler pod specification file ownership is set to root (Automated)",id:"116-ensure-that-the-scheduler-pod-specification-file-ownership-is-set-to-root-automated",level:3},{value:"1.1.7 Ensure that the etcd pod specification file permissions are set to 644 or more restrictive (Automated)",id:"117-ensure-that-the-etcd-pod-specification-file-permissions-are-set-to-644-or-more-restrictive-automated",level:3},{value:"1.1.8 Ensure that the etcd pod specification file ownership is set to root (Automated)",id:"118-ensure-that-the-etcd-pod-specification-file-ownership-is-set-to-root-automated",level:3},{value:"1.1.9 Ensure that the Container Network Interface file permissions are set to 644 or more restrictive (Manual)",id:"119-ensure-that-the-container-network-interface-file-permissions-are-set-to-644-or-more-restrictive-manual",level:3},{value:"1.1.10 Ensure that the Container Network Interface file ownership is set to root (Manual)",id:"1110-ensure-that-the-container-network-interface-file-ownership-is-set-to-root-manual",level:3},{value:"1.1.11 Ensure that the etcd data directory permissions are set to 700 or more restrictive (Automated)",id:"1111-ensure-that-the-etcd-data-directory-permissions-are-set-to-700-or-more-restrictive-automated",level:3},{value:"1.1.12 Ensure that the etcd data directory ownership is set to etcd (Automated)",id:"1112-ensure-that-the-etcd-data-directory-ownership-is-set-to-etcd-automated",level:3},{value:"1.1.13 Ensure that the admin.conf file permissions are set to 600 or more restrictive (Automated)",id:"1113-ensure-that-the-adminconf-file-permissions-are-set-to-600-or-more-restrictive-automated",level:3},{value:"1.1.14 Ensure that the admin.conf file ownership is set to root (Automated)",id:"1114-ensure-that-the-adminconf-file-ownership-is-set-to-root-automated",level:3},{value:"1.1.15 Ensure that the scheduler.conf file permissions are set to 644 or more restrictive (Automated)",id:"1115-ensure-that-the-schedulerconf-file-permissions-are-set-to-644-or-more-restrictive-automated",level:3},{value:"1.1.16 Ensure that the scheduler.conf file ownership is set to root (Automated)",id:"1116-ensure-that-the-schedulerconf-file-ownership-is-set-to-root-automated",level:3},{value:"1.1.17 Ensure that the controller-manager.conf file permissions are set to 644 or more restrictive (Automated)",id:"1117-ensure-that-the-controller-managerconf-file-permissions-are-set-to-644-or-more-restrictive-automated",level:3},{value:"1.1.18 Ensure that the controller-manager.conf file ownership is set to root (Automated)",id:"1118-ensure-that-the-controller-managerconf-file-ownership-is-set-to-root-automated",level:3},{value:"1.1.19 Ensure that the Kubernetes PKI directory and file ownership is set to root (Automated)",id:"1119-ensure-that-the-kubernetes-pki-directory-and-file-ownership-is-set-to-root-automated",level:3},{value:"1.1.20 Ensure that the Kubernetes PKI certificate file permissions are set to 644 or more restrictive (Manual)",id:"1120-ensure-that-the-kubernetes-pki-certificate-file-permissions-are-set-to-644-or-more-restrictive-manual",level:3},{value:"1.1.21 Ensure that the Kubernetes PKI key file permissions are set to 600 (Manual)",id:"1121-ensure-that-the-kubernetes-pki-key-file-permissions-are-set-to-600-manual",level:3},{value:"1.2 API Server",id:"12-api-server",level:2},{value:"1.2.1 Ensure that the --anonymous-auth argument is set to false (Manual)",id:"121-ensure-that-the---anonymous-auth-argument-is-set-to-false-manual",level:3},{value:"1.2.2 Ensure that the --token-auth-file parameter is not set (Automated)",id:"122-ensure-that-the---token-auth-file-parameter-is-not-set-automated",level:3},{value:"1.2.3 Ensure that the --DenyServiceExternalIPs is not set (Automated)",id:"123-ensure-that-the---denyserviceexternalips-is-not-set-automated",level:3},{value:"1.2.4 Ensure that the --kubelet-https argument is set to true (Automated)",id:"124-ensure-that-the---kubelet-https-argument-is-set-to-true-automated",level:3},{value:"1.2.5 Ensure that the --kubelet-client-certificate and --kubelet-client-key arguments are set as appropriate (Automated)",id:"125-ensure-that-the---kubelet-client-certificate-and---kubelet-client-key-arguments-are-set-as-appropriate-automated",level:3},{value:"1.2.6 Ensure that the --kubelet-certificate-authority argument is set as appropriate (Automated)",id:"126-ensure-that-the---kubelet-certificate-authority-argument-is-set-as-appropriate-automated",level:3},{value:"1.2.7 Ensure that the --authorization-mode argument is not set to AlwaysAllow (Automated)",id:"127-ensure-that-the---authorization-mode-argument-is-not-set-to-alwaysallow-automated",level:3},{value:"1.2.8 Ensure that the --authorization-mode argument includes Node (Automated)",id:"128-ensure-that-the---authorization-mode-argument-includes-node-automated",level:3},{value:"1.2.9 Ensure that the --authorization-mode argument includes RBAC (Automated)",id:"129-ensure-that-the---authorization-mode-argument-includes-rbac-automated",level:3},{value:"1.2.10 Ensure that the admission control plugin EventRateLimit is set (Manual)",id:"1210-ensure-that-the-admission-control-plugin-eventratelimit-is-set-manual",level:3},{value:"1.2.11 Ensure that the admission control plugin AlwaysAdmit is not set (Automated)",id:"1211-ensure-that-the-admission-control-plugin-alwaysadmit-is-not-set-automated",level:3},{value:"1.2.12 Ensure that the admission control plugin AlwaysPullImages is set (Manual)",id:"1212-ensure-that-the-admission-control-plugin-alwayspullimages-is-set-manual",level:3},{value:"1.2.13 Ensure that the admission control plugin SecurityContextDeny is set if PodSecurityPolicy is not used (Manual)",id:"1213-ensure-that-the-admission-control-plugin-securitycontextdeny-is-set-if-podsecuritypolicy-is-not-used-manual",level:3},{value:"1.2.14 Ensure that the admission control plugin ServiceAccount is set (Automated)",id:"1214-ensure-that-the-admission-control-plugin-serviceaccount-is-set-automated",level:3},{value:"1.2.15 Ensure that the admission control plugin NamespaceLifecycle is set (Automated)",id:"1215-ensure-that-the-admission-control-plugin-namespacelifecycle-is-set-automated",level:3},{value:"1.2.16 Ensure that the admission control plugin NodeRestriction is set (Automated)",id:"1216-ensure-that-the-admission-control-plugin-noderestriction-is-set-automated",level:3},{value:"1.2.17 Ensure that the --secure-port argument is not set to 0 (Automated)",id:"1217-ensure-that-the---secure-port-argument-is-not-set-to-0-automated",level:3},{value:"1.2.18 Ensure that the --profiling argument is set to false (Automated)",id:"1218-ensure-that-the---profiling-argument-is-set-to-false-automated",level:3},{value:"1.2.19 Ensure that the --audit-log-path argument is set (Automated)",id:"1219-ensure-that-the---audit-log-path-argument-is-set-automated",level:3},{value:"1.2.20 Ensure that the --audit-log-maxage argument is set to 30 or as appropriate (Automated)",id:"1220-ensure-that-the---audit-log-maxage-argument-is-set-to-30-or-as-appropriate-automated",level:3},{value:"1.2.21 Ensure that the --audit-log-maxbackup argument is set to 10 or as appropriate (Automated)",id:"1221-ensure-that-the---audit-log-maxbackup-argument-is-set-to-10-or-as-appropriate-automated",level:3},{value:"1.2.22 Ensure that the --audit-log-maxsize argument is set to 100 or as appropriate (Automated)",id:"1222-ensure-that-the---audit-log-maxsize-argument-is-set-to-100-or-as-appropriate-automated",level:3},{value:"1.2.24 Ensure that the --service-account-lookup argument is set to true (Automated)",id:"1224-ensure-that-the---service-account-lookup-argument-is-set-to-true-automated",level:3},{value:"1.2.25 Ensure that the --request-timeout argument is set as appropriate (Automated)",id:"1225-ensure-that-the---request-timeout-argument-is-set-as-appropriate-automated",level:3},{value:"1.2.26 Ensure that the --etcd-certfile and --etcd-keyfile arguments are set as appropriate (Automated)",id:"1226-ensure-that-the---etcd-certfile-and---etcd-keyfile-arguments-are-set-as-appropriate-automated",level:3},{value:"1.2.27 Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate (Automated)",id:"1227-ensure-that-the---tls-cert-file-and---tls-private-key-file-arguments-are-set-as-appropriate-automated",level:3},{value:"1.2.28 Ensure that the --client-ca-file argument is set as appropriate (Automated)",id:"1228-ensure-that-the---client-ca-file-argument-is-set-as-appropriate-automated",level:3},{value:"1.2.29 Ensure that the --etcd-cafile argument is set as appropriate (Automated)",id:"1229-ensure-that-the---etcd-cafile-argument-is-set-as-appropriate-automated",level:3},{value:"1.2.30 Ensure that the --encryption-provider-config argument is set as appropriate (Manual)",id:"1230-ensure-that-the---encryption-provider-config-argument-is-set-as-appropriate-manual",level:3},{value:"1.2.31 Ensure that encryption providers are appropriately configured (Manual)",id:"1231-ensure-that-encryption-providers-are-appropriately-configured-manual",level:3},{value:"1.2.32 Ensure that the API Server only makes use of Strong Cryptographic Ciphers (Manual)",id:"1232-ensure-that-the-api-server-only-makes-use-of-strong-cryptographic-ciphers-manual",level:3},{value:"1.3 Controller Manager",id:"13-controller-manager",level:2},{value:"1.3.1 Ensure that the --terminated-pod-gc-threshold argument is set as appropriate (Manual)",id:"131-ensure-that-the---terminated-pod-gc-threshold-argument-is-set-as-appropriate-manual",level:3},{value:"1.3.2 Ensure that the --profiling argument is set to false (Automated)",id:"132-ensure-that-the---profiling-argument-is-set-to-false-automated",level:3},{value:"1.3.3 Ensure that the --use-service-account-credentials argument is set to true (Automated)",id:"133-ensure-that-the---use-service-account-credentials-argument-is-set-to-true-automated",level:3},{value:"1.3.4 Ensure that the --service-account-private-key-file argument is set as appropriate (Automated)",id:"134-ensure-that-the---service-account-private-key-file-argument-is-set-as-appropriate-automated",level:3},{value:"1.3.5 Ensure that the --root-ca-file argument is set as appropriate (Automated)",id:"135-ensure-that-the---root-ca-file-argument-is-set-as-appropriate-automated",level:3},{value:"1.3.6 Ensure that the RotateKubeletServerCertificate argument is set to true (Automated)",id:"136-ensure-that-the-rotatekubeletservercertificate-argument-is-set-to-true-automated",level:3},{value:"1.3.7 Ensure that the --bind-address argument is set to 127.0.0.1 (Automated)",id:"137-ensure-that-the---bind-address-argument-is-set-to-127001-automated",level:3},{value:"1.4 Scheduler",id:"14-scheduler",level:2},{value:"1.4.1 Ensure that the --profiling argument is set to false (Automated)",id:"141-ensure-that-the---profiling-argument-is-set-to-false-automated",level:3},{value:"1.4.2 Ensure that the --bind-address argument is set to 127.0.0.1 (Automated)",id:"142-ensure-that-the---bind-address-argument-is-set-to-127001-automated",level:3},{value:"2 Etcd Node Configuration",id:"2-etcd-node-configuration",level:2},{value:"2.1 Ensure that the --cert-file and --key-file arguments are set as appropriate (Automated)",id:"21-ensure-that-the---cert-file-and---key-file-arguments-are-set-as-appropriate-automated",level:3},{value:"2.2 Ensure that the --client-cert-auth argument is set to true (Automated)",id:"22-ensure-that-the---client-cert-auth-argument-is-set-to-true-automated",level:3},{value:"2.3 Ensure that the --auto-tls argument is not set to true (Automated)",id:"23-ensure-that-the---auto-tls-argument-is-not-set-to-true-automated",level:3},{value:"2.4 Ensure that the --peer-cert-file and --peer-key-file arguments are set as appropriate (Automated)",id:"24-ensure-that-the---peer-cert-file-and---peer-key-file-arguments-are-set-as-appropriate-automated",level:3},{value:"2.5 Ensure that the --peer-client-cert-auth argument is set to true (Automated)",id:"25-ensure-that-the---peer-client-cert-auth-argument-is-set-to-true-automated",level:3},{value:"2.6 Ensure that the --peer-auto-tls argument is not set to true (Automated)",id:"26-ensure-that-the---peer-auto-tls-argument-is-not-set-to-true-automated",level:3},{value:"2.7 Ensure that a unique Certificate Authority is used for etcd (Manual)",id:"27-ensure-that-a-unique-certificate-authority-is-used-for-etcd-manual",level:3},{value:"3.1 Authentication and Authorization",id:"31-authentication-and-authorization",level:2},{value:"3.1.1 Client certificate authentication should not be used for users (Manual)",id:"311-client-certificate-authentication-should-not-be-used-for-users-manual",level:3},{value:"3.2 Logging",id:"32-logging",level:2},{value:"3.2.1 Ensure that a minimal audit policy is created (Manual)",id:"321-ensure-that-a-minimal-audit-policy-is-created-manual",level:3},{value:"3.2.2 Ensure that the audit policy covers key security concerns (Manual)",id:"322-ensure-that-the-audit-policy-covers-key-security-concerns-manual",level:3},{value:"4.1 Worker Node Configuration Files",id:"41-worker-node-configuration-files",level:2},{value:"4.1.1 Ensure that the kubelet service file permissions are set to 644 or more restrictive (Automated)",id:"411-ensure-that-the-kubelet-service-file-permissions-are-set-to-644-or-more-restrictive-automated",level:3},{value:"4.1.2 Ensure that the kubelet service file ownership is set to root (Automated)",id:"412-ensure-that-the-kubelet-service-file-ownership-is-set-to-root-automated",level:3},{value:"4.1.3 If proxy kubeconfig file exists ensure permissions are set to 644 or more restrictive (Manual)",id:"413-if-proxy-kubeconfig-file-exists-ensure-permissions-are-set-to-644-or-more-restrictive-manual",level:3},{value:"4.1.4 If proxy kubeconfig file exists ensure ownership is set to root (Manual)",id:"414-if-proxy-kubeconfig-file-exists-ensure-ownership-is-set-to-root-manual",level:3},{value:"4.1.5 Ensure that the --kubeconfig kubelet.conf file permissions are set to 644 or more restrictive (Automated)",id:"415-ensure-that-the---kubeconfig-kubeletconf-file-permissions-are-set-to-644-or-more-restrictive-automated",level:3},{value:"4.1.6 Ensure that the --kubeconfig kubelet.conf file ownership is set to root (Automated)",id:"416-ensure-that-the---kubeconfig-kubeletconf-file-ownership-is-set-to-root-automated",level:3},{value:"4.1.7 Ensure that the certificate authorities file permissions are set to 644 or more restrictive (Manual)",id:"417-ensure-that-the-certificate-authorities-file-permissions-are-set-to-644-or-more-restrictive-manual",level:3},{value:"4.1.8 Ensure that the client certificate authorities file ownership is set to root (Manual)",id:"418-ensure-that-the-client-certificate-authorities-file-ownership-is-set-to-root-manual",level:3},{value:"4.1.9 Ensure that the kubelet --config configuration file has permissions set to 644 or more restrictive (Automated)",id:"419-ensure-that-the-kubelet---config-configuration-file-has-permissions-set-to-644-or-more-restrictive-automated",level:3},{value:"4.1.10 Ensure that the kubelet --config configuration file ownership is set to root (Automated)",id:"4110-ensure-that-the-kubelet---config-configuration-file-ownership-is-set-to-root-automated",level:3},{value:"4.2 Kubelet",id:"42-kubelet",level:2},{value:"4.2.1 Ensure that the --anonymous-auth argument is set to false (Automated)",id:"421-ensure-that-the---anonymous-auth-argument-is-set-to-false-automated",level:3},{value:"4.2.2 Ensure that the --authorization-mode argument is not set to AlwaysAllow (Automated)",id:"422-ensure-that-the---authorization-mode-argument-is-not-set-to-alwaysallow-automated",level:3},{value:"4.2.3 Ensure that the --client-ca-file argument is set as appropriate (Automated)",id:"423-ensure-that-the---client-ca-file-argument-is-set-as-appropriate-automated",level:3},{value:"4.2.4 Ensure that the --read-only-port argument is set to 0 (Manual)",id:"424-ensure-that-the---read-only-port-argument-is-set-to-0-manual",level:3},{value:"4.2.5 Ensure that the --streaming-connection-idle-timeout argument is not set to 0 (Manual)",id:"425-ensure-that-the---streaming-connection-idle-timeout-argument-is-not-set-to-0-manual",level:3},{value:"4.2.6 Ensure that the --protect-kernel-defaults argument is set to true (Automated)",id:"426-ensure-that-the---protect-kernel-defaults-argument-is-set-to-true-automated",level:3},{value:"4.2.7 Ensure that the --make-iptables-util-chains argument is set to true (Automated)",id:"427-ensure-that-the---make-iptables-util-chains-argument-is-set-to-true-automated",level:3},{value:"4.2.8 Ensure that the --hostname-override argument is not set (Manual)",id:"428-ensure-that-the---hostname-override-argument-is-not-set-manual",level:3},{value:"4.2.9 Ensure that the --event-qps argument is set to 0 or a level which ensures appropriate event capture (Manual)",id:"429-ensure-that-the---event-qps-argument-is-set-to-0-or-a-level-which-ensures-appropriate-event-capture-manual",level:3},{value:"4.2.10 Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate (Manual)",id:"4210-ensure-that-the---tls-cert-file-and---tls-private-key-file-arguments-are-set-as-appropriate-manual",level:3},{value:"4.2.11 Ensure that the --rotate-certificates argument is not set to false (Automated)",id:"4211-ensure-that-the---rotate-certificates-argument-is-not-set-to-false-automated",level:3},{value:"4.2.12 Verify that the RotateKubeletServerCertificate argument is set to true (Manual)",id:"4212-verify-that-the-rotatekubeletservercertificate-argument-is-set-to-true-manual",level:3},{value:"4.2.13 Ensure that the Kubelet only makes use of Strong Cryptographic Ciphers (Manual)",id:"4213-ensure-that-the-kubelet-only-makes-use-of-strong-cryptographic-ciphers-manual",level:3},{value:"5.1 RBAC and Service Accounts",id:"51-rbac-and-service-accounts",level:2},{value:"5.1.1 Ensure that the cluster-admin role is only used where required (Manual)",id:"511-ensure-that-the-cluster-admin-role-is-only-used-where-required-manual",level:3},{value:"5.1.2 Minimize access to secrets (Manual)",id:"512-minimize-access-to-secrets-manual",level:3},{value:"5.1.3 Minimize wildcard use in Roles and ClusterRoles (Manual)",id:"513-minimize-wildcard-use-in-roles-and-clusterroles-manual",level:3},{value:"5.1.4 Minimize access to create pods (Manual)",id:"514-minimize-access-to-create-pods-manual",level:3},{value:"5.1.5 Ensure that default service accounts are not actively used. (Manual)",id:"515-ensure-that-default-service-accounts-are-not-actively-used-manual",level:3},{value:"5.1.6 Ensure that Service Account Tokens are only mounted where necessary (Manual)",id:"516-ensure-that-service-account-tokens-are-only-mounted-where-necessary-manual",level:3},{value:"5.1.7 Avoid use of system group (Manual)",id:"517-avoid-use-of-system-group-manual",level:3},{value:"5.1.8 Limit use of the Bind, Impersonate and Escalate permissions in the Kubernetes cluster (Manual)",id:"518-limit-use-of-the-bind-impersonate-and-escalate-permissions-in-the-kubernetes-cluster-manual",level:3},{value:"5.2 Pod Security Standards",id:"52-pod-security-standards",level:2},{value:"5.2.1 Ensure that the cluster has at least one active policy control mechanism in place (Manual)",id:"521-ensure-that-the-cluster-has-at-least-one-active-policy-control-mechanism-in-place-manual",level:3},{value:"5.2.2 Minimize the admission of privileged containers (Automated)",id:"522-minimize-the-admission-of-privileged-containers-automated",level:3},{value:"5.2.3 Minimize the admission of containers wishing to share the host process ID namespace (Automated)",id:"523-minimize-the-admission-of-containers-wishing-to-share-the-host-process-id-namespace-automated",level:3},{value:"5.2.4 Minimize the admission of containers wishing to share the host IPC namespace (Automated)",id:"524-minimize-the-admission-of-containers-wishing-to-share-the-host-ipc-namespace-automated",level:3},{value:"5.2.5 Minimize the admission of containers wishing to share the host network namespace (Automated)",id:"525-minimize-the-admission-of-containers-wishing-to-share-the-host-network-namespace-automated",level:3},{value:"5.2.6 Minimize the admission of containers with allowPrivilegeEscalation (Automated)",id:"526-minimize-the-admission-of-containers-with-allowprivilegeescalation-automated",level:3},{value:"5.2.7 Minimize the admission of root containers (Automated)",id:"527-minimize-the-admission-of-root-containers-automated",level:3},{value:"5.2.8 Minimize the admission of containers with the NET_RAW capability (Automated)",id:"528-minimize-the-admission-of-containers-with-the-net_raw-capability-automated",level:3},{value:"5.2.9 Minimize the admission of containers with added capabilities (Automated)",id:"529-minimize-the-admission-of-containers-with-added-capabilities-automated",level:3},{value:"5.2.10 Minimize the admission of containers with capabilities assigned (Manual)",id:"5210-minimize-the-admission-of-containers-with-capabilities-assigned-manual",level:3},{value:"5.2.11 Minimize the admission of Windows HostProcess containers (Manual)",id:"5211-minimize-the-admission-of-windows-hostprocess-containers-manual",level:3},{value:"5.2.12 Minimize the admission of HostPath volumes (Manual)",id:"5212-minimize-the-admission-of-hostpath-volumes-manual",level:3},{value:"5.2.13 Minimize the admission of containers which use HostPorts (Manual)",id:"5213-minimize-the-admission-of-containers-which-use-hostports-manual",level:3},{value:"5.3 Network Policies and CNI",id:"53-network-policies-and-cni",level:2},{value:"5.3.1 Ensure that the CNI in use supports NetworkPolicies (Manual)",id:"531-ensure-that-the-cni-in-use-supports-networkpolicies-manual",level:3},{value:"5.3.2 Ensure that all Namespaces have NetworkPolicies defined (Manual)",id:"532-ensure-that-all-namespaces-have-networkpolicies-defined-manual",level:3},{value:"5.4 Secrets Management",id:"54-secrets-management",level:2},{value:"5.4.1 Prefer using Secrets as files over Secrets as environment variables (Manual)",id:"541-prefer-using-secrets-as-files-over-secrets-as-environment-variables-manual",level:3},{value:"5.4.2 Consider external secret storage (Manual)",id:"542-consider-external-secret-storage-manual",level:3},{value:"5.5 Extensible Admission Control",id:"55-extensible-admission-control",level:2},{value:"5.5.1 Configure Image Provenance using ImagePolicyWebhook admission controller (Manual)",id:"551-configure-image-provenance-using-imagepolicywebhook-admission-controller-manual",level:3},{value:"5.7 General Policies",id:"57-general-policies",level:2},{value:"5.7.1 Create administrative boundaries between resources using namespaces (Manual)",id:"571-create-administrative-boundaries-between-resources-using-namespaces-manual",level:3},{value:"5.7.2 Ensure that the seccomp profile is set to docker/default in your Pod definitions (Manual)",id:"572-ensure-that-the-seccomp-profile-is-set-to-dockerdefault-in-your-pod-definitions-manual",level:3},{value:"5.7.3 Apply SecurityContext to your Pods and Containers (Manual)",id:"573-apply-securitycontext-to-your-pods-and-containers-manual",level:3},{value:"5.7.4 The default namespace should not be used (Manual)",id:"574-the-default-namespace-should-not-be-used-manual",level:3}];function d(e){const r={a:"a",blockquote:"blockquote",code:"code",h2:"h2",h3:"h3",li:"li",p:"p",pre:"pre",strong:"strong",ul:"ul",...(0,n.a)(),...e.components};return(0,s.jsxs)(s.Fragment,{children:[(0,s.jsx)(r.h2,{id:"overview",children:"Overview"}),"\n",(0,s.jsxs)(r.p,{children:["This document is a companion to the ",(0,s.jsx)(r.a,{href:"/security/hardening-guide",children:"K3s security hardening guide"}),". The hardening guide provides prescriptive guidance for hardening a production installation of K3s, and this benchmark guide is meant to help you evaluate the level of security of the hardened cluster against each control in the CIS Kubernetes Benchmark. It is to be used by K3s operators, security teams, auditors, and decision-makers."]}),"\n",(0,s.jsxs)(r.p,{children:["This guide is specific to the ",(0,s.jsx)(r.strong,{children:"v1.22-v1.23"})," release lines of K3s and the ",(0,s.jsx)(r.strong,{children:"v1.23"})," release of the CIS Kubernetes Benchmark."]}),"\n",(0,s.jsxs)(r.p,{children:["For more information about each control, including detailed descriptions and remediations for failing tests, you can refer to the corresponding section of the CIS Kubernetes Benchmark v1.6. You can download the benchmark, after creating a free account, in ",(0,s.jsx)(r.a,{href:"https://www.cisecurity.org/benchmark/kubernetes/",children:"Center for Internet Security (CIS)"}),"."]}),"\n",(0,s.jsx)(r.h3,{id:"testing-controls-methodology",children:"Testing controls methodology"}),"\n",(0,s.jsx)(r.p,{children:"Each control in the CIS Kubernetes Benchmark was evaluated against a K3s cluster that was configured according to the accompanying hardening guide."}),"\n",(0,s.jsx)(r.p,{children:"Where control audits differ from the original CIS benchmark, the audit commands specific to K3s are provided for testing."}),"\n",(0,s.jsx)(r.p,{children:"These are the possible results for each control:"}),"\n",(0,s.jsxs)(r.ul,{children:["\n",(0,s.jsxs)(r.li,{children:[(0,s.jsx)(r.strong,{children:"Pass"})," - The K3s cluster under test passed the audit outlined in the benchmark."]}),"\n",(0,s.jsxs)(r.li,{children:[(0,s.jsx)(r.strong,{children:"Not Applicable"})," - The control is not applicable to K3s because of how it is designed to operate. The remediation section will explain why this is so."]}),"\n",(0,s.jsxs)(r.li,{children:[(0,s.jsx)(r.strong,{children:"Warn"})," - The control is manual in the CIS benchmark and it depends on the cluster's use case or some other factor that must be determined by the cluster operator. These controls have been evaluated to ensure K3s does not prevent their implementation, but no further configuration or auditing of the cluster under test has been performed."]}),"\n"]}),"\n",(0,s.jsx)(r.p,{children:'This guide makes the assumption that K3s is running as a Systemd unit. Your installation may vary and will require you to adjust the "audit" commands to fit your scenario.'}),"\n",(0,s.jsxs)(r.blockquote,{children:["\n",(0,s.jsxs)(r.p,{children:["NOTE: Only ",(0,s.jsx)(r.code,{children:"automated"})," tests (previously called ",(0,s.jsx)(r.code,{children:"scored"}),") are covered in this guide."]}),"\n"]}),"\n",(0,s.jsx)(r.h2,{id:"11-control-plane-node-configuration-files",children:"1.1 Control Plane Node Configuration Files"}),"\n",(0,s.jsx)(r.h3,{id:"111-ensure-that-the-api-server-pod-specification-file-permissions-are-set-to-644-or-more-restrictive-automated",children:"1.1.1 Ensure that the API server pod specification file permissions are set to 644 or more restrictive (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," Not Applicable"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nRun the below command (based on the file location on your system) on the\ncontrol plane node.\nFor example, ",(0,s.jsx)(r.code,{children:"chmod 644 /etc/kubernetes/manifests/kube-apiserver.yaml"})]}),"\n",(0,s.jsxs)(r.h3,{id:"112-ensure-that-the-api-server-pod-specification-file-ownership-is-set-to-root-automated",children:["1.1.2 Ensure that the API server pod specification file ownership is set to root",":root"," (Automated)"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," Not Applicable"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nRun the below command (based on the file location on your system) on the control plane node.\nFor example, ",(0,s.jsx)(r.code,{children:"chown root:root /etc/kubernetes/manifests/kube-apiserver.yaml"})]}),"\n",(0,s.jsx)(r.h3,{id:"113-ensure-that-the-controller-manager-pod-specification-file-permissions-are-set-to-644-or-more-restrictive-automated",children:"1.1.3 Ensure that the controller manager pod specification file permissions are set to 644 or more restrictive (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," Not Applicable"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nRun the below command (based on the file location on your system) on the control plane node.\nFor example, ",(0,s.jsx)(r.code,{children:"chmod 644 /etc/kubernetes/manifests/kube-controller-manager.yaml"})]}),"\n",(0,s.jsxs)(r.h3,{id:"114-ensure-that-the-controller-manager-pod-specification-file-ownership-is-set-to-root-automated",children:["1.1.4 Ensure that the controller manager pod specification file ownership is set to root",":root"," (Automated)"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," Not Applicable"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nRun the below command (based on the file location on your system) on the control plane node.\nFor example, ",(0,s.jsx)(r.code,{children:"chown root:root /etc/kubernetes/manifests/kube-controller-manager.yaml"})]}),"\n",(0,s.jsx)(r.h3,{id:"115-ensure-that-the-scheduler-pod-specification-file-permissions-are-set-to-644-or-more-restrictive-automated",children:"1.1.5 Ensure that the scheduler pod specification file permissions are set to 644 or more restrictive (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," Not Applicable"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nRun the below command (based on the file location on your system) on the control plane node.\nFor example, ",(0,s.jsx)(r.code,{children:"chmod 644 /etc/kubernetes/manifests/kube-scheduler.yaml"})]}),"\n",(0,s.jsxs)(r.h3,{id:"116-ensure-that-the-scheduler-pod-specification-file-ownership-is-set-to-root-automated",children:["1.1.6 Ensure that the scheduler pod specification file ownership is set to root",":root"," (Automated)"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," Not Applicable"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nRun the below command (based on the file location on your system) on the control plane node.\nFor example, ",(0,s.jsx)(r.code,{children:"chown root:root /etc/kubernetes/manifests/kube-scheduler.yaml"})]}),"\n",(0,s.jsx)(r.h3,{id:"117-ensure-that-the-etcd-pod-specification-file-permissions-are-set-to-644-or-more-restrictive-automated",children:"1.1.7 Ensure that the etcd pod specification file permissions are set to 644 or more restrictive (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," Not Applicable"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nRun the below command (based on the file location on your system) on the control plane node.\nFor example, ",(0,s.jsx)(r.code,{children:"chmod 644 /etc/kubernetes/manifests/etcd.yaml"})]}),"\n",(0,s.jsxs)(r.h3,{id:"118-ensure-that-the-etcd-pod-specification-file-ownership-is-set-to-root-automated",children:["1.1.8 Ensure that the etcd pod specification file ownership is set to root",":root"," (Automated)"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," Not Applicable"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nRun the below command (based on the file location on your system) on the control plane node.\nFor example, ",(0,s.jsx)(r.code,{children:"chown root:root /etc/kubernetes/manifests/etcd.yaml"})]}),"\n",(0,s.jsx)(r.h3,{id:"119-ensure-that-the-container-network-interface-file-permissions-are-set-to-644-or-more-restrictive-manual",children:"1.1.9 Ensure that the Container Network Interface file permissions are set to 644 or more restrictive (Manual)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," Not Applicable"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nRun the below command (based on the file location on your system) on the control plane node.\nFor example, ",(0,s.jsx)(r.code,{children:"chmod 644 "})]}),"\n",(0,s.jsxs)(r.h3,{id:"1110-ensure-that-the-container-network-interface-file-ownership-is-set-to-root-manual",children:["1.1.10 Ensure that the Container Network Interface file ownership is set to root",":root"," (Manual)"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," Not Applicable"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nRun the below command (based on the file location on your system) on the control plane node.\nFor example, ",(0,s.jsx)(r.code,{children:"chown root:root "})]}),"\n",(0,s.jsx)(r.h3,{id:"1111-ensure-that-the-etcd-data-directory-permissions-are-set-to-700-or-more-restrictive-automated",children:"1.1.11 Ensure that the etcd data directory permissions are set to 700 or more restrictive (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," pass"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nOn the etcd server node, get the etcd data directory, passed as an argument --data-dir,\nfrom the command 'ps -ef | grep etcd'.\nRun the below command (based on the etcd data directory found above). For example,\nchmod 700 /var/lib/etcd"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Audit Script:"})," ",(0,s.jsx)(r.code,{children:"check_for_k3s_etcd.sh"})]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:'#!/bin/bash\n\n# This script is used to ensure that k3s is actually running etcd (and not other databases like sqlite3)\n# before it checks the requirement\nset -eE\n\nhandle_error() {\n echo "false"\n}\n\ntrap \'handle_error\' ERR\n\n\nif [[ "$(journalctl -D /var/log/journal -u k3s | grep \'Managed etcd cluster initializing\' | grep -v grep | wc -l)" -gt 0 ]]; then\n case $1 in \n "1.1.11")\n echo $(stat -c %a /var/lib/rancher/k3s/server/db/etcd);;\n "1.2.29")\n echo $(journalctl -D /var/log/journal -u k3s | grep \'Running kube-apiserver\' | tail -n1 | grep \'etcd-\');;\n "2.1")\n echo $(grep -A 5 \'client-transport-security\' /var/lib/rancher/k3s/server/db/etcd/config | grep -E \'cert-file|key-file\');;\n "2.2")\n echo $(grep -A 5 \'client-transport-security\' /var/lib/rancher/k3s/server/db/etcd/config | grep \'client-cert-auth\');;\n "2.3")\n echo $(grep \'auto-tls\' /var/lib/rancher/k3s/server/db/etcd/config);;\n "2.4")\n echo $(grep -A 5 \'peer-transport-security\' /var/lib/rancher/k3s/server/db/etcd/config | grep -E \'cert-file|key-file\');;\n "2.5")\n echo $(grep -A 5 \'peer-transport-security\' /var/lib/rancher/k3s/server/db/etcd/config | grep \'client-cert-auth\');;\n "2.6")\n echo $(grep \'peer-auto-tls\' /var/lib/rancher/k3s/server/db/etcd/config);;\n "2.7")\n echo $(grep \'trusted-ca-file\' /var/lib/rancher/k3s/server/db/etcd/config);;\n esac\nelse\n# If another database is running, return whatever is required to pass the scan\n case $1 in\n "1.1.11")\n echo "700";;\n "1.2.29")\n echo "--etcd-certfile AND --etcd-keyfile";;\n "2.1")\n echo "cert-file AND key-file";;\n "2.2")\n echo "--client-cert-auth=true";;\n "2.3")\n echo "false";;\n "2.4")\n echo "peer-cert-file AND peer-key-file";;\n "2.5")\n echo "--client-cert-auth=true";;\n "2.6")\n echo "--peer-auto-tls=false";;\n "2.7")\n echo "--trusted-ca-file";;\n esac\nfi\n\n'})}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit Execution:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"./check_for_k3s_etcd.sh 1.1.11\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result"}),":"]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:"'700' is equal to '700'\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Returned Value"}),":"]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:"700\n"})}),"\n",(0,s.jsxs)(r.h3,{id:"1112-ensure-that-the-etcd-data-directory-ownership-is-set-to-etcd-automated",children:["1.1.12 Ensure that the etcd data directory ownership is set to etcd",":etcd"," (Automated)"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," Not Applicable"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nOn the etcd server node, get the etcd data directory, passed as an argument --data-dir,\nfrom the command 'ps -ef | grep etcd'.\nRun the below command (based on the etcd data directory found above).\nFor example, chown etcd",":etcd"," /var/lib/etcd"]}),"\n",(0,s.jsx)(r.h3,{id:"1113-ensure-that-the-adminconf-file-permissions-are-set-to-600-or-more-restrictive-automated",children:"1.1.13 Ensure that the admin.conf file permissions are set to 600 or more restrictive (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," Not Applicable"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nRun the below command (based on the file location on your system) on the control plane node.\nFor example, chmod 600 /var/lib/rancher/k3s/server/cred/admin.kubeconfig"]}),"\n",(0,s.jsxs)(r.h3,{id:"1114-ensure-that-the-adminconf-file-ownership-is-set-to-root-automated",children:["1.1.14 Ensure that the admin.conf file ownership is set to root",":root"," (Automated)"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," pass"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nRun the below command (based on the file location on your system) on the control plane node.\nFor example, chown root",":root"," /etc/kubernetes/admin.conf"]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"/bin/sh -c 'if test -e /var/lib/rancher/k3s/server/cred/admin.kubeconfig; then stat -c %U:%G /var/lib/rancher/k3s/server/cred/admin.kubeconfig; fi'\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result"}),":"]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:"'root:root' is equal to 'root:root'\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Returned Value"}),":"]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:"root:root\n"})}),"\n",(0,s.jsx)(r.h3,{id:"1115-ensure-that-the-schedulerconf-file-permissions-are-set-to-644-or-more-restrictive-automated",children:"1.1.15 Ensure that the scheduler.conf file permissions are set to 644 or more restrictive (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," pass"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nRun the below command (based on the file location on your system) on the control plane node.\nFor example,\nchmod 644 scheduler"]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"/bin/sh -c 'if test -e /var/lib/rancher/k3s/server/cred/scheduler.kubeconfig; then stat -c permissions=%a /var/lib/rancher/k3s/server/cred/scheduler.kubeconfig; fi'\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result"}),":"]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:"permissions has permissions 644, expected 644 or more restrictive\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Returned Value"}),":"]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:"permissions=644\n"})}),"\n",(0,s.jsxs)(r.h3,{id:"1116-ensure-that-the-schedulerconf-file-ownership-is-set-to-root-automated",children:["1.1.16 Ensure that the scheduler.conf file ownership is set to root",":root"," (Automated)"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," pass"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nRun the below command (based on the file location on your system) on the control plane node.\nFor example, ",(0,s.jsx)(r.code,{children:"chown root:root scheduler"})]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"/bin/sh -c 'if test -e /var/lib/rancher/k3s/server/cred/scheduler.kubeconfig; then stat -c %U:%G /var/lib/rancher/k3s/server/cred/scheduler.kubeconfig; fi'\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result"}),":"]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:"'root:root' is present\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Returned Value"}),":"]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:"root:root\n"})}),"\n",(0,s.jsx)(r.h3,{id:"1117-ensure-that-the-controller-managerconf-file-permissions-are-set-to-644-or-more-restrictive-automated",children:"1.1.17 Ensure that the controller-manager.conf file permissions are set to 644 or more restrictive (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," pass"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nRun the below command (based on the file location on your system) on the control plane node.\nFor example,\nchmod 644 controllermanager"]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"/bin/sh -c 'if test -e /var/lib/rancher/k3s/server/cred/controller.kubeconfig; then stat -c permissions=%a /var/lib/rancher/k3s/server/cred/controller.kubeconfig; fi'\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result"}),":"]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:"permissions has permissions 644, expected 644 or more restrictive\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Returned Value"}),":"]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:"permissions=644\n"})}),"\n",(0,s.jsxs)(r.h3,{id:"1118-ensure-that-the-controller-managerconf-file-ownership-is-set-to-root-automated",children:["1.1.18 Ensure that the controller-manager.conf file ownership is set to root",":root"," (Automated)"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," pass"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nRun the below command (based on the file location on your system) on the control plane node.\nFor example,\nchown root",":root"," controllermanager"]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"stat -c %U:%G /var/lib/rancher/k3s/server/tls\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result"}),":"]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:"'root:root' is equal to 'root:root'\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Returned Value"}),":"]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:"root:root\n"})}),"\n",(0,s.jsxs)(r.h3,{id:"1119-ensure-that-the-kubernetes-pki-directory-and-file-ownership-is-set-to-root-automated",children:["1.1.19 Ensure that the Kubernetes PKI directory and file ownership is set to root",":root"," (Automated)"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," pass"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nRun the below command (based on the file location on your system) on the control plane node.\nFor example,\nchown -R root",":root"," /etc/kubernetes/pki/"]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"find /var/lib/rancher/k3s/server/tls | xargs stat -c %U:%G\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result"}),":"]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:"'root:root' is present\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Returned Value"}),":"]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:"root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root\n"})}),"\n",(0,s.jsx)(r.h3,{id:"1120-ensure-that-the-kubernetes-pki-certificate-file-permissions-are-set-to-644-or-more-restrictive-manual",children:"1.1.20 Ensure that the Kubernetes PKI certificate file permissions are set to 644 or more restrictive (Manual)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," warn"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nRun the below command (based on the file location on your system) on the control plane node.\nFor example,\nchmod -R 644 /etc/kubernetes/pki/*.crt"]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"stat -c %n %a /var/lib/rancher/k3s/server/tls/*.crt\n"})}),"\n",(0,s.jsx)(r.h3,{id:"1121-ensure-that-the-kubernetes-pki-key-file-permissions-are-set-to-600-manual",children:"1.1.21 Ensure that the Kubernetes PKI key file permissions are set to 600 (Manual)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," warn"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nRun the below command (based on the file location on your system) on the control plane node.\nFor example,\nchmod -R 600 /etc/kubernetes/pki/*.key"]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"stat -c %n %a /var/lib/rancher/k3s/server/tls/*.key\n"})}),"\n",(0,s.jsx)(r.h2,{id:"12-api-server",children:"1.2 API Server"}),"\n",(0,s.jsx)(r.h3,{id:"121-ensure-that-the---anonymous-auth-argument-is-set-to-false-manual",children:"1.2.1 Ensure that the --anonymous-auth argument is set to false (Manual)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," warn"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nEdit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml\non the control plane node and set the below parameter.\n--anonymous-auth=false"]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'anonymous-auth'\n"})}),"\n",(0,s.jsx)(r.h3,{id:"122-ensure-that-the---token-auth-file-parameter-is-not-set-automated",children:"1.2.2 Ensure that the --token-auth-file parameter is not set (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," pass"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nFollow the documentation and configure alternate mechanisms for authentication. Then,\nedit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml\non the control plane node and remove the ",(0,s.jsx)(r.code,{children:"--token-auth-file="})," parameter."]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"/bin/ps -ef | grep containerd | grep -v grep\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result"}),":"]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:"'--token-auth-file' is not present\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Returned Value"}),":"]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:"root 1616 1600 6 13:26 ? 00:01:28 containerd -c /var/lib/rancher/k3s/agent/etc/containerd/config.toml -a /run/k3s/containerd/containerd.sock --state /run/k3s/containerd --root /var/lib/rancher/k3s/agent/containerd root 2318 1 0 13:27 ? 00:00:00 /var/lib/rancher/k3s/data/577968fa3d58539cc4265245941b7be688833e6bf5ad7869fa2afe02f15f1cd2/bin/containerd-shim-runc-v2 -namespace k8s.io -id b41ec3297be4625c2406ad8b7b4f8b91cddd60850c420050c4c3273f809b3e7e -address /run/k3s/containerd/containerd.sock root 2341 1 0 13:27 ? 00:00:00 /var/lib/rancher/k3s/data/577968fa3d58539cc4265245941b7be688833e6bf5ad7869fa2afe02f15f1cd2/bin/containerd-shim-runc-v2 -namespace k8s.io -id e7999a65ae0a4e9969f32317ec48ae4f7071b62f92e5236696737973be77c2e1 -address /run/k3s/containerd/containerd.sock root 3199 1 0 13:27 ? 00:00:00 /var/lib/rancher/k3s/data/577968fa3d58539cc4265245941b7be688833e6bf5ad7869fa2afe02f15f1cd2/bin/containerd-shim-runc-v2 -namespace k8s.io -id 90c4e63d6ee29d40a48c2fdaf2738c2472cba1139dde8a550466c452184f8528 -address /run/k3s/containerd/containerd.sock root 3923 1 0 13:27 ? 00:00:00 /var/lib/rancher/k3s/data/577968fa3d58539cc4265245941b7be688833e6bf5ad7869fa2afe02f15f1cd2/bin/containerd-shim-runc-v2 -namespace k8s.io -id be5f4b9bd1ed9239362b7000b47f353acb8bc8ca52a9c9145cba0e902ec1c4b9 -address /run/k3s/containerd/containerd.sock root 4559 1 0 13:28 ? 00:00:00 /var/lib/rancher/k3s/data/577968fa3d58539cc4265245941b7be688833e6bf5ad7869fa2afe02f15f1cd2/bin/containerd-shim-runc-v2 -namespace k8s.io -id 04cd40ea6b6078797f177c902c89412c70e523ad2a687a62829bf1d16ff0e19c -address /run/k3s/containerd/containerd.sock root 4647 1 0 13:28 ? 00:00:00 /var/lib/rancher/k3s/data/577968fa3d58539cc4265245941b7be688833e6bf5ad7869fa2afe02f15f1cd2/bin/containerd-shim-runc-v2 -namespace k8s.io -id 48f37a480315b6adce2d2a5c5d67a85412dd0ba7a2e82816434e0deb9fa75de9 -address /run/k3s/containerd/containerd.sock root 6610 1 0 13:47 ? 00:00:00 /var/lib/rancher/k3s/data/577968fa3d58539cc4265245941b7be688833e6bf5ad7869fa2afe02f15f1cd2/bin/containerd-shim-runc-v2 -namespace k8s.io -id 1cf71c22f568468055e517ab363437c0e54e45274c64024d337cc5bcce66341d -address /run/k3s/containerd/containerd.sock\n"})}),"\n",(0,s.jsx)(r.h3,{id:"123-ensure-that-the---denyserviceexternalips-is-not-set-automated",children:"1.2.3 Ensure that the --DenyServiceExternalIPs is not set (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," pass"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nEdit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml\non the control plane node and remove the ",(0,s.jsx)(r.code,{children:"DenyServiceExternalIPs"}),"\nfrom enabled admission plugins."]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"/bin/ps -ef | grep containerd | grep -v grep\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result"}),":"]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:"'--enable-admission-plugins' is present OR '--enable-admission-plugins' is not present\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Returned Value"}),":"]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:"root 1616 1600 6 13:26 ? 00:01:28 containerd -c /var/lib/rancher/k3s/agent/etc/containerd/config.toml -a /run/k3s/containerd/containerd.sock --state /run/k3s/containerd --root /var/lib/rancher/k3s/agent/containerd root 2318 1 0 13:27 ? 00:00:00 /var/lib/rancher/k3s/data/577968fa3d58539cc4265245941b7be688833e6bf5ad7869fa2afe02f15f1cd2/bin/containerd-shim-runc-v2 -namespace k8s.io -id b41ec3297be4625c2406ad8b7b4f8b91cddd60850c420050c4c3273f809b3e7e -address /run/k3s/containerd/containerd.sock root 2341 1 0 13:27 ? 00:00:00 /var/lib/rancher/k3s/data/577968fa3d58539cc4265245941b7be688833e6bf5ad7869fa2afe02f15f1cd2/bin/containerd-shim-runc-v2 -namespace k8s.io -id e7999a65ae0a4e9969f32317ec48ae4f7071b62f92e5236696737973be77c2e1 -address /run/k3s/containerd/containerd.sock root 3199 1 0 13:27 ? 00:00:00 /var/lib/rancher/k3s/data/577968fa3d58539cc4265245941b7be688833e6bf5ad7869fa2afe02f15f1cd2/bin/containerd-shim-runc-v2 -namespace k8s.io -id 90c4e63d6ee29d40a48c2fdaf2738c2472cba1139dde8a550466c452184f8528 -address /run/k3s/containerd/containerd.sock root 3923 1 0 13:27 ? 00:00:00 /var/lib/rancher/k3s/data/577968fa3d58539cc4265245941b7be688833e6bf5ad7869fa2afe02f15f1cd2/bin/containerd-shim-runc-v2 -namespace k8s.io -id be5f4b9bd1ed9239362b7000b47f353acb8bc8ca52a9c9145cba0e902ec1c4b9 -address /run/k3s/containerd/containerd.sock root 4559 1 0 13:28 ? 00:00:00 /var/lib/rancher/k3s/data/577968fa3d58539cc4265245941b7be688833e6bf5ad7869fa2afe02f15f1cd2/bin/containerd-shim-runc-v2 -namespace k8s.io -id 04cd40ea6b6078797f177c902c89412c70e523ad2a687a62829bf1d16ff0e19c -address /run/k3s/containerd/containerd.sock root 4647 1 0 13:28 ? 00:00:00 /var/lib/rancher/k3s/data/577968fa3d58539cc4265245941b7be688833e6bf5ad7869fa2afe02f15f1cd2/bin/containerd-shim-runc-v2 -namespace k8s.io -id 48f37a480315b6adce2d2a5c5d67a85412dd0ba7a2e82816434e0deb9fa75de9 -address /run/k3s/containerd/containerd.sock root 6610 1 0 13:47 ? 00:00:00 /var/lib/rancher/k3s/data/577968fa3d58539cc4265245941b7be688833e6bf5ad7869fa2afe02f15f1cd2/bin/containerd-shim-runc-v2 -namespace k8s.io -id 1cf71c22f568468055e517ab363437c0e54e45274c64024d337cc5bcce66341d -address /run/k3s/containerd/containerd.sock\n"})}),"\n",(0,s.jsx)(r.h3,{id:"124-ensure-that-the---kubelet-https-argument-is-set-to-true-automated",children:"1.2.4 Ensure that the --kubelet-https argument is set to true (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," Not Applicable"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nEdit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml\non the control plane node and remove the --kubelet-https parameter."]}),"\n",(0,s.jsx)(r.h3,{id:"125-ensure-that-the---kubelet-client-certificate-and---kubelet-client-key-arguments-are-set-as-appropriate-automated",children:"1.2.5 Ensure that the --kubelet-client-certificate and --kubelet-client-key arguments are set as appropriate (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," pass"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nFollow the Kubernetes documentation and set up the TLS connection between the\napiserver and kubelets. Then, edit API server pod specification file\n/etc/kubernetes/manifests/kube-apiserver.yaml on the control plane node and set the\nkubelet client certificate and key parameters as below."]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{children:"--kubelet-client-certificate=\n--kubelet-client-key=\n"})}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'kubelet-certificate-authority'\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result"}),":"]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:"'--kubelet-client-certificate' is present AND '--kubelet-client-key' is present\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Returned Value"}),":"]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:'Sep 13 13:26:40 k3s-123-cis-pool3-b403f678-bzdg5 k3s[1600]: time="2022-09-13T13:26:40Z" level=info msg="Running kube-apiserver --advertise-address=172.31.0.140 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})}),"\n",(0,s.jsx)(r.h3,{id:"126-ensure-that-the---kubelet-certificate-authority-argument-is-set-as-appropriate-automated",children:"1.2.6 Ensure that the --kubelet-certificate-authority argument is set as appropriate (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," pass"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nFollow the Kubernetes documentation and setup the TLS connection between\nthe apiserver and kubelets. Then, edit the API server pod specification file\n/etc/kubernetes/manifests/kube-apiserver.yaml on the control plane node and set the\n--kubelet-certificate-authority parameter to the path to the cert file for the certificate authority\n",(0,s.jsx)(r.code,{children:"--kubelet-certificate-authority="}),"."]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'kubelet-certificate-authority'\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result"}),":"]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:"'--kubelet-certificate-authority' is present\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Returned Value"}),":"]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:'Sep 13 13:26:40 k3s-123-cis-pool3-b403f678-bzdg5 k3s[1600]: time="2022-09-13T13:26:40Z" level=info msg="Running kube-apiserver --advertise-address=172.31.0.140 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})}),"\n",(0,s.jsx)(r.h3,{id:"127-ensure-that-the---authorization-mode-argument-is-not-set-to-alwaysallow-automated",children:"1.2.7 Ensure that the --authorization-mode argument is not set to AlwaysAllow (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," pass"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nEdit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml\non the control plane node and set the --authorization-mode parameter to values other than AlwaysAllow.\nOne such example could be as below.\n--authorization-mode=RBAC"]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'authorization-mode'\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result"}),":"]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:"'--authorization-mode' does not have 'AlwaysAllow'\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Returned Value"}),":"]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:'Sep 13 13:26:40 k3s-123-cis-pool3-b403f678-bzdg5 k3s[1600]: time="2022-09-13T13:26:40Z" level=info msg="Running kube-apiserver --advertise-address=172.31.0.140 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})}),"\n",(0,s.jsx)(r.h3,{id:"128-ensure-that-the---authorization-mode-argument-includes-node-automated",children:"1.2.8 Ensure that the --authorization-mode argument includes Node (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," pass"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nEdit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml\non the control plane node and set the --authorization-mode parameter to a value that includes Node.\n--authorization-mode=Node,RBAC"]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'authorization-mode'\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result"}),":"]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:"'--authorization-mode' has 'Node'\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Returned Value"}),":"]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:'Sep 13 13:26:40 k3s-123-cis-pool3-b403f678-bzdg5 k3s[1600]: time="2022-09-13T13:26:40Z" level=info msg="Running kube-apiserver --advertise-address=172.31.0.140 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})}),"\n",(0,s.jsx)(r.h3,{id:"129-ensure-that-the---authorization-mode-argument-includes-rbac-automated",children:"1.2.9 Ensure that the --authorization-mode argument includes RBAC (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," pass"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nEdit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml\non the control plane node and set the --authorization-mode parameter to a value that includes RBAC,\nfor example ",(0,s.jsx)(r.code,{children:"--authorization-mode=Node,RBAC"}),"."]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'authorization-mode'\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result"}),":"]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:"'--authorization-mode' has 'RBAC'\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Returned Value"}),":"]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:'Sep 13 13:26:40 k3s-123-cis-pool3-b403f678-bzdg5 k3s[1600]: time="2022-09-13T13:26:40Z" level=info msg="Running kube-apiserver --advertise-address=172.31.0.140 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})}),"\n",(0,s.jsx)(r.h3,{id:"1210-ensure-that-the-admission-control-plugin-eventratelimit-is-set-manual",children:"1.2.10 Ensure that the admission control plugin EventRateLimit is set (Manual)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," warn"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nFollow the Kubernetes documentation and set the desired limits in a configuration file.\nThen, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml\nand set the below parameters."]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{children:"--enable-admission-plugins=...,EventRateLimit,...\n--admission-control-config-file=\n"})}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'enable-admission-plugins'\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result"}),":"]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:"'--enable-admission-plugins' has 'EventRateLimit'\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Returned Value"}),":"]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:'Sep 13 13:26:40 k3s-123-cis-pool3-b403f678-bzdg5 k3s[1600]: time="2022-09-13T13:26:40Z" level=info msg="Running kube-apiserver --advertise-address=172.31.0.140 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})}),"\n",(0,s.jsx)(r.h3,{id:"1211-ensure-that-the-admission-control-plugin-alwaysadmit-is-not-set-automated",children:"1.2.11 Ensure that the admission control plugin AlwaysAdmit is not set (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," pass"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nEdit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml\non the control plane node and either remove the --enable-admission-plugins parameter, or set it to a\nvalue that does not include AlwaysAdmit."]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'enable-admission-plugins'\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result"}),":"]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:"'--enable-admission-plugins' does not have 'AlwaysAdmit' OR '--enable-admission-plugins' is not present\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Returned Value"}),":"]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:'Sep 13 13:26:40 k3s-123-cis-pool3-b403f678-bzdg5 k3s[1600]: time="2022-09-13T13:26:40Z" level=info msg="Running kube-apiserver --advertise-address=172.31.0.140 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})}),"\n",(0,s.jsx)(r.h3,{id:"1212-ensure-that-the-admission-control-plugin-alwayspullimages-is-set-manual",children:"1.2.12 Ensure that the admission control plugin AlwaysPullImages is set (Manual)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," warn"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nEdit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml\non the control plane node and set the --enable-admission-plugins parameter to include\nAlwaysPullImages.\n--enable-admission-plugins=...,AlwaysPullImages,..."]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"/bin/ps -ef | grep containerd | grep -v grep\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result"}),":"]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:"'--enable-admission-plugins' is present\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Returned Value"}),":"]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:"root 1616 1600 6 13:26 ? 00:01:28 containerd -c /var/lib/rancher/k3s/agent/etc/containerd/config.toml -a /run/k3s/containerd/containerd.sock --state /run/k3s/containerd --root /var/lib/rancher/k3s/agent/containerd root 2318 1 0 13:27 ? 00:00:00 /var/lib/rancher/k3s/data/577968fa3d58539cc4265245941b7be688833e6bf5ad7869fa2afe02f15f1cd2/bin/containerd-shim-runc-v2 -namespace k8s.io -id b41ec3297be4625c2406ad8b7b4f8b91cddd60850c420050c4c3273f809b3e7e -address /run/k3s/containerd/containerd.sock root 2341 1 0 13:27 ? 00:00:00 /var/lib/rancher/k3s/data/577968fa3d58539cc4265245941b7be688833e6bf5ad7869fa2afe02f15f1cd2/bin/containerd-shim-runc-v2 -namespace k8s.io -id e7999a65ae0a4e9969f32317ec48ae4f7071b62f92e5236696737973be77c2e1 -address /run/k3s/containerd/containerd.sock root 3199 1 0 13:27 ? 00:00:00 /var/lib/rancher/k3s/data/577968fa3d58539cc4265245941b7be688833e6bf5ad7869fa2afe02f15f1cd2/bin/containerd-shim-runc-v2 -namespace k8s.io -id 90c4e63d6ee29d40a48c2fdaf2738c2472cba1139dde8a550466c452184f8528 -address /run/k3s/containerd/containerd.sock root 3923 1 0 13:27 ? 00:00:00 /var/lib/rancher/k3s/data/577968fa3d58539cc4265245941b7be688833e6bf5ad7869fa2afe02f15f1cd2/bin/containerd-shim-runc-v2 -namespace k8s.io -id be5f4b9bd1ed9239362b7000b47f353acb8bc8ca52a9c9145cba0e902ec1c4b9 -address /run/k3s/containerd/containerd.sock root 4559 1 0 13:28 ? 00:00:00 /var/lib/rancher/k3s/data/577968fa3d58539cc4265245941b7be688833e6bf5ad7869fa2afe02f15f1cd2/bin/containerd-shim-runc-v2 -namespace k8s.io -id 04cd40ea6b6078797f177c902c89412c70e523ad2a687a62829bf1d16ff0e19c -address /run/k3s/containerd/containerd.sock root 4647 1 0 13:28 ? 00:00:00 /var/lib/rancher/k3s/data/577968fa3d58539cc4265245941b7be688833e6bf5ad7869fa2afe02f15f1cd2/bin/containerd-shim-runc-v2 -namespace k8s.io -id 48f37a480315b6adce2d2a5c5d67a85412dd0ba7a2e82816434e0deb9fa75de9 -address /run/k3s/containerd/containerd.sock root 6610 1 0 13:47 ? 00:00:00 /var/lib/rancher/k3s/data/577968fa3d58539cc4265245941b7be688833e6bf5ad7869fa2afe02f15f1cd2/bin/containerd-shim-runc-v2 -namespace k8s.io -id 1cf71c22f568468055e517ab363437c0e54e45274c64024d337cc5bcce66341d -address /run/k3s/containerd/containerd.sock\n"})}),"\n",(0,s.jsx)(r.h3,{id:"1213-ensure-that-the-admission-control-plugin-securitycontextdeny-is-set-if-podsecuritypolicy-is-not-used-manual",children:"1.2.13 Ensure that the admission control plugin SecurityContextDeny is set if PodSecurityPolicy is not used (Manual)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," warn"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nEdit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml\non the control plane node and set the --enable-admission-plugins parameter to include\nSecurityContextDeny, unless PodSecurityPolicy is already in place.\n--enable-admission-plugins=...,SecurityContextDeny,..."]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'enable-admission-plugins'\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result"}),":"]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:"'--enable-admission-plugins' has 'SecurityContextDeny' OR '--enable-admission-plugins' has 'PodSecurityPolicy'\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Returned Value"}),":"]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:'Sep 13 13:26:40 k3s-123-cis-pool3-b403f678-bzdg5 k3s[1600]: time="2022-09-13T13:26:40Z" level=info msg="Running kube-apiserver --advertise-address=172.31.0.140 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})}),"\n",(0,s.jsx)(r.h3,{id:"1214-ensure-that-the-admission-control-plugin-serviceaccount-is-set-automated",children:"1.2.14 Ensure that the admission control plugin ServiceAccount is set (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," pass"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nFollow the documentation and create ServiceAccount objects as per your environment.\nThen, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml\non the control plane node and ensure that the --disable-admission-plugins parameter is set to a\nvalue that does not include ServiceAccount."]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep -v grep\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result"}),":"]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:"'--disable-admission-plugins' is present OR '--disable-admission-plugins' is not present\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Returned Value"}),":"]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:'Sep 13 13:26:40 k3s-123-cis-pool3-b403f678-bzdg5 k3s[1600]: time="2022-09-13T13:26:40Z" level=info msg="Running kube-apiserver --advertise-address=172.31.0.140 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})}),"\n",(0,s.jsx)(r.h3,{id:"1215-ensure-that-the-admission-control-plugin-namespacelifecycle-is-set-automated",children:"1.2.15 Ensure that the admission control plugin NamespaceLifecycle is set (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," pass"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nEdit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml\non the control plane node and set the --disable-admission-plugins parameter to\nensure it does not include NamespaceLifecycle."]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep -v grep\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result"}),":"]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:"'--disable-admission-plugins' is present OR '--disable-admission-plugins' is not present\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Returned Value"}),":"]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:'Sep 13 13:26:40 k3s-123-cis-pool3-b403f678-bzdg5 k3s[1600]: time="2022-09-13T13:26:40Z" level=info msg="Running kube-apiserver --advertise-address=172.31.0.140 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})}),"\n",(0,s.jsx)(r.h3,{id:"1216-ensure-that-the-admission-control-plugin-noderestriction-is-set-automated",children:"1.2.16 Ensure that the admission control plugin NodeRestriction is set (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," pass"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nFollow the Kubernetes documentation and configure NodeRestriction plug-in on kubelets.\nThen, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml\non the control plane node and set the --enable-admission-plugins parameter to a\nvalue that includes NodeRestriction.\n--enable-admission-plugins=...,NodeRestriction,..."]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'enable-admission-plugins'\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result"}),":"]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:"'--enable-admission-plugins' has 'NodeRestriction'\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Returned Value"}),":"]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:'Sep 13 13:26:40 k3s-123-cis-pool3-b403f678-bzdg5 k3s[1600]: time="2022-09-13T13:26:40Z" level=info msg="Running kube-apiserver --advertise-address=172.31.0.140 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})}),"\n",(0,s.jsx)(r.h3,{id:"1217-ensure-that-the---secure-port-argument-is-not-set-to-0-automated",children:"1.2.17 Ensure that the --secure-port argument is not set to 0 (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," pass"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nEdit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml\non the control plane node and either remove the --secure-port parameter or\nset it to a different (non-zero) desired port."]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'secure-port'\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result"}),":"]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:"'--secure-port' is greater than 0 OR '--secure-port' is not present\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Returned Value"}),":"]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:'Sep 13 13:26:40 k3s-123-cis-pool3-b403f678-bzdg5 k3s[1600]: time="2022-09-13T13:26:40Z" level=info msg="Running kube-apiserver --advertise-address=172.31.0.140 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})}),"\n",(0,s.jsx)(r.h3,{id:"1218-ensure-that-the---profiling-argument-is-set-to-false-automated",children:"1.2.18 Ensure that the --profiling argument is set to false (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," pass"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nEdit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml\non the control plane node and set the below parameter.\n--profiling=false"]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'profiling'\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result"}),":"]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:"'--profiling' is equal to 'false'\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Returned Value"}),":"]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:'Sep 13 13:26:40 k3s-123-cis-pool3-b403f678-bzdg5 k3s[1600]: time="2022-09-13T13:26:40Z" level=info msg="Running kube-apiserver --advertise-address=172.31.0.140 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})}),"\n",(0,s.jsx)(r.h3,{id:"1219-ensure-that-the---audit-log-path-argument-is-set-automated",children:"1.2.19 Ensure that the --audit-log-path argument is set (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," Not Applicable"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nEdit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml\non the control plane node and set the --audit-log-path parameter to a suitable path and\nfile where you would like audit logs to be written, for example,\n--audit-log-path=/var/log/apiserver/audit.log"]}),"\n",(0,s.jsx)(r.h3,{id:"1220-ensure-that-the---audit-log-maxage-argument-is-set-to-30-or-as-appropriate-automated",children:"1.2.20 Ensure that the --audit-log-maxage argument is set to 30 or as appropriate (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," Not Applicable"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nEdit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml\non the control plane node and set the --audit-log-maxage parameter to 30\nor as an appropriate number of days, for example,\n--audit-log-maxage=30"]}),"\n",(0,s.jsx)(r.h3,{id:"1221-ensure-that-the---audit-log-maxbackup-argument-is-set-to-10-or-as-appropriate-automated",children:"1.2.21 Ensure that the --audit-log-maxbackup argument is set to 10 or as appropriate (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," Not Applicable"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nEdit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml\non the control plane node and set the --audit-log-maxbackup parameter to 10 or to an appropriate\nvalue. For example,\n--audit-log-maxbackup=10"]}),"\n",(0,s.jsx)(r.h3,{id:"1222-ensure-that-the---audit-log-maxsize-argument-is-set-to-100-or-as-appropriate-automated",children:"1.2.22 Ensure that the --audit-log-maxsize argument is set to 100 or as appropriate (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," Not Applicable"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nEdit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml\non the control plane node and set the --audit-log-maxsize parameter to an appropriate size in MB.\nFor example, to set it as 100 MB, --audit-log-maxsize=100"]}),"\n",(0,s.jsx)(r.h3,{id:"1224-ensure-that-the---service-account-lookup-argument-is-set-to-true-automated",children:"1.2.24 Ensure that the --service-account-lookup argument is set to true (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," pass"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nEdit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml\non the control plane node and set the below parameter.\n--service-account-lookup=true\nAlternatively, you can delete the --service-account-lookup parameter from this file so\nthat the default takes effect."]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep -v grep\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result"}),":"]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:"'--service-account-lookup' is not present OR '--service-account-lookup' is present\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Returned Value"}),":"]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:'Sep 13 13:26:40 k3s-123-cis-pool3-b403f678-bzdg5 k3s[1600]: time="2022-09-13T13:26:40Z" level=info msg="Running kube-apiserver --advertise-address=172.31.0.140 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})}),"\n",(0,s.jsx)(r.h3,{id:"1225-ensure-that-the---request-timeout-argument-is-set-as-appropriate-automated",children:"1.2.25 Ensure that the --request-timeout argument is set as appropriate (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," Not Applicable"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nEdit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml\non the control plane node and set the --service-account-key-file parameter\nto the public key file for service accounts. For example,\n",(0,s.jsx)(r.code,{children:"--service-account-key-file="}),"."]}),"\n",(0,s.jsx)(r.h3,{id:"1226-ensure-that-the---etcd-certfile-and---etcd-keyfile-arguments-are-set-as-appropriate-automated",children:"1.2.26 Ensure that the --etcd-certfile and --etcd-keyfile arguments are set as appropriate (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," pass"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nFollow the Kubernetes documentation and set up the TLS connection between the apiserver and etcd.\nThen, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml\non the control plane node and set the etcd certificate and key file parameters."]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{children:"--etcd-certfile=\n--etcd-keyfile=\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Audit Script:"})," ",(0,s.jsx)(r.code,{children:"check_for_k3s_etcd.sh"})]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:'#!/bin/bash\n\n# This script is used to ensure that k3s is actually running etcd (and not other databases like sqlite3)\n# before it checks the requirement\nset -eE\n\nhandle_error() {\n echo "false"\n}\n\ntrap \'handle_error\' ERR\n\n\nif [[ "$(journalctl -D /var/log/journal -u k3s | grep \'Managed etcd cluster initializing\' | grep -v grep | wc -l)" -gt 0 ]]; then\n case $1 in \n "1.1.11")\n echo $(stat -c %a /var/lib/rancher/k3s/server/db/etcd);;\n "1.2.29")\n echo $(journalctl -D /var/log/journal -u k3s | grep \'Running kube-apiserver\' | tail -n1 | grep \'etcd-\');;\n "2.1")\n echo $(grep -A 5 \'client-transport-security\' /var/lib/rancher/k3s/server/db/etcd/config | grep -E \'cert-file|key-file\');;\n "2.2")\n echo $(grep -A 5 \'client-transport-security\' /var/lib/rancher/k3s/server/db/etcd/config | grep \'client-cert-auth\');;\n "2.3")\n echo $(grep \'auto-tls\' /var/lib/rancher/k3s/server/db/etcd/config);;\n "2.4")\n echo $(grep -A 5 \'peer-transport-security\' /var/lib/rancher/k3s/server/db/etcd/config | grep -E \'cert-file|key-file\');;\n "2.5")\n echo $(grep -A 5 \'peer-transport-security\' /var/lib/rancher/k3s/server/db/etcd/config | grep \'client-cert-auth\');;\n "2.6")\n echo $(grep \'peer-auto-tls\' /var/lib/rancher/k3s/server/db/etcd/config);;\n "2.7")\n echo $(grep \'trusted-ca-file\' /var/lib/rancher/k3s/server/db/etcd/config);;\n esac\nelse\n# If another database is running, return whatever is required to pass the scan\n case $1 in\n "1.1.11")\n echo "700";;\n "1.2.29")\n echo "--etcd-certfile AND --etcd-keyfile";;\n "2.1")\n echo "cert-file AND key-file";;\n "2.2")\n echo "--client-cert-auth=true";;\n "2.3")\n echo "false";;\n "2.4")\n echo "peer-cert-file AND peer-key-file";;\n "2.5")\n echo "--client-cert-auth=true";;\n "2.6")\n echo "--peer-auto-tls=false";;\n "2.7")\n echo "--trusted-ca-file";;\n esac\nfi\n\n'})}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit Execution:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"./check_for_k3s_etcd.sh 1.2.29\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result"}),":"]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:"'--etcd-certfile' is present AND '--etcd-keyfile' is present\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Returned Value"}),":"]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:"--etcd-certfile AND --etcd-keyfile\n"})}),"\n",(0,s.jsx)(r.h3,{id:"1227-ensure-that-the---tls-cert-file-and---tls-private-key-file-arguments-are-set-as-appropriate-automated",children:"1.2.27 Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," pass"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nFollow the Kubernetes documentation and set up the TLS connection on the apiserver.\nThen, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml\non the control plane node and set the TLS certificate and private key file parameters."]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{children:"--tls-cert-file=\n--tls-private-key-file=\n"})}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"journalctl -D /var/log/journal -u k3s | grep -A1 'Running kube-apiserver' | tail -n2\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result"}),":"]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:"'--tls-cert-file' is present AND '--tls-private-key-file' is present\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Returned Value"}),":"]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:'Sep 13 13:26:40 k3s-123-cis-pool3-b403f678-bzdg5 k3s[1600]: time="2022-09-13T13:26:40Z" level=info msg="Running kube-apiserver --advertise-address=172.31.0.140 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" Sep 13 13:26:40 k3s-123-cis-pool3-b403f678-bzdg5 k3s[1600]: time="2022-09-13T13:26:40Z" level=info msg="Running kube-scheduler --authentication-kubeconfig=/var/lib/rancher/k3s/server/cred/scheduler.kubeconfig --authorization-kubeconfig=/var/lib/rancher/k3s/server/cred/scheduler.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/kube-scheduler --kubeconfig=/var/lib/rancher/k3s/server/cred/scheduler.kubeconfig --profiling=false --secure-port=10259"\n'})}),"\n",(0,s.jsx)(r.h3,{id:"1228-ensure-that-the---client-ca-file-argument-is-set-as-appropriate-automated",children:"1.2.28 Ensure that the --client-ca-file argument is set as appropriate (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," pass"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nFollow the Kubernetes documentation and set up the TLS connection on the apiserver.\nThen, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml\non the control plane node and set the client certificate authority file.\n",(0,s.jsx)(r.code,{children:"--client-ca-file="})]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'client-ca-file'\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result"}),":"]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:"'--client-ca-file' is present\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Returned Value"}),":"]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:'Sep 13 13:26:40 k3s-123-cis-pool3-b403f678-bzdg5 k3s[1600]: time="2022-09-13T13:26:40Z" level=info msg="Running kube-apiserver --advertise-address=172.31.0.140 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})}),"\n",(0,s.jsx)(r.h3,{id:"1229-ensure-that-the---etcd-cafile-argument-is-set-as-appropriate-automated",children:"1.2.29 Ensure that the --etcd-cafile argument is set as appropriate (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," pass"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nFollow the Kubernetes documentation and set up the TLS connection between the apiserver and etcd.\nThen, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml\non the control plane node and set the etcd certificate authority file parameter.\n",(0,s.jsx)(r.code,{children:"--etcd-cafile="})]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'etcd-cafile'\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result"}),":"]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:"'--etcd-cafile' is present\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Returned Value"}),":"]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:'Sep 13 13:26:40 k3s-123-cis-pool3-b403f678-bzdg5 k3s[1600]: time="2022-09-13T13:26:40Z" level=info msg="Running kube-apiserver --advertise-address=172.31.0.140 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})}),"\n",(0,s.jsx)(r.h3,{id:"1230-ensure-that-the---encryption-provider-config-argument-is-set-as-appropriate-manual",children:"1.2.30 Ensure that the --encryption-provider-config argument is set as appropriate (Manual)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," warn"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nFollow the Kubernetes documentation and configure a EncryptionConfig file.\nThen, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml\non the control plane node and set the --encryption-provider-config parameter to the path of that file.\nFor example, ",(0,s.jsx)(r.code,{children:"--encryption-provider-config="})]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'encryption-provider-config'\n"})}),"\n",(0,s.jsx)(r.h3,{id:"1231-ensure-that-encryption-providers-are-appropriately-configured-manual",children:"1.2.31 Ensure that encryption providers are appropriately configured (Manual)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," warn"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nFollow the Kubernetes documentation and configure a EncryptionConfig file.\nIn this file, choose aescbc, kms or secretbox as the encryption provider."]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"grep aescbc /path/to/encryption-config.json\n"})}),"\n",(0,s.jsx)(r.h3,{id:"1232-ensure-that-the-api-server-only-makes-use-of-strong-cryptographic-ciphers-manual",children:"1.2.32 Ensure that the API Server only makes use of Strong Cryptographic Ciphers (Manual)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," warn"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nEdit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml\non the control plane node and set the below parameter.\n--tls-cipher-suites=TLS_AES_128_GCM_SHA256,TLS_AES_256_GCM_SHA384,TLS_CHACHA20_POLY1305_SHA256,\nTLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,\nTLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,\nTLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256,\nTLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,\nTLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,\nTLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256,TLS_RSA_WITH_3DES_EDE_CBC_SHA,TLS_RSA_WITH_AES_128_CBC_SHA,\nTLS_RSA_WITH_AES_128_GCM_SHA256,TLS_RSA_WITH_AES_256_CBC_SHA,TLS_RSA_WITH_AES_256_GCM_SHA384"]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'tls-cipher-suites'\n"})}),"\n",(0,s.jsx)(r.h2,{id:"13-controller-manager",children:"1.3 Controller Manager"}),"\n",(0,s.jsx)(r.h3,{id:"131-ensure-that-the---terminated-pod-gc-threshold-argument-is-set-as-appropriate-manual",children:"1.3.1 Ensure that the --terminated-pod-gc-threshold argument is set as appropriate (Manual)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," warn"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nEdit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml\non the control plane node and set the --terminated-pod-gc-threshold to an appropriate threshold,\nfor example, --terminated-pod-gc-threshold=10"]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"journalctl -D /var/log/journal -u k3s | grep 'Running kube-controller-manager' | tail -n1 | grep 'terminated-pod-gc-threshold'\n"})}),"\n",(0,s.jsx)(r.h3,{id:"132-ensure-that-the---profiling-argument-is-set-to-false-automated",children:"1.3.2 Ensure that the --profiling argument is set to false (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," pass"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nEdit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml\non the control plane node and set the below parameter.\n--profiling=false"]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"journalctl -D /var/log/journal -u k3s | grep 'Running kube-controller-manager' | tail -n1 | grep 'profiling'\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result"}),":"]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:"'--profiling' is equal to 'false'\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Returned Value"}),":"]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:'Sep 13 13:26:40 k3s-123-cis-pool3-b403f678-bzdg5 k3s[1600]: time="2022-09-13T13:26:40Z" level=info msg="Running kube-controller-manager --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/k3s/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/k3s/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/k3s/server/tls/server-ca.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/k3s/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/k3s/server/tls/server-ca.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/k3s/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/k3s/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true"\n'})}),"\n",(0,s.jsx)(r.h3,{id:"133-ensure-that-the---use-service-account-credentials-argument-is-set-to-true-automated",children:"1.3.3 Ensure that the --use-service-account-credentials argument is set to true (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," pass"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nEdit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml\non the control plane node to set the below parameter.\n--use-service-account-credentials=true"]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"journalctl -D /var/log/journal -u k3s | grep 'Running kube-controller-manager' | tail -n1 | grep 'use-service-account-credentials'\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result"}),":"]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:"'--use-service-account-credentials' is not equal to 'false'\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Returned Value"}),":"]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:'Sep 13 13:26:40 k3s-123-cis-pool3-b403f678-bzdg5 k3s[1600]: time="2022-09-13T13:26:40Z" level=info msg="Running kube-controller-manager --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/k3s/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/k3s/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/k3s/server/tls/server-ca.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/k3s/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/k3s/server/tls/server-ca.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/k3s/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/k3s/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true"\n'})}),"\n",(0,s.jsx)(r.h3,{id:"134-ensure-that-the---service-account-private-key-file-argument-is-set-as-appropriate-automated",children:"1.3.4 Ensure that the --service-account-private-key-file argument is set as appropriate (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," pass"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nEdit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml\non the control plane node and set the --service-account-private-key-file parameter\nto the private key file for service accounts. For example,\n",(0,s.jsx)(r.code,{children:"--service-account-private-key-file="}),"."]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"journalctl -D /var/log/journal -u k3s | grep 'Running kube-controller-manager' | tail -n1 | grep 'service-account-private-key-file'\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result"}),":"]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:"'--service-account-private-key-file' is present\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Returned Value"}),":"]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:'Sep 13 13:26:40 k3s-123-cis-pool3-b403f678-bzdg5 k3s[1600]: time="2022-09-13T13:26:40Z" level=info msg="Running kube-controller-manager --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/k3s/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/k3s/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/k3s/server/tls/server-ca.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/k3s/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/k3s/server/tls/server-ca.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/k3s/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/k3s/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true"\n'})}),"\n",(0,s.jsx)(r.h3,{id:"135-ensure-that-the---root-ca-file-argument-is-set-as-appropriate-automated",children:"1.3.5 Ensure that the --root-ca-file argument is set as appropriate (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," pass"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nEdit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml\non the control plane node and set the --root-ca-file parameter to the certificate bundle file.\n",(0,s.jsx)(r.code,{children:"--root-ca-file="})]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"journalctl -D /var/log/journal -u k3s | grep 'Running kube-controller-manager' | tail -n1 | grep 'root-ca-file'\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result"}),":"]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:"'--root-ca-file' is present\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Returned Value"}),":"]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:'Sep 13 13:26:40 k3s-123-cis-pool3-b403f678-bzdg5 k3s[1600]: time="2022-09-13T13:26:40Z" level=info msg="Running kube-controller-manager --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/k3s/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/k3s/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/k3s/server/tls/server-ca.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/k3s/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/k3s/server/tls/server-ca.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/k3s/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/k3s/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true"\n'})}),"\n",(0,s.jsx)(r.h3,{id:"136-ensure-that-the-rotatekubeletservercertificate-argument-is-set-to-true-automated",children:"1.3.6 Ensure that the RotateKubeletServerCertificate argument is set to true (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," Not Applicable"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nEdit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml\non the control plane node and set the --feature-gates parameter to include RotateKubeletServerCertificate=true.\n--feature-gates=RotateKubeletServerCertificate=true"]}),"\n",(0,s.jsx)(r.h3,{id:"137-ensure-that-the---bind-address-argument-is-set-to-127001-automated",children:"1.3.7 Ensure that the --bind-address argument is set to 127.0.0.1 (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," pass"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nEdit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml\non the control plane node and ensure the correct value for the --bind-address parameter"]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"/bin/ps -ef | grep containerd | grep -v grep\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result"}),":"]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:"'--bind-address' is present OR '--bind-address' is not present\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Returned Value"}),":"]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:"root 1616 1600 6 13:26 ? 00:01:28 containerd -c /var/lib/rancher/k3s/agent/etc/containerd/config.toml -a /run/k3s/containerd/containerd.sock --state /run/k3s/containerd --root /var/lib/rancher/k3s/agent/containerd root 2318 1 0 13:27 ? 00:00:00 /var/lib/rancher/k3s/data/577968fa3d58539cc4265245941b7be688833e6bf5ad7869fa2afe02f15f1cd2/bin/containerd-shim-runc-v2 -namespace k8s.io -id b41ec3297be4625c2406ad8b7b4f8b91cddd60850c420050c4c3273f809b3e7e -address /run/k3s/containerd/containerd.sock root 2341 1 0 13:27 ? 00:00:00 /var/lib/rancher/k3s/data/577968fa3d58539cc4265245941b7be688833e6bf5ad7869fa2afe02f15f1cd2/bin/containerd-shim-runc-v2 -namespace k8s.io -id e7999a65ae0a4e9969f32317ec48ae4f7071b62f92e5236696737973be77c2e1 -address /run/k3s/containerd/containerd.sock root 3199 1 0 13:27 ? 00:00:00 /var/lib/rancher/k3s/data/577968fa3d58539cc4265245941b7be688833e6bf5ad7869fa2afe02f15f1cd2/bin/containerd-shim-runc-v2 -namespace k8s.io -id 90c4e63d6ee29d40a48c2fdaf2738c2472cba1139dde8a550466c452184f8528 -address /run/k3s/containerd/containerd.sock root 3923 1 0 13:27 ? 00:00:00 /var/lib/rancher/k3s/data/577968fa3d58539cc4265245941b7be688833e6bf5ad7869fa2afe02f15f1cd2/bin/containerd-shim-runc-v2 -namespace k8s.io -id be5f4b9bd1ed9239362b7000b47f353acb8bc8ca52a9c9145cba0e902ec1c4b9 -address /run/k3s/containerd/containerd.sock root 4559 1 0 13:28 ? 00:00:00 /var/lib/rancher/k3s/data/577968fa3d58539cc4265245941b7be688833e6bf5ad7869fa2afe02f15f1cd2/bin/containerd-shim-runc-v2 -namespace k8s.io -id 04cd40ea6b6078797f177c902c89412c70e523ad2a687a62829bf1d16ff0e19c -address /run/k3s/containerd/containerd.sock root 4647 1 0 13:28 ? 00:00:00 /var/lib/rancher/k3s/data/577968fa3d58539cc4265245941b7be688833e6bf5ad7869fa2afe02f15f1cd2/bin/containerd-shim-runc-v2 -namespace k8s.io -id 48f37a480315b6adce2d2a5c5d67a85412dd0ba7a2e82816434e0deb9fa75de9 -address /run/k3s/containerd/containerd.sock root 6610 1 0 13:47 ? 00:00:00 /var/lib/rancher/k3s/data/577968fa3d58539cc4265245941b7be688833e6bf5ad7869fa2afe02f15f1cd2/bin/containerd-shim-runc-v2 -namespace k8s.io -id 1cf71c22f568468055e517ab363437c0e54e45274c64024d337cc5bcce66341d -address /run/k3s/containerd/containerd.sock\n"})}),"\n",(0,s.jsx)(r.h2,{id:"14-scheduler",children:"1.4 Scheduler"}),"\n",(0,s.jsx)(r.h3,{id:"141-ensure-that-the---profiling-argument-is-set-to-false-automated",children:"1.4.1 Ensure that the --profiling argument is set to false (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," pass"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nEdit the Scheduler pod specification file /etc/kubernetes/manifests/kube-scheduler.yaml file\non the control plane node and set the below parameter.\n--profiling=false"]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"journalctl -D /var/log/journal -u k3s | grep 'Running kube-scheduler' | tail -n1\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result"}),":"]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:"'--profiling' is equal to 'false'\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Returned Value"}),":"]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:'Sep 13 13:26:40 k3s-123-cis-pool3-b403f678-bzdg5 k3s[1600]: time="2022-09-13T13:26:40Z" level=info msg="Running kube-scheduler --authentication-kubeconfig=/var/lib/rancher/k3s/server/cred/scheduler.kubeconfig --authorization-kubeconfig=/var/lib/rancher/k3s/server/cred/scheduler.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/kube-scheduler --kubeconfig=/var/lib/rancher/k3s/server/cred/scheduler.kubeconfig --profiling=false --secure-port=10259"\n'})}),"\n",(0,s.jsx)(r.h3,{id:"142-ensure-that-the---bind-address-argument-is-set-to-127001-automated",children:"1.4.2 Ensure that the --bind-address argument is set to 127.0.0.1 (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," pass"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nEdit the Scheduler pod specification file /etc/kubernetes/manifests/kube-scheduler.yaml\non the control plane node and ensure the correct value for the --bind-address parameter"]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"journalctl -D /var/log/journal -u k3s | grep 'Running kube-scheduler' | tail -n1 | grep 'bind-address'\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result"}),":"]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:"'--bind-address' is equal to '127.0.0.1' OR '--bind-address' is not present\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Returned Value"}),":"]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:'Sep 13 13:26:40 k3s-123-cis-pool3-b403f678-bzdg5 k3s[1600]: time="2022-09-13T13:26:40Z" level=info msg="Running kube-scheduler --authentication-kubeconfig=/var/lib/rancher/k3s/server/cred/scheduler.kubeconfig --authorization-kubeconfig=/var/lib/rancher/k3s/server/cred/scheduler.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/kube-scheduler --kubeconfig=/var/lib/rancher/k3s/server/cred/scheduler.kubeconfig --profiling=false --secure-port=10259"\n'})}),"\n",(0,s.jsx)(r.h2,{id:"2-etcd-node-configuration",children:"2 Etcd Node Configuration"}),"\n",(0,s.jsx)(r.h3,{id:"21-ensure-that-the---cert-file-and---key-file-arguments-are-set-as-appropriate-automated",children:"2.1 Ensure that the --cert-file and --key-file arguments are set as appropriate (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," pass"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nFollow the etcd service documentation and configure TLS encryption.\nThen, edit the etcd pod specification file /etc/kubernetes/manifests/etcd.yaml\non the master node and set the below parameters."]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{children:"--cert-file=\n--key-file=\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Audit Script:"})," ",(0,s.jsx)(r.code,{children:"check_for_k3s_etcd.sh"})]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:'#!/bin/bash\n\n# This script is used to ensure that k3s is actually running etcd (and not other databases like sqlite3)\n# before it checks the requirement\nset -eE\n\nhandle_error() {\n echo "false"\n}\n\ntrap \'handle_error\' ERR\n\n\nif [[ "$(journalctl -D /var/log/journal -u k3s | grep \'Managed etcd cluster initializing\' | grep -v grep | wc -l)" -gt 0 ]]; then\n case $1 in \n "1.1.11")\n echo $(stat -c %a /var/lib/rancher/k3s/server/db/etcd);;\n "1.2.29")\n echo $(journalctl -D /var/log/journal -u k3s | grep \'Running kube-apiserver\' | tail -n1 | grep \'etcd-\');;\n "2.1")\n echo $(grep -A 5 \'client-transport-security\' /var/lib/rancher/k3s/server/db/etcd/config | grep -E \'cert-file|key-file\');;\n "2.2")\n echo $(grep -A 5 \'client-transport-security\' /var/lib/rancher/k3s/server/db/etcd/config | grep \'client-cert-auth\');;\n "2.3")\n echo $(grep \'auto-tls\' /var/lib/rancher/k3s/server/db/etcd/config);;\n "2.4")\n echo $(grep -A 5 \'peer-transport-security\' /var/lib/rancher/k3s/server/db/etcd/config | grep -E \'cert-file|key-file\');;\n "2.5")\n echo $(grep -A 5 \'peer-transport-security\' /var/lib/rancher/k3s/server/db/etcd/config | grep \'client-cert-auth\');;\n "2.6")\n echo $(grep \'peer-auto-tls\' /var/lib/rancher/k3s/server/db/etcd/config);;\n "2.7")\n echo $(grep \'trusted-ca-file\' /var/lib/rancher/k3s/server/db/etcd/config);;\n esac\nelse\n# If another database is running, return whatever is required to pass the scan\n case $1 in\n "1.1.11")\n echo "700";;\n "1.2.29")\n echo "--etcd-certfile AND --etcd-keyfile";;\n "2.1")\n echo "cert-file AND key-file";;\n "2.2")\n echo "--client-cert-auth=true";;\n "2.3")\n echo "false";;\n "2.4")\n echo "peer-cert-file AND peer-key-file";;\n "2.5")\n echo "--client-cert-auth=true";;\n "2.6")\n echo "--peer-auto-tls=false";;\n "2.7")\n echo "--trusted-ca-file";;\n esac\nfi\n\n'})}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit Execution:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"./check_for_k3s_etcd.sh 2.1\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result"}),":"]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:"'cert-file' is present AND 'key-file' is present\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Returned Value"}),":"]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:"cert-file AND key-file cert-file: /var/lib/rancher/k3s/server/tls/etcd/server-client.crt key-file: /var/lib/rancher/k3s/server/tls/etcd/server-client.key cert-file AND key-file\n"})}),"\n",(0,s.jsx)(r.h3,{id:"22-ensure-that-the---client-cert-auth-argument-is-set-to-true-automated",children:"2.2 Ensure that the --client-cert-auth argument is set to true (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," pass"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),'\nEdit the etcd pod specification file /etc/kubernetes/manifests/etcd.yaml on the master\nnode and set the below parameter.\n--client-cert-auth="true"']}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Audit Script:"})," ",(0,s.jsx)(r.code,{children:"check_for_k3s_etcd.sh"})]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:'#!/bin/bash\n\n# This script is used to ensure that k3s is actually running etcd (and not other databases like sqlite3)\n# before it checks the requirement\nset -eE\n\nhandle_error() {\n echo "false"\n}\n\ntrap \'handle_error\' ERR\n\n\nif [[ "$(journalctl -D /var/log/journal -u k3s | grep \'Managed etcd cluster initializing\' | grep -v grep | wc -l)" -gt 0 ]]; then\n case $1 in \n "1.1.11")\n echo $(stat -c %a /var/lib/rancher/k3s/server/db/etcd);;\n "1.2.29")\n echo $(journalctl -D /var/log/journal -u k3s | grep \'Running kube-apiserver\' | tail -n1 | grep \'etcd-\');;\n "2.1")\n echo $(grep -A 5 \'client-transport-security\' /var/lib/rancher/k3s/server/db/etcd/config | grep -E \'cert-file|key-file\');;\n "2.2")\n echo $(grep -A 5 \'client-transport-security\' /var/lib/rancher/k3s/server/db/etcd/config | grep \'client-cert-auth\');;\n "2.3")\n echo $(grep \'auto-tls\' /var/lib/rancher/k3s/server/db/etcd/config);;\n "2.4")\n echo $(grep -A 5 \'peer-transport-security\' /var/lib/rancher/k3s/server/db/etcd/config | grep -E \'cert-file|key-file\');;\n "2.5")\n echo $(grep -A 5 \'peer-transport-security\' /var/lib/rancher/k3s/server/db/etcd/config | grep \'client-cert-auth\');;\n "2.6")\n echo $(grep \'peer-auto-tls\' /var/lib/rancher/k3s/server/db/etcd/config);;\n "2.7")\n echo $(grep \'trusted-ca-file\' /var/lib/rancher/k3s/server/db/etcd/config);;\n esac\nelse\n# If another database is running, return whatever is required to pass the scan\n case $1 in\n "1.1.11")\n echo "700";;\n "1.2.29")\n echo "--etcd-certfile AND --etcd-keyfile";;\n "2.1")\n echo "cert-file AND key-file";;\n "2.2")\n echo "--client-cert-auth=true";;\n "2.3")\n echo "false";;\n "2.4")\n echo "peer-cert-file AND peer-key-file";;\n "2.5")\n echo "--client-cert-auth=true";;\n "2.6")\n echo "--peer-auto-tls=false";;\n "2.7")\n echo "--trusted-ca-file";;\n esac\nfi\n\n'})}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit Execution:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"./check_for_k3s_etcd.sh 2.2\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result"}),":"]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:"'--client-cert-auth' is present OR 'client-cert-auth' is equal to 'true'\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Returned Value"}),":"]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:"--client-cert-auth=true client-cert-auth: true --client-cert-auth=true\n"})}),"\n",(0,s.jsx)(r.h3,{id:"23-ensure-that-the---auto-tls-argument-is-not-set-to-true-automated",children:"2.3 Ensure that the --auto-tls argument is not set to true (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," pass"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nEdit the etcd pod specification file /etc/kubernetes/manifests/etcd.yaml on the master\nnode and either remove the --auto-tls parameter or set it to false.\n--auto-tls=false"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Audit Script:"})," ",(0,s.jsx)(r.code,{children:"check_for_k3s_etcd.sh"})]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:'#!/bin/bash\n\n# This script is used to ensure that k3s is actually running etcd (and not other databases like sqlite3)\n# before it checks the requirement\nset -eE\n\nhandle_error() {\n echo "false"\n}\n\ntrap \'handle_error\' ERR\n\n\nif [[ "$(journalctl -D /var/log/journal -u k3s | grep \'Managed etcd cluster initializing\' | grep -v grep | wc -l)" -gt 0 ]]; then\n case $1 in \n "1.1.11")\n echo $(stat -c %a /var/lib/rancher/k3s/server/db/etcd);;\n "1.2.29")\n echo $(journalctl -D /var/log/journal -u k3s | grep \'Running kube-apiserver\' | tail -n1 | grep \'etcd-\');;\n "2.1")\n echo $(grep -A 5 \'client-transport-security\' /var/lib/rancher/k3s/server/db/etcd/config | grep -E \'cert-file|key-file\');;\n "2.2")\n echo $(grep -A 5 \'client-transport-security\' /var/lib/rancher/k3s/server/db/etcd/config | grep \'client-cert-auth\');;\n "2.3")\n echo $(grep \'auto-tls\' /var/lib/rancher/k3s/server/db/etcd/config);;\n "2.4")\n echo $(grep -A 5 \'peer-transport-security\' /var/lib/rancher/k3s/server/db/etcd/config | grep -E \'cert-file|key-file\');;\n "2.5")\n echo $(grep -A 5 \'peer-transport-security\' /var/lib/rancher/k3s/server/db/etcd/config | grep \'client-cert-auth\');;\n "2.6")\n echo $(grep \'peer-auto-tls\' /var/lib/rancher/k3s/server/db/etcd/config);;\n "2.7")\n echo $(grep \'trusted-ca-file\' /var/lib/rancher/k3s/server/db/etcd/config);;\n esac\nelse\n# If another database is running, return whatever is required to pass the scan\n case $1 in\n "1.1.11")\n echo "700";;\n "1.2.29")\n echo "--etcd-certfile AND --etcd-keyfile";;\n "2.1")\n echo "cert-file AND key-file";;\n "2.2")\n echo "--client-cert-auth=true";;\n "2.3")\n echo "false";;\n "2.4")\n echo "peer-cert-file AND peer-key-file";;\n "2.5")\n echo "--client-cert-auth=true";;\n "2.6")\n echo "--peer-auto-tls=false";;\n "2.7")\n echo "--trusted-ca-file";;\n esac\nfi\n\n'})}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit Execution:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"./check_for_k3s_etcd.sh 2.3\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result"}),":"]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:"'ETCD_AUTO_TLS' is not present OR 'ETCD_AUTO_TLS' is present\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Returned Value"}),":"]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:"error: process ID list syntax error Usage: ps [options] Try 'ps --help ' or 'ps --help ' for additional help text. For more details see ps(1). cat: /proc//environ: No such file or directory error: process ID list syntax error Usage: ps [options] Try 'ps --help ' or 'ps --help ' for additional help text. For more details see ps(1). cat: /proc//environ: No such file or directory error: process ID list syntax error Usage: ps [options] Try 'ps --help ' or 'ps --help ' for additional help text. For more details see ps(1). cat: /proc//environ: No such file or directory\n"})}),"\n",(0,s.jsx)(r.h3,{id:"24-ensure-that-the---peer-cert-file-and---peer-key-file-arguments-are-set-as-appropriate-automated",children:"2.4 Ensure that the --peer-cert-file and --peer-key-file arguments are set as appropriate (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," pass"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nFollow the etcd service documentation and configure peer TLS encryption as appropriate\nfor your etcd cluster.\nThen, edit the etcd pod specification file /etc/kubernetes/manifests/etcd.yaml on the\nmaster node and set the below parameters."]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{children:"--peer-client-file=\n--peer-key-file=\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Audit Script:"})," ",(0,s.jsx)(r.code,{children:"check_for_k3s_etcd.sh"})]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:'#!/bin/bash\n\n# This script is used to ensure that k3s is actually running etcd (and not other databases like sqlite3)\n# before it checks the requirement\nset -eE\n\nhandle_error() {\n echo "false"\n}\n\ntrap \'handle_error\' ERR\n\n\nif [[ "$(journalctl -D /var/log/journal -u k3s | grep \'Managed etcd cluster initializing\' | grep -v grep | wc -l)" -gt 0 ]]; then\n case $1 in \n "1.1.11")\n echo $(stat -c %a /var/lib/rancher/k3s/server/db/etcd);;\n "1.2.29")\n echo $(journalctl -D /var/log/journal -u k3s | grep \'Running kube-apiserver\' | tail -n1 | grep \'etcd-\');;\n "2.1")\n echo $(grep -A 5 \'client-transport-security\' /var/lib/rancher/k3s/server/db/etcd/config | grep -E \'cert-file|key-file\');;\n "2.2")\n echo $(grep -A 5 \'client-transport-security\' /var/lib/rancher/k3s/server/db/etcd/config | grep \'client-cert-auth\');;\n "2.3")\n echo $(grep \'auto-tls\' /var/lib/rancher/k3s/server/db/etcd/config);;\n "2.4")\n echo $(grep -A 5 \'peer-transport-security\' /var/lib/rancher/k3s/server/db/etcd/config | grep -E \'cert-file|key-file\');;\n "2.5")\n echo $(grep -A 5 \'peer-transport-security\' /var/lib/rancher/k3s/server/db/etcd/config | grep \'client-cert-auth\');;\n "2.6")\n echo $(grep \'peer-auto-tls\' /var/lib/rancher/k3s/server/db/etcd/config);;\n "2.7")\n echo $(grep \'trusted-ca-file\' /var/lib/rancher/k3s/server/db/etcd/config);;\n esac\nelse\n# If another database is running, return whatever is required to pass the scan\n case $1 in\n "1.1.11")\n echo "700";;\n "1.2.29")\n echo "--etcd-certfile AND --etcd-keyfile";;\n "2.1")\n echo "cert-file AND key-file";;\n "2.2")\n echo "--client-cert-auth=true";;\n "2.3")\n echo "false";;\n "2.4")\n echo "peer-cert-file AND peer-key-file";;\n "2.5")\n echo "--client-cert-auth=true";;\n "2.6")\n echo "--peer-auto-tls=false";;\n "2.7")\n echo "--trusted-ca-file";;\n esac\nfi\n\n'})}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit Execution:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"./check_for_k3s_etcd.sh 2.4\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result"}),":"]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:"'cert-file' is present AND 'key-file' is present\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Returned Value"}),":"]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:"peer-cert-file AND peer-key-file cert-file: /var/lib/rancher/k3s/server/tls/etcd/peer-server-client.crt key-file: /var/lib/rancher/k3s/server/tls/etcd/peer-server-client.key peer-cert-file AND peer-key-file\n"})}),"\n",(0,s.jsx)(r.h3,{id:"25-ensure-that-the---peer-client-cert-auth-argument-is-set-to-true-automated",children:"2.5 Ensure that the --peer-client-cert-auth argument is set to true (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," pass"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nEdit the etcd pod specification file /etc/kubernetes/manifests/etcd.yaml on the master\nnode and set the below parameter.\n--peer-client-cert-auth=true"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Audit Script:"})," ",(0,s.jsx)(r.code,{children:"check_for_k3s_etcd.sh"})]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:'#!/bin/bash\n\n# This script is used to ensure that k3s is actually running etcd (and not other databases like sqlite3)\n# before it checks the requirement\nset -eE\n\nhandle_error() {\n echo "false"\n}\n\ntrap \'handle_error\' ERR\n\n\nif [[ "$(journalctl -D /var/log/journal -u k3s | grep \'Managed etcd cluster initializing\' | grep -v grep | wc -l)" -gt 0 ]]; then\n case $1 in \n "1.1.11")\n echo $(stat -c %a /var/lib/rancher/k3s/server/db/etcd);;\n "1.2.29")\n echo $(journalctl -D /var/log/journal -u k3s | grep \'Running kube-apiserver\' | tail -n1 | grep \'etcd-\');;\n "2.1")\n echo $(grep -A 5 \'client-transport-security\' /var/lib/rancher/k3s/server/db/etcd/config | grep -E \'cert-file|key-file\');;\n "2.2")\n echo $(grep -A 5 \'client-transport-security\' /var/lib/rancher/k3s/server/db/etcd/config | grep \'client-cert-auth\');;\n "2.3")\n echo $(grep \'auto-tls\' /var/lib/rancher/k3s/server/db/etcd/config);;\n "2.4")\n echo $(grep -A 5 \'peer-transport-security\' /var/lib/rancher/k3s/server/db/etcd/config | grep -E \'cert-file|key-file\');;\n "2.5")\n echo $(grep -A 5 \'peer-transport-security\' /var/lib/rancher/k3s/server/db/etcd/config | grep \'client-cert-auth\');;\n "2.6")\n echo $(grep \'peer-auto-tls\' /var/lib/rancher/k3s/server/db/etcd/config);;\n "2.7")\n echo $(grep \'trusted-ca-file\' /var/lib/rancher/k3s/server/db/etcd/config);;\n esac\nelse\n# If another database is running, return whatever is required to pass the scan\n case $1 in\n "1.1.11")\n echo "700";;\n "1.2.29")\n echo "--etcd-certfile AND --etcd-keyfile";;\n "2.1")\n echo "cert-file AND key-file";;\n "2.2")\n echo "--client-cert-auth=true";;\n "2.3")\n echo "false";;\n "2.4")\n echo "peer-cert-file AND peer-key-file";;\n "2.5")\n echo "--client-cert-auth=true";;\n "2.6")\n echo "--peer-auto-tls=false";;\n "2.7")\n echo "--trusted-ca-file";;\n esac\nfi\n\n'})}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit Execution:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"./check_for_k3s_etcd.sh 2.5\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result"}),":"]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:"'--client-cert-auth' is present OR 'client-cert-auth' is equal to 'true'\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Returned Value"}),":"]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:"--client-cert-auth=true client-cert-auth: true --client-cert-auth=true\n"})}),"\n",(0,s.jsx)(r.h3,{id:"26-ensure-that-the---peer-auto-tls-argument-is-not-set-to-true-automated",children:"2.6 Ensure that the --peer-auto-tls argument is not set to true (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," pass"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nEdit the etcd pod specification file /etc/kubernetes/manifests/etcd.yaml on the master\nnode and either remove the --peer-auto-tls parameter or set it to false.\n--peer-auto-tls=false"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Audit Script:"})," ",(0,s.jsx)(r.code,{children:"check_for_k3s_etcd.sh"})]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:'#!/bin/bash\n\n# This script is used to ensure that k3s is actually running etcd (and not other databases like sqlite3)\n# before it checks the requirement\nset -eE\n\nhandle_error() {\n echo "false"\n}\n\ntrap \'handle_error\' ERR\n\n\nif [[ "$(journalctl -D /var/log/journal -u k3s | grep \'Managed etcd cluster initializing\' | grep -v grep | wc -l)" -gt 0 ]]; then\n case $1 in \n "1.1.11")\n echo $(stat -c %a /var/lib/rancher/k3s/server/db/etcd);;\n "1.2.29")\n echo $(journalctl -D /var/log/journal -u k3s | grep \'Running kube-apiserver\' | tail -n1 | grep \'etcd-\');;\n "2.1")\n echo $(grep -A 5 \'client-transport-security\' /var/lib/rancher/k3s/server/db/etcd/config | grep -E \'cert-file|key-file\');;\n "2.2")\n echo $(grep -A 5 \'client-transport-security\' /var/lib/rancher/k3s/server/db/etcd/config | grep \'client-cert-auth\');;\n "2.3")\n echo $(grep \'auto-tls\' /var/lib/rancher/k3s/server/db/etcd/config);;\n "2.4")\n echo $(grep -A 5 \'peer-transport-security\' /var/lib/rancher/k3s/server/db/etcd/config | grep -E \'cert-file|key-file\');;\n "2.5")\n echo $(grep -A 5 \'peer-transport-security\' /var/lib/rancher/k3s/server/db/etcd/config | grep \'client-cert-auth\');;\n "2.6")\n echo $(grep \'peer-auto-tls\' /var/lib/rancher/k3s/server/db/etcd/config);;\n "2.7")\n echo $(grep \'trusted-ca-file\' /var/lib/rancher/k3s/server/db/etcd/config);;\n esac\nelse\n# If another database is running, return whatever is required to pass the scan\n case $1 in\n "1.1.11")\n echo "700";;\n "1.2.29")\n echo "--etcd-certfile AND --etcd-keyfile";;\n "2.1")\n echo "cert-file AND key-file";;\n "2.2")\n echo "--client-cert-auth=true";;\n "2.3")\n echo "false";;\n "2.4")\n echo "peer-cert-file AND peer-key-file";;\n "2.5")\n echo "--client-cert-auth=true";;\n "2.6")\n echo "--peer-auto-tls=false";;\n "2.7")\n echo "--trusted-ca-file";;\n esac\nfi\n\n'})}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit Execution:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"./check_for_k3s_etcd.sh 2.6\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result"}),":"]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:"'--peer-auto-tls' is not present OR '--peer-auto-tls' is equal to 'false'\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Returned Value"}),":"]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:"--peer-auto-tls=false error: process ID list syntax error Usage: ps [options] Try 'ps --help ' or 'ps --help ' for additional help text. For more details see ps(1). cat: /proc//environ: No such file or directory --peer-auto-tls=false\n"})}),"\n",(0,s.jsx)(r.h3,{id:"27-ensure-that-a-unique-certificate-authority-is-used-for-etcd-manual",children:"2.7 Ensure that a unique Certificate Authority is used for etcd (Manual)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," pass"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\n[Manual test]\nFollow the etcd documentation and create a dedicated certificate authority setup for the\netcd service.\nThen, edit the etcd pod specification file /etc/kubernetes/manifests/etcd.yaml on the\nmaster node and set the below parameter.\n",(0,s.jsx)(r.code,{children:"--trusted-ca-file="})]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Audit Script:"})," ",(0,s.jsx)(r.code,{children:"check_for_k3s_etcd.sh"})]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:'#!/bin/bash\n\n# This script is used to ensure that k3s is actually running etcd (and not other databases like sqlite3)\n# before it checks the requirement\nset -eE\n\nhandle_error() {\n echo "false"\n}\n\ntrap \'handle_error\' ERR\n\n\nif [[ "$(journalctl -D /var/log/journal -u k3s | grep \'Managed etcd cluster initializing\' | grep -v grep | wc -l)" -gt 0 ]]; then\n case $1 in \n "1.1.11")\n echo $(stat -c %a /var/lib/rancher/k3s/server/db/etcd);;\n "1.2.29")\n echo $(journalctl -D /var/log/journal -u k3s | grep \'Running kube-apiserver\' | tail -n1 | grep \'etcd-\');;\n "2.1")\n echo $(grep -A 5 \'client-transport-security\' /var/lib/rancher/k3s/server/db/etcd/config | grep -E \'cert-file|key-file\');;\n "2.2")\n echo $(grep -A 5 \'client-transport-security\' /var/lib/rancher/k3s/server/db/etcd/config | grep \'client-cert-auth\');;\n "2.3")\n echo $(grep \'auto-tls\' /var/lib/rancher/k3s/server/db/etcd/config);;\n "2.4")\n echo $(grep -A 5 \'peer-transport-security\' /var/lib/rancher/k3s/server/db/etcd/config | grep -E \'cert-file|key-file\');;\n "2.5")\n echo $(grep -A 5 \'peer-transport-security\' /var/lib/rancher/k3s/server/db/etcd/config | grep \'client-cert-auth\');;\n "2.6")\n echo $(grep \'peer-auto-tls\' /var/lib/rancher/k3s/server/db/etcd/config);;\n "2.7")\n echo $(grep \'trusted-ca-file\' /var/lib/rancher/k3s/server/db/etcd/config);;\n esac\nelse\n# If another database is running, return whatever is required to pass the scan\n case $1 in\n "1.1.11")\n echo "700";;\n "1.2.29")\n echo "--etcd-certfile AND --etcd-keyfile";;\n "2.1")\n echo "cert-file AND key-file";;\n "2.2")\n echo "--client-cert-auth=true";;\n "2.3")\n echo "false";;\n "2.4")\n echo "peer-cert-file AND peer-key-file";;\n "2.5")\n echo "--client-cert-auth=true";;\n "2.6")\n echo "--peer-auto-tls=false";;\n "2.7")\n echo "--trusted-ca-file";;\n esac\nfi\n\n'})}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit Execution:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"./check_for_k3s_etcd.sh 2.7\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result"}),":"]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:"'trusted-ca-file' is present\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Returned Value"}),":"]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:"--trusted-ca-file trusted-ca-file: /var/lib/rancher/k3s/server/tls/etcd/server-ca.crt trusted-ca-file: /var/lib/rancher/k3s/server/tls/etcd/peer-ca.crt --trusted-ca-file\n"})}),"\n",(0,s.jsx)(r.h2,{id:"31-authentication-and-authorization",children:"3.1 Authentication and Authorization"}),"\n",(0,s.jsx)(r.h3,{id:"311-client-certificate-authentication-should-not-be-used-for-users-manual",children:"3.1.1 Client certificate authentication should not be used for users (Manual)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," warn"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nAlternative mechanisms provided by Kubernetes such as the use of OIDC should be\nimplemented in place of client certificates."]}),"\n",(0,s.jsx)(r.h2,{id:"32-logging",children:"3.2 Logging"}),"\n",(0,s.jsx)(r.h3,{id:"321-ensure-that-a-minimal-audit-policy-is-created-manual",children:"3.2.1 Ensure that a minimal audit policy is created (Manual)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," warn"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nCreate an audit policy file for your cluster."]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'audit-policy-file'\n"})}),"\n",(0,s.jsx)(r.h3,{id:"322-ensure-that-the-audit-policy-covers-key-security-concerns-manual",children:"3.2.2 Ensure that the audit policy covers key security concerns (Manual)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," warn"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nReview the audit policy provided for the cluster and ensure that it covers\nat least the following areas,"]}),"\n",(0,s.jsxs)(r.ul,{children:["\n",(0,s.jsx)(r.li,{children:"Access to Secrets managed by the cluster. Care should be taken to only\nlog Metadata for requests to Secrets, ConfigMaps, and TokenReviews, in\norder to avoid risk of logging sensitive data."}),"\n",(0,s.jsx)(r.li,{children:"Modification of Pod and Deployment objects."}),"\n",(0,s.jsxs)(r.li,{children:["Use of ",(0,s.jsx)(r.code,{children:"pods/exec"}),", ",(0,s.jsx)(r.code,{children:"pods/portforward"}),", ",(0,s.jsx)(r.code,{children:"pods/proxy"})," and ",(0,s.jsx)(r.code,{children:"services/proxy"}),".\nFor most requests, minimally logging at the Metadata level is recommended\n(the most basic level of logging)."]}),"\n"]}),"\n",(0,s.jsx)(r.h2,{id:"41-worker-node-configuration-files",children:"4.1 Worker Node Configuration Files"}),"\n",(0,s.jsx)(r.h3,{id:"411-ensure-that-the-kubelet-service-file-permissions-are-set-to-644-or-more-restrictive-automated",children:"4.1.1 Ensure that the kubelet service file permissions are set to 644 or more restrictive (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," Not Applicable"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nRun the below command (based on the file location on your system) on the each worker node.\nFor example, chmod 644 /etc/systemd/system/kubelet.service.d/10-kubeadm.conf"]}),"\n",(0,s.jsxs)(r.h3,{id:"412-ensure-that-the-kubelet-service-file-ownership-is-set-to-root-automated",children:["4.1.2 Ensure that the kubelet service file ownership is set to root",":root"," (Automated)"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," Not Applicable"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nRun the below command (based on the file location on your system) on the each worker node.\nFor example,\nchown root",":root"," /etc/systemd/system/kubelet.service.d/10-kubeadm.conf"]}),"\n",(0,s.jsx)(r.h3,{id:"413-if-proxy-kubeconfig-file-exists-ensure-permissions-are-set-to-644-or-more-restrictive-manual",children:"4.1.3 If proxy kubeconfig file exists ensure permissions are set to 644 or more restrictive (Manual)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," pass"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nRun the below command (based on the file location on your system) on the each worker node.\nFor example,\nchmod 644 /var/lib/rancher/k3s/agent/kubeproxy.kubeconfig"]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"stat -c %a /var/lib/rancher/k3s/agent/kubeproxy.kubeconfig\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result"}),":"]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:"'permissions' is present OR '/var/lib/rancher/k3s/agent/kubeproxy.kubeconfig' is not present\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Returned Value"}),":"]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:"644 644\n"})}),"\n",(0,s.jsxs)(r.h3,{id:"414-if-proxy-kubeconfig-file-exists-ensure-ownership-is-set-to-root-manual",children:["4.1.4 If proxy kubeconfig file exists ensure ownership is set to root",":root"," (Manual)"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," pass"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nRun the below command (based on the file location on your system) on the each worker node.\nFor example, chown root",":root"," /var/lib/rancher/k3s/agent/kubeproxy.kubeconfig"]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"/bin/sh -c 'if test -e /var/lib/rancher/k3s/agent/kubeproxy.kubeconfig; then stat -c %U:%G /var/lib/rancher/k3s/agent/kubeproxy.kubeconfig; fi'\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result"}),":"]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:"'root:root' is present OR '/var/lib/rancher/k3s/agent/kubeproxy.kubeconfig' is not present\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Returned Value"}),":"]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:"root:root root:root\n"})}),"\n",(0,s.jsx)(r.h3,{id:"415-ensure-that-the---kubeconfig-kubeletconf-file-permissions-are-set-to-644-or-more-restrictive-automated",children:"4.1.5 Ensure that the --kubeconfig kubelet.conf file permissions are set to 644 or more restrictive (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," pass"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nRun the below command (based on the file location on your system) on the each worker node.\nFor example,\nchmod 644 /var/lib/rancher/k3s/server/cred/admin.kubeconfig"]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"stat -c %a /var/lib/rancher/k3s/agent/kubelet.kubeconfig\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result"}),":"]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:"'644' is equal to '644'\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Returned Value"}),":"]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:"644 644\n"})}),"\n",(0,s.jsxs)(r.h3,{id:"416-ensure-that-the---kubeconfig-kubeletconf-file-ownership-is-set-to-root-automated",children:["4.1.6 Ensure that the --kubeconfig kubelet.conf file ownership is set to root",":root"," (Automated)"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," pass"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nRun the below command (based on the file location on your system) on the each worker node.\nFor example,\nchown root",":root"," /var/lib/rancher/k3s/server/cred/admin.kubeconfig"]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"stat -c %U:%G /var/lib/rancher/k3s/agent/kubelet.kubeconfig\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result"}),":"]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:"'root:root' is equal to 'root:root'\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Returned Value"}),":"]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:"root:root root:root\n"})}),"\n",(0,s.jsx)(r.h3,{id:"417-ensure-that-the-certificate-authorities-file-permissions-are-set-to-644-or-more-restrictive-manual",children:"4.1.7 Ensure that the certificate authorities file permissions are set to 644 or more restrictive (Manual)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," pass"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nRun the following command to modify the file permissions of the\n--client-ca-file: ",(0,s.jsx)(r.code,{children:"chmod 644 "})]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"stat -c %a /var/lib/rancher/k3s/server/tls/server-ca.crt\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result"}),":"]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:"'644' is present OR '640' is present OR '600' is equal to '600' OR '444' is present OR '440' is present OR '400' is present OR '000' is present\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Returned Value"}),":"]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:"644 600\n"})}),"\n",(0,s.jsxs)(r.h3,{id:"418-ensure-that-the-client-certificate-authorities-file-ownership-is-set-to-root-manual",children:["4.1.8 Ensure that the client certificate authorities file ownership is set to root",":root"," (Manual)"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," pass"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nRun the following command to modify the ownership of the --client-ca-file:\n",(0,s.jsx)(r.code,{children:"chown root:root "}),"."]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"stat -c %U:%G /var/lib/rancher/k3s/server/tls/client-ca.crt\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result"}),":"]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:"'root:root' is equal to 'root:root'\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Returned Value"}),":"]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:"root:root root:root\n"})}),"\n",(0,s.jsx)(r.h3,{id:"419-ensure-that-the-kubelet---config-configuration-file-has-permissions-set-to-644-or-more-restrictive-automated",children:"4.1.9 Ensure that the kubelet --config configuration file has permissions set to 644 or more restrictive (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," Not Applicable"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nRun the following command (using the config file location identified in the Audit step)\nchmod 644 /var/lib/kubelet/config.yaml"]}),"\n",(0,s.jsxs)(r.h3,{id:"4110-ensure-that-the-kubelet---config-configuration-file-ownership-is-set-to-root-automated",children:["4.1.10 Ensure that the kubelet --config configuration file ownership is set to root",":root"," (Automated)"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," Not Applicable"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nRun the following command (using the config file location identified in the Audit step)\nchown root",":root"," /var/lib/kubelet/config.yaml"]}),"\n",(0,s.jsx)(r.h2,{id:"42-kubelet",children:"4.2 Kubelet"}),"\n",(0,s.jsx)(r.h3,{id:"421-ensure-that-the---anonymous-auth-argument-is-set-to-false-automated",children:"4.2.1 Ensure that the --anonymous-auth argument is set to false (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," pass"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nIf using a Kubelet config file, edit the file to set ",(0,s.jsx)(r.code,{children:"authentication: anonymous: enabled"})," to\n",(0,s.jsx)(r.code,{children:"false"}),".\nIf using executable arguments, edit the kubelet service file\n/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and\nset the below parameter in KUBELET_SYSTEM_PODS_ARGS variable.\n",(0,s.jsx)(r.code,{children:"--anonymous-auth=false"}),"\nBased on your system, restart the kubelet service. For example,\nsystemctl daemon-reload\nsystemctl restart kubelet.service"]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:'/bin/sh -c \'if test $(journalctl -D /var/log/journal -u k3s | grep "Running kube-apiserver" | wc -l) -gt 0; then journalctl -D /var/log/journal -u k3s | grep "Running kube-apiserver" | tail -n1 | grep "anonymous-auth" | grep -v grep; else echo "--anonymous-auth=false"; fi\'\n'})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result"}),":"]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:"'--anonymous-auth' is equal to 'false'\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Returned Value"}),":"]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:'--anonymous-auth=false Sep 13 13:26:40 k3s-123-cis-pool3-b403f678-bzdg5 k3s[1600]: time="2022-09-13T13:26:40Z" level=info msg="Running kube-apiserver --advertise-address=172.31.0.140 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})}),"\n",(0,s.jsx)(r.h3,{id:"422-ensure-that-the---authorization-mode-argument-is-not-set-to-alwaysallow-automated",children:"4.2.2 Ensure that the --authorization-mode argument is not set to AlwaysAllow (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," pass"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nIf using a Kubelet config file, edit the file to set ",(0,s.jsx)(r.code,{children:"authorization.mode"})," to Webhook. If\nusing executable arguments, edit the kubelet service file\n/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and\nset the below parameter in KUBELET_AUTHZ_ARGS variable.\n--authorization-mode=Webhook\nBased on your system, restart the kubelet service. For example,\nsystemctl daemon-reload\nsystemctl restart kubelet.service"]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:'/bin/sh -c \'if test $(journalctl -D /var/log/journal -u k3s | grep "Running kube-apiserver" | wc -l) -gt 0; then journalctl -D /var/log/journal -u k3s | grep "Running kube-apiserver" | tail -n1 | grep "authorization-mode" | grep -v grep; else echo "--authorization-mode=Webhook"; fi\'\n'})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result"}),":"]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:"'--authorization-mode' does not have 'AlwaysAllow'\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Returned Value"}),":"]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:'--authorization-mode=Webhook Sep 13 13:26:40 k3s-123-cis-pool3-b403f678-bzdg5 k3s[1600]: time="2022-09-13T13:26:40Z" level=info msg="Running kube-apiserver --advertise-address=172.31.0.140 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})}),"\n",(0,s.jsx)(r.h3,{id:"423-ensure-that-the---client-ca-file-argument-is-set-as-appropriate-automated",children:"4.2.3 Ensure that the --client-ca-file argument is set as appropriate (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," pass"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nIf using a Kubelet config file, edit the file to set ",(0,s.jsx)(r.code,{children:"authentication.x509.clientCAFile"})," to\nthe location of the client CA file.\nIf using command line arguments, edit the kubelet service file\n/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and\nset the below parameter in KUBELET_AUTHZ_ARGS variable.\n",(0,s.jsx)(r.code,{children:"--client-ca-file="}),"\nBased on your system, restart the kubelet service. For example,\nsystemctl daemon-reload\nsystemctl restart kubelet.service"]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:'/bin/sh -c \'if test $(journalctl -D /var/log/journal -u k3s | grep "Running kube-apiserver" | wc -l) -gt 0; then journalctl -D /var/log/journal -u k3s | grep "Running kube-apiserver" | tail -n1 | grep "client-ca-file" | grep -v grep; else echo "--client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt"; fi\'\n'})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result"}),":"]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:"'--client-ca-file' is present\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Returned Value"}),":"]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:'--client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt Sep 13 13:26:40 k3s-123-cis-pool3-b403f678-bzdg5 k3s[1600]: time="2022-09-13T13:26:40Z" level=info msg="Running kube-apiserver --advertise-address=172.31.0.140 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})}),"\n",(0,s.jsx)(r.h3,{id:"424-ensure-that-the---read-only-port-argument-is-set-to-0-manual",children:"4.2.4 Ensure that the --read-only-port argument is set to 0 (Manual)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," pass"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nIf using a Kubelet config file, edit the file to set ",(0,s.jsx)(r.code,{children:"readOnlyPort"})," to 0.\nIf using command line arguments, edit the kubelet service file\n/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and\nset the below parameter in KUBELET_SYSTEM_PODS_ARGS variable.\n--read-only-port=0\nBased on your system, restart the kubelet service. For example,\nsystemctl daemon-reload\nsystemctl restart kubelet.service"]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"journalctl -D /var/log/journal -u k3s | grep 'Running kubelet' | tail -n1 | grep 'read-only-port'\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result"}),":"]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:"'--read-only-port' is equal to '0' OR '--read-only-port' is not present\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Returned Value"}),":"]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:'Sep 13 13:26:50 k3s-123-cis-pool2-98604672-hr9p5 k3s[1592]: time="2022-09-13T13:26:50Z" level=info msg="Running kubelet --address=0.0.0.0 --anonymous-auth=false --authentication-token-webhook=true --authorization-mode=Webhook --cgroup-driver=systemd --client-ca-file=/var/lib/rancher/k3s/agent/client-ca.crt --cloud-provider=external --cluster-dns=10.43.0.10 --cluster-domain=cluster.local --container-runtime-endpoint=unix:///run/k3s/containerd/containerd.sock --containerd=/run/k3s/containerd/containerd.sock --eviction-hard=imagefs.available<5%,nodefs.available<5% --eviction-minimum-reclaim=imagefs.available=10%,nodefs.available=10% --fail-swap-on=false --healthz-bind-address=127.0.0.1 --hostname-override=k3s-123-cis-pool2-98604672-hr9p5 --kubeconfig=/var/lib/rancher/k3s/agent/kubelet.kubeconfig --node-labels=rke.cattle.io/machine=00c4e7a0-5497-4367-a70c-0b836757eae8 --pod-infra-container-image=rancher/mirrored-pause:3.6 --pod-manifest-path=/var/lib/rancher/k3s/agent/pod-manifests --read-only-port=0 --resolv-conf=/run/systemd/resolve/resolv.conf --serialize-image-pulls=false --tls-cert-file=/var/lib/rancher/k3s/agent/serving-kubelet.crt --tls-private-key-file=/var/lib/rancher/k3s/agent/serving-kubelet.key" Sep 13 13:26:44 k3s-123-cis-pool3-b403f678-bzdg5 k3s[1600]: time="2022-09-13T13:26:44Z" level=info msg="Running kubelet --address=0.0.0.0 --anonymous-auth=false --authentication-token-webhook=true --authorization-mode=Webhook --cgroup-driver=systemd --client-ca-file=/var/lib/rancher/k3s/agent/client-ca.crt --cloud-provider=external --cluster-dns=10.43.0.10 --cluster-domain=cluster.local --container-runtime-endpoint=unix:///run/k3s/containerd/containerd.sock --containerd=/run/k3s/containerd/containerd.sock --eviction-hard=imagefs.available<5%,nodefs.available<5% --eviction-minimum-reclaim=imagefs.available=10%,nodefs.available=10% --fail-swap-on=false --healthz-bind-address=127.0.0.1 --hostname-override=k3s-123-cis-pool3-b403f678-bzdg5 --kubeconfig=/var/lib/rancher/k3s/agent/kubelet.kubeconfig --node-labels=rke.cattle.io/machine=109d596c-89f5-4c10-8c7f-6b82a38edd8f --pod-infra-container-image=rancher/mirrored-pause:3.6 --pod-manifest-path=/var/lib/rancher/k3s/agent/pod-manifests --read-only-port=0 --resolv-conf=/run/systemd/resolve/resolv.conf --serialize-image-pulls=false --tls-cert-file=/var/lib/rancher/k3s/agent/serving-kubelet.crt --tls-private-key-file=/var/lib/rancher/k3s/agent/serving-kubelet.key"\n'})}),"\n",(0,s.jsx)(r.h3,{id:"425-ensure-that-the---streaming-connection-idle-timeout-argument-is-not-set-to-0-manual",children:"4.2.5 Ensure that the --streaming-connection-idle-timeout argument is not set to 0 (Manual)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," warn"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nIf using a Kubelet config file, edit the file to set ",(0,s.jsx)(r.code,{children:"streamingConnectionIdleTimeout"})," to a\nvalue other than 0.\nIf using command line arguments, edit the kubelet service file\n/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and\nset the below parameter in KUBELET_SYSTEM_PODS_ARGS variable.\n--streaming-connection-idle-timeout=5m\nBased on your system, restart the kubelet service. For example,\nsystemctl daemon-reload\nsystemctl restart kubelet.service"]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"journalctl -D /var/log/journal -u k3s | grep 'Running kubelet' | tail -n1 | grep 'streaming-connection-idle-timeout'\n"})}),"\n",(0,s.jsx)(r.h3,{id:"426-ensure-that-the---protect-kernel-defaults-argument-is-set-to-true-automated",children:"4.2.6 Ensure that the --protect-kernel-defaults argument is set to true (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," Not Applicable"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nIf using a Kubelet config file, edit the file to set ",(0,s.jsx)(r.code,{children:"protectKernelDefaults"})," to ",(0,s.jsx)(r.code,{children:"true"}),".\nIf using command line arguments, edit the kubelet service file\n/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and\nset the below parameter in KUBELET_SYSTEM_PODS_ARGS variable.\n--protect-kernel-defaults=true\nBased on your system, restart the kubelet service. For example:\nsystemctl daemon-reload\nsystemctl restart kubelet.service"]}),"\n",(0,s.jsx)(r.h3,{id:"427-ensure-that-the---make-iptables-util-chains-argument-is-set-to-true-automated",children:"4.2.7 Ensure that the --make-iptables-util-chains argument is set to true (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," Not Applicable"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nIf using a Kubelet config file, edit the file to set ",(0,s.jsx)(r.code,{children:"makeIPTablesUtilChains"})," to ",(0,s.jsx)(r.code,{children:"true"}),".\nIf using command line arguments, edit the kubelet service file\n/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and\nremove the --make-iptables-util-chains argument from the\nKUBELET_SYSTEM_PODS_ARGS variable.\nBased on your system, restart the kubelet service. For example:\nsystemctl daemon-reload\nsystemctl restart kubelet.service"]}),"\n",(0,s.jsx)(r.h3,{id:"428-ensure-that-the---hostname-override-argument-is-not-set-manual",children:"4.2.8 Ensure that the --hostname-override argument is not set (Manual)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," Not Applicable"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nEdit the kubelet service file /etc/systemd/system/kubelet.service.d/10-kubeadm.conf\non each worker node and remove the --hostname-override argument from the\nKUBELET_SYSTEM_PODS_ARGS variable.\nBased on your system, restart the kubelet service. For example,\nsystemctl daemon-reload\nsystemctl restart kubelet.service"]}),"\n",(0,s.jsx)(r.h3,{id:"429-ensure-that-the---event-qps-argument-is-set-to-0-or-a-level-which-ensures-appropriate-event-capture-manual",children:"4.2.9 Ensure that the --event-qps argument is set to 0 or a level which ensures appropriate event capture (Manual)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," warn"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nIf using a Kubelet config file, edit the file to set ",(0,s.jsx)(r.code,{children:"eventRecordQPS"})," to an appropriate level.\nIf using command line arguments, edit the kubelet service file\n/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and\nset the below parameter in KUBELET_SYSTEM_PODS_ARGS variable.\nBased on your system, restart the kubelet service. For example,\nsystemctl daemon-reload\nsystemctl restart kubelet.service"]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"/bin/ps -fC containerd\n"})}),"\n",(0,s.jsx)(r.h3,{id:"4210-ensure-that-the---tls-cert-file-and---tls-private-key-file-arguments-are-set-as-appropriate-manual",children:"4.2.10 Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate (Manual)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," pass"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nIf using a Kubelet config file, edit the file to set ",(0,s.jsx)(r.code,{children:"tlsCertFile"})," to the location\nof the certificate file to use to identify this Kubelet, and ",(0,s.jsx)(r.code,{children:"tlsPrivateKeyFile"}),"\nto the location of the corresponding private key file.\nIf using command line arguments, edit the kubelet service file\n/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and\nset the below parameters in KUBELET_CERTIFICATE_ARGS variable."]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{children:"--tls-cert-file=\n--tls-private-key-file=\n"})}),"\n",(0,s.jsx)(r.p,{children:"Based on your system, restart the kubelet service. For example,\nsystemctl daemon-reload\nsystemctl restart kubelet.service"}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"journalctl -D /var/log/journal -u k3s | grep 'Running kubelet' | tail -n1\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result"}),":"]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:"'--tls-cert-file' is present AND '--tls-private-key-file' is present\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Returned Value"}),":"]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:'Sep 13 13:26:50 k3s-123-cis-pool2-98604672-hr9p5 k3s[1592]: time="2022-09-13T13:26:50Z" level=info msg="Running kubelet --address=0.0.0.0 --anonymous-auth=false --authentication-token-webhook=true --authorization-mode=Webhook --cgroup-driver=systemd --client-ca-file=/var/lib/rancher/k3s/agent/client-ca.crt --cloud-provider=external --cluster-dns=10.43.0.10 --cluster-domain=cluster.local --container-runtime-endpoint=unix:///run/k3s/containerd/containerd.sock --containerd=/run/k3s/containerd/containerd.sock --eviction-hard=imagefs.available<5%,nodefs.available<5% --eviction-minimum-reclaim=imagefs.available=10%,nodefs.available=10% --fail-swap-on=false --healthz-bind-address=127.0.0.1 --hostname-override=k3s-123-cis-pool2-98604672-hr9p5 --kubeconfig=/var/lib/rancher/k3s/agent/kubelet.kubeconfig --node-labels=rke.cattle.io/machine=00c4e7a0-5497-4367-a70c-0b836757eae8 --pod-infra-container-image=rancher/mirrored-pause:3.6 --pod-manifest-path=/var/lib/rancher/k3s/agent/pod-manifests --read-only-port=0 --resolv-conf=/run/systemd/resolve/resolv.conf --serialize-image-pulls=false --tls-cert-file=/var/lib/rancher/k3s/agent/serving-kubelet.crt --tls-private-key-file=/var/lib/rancher/k3s/agent/serving-kubelet.key" Sep 13 13:26:44 k3s-123-cis-pool3-b403f678-bzdg5 k3s[1600]: time="2022-09-13T13:26:44Z" level=info msg="Running kubelet --address=0.0.0.0 --anonymous-auth=false --authentication-token-webhook=true --authorization-mode=Webhook --cgroup-driver=systemd --client-ca-file=/var/lib/rancher/k3s/agent/client-ca.crt --cloud-provider=external --cluster-dns=10.43.0.10 --cluster-domain=cluster.local --container-runtime-endpoint=unix:///run/k3s/containerd/containerd.sock --containerd=/run/k3s/containerd/containerd.sock --eviction-hard=imagefs.available<5%,nodefs.available<5% --eviction-minimum-reclaim=imagefs.available=10%,nodefs.available=10% --fail-swap-on=false --healthz-bind-address=127.0.0.1 --hostname-override=k3s-123-cis-pool3-b403f678-bzdg5 --kubeconfig=/var/lib/rancher/k3s/agent/kubelet.kubeconfig --node-labels=rke.cattle.io/machine=109d596c-89f5-4c10-8c7f-6b82a38edd8f --pod-infra-container-image=rancher/mirrored-pause:3.6 --pod-manifest-path=/var/lib/rancher/k3s/agent/pod-manifests --read-only-port=0 --resolv-conf=/run/systemd/resolve/resolv.conf --serialize-image-pulls=false --tls-cert-file=/var/lib/rancher/k3s/agent/serving-kubelet.crt --tls-private-key-file=/var/lib/rancher/k3s/agent/serving-kubelet.key"\n'})}),"\n",(0,s.jsx)(r.h3,{id:"4211-ensure-that-the---rotate-certificates-argument-is-not-set-to-false-automated",children:"4.2.11 Ensure that the --rotate-certificates argument is not set to false (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," Not Applicable"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nIf using a Kubelet config file, edit the file to add the line ",(0,s.jsx)(r.code,{children:"rotateCertificates"})," to ",(0,s.jsx)(r.code,{children:"true"})," or\nremove it altogether to use the default value.\nIf using command line arguments, edit the kubelet service file\n/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and\nremove --rotate-certificates=false argument from the KUBELET_CERTIFICATE_ARGS\nvariable.\nBased on your system, restart the kubelet service. For example,\nsystemctl daemon-reload\nsystemctl restart kubelet.service"]}),"\n",(0,s.jsx)(r.h3,{id:"4212-verify-that-the-rotatekubeletservercertificate-argument-is-set-to-true-manual",children:"4.2.12 Verify that the RotateKubeletServerCertificate argument is set to true (Manual)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," Not Applicable"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nEdit the kubelet service file /etc/systemd/system/kubelet.service.d/10-kubeadm.conf\non each worker node and set the below parameter in KUBELET_CERTIFICATE_ARGS variable.\n--feature-gates=RotateKubeletServerCertificate=true\nBased on your system, restart the kubelet service. For example:\nsystemctl daemon-reload\nsystemctl restart kubelet.service"]}),"\n",(0,s.jsx)(r.h3,{id:"4213-ensure-that-the-kubelet-only-makes-use-of-strong-cryptographic-ciphers-manual",children:"4.2.13 Ensure that the Kubelet only makes use of Strong Cryptographic Ciphers (Manual)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," warn"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nIf using a Kubelet config file, edit the file to set ",(0,s.jsx)(r.code,{children:"TLSCipherSuites"})," to\nTLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256\nor to a subset of these values.\nIf using executable arguments, edit the kubelet service file\n/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and\nset the --tls-cipher-suites parameter as follows, or to a subset of these values.\n--tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256\nBased on your system, restart the kubelet service. For example:\nsystemctl daemon-reload\nsystemctl restart kubelet.service"]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"/bin/ps -fC containerd\n"})}),"\n",(0,s.jsx)(r.h2,{id:"51-rbac-and-service-accounts",children:"5.1 RBAC and Service Accounts"}),"\n",(0,s.jsx)(r.h3,{id:"511-ensure-that-the-cluster-admin-role-is-only-used-where-required-manual",children:"5.1.1 Ensure that the cluster-admin role is only used where required (Manual)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," warn"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nIdentify all clusterrolebindings to the cluster-admin role. Check if they are used and\nif they need this role or if they could use a role with fewer privileges.\nWhere possible, first bind users to a lower privileged role and then remove the\nclusterrolebinding to the cluster-admin role :\nkubectl delete clusterrolebinding [name]"]}),"\n",(0,s.jsx)(r.h3,{id:"512-minimize-access-to-secrets-manual",children:"5.1.2 Minimize access to secrets (Manual)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," warn"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nWhere possible, remove get, list and watch access to Secret objects in the cluster."]}),"\n",(0,s.jsx)(r.h3,{id:"513-minimize-wildcard-use-in-roles-and-clusterroles-manual",children:"5.1.3 Minimize wildcard use in Roles and ClusterRoles (Manual)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," warn"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nWhere possible replace any use of wildcards in clusterroles and roles with specific\nobjects or actions."]}),"\n",(0,s.jsx)(r.h3,{id:"514-minimize-access-to-create-pods-manual",children:"5.1.4 Minimize access to create pods (Manual)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," warn"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nWhere possible, remove create access to pod objects in the cluster."]}),"\n",(0,s.jsx)(r.h3,{id:"515-ensure-that-default-service-accounts-are-not-actively-used-manual",children:"5.1.5 Ensure that default service accounts are not actively used. (Manual)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," warn"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nCreate explicit service accounts wherever a Kubernetes workload requires specific access\nto the Kubernetes API server.\nModify the configuration of each default service account to include this value\nautomountServiceAccountToken: false"]}),"\n",(0,s.jsx)(r.h3,{id:"516-ensure-that-service-account-tokens-are-only-mounted-where-necessary-manual",children:"5.1.6 Ensure that Service Account Tokens are only mounted where necessary (Manual)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," warn"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nModify the definition of pods and service accounts which do not need to mount service\naccount tokens to disable it."]}),"\n",(0,s.jsxs)(r.h3,{id:"517-avoid-use-of-system-group-manual",children:["5.1.7 Avoid use of system",":masters"," group (Manual)"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," warn"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nRemove the system",":masters"," group from all users in the cluster."]}),"\n",(0,s.jsx)(r.h3,{id:"518-limit-use-of-the-bind-impersonate-and-escalate-permissions-in-the-kubernetes-cluster-manual",children:"5.1.8 Limit use of the Bind, Impersonate and Escalate permissions in the Kubernetes cluster (Manual)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," warn"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nWhere possible, remove the impersonate, bind and escalate rights from subjects."]}),"\n",(0,s.jsx)(r.h2,{id:"52-pod-security-standards",children:"5.2 Pod Security Standards"}),"\n",(0,s.jsx)(r.h3,{id:"521-ensure-that-the-cluster-has-at-least-one-active-policy-control-mechanism-in-place-manual",children:"5.2.1 Ensure that the cluster has at least one active policy control mechanism in place (Manual)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," warn"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nEnsure that either Pod Security Admission or an external policy control system is in place\nfor every namespace which contains user workloads."]}),"\n",(0,s.jsx)(r.h3,{id:"522-minimize-the-admission-of-privileged-containers-automated",children:"5.2.2 Minimize the admission of privileged containers (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," warn"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nAdd policies to each namespace in the cluster which has user workloads to restrict the\nadmission of privileged containers."]}),"\n",(0,s.jsx)(r.h3,{id:"523-minimize-the-admission-of-containers-wishing-to-share-the-host-process-id-namespace-automated",children:"5.2.3 Minimize the admission of containers wishing to share the host process ID namespace (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," warn"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nAdd policies to each namespace in the cluster which has user workloads to restrict the\nadmission of ",(0,s.jsx)(r.code,{children:"hostPID"})," containers."]}),"\n",(0,s.jsx)(r.h3,{id:"524-minimize-the-admission-of-containers-wishing-to-share-the-host-ipc-namespace-automated",children:"5.2.4 Minimize the admission of containers wishing to share the host IPC namespace (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," warn"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nAdd policies to each namespace in the cluster which has user workloads to restrict the\nadmission of ",(0,s.jsx)(r.code,{children:"hostIPC"})," containers."]}),"\n",(0,s.jsx)(r.h3,{id:"525-minimize-the-admission-of-containers-wishing-to-share-the-host-network-namespace-automated",children:"5.2.5 Minimize the admission of containers wishing to share the host network namespace (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," warn"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nAdd policies to each namespace in the cluster which has user workloads to restrict the\nadmission of ",(0,s.jsx)(r.code,{children:"hostNetwork"})," containers."]}),"\n",(0,s.jsx)(r.h3,{id:"526-minimize-the-admission-of-containers-with-allowprivilegeescalation-automated",children:"5.2.6 Minimize the admission of containers with allowPrivilegeEscalation (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," warn"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nAdd policies to each namespace in the cluster which has user workloads to restrict the\nadmission of containers with ",(0,s.jsx)(r.code,{children:".spec.allowPrivilegeEscalation"})," set to ",(0,s.jsx)(r.code,{children:"true"}),"."]}),"\n",(0,s.jsx)(r.h3,{id:"527-minimize-the-admission-of-root-containers-automated",children:"5.2.7 Minimize the admission of root containers (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," warn"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nCreate a policy for each namespace in the cluster, ensuring that either ",(0,s.jsx)(r.code,{children:"MustRunAsNonRoot"}),"\nor ",(0,s.jsx)(r.code,{children:"MustRunAs"})," with the range of UIDs not including 0, is set."]}),"\n",(0,s.jsx)(r.h3,{id:"528-minimize-the-admission-of-containers-with-the-net_raw-capability-automated",children:"5.2.8 Minimize the admission of containers with the NET_RAW capability (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," warn"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nAdd policies to each namespace in the cluster which has user workloads to restrict the\nadmission of containers with the ",(0,s.jsx)(r.code,{children:"NET_RAW"})," capability."]}),"\n",(0,s.jsx)(r.h3,{id:"529-minimize-the-admission-of-containers-with-added-capabilities-automated",children:"5.2.9 Minimize the admission of containers with added capabilities (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," warn"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nEnsure that ",(0,s.jsx)(r.code,{children:"allowedCapabilities"})," is not present in policies for the cluster unless\nit is set to an empty array."]}),"\n",(0,s.jsx)(r.h3,{id:"5210-minimize-the-admission-of-containers-with-capabilities-assigned-manual",children:"5.2.10 Minimize the admission of containers with capabilities assigned (Manual)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," warn"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nReview the use of capabilities in applications running on your cluster. Where a namespace\ncontains applications which do not require any Linux capabilities to operate consider adding\na PSP which forbids the admission of containers which do not drop all capabilities."]}),"\n",(0,s.jsx)(r.h3,{id:"5211-minimize-the-admission-of-windows-hostprocess-containers-manual",children:"5.2.11 Minimize the admission of Windows HostProcess containers (Manual)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," warn"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nAdd policies to each namespace in the cluster which has user workloads to restrict the\nadmission of containers that have ",(0,s.jsx)(r.code,{children:".securityContext.windowsOptions.hostProcess"})," set to ",(0,s.jsx)(r.code,{children:"true"}),"."]}),"\n",(0,s.jsx)(r.h3,{id:"5212-minimize-the-admission-of-hostpath-volumes-manual",children:"5.2.12 Minimize the admission of HostPath volumes (Manual)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," warn"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nAdd policies to each namespace in the cluster which has user workloads to restrict the\nadmission of containers with ",(0,s.jsx)(r.code,{children:"hostPath"})," volumes."]}),"\n",(0,s.jsx)(r.h3,{id:"5213-minimize-the-admission-of-containers-which-use-hostports-manual",children:"5.2.13 Minimize the admission of containers which use HostPorts (Manual)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," warn"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nAdd policies to each namespace in the cluster which has user workloads to restrict the\nadmission of containers which use ",(0,s.jsx)(r.code,{children:"hostPort"})," sections."]}),"\n",(0,s.jsx)(r.h2,{id:"53-network-policies-and-cni",children:"5.3 Network Policies and CNI"}),"\n",(0,s.jsx)(r.h3,{id:"531-ensure-that-the-cni-in-use-supports-networkpolicies-manual",children:"5.3.1 Ensure that the CNI in use supports NetworkPolicies (Manual)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," warn"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nIf the CNI plugin in use does not support network policies, consideration should be given to\nmaking use of a different plugin, or finding an alternate mechanism for restricting traffic\nin the Kubernetes cluster."]}),"\n",(0,s.jsx)(r.h3,{id:"532-ensure-that-all-namespaces-have-networkpolicies-defined-manual",children:"5.3.2 Ensure that all Namespaces have NetworkPolicies defined (Manual)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," warn"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nFollow the documentation and create NetworkPolicy objects as you need them."]}),"\n",(0,s.jsx)(r.h2,{id:"54-secrets-management",children:"5.4 Secrets Management"}),"\n",(0,s.jsx)(r.h3,{id:"541-prefer-using-secrets-as-files-over-secrets-as-environment-variables-manual",children:"5.4.1 Prefer using Secrets as files over Secrets as environment variables (Manual)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," warn"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nIf possible, rewrite application code to read Secrets from mounted secret files, rather than\nfrom environment variables."]}),"\n",(0,s.jsx)(r.h3,{id:"542-consider-external-secret-storage-manual",children:"5.4.2 Consider external secret storage (Manual)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," warn"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nRefer to the Secrets management options offered by your cloud provider or a third-party\nsecrets management solution."]}),"\n",(0,s.jsx)(r.h2,{id:"55-extensible-admission-control",children:"5.5 Extensible Admission Control"}),"\n",(0,s.jsx)(r.h3,{id:"551-configure-image-provenance-using-imagepolicywebhook-admission-controller-manual",children:"5.5.1 Configure Image Provenance using ImagePolicyWebhook admission controller (Manual)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," warn"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nFollow the Kubernetes documentation and setup image provenance."]}),"\n",(0,s.jsx)(r.h2,{id:"57-general-policies",children:"5.7 General Policies"}),"\n",(0,s.jsx)(r.h3,{id:"571-create-administrative-boundaries-between-resources-using-namespaces-manual",children:"5.7.1 Create administrative boundaries between resources using namespaces (Manual)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," warn"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nFollow the documentation and create namespaces for objects in your deployment as you need\nthem."]}),"\n",(0,s.jsx)(r.h3,{id:"572-ensure-that-the-seccomp-profile-is-set-to-dockerdefault-in-your-pod-definitions-manual",children:"5.7.2 Ensure that the seccomp profile is set to docker/default in your Pod definitions (Manual)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," warn"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nUse ",(0,s.jsx)(r.code,{children:"securityContext"})," to enable the docker/default seccomp profile in your pod definitions.\nAn example is as below:\nsecurityContext:\nseccompProfile:\ntype: RuntimeDefault"]}),"\n",(0,s.jsx)(r.h3,{id:"573-apply-securitycontext-to-your-pods-and-containers-manual",children:"5.7.3 Apply SecurityContext to your Pods and Containers (Manual)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," warn"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nFollow the Kubernetes documentation and apply SecurityContexts to your Pods. For a\nsuggested list of SecurityContexts, you may refer to the CIS Security Benchmark for Docker\nContainers."]}),"\n",(0,s.jsx)(r.h3,{id:"574-the-default-namespace-should-not-be-used-manual",children:"5.7.4 The default namespace should not be used (Manual)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," warn"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nEnsure that namespaces are created to allow for appropriate segregation of Kubernetes\nresources and that all new resources are created in a specific namespace."]})]})}function h(e={}){const{wrapper:r}={...(0,n.a)(),...e.components};return r?(0,s.jsx)(r,{...e,children:(0,s.jsx)(d,{...e})}):d(e)}},1151:(e,r,t)=>{t.d(r,{Z:()=>c,a:()=>i});var s=t(7294);const n={},a=s.createContext(n);function i(e){const r=s.useContext(a);return s.useMemo((function(){return"function"==typeof e?e(r):{...r,...e}}),[r,e])}function c(e){let r;return r=e.disableParentContext?"function"==typeof e.components?e.components(n):e.components||n:i(e.components),s.createElement(a.Provider,{value:r},e.children)}}}]); \ No newline at end of file +"use strict";(self.webpackChunkk_3_s_docs=self.webpackChunkk_3_s_docs||[]).push([[3189],{9297:(e,r,t)=>{t.r(r),t.d(r,{assets:()=>l,contentTitle:()=>i,default:()=>h,frontMatter:()=>a,metadata:()=>c,toc:()=>o});var s=t(5893),n=t(1151);const a={title:"CIS 1.23 Self Assessment Guide"},i=void 0,c={id:"security/self-assessment-1.23",title:"CIS 1.23 Self Assessment Guide",description:"Overview",source:"@site/docs/security/self-assessment-1.23.md",sourceDirName:"security",slug:"/security/self-assessment-1.23",permalink:"/security/self-assessment-1.23",draft:!1,unlisted:!1,editUrl:"https://github.com/k3s-io/docs/edit/main/docs/security/self-assessment-1.23.md",tags:[],version:"current",lastUpdatedAt:1723747404e3,frontMatter:{title:"CIS 1.23 Self Assessment Guide"}},l={},o=[{value:"Overview",id:"overview",level:2},{value:"Testing controls methodology",id:"testing-controls-methodology",level:3},{value:"1.1 Control Plane Node Configuration Files",id:"11-control-plane-node-configuration-files",level:2},{value:"1.1.1 Ensure that the API server pod specification file permissions are set to 644 or more restrictive (Automated)",id:"111-ensure-that-the-api-server-pod-specification-file-permissions-are-set-to-644-or-more-restrictive-automated",level:3},{value:"1.1.2 Ensure that the API server pod specification file ownership is set to root (Automated)",id:"112-ensure-that-the-api-server-pod-specification-file-ownership-is-set-to-root-automated",level:3},{value:"1.1.3 Ensure that the controller manager pod specification file permissions are set to 644 or more restrictive (Automated)",id:"113-ensure-that-the-controller-manager-pod-specification-file-permissions-are-set-to-644-or-more-restrictive-automated",level:3},{value:"1.1.4 Ensure that the controller manager pod specification file ownership is set to root (Automated)",id:"114-ensure-that-the-controller-manager-pod-specification-file-ownership-is-set-to-root-automated",level:3},{value:"1.1.5 Ensure that the scheduler pod specification file permissions are set to 644 or more restrictive (Automated)",id:"115-ensure-that-the-scheduler-pod-specification-file-permissions-are-set-to-644-or-more-restrictive-automated",level:3},{value:"1.1.6 Ensure that the scheduler pod specification file ownership is set to root (Automated)",id:"116-ensure-that-the-scheduler-pod-specification-file-ownership-is-set-to-root-automated",level:3},{value:"1.1.7 Ensure that the etcd pod specification file permissions are set to 644 or more restrictive (Automated)",id:"117-ensure-that-the-etcd-pod-specification-file-permissions-are-set-to-644-or-more-restrictive-automated",level:3},{value:"1.1.8 Ensure that the etcd pod specification file ownership is set to root (Automated)",id:"118-ensure-that-the-etcd-pod-specification-file-ownership-is-set-to-root-automated",level:3},{value:"1.1.9 Ensure that the Container Network Interface file permissions are set to 644 or more restrictive (Manual)",id:"119-ensure-that-the-container-network-interface-file-permissions-are-set-to-644-or-more-restrictive-manual",level:3},{value:"1.1.10 Ensure that the Container Network Interface file ownership is set to root (Manual)",id:"1110-ensure-that-the-container-network-interface-file-ownership-is-set-to-root-manual",level:3},{value:"1.1.11 Ensure that the etcd data directory permissions are set to 700 or more restrictive (Automated)",id:"1111-ensure-that-the-etcd-data-directory-permissions-are-set-to-700-or-more-restrictive-automated",level:3},{value:"1.1.12 Ensure that the etcd data directory ownership is set to etcd (Automated)",id:"1112-ensure-that-the-etcd-data-directory-ownership-is-set-to-etcd-automated",level:3},{value:"1.1.13 Ensure that the admin.conf file permissions are set to 600 or more restrictive (Automated)",id:"1113-ensure-that-the-adminconf-file-permissions-are-set-to-600-or-more-restrictive-automated",level:3},{value:"1.1.14 Ensure that the admin.conf file ownership is set to root (Automated)",id:"1114-ensure-that-the-adminconf-file-ownership-is-set-to-root-automated",level:3},{value:"1.1.15 Ensure that the scheduler.conf file permissions are set to 644 or more restrictive (Automated)",id:"1115-ensure-that-the-schedulerconf-file-permissions-are-set-to-644-or-more-restrictive-automated",level:3},{value:"1.1.16 Ensure that the scheduler.conf file ownership is set to root (Automated)",id:"1116-ensure-that-the-schedulerconf-file-ownership-is-set-to-root-automated",level:3},{value:"1.1.17 Ensure that the controller-manager.conf file permissions are set to 644 or more restrictive (Automated)",id:"1117-ensure-that-the-controller-managerconf-file-permissions-are-set-to-644-or-more-restrictive-automated",level:3},{value:"1.1.18 Ensure that the controller-manager.conf file ownership is set to root (Automated)",id:"1118-ensure-that-the-controller-managerconf-file-ownership-is-set-to-root-automated",level:3},{value:"1.1.19 Ensure that the Kubernetes PKI directory and file ownership is set to root (Automated)",id:"1119-ensure-that-the-kubernetes-pki-directory-and-file-ownership-is-set-to-root-automated",level:3},{value:"1.1.20 Ensure that the Kubernetes PKI certificate file permissions are set to 644 or more restrictive (Manual)",id:"1120-ensure-that-the-kubernetes-pki-certificate-file-permissions-are-set-to-644-or-more-restrictive-manual",level:3},{value:"1.1.21 Ensure that the Kubernetes PKI key file permissions are set to 600 (Manual)",id:"1121-ensure-that-the-kubernetes-pki-key-file-permissions-are-set-to-600-manual",level:3},{value:"1.2 API Server",id:"12-api-server",level:2},{value:"1.2.1 Ensure that the --anonymous-auth argument is set to false (Manual)",id:"121-ensure-that-the---anonymous-auth-argument-is-set-to-false-manual",level:3},{value:"1.2.2 Ensure that the --token-auth-file parameter is not set (Automated)",id:"122-ensure-that-the---token-auth-file-parameter-is-not-set-automated",level:3},{value:"1.2.3 Ensure that the --DenyServiceExternalIPs is not set (Automated)",id:"123-ensure-that-the---denyserviceexternalips-is-not-set-automated",level:3},{value:"1.2.4 Ensure that the --kubelet-https argument is set to true (Automated)",id:"124-ensure-that-the---kubelet-https-argument-is-set-to-true-automated",level:3},{value:"1.2.5 Ensure that the --kubelet-client-certificate and --kubelet-client-key arguments are set as appropriate (Automated)",id:"125-ensure-that-the---kubelet-client-certificate-and---kubelet-client-key-arguments-are-set-as-appropriate-automated",level:3},{value:"1.2.6 Ensure that the --kubelet-certificate-authority argument is set as appropriate (Automated)",id:"126-ensure-that-the---kubelet-certificate-authority-argument-is-set-as-appropriate-automated",level:3},{value:"1.2.7 Ensure that the --authorization-mode argument is not set to AlwaysAllow (Automated)",id:"127-ensure-that-the---authorization-mode-argument-is-not-set-to-alwaysallow-automated",level:3},{value:"1.2.8 Ensure that the --authorization-mode argument includes Node (Automated)",id:"128-ensure-that-the---authorization-mode-argument-includes-node-automated",level:3},{value:"1.2.9 Ensure that the --authorization-mode argument includes RBAC (Automated)",id:"129-ensure-that-the---authorization-mode-argument-includes-rbac-automated",level:3},{value:"1.2.10 Ensure that the admission control plugin EventRateLimit is set (Manual)",id:"1210-ensure-that-the-admission-control-plugin-eventratelimit-is-set-manual",level:3},{value:"1.2.11 Ensure that the admission control plugin AlwaysAdmit is not set (Automated)",id:"1211-ensure-that-the-admission-control-plugin-alwaysadmit-is-not-set-automated",level:3},{value:"1.2.12 Ensure that the admission control plugin AlwaysPullImages is set (Manual)",id:"1212-ensure-that-the-admission-control-plugin-alwayspullimages-is-set-manual",level:3},{value:"1.2.13 Ensure that the admission control plugin SecurityContextDeny is set if PodSecurityPolicy is not used (Manual)",id:"1213-ensure-that-the-admission-control-plugin-securitycontextdeny-is-set-if-podsecuritypolicy-is-not-used-manual",level:3},{value:"1.2.14 Ensure that the admission control plugin ServiceAccount is set (Automated)",id:"1214-ensure-that-the-admission-control-plugin-serviceaccount-is-set-automated",level:3},{value:"1.2.15 Ensure that the admission control plugin NamespaceLifecycle is set (Automated)",id:"1215-ensure-that-the-admission-control-plugin-namespacelifecycle-is-set-automated",level:3},{value:"1.2.16 Ensure that the admission control plugin NodeRestriction is set (Automated)",id:"1216-ensure-that-the-admission-control-plugin-noderestriction-is-set-automated",level:3},{value:"1.2.17 Ensure that the --secure-port argument is not set to 0 (Automated)",id:"1217-ensure-that-the---secure-port-argument-is-not-set-to-0-automated",level:3},{value:"1.2.18 Ensure that the --profiling argument is set to false (Automated)",id:"1218-ensure-that-the---profiling-argument-is-set-to-false-automated",level:3},{value:"1.2.19 Ensure that the --audit-log-path argument is set (Automated)",id:"1219-ensure-that-the---audit-log-path-argument-is-set-automated",level:3},{value:"1.2.20 Ensure that the --audit-log-maxage argument is set to 30 or as appropriate (Automated)",id:"1220-ensure-that-the---audit-log-maxage-argument-is-set-to-30-or-as-appropriate-automated",level:3},{value:"1.2.21 Ensure that the --audit-log-maxbackup argument is set to 10 or as appropriate (Automated)",id:"1221-ensure-that-the---audit-log-maxbackup-argument-is-set-to-10-or-as-appropriate-automated",level:3},{value:"1.2.22 Ensure that the --audit-log-maxsize argument is set to 100 or as appropriate (Automated)",id:"1222-ensure-that-the---audit-log-maxsize-argument-is-set-to-100-or-as-appropriate-automated",level:3},{value:"1.2.24 Ensure that the --service-account-lookup argument is set to true (Automated)",id:"1224-ensure-that-the---service-account-lookup-argument-is-set-to-true-automated",level:3},{value:"1.2.25 Ensure that the --request-timeout argument is set as appropriate (Automated)",id:"1225-ensure-that-the---request-timeout-argument-is-set-as-appropriate-automated",level:3},{value:"1.2.26 Ensure that the --etcd-certfile and --etcd-keyfile arguments are set as appropriate (Automated)",id:"1226-ensure-that-the---etcd-certfile-and---etcd-keyfile-arguments-are-set-as-appropriate-automated",level:3},{value:"1.2.27 Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate (Automated)",id:"1227-ensure-that-the---tls-cert-file-and---tls-private-key-file-arguments-are-set-as-appropriate-automated",level:3},{value:"1.2.28 Ensure that the --client-ca-file argument is set as appropriate (Automated)",id:"1228-ensure-that-the---client-ca-file-argument-is-set-as-appropriate-automated",level:3},{value:"1.2.29 Ensure that the --etcd-cafile argument is set as appropriate (Automated)",id:"1229-ensure-that-the---etcd-cafile-argument-is-set-as-appropriate-automated",level:3},{value:"1.2.30 Ensure that the --encryption-provider-config argument is set as appropriate (Manual)",id:"1230-ensure-that-the---encryption-provider-config-argument-is-set-as-appropriate-manual",level:3},{value:"1.2.31 Ensure that encryption providers are appropriately configured (Manual)",id:"1231-ensure-that-encryption-providers-are-appropriately-configured-manual",level:3},{value:"1.2.32 Ensure that the API Server only makes use of Strong Cryptographic Ciphers (Manual)",id:"1232-ensure-that-the-api-server-only-makes-use-of-strong-cryptographic-ciphers-manual",level:3},{value:"1.3 Controller Manager",id:"13-controller-manager",level:2},{value:"1.3.1 Ensure that the --terminated-pod-gc-threshold argument is set as appropriate (Manual)",id:"131-ensure-that-the---terminated-pod-gc-threshold-argument-is-set-as-appropriate-manual",level:3},{value:"1.3.2 Ensure that the --profiling argument is set to false (Automated)",id:"132-ensure-that-the---profiling-argument-is-set-to-false-automated",level:3},{value:"1.3.3 Ensure that the --use-service-account-credentials argument is set to true (Automated)",id:"133-ensure-that-the---use-service-account-credentials-argument-is-set-to-true-automated",level:3},{value:"1.3.4 Ensure that the --service-account-private-key-file argument is set as appropriate (Automated)",id:"134-ensure-that-the---service-account-private-key-file-argument-is-set-as-appropriate-automated",level:3},{value:"1.3.5 Ensure that the --root-ca-file argument is set as appropriate (Automated)",id:"135-ensure-that-the---root-ca-file-argument-is-set-as-appropriate-automated",level:3},{value:"1.3.6 Ensure that the RotateKubeletServerCertificate argument is set to true (Automated)",id:"136-ensure-that-the-rotatekubeletservercertificate-argument-is-set-to-true-automated",level:3},{value:"1.3.7 Ensure that the --bind-address argument is set to 127.0.0.1 (Automated)",id:"137-ensure-that-the---bind-address-argument-is-set-to-127001-automated",level:3},{value:"1.4 Scheduler",id:"14-scheduler",level:2},{value:"1.4.1 Ensure that the --profiling argument is set to false (Automated)",id:"141-ensure-that-the---profiling-argument-is-set-to-false-automated",level:3},{value:"1.4.2 Ensure that the --bind-address argument is set to 127.0.0.1 (Automated)",id:"142-ensure-that-the---bind-address-argument-is-set-to-127001-automated",level:3},{value:"2 Etcd Node Configuration",id:"2-etcd-node-configuration",level:2},{value:"2.1 Ensure that the --cert-file and --key-file arguments are set as appropriate (Automated)",id:"21-ensure-that-the---cert-file-and---key-file-arguments-are-set-as-appropriate-automated",level:3},{value:"2.2 Ensure that the --client-cert-auth argument is set to true (Automated)",id:"22-ensure-that-the---client-cert-auth-argument-is-set-to-true-automated",level:3},{value:"2.3 Ensure that the --auto-tls argument is not set to true (Automated)",id:"23-ensure-that-the---auto-tls-argument-is-not-set-to-true-automated",level:3},{value:"2.4 Ensure that the --peer-cert-file and --peer-key-file arguments are set as appropriate (Automated)",id:"24-ensure-that-the---peer-cert-file-and---peer-key-file-arguments-are-set-as-appropriate-automated",level:3},{value:"2.5 Ensure that the --peer-client-cert-auth argument is set to true (Automated)",id:"25-ensure-that-the---peer-client-cert-auth-argument-is-set-to-true-automated",level:3},{value:"2.6 Ensure that the --peer-auto-tls argument is not set to true (Automated)",id:"26-ensure-that-the---peer-auto-tls-argument-is-not-set-to-true-automated",level:3},{value:"2.7 Ensure that a unique Certificate Authority is used for etcd (Manual)",id:"27-ensure-that-a-unique-certificate-authority-is-used-for-etcd-manual",level:3},{value:"3.1 Authentication and Authorization",id:"31-authentication-and-authorization",level:2},{value:"3.1.1 Client certificate authentication should not be used for users (Manual)",id:"311-client-certificate-authentication-should-not-be-used-for-users-manual",level:3},{value:"3.2 Logging",id:"32-logging",level:2},{value:"3.2.1 Ensure that a minimal audit policy is created (Manual)",id:"321-ensure-that-a-minimal-audit-policy-is-created-manual",level:3},{value:"3.2.2 Ensure that the audit policy covers key security concerns (Manual)",id:"322-ensure-that-the-audit-policy-covers-key-security-concerns-manual",level:3},{value:"4.1 Worker Node Configuration Files",id:"41-worker-node-configuration-files",level:2},{value:"4.1.1 Ensure that the kubelet service file permissions are set to 644 or more restrictive (Automated)",id:"411-ensure-that-the-kubelet-service-file-permissions-are-set-to-644-or-more-restrictive-automated",level:3},{value:"4.1.2 Ensure that the kubelet service file ownership is set to root (Automated)",id:"412-ensure-that-the-kubelet-service-file-ownership-is-set-to-root-automated",level:3},{value:"4.1.3 If proxy kubeconfig file exists ensure permissions are set to 644 or more restrictive (Manual)",id:"413-if-proxy-kubeconfig-file-exists-ensure-permissions-are-set-to-644-or-more-restrictive-manual",level:3},{value:"4.1.4 If proxy kubeconfig file exists ensure ownership is set to root (Manual)",id:"414-if-proxy-kubeconfig-file-exists-ensure-ownership-is-set-to-root-manual",level:3},{value:"4.1.5 Ensure that the --kubeconfig kubelet.conf file permissions are set to 644 or more restrictive (Automated)",id:"415-ensure-that-the---kubeconfig-kubeletconf-file-permissions-are-set-to-644-or-more-restrictive-automated",level:3},{value:"4.1.6 Ensure that the --kubeconfig kubelet.conf file ownership is set to root (Automated)",id:"416-ensure-that-the---kubeconfig-kubeletconf-file-ownership-is-set-to-root-automated",level:3},{value:"4.1.7 Ensure that the certificate authorities file permissions are set to 644 or more restrictive (Manual)",id:"417-ensure-that-the-certificate-authorities-file-permissions-are-set-to-644-or-more-restrictive-manual",level:3},{value:"4.1.8 Ensure that the client certificate authorities file ownership is set to root (Manual)",id:"418-ensure-that-the-client-certificate-authorities-file-ownership-is-set-to-root-manual",level:3},{value:"4.1.9 Ensure that the kubelet --config configuration file has permissions set to 644 or more restrictive (Automated)",id:"419-ensure-that-the-kubelet---config-configuration-file-has-permissions-set-to-644-or-more-restrictive-automated",level:3},{value:"4.1.10 Ensure that the kubelet --config configuration file ownership is set to root (Automated)",id:"4110-ensure-that-the-kubelet---config-configuration-file-ownership-is-set-to-root-automated",level:3},{value:"4.2 Kubelet",id:"42-kubelet",level:2},{value:"4.2.1 Ensure that the --anonymous-auth argument is set to false (Automated)",id:"421-ensure-that-the---anonymous-auth-argument-is-set-to-false-automated",level:3},{value:"4.2.2 Ensure that the --authorization-mode argument is not set to AlwaysAllow (Automated)",id:"422-ensure-that-the---authorization-mode-argument-is-not-set-to-alwaysallow-automated",level:3},{value:"4.2.3 Ensure that the --client-ca-file argument is set as appropriate (Automated)",id:"423-ensure-that-the---client-ca-file-argument-is-set-as-appropriate-automated",level:3},{value:"4.2.4 Ensure that the --read-only-port argument is set to 0 (Manual)",id:"424-ensure-that-the---read-only-port-argument-is-set-to-0-manual",level:3},{value:"4.2.5 Ensure that the --streaming-connection-idle-timeout argument is not set to 0 (Manual)",id:"425-ensure-that-the---streaming-connection-idle-timeout-argument-is-not-set-to-0-manual",level:3},{value:"4.2.6 Ensure that the --protect-kernel-defaults argument is set to true (Automated)",id:"426-ensure-that-the---protect-kernel-defaults-argument-is-set-to-true-automated",level:3},{value:"4.2.7 Ensure that the --make-iptables-util-chains argument is set to true (Automated)",id:"427-ensure-that-the---make-iptables-util-chains-argument-is-set-to-true-automated",level:3},{value:"4.2.8 Ensure that the --hostname-override argument is not set (Manual)",id:"428-ensure-that-the---hostname-override-argument-is-not-set-manual",level:3},{value:"4.2.9 Ensure that the --event-qps argument is set to 0 or a level which ensures appropriate event capture (Manual)",id:"429-ensure-that-the---event-qps-argument-is-set-to-0-or-a-level-which-ensures-appropriate-event-capture-manual",level:3},{value:"4.2.10 Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate (Manual)",id:"4210-ensure-that-the---tls-cert-file-and---tls-private-key-file-arguments-are-set-as-appropriate-manual",level:3},{value:"4.2.11 Ensure that the --rotate-certificates argument is not set to false (Automated)",id:"4211-ensure-that-the---rotate-certificates-argument-is-not-set-to-false-automated",level:3},{value:"4.2.12 Verify that the RotateKubeletServerCertificate argument is set to true (Manual)",id:"4212-verify-that-the-rotatekubeletservercertificate-argument-is-set-to-true-manual",level:3},{value:"4.2.13 Ensure that the Kubelet only makes use of Strong Cryptographic Ciphers (Manual)",id:"4213-ensure-that-the-kubelet-only-makes-use-of-strong-cryptographic-ciphers-manual",level:3},{value:"5.1 RBAC and Service Accounts",id:"51-rbac-and-service-accounts",level:2},{value:"5.1.1 Ensure that the cluster-admin role is only used where required (Manual)",id:"511-ensure-that-the-cluster-admin-role-is-only-used-where-required-manual",level:3},{value:"5.1.2 Minimize access to secrets (Manual)",id:"512-minimize-access-to-secrets-manual",level:3},{value:"5.1.3 Minimize wildcard use in Roles and ClusterRoles (Manual)",id:"513-minimize-wildcard-use-in-roles-and-clusterroles-manual",level:3},{value:"5.1.4 Minimize access to create pods (Manual)",id:"514-minimize-access-to-create-pods-manual",level:3},{value:"5.1.5 Ensure that default service accounts are not actively used. (Manual)",id:"515-ensure-that-default-service-accounts-are-not-actively-used-manual",level:3},{value:"5.1.6 Ensure that Service Account Tokens are only mounted where necessary (Manual)",id:"516-ensure-that-service-account-tokens-are-only-mounted-where-necessary-manual",level:3},{value:"5.1.7 Avoid use of system group (Manual)",id:"517-avoid-use-of-system-group-manual",level:3},{value:"5.1.8 Limit use of the Bind, Impersonate and Escalate permissions in the Kubernetes cluster (Manual)",id:"518-limit-use-of-the-bind-impersonate-and-escalate-permissions-in-the-kubernetes-cluster-manual",level:3},{value:"5.2 Pod Security Standards",id:"52-pod-security-standards",level:2},{value:"5.2.1 Ensure that the cluster has at least one active policy control mechanism in place (Manual)",id:"521-ensure-that-the-cluster-has-at-least-one-active-policy-control-mechanism-in-place-manual",level:3},{value:"5.2.2 Minimize the admission of privileged containers (Automated)",id:"522-minimize-the-admission-of-privileged-containers-automated",level:3},{value:"5.2.3 Minimize the admission of containers wishing to share the host process ID namespace (Automated)",id:"523-minimize-the-admission-of-containers-wishing-to-share-the-host-process-id-namespace-automated",level:3},{value:"5.2.4 Minimize the admission of containers wishing to share the host IPC namespace (Automated)",id:"524-minimize-the-admission-of-containers-wishing-to-share-the-host-ipc-namespace-automated",level:3},{value:"5.2.5 Minimize the admission of containers wishing to share the host network namespace (Automated)",id:"525-minimize-the-admission-of-containers-wishing-to-share-the-host-network-namespace-automated",level:3},{value:"5.2.6 Minimize the admission of containers with allowPrivilegeEscalation (Automated)",id:"526-minimize-the-admission-of-containers-with-allowprivilegeescalation-automated",level:3},{value:"5.2.7 Minimize the admission of root containers (Automated)",id:"527-minimize-the-admission-of-root-containers-automated",level:3},{value:"5.2.8 Minimize the admission of containers with the NET_RAW capability (Automated)",id:"528-minimize-the-admission-of-containers-with-the-net_raw-capability-automated",level:3},{value:"5.2.9 Minimize the admission of containers with added capabilities (Automated)",id:"529-minimize-the-admission-of-containers-with-added-capabilities-automated",level:3},{value:"5.2.10 Minimize the admission of containers with capabilities assigned (Manual)",id:"5210-minimize-the-admission-of-containers-with-capabilities-assigned-manual",level:3},{value:"5.2.11 Minimize the admission of Windows HostProcess containers (Manual)",id:"5211-minimize-the-admission-of-windows-hostprocess-containers-manual",level:3},{value:"5.2.12 Minimize the admission of HostPath volumes (Manual)",id:"5212-minimize-the-admission-of-hostpath-volumes-manual",level:3},{value:"5.2.13 Minimize the admission of containers which use HostPorts (Manual)",id:"5213-minimize-the-admission-of-containers-which-use-hostports-manual",level:3},{value:"5.3 Network Policies and CNI",id:"53-network-policies-and-cni",level:2},{value:"5.3.1 Ensure that the CNI in use supports NetworkPolicies (Manual)",id:"531-ensure-that-the-cni-in-use-supports-networkpolicies-manual",level:3},{value:"5.3.2 Ensure that all Namespaces have NetworkPolicies defined (Manual)",id:"532-ensure-that-all-namespaces-have-networkpolicies-defined-manual",level:3},{value:"5.4 Secrets Management",id:"54-secrets-management",level:2},{value:"5.4.1 Prefer using Secrets as files over Secrets as environment variables (Manual)",id:"541-prefer-using-secrets-as-files-over-secrets-as-environment-variables-manual",level:3},{value:"5.4.2 Consider external secret storage (Manual)",id:"542-consider-external-secret-storage-manual",level:3},{value:"5.5 Extensible Admission Control",id:"55-extensible-admission-control",level:2},{value:"5.5.1 Configure Image Provenance using ImagePolicyWebhook admission controller (Manual)",id:"551-configure-image-provenance-using-imagepolicywebhook-admission-controller-manual",level:3},{value:"5.7 General Policies",id:"57-general-policies",level:2},{value:"5.7.1 Create administrative boundaries between resources using namespaces (Manual)",id:"571-create-administrative-boundaries-between-resources-using-namespaces-manual",level:3},{value:"5.7.2 Ensure that the seccomp profile is set to docker/default in your Pod definitions (Manual)",id:"572-ensure-that-the-seccomp-profile-is-set-to-dockerdefault-in-your-pod-definitions-manual",level:3},{value:"5.7.3 Apply SecurityContext to your Pods and Containers (Manual)",id:"573-apply-securitycontext-to-your-pods-and-containers-manual",level:3},{value:"5.7.4 The default namespace should not be used (Manual)",id:"574-the-default-namespace-should-not-be-used-manual",level:3}];function d(e){const r={a:"a",blockquote:"blockquote",code:"code",h2:"h2",h3:"h3",li:"li",p:"p",pre:"pre",strong:"strong",ul:"ul",...(0,n.a)(),...e.components};return(0,s.jsxs)(s.Fragment,{children:[(0,s.jsx)(r.h2,{id:"overview",children:"Overview"}),"\n",(0,s.jsxs)(r.p,{children:["This document is a companion to the ",(0,s.jsx)(r.a,{href:"/security/hardening-guide",children:"K3s security hardening guide"}),". The hardening guide provides prescriptive guidance for hardening a production installation of K3s, and this benchmark guide is meant to help you evaluate the level of security of the hardened cluster against each control in the CIS Kubernetes Benchmark. It is to be used by K3s operators, security teams, auditors, and decision-makers."]}),"\n",(0,s.jsxs)(r.p,{children:["This guide is specific to the ",(0,s.jsx)(r.strong,{children:"v1.22-v1.23"})," release lines of K3s and the ",(0,s.jsx)(r.strong,{children:"v1.23"})," release of the CIS Kubernetes Benchmark."]}),"\n",(0,s.jsxs)(r.p,{children:["For more information about each control, including detailed descriptions and remediations for failing tests, you can refer to the corresponding section of the CIS Kubernetes Benchmark v1.6. You can download the benchmark, after creating a free account, in ",(0,s.jsx)(r.a,{href:"https://www.cisecurity.org/benchmark/kubernetes/",children:"Center for Internet Security (CIS)"}),"."]}),"\n",(0,s.jsx)(r.h3,{id:"testing-controls-methodology",children:"Testing controls methodology"}),"\n",(0,s.jsx)(r.p,{children:"Each control in the CIS Kubernetes Benchmark was evaluated against a K3s cluster that was configured according to the accompanying hardening guide."}),"\n",(0,s.jsx)(r.p,{children:"Where control audits differ from the original CIS benchmark, the audit commands specific to K3s are provided for testing."}),"\n",(0,s.jsx)(r.p,{children:"These are the possible results for each control:"}),"\n",(0,s.jsxs)(r.ul,{children:["\n",(0,s.jsxs)(r.li,{children:[(0,s.jsx)(r.strong,{children:"Pass"})," - The K3s cluster under test passed the audit outlined in the benchmark."]}),"\n",(0,s.jsxs)(r.li,{children:[(0,s.jsx)(r.strong,{children:"Not Applicable"})," - The control is not applicable to K3s because of how it is designed to operate. The remediation section will explain why this is so."]}),"\n",(0,s.jsxs)(r.li,{children:[(0,s.jsx)(r.strong,{children:"Warn"})," - The control is manual in the CIS benchmark and it depends on the cluster's use case or some other factor that must be determined by the cluster operator. These controls have been evaluated to ensure K3s does not prevent their implementation, but no further configuration or auditing of the cluster under test has been performed."]}),"\n"]}),"\n",(0,s.jsx)(r.p,{children:'This guide makes the assumption that K3s is running as a Systemd unit. Your installation may vary and will require you to adjust the "audit" commands to fit your scenario.'}),"\n",(0,s.jsxs)(r.blockquote,{children:["\n",(0,s.jsxs)(r.p,{children:["NOTE: Only ",(0,s.jsx)(r.code,{children:"automated"})," tests (previously called ",(0,s.jsx)(r.code,{children:"scored"}),") are covered in this guide."]}),"\n"]}),"\n",(0,s.jsx)(r.h2,{id:"11-control-plane-node-configuration-files",children:"1.1 Control Plane Node Configuration Files"}),"\n",(0,s.jsx)(r.h3,{id:"111-ensure-that-the-api-server-pod-specification-file-permissions-are-set-to-644-or-more-restrictive-automated",children:"1.1.1 Ensure that the API server pod specification file permissions are set to 644 or more restrictive (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," Not Applicable"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nRun the below command (based on the file location on your system) on the\ncontrol plane node.\nFor example, ",(0,s.jsx)(r.code,{children:"chmod 644 /etc/kubernetes/manifests/kube-apiserver.yaml"})]}),"\n",(0,s.jsxs)(r.h3,{id:"112-ensure-that-the-api-server-pod-specification-file-ownership-is-set-to-root-automated",children:["1.1.2 Ensure that the API server pod specification file ownership is set to root",":root"," (Automated)"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," Not Applicable"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nRun the below command (based on the file location on your system) on the control plane node.\nFor example, ",(0,s.jsx)(r.code,{children:"chown root:root /etc/kubernetes/manifests/kube-apiserver.yaml"})]}),"\n",(0,s.jsx)(r.h3,{id:"113-ensure-that-the-controller-manager-pod-specification-file-permissions-are-set-to-644-or-more-restrictive-automated",children:"1.1.3 Ensure that the controller manager pod specification file permissions are set to 644 or more restrictive (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," Not Applicable"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nRun the below command (based on the file location on your system) on the control plane node.\nFor example, ",(0,s.jsx)(r.code,{children:"chmod 644 /etc/kubernetes/manifests/kube-controller-manager.yaml"})]}),"\n",(0,s.jsxs)(r.h3,{id:"114-ensure-that-the-controller-manager-pod-specification-file-ownership-is-set-to-root-automated",children:["1.1.4 Ensure that the controller manager pod specification file ownership is set to root",":root"," (Automated)"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," Not Applicable"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nRun the below command (based on the file location on your system) on the control plane node.\nFor example, ",(0,s.jsx)(r.code,{children:"chown root:root /etc/kubernetes/manifests/kube-controller-manager.yaml"})]}),"\n",(0,s.jsx)(r.h3,{id:"115-ensure-that-the-scheduler-pod-specification-file-permissions-are-set-to-644-or-more-restrictive-automated",children:"1.1.5 Ensure that the scheduler pod specification file permissions are set to 644 or more restrictive (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," Not Applicable"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nRun the below command (based on the file location on your system) on the control plane node.\nFor example, ",(0,s.jsx)(r.code,{children:"chmod 644 /etc/kubernetes/manifests/kube-scheduler.yaml"})]}),"\n",(0,s.jsxs)(r.h3,{id:"116-ensure-that-the-scheduler-pod-specification-file-ownership-is-set-to-root-automated",children:["1.1.6 Ensure that the scheduler pod specification file ownership is set to root",":root"," (Automated)"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," Not Applicable"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nRun the below command (based on the file location on your system) on the control plane node.\nFor example, ",(0,s.jsx)(r.code,{children:"chown root:root /etc/kubernetes/manifests/kube-scheduler.yaml"})]}),"\n",(0,s.jsx)(r.h3,{id:"117-ensure-that-the-etcd-pod-specification-file-permissions-are-set-to-644-or-more-restrictive-automated",children:"1.1.7 Ensure that the etcd pod specification file permissions are set to 644 or more restrictive (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," Not Applicable"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nRun the below command (based on the file location on your system) on the control plane node.\nFor example, ",(0,s.jsx)(r.code,{children:"chmod 644 /etc/kubernetes/manifests/etcd.yaml"})]}),"\n",(0,s.jsxs)(r.h3,{id:"118-ensure-that-the-etcd-pod-specification-file-ownership-is-set-to-root-automated",children:["1.1.8 Ensure that the etcd pod specification file ownership is set to root",":root"," (Automated)"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," Not Applicable"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nRun the below command (based on the file location on your system) on the control plane node.\nFor example, ",(0,s.jsx)(r.code,{children:"chown root:root /etc/kubernetes/manifests/etcd.yaml"})]}),"\n",(0,s.jsx)(r.h3,{id:"119-ensure-that-the-container-network-interface-file-permissions-are-set-to-644-or-more-restrictive-manual",children:"1.1.9 Ensure that the Container Network Interface file permissions are set to 644 or more restrictive (Manual)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," Not Applicable"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nRun the below command (based on the file location on your system) on the control plane node.\nFor example, ",(0,s.jsx)(r.code,{children:"chmod 644 "})]}),"\n",(0,s.jsxs)(r.h3,{id:"1110-ensure-that-the-container-network-interface-file-ownership-is-set-to-root-manual",children:["1.1.10 Ensure that the Container Network Interface file ownership is set to root",":root"," (Manual)"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," Not Applicable"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nRun the below command (based on the file location on your system) on the control plane node.\nFor example, ",(0,s.jsx)(r.code,{children:"chown root:root "})]}),"\n",(0,s.jsx)(r.h3,{id:"1111-ensure-that-the-etcd-data-directory-permissions-are-set-to-700-or-more-restrictive-automated",children:"1.1.11 Ensure that the etcd data directory permissions are set to 700 or more restrictive (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," pass"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nOn the etcd server node, get the etcd data directory, passed as an argument --data-dir,\nfrom the command 'ps -ef | grep etcd'.\nRun the below command (based on the etcd data directory found above). For example,\nchmod 700 /var/lib/etcd"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Audit Script:"})," ",(0,s.jsx)(r.code,{children:"check_for_k3s_etcd.sh"})]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:'#!/bin/bash\n\n# This script is used to ensure that k3s is actually running etcd (and not other databases like sqlite3)\n# before it checks the requirement\nset -eE\n\nhandle_error() {\n echo "false"\n}\n\ntrap \'handle_error\' ERR\n\n\nif [[ "$(journalctl -D /var/log/journal -u k3s | grep \'Managed etcd cluster initializing\' | grep -v grep | wc -l)" -gt 0 ]]; then\n case $1 in \n "1.1.11")\n echo $(stat -c %a /var/lib/rancher/k3s/server/db/etcd);;\n "1.2.29")\n echo $(journalctl -D /var/log/journal -u k3s | grep \'Running kube-apiserver\' | tail -n1 | grep \'etcd-\');;\n "2.1")\n echo $(grep -A 5 \'client-transport-security\' /var/lib/rancher/k3s/server/db/etcd/config | grep -E \'cert-file|key-file\');;\n "2.2")\n echo $(grep -A 5 \'client-transport-security\' /var/lib/rancher/k3s/server/db/etcd/config | grep \'client-cert-auth\');;\n "2.3")\n echo $(grep \'auto-tls\' /var/lib/rancher/k3s/server/db/etcd/config);;\n "2.4")\n echo $(grep -A 5 \'peer-transport-security\' /var/lib/rancher/k3s/server/db/etcd/config | grep -E \'cert-file|key-file\');;\n "2.5")\n echo $(grep -A 5 \'peer-transport-security\' /var/lib/rancher/k3s/server/db/etcd/config | grep \'client-cert-auth\');;\n "2.6")\n echo $(grep \'peer-auto-tls\' /var/lib/rancher/k3s/server/db/etcd/config);;\n "2.7")\n echo $(grep \'trusted-ca-file\' /var/lib/rancher/k3s/server/db/etcd/config);;\n esac\nelse\n# If another database is running, return whatever is required to pass the scan\n case $1 in\n "1.1.11")\n echo "700";;\n "1.2.29")\n echo "--etcd-certfile AND --etcd-keyfile";;\n "2.1")\n echo "cert-file AND key-file";;\n "2.2")\n echo "--client-cert-auth=true";;\n "2.3")\n echo "false";;\n "2.4")\n echo "peer-cert-file AND peer-key-file";;\n "2.5")\n echo "--client-cert-auth=true";;\n "2.6")\n echo "--peer-auto-tls=false";;\n "2.7")\n echo "--trusted-ca-file";;\n esac\nfi\n\n'})}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit Execution:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"./check_for_k3s_etcd.sh 1.1.11\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result"}),":"]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:"'700' is equal to '700'\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Returned Value"}),":"]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:"700\n"})}),"\n",(0,s.jsxs)(r.h3,{id:"1112-ensure-that-the-etcd-data-directory-ownership-is-set-to-etcd-automated",children:["1.1.12 Ensure that the etcd data directory ownership is set to etcd",":etcd"," (Automated)"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," Not Applicable"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nOn the etcd server node, get the etcd data directory, passed as an argument --data-dir,\nfrom the command 'ps -ef | grep etcd'.\nRun the below command (based on the etcd data directory found above).\nFor example, chown etcd",":etcd"," /var/lib/etcd"]}),"\n",(0,s.jsx)(r.h3,{id:"1113-ensure-that-the-adminconf-file-permissions-are-set-to-600-or-more-restrictive-automated",children:"1.1.13 Ensure that the admin.conf file permissions are set to 600 or more restrictive (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," Not Applicable"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nRun the below command (based on the file location on your system) on the control plane node.\nFor example, chmod 600 /var/lib/rancher/k3s/server/cred/admin.kubeconfig"]}),"\n",(0,s.jsxs)(r.h3,{id:"1114-ensure-that-the-adminconf-file-ownership-is-set-to-root-automated",children:["1.1.14 Ensure that the admin.conf file ownership is set to root",":root"," (Automated)"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," pass"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nRun the below command (based on the file location on your system) on the control plane node.\nFor example, chown root",":root"," /etc/kubernetes/admin.conf"]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"/bin/sh -c 'if test -e /var/lib/rancher/k3s/server/cred/admin.kubeconfig; then stat -c %U:%G /var/lib/rancher/k3s/server/cred/admin.kubeconfig; fi'\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result"}),":"]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:"'root:root' is equal to 'root:root'\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Returned Value"}),":"]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:"root:root\n"})}),"\n",(0,s.jsx)(r.h3,{id:"1115-ensure-that-the-schedulerconf-file-permissions-are-set-to-644-or-more-restrictive-automated",children:"1.1.15 Ensure that the scheduler.conf file permissions are set to 644 or more restrictive (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," pass"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nRun the below command (based on the file location on your system) on the control plane node.\nFor example,\nchmod 644 scheduler"]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"/bin/sh -c 'if test -e /var/lib/rancher/k3s/server/cred/scheduler.kubeconfig; then stat -c permissions=%a /var/lib/rancher/k3s/server/cred/scheduler.kubeconfig; fi'\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result"}),":"]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:"permissions has permissions 644, expected 644 or more restrictive\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Returned Value"}),":"]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:"permissions=644\n"})}),"\n",(0,s.jsxs)(r.h3,{id:"1116-ensure-that-the-schedulerconf-file-ownership-is-set-to-root-automated",children:["1.1.16 Ensure that the scheduler.conf file ownership is set to root",":root"," (Automated)"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," pass"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nRun the below command (based on the file location on your system) on the control plane node.\nFor example, ",(0,s.jsx)(r.code,{children:"chown root:root scheduler"})]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"/bin/sh -c 'if test -e /var/lib/rancher/k3s/server/cred/scheduler.kubeconfig; then stat -c %U:%G /var/lib/rancher/k3s/server/cred/scheduler.kubeconfig; fi'\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result"}),":"]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:"'root:root' is present\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Returned Value"}),":"]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:"root:root\n"})}),"\n",(0,s.jsx)(r.h3,{id:"1117-ensure-that-the-controller-managerconf-file-permissions-are-set-to-644-or-more-restrictive-automated",children:"1.1.17 Ensure that the controller-manager.conf file permissions are set to 644 or more restrictive (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," pass"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nRun the below command (based on the file location on your system) on the control plane node.\nFor example,\nchmod 644 controllermanager"]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"/bin/sh -c 'if test -e /var/lib/rancher/k3s/server/cred/controller.kubeconfig; then stat -c permissions=%a /var/lib/rancher/k3s/server/cred/controller.kubeconfig; fi'\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result"}),":"]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:"permissions has permissions 644, expected 644 or more restrictive\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Returned Value"}),":"]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:"permissions=644\n"})}),"\n",(0,s.jsxs)(r.h3,{id:"1118-ensure-that-the-controller-managerconf-file-ownership-is-set-to-root-automated",children:["1.1.18 Ensure that the controller-manager.conf file ownership is set to root",":root"," (Automated)"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," pass"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nRun the below command (based on the file location on your system) on the control plane node.\nFor example,\nchown root",":root"," controllermanager"]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"stat -c %U:%G /var/lib/rancher/k3s/server/tls\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result"}),":"]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:"'root:root' is equal to 'root:root'\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Returned Value"}),":"]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:"root:root\n"})}),"\n",(0,s.jsxs)(r.h3,{id:"1119-ensure-that-the-kubernetes-pki-directory-and-file-ownership-is-set-to-root-automated",children:["1.1.19 Ensure that the Kubernetes PKI directory and file ownership is set to root",":root"," (Automated)"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," pass"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nRun the below command (based on the file location on your system) on the control plane node.\nFor example,\nchown -R root",":root"," /etc/kubernetes/pki/"]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"find /var/lib/rancher/k3s/server/tls | xargs stat -c %U:%G\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result"}),":"]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:"'root:root' is present\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Returned Value"}),":"]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:"root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root root:root\n"})}),"\n",(0,s.jsx)(r.h3,{id:"1120-ensure-that-the-kubernetes-pki-certificate-file-permissions-are-set-to-644-or-more-restrictive-manual",children:"1.1.20 Ensure that the Kubernetes PKI certificate file permissions are set to 644 or more restrictive (Manual)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," warn"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nRun the below command (based on the file location on your system) on the control plane node.\nFor example,\nchmod -R 644 /etc/kubernetes/pki/*.crt"]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"stat -c %n %a /var/lib/rancher/k3s/server/tls/*.crt\n"})}),"\n",(0,s.jsx)(r.h3,{id:"1121-ensure-that-the-kubernetes-pki-key-file-permissions-are-set-to-600-manual",children:"1.1.21 Ensure that the Kubernetes PKI key file permissions are set to 600 (Manual)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," warn"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nRun the below command (based on the file location on your system) on the control plane node.\nFor example,\nchmod -R 600 /etc/kubernetes/pki/*.key"]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"stat -c %n %a /var/lib/rancher/k3s/server/tls/*.key\n"})}),"\n",(0,s.jsx)(r.h2,{id:"12-api-server",children:"1.2 API Server"}),"\n",(0,s.jsx)(r.h3,{id:"121-ensure-that-the---anonymous-auth-argument-is-set-to-false-manual",children:"1.2.1 Ensure that the --anonymous-auth argument is set to false (Manual)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," warn"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nEdit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml\non the control plane node and set the below parameter.\n--anonymous-auth=false"]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'anonymous-auth'\n"})}),"\n",(0,s.jsx)(r.h3,{id:"122-ensure-that-the---token-auth-file-parameter-is-not-set-automated",children:"1.2.2 Ensure that the --token-auth-file parameter is not set (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," pass"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nFollow the documentation and configure alternate mechanisms for authentication. Then,\nedit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml\non the control plane node and remove the ",(0,s.jsx)(r.code,{children:"--token-auth-file="})," parameter."]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"/bin/ps -ef | grep containerd | grep -v grep\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result"}),":"]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:"'--token-auth-file' is not present\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Returned Value"}),":"]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:"root 1616 1600 6 13:26 ? 00:01:28 containerd -c /var/lib/rancher/k3s/agent/etc/containerd/config.toml -a /run/k3s/containerd/containerd.sock --state /run/k3s/containerd --root /var/lib/rancher/k3s/agent/containerd root 2318 1 0 13:27 ? 00:00:00 /var/lib/rancher/k3s/data/577968fa3d58539cc4265245941b7be688833e6bf5ad7869fa2afe02f15f1cd2/bin/containerd-shim-runc-v2 -namespace k8s.io -id b41ec3297be4625c2406ad8b7b4f8b91cddd60850c420050c4c3273f809b3e7e -address /run/k3s/containerd/containerd.sock root 2341 1 0 13:27 ? 00:00:00 /var/lib/rancher/k3s/data/577968fa3d58539cc4265245941b7be688833e6bf5ad7869fa2afe02f15f1cd2/bin/containerd-shim-runc-v2 -namespace k8s.io -id e7999a65ae0a4e9969f32317ec48ae4f7071b62f92e5236696737973be77c2e1 -address /run/k3s/containerd/containerd.sock root 3199 1 0 13:27 ? 00:00:00 /var/lib/rancher/k3s/data/577968fa3d58539cc4265245941b7be688833e6bf5ad7869fa2afe02f15f1cd2/bin/containerd-shim-runc-v2 -namespace k8s.io -id 90c4e63d6ee29d40a48c2fdaf2738c2472cba1139dde8a550466c452184f8528 -address /run/k3s/containerd/containerd.sock root 3923 1 0 13:27 ? 00:00:00 /var/lib/rancher/k3s/data/577968fa3d58539cc4265245941b7be688833e6bf5ad7869fa2afe02f15f1cd2/bin/containerd-shim-runc-v2 -namespace k8s.io -id be5f4b9bd1ed9239362b7000b47f353acb8bc8ca52a9c9145cba0e902ec1c4b9 -address /run/k3s/containerd/containerd.sock root 4559 1 0 13:28 ? 00:00:00 /var/lib/rancher/k3s/data/577968fa3d58539cc4265245941b7be688833e6bf5ad7869fa2afe02f15f1cd2/bin/containerd-shim-runc-v2 -namespace k8s.io -id 04cd40ea6b6078797f177c902c89412c70e523ad2a687a62829bf1d16ff0e19c -address /run/k3s/containerd/containerd.sock root 4647 1 0 13:28 ? 00:00:00 /var/lib/rancher/k3s/data/577968fa3d58539cc4265245941b7be688833e6bf5ad7869fa2afe02f15f1cd2/bin/containerd-shim-runc-v2 -namespace k8s.io -id 48f37a480315b6adce2d2a5c5d67a85412dd0ba7a2e82816434e0deb9fa75de9 -address /run/k3s/containerd/containerd.sock root 6610 1 0 13:47 ? 00:00:00 /var/lib/rancher/k3s/data/577968fa3d58539cc4265245941b7be688833e6bf5ad7869fa2afe02f15f1cd2/bin/containerd-shim-runc-v2 -namespace k8s.io -id 1cf71c22f568468055e517ab363437c0e54e45274c64024d337cc5bcce66341d -address /run/k3s/containerd/containerd.sock\n"})}),"\n",(0,s.jsx)(r.h3,{id:"123-ensure-that-the---denyserviceexternalips-is-not-set-automated",children:"1.2.3 Ensure that the --DenyServiceExternalIPs is not set (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," pass"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nEdit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml\non the control plane node and remove the ",(0,s.jsx)(r.code,{children:"DenyServiceExternalIPs"}),"\nfrom enabled admission plugins."]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"/bin/ps -ef | grep containerd | grep -v grep\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result"}),":"]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:"'--enable-admission-plugins' is present OR '--enable-admission-plugins' is not present\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Returned Value"}),":"]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:"root 1616 1600 6 13:26 ? 00:01:28 containerd -c /var/lib/rancher/k3s/agent/etc/containerd/config.toml -a /run/k3s/containerd/containerd.sock --state /run/k3s/containerd --root /var/lib/rancher/k3s/agent/containerd root 2318 1 0 13:27 ? 00:00:00 /var/lib/rancher/k3s/data/577968fa3d58539cc4265245941b7be688833e6bf5ad7869fa2afe02f15f1cd2/bin/containerd-shim-runc-v2 -namespace k8s.io -id b41ec3297be4625c2406ad8b7b4f8b91cddd60850c420050c4c3273f809b3e7e -address /run/k3s/containerd/containerd.sock root 2341 1 0 13:27 ? 00:00:00 /var/lib/rancher/k3s/data/577968fa3d58539cc4265245941b7be688833e6bf5ad7869fa2afe02f15f1cd2/bin/containerd-shim-runc-v2 -namespace k8s.io -id e7999a65ae0a4e9969f32317ec48ae4f7071b62f92e5236696737973be77c2e1 -address /run/k3s/containerd/containerd.sock root 3199 1 0 13:27 ? 00:00:00 /var/lib/rancher/k3s/data/577968fa3d58539cc4265245941b7be688833e6bf5ad7869fa2afe02f15f1cd2/bin/containerd-shim-runc-v2 -namespace k8s.io -id 90c4e63d6ee29d40a48c2fdaf2738c2472cba1139dde8a550466c452184f8528 -address /run/k3s/containerd/containerd.sock root 3923 1 0 13:27 ? 00:00:00 /var/lib/rancher/k3s/data/577968fa3d58539cc4265245941b7be688833e6bf5ad7869fa2afe02f15f1cd2/bin/containerd-shim-runc-v2 -namespace k8s.io -id be5f4b9bd1ed9239362b7000b47f353acb8bc8ca52a9c9145cba0e902ec1c4b9 -address /run/k3s/containerd/containerd.sock root 4559 1 0 13:28 ? 00:00:00 /var/lib/rancher/k3s/data/577968fa3d58539cc4265245941b7be688833e6bf5ad7869fa2afe02f15f1cd2/bin/containerd-shim-runc-v2 -namespace k8s.io -id 04cd40ea6b6078797f177c902c89412c70e523ad2a687a62829bf1d16ff0e19c -address /run/k3s/containerd/containerd.sock root 4647 1 0 13:28 ? 00:00:00 /var/lib/rancher/k3s/data/577968fa3d58539cc4265245941b7be688833e6bf5ad7869fa2afe02f15f1cd2/bin/containerd-shim-runc-v2 -namespace k8s.io -id 48f37a480315b6adce2d2a5c5d67a85412dd0ba7a2e82816434e0deb9fa75de9 -address /run/k3s/containerd/containerd.sock root 6610 1 0 13:47 ? 00:00:00 /var/lib/rancher/k3s/data/577968fa3d58539cc4265245941b7be688833e6bf5ad7869fa2afe02f15f1cd2/bin/containerd-shim-runc-v2 -namespace k8s.io -id 1cf71c22f568468055e517ab363437c0e54e45274c64024d337cc5bcce66341d -address /run/k3s/containerd/containerd.sock\n"})}),"\n",(0,s.jsx)(r.h3,{id:"124-ensure-that-the---kubelet-https-argument-is-set-to-true-automated",children:"1.2.4 Ensure that the --kubelet-https argument is set to true (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," Not Applicable"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nEdit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml\non the control plane node and remove the --kubelet-https parameter."]}),"\n",(0,s.jsx)(r.h3,{id:"125-ensure-that-the---kubelet-client-certificate-and---kubelet-client-key-arguments-are-set-as-appropriate-automated",children:"1.2.5 Ensure that the --kubelet-client-certificate and --kubelet-client-key arguments are set as appropriate (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," pass"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nFollow the Kubernetes documentation and set up the TLS connection between the\napiserver and kubelets. Then, edit API server pod specification file\n/etc/kubernetes/manifests/kube-apiserver.yaml on the control plane node and set the\nkubelet client certificate and key parameters as below."]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{children:"--kubelet-client-certificate=\n--kubelet-client-key=\n"})}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'kubelet-certificate-authority'\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result"}),":"]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:"'--kubelet-client-certificate' is present AND '--kubelet-client-key' is present\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Returned Value"}),":"]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:'Sep 13 13:26:40 k3s-123-cis-pool3-b403f678-bzdg5 k3s[1600]: time="2022-09-13T13:26:40Z" level=info msg="Running kube-apiserver --advertise-address=172.31.0.140 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})}),"\n",(0,s.jsx)(r.h3,{id:"126-ensure-that-the---kubelet-certificate-authority-argument-is-set-as-appropriate-automated",children:"1.2.6 Ensure that the --kubelet-certificate-authority argument is set as appropriate (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," pass"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nFollow the Kubernetes documentation and setup the TLS connection between\nthe apiserver and kubelets. Then, edit the API server pod specification file\n/etc/kubernetes/manifests/kube-apiserver.yaml on the control plane node and set the\n--kubelet-certificate-authority parameter to the path to the cert file for the certificate authority\n",(0,s.jsx)(r.code,{children:"--kubelet-certificate-authority="}),"."]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'kubelet-certificate-authority'\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result"}),":"]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:"'--kubelet-certificate-authority' is present\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Returned Value"}),":"]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:'Sep 13 13:26:40 k3s-123-cis-pool3-b403f678-bzdg5 k3s[1600]: time="2022-09-13T13:26:40Z" level=info msg="Running kube-apiserver --advertise-address=172.31.0.140 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})}),"\n",(0,s.jsx)(r.h3,{id:"127-ensure-that-the---authorization-mode-argument-is-not-set-to-alwaysallow-automated",children:"1.2.7 Ensure that the --authorization-mode argument is not set to AlwaysAllow (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," pass"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nEdit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml\non the control plane node and set the --authorization-mode parameter to values other than AlwaysAllow.\nOne such example could be as below.\n--authorization-mode=RBAC"]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'authorization-mode'\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result"}),":"]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:"'--authorization-mode' does not have 'AlwaysAllow'\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Returned Value"}),":"]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:'Sep 13 13:26:40 k3s-123-cis-pool3-b403f678-bzdg5 k3s[1600]: time="2022-09-13T13:26:40Z" level=info msg="Running kube-apiserver --advertise-address=172.31.0.140 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})}),"\n",(0,s.jsx)(r.h3,{id:"128-ensure-that-the---authorization-mode-argument-includes-node-automated",children:"1.2.8 Ensure that the --authorization-mode argument includes Node (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," pass"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nEdit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml\non the control plane node and set the --authorization-mode parameter to a value that includes Node.\n--authorization-mode=Node,RBAC"]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'authorization-mode'\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result"}),":"]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:"'--authorization-mode' has 'Node'\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Returned Value"}),":"]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:'Sep 13 13:26:40 k3s-123-cis-pool3-b403f678-bzdg5 k3s[1600]: time="2022-09-13T13:26:40Z" level=info msg="Running kube-apiserver --advertise-address=172.31.0.140 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})}),"\n",(0,s.jsx)(r.h3,{id:"129-ensure-that-the---authorization-mode-argument-includes-rbac-automated",children:"1.2.9 Ensure that the --authorization-mode argument includes RBAC (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," pass"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nEdit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml\non the control plane node and set the --authorization-mode parameter to a value that includes RBAC,\nfor example ",(0,s.jsx)(r.code,{children:"--authorization-mode=Node,RBAC"}),"."]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'authorization-mode'\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result"}),":"]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:"'--authorization-mode' has 'RBAC'\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Returned Value"}),":"]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:'Sep 13 13:26:40 k3s-123-cis-pool3-b403f678-bzdg5 k3s[1600]: time="2022-09-13T13:26:40Z" level=info msg="Running kube-apiserver --advertise-address=172.31.0.140 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})}),"\n",(0,s.jsx)(r.h3,{id:"1210-ensure-that-the-admission-control-plugin-eventratelimit-is-set-manual",children:"1.2.10 Ensure that the admission control plugin EventRateLimit is set (Manual)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," warn"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nFollow the Kubernetes documentation and set the desired limits in a configuration file.\nThen, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml\nand set the below parameters."]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{children:"--enable-admission-plugins=...,EventRateLimit,...\n--admission-control-config-file=\n"})}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'enable-admission-plugins'\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result"}),":"]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:"'--enable-admission-plugins' has 'EventRateLimit'\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Returned Value"}),":"]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:'Sep 13 13:26:40 k3s-123-cis-pool3-b403f678-bzdg5 k3s[1600]: time="2022-09-13T13:26:40Z" level=info msg="Running kube-apiserver --advertise-address=172.31.0.140 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})}),"\n",(0,s.jsx)(r.h3,{id:"1211-ensure-that-the-admission-control-plugin-alwaysadmit-is-not-set-automated",children:"1.2.11 Ensure that the admission control plugin AlwaysAdmit is not set (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," pass"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nEdit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml\non the control plane node and either remove the --enable-admission-plugins parameter, or set it to a\nvalue that does not include AlwaysAdmit."]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'enable-admission-plugins'\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result"}),":"]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:"'--enable-admission-plugins' does not have 'AlwaysAdmit' OR '--enable-admission-plugins' is not present\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Returned Value"}),":"]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:'Sep 13 13:26:40 k3s-123-cis-pool3-b403f678-bzdg5 k3s[1600]: time="2022-09-13T13:26:40Z" level=info msg="Running kube-apiserver --advertise-address=172.31.0.140 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})}),"\n",(0,s.jsx)(r.h3,{id:"1212-ensure-that-the-admission-control-plugin-alwayspullimages-is-set-manual",children:"1.2.12 Ensure that the admission control plugin AlwaysPullImages is set (Manual)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," warn"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nEdit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml\non the control plane node and set the --enable-admission-plugins parameter to include\nAlwaysPullImages.\n--enable-admission-plugins=...,AlwaysPullImages,..."]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"/bin/ps -ef | grep containerd | grep -v grep\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result"}),":"]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:"'--enable-admission-plugins' is present\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Returned Value"}),":"]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:"root 1616 1600 6 13:26 ? 00:01:28 containerd -c /var/lib/rancher/k3s/agent/etc/containerd/config.toml -a /run/k3s/containerd/containerd.sock --state /run/k3s/containerd --root /var/lib/rancher/k3s/agent/containerd root 2318 1 0 13:27 ? 00:00:00 /var/lib/rancher/k3s/data/577968fa3d58539cc4265245941b7be688833e6bf5ad7869fa2afe02f15f1cd2/bin/containerd-shim-runc-v2 -namespace k8s.io -id b41ec3297be4625c2406ad8b7b4f8b91cddd60850c420050c4c3273f809b3e7e -address /run/k3s/containerd/containerd.sock root 2341 1 0 13:27 ? 00:00:00 /var/lib/rancher/k3s/data/577968fa3d58539cc4265245941b7be688833e6bf5ad7869fa2afe02f15f1cd2/bin/containerd-shim-runc-v2 -namespace k8s.io -id e7999a65ae0a4e9969f32317ec48ae4f7071b62f92e5236696737973be77c2e1 -address /run/k3s/containerd/containerd.sock root 3199 1 0 13:27 ? 00:00:00 /var/lib/rancher/k3s/data/577968fa3d58539cc4265245941b7be688833e6bf5ad7869fa2afe02f15f1cd2/bin/containerd-shim-runc-v2 -namespace k8s.io -id 90c4e63d6ee29d40a48c2fdaf2738c2472cba1139dde8a550466c452184f8528 -address /run/k3s/containerd/containerd.sock root 3923 1 0 13:27 ? 00:00:00 /var/lib/rancher/k3s/data/577968fa3d58539cc4265245941b7be688833e6bf5ad7869fa2afe02f15f1cd2/bin/containerd-shim-runc-v2 -namespace k8s.io -id be5f4b9bd1ed9239362b7000b47f353acb8bc8ca52a9c9145cba0e902ec1c4b9 -address /run/k3s/containerd/containerd.sock root 4559 1 0 13:28 ? 00:00:00 /var/lib/rancher/k3s/data/577968fa3d58539cc4265245941b7be688833e6bf5ad7869fa2afe02f15f1cd2/bin/containerd-shim-runc-v2 -namespace k8s.io -id 04cd40ea6b6078797f177c902c89412c70e523ad2a687a62829bf1d16ff0e19c -address /run/k3s/containerd/containerd.sock root 4647 1 0 13:28 ? 00:00:00 /var/lib/rancher/k3s/data/577968fa3d58539cc4265245941b7be688833e6bf5ad7869fa2afe02f15f1cd2/bin/containerd-shim-runc-v2 -namespace k8s.io -id 48f37a480315b6adce2d2a5c5d67a85412dd0ba7a2e82816434e0deb9fa75de9 -address /run/k3s/containerd/containerd.sock root 6610 1 0 13:47 ? 00:00:00 /var/lib/rancher/k3s/data/577968fa3d58539cc4265245941b7be688833e6bf5ad7869fa2afe02f15f1cd2/bin/containerd-shim-runc-v2 -namespace k8s.io -id 1cf71c22f568468055e517ab363437c0e54e45274c64024d337cc5bcce66341d -address /run/k3s/containerd/containerd.sock\n"})}),"\n",(0,s.jsx)(r.h3,{id:"1213-ensure-that-the-admission-control-plugin-securitycontextdeny-is-set-if-podsecuritypolicy-is-not-used-manual",children:"1.2.13 Ensure that the admission control plugin SecurityContextDeny is set if PodSecurityPolicy is not used (Manual)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," warn"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nEdit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml\non the control plane node and set the --enable-admission-plugins parameter to include\nSecurityContextDeny, unless PodSecurityPolicy is already in place.\n--enable-admission-plugins=...,SecurityContextDeny,..."]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'enable-admission-plugins'\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result"}),":"]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:"'--enable-admission-plugins' has 'SecurityContextDeny' OR '--enable-admission-plugins' has 'PodSecurityPolicy'\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Returned Value"}),":"]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:'Sep 13 13:26:40 k3s-123-cis-pool3-b403f678-bzdg5 k3s[1600]: time="2022-09-13T13:26:40Z" level=info msg="Running kube-apiserver --advertise-address=172.31.0.140 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})}),"\n",(0,s.jsx)(r.h3,{id:"1214-ensure-that-the-admission-control-plugin-serviceaccount-is-set-automated",children:"1.2.14 Ensure that the admission control plugin ServiceAccount is set (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," pass"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nFollow the documentation and create ServiceAccount objects as per your environment.\nThen, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml\non the control plane node and ensure that the --disable-admission-plugins parameter is set to a\nvalue that does not include ServiceAccount."]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep -v grep\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result"}),":"]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:"'--disable-admission-plugins' is present OR '--disable-admission-plugins' is not present\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Returned Value"}),":"]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:'Sep 13 13:26:40 k3s-123-cis-pool3-b403f678-bzdg5 k3s[1600]: time="2022-09-13T13:26:40Z" level=info msg="Running kube-apiserver --advertise-address=172.31.0.140 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})}),"\n",(0,s.jsx)(r.h3,{id:"1215-ensure-that-the-admission-control-plugin-namespacelifecycle-is-set-automated",children:"1.2.15 Ensure that the admission control plugin NamespaceLifecycle is set (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," pass"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nEdit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml\non the control plane node and set the --disable-admission-plugins parameter to\nensure it does not include NamespaceLifecycle."]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep -v grep\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result"}),":"]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:"'--disable-admission-plugins' is present OR '--disable-admission-plugins' is not present\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Returned Value"}),":"]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:'Sep 13 13:26:40 k3s-123-cis-pool3-b403f678-bzdg5 k3s[1600]: time="2022-09-13T13:26:40Z" level=info msg="Running kube-apiserver --advertise-address=172.31.0.140 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})}),"\n",(0,s.jsx)(r.h3,{id:"1216-ensure-that-the-admission-control-plugin-noderestriction-is-set-automated",children:"1.2.16 Ensure that the admission control plugin NodeRestriction is set (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," pass"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nFollow the Kubernetes documentation and configure NodeRestriction plug-in on kubelets.\nThen, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml\non the control plane node and set the --enable-admission-plugins parameter to a\nvalue that includes NodeRestriction.\n--enable-admission-plugins=...,NodeRestriction,..."]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'enable-admission-plugins'\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result"}),":"]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:"'--enable-admission-plugins' has 'NodeRestriction'\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Returned Value"}),":"]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:'Sep 13 13:26:40 k3s-123-cis-pool3-b403f678-bzdg5 k3s[1600]: time="2022-09-13T13:26:40Z" level=info msg="Running kube-apiserver --advertise-address=172.31.0.140 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})}),"\n",(0,s.jsx)(r.h3,{id:"1217-ensure-that-the---secure-port-argument-is-not-set-to-0-automated",children:"1.2.17 Ensure that the --secure-port argument is not set to 0 (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," pass"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nEdit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml\non the control plane node and either remove the --secure-port parameter or\nset it to a different (non-zero) desired port."]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'secure-port'\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result"}),":"]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:"'--secure-port' is greater than 0 OR '--secure-port' is not present\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Returned Value"}),":"]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:'Sep 13 13:26:40 k3s-123-cis-pool3-b403f678-bzdg5 k3s[1600]: time="2022-09-13T13:26:40Z" level=info msg="Running kube-apiserver --advertise-address=172.31.0.140 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})}),"\n",(0,s.jsx)(r.h3,{id:"1218-ensure-that-the---profiling-argument-is-set-to-false-automated",children:"1.2.18 Ensure that the --profiling argument is set to false (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," pass"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nEdit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml\non the control plane node and set the below parameter.\n--profiling=false"]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'profiling'\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result"}),":"]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:"'--profiling' is equal to 'false'\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Returned Value"}),":"]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:'Sep 13 13:26:40 k3s-123-cis-pool3-b403f678-bzdg5 k3s[1600]: time="2022-09-13T13:26:40Z" level=info msg="Running kube-apiserver --advertise-address=172.31.0.140 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})}),"\n",(0,s.jsx)(r.h3,{id:"1219-ensure-that-the---audit-log-path-argument-is-set-automated",children:"1.2.19 Ensure that the --audit-log-path argument is set (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," Not Applicable"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nEdit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml\non the control plane node and set the --audit-log-path parameter to a suitable path and\nfile where you would like audit logs to be written, for example,\n--audit-log-path=/var/log/apiserver/audit.log"]}),"\n",(0,s.jsx)(r.h3,{id:"1220-ensure-that-the---audit-log-maxage-argument-is-set-to-30-or-as-appropriate-automated",children:"1.2.20 Ensure that the --audit-log-maxage argument is set to 30 or as appropriate (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," Not Applicable"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nEdit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml\non the control plane node and set the --audit-log-maxage parameter to 30\nor as an appropriate number of days, for example,\n--audit-log-maxage=30"]}),"\n",(0,s.jsx)(r.h3,{id:"1221-ensure-that-the---audit-log-maxbackup-argument-is-set-to-10-or-as-appropriate-automated",children:"1.2.21 Ensure that the --audit-log-maxbackup argument is set to 10 or as appropriate (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," Not Applicable"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nEdit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml\non the control plane node and set the --audit-log-maxbackup parameter to 10 or to an appropriate\nvalue. For example,\n--audit-log-maxbackup=10"]}),"\n",(0,s.jsx)(r.h3,{id:"1222-ensure-that-the---audit-log-maxsize-argument-is-set-to-100-or-as-appropriate-automated",children:"1.2.22 Ensure that the --audit-log-maxsize argument is set to 100 or as appropriate (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," Not Applicable"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nEdit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml\non the control plane node and set the --audit-log-maxsize parameter to an appropriate size in MB.\nFor example, to set it as 100 MB, --audit-log-maxsize=100"]}),"\n",(0,s.jsx)(r.h3,{id:"1224-ensure-that-the---service-account-lookup-argument-is-set-to-true-automated",children:"1.2.24 Ensure that the --service-account-lookup argument is set to true (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," pass"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nEdit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml\non the control plane node and set the below parameter.\n--service-account-lookup=true\nAlternatively, you can delete the --service-account-lookup parameter from this file so\nthat the default takes effect."]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep -v grep\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result"}),":"]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:"'--service-account-lookup' is not present OR '--service-account-lookup' is present\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Returned Value"}),":"]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:'Sep 13 13:26:40 k3s-123-cis-pool3-b403f678-bzdg5 k3s[1600]: time="2022-09-13T13:26:40Z" level=info msg="Running kube-apiserver --advertise-address=172.31.0.140 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})}),"\n",(0,s.jsx)(r.h3,{id:"1225-ensure-that-the---request-timeout-argument-is-set-as-appropriate-automated",children:"1.2.25 Ensure that the --request-timeout argument is set as appropriate (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," Not Applicable"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nEdit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml\non the control plane node and set the --service-account-key-file parameter\nto the public key file for service accounts. For example,\n",(0,s.jsx)(r.code,{children:"--service-account-key-file="}),"."]}),"\n",(0,s.jsx)(r.h3,{id:"1226-ensure-that-the---etcd-certfile-and---etcd-keyfile-arguments-are-set-as-appropriate-automated",children:"1.2.26 Ensure that the --etcd-certfile and --etcd-keyfile arguments are set as appropriate (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," pass"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nFollow the Kubernetes documentation and set up the TLS connection between the apiserver and etcd.\nThen, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml\non the control plane node and set the etcd certificate and key file parameters."]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{children:"--etcd-certfile=\n--etcd-keyfile=\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Audit Script:"})," ",(0,s.jsx)(r.code,{children:"check_for_k3s_etcd.sh"})]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:'#!/bin/bash\n\n# This script is used to ensure that k3s is actually running etcd (and not other databases like sqlite3)\n# before it checks the requirement\nset -eE\n\nhandle_error() {\n echo "false"\n}\n\ntrap \'handle_error\' ERR\n\n\nif [[ "$(journalctl -D /var/log/journal -u k3s | grep \'Managed etcd cluster initializing\' | grep -v grep | wc -l)" -gt 0 ]]; then\n case $1 in \n "1.1.11")\n echo $(stat -c %a /var/lib/rancher/k3s/server/db/etcd);;\n "1.2.29")\n echo $(journalctl -D /var/log/journal -u k3s | grep \'Running kube-apiserver\' | tail -n1 | grep \'etcd-\');;\n "2.1")\n echo $(grep -A 5 \'client-transport-security\' /var/lib/rancher/k3s/server/db/etcd/config | grep -E \'cert-file|key-file\');;\n "2.2")\n echo $(grep -A 5 \'client-transport-security\' /var/lib/rancher/k3s/server/db/etcd/config | grep \'client-cert-auth\');;\n "2.3")\n echo $(grep \'auto-tls\' /var/lib/rancher/k3s/server/db/etcd/config);;\n "2.4")\n echo $(grep -A 5 \'peer-transport-security\' /var/lib/rancher/k3s/server/db/etcd/config | grep -E \'cert-file|key-file\');;\n "2.5")\n echo $(grep -A 5 \'peer-transport-security\' /var/lib/rancher/k3s/server/db/etcd/config | grep \'client-cert-auth\');;\n "2.6")\n echo $(grep \'peer-auto-tls\' /var/lib/rancher/k3s/server/db/etcd/config);;\n "2.7")\n echo $(grep \'trusted-ca-file\' /var/lib/rancher/k3s/server/db/etcd/config);;\n esac\nelse\n# If another database is running, return whatever is required to pass the scan\n case $1 in\n "1.1.11")\n echo "700";;\n "1.2.29")\n echo "--etcd-certfile AND --etcd-keyfile";;\n "2.1")\n echo "cert-file AND key-file";;\n "2.2")\n echo "--client-cert-auth=true";;\n "2.3")\n echo "false";;\n "2.4")\n echo "peer-cert-file AND peer-key-file";;\n "2.5")\n echo "--client-cert-auth=true";;\n "2.6")\n echo "--peer-auto-tls=false";;\n "2.7")\n echo "--trusted-ca-file";;\n esac\nfi\n\n'})}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit Execution:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"./check_for_k3s_etcd.sh 1.2.29\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result"}),":"]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:"'--etcd-certfile' is present AND '--etcd-keyfile' is present\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Returned Value"}),":"]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:"--etcd-certfile AND --etcd-keyfile\n"})}),"\n",(0,s.jsx)(r.h3,{id:"1227-ensure-that-the---tls-cert-file-and---tls-private-key-file-arguments-are-set-as-appropriate-automated",children:"1.2.27 Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," pass"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nFollow the Kubernetes documentation and set up the TLS connection on the apiserver.\nThen, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml\non the control plane node and set the TLS certificate and private key file parameters."]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{children:"--tls-cert-file=\n--tls-private-key-file=\n"})}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"journalctl -D /var/log/journal -u k3s | grep -A1 'Running kube-apiserver' | tail -n2\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result"}),":"]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:"'--tls-cert-file' is present AND '--tls-private-key-file' is present\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Returned Value"}),":"]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:'Sep 13 13:26:40 k3s-123-cis-pool3-b403f678-bzdg5 k3s[1600]: time="2022-09-13T13:26:40Z" level=info msg="Running kube-apiserver --advertise-address=172.31.0.140 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key" Sep 13 13:26:40 k3s-123-cis-pool3-b403f678-bzdg5 k3s[1600]: time="2022-09-13T13:26:40Z" level=info msg="Running kube-scheduler --authentication-kubeconfig=/var/lib/rancher/k3s/server/cred/scheduler.kubeconfig --authorization-kubeconfig=/var/lib/rancher/k3s/server/cred/scheduler.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/kube-scheduler --kubeconfig=/var/lib/rancher/k3s/server/cred/scheduler.kubeconfig --profiling=false --secure-port=10259"\n'})}),"\n",(0,s.jsx)(r.h3,{id:"1228-ensure-that-the---client-ca-file-argument-is-set-as-appropriate-automated",children:"1.2.28 Ensure that the --client-ca-file argument is set as appropriate (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," pass"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nFollow the Kubernetes documentation and set up the TLS connection on the apiserver.\nThen, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml\non the control plane node and set the client certificate authority file.\n",(0,s.jsx)(r.code,{children:"--client-ca-file="})]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'client-ca-file'\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result"}),":"]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:"'--client-ca-file' is present\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Returned Value"}),":"]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:'Sep 13 13:26:40 k3s-123-cis-pool3-b403f678-bzdg5 k3s[1600]: time="2022-09-13T13:26:40Z" level=info msg="Running kube-apiserver --advertise-address=172.31.0.140 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})}),"\n",(0,s.jsx)(r.h3,{id:"1229-ensure-that-the---etcd-cafile-argument-is-set-as-appropriate-automated",children:"1.2.29 Ensure that the --etcd-cafile argument is set as appropriate (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," pass"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nFollow the Kubernetes documentation and set up the TLS connection between the apiserver and etcd.\nThen, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml\non the control plane node and set the etcd certificate authority file parameter.\n",(0,s.jsx)(r.code,{children:"--etcd-cafile="})]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'etcd-cafile'\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result"}),":"]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:"'--etcd-cafile' is present\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Returned Value"}),":"]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:'Sep 13 13:26:40 k3s-123-cis-pool3-b403f678-bzdg5 k3s[1600]: time="2022-09-13T13:26:40Z" level=info msg="Running kube-apiserver --advertise-address=172.31.0.140 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})}),"\n",(0,s.jsx)(r.h3,{id:"1230-ensure-that-the---encryption-provider-config-argument-is-set-as-appropriate-manual",children:"1.2.30 Ensure that the --encryption-provider-config argument is set as appropriate (Manual)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," warn"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nFollow the Kubernetes documentation and configure a EncryptionConfig file.\nThen, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml\non the control plane node and set the --encryption-provider-config parameter to the path of that file.\nFor example, ",(0,s.jsx)(r.code,{children:"--encryption-provider-config="})]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'encryption-provider-config'\n"})}),"\n",(0,s.jsx)(r.h3,{id:"1231-ensure-that-encryption-providers-are-appropriately-configured-manual",children:"1.2.31 Ensure that encryption providers are appropriately configured (Manual)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," warn"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nFollow the Kubernetes documentation and configure a EncryptionConfig file.\nIn this file, choose aescbc, kms or secretbox as the encryption provider."]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"grep aescbc /path/to/encryption-config.json\n"})}),"\n",(0,s.jsx)(r.h3,{id:"1232-ensure-that-the-api-server-only-makes-use-of-strong-cryptographic-ciphers-manual",children:"1.2.32 Ensure that the API Server only makes use of Strong Cryptographic Ciphers (Manual)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," warn"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nEdit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml\non the control plane node and set the below parameter.\n--tls-cipher-suites=TLS_AES_128_GCM_SHA256,TLS_AES_256_GCM_SHA384,TLS_CHACHA20_POLY1305_SHA256,\nTLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,\nTLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,\nTLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256,\nTLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,\nTLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,\nTLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256,TLS_RSA_WITH_3DES_EDE_CBC_SHA,TLS_RSA_WITH_AES_128_CBC_SHA,\nTLS_RSA_WITH_AES_128_GCM_SHA256,TLS_RSA_WITH_AES_256_CBC_SHA,TLS_RSA_WITH_AES_256_GCM_SHA384"]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'tls-cipher-suites'\n"})}),"\n",(0,s.jsx)(r.h2,{id:"13-controller-manager",children:"1.3 Controller Manager"}),"\n",(0,s.jsx)(r.h3,{id:"131-ensure-that-the---terminated-pod-gc-threshold-argument-is-set-as-appropriate-manual",children:"1.3.1 Ensure that the --terminated-pod-gc-threshold argument is set as appropriate (Manual)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," warn"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nEdit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml\non the control plane node and set the --terminated-pod-gc-threshold to an appropriate threshold,\nfor example, --terminated-pod-gc-threshold=10"]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"journalctl -D /var/log/journal -u k3s | grep 'Running kube-controller-manager' | tail -n1 | grep 'terminated-pod-gc-threshold'\n"})}),"\n",(0,s.jsx)(r.h3,{id:"132-ensure-that-the---profiling-argument-is-set-to-false-automated",children:"1.3.2 Ensure that the --profiling argument is set to false (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," pass"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nEdit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml\non the control plane node and set the below parameter.\n--profiling=false"]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"journalctl -D /var/log/journal -u k3s | grep 'Running kube-controller-manager' | tail -n1 | grep 'profiling'\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result"}),":"]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:"'--profiling' is equal to 'false'\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Returned Value"}),":"]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:'Sep 13 13:26:40 k3s-123-cis-pool3-b403f678-bzdg5 k3s[1600]: time="2022-09-13T13:26:40Z" level=info msg="Running kube-controller-manager --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/k3s/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/k3s/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/k3s/server/tls/server-ca.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/k3s/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/k3s/server/tls/server-ca.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/k3s/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/k3s/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true"\n'})}),"\n",(0,s.jsx)(r.h3,{id:"133-ensure-that-the---use-service-account-credentials-argument-is-set-to-true-automated",children:"1.3.3 Ensure that the --use-service-account-credentials argument is set to true (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," pass"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nEdit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml\non the control plane node to set the below parameter.\n--use-service-account-credentials=true"]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"journalctl -D /var/log/journal -u k3s | grep 'Running kube-controller-manager' | tail -n1 | grep 'use-service-account-credentials'\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result"}),":"]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:"'--use-service-account-credentials' is not equal to 'false'\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Returned Value"}),":"]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:'Sep 13 13:26:40 k3s-123-cis-pool3-b403f678-bzdg5 k3s[1600]: time="2022-09-13T13:26:40Z" level=info msg="Running kube-controller-manager --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/k3s/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/k3s/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/k3s/server/tls/server-ca.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/k3s/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/k3s/server/tls/server-ca.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/k3s/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/k3s/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true"\n'})}),"\n",(0,s.jsx)(r.h3,{id:"134-ensure-that-the---service-account-private-key-file-argument-is-set-as-appropriate-automated",children:"1.3.4 Ensure that the --service-account-private-key-file argument is set as appropriate (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," pass"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nEdit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml\non the control plane node and set the --service-account-private-key-file parameter\nto the private key file for service accounts. For example,\n",(0,s.jsx)(r.code,{children:"--service-account-private-key-file="}),"."]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"journalctl -D /var/log/journal -u k3s | grep 'Running kube-controller-manager' | tail -n1 | grep 'service-account-private-key-file'\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result"}),":"]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:"'--service-account-private-key-file' is present\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Returned Value"}),":"]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:'Sep 13 13:26:40 k3s-123-cis-pool3-b403f678-bzdg5 k3s[1600]: time="2022-09-13T13:26:40Z" level=info msg="Running kube-controller-manager --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/k3s/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/k3s/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/k3s/server/tls/server-ca.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/k3s/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/k3s/server/tls/server-ca.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/k3s/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/k3s/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true"\n'})}),"\n",(0,s.jsx)(r.h3,{id:"135-ensure-that-the---root-ca-file-argument-is-set-as-appropriate-automated",children:"1.3.5 Ensure that the --root-ca-file argument is set as appropriate (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," pass"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nEdit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml\non the control plane node and set the --root-ca-file parameter to the certificate bundle file.\n",(0,s.jsx)(r.code,{children:"--root-ca-file="})]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"journalctl -D /var/log/journal -u k3s | grep 'Running kube-controller-manager' | tail -n1 | grep 'root-ca-file'\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result"}),":"]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:"'--root-ca-file' is present\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Returned Value"}),":"]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:'Sep 13 13:26:40 k3s-123-cis-pool3-b403f678-bzdg5 k3s[1600]: time="2022-09-13T13:26:40Z" level=info msg="Running kube-controller-manager --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/kube-controller-manager --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/k3s/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/k3s/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/k3s/server/tls/server-ca.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/k3s/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/k3s/server/tls/server-ca.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/k3s/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/k3s/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --use-service-account-credentials=true"\n'})}),"\n",(0,s.jsx)(r.h3,{id:"136-ensure-that-the-rotatekubeletservercertificate-argument-is-set-to-true-automated",children:"1.3.6 Ensure that the RotateKubeletServerCertificate argument is set to true (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," Not Applicable"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nEdit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml\non the control plane node and set the --feature-gates parameter to include RotateKubeletServerCertificate=true.\n--feature-gates=RotateKubeletServerCertificate=true"]}),"\n",(0,s.jsx)(r.h3,{id:"137-ensure-that-the---bind-address-argument-is-set-to-127001-automated",children:"1.3.7 Ensure that the --bind-address argument is set to 127.0.0.1 (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," pass"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nEdit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml\non the control plane node and ensure the correct value for the --bind-address parameter"]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"/bin/ps -ef | grep containerd | grep -v grep\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result"}),":"]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:"'--bind-address' is present OR '--bind-address' is not present\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Returned Value"}),":"]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:"root 1616 1600 6 13:26 ? 00:01:28 containerd -c /var/lib/rancher/k3s/agent/etc/containerd/config.toml -a /run/k3s/containerd/containerd.sock --state /run/k3s/containerd --root /var/lib/rancher/k3s/agent/containerd root 2318 1 0 13:27 ? 00:00:00 /var/lib/rancher/k3s/data/577968fa3d58539cc4265245941b7be688833e6bf5ad7869fa2afe02f15f1cd2/bin/containerd-shim-runc-v2 -namespace k8s.io -id b41ec3297be4625c2406ad8b7b4f8b91cddd60850c420050c4c3273f809b3e7e -address /run/k3s/containerd/containerd.sock root 2341 1 0 13:27 ? 00:00:00 /var/lib/rancher/k3s/data/577968fa3d58539cc4265245941b7be688833e6bf5ad7869fa2afe02f15f1cd2/bin/containerd-shim-runc-v2 -namespace k8s.io -id e7999a65ae0a4e9969f32317ec48ae4f7071b62f92e5236696737973be77c2e1 -address /run/k3s/containerd/containerd.sock root 3199 1 0 13:27 ? 00:00:00 /var/lib/rancher/k3s/data/577968fa3d58539cc4265245941b7be688833e6bf5ad7869fa2afe02f15f1cd2/bin/containerd-shim-runc-v2 -namespace k8s.io -id 90c4e63d6ee29d40a48c2fdaf2738c2472cba1139dde8a550466c452184f8528 -address /run/k3s/containerd/containerd.sock root 3923 1 0 13:27 ? 00:00:00 /var/lib/rancher/k3s/data/577968fa3d58539cc4265245941b7be688833e6bf5ad7869fa2afe02f15f1cd2/bin/containerd-shim-runc-v2 -namespace k8s.io -id be5f4b9bd1ed9239362b7000b47f353acb8bc8ca52a9c9145cba0e902ec1c4b9 -address /run/k3s/containerd/containerd.sock root 4559 1 0 13:28 ? 00:00:00 /var/lib/rancher/k3s/data/577968fa3d58539cc4265245941b7be688833e6bf5ad7869fa2afe02f15f1cd2/bin/containerd-shim-runc-v2 -namespace k8s.io -id 04cd40ea6b6078797f177c902c89412c70e523ad2a687a62829bf1d16ff0e19c -address /run/k3s/containerd/containerd.sock root 4647 1 0 13:28 ? 00:00:00 /var/lib/rancher/k3s/data/577968fa3d58539cc4265245941b7be688833e6bf5ad7869fa2afe02f15f1cd2/bin/containerd-shim-runc-v2 -namespace k8s.io -id 48f37a480315b6adce2d2a5c5d67a85412dd0ba7a2e82816434e0deb9fa75de9 -address /run/k3s/containerd/containerd.sock root 6610 1 0 13:47 ? 00:00:00 /var/lib/rancher/k3s/data/577968fa3d58539cc4265245941b7be688833e6bf5ad7869fa2afe02f15f1cd2/bin/containerd-shim-runc-v2 -namespace k8s.io -id 1cf71c22f568468055e517ab363437c0e54e45274c64024d337cc5bcce66341d -address /run/k3s/containerd/containerd.sock\n"})}),"\n",(0,s.jsx)(r.h2,{id:"14-scheduler",children:"1.4 Scheduler"}),"\n",(0,s.jsx)(r.h3,{id:"141-ensure-that-the---profiling-argument-is-set-to-false-automated",children:"1.4.1 Ensure that the --profiling argument is set to false (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," pass"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nEdit the Scheduler pod specification file /etc/kubernetes/manifests/kube-scheduler.yaml file\non the control plane node and set the below parameter.\n--profiling=false"]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"journalctl -D /var/log/journal -u k3s | grep 'Running kube-scheduler' | tail -n1\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result"}),":"]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:"'--profiling' is equal to 'false'\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Returned Value"}),":"]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:'Sep 13 13:26:40 k3s-123-cis-pool3-b403f678-bzdg5 k3s[1600]: time="2022-09-13T13:26:40Z" level=info msg="Running kube-scheduler --authentication-kubeconfig=/var/lib/rancher/k3s/server/cred/scheduler.kubeconfig --authorization-kubeconfig=/var/lib/rancher/k3s/server/cred/scheduler.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/kube-scheduler --kubeconfig=/var/lib/rancher/k3s/server/cred/scheduler.kubeconfig --profiling=false --secure-port=10259"\n'})}),"\n",(0,s.jsx)(r.h3,{id:"142-ensure-that-the---bind-address-argument-is-set-to-127001-automated",children:"1.4.2 Ensure that the --bind-address argument is set to 127.0.0.1 (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," pass"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nEdit the Scheduler pod specification file /etc/kubernetes/manifests/kube-scheduler.yaml\non the control plane node and ensure the correct value for the --bind-address parameter"]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"journalctl -D /var/log/journal -u k3s | grep 'Running kube-scheduler' | tail -n1 | grep 'bind-address'\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result"}),":"]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:"'--bind-address' is equal to '127.0.0.1' OR '--bind-address' is not present\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Returned Value"}),":"]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:'Sep 13 13:26:40 k3s-123-cis-pool3-b403f678-bzdg5 k3s[1600]: time="2022-09-13T13:26:40Z" level=info msg="Running kube-scheduler --authentication-kubeconfig=/var/lib/rancher/k3s/server/cred/scheduler.kubeconfig --authorization-kubeconfig=/var/lib/rancher/k3s/server/cred/scheduler.kubeconfig --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/kube-scheduler --kubeconfig=/var/lib/rancher/k3s/server/cred/scheduler.kubeconfig --profiling=false --secure-port=10259"\n'})}),"\n",(0,s.jsx)(r.h2,{id:"2-etcd-node-configuration",children:"2 Etcd Node Configuration"}),"\n",(0,s.jsx)(r.h3,{id:"21-ensure-that-the---cert-file-and---key-file-arguments-are-set-as-appropriate-automated",children:"2.1 Ensure that the --cert-file and --key-file arguments are set as appropriate (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," pass"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nFollow the etcd service documentation and configure TLS encryption.\nThen, edit the etcd pod specification file /etc/kubernetes/manifests/etcd.yaml\non the master node and set the below parameters."]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{children:"--cert-file=\n--key-file=\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Audit Script:"})," ",(0,s.jsx)(r.code,{children:"check_for_k3s_etcd.sh"})]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:'#!/bin/bash\n\n# This script is used to ensure that k3s is actually running etcd (and not other databases like sqlite3)\n# before it checks the requirement\nset -eE\n\nhandle_error() {\n echo "false"\n}\n\ntrap \'handle_error\' ERR\n\n\nif [[ "$(journalctl -D /var/log/journal -u k3s | grep \'Managed etcd cluster initializing\' | grep -v grep | wc -l)" -gt 0 ]]; then\n case $1 in \n "1.1.11")\n echo $(stat -c %a /var/lib/rancher/k3s/server/db/etcd);;\n "1.2.29")\n echo $(journalctl -D /var/log/journal -u k3s | grep \'Running kube-apiserver\' | tail -n1 | grep \'etcd-\');;\n "2.1")\n echo $(grep -A 5 \'client-transport-security\' /var/lib/rancher/k3s/server/db/etcd/config | grep -E \'cert-file|key-file\');;\n "2.2")\n echo $(grep -A 5 \'client-transport-security\' /var/lib/rancher/k3s/server/db/etcd/config | grep \'client-cert-auth\');;\n "2.3")\n echo $(grep \'auto-tls\' /var/lib/rancher/k3s/server/db/etcd/config);;\n "2.4")\n echo $(grep -A 5 \'peer-transport-security\' /var/lib/rancher/k3s/server/db/etcd/config | grep -E \'cert-file|key-file\');;\n "2.5")\n echo $(grep -A 5 \'peer-transport-security\' /var/lib/rancher/k3s/server/db/etcd/config | grep \'client-cert-auth\');;\n "2.6")\n echo $(grep \'peer-auto-tls\' /var/lib/rancher/k3s/server/db/etcd/config);;\n "2.7")\n echo $(grep \'trusted-ca-file\' /var/lib/rancher/k3s/server/db/etcd/config);;\n esac\nelse\n# If another database is running, return whatever is required to pass the scan\n case $1 in\n "1.1.11")\n echo "700";;\n "1.2.29")\n echo "--etcd-certfile AND --etcd-keyfile";;\n "2.1")\n echo "cert-file AND key-file";;\n "2.2")\n echo "--client-cert-auth=true";;\n "2.3")\n echo "false";;\n "2.4")\n echo "peer-cert-file AND peer-key-file";;\n "2.5")\n echo "--client-cert-auth=true";;\n "2.6")\n echo "--peer-auto-tls=false";;\n "2.7")\n echo "--trusted-ca-file";;\n esac\nfi\n\n'})}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit Execution:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"./check_for_k3s_etcd.sh 2.1\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result"}),":"]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:"'cert-file' is present AND 'key-file' is present\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Returned Value"}),":"]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:"cert-file AND key-file cert-file: /var/lib/rancher/k3s/server/tls/etcd/server-client.crt key-file: /var/lib/rancher/k3s/server/tls/etcd/server-client.key cert-file AND key-file\n"})}),"\n",(0,s.jsx)(r.h3,{id:"22-ensure-that-the---client-cert-auth-argument-is-set-to-true-automated",children:"2.2 Ensure that the --client-cert-auth argument is set to true (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," pass"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),'\nEdit the etcd pod specification file /etc/kubernetes/manifests/etcd.yaml on the master\nnode and set the below parameter.\n--client-cert-auth="true"']}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Audit Script:"})," ",(0,s.jsx)(r.code,{children:"check_for_k3s_etcd.sh"})]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:'#!/bin/bash\n\n# This script is used to ensure that k3s is actually running etcd (and not other databases like sqlite3)\n# before it checks the requirement\nset -eE\n\nhandle_error() {\n echo "false"\n}\n\ntrap \'handle_error\' ERR\n\n\nif [[ "$(journalctl -D /var/log/journal -u k3s | grep \'Managed etcd cluster initializing\' | grep -v grep | wc -l)" -gt 0 ]]; then\n case $1 in \n "1.1.11")\n echo $(stat -c %a /var/lib/rancher/k3s/server/db/etcd);;\n "1.2.29")\n echo $(journalctl -D /var/log/journal -u k3s | grep \'Running kube-apiserver\' | tail -n1 | grep \'etcd-\');;\n "2.1")\n echo $(grep -A 5 \'client-transport-security\' /var/lib/rancher/k3s/server/db/etcd/config | grep -E \'cert-file|key-file\');;\n "2.2")\n echo $(grep -A 5 \'client-transport-security\' /var/lib/rancher/k3s/server/db/etcd/config | grep \'client-cert-auth\');;\n "2.3")\n echo $(grep \'auto-tls\' /var/lib/rancher/k3s/server/db/etcd/config);;\n "2.4")\n echo $(grep -A 5 \'peer-transport-security\' /var/lib/rancher/k3s/server/db/etcd/config | grep -E \'cert-file|key-file\');;\n "2.5")\n echo $(grep -A 5 \'peer-transport-security\' /var/lib/rancher/k3s/server/db/etcd/config | grep \'client-cert-auth\');;\n "2.6")\n echo $(grep \'peer-auto-tls\' /var/lib/rancher/k3s/server/db/etcd/config);;\n "2.7")\n echo $(grep \'trusted-ca-file\' /var/lib/rancher/k3s/server/db/etcd/config);;\n esac\nelse\n# If another database is running, return whatever is required to pass the scan\n case $1 in\n "1.1.11")\n echo "700";;\n "1.2.29")\n echo "--etcd-certfile AND --etcd-keyfile";;\n "2.1")\n echo "cert-file AND key-file";;\n "2.2")\n echo "--client-cert-auth=true";;\n "2.3")\n echo "false";;\n "2.4")\n echo "peer-cert-file AND peer-key-file";;\n "2.5")\n echo "--client-cert-auth=true";;\n "2.6")\n echo "--peer-auto-tls=false";;\n "2.7")\n echo "--trusted-ca-file";;\n esac\nfi\n\n'})}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit Execution:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"./check_for_k3s_etcd.sh 2.2\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result"}),":"]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:"'--client-cert-auth' is present OR 'client-cert-auth' is equal to 'true'\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Returned Value"}),":"]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:"--client-cert-auth=true client-cert-auth: true --client-cert-auth=true\n"})}),"\n",(0,s.jsx)(r.h3,{id:"23-ensure-that-the---auto-tls-argument-is-not-set-to-true-automated",children:"2.3 Ensure that the --auto-tls argument is not set to true (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," pass"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nEdit the etcd pod specification file /etc/kubernetes/manifests/etcd.yaml on the master\nnode and either remove the --auto-tls parameter or set it to false.\n--auto-tls=false"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Audit Script:"})," ",(0,s.jsx)(r.code,{children:"check_for_k3s_etcd.sh"})]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:'#!/bin/bash\n\n# This script is used to ensure that k3s is actually running etcd (and not other databases like sqlite3)\n# before it checks the requirement\nset -eE\n\nhandle_error() {\n echo "false"\n}\n\ntrap \'handle_error\' ERR\n\n\nif [[ "$(journalctl -D /var/log/journal -u k3s | grep \'Managed etcd cluster initializing\' | grep -v grep | wc -l)" -gt 0 ]]; then\n case $1 in \n "1.1.11")\n echo $(stat -c %a /var/lib/rancher/k3s/server/db/etcd);;\n "1.2.29")\n echo $(journalctl -D /var/log/journal -u k3s | grep \'Running kube-apiserver\' | tail -n1 | grep \'etcd-\');;\n "2.1")\n echo $(grep -A 5 \'client-transport-security\' /var/lib/rancher/k3s/server/db/etcd/config | grep -E \'cert-file|key-file\');;\n "2.2")\n echo $(grep -A 5 \'client-transport-security\' /var/lib/rancher/k3s/server/db/etcd/config | grep \'client-cert-auth\');;\n "2.3")\n echo $(grep \'auto-tls\' /var/lib/rancher/k3s/server/db/etcd/config);;\n "2.4")\n echo $(grep -A 5 \'peer-transport-security\' /var/lib/rancher/k3s/server/db/etcd/config | grep -E \'cert-file|key-file\');;\n "2.5")\n echo $(grep -A 5 \'peer-transport-security\' /var/lib/rancher/k3s/server/db/etcd/config | grep \'client-cert-auth\');;\n "2.6")\n echo $(grep \'peer-auto-tls\' /var/lib/rancher/k3s/server/db/etcd/config);;\n "2.7")\n echo $(grep \'trusted-ca-file\' /var/lib/rancher/k3s/server/db/etcd/config);;\n esac\nelse\n# If another database is running, return whatever is required to pass the scan\n case $1 in\n "1.1.11")\n echo "700";;\n "1.2.29")\n echo "--etcd-certfile AND --etcd-keyfile";;\n "2.1")\n echo "cert-file AND key-file";;\n "2.2")\n echo "--client-cert-auth=true";;\n "2.3")\n echo "false";;\n "2.4")\n echo "peer-cert-file AND peer-key-file";;\n "2.5")\n echo "--client-cert-auth=true";;\n "2.6")\n echo "--peer-auto-tls=false";;\n "2.7")\n echo "--trusted-ca-file";;\n esac\nfi\n\n'})}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit Execution:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"./check_for_k3s_etcd.sh 2.3\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result"}),":"]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:"'ETCD_AUTO_TLS' is not present OR 'ETCD_AUTO_TLS' is present\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Returned Value"}),":"]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:"error: process ID list syntax error Usage: ps [options] Try 'ps --help ' or 'ps --help ' for additional help text. For more details see ps(1). cat: /proc//environ: No such file or directory error: process ID list syntax error Usage: ps [options] Try 'ps --help ' or 'ps --help ' for additional help text. For more details see ps(1). cat: /proc//environ: No such file or directory error: process ID list syntax error Usage: ps [options] Try 'ps --help ' or 'ps --help ' for additional help text. For more details see ps(1). cat: /proc//environ: No such file or directory\n"})}),"\n",(0,s.jsx)(r.h3,{id:"24-ensure-that-the---peer-cert-file-and---peer-key-file-arguments-are-set-as-appropriate-automated",children:"2.4 Ensure that the --peer-cert-file and --peer-key-file arguments are set as appropriate (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," pass"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nFollow the etcd service documentation and configure peer TLS encryption as appropriate\nfor your etcd cluster.\nThen, edit the etcd pod specification file /etc/kubernetes/manifests/etcd.yaml on the\nmaster node and set the below parameters."]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{children:"--peer-client-file=\n--peer-key-file=\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Audit Script:"})," ",(0,s.jsx)(r.code,{children:"check_for_k3s_etcd.sh"})]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:'#!/bin/bash\n\n# This script is used to ensure that k3s is actually running etcd (and not other databases like sqlite3)\n# before it checks the requirement\nset -eE\n\nhandle_error() {\n echo "false"\n}\n\ntrap \'handle_error\' ERR\n\n\nif [[ "$(journalctl -D /var/log/journal -u k3s | grep \'Managed etcd cluster initializing\' | grep -v grep | wc -l)" -gt 0 ]]; then\n case $1 in \n "1.1.11")\n echo $(stat -c %a /var/lib/rancher/k3s/server/db/etcd);;\n "1.2.29")\n echo $(journalctl -D /var/log/journal -u k3s | grep \'Running kube-apiserver\' | tail -n1 | grep \'etcd-\');;\n "2.1")\n echo $(grep -A 5 \'client-transport-security\' /var/lib/rancher/k3s/server/db/etcd/config | grep -E \'cert-file|key-file\');;\n "2.2")\n echo $(grep -A 5 \'client-transport-security\' /var/lib/rancher/k3s/server/db/etcd/config | grep \'client-cert-auth\');;\n "2.3")\n echo $(grep \'auto-tls\' /var/lib/rancher/k3s/server/db/etcd/config);;\n "2.4")\n echo $(grep -A 5 \'peer-transport-security\' /var/lib/rancher/k3s/server/db/etcd/config | grep -E \'cert-file|key-file\');;\n "2.5")\n echo $(grep -A 5 \'peer-transport-security\' /var/lib/rancher/k3s/server/db/etcd/config | grep \'client-cert-auth\');;\n "2.6")\n echo $(grep \'peer-auto-tls\' /var/lib/rancher/k3s/server/db/etcd/config);;\n "2.7")\n echo $(grep \'trusted-ca-file\' /var/lib/rancher/k3s/server/db/etcd/config);;\n esac\nelse\n# If another database is running, return whatever is required to pass the scan\n case $1 in\n "1.1.11")\n echo "700";;\n "1.2.29")\n echo "--etcd-certfile AND --etcd-keyfile";;\n "2.1")\n echo "cert-file AND key-file";;\n "2.2")\n echo "--client-cert-auth=true";;\n "2.3")\n echo "false";;\n "2.4")\n echo "peer-cert-file AND peer-key-file";;\n "2.5")\n echo "--client-cert-auth=true";;\n "2.6")\n echo "--peer-auto-tls=false";;\n "2.7")\n echo "--trusted-ca-file";;\n esac\nfi\n\n'})}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit Execution:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"./check_for_k3s_etcd.sh 2.4\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result"}),":"]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:"'cert-file' is present AND 'key-file' is present\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Returned Value"}),":"]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:"peer-cert-file AND peer-key-file cert-file: /var/lib/rancher/k3s/server/tls/etcd/peer-server-client.crt key-file: /var/lib/rancher/k3s/server/tls/etcd/peer-server-client.key peer-cert-file AND peer-key-file\n"})}),"\n",(0,s.jsx)(r.h3,{id:"25-ensure-that-the---peer-client-cert-auth-argument-is-set-to-true-automated",children:"2.5 Ensure that the --peer-client-cert-auth argument is set to true (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," pass"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nEdit the etcd pod specification file /etc/kubernetes/manifests/etcd.yaml on the master\nnode and set the below parameter.\n--peer-client-cert-auth=true"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Audit Script:"})," ",(0,s.jsx)(r.code,{children:"check_for_k3s_etcd.sh"})]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:'#!/bin/bash\n\n# This script is used to ensure that k3s is actually running etcd (and not other databases like sqlite3)\n# before it checks the requirement\nset -eE\n\nhandle_error() {\n echo "false"\n}\n\ntrap \'handle_error\' ERR\n\n\nif [[ "$(journalctl -D /var/log/journal -u k3s | grep \'Managed etcd cluster initializing\' | grep -v grep | wc -l)" -gt 0 ]]; then\n case $1 in \n "1.1.11")\n echo $(stat -c %a /var/lib/rancher/k3s/server/db/etcd);;\n "1.2.29")\n echo $(journalctl -D /var/log/journal -u k3s | grep \'Running kube-apiserver\' | tail -n1 | grep \'etcd-\');;\n "2.1")\n echo $(grep -A 5 \'client-transport-security\' /var/lib/rancher/k3s/server/db/etcd/config | grep -E \'cert-file|key-file\');;\n "2.2")\n echo $(grep -A 5 \'client-transport-security\' /var/lib/rancher/k3s/server/db/etcd/config | grep \'client-cert-auth\');;\n "2.3")\n echo $(grep \'auto-tls\' /var/lib/rancher/k3s/server/db/etcd/config);;\n "2.4")\n echo $(grep -A 5 \'peer-transport-security\' /var/lib/rancher/k3s/server/db/etcd/config | grep -E \'cert-file|key-file\');;\n "2.5")\n echo $(grep -A 5 \'peer-transport-security\' /var/lib/rancher/k3s/server/db/etcd/config | grep \'client-cert-auth\');;\n "2.6")\n echo $(grep \'peer-auto-tls\' /var/lib/rancher/k3s/server/db/etcd/config);;\n "2.7")\n echo $(grep \'trusted-ca-file\' /var/lib/rancher/k3s/server/db/etcd/config);;\n esac\nelse\n# If another database is running, return whatever is required to pass the scan\n case $1 in\n "1.1.11")\n echo "700";;\n "1.2.29")\n echo "--etcd-certfile AND --etcd-keyfile";;\n "2.1")\n echo "cert-file AND key-file";;\n "2.2")\n echo "--client-cert-auth=true";;\n "2.3")\n echo "false";;\n "2.4")\n echo "peer-cert-file AND peer-key-file";;\n "2.5")\n echo "--client-cert-auth=true";;\n "2.6")\n echo "--peer-auto-tls=false";;\n "2.7")\n echo "--trusted-ca-file";;\n esac\nfi\n\n'})}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit Execution:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"./check_for_k3s_etcd.sh 2.5\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result"}),":"]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:"'--client-cert-auth' is present OR 'client-cert-auth' is equal to 'true'\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Returned Value"}),":"]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:"--client-cert-auth=true client-cert-auth: true --client-cert-auth=true\n"})}),"\n",(0,s.jsx)(r.h3,{id:"26-ensure-that-the---peer-auto-tls-argument-is-not-set-to-true-automated",children:"2.6 Ensure that the --peer-auto-tls argument is not set to true (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," pass"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nEdit the etcd pod specification file /etc/kubernetes/manifests/etcd.yaml on the master\nnode and either remove the --peer-auto-tls parameter or set it to false.\n--peer-auto-tls=false"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Audit Script:"})," ",(0,s.jsx)(r.code,{children:"check_for_k3s_etcd.sh"})]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:'#!/bin/bash\n\n# This script is used to ensure that k3s is actually running etcd (and not other databases like sqlite3)\n# before it checks the requirement\nset -eE\n\nhandle_error() {\n echo "false"\n}\n\ntrap \'handle_error\' ERR\n\n\nif [[ "$(journalctl -D /var/log/journal -u k3s | grep \'Managed etcd cluster initializing\' | grep -v grep | wc -l)" -gt 0 ]]; then\n case $1 in \n "1.1.11")\n echo $(stat -c %a /var/lib/rancher/k3s/server/db/etcd);;\n "1.2.29")\n echo $(journalctl -D /var/log/journal -u k3s | grep \'Running kube-apiserver\' | tail -n1 | grep \'etcd-\');;\n "2.1")\n echo $(grep -A 5 \'client-transport-security\' /var/lib/rancher/k3s/server/db/etcd/config | grep -E \'cert-file|key-file\');;\n "2.2")\n echo $(grep -A 5 \'client-transport-security\' /var/lib/rancher/k3s/server/db/etcd/config | grep \'client-cert-auth\');;\n "2.3")\n echo $(grep \'auto-tls\' /var/lib/rancher/k3s/server/db/etcd/config);;\n "2.4")\n echo $(grep -A 5 \'peer-transport-security\' /var/lib/rancher/k3s/server/db/etcd/config | grep -E \'cert-file|key-file\');;\n "2.5")\n echo $(grep -A 5 \'peer-transport-security\' /var/lib/rancher/k3s/server/db/etcd/config | grep \'client-cert-auth\');;\n "2.6")\n echo $(grep \'peer-auto-tls\' /var/lib/rancher/k3s/server/db/etcd/config);;\n "2.7")\n echo $(grep \'trusted-ca-file\' /var/lib/rancher/k3s/server/db/etcd/config);;\n esac\nelse\n# If another database is running, return whatever is required to pass the scan\n case $1 in\n "1.1.11")\n echo "700";;\n "1.2.29")\n echo "--etcd-certfile AND --etcd-keyfile";;\n "2.1")\n echo "cert-file AND key-file";;\n "2.2")\n echo "--client-cert-auth=true";;\n "2.3")\n echo "false";;\n "2.4")\n echo "peer-cert-file AND peer-key-file";;\n "2.5")\n echo "--client-cert-auth=true";;\n "2.6")\n echo "--peer-auto-tls=false";;\n "2.7")\n echo "--trusted-ca-file";;\n esac\nfi\n\n'})}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit Execution:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"./check_for_k3s_etcd.sh 2.6\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result"}),":"]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:"'--peer-auto-tls' is not present OR '--peer-auto-tls' is equal to 'false'\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Returned Value"}),":"]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:"--peer-auto-tls=false error: process ID list syntax error Usage: ps [options] Try 'ps --help ' or 'ps --help ' for additional help text. For more details see ps(1). cat: /proc//environ: No such file or directory --peer-auto-tls=false\n"})}),"\n",(0,s.jsx)(r.h3,{id:"27-ensure-that-a-unique-certificate-authority-is-used-for-etcd-manual",children:"2.7 Ensure that a unique Certificate Authority is used for etcd (Manual)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," pass"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\n[Manual test]\nFollow the etcd documentation and create a dedicated certificate authority setup for the\netcd service.\nThen, edit the etcd pod specification file /etc/kubernetes/manifests/etcd.yaml on the\nmaster node and set the below parameter.\n",(0,s.jsx)(r.code,{children:"--trusted-ca-file="})]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Audit Script:"})," ",(0,s.jsx)(r.code,{children:"check_for_k3s_etcd.sh"})]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:'#!/bin/bash\n\n# This script is used to ensure that k3s is actually running etcd (and not other databases like sqlite3)\n# before it checks the requirement\nset -eE\n\nhandle_error() {\n echo "false"\n}\n\ntrap \'handle_error\' ERR\n\n\nif [[ "$(journalctl -D /var/log/journal -u k3s | grep \'Managed etcd cluster initializing\' | grep -v grep | wc -l)" -gt 0 ]]; then\n case $1 in \n "1.1.11")\n echo $(stat -c %a /var/lib/rancher/k3s/server/db/etcd);;\n "1.2.29")\n echo $(journalctl -D /var/log/journal -u k3s | grep \'Running kube-apiserver\' | tail -n1 | grep \'etcd-\');;\n "2.1")\n echo $(grep -A 5 \'client-transport-security\' /var/lib/rancher/k3s/server/db/etcd/config | grep -E \'cert-file|key-file\');;\n "2.2")\n echo $(grep -A 5 \'client-transport-security\' /var/lib/rancher/k3s/server/db/etcd/config | grep \'client-cert-auth\');;\n "2.3")\n echo $(grep \'auto-tls\' /var/lib/rancher/k3s/server/db/etcd/config);;\n "2.4")\n echo $(grep -A 5 \'peer-transport-security\' /var/lib/rancher/k3s/server/db/etcd/config | grep -E \'cert-file|key-file\');;\n "2.5")\n echo $(grep -A 5 \'peer-transport-security\' /var/lib/rancher/k3s/server/db/etcd/config | grep \'client-cert-auth\');;\n "2.6")\n echo $(grep \'peer-auto-tls\' /var/lib/rancher/k3s/server/db/etcd/config);;\n "2.7")\n echo $(grep \'trusted-ca-file\' /var/lib/rancher/k3s/server/db/etcd/config);;\n esac\nelse\n# If another database is running, return whatever is required to pass the scan\n case $1 in\n "1.1.11")\n echo "700";;\n "1.2.29")\n echo "--etcd-certfile AND --etcd-keyfile";;\n "2.1")\n echo "cert-file AND key-file";;\n "2.2")\n echo "--client-cert-auth=true";;\n "2.3")\n echo "false";;\n "2.4")\n echo "peer-cert-file AND peer-key-file";;\n "2.5")\n echo "--client-cert-auth=true";;\n "2.6")\n echo "--peer-auto-tls=false";;\n "2.7")\n echo "--trusted-ca-file";;\n esac\nfi\n\n'})}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit Execution:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"./check_for_k3s_etcd.sh 2.7\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result"}),":"]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:"'trusted-ca-file' is present\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Returned Value"}),":"]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:"--trusted-ca-file trusted-ca-file: /var/lib/rancher/k3s/server/tls/etcd/server-ca.crt trusted-ca-file: /var/lib/rancher/k3s/server/tls/etcd/peer-ca.crt --trusted-ca-file\n"})}),"\n",(0,s.jsx)(r.h2,{id:"31-authentication-and-authorization",children:"3.1 Authentication and Authorization"}),"\n",(0,s.jsx)(r.h3,{id:"311-client-certificate-authentication-should-not-be-used-for-users-manual",children:"3.1.1 Client certificate authentication should not be used for users (Manual)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," warn"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nAlternative mechanisms provided by Kubernetes such as the use of OIDC should be\nimplemented in place of client certificates."]}),"\n",(0,s.jsx)(r.h2,{id:"32-logging",children:"3.2 Logging"}),"\n",(0,s.jsx)(r.h3,{id:"321-ensure-that-a-minimal-audit-policy-is-created-manual",children:"3.2.1 Ensure that a minimal audit policy is created (Manual)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," warn"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nCreate an audit policy file for your cluster."]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'audit-policy-file'\n"})}),"\n",(0,s.jsx)(r.h3,{id:"322-ensure-that-the-audit-policy-covers-key-security-concerns-manual",children:"3.2.2 Ensure that the audit policy covers key security concerns (Manual)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," warn"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nReview the audit policy provided for the cluster and ensure that it covers\nat least the following areas,"]}),"\n",(0,s.jsxs)(r.ul,{children:["\n",(0,s.jsx)(r.li,{children:"Access to Secrets managed by the cluster. Care should be taken to only\nlog Metadata for requests to Secrets, ConfigMaps, and TokenReviews, in\norder to avoid risk of logging sensitive data."}),"\n",(0,s.jsx)(r.li,{children:"Modification of Pod and Deployment objects."}),"\n",(0,s.jsxs)(r.li,{children:["Use of ",(0,s.jsx)(r.code,{children:"pods/exec"}),", ",(0,s.jsx)(r.code,{children:"pods/portforward"}),", ",(0,s.jsx)(r.code,{children:"pods/proxy"})," and ",(0,s.jsx)(r.code,{children:"services/proxy"}),".\nFor most requests, minimally logging at the Metadata level is recommended\n(the most basic level of logging)."]}),"\n"]}),"\n",(0,s.jsx)(r.h2,{id:"41-worker-node-configuration-files",children:"4.1 Worker Node Configuration Files"}),"\n",(0,s.jsx)(r.h3,{id:"411-ensure-that-the-kubelet-service-file-permissions-are-set-to-644-or-more-restrictive-automated",children:"4.1.1 Ensure that the kubelet service file permissions are set to 644 or more restrictive (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," Not Applicable"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nRun the below command (based on the file location on your system) on the each worker node.\nFor example, chmod 644 /etc/systemd/system/kubelet.service.d/10-kubeadm.conf"]}),"\n",(0,s.jsxs)(r.h3,{id:"412-ensure-that-the-kubelet-service-file-ownership-is-set-to-root-automated",children:["4.1.2 Ensure that the kubelet service file ownership is set to root",":root"," (Automated)"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," Not Applicable"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nRun the below command (based on the file location on your system) on the each worker node.\nFor example,\nchown root",":root"," /etc/systemd/system/kubelet.service.d/10-kubeadm.conf"]}),"\n",(0,s.jsx)(r.h3,{id:"413-if-proxy-kubeconfig-file-exists-ensure-permissions-are-set-to-644-or-more-restrictive-manual",children:"4.1.3 If proxy kubeconfig file exists ensure permissions are set to 644 or more restrictive (Manual)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," pass"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nRun the below command (based on the file location on your system) on the each worker node.\nFor example,\nchmod 644 /var/lib/rancher/k3s/agent/kubeproxy.kubeconfig"]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"stat -c %a /var/lib/rancher/k3s/agent/kubeproxy.kubeconfig\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result"}),":"]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:"'permissions' is present OR '/var/lib/rancher/k3s/agent/kubeproxy.kubeconfig' is not present\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Returned Value"}),":"]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:"644 644\n"})}),"\n",(0,s.jsxs)(r.h3,{id:"414-if-proxy-kubeconfig-file-exists-ensure-ownership-is-set-to-root-manual",children:["4.1.4 If proxy kubeconfig file exists ensure ownership is set to root",":root"," (Manual)"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," pass"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nRun the below command (based on the file location on your system) on the each worker node.\nFor example, chown root",":root"," /var/lib/rancher/k3s/agent/kubeproxy.kubeconfig"]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"/bin/sh -c 'if test -e /var/lib/rancher/k3s/agent/kubeproxy.kubeconfig; then stat -c %U:%G /var/lib/rancher/k3s/agent/kubeproxy.kubeconfig; fi'\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result"}),":"]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:"'root:root' is present OR '/var/lib/rancher/k3s/agent/kubeproxy.kubeconfig' is not present\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Returned Value"}),":"]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:"root:root root:root\n"})}),"\n",(0,s.jsx)(r.h3,{id:"415-ensure-that-the---kubeconfig-kubeletconf-file-permissions-are-set-to-644-or-more-restrictive-automated",children:"4.1.5 Ensure that the --kubeconfig kubelet.conf file permissions are set to 644 or more restrictive (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," pass"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nRun the below command (based on the file location on your system) on the each worker node.\nFor example,\nchmod 644 /var/lib/rancher/k3s/server/cred/admin.kubeconfig"]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"stat -c %a /var/lib/rancher/k3s/agent/kubelet.kubeconfig\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result"}),":"]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:"'644' is equal to '644'\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Returned Value"}),":"]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:"644 644\n"})}),"\n",(0,s.jsxs)(r.h3,{id:"416-ensure-that-the---kubeconfig-kubeletconf-file-ownership-is-set-to-root-automated",children:["4.1.6 Ensure that the --kubeconfig kubelet.conf file ownership is set to root",":root"," (Automated)"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," pass"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nRun the below command (based on the file location on your system) on the each worker node.\nFor example,\nchown root",":root"," /var/lib/rancher/k3s/server/cred/admin.kubeconfig"]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"stat -c %U:%G /var/lib/rancher/k3s/agent/kubelet.kubeconfig\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result"}),":"]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:"'root:root' is equal to 'root:root'\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Returned Value"}),":"]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:"root:root root:root\n"})}),"\n",(0,s.jsx)(r.h3,{id:"417-ensure-that-the-certificate-authorities-file-permissions-are-set-to-644-or-more-restrictive-manual",children:"4.1.7 Ensure that the certificate authorities file permissions are set to 644 or more restrictive (Manual)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," pass"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nRun the following command to modify the file permissions of the\n--client-ca-file: ",(0,s.jsx)(r.code,{children:"chmod 644 "})]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"stat -c %a /var/lib/rancher/k3s/server/tls/server-ca.crt\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result"}),":"]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:"'644' is present OR '640' is present OR '600' is equal to '600' OR '444' is present OR '440' is present OR '400' is present OR '000' is present\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Returned Value"}),":"]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:"644 600\n"})}),"\n",(0,s.jsxs)(r.h3,{id:"418-ensure-that-the-client-certificate-authorities-file-ownership-is-set-to-root-manual",children:["4.1.8 Ensure that the client certificate authorities file ownership is set to root",":root"," (Manual)"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," pass"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nRun the following command to modify the ownership of the --client-ca-file:\n",(0,s.jsx)(r.code,{children:"chown root:root "}),"."]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"stat -c %U:%G /var/lib/rancher/k3s/server/tls/client-ca.crt\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result"}),":"]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:"'root:root' is equal to 'root:root'\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Returned Value"}),":"]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:"root:root root:root\n"})}),"\n",(0,s.jsx)(r.h3,{id:"419-ensure-that-the-kubelet---config-configuration-file-has-permissions-set-to-644-or-more-restrictive-automated",children:"4.1.9 Ensure that the kubelet --config configuration file has permissions set to 644 or more restrictive (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," Not Applicable"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nRun the following command (using the config file location identified in the Audit step)\nchmod 644 /var/lib/kubelet/config.yaml"]}),"\n",(0,s.jsxs)(r.h3,{id:"4110-ensure-that-the-kubelet---config-configuration-file-ownership-is-set-to-root-automated",children:["4.1.10 Ensure that the kubelet --config configuration file ownership is set to root",":root"," (Automated)"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," Not Applicable"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nRun the following command (using the config file location identified in the Audit step)\nchown root",":root"," /var/lib/kubelet/config.yaml"]}),"\n",(0,s.jsx)(r.h2,{id:"42-kubelet",children:"4.2 Kubelet"}),"\n",(0,s.jsx)(r.h3,{id:"421-ensure-that-the---anonymous-auth-argument-is-set-to-false-automated",children:"4.2.1 Ensure that the --anonymous-auth argument is set to false (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," pass"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nIf using a Kubelet config file, edit the file to set ",(0,s.jsx)(r.code,{children:"authentication: anonymous: enabled"})," to\n",(0,s.jsx)(r.code,{children:"false"}),".\nIf using executable arguments, edit the kubelet service file\n/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and\nset the below parameter in KUBELET_SYSTEM_PODS_ARGS variable.\n",(0,s.jsx)(r.code,{children:"--anonymous-auth=false"}),"\nBased on your system, restart the kubelet service. For example,\nsystemctl daemon-reload\nsystemctl restart kubelet.service"]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:'/bin/sh -c \'if test $(journalctl -D /var/log/journal -u k3s | grep "Running kube-apiserver" | wc -l) -gt 0; then journalctl -D /var/log/journal -u k3s | grep "Running kube-apiserver" | tail -n1 | grep "anonymous-auth" | grep -v grep; else echo "--anonymous-auth=false"; fi\'\n'})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result"}),":"]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:"'--anonymous-auth' is equal to 'false'\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Returned Value"}),":"]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:'--anonymous-auth=false Sep 13 13:26:40 k3s-123-cis-pool3-b403f678-bzdg5 k3s[1600]: time="2022-09-13T13:26:40Z" level=info msg="Running kube-apiserver --advertise-address=172.31.0.140 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})}),"\n",(0,s.jsx)(r.h3,{id:"422-ensure-that-the---authorization-mode-argument-is-not-set-to-alwaysallow-automated",children:"4.2.2 Ensure that the --authorization-mode argument is not set to AlwaysAllow (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," pass"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nIf using a Kubelet config file, edit the file to set ",(0,s.jsx)(r.code,{children:"authorization.mode"})," to Webhook. If\nusing executable arguments, edit the kubelet service file\n/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and\nset the below parameter in KUBELET_AUTHZ_ARGS variable.\n--authorization-mode=Webhook\nBased on your system, restart the kubelet service. For example,\nsystemctl daemon-reload\nsystemctl restart kubelet.service"]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:'/bin/sh -c \'if test $(journalctl -D /var/log/journal -u k3s | grep "Running kube-apiserver" | wc -l) -gt 0; then journalctl -D /var/log/journal -u k3s | grep "Running kube-apiserver" | tail -n1 | grep "authorization-mode" | grep -v grep; else echo "--authorization-mode=Webhook"; fi\'\n'})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result"}),":"]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:"'--authorization-mode' does not have 'AlwaysAllow'\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Returned Value"}),":"]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:'--authorization-mode=Webhook Sep 13 13:26:40 k3s-123-cis-pool3-b403f678-bzdg5 k3s[1600]: time="2022-09-13T13:26:40Z" level=info msg="Running kube-apiserver --advertise-address=172.31.0.140 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})}),"\n",(0,s.jsx)(r.h3,{id:"423-ensure-that-the---client-ca-file-argument-is-set-as-appropriate-automated",children:"4.2.3 Ensure that the --client-ca-file argument is set as appropriate (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," pass"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nIf using a Kubelet config file, edit the file to set ",(0,s.jsx)(r.code,{children:"authentication.x509.clientCAFile"})," to\nthe location of the client CA file.\nIf using command line arguments, edit the kubelet service file\n/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and\nset the below parameter in KUBELET_AUTHZ_ARGS variable.\n",(0,s.jsx)(r.code,{children:"--client-ca-file="}),"\nBased on your system, restart the kubelet service. For example,\nsystemctl daemon-reload\nsystemctl restart kubelet.service"]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:'/bin/sh -c \'if test $(journalctl -D /var/log/journal -u k3s | grep "Running kube-apiserver" | wc -l) -gt 0; then journalctl -D /var/log/journal -u k3s | grep "Running kube-apiserver" | tail -n1 | grep "client-ca-file" | grep -v grep; else echo "--client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt"; fi\'\n'})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result"}),":"]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:"'--client-ca-file' is present\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Returned Value"}),":"]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:'--client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt Sep 13 13:26:40 k3s-123-cis-pool3-b403f678-bzdg5 k3s[1600]: time="2022-09-13T13:26:40Z" level=info msg="Running kube-apiserver --advertise-address=172.31.0.140 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})}),"\n",(0,s.jsx)(r.h3,{id:"424-ensure-that-the---read-only-port-argument-is-set-to-0-manual",children:"4.2.4 Ensure that the --read-only-port argument is set to 0 (Manual)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," pass"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nIf using a Kubelet config file, edit the file to set ",(0,s.jsx)(r.code,{children:"readOnlyPort"})," to 0.\nIf using command line arguments, edit the kubelet service file\n/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and\nset the below parameter in KUBELET_SYSTEM_PODS_ARGS variable.\n--read-only-port=0\nBased on your system, restart the kubelet service. For example,\nsystemctl daemon-reload\nsystemctl restart kubelet.service"]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"journalctl -D /var/log/journal -u k3s | grep 'Running kubelet' | tail -n1 | grep 'read-only-port'\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result"}),":"]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:"'--read-only-port' is equal to '0' OR '--read-only-port' is not present\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Returned Value"}),":"]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:'Sep 13 13:26:50 k3s-123-cis-pool2-98604672-hr9p5 k3s[1592]: time="2022-09-13T13:26:50Z" level=info msg="Running kubelet --address=0.0.0.0 --anonymous-auth=false --authentication-token-webhook=true --authorization-mode=Webhook --cgroup-driver=systemd --client-ca-file=/var/lib/rancher/k3s/agent/client-ca.crt --cloud-provider=external --cluster-dns=10.43.0.10 --cluster-domain=cluster.local --container-runtime-endpoint=unix:///run/k3s/containerd/containerd.sock --containerd=/run/k3s/containerd/containerd.sock --eviction-hard=imagefs.available<5%,nodefs.available<5% --eviction-minimum-reclaim=imagefs.available=10%,nodefs.available=10% --fail-swap-on=false --healthz-bind-address=127.0.0.1 --hostname-override=k3s-123-cis-pool2-98604672-hr9p5 --kubeconfig=/var/lib/rancher/k3s/agent/kubelet.kubeconfig --node-labels=rke.cattle.io/machine=00c4e7a0-5497-4367-a70c-0b836757eae8 --pod-infra-container-image=rancher/mirrored-pause:3.6 --pod-manifest-path=/var/lib/rancher/k3s/agent/pod-manifests --read-only-port=0 --resolv-conf=/run/systemd/resolve/resolv.conf --serialize-image-pulls=false --tls-cert-file=/var/lib/rancher/k3s/agent/serving-kubelet.crt --tls-private-key-file=/var/lib/rancher/k3s/agent/serving-kubelet.key" Sep 13 13:26:44 k3s-123-cis-pool3-b403f678-bzdg5 k3s[1600]: time="2022-09-13T13:26:44Z" level=info msg="Running kubelet --address=0.0.0.0 --anonymous-auth=false --authentication-token-webhook=true --authorization-mode=Webhook --cgroup-driver=systemd --client-ca-file=/var/lib/rancher/k3s/agent/client-ca.crt --cloud-provider=external --cluster-dns=10.43.0.10 --cluster-domain=cluster.local --container-runtime-endpoint=unix:///run/k3s/containerd/containerd.sock --containerd=/run/k3s/containerd/containerd.sock --eviction-hard=imagefs.available<5%,nodefs.available<5% --eviction-minimum-reclaim=imagefs.available=10%,nodefs.available=10% --fail-swap-on=false --healthz-bind-address=127.0.0.1 --hostname-override=k3s-123-cis-pool3-b403f678-bzdg5 --kubeconfig=/var/lib/rancher/k3s/agent/kubelet.kubeconfig --node-labels=rke.cattle.io/machine=109d596c-89f5-4c10-8c7f-6b82a38edd8f --pod-infra-container-image=rancher/mirrored-pause:3.6 --pod-manifest-path=/var/lib/rancher/k3s/agent/pod-manifests --read-only-port=0 --resolv-conf=/run/systemd/resolve/resolv.conf --serialize-image-pulls=false --tls-cert-file=/var/lib/rancher/k3s/agent/serving-kubelet.crt --tls-private-key-file=/var/lib/rancher/k3s/agent/serving-kubelet.key"\n'})}),"\n",(0,s.jsx)(r.h3,{id:"425-ensure-that-the---streaming-connection-idle-timeout-argument-is-not-set-to-0-manual",children:"4.2.5 Ensure that the --streaming-connection-idle-timeout argument is not set to 0 (Manual)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," warn"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nIf using a Kubelet config file, edit the file to set ",(0,s.jsx)(r.code,{children:"streamingConnectionIdleTimeout"})," to a\nvalue other than 0.\nIf using command line arguments, edit the kubelet service file\n/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and\nset the below parameter in KUBELET_SYSTEM_PODS_ARGS variable.\n--streaming-connection-idle-timeout=5m\nBased on your system, restart the kubelet service. For example,\nsystemctl daemon-reload\nsystemctl restart kubelet.service"]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"journalctl -D /var/log/journal -u k3s | grep 'Running kubelet' | tail -n1 | grep 'streaming-connection-idle-timeout'\n"})}),"\n",(0,s.jsx)(r.h3,{id:"426-ensure-that-the---protect-kernel-defaults-argument-is-set-to-true-automated",children:"4.2.6 Ensure that the --protect-kernel-defaults argument is set to true (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," Not Applicable"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nIf using a Kubelet config file, edit the file to set ",(0,s.jsx)(r.code,{children:"protectKernelDefaults"})," to ",(0,s.jsx)(r.code,{children:"true"}),".\nIf using command line arguments, edit the kubelet service file\n/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and\nset the below parameter in KUBELET_SYSTEM_PODS_ARGS variable.\n--protect-kernel-defaults=true\nBased on your system, restart the kubelet service. For example:\nsystemctl daemon-reload\nsystemctl restart kubelet.service"]}),"\n",(0,s.jsx)(r.h3,{id:"427-ensure-that-the---make-iptables-util-chains-argument-is-set-to-true-automated",children:"4.2.7 Ensure that the --make-iptables-util-chains argument is set to true (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," Not Applicable"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nIf using a Kubelet config file, edit the file to set ",(0,s.jsx)(r.code,{children:"makeIPTablesUtilChains"})," to ",(0,s.jsx)(r.code,{children:"true"}),".\nIf using command line arguments, edit the kubelet service file\n/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and\nremove the --make-iptables-util-chains argument from the\nKUBELET_SYSTEM_PODS_ARGS variable.\nBased on your system, restart the kubelet service. For example:\nsystemctl daemon-reload\nsystemctl restart kubelet.service"]}),"\n",(0,s.jsx)(r.h3,{id:"428-ensure-that-the---hostname-override-argument-is-not-set-manual",children:"4.2.8 Ensure that the --hostname-override argument is not set (Manual)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," Not Applicable"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nEdit the kubelet service file /etc/systemd/system/kubelet.service.d/10-kubeadm.conf\non each worker node and remove the --hostname-override argument from the\nKUBELET_SYSTEM_PODS_ARGS variable.\nBased on your system, restart the kubelet service. For example,\nsystemctl daemon-reload\nsystemctl restart kubelet.service"]}),"\n",(0,s.jsx)(r.h3,{id:"429-ensure-that-the---event-qps-argument-is-set-to-0-or-a-level-which-ensures-appropriate-event-capture-manual",children:"4.2.9 Ensure that the --event-qps argument is set to 0 or a level which ensures appropriate event capture (Manual)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," warn"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nIf using a Kubelet config file, edit the file to set ",(0,s.jsx)(r.code,{children:"eventRecordQPS"})," to an appropriate level.\nIf using command line arguments, edit the kubelet service file\n/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and\nset the below parameter in KUBELET_SYSTEM_PODS_ARGS variable.\nBased on your system, restart the kubelet service. For example,\nsystemctl daemon-reload\nsystemctl restart kubelet.service"]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"/bin/ps -fC containerd\n"})}),"\n",(0,s.jsx)(r.h3,{id:"4210-ensure-that-the---tls-cert-file-and---tls-private-key-file-arguments-are-set-as-appropriate-manual",children:"4.2.10 Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate (Manual)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," pass"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nIf using a Kubelet config file, edit the file to set ",(0,s.jsx)(r.code,{children:"tlsCertFile"})," to the location\nof the certificate file to use to identify this Kubelet, and ",(0,s.jsx)(r.code,{children:"tlsPrivateKeyFile"}),"\nto the location of the corresponding private key file.\nIf using command line arguments, edit the kubelet service file\n/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and\nset the below parameters in KUBELET_CERTIFICATE_ARGS variable."]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{children:"--tls-cert-file=\n--tls-private-key-file=\n"})}),"\n",(0,s.jsx)(r.p,{children:"Based on your system, restart the kubelet service. For example,\nsystemctl daemon-reload\nsystemctl restart kubelet.service"}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"journalctl -D /var/log/journal -u k3s | grep 'Running kubelet' | tail -n1\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result"}),":"]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:"'--tls-cert-file' is present AND '--tls-private-key-file' is present\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Returned Value"}),":"]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:'Sep 13 13:26:50 k3s-123-cis-pool2-98604672-hr9p5 k3s[1592]: time="2022-09-13T13:26:50Z" level=info msg="Running kubelet --address=0.0.0.0 --anonymous-auth=false --authentication-token-webhook=true --authorization-mode=Webhook --cgroup-driver=systemd --client-ca-file=/var/lib/rancher/k3s/agent/client-ca.crt --cloud-provider=external --cluster-dns=10.43.0.10 --cluster-domain=cluster.local --container-runtime-endpoint=unix:///run/k3s/containerd/containerd.sock --containerd=/run/k3s/containerd/containerd.sock --eviction-hard=imagefs.available<5%,nodefs.available<5% --eviction-minimum-reclaim=imagefs.available=10%,nodefs.available=10% --fail-swap-on=false --healthz-bind-address=127.0.0.1 --hostname-override=k3s-123-cis-pool2-98604672-hr9p5 --kubeconfig=/var/lib/rancher/k3s/agent/kubelet.kubeconfig --node-labels=rke.cattle.io/machine=00c4e7a0-5497-4367-a70c-0b836757eae8 --pod-infra-container-image=rancher/mirrored-pause:3.6 --pod-manifest-path=/var/lib/rancher/k3s/agent/pod-manifests --read-only-port=0 --resolv-conf=/run/systemd/resolve/resolv.conf --serialize-image-pulls=false --tls-cert-file=/var/lib/rancher/k3s/agent/serving-kubelet.crt --tls-private-key-file=/var/lib/rancher/k3s/agent/serving-kubelet.key" Sep 13 13:26:44 k3s-123-cis-pool3-b403f678-bzdg5 k3s[1600]: time="2022-09-13T13:26:44Z" level=info msg="Running kubelet --address=0.0.0.0 --anonymous-auth=false --authentication-token-webhook=true --authorization-mode=Webhook --cgroup-driver=systemd --client-ca-file=/var/lib/rancher/k3s/agent/client-ca.crt --cloud-provider=external --cluster-dns=10.43.0.10 --cluster-domain=cluster.local --container-runtime-endpoint=unix:///run/k3s/containerd/containerd.sock --containerd=/run/k3s/containerd/containerd.sock --eviction-hard=imagefs.available<5%,nodefs.available<5% --eviction-minimum-reclaim=imagefs.available=10%,nodefs.available=10% --fail-swap-on=false --healthz-bind-address=127.0.0.1 --hostname-override=k3s-123-cis-pool3-b403f678-bzdg5 --kubeconfig=/var/lib/rancher/k3s/agent/kubelet.kubeconfig --node-labels=rke.cattle.io/machine=109d596c-89f5-4c10-8c7f-6b82a38edd8f --pod-infra-container-image=rancher/mirrored-pause:3.6 --pod-manifest-path=/var/lib/rancher/k3s/agent/pod-manifests --read-only-port=0 --resolv-conf=/run/systemd/resolve/resolv.conf --serialize-image-pulls=false --tls-cert-file=/var/lib/rancher/k3s/agent/serving-kubelet.crt --tls-private-key-file=/var/lib/rancher/k3s/agent/serving-kubelet.key"\n'})}),"\n",(0,s.jsx)(r.h3,{id:"4211-ensure-that-the---rotate-certificates-argument-is-not-set-to-false-automated",children:"4.2.11 Ensure that the --rotate-certificates argument is not set to false (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," Not Applicable"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nIf using a Kubelet config file, edit the file to add the line ",(0,s.jsx)(r.code,{children:"rotateCertificates"})," to ",(0,s.jsx)(r.code,{children:"true"})," or\nremove it altogether to use the default value.\nIf using command line arguments, edit the kubelet service file\n/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and\nremove --rotate-certificates=false argument from the KUBELET_CERTIFICATE_ARGS\nvariable.\nBased on your system, restart the kubelet service. For example,\nsystemctl daemon-reload\nsystemctl restart kubelet.service"]}),"\n",(0,s.jsx)(r.h3,{id:"4212-verify-that-the-rotatekubeletservercertificate-argument-is-set-to-true-manual",children:"4.2.12 Verify that the RotateKubeletServerCertificate argument is set to true (Manual)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," Not Applicable"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nEdit the kubelet service file /etc/systemd/system/kubelet.service.d/10-kubeadm.conf\non each worker node and set the below parameter in KUBELET_CERTIFICATE_ARGS variable.\n--feature-gates=RotateKubeletServerCertificate=true\nBased on your system, restart the kubelet service. For example:\nsystemctl daemon-reload\nsystemctl restart kubelet.service"]}),"\n",(0,s.jsx)(r.h3,{id:"4213-ensure-that-the-kubelet-only-makes-use-of-strong-cryptographic-ciphers-manual",children:"4.2.13 Ensure that the Kubelet only makes use of Strong Cryptographic Ciphers (Manual)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," warn"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nIf using a Kubelet config file, edit the file to set ",(0,s.jsx)(r.code,{children:"TLSCipherSuites"})," to\nTLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256\nor to a subset of these values.\nIf using executable arguments, edit the kubelet service file\n/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and\nset the --tls-cipher-suites parameter as follows, or to a subset of these values.\n--tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256\nBased on your system, restart the kubelet service. For example:\nsystemctl daemon-reload\nsystemctl restart kubelet.service"]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"/bin/ps -fC containerd\n"})}),"\n",(0,s.jsx)(r.h2,{id:"51-rbac-and-service-accounts",children:"5.1 RBAC and Service Accounts"}),"\n",(0,s.jsx)(r.h3,{id:"511-ensure-that-the-cluster-admin-role-is-only-used-where-required-manual",children:"5.1.1 Ensure that the cluster-admin role is only used where required (Manual)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," warn"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nIdentify all clusterrolebindings to the cluster-admin role. Check if they are used and\nif they need this role or if they could use a role with fewer privileges.\nWhere possible, first bind users to a lower privileged role and then remove the\nclusterrolebinding to the cluster-admin role :\nkubectl delete clusterrolebinding [name]"]}),"\n",(0,s.jsx)(r.h3,{id:"512-minimize-access-to-secrets-manual",children:"5.1.2 Minimize access to secrets (Manual)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," warn"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nWhere possible, remove get, list and watch access to Secret objects in the cluster."]}),"\n",(0,s.jsx)(r.h3,{id:"513-minimize-wildcard-use-in-roles-and-clusterroles-manual",children:"5.1.3 Minimize wildcard use in Roles and ClusterRoles (Manual)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," warn"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nWhere possible replace any use of wildcards in clusterroles and roles with specific\nobjects or actions."]}),"\n",(0,s.jsx)(r.h3,{id:"514-minimize-access-to-create-pods-manual",children:"5.1.4 Minimize access to create pods (Manual)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," warn"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nWhere possible, remove create access to pod objects in the cluster."]}),"\n",(0,s.jsx)(r.h3,{id:"515-ensure-that-default-service-accounts-are-not-actively-used-manual",children:"5.1.5 Ensure that default service accounts are not actively used. (Manual)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," warn"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nCreate explicit service accounts wherever a Kubernetes workload requires specific access\nto the Kubernetes API server.\nModify the configuration of each default service account to include this value\nautomountServiceAccountToken: false"]}),"\n",(0,s.jsx)(r.h3,{id:"516-ensure-that-service-account-tokens-are-only-mounted-where-necessary-manual",children:"5.1.6 Ensure that Service Account Tokens are only mounted where necessary (Manual)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," warn"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nModify the definition of pods and service accounts which do not need to mount service\naccount tokens to disable it."]}),"\n",(0,s.jsxs)(r.h3,{id:"517-avoid-use-of-system-group-manual",children:["5.1.7 Avoid use of system",":masters"," group (Manual)"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," warn"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nRemove the system",":masters"," group from all users in the cluster."]}),"\n",(0,s.jsx)(r.h3,{id:"518-limit-use-of-the-bind-impersonate-and-escalate-permissions-in-the-kubernetes-cluster-manual",children:"5.1.8 Limit use of the Bind, Impersonate and Escalate permissions in the Kubernetes cluster (Manual)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," warn"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nWhere possible, remove the impersonate, bind and escalate rights from subjects."]}),"\n",(0,s.jsx)(r.h2,{id:"52-pod-security-standards",children:"5.2 Pod Security Standards"}),"\n",(0,s.jsx)(r.h3,{id:"521-ensure-that-the-cluster-has-at-least-one-active-policy-control-mechanism-in-place-manual",children:"5.2.1 Ensure that the cluster has at least one active policy control mechanism in place (Manual)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," warn"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nEnsure that either Pod Security Admission or an external policy control system is in place\nfor every namespace which contains user workloads."]}),"\n",(0,s.jsx)(r.h3,{id:"522-minimize-the-admission-of-privileged-containers-automated",children:"5.2.2 Minimize the admission of privileged containers (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," warn"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nAdd policies to each namespace in the cluster which has user workloads to restrict the\nadmission of privileged containers."]}),"\n",(0,s.jsx)(r.h3,{id:"523-minimize-the-admission-of-containers-wishing-to-share-the-host-process-id-namespace-automated",children:"5.2.3 Minimize the admission of containers wishing to share the host process ID namespace (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," warn"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nAdd policies to each namespace in the cluster which has user workloads to restrict the\nadmission of ",(0,s.jsx)(r.code,{children:"hostPID"})," containers."]}),"\n",(0,s.jsx)(r.h3,{id:"524-minimize-the-admission-of-containers-wishing-to-share-the-host-ipc-namespace-automated",children:"5.2.4 Minimize the admission of containers wishing to share the host IPC namespace (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," warn"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nAdd policies to each namespace in the cluster which has user workloads to restrict the\nadmission of ",(0,s.jsx)(r.code,{children:"hostIPC"})," containers."]}),"\n",(0,s.jsx)(r.h3,{id:"525-minimize-the-admission-of-containers-wishing-to-share-the-host-network-namespace-automated",children:"5.2.5 Minimize the admission of containers wishing to share the host network namespace (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," warn"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nAdd policies to each namespace in the cluster which has user workloads to restrict the\nadmission of ",(0,s.jsx)(r.code,{children:"hostNetwork"})," containers."]}),"\n",(0,s.jsx)(r.h3,{id:"526-minimize-the-admission-of-containers-with-allowprivilegeescalation-automated",children:"5.2.6 Minimize the admission of containers with allowPrivilegeEscalation (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," warn"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nAdd policies to each namespace in the cluster which has user workloads to restrict the\nadmission of containers with ",(0,s.jsx)(r.code,{children:".spec.allowPrivilegeEscalation"})," set to ",(0,s.jsx)(r.code,{children:"true"}),"."]}),"\n",(0,s.jsx)(r.h3,{id:"527-minimize-the-admission-of-root-containers-automated",children:"5.2.7 Minimize the admission of root containers (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," warn"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nCreate a policy for each namespace in the cluster, ensuring that either ",(0,s.jsx)(r.code,{children:"MustRunAsNonRoot"}),"\nor ",(0,s.jsx)(r.code,{children:"MustRunAs"})," with the range of UIDs not including 0, is set."]}),"\n",(0,s.jsx)(r.h3,{id:"528-minimize-the-admission-of-containers-with-the-net_raw-capability-automated",children:"5.2.8 Minimize the admission of containers with the NET_RAW capability (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," warn"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nAdd policies to each namespace in the cluster which has user workloads to restrict the\nadmission of containers with the ",(0,s.jsx)(r.code,{children:"NET_RAW"})," capability."]}),"\n",(0,s.jsx)(r.h3,{id:"529-minimize-the-admission-of-containers-with-added-capabilities-automated",children:"5.2.9 Minimize the admission of containers with added capabilities (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," warn"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nEnsure that ",(0,s.jsx)(r.code,{children:"allowedCapabilities"})," is not present in policies for the cluster unless\nit is set to an empty array."]}),"\n",(0,s.jsx)(r.h3,{id:"5210-minimize-the-admission-of-containers-with-capabilities-assigned-manual",children:"5.2.10 Minimize the admission of containers with capabilities assigned (Manual)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," warn"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nReview the use of capabilities in applications running on your cluster. Where a namespace\ncontains applications which do not require any Linux capabilities to operate consider adding\na PSP which forbids the admission of containers which do not drop all capabilities."]}),"\n",(0,s.jsx)(r.h3,{id:"5211-minimize-the-admission-of-windows-hostprocess-containers-manual",children:"5.2.11 Minimize the admission of Windows HostProcess containers (Manual)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," warn"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nAdd policies to each namespace in the cluster which has user workloads to restrict the\nadmission of containers that have ",(0,s.jsx)(r.code,{children:".securityContext.windowsOptions.hostProcess"})," set to ",(0,s.jsx)(r.code,{children:"true"}),"."]}),"\n",(0,s.jsx)(r.h3,{id:"5212-minimize-the-admission-of-hostpath-volumes-manual",children:"5.2.12 Minimize the admission of HostPath volumes (Manual)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," warn"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nAdd policies to each namespace in the cluster which has user workloads to restrict the\nadmission of containers with ",(0,s.jsx)(r.code,{children:"hostPath"})," volumes."]}),"\n",(0,s.jsx)(r.h3,{id:"5213-minimize-the-admission-of-containers-which-use-hostports-manual",children:"5.2.13 Minimize the admission of containers which use HostPorts (Manual)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," warn"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nAdd policies to each namespace in the cluster which has user workloads to restrict the\nadmission of containers which use ",(0,s.jsx)(r.code,{children:"hostPort"})," sections."]}),"\n",(0,s.jsx)(r.h2,{id:"53-network-policies-and-cni",children:"5.3 Network Policies and CNI"}),"\n",(0,s.jsx)(r.h3,{id:"531-ensure-that-the-cni-in-use-supports-networkpolicies-manual",children:"5.3.1 Ensure that the CNI in use supports NetworkPolicies (Manual)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," warn"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nIf the CNI plugin in use does not support network policies, consideration should be given to\nmaking use of a different plugin, or finding an alternate mechanism for restricting traffic\nin the Kubernetes cluster."]}),"\n",(0,s.jsx)(r.h3,{id:"532-ensure-that-all-namespaces-have-networkpolicies-defined-manual",children:"5.3.2 Ensure that all Namespaces have NetworkPolicies defined (Manual)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," warn"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nFollow the documentation and create NetworkPolicy objects as you need them."]}),"\n",(0,s.jsx)(r.h2,{id:"54-secrets-management",children:"5.4 Secrets Management"}),"\n",(0,s.jsx)(r.h3,{id:"541-prefer-using-secrets-as-files-over-secrets-as-environment-variables-manual",children:"5.4.1 Prefer using Secrets as files over Secrets as environment variables (Manual)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," warn"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nIf possible, rewrite application code to read Secrets from mounted secret files, rather than\nfrom environment variables."]}),"\n",(0,s.jsx)(r.h3,{id:"542-consider-external-secret-storage-manual",children:"5.4.2 Consider external secret storage (Manual)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," warn"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nRefer to the Secrets management options offered by your cloud provider or a third-party\nsecrets management solution."]}),"\n",(0,s.jsx)(r.h2,{id:"55-extensible-admission-control",children:"5.5 Extensible Admission Control"}),"\n",(0,s.jsx)(r.h3,{id:"551-configure-image-provenance-using-imagepolicywebhook-admission-controller-manual",children:"5.5.1 Configure Image Provenance using ImagePolicyWebhook admission controller (Manual)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," warn"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nFollow the Kubernetes documentation and setup image provenance."]}),"\n",(0,s.jsx)(r.h2,{id:"57-general-policies",children:"5.7 General Policies"}),"\n",(0,s.jsx)(r.h3,{id:"571-create-administrative-boundaries-between-resources-using-namespaces-manual",children:"5.7.1 Create administrative boundaries between resources using namespaces (Manual)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," warn"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nFollow the documentation and create namespaces for objects in your deployment as you need\nthem."]}),"\n",(0,s.jsx)(r.h3,{id:"572-ensure-that-the-seccomp-profile-is-set-to-dockerdefault-in-your-pod-definitions-manual",children:"5.7.2 Ensure that the seccomp profile is set to docker/default in your Pod definitions (Manual)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," warn"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nUse ",(0,s.jsx)(r.code,{children:"securityContext"})," to enable the docker/default seccomp profile in your pod definitions.\nAn example is as below:\nsecurityContext:\nseccompProfile:\ntype: RuntimeDefault"]}),"\n",(0,s.jsx)(r.h3,{id:"573-apply-securitycontext-to-your-pods-and-containers-manual",children:"5.7.3 Apply SecurityContext to your Pods and Containers (Manual)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," warn"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nFollow the Kubernetes documentation and apply SecurityContexts to your Pods. For a\nsuggested list of SecurityContexts, you may refer to the CIS Security Benchmark for Docker\nContainers."]}),"\n",(0,s.jsx)(r.h3,{id:"574-the-default-namespace-should-not-be-used-manual",children:"5.7.4 The default namespace should not be used (Manual)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," warn"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nEnsure that namespaces are created to allow for appropriate segregation of Kubernetes\nresources and that all new resources are created in a specific namespace."]})]})}function h(e={}){const{wrapper:r}={...(0,n.a)(),...e.components};return r?(0,s.jsx)(r,{...e,children:(0,s.jsx)(d,{...e})}):d(e)}},1151:(e,r,t)=>{t.d(r,{Z:()=>c,a:()=>i});var s=t(7294);const n={},a=s.createContext(n);function i(e){const r=s.useContext(a);return s.useMemo((function(){return"function"==typeof e?e(r):{...r,...e}}),[r,e])}function c(e){let r;return r=e.disableParentContext?"function"==typeof e.components?e.components(n):e.components||n:i(e.components),s.createElement(a.Provider,{value:r},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/a09c2993.bf3a0eee.js b/assets/js/a09c2993.f6378292.js similarity index 98% rename from assets/js/a09c2993.bf3a0eee.js rename to assets/js/a09c2993.f6378292.js index ea98c20d3..ca991d4c2 100644 --- a/assets/js/a09c2993.bf3a0eee.js +++ b/assets/js/a09c2993.f6378292.js @@ -1 +1 @@ -"use strict";(self.webpackChunkk_3_s_docs=self.webpackChunkk_3_s_docs||[]).push([[4128],{8152:(e,n,t)=>{t.r(n),t.d(n,{assets:()=>a,contentTitle:()=>l,default:()=>h,frontMatter:()=>r,metadata:()=>o,toc:()=>c});var i=t(5893),s=t(1151);const r={slug:"/",title:"K3s - Lightweight Kubernetes"},l="What is K3s?",o={id:"introduction",title:"K3s - Lightweight Kubernetes",description:"Lightweight Kubernetes. Easy to install, half the memory, all in a binary of less than 100 MB.",source:"@site/docs/introduction.md",sourceDirName:".",slug:"/",permalink:"/",draft:!1,unlisted:!1,editUrl:"https://github.com/k3s-io/docs/edit/main/docs/introduction.md",tags:[],version:"current",lastUpdatedAt:1723651727e3,frontMatter:{slug:"/",title:"K3s - Lightweight Kubernetes"},sidebar:"mySidebar",next:{title:"Quick-Start Guide",permalink:"/quick-start"}},a={},c=[];function d(e){const n={h1:"h1",header:"header",li:"li",p:"p",ul:"ul",...(0,s.a)(),...e.components};return(0,i.jsxs)(i.Fragment,{children:[(0,i.jsx)(n.p,{children:"Lightweight Kubernetes. Easy to install, half the memory, all in a binary of less than 100 MB."}),"\n",(0,i.jsx)(n.p,{children:"Great for:"}),"\n",(0,i.jsxs)(n.ul,{children:["\n",(0,i.jsx)(n.li,{children:"Edge"}),"\n",(0,i.jsx)(n.li,{children:"Homelab"}),"\n",(0,i.jsx)(n.li,{children:"Internet of Things (IoT)"}),"\n",(0,i.jsx)(n.li,{children:"Continuous Integration (CI)"}),"\n",(0,i.jsx)(n.li,{children:"Development"}),"\n",(0,i.jsx)(n.li,{children:"Single board computers (ARM)"}),"\n",(0,i.jsx)(n.li,{children:"Air-gapped environments"}),"\n",(0,i.jsx)(n.li,{children:"Embedded K8s"}),"\n",(0,i.jsx)(n.li,{children:"Situations where a PhD in K8s clusterology is infeasible"}),"\n"]}),"\n",(0,i.jsx)(n.header,{children:(0,i.jsx)(n.h1,{id:"what-is-k3s",children:"What is K3s?"})}),"\n",(0,i.jsx)(n.p,{children:"K3s is a fully compliant Kubernetes distribution with the following enhancements:"}),"\n",(0,i.jsxs)(n.ul,{children:["\n",(0,i.jsx)(n.li,{children:"Distributed as a single binary or minimal container image."}),"\n",(0,i.jsx)(n.li,{children:"Lightweight datastore based on sqlite3 as the default storage backend. etcd3, MySQL, and Postgres are also available."}),"\n",(0,i.jsx)(n.li,{children:"Wrapped in simple launcher that handles a lot of the complexity of TLS and options."}),"\n",(0,i.jsx)(n.li,{children:"Secure by default with reasonable defaults for lightweight environments."}),"\n",(0,i.jsx)(n.li,{children:"Operation of all Kubernetes control plane components is encapsulated in a single binary and process, allowing K3s to automate and manage complex cluster operations like distributing certificates."}),"\n",(0,i.jsx)(n.li,{children:"External dependencies have been minimized; the only requirements are a modern kernel and cgroup mounts."}),"\n",(0,i.jsxs)(n.li,{children:['Packages the required dependencies for easy "batteries-included" cluster creation:',"\n",(0,i.jsxs)(n.ul,{children:["\n",(0,i.jsx)(n.li,{children:"containerd / cri-dockerd container runtime (CRI)"}),"\n",(0,i.jsx)(n.li,{children:"Flannel Container Network Interface (CNI)"}),"\n",(0,i.jsx)(n.li,{children:"CoreDNS Cluster DNS"}),"\n",(0,i.jsx)(n.li,{children:"Traefik Ingress controller"}),"\n",(0,i.jsx)(n.li,{children:"ServiceLB Load-Balancer controller"}),"\n",(0,i.jsx)(n.li,{children:"Kube-router Network Policy controller"}),"\n",(0,i.jsx)(n.li,{children:"Local-path-provisioner Persistent Volume controller"}),"\n",(0,i.jsx)(n.li,{children:"Spegel distributed container image registry mirror"}),"\n",(0,i.jsx)(n.li,{children:"Host utilities (iptables, socat, etc)"}),"\n"]}),"\n"]}),"\n"]}),"\n",(0,i.jsx)(n.h1,{id:"whats-with-the-name",children:"What's with the name?"}),"\n",(0,i.jsx)(n.p,{children:"We wanted an installation of Kubernetes that was half the size in terms of memory footprint. Kubernetes is a 10-letter word stylized as K8s. So something half as big as Kubernetes would be a 5-letter word stylized as K3s. There is no long form of K3s and no official pronunciation."})]})}function h(e={}){const{wrapper:n}={...(0,s.a)(),...e.components};return n?(0,i.jsx)(n,{...e,children:(0,i.jsx)(d,{...e})}):d(e)}},1151:(e,n,t)=>{t.d(n,{Z:()=>o,a:()=>l});var i=t(7294);const s={},r=i.createContext(s);function l(e){const n=i.useContext(r);return i.useMemo((function(){return"function"==typeof e?e(n):{...n,...e}}),[n,e])}function o(e){let n;return n=e.disableParentContext?"function"==typeof e.components?e.components(s):e.components||s:l(e.components),i.createElement(r.Provider,{value:n},e.children)}}}]); \ No newline at end of file +"use strict";(self.webpackChunkk_3_s_docs=self.webpackChunkk_3_s_docs||[]).push([[4128],{8152:(e,n,t)=>{t.r(n),t.d(n,{assets:()=>a,contentTitle:()=>l,default:()=>h,frontMatter:()=>r,metadata:()=>o,toc:()=>c});var i=t(5893),s=t(1151);const r={slug:"/",title:"K3s - Lightweight Kubernetes"},l="What is K3s?",o={id:"introduction",title:"K3s - Lightweight Kubernetes",description:"Lightweight Kubernetes. Easy to install, half the memory, all in a binary of less than 100 MB.",source:"@site/docs/introduction.md",sourceDirName:".",slug:"/",permalink:"/",draft:!1,unlisted:!1,editUrl:"https://github.com/k3s-io/docs/edit/main/docs/introduction.md",tags:[],version:"current",lastUpdatedAt:1723747404e3,frontMatter:{slug:"/",title:"K3s - Lightweight Kubernetes"},sidebar:"mySidebar",next:{title:"Quick-Start Guide",permalink:"/quick-start"}},a={},c=[];function d(e){const n={h1:"h1",header:"header",li:"li",p:"p",ul:"ul",...(0,s.a)(),...e.components};return(0,i.jsxs)(i.Fragment,{children:[(0,i.jsx)(n.p,{children:"Lightweight Kubernetes. Easy to install, half the memory, all in a binary of less than 100 MB."}),"\n",(0,i.jsx)(n.p,{children:"Great for:"}),"\n",(0,i.jsxs)(n.ul,{children:["\n",(0,i.jsx)(n.li,{children:"Edge"}),"\n",(0,i.jsx)(n.li,{children:"Homelab"}),"\n",(0,i.jsx)(n.li,{children:"Internet of Things (IoT)"}),"\n",(0,i.jsx)(n.li,{children:"Continuous Integration (CI)"}),"\n",(0,i.jsx)(n.li,{children:"Development"}),"\n",(0,i.jsx)(n.li,{children:"Single board computers (ARM)"}),"\n",(0,i.jsx)(n.li,{children:"Air-gapped environments"}),"\n",(0,i.jsx)(n.li,{children:"Embedded K8s"}),"\n",(0,i.jsx)(n.li,{children:"Situations where a PhD in K8s clusterology is infeasible"}),"\n"]}),"\n",(0,i.jsx)(n.header,{children:(0,i.jsx)(n.h1,{id:"what-is-k3s",children:"What is K3s?"})}),"\n",(0,i.jsx)(n.p,{children:"K3s is a fully compliant Kubernetes distribution with the following enhancements:"}),"\n",(0,i.jsxs)(n.ul,{children:["\n",(0,i.jsx)(n.li,{children:"Distributed as a single binary or minimal container image."}),"\n",(0,i.jsx)(n.li,{children:"Lightweight datastore based on sqlite3 as the default storage backend. etcd3, MySQL, and Postgres are also available."}),"\n",(0,i.jsx)(n.li,{children:"Wrapped in simple launcher that handles a lot of the complexity of TLS and options."}),"\n",(0,i.jsx)(n.li,{children:"Secure by default with reasonable defaults for lightweight environments."}),"\n",(0,i.jsx)(n.li,{children:"Operation of all Kubernetes control plane components is encapsulated in a single binary and process, allowing K3s to automate and manage complex cluster operations like distributing certificates."}),"\n",(0,i.jsx)(n.li,{children:"External dependencies have been minimized; the only requirements are a modern kernel and cgroup mounts."}),"\n",(0,i.jsxs)(n.li,{children:['Packages the required dependencies for easy "batteries-included" cluster creation:',"\n",(0,i.jsxs)(n.ul,{children:["\n",(0,i.jsx)(n.li,{children:"containerd / cri-dockerd container runtime (CRI)"}),"\n",(0,i.jsx)(n.li,{children:"Flannel Container Network Interface (CNI)"}),"\n",(0,i.jsx)(n.li,{children:"CoreDNS Cluster DNS"}),"\n",(0,i.jsx)(n.li,{children:"Traefik Ingress controller"}),"\n",(0,i.jsx)(n.li,{children:"ServiceLB Load-Balancer controller"}),"\n",(0,i.jsx)(n.li,{children:"Kube-router Network Policy controller"}),"\n",(0,i.jsx)(n.li,{children:"Local-path-provisioner Persistent Volume controller"}),"\n",(0,i.jsx)(n.li,{children:"Spegel distributed container image registry mirror"}),"\n",(0,i.jsx)(n.li,{children:"Host utilities (iptables, socat, etc)"}),"\n"]}),"\n"]}),"\n"]}),"\n",(0,i.jsx)(n.h1,{id:"whats-with-the-name",children:"What's with the name?"}),"\n",(0,i.jsx)(n.p,{children:"We wanted an installation of Kubernetes that was half the size in terms of memory footprint. Kubernetes is a 10-letter word stylized as K8s. So something half as big as Kubernetes would be a 5-letter word stylized as K3s. There is no long form of K3s and no official pronunciation."})]})}function h(e={}){const{wrapper:n}={...(0,s.a)(),...e.components};return n?(0,i.jsx)(n,{...e,children:(0,i.jsx)(d,{...e})}):d(e)}},1151:(e,n,t)=>{t.d(n,{Z:()=>o,a:()=>l});var i=t(7294);const s={},r=i.createContext(s);function l(e){const n=i.useContext(r);return i.useMemo((function(){return"function"==typeof e?e(n):{...n,...e}}),[n,e])}function o(e){let n;return n=e.disableParentContext?"function"==typeof e.components?e.components(s):e.components||s:l(e.components),i.createElement(r.Provider,{value:n},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/ab388925.dd5c6ec3.js b/assets/js/ab388925.b7cfffff.js similarity index 99% rename from assets/js/ab388925.dd5c6ec3.js rename to assets/js/ab388925.b7cfffff.js index d76f1b154..819ed8d1e 100644 --- a/assets/js/ab388925.dd5c6ec3.js +++ b/assets/js/ab388925.b7cfffff.js @@ -1 +1 @@ -"use strict";(self.webpackChunkk_3_s_docs=self.webpackChunkk_3_s_docs||[]).push([[4548],{9027:(e,t,s)=>{s.r(t),s.d(t,{assets:()=>d,contentTitle:()=>o,default:()=>h,frontMatter:()=>n,metadata:()=>i,toc:()=>c});var a=s(5893),r=s(1151);const n={title:"Cluster Datastore"},o=void 0,i={id:"datastore/datastore",title:"Cluster Datastore",description:"The ability to run Kubernetes using a datastore other than etcd sets K3s apart from other Kubernetes distributions. This feature provides flexibility to Kubernetes operators. The available datastore options allow you to select a datastore that best fits your use case. For example:",source:"@site/docs/datastore/datastore.md",sourceDirName:"datastore",slug:"/datastore/",permalink:"/datastore/",draft:!1,unlisted:!1,editUrl:"https://github.com/k3s-io/docs/edit/main/docs/datastore/datastore.md",tags:[],version:"current",lastUpdatedAt:1723651727e3,frontMatter:{title:"Cluster Datastore"},sidebar:"mySidebar",previous:{title:"Uninstalling K3s",permalink:"/installation/uninstall"},next:{title:"Backup and Restore",permalink:"/datastore/backup-restore"}},d={},c=[{value:"External Datastore Configuration Parameters",id:"external-datastore-configuration-parameters",level:3},{value:"Datastore Endpoint Format and Functionality",id:"datastore-endpoint-format-and-functionality",level:3}];function l(e){const t={a:"a",admonition:"admonition",br:"br",code:"code",h3:"h3",li:"li",p:"p",strong:"strong",table:"table",tbody:"tbody",td:"td",th:"th",thead:"thead",tr:"tr",ul:"ul",...(0,r.a)(),...e.components},{TabItem:s,Tabs:n}=t;return s||u("TabItem",!0),n||u("Tabs",!0),(0,a.jsxs)(a.Fragment,{children:[(0,a.jsx)(t.p,{children:"The ability to run Kubernetes using a datastore other than etcd sets K3s apart from other Kubernetes distributions. This feature provides flexibility to Kubernetes operators. The available datastore options allow you to select a datastore that best fits your use case. For example:"}),"\n",(0,a.jsxs)(t.ul,{children:["\n",(0,a.jsx)(t.li,{children:"If your team doesn't have expertise in operating etcd, you can choose an enterprise-grade SQL database like MySQL or PostgreSQL"}),"\n",(0,a.jsx)(t.li,{children:"If you need to run a simple, short-lived cluster in your CI/CD environment, you can use the embedded SQLite database"}),"\n",(0,a.jsx)(t.li,{children:"If you wish to deploy Kubernetes on the edge and require a highly available solution but can't afford the operational overhead of managing a database at the edge, you can use K3s's embedded HA datastore built on top of embedded etcd."}),"\n"]}),"\n",(0,a.jsx)(t.p,{children:"K3s supports the following datastore options:"}),"\n",(0,a.jsxs)(t.ul,{children:["\n",(0,a.jsxs)(t.li,{children:[(0,a.jsxs)(t.strong,{children:["Embedded ",(0,a.jsx)(t.a,{href:"https://www.sqlite.org/index.html",children:"SQLite"})]}),(0,a.jsx)(t.br,{}),"\n","SQLite cannot be used on clusters with multiple servers.",(0,a.jsx)(t.br,{}),"\n","SQLite is the default datastore, and will be used if no other datastore configuration is present, and no embedded etcd database files are present on disk."]}),"\n",(0,a.jsxs)(t.li,{children:[(0,a.jsx)(t.strong,{children:"Embedded etcd"}),(0,a.jsx)(t.br,{}),"\n","See the ",(0,a.jsx)(t.a,{href:"/datastore/ha-embedded",children:"High Availability Embedded etcd"})," documentation for more information on using embedded etcd with multiple servers.\nEmbedded etcd will be automatically selected if K3s is configured to initialize a new etcd cluster, join an existing etcd cluster, or if etcd database files are present on disk during startup."]}),"\n",(0,a.jsxs)(t.li,{children:[(0,a.jsx)(t.strong,{children:"External Database"}),(0,a.jsx)(t.br,{}),"\n","See the ",(0,a.jsx)(t.a,{href:"/datastore/ha",children:"High Availability External DB"})," documentation for more information on using external datastores with multiple servers.",(0,a.jsx)(t.br,{}),"\n","The following external datastores are supported:","\n",(0,a.jsxs)(t.ul,{children:["\n",(0,a.jsxs)(t.li,{children:[(0,a.jsx)(t.a,{href:"https://etcd.io/",children:"etcd"})," (certified against version 3.5.4)"]}),"\n",(0,a.jsxs)(t.li,{children:[(0,a.jsx)(t.a,{href:"https://www.mysql.com/",children:"MySQL"})," (certified against versions 5.7 and 8.0)"]}),"\n",(0,a.jsxs)(t.li,{children:[(0,a.jsx)(t.a,{href:"https://mariadb.org/",children:"MariaDB"})," (certified against version 10.6.8)"]}),"\n",(0,a.jsxs)(t.li,{children:[(0,a.jsx)(t.a,{href:"https://www.postgresql.org/",children:"PostgreSQL"})," (certified against versions 12.16, 13.12, 14.9 and 15.4)"]}),"\n"]}),"\n"]}),"\n"]}),"\n",(0,a.jsx)(t.admonition,{title:"Prepared Statement Support",type:"warning",children:(0,a.jsxs)(t.p,{children:["K3s requires prepared statements support from the DB. This means that connection poolers such as ",(0,a.jsx)(t.a,{href:"https://www.pgbouncer.org/faq.html#how-to-use-prepared-statements-with-transaction-pooling",children:"PgBouncer"})," may require additional configuration to work with K3s."]})}),"\n",(0,a.jsx)(t.h3,{id:"external-datastore-configuration-parameters",children:"External Datastore Configuration Parameters"}),"\n",(0,a.jsxs)(t.p,{children:["If you wish to use an external datastore such as PostgreSQL, MySQL, or etcd you must set the ",(0,a.jsx)(t.code,{children:"datastore-endpoint"})," parameter so that K3s knows how to connect to it. You may also specify parameters to configure the authentication and encryption of the connection. The below table summarizes these parameters, which can be passed as either CLI flags or environment variables."]}),"\n",(0,a.jsxs)(t.table,{children:[(0,a.jsx)(t.thead,{children:(0,a.jsxs)(t.tr,{children:[(0,a.jsx)(t.th,{children:"CLI Flag"}),(0,a.jsx)(t.th,{children:"Environment Variable"}),(0,a.jsx)(t.th,{children:"Description"})]})}),(0,a.jsxs)(t.tbody,{children:[(0,a.jsxs)(t.tr,{children:[(0,a.jsx)(t.td,{children:(0,a.jsx)(t.code,{children:"--datastore-endpoint"})}),(0,a.jsx)(t.td,{children:(0,a.jsx)(t.code,{children:"K3S_DATASTORE_ENDPOINT"})}),(0,a.jsx)(t.td,{children:"Specify a PostgreSQL, MySQL, or etcd connection string. This is a string used to describe the connection to the datastore. The structure of this string is specific to each backend and is detailed below."})]}),(0,a.jsxs)(t.tr,{children:[(0,a.jsx)(t.td,{children:(0,a.jsx)(t.code,{children:"--datastore-cafile"})}),(0,a.jsx)(t.td,{children:(0,a.jsx)(t.code,{children:"K3S_DATASTORE_CAFILE"})}),(0,a.jsx)(t.td,{children:"TLS Certificate Authority (CA) file used to help secure communication with the datastore. If your datastore serves requests over TLS using a certificate signed by a custom certificate authority, you can specify that CA using this parameter so that the K3s client can properly verify the certificate."})]}),(0,a.jsxs)(t.tr,{children:[(0,a.jsx)(t.td,{children:(0,a.jsx)(t.code,{children:"--datastore-certfile"})}),(0,a.jsx)(t.td,{children:(0,a.jsx)(t.code,{children:"K3S_DATASTORE_CERTFILE"})}),(0,a.jsxs)(t.td,{children:["TLS certificate file used for client certificate based authentication to your datastore. To use this feature, your datastore must be configured to support client certificate based authentication. If you specify this parameter, you must also specify the ",(0,a.jsx)(t.code,{children:"datastore-keyfile"})," parameter."]})]}),(0,a.jsxs)(t.tr,{children:[(0,a.jsx)(t.td,{children:(0,a.jsx)(t.code,{children:"--datastore-keyfile"})}),(0,a.jsx)(t.td,{children:(0,a.jsx)(t.code,{children:"K3S_DATASTORE_KEYFILE"})}),(0,a.jsxs)(t.td,{children:["TLS key file used for client certificate based authentication to your datastore. See the previous ",(0,a.jsx)(t.code,{children:"datastore-certfile"})," parameter for more details."]})]})]})]}),"\n",(0,a.jsx)(t.p,{children:"As a best practice we recommend setting these parameters as environment variables rather than command line arguments so that your database credentials or other sensitive information aren't exposed as part of the process info."}),"\n",(0,a.jsx)(t.h3,{id:"datastore-endpoint-format-and-functionality",children:"Datastore Endpoint Format and Functionality"}),"\n",(0,a.jsxs)(t.p,{children:["As mentioned, the format of the value passed to the ",(0,a.jsx)(t.code,{children:"datastore-endpoint"})," parameter is dependent upon the datastore backend. The following details this format and functionality for each supported external datastore."]}),"\n",(0,a.jsxs)(n,{queryString:"ext-db",children:[(0,a.jsxs)(s,{value:"PostgreSQL",children:[(0,a.jsx)(t.p,{children:"In its most common form, the datastore-endpoint parameter for PostgreSQL has the following format:"}),(0,a.jsx)(t.p,{children:(0,a.jsx)(t.code,{children:"postgres://username:password@hostname:port/database-name"})}),(0,a.jsxs)(t.p,{children:["More advanced configuration parameters are available. For more information on these, please see ",(0,a.jsx)(t.a,{href:"https://godoc.org/github.com/lib/pq",children:"https://godoc.org/github.com/lib/pq"}),"."]}),(0,a.jsx)(t.p,{children:"If you specify a database name and it does not exist, the server will attempt to create it."}),(0,a.jsxs)(t.p,{children:["If you only supply ",(0,a.jsx)(t.code,{children:"postgres://"})," as the endpoint, K3s will attempt to do the following:"]}),(0,a.jsxs)(t.ul,{children:["\n",(0,a.jsxs)(t.li,{children:["Connect to localhost using ",(0,a.jsx)(t.code,{children:"postgres"})," as the username and password"]}),"\n",(0,a.jsxs)(t.li,{children:["Create a database named ",(0,a.jsx)(t.code,{children:"kubernetes"})]}),"\n"]})]}),(0,a.jsxs)(s,{value:"MySQL / MariaDB",children:[(0,a.jsxs)(t.p,{children:["In its most common form, the ",(0,a.jsx)(t.code,{children:"datastore-endpoint"})," parameter for MySQL and MariaDB has the following format:"]}),(0,a.jsx)(t.p,{children:(0,a.jsx)(t.code,{children:"mysql://username:password@tcp(hostname:3306)/database-name"})}),(0,a.jsxs)(t.p,{children:["More advanced configuration parameters are available. For more information on these, please see ",(0,a.jsx)(t.a,{href:"https://github.com/go-sql-driver/mysql#dsn-data-source-name",children:"https://github.com/go-sql-driver/mysql#dsn-data-source-name"})]}),(0,a.jsxs)(t.p,{children:["Note that due to a ",(0,a.jsx)(t.a,{href:"https://github.com/k3s-io/k3s/issues/1093",children:"known issue"})," in K3s, you cannot set the ",(0,a.jsx)(t.code,{children:"tls"}),' parameter. TLS communication is supported, but you cannot, for example, set this parameter to "skip-verify" to cause K3s to skip certificate verification.']}),(0,a.jsx)(t.p,{children:"If you specify a database name and it does not exist, the server will attempt to create it."}),(0,a.jsxs)(t.p,{children:["If you only supply ",(0,a.jsx)(t.code,{children:"mysql://"})," as the endpoint, K3s will attempt to do the following:"]}),(0,a.jsxs)(t.ul,{children:["\n",(0,a.jsxs)(t.li,{children:["Connect to the MySQL socket at ",(0,a.jsx)(t.code,{children:"/var/run/mysqld/mysqld.sock"})," using the ",(0,a.jsx)(t.code,{children:"root"})," user and no password"]}),"\n",(0,a.jsxs)(t.li,{children:["Create a database with the name ",(0,a.jsx)(t.code,{children:"kubernetes"})]}),"\n"]})]}),(0,a.jsxs)(s,{value:"etcd",children:[(0,a.jsxs)(t.p,{children:["In its most common form, the ",(0,a.jsx)(t.code,{children:"datastore-endpoint"})," parameter for etcd has the following format:"]}),(0,a.jsx)(t.p,{children:(0,a.jsx)(t.code,{children:"https://etcd-host-1:2379,https://etcd-host-2:2379,https://etcd-host-3:2379"})}),(0,a.jsx)(t.p,{children:"The above assumes a typical three node etcd cluster. The parameter can accept one more comma separated etcd URLs."})]})]})]})}function h(e={}){const{wrapper:t}={...(0,r.a)(),...e.components};return t?(0,a.jsx)(t,{...e,children:(0,a.jsx)(l,{...e})}):l(e)}function u(e,t){throw new Error("Expected "+(t?"component":"object")+" `"+e+"` to be defined: you likely forgot to import, pass, or provide it.")}},1151:(e,t,s)=>{s.d(t,{Z:()=>i,a:()=>o});var a=s(7294);const r={},n=a.createContext(r);function o(e){const t=a.useContext(n);return a.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function i(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(r):e.components||r:o(e.components),a.createElement(n.Provider,{value:t},e.children)}}}]); \ No newline at end of file +"use strict";(self.webpackChunkk_3_s_docs=self.webpackChunkk_3_s_docs||[]).push([[4548],{9027:(e,t,s)=>{s.r(t),s.d(t,{assets:()=>d,contentTitle:()=>o,default:()=>h,frontMatter:()=>n,metadata:()=>i,toc:()=>c});var a=s(5893),r=s(1151);const n={title:"Cluster Datastore"},o=void 0,i={id:"datastore/datastore",title:"Cluster Datastore",description:"The ability to run Kubernetes using a datastore other than etcd sets K3s apart from other Kubernetes distributions. This feature provides flexibility to Kubernetes operators. The available datastore options allow you to select a datastore that best fits your use case. For example:",source:"@site/docs/datastore/datastore.md",sourceDirName:"datastore",slug:"/datastore/",permalink:"/datastore/",draft:!1,unlisted:!1,editUrl:"https://github.com/k3s-io/docs/edit/main/docs/datastore/datastore.md",tags:[],version:"current",lastUpdatedAt:1723747404e3,frontMatter:{title:"Cluster Datastore"},sidebar:"mySidebar",previous:{title:"Uninstalling K3s",permalink:"/installation/uninstall"},next:{title:"Backup and Restore",permalink:"/datastore/backup-restore"}},d={},c=[{value:"External Datastore Configuration Parameters",id:"external-datastore-configuration-parameters",level:3},{value:"Datastore Endpoint Format and Functionality",id:"datastore-endpoint-format-and-functionality",level:3}];function l(e){const t={a:"a",admonition:"admonition",br:"br",code:"code",h3:"h3",li:"li",p:"p",strong:"strong",table:"table",tbody:"tbody",td:"td",th:"th",thead:"thead",tr:"tr",ul:"ul",...(0,r.a)(),...e.components},{TabItem:s,Tabs:n}=t;return s||u("TabItem",!0),n||u("Tabs",!0),(0,a.jsxs)(a.Fragment,{children:[(0,a.jsx)(t.p,{children:"The ability to run Kubernetes using a datastore other than etcd sets K3s apart from other Kubernetes distributions. This feature provides flexibility to Kubernetes operators. The available datastore options allow you to select a datastore that best fits your use case. For example:"}),"\n",(0,a.jsxs)(t.ul,{children:["\n",(0,a.jsx)(t.li,{children:"If your team doesn't have expertise in operating etcd, you can choose an enterprise-grade SQL database like MySQL or PostgreSQL"}),"\n",(0,a.jsx)(t.li,{children:"If you need to run a simple, short-lived cluster in your CI/CD environment, you can use the embedded SQLite database"}),"\n",(0,a.jsx)(t.li,{children:"If you wish to deploy Kubernetes on the edge and require a highly available solution but can't afford the operational overhead of managing a database at the edge, you can use K3s's embedded HA datastore built on top of embedded etcd."}),"\n"]}),"\n",(0,a.jsx)(t.p,{children:"K3s supports the following datastore options:"}),"\n",(0,a.jsxs)(t.ul,{children:["\n",(0,a.jsxs)(t.li,{children:[(0,a.jsxs)(t.strong,{children:["Embedded ",(0,a.jsx)(t.a,{href:"https://www.sqlite.org/index.html",children:"SQLite"})]}),(0,a.jsx)(t.br,{}),"\n","SQLite cannot be used on clusters with multiple servers.",(0,a.jsx)(t.br,{}),"\n","SQLite is the default datastore, and will be used if no other datastore configuration is present, and no embedded etcd database files are present on disk."]}),"\n",(0,a.jsxs)(t.li,{children:[(0,a.jsx)(t.strong,{children:"Embedded etcd"}),(0,a.jsx)(t.br,{}),"\n","See the ",(0,a.jsx)(t.a,{href:"/datastore/ha-embedded",children:"High Availability Embedded etcd"})," documentation for more information on using embedded etcd with multiple servers.\nEmbedded etcd will be automatically selected if K3s is configured to initialize a new etcd cluster, join an existing etcd cluster, or if etcd database files are present on disk during startup."]}),"\n",(0,a.jsxs)(t.li,{children:[(0,a.jsx)(t.strong,{children:"External Database"}),(0,a.jsx)(t.br,{}),"\n","See the ",(0,a.jsx)(t.a,{href:"/datastore/ha",children:"High Availability External DB"})," documentation for more information on using external datastores with multiple servers.",(0,a.jsx)(t.br,{}),"\n","The following external datastores are supported:","\n",(0,a.jsxs)(t.ul,{children:["\n",(0,a.jsxs)(t.li,{children:[(0,a.jsx)(t.a,{href:"https://etcd.io/",children:"etcd"})," (certified against version 3.5.4)"]}),"\n",(0,a.jsxs)(t.li,{children:[(0,a.jsx)(t.a,{href:"https://www.mysql.com/",children:"MySQL"})," (certified against versions 5.7 and 8.0)"]}),"\n",(0,a.jsxs)(t.li,{children:[(0,a.jsx)(t.a,{href:"https://mariadb.org/",children:"MariaDB"})," (certified against version 10.6.8)"]}),"\n",(0,a.jsxs)(t.li,{children:[(0,a.jsx)(t.a,{href:"https://www.postgresql.org/",children:"PostgreSQL"})," (certified against versions 12.16, 13.12, 14.9 and 15.4)"]}),"\n"]}),"\n"]}),"\n"]}),"\n",(0,a.jsx)(t.admonition,{title:"Prepared Statement Support",type:"warning",children:(0,a.jsxs)(t.p,{children:["K3s requires prepared statements support from the DB. This means that connection poolers such as ",(0,a.jsx)(t.a,{href:"https://www.pgbouncer.org/faq.html#how-to-use-prepared-statements-with-transaction-pooling",children:"PgBouncer"})," may require additional configuration to work with K3s."]})}),"\n",(0,a.jsx)(t.h3,{id:"external-datastore-configuration-parameters",children:"External Datastore Configuration Parameters"}),"\n",(0,a.jsxs)(t.p,{children:["If you wish to use an external datastore such as PostgreSQL, MySQL, or etcd you must set the ",(0,a.jsx)(t.code,{children:"datastore-endpoint"})," parameter so that K3s knows how to connect to it. You may also specify parameters to configure the authentication and encryption of the connection. The below table summarizes these parameters, which can be passed as either CLI flags or environment variables."]}),"\n",(0,a.jsxs)(t.table,{children:[(0,a.jsx)(t.thead,{children:(0,a.jsxs)(t.tr,{children:[(0,a.jsx)(t.th,{children:"CLI Flag"}),(0,a.jsx)(t.th,{children:"Environment Variable"}),(0,a.jsx)(t.th,{children:"Description"})]})}),(0,a.jsxs)(t.tbody,{children:[(0,a.jsxs)(t.tr,{children:[(0,a.jsx)(t.td,{children:(0,a.jsx)(t.code,{children:"--datastore-endpoint"})}),(0,a.jsx)(t.td,{children:(0,a.jsx)(t.code,{children:"K3S_DATASTORE_ENDPOINT"})}),(0,a.jsx)(t.td,{children:"Specify a PostgreSQL, MySQL, or etcd connection string. This is a string used to describe the connection to the datastore. The structure of this string is specific to each backend and is detailed below."})]}),(0,a.jsxs)(t.tr,{children:[(0,a.jsx)(t.td,{children:(0,a.jsx)(t.code,{children:"--datastore-cafile"})}),(0,a.jsx)(t.td,{children:(0,a.jsx)(t.code,{children:"K3S_DATASTORE_CAFILE"})}),(0,a.jsx)(t.td,{children:"TLS Certificate Authority (CA) file used to help secure communication with the datastore. If your datastore serves requests over TLS using a certificate signed by a custom certificate authority, you can specify that CA using this parameter so that the K3s client can properly verify the certificate."})]}),(0,a.jsxs)(t.tr,{children:[(0,a.jsx)(t.td,{children:(0,a.jsx)(t.code,{children:"--datastore-certfile"})}),(0,a.jsx)(t.td,{children:(0,a.jsx)(t.code,{children:"K3S_DATASTORE_CERTFILE"})}),(0,a.jsxs)(t.td,{children:["TLS certificate file used for client certificate based authentication to your datastore. To use this feature, your datastore must be configured to support client certificate based authentication. If you specify this parameter, you must also specify the ",(0,a.jsx)(t.code,{children:"datastore-keyfile"})," parameter."]})]}),(0,a.jsxs)(t.tr,{children:[(0,a.jsx)(t.td,{children:(0,a.jsx)(t.code,{children:"--datastore-keyfile"})}),(0,a.jsx)(t.td,{children:(0,a.jsx)(t.code,{children:"K3S_DATASTORE_KEYFILE"})}),(0,a.jsxs)(t.td,{children:["TLS key file used for client certificate based authentication to your datastore. See the previous ",(0,a.jsx)(t.code,{children:"datastore-certfile"})," parameter for more details."]})]})]})]}),"\n",(0,a.jsx)(t.p,{children:"As a best practice we recommend setting these parameters as environment variables rather than command line arguments so that your database credentials or other sensitive information aren't exposed as part of the process info."}),"\n",(0,a.jsx)(t.h3,{id:"datastore-endpoint-format-and-functionality",children:"Datastore Endpoint Format and Functionality"}),"\n",(0,a.jsxs)(t.p,{children:["As mentioned, the format of the value passed to the ",(0,a.jsx)(t.code,{children:"datastore-endpoint"})," parameter is dependent upon the datastore backend. The following details this format and functionality for each supported external datastore."]}),"\n",(0,a.jsxs)(n,{queryString:"ext-db",children:[(0,a.jsxs)(s,{value:"PostgreSQL",children:[(0,a.jsx)(t.p,{children:"In its most common form, the datastore-endpoint parameter for PostgreSQL has the following format:"}),(0,a.jsx)(t.p,{children:(0,a.jsx)(t.code,{children:"postgres://username:password@hostname:port/database-name"})}),(0,a.jsxs)(t.p,{children:["More advanced configuration parameters are available. For more information on these, please see ",(0,a.jsx)(t.a,{href:"https://godoc.org/github.com/lib/pq",children:"https://godoc.org/github.com/lib/pq"}),"."]}),(0,a.jsx)(t.p,{children:"If you specify a database name and it does not exist, the server will attempt to create it."}),(0,a.jsxs)(t.p,{children:["If you only supply ",(0,a.jsx)(t.code,{children:"postgres://"})," as the endpoint, K3s will attempt to do the following:"]}),(0,a.jsxs)(t.ul,{children:["\n",(0,a.jsxs)(t.li,{children:["Connect to localhost using ",(0,a.jsx)(t.code,{children:"postgres"})," as the username and password"]}),"\n",(0,a.jsxs)(t.li,{children:["Create a database named ",(0,a.jsx)(t.code,{children:"kubernetes"})]}),"\n"]})]}),(0,a.jsxs)(s,{value:"MySQL / MariaDB",children:[(0,a.jsxs)(t.p,{children:["In its most common form, the ",(0,a.jsx)(t.code,{children:"datastore-endpoint"})," parameter for MySQL and MariaDB has the following format:"]}),(0,a.jsx)(t.p,{children:(0,a.jsx)(t.code,{children:"mysql://username:password@tcp(hostname:3306)/database-name"})}),(0,a.jsxs)(t.p,{children:["More advanced configuration parameters are available. For more information on these, please see ",(0,a.jsx)(t.a,{href:"https://github.com/go-sql-driver/mysql#dsn-data-source-name",children:"https://github.com/go-sql-driver/mysql#dsn-data-source-name"})]}),(0,a.jsxs)(t.p,{children:["Note that due to a ",(0,a.jsx)(t.a,{href:"https://github.com/k3s-io/k3s/issues/1093",children:"known issue"})," in K3s, you cannot set the ",(0,a.jsx)(t.code,{children:"tls"}),' parameter. TLS communication is supported, but you cannot, for example, set this parameter to "skip-verify" to cause K3s to skip certificate verification.']}),(0,a.jsx)(t.p,{children:"If you specify a database name and it does not exist, the server will attempt to create it."}),(0,a.jsxs)(t.p,{children:["If you only supply ",(0,a.jsx)(t.code,{children:"mysql://"})," as the endpoint, K3s will attempt to do the following:"]}),(0,a.jsxs)(t.ul,{children:["\n",(0,a.jsxs)(t.li,{children:["Connect to the MySQL socket at ",(0,a.jsx)(t.code,{children:"/var/run/mysqld/mysqld.sock"})," using the ",(0,a.jsx)(t.code,{children:"root"})," user and no password"]}),"\n",(0,a.jsxs)(t.li,{children:["Create a database with the name ",(0,a.jsx)(t.code,{children:"kubernetes"})]}),"\n"]})]}),(0,a.jsxs)(s,{value:"etcd",children:[(0,a.jsxs)(t.p,{children:["In its most common form, the ",(0,a.jsx)(t.code,{children:"datastore-endpoint"})," parameter for etcd has the following format:"]}),(0,a.jsx)(t.p,{children:(0,a.jsx)(t.code,{children:"https://etcd-host-1:2379,https://etcd-host-2:2379,https://etcd-host-3:2379"})}),(0,a.jsx)(t.p,{children:"The above assumes a typical three node etcd cluster. The parameter can accept one more comma separated etcd URLs."})]})]})]})}function h(e={}){const{wrapper:t}={...(0,r.a)(),...e.components};return t?(0,a.jsx)(t,{...e,children:(0,a.jsx)(l,{...e})}):l(e)}function u(e,t){throw new Error("Expected "+(t?"component":"object")+" `"+e+"` to be defined: you likely forgot to import, pass, or provide it.")}},1151:(e,t,s)=>{s.d(t,{Z:()=>i,a:()=>o});var a=s(7294);const r={},n=a.createContext(r);function o(e){const t=a.useContext(n);return a.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function i(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(r):e.components||r:o(e.components),a.createElement(n.Provider,{value:t},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/ab60f49a.961512bd.js b/assets/js/ab60f49a.814ea337.js similarity index 99% rename from assets/js/ab60f49a.961512bd.js rename to assets/js/ab60f49a.814ea337.js index 5d8e1caef..d2dc60f1e 100644 --- a/assets/js/ab60f49a.961512bd.js +++ b/assets/js/ab60f49a.814ea337.js @@ -1 +1 @@ -"use strict";(self.webpackChunkk_3_s_docs=self.webpackChunkk_3_s_docs||[]).push([[3555],{2688:(e,r,t)=>{t.r(r),t.d(r,{assets:()=>c,contentTitle:()=>a,default:()=>u,frontMatter:()=>i,metadata:()=>l,toc:()=>o});var s=t(5893),n=t(1151);const i={title:"CIS 1.24 Self Assessment Guide"},a=void 0,l={id:"security/self-assessment-1.24",title:"CIS 1.24 Self Assessment Guide",description:"Overview",source:"@site/docs/security/self-assessment-1.24.md",sourceDirName:"security",slug:"/security/self-assessment-1.24",permalink:"/security/self-assessment-1.24",draft:!1,unlisted:!1,editUrl:"https://github.com/k3s-io/docs/edit/main/docs/security/self-assessment-1.24.md",tags:[],version:"current",lastUpdatedAt:1723651727e3,frontMatter:{title:"CIS 1.24 Self Assessment Guide"},sidebar:"mySidebar",previous:{title:"CIS 1.7 Self Assessment Guide",permalink:"/security/self-assessment-1.7"},next:{title:"CLI Tools",permalink:"/cli/"}},c={},o=[{value:"Overview",id:"overview",level:2},{value:"Testing controls methodology",id:"testing-controls-methodology",level:3},{value:"1.1 Control Plane Node Configuration Files",id:"11-control-plane-node-configuration-files",level:2},{value:"1.1.1 Ensure that the API server pod specification file permissions are set to 644 or more restrictive (Automated)",id:"111-ensure-that-the-api-server-pod-specification-file-permissions-are-set-to-644-or-more-restrictive-automated",level:3},{value:"1.1.2 Ensure that the API server pod specification file ownership is set to root (Automated)",id:"112-ensure-that-the-api-server-pod-specification-file-ownership-is-set-to-root-automated",level:3},{value:"1.1.3 Ensure that the controller manager pod specification file permissions are set to 600 or more restrictive (Automated)",id:"113-ensure-that-the-controller-manager-pod-specification-file-permissions-are-set-to-600-or-more-restrictive-automated",level:3},{value:"1.1.4 Ensure that the controller manager pod specification file ownership is set to root (Automated)",id:"114-ensure-that-the-controller-manager-pod-specification-file-ownership-is-set-to-root-automated",level:3},{value:"1.1.5 Ensure that the scheduler pod specification file permissions are set to 600 or more restrictive (Automated)",id:"115-ensure-that-the-scheduler-pod-specification-file-permissions-are-set-to-600-or-more-restrictive-automated",level:3},{value:"1.1.6 Ensure that the scheduler pod specification file ownership is set to root (Automated)",id:"116-ensure-that-the-scheduler-pod-specification-file-ownership-is-set-to-root-automated",level:3},{value:"1.1.7 Ensure that the etcd pod specification file permissions are set to 600 or more restrictive (Automated)",id:"117-ensure-that-the-etcd-pod-specification-file-permissions-are-set-to-600-or-more-restrictive-automated",level:3},{value:"1.1.8 Ensure that the etcd pod specification file ownership is set to root (Automated)",id:"118-ensure-that-the-etcd-pod-specification-file-ownership-is-set-to-root-automated",level:3},{value:"1.1.9 Ensure that the Container Network Interface file permissions are set to 600 or more restrictive (Automated)",id:"119-ensure-that-the-container-network-interface-file-permissions-are-set-to-600-or-more-restrictive-automated",level:3},{value:"1.1.10 Ensure that the Container Network Interface file ownership is set to root (Manual)",id:"1110-ensure-that-the-container-network-interface-file-ownership-is-set-to-root-manual",level:3},{value:"1.1.11 Ensure that the etcd data directory permissions are set to 700 or more restrictive (Automated)",id:"1111-ensure-that-the-etcd-data-directory-permissions-are-set-to-700-or-more-restrictive-automated",level:3},{value:"1.1.12 Ensure that the etcd data directory ownership is set to etcd (Automated)",id:"1112-ensure-that-the-etcd-data-directory-ownership-is-set-to-etcd-automated",level:3},{value:"1.1.13 Ensure that the admin.conf file permissions are set to 600 or more restrictive (Automated)",id:"1113-ensure-that-the-adminconf-file-permissions-are-set-to-600-or-more-restrictive-automated",level:3},{value:"1.1.14 Ensure that the admin.conf file ownership is set to root (Automated)",id:"1114-ensure-that-the-adminconf-file-ownership-is-set-to-root-automated",level:3},{value:"1.1.15 Ensure that the scheduler.conf file permissions are set to 600 or more restrictive (Automated)",id:"1115-ensure-that-the-schedulerconf-file-permissions-are-set-to-600-or-more-restrictive-automated",level:3},{value:"1.1.16 Ensure that the scheduler.conf file ownership is set to root (Automated)",id:"1116-ensure-that-the-schedulerconf-file-ownership-is-set-to-root-automated",level:3},{value:"1.1.17 Ensure that the controller-manager.conf file permissions are set to 600 or more restrictive (Automated)",id:"1117-ensure-that-the-controller-managerconf-file-permissions-are-set-to-600-or-more-restrictive-automated",level:3},{value:"1.1.18 Ensure that the controller-manager.conf file ownership is set to root (Automated)",id:"1118-ensure-that-the-controller-managerconf-file-ownership-is-set-to-root-automated",level:3},{value:"1.1.19 Ensure that the Kubernetes PKI directory and file ownership is set to root (Automated)",id:"1119-ensure-that-the-kubernetes-pki-directory-and-file-ownership-is-set-to-root-automated",level:3},{value:"1.1.20 Ensure that the Kubernetes PKI certificate file permissions are set to 600 or more restrictive (Manual)",id:"1120-ensure-that-the-kubernetes-pki-certificate-file-permissions-are-set-to-600-or-more-restrictive-manual",level:3},{value:"1.1.21 Ensure that the Kubernetes PKI key file permissions are set to 600 (Automated)",id:"1121-ensure-that-the-kubernetes-pki-key-file-permissions-are-set-to-600-automated",level:3},{value:"1.2 API Server",id:"12-api-server",level:2},{value:"1.2.1 Ensure that the --anonymous-auth argument is set to false (Automated)",id:"121-ensure-that-the---anonymous-auth-argument-is-set-to-false-automated",level:3},{value:"1.2.2 Ensure that the --token-auth-file parameter is not set (Automated)",id:"122-ensure-that-the---token-auth-file-parameter-is-not-set-automated",level:3},{value:"1.2.3 Ensure that the --DenyServiceExternalIPs is not set (Automated)",id:"123-ensure-that-the---denyserviceexternalips-is-not-set-automated",level:3},{value:"1.2.4 Ensure that the --kubelet-https argument is set to true (Automated)",id:"124-ensure-that-the---kubelet-https-argument-is-set-to-true-automated",level:3},{value:"1.2.5 Ensure that the --kubelet-client-certificate and --kubelet-client-key arguments are set as appropriate (Automated)",id:"125-ensure-that-the---kubelet-client-certificate-and---kubelet-client-key-arguments-are-set-as-appropriate-automated",level:3},{value:"1.2.6 Ensure that the --kubelet-certificate-authority argument is set as appropriate (Automated)",id:"126-ensure-that-the---kubelet-certificate-authority-argument-is-set-as-appropriate-automated",level:3},{value:"1.2.7 Ensure that the --authorization-mode argument is not set to AlwaysAllow (Automated)",id:"127-ensure-that-the---authorization-mode-argument-is-not-set-to-alwaysallow-automated",level:3},{value:"1.2.8 Ensure that the --authorization-mode argument includes Node (Automated)",id:"128-ensure-that-the---authorization-mode-argument-includes-node-automated",level:3},{value:"1.2.9 Ensure that the --authorization-mode argument includes RBAC (Automated)",id:"129-ensure-that-the---authorization-mode-argument-includes-rbac-automated",level:3},{value:"1.2.10 Ensure that the admission control plugin EventRateLimit is set (Manual)",id:"1210-ensure-that-the-admission-control-plugin-eventratelimit-is-set-manual",level:3},{value:"1.2.11 Ensure that the admission control plugin AlwaysAdmit is not set (Automated)",id:"1211-ensure-that-the-admission-control-plugin-alwaysadmit-is-not-set-automated",level:3},{value:"1.2.12 Ensure that the admission control plugin AlwaysPullImages is set (Manual)",id:"1212-ensure-that-the-admission-control-plugin-alwayspullimages-is-set-manual",level:3},{value:"1.2.13 Ensure that the admission control plugin SecurityContextDeny is set if PodSecurityPolicy is not used (Manual)",id:"1213-ensure-that-the-admission-control-plugin-securitycontextdeny-is-set-if-podsecuritypolicy-is-not-used-manual",level:3},{value:"1.2.14 Ensure that the admission control plugin ServiceAccount is set (Automated)",id:"1214-ensure-that-the-admission-control-plugin-serviceaccount-is-set-automated",level:3},{value:"1.2.15 Ensure that the admission control plugin NamespaceLifecycle is set (Automated)",id:"1215-ensure-that-the-admission-control-plugin-namespacelifecycle-is-set-automated",level:3},{value:"1.2.16 Ensure that the admission control plugin NodeRestriction is set (Automated)",id:"1216-ensure-that-the-admission-control-plugin-noderestriction-is-set-automated",level:3},{value:"1.2.17 Ensure that the --secure-port argument is not set to 0 (Automated)",id:"1217-ensure-that-the---secure-port-argument-is-not-set-to-0-automated",level:3},{value:"1.2.18 Ensure that the --profiling argument is set to false (Automated)",id:"1218-ensure-that-the---profiling-argument-is-set-to-false-automated",level:3},{value:"1.2.19 Ensure that the --audit-log-path argument is set (Manual)",id:"1219-ensure-that-the---audit-log-path-argument-is-set-manual",level:3},{value:"1.2.20 Ensure that the --audit-log-maxage argument is set to 30 or as appropriate (Automated)",id:"1220-ensure-that-the---audit-log-maxage-argument-is-set-to-30-or-as-appropriate-automated",level:3},{value:"1.2.21 Ensure that the --audit-log-maxbackup argument is set to 10 or as appropriate (Automated)",id:"1221-ensure-that-the---audit-log-maxbackup-argument-is-set-to-10-or-as-appropriate-automated",level:3},{value:"1.2.22 Ensure that the --audit-log-maxsize argument is set to 100 or as appropriate (Automated)",id:"1222-ensure-that-the---audit-log-maxsize-argument-is-set-to-100-or-as-appropriate-automated",level:3},{value:"1.2.23 Ensure that the --request-timeout argument is set as appropriate (Manual)",id:"1223-ensure-that-the---request-timeout-argument-is-set-as-appropriate-manual",level:3},{value:"1.2.24 Ensure that the --service-account-lookup argument is set to true (Automated)",id:"1224-ensure-that-the---service-account-lookup-argument-is-set-to-true-automated",level:3},{value:"1.2.25 Ensure that the --service-account-key-file argument is set as appropriate (Automated)",id:"1225-ensure-that-the---service-account-key-file-argument-is-set-as-appropriate-automated",level:3},{value:"1.2.26 Ensure that the --etcd-certfile and --etcd-keyfile arguments are set as appropriate (Automated)",id:"1226-ensure-that-the---etcd-certfile-and---etcd-keyfile-arguments-are-set-as-appropriate-automated",level:3},{value:"1.2.27 Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate (Automated)",id:"1227-ensure-that-the---tls-cert-file-and---tls-private-key-file-arguments-are-set-as-appropriate-automated",level:3},{value:"1.2.28 Ensure that the --client-ca-file argument is set as appropriate (Automated)",id:"1228-ensure-that-the---client-ca-file-argument-is-set-as-appropriate-automated",level:3},{value:"1.2.29 Ensure that the --etcd-cafile argument is set as appropriate (Automated)",id:"1229-ensure-that-the---etcd-cafile-argument-is-set-as-appropriate-automated",level:3},{value:"1.2.30 Ensure that the --encryption-provider-config argument is set as appropriate (Manual)",id:"1230-ensure-that-the---encryption-provider-config-argument-is-set-as-appropriate-manual",level:3},{value:"1.2.31 Ensure that encryption providers are appropriately configured (Manual)",id:"1231-ensure-that-encryption-providers-are-appropriately-configured-manual",level:3},{value:"1.2.32 Ensure that the API Server only makes use of Strong Cryptographic Ciphers (Automated)",id:"1232-ensure-that-the-api-server-only-makes-use-of-strong-cryptographic-ciphers-automated",level:3},{value:"1.3 Controller Manager",id:"13-controller-manager",level:2},{value:"1.3.1 Ensure that the --terminated-pod-gc-threshold argument is set as appropriate (Manual)",id:"131-ensure-that-the---terminated-pod-gc-threshold-argument-is-set-as-appropriate-manual",level:3},{value:"1.3.2 Ensure that the --profiling argument is set to false (Automated)",id:"132-ensure-that-the---profiling-argument-is-set-to-false-automated",level:3},{value:"1.3.3 Ensure that the --use-service-account-credentials argument is set to true (Automated)",id:"133-ensure-that-the---use-service-account-credentials-argument-is-set-to-true-automated",level:3},{value:"1.3.4 Ensure that the --service-account-private-key-file argument is set as appropriate (Automated)",id:"134-ensure-that-the---service-account-private-key-file-argument-is-set-as-appropriate-automated",level:3},{value:"1.3.5 Ensure that the --root-ca-file argument is set as appropriate (Automated)",id:"135-ensure-that-the---root-ca-file-argument-is-set-as-appropriate-automated",level:3},{value:"1.3.6 Ensure that the RotateKubeletServerCertificate argument is set to true (Automated)",id:"136-ensure-that-the-rotatekubeletservercertificate-argument-is-set-to-true-automated",level:3},{value:"1.3.7 Ensure that the --bind-address argument is set to 127.0.0.1 (Automated)",id:"137-ensure-that-the---bind-address-argument-is-set-to-127001-automated",level:3},{value:"1.4 Scheduler",id:"14-scheduler",level:2},{value:"1.4.1 Ensure that the --profiling argument is set to false (Automated)",id:"141-ensure-that-the---profiling-argument-is-set-to-false-automated",level:3},{value:"1.4.2 Ensure that the --bind-address argument is set to 127.0.0.1 (Automated)",id:"142-ensure-that-the---bind-address-argument-is-set-to-127001-automated",level:3},{value:"2 Etcd Node Configuration",id:"2-etcd-node-configuration",level:2},{value:"2.1 Ensure that the --cert-file and --key-file arguments are set as appropriate (Automated)",id:"21-ensure-that-the---cert-file-and---key-file-arguments-are-set-as-appropriate-automated",level:3},{value:"2.2 Ensure that the --client-cert-auth argument is set to true (Automated)",id:"22-ensure-that-the---client-cert-auth-argument-is-set-to-true-automated",level:3},{value:"2.3 Ensure that the --auto-tls argument is not set to true (Automated)",id:"23-ensure-that-the---auto-tls-argument-is-not-set-to-true-automated",level:3},{value:"2.4 Ensure that the --peer-cert-file and --peer-key-file arguments are set as appropriate (Automated)",id:"24-ensure-that-the---peer-cert-file-and---peer-key-file-arguments-are-set-as-appropriate-automated",level:3},{value:"2.5 Ensure that the --peer-client-cert-auth argument is set to true (Automated)",id:"25-ensure-that-the---peer-client-cert-auth-argument-is-set-to-true-automated",level:3},{value:"2.6 Ensure that the --peer-auto-tls argument is not set to true (Automated)",id:"26-ensure-that-the---peer-auto-tls-argument-is-not-set-to-true-automated",level:3},{value:"2.7 Ensure that a unique Certificate Authority is used for etcd (Automated)",id:"27-ensure-that-a-unique-certificate-authority-is-used-for-etcd-automated",level:3},{value:"4.1 Worker Node Configuration Files",id:"41-worker-node-configuration-files",level:2},{value:"4.1.1 Ensure that the kubelet service file permissions are set to 600 or more restrictive (Automated)",id:"411-ensure-that-the-kubelet-service-file-permissions-are-set-to-600-or-more-restrictive-automated",level:3},{value:"4.1.2 Ensure that the kubelet service file ownership is set to root (Automated)",id:"412-ensure-that-the-kubelet-service-file-ownership-is-set-to-root-automated",level:3},{value:"4.1.3 If proxy kubeconfig file exists ensure permissions are set to 600 or more restrictive (Automated)",id:"413-if-proxy-kubeconfig-file-exists-ensure-permissions-are-set-to-600-or-more-restrictive-automated",level:3},{value:"4.1.4 If proxy kubeconfig file exists ensure ownership is set to root (Automated)",id:"414-if-proxy-kubeconfig-file-exists-ensure-ownership-is-set-to-root-automated",level:3},{value:"4.1.5 Ensure that the --kubeconfig kubelet.conf file permissions are set to 600 or more restrictive (Automated)",id:"415-ensure-that-the---kubeconfig-kubeletconf-file-permissions-are-set-to-600-or-more-restrictive-automated",level:3},{value:"4.1.6 Ensure that the --kubeconfig kubelet.conf file ownership is set to root (Automated)",id:"416-ensure-that-the---kubeconfig-kubeletconf-file-ownership-is-set-to-root-automated",level:3},{value:"4.1.7 Ensure that the certificate authorities file permissions are set to 600 or more restrictive (Automated)",id:"417-ensure-that-the-certificate-authorities-file-permissions-are-set-to-600-or-more-restrictive-automated",level:3},{value:"4.1.8 Ensure that the client certificate authorities file ownership is set to root (Automated)",id:"418-ensure-that-the-client-certificate-authorities-file-ownership-is-set-to-root-automated",level:3},{value:"4.1.9 If the kubelet config.yaml configuration file is being used validate permissions set to 600 or more restrictive (Automated)",id:"419-if-the-kubelet-configyaml-configuration-file-is-being-used-validate-permissions-set-to-600-or-more-restrictive-automated",level:3},{value:"4.1.10 If the kubelet config.yaml configuration file is being used validate file ownership is set to root (Automated)",id:"4110-if-the-kubelet-configyaml-configuration-file-is-being-used-validate-file-ownership-is-set-to-root-automated",level:3},{value:"4.2 Kubelet",id:"42-kubelet",level:2},{value:"4.2.1 Ensure that the --anonymous-auth argument is set to false (Automated)",id:"421-ensure-that-the---anonymous-auth-argument-is-set-to-false-automated",level:3},{value:"4.2.2 Ensure that the --authorization-mode argument is not set to AlwaysAllow (Automated)",id:"422-ensure-that-the---authorization-mode-argument-is-not-set-to-alwaysallow-automated",level:3},{value:"4.2.3 Ensure that the --client-ca-file argument is set as appropriate (Automated)",id:"423-ensure-that-the---client-ca-file-argument-is-set-as-appropriate-automated",level:3},{value:"4.2.4 Verify that the --read-only-port argument is set to 0 (Automated)",id:"424-verify-that-the---read-only-port-argument-is-set-to-0-automated",level:3},{value:"4.2.5 Ensure that the --streaming-connection-idle-timeout argument is not set to 0 (Manual)",id:"425-ensure-that-the---streaming-connection-idle-timeout-argument-is-not-set-to-0-manual",level:3},{value:"4.2.6 Ensure that the --protect-kernel-defaults argument is set to true (Automated)",id:"426-ensure-that-the---protect-kernel-defaults-argument-is-set-to-true-automated",level:3},{value:"4.2.7 Ensure that the --make-iptables-util-chains argument is set to true (Automated)",id:"427-ensure-that-the---make-iptables-util-chains-argument-is-set-to-true-automated",level:3},{value:"4.2.8 Ensure that the --hostname-override argument is not set (Automated)",id:"428-ensure-that-the---hostname-override-argument-is-not-set-automated",level:3},{value:"4.2.9 Ensure that the eventRecordQPS argument is set to a level which ensures appropriate event capture (Manual)",id:"429-ensure-that-the-eventrecordqps-argument-is-set-to-a-level-which-ensures-appropriate-event-capture-manual",level:3},{value:"4.2.10 Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate (Automated)",id:"4210-ensure-that-the---tls-cert-file-and---tls-private-key-file-arguments-are-set-as-appropriate-automated",level:3},{value:"4.2.11 Ensure that the --rotate-certificates argument is not set to false (Automated)",id:"4211-ensure-that-the---rotate-certificates-argument-is-not-set-to-false-automated",level:3},{value:"4.2.12 Verify that the RotateKubeletServerCertificate argument is set to true (Automated)",id:"4212-verify-that-the-rotatekubeletservercertificate-argument-is-set-to-true-automated",level:3},{value:"4.2.13 Ensure that the Kubelet only makes use of Strong Cryptographic Ciphers (Manual)",id:"4213-ensure-that-the-kubelet-only-makes-use-of-strong-cryptographic-ciphers-manual",level:3},{value:"5.1 RBAC and Service Accounts",id:"51-rbac-and-service-accounts",level:2},{value:"5.1.1 Ensure that the cluster-admin role is only used where required (Manual)",id:"511-ensure-that-the-cluster-admin-role-is-only-used-where-required-manual",level:3},{value:"5.1.2 Minimize access to secrets (Manual)",id:"512-minimize-access-to-secrets-manual",level:3},{value:"5.1.3 Minimize wildcard use in Roles and ClusterRoles (Manual)",id:"513-minimize-wildcard-use-in-roles-and-clusterroles-manual",level:3},{value:"5.1.4 Minimize access to create pods (Manual)",id:"514-minimize-access-to-create-pods-manual",level:3},{value:"5.1.5 Ensure that default service accounts are not actively used. (Manual)",id:"515-ensure-that-default-service-accounts-are-not-actively-used-manual",level:3},{value:"5.1.6 Ensure that Service Account Tokens are only mounted where necessary (Manual)",id:"516-ensure-that-service-account-tokens-are-only-mounted-where-necessary-manual",level:3},{value:"5.1.7 Avoid use of system group (Manual)",id:"517-avoid-use-of-system-group-manual",level:3},{value:"5.1.8 Limit use of the Bind, Impersonate and Escalate permissions in the Kubernetes cluster (Manual)",id:"518-limit-use-of-the-bind-impersonate-and-escalate-permissions-in-the-kubernetes-cluster-manual",level:3},{value:"5.2 Pod Security Standards",id:"52-pod-security-standards",level:2},{value:"5.2.1 Ensure that the cluster has at least one active policy control mechanism in place (Manual)",id:"521-ensure-that-the-cluster-has-at-least-one-active-policy-control-mechanism-in-place-manual",level:3},{value:"5.2.2 Minimize the admission of privileged containers (Manual)",id:"522-minimize-the-admission-of-privileged-containers-manual",level:3},{value:"5.2.3 Minimize the admission of containers wishing to share the host process ID namespace (Automated)",id:"523-minimize-the-admission-of-containers-wishing-to-share-the-host-process-id-namespace-automated",level:3},{value:"5.2.4 Minimize the admission of containers wishing to share the host IPC namespace (Automated)",id:"524-minimize-the-admission-of-containers-wishing-to-share-the-host-ipc-namespace-automated",level:3},{value:"5.2.5 Minimize the admission of containers wishing to share the host network namespace (Automated)",id:"525-minimize-the-admission-of-containers-wishing-to-share-the-host-network-namespace-automated",level:3},{value:"5.2.6 Minimize the admission of containers with allowPrivilegeEscalation (Automated)",id:"526-minimize-the-admission-of-containers-with-allowprivilegeescalation-automated",level:3},{value:"5.2.7 Minimize the admission of root containers (Automated)",id:"527-minimize-the-admission-of-root-containers-automated",level:3},{value:"5.2.8 Minimize the admission of containers with the NET_RAW capability (Automated)",id:"528-minimize-the-admission-of-containers-with-the-net_raw-capability-automated",level:3},{value:"5.2.9 Minimize the admission of containers with added capabilities (Automated)",id:"529-minimize-the-admission-of-containers-with-added-capabilities-automated",level:3},{value:"5.2.10 Minimize the admission of containers with capabilities assigned (Manual)",id:"5210-minimize-the-admission-of-containers-with-capabilities-assigned-manual",level:3},{value:"5.2.11 Minimize the admission of Windows HostProcess containers (Manual)",id:"5211-minimize-the-admission-of-windows-hostprocess-containers-manual",level:3},{value:"5.2.12 Minimize the admission of HostPath volumes (Manual)",id:"5212-minimize-the-admission-of-hostpath-volumes-manual",level:3},{value:"5.2.13 Minimize the admission of containers which use HostPorts (Manual)",id:"5213-minimize-the-admission-of-containers-which-use-hostports-manual",level:3},{value:"5.3 Network Policies and CNI",id:"53-network-policies-and-cni",level:2},{value:"5.3.1 Ensure that the CNI in use supports NetworkPolicies (Manual)",id:"531-ensure-that-the-cni-in-use-supports-networkpolicies-manual",level:3},{value:"5.3.2 Ensure that all Namespaces have NetworkPolicies defined (Manual)",id:"532-ensure-that-all-namespaces-have-networkpolicies-defined-manual",level:3},{value:"5.4 Secrets Management",id:"54-secrets-management",level:2},{value:"5.4.1 Prefer using Secrets as files over Secrets as environment variables (Manual)",id:"541-prefer-using-secrets-as-files-over-secrets-as-environment-variables-manual",level:3},{value:"5.4.2 Consider external secret storage (Manual)",id:"542-consider-external-secret-storage-manual",level:3},{value:"5.5 Extensible Admission Control",id:"55-extensible-admission-control",level:2},{value:"5.5.1 Configure Image Provenance using ImagePolicyWebhook admission controller (Manual)",id:"551-configure-image-provenance-using-imagepolicywebhook-admission-controller-manual",level:3},{value:"5.7 General Policies",id:"57-general-policies",level:2},{value:"5.7.1 Create administrative boundaries between resources using namespaces (Manual)",id:"571-create-administrative-boundaries-between-resources-using-namespaces-manual",level:3},{value:"5.7.2 Ensure that the seccomp profile is set to docker/default in your Pod definitions (Manual)",id:"572-ensure-that-the-seccomp-profile-is-set-to-dockerdefault-in-your-pod-definitions-manual",level:3},{value:"5.7.3 Apply SecurityContext to your Pods and Containers (Manual)",id:"573-apply-securitycontext-to-your-pods-and-containers-manual",level:3},{value:"5.7.4 The default namespace should not be used (Manual)",id:"574-the-default-namespace-should-not-be-used-manual",level:3}];function d(e){const r={a:"a",code:"code",h2:"h2",h3:"h3",li:"li",p:"p",pre:"pre",strong:"strong",ul:"ul",...(0,n.a)(),...e.components},{Details:t}=r;return t||function(e,r){throw new Error("Expected "+(r?"component":"object")+" `"+e+"` to be defined: you likely forgot to import, pass, or provide it.")}("Details",!0),(0,s.jsxs)(s.Fragment,{children:[(0,s.jsx)(r.h2,{id:"overview",children:"Overview"}),"\n",(0,s.jsxs)(r.p,{children:["This document is a companion to the ",(0,s.jsx)(r.a,{href:"/security/hardening-guide",children:"K3s security hardening guide"}),". The hardening guide provides prescriptive guidance for hardening a production installation of K3s, and this benchmark guide is meant to help you evaluate the level of security of the hardened cluster against each control in the CIS Kubernetes Benchmark. It is to be used by K3s operators, security teams, auditors, and decision-makers."]}),"\n",(0,s.jsxs)(r.p,{children:["This guide is specific to the ",(0,s.jsx)(r.strong,{children:"v1.24"})," release line of K3s and the ",(0,s.jsx)(r.strong,{children:"v1.24"})," release of the CIS Kubernetes Benchmark."]}),"\n",(0,s.jsxs)(r.p,{children:["For more information about each control, including detailed descriptions and remediations for failing tests, you can refer to the corresponding section of the CIS Kubernetes Benchmark v1.6. You can download the benchmark, after creating a free account, in ",(0,s.jsx)(r.a,{href:"https://www.cisecurity.org/benchmark/kubernetes/",children:"Center for Internet Security (CIS)"}),"."]}),"\n",(0,s.jsx)(r.h3,{id:"testing-controls-methodology",children:"Testing controls methodology"}),"\n",(0,s.jsx)(r.p,{children:"Each control in the CIS Kubernetes Benchmark was evaluated against a K3s cluster that was configured according to the accompanying hardening guide."}),"\n",(0,s.jsx)(r.p,{children:"Where control audits differ from the original CIS benchmark, the audit commands specific to K3s are provided for testing."}),"\n",(0,s.jsx)(r.p,{children:"These are the possible results for each control:"}),"\n",(0,s.jsxs)(r.ul,{children:["\n",(0,s.jsxs)(r.li,{children:[(0,s.jsx)(r.strong,{children:"Pass"})," - The K3s cluster under test passed the audit outlined in the benchmark."]}),"\n",(0,s.jsxs)(r.li,{children:[(0,s.jsx)(r.strong,{children:"Not Applicable"})," - The control is not applicable to K3s because of how it is designed to operate. The remediation section will explain why this is so."]}),"\n",(0,s.jsxs)(r.li,{children:[(0,s.jsx)(r.strong,{children:"Warn"})," - The control is manual in the CIS benchmark and it depends on the cluster's use case or some other factor that must be determined by the cluster operator. These controls have been evaluated to ensure K3s does not prevent their implementation, but no further configuration or auditing of the cluster under test has been performed."]}),"\n"]}),"\n",(0,s.jsx)(r.p,{children:'This guide makes the assumption that K3s is running as a Systemd unit. Your installation may vary and will require you to adjust the "audit" commands to fit your scenario.'}),"\n",(0,s.jsx)(r.h2,{id:"11-control-plane-node-configuration-files",children:"1.1 Control Plane Node Configuration Files"}),"\n",(0,s.jsx)(r.h3,{id:"111-ensure-that-the-api-server-pod-specification-file-permissions-are-set-to-644-or-more-restrictive-automated",children:"1.1.1 Ensure that the API server pod specification file permissions are set to 644 or more restrictive (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," Not Applicable"]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Rationale:"})}),"\n",(0,s.jsx)(r.p,{children:"By default, K3s embeds the api server within the k3s process. There is no API server pod specification file."}),"\n",(0,s.jsxs)(r.h3,{id:"112-ensure-that-the-api-server-pod-specification-file-ownership-is-set-to-root-automated",children:["1.1.2 Ensure that the API server pod specification file ownership is set to root",":root"," (Automated)"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," Not Applicable"]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Rationale:"})}),"\n",(0,s.jsx)(r.p,{children:"By default, K3s embeds the api server within the k3s process. There is no API server pod specification file."}),"\n",(0,s.jsx)(r.h3,{id:"113-ensure-that-the-controller-manager-pod-specification-file-permissions-are-set-to-600-or-more-restrictive-automated",children:"1.1.3 Ensure that the controller manager pod specification file permissions are set to 600 or more restrictive (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," Not Applicable"]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Rationale:"})}),"\n",(0,s.jsx)(r.p,{children:"By default, K3s embeds the controller manager within the k3s process. There is no controller manager pod specification file."}),"\n",(0,s.jsxs)(r.h3,{id:"114-ensure-that-the-controller-manager-pod-specification-file-ownership-is-set-to-root-automated",children:["1.1.4 Ensure that the controller manager pod specification file ownership is set to root",":root"," (Automated)"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," Not Applicable"]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Rationale:"})}),"\n",(0,s.jsx)(r.p,{children:"By default, K3s embeds the controller manager within the k3s process. There is no controller manager pod specification file."}),"\n",(0,s.jsx)(r.h3,{id:"115-ensure-that-the-scheduler-pod-specification-file-permissions-are-set-to-600-or-more-restrictive-automated",children:"1.1.5 Ensure that the scheduler pod specification file permissions are set to 600 or more restrictive (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," Not Applicable"]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Rationale:"})}),"\n",(0,s.jsx)(r.p,{children:"By default, K3s embeds the scheduler within the k3s process. There is no scheduler pod specification file."}),"\n",(0,s.jsxs)(r.h3,{id:"116-ensure-that-the-scheduler-pod-specification-file-ownership-is-set-to-root-automated",children:["1.1.6 Ensure that the scheduler pod specification file ownership is set to root",":root"," (Automated)"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," Not Applicable"]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Rationale:"})}),"\n",(0,s.jsx)(r.p,{children:"By default, K3s embeds the scheduler within the k3s process. There is no scheduler pod specification file."}),"\n",(0,s.jsx)(r.h3,{id:"117-ensure-that-the-etcd-pod-specification-file-permissions-are-set-to-600-or-more-restrictive-automated",children:"1.1.7 Ensure that the etcd pod specification file permissions are set to 600 or more restrictive (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," Not Applicable"]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Rationale:"})}),"\n",(0,s.jsx)(r.p,{children:"By default, K3s embeds etcd within the k3s process. There is no etcd pod specification file."}),"\n",(0,s.jsxs)(r.h3,{id:"118-ensure-that-the-etcd-pod-specification-file-ownership-is-set-to-root-automated",children:["1.1.8 Ensure that the etcd pod specification file ownership is set to root",":root"," (Automated)"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," Not Applicable"]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Rationale:"})}),"\n",(0,s.jsx)(r.p,{children:"By default, K3s embeds etcd within the k3s process. There is no etcd pod specification file."}),"\n",(0,s.jsx)(r.h3,{id:"119-ensure-that-the-container-network-interface-file-permissions-are-set-to-600-or-more-restrictive-automated",children:"1.1.9 Ensure that the Container Network Interface file permissions are set to 600 or more restrictive (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," Not Applicable"]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Rationale:"})}),"\n",(0,s.jsx)(r.p,{children:"The default K3s CNI, flannel, does not create any files in /var/lib/cni/networks."}),"\n",(0,s.jsxs)(r.h3,{id:"1110-ensure-that-the-container-network-interface-file-ownership-is-set-to-root-manual",children:["1.1.10 Ensure that the Container Network Interface file ownership is set to root",":root"," (Manual)"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," Not Applicable"]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Rationale:"})}),"\n",(0,s.jsx)(r.p,{children:"The default K3s CNI, flannel, does not create any files in /var/lib/cni/networks."}),"\n",(0,s.jsx)(r.h3,{id:"1111-ensure-that-the-etcd-data-directory-permissions-are-set-to-700-or-more-restrictive-automated",children:"1.1.11 Ensure that the etcd data directory permissions are set to 700 or more restrictive (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:'if [ "$(journalctl -u k3s | grep -m1 \'Managed etcd cluster\' | wc -l)" -gt 0 ]; then\n stat -c permissions=%a /var/lib/rancher/k3s/server/db/etcd\nelse\n echo "permissions=700"\nfi\n'})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result:"})," permissions has permissions 700, expected 700 or more restrictive"]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Returned Value:"})}),(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:"permissions=700\n"})})]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Remediation:"})}),(0,s.jsxs)(r.p,{children:["On the etcd server node, get the etcd data directory, passed as an argument --data-dir,\nfrom the command 'ps -ef | grep etcd'.\nRun the below command (based on the etcd data directory found above). For example,\n",(0,s.jsx)(r.code,{children:"chmod 700 /var/lib/etcd"})]})]}),"\n",(0,s.jsxs)(r.h3,{id:"1112-ensure-that-the-etcd-data-directory-ownership-is-set-to-etcd-automated",children:["1.1.12 Ensure that the etcd data directory ownership is set to etcd",":etcd"," (Automated)"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," Not Applicable"]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Rationale:"})}),"\n",(0,s.jsxs)(r.p,{children:["For K3s, etcd is embedded within the k3s process. There is no separate etcd process.\nTherefore the etcd data directory ownership is managed by the k3s process and should be root",":root","."]}),"\n",(0,s.jsx)(r.h3,{id:"1113-ensure-that-the-adminconf-file-permissions-are-set-to-600-or-more-restrictive-automated",children:"1.1.13 Ensure that the admin.conf file permissions are set to 600 or more restrictive (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," INFO"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nRun the below command (based on the file location on your system) on the control plane node.\nFor example, ",(0,s.jsx)(r.code,{children:"chmod 600 /var/lib/rancher/k3s/server/cred/admin.kubeconfig"})]}),"\n",(0,s.jsxs)(r.h3,{id:"1114-ensure-that-the-adminconf-file-ownership-is-set-to-root-automated",children:["1.1.14 Ensure that the admin.conf file ownership is set to root",":root"," (Automated)"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"/bin/sh -c 'if test -e /var/lib/rancher/k3s/server/cred/admin.kubeconfig; then stat -c %U:%G /var/lib/rancher/k3s/server/cred/admin.kubeconfig; fi'\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result:"})," 'root",":root","' is equal to 'root",":root","'"]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Returned Value:"})}),(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:"root:root\n"})})]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Remediation:"})}),(0,s.jsxs)(r.p,{children:["Run the below command (based on the file location on your system) on the control plane node.\nFor example, ",(0,s.jsx)(r.code,{children:"chown root:root /var/lib/rancher/k3s/server/cred/admin.kubeconfig"})]})]}),"\n",(0,s.jsx)(r.h3,{id:"1115-ensure-that-the-schedulerconf-file-permissions-are-set-to-600-or-more-restrictive-automated",children:"1.1.15 Ensure that the scheduler.conf file permissions are set to 600 or more restrictive (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"/bin/sh -c 'if test -e /var/lib/rancher/k3s/server/cred/scheduler.kubeconfig; then stat -c permissions=%a /var/lib/rancher/k3s/server/cred/scheduler.kubeconfig; fi'\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result:"})," permissions has permissions 600, expected 600 or more restrictive"]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Returned Value:"})}),(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:"permissions=600\n"})})]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Remediation:"})}),(0,s.jsxs)(r.p,{children:["Run the below command (based on the file location on your system) on the control plane node.\nFor example,\n",(0,s.jsx)(r.code,{children:"chmod 600 /var/lib/rancher/k3s/server/cred/scheduler.kubeconfig"})]})]}),"\n",(0,s.jsxs)(r.h3,{id:"1116-ensure-that-the-schedulerconf-file-ownership-is-set-to-root-automated",children:["1.1.16 Ensure that the scheduler.conf file ownership is set to root",":root"," (Automated)"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"/bin/sh -c 'if test -e /var/lib/rancher/k3s/server/cred/scheduler.kubeconfig; then stat -c %U:%G /var/lib/rancher/k3s/server/cred/scheduler.kubeconfig; fi'\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result:"})," 'root",":root","' is present"]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Returned Value:"})}),(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:"root:root\n"})})]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Remediation:"})}),(0,s.jsxs)(r.p,{children:["Run the below command (based on the file location on your system) on the control plane node.\nFor example,\n",(0,s.jsx)(r.code,{children:"chown root:root /var/lib/rancher/k3s/server/cred/scheduler.kubeconfig"})]})]}),"\n",(0,s.jsx)(r.h3,{id:"1117-ensure-that-the-controller-managerconf-file-permissions-are-set-to-600-or-more-restrictive-automated",children:"1.1.17 Ensure that the controller-manager.conf file permissions are set to 600 or more restrictive (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"/bin/sh -c 'if test -e /var/lib/rancher/k3s/server/cred/controller.kubeconfig; then stat -c permissions=%a /var/lib/rancher/k3s/server/cred/controller.kubeconfig; fi'\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result:"})," permissions has permissions 600, expected 600 or more restrictive"]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Returned Value:"})}),(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:"permissions=600\n"})})]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Remediation:"})}),(0,s.jsxs)(r.p,{children:["Run the below command (based on the file location on your system) on the control plane node.\nFor example,\n",(0,s.jsx)(r.code,{children:"chmod 600 /var/lib/rancher/k3s/server/cred/controller.kubeconfig"})]})]}),"\n",(0,s.jsxs)(r.h3,{id:"1118-ensure-that-the-controller-managerconf-file-ownership-is-set-to-root-automated",children:["1.1.18 Ensure that the controller-manager.conf file ownership is set to root",":root"," (Automated)"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"stat -c %U:%G /var/lib/rancher/k3s/server/tls\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result:"})," 'root",":root","' is equal to 'root",":root","'"]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Returned Value:"})}),(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:"root:root\n"})})]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Remediation:"})}),(0,s.jsxs)(r.p,{children:["Run the below command (based on the file location on your system) on the control plane node.\nFor example,\n",(0,s.jsx)(r.code,{children:"chown root:root /var/lib/rancher/k3s/server/cred/controller.kubeconfig"})]})]}),"\n",(0,s.jsxs)(r.h3,{id:"1119-ensure-that-the-kubernetes-pki-directory-and-file-ownership-is-set-to-root-automated",children:["1.1.19 Ensure that the Kubernetes PKI directory and file ownership is set to root",":root"," (Automated)"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"find /var/lib/rancher/k3s/server/tls | xargs stat -c %U:%G\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result:"})," 'root",":root","' is present"]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Returned Value:"})}),(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:"root:root\nroot:root\nroot:root\nroot:root\nroot:root\nroot:root\nroot:root\nroot:root\nroot:root\nroot:root\nroot:root\nroot:root\nroot:root\nroot:root\nroot:root\nroot:root\nroot:root\nroot:root\nroot:root\nroot:root\nroot:root\nroot:root\nroot:root\nroot:root\nroot:root\nroot:root\nroot:root\nroot:root\nroot:root\nroot:root\nroot:root\nroot:root\nroot:root\nroot:root\nroot:root\nroot:root\nroot:root\nroot:root\nroot:root\nroot:root\nroot:root\nroot:root\nroot:root\nroot:root\nroot:root\nroot:root\nroot:root\nroot:root\n"})})]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Remediation:"})}),(0,s.jsxs)(r.p,{children:["Run the below command (based on the file location on your system) on the control plane node.\nFor example,\n",(0,s.jsx)(r.code,{children:"chown -R root:root /etc/kubernetes/pki/"})]})]}),"\n",(0,s.jsx)(r.h3,{id:"1120-ensure-that-the-kubernetes-pki-certificate-file-permissions-are-set-to-600-or-more-restrictive-manual",children:"1.1.20 Ensure that the Kubernetes PKI certificate file permissions are set to 600 or more restrictive (Manual)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nRun the below command (based on the file location on your system) on the master node.\nFor example,\n",(0,s.jsx)(r.code,{children:"chmod -R 600 /var/lib/rancher/k3s/server/tls/*.crt"})]}),"\n",(0,s.jsx)(r.h3,{id:"1121-ensure-that-the-kubernetes-pki-key-file-permissions-are-set-to-600-automated",children:"1.1.21 Ensure that the Kubernetes PKI key file permissions are set to 600 (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"/bin/sh -c 'stat -c permissions=%a /var/lib/rancher/k3s/server/tls/*.key'\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result:"})," permissions has permissions 600, expected 600 or more restrictive"]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Returned Value:"})}),(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:"permissions=600\npermissions=600\npermissions=600\npermissions=600\npermissions=600\npermissions=600\npermissions=600\npermissions=600\npermissions=600\npermissions=600\npermissions=600\npermissions=600\npermissions=600\npermissions=600\npermissions=600\npermissions=600\npermissions=600\n"})})]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Remediation:"})}),(0,s.jsxs)(r.p,{children:["Run the below command (based on the file location on your system) on the master node.\nFor example,\n",(0,s.jsx)(r.code,{children:"chmod -R 600 /var/lib/rancher/k3s/server/tls/*.key"})]})]}),"\n",(0,s.jsx)(r.h2,{id:"12-api-server",children:"1.2 API Server"}),"\n",(0,s.jsx)(r.h3,{id:"121-ensure-that-the---anonymous-auth-argument-is-set-to-false-automated",children:"1.2.1 Ensure that the --anonymous-auth argument is set to false (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'anonymous-auth'\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result:"})," '--anonymous-auth' is equal to 'false'"]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Returned Value:"})}),(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:'Aug 09 18:56:04 server-0 k3s[2366]: time="2024-08-09T18:56:04Z" level=info msg="Running kube-apiserver --advertise-address=10.10.10.100 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,NamespaceLifecycle,ServiceAccount,PodSecurityPolicy --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})})]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Remediation:"})}),(0,s.jsx)(r.p,{children:"By default, K3s sets the --anonymous-auth argument to false. If it is set to true,\nedit the K3s config file /etc/rancher/k3s/config.yaml and remove anything similar to below."}),(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{children:'kube-apiserver-arg:\n - "anonymous-auth=true"\n'})})]}),"\n",(0,s.jsx)(r.h3,{id:"122-ensure-that-the---token-auth-file-parameter-is-not-set-automated",children:"1.2.2 Ensure that the --token-auth-file parameter is not set (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s | grep 'Running kube-apiserver' | tail -n1\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result:"})," '--token-auth-file' is not present"]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Returned Value:"})}),(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:'Aug 09 18:56:04 server-0 k3s[2366]: time="2024-08-09T18:56:04Z" level=info msg="Running kube-apiserver --advertise-address=10.10.10.100 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,NamespaceLifecycle,ServiceAccount,PodSecurityPolicy --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})})]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Remediation:"})}),(0,s.jsx)(r.p,{children:"Follow the documentation and configure alternate mechanisms for authentication.\nIf this check fails, edit the K3s config file /etc/rancher/k3s/config.yaml and remove anything similar to below."}),(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{children:'kube-apiserver-arg:\n - "token-auth-file="\n'})})]}),"\n",(0,s.jsx)(r.h3,{id:"123-ensure-that-the---denyserviceexternalips-is-not-set-automated",children:"1.2.3 Ensure that the --DenyServiceExternalIPs is not set (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s | grep 'Running kube-apiserver' | tail -n1\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result:"})," '--enable-admission-plugins' does not have 'DenyServiceExternalIPs' OR '--enable-admission-plugins' is not present"]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Returned Value:"})}),(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:'Aug 09 18:56:04 server-0 k3s[2366]: time="2024-08-09T18:56:04Z" level=info msg="Running kube-apiserver --advertise-address=10.10.10.100 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,NamespaceLifecycle,ServiceAccount,PodSecurityPolicy --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})})]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Remediation:"})}),(0,s.jsx)(r.p,{children:"By default, K3s does not set DenyServiceExternalIPs.\nIf this check fails, edit the K3s config file /etc/rancher/k3s/config.yaml, remove any lines like below."}),(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{children:'kube-apiserver-arg:\n - "enable-admission-plugins=DenyServiceExternalIPs"\n'})})]}),"\n",(0,s.jsx)(r.h3,{id:"124-ensure-that-the---kubelet-https-argument-is-set-to-true-automated",children:"1.2.4 Ensure that the --kubelet-https argument is set to true (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," INFO"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nEdit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml\non the control plane node and remove the --kubelet-https parameter."]}),"\n",(0,s.jsx)(r.h3,{id:"125-ensure-that-the---kubelet-client-certificate-and---kubelet-client-key-arguments-are-set-as-appropriate-automated",children:"1.2.5 Ensure that the --kubelet-client-certificate and --kubelet-client-key arguments are set as appropriate (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'kubelet-certificate-authority'\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result:"})," '--kubelet-client-certificate' is present AND '--kubelet-client-key' is present"]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Returned Value:"})}),(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:'Aug 09 18:56:04 server-0 k3s[2366]: time="2024-08-09T18:56:04Z" level=info msg="Running kube-apiserver --advertise-address=10.10.10.100 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,NamespaceLifecycle,ServiceAccount,PodSecurityPolicy --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})})]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Remediation:"})}),(0,s.jsx)(r.p,{children:"By default, K3s automatically provides the kubelet client certificate and key.\nThey are generated and located at /var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt and /var/lib/rancher/k3s/server/tls/client-kube-apiserver.key\nIf for some reason you need to provide your own certificate and key, you can set the\nbelow parameters in the K3s config file /etc/rancher/k3s/config.yaml."}),(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{children:'kube-apiserver-arg:\n - "kubelet-client-certificate="\n - "kubelet-client-key="\n'})})]}),"\n",(0,s.jsx)(r.h3,{id:"126-ensure-that-the---kubelet-certificate-authority-argument-is-set-as-appropriate-automated",children:"1.2.6 Ensure that the --kubelet-certificate-authority argument is set as appropriate (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'kubelet-certificate-authority'\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result:"})," '--kubelet-certificate-authority' is present"]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Returned Value:"})}),(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:'Aug 09 18:56:04 server-0 k3s[2366]: time="2024-08-09T18:56:04Z" level=info msg="Running kube-apiserver --advertise-address=10.10.10.100 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,NamespaceLifecycle,ServiceAccount,PodSecurityPolicy --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})})]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Remediation:"})}),(0,s.jsx)(r.p,{children:"Follow the Kubernetes documentation and setup the TLS connection between\nthe apiserver and kubelets. Then, edit the API server pod specification file\n/etc/kubernetes/manifests/kube-apiserver.yaml on the control plane node and set the\n--kubelet-certificate-authority parameter to the path to the cert file for the certificate authority.\n--kubelet-certificate-authority="})]}),"\n",(0,s.jsx)(r.h3,{id:"127-ensure-that-the---authorization-mode-argument-is-not-set-to-alwaysallow-automated",children:"1.2.7 Ensure that the --authorization-mode argument is not set to AlwaysAllow (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'authorization-mode'\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result:"})," '--authorization-mode' does not have 'AlwaysAllow'"]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Returned Value:"})}),(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:'Aug 09 18:56:04 server-0 k3s[2366]: time="2024-08-09T18:56:04Z" level=info msg="Running kube-apiserver --advertise-address=10.10.10.100 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,NamespaceLifecycle,ServiceAccount,PodSecurityPolicy --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})})]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Remediation:"})}),(0,s.jsx)(r.p,{children:"By default, K3s does not set the --authorization-mode to AlwaysAllow.\nIf this check fails, edit K3s config file /etc/rancher/k3s/config.yaml, remove any lines like below."}),(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{children:'kube-apiserver-arg:\n - "authorization-mode=AlwaysAllow"\n'})})]}),"\n",(0,s.jsx)(r.h3,{id:"128-ensure-that-the---authorization-mode-argument-includes-node-automated",children:"1.2.8 Ensure that the --authorization-mode argument includes Node (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'authorization-mode'\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result:"})," '--authorization-mode' has 'Node'"]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Returned Value:"})}),(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:'Aug 09 18:56:04 server-0 k3s[2366]: time="2024-08-09T18:56:04Z" level=info msg="Running kube-apiserver --advertise-address=10.10.10.100 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,NamespaceLifecycle,ServiceAccount,PodSecurityPolicy --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})})]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Remediation:"})}),(0,s.jsx)(r.p,{children:"By default, K3s sets the --authorization-mode to Node and RBAC.\nIf this check fails, edit the K3s config file /etc/rancher/k3s/config.yaml,\nensure that you are not overriding authorization-mode."})]}),"\n",(0,s.jsx)(r.h3,{id:"129-ensure-that-the---authorization-mode-argument-includes-rbac-automated",children:"1.2.9 Ensure that the --authorization-mode argument includes RBAC (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'authorization-mode'\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result:"})," '--authorization-mode' has 'RBAC'"]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Returned Value:"})}),(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:'Aug 09 18:56:04 server-0 k3s[2366]: time="2024-08-09T18:56:04Z" level=info msg="Running kube-apiserver --advertise-address=10.10.10.100 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,NamespaceLifecycle,ServiceAccount,PodSecurityPolicy --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})})]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Remediation:"})}),(0,s.jsx)(r.p,{children:"By default, K3s sets the --authorization-mode to Node and RBAC.\nIf this check fails, edit the K3s config file /etc/rancher/k3s/config.yaml,\nensure that you are not overriding authorization-mode."})]}),"\n",(0,s.jsx)(r.h3,{id:"1210-ensure-that-the-admission-control-plugin-eventratelimit-is-set-manual",children:"1.2.10 Ensure that the admission control plugin EventRateLimit is set (Manual)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nFollow the Kubernetes documentation and set the desired limits in a configuration file.\nThen, edit the K3s config file /etc/rancher/k3s/config.yaml and set the below parameters."]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{children:'kube-apiserver-arg:\n - "enable-admission-plugins=...,EventRateLimit,..."\n - "admission-control-config-file="\n'})}),"\n",(0,s.jsx)(r.h3,{id:"1211-ensure-that-the-admission-control-plugin-alwaysadmit-is-not-set-automated",children:"1.2.11 Ensure that the admission control plugin AlwaysAdmit is not set (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'enable-admission-plugins'\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result:"})," '--enable-admission-plugins' does not have 'AlwaysAdmit' OR '--enable-admission-plugins' is not present"]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Returned Value:"})}),(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:'Aug 09 18:56:04 server-0 k3s[2366]: time="2024-08-09T18:56:04Z" level=info msg="Running kube-apiserver --advertise-address=10.10.10.100 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,NamespaceLifecycle,ServiceAccount,PodSecurityPolicy --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})})]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Remediation:"})}),(0,s.jsx)(r.p,{children:"By default, K3s does not set the --enable-admission-plugins to AlwaysAdmit.\nIf this check fails, edit K3s config file /etc/rancher/k3s/config.yaml, remove any lines like below."}),(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{children:'kube-apiserver-arg:\n - "enable-admission-plugins=AlwaysAdmit"\n'})})]}),"\n",(0,s.jsx)(r.h3,{id:"1212-ensure-that-the-admission-control-plugin-alwayspullimages-is-set-manual",children:"1.2.12 Ensure that the admission control plugin AlwaysPullImages is set (Manual)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),'\nPermissive, per CIS guidelines,\n"This setting could impact offline or isolated clusters, which have images pre-loaded and\ndo not have access to a registry to pull in-use images. This setting is not appropriate for\nclusters which use this configuration."\nEdit the K3s config file /etc/rancher/k3s/config.yaml and set the below parameter.']}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{children:'kube-apiserver-arg:\n - "enable-admission-plugins=...,AlwaysPullImages,..."\n'})}),"\n",(0,s.jsx)(r.h3,{id:"1213-ensure-that-the-admission-control-plugin-securitycontextdeny-is-set-if-podsecuritypolicy-is-not-used-manual",children:"1.2.13 Ensure that the admission control plugin SecurityContextDeny is set if PodSecurityPolicy is not used (Manual)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'enable-admission-plugins'\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result:"})," '--enable-admission-plugins' has 'SecurityContextDeny' OR '--enable-admission-plugins' has 'PodSecurityPolicy'"]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Returned Value:"})}),(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:'Aug 09 18:56:04 server-0 k3s[2366]: time="2024-08-09T18:56:04Z" level=info msg="Running kube-apiserver --advertise-address=10.10.10.100 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,NamespaceLifecycle,ServiceAccount,PodSecurityPolicy --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})})]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Remediation:"})}),(0,s.jsx)(r.p,{children:"Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml\non the control plane node and set the --enable-admission-plugins parameter to include\nSecurityContextDeny, unless PodSecurityPolicy is already in place.\n--enable-admission-plugins=...,SecurityContextDeny,..."})]}),"\n",(0,s.jsx)(r.h3,{id:"1214-ensure-that-the-admission-control-plugin-serviceaccount-is-set-automated",children:"1.2.14 Ensure that the admission control plugin ServiceAccount is set (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'ServiceAccount'\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result:"})," '--disable-admission-plugins' is present OR '--disable-admission-plugins' is not present"]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Returned Value:"})}),(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:'Aug 09 18:56:04 server-0 k3s[2366]: time="2024-08-09T18:56:04Z" level=info msg="Running kube-apiserver --advertise-address=10.10.10.100 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,NamespaceLifecycle,ServiceAccount,PodSecurityPolicy --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})})]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Remediation:"})}),(0,s.jsx)(r.p,{children:"By default, K3s does not set the --disable-admission-plugins to anything.\nFollow the documentation and create ServiceAccount objects as per your environment.\nIf this check fails, edit the K3s config file /etc/rancher/k3s/config.yaml and remove any lines like below."}),(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{children:'kube-apiserver-arg:\n - "disable-admission-plugins=ServiceAccount"\n'})})]}),"\n",(0,s.jsx)(r.h3,{id:"1215-ensure-that-the-admission-control-plugin-namespacelifecycle-is-set-automated",children:"1.2.15 Ensure that the admission control plugin NamespaceLifecycle is set (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s | grep 'Running kube-apiserver' | tail -n1\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result:"})," '--disable-admission-plugins' is present OR '--disable-admission-plugins' is not present"]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Returned Value:"})}),(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:'Aug 09 18:56:04 server-0 k3s[2366]: time="2024-08-09T18:56:04Z" level=info msg="Running kube-apiserver --advertise-address=10.10.10.100 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,NamespaceLifecycle,ServiceAccount,PodSecurityPolicy --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})})]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Remediation:"})}),(0,s.jsx)(r.p,{children:"By default, K3s does not set the --disable-admission-plugins to anything.\nIf this check fails, edit the K3s config file /etc/rancher/k3s/config.yaml and remove any lines like below."}),(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{children:'kube-apiserver-arg:\n - "disable-admission-plugins=...,NamespaceLifecycle,..."\n'})})]}),"\n",(0,s.jsx)(r.h3,{id:"1216-ensure-that-the-admission-control-plugin-noderestriction-is-set-automated",children:"1.2.16 Ensure that the admission control plugin NodeRestriction is set (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'enable-admission-plugins'\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result:"})," '--enable-admission-plugins' has 'NodeRestriction'"]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Returned Value:"})}),(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:'Aug 09 18:56:04 server-0 k3s[2366]: time="2024-08-09T18:56:04Z" level=info msg="Running kube-apiserver --advertise-address=10.10.10.100 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,NamespaceLifecycle,ServiceAccount,PodSecurityPolicy --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})})]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Remediation:"})}),(0,s.jsx)(r.p,{children:"By default, K3s sets the --enable-admission-plugins to NodeRestriction.\nIf using the K3s config file /etc/rancher/k3s/config.yaml, check that you are not overriding the admission plugins.\nIf you are, include NodeRestriction in the list."}),(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{children:'kube-apiserver-arg:\n - "enable-admission-plugins=...,NodeRestriction,..."\n'})})]}),"\n",(0,s.jsx)(r.h3,{id:"1217-ensure-that-the---secure-port-argument-is-not-set-to-0-automated",children:"1.2.17 Ensure that the --secure-port argument is not set to 0 (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'secure-port'\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result:"})," '--secure-port' is greater than 0 OR '--secure-port' is not present"]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Returned Value:"})}),(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:'Aug 09 18:56:04 server-0 k3s[2366]: time="2024-08-09T18:56:04Z" level=info msg="Running kube-apiserver --advertise-address=10.10.10.100 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,NamespaceLifecycle,ServiceAccount,PodSecurityPolicy --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})})]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Remediation:"})}),(0,s.jsx)(r.p,{children:"By default, K3s sets the secure port to 6444.\nIf this check fails, edit the K3s config file /etc/rancher/k3s/config.yaml and remove any lines like below."}),(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{children:'kube-apiserver-arg:\n - "secure-port="\n'})})]}),"\n",(0,s.jsx)(r.h3,{id:"1218-ensure-that-the---profiling-argument-is-set-to-false-automated",children:"1.2.18 Ensure that the --profiling argument is set to false (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'profiling'\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result:"})," '--profiling' is equal to 'false'"]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Returned Value:"})}),(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:'Aug 09 18:56:04 server-0 k3s[2366]: time="2024-08-09T18:56:04Z" level=info msg="Running kube-apiserver --advertise-address=10.10.10.100 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,NamespaceLifecycle,ServiceAccount,PodSecurityPolicy --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})})]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Remediation:"})}),(0,s.jsx)(r.p,{children:"By default, K3s sets the --profiling argument to false.\nIf this check fails, edit the K3s config file /etc/rancher/k3s/config.yaml and remove any lines like below."}),(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{children:'kube-apiserver-arg:\n - "profiling=true"\n'})})]}),"\n",(0,s.jsx)(r.h3,{id:"1219-ensure-that-the---audit-log-path-argument-is-set-manual",children:"1.2.19 Ensure that the --audit-log-path argument is set (Manual)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'audit-log-path'\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result:"})," '--audit-log-path' is present"]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Returned Value:"})}),(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:'Aug 09 18:56:04 server-0 k3s[2366]: time="2024-08-09T18:56:04Z" level=info msg="Running kube-apiserver --advertise-address=10.10.10.100 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,NamespaceLifecycle,ServiceAccount,PodSecurityPolicy --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})})]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Remediation:"})}),(0,s.jsx)(r.p,{children:"Edit the K3s config file /etc/rancher/k3s/config.yaml and set the audit-log-path parameter to a suitable path and\nfile where you would like audit logs to be written, for example,"}),(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{children:'kube-apiserver-arg:\n - "audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log"\n'})})]}),"\n",(0,s.jsx)(r.h3,{id:"1220-ensure-that-the---audit-log-maxage-argument-is-set-to-30-or-as-appropriate-automated",children:"1.2.20 Ensure that the --audit-log-maxage argument is set to 30 or as appropriate (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'audit-log-maxage'\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result:"})," '--audit-log-maxage' is greater or equal to 30"]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Returned Value:"})}),(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:'Aug 09 18:56:04 server-0 k3s[2366]: time="2024-08-09T18:56:04Z" level=info msg="Running kube-apiserver --advertise-address=10.10.10.100 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,NamespaceLifecycle,ServiceAccount,PodSecurityPolicy --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})})]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Remediation:"})}),(0,s.jsx)(r.p,{children:"Edit the K3s config file /etc/rancher/k3s/config.yaml on the control plane node and\nset the audit-log-maxage parameter to 30 or as an appropriate number of days, for example,"}),(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{children:'kube-apiserver-arg:\n - "audit-log-maxage=30"\n'})})]}),"\n",(0,s.jsx)(r.h3,{id:"1221-ensure-that-the---audit-log-maxbackup-argument-is-set-to-10-or-as-appropriate-automated",children:"1.2.21 Ensure that the --audit-log-maxbackup argument is set to 10 or as appropriate (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'audit-log-maxbackup'\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result:"})," '--audit-log-maxbackup' is greater or equal to 10"]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Returned Value:"})}),(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:'Aug 09 18:56:04 server-0 k3s[2366]: time="2024-08-09T18:56:04Z" level=info msg="Running kube-apiserver --advertise-address=10.10.10.100 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,NamespaceLifecycle,ServiceAccount,PodSecurityPolicy --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})})]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Remediation:"})}),(0,s.jsx)(r.p,{children:"Edit the K3s config file /etc/rancher/k3s/config.yaml on the control plane node and\nset the audit-log-maxbackup parameter to 10 or to an appropriate value. For example,"}),(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{children:'kube-apiserver-arg:\n - "audit-log-maxbackup=10"\n'})})]}),"\n",(0,s.jsx)(r.h3,{id:"1222-ensure-that-the---audit-log-maxsize-argument-is-set-to-100-or-as-appropriate-automated",children:"1.2.22 Ensure that the --audit-log-maxsize argument is set to 100 or as appropriate (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'audit-log-maxsize'\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result:"})," '--audit-log-maxsize' is greater or equal to 100"]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Returned Value:"})}),(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:'Aug 09 18:56:04 server-0 k3s[2366]: time="2024-08-09T18:56:04Z" level=info msg="Running kube-apiserver --advertise-address=10.10.10.100 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,NamespaceLifecycle,ServiceAccount,PodSecurityPolicy --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})})]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Remediation:"})}),(0,s.jsx)(r.p,{children:"Edit the K3s config file /etc/rancher/k3s/config.yaml on the control plane node and\nset the audit-log-maxsize parameter to an appropriate size in MB. For example,"}),(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{children:'kube-apiserver-arg:\n - "audit-log-maxsize=100"\n'})})]}),"\n",(0,s.jsx)(r.h3,{id:"1223-ensure-that-the---request-timeout-argument-is-set-as-appropriate-manual",children:"1.2.23 Ensure that the --request-timeout argument is set as appropriate (Manual)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),'\nPermissive, per CIS guidelines,\n"it is recommended to set this limit as appropriate and change the default limit of 60 seconds only if needed".\nEdit the K3s config file /etc/rancher/k3s/config.yaml\nand set the below parameter if needed. For example,']}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{children:'kube-apiserver-arg:\n - "request-timeout=300s"\n'})}),"\n",(0,s.jsx)(r.h3,{id:"1224-ensure-that-the---service-account-lookup-argument-is-set-to-true-automated",children:"1.2.24 Ensure that the --service-account-lookup argument is set to true (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s | grep 'Running kube-apiserver' | tail -n1\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result:"})," '--service-account-lookup' is not present OR '--service-account-lookup' is present"]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Returned Value:"})}),(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:'Aug 09 18:56:04 server-0 k3s[2366]: time="2024-08-09T18:56:04Z" level=info msg="Running kube-apiserver --advertise-address=10.10.10.100 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,NamespaceLifecycle,ServiceAccount,PodSecurityPolicy --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})})]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Remediation:"})}),(0,s.jsx)(r.p,{children:"By default, K3s does not set the --service-account-lookup argument.\nEdit the K3s config file /etc/rancher/k3s/config.yaml and set the service-account-lookup. For example,"}),(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{children:'kube-apiserver-arg:\n - "service-account-lookup=true"\n'})}),(0,s.jsx)(r.p,{children:"Alternatively, you can delete the service-account-lookup parameter from this file so\nthat the default takes effect."})]}),"\n",(0,s.jsx)(r.h3,{id:"1225-ensure-that-the---service-account-key-file-argument-is-set-as-appropriate-automated",children:"1.2.25 Ensure that the --service-account-key-file argument is set as appropriate (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'service-account-key-file'\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result:"})," '--service-account-key-file' is present"]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Returned Value:"})}),(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:'Aug 09 18:56:04 server-0 k3s[2366]: time="2024-08-09T18:56:04Z" level=info msg="Running kube-apiserver --advertise-address=10.10.10.100 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,NamespaceLifecycle,ServiceAccount,PodSecurityPolicy --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})})]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Remediation:"})}),(0,s.jsx)(r.p,{children:"K3s automatically generates and sets the service account key file.\nIt is located at /var/lib/rancher/k3s/server/tls/service.key.\nIf this check fails, edit K3s config file /etc/rancher/k3s/config.yaml and remove any lines like below."}),(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{children:'kube-apiserver-arg:\n - "service-account-key-file="\n'})})]}),"\n",(0,s.jsx)(r.h3,{id:"1226-ensure-that-the---etcd-certfile-and---etcd-keyfile-arguments-are-set-as-appropriate-automated",children:"1.2.26 Ensure that the --etcd-certfile and --etcd-keyfile arguments are set as appropriate (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"if [ \"$(journalctl -u k3s | grep -m1 'Managed etcd cluster' | wc -l)\" -gt 0 ]; then\n journalctl -D /var/log/journal -u k3s | grep -m1 'Running kube-apiserver' | tail -n1\nelse\n echo \"--etcd-certfile AND --etcd-keyfile\"\nfi\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result:"})," '--etcd-certfile' is present AND '--etcd-keyfile' is present"]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Returned Value:"})}),(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:'Aug 09 18:56:04 server-0 k3s[2366]: time="2024-08-09T18:56:04Z" level=info msg="Running kube-apiserver --advertise-address=10.10.10.100 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,NamespaceLifecycle,ServiceAccount,PodSecurityPolicy --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})})]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Remediation:"})}),(0,s.jsx)(r.p,{children:"K3s automatically generates and sets the etcd certificate and key files.\nThey are located at /var/lib/rancher/k3s/server/tls/etcd/client.crt and /var/lib/rancher/k3s/server/tls/etcd/client.key.\nIf this check fails, edit the K3s config file /etc/rancher/k3s/config.yaml and remove any lines like below."}),(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{children:'kube-apiserver-arg:\n - "etcd-certfile="\n - "etcd-keyfile="\n'})})]}),"\n",(0,s.jsx)(r.h3,{id:"1227-ensure-that-the---tls-cert-file-and---tls-private-key-file-arguments-are-set-as-appropriate-automated",children:"1.2.27 Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"journalctl -D /var/log/journal -u k3s | grep -A1 'Running kube-apiserver' | tail -n2\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result:"})," '--tls-cert-file' is present AND '--tls-private-key-file' is present"]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Returned Value:"})}),(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:'Aug 09 18:56:04 server-0 k3s[2366]: time="2024-08-09T18:56:04Z" level=info msg="Running kube-apiserver --advertise-address=10.10.10.100 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,NamespaceLifecycle,ServiceAccount,PodSecurityPolicy --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\nAug 09 18:56:04 server-0 k3s[2366]: time="2024-08-09T18:56:04Z" level=info msg="Running kube-scheduler --authentication-kubeconfig=/var/lib/rancher/k3s/server/cred/scheduler.kubeconfig --authorization-kubeconfig=/var/lib/rancher/k3s/server/cred/scheduler.kubeconfig --bind-address=127.0.0.1 --kubeconfig=/var/lib/rancher/k3s/server/cred/scheduler.kubeconfig --profiling=false --secure-port=10259"\n'})})]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Remediation:"})}),(0,s.jsx)(r.p,{children:"By default, K3s automatically generates and provides the TLS certificate and private key for the apiserver.\nThey are generated and located at /var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt and /var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key\nIf this check fails, edit the K3s config file /etc/rancher/k3s/config.yaml and remove any lines like below."}),(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{children:'kube-apiserver-arg:\n - "tls-cert-file="\n - "tls-private-key-file="\n'})})]}),"\n",(0,s.jsx)(r.h3,{id:"1228-ensure-that-the---client-ca-file-argument-is-set-as-appropriate-automated",children:"1.2.28 Ensure that the --client-ca-file argument is set as appropriate (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'client-ca-file'\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result:"})," '--client-ca-file' is present"]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Returned Value:"})}),(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:'Aug 09 18:56:04 server-0 k3s[2366]: time="2024-08-09T18:56:04Z" level=info msg="Running kube-apiserver --advertise-address=10.10.10.100 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,NamespaceLifecycle,ServiceAccount,PodSecurityPolicy --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})})]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Remediation:"})}),(0,s.jsx)(r.p,{children:"By default, K3s automatically provides the client certificate authority file.\nIt is generated and located at /var/lib/rancher/k3s/server/tls/client-ca.crt.\nIf this check fails, edit the K3s config file /etc/rancher/k3s/config.yaml and remove any lines like below."}),(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{children:'kube-apiserver-arg:\n - "client-ca-file="\n'})})]}),"\n",(0,s.jsx)(r.h3,{id:"1229-ensure-that-the---etcd-cafile-argument-is-set-as-appropriate-automated",children:"1.2.29 Ensure that the --etcd-cafile argument is set as appropriate (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'etcd-cafile'\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result:"})," '--etcd-cafile' is present"]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Returned Value:"})}),(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:'Aug 09 18:56:04 server-0 k3s[2366]: time="2024-08-09T18:56:04Z" level=info msg="Running kube-apiserver --advertise-address=10.10.10.100 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,NamespaceLifecycle,ServiceAccount,PodSecurityPolicy --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})})]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Remediation:"})}),(0,s.jsx)(r.p,{children:"By default, K3s automatically provides the etcd certificate authority file.\nIt is generated and located at /var/lib/rancher/k3s/server/tls/client-ca.crt.\nIf this check fails, edit the K3s config file /etc/rancher/k3s/config.yaml and remove any lines like below."}),(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{children:'kube-apiserver-arg:\n - "etcd-cafile="\n'})})]}),"\n",(0,s.jsx)(r.h3,{id:"1230-ensure-that-the---encryption-provider-config-argument-is-set-as-appropriate-manual",children:"1.2.30 Ensure that the --encryption-provider-config argument is set as appropriate (Manual)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'encryption-provider-config'\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result:"})," '--encryption-provider-config' is present"]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Returned Value:"})}),(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:'Aug 09 18:56:04 server-0 k3s[2366]: time="2024-08-09T18:56:04Z" level=info msg="Running kube-apiserver --advertise-address=10.10.10.100 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,NamespaceLifecycle,ServiceAccount,PodSecurityPolicy --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})})]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Remediation:"})}),(0,s.jsx)(r.p,{children:"K3s can be configured to use encryption providers to encrypt secrets at rest.\nEdit the K3s config file /etc/rancher/k3s/config.yaml on the control plane node and set the below parameter.\nsecrets-encryption: true\nSecrets encryption can then be managed with the k3s secrets-encrypt command line tool.\nIf needed, you can find the generated encryption config at /var/lib/rancher/k3s/server/cred/encryption-config.json."})]}),"\n",(0,s.jsx)(r.h3,{id:"1231-ensure-that-encryption-providers-are-appropriately-configured-manual",children:"1.2.31 Ensure that encryption providers are appropriately configured (Manual)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"ENCRYPTION_PROVIDER_CONFIG=$(journalctl -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep -- --encryption-provider-config | sed 's%.*encryption-provider-config[= ]\\([^ ]*\\).*%\\1%')\nif test -e $ENCRYPTION_PROVIDER_CONFIG; then grep -o 'providers\\\"\\:\\[.*\\]' $ENCRYPTION_PROVIDER_CONFIG | grep -o \"[A-Za-z]*\" | head -2 | tail -1 | sed 's/^/provider=/'; fi\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result:"})," 'provider' contains valid elements from 'aescbc,kms,secretbox'"]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Returned Value:"})}),(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:"provider=aescbc\n"})})]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Remediation:"})}),(0,s.jsx)(r.p,{children:"K3s can be configured to use encryption providers to encrypt secrets at rest. K3s will utilize the aescbc provider.\nEdit the K3s config file /etc/rancher/k3s/config.yaml on the control plane node and set the below parameter.\nsecrets-encryption: true\nSecrets encryption can then be managed with the k3s secrets-encrypt command line tool.\nIf needed, you can find the generated encryption config at /var/lib/rancher/k3s/server/cred/encryption-config.json"})]}),"\n",(0,s.jsx)(r.h3,{id:"1232-ensure-that-the-api-server-only-makes-use-of-strong-cryptographic-ciphers-automated",children:"1.2.32 Ensure that the API Server only makes use of Strong Cryptographic Ciphers (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'tls-cipher-suites'\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result:"})," '--tls-cipher-suites' contains valid elements from 'TLS_AES_128_GCM_SHA256,TLS_AES_256_GCM_SHA384,TLS_CHACHA20_POLY1305_SHA256,TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256,TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256,TLS_RSA_WITH_3DES_EDE_CBC_SHA,TLS_RSA_WITH_AES_128_CBC_SHA,TLS_RSA_WITH_AES_128_GCM_SHA256,TLS_RSA_WITH_AES_256_CBC_SHA,TLS_RSA_WITH_AES_256_GCM_SHA384'"]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Returned Value:"})}),(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:'Aug 09 18:56:04 server-0 k3s[2366]: time="2024-08-09T18:56:04Z" level=info msg="Running kube-apiserver --advertise-address=10.10.10.100 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,NamespaceLifecycle,ServiceAccount,PodSecurityPolicy --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})})]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Remediation:"})}),(0,s.jsxs)(r.p,{children:["By default, the K3s kube-apiserver complies with this test. Changes to these values may cause regression, therefore ensure that all apiserver clients support the new TLS configuration before applying it in production deployments.\nIf a custom TLS configuration is required, consider also creating a custom version of this rule that aligns with your requirements.\nIf this check fails, remove any custom configuration around ",(0,s.jsx)(r.code,{children:"tls-cipher-suites"})," or update the /etc/rancher/k3s/config.yaml file to match the default by adding the following:"]}),(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{children:'kube-apiserver-arg:\n - "tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305"\n'})})]}),"\n",(0,s.jsx)(r.h2,{id:"13-controller-manager",children:"1.3 Controller Manager"}),"\n",(0,s.jsx)(r.h3,{id:"131-ensure-that-the---terminated-pod-gc-threshold-argument-is-set-as-appropriate-manual",children:"1.3.1 Ensure that the --terminated-pod-gc-threshold argument is set as appropriate (Manual)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s | grep 'Running kube-controller-manager' | tail -n1 | grep 'terminated-pod-gc-threshold'\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result:"})," '--terminated-pod-gc-threshold' is present"]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Returned Value:"})}),(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:'Aug 09 18:56:04 server-0 k3s[2366]: time="2024-08-09T18:56:04Z" level=info msg="Running kube-controller-manager --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/k3s/server/tls/client-ca.nochain.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/k3s/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/k3s/server/tls/client-ca.nochain.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/k3s/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/k3s/server/tls/server-ca.nochain.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/k3s/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/k3s/server/tls/server-ca.nochain.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/k3s/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,tokencleaner,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/k3s/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --terminated-pod-gc-threshold=10 --use-service-account-credentials=true"\n'})})]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Remediation:"})}),(0,s.jsx)(r.p,{children:"Edit the K3s config file /etc/rancher/k3s/config.yaml on the control plane node\nand set the --terminated-pod-gc-threshold to an appropriate threshold,"}),(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{children:'kube-controller-manager-arg:\n - "terminated-pod-gc-threshold=10"\n'})})]}),"\n",(0,s.jsx)(r.h3,{id:"132-ensure-that-the---profiling-argument-is-set-to-false-automated",children:"1.3.2 Ensure that the --profiling argument is set to false (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s | grep 'Running kube-controller-manager' | tail -n1 | grep 'profiling'\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result:"})," '--profiling' is equal to 'false'"]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Returned Value:"})}),(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:'Aug 09 18:56:04 server-0 k3s[2366]: time="2024-08-09T18:56:04Z" level=info msg="Running kube-controller-manager --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/k3s/server/tls/client-ca.nochain.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/k3s/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/k3s/server/tls/client-ca.nochain.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/k3s/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/k3s/server/tls/server-ca.nochain.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/k3s/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/k3s/server/tls/server-ca.nochain.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/k3s/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,tokencleaner,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/k3s/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --terminated-pod-gc-threshold=10 --use-service-account-credentials=true"\n'})})]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Remediation:"})}),(0,s.jsx)(r.p,{children:"By default, K3s sets the --profiling argument to false.\nIf this check fails, edit the K3s config file /etc/rancher/k3s/config.yaml and remove any lines like below."}),(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{children:'kube-controller-manager-arg:\n - "profiling=true"\n'})})]}),"\n",(0,s.jsx)(r.h3,{id:"133-ensure-that-the---use-service-account-credentials-argument-is-set-to-true-automated",children:"1.3.3 Ensure that the --use-service-account-credentials argument is set to true (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s | grep 'Running kube-controller-manager' | tail -n1 | grep 'use-service-account-credentials'\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result:"})," '--use-service-account-credentials' is not equal to 'false'"]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Returned Value:"})}),(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:'Aug 09 18:56:04 server-0 k3s[2366]: time="2024-08-09T18:56:04Z" level=info msg="Running kube-controller-manager --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/k3s/server/tls/client-ca.nochain.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/k3s/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/k3s/server/tls/client-ca.nochain.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/k3s/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/k3s/server/tls/server-ca.nochain.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/k3s/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/k3s/server/tls/server-ca.nochain.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/k3s/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,tokencleaner,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/k3s/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --terminated-pod-gc-threshold=10 --use-service-account-credentials=true"\n'})})]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Remediation:"})}),(0,s.jsx)(r.p,{children:"By default, K3s sets the --use-service-account-credentials argument to true.\nIf this check fails, edit the K3s config file /etc/rancher/k3s/config.yaml and remove any lines like below."}),(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{children:'kube-controller-manager-arg:\n - "use-service-account-credentials=false"\n'})})]}),"\n",(0,s.jsx)(r.h3,{id:"134-ensure-that-the---service-account-private-key-file-argument-is-set-as-appropriate-automated",children:"1.3.4 Ensure that the --service-account-private-key-file argument is set as appropriate (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s | grep 'Running kube-controller-manager' | tail -n1 | grep 'service-account-private-key-file'\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result:"})," '--service-account-private-key-file' is present"]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Returned Value:"})}),(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:'Aug 09 18:56:04 server-0 k3s[2366]: time="2024-08-09T18:56:04Z" level=info msg="Running kube-controller-manager --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/k3s/server/tls/client-ca.nochain.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/k3s/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/k3s/server/tls/client-ca.nochain.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/k3s/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/k3s/server/tls/server-ca.nochain.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/k3s/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/k3s/server/tls/server-ca.nochain.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/k3s/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,tokencleaner,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/k3s/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --terminated-pod-gc-threshold=10 --use-service-account-credentials=true"\n'})})]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Remediation:"})}),(0,s.jsx)(r.p,{children:"By default, K3s automatically provides the service account private key file.\nIt is generated and located at /var/lib/rancher/k3s/server/tls/service.current.key.\nIf this check fails, edit the K3s config file /etc/rancher/k3s/config.yaml and remove any lines like below."}),(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{children:'kube-controller-manager-arg:\n - "service-account-private-key-file="\n'})})]}),"\n",(0,s.jsx)(r.h3,{id:"135-ensure-that-the---root-ca-file-argument-is-set-as-appropriate-automated",children:"1.3.5 Ensure that the --root-ca-file argument is set as appropriate (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s | grep 'Running kube-controller-manager' | tail -n1 | grep 'root-ca-file'\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result:"})," '--root-ca-file' is present"]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Returned Value:"})}),(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:'Aug 09 18:56:04 server-0 k3s[2366]: time="2024-08-09T18:56:04Z" level=info msg="Running kube-controller-manager --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/k3s/server/tls/client-ca.nochain.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/k3s/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/k3s/server/tls/client-ca.nochain.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/k3s/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/k3s/server/tls/server-ca.nochain.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/k3s/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/k3s/server/tls/server-ca.nochain.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/k3s/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,tokencleaner,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/k3s/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --terminated-pod-gc-threshold=10 --use-service-account-credentials=true"\n'})})]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Remediation:"})}),(0,s.jsx)(r.p,{children:"By default, K3s automatically provides the root CA file.\nIt is generated and located at /var/lib/rancher/k3s/server/tls/server-ca.crt.\nIf this check fails, edit the K3s config file /etc/rancher/k3s/config.yaml and remove any lines like below."}),(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{children:'kube-controller-manager-arg:\n - "root-ca-file="\n'})})]}),"\n",(0,s.jsx)(r.h3,{id:"136-ensure-that-the-rotatekubeletservercertificate-argument-is-set-to-true-automated",children:"1.3.6 Ensure that the RotateKubeletServerCertificate argument is set to true (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s | grep 'Running kube-controller-manager' | tail -n1\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result:"})," '--feature-gates' does not have 'RotateKubeletServerCertificate=false' OR '--feature-gates' is not present"]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Returned Value:"})}),(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:'Aug 09 18:56:04 server-0 k3s[2366]: time="2024-08-09T18:56:04Z" level=info msg="Running kube-controller-manager --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/k3s/server/tls/client-ca.nochain.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/k3s/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/k3s/server/tls/client-ca.nochain.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/k3s/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/k3s/server/tls/server-ca.nochain.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/k3s/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/k3s/server/tls/server-ca.nochain.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/k3s/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,tokencleaner,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/k3s/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --terminated-pod-gc-threshold=10 --use-service-account-credentials=true"\n'})})]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Remediation:"})}),(0,s.jsx)(r.p,{children:"By default, K3s does not set the RotateKubeletServerCertificate feature gate.\nIf you have enabled this feature gate, you should remove it.\nIf this check fails, edit the K3s config file /etc/rancher/k3s/config.yaml, remove any lines like below."}),(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{children:'kube-controller-manager-arg:\n - "feature-gate=RotateKubeletServerCertificate"\n'})})]}),"\n",(0,s.jsx)(r.h3,{id:"137-ensure-that-the---bind-address-argument-is-set-to-127001-automated",children:"1.3.7 Ensure that the --bind-address argument is set to 127.0.0.1 (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s | grep 'Running kube-controller-manager' | tail -n1 | grep 'bind-address'\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result:"})," '--bind-address' is equal to '127.0.0.1' OR '--bind-address' is not present"]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Returned Value:"})}),(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:'Aug 09 18:56:04 server-0 k3s[2366]: time="2024-08-09T18:56:04Z" level=info msg="Running kube-controller-manager --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/k3s/server/tls/client-ca.nochain.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/k3s/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/k3s/server/tls/client-ca.nochain.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/k3s/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/k3s/server/tls/server-ca.nochain.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/k3s/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/k3s/server/tls/server-ca.nochain.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/k3s/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,tokencleaner,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/k3s/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --terminated-pod-gc-threshold=10 --use-service-account-credentials=true"\n'})})]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Remediation:"})}),(0,s.jsx)(r.p,{children:"By default, K3s sets the --bind-address argument to 127.0.0.1\nIf this check fails, edit the K3s config file /etc/rancher/k3s/config.yaml and remove any lines like below."}),(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{children:'kube-controller-manager-arg:\n - "bind-address="\n'})})]}),"\n",(0,s.jsx)(r.h2,{id:"14-scheduler",children:"1.4 Scheduler"}),"\n",(0,s.jsx)(r.h3,{id:"141-ensure-that-the---profiling-argument-is-set-to-false-automated",children:"1.4.1 Ensure that the --profiling argument is set to false (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"journalctl -D /var/log/journal -u k3s | grep 'Running kube-scheduler' | tail -n1\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result:"})," '--profiling' is equal to 'false'"]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Returned Value:"})}),(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:'Aug 09 18:56:04 server-0 k3s[2366]: time="2024-08-09T18:56:04Z" level=info msg="Running kube-scheduler --authentication-kubeconfig=/var/lib/rancher/k3s/server/cred/scheduler.kubeconfig --authorization-kubeconfig=/var/lib/rancher/k3s/server/cred/scheduler.kubeconfig --bind-address=127.0.0.1 --kubeconfig=/var/lib/rancher/k3s/server/cred/scheduler.kubeconfig --profiling=false --secure-port=10259"\n'})})]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Remediation:"})}),(0,s.jsx)(r.p,{children:"By default, K3s sets the --profiling argument to false.\nIf this check fails, edit the K3s config file /etc/rancher/k3s/config.yaml and remove any lines like below."}),(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{children:'kube-scheduler-arg:\n - "profiling=true"\n'})})]}),"\n",(0,s.jsx)(r.h3,{id:"142-ensure-that-the---bind-address-argument-is-set-to-127001-automated",children:"1.4.2 Ensure that the --bind-address argument is set to 127.0.0.1 (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s | grep 'Running kube-scheduler' | tail -n1 | grep 'bind-address'\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result:"})," '--bind-address' is equal to '127.0.0.1' OR '--bind-address' is not present"]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Returned Value:"})}),(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:'Aug 09 18:56:04 server-0 k3s[2366]: time="2024-08-09T18:56:04Z" level=info msg="Running kube-scheduler --authentication-kubeconfig=/var/lib/rancher/k3s/server/cred/scheduler.kubeconfig --authorization-kubeconfig=/var/lib/rancher/k3s/server/cred/scheduler.kubeconfig --bind-address=127.0.0.1 --kubeconfig=/var/lib/rancher/k3s/server/cred/scheduler.kubeconfig --profiling=false --secure-port=10259"\n'})})]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Remediation:"})}),(0,s.jsx)(r.p,{children:"By default, K3s sets the --bind-address argument to 127.0.0.1\nIf this check fails, edit the K3s config file /etc/rancher/k3s/config.yaml and remove any lines like below."}),(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{children:'kube-scheduler-arg:\n - "bind-address="\n'})})]}),"\n",(0,s.jsx)(r.h2,{id:"2-etcd-node-configuration",children:"2 Etcd Node Configuration"}),"\n",(0,s.jsx)(r.h3,{id:"21-ensure-that-the---cert-file-and---key-file-arguments-are-set-as-appropriate-automated",children:"2.1 Ensure that the --cert-file and --key-file arguments are set as appropriate (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result:"})," '.client-transport-security.cert-file' is equal to '/var/lib/rancher/k3s/server/tls/etcd/server-client.crt' AND '.client-transport-security.key-file' is equal to '/var/lib/rancher/k3s/server/tls/etcd/server-client.key'"]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Returned Value:"})}),(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:"advertise-client-urls: https://10.10.10.100:2379\nclient-transport-security:\n cert-file: /var/lib/rancher/k3s/server/tls/etcd/server-client.crt\n client-cert-auth: true\n key-file: /var/lib/rancher/k3s/server/tls/etcd/server-client.key\n trusted-ca-file: /var/lib/rancher/k3s/server/tls/etcd/server-ca.crt\ndata-dir: /var/lib/rancher/k3s/server/db/etcd\nelection-timeout: 5000\nexperimental-initial-corrupt-check: true\nheartbeat-interval: 500\ninitial-advertise-peer-urls: https://10.10.10.100:2380\ninitial-cluster: server-0-ee1de912=https://10.10.10.100:2380\ninitial-cluster-state: new\nlisten-client-urls: https://127.0.0.1:2379,https://10.10.10.100:2379\nlisten-metrics-urls: http://127.0.0.1:2381\nlisten-peer-urls: https://127.0.0.1:2380,https://10.10.10.100:2380\nlog-outputs:\n- stderr\nlogger: zap\nname: server-0-ee1de912\npeer-transport-security:\n cert-file: /var/lib/rancher/k3s/server/tls/etcd/peer-server-client.crt\n client-cert-auth: true\n key-file: /var/lib/rancher/k3s/server/tls/etcd/peer-server-client.key\n trusted-ca-file: /var/lib/rancher/k3s/server/tls/etcd/peer-ca.crt\nsnapshot-count: 10000\n"})})]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Remediation:"})}),(0,s.jsx)(r.p,{children:"If running on with sqlite or a external DB, etcd checks are Not Applicable.\nWhen running with embedded-etcd, K3s generates cert and key files for etcd.\nThese are located in /var/lib/rancher/k3s/server/tls/etcd/.\nIf this check fails, ensure that the configuration file /var/lib/rancher/k3s/server/db/etcd/config\nhas not been modified to use custom cert and key files."})]}),"\n",(0,s.jsx)(r.h3,{id:"22-ensure-that-the---client-cert-auth-argument-is-set-to-true-automated",children:"2.2 Ensure that the --client-cert-auth argument is set to true (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result:"})," '.client-transport-security.client-cert-auth' is equal to 'true'"]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Returned Value:"})}),(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:"advertise-client-urls: https://10.10.10.100:2379\nclient-transport-security:\n cert-file: /var/lib/rancher/k3s/server/tls/etcd/server-client.crt\n client-cert-auth: true\n key-file: /var/lib/rancher/k3s/server/tls/etcd/server-client.key\n trusted-ca-file: /var/lib/rancher/k3s/server/tls/etcd/server-ca.crt\ndata-dir: /var/lib/rancher/k3s/server/db/etcd\nelection-timeout: 5000\nexperimental-initial-corrupt-check: true\nheartbeat-interval: 500\ninitial-advertise-peer-urls: https://10.10.10.100:2380\ninitial-cluster: server-0-ee1de912=https://10.10.10.100:2380\ninitial-cluster-state: new\nlisten-client-urls: https://127.0.0.1:2379,https://10.10.10.100:2379\nlisten-metrics-urls: http://127.0.0.1:2381\nlisten-peer-urls: https://127.0.0.1:2380,https://10.10.10.100:2380\nlog-outputs:\n- stderr\nlogger: zap\nname: server-0-ee1de912\npeer-transport-security:\n cert-file: /var/lib/rancher/k3s/server/tls/etcd/peer-server-client.crt\n client-cert-auth: true\n key-file: /var/lib/rancher/k3s/server/tls/etcd/peer-server-client.key\n trusted-ca-file: /var/lib/rancher/k3s/server/tls/etcd/peer-ca.crt\nsnapshot-count: 10000\n"})})]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Remediation:"})}),(0,s.jsx)(r.p,{children:"If running on with sqlite or a external DB, etcd checks are Not Applicable.\nWhen running with embedded-etcd, K3s sets the --client-cert-auth parameter to true.\nIf this check fails, ensure that the configuration file /var/lib/rancher/k3s/server/db/etcd/config\nhas not been modified to disable client certificate authentication."})]}),"\n",(0,s.jsx)(r.h3,{id:"23-ensure-that-the---auto-tls-argument-is-not-set-to-true-automated",children:"2.3 Ensure that the --auto-tls argument is not set to true (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result:"})," '.client-transport-security.auto-tls' is present OR '.client-transport-security.auto-tls' is not present"]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Returned Value:"})}),(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:"advertise-client-urls: https://10.10.10.100:2379\nclient-transport-security:\n cert-file: /var/lib/rancher/k3s/server/tls/etcd/server-client.crt\n client-cert-auth: true\n key-file: /var/lib/rancher/k3s/server/tls/etcd/server-client.key\n trusted-ca-file: /var/lib/rancher/k3s/server/tls/etcd/server-ca.crt\ndata-dir: /var/lib/rancher/k3s/server/db/etcd\nelection-timeout: 5000\nexperimental-initial-corrupt-check: true\nheartbeat-interval: 500\ninitial-advertise-peer-urls: https://10.10.10.100:2380\ninitial-cluster: server-0-ee1de912=https://10.10.10.100:2380\ninitial-cluster-state: new\nlisten-client-urls: https://127.0.0.1:2379,https://10.10.10.100:2379\nlisten-metrics-urls: http://127.0.0.1:2381\nlisten-peer-urls: https://127.0.0.1:2380,https://10.10.10.100:2380\nlog-outputs:\n- stderr\nlogger: zap\nname: server-0-ee1de912\npeer-transport-security:\n cert-file: /var/lib/rancher/k3s/server/tls/etcd/peer-server-client.crt\n client-cert-auth: true\n key-file: /var/lib/rancher/k3s/server/tls/etcd/peer-server-client.key\n trusted-ca-file: /var/lib/rancher/k3s/server/tls/etcd/peer-ca.crt\nsnapshot-count: 10000\n"})})]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Remediation:"})}),(0,s.jsx)(r.p,{children:"If running on with sqlite or a external DB, etcd checks are Not Applicable.\nWhen running with embedded-etcd, K3s does not set the --auto-tls parameter.\nIf this check fails, edit the etcd pod specification file /var/lib/rancher/k3s/server/db/etcd/config on the master\nnode and either remove the --auto-tls parameter or set it to false.\nclient-transport-security:\nauto-tls: false"})]}),"\n",(0,s.jsx)(r.h3,{id:"24-ensure-that-the---peer-cert-file-and---peer-key-file-arguments-are-set-as-appropriate-automated",children:"2.4 Ensure that the --peer-cert-file and --peer-key-file arguments are set as appropriate (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result:"})," '.peer-transport-security.cert-file' is equal to '/var/lib/rancher/k3s/server/tls/etcd/peer-server-client.crt' AND '.peer-transport-security.key-file' is equal to '/var/lib/rancher/k3s/server/tls/etcd/peer-server-client.key'"]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Returned Value:"})}),(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:"advertise-client-urls: https://10.10.10.100:2379\nclient-transport-security:\n cert-file: /var/lib/rancher/k3s/server/tls/etcd/server-client.crt\n client-cert-auth: true\n key-file: /var/lib/rancher/k3s/server/tls/etcd/server-client.key\n trusted-ca-file: /var/lib/rancher/k3s/server/tls/etcd/server-ca.crt\ndata-dir: /var/lib/rancher/k3s/server/db/etcd\nelection-timeout: 5000\nexperimental-initial-corrupt-check: true\nheartbeat-interval: 500\ninitial-advertise-peer-urls: https://10.10.10.100:2380\ninitial-cluster: server-0-ee1de912=https://10.10.10.100:2380\ninitial-cluster-state: new\nlisten-client-urls: https://127.0.0.1:2379,https://10.10.10.100:2379\nlisten-metrics-urls: http://127.0.0.1:2381\nlisten-peer-urls: https://127.0.0.1:2380,https://10.10.10.100:2380\nlog-outputs:\n- stderr\nlogger: zap\nname: server-0-ee1de912\npeer-transport-security:\n cert-file: /var/lib/rancher/k3s/server/tls/etcd/peer-server-client.crt\n client-cert-auth: true\n key-file: /var/lib/rancher/k3s/server/tls/etcd/peer-server-client.key\n trusted-ca-file: /var/lib/rancher/k3s/server/tls/etcd/peer-ca.crt\nsnapshot-count: 10000\n"})})]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Remediation:"})}),(0,s.jsx)(r.p,{children:"If running on with sqlite or a external DB, etcd checks are Not Applicable.\nWhen running with embedded-etcd, K3s generates peer cert and key files for etcd.\nThese are located in /var/lib/rancher/k3s/server/tls/etcd/.\nIf this check fails, ensure that the configuration file /var/lib/rancher/k3s/server/db/etcd/config\nhas not been modified to use custom peer cert and key files."})]}),"\n",(0,s.jsx)(r.h3,{id:"25-ensure-that-the---peer-client-cert-auth-argument-is-set-to-true-automated",children:"2.5 Ensure that the --peer-client-cert-auth argument is set to true (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result:"})," '.peer-transport-security.client-cert-auth' is equal to 'true'"]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Returned Value:"})}),(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:"advertise-client-urls: https://10.10.10.100:2379\nclient-transport-security:\n cert-file: /var/lib/rancher/k3s/server/tls/etcd/server-client.crt\n client-cert-auth: true\n key-file: /var/lib/rancher/k3s/server/tls/etcd/server-client.key\n trusted-ca-file: /var/lib/rancher/k3s/server/tls/etcd/server-ca.crt\ndata-dir: /var/lib/rancher/k3s/server/db/etcd\nelection-timeout: 5000\nexperimental-initial-corrupt-check: true\nheartbeat-interval: 500\ninitial-advertise-peer-urls: https://10.10.10.100:2380\ninitial-cluster: server-0-ee1de912=https://10.10.10.100:2380\ninitial-cluster-state: new\nlisten-client-urls: https://127.0.0.1:2379,https://10.10.10.100:2379\nlisten-metrics-urls: http://127.0.0.1:2381\nlisten-peer-urls: https://127.0.0.1:2380,https://10.10.10.100:2380\nlog-outputs:\n- stderr\nlogger: zap\nname: server-0-ee1de912\npeer-transport-security:\n cert-file: /var/lib/rancher/k3s/server/tls/etcd/peer-server-client.crt\n client-cert-auth: true\n key-file: /var/lib/rancher/k3s/server/tls/etcd/peer-server-client.key\n trusted-ca-file: /var/lib/rancher/k3s/server/tls/etcd/peer-ca.crt\nsnapshot-count: 10000\n"})})]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Remediation:"})}),(0,s.jsx)(r.p,{children:"If running on with sqlite or a external DB, etcd checks are Not Applicable.\nWhen running with embedded-etcd, K3s sets the --peer-cert-auth parameter to true.\nIf this check fails, ensure that the configuration file /var/lib/rancher/k3s/server/db/etcd/config\nhas not been modified to disable peer client certificate authentication."})]}),"\n",(0,s.jsx)(r.h3,{id:"26-ensure-that-the---peer-auto-tls-argument-is-not-set-to-true-automated",children:"2.6 Ensure that the --peer-auto-tls argument is not set to true (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result:"})," '.peer-transport-security.auto-tls' is present OR '.peer-transport-security.auto-tls' is not present"]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Returned Value:"})}),(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:"advertise-client-urls: https://10.10.10.100:2379\nclient-transport-security:\n cert-file: /var/lib/rancher/k3s/server/tls/etcd/server-client.crt\n client-cert-auth: true\n key-file: /var/lib/rancher/k3s/server/tls/etcd/server-client.key\n trusted-ca-file: /var/lib/rancher/k3s/server/tls/etcd/server-ca.crt\ndata-dir: /var/lib/rancher/k3s/server/db/etcd\nelection-timeout: 5000\nexperimental-initial-corrupt-check: true\nheartbeat-interval: 500\ninitial-advertise-peer-urls: https://10.10.10.100:2380\ninitial-cluster: server-0-ee1de912=https://10.10.10.100:2380\ninitial-cluster-state: new\nlisten-client-urls: https://127.0.0.1:2379,https://10.10.10.100:2379\nlisten-metrics-urls: http://127.0.0.1:2381\nlisten-peer-urls: https://127.0.0.1:2380,https://10.10.10.100:2380\nlog-outputs:\n- stderr\nlogger: zap\nname: server-0-ee1de912\npeer-transport-security:\n cert-file: /var/lib/rancher/k3s/server/tls/etcd/peer-server-client.crt\n client-cert-auth: true\n key-file: /var/lib/rancher/k3s/server/tls/etcd/peer-server-client.key\n trusted-ca-file: /var/lib/rancher/k3s/server/tls/etcd/peer-ca.crt\nsnapshot-count: 10000\n"})})]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Remediation:"})}),(0,s.jsx)(r.p,{children:"If running on with sqlite or a external DB, etcd checks are Not Applicable.\nWhen running with embedded-etcd, K3s does not set the --peer-auto-tls parameter.\nIf this check fails, edit the etcd pod specification file /var/lib/rancher/k3s/server/db/etcd/config on the master\nnode and either remove the --peer-auto-tls parameter or set it to false.\npeer-transport-security:\nauto-tls: false"})]}),"\n",(0,s.jsx)(r.h3,{id:"27-ensure-that-a-unique-certificate-authority-is-used-for-etcd-automated",children:"2.7 Ensure that a unique Certificate Authority is used for etcd (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result:"})," '.peer-transport-security.trusted-ca-file' is equal to '/var/lib/rancher/k3s/server/tls/etcd/peer-ca.crt'"]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Returned Value:"})}),(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:"advertise-client-urls: https://10.10.10.100:2379\nclient-transport-security:\n cert-file: /var/lib/rancher/k3s/server/tls/etcd/server-client.crt\n client-cert-auth: true\n key-file: /var/lib/rancher/k3s/server/tls/etcd/server-client.key\n trusted-ca-file: /var/lib/rancher/k3s/server/tls/etcd/server-ca.crt\ndata-dir: /var/lib/rancher/k3s/server/db/etcd\nelection-timeout: 5000\nexperimental-initial-corrupt-check: true\nheartbeat-interval: 500\ninitial-advertise-peer-urls: https://10.10.10.100:2380\ninitial-cluster: server-0-ee1de912=https://10.10.10.100:2380\ninitial-cluster-state: new\nlisten-client-urls: https://127.0.0.1:2379,https://10.10.10.100:2379\nlisten-metrics-urls: http://127.0.0.1:2381\nlisten-peer-urls: https://127.0.0.1:2380,https://10.10.10.100:2380\nlog-outputs:\n- stderr\nlogger: zap\nname: server-0-ee1de912\npeer-transport-security:\n cert-file: /var/lib/rancher/k3s/server/tls/etcd/peer-server-client.crt\n client-cert-auth: true\n key-file: /var/lib/rancher/k3s/server/tls/etcd/peer-server-client.key\n trusted-ca-file: /var/lib/rancher/k3s/server/tls/etcd/peer-ca.crt\nsnapshot-count: 10000\n"})})]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Remediation:"})}),(0,s.jsx)(r.p,{children:"If running on with sqlite or a external DB, etcd checks are Not Applicable.\nWhen running with embedded-etcd, K3s generates a unique certificate authority for etcd.\nThis is located at /var/lib/rancher/k3s/server/tls/etcd/peer-ca.crt.\nIf this check fails, ensure that the configuration file /var/lib/rancher/k3s/server/db/etcd/config\nhas not been modified to use a shared certificate authority."})]}),"\n",(0,s.jsx)(r.h2,{id:"41-worker-node-configuration-files",children:"4.1 Worker Node Configuration Files"}),"\n",(0,s.jsx)(r.h3,{id:"411-ensure-that-the-kubelet-service-file-permissions-are-set-to-600-or-more-restrictive-automated",children:"4.1.1 Ensure that the kubelet service file permissions are set to 600 or more restrictive (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," Not Applicable"]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Rationale:"})}),"\n",(0,s.jsx)(r.p,{children:"The kubelet is embedded in the k3s process. There is no kubelet service file, all configuration is passed in as arguments at runtime."}),"\n",(0,s.jsxs)(r.h3,{id:"412-ensure-that-the-kubelet-service-file-ownership-is-set-to-root-automated",children:["4.1.2 Ensure that the kubelet service file ownership is set to root",":root"," (Automated)"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," Not Applicable"]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Rationale:"})}),"\n",(0,s.jsx)(r.p,{children:"The kubelet is embedded in the k3s process. There is no kubelet service file, all configuration is passed in as arguments at runtime."}),"\n",(0,s.jsx)(r.h3,{id:"413-if-proxy-kubeconfig-file-exists-ensure-permissions-are-set-to-600-or-more-restrictive-automated",children:"4.1.3 If proxy kubeconfig file exists ensure permissions are set to 600 or more restrictive (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"/bin/sh -c 'if test -e /var/lib/rancher/k3s/agent/kubeproxy.kubeconfig; then stat -c permissions=%a /var/lib/rancher/k3s/agent/kubeproxy.kubeconfig; fi' \n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result:"})," permissions has permissions 600, expected 600 or more restrictive"]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Returned Value:"})}),(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:"permissions=600\n"})})]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Remediation:"})}),(0,s.jsxs)(r.p,{children:["Run the below command (based on the file location on your system) on the each worker node.\nFor example,\n",(0,s.jsx)(r.code,{children:"chmod 600 /var/lib/rancher/k3s/agent/kubeproxy.kubeconfig"})]})]}),"\n",(0,s.jsxs)(r.h3,{id:"414-if-proxy-kubeconfig-file-exists-ensure-ownership-is-set-to-root-automated",children:["4.1.4 If proxy kubeconfig file exists ensure ownership is set to root",":root"," (Automated)"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"stat -c %U:%G /var/lib/rancher/k3s/agent/kubeproxy.kubeconfig\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result:"})," 'root",":root","' is present"]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Returned Value:"})}),(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:"root:root\n"})})]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Remediation:"})}),(0,s.jsxs)(r.p,{children:["Run the below command (based on the file location on your system) on the each worker node.\nFor example, ",(0,s.jsx)(r.code,{children:"chown root:root /var/lib/rancher/k3s/agent/kubeproxy.kubeconfig"})]})]}),"\n",(0,s.jsx)(r.h3,{id:"415-ensure-that-the---kubeconfig-kubeletconf-file-permissions-are-set-to-600-or-more-restrictive-automated",children:"4.1.5 Ensure that the --kubeconfig kubelet.conf file permissions are set to 600 or more restrictive (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"/bin/sh -c 'if test -e /var/lib/rancher/k3s/agent/kubelet.kubeconfig; then stat -c permissions=%a /var/lib/rancher/k3s/agent/kubelet.kubeconfig; fi' \n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result:"})," permissions has permissions 600, expected 600 or more restrictive"]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Returned Value:"})}),(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:"permissions=600\n"})})]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Remediation:"})}),(0,s.jsxs)(r.p,{children:["Run the below command (based on the file location on your system) on the each worker node.\nFor example,\n",(0,s.jsx)(r.code,{children:"chmod 600 /var/lib/rancher/k3s/agent/kubelet.kubeconfig"})]})]}),"\n",(0,s.jsxs)(r.h3,{id:"416-ensure-that-the---kubeconfig-kubeletconf-file-ownership-is-set-to-root-automated",children:["4.1.6 Ensure that the --kubeconfig kubelet.conf file ownership is set to root",":root"," (Automated)"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"stat -c %U:%G /var/lib/rancher/k3s/agent/kubelet.kubeconfig\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result:"})," 'root",":root","' is equal to 'root",":root","'"]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Returned Value:"})}),(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:"root:root\n"})})]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Remediation:"})}),(0,s.jsxs)(r.p,{children:["Run the below command (based on the file location on your system) on the each worker node.\nFor example,\n",(0,s.jsx)(r.code,{children:"chown root:root /var/lib/rancher/k3s/agent/kubelet.kubeconfig"})]})]}),"\n",(0,s.jsx)(r.h3,{id:"417-ensure-that-the-certificate-authorities-file-permissions-are-set-to-600-or-more-restrictive-automated",children:"4.1.7 Ensure that the certificate authorities file permissions are set to 600 or more restrictive (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"stat -c permissions=%a /var/lib/rancher/k3s/agent/client-ca.crt\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result:"})," permissions has permissions 600, expected 600 or more restrictive"]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Returned Value:"})}),(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:"permissions=600\n"})})]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Remediation:"})}),(0,s.jsxs)(r.p,{children:["Run the following command to modify the file permissions of the\n--client-ca-file ",(0,s.jsx)(r.code,{children:"chmod 600 /var/lib/rancher/k3s/agent/client-ca.crt"})]})]}),"\n",(0,s.jsxs)(r.h3,{id:"418-ensure-that-the-client-certificate-authorities-file-ownership-is-set-to-root-automated",children:["4.1.8 Ensure that the client certificate authorities file ownership is set to root",":root"," (Automated)"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"stat -c %U:%G /var/lib/rancher/k3s/agent/client-ca.crt\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result:"})," 'root",":root","' is equal to 'root",":root","'"]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Returned Value:"})}),(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:"root:root\n"})})]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Remediation:"})}),(0,s.jsxs)(r.p,{children:["Run the following command to modify the ownership of the --client-ca-file.\n",(0,s.jsx)(r.code,{children:"chown root:root /var/lib/rancher/k3s/agent/client-ca.crt"})]})]}),"\n",(0,s.jsx)(r.h3,{id:"419-if-the-kubelet-configyaml-configuration-file-is-being-used-validate-permissions-set-to-600-or-more-restrictive-automated",children:"4.1.9 If the kubelet config.yaml configuration file is being used validate permissions set to 600 or more restrictive (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," Not Applicable"]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Rationale:"})}),"\n",(0,s.jsx)(r.p,{children:"The kubelet is embedded in the k3s process. There is no kubelet config file, all configuration is passed in as arguments at runtime."}),"\n",(0,s.jsxs)(r.h3,{id:"4110-if-the-kubelet-configyaml-configuration-file-is-being-used-validate-file-ownership-is-set-to-root-automated",children:["4.1.10 If the kubelet config.yaml configuration file is being used validate file ownership is set to root",":root"," (Automated)"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," Not Applicable"]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Rationale:"})}),"\n",(0,s.jsx)(r.p,{children:"The kubelet is embedded in the k3s process. There is no kubelet config file, all configuration is passed in as arguments at runtime."}),"\n",(0,s.jsx)(r.h2,{id:"42-kubelet",children:"4.2 Kubelet"}),"\n",(0,s.jsx)(r.h3,{id:"421-ensure-that-the---anonymous-auth-argument-is-set-to-false-automated",children:"4.2.1 Ensure that the --anonymous-auth argument is set to false (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:'/bin/sh -c \'if test $(journalctl -D /var/log/journal -u k3s | grep "Running kube-apiserver" | wc -l) -gt 0; then journalctl -D /var/log/journal -u k3s | grep "Running kube-apiserver" | tail -n1 | grep "anonymous-auth" | grep -v grep; else echo "--anonymous-auth=false"; fi\' \n'})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result:"})," '--anonymous-auth' is equal to 'false'"]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Returned Value:"})}),(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:'Aug 09 18:56:04 server-0 k3s[2366]: time="2024-08-09T18:56:04Z" level=info msg="Running kube-apiserver --advertise-address=10.10.10.100 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,NamespaceLifecycle,ServiceAccount,PodSecurityPolicy --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})})]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Remediation:"})}),(0,s.jsx)(r.p,{children:"By default, K3s sets the --anonymous-auth to false. If you have set this to a different value, you\nshould set it back to false. If using the K3s config file /etc/rancher/k3s/config.yaml, remove any lines similar to below."}),(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{children:'kubelet-arg:\n - "anonymous-auth=true"\n'})}),(0,s.jsx)(r.p,{children:'If using the command line, edit the K3s service file and remove the below argument.\n--kubelet-arg="anonymous-auth=true"\nBased on your system, restart the k3s service. For example,\nsystemctl daemon-reload\nsystemctl restart k3s.service'})]}),"\n",(0,s.jsx)(r.h3,{id:"422-ensure-that-the---authorization-mode-argument-is-not-set-to-alwaysallow-automated",children:"4.2.2 Ensure that the --authorization-mode argument is not set to AlwaysAllow (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:'/bin/sh -c \'if test $(journalctl -D /var/log/journal -u k3s | grep "Running kube-apiserver" | wc -l) -gt 0; then journalctl -D /var/log/journal -u k3s | grep "Running kube-apiserver" | tail -n1 | grep "authorization-mode"; else echo "--authorization-mode=Webhook"; fi\' \n'})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result:"})," '--authorization-mode' does not have 'AlwaysAllow'"]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Returned Value:"})}),(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:'Aug 09 18:56:04 server-0 k3s[2366]: time="2024-08-09T18:56:04Z" level=info msg="Running kube-apiserver --advertise-address=10.10.10.100 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,NamespaceLifecycle,ServiceAccount,PodSecurityPolicy --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})})]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Remediation:"})}),(0,s.jsx)(r.p,{children:"By default, K3s does not set the --authorization-mode to AlwaysAllow.\nIf using the K3s config file /etc/rancher/k3s/config.yaml, remove any lines similar to below."}),(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{children:'kubelet-arg:\n - "authorization-mode=AlwaysAllow"\n'})}),(0,s.jsx)(r.p,{children:'If using the command line, edit the K3s service file and remove the below argument.\n--kubelet-arg="authorization-mode=AlwaysAllow"\nBased on your system, restart the k3s service. For example,\nsystemctl daemon-reload\nsystemctl restart k3s.service'})]}),"\n",(0,s.jsx)(r.h3,{id:"423-ensure-that-the---client-ca-file-argument-is-set-as-appropriate-automated",children:"4.2.3 Ensure that the --client-ca-file argument is set as appropriate (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:'/bin/sh -c \'if test $(journalctl -D /var/log/journal -u k3s | grep "Running kube-apiserver" | wc -l) -gt 0; then journalctl -D /var/log/journal -u k3s | grep "Running kube-apiserver" | tail -n1 | grep "client-ca-file"; else echo "--client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt"; fi\' \n'})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result:"})," '--client-ca-file' is present"]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Returned Value:"})}),(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:'Aug 09 18:56:04 server-0 k3s[2366]: time="2024-08-09T18:56:04Z" level=info msg="Running kube-apiserver --advertise-address=10.10.10.100 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,NamespaceLifecycle,ServiceAccount,PodSecurityPolicy --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})})]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Remediation:"})}),(0,s.jsx)(r.p,{children:"By default, K3s automatically provides the client ca certificate for the Kubelet.\nIt is generated and located at /var/lib/rancher/k3s/agent/client-ca.crt"})]}),"\n",(0,s.jsx)(r.h3,{id:"424-verify-that-the---read-only-port-argument-is-set-to-0-automated",children:"4.2.4 Verify that the --read-only-port argument is set to 0 (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s -u k3s-agent | grep 'Running kubelet' | tail -n1\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result:"})," '--read-only-port' is equal to '0' OR '--read-only-port' is not present"]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Returned Value:"})}),(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:'Aug 09 18:56:06 server-0 k3s[2366]: time="2024-08-09T18:56:06Z" level=info msg="Running kubelet --address=0.0.0.0 --allowed-unsafe-sysctls=net.ipv4.ip_forward,net.ipv6.conf.all.forwarding --anonymous-auth=false --authentication-token-webhook=true --authorization-mode=Webhook --cgroup-driver=systemd --client-ca-file=/var/lib/rancher/k3s/agent/client-ca.crt --cloud-provider=external --cluster-dns=10.43.0.10 --cluster-domain=cluster.local --container-runtime-endpoint=unix:///run/k3s/containerd/containerd.sock --containerd=/run/k3s/containerd/containerd.sock --event-qps=0 --eviction-hard=imagefs.available<5%,nodefs.available<5% --eviction-minimum-reclaim=imagefs.available=10%,nodefs.available=10% --fail-swap-on=false --healthz-bind-address=127.0.0.1 --hostname-override=server-0 --kubeconfig=/var/lib/rancher/k3s/agent/kubelet.kubeconfig --make-iptables-util-chains=true --node-ip=10.10.10.100 --node-labels= --pod-infra-container-image=rancher/mirrored-pause:3.6 --pod-manifest-path=/var/lib/rancher/k3s/agent/pod-manifests --protect-kernel-defaults=true --read-only-port=0 --resolv-conf=/run/systemd/resolve/resolv.conf --serialize-image-pulls=false --streaming-connection-idle-timeout=5m --tls-cert-file=/var/lib/rancher/k3s/agent/serving-kubelet.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/agent/serving-kubelet.key"\n'})})]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Remediation:"})}),(0,s.jsx)(r.p,{children:"By default, K3s sets the --read-only-port to 0. If you have set this to a different value, you\nshould set it back to 0. If using the K3s config file /etc/rancher/k3s/config.yaml, remove any lines similar to below."}),(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{children:'kubelet-arg:\n - "read-only-port=XXXX"\n'})}),(0,s.jsx)(r.p,{children:'If using the command line, edit the K3s service file and remove the below argument.\n--kubelet-arg="read-only-port=XXXX"\nBased on your system, restart the k3s service. For example,\nsystemctl daemon-reload\nsystemctl restart k3s.service'})]}),"\n",(0,s.jsx)(r.h3,{id:"425-ensure-that-the---streaming-connection-idle-timeout-argument-is-not-set-to-0-manual",children:"4.2.5 Ensure that the --streaming-connection-idle-timeout argument is not set to 0 (Manual)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s -u k3s-agent | grep 'Running kubelet' | tail -n1\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result:"})," '--streaming-connection-idle-timeout' is not equal to '0' OR '--streaming-connection-idle-timeout' is not present"]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Returned Value:"})}),(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:'Aug 09 18:56:06 server-0 k3s[2366]: time="2024-08-09T18:56:06Z" level=info msg="Running kubelet --address=0.0.0.0 --allowed-unsafe-sysctls=net.ipv4.ip_forward,net.ipv6.conf.all.forwarding --anonymous-auth=false --authentication-token-webhook=true --authorization-mode=Webhook --cgroup-driver=systemd --client-ca-file=/var/lib/rancher/k3s/agent/client-ca.crt --cloud-provider=external --cluster-dns=10.43.0.10 --cluster-domain=cluster.local --container-runtime-endpoint=unix:///run/k3s/containerd/containerd.sock --containerd=/run/k3s/containerd/containerd.sock --event-qps=0 --eviction-hard=imagefs.available<5%,nodefs.available<5% --eviction-minimum-reclaim=imagefs.available=10%,nodefs.available=10% --fail-swap-on=false --healthz-bind-address=127.0.0.1 --hostname-override=server-0 --kubeconfig=/var/lib/rancher/k3s/agent/kubelet.kubeconfig --make-iptables-util-chains=true --node-ip=10.10.10.100 --node-labels= --pod-infra-container-image=rancher/mirrored-pause:3.6 --pod-manifest-path=/var/lib/rancher/k3s/agent/pod-manifests --protect-kernel-defaults=true --read-only-port=0 --resolv-conf=/run/systemd/resolve/resolv.conf --serialize-image-pulls=false --streaming-connection-idle-timeout=5m --tls-cert-file=/var/lib/rancher/k3s/agent/serving-kubelet.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/agent/serving-kubelet.key"\n'})})]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Remediation:"})}),(0,s.jsx)(r.p,{children:"If using the K3s config file /etc/rancher/k3s/config.yaml, set the following parameter to an appropriate value."}),(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{children:'kubelet-arg:\n - "streaming-connection-idle-timeout=5m"\n'})}),(0,s.jsx)(r.p,{children:'If using the command line, run K3s with --kubelet-arg="streaming-connection-idle-timeout=5m".\nBased on your system, restart the k3s service. For example,\nsystemctl restart k3s.service'})]}),"\n",(0,s.jsx)(r.h3,{id:"426-ensure-that-the---protect-kernel-defaults-argument-is-set-to-true-automated",children:"4.2.6 Ensure that the --protect-kernel-defaults argument is set to true (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s -u k3s-agent | grep 'Running kubelet' | tail -n1\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result:"})," '--protect-kernel-defaults' is equal to 'true'"]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Returned Value:"})}),(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:'Aug 09 18:56:06 server-0 k3s[2366]: time="2024-08-09T18:56:06Z" level=info msg="Running kubelet --address=0.0.0.0 --allowed-unsafe-sysctls=net.ipv4.ip_forward,net.ipv6.conf.all.forwarding --anonymous-auth=false --authentication-token-webhook=true --authorization-mode=Webhook --cgroup-driver=systemd --client-ca-file=/var/lib/rancher/k3s/agent/client-ca.crt --cloud-provider=external --cluster-dns=10.43.0.10 --cluster-domain=cluster.local --container-runtime-endpoint=unix:///run/k3s/containerd/containerd.sock --containerd=/run/k3s/containerd/containerd.sock --event-qps=0 --eviction-hard=imagefs.available<5%,nodefs.available<5% --eviction-minimum-reclaim=imagefs.available=10%,nodefs.available=10% --fail-swap-on=false --healthz-bind-address=127.0.0.1 --hostname-override=server-0 --kubeconfig=/var/lib/rancher/k3s/agent/kubelet.kubeconfig --make-iptables-util-chains=true --node-ip=10.10.10.100 --node-labels= --pod-infra-container-image=rancher/mirrored-pause:3.6 --pod-manifest-path=/var/lib/rancher/k3s/agent/pod-manifests --protect-kernel-defaults=true --read-only-port=0 --resolv-conf=/run/systemd/resolve/resolv.conf --serialize-image-pulls=false --streaming-connection-idle-timeout=5m --tls-cert-file=/var/lib/rancher/k3s/agent/serving-kubelet.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/agent/serving-kubelet.key"\n'})})]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Remediation:"})}),(0,s.jsx)(r.p,{children:"If using the K3s config file /etc/rancher/k3s/config.yaml, set the following parameter.\nprotect-kernel-defaults: true\nIf using the command line, run K3s with --protect-kernel-defaults=true.\nBased on your system, restart the k3s service. For example,\nsystemctl restart k3s.service"})]}),"\n",(0,s.jsx)(r.h3,{id:"427-ensure-that-the---make-iptables-util-chains-argument-is-set-to-true-automated",children:"4.2.7 Ensure that the --make-iptables-util-chains argument is set to true (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s -u k3s-agent | grep 'Running kubelet' | tail -n1\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result:"})," '--make-iptables-util-chains' is equal to 'true' OR '--make-iptables-util-chains' is not present"]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Returned Value:"})}),(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:'Aug 09 18:56:06 server-0 k3s[2366]: time="2024-08-09T18:56:06Z" level=info msg="Running kubelet --address=0.0.0.0 --allowed-unsafe-sysctls=net.ipv4.ip_forward,net.ipv6.conf.all.forwarding --anonymous-auth=false --authentication-token-webhook=true --authorization-mode=Webhook --cgroup-driver=systemd --client-ca-file=/var/lib/rancher/k3s/agent/client-ca.crt --cloud-provider=external --cluster-dns=10.43.0.10 --cluster-domain=cluster.local --container-runtime-endpoint=unix:///run/k3s/containerd/containerd.sock --containerd=/run/k3s/containerd/containerd.sock --event-qps=0 --eviction-hard=imagefs.available<5%,nodefs.available<5% --eviction-minimum-reclaim=imagefs.available=10%,nodefs.available=10% --fail-swap-on=false --healthz-bind-address=127.0.0.1 --hostname-override=server-0 --kubeconfig=/var/lib/rancher/k3s/agent/kubelet.kubeconfig --make-iptables-util-chains=true --node-ip=10.10.10.100 --node-labels= --pod-infra-container-image=rancher/mirrored-pause:3.6 --pod-manifest-path=/var/lib/rancher/k3s/agent/pod-manifests --protect-kernel-defaults=true --read-only-port=0 --resolv-conf=/run/systemd/resolve/resolv.conf --serialize-image-pulls=false --streaming-connection-idle-timeout=5m --tls-cert-file=/var/lib/rancher/k3s/agent/serving-kubelet.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/agent/serving-kubelet.key"\n'})})]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Remediation:"})}),(0,s.jsx)(r.p,{children:"If using the K3s config file /etc/rancher/k3s/config.yaml, set the following parameter."}),(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{children:'kubelet-arg:\n - "make-iptables-util-chains=true"\n'})}),(0,s.jsx)(r.p,{children:'If using the command line, run K3s with --kubelet-arg="make-iptables-util-chains=true".\nBased on your system, restart the k3s service. For example,\nsystemctl restart k3s.service'})]}),"\n",(0,s.jsx)(r.h3,{id:"428-ensure-that-the---hostname-override-argument-is-not-set-automated",children:"4.2.8 Ensure that the --hostname-override argument is not set (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," Not Applicable"]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Rationale:"})}),"\n",(0,s.jsx)(r.p,{children:"By default, K3s does set the --hostname-override argument. Per CIS guidelines, this is to comply\nwith cloud providers that require this flag to ensure that hostname matches node names."}),"\n",(0,s.jsx)(r.h3,{id:"429-ensure-that-the-eventrecordqps-argument-is-set-to-a-level-which-ensures-appropriate-event-capture-manual",children:"4.2.9 Ensure that the eventRecordQPS argument is set to a level which ensures appropriate event capture (Manual)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s -u k3s-agent | grep 'Running kubelet' | tail -n1\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result:"})," '--event-qps' is equal to '0'"]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Returned Value:"})}),(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:'Aug 09 18:56:06 server-0 k3s[2366]: time="2024-08-09T18:56:06Z" level=info msg="Running kubelet --address=0.0.0.0 --allowed-unsafe-sysctls=net.ipv4.ip_forward,net.ipv6.conf.all.forwarding --anonymous-auth=false --authentication-token-webhook=true --authorization-mode=Webhook --cgroup-driver=systemd --client-ca-file=/var/lib/rancher/k3s/agent/client-ca.crt --cloud-provider=external --cluster-dns=10.43.0.10 --cluster-domain=cluster.local --container-runtime-endpoint=unix:///run/k3s/containerd/containerd.sock --containerd=/run/k3s/containerd/containerd.sock --event-qps=0 --eviction-hard=imagefs.available<5%,nodefs.available<5% --eviction-minimum-reclaim=imagefs.available=10%,nodefs.available=10% --fail-swap-on=false --healthz-bind-address=127.0.0.1 --hostname-override=server-0 --kubeconfig=/var/lib/rancher/k3s/agent/kubelet.kubeconfig --make-iptables-util-chains=true --node-ip=10.10.10.100 --node-labels= --pod-infra-container-image=rancher/mirrored-pause:3.6 --pod-manifest-path=/var/lib/rancher/k3s/agent/pod-manifests --protect-kernel-defaults=true --read-only-port=0 --resolv-conf=/run/systemd/resolve/resolv.conf --serialize-image-pulls=false --streaming-connection-idle-timeout=5m --tls-cert-file=/var/lib/rancher/k3s/agent/serving-kubelet.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/agent/serving-kubelet.key"\n'})})]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Remediation:"})}),(0,s.jsx)(r.p,{children:"By default, K3s sets the event-qps to 0. Should you wish to change this,\nIf using the K3s config file /etc/rancher/k3s/config.yaml, set the following parameter to an appropriate value."}),(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{children:'kubelet-arg:\n - "event-qps="\n'})}),(0,s.jsx)(r.p,{children:'If using the command line, run K3s with --kubelet-arg="event-qps=".\nBased on your system, restart the k3s service. For example,\nsystemctl restart k3s.service'})]}),"\n",(0,s.jsx)(r.h3,{id:"4210-ensure-that-the---tls-cert-file-and---tls-private-key-file-arguments-are-set-as-appropriate-automated",children:"4.2.10 Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s -u k3s-agent | grep 'Running kubelet' | tail -n1\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result:"})," '--tls-cert-file' is present AND '--tls-private-key-file' is present"]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Returned Value:"})}),(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:'Aug 09 18:56:06 server-0 k3s[2366]: time="2024-08-09T18:56:06Z" level=info msg="Running kubelet --address=0.0.0.0 --allowed-unsafe-sysctls=net.ipv4.ip_forward,net.ipv6.conf.all.forwarding --anonymous-auth=false --authentication-token-webhook=true --authorization-mode=Webhook --cgroup-driver=systemd --client-ca-file=/var/lib/rancher/k3s/agent/client-ca.crt --cloud-provider=external --cluster-dns=10.43.0.10 --cluster-domain=cluster.local --container-runtime-endpoint=unix:///run/k3s/containerd/containerd.sock --containerd=/run/k3s/containerd/containerd.sock --event-qps=0 --eviction-hard=imagefs.available<5%,nodefs.available<5% --eviction-minimum-reclaim=imagefs.available=10%,nodefs.available=10% --fail-swap-on=false --healthz-bind-address=127.0.0.1 --hostname-override=server-0 --kubeconfig=/var/lib/rancher/k3s/agent/kubelet.kubeconfig --make-iptables-util-chains=true --node-ip=10.10.10.100 --node-labels= --pod-infra-container-image=rancher/mirrored-pause:3.6 --pod-manifest-path=/var/lib/rancher/k3s/agent/pod-manifests --protect-kernel-defaults=true --read-only-port=0 --resolv-conf=/run/systemd/resolve/resolv.conf --serialize-image-pulls=false --streaming-connection-idle-timeout=5m --tls-cert-file=/var/lib/rancher/k3s/agent/serving-kubelet.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/agent/serving-kubelet.key"\n'})})]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Remediation:"})}),(0,s.jsx)(r.p,{children:"By default, K3s automatically provides the TLS certificate and private key for the Kubelet.\nThey are generated and located at /var/lib/rancher/k3s/agent/serving-kubelet.crt and /var/lib/rancher/k3s/agent/serving-kubelet.key\nIf for some reason you need to provide your own certificate and key, you can set the\nbelow parameters in the K3s config file /etc/rancher/k3s/config.yaml."}),(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{children:'kubelet-arg:\n - "tls-cert-file="\n - "tls-private-key-file="\n'})})]}),"\n",(0,s.jsx)(r.h3,{id:"4211-ensure-that-the---rotate-certificates-argument-is-not-set-to-false-automated",children:"4.2.11 Ensure that the --rotate-certificates argument is not set to false (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s -u k3s-agent | grep 'Running kubelet' | tail -n1\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result:"})," '--rotate-certificates' is present OR '--rotate-certificates' is not present"]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Returned Value:"})}),(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:'Aug 09 18:56:06 server-0 k3s[2366]: time="2024-08-09T18:56:06Z" level=info msg="Running kubelet --address=0.0.0.0 --allowed-unsafe-sysctls=net.ipv4.ip_forward,net.ipv6.conf.all.forwarding --anonymous-auth=false --authentication-token-webhook=true --authorization-mode=Webhook --cgroup-driver=systemd --client-ca-file=/var/lib/rancher/k3s/agent/client-ca.crt --cloud-provider=external --cluster-dns=10.43.0.10 --cluster-domain=cluster.local --container-runtime-endpoint=unix:///run/k3s/containerd/containerd.sock --containerd=/run/k3s/containerd/containerd.sock --event-qps=0 --eviction-hard=imagefs.available<5%,nodefs.available<5% --eviction-minimum-reclaim=imagefs.available=10%,nodefs.available=10% --fail-swap-on=false --healthz-bind-address=127.0.0.1 --hostname-override=server-0 --kubeconfig=/var/lib/rancher/k3s/agent/kubelet.kubeconfig --make-iptables-util-chains=true --node-ip=10.10.10.100 --node-labels= --pod-infra-container-image=rancher/mirrored-pause:3.6 --pod-manifest-path=/var/lib/rancher/k3s/agent/pod-manifests --protect-kernel-defaults=true --read-only-port=0 --resolv-conf=/run/systemd/resolve/resolv.conf --serialize-image-pulls=false --streaming-connection-idle-timeout=5m --tls-cert-file=/var/lib/rancher/k3s/agent/serving-kubelet.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/agent/serving-kubelet.key"\n'})})]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Remediation:"})}),(0,s.jsxs)(r.p,{children:["By default, K3s does not set the --rotate-certificates argument. If you have set this flag with a value of ",(0,s.jsx)(r.code,{children:"false"}),", you should either set it to ",(0,s.jsx)(r.code,{children:"true"}),' or completely remove the flag.\nIf using the K3s config file /etc/rancher/k3s/config.yaml, remove any rotate-certificates parameter.\nIf using the command line, remove the K3s flag --kubelet-arg="rotate-certificates".\nBased on your system, restart the k3s service. For example,\nsystemctl restart k3s.service']})]}),"\n",(0,s.jsx)(r.h3,{id:"4212-verify-that-the-rotatekubeletservercertificate-argument-is-set-to-true-automated",children:"4.2.12 Verify that the RotateKubeletServerCertificate argument is set to true (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s -u k3s-agent | grep 'Running kubelet' | tail -n1\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result:"})," 'RotateKubeletServerCertificate' is present OR 'RotateKubeletServerCertificate' is not present"]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Returned Value:"})}),(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:'Aug 09 18:56:06 server-0 k3s[2366]: time="2024-08-09T18:56:06Z" level=info msg="Running kubelet --address=0.0.0.0 --allowed-unsafe-sysctls=net.ipv4.ip_forward,net.ipv6.conf.all.forwarding --anonymous-auth=false --authentication-token-webhook=true --authorization-mode=Webhook --cgroup-driver=systemd --client-ca-file=/var/lib/rancher/k3s/agent/client-ca.crt --cloud-provider=external --cluster-dns=10.43.0.10 --cluster-domain=cluster.local --container-runtime-endpoint=unix:///run/k3s/containerd/containerd.sock --containerd=/run/k3s/containerd/containerd.sock --event-qps=0 --eviction-hard=imagefs.available<5%,nodefs.available<5% --eviction-minimum-reclaim=imagefs.available=10%,nodefs.available=10% --fail-swap-on=false --healthz-bind-address=127.0.0.1 --hostname-override=server-0 --kubeconfig=/var/lib/rancher/k3s/agent/kubelet.kubeconfig --make-iptables-util-chains=true --node-ip=10.10.10.100 --node-labels= --pod-infra-container-image=rancher/mirrored-pause:3.6 --pod-manifest-path=/var/lib/rancher/k3s/agent/pod-manifests --protect-kernel-defaults=true --read-only-port=0 --resolv-conf=/run/systemd/resolve/resolv.conf --serialize-image-pulls=false --streaming-connection-idle-timeout=5m --tls-cert-file=/var/lib/rancher/k3s/agent/serving-kubelet.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/agent/serving-kubelet.key"\n'})})]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Remediation:"})}),(0,s.jsx)(r.p,{children:'By default, K3s does not set the RotateKubeletServerCertificate feature gate.\nIf you have enabled this feature gate, you should remove it.\nIf using the K3s config file /etc/rancher/k3s/config.yaml, remove any feature-gate=RotateKubeletServerCertificate parameter.\nIf using the command line, remove the K3s flag --kubelet-arg="feature-gate=RotateKubeletServerCertificate".\nBased on your system, restart the k3s service. For example,\nsystemctl restart k3s.service'})]}),"\n",(0,s.jsx)(r.h3,{id:"4213-ensure-that-the-kubelet-only-makes-use-of-strong-cryptographic-ciphers-manual",children:"4.2.13 Ensure that the Kubelet only makes use of Strong Cryptographic Ciphers (Manual)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s -u k3s-agent | grep 'Running kubelet' | tail -n1\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result:"})," '--tls-cipher-suites' contains valid elements from 'TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256'"]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Returned Value:"})}),(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:'Aug 09 18:56:06 server-0 k3s[2366]: time="2024-08-09T18:56:06Z" level=info msg="Running kubelet --address=0.0.0.0 --allowed-unsafe-sysctls=net.ipv4.ip_forward,net.ipv6.conf.all.forwarding --anonymous-auth=false --authentication-token-webhook=true --authorization-mode=Webhook --cgroup-driver=systemd --client-ca-file=/var/lib/rancher/k3s/agent/client-ca.crt --cloud-provider=external --cluster-dns=10.43.0.10 --cluster-domain=cluster.local --container-runtime-endpoint=unix:///run/k3s/containerd/containerd.sock --containerd=/run/k3s/containerd/containerd.sock --event-qps=0 --eviction-hard=imagefs.available<5%,nodefs.available<5% --eviction-minimum-reclaim=imagefs.available=10%,nodefs.available=10% --fail-swap-on=false --healthz-bind-address=127.0.0.1 --hostname-override=server-0 --kubeconfig=/var/lib/rancher/k3s/agent/kubelet.kubeconfig --make-iptables-util-chains=true --node-ip=10.10.10.100 --node-labels= --pod-infra-container-image=rancher/mirrored-pause:3.6 --pod-manifest-path=/var/lib/rancher/k3s/agent/pod-manifests --protect-kernel-defaults=true --read-only-port=0 --resolv-conf=/run/systemd/resolve/resolv.conf --serialize-image-pulls=false --streaming-connection-idle-timeout=5m --tls-cert-file=/var/lib/rancher/k3s/agent/serving-kubelet.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/agent/serving-kubelet.key"\n'})})]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Remediation:"})}),(0,s.jsxs)(r.p,{children:["If using a K3s config file /etc/rancher/k3s/config.yaml, edit the file to set ",(0,s.jsx)(r.code,{children:"TLSCipherSuites"})," to"]}),(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{children:'kubelet-arg:\n - "tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305"\n'})}),(0,s.jsx)(r.p,{children:'or to a subset of these values.\nIf using the command line, add the K3s flag --kubelet-arg="tls-cipher-suites="\nBased on your system, restart the k3s service. For example,\nsystemctl restart k3s.service'})]}),"\n",(0,s.jsx)(r.h2,{id:"51-rbac-and-service-accounts",children:"5.1 RBAC and Service Accounts"}),"\n",(0,s.jsx)(r.h3,{id:"511-ensure-that-the-cluster-admin-role-is-only-used-where-required-manual",children:"5.1.1 Ensure that the cluster-admin role is only used where required (Manual)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nIdentify all clusterrolebindings to the cluster-admin role. Check if they are used and\nif they need this role or if they could use a role with fewer privileges.\nWhere possible, first bind users to a lower privileged role and then remove the\nclusterrolebinding to the cluster-admin role :\nkubectl delete clusterrolebinding [name]"]}),"\n",(0,s.jsx)(r.h3,{id:"512-minimize-access-to-secrets-manual",children:"5.1.2 Minimize access to secrets (Manual)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nWhere possible, remove get, list and watch access to Secret objects in the cluster."]}),"\n",(0,s.jsx)(r.h3,{id:"513-minimize-wildcard-use-in-roles-and-clusterroles-manual",children:"5.1.3 Minimize wildcard use in Roles and ClusterRoles (Manual)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nWhere possible replace any use of wildcards in clusterroles and roles with specific\nobjects or actions."]}),"\n",(0,s.jsx)(r.h3,{id:"514-minimize-access-to-create-pods-manual",children:"5.1.4 Minimize access to create pods (Manual)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nWhere possible, remove create access to pod objects in the cluster."]}),"\n",(0,s.jsx)(r.h3,{id:"515-ensure-that-default-service-accounts-are-not-actively-used-manual",children:"5.1.5 Ensure that default service accounts are not actively used. (Manual)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nCreate explicit service accounts wherever a Kubernetes workload requires specific access\nto the Kubernetes API server.\nModify the configuration of each default service account to include this value\nautomountServiceAccountToken: false"]}),"\n",(0,s.jsx)(r.h3,{id:"516-ensure-that-service-account-tokens-are-only-mounted-where-necessary-manual",children:"5.1.6 Ensure that Service Account Tokens are only mounted where necessary (Manual)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nModify the definition of pods and service accounts which do not need to mount service\naccount tokens to disable it."]}),"\n",(0,s.jsxs)(r.h3,{id:"517-avoid-use-of-system-group-manual",children:["5.1.7 Avoid use of system",":masters"," group (Manual)"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nRemove the system",":masters"," group from all users in the cluster."]}),"\n",(0,s.jsx)(r.h3,{id:"518-limit-use-of-the-bind-impersonate-and-escalate-permissions-in-the-kubernetes-cluster-manual",children:"5.1.8 Limit use of the Bind, Impersonate and Escalate permissions in the Kubernetes cluster (Manual)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nWhere possible, remove the impersonate, bind and escalate rights from subjects."]}),"\n",(0,s.jsx)(r.h2,{id:"52-pod-security-standards",children:"5.2 Pod Security Standards"}),"\n",(0,s.jsx)(r.h3,{id:"521-ensure-that-the-cluster-has-at-least-one-active-policy-control-mechanism-in-place-manual",children:"5.2.1 Ensure that the cluster has at least one active policy control mechanism in place (Manual)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nEnsure that either Pod Security Admission or an external policy control system is in place\nfor every namespace which contains user workloads."]}),"\n",(0,s.jsx)(r.h3,{id:"522-minimize-the-admission-of-privileged-containers-manual",children:"5.2.2 Minimize the admission of privileged containers (Manual)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nAdd policies to each namespace in the cluster which has user workloads to restrict the\nadmission of privileged containers."]}),"\n",(0,s.jsx)(r.h3,{id:"523-minimize-the-admission-of-containers-wishing-to-share-the-host-process-id-namespace-automated",children:"5.2.3 Minimize the admission of containers wishing to share the host process ID namespace (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nAdd policies to each namespace in the cluster which has user workloads to restrict the\nadmission of ",(0,s.jsx)(r.code,{children:"hostPID"})," containers."]}),"\n",(0,s.jsx)(r.h3,{id:"524-minimize-the-admission-of-containers-wishing-to-share-the-host-ipc-namespace-automated",children:"5.2.4 Minimize the admission of containers wishing to share the host IPC namespace (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nAdd policies to each namespace in the cluster which has user workloads to restrict the\nadmission of ",(0,s.jsx)(r.code,{children:"hostIPC"})," containers."]}),"\n",(0,s.jsx)(r.h3,{id:"525-minimize-the-admission-of-containers-wishing-to-share-the-host-network-namespace-automated",children:"5.2.5 Minimize the admission of containers wishing to share the host network namespace (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nAdd policies to each namespace in the cluster which has user workloads to restrict the\nadmission of ",(0,s.jsx)(r.code,{children:"hostNetwork"})," containers."]}),"\n",(0,s.jsx)(r.h3,{id:"526-minimize-the-admission-of-containers-with-allowprivilegeescalation-automated",children:"5.2.6 Minimize the admission of containers with allowPrivilegeEscalation (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nAdd policies to each namespace in the cluster which has user workloads to restrict the\nadmission of containers with ",(0,s.jsx)(r.code,{children:".spec.allowPrivilegeEscalation"})," set to ",(0,s.jsx)(r.code,{children:"true"}),"."]}),"\n",(0,s.jsx)(r.h3,{id:"527-minimize-the-admission-of-root-containers-automated",children:"5.2.7 Minimize the admission of root containers (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nCreate a policy for each namespace in the cluster, ensuring that either ",(0,s.jsx)(r.code,{children:"MustRunAsNonRoot"}),"\nor ",(0,s.jsx)(r.code,{children:"MustRunAs"})," with the range of UIDs not including 0, is set."]}),"\n",(0,s.jsx)(r.h3,{id:"528-minimize-the-admission-of-containers-with-the-net_raw-capability-automated",children:"5.2.8 Minimize the admission of containers with the NET_RAW capability (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nAdd policies to each namespace in the cluster which has user workloads to restrict the\nadmission of containers with the ",(0,s.jsx)(r.code,{children:"NET_RAW"})," capability."]}),"\n",(0,s.jsx)(r.h3,{id:"529-minimize-the-admission-of-containers-with-added-capabilities-automated",children:"5.2.9 Minimize the admission of containers with added capabilities (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nEnsure that ",(0,s.jsx)(r.code,{children:"allowedCapabilities"})," is not present in policies for the cluster unless\nit is set to an empty array."]}),"\n",(0,s.jsx)(r.h3,{id:"5210-minimize-the-admission-of-containers-with-capabilities-assigned-manual",children:"5.2.10 Minimize the admission of containers with capabilities assigned (Manual)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nReview the use of capabilities in applications running on your cluster. Where a namespace\ncontains applications which do not require any Linux capabities to operate consider adding\na PSP which forbids the admission of containers which do not drop all capabilities."]}),"\n",(0,s.jsx)(r.h3,{id:"5211-minimize-the-admission-of-windows-hostprocess-containers-manual",children:"5.2.11 Minimize the admission of Windows HostProcess containers (Manual)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nAdd policies to each namespace in the cluster which has user workloads to restrict the\nadmission of containers that have ",(0,s.jsx)(r.code,{children:".securityContext.windowsOptions.hostProcess"})," set to ",(0,s.jsx)(r.code,{children:"true"}),"."]}),"\n",(0,s.jsx)(r.h3,{id:"5212-minimize-the-admission-of-hostpath-volumes-manual",children:"5.2.12 Minimize the admission of HostPath volumes (Manual)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nAdd policies to each namespace in the cluster which has user workloads to restrict the\nadmission of containers with ",(0,s.jsx)(r.code,{children:"hostPath"})," volumes."]}),"\n",(0,s.jsx)(r.h3,{id:"5213-minimize-the-admission-of-containers-which-use-hostports-manual",children:"5.2.13 Minimize the admission of containers which use HostPorts (Manual)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nAdd policies to each namespace in the cluster which has user workloads to restrict the\nadmission of containers which use ",(0,s.jsx)(r.code,{children:"hostPort"})," sections."]}),"\n",(0,s.jsx)(r.h2,{id:"53-network-policies-and-cni",children:"5.3 Network Policies and CNI"}),"\n",(0,s.jsx)(r.h3,{id:"531-ensure-that-the-cni-in-use-supports-networkpolicies-manual",children:"5.3.1 Ensure that the CNI in use supports NetworkPolicies (Manual)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nIf the CNI plugin in use does not support network policies, consideration should be given to\nmaking use of a different plugin, or finding an alternate mechanism for restricting traffic\nin the Kubernetes cluster."]}),"\n",(0,s.jsx)(r.h3,{id:"532-ensure-that-all-namespaces-have-networkpolicies-defined-manual",children:"5.3.2 Ensure that all Namespaces have NetworkPolicies defined (Manual)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nFollow the documentation and create NetworkPolicy objects as you need them."]}),"\n",(0,s.jsx)(r.h2,{id:"54-secrets-management",children:"5.4 Secrets Management"}),"\n",(0,s.jsx)(r.h3,{id:"541-prefer-using-secrets-as-files-over-secrets-as-environment-variables-manual",children:"5.4.1 Prefer using Secrets as files over Secrets as environment variables (Manual)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nIf possible, rewrite application code to read Secrets from mounted secret files, rather than\nfrom environment variables."]}),"\n",(0,s.jsx)(r.h3,{id:"542-consider-external-secret-storage-manual",children:"5.4.2 Consider external secret storage (Manual)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nRefer to the Secrets management options offered by your cloud provider or a third-party\nsecrets management solution."]}),"\n",(0,s.jsx)(r.h2,{id:"55-extensible-admission-control",children:"5.5 Extensible Admission Control"}),"\n",(0,s.jsx)(r.h3,{id:"551-configure-image-provenance-using-imagepolicywebhook-admission-controller-manual",children:"5.5.1 Configure Image Provenance using ImagePolicyWebhook admission controller (Manual)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nFollow the Kubernetes documentation and setup image provenance."]}),"\n",(0,s.jsx)(r.h2,{id:"57-general-policies",children:"5.7 General Policies"}),"\n",(0,s.jsx)(r.h3,{id:"571-create-administrative-boundaries-between-resources-using-namespaces-manual",children:"5.7.1 Create administrative boundaries between resources using namespaces (Manual)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nFollow the documentation and create namespaces for objects in your deployment as you need\nthem."]}),"\n",(0,s.jsx)(r.h3,{id:"572-ensure-that-the-seccomp-profile-is-set-to-dockerdefault-in-your-pod-definitions-manual",children:"5.7.2 Ensure that the seccomp profile is set to docker/default in your Pod definitions (Manual)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nUse ",(0,s.jsx)(r.code,{children:"securityContext"})," to enable the docker/default seccomp profile in your pod definitions.\nAn example is as below:\nsecurityContext:\nseccompProfile:\ntype: RuntimeDefault"]}),"\n",(0,s.jsx)(r.h3,{id:"573-apply-securitycontext-to-your-pods-and-containers-manual",children:"5.7.3 Apply SecurityContext to your Pods and Containers (Manual)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nFollow the Kubernetes documentation and apply SecurityContexts to your Pods. For a\nsuggested list of SecurityContexts, you may refer to the CIS Security Benchmark for Docker\nContainers."]}),"\n",(0,s.jsx)(r.h3,{id:"574-the-default-namespace-should-not-be-used-manual",children:"5.7.4 The default namespace should not be used (Manual)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nEnsure that namespaces are created to allow for appropriate segregation of Kubernetes\nresources and that all new resources are created in a specific namespace."]})]})}function u(e={}){const{wrapper:r}={...(0,n.a)(),...e.components};return r?(0,s.jsx)(r,{...e,children:(0,s.jsx)(d,{...e})}):d(e)}},1151:(e,r,t)=>{t.d(r,{Z:()=>l,a:()=>a});var s=t(7294);const n={},i=s.createContext(n);function a(e){const r=s.useContext(i);return s.useMemo((function(){return"function"==typeof e?e(r):{...r,...e}}),[r,e])}function l(e){let r;return r=e.disableParentContext?"function"==typeof e.components?e.components(n):e.components||n:a(e.components),s.createElement(i.Provider,{value:r},e.children)}}}]); \ No newline at end of file +"use strict";(self.webpackChunkk_3_s_docs=self.webpackChunkk_3_s_docs||[]).push([[3555],{2688:(e,r,t)=>{t.r(r),t.d(r,{assets:()=>c,contentTitle:()=>a,default:()=>u,frontMatter:()=>i,metadata:()=>l,toc:()=>o});var s=t(5893),n=t(1151);const i={title:"CIS 1.24 Self Assessment Guide"},a=void 0,l={id:"security/self-assessment-1.24",title:"CIS 1.24 Self Assessment Guide",description:"Overview",source:"@site/docs/security/self-assessment-1.24.md",sourceDirName:"security",slug:"/security/self-assessment-1.24",permalink:"/security/self-assessment-1.24",draft:!1,unlisted:!1,editUrl:"https://github.com/k3s-io/docs/edit/main/docs/security/self-assessment-1.24.md",tags:[],version:"current",lastUpdatedAt:1723747404e3,frontMatter:{title:"CIS 1.24 Self Assessment Guide"},sidebar:"mySidebar",previous:{title:"CIS 1.7 Self Assessment Guide",permalink:"/security/self-assessment-1.7"},next:{title:"CLI Tools",permalink:"/cli/"}},c={},o=[{value:"Overview",id:"overview",level:2},{value:"Testing controls methodology",id:"testing-controls-methodology",level:3},{value:"1.1 Control Plane Node Configuration Files",id:"11-control-plane-node-configuration-files",level:2},{value:"1.1.1 Ensure that the API server pod specification file permissions are set to 644 or more restrictive (Automated)",id:"111-ensure-that-the-api-server-pod-specification-file-permissions-are-set-to-644-or-more-restrictive-automated",level:3},{value:"1.1.2 Ensure that the API server pod specification file ownership is set to root (Automated)",id:"112-ensure-that-the-api-server-pod-specification-file-ownership-is-set-to-root-automated",level:3},{value:"1.1.3 Ensure that the controller manager pod specification file permissions are set to 600 or more restrictive (Automated)",id:"113-ensure-that-the-controller-manager-pod-specification-file-permissions-are-set-to-600-or-more-restrictive-automated",level:3},{value:"1.1.4 Ensure that the controller manager pod specification file ownership is set to root (Automated)",id:"114-ensure-that-the-controller-manager-pod-specification-file-ownership-is-set-to-root-automated",level:3},{value:"1.1.5 Ensure that the scheduler pod specification file permissions are set to 600 or more restrictive (Automated)",id:"115-ensure-that-the-scheduler-pod-specification-file-permissions-are-set-to-600-or-more-restrictive-automated",level:3},{value:"1.1.6 Ensure that the scheduler pod specification file ownership is set to root (Automated)",id:"116-ensure-that-the-scheduler-pod-specification-file-ownership-is-set-to-root-automated",level:3},{value:"1.1.7 Ensure that the etcd pod specification file permissions are set to 600 or more restrictive (Automated)",id:"117-ensure-that-the-etcd-pod-specification-file-permissions-are-set-to-600-or-more-restrictive-automated",level:3},{value:"1.1.8 Ensure that the etcd pod specification file ownership is set to root (Automated)",id:"118-ensure-that-the-etcd-pod-specification-file-ownership-is-set-to-root-automated",level:3},{value:"1.1.9 Ensure that the Container Network Interface file permissions are set to 600 or more restrictive (Automated)",id:"119-ensure-that-the-container-network-interface-file-permissions-are-set-to-600-or-more-restrictive-automated",level:3},{value:"1.1.10 Ensure that the Container Network Interface file ownership is set to root (Manual)",id:"1110-ensure-that-the-container-network-interface-file-ownership-is-set-to-root-manual",level:3},{value:"1.1.11 Ensure that the etcd data directory permissions are set to 700 or more restrictive (Automated)",id:"1111-ensure-that-the-etcd-data-directory-permissions-are-set-to-700-or-more-restrictive-automated",level:3},{value:"1.1.12 Ensure that the etcd data directory ownership is set to etcd (Automated)",id:"1112-ensure-that-the-etcd-data-directory-ownership-is-set-to-etcd-automated",level:3},{value:"1.1.13 Ensure that the admin.conf file permissions are set to 600 or more restrictive (Automated)",id:"1113-ensure-that-the-adminconf-file-permissions-are-set-to-600-or-more-restrictive-automated",level:3},{value:"1.1.14 Ensure that the admin.conf file ownership is set to root (Automated)",id:"1114-ensure-that-the-adminconf-file-ownership-is-set-to-root-automated",level:3},{value:"1.1.15 Ensure that the scheduler.conf file permissions are set to 600 or more restrictive (Automated)",id:"1115-ensure-that-the-schedulerconf-file-permissions-are-set-to-600-or-more-restrictive-automated",level:3},{value:"1.1.16 Ensure that the scheduler.conf file ownership is set to root (Automated)",id:"1116-ensure-that-the-schedulerconf-file-ownership-is-set-to-root-automated",level:3},{value:"1.1.17 Ensure that the controller-manager.conf file permissions are set to 600 or more restrictive (Automated)",id:"1117-ensure-that-the-controller-managerconf-file-permissions-are-set-to-600-or-more-restrictive-automated",level:3},{value:"1.1.18 Ensure that the controller-manager.conf file ownership is set to root (Automated)",id:"1118-ensure-that-the-controller-managerconf-file-ownership-is-set-to-root-automated",level:3},{value:"1.1.19 Ensure that the Kubernetes PKI directory and file ownership is set to root (Automated)",id:"1119-ensure-that-the-kubernetes-pki-directory-and-file-ownership-is-set-to-root-automated",level:3},{value:"1.1.20 Ensure that the Kubernetes PKI certificate file permissions are set to 600 or more restrictive (Manual)",id:"1120-ensure-that-the-kubernetes-pki-certificate-file-permissions-are-set-to-600-or-more-restrictive-manual",level:3},{value:"1.1.21 Ensure that the Kubernetes PKI key file permissions are set to 600 (Automated)",id:"1121-ensure-that-the-kubernetes-pki-key-file-permissions-are-set-to-600-automated",level:3},{value:"1.2 API Server",id:"12-api-server",level:2},{value:"1.2.1 Ensure that the --anonymous-auth argument is set to false (Automated)",id:"121-ensure-that-the---anonymous-auth-argument-is-set-to-false-automated",level:3},{value:"1.2.2 Ensure that the --token-auth-file parameter is not set (Automated)",id:"122-ensure-that-the---token-auth-file-parameter-is-not-set-automated",level:3},{value:"1.2.3 Ensure that the --DenyServiceExternalIPs is not set (Automated)",id:"123-ensure-that-the---denyserviceexternalips-is-not-set-automated",level:3},{value:"1.2.4 Ensure that the --kubelet-https argument is set to true (Automated)",id:"124-ensure-that-the---kubelet-https-argument-is-set-to-true-automated",level:3},{value:"1.2.5 Ensure that the --kubelet-client-certificate and --kubelet-client-key arguments are set as appropriate (Automated)",id:"125-ensure-that-the---kubelet-client-certificate-and---kubelet-client-key-arguments-are-set-as-appropriate-automated",level:3},{value:"1.2.6 Ensure that the --kubelet-certificate-authority argument is set as appropriate (Automated)",id:"126-ensure-that-the---kubelet-certificate-authority-argument-is-set-as-appropriate-automated",level:3},{value:"1.2.7 Ensure that the --authorization-mode argument is not set to AlwaysAllow (Automated)",id:"127-ensure-that-the---authorization-mode-argument-is-not-set-to-alwaysallow-automated",level:3},{value:"1.2.8 Ensure that the --authorization-mode argument includes Node (Automated)",id:"128-ensure-that-the---authorization-mode-argument-includes-node-automated",level:3},{value:"1.2.9 Ensure that the --authorization-mode argument includes RBAC (Automated)",id:"129-ensure-that-the---authorization-mode-argument-includes-rbac-automated",level:3},{value:"1.2.10 Ensure that the admission control plugin EventRateLimit is set (Manual)",id:"1210-ensure-that-the-admission-control-plugin-eventratelimit-is-set-manual",level:3},{value:"1.2.11 Ensure that the admission control plugin AlwaysAdmit is not set (Automated)",id:"1211-ensure-that-the-admission-control-plugin-alwaysadmit-is-not-set-automated",level:3},{value:"1.2.12 Ensure that the admission control plugin AlwaysPullImages is set (Manual)",id:"1212-ensure-that-the-admission-control-plugin-alwayspullimages-is-set-manual",level:3},{value:"1.2.13 Ensure that the admission control plugin SecurityContextDeny is set if PodSecurityPolicy is not used (Manual)",id:"1213-ensure-that-the-admission-control-plugin-securitycontextdeny-is-set-if-podsecuritypolicy-is-not-used-manual",level:3},{value:"1.2.14 Ensure that the admission control plugin ServiceAccount is set (Automated)",id:"1214-ensure-that-the-admission-control-plugin-serviceaccount-is-set-automated",level:3},{value:"1.2.15 Ensure that the admission control plugin NamespaceLifecycle is set (Automated)",id:"1215-ensure-that-the-admission-control-plugin-namespacelifecycle-is-set-automated",level:3},{value:"1.2.16 Ensure that the admission control plugin NodeRestriction is set (Automated)",id:"1216-ensure-that-the-admission-control-plugin-noderestriction-is-set-automated",level:3},{value:"1.2.17 Ensure that the --secure-port argument is not set to 0 (Automated)",id:"1217-ensure-that-the---secure-port-argument-is-not-set-to-0-automated",level:3},{value:"1.2.18 Ensure that the --profiling argument is set to false (Automated)",id:"1218-ensure-that-the---profiling-argument-is-set-to-false-automated",level:3},{value:"1.2.19 Ensure that the --audit-log-path argument is set (Manual)",id:"1219-ensure-that-the---audit-log-path-argument-is-set-manual",level:3},{value:"1.2.20 Ensure that the --audit-log-maxage argument is set to 30 or as appropriate (Automated)",id:"1220-ensure-that-the---audit-log-maxage-argument-is-set-to-30-or-as-appropriate-automated",level:3},{value:"1.2.21 Ensure that the --audit-log-maxbackup argument is set to 10 or as appropriate (Automated)",id:"1221-ensure-that-the---audit-log-maxbackup-argument-is-set-to-10-or-as-appropriate-automated",level:3},{value:"1.2.22 Ensure that the --audit-log-maxsize argument is set to 100 or as appropriate (Automated)",id:"1222-ensure-that-the---audit-log-maxsize-argument-is-set-to-100-or-as-appropriate-automated",level:3},{value:"1.2.23 Ensure that the --request-timeout argument is set as appropriate (Manual)",id:"1223-ensure-that-the---request-timeout-argument-is-set-as-appropriate-manual",level:3},{value:"1.2.24 Ensure that the --service-account-lookup argument is set to true (Automated)",id:"1224-ensure-that-the---service-account-lookup-argument-is-set-to-true-automated",level:3},{value:"1.2.25 Ensure that the --service-account-key-file argument is set as appropriate (Automated)",id:"1225-ensure-that-the---service-account-key-file-argument-is-set-as-appropriate-automated",level:3},{value:"1.2.26 Ensure that the --etcd-certfile and --etcd-keyfile arguments are set as appropriate (Automated)",id:"1226-ensure-that-the---etcd-certfile-and---etcd-keyfile-arguments-are-set-as-appropriate-automated",level:3},{value:"1.2.27 Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate (Automated)",id:"1227-ensure-that-the---tls-cert-file-and---tls-private-key-file-arguments-are-set-as-appropriate-automated",level:3},{value:"1.2.28 Ensure that the --client-ca-file argument is set as appropriate (Automated)",id:"1228-ensure-that-the---client-ca-file-argument-is-set-as-appropriate-automated",level:3},{value:"1.2.29 Ensure that the --etcd-cafile argument is set as appropriate (Automated)",id:"1229-ensure-that-the---etcd-cafile-argument-is-set-as-appropriate-automated",level:3},{value:"1.2.30 Ensure that the --encryption-provider-config argument is set as appropriate (Manual)",id:"1230-ensure-that-the---encryption-provider-config-argument-is-set-as-appropriate-manual",level:3},{value:"1.2.31 Ensure that encryption providers are appropriately configured (Manual)",id:"1231-ensure-that-encryption-providers-are-appropriately-configured-manual",level:3},{value:"1.2.32 Ensure that the API Server only makes use of Strong Cryptographic Ciphers (Automated)",id:"1232-ensure-that-the-api-server-only-makes-use-of-strong-cryptographic-ciphers-automated",level:3},{value:"1.3 Controller Manager",id:"13-controller-manager",level:2},{value:"1.3.1 Ensure that the --terminated-pod-gc-threshold argument is set as appropriate (Manual)",id:"131-ensure-that-the---terminated-pod-gc-threshold-argument-is-set-as-appropriate-manual",level:3},{value:"1.3.2 Ensure that the --profiling argument is set to false (Automated)",id:"132-ensure-that-the---profiling-argument-is-set-to-false-automated",level:3},{value:"1.3.3 Ensure that the --use-service-account-credentials argument is set to true (Automated)",id:"133-ensure-that-the---use-service-account-credentials-argument-is-set-to-true-automated",level:3},{value:"1.3.4 Ensure that the --service-account-private-key-file argument is set as appropriate (Automated)",id:"134-ensure-that-the---service-account-private-key-file-argument-is-set-as-appropriate-automated",level:3},{value:"1.3.5 Ensure that the --root-ca-file argument is set as appropriate (Automated)",id:"135-ensure-that-the---root-ca-file-argument-is-set-as-appropriate-automated",level:3},{value:"1.3.6 Ensure that the RotateKubeletServerCertificate argument is set to true (Automated)",id:"136-ensure-that-the-rotatekubeletservercertificate-argument-is-set-to-true-automated",level:3},{value:"1.3.7 Ensure that the --bind-address argument is set to 127.0.0.1 (Automated)",id:"137-ensure-that-the---bind-address-argument-is-set-to-127001-automated",level:3},{value:"1.4 Scheduler",id:"14-scheduler",level:2},{value:"1.4.1 Ensure that the --profiling argument is set to false (Automated)",id:"141-ensure-that-the---profiling-argument-is-set-to-false-automated",level:3},{value:"1.4.2 Ensure that the --bind-address argument is set to 127.0.0.1 (Automated)",id:"142-ensure-that-the---bind-address-argument-is-set-to-127001-automated",level:3},{value:"2 Etcd Node Configuration",id:"2-etcd-node-configuration",level:2},{value:"2.1 Ensure that the --cert-file and --key-file arguments are set as appropriate (Automated)",id:"21-ensure-that-the---cert-file-and---key-file-arguments-are-set-as-appropriate-automated",level:3},{value:"2.2 Ensure that the --client-cert-auth argument is set to true (Automated)",id:"22-ensure-that-the---client-cert-auth-argument-is-set-to-true-automated",level:3},{value:"2.3 Ensure that the --auto-tls argument is not set to true (Automated)",id:"23-ensure-that-the---auto-tls-argument-is-not-set-to-true-automated",level:3},{value:"2.4 Ensure that the --peer-cert-file and --peer-key-file arguments are set as appropriate (Automated)",id:"24-ensure-that-the---peer-cert-file-and---peer-key-file-arguments-are-set-as-appropriate-automated",level:3},{value:"2.5 Ensure that the --peer-client-cert-auth argument is set to true (Automated)",id:"25-ensure-that-the---peer-client-cert-auth-argument-is-set-to-true-automated",level:3},{value:"2.6 Ensure that the --peer-auto-tls argument is not set to true (Automated)",id:"26-ensure-that-the---peer-auto-tls-argument-is-not-set-to-true-automated",level:3},{value:"2.7 Ensure that a unique Certificate Authority is used for etcd (Automated)",id:"27-ensure-that-a-unique-certificate-authority-is-used-for-etcd-automated",level:3},{value:"4.1 Worker Node Configuration Files",id:"41-worker-node-configuration-files",level:2},{value:"4.1.1 Ensure that the kubelet service file permissions are set to 600 or more restrictive (Automated)",id:"411-ensure-that-the-kubelet-service-file-permissions-are-set-to-600-or-more-restrictive-automated",level:3},{value:"4.1.2 Ensure that the kubelet service file ownership is set to root (Automated)",id:"412-ensure-that-the-kubelet-service-file-ownership-is-set-to-root-automated",level:3},{value:"4.1.3 If proxy kubeconfig file exists ensure permissions are set to 600 or more restrictive (Automated)",id:"413-if-proxy-kubeconfig-file-exists-ensure-permissions-are-set-to-600-or-more-restrictive-automated",level:3},{value:"4.1.4 If proxy kubeconfig file exists ensure ownership is set to root (Automated)",id:"414-if-proxy-kubeconfig-file-exists-ensure-ownership-is-set-to-root-automated",level:3},{value:"4.1.5 Ensure that the --kubeconfig kubelet.conf file permissions are set to 600 or more restrictive (Automated)",id:"415-ensure-that-the---kubeconfig-kubeletconf-file-permissions-are-set-to-600-or-more-restrictive-automated",level:3},{value:"4.1.6 Ensure that the --kubeconfig kubelet.conf file ownership is set to root (Automated)",id:"416-ensure-that-the---kubeconfig-kubeletconf-file-ownership-is-set-to-root-automated",level:3},{value:"4.1.7 Ensure that the certificate authorities file permissions are set to 600 or more restrictive (Automated)",id:"417-ensure-that-the-certificate-authorities-file-permissions-are-set-to-600-or-more-restrictive-automated",level:3},{value:"4.1.8 Ensure that the client certificate authorities file ownership is set to root (Automated)",id:"418-ensure-that-the-client-certificate-authorities-file-ownership-is-set-to-root-automated",level:3},{value:"4.1.9 If the kubelet config.yaml configuration file is being used validate permissions set to 600 or more restrictive (Automated)",id:"419-if-the-kubelet-configyaml-configuration-file-is-being-used-validate-permissions-set-to-600-or-more-restrictive-automated",level:3},{value:"4.1.10 If the kubelet config.yaml configuration file is being used validate file ownership is set to root (Automated)",id:"4110-if-the-kubelet-configyaml-configuration-file-is-being-used-validate-file-ownership-is-set-to-root-automated",level:3},{value:"4.2 Kubelet",id:"42-kubelet",level:2},{value:"4.2.1 Ensure that the --anonymous-auth argument is set to false (Automated)",id:"421-ensure-that-the---anonymous-auth-argument-is-set-to-false-automated",level:3},{value:"4.2.2 Ensure that the --authorization-mode argument is not set to AlwaysAllow (Automated)",id:"422-ensure-that-the---authorization-mode-argument-is-not-set-to-alwaysallow-automated",level:3},{value:"4.2.3 Ensure that the --client-ca-file argument is set as appropriate (Automated)",id:"423-ensure-that-the---client-ca-file-argument-is-set-as-appropriate-automated",level:3},{value:"4.2.4 Verify that the --read-only-port argument is set to 0 (Automated)",id:"424-verify-that-the---read-only-port-argument-is-set-to-0-automated",level:3},{value:"4.2.5 Ensure that the --streaming-connection-idle-timeout argument is not set to 0 (Manual)",id:"425-ensure-that-the---streaming-connection-idle-timeout-argument-is-not-set-to-0-manual",level:3},{value:"4.2.6 Ensure that the --protect-kernel-defaults argument is set to true (Automated)",id:"426-ensure-that-the---protect-kernel-defaults-argument-is-set-to-true-automated",level:3},{value:"4.2.7 Ensure that the --make-iptables-util-chains argument is set to true (Automated)",id:"427-ensure-that-the---make-iptables-util-chains-argument-is-set-to-true-automated",level:3},{value:"4.2.8 Ensure that the --hostname-override argument is not set (Automated)",id:"428-ensure-that-the---hostname-override-argument-is-not-set-automated",level:3},{value:"4.2.9 Ensure that the eventRecordQPS argument is set to a level which ensures appropriate event capture (Manual)",id:"429-ensure-that-the-eventrecordqps-argument-is-set-to-a-level-which-ensures-appropriate-event-capture-manual",level:3},{value:"4.2.10 Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate (Automated)",id:"4210-ensure-that-the---tls-cert-file-and---tls-private-key-file-arguments-are-set-as-appropriate-automated",level:3},{value:"4.2.11 Ensure that the --rotate-certificates argument is not set to false (Automated)",id:"4211-ensure-that-the---rotate-certificates-argument-is-not-set-to-false-automated",level:3},{value:"4.2.12 Verify that the RotateKubeletServerCertificate argument is set to true (Automated)",id:"4212-verify-that-the-rotatekubeletservercertificate-argument-is-set-to-true-automated",level:3},{value:"4.2.13 Ensure that the Kubelet only makes use of Strong Cryptographic Ciphers (Manual)",id:"4213-ensure-that-the-kubelet-only-makes-use-of-strong-cryptographic-ciphers-manual",level:3},{value:"5.1 RBAC and Service Accounts",id:"51-rbac-and-service-accounts",level:2},{value:"5.1.1 Ensure that the cluster-admin role is only used where required (Manual)",id:"511-ensure-that-the-cluster-admin-role-is-only-used-where-required-manual",level:3},{value:"5.1.2 Minimize access to secrets (Manual)",id:"512-minimize-access-to-secrets-manual",level:3},{value:"5.1.3 Minimize wildcard use in Roles and ClusterRoles (Manual)",id:"513-minimize-wildcard-use-in-roles-and-clusterroles-manual",level:3},{value:"5.1.4 Minimize access to create pods (Manual)",id:"514-minimize-access-to-create-pods-manual",level:3},{value:"5.1.5 Ensure that default service accounts are not actively used. (Manual)",id:"515-ensure-that-default-service-accounts-are-not-actively-used-manual",level:3},{value:"5.1.6 Ensure that Service Account Tokens are only mounted where necessary (Manual)",id:"516-ensure-that-service-account-tokens-are-only-mounted-where-necessary-manual",level:3},{value:"5.1.7 Avoid use of system group (Manual)",id:"517-avoid-use-of-system-group-manual",level:3},{value:"5.1.8 Limit use of the Bind, Impersonate and Escalate permissions in the Kubernetes cluster (Manual)",id:"518-limit-use-of-the-bind-impersonate-and-escalate-permissions-in-the-kubernetes-cluster-manual",level:3},{value:"5.2 Pod Security Standards",id:"52-pod-security-standards",level:2},{value:"5.2.1 Ensure that the cluster has at least one active policy control mechanism in place (Manual)",id:"521-ensure-that-the-cluster-has-at-least-one-active-policy-control-mechanism-in-place-manual",level:3},{value:"5.2.2 Minimize the admission of privileged containers (Manual)",id:"522-minimize-the-admission-of-privileged-containers-manual",level:3},{value:"5.2.3 Minimize the admission of containers wishing to share the host process ID namespace (Automated)",id:"523-minimize-the-admission-of-containers-wishing-to-share-the-host-process-id-namespace-automated",level:3},{value:"5.2.4 Minimize the admission of containers wishing to share the host IPC namespace (Automated)",id:"524-minimize-the-admission-of-containers-wishing-to-share-the-host-ipc-namespace-automated",level:3},{value:"5.2.5 Minimize the admission of containers wishing to share the host network namespace (Automated)",id:"525-minimize-the-admission-of-containers-wishing-to-share-the-host-network-namespace-automated",level:3},{value:"5.2.6 Minimize the admission of containers with allowPrivilegeEscalation (Automated)",id:"526-minimize-the-admission-of-containers-with-allowprivilegeescalation-automated",level:3},{value:"5.2.7 Minimize the admission of root containers (Automated)",id:"527-minimize-the-admission-of-root-containers-automated",level:3},{value:"5.2.8 Minimize the admission of containers with the NET_RAW capability (Automated)",id:"528-minimize-the-admission-of-containers-with-the-net_raw-capability-automated",level:3},{value:"5.2.9 Minimize the admission of containers with added capabilities (Automated)",id:"529-minimize-the-admission-of-containers-with-added-capabilities-automated",level:3},{value:"5.2.10 Minimize the admission of containers with capabilities assigned (Manual)",id:"5210-minimize-the-admission-of-containers-with-capabilities-assigned-manual",level:3},{value:"5.2.11 Minimize the admission of Windows HostProcess containers (Manual)",id:"5211-minimize-the-admission-of-windows-hostprocess-containers-manual",level:3},{value:"5.2.12 Minimize the admission of HostPath volumes (Manual)",id:"5212-minimize-the-admission-of-hostpath-volumes-manual",level:3},{value:"5.2.13 Minimize the admission of containers which use HostPorts (Manual)",id:"5213-minimize-the-admission-of-containers-which-use-hostports-manual",level:3},{value:"5.3 Network Policies and CNI",id:"53-network-policies-and-cni",level:2},{value:"5.3.1 Ensure that the CNI in use supports NetworkPolicies (Manual)",id:"531-ensure-that-the-cni-in-use-supports-networkpolicies-manual",level:3},{value:"5.3.2 Ensure that all Namespaces have NetworkPolicies defined (Manual)",id:"532-ensure-that-all-namespaces-have-networkpolicies-defined-manual",level:3},{value:"5.4 Secrets Management",id:"54-secrets-management",level:2},{value:"5.4.1 Prefer using Secrets as files over Secrets as environment variables (Manual)",id:"541-prefer-using-secrets-as-files-over-secrets-as-environment-variables-manual",level:3},{value:"5.4.2 Consider external secret storage (Manual)",id:"542-consider-external-secret-storage-manual",level:3},{value:"5.5 Extensible Admission Control",id:"55-extensible-admission-control",level:2},{value:"5.5.1 Configure Image Provenance using ImagePolicyWebhook admission controller (Manual)",id:"551-configure-image-provenance-using-imagepolicywebhook-admission-controller-manual",level:3},{value:"5.7 General Policies",id:"57-general-policies",level:2},{value:"5.7.1 Create administrative boundaries between resources using namespaces (Manual)",id:"571-create-administrative-boundaries-between-resources-using-namespaces-manual",level:3},{value:"5.7.2 Ensure that the seccomp profile is set to docker/default in your Pod definitions (Manual)",id:"572-ensure-that-the-seccomp-profile-is-set-to-dockerdefault-in-your-pod-definitions-manual",level:3},{value:"5.7.3 Apply SecurityContext to your Pods and Containers (Manual)",id:"573-apply-securitycontext-to-your-pods-and-containers-manual",level:3},{value:"5.7.4 The default namespace should not be used (Manual)",id:"574-the-default-namespace-should-not-be-used-manual",level:3}];function d(e){const r={a:"a",code:"code",h2:"h2",h3:"h3",li:"li",p:"p",pre:"pre",strong:"strong",ul:"ul",...(0,n.a)(),...e.components},{Details:t}=r;return t||function(e,r){throw new Error("Expected "+(r?"component":"object")+" `"+e+"` to be defined: you likely forgot to import, pass, or provide it.")}("Details",!0),(0,s.jsxs)(s.Fragment,{children:[(0,s.jsx)(r.h2,{id:"overview",children:"Overview"}),"\n",(0,s.jsxs)(r.p,{children:["This document is a companion to the ",(0,s.jsx)(r.a,{href:"/security/hardening-guide",children:"K3s security hardening guide"}),". The hardening guide provides prescriptive guidance for hardening a production installation of K3s, and this benchmark guide is meant to help you evaluate the level of security of the hardened cluster against each control in the CIS Kubernetes Benchmark. It is to be used by K3s operators, security teams, auditors, and decision-makers."]}),"\n",(0,s.jsxs)(r.p,{children:["This guide is specific to the ",(0,s.jsx)(r.strong,{children:"v1.24"})," release line of K3s and the ",(0,s.jsx)(r.strong,{children:"v1.24"})," release of the CIS Kubernetes Benchmark."]}),"\n",(0,s.jsxs)(r.p,{children:["For more information about each control, including detailed descriptions and remediations for failing tests, you can refer to the corresponding section of the CIS Kubernetes Benchmark v1.6. You can download the benchmark, after creating a free account, in ",(0,s.jsx)(r.a,{href:"https://www.cisecurity.org/benchmark/kubernetes/",children:"Center for Internet Security (CIS)"}),"."]}),"\n",(0,s.jsx)(r.h3,{id:"testing-controls-methodology",children:"Testing controls methodology"}),"\n",(0,s.jsx)(r.p,{children:"Each control in the CIS Kubernetes Benchmark was evaluated against a K3s cluster that was configured according to the accompanying hardening guide."}),"\n",(0,s.jsx)(r.p,{children:"Where control audits differ from the original CIS benchmark, the audit commands specific to K3s are provided for testing."}),"\n",(0,s.jsx)(r.p,{children:"These are the possible results for each control:"}),"\n",(0,s.jsxs)(r.ul,{children:["\n",(0,s.jsxs)(r.li,{children:[(0,s.jsx)(r.strong,{children:"Pass"})," - The K3s cluster under test passed the audit outlined in the benchmark."]}),"\n",(0,s.jsxs)(r.li,{children:[(0,s.jsx)(r.strong,{children:"Not Applicable"})," - The control is not applicable to K3s because of how it is designed to operate. The remediation section will explain why this is so."]}),"\n",(0,s.jsxs)(r.li,{children:[(0,s.jsx)(r.strong,{children:"Warn"})," - The control is manual in the CIS benchmark and it depends on the cluster's use case or some other factor that must be determined by the cluster operator. These controls have been evaluated to ensure K3s does not prevent their implementation, but no further configuration or auditing of the cluster under test has been performed."]}),"\n"]}),"\n",(0,s.jsx)(r.p,{children:'This guide makes the assumption that K3s is running as a Systemd unit. Your installation may vary and will require you to adjust the "audit" commands to fit your scenario.'}),"\n",(0,s.jsx)(r.h2,{id:"11-control-plane-node-configuration-files",children:"1.1 Control Plane Node Configuration Files"}),"\n",(0,s.jsx)(r.h3,{id:"111-ensure-that-the-api-server-pod-specification-file-permissions-are-set-to-644-or-more-restrictive-automated",children:"1.1.1 Ensure that the API server pod specification file permissions are set to 644 or more restrictive (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," Not Applicable"]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Rationale:"})}),"\n",(0,s.jsx)(r.p,{children:"By default, K3s embeds the api server within the k3s process. There is no API server pod specification file."}),"\n",(0,s.jsxs)(r.h3,{id:"112-ensure-that-the-api-server-pod-specification-file-ownership-is-set-to-root-automated",children:["1.1.2 Ensure that the API server pod specification file ownership is set to root",":root"," (Automated)"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," Not Applicable"]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Rationale:"})}),"\n",(0,s.jsx)(r.p,{children:"By default, K3s embeds the api server within the k3s process. There is no API server pod specification file."}),"\n",(0,s.jsx)(r.h3,{id:"113-ensure-that-the-controller-manager-pod-specification-file-permissions-are-set-to-600-or-more-restrictive-automated",children:"1.1.3 Ensure that the controller manager pod specification file permissions are set to 600 or more restrictive (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," Not Applicable"]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Rationale:"})}),"\n",(0,s.jsx)(r.p,{children:"By default, K3s embeds the controller manager within the k3s process. There is no controller manager pod specification file."}),"\n",(0,s.jsxs)(r.h3,{id:"114-ensure-that-the-controller-manager-pod-specification-file-ownership-is-set-to-root-automated",children:["1.1.4 Ensure that the controller manager pod specification file ownership is set to root",":root"," (Automated)"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," Not Applicable"]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Rationale:"})}),"\n",(0,s.jsx)(r.p,{children:"By default, K3s embeds the controller manager within the k3s process. There is no controller manager pod specification file."}),"\n",(0,s.jsx)(r.h3,{id:"115-ensure-that-the-scheduler-pod-specification-file-permissions-are-set-to-600-or-more-restrictive-automated",children:"1.1.5 Ensure that the scheduler pod specification file permissions are set to 600 or more restrictive (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," Not Applicable"]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Rationale:"})}),"\n",(0,s.jsx)(r.p,{children:"By default, K3s embeds the scheduler within the k3s process. There is no scheduler pod specification file."}),"\n",(0,s.jsxs)(r.h3,{id:"116-ensure-that-the-scheduler-pod-specification-file-ownership-is-set-to-root-automated",children:["1.1.6 Ensure that the scheduler pod specification file ownership is set to root",":root"," (Automated)"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," Not Applicable"]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Rationale:"})}),"\n",(0,s.jsx)(r.p,{children:"By default, K3s embeds the scheduler within the k3s process. There is no scheduler pod specification file."}),"\n",(0,s.jsx)(r.h3,{id:"117-ensure-that-the-etcd-pod-specification-file-permissions-are-set-to-600-or-more-restrictive-automated",children:"1.1.7 Ensure that the etcd pod specification file permissions are set to 600 or more restrictive (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," Not Applicable"]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Rationale:"})}),"\n",(0,s.jsx)(r.p,{children:"By default, K3s embeds etcd within the k3s process. There is no etcd pod specification file."}),"\n",(0,s.jsxs)(r.h3,{id:"118-ensure-that-the-etcd-pod-specification-file-ownership-is-set-to-root-automated",children:["1.1.8 Ensure that the etcd pod specification file ownership is set to root",":root"," (Automated)"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," Not Applicable"]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Rationale:"})}),"\n",(0,s.jsx)(r.p,{children:"By default, K3s embeds etcd within the k3s process. There is no etcd pod specification file."}),"\n",(0,s.jsx)(r.h3,{id:"119-ensure-that-the-container-network-interface-file-permissions-are-set-to-600-or-more-restrictive-automated",children:"1.1.9 Ensure that the Container Network Interface file permissions are set to 600 or more restrictive (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," Not Applicable"]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Rationale:"})}),"\n",(0,s.jsx)(r.p,{children:"The default K3s CNI, flannel, does not create any files in /var/lib/cni/networks."}),"\n",(0,s.jsxs)(r.h3,{id:"1110-ensure-that-the-container-network-interface-file-ownership-is-set-to-root-manual",children:["1.1.10 Ensure that the Container Network Interface file ownership is set to root",":root"," (Manual)"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," Not Applicable"]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Rationale:"})}),"\n",(0,s.jsx)(r.p,{children:"The default K3s CNI, flannel, does not create any files in /var/lib/cni/networks."}),"\n",(0,s.jsx)(r.h3,{id:"1111-ensure-that-the-etcd-data-directory-permissions-are-set-to-700-or-more-restrictive-automated",children:"1.1.11 Ensure that the etcd data directory permissions are set to 700 or more restrictive (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:'if [ "$(journalctl -u k3s | grep -m1 \'Managed etcd cluster\' | wc -l)" -gt 0 ]; then\n stat -c permissions=%a /var/lib/rancher/k3s/server/db/etcd\nelse\n echo "permissions=700"\nfi\n'})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result:"})," permissions has permissions 700, expected 700 or more restrictive"]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Returned Value:"})}),(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:"permissions=700\n"})})]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Remediation:"})}),(0,s.jsxs)(r.p,{children:["On the etcd server node, get the etcd data directory, passed as an argument --data-dir,\nfrom the command 'ps -ef | grep etcd'.\nRun the below command (based on the etcd data directory found above). For example,\n",(0,s.jsx)(r.code,{children:"chmod 700 /var/lib/etcd"})]})]}),"\n",(0,s.jsxs)(r.h3,{id:"1112-ensure-that-the-etcd-data-directory-ownership-is-set-to-etcd-automated",children:["1.1.12 Ensure that the etcd data directory ownership is set to etcd",":etcd"," (Automated)"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," Not Applicable"]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Rationale:"})}),"\n",(0,s.jsxs)(r.p,{children:["For K3s, etcd is embedded within the k3s process. There is no separate etcd process.\nTherefore the etcd data directory ownership is managed by the k3s process and should be root",":root","."]}),"\n",(0,s.jsx)(r.h3,{id:"1113-ensure-that-the-adminconf-file-permissions-are-set-to-600-or-more-restrictive-automated",children:"1.1.13 Ensure that the admin.conf file permissions are set to 600 or more restrictive (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," INFO"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nRun the below command (based on the file location on your system) on the control plane node.\nFor example, ",(0,s.jsx)(r.code,{children:"chmod 600 /var/lib/rancher/k3s/server/cred/admin.kubeconfig"})]}),"\n",(0,s.jsxs)(r.h3,{id:"1114-ensure-that-the-adminconf-file-ownership-is-set-to-root-automated",children:["1.1.14 Ensure that the admin.conf file ownership is set to root",":root"," (Automated)"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"/bin/sh -c 'if test -e /var/lib/rancher/k3s/server/cred/admin.kubeconfig; then stat -c %U:%G /var/lib/rancher/k3s/server/cred/admin.kubeconfig; fi'\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result:"})," 'root",":root","' is equal to 'root",":root","'"]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Returned Value:"})}),(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:"root:root\n"})})]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Remediation:"})}),(0,s.jsxs)(r.p,{children:["Run the below command (based on the file location on your system) on the control plane node.\nFor example, ",(0,s.jsx)(r.code,{children:"chown root:root /var/lib/rancher/k3s/server/cred/admin.kubeconfig"})]})]}),"\n",(0,s.jsx)(r.h3,{id:"1115-ensure-that-the-schedulerconf-file-permissions-are-set-to-600-or-more-restrictive-automated",children:"1.1.15 Ensure that the scheduler.conf file permissions are set to 600 or more restrictive (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"/bin/sh -c 'if test -e /var/lib/rancher/k3s/server/cred/scheduler.kubeconfig; then stat -c permissions=%a /var/lib/rancher/k3s/server/cred/scheduler.kubeconfig; fi'\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result:"})," permissions has permissions 600, expected 600 or more restrictive"]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Returned Value:"})}),(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:"permissions=600\n"})})]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Remediation:"})}),(0,s.jsxs)(r.p,{children:["Run the below command (based on the file location on your system) on the control plane node.\nFor example,\n",(0,s.jsx)(r.code,{children:"chmod 600 /var/lib/rancher/k3s/server/cred/scheduler.kubeconfig"})]})]}),"\n",(0,s.jsxs)(r.h3,{id:"1116-ensure-that-the-schedulerconf-file-ownership-is-set-to-root-automated",children:["1.1.16 Ensure that the scheduler.conf file ownership is set to root",":root"," (Automated)"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"/bin/sh -c 'if test -e /var/lib/rancher/k3s/server/cred/scheduler.kubeconfig; then stat -c %U:%G /var/lib/rancher/k3s/server/cred/scheduler.kubeconfig; fi'\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result:"})," 'root",":root","' is present"]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Returned Value:"})}),(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:"root:root\n"})})]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Remediation:"})}),(0,s.jsxs)(r.p,{children:["Run the below command (based on the file location on your system) on the control plane node.\nFor example,\n",(0,s.jsx)(r.code,{children:"chown root:root /var/lib/rancher/k3s/server/cred/scheduler.kubeconfig"})]})]}),"\n",(0,s.jsx)(r.h3,{id:"1117-ensure-that-the-controller-managerconf-file-permissions-are-set-to-600-or-more-restrictive-automated",children:"1.1.17 Ensure that the controller-manager.conf file permissions are set to 600 or more restrictive (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"/bin/sh -c 'if test -e /var/lib/rancher/k3s/server/cred/controller.kubeconfig; then stat -c permissions=%a /var/lib/rancher/k3s/server/cred/controller.kubeconfig; fi'\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result:"})," permissions has permissions 600, expected 600 or more restrictive"]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Returned Value:"})}),(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:"permissions=600\n"})})]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Remediation:"})}),(0,s.jsxs)(r.p,{children:["Run the below command (based on the file location on your system) on the control plane node.\nFor example,\n",(0,s.jsx)(r.code,{children:"chmod 600 /var/lib/rancher/k3s/server/cred/controller.kubeconfig"})]})]}),"\n",(0,s.jsxs)(r.h3,{id:"1118-ensure-that-the-controller-managerconf-file-ownership-is-set-to-root-automated",children:["1.1.18 Ensure that the controller-manager.conf file ownership is set to root",":root"," (Automated)"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"stat -c %U:%G /var/lib/rancher/k3s/server/tls\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result:"})," 'root",":root","' is equal to 'root",":root","'"]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Returned Value:"})}),(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:"root:root\n"})})]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Remediation:"})}),(0,s.jsxs)(r.p,{children:["Run the below command (based on the file location on your system) on the control plane node.\nFor example,\n",(0,s.jsx)(r.code,{children:"chown root:root /var/lib/rancher/k3s/server/cred/controller.kubeconfig"})]})]}),"\n",(0,s.jsxs)(r.h3,{id:"1119-ensure-that-the-kubernetes-pki-directory-and-file-ownership-is-set-to-root-automated",children:["1.1.19 Ensure that the Kubernetes PKI directory and file ownership is set to root",":root"," (Automated)"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"find /var/lib/rancher/k3s/server/tls | xargs stat -c %U:%G\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result:"})," 'root",":root","' is present"]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Returned Value:"})}),(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:"root:root\nroot:root\nroot:root\nroot:root\nroot:root\nroot:root\nroot:root\nroot:root\nroot:root\nroot:root\nroot:root\nroot:root\nroot:root\nroot:root\nroot:root\nroot:root\nroot:root\nroot:root\nroot:root\nroot:root\nroot:root\nroot:root\nroot:root\nroot:root\nroot:root\nroot:root\nroot:root\nroot:root\nroot:root\nroot:root\nroot:root\nroot:root\nroot:root\nroot:root\nroot:root\nroot:root\nroot:root\nroot:root\nroot:root\nroot:root\nroot:root\nroot:root\nroot:root\nroot:root\nroot:root\nroot:root\nroot:root\nroot:root\n"})})]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Remediation:"})}),(0,s.jsxs)(r.p,{children:["Run the below command (based on the file location on your system) on the control plane node.\nFor example,\n",(0,s.jsx)(r.code,{children:"chown -R root:root /etc/kubernetes/pki/"})]})]}),"\n",(0,s.jsx)(r.h3,{id:"1120-ensure-that-the-kubernetes-pki-certificate-file-permissions-are-set-to-600-or-more-restrictive-manual",children:"1.1.20 Ensure that the Kubernetes PKI certificate file permissions are set to 600 or more restrictive (Manual)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nRun the below command (based on the file location on your system) on the master node.\nFor example,\n",(0,s.jsx)(r.code,{children:"chmod -R 600 /var/lib/rancher/k3s/server/tls/*.crt"})]}),"\n",(0,s.jsx)(r.h3,{id:"1121-ensure-that-the-kubernetes-pki-key-file-permissions-are-set-to-600-automated",children:"1.1.21 Ensure that the Kubernetes PKI key file permissions are set to 600 (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"/bin/sh -c 'stat -c permissions=%a /var/lib/rancher/k3s/server/tls/*.key'\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result:"})," permissions has permissions 600, expected 600 or more restrictive"]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Returned Value:"})}),(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:"permissions=600\npermissions=600\npermissions=600\npermissions=600\npermissions=600\npermissions=600\npermissions=600\npermissions=600\npermissions=600\npermissions=600\npermissions=600\npermissions=600\npermissions=600\npermissions=600\npermissions=600\npermissions=600\npermissions=600\n"})})]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Remediation:"})}),(0,s.jsxs)(r.p,{children:["Run the below command (based on the file location on your system) on the master node.\nFor example,\n",(0,s.jsx)(r.code,{children:"chmod -R 600 /var/lib/rancher/k3s/server/tls/*.key"})]})]}),"\n",(0,s.jsx)(r.h2,{id:"12-api-server",children:"1.2 API Server"}),"\n",(0,s.jsx)(r.h3,{id:"121-ensure-that-the---anonymous-auth-argument-is-set-to-false-automated",children:"1.2.1 Ensure that the --anonymous-auth argument is set to false (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'anonymous-auth'\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result:"})," '--anonymous-auth' is equal to 'false'"]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Returned Value:"})}),(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:'Aug 09 18:56:04 server-0 k3s[2366]: time="2024-08-09T18:56:04Z" level=info msg="Running kube-apiserver --advertise-address=10.10.10.100 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,NamespaceLifecycle,ServiceAccount,PodSecurityPolicy --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})})]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Remediation:"})}),(0,s.jsx)(r.p,{children:"By default, K3s sets the --anonymous-auth argument to false. If it is set to true,\nedit the K3s config file /etc/rancher/k3s/config.yaml and remove anything similar to below."}),(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{children:'kube-apiserver-arg:\n - "anonymous-auth=true"\n'})})]}),"\n",(0,s.jsx)(r.h3,{id:"122-ensure-that-the---token-auth-file-parameter-is-not-set-automated",children:"1.2.2 Ensure that the --token-auth-file parameter is not set (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s | grep 'Running kube-apiserver' | tail -n1\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result:"})," '--token-auth-file' is not present"]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Returned Value:"})}),(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:'Aug 09 18:56:04 server-0 k3s[2366]: time="2024-08-09T18:56:04Z" level=info msg="Running kube-apiserver --advertise-address=10.10.10.100 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,NamespaceLifecycle,ServiceAccount,PodSecurityPolicy --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})})]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Remediation:"})}),(0,s.jsx)(r.p,{children:"Follow the documentation and configure alternate mechanisms for authentication.\nIf this check fails, edit the K3s config file /etc/rancher/k3s/config.yaml and remove anything similar to below."}),(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{children:'kube-apiserver-arg:\n - "token-auth-file="\n'})})]}),"\n",(0,s.jsx)(r.h3,{id:"123-ensure-that-the---denyserviceexternalips-is-not-set-automated",children:"1.2.3 Ensure that the --DenyServiceExternalIPs is not set (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s | grep 'Running kube-apiserver' | tail -n1\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result:"})," '--enable-admission-plugins' does not have 'DenyServiceExternalIPs' OR '--enable-admission-plugins' is not present"]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Returned Value:"})}),(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:'Aug 09 18:56:04 server-0 k3s[2366]: time="2024-08-09T18:56:04Z" level=info msg="Running kube-apiserver --advertise-address=10.10.10.100 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,NamespaceLifecycle,ServiceAccount,PodSecurityPolicy --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})})]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Remediation:"})}),(0,s.jsx)(r.p,{children:"By default, K3s does not set DenyServiceExternalIPs.\nIf this check fails, edit the K3s config file /etc/rancher/k3s/config.yaml, remove any lines like below."}),(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{children:'kube-apiserver-arg:\n - "enable-admission-plugins=DenyServiceExternalIPs"\n'})})]}),"\n",(0,s.jsx)(r.h3,{id:"124-ensure-that-the---kubelet-https-argument-is-set-to-true-automated",children:"1.2.4 Ensure that the --kubelet-https argument is set to true (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," INFO"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nEdit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml\non the control plane node and remove the --kubelet-https parameter."]}),"\n",(0,s.jsx)(r.h3,{id:"125-ensure-that-the---kubelet-client-certificate-and---kubelet-client-key-arguments-are-set-as-appropriate-automated",children:"1.2.5 Ensure that the --kubelet-client-certificate and --kubelet-client-key arguments are set as appropriate (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'kubelet-certificate-authority'\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result:"})," '--kubelet-client-certificate' is present AND '--kubelet-client-key' is present"]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Returned Value:"})}),(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:'Aug 09 18:56:04 server-0 k3s[2366]: time="2024-08-09T18:56:04Z" level=info msg="Running kube-apiserver --advertise-address=10.10.10.100 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,NamespaceLifecycle,ServiceAccount,PodSecurityPolicy --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})})]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Remediation:"})}),(0,s.jsx)(r.p,{children:"By default, K3s automatically provides the kubelet client certificate and key.\nThey are generated and located at /var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt and /var/lib/rancher/k3s/server/tls/client-kube-apiserver.key\nIf for some reason you need to provide your own certificate and key, you can set the\nbelow parameters in the K3s config file /etc/rancher/k3s/config.yaml."}),(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{children:'kube-apiserver-arg:\n - "kubelet-client-certificate="\n - "kubelet-client-key="\n'})})]}),"\n",(0,s.jsx)(r.h3,{id:"126-ensure-that-the---kubelet-certificate-authority-argument-is-set-as-appropriate-automated",children:"1.2.6 Ensure that the --kubelet-certificate-authority argument is set as appropriate (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'kubelet-certificate-authority'\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result:"})," '--kubelet-certificate-authority' is present"]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Returned Value:"})}),(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:'Aug 09 18:56:04 server-0 k3s[2366]: time="2024-08-09T18:56:04Z" level=info msg="Running kube-apiserver --advertise-address=10.10.10.100 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,NamespaceLifecycle,ServiceAccount,PodSecurityPolicy --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})})]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Remediation:"})}),(0,s.jsx)(r.p,{children:"Follow the Kubernetes documentation and setup the TLS connection between\nthe apiserver and kubelets. Then, edit the API server pod specification file\n/etc/kubernetes/manifests/kube-apiserver.yaml on the control plane node and set the\n--kubelet-certificate-authority parameter to the path to the cert file for the certificate authority.\n--kubelet-certificate-authority="})]}),"\n",(0,s.jsx)(r.h3,{id:"127-ensure-that-the---authorization-mode-argument-is-not-set-to-alwaysallow-automated",children:"1.2.7 Ensure that the --authorization-mode argument is not set to AlwaysAllow (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'authorization-mode'\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result:"})," '--authorization-mode' does not have 'AlwaysAllow'"]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Returned Value:"})}),(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:'Aug 09 18:56:04 server-0 k3s[2366]: time="2024-08-09T18:56:04Z" level=info msg="Running kube-apiserver --advertise-address=10.10.10.100 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,NamespaceLifecycle,ServiceAccount,PodSecurityPolicy --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})})]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Remediation:"})}),(0,s.jsx)(r.p,{children:"By default, K3s does not set the --authorization-mode to AlwaysAllow.\nIf this check fails, edit K3s config file /etc/rancher/k3s/config.yaml, remove any lines like below."}),(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{children:'kube-apiserver-arg:\n - "authorization-mode=AlwaysAllow"\n'})})]}),"\n",(0,s.jsx)(r.h3,{id:"128-ensure-that-the---authorization-mode-argument-includes-node-automated",children:"1.2.8 Ensure that the --authorization-mode argument includes Node (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'authorization-mode'\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result:"})," '--authorization-mode' has 'Node'"]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Returned Value:"})}),(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:'Aug 09 18:56:04 server-0 k3s[2366]: time="2024-08-09T18:56:04Z" level=info msg="Running kube-apiserver --advertise-address=10.10.10.100 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,NamespaceLifecycle,ServiceAccount,PodSecurityPolicy --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})})]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Remediation:"})}),(0,s.jsx)(r.p,{children:"By default, K3s sets the --authorization-mode to Node and RBAC.\nIf this check fails, edit the K3s config file /etc/rancher/k3s/config.yaml,\nensure that you are not overriding authorization-mode."})]}),"\n",(0,s.jsx)(r.h3,{id:"129-ensure-that-the---authorization-mode-argument-includes-rbac-automated",children:"1.2.9 Ensure that the --authorization-mode argument includes RBAC (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'authorization-mode'\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result:"})," '--authorization-mode' has 'RBAC'"]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Returned Value:"})}),(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:'Aug 09 18:56:04 server-0 k3s[2366]: time="2024-08-09T18:56:04Z" level=info msg="Running kube-apiserver --advertise-address=10.10.10.100 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,NamespaceLifecycle,ServiceAccount,PodSecurityPolicy --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})})]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Remediation:"})}),(0,s.jsx)(r.p,{children:"By default, K3s sets the --authorization-mode to Node and RBAC.\nIf this check fails, edit the K3s config file /etc/rancher/k3s/config.yaml,\nensure that you are not overriding authorization-mode."})]}),"\n",(0,s.jsx)(r.h3,{id:"1210-ensure-that-the-admission-control-plugin-eventratelimit-is-set-manual",children:"1.2.10 Ensure that the admission control plugin EventRateLimit is set (Manual)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nFollow the Kubernetes documentation and set the desired limits in a configuration file.\nThen, edit the K3s config file /etc/rancher/k3s/config.yaml and set the below parameters."]}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{children:'kube-apiserver-arg:\n - "enable-admission-plugins=...,EventRateLimit,..."\n - "admission-control-config-file="\n'})}),"\n",(0,s.jsx)(r.h3,{id:"1211-ensure-that-the-admission-control-plugin-alwaysadmit-is-not-set-automated",children:"1.2.11 Ensure that the admission control plugin AlwaysAdmit is not set (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'enable-admission-plugins'\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result:"})," '--enable-admission-plugins' does not have 'AlwaysAdmit' OR '--enable-admission-plugins' is not present"]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Returned Value:"})}),(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:'Aug 09 18:56:04 server-0 k3s[2366]: time="2024-08-09T18:56:04Z" level=info msg="Running kube-apiserver --advertise-address=10.10.10.100 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,NamespaceLifecycle,ServiceAccount,PodSecurityPolicy --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})})]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Remediation:"})}),(0,s.jsx)(r.p,{children:"By default, K3s does not set the --enable-admission-plugins to AlwaysAdmit.\nIf this check fails, edit K3s config file /etc/rancher/k3s/config.yaml, remove any lines like below."}),(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{children:'kube-apiserver-arg:\n - "enable-admission-plugins=AlwaysAdmit"\n'})})]}),"\n",(0,s.jsx)(r.h3,{id:"1212-ensure-that-the-admission-control-plugin-alwayspullimages-is-set-manual",children:"1.2.12 Ensure that the admission control plugin AlwaysPullImages is set (Manual)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),'\nPermissive, per CIS guidelines,\n"This setting could impact offline or isolated clusters, which have images pre-loaded and\ndo not have access to a registry to pull in-use images. This setting is not appropriate for\nclusters which use this configuration."\nEdit the K3s config file /etc/rancher/k3s/config.yaml and set the below parameter.']}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{children:'kube-apiserver-arg:\n - "enable-admission-plugins=...,AlwaysPullImages,..."\n'})}),"\n",(0,s.jsx)(r.h3,{id:"1213-ensure-that-the-admission-control-plugin-securitycontextdeny-is-set-if-podsecuritypolicy-is-not-used-manual",children:"1.2.13 Ensure that the admission control plugin SecurityContextDeny is set if PodSecurityPolicy is not used (Manual)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'enable-admission-plugins'\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result:"})," '--enable-admission-plugins' has 'SecurityContextDeny' OR '--enable-admission-plugins' has 'PodSecurityPolicy'"]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Returned Value:"})}),(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:'Aug 09 18:56:04 server-0 k3s[2366]: time="2024-08-09T18:56:04Z" level=info msg="Running kube-apiserver --advertise-address=10.10.10.100 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,NamespaceLifecycle,ServiceAccount,PodSecurityPolicy --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})})]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Remediation:"})}),(0,s.jsx)(r.p,{children:"Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml\non the control plane node and set the --enable-admission-plugins parameter to include\nSecurityContextDeny, unless PodSecurityPolicy is already in place.\n--enable-admission-plugins=...,SecurityContextDeny,..."})]}),"\n",(0,s.jsx)(r.h3,{id:"1214-ensure-that-the-admission-control-plugin-serviceaccount-is-set-automated",children:"1.2.14 Ensure that the admission control plugin ServiceAccount is set (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'ServiceAccount'\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result:"})," '--disable-admission-plugins' is present OR '--disable-admission-plugins' is not present"]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Returned Value:"})}),(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:'Aug 09 18:56:04 server-0 k3s[2366]: time="2024-08-09T18:56:04Z" level=info msg="Running kube-apiserver --advertise-address=10.10.10.100 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,NamespaceLifecycle,ServiceAccount,PodSecurityPolicy --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})})]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Remediation:"})}),(0,s.jsx)(r.p,{children:"By default, K3s does not set the --disable-admission-plugins to anything.\nFollow the documentation and create ServiceAccount objects as per your environment.\nIf this check fails, edit the K3s config file /etc/rancher/k3s/config.yaml and remove any lines like below."}),(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{children:'kube-apiserver-arg:\n - "disable-admission-plugins=ServiceAccount"\n'})})]}),"\n",(0,s.jsx)(r.h3,{id:"1215-ensure-that-the-admission-control-plugin-namespacelifecycle-is-set-automated",children:"1.2.15 Ensure that the admission control plugin NamespaceLifecycle is set (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s | grep 'Running kube-apiserver' | tail -n1\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result:"})," '--disable-admission-plugins' is present OR '--disable-admission-plugins' is not present"]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Returned Value:"})}),(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:'Aug 09 18:56:04 server-0 k3s[2366]: time="2024-08-09T18:56:04Z" level=info msg="Running kube-apiserver --advertise-address=10.10.10.100 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,NamespaceLifecycle,ServiceAccount,PodSecurityPolicy --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})})]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Remediation:"})}),(0,s.jsx)(r.p,{children:"By default, K3s does not set the --disable-admission-plugins to anything.\nIf this check fails, edit the K3s config file /etc/rancher/k3s/config.yaml and remove any lines like below."}),(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{children:'kube-apiserver-arg:\n - "disable-admission-plugins=...,NamespaceLifecycle,..."\n'})})]}),"\n",(0,s.jsx)(r.h3,{id:"1216-ensure-that-the-admission-control-plugin-noderestriction-is-set-automated",children:"1.2.16 Ensure that the admission control plugin NodeRestriction is set (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'enable-admission-plugins'\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result:"})," '--enable-admission-plugins' has 'NodeRestriction'"]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Returned Value:"})}),(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:'Aug 09 18:56:04 server-0 k3s[2366]: time="2024-08-09T18:56:04Z" level=info msg="Running kube-apiserver --advertise-address=10.10.10.100 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,NamespaceLifecycle,ServiceAccount,PodSecurityPolicy --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})})]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Remediation:"})}),(0,s.jsx)(r.p,{children:"By default, K3s sets the --enable-admission-plugins to NodeRestriction.\nIf using the K3s config file /etc/rancher/k3s/config.yaml, check that you are not overriding the admission plugins.\nIf you are, include NodeRestriction in the list."}),(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{children:'kube-apiserver-arg:\n - "enable-admission-plugins=...,NodeRestriction,..."\n'})})]}),"\n",(0,s.jsx)(r.h3,{id:"1217-ensure-that-the---secure-port-argument-is-not-set-to-0-automated",children:"1.2.17 Ensure that the --secure-port argument is not set to 0 (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'secure-port'\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result:"})," '--secure-port' is greater than 0 OR '--secure-port' is not present"]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Returned Value:"})}),(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:'Aug 09 18:56:04 server-0 k3s[2366]: time="2024-08-09T18:56:04Z" level=info msg="Running kube-apiserver --advertise-address=10.10.10.100 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,NamespaceLifecycle,ServiceAccount,PodSecurityPolicy --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})})]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Remediation:"})}),(0,s.jsx)(r.p,{children:"By default, K3s sets the secure port to 6444.\nIf this check fails, edit the K3s config file /etc/rancher/k3s/config.yaml and remove any lines like below."}),(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{children:'kube-apiserver-arg:\n - "secure-port="\n'})})]}),"\n",(0,s.jsx)(r.h3,{id:"1218-ensure-that-the---profiling-argument-is-set-to-false-automated",children:"1.2.18 Ensure that the --profiling argument is set to false (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'profiling'\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result:"})," '--profiling' is equal to 'false'"]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Returned Value:"})}),(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:'Aug 09 18:56:04 server-0 k3s[2366]: time="2024-08-09T18:56:04Z" level=info msg="Running kube-apiserver --advertise-address=10.10.10.100 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,NamespaceLifecycle,ServiceAccount,PodSecurityPolicy --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})})]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Remediation:"})}),(0,s.jsx)(r.p,{children:"By default, K3s sets the --profiling argument to false.\nIf this check fails, edit the K3s config file /etc/rancher/k3s/config.yaml and remove any lines like below."}),(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{children:'kube-apiserver-arg:\n - "profiling=true"\n'})})]}),"\n",(0,s.jsx)(r.h3,{id:"1219-ensure-that-the---audit-log-path-argument-is-set-manual",children:"1.2.19 Ensure that the --audit-log-path argument is set (Manual)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'audit-log-path'\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result:"})," '--audit-log-path' is present"]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Returned Value:"})}),(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:'Aug 09 18:56:04 server-0 k3s[2366]: time="2024-08-09T18:56:04Z" level=info msg="Running kube-apiserver --advertise-address=10.10.10.100 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,NamespaceLifecycle,ServiceAccount,PodSecurityPolicy --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})})]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Remediation:"})}),(0,s.jsx)(r.p,{children:"Edit the K3s config file /etc/rancher/k3s/config.yaml and set the audit-log-path parameter to a suitable path and\nfile where you would like audit logs to be written, for example,"}),(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{children:'kube-apiserver-arg:\n - "audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log"\n'})})]}),"\n",(0,s.jsx)(r.h3,{id:"1220-ensure-that-the---audit-log-maxage-argument-is-set-to-30-or-as-appropriate-automated",children:"1.2.20 Ensure that the --audit-log-maxage argument is set to 30 or as appropriate (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'audit-log-maxage'\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result:"})," '--audit-log-maxage' is greater or equal to 30"]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Returned Value:"})}),(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:'Aug 09 18:56:04 server-0 k3s[2366]: time="2024-08-09T18:56:04Z" level=info msg="Running kube-apiserver --advertise-address=10.10.10.100 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,NamespaceLifecycle,ServiceAccount,PodSecurityPolicy --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})})]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Remediation:"})}),(0,s.jsx)(r.p,{children:"Edit the K3s config file /etc/rancher/k3s/config.yaml on the control plane node and\nset the audit-log-maxage parameter to 30 or as an appropriate number of days, for example,"}),(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{children:'kube-apiserver-arg:\n - "audit-log-maxage=30"\n'})})]}),"\n",(0,s.jsx)(r.h3,{id:"1221-ensure-that-the---audit-log-maxbackup-argument-is-set-to-10-or-as-appropriate-automated",children:"1.2.21 Ensure that the --audit-log-maxbackup argument is set to 10 or as appropriate (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'audit-log-maxbackup'\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result:"})," '--audit-log-maxbackup' is greater or equal to 10"]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Returned Value:"})}),(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:'Aug 09 18:56:04 server-0 k3s[2366]: time="2024-08-09T18:56:04Z" level=info msg="Running kube-apiserver --advertise-address=10.10.10.100 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,NamespaceLifecycle,ServiceAccount,PodSecurityPolicy --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})})]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Remediation:"})}),(0,s.jsx)(r.p,{children:"Edit the K3s config file /etc/rancher/k3s/config.yaml on the control plane node and\nset the audit-log-maxbackup parameter to 10 or to an appropriate value. For example,"}),(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{children:'kube-apiserver-arg:\n - "audit-log-maxbackup=10"\n'})})]}),"\n",(0,s.jsx)(r.h3,{id:"1222-ensure-that-the---audit-log-maxsize-argument-is-set-to-100-or-as-appropriate-automated",children:"1.2.22 Ensure that the --audit-log-maxsize argument is set to 100 or as appropriate (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'audit-log-maxsize'\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result:"})," '--audit-log-maxsize' is greater or equal to 100"]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Returned Value:"})}),(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:'Aug 09 18:56:04 server-0 k3s[2366]: time="2024-08-09T18:56:04Z" level=info msg="Running kube-apiserver --advertise-address=10.10.10.100 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,NamespaceLifecycle,ServiceAccount,PodSecurityPolicy --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})})]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Remediation:"})}),(0,s.jsx)(r.p,{children:"Edit the K3s config file /etc/rancher/k3s/config.yaml on the control plane node and\nset the audit-log-maxsize parameter to an appropriate size in MB. For example,"}),(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{children:'kube-apiserver-arg:\n - "audit-log-maxsize=100"\n'})})]}),"\n",(0,s.jsx)(r.h3,{id:"1223-ensure-that-the---request-timeout-argument-is-set-as-appropriate-manual",children:"1.2.23 Ensure that the --request-timeout argument is set as appropriate (Manual)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),'\nPermissive, per CIS guidelines,\n"it is recommended to set this limit as appropriate and change the default limit of 60 seconds only if needed".\nEdit the K3s config file /etc/rancher/k3s/config.yaml\nand set the below parameter if needed. For example,']}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{children:'kube-apiserver-arg:\n - "request-timeout=300s"\n'})}),"\n",(0,s.jsx)(r.h3,{id:"1224-ensure-that-the---service-account-lookup-argument-is-set-to-true-automated",children:"1.2.24 Ensure that the --service-account-lookup argument is set to true (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s | grep 'Running kube-apiserver' | tail -n1\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result:"})," '--service-account-lookup' is not present OR '--service-account-lookup' is present"]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Returned Value:"})}),(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:'Aug 09 18:56:04 server-0 k3s[2366]: time="2024-08-09T18:56:04Z" level=info msg="Running kube-apiserver --advertise-address=10.10.10.100 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,NamespaceLifecycle,ServiceAccount,PodSecurityPolicy --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})})]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Remediation:"})}),(0,s.jsx)(r.p,{children:"By default, K3s does not set the --service-account-lookup argument.\nEdit the K3s config file /etc/rancher/k3s/config.yaml and set the service-account-lookup. For example,"}),(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{children:'kube-apiserver-arg:\n - "service-account-lookup=true"\n'})}),(0,s.jsx)(r.p,{children:"Alternatively, you can delete the service-account-lookup parameter from this file so\nthat the default takes effect."})]}),"\n",(0,s.jsx)(r.h3,{id:"1225-ensure-that-the---service-account-key-file-argument-is-set-as-appropriate-automated",children:"1.2.25 Ensure that the --service-account-key-file argument is set as appropriate (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'service-account-key-file'\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result:"})," '--service-account-key-file' is present"]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Returned Value:"})}),(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:'Aug 09 18:56:04 server-0 k3s[2366]: time="2024-08-09T18:56:04Z" level=info msg="Running kube-apiserver --advertise-address=10.10.10.100 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,NamespaceLifecycle,ServiceAccount,PodSecurityPolicy --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})})]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Remediation:"})}),(0,s.jsx)(r.p,{children:"K3s automatically generates and sets the service account key file.\nIt is located at /var/lib/rancher/k3s/server/tls/service.key.\nIf this check fails, edit K3s config file /etc/rancher/k3s/config.yaml and remove any lines like below."}),(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{children:'kube-apiserver-arg:\n - "service-account-key-file="\n'})})]}),"\n",(0,s.jsx)(r.h3,{id:"1226-ensure-that-the---etcd-certfile-and---etcd-keyfile-arguments-are-set-as-appropriate-automated",children:"1.2.26 Ensure that the --etcd-certfile and --etcd-keyfile arguments are set as appropriate (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"if [ \"$(journalctl -u k3s | grep -m1 'Managed etcd cluster' | wc -l)\" -gt 0 ]; then\n journalctl -D /var/log/journal -u k3s | grep -m1 'Running kube-apiserver' | tail -n1\nelse\n echo \"--etcd-certfile AND --etcd-keyfile\"\nfi\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result:"})," '--etcd-certfile' is present AND '--etcd-keyfile' is present"]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Returned Value:"})}),(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:'Aug 09 18:56:04 server-0 k3s[2366]: time="2024-08-09T18:56:04Z" level=info msg="Running kube-apiserver --advertise-address=10.10.10.100 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,NamespaceLifecycle,ServiceAccount,PodSecurityPolicy --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})})]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Remediation:"})}),(0,s.jsx)(r.p,{children:"K3s automatically generates and sets the etcd certificate and key files.\nThey are located at /var/lib/rancher/k3s/server/tls/etcd/client.crt and /var/lib/rancher/k3s/server/tls/etcd/client.key.\nIf this check fails, edit the K3s config file /etc/rancher/k3s/config.yaml and remove any lines like below."}),(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{children:'kube-apiserver-arg:\n - "etcd-certfile="\n - "etcd-keyfile="\n'})})]}),"\n",(0,s.jsx)(r.h3,{id:"1227-ensure-that-the---tls-cert-file-and---tls-private-key-file-arguments-are-set-as-appropriate-automated",children:"1.2.27 Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"journalctl -D /var/log/journal -u k3s | grep -A1 'Running kube-apiserver' | tail -n2\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result:"})," '--tls-cert-file' is present AND '--tls-private-key-file' is present"]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Returned Value:"})}),(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:'Aug 09 18:56:04 server-0 k3s[2366]: time="2024-08-09T18:56:04Z" level=info msg="Running kube-apiserver --advertise-address=10.10.10.100 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,NamespaceLifecycle,ServiceAccount,PodSecurityPolicy --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\nAug 09 18:56:04 server-0 k3s[2366]: time="2024-08-09T18:56:04Z" level=info msg="Running kube-scheduler --authentication-kubeconfig=/var/lib/rancher/k3s/server/cred/scheduler.kubeconfig --authorization-kubeconfig=/var/lib/rancher/k3s/server/cred/scheduler.kubeconfig --bind-address=127.0.0.1 --kubeconfig=/var/lib/rancher/k3s/server/cred/scheduler.kubeconfig --profiling=false --secure-port=10259"\n'})})]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Remediation:"})}),(0,s.jsx)(r.p,{children:"By default, K3s automatically generates and provides the TLS certificate and private key for the apiserver.\nThey are generated and located at /var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt and /var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key\nIf this check fails, edit the K3s config file /etc/rancher/k3s/config.yaml and remove any lines like below."}),(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{children:'kube-apiserver-arg:\n - "tls-cert-file="\n - "tls-private-key-file="\n'})})]}),"\n",(0,s.jsx)(r.h3,{id:"1228-ensure-that-the---client-ca-file-argument-is-set-as-appropriate-automated",children:"1.2.28 Ensure that the --client-ca-file argument is set as appropriate (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'client-ca-file'\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result:"})," '--client-ca-file' is present"]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Returned Value:"})}),(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:'Aug 09 18:56:04 server-0 k3s[2366]: time="2024-08-09T18:56:04Z" level=info msg="Running kube-apiserver --advertise-address=10.10.10.100 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,NamespaceLifecycle,ServiceAccount,PodSecurityPolicy --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})})]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Remediation:"})}),(0,s.jsx)(r.p,{children:"By default, K3s automatically provides the client certificate authority file.\nIt is generated and located at /var/lib/rancher/k3s/server/tls/client-ca.crt.\nIf this check fails, edit the K3s config file /etc/rancher/k3s/config.yaml and remove any lines like below."}),(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{children:'kube-apiserver-arg:\n - "client-ca-file="\n'})})]}),"\n",(0,s.jsx)(r.h3,{id:"1229-ensure-that-the---etcd-cafile-argument-is-set-as-appropriate-automated",children:"1.2.29 Ensure that the --etcd-cafile argument is set as appropriate (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'etcd-cafile'\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result:"})," '--etcd-cafile' is present"]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Returned Value:"})}),(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:'Aug 09 18:56:04 server-0 k3s[2366]: time="2024-08-09T18:56:04Z" level=info msg="Running kube-apiserver --advertise-address=10.10.10.100 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,NamespaceLifecycle,ServiceAccount,PodSecurityPolicy --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})})]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Remediation:"})}),(0,s.jsx)(r.p,{children:"By default, K3s automatically provides the etcd certificate authority file.\nIt is generated and located at /var/lib/rancher/k3s/server/tls/client-ca.crt.\nIf this check fails, edit the K3s config file /etc/rancher/k3s/config.yaml and remove any lines like below."}),(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{children:'kube-apiserver-arg:\n - "etcd-cafile="\n'})})]}),"\n",(0,s.jsx)(r.h3,{id:"1230-ensure-that-the---encryption-provider-config-argument-is-set-as-appropriate-manual",children:"1.2.30 Ensure that the --encryption-provider-config argument is set as appropriate (Manual)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'encryption-provider-config'\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result:"})," '--encryption-provider-config' is present"]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Returned Value:"})}),(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:'Aug 09 18:56:04 server-0 k3s[2366]: time="2024-08-09T18:56:04Z" level=info msg="Running kube-apiserver --advertise-address=10.10.10.100 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,NamespaceLifecycle,ServiceAccount,PodSecurityPolicy --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})})]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Remediation:"})}),(0,s.jsx)(r.p,{children:"K3s can be configured to use encryption providers to encrypt secrets at rest.\nEdit the K3s config file /etc/rancher/k3s/config.yaml on the control plane node and set the below parameter.\nsecrets-encryption: true\nSecrets encryption can then be managed with the k3s secrets-encrypt command line tool.\nIf needed, you can find the generated encryption config at /var/lib/rancher/k3s/server/cred/encryption-config.json."})]}),"\n",(0,s.jsx)(r.h3,{id:"1231-ensure-that-encryption-providers-are-appropriately-configured-manual",children:"1.2.31 Ensure that encryption providers are appropriately configured (Manual)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"ENCRYPTION_PROVIDER_CONFIG=$(journalctl -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep -- --encryption-provider-config | sed 's%.*encryption-provider-config[= ]\\([^ ]*\\).*%\\1%')\nif test -e $ENCRYPTION_PROVIDER_CONFIG; then grep -o 'providers\\\"\\:\\[.*\\]' $ENCRYPTION_PROVIDER_CONFIG | grep -o \"[A-Za-z]*\" | head -2 | tail -1 | sed 's/^/provider=/'; fi\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result:"})," 'provider' contains valid elements from 'aescbc,kms,secretbox'"]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Returned Value:"})}),(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:"provider=aescbc\n"})})]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Remediation:"})}),(0,s.jsx)(r.p,{children:"K3s can be configured to use encryption providers to encrypt secrets at rest. K3s will utilize the aescbc provider.\nEdit the K3s config file /etc/rancher/k3s/config.yaml on the control plane node and set the below parameter.\nsecrets-encryption: true\nSecrets encryption can then be managed with the k3s secrets-encrypt command line tool.\nIf needed, you can find the generated encryption config at /var/lib/rancher/k3s/server/cred/encryption-config.json"})]}),"\n",(0,s.jsx)(r.h3,{id:"1232-ensure-that-the-api-server-only-makes-use-of-strong-cryptographic-ciphers-automated",children:"1.2.32 Ensure that the API Server only makes use of Strong Cryptographic Ciphers (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'tls-cipher-suites'\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result:"})," '--tls-cipher-suites' contains valid elements from 'TLS_AES_128_GCM_SHA256,TLS_AES_256_GCM_SHA384,TLS_CHACHA20_POLY1305_SHA256,TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256,TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256,TLS_RSA_WITH_3DES_EDE_CBC_SHA,TLS_RSA_WITH_AES_128_CBC_SHA,TLS_RSA_WITH_AES_128_GCM_SHA256,TLS_RSA_WITH_AES_256_CBC_SHA,TLS_RSA_WITH_AES_256_GCM_SHA384'"]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Returned Value:"})}),(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:'Aug 09 18:56:04 server-0 k3s[2366]: time="2024-08-09T18:56:04Z" level=info msg="Running kube-apiserver --advertise-address=10.10.10.100 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,NamespaceLifecycle,ServiceAccount,PodSecurityPolicy --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})})]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Remediation:"})}),(0,s.jsxs)(r.p,{children:["By default, the K3s kube-apiserver complies with this test. Changes to these values may cause regression, therefore ensure that all apiserver clients support the new TLS configuration before applying it in production deployments.\nIf a custom TLS configuration is required, consider also creating a custom version of this rule that aligns with your requirements.\nIf this check fails, remove any custom configuration around ",(0,s.jsx)(r.code,{children:"tls-cipher-suites"})," or update the /etc/rancher/k3s/config.yaml file to match the default by adding the following:"]}),(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{children:'kube-apiserver-arg:\n - "tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305"\n'})})]}),"\n",(0,s.jsx)(r.h2,{id:"13-controller-manager",children:"1.3 Controller Manager"}),"\n",(0,s.jsx)(r.h3,{id:"131-ensure-that-the---terminated-pod-gc-threshold-argument-is-set-as-appropriate-manual",children:"1.3.1 Ensure that the --terminated-pod-gc-threshold argument is set as appropriate (Manual)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s | grep 'Running kube-controller-manager' | tail -n1 | grep 'terminated-pod-gc-threshold'\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result:"})," '--terminated-pod-gc-threshold' is present"]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Returned Value:"})}),(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:'Aug 09 18:56:04 server-0 k3s[2366]: time="2024-08-09T18:56:04Z" level=info msg="Running kube-controller-manager --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/k3s/server/tls/client-ca.nochain.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/k3s/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/k3s/server/tls/client-ca.nochain.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/k3s/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/k3s/server/tls/server-ca.nochain.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/k3s/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/k3s/server/tls/server-ca.nochain.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/k3s/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,tokencleaner,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/k3s/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --terminated-pod-gc-threshold=10 --use-service-account-credentials=true"\n'})})]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Remediation:"})}),(0,s.jsx)(r.p,{children:"Edit the K3s config file /etc/rancher/k3s/config.yaml on the control plane node\nand set the --terminated-pod-gc-threshold to an appropriate threshold,"}),(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{children:'kube-controller-manager-arg:\n - "terminated-pod-gc-threshold=10"\n'})})]}),"\n",(0,s.jsx)(r.h3,{id:"132-ensure-that-the---profiling-argument-is-set-to-false-automated",children:"1.3.2 Ensure that the --profiling argument is set to false (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s | grep 'Running kube-controller-manager' | tail -n1 | grep 'profiling'\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result:"})," '--profiling' is equal to 'false'"]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Returned Value:"})}),(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:'Aug 09 18:56:04 server-0 k3s[2366]: time="2024-08-09T18:56:04Z" level=info msg="Running kube-controller-manager --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/k3s/server/tls/client-ca.nochain.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/k3s/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/k3s/server/tls/client-ca.nochain.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/k3s/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/k3s/server/tls/server-ca.nochain.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/k3s/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/k3s/server/tls/server-ca.nochain.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/k3s/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,tokencleaner,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/k3s/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --terminated-pod-gc-threshold=10 --use-service-account-credentials=true"\n'})})]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Remediation:"})}),(0,s.jsx)(r.p,{children:"By default, K3s sets the --profiling argument to false.\nIf this check fails, edit the K3s config file /etc/rancher/k3s/config.yaml and remove any lines like below."}),(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{children:'kube-controller-manager-arg:\n - "profiling=true"\n'})})]}),"\n",(0,s.jsx)(r.h3,{id:"133-ensure-that-the---use-service-account-credentials-argument-is-set-to-true-automated",children:"1.3.3 Ensure that the --use-service-account-credentials argument is set to true (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s | grep 'Running kube-controller-manager' | tail -n1 | grep 'use-service-account-credentials'\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result:"})," '--use-service-account-credentials' is not equal to 'false'"]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Returned Value:"})}),(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:'Aug 09 18:56:04 server-0 k3s[2366]: time="2024-08-09T18:56:04Z" level=info msg="Running kube-controller-manager --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/k3s/server/tls/client-ca.nochain.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/k3s/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/k3s/server/tls/client-ca.nochain.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/k3s/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/k3s/server/tls/server-ca.nochain.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/k3s/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/k3s/server/tls/server-ca.nochain.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/k3s/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,tokencleaner,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/k3s/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --terminated-pod-gc-threshold=10 --use-service-account-credentials=true"\n'})})]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Remediation:"})}),(0,s.jsx)(r.p,{children:"By default, K3s sets the --use-service-account-credentials argument to true.\nIf this check fails, edit the K3s config file /etc/rancher/k3s/config.yaml and remove any lines like below."}),(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{children:'kube-controller-manager-arg:\n - "use-service-account-credentials=false"\n'})})]}),"\n",(0,s.jsx)(r.h3,{id:"134-ensure-that-the---service-account-private-key-file-argument-is-set-as-appropriate-automated",children:"1.3.4 Ensure that the --service-account-private-key-file argument is set as appropriate (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s | grep 'Running kube-controller-manager' | tail -n1 | grep 'service-account-private-key-file'\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result:"})," '--service-account-private-key-file' is present"]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Returned Value:"})}),(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:'Aug 09 18:56:04 server-0 k3s[2366]: time="2024-08-09T18:56:04Z" level=info msg="Running kube-controller-manager --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/k3s/server/tls/client-ca.nochain.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/k3s/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/k3s/server/tls/client-ca.nochain.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/k3s/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/k3s/server/tls/server-ca.nochain.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/k3s/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/k3s/server/tls/server-ca.nochain.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/k3s/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,tokencleaner,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/k3s/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --terminated-pod-gc-threshold=10 --use-service-account-credentials=true"\n'})})]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Remediation:"})}),(0,s.jsx)(r.p,{children:"By default, K3s automatically provides the service account private key file.\nIt is generated and located at /var/lib/rancher/k3s/server/tls/service.current.key.\nIf this check fails, edit the K3s config file /etc/rancher/k3s/config.yaml and remove any lines like below."}),(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{children:'kube-controller-manager-arg:\n - "service-account-private-key-file="\n'})})]}),"\n",(0,s.jsx)(r.h3,{id:"135-ensure-that-the---root-ca-file-argument-is-set-as-appropriate-automated",children:"1.3.5 Ensure that the --root-ca-file argument is set as appropriate (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s | grep 'Running kube-controller-manager' | tail -n1 | grep 'root-ca-file'\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result:"})," '--root-ca-file' is present"]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Returned Value:"})}),(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:'Aug 09 18:56:04 server-0 k3s[2366]: time="2024-08-09T18:56:04Z" level=info msg="Running kube-controller-manager --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/k3s/server/tls/client-ca.nochain.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/k3s/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/k3s/server/tls/client-ca.nochain.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/k3s/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/k3s/server/tls/server-ca.nochain.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/k3s/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/k3s/server/tls/server-ca.nochain.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/k3s/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,tokencleaner,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/k3s/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --terminated-pod-gc-threshold=10 --use-service-account-credentials=true"\n'})})]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Remediation:"})}),(0,s.jsx)(r.p,{children:"By default, K3s automatically provides the root CA file.\nIt is generated and located at /var/lib/rancher/k3s/server/tls/server-ca.crt.\nIf this check fails, edit the K3s config file /etc/rancher/k3s/config.yaml and remove any lines like below."}),(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{children:'kube-controller-manager-arg:\n - "root-ca-file="\n'})})]}),"\n",(0,s.jsx)(r.h3,{id:"136-ensure-that-the-rotatekubeletservercertificate-argument-is-set-to-true-automated",children:"1.3.6 Ensure that the RotateKubeletServerCertificate argument is set to true (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s | grep 'Running kube-controller-manager' | tail -n1\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result:"})," '--feature-gates' does not have 'RotateKubeletServerCertificate=false' OR '--feature-gates' is not present"]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Returned Value:"})}),(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:'Aug 09 18:56:04 server-0 k3s[2366]: time="2024-08-09T18:56:04Z" level=info msg="Running kube-controller-manager --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/k3s/server/tls/client-ca.nochain.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/k3s/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/k3s/server/tls/client-ca.nochain.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/k3s/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/k3s/server/tls/server-ca.nochain.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/k3s/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/k3s/server/tls/server-ca.nochain.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/k3s/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,tokencleaner,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/k3s/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --terminated-pod-gc-threshold=10 --use-service-account-credentials=true"\n'})})]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Remediation:"})}),(0,s.jsx)(r.p,{children:"By default, K3s does not set the RotateKubeletServerCertificate feature gate.\nIf you have enabled this feature gate, you should remove it.\nIf this check fails, edit the K3s config file /etc/rancher/k3s/config.yaml, remove any lines like below."}),(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{children:'kube-controller-manager-arg:\n - "feature-gate=RotateKubeletServerCertificate"\n'})})]}),"\n",(0,s.jsx)(r.h3,{id:"137-ensure-that-the---bind-address-argument-is-set-to-127001-automated",children:"1.3.7 Ensure that the --bind-address argument is set to 127.0.0.1 (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s | grep 'Running kube-controller-manager' | tail -n1 | grep 'bind-address'\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result:"})," '--bind-address' is equal to '127.0.0.1' OR '--bind-address' is not present"]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Returned Value:"})}),(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:'Aug 09 18:56:04 server-0 k3s[2366]: time="2024-08-09T18:56:04Z" level=info msg="Running kube-controller-manager --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/k3s/server/tls/client-ca.nochain.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/k3s/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/k3s/server/tls/client-ca.nochain.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/k3s/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/k3s/server/tls/server-ca.nochain.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/k3s/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/k3s/server/tls/server-ca.nochain.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/k3s/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,tokencleaner,-service,-route,-cloud-node-lifecycle --feature-gates=JobTrackingWithFinalizers=true --kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/k3s/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --terminated-pod-gc-threshold=10 --use-service-account-credentials=true"\n'})})]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Remediation:"})}),(0,s.jsx)(r.p,{children:"By default, K3s sets the --bind-address argument to 127.0.0.1\nIf this check fails, edit the K3s config file /etc/rancher/k3s/config.yaml and remove any lines like below."}),(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{children:'kube-controller-manager-arg:\n - "bind-address="\n'})})]}),"\n",(0,s.jsx)(r.h2,{id:"14-scheduler",children:"1.4 Scheduler"}),"\n",(0,s.jsx)(r.h3,{id:"141-ensure-that-the---profiling-argument-is-set-to-false-automated",children:"1.4.1 Ensure that the --profiling argument is set to false (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"journalctl -D /var/log/journal -u k3s | grep 'Running kube-scheduler' | tail -n1\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result:"})," '--profiling' is equal to 'false'"]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Returned Value:"})}),(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:'Aug 09 18:56:04 server-0 k3s[2366]: time="2024-08-09T18:56:04Z" level=info msg="Running kube-scheduler --authentication-kubeconfig=/var/lib/rancher/k3s/server/cred/scheduler.kubeconfig --authorization-kubeconfig=/var/lib/rancher/k3s/server/cred/scheduler.kubeconfig --bind-address=127.0.0.1 --kubeconfig=/var/lib/rancher/k3s/server/cred/scheduler.kubeconfig --profiling=false --secure-port=10259"\n'})})]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Remediation:"})}),(0,s.jsx)(r.p,{children:"By default, K3s sets the --profiling argument to false.\nIf this check fails, edit the K3s config file /etc/rancher/k3s/config.yaml and remove any lines like below."}),(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{children:'kube-scheduler-arg:\n - "profiling=true"\n'})})]}),"\n",(0,s.jsx)(r.h3,{id:"142-ensure-that-the---bind-address-argument-is-set-to-127001-automated",children:"1.4.2 Ensure that the --bind-address argument is set to 127.0.0.1 (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s | grep 'Running kube-scheduler' | tail -n1 | grep 'bind-address'\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result:"})," '--bind-address' is equal to '127.0.0.1' OR '--bind-address' is not present"]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Returned Value:"})}),(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:'Aug 09 18:56:04 server-0 k3s[2366]: time="2024-08-09T18:56:04Z" level=info msg="Running kube-scheduler --authentication-kubeconfig=/var/lib/rancher/k3s/server/cred/scheduler.kubeconfig --authorization-kubeconfig=/var/lib/rancher/k3s/server/cred/scheduler.kubeconfig --bind-address=127.0.0.1 --kubeconfig=/var/lib/rancher/k3s/server/cred/scheduler.kubeconfig --profiling=false --secure-port=10259"\n'})})]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Remediation:"})}),(0,s.jsx)(r.p,{children:"By default, K3s sets the --bind-address argument to 127.0.0.1\nIf this check fails, edit the K3s config file /etc/rancher/k3s/config.yaml and remove any lines like below."}),(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{children:'kube-scheduler-arg:\n - "bind-address="\n'})})]}),"\n",(0,s.jsx)(r.h2,{id:"2-etcd-node-configuration",children:"2 Etcd Node Configuration"}),"\n",(0,s.jsx)(r.h3,{id:"21-ensure-that-the---cert-file-and---key-file-arguments-are-set-as-appropriate-automated",children:"2.1 Ensure that the --cert-file and --key-file arguments are set as appropriate (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result:"})," '.client-transport-security.cert-file' is equal to '/var/lib/rancher/k3s/server/tls/etcd/server-client.crt' AND '.client-transport-security.key-file' is equal to '/var/lib/rancher/k3s/server/tls/etcd/server-client.key'"]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Returned Value:"})}),(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:"advertise-client-urls: https://10.10.10.100:2379\nclient-transport-security:\n cert-file: /var/lib/rancher/k3s/server/tls/etcd/server-client.crt\n client-cert-auth: true\n key-file: /var/lib/rancher/k3s/server/tls/etcd/server-client.key\n trusted-ca-file: /var/lib/rancher/k3s/server/tls/etcd/server-ca.crt\ndata-dir: /var/lib/rancher/k3s/server/db/etcd\nelection-timeout: 5000\nexperimental-initial-corrupt-check: true\nheartbeat-interval: 500\ninitial-advertise-peer-urls: https://10.10.10.100:2380\ninitial-cluster: server-0-ee1de912=https://10.10.10.100:2380\ninitial-cluster-state: new\nlisten-client-urls: https://127.0.0.1:2379,https://10.10.10.100:2379\nlisten-metrics-urls: http://127.0.0.1:2381\nlisten-peer-urls: https://127.0.0.1:2380,https://10.10.10.100:2380\nlog-outputs:\n- stderr\nlogger: zap\nname: server-0-ee1de912\npeer-transport-security:\n cert-file: /var/lib/rancher/k3s/server/tls/etcd/peer-server-client.crt\n client-cert-auth: true\n key-file: /var/lib/rancher/k3s/server/tls/etcd/peer-server-client.key\n trusted-ca-file: /var/lib/rancher/k3s/server/tls/etcd/peer-ca.crt\nsnapshot-count: 10000\n"})})]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Remediation:"})}),(0,s.jsx)(r.p,{children:"If running on with sqlite or a external DB, etcd checks are Not Applicable.\nWhen running with embedded-etcd, K3s generates cert and key files for etcd.\nThese are located in /var/lib/rancher/k3s/server/tls/etcd/.\nIf this check fails, ensure that the configuration file /var/lib/rancher/k3s/server/db/etcd/config\nhas not been modified to use custom cert and key files."})]}),"\n",(0,s.jsx)(r.h3,{id:"22-ensure-that-the---client-cert-auth-argument-is-set-to-true-automated",children:"2.2 Ensure that the --client-cert-auth argument is set to true (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result:"})," '.client-transport-security.client-cert-auth' is equal to 'true'"]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Returned Value:"})}),(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:"advertise-client-urls: https://10.10.10.100:2379\nclient-transport-security:\n cert-file: /var/lib/rancher/k3s/server/tls/etcd/server-client.crt\n client-cert-auth: true\n key-file: /var/lib/rancher/k3s/server/tls/etcd/server-client.key\n trusted-ca-file: /var/lib/rancher/k3s/server/tls/etcd/server-ca.crt\ndata-dir: /var/lib/rancher/k3s/server/db/etcd\nelection-timeout: 5000\nexperimental-initial-corrupt-check: true\nheartbeat-interval: 500\ninitial-advertise-peer-urls: https://10.10.10.100:2380\ninitial-cluster: server-0-ee1de912=https://10.10.10.100:2380\ninitial-cluster-state: new\nlisten-client-urls: https://127.0.0.1:2379,https://10.10.10.100:2379\nlisten-metrics-urls: http://127.0.0.1:2381\nlisten-peer-urls: https://127.0.0.1:2380,https://10.10.10.100:2380\nlog-outputs:\n- stderr\nlogger: zap\nname: server-0-ee1de912\npeer-transport-security:\n cert-file: /var/lib/rancher/k3s/server/tls/etcd/peer-server-client.crt\n client-cert-auth: true\n key-file: /var/lib/rancher/k3s/server/tls/etcd/peer-server-client.key\n trusted-ca-file: /var/lib/rancher/k3s/server/tls/etcd/peer-ca.crt\nsnapshot-count: 10000\n"})})]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Remediation:"})}),(0,s.jsx)(r.p,{children:"If running on with sqlite or a external DB, etcd checks are Not Applicable.\nWhen running with embedded-etcd, K3s sets the --client-cert-auth parameter to true.\nIf this check fails, ensure that the configuration file /var/lib/rancher/k3s/server/db/etcd/config\nhas not been modified to disable client certificate authentication."})]}),"\n",(0,s.jsx)(r.h3,{id:"23-ensure-that-the---auto-tls-argument-is-not-set-to-true-automated",children:"2.3 Ensure that the --auto-tls argument is not set to true (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result:"})," '.client-transport-security.auto-tls' is present OR '.client-transport-security.auto-tls' is not present"]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Returned Value:"})}),(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:"advertise-client-urls: https://10.10.10.100:2379\nclient-transport-security:\n cert-file: /var/lib/rancher/k3s/server/tls/etcd/server-client.crt\n client-cert-auth: true\n key-file: /var/lib/rancher/k3s/server/tls/etcd/server-client.key\n trusted-ca-file: /var/lib/rancher/k3s/server/tls/etcd/server-ca.crt\ndata-dir: /var/lib/rancher/k3s/server/db/etcd\nelection-timeout: 5000\nexperimental-initial-corrupt-check: true\nheartbeat-interval: 500\ninitial-advertise-peer-urls: https://10.10.10.100:2380\ninitial-cluster: server-0-ee1de912=https://10.10.10.100:2380\ninitial-cluster-state: new\nlisten-client-urls: https://127.0.0.1:2379,https://10.10.10.100:2379\nlisten-metrics-urls: http://127.0.0.1:2381\nlisten-peer-urls: https://127.0.0.1:2380,https://10.10.10.100:2380\nlog-outputs:\n- stderr\nlogger: zap\nname: server-0-ee1de912\npeer-transport-security:\n cert-file: /var/lib/rancher/k3s/server/tls/etcd/peer-server-client.crt\n client-cert-auth: true\n key-file: /var/lib/rancher/k3s/server/tls/etcd/peer-server-client.key\n trusted-ca-file: /var/lib/rancher/k3s/server/tls/etcd/peer-ca.crt\nsnapshot-count: 10000\n"})})]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Remediation:"})}),(0,s.jsx)(r.p,{children:"If running on with sqlite or a external DB, etcd checks are Not Applicable.\nWhen running with embedded-etcd, K3s does not set the --auto-tls parameter.\nIf this check fails, edit the etcd pod specification file /var/lib/rancher/k3s/server/db/etcd/config on the master\nnode and either remove the --auto-tls parameter or set it to false.\nclient-transport-security:\nauto-tls: false"})]}),"\n",(0,s.jsx)(r.h3,{id:"24-ensure-that-the---peer-cert-file-and---peer-key-file-arguments-are-set-as-appropriate-automated",children:"2.4 Ensure that the --peer-cert-file and --peer-key-file arguments are set as appropriate (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result:"})," '.peer-transport-security.cert-file' is equal to '/var/lib/rancher/k3s/server/tls/etcd/peer-server-client.crt' AND '.peer-transport-security.key-file' is equal to '/var/lib/rancher/k3s/server/tls/etcd/peer-server-client.key'"]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Returned Value:"})}),(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:"advertise-client-urls: https://10.10.10.100:2379\nclient-transport-security:\n cert-file: /var/lib/rancher/k3s/server/tls/etcd/server-client.crt\n client-cert-auth: true\n key-file: /var/lib/rancher/k3s/server/tls/etcd/server-client.key\n trusted-ca-file: /var/lib/rancher/k3s/server/tls/etcd/server-ca.crt\ndata-dir: /var/lib/rancher/k3s/server/db/etcd\nelection-timeout: 5000\nexperimental-initial-corrupt-check: true\nheartbeat-interval: 500\ninitial-advertise-peer-urls: https://10.10.10.100:2380\ninitial-cluster: server-0-ee1de912=https://10.10.10.100:2380\ninitial-cluster-state: new\nlisten-client-urls: https://127.0.0.1:2379,https://10.10.10.100:2379\nlisten-metrics-urls: http://127.0.0.1:2381\nlisten-peer-urls: https://127.0.0.1:2380,https://10.10.10.100:2380\nlog-outputs:\n- stderr\nlogger: zap\nname: server-0-ee1de912\npeer-transport-security:\n cert-file: /var/lib/rancher/k3s/server/tls/etcd/peer-server-client.crt\n client-cert-auth: true\n key-file: /var/lib/rancher/k3s/server/tls/etcd/peer-server-client.key\n trusted-ca-file: /var/lib/rancher/k3s/server/tls/etcd/peer-ca.crt\nsnapshot-count: 10000\n"})})]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Remediation:"})}),(0,s.jsx)(r.p,{children:"If running on with sqlite or a external DB, etcd checks are Not Applicable.\nWhen running with embedded-etcd, K3s generates peer cert and key files for etcd.\nThese are located in /var/lib/rancher/k3s/server/tls/etcd/.\nIf this check fails, ensure that the configuration file /var/lib/rancher/k3s/server/db/etcd/config\nhas not been modified to use custom peer cert and key files."})]}),"\n",(0,s.jsx)(r.h3,{id:"25-ensure-that-the---peer-client-cert-auth-argument-is-set-to-true-automated",children:"2.5 Ensure that the --peer-client-cert-auth argument is set to true (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result:"})," '.peer-transport-security.client-cert-auth' is equal to 'true'"]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Returned Value:"})}),(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:"advertise-client-urls: https://10.10.10.100:2379\nclient-transport-security:\n cert-file: /var/lib/rancher/k3s/server/tls/etcd/server-client.crt\n client-cert-auth: true\n key-file: /var/lib/rancher/k3s/server/tls/etcd/server-client.key\n trusted-ca-file: /var/lib/rancher/k3s/server/tls/etcd/server-ca.crt\ndata-dir: /var/lib/rancher/k3s/server/db/etcd\nelection-timeout: 5000\nexperimental-initial-corrupt-check: true\nheartbeat-interval: 500\ninitial-advertise-peer-urls: https://10.10.10.100:2380\ninitial-cluster: server-0-ee1de912=https://10.10.10.100:2380\ninitial-cluster-state: new\nlisten-client-urls: https://127.0.0.1:2379,https://10.10.10.100:2379\nlisten-metrics-urls: http://127.0.0.1:2381\nlisten-peer-urls: https://127.0.0.1:2380,https://10.10.10.100:2380\nlog-outputs:\n- stderr\nlogger: zap\nname: server-0-ee1de912\npeer-transport-security:\n cert-file: /var/lib/rancher/k3s/server/tls/etcd/peer-server-client.crt\n client-cert-auth: true\n key-file: /var/lib/rancher/k3s/server/tls/etcd/peer-server-client.key\n trusted-ca-file: /var/lib/rancher/k3s/server/tls/etcd/peer-ca.crt\nsnapshot-count: 10000\n"})})]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Remediation:"})}),(0,s.jsx)(r.p,{children:"If running on with sqlite or a external DB, etcd checks are Not Applicable.\nWhen running with embedded-etcd, K3s sets the --peer-cert-auth parameter to true.\nIf this check fails, ensure that the configuration file /var/lib/rancher/k3s/server/db/etcd/config\nhas not been modified to disable peer client certificate authentication."})]}),"\n",(0,s.jsx)(r.h3,{id:"26-ensure-that-the---peer-auto-tls-argument-is-not-set-to-true-automated",children:"2.6 Ensure that the --peer-auto-tls argument is not set to true (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result:"})," '.peer-transport-security.auto-tls' is present OR '.peer-transport-security.auto-tls' is not present"]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Returned Value:"})}),(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:"advertise-client-urls: https://10.10.10.100:2379\nclient-transport-security:\n cert-file: /var/lib/rancher/k3s/server/tls/etcd/server-client.crt\n client-cert-auth: true\n key-file: /var/lib/rancher/k3s/server/tls/etcd/server-client.key\n trusted-ca-file: /var/lib/rancher/k3s/server/tls/etcd/server-ca.crt\ndata-dir: /var/lib/rancher/k3s/server/db/etcd\nelection-timeout: 5000\nexperimental-initial-corrupt-check: true\nheartbeat-interval: 500\ninitial-advertise-peer-urls: https://10.10.10.100:2380\ninitial-cluster: server-0-ee1de912=https://10.10.10.100:2380\ninitial-cluster-state: new\nlisten-client-urls: https://127.0.0.1:2379,https://10.10.10.100:2379\nlisten-metrics-urls: http://127.0.0.1:2381\nlisten-peer-urls: https://127.0.0.1:2380,https://10.10.10.100:2380\nlog-outputs:\n- stderr\nlogger: zap\nname: server-0-ee1de912\npeer-transport-security:\n cert-file: /var/lib/rancher/k3s/server/tls/etcd/peer-server-client.crt\n client-cert-auth: true\n key-file: /var/lib/rancher/k3s/server/tls/etcd/peer-server-client.key\n trusted-ca-file: /var/lib/rancher/k3s/server/tls/etcd/peer-ca.crt\nsnapshot-count: 10000\n"})})]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Remediation:"})}),(0,s.jsx)(r.p,{children:"If running on with sqlite or a external DB, etcd checks are Not Applicable.\nWhen running with embedded-etcd, K3s does not set the --peer-auto-tls parameter.\nIf this check fails, edit the etcd pod specification file /var/lib/rancher/k3s/server/db/etcd/config on the master\nnode and either remove the --peer-auto-tls parameter or set it to false.\npeer-transport-security:\nauto-tls: false"})]}),"\n",(0,s.jsx)(r.h3,{id:"27-ensure-that-a-unique-certificate-authority-is-used-for-etcd-automated",children:"2.7 Ensure that a unique Certificate Authority is used for etcd (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result:"})," '.peer-transport-security.trusted-ca-file' is equal to '/var/lib/rancher/k3s/server/tls/etcd/peer-ca.crt'"]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Returned Value:"})}),(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:"advertise-client-urls: https://10.10.10.100:2379\nclient-transport-security:\n cert-file: /var/lib/rancher/k3s/server/tls/etcd/server-client.crt\n client-cert-auth: true\n key-file: /var/lib/rancher/k3s/server/tls/etcd/server-client.key\n trusted-ca-file: /var/lib/rancher/k3s/server/tls/etcd/server-ca.crt\ndata-dir: /var/lib/rancher/k3s/server/db/etcd\nelection-timeout: 5000\nexperimental-initial-corrupt-check: true\nheartbeat-interval: 500\ninitial-advertise-peer-urls: https://10.10.10.100:2380\ninitial-cluster: server-0-ee1de912=https://10.10.10.100:2380\ninitial-cluster-state: new\nlisten-client-urls: https://127.0.0.1:2379,https://10.10.10.100:2379\nlisten-metrics-urls: http://127.0.0.1:2381\nlisten-peer-urls: https://127.0.0.1:2380,https://10.10.10.100:2380\nlog-outputs:\n- stderr\nlogger: zap\nname: server-0-ee1de912\npeer-transport-security:\n cert-file: /var/lib/rancher/k3s/server/tls/etcd/peer-server-client.crt\n client-cert-auth: true\n key-file: /var/lib/rancher/k3s/server/tls/etcd/peer-server-client.key\n trusted-ca-file: /var/lib/rancher/k3s/server/tls/etcd/peer-ca.crt\nsnapshot-count: 10000\n"})})]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Remediation:"})}),(0,s.jsx)(r.p,{children:"If running on with sqlite or a external DB, etcd checks are Not Applicable.\nWhen running with embedded-etcd, K3s generates a unique certificate authority for etcd.\nThis is located at /var/lib/rancher/k3s/server/tls/etcd/peer-ca.crt.\nIf this check fails, ensure that the configuration file /var/lib/rancher/k3s/server/db/etcd/config\nhas not been modified to use a shared certificate authority."})]}),"\n",(0,s.jsx)(r.h2,{id:"41-worker-node-configuration-files",children:"4.1 Worker Node Configuration Files"}),"\n",(0,s.jsx)(r.h3,{id:"411-ensure-that-the-kubelet-service-file-permissions-are-set-to-600-or-more-restrictive-automated",children:"4.1.1 Ensure that the kubelet service file permissions are set to 600 or more restrictive (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," Not Applicable"]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Rationale:"})}),"\n",(0,s.jsx)(r.p,{children:"The kubelet is embedded in the k3s process. There is no kubelet service file, all configuration is passed in as arguments at runtime."}),"\n",(0,s.jsxs)(r.h3,{id:"412-ensure-that-the-kubelet-service-file-ownership-is-set-to-root-automated",children:["4.1.2 Ensure that the kubelet service file ownership is set to root",":root"," (Automated)"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," Not Applicable"]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Rationale:"})}),"\n",(0,s.jsx)(r.p,{children:"The kubelet is embedded in the k3s process. There is no kubelet service file, all configuration is passed in as arguments at runtime."}),"\n",(0,s.jsx)(r.h3,{id:"413-if-proxy-kubeconfig-file-exists-ensure-permissions-are-set-to-600-or-more-restrictive-automated",children:"4.1.3 If proxy kubeconfig file exists ensure permissions are set to 600 or more restrictive (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"/bin/sh -c 'if test -e /var/lib/rancher/k3s/agent/kubeproxy.kubeconfig; then stat -c permissions=%a /var/lib/rancher/k3s/agent/kubeproxy.kubeconfig; fi' \n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result:"})," permissions has permissions 600, expected 600 or more restrictive"]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Returned Value:"})}),(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:"permissions=600\n"})})]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Remediation:"})}),(0,s.jsxs)(r.p,{children:["Run the below command (based on the file location on your system) on the each worker node.\nFor example,\n",(0,s.jsx)(r.code,{children:"chmod 600 /var/lib/rancher/k3s/agent/kubeproxy.kubeconfig"})]})]}),"\n",(0,s.jsxs)(r.h3,{id:"414-if-proxy-kubeconfig-file-exists-ensure-ownership-is-set-to-root-automated",children:["4.1.4 If proxy kubeconfig file exists ensure ownership is set to root",":root"," (Automated)"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"stat -c %U:%G /var/lib/rancher/k3s/agent/kubeproxy.kubeconfig\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result:"})," 'root",":root","' is present"]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Returned Value:"})}),(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:"root:root\n"})})]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Remediation:"})}),(0,s.jsxs)(r.p,{children:["Run the below command (based on the file location on your system) on the each worker node.\nFor example, ",(0,s.jsx)(r.code,{children:"chown root:root /var/lib/rancher/k3s/agent/kubeproxy.kubeconfig"})]})]}),"\n",(0,s.jsx)(r.h3,{id:"415-ensure-that-the---kubeconfig-kubeletconf-file-permissions-are-set-to-600-or-more-restrictive-automated",children:"4.1.5 Ensure that the --kubeconfig kubelet.conf file permissions are set to 600 or more restrictive (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"/bin/sh -c 'if test -e /var/lib/rancher/k3s/agent/kubelet.kubeconfig; then stat -c permissions=%a /var/lib/rancher/k3s/agent/kubelet.kubeconfig; fi' \n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result:"})," permissions has permissions 600, expected 600 or more restrictive"]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Returned Value:"})}),(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:"permissions=600\n"})})]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Remediation:"})}),(0,s.jsxs)(r.p,{children:["Run the below command (based on the file location on your system) on the each worker node.\nFor example,\n",(0,s.jsx)(r.code,{children:"chmod 600 /var/lib/rancher/k3s/agent/kubelet.kubeconfig"})]})]}),"\n",(0,s.jsxs)(r.h3,{id:"416-ensure-that-the---kubeconfig-kubeletconf-file-ownership-is-set-to-root-automated",children:["4.1.6 Ensure that the --kubeconfig kubelet.conf file ownership is set to root",":root"," (Automated)"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"stat -c %U:%G /var/lib/rancher/k3s/agent/kubelet.kubeconfig\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result:"})," 'root",":root","' is equal to 'root",":root","'"]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Returned Value:"})}),(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:"root:root\n"})})]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Remediation:"})}),(0,s.jsxs)(r.p,{children:["Run the below command (based on the file location on your system) on the each worker node.\nFor example,\n",(0,s.jsx)(r.code,{children:"chown root:root /var/lib/rancher/k3s/agent/kubelet.kubeconfig"})]})]}),"\n",(0,s.jsx)(r.h3,{id:"417-ensure-that-the-certificate-authorities-file-permissions-are-set-to-600-or-more-restrictive-automated",children:"4.1.7 Ensure that the certificate authorities file permissions are set to 600 or more restrictive (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"stat -c permissions=%a /var/lib/rancher/k3s/agent/client-ca.crt\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result:"})," permissions has permissions 600, expected 600 or more restrictive"]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Returned Value:"})}),(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:"permissions=600\n"})})]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Remediation:"})}),(0,s.jsxs)(r.p,{children:["Run the following command to modify the file permissions of the\n--client-ca-file ",(0,s.jsx)(r.code,{children:"chmod 600 /var/lib/rancher/k3s/agent/client-ca.crt"})]})]}),"\n",(0,s.jsxs)(r.h3,{id:"418-ensure-that-the-client-certificate-authorities-file-ownership-is-set-to-root-automated",children:["4.1.8 Ensure that the client certificate authorities file ownership is set to root",":root"," (Automated)"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"stat -c %U:%G /var/lib/rancher/k3s/agent/client-ca.crt\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result:"})," 'root",":root","' is equal to 'root",":root","'"]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Returned Value:"})}),(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:"root:root\n"})})]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Remediation:"})}),(0,s.jsxs)(r.p,{children:["Run the following command to modify the ownership of the --client-ca-file.\n",(0,s.jsx)(r.code,{children:"chown root:root /var/lib/rancher/k3s/agent/client-ca.crt"})]})]}),"\n",(0,s.jsx)(r.h3,{id:"419-if-the-kubelet-configyaml-configuration-file-is-being-used-validate-permissions-set-to-600-or-more-restrictive-automated",children:"4.1.9 If the kubelet config.yaml configuration file is being used validate permissions set to 600 or more restrictive (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," Not Applicable"]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Rationale:"})}),"\n",(0,s.jsx)(r.p,{children:"The kubelet is embedded in the k3s process. There is no kubelet config file, all configuration is passed in as arguments at runtime."}),"\n",(0,s.jsxs)(r.h3,{id:"4110-if-the-kubelet-configyaml-configuration-file-is-being-used-validate-file-ownership-is-set-to-root-automated",children:["4.1.10 If the kubelet config.yaml configuration file is being used validate file ownership is set to root",":root"," (Automated)"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," Not Applicable"]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Rationale:"})}),"\n",(0,s.jsx)(r.p,{children:"The kubelet is embedded in the k3s process. There is no kubelet config file, all configuration is passed in as arguments at runtime."}),"\n",(0,s.jsx)(r.h2,{id:"42-kubelet",children:"4.2 Kubelet"}),"\n",(0,s.jsx)(r.h3,{id:"421-ensure-that-the---anonymous-auth-argument-is-set-to-false-automated",children:"4.2.1 Ensure that the --anonymous-auth argument is set to false (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:'/bin/sh -c \'if test $(journalctl -D /var/log/journal -u k3s | grep "Running kube-apiserver" | wc -l) -gt 0; then journalctl -D /var/log/journal -u k3s | grep "Running kube-apiserver" | tail -n1 | grep "anonymous-auth" | grep -v grep; else echo "--anonymous-auth=false"; fi\' \n'})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result:"})," '--anonymous-auth' is equal to 'false'"]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Returned Value:"})}),(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:'Aug 09 18:56:04 server-0 k3s[2366]: time="2024-08-09T18:56:04Z" level=info msg="Running kube-apiserver --advertise-address=10.10.10.100 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,NamespaceLifecycle,ServiceAccount,PodSecurityPolicy --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})})]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Remediation:"})}),(0,s.jsx)(r.p,{children:"By default, K3s sets the --anonymous-auth to false. If you have set this to a different value, you\nshould set it back to false. If using the K3s config file /etc/rancher/k3s/config.yaml, remove any lines similar to below."}),(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{children:'kubelet-arg:\n - "anonymous-auth=true"\n'})}),(0,s.jsx)(r.p,{children:'If using the command line, edit the K3s service file and remove the below argument.\n--kubelet-arg="anonymous-auth=true"\nBased on your system, restart the k3s service. For example,\nsystemctl daemon-reload\nsystemctl restart k3s.service'})]}),"\n",(0,s.jsx)(r.h3,{id:"422-ensure-that-the---authorization-mode-argument-is-not-set-to-alwaysallow-automated",children:"4.2.2 Ensure that the --authorization-mode argument is not set to AlwaysAllow (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:'/bin/sh -c \'if test $(journalctl -D /var/log/journal -u k3s | grep "Running kube-apiserver" | wc -l) -gt 0; then journalctl -D /var/log/journal -u k3s | grep "Running kube-apiserver" | tail -n1 | grep "authorization-mode"; else echo "--authorization-mode=Webhook"; fi\' \n'})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result:"})," '--authorization-mode' does not have 'AlwaysAllow'"]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Returned Value:"})}),(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:'Aug 09 18:56:04 server-0 k3s[2366]: time="2024-08-09T18:56:04Z" level=info msg="Running kube-apiserver --advertise-address=10.10.10.100 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,NamespaceLifecycle,ServiceAccount,PodSecurityPolicy --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})})]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Remediation:"})}),(0,s.jsx)(r.p,{children:"By default, K3s does not set the --authorization-mode to AlwaysAllow.\nIf using the K3s config file /etc/rancher/k3s/config.yaml, remove any lines similar to below."}),(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{children:'kubelet-arg:\n - "authorization-mode=AlwaysAllow"\n'})}),(0,s.jsx)(r.p,{children:'If using the command line, edit the K3s service file and remove the below argument.\n--kubelet-arg="authorization-mode=AlwaysAllow"\nBased on your system, restart the k3s service. For example,\nsystemctl daemon-reload\nsystemctl restart k3s.service'})]}),"\n",(0,s.jsx)(r.h3,{id:"423-ensure-that-the---client-ca-file-argument-is-set-as-appropriate-automated",children:"4.2.3 Ensure that the --client-ca-file argument is set as appropriate (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:'/bin/sh -c \'if test $(journalctl -D /var/log/journal -u k3s | grep "Running kube-apiserver" | wc -l) -gt 0; then journalctl -D /var/log/journal -u k3s | grep "Running kube-apiserver" | tail -n1 | grep "client-ca-file"; else echo "--client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt"; fi\' \n'})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result:"})," '--client-ca-file' is present"]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Returned Value:"})}),(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:'Aug 09 18:56:04 server-0 k3s[2366]: time="2024-08-09T18:56:04Z" level=info msg="Running kube-apiserver --advertise-address=10.10.10.100 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction,NamespaceLifecycle,ServiceAccount,PodSecurityPolicy --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --feature-gates=JobTrackingWithFinalizers=true --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})})]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Remediation:"})}),(0,s.jsx)(r.p,{children:"By default, K3s automatically provides the client ca certificate for the Kubelet.\nIt is generated and located at /var/lib/rancher/k3s/agent/client-ca.crt"})]}),"\n",(0,s.jsx)(r.h3,{id:"424-verify-that-the---read-only-port-argument-is-set-to-0-automated",children:"4.2.4 Verify that the --read-only-port argument is set to 0 (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s -u k3s-agent | grep 'Running kubelet' | tail -n1\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result:"})," '--read-only-port' is equal to '0' OR '--read-only-port' is not present"]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Returned Value:"})}),(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:'Aug 09 18:56:06 server-0 k3s[2366]: time="2024-08-09T18:56:06Z" level=info msg="Running kubelet --address=0.0.0.0 --allowed-unsafe-sysctls=net.ipv4.ip_forward,net.ipv6.conf.all.forwarding --anonymous-auth=false --authentication-token-webhook=true --authorization-mode=Webhook --cgroup-driver=systemd --client-ca-file=/var/lib/rancher/k3s/agent/client-ca.crt --cloud-provider=external --cluster-dns=10.43.0.10 --cluster-domain=cluster.local --container-runtime-endpoint=unix:///run/k3s/containerd/containerd.sock --containerd=/run/k3s/containerd/containerd.sock --event-qps=0 --eviction-hard=imagefs.available<5%,nodefs.available<5% --eviction-minimum-reclaim=imagefs.available=10%,nodefs.available=10% --fail-swap-on=false --healthz-bind-address=127.0.0.1 --hostname-override=server-0 --kubeconfig=/var/lib/rancher/k3s/agent/kubelet.kubeconfig --make-iptables-util-chains=true --node-ip=10.10.10.100 --node-labels= --pod-infra-container-image=rancher/mirrored-pause:3.6 --pod-manifest-path=/var/lib/rancher/k3s/agent/pod-manifests --protect-kernel-defaults=true --read-only-port=0 --resolv-conf=/run/systemd/resolve/resolv.conf --serialize-image-pulls=false --streaming-connection-idle-timeout=5m --tls-cert-file=/var/lib/rancher/k3s/agent/serving-kubelet.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/agent/serving-kubelet.key"\n'})})]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Remediation:"})}),(0,s.jsx)(r.p,{children:"By default, K3s sets the --read-only-port to 0. If you have set this to a different value, you\nshould set it back to 0. If using the K3s config file /etc/rancher/k3s/config.yaml, remove any lines similar to below."}),(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{children:'kubelet-arg:\n - "read-only-port=XXXX"\n'})}),(0,s.jsx)(r.p,{children:'If using the command line, edit the K3s service file and remove the below argument.\n--kubelet-arg="read-only-port=XXXX"\nBased on your system, restart the k3s service. For example,\nsystemctl daemon-reload\nsystemctl restart k3s.service'})]}),"\n",(0,s.jsx)(r.h3,{id:"425-ensure-that-the---streaming-connection-idle-timeout-argument-is-not-set-to-0-manual",children:"4.2.5 Ensure that the --streaming-connection-idle-timeout argument is not set to 0 (Manual)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s -u k3s-agent | grep 'Running kubelet' | tail -n1\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result:"})," '--streaming-connection-idle-timeout' is not equal to '0' OR '--streaming-connection-idle-timeout' is not present"]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Returned Value:"})}),(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:'Aug 09 18:56:06 server-0 k3s[2366]: time="2024-08-09T18:56:06Z" level=info msg="Running kubelet --address=0.0.0.0 --allowed-unsafe-sysctls=net.ipv4.ip_forward,net.ipv6.conf.all.forwarding --anonymous-auth=false --authentication-token-webhook=true --authorization-mode=Webhook --cgroup-driver=systemd --client-ca-file=/var/lib/rancher/k3s/agent/client-ca.crt --cloud-provider=external --cluster-dns=10.43.0.10 --cluster-domain=cluster.local --container-runtime-endpoint=unix:///run/k3s/containerd/containerd.sock --containerd=/run/k3s/containerd/containerd.sock --event-qps=0 --eviction-hard=imagefs.available<5%,nodefs.available<5% --eviction-minimum-reclaim=imagefs.available=10%,nodefs.available=10% --fail-swap-on=false --healthz-bind-address=127.0.0.1 --hostname-override=server-0 --kubeconfig=/var/lib/rancher/k3s/agent/kubelet.kubeconfig --make-iptables-util-chains=true --node-ip=10.10.10.100 --node-labels= --pod-infra-container-image=rancher/mirrored-pause:3.6 --pod-manifest-path=/var/lib/rancher/k3s/agent/pod-manifests --protect-kernel-defaults=true --read-only-port=0 --resolv-conf=/run/systemd/resolve/resolv.conf --serialize-image-pulls=false --streaming-connection-idle-timeout=5m --tls-cert-file=/var/lib/rancher/k3s/agent/serving-kubelet.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/agent/serving-kubelet.key"\n'})})]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Remediation:"})}),(0,s.jsx)(r.p,{children:"If using the K3s config file /etc/rancher/k3s/config.yaml, set the following parameter to an appropriate value."}),(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{children:'kubelet-arg:\n - "streaming-connection-idle-timeout=5m"\n'})}),(0,s.jsx)(r.p,{children:'If using the command line, run K3s with --kubelet-arg="streaming-connection-idle-timeout=5m".\nBased on your system, restart the k3s service. For example,\nsystemctl restart k3s.service'})]}),"\n",(0,s.jsx)(r.h3,{id:"426-ensure-that-the---protect-kernel-defaults-argument-is-set-to-true-automated",children:"4.2.6 Ensure that the --protect-kernel-defaults argument is set to true (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s -u k3s-agent | grep 'Running kubelet' | tail -n1\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result:"})," '--protect-kernel-defaults' is equal to 'true'"]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Returned Value:"})}),(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:'Aug 09 18:56:06 server-0 k3s[2366]: time="2024-08-09T18:56:06Z" level=info msg="Running kubelet --address=0.0.0.0 --allowed-unsafe-sysctls=net.ipv4.ip_forward,net.ipv6.conf.all.forwarding --anonymous-auth=false --authentication-token-webhook=true --authorization-mode=Webhook --cgroup-driver=systemd --client-ca-file=/var/lib/rancher/k3s/agent/client-ca.crt --cloud-provider=external --cluster-dns=10.43.0.10 --cluster-domain=cluster.local --container-runtime-endpoint=unix:///run/k3s/containerd/containerd.sock --containerd=/run/k3s/containerd/containerd.sock --event-qps=0 --eviction-hard=imagefs.available<5%,nodefs.available<5% --eviction-minimum-reclaim=imagefs.available=10%,nodefs.available=10% --fail-swap-on=false --healthz-bind-address=127.0.0.1 --hostname-override=server-0 --kubeconfig=/var/lib/rancher/k3s/agent/kubelet.kubeconfig --make-iptables-util-chains=true --node-ip=10.10.10.100 --node-labels= --pod-infra-container-image=rancher/mirrored-pause:3.6 --pod-manifest-path=/var/lib/rancher/k3s/agent/pod-manifests --protect-kernel-defaults=true --read-only-port=0 --resolv-conf=/run/systemd/resolve/resolv.conf --serialize-image-pulls=false --streaming-connection-idle-timeout=5m --tls-cert-file=/var/lib/rancher/k3s/agent/serving-kubelet.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/agent/serving-kubelet.key"\n'})})]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Remediation:"})}),(0,s.jsx)(r.p,{children:"If using the K3s config file /etc/rancher/k3s/config.yaml, set the following parameter.\nprotect-kernel-defaults: true\nIf using the command line, run K3s with --protect-kernel-defaults=true.\nBased on your system, restart the k3s service. For example,\nsystemctl restart k3s.service"})]}),"\n",(0,s.jsx)(r.h3,{id:"427-ensure-that-the---make-iptables-util-chains-argument-is-set-to-true-automated",children:"4.2.7 Ensure that the --make-iptables-util-chains argument is set to true (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s -u k3s-agent | grep 'Running kubelet' | tail -n1\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result:"})," '--make-iptables-util-chains' is equal to 'true' OR '--make-iptables-util-chains' is not present"]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Returned Value:"})}),(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:'Aug 09 18:56:06 server-0 k3s[2366]: time="2024-08-09T18:56:06Z" level=info msg="Running kubelet --address=0.0.0.0 --allowed-unsafe-sysctls=net.ipv4.ip_forward,net.ipv6.conf.all.forwarding --anonymous-auth=false --authentication-token-webhook=true --authorization-mode=Webhook --cgroup-driver=systemd --client-ca-file=/var/lib/rancher/k3s/agent/client-ca.crt --cloud-provider=external --cluster-dns=10.43.0.10 --cluster-domain=cluster.local --container-runtime-endpoint=unix:///run/k3s/containerd/containerd.sock --containerd=/run/k3s/containerd/containerd.sock --event-qps=0 --eviction-hard=imagefs.available<5%,nodefs.available<5% --eviction-minimum-reclaim=imagefs.available=10%,nodefs.available=10% --fail-swap-on=false --healthz-bind-address=127.0.0.1 --hostname-override=server-0 --kubeconfig=/var/lib/rancher/k3s/agent/kubelet.kubeconfig --make-iptables-util-chains=true --node-ip=10.10.10.100 --node-labels= --pod-infra-container-image=rancher/mirrored-pause:3.6 --pod-manifest-path=/var/lib/rancher/k3s/agent/pod-manifests --protect-kernel-defaults=true --read-only-port=0 --resolv-conf=/run/systemd/resolve/resolv.conf --serialize-image-pulls=false --streaming-connection-idle-timeout=5m --tls-cert-file=/var/lib/rancher/k3s/agent/serving-kubelet.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/agent/serving-kubelet.key"\n'})})]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Remediation:"})}),(0,s.jsx)(r.p,{children:"If using the K3s config file /etc/rancher/k3s/config.yaml, set the following parameter."}),(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{children:'kubelet-arg:\n - "make-iptables-util-chains=true"\n'})}),(0,s.jsx)(r.p,{children:'If using the command line, run K3s with --kubelet-arg="make-iptables-util-chains=true".\nBased on your system, restart the k3s service. For example,\nsystemctl restart k3s.service'})]}),"\n",(0,s.jsx)(r.h3,{id:"428-ensure-that-the---hostname-override-argument-is-not-set-automated",children:"4.2.8 Ensure that the --hostname-override argument is not set (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," Not Applicable"]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Rationale:"})}),"\n",(0,s.jsx)(r.p,{children:"By default, K3s does set the --hostname-override argument. Per CIS guidelines, this is to comply\nwith cloud providers that require this flag to ensure that hostname matches node names."}),"\n",(0,s.jsx)(r.h3,{id:"429-ensure-that-the-eventrecordqps-argument-is-set-to-a-level-which-ensures-appropriate-event-capture-manual",children:"4.2.9 Ensure that the eventRecordQPS argument is set to a level which ensures appropriate event capture (Manual)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s -u k3s-agent | grep 'Running kubelet' | tail -n1\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result:"})," '--event-qps' is equal to '0'"]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Returned Value:"})}),(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:'Aug 09 18:56:06 server-0 k3s[2366]: time="2024-08-09T18:56:06Z" level=info msg="Running kubelet --address=0.0.0.0 --allowed-unsafe-sysctls=net.ipv4.ip_forward,net.ipv6.conf.all.forwarding --anonymous-auth=false --authentication-token-webhook=true --authorization-mode=Webhook --cgroup-driver=systemd --client-ca-file=/var/lib/rancher/k3s/agent/client-ca.crt --cloud-provider=external --cluster-dns=10.43.0.10 --cluster-domain=cluster.local --container-runtime-endpoint=unix:///run/k3s/containerd/containerd.sock --containerd=/run/k3s/containerd/containerd.sock --event-qps=0 --eviction-hard=imagefs.available<5%,nodefs.available<5% --eviction-minimum-reclaim=imagefs.available=10%,nodefs.available=10% --fail-swap-on=false --healthz-bind-address=127.0.0.1 --hostname-override=server-0 --kubeconfig=/var/lib/rancher/k3s/agent/kubelet.kubeconfig --make-iptables-util-chains=true --node-ip=10.10.10.100 --node-labels= --pod-infra-container-image=rancher/mirrored-pause:3.6 --pod-manifest-path=/var/lib/rancher/k3s/agent/pod-manifests --protect-kernel-defaults=true --read-only-port=0 --resolv-conf=/run/systemd/resolve/resolv.conf --serialize-image-pulls=false --streaming-connection-idle-timeout=5m --tls-cert-file=/var/lib/rancher/k3s/agent/serving-kubelet.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/agent/serving-kubelet.key"\n'})})]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Remediation:"})}),(0,s.jsx)(r.p,{children:"By default, K3s sets the event-qps to 0. Should you wish to change this,\nIf using the K3s config file /etc/rancher/k3s/config.yaml, set the following parameter to an appropriate value."}),(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{children:'kubelet-arg:\n - "event-qps="\n'})}),(0,s.jsx)(r.p,{children:'If using the command line, run K3s with --kubelet-arg="event-qps=".\nBased on your system, restart the k3s service. For example,\nsystemctl restart k3s.service'})]}),"\n",(0,s.jsx)(r.h3,{id:"4210-ensure-that-the---tls-cert-file-and---tls-private-key-file-arguments-are-set-as-appropriate-automated",children:"4.2.10 Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s -u k3s-agent | grep 'Running kubelet' | tail -n1\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result:"})," '--tls-cert-file' is present AND '--tls-private-key-file' is present"]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Returned Value:"})}),(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:'Aug 09 18:56:06 server-0 k3s[2366]: time="2024-08-09T18:56:06Z" level=info msg="Running kubelet --address=0.0.0.0 --allowed-unsafe-sysctls=net.ipv4.ip_forward,net.ipv6.conf.all.forwarding --anonymous-auth=false --authentication-token-webhook=true --authorization-mode=Webhook --cgroup-driver=systemd --client-ca-file=/var/lib/rancher/k3s/agent/client-ca.crt --cloud-provider=external --cluster-dns=10.43.0.10 --cluster-domain=cluster.local --container-runtime-endpoint=unix:///run/k3s/containerd/containerd.sock --containerd=/run/k3s/containerd/containerd.sock --event-qps=0 --eviction-hard=imagefs.available<5%,nodefs.available<5% --eviction-minimum-reclaim=imagefs.available=10%,nodefs.available=10% --fail-swap-on=false --healthz-bind-address=127.0.0.1 --hostname-override=server-0 --kubeconfig=/var/lib/rancher/k3s/agent/kubelet.kubeconfig --make-iptables-util-chains=true --node-ip=10.10.10.100 --node-labels= --pod-infra-container-image=rancher/mirrored-pause:3.6 --pod-manifest-path=/var/lib/rancher/k3s/agent/pod-manifests --protect-kernel-defaults=true --read-only-port=0 --resolv-conf=/run/systemd/resolve/resolv.conf --serialize-image-pulls=false --streaming-connection-idle-timeout=5m --tls-cert-file=/var/lib/rancher/k3s/agent/serving-kubelet.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/agent/serving-kubelet.key"\n'})})]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Remediation:"})}),(0,s.jsx)(r.p,{children:"By default, K3s automatically provides the TLS certificate and private key for the Kubelet.\nThey are generated and located at /var/lib/rancher/k3s/agent/serving-kubelet.crt and /var/lib/rancher/k3s/agent/serving-kubelet.key\nIf for some reason you need to provide your own certificate and key, you can set the\nbelow parameters in the K3s config file /etc/rancher/k3s/config.yaml."}),(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{children:'kubelet-arg:\n - "tls-cert-file="\n - "tls-private-key-file="\n'})})]}),"\n",(0,s.jsx)(r.h3,{id:"4211-ensure-that-the---rotate-certificates-argument-is-not-set-to-false-automated",children:"4.2.11 Ensure that the --rotate-certificates argument is not set to false (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s -u k3s-agent | grep 'Running kubelet' | tail -n1\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result:"})," '--rotate-certificates' is present OR '--rotate-certificates' is not present"]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Returned Value:"})}),(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:'Aug 09 18:56:06 server-0 k3s[2366]: time="2024-08-09T18:56:06Z" level=info msg="Running kubelet --address=0.0.0.0 --allowed-unsafe-sysctls=net.ipv4.ip_forward,net.ipv6.conf.all.forwarding --anonymous-auth=false --authentication-token-webhook=true --authorization-mode=Webhook --cgroup-driver=systemd --client-ca-file=/var/lib/rancher/k3s/agent/client-ca.crt --cloud-provider=external --cluster-dns=10.43.0.10 --cluster-domain=cluster.local --container-runtime-endpoint=unix:///run/k3s/containerd/containerd.sock --containerd=/run/k3s/containerd/containerd.sock --event-qps=0 --eviction-hard=imagefs.available<5%,nodefs.available<5% --eviction-minimum-reclaim=imagefs.available=10%,nodefs.available=10% --fail-swap-on=false --healthz-bind-address=127.0.0.1 --hostname-override=server-0 --kubeconfig=/var/lib/rancher/k3s/agent/kubelet.kubeconfig --make-iptables-util-chains=true --node-ip=10.10.10.100 --node-labels= --pod-infra-container-image=rancher/mirrored-pause:3.6 --pod-manifest-path=/var/lib/rancher/k3s/agent/pod-manifests --protect-kernel-defaults=true --read-only-port=0 --resolv-conf=/run/systemd/resolve/resolv.conf --serialize-image-pulls=false --streaming-connection-idle-timeout=5m --tls-cert-file=/var/lib/rancher/k3s/agent/serving-kubelet.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/agent/serving-kubelet.key"\n'})})]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Remediation:"})}),(0,s.jsxs)(r.p,{children:["By default, K3s does not set the --rotate-certificates argument. If you have set this flag with a value of ",(0,s.jsx)(r.code,{children:"false"}),", you should either set it to ",(0,s.jsx)(r.code,{children:"true"}),' or completely remove the flag.\nIf using the K3s config file /etc/rancher/k3s/config.yaml, remove any rotate-certificates parameter.\nIf using the command line, remove the K3s flag --kubelet-arg="rotate-certificates".\nBased on your system, restart the k3s service. For example,\nsystemctl restart k3s.service']})]}),"\n",(0,s.jsx)(r.h3,{id:"4212-verify-that-the-rotatekubeletservercertificate-argument-is-set-to-true-automated",children:"4.2.12 Verify that the RotateKubeletServerCertificate argument is set to true (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s -u k3s-agent | grep 'Running kubelet' | tail -n1\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result:"})," 'RotateKubeletServerCertificate' is present OR 'RotateKubeletServerCertificate' is not present"]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Returned Value:"})}),(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:'Aug 09 18:56:06 server-0 k3s[2366]: time="2024-08-09T18:56:06Z" level=info msg="Running kubelet --address=0.0.0.0 --allowed-unsafe-sysctls=net.ipv4.ip_forward,net.ipv6.conf.all.forwarding --anonymous-auth=false --authentication-token-webhook=true --authorization-mode=Webhook --cgroup-driver=systemd --client-ca-file=/var/lib/rancher/k3s/agent/client-ca.crt --cloud-provider=external --cluster-dns=10.43.0.10 --cluster-domain=cluster.local --container-runtime-endpoint=unix:///run/k3s/containerd/containerd.sock --containerd=/run/k3s/containerd/containerd.sock --event-qps=0 --eviction-hard=imagefs.available<5%,nodefs.available<5% --eviction-minimum-reclaim=imagefs.available=10%,nodefs.available=10% --fail-swap-on=false --healthz-bind-address=127.0.0.1 --hostname-override=server-0 --kubeconfig=/var/lib/rancher/k3s/agent/kubelet.kubeconfig --make-iptables-util-chains=true --node-ip=10.10.10.100 --node-labels= --pod-infra-container-image=rancher/mirrored-pause:3.6 --pod-manifest-path=/var/lib/rancher/k3s/agent/pod-manifests --protect-kernel-defaults=true --read-only-port=0 --resolv-conf=/run/systemd/resolve/resolv.conf --serialize-image-pulls=false --streaming-connection-idle-timeout=5m --tls-cert-file=/var/lib/rancher/k3s/agent/serving-kubelet.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/agent/serving-kubelet.key"\n'})})]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Remediation:"})}),(0,s.jsx)(r.p,{children:'By default, K3s does not set the RotateKubeletServerCertificate feature gate.\nIf you have enabled this feature gate, you should remove it.\nIf using the K3s config file /etc/rancher/k3s/config.yaml, remove any feature-gate=RotateKubeletServerCertificate parameter.\nIf using the command line, remove the K3s flag --kubelet-arg="feature-gate=RotateKubeletServerCertificate".\nBased on your system, restart the k3s service. For example,\nsystemctl restart k3s.service'})]}),"\n",(0,s.jsx)(r.h3,{id:"4213-ensure-that-the-kubelet-only-makes-use-of-strong-cryptographic-ciphers-manual",children:"4.2.13 Ensure that the Kubelet only makes use of Strong Cryptographic Ciphers (Manual)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,s.jsx)(r.p,{children:(0,s.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s -u k3s-agent | grep 'Running kubelet' | tail -n1\n"})}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Expected Result:"})," '--tls-cipher-suites' contains valid elements from 'TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256'"]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Returned Value:"})}),(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{className:"language-console",children:'Aug 09 18:56:06 server-0 k3s[2366]: time="2024-08-09T18:56:06Z" level=info msg="Running kubelet --address=0.0.0.0 --allowed-unsafe-sysctls=net.ipv4.ip_forward,net.ipv6.conf.all.forwarding --anonymous-auth=false --authentication-token-webhook=true --authorization-mode=Webhook --cgroup-driver=systemd --client-ca-file=/var/lib/rancher/k3s/agent/client-ca.crt --cloud-provider=external --cluster-dns=10.43.0.10 --cluster-domain=cluster.local --container-runtime-endpoint=unix:///run/k3s/containerd/containerd.sock --containerd=/run/k3s/containerd/containerd.sock --event-qps=0 --eviction-hard=imagefs.available<5%,nodefs.available<5% --eviction-minimum-reclaim=imagefs.available=10%,nodefs.available=10% --fail-swap-on=false --healthz-bind-address=127.0.0.1 --hostname-override=server-0 --kubeconfig=/var/lib/rancher/k3s/agent/kubelet.kubeconfig --make-iptables-util-chains=true --node-ip=10.10.10.100 --node-labels= --pod-infra-container-image=rancher/mirrored-pause:3.6 --pod-manifest-path=/var/lib/rancher/k3s/agent/pod-manifests --protect-kernel-defaults=true --read-only-port=0 --resolv-conf=/run/systemd/resolve/resolv.conf --serialize-image-pulls=false --streaming-connection-idle-timeout=5m --tls-cert-file=/var/lib/rancher/k3s/agent/serving-kubelet.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/agent/serving-kubelet.key"\n'})})]}),"\n",(0,s.jsxs)(t,{children:[(0,s.jsx)("summary",{children:(0,s.jsx)("b",{children:"Remediation:"})}),(0,s.jsxs)(r.p,{children:["If using a K3s config file /etc/rancher/k3s/config.yaml, edit the file to set ",(0,s.jsx)(r.code,{children:"TLSCipherSuites"})," to"]}),(0,s.jsx)(r.pre,{children:(0,s.jsx)(r.code,{children:'kubelet-arg:\n - "tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305"\n'})}),(0,s.jsx)(r.p,{children:'or to a subset of these values.\nIf using the command line, add the K3s flag --kubelet-arg="tls-cipher-suites="\nBased on your system, restart the k3s service. For example,\nsystemctl restart k3s.service'})]}),"\n",(0,s.jsx)(r.h2,{id:"51-rbac-and-service-accounts",children:"5.1 RBAC and Service Accounts"}),"\n",(0,s.jsx)(r.h3,{id:"511-ensure-that-the-cluster-admin-role-is-only-used-where-required-manual",children:"5.1.1 Ensure that the cluster-admin role is only used where required (Manual)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nIdentify all clusterrolebindings to the cluster-admin role. Check if they are used and\nif they need this role or if they could use a role with fewer privileges.\nWhere possible, first bind users to a lower privileged role and then remove the\nclusterrolebinding to the cluster-admin role :\nkubectl delete clusterrolebinding [name]"]}),"\n",(0,s.jsx)(r.h3,{id:"512-minimize-access-to-secrets-manual",children:"5.1.2 Minimize access to secrets (Manual)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nWhere possible, remove get, list and watch access to Secret objects in the cluster."]}),"\n",(0,s.jsx)(r.h3,{id:"513-minimize-wildcard-use-in-roles-and-clusterroles-manual",children:"5.1.3 Minimize wildcard use in Roles and ClusterRoles (Manual)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nWhere possible replace any use of wildcards in clusterroles and roles with specific\nobjects or actions."]}),"\n",(0,s.jsx)(r.h3,{id:"514-minimize-access-to-create-pods-manual",children:"5.1.4 Minimize access to create pods (Manual)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nWhere possible, remove create access to pod objects in the cluster."]}),"\n",(0,s.jsx)(r.h3,{id:"515-ensure-that-default-service-accounts-are-not-actively-used-manual",children:"5.1.5 Ensure that default service accounts are not actively used. (Manual)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nCreate explicit service accounts wherever a Kubernetes workload requires specific access\nto the Kubernetes API server.\nModify the configuration of each default service account to include this value\nautomountServiceAccountToken: false"]}),"\n",(0,s.jsx)(r.h3,{id:"516-ensure-that-service-account-tokens-are-only-mounted-where-necessary-manual",children:"5.1.6 Ensure that Service Account Tokens are only mounted where necessary (Manual)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nModify the definition of pods and service accounts which do not need to mount service\naccount tokens to disable it."]}),"\n",(0,s.jsxs)(r.h3,{id:"517-avoid-use-of-system-group-manual",children:["5.1.7 Avoid use of system",":masters"," group (Manual)"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nRemove the system",":masters"," group from all users in the cluster."]}),"\n",(0,s.jsx)(r.h3,{id:"518-limit-use-of-the-bind-impersonate-and-escalate-permissions-in-the-kubernetes-cluster-manual",children:"5.1.8 Limit use of the Bind, Impersonate and Escalate permissions in the Kubernetes cluster (Manual)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nWhere possible, remove the impersonate, bind and escalate rights from subjects."]}),"\n",(0,s.jsx)(r.h2,{id:"52-pod-security-standards",children:"5.2 Pod Security Standards"}),"\n",(0,s.jsx)(r.h3,{id:"521-ensure-that-the-cluster-has-at-least-one-active-policy-control-mechanism-in-place-manual",children:"5.2.1 Ensure that the cluster has at least one active policy control mechanism in place (Manual)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nEnsure that either Pod Security Admission or an external policy control system is in place\nfor every namespace which contains user workloads."]}),"\n",(0,s.jsx)(r.h3,{id:"522-minimize-the-admission-of-privileged-containers-manual",children:"5.2.2 Minimize the admission of privileged containers (Manual)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nAdd policies to each namespace in the cluster which has user workloads to restrict the\nadmission of privileged containers."]}),"\n",(0,s.jsx)(r.h3,{id:"523-minimize-the-admission-of-containers-wishing-to-share-the-host-process-id-namespace-automated",children:"5.2.3 Minimize the admission of containers wishing to share the host process ID namespace (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nAdd policies to each namespace in the cluster which has user workloads to restrict the\nadmission of ",(0,s.jsx)(r.code,{children:"hostPID"})," containers."]}),"\n",(0,s.jsx)(r.h3,{id:"524-minimize-the-admission-of-containers-wishing-to-share-the-host-ipc-namespace-automated",children:"5.2.4 Minimize the admission of containers wishing to share the host IPC namespace (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nAdd policies to each namespace in the cluster which has user workloads to restrict the\nadmission of ",(0,s.jsx)(r.code,{children:"hostIPC"})," containers."]}),"\n",(0,s.jsx)(r.h3,{id:"525-minimize-the-admission-of-containers-wishing-to-share-the-host-network-namespace-automated",children:"5.2.5 Minimize the admission of containers wishing to share the host network namespace (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nAdd policies to each namespace in the cluster which has user workloads to restrict the\nadmission of ",(0,s.jsx)(r.code,{children:"hostNetwork"})," containers."]}),"\n",(0,s.jsx)(r.h3,{id:"526-minimize-the-admission-of-containers-with-allowprivilegeescalation-automated",children:"5.2.6 Minimize the admission of containers with allowPrivilegeEscalation (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nAdd policies to each namespace in the cluster which has user workloads to restrict the\nadmission of containers with ",(0,s.jsx)(r.code,{children:".spec.allowPrivilegeEscalation"})," set to ",(0,s.jsx)(r.code,{children:"true"}),"."]}),"\n",(0,s.jsx)(r.h3,{id:"527-minimize-the-admission-of-root-containers-automated",children:"5.2.7 Minimize the admission of root containers (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nCreate a policy for each namespace in the cluster, ensuring that either ",(0,s.jsx)(r.code,{children:"MustRunAsNonRoot"}),"\nor ",(0,s.jsx)(r.code,{children:"MustRunAs"})," with the range of UIDs not including 0, is set."]}),"\n",(0,s.jsx)(r.h3,{id:"528-minimize-the-admission-of-containers-with-the-net_raw-capability-automated",children:"5.2.8 Minimize the admission of containers with the NET_RAW capability (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nAdd policies to each namespace in the cluster which has user workloads to restrict the\nadmission of containers with the ",(0,s.jsx)(r.code,{children:"NET_RAW"})," capability."]}),"\n",(0,s.jsx)(r.h3,{id:"529-minimize-the-admission-of-containers-with-added-capabilities-automated",children:"5.2.9 Minimize the admission of containers with added capabilities (Automated)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nEnsure that ",(0,s.jsx)(r.code,{children:"allowedCapabilities"})," is not present in policies for the cluster unless\nit is set to an empty array."]}),"\n",(0,s.jsx)(r.h3,{id:"5210-minimize-the-admission-of-containers-with-capabilities-assigned-manual",children:"5.2.10 Minimize the admission of containers with capabilities assigned (Manual)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nReview the use of capabilities in applications running on your cluster. Where a namespace\ncontains applications which do not require any Linux capabities to operate consider adding\na PSP which forbids the admission of containers which do not drop all capabilities."]}),"\n",(0,s.jsx)(r.h3,{id:"5211-minimize-the-admission-of-windows-hostprocess-containers-manual",children:"5.2.11 Minimize the admission of Windows HostProcess containers (Manual)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nAdd policies to each namespace in the cluster which has user workloads to restrict the\nadmission of containers that have ",(0,s.jsx)(r.code,{children:".securityContext.windowsOptions.hostProcess"})," set to ",(0,s.jsx)(r.code,{children:"true"}),"."]}),"\n",(0,s.jsx)(r.h3,{id:"5212-minimize-the-admission-of-hostpath-volumes-manual",children:"5.2.12 Minimize the admission of HostPath volumes (Manual)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nAdd policies to each namespace in the cluster which has user workloads to restrict the\nadmission of containers with ",(0,s.jsx)(r.code,{children:"hostPath"})," volumes."]}),"\n",(0,s.jsx)(r.h3,{id:"5213-minimize-the-admission-of-containers-which-use-hostports-manual",children:"5.2.13 Minimize the admission of containers which use HostPorts (Manual)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nAdd policies to each namespace in the cluster which has user workloads to restrict the\nadmission of containers which use ",(0,s.jsx)(r.code,{children:"hostPort"})," sections."]}),"\n",(0,s.jsx)(r.h2,{id:"53-network-policies-and-cni",children:"5.3 Network Policies and CNI"}),"\n",(0,s.jsx)(r.h3,{id:"531-ensure-that-the-cni-in-use-supports-networkpolicies-manual",children:"5.3.1 Ensure that the CNI in use supports NetworkPolicies (Manual)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nIf the CNI plugin in use does not support network policies, consideration should be given to\nmaking use of a different plugin, or finding an alternate mechanism for restricting traffic\nin the Kubernetes cluster."]}),"\n",(0,s.jsx)(r.h3,{id:"532-ensure-that-all-namespaces-have-networkpolicies-defined-manual",children:"5.3.2 Ensure that all Namespaces have NetworkPolicies defined (Manual)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nFollow the documentation and create NetworkPolicy objects as you need them."]}),"\n",(0,s.jsx)(r.h2,{id:"54-secrets-management",children:"5.4 Secrets Management"}),"\n",(0,s.jsx)(r.h3,{id:"541-prefer-using-secrets-as-files-over-secrets-as-environment-variables-manual",children:"5.4.1 Prefer using Secrets as files over Secrets as environment variables (Manual)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nIf possible, rewrite application code to read Secrets from mounted secret files, rather than\nfrom environment variables."]}),"\n",(0,s.jsx)(r.h3,{id:"542-consider-external-secret-storage-manual",children:"5.4.2 Consider external secret storage (Manual)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nRefer to the Secrets management options offered by your cloud provider or a third-party\nsecrets management solution."]}),"\n",(0,s.jsx)(r.h2,{id:"55-extensible-admission-control",children:"5.5 Extensible Admission Control"}),"\n",(0,s.jsx)(r.h3,{id:"551-configure-image-provenance-using-imagepolicywebhook-admission-controller-manual",children:"5.5.1 Configure Image Provenance using ImagePolicyWebhook admission controller (Manual)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nFollow the Kubernetes documentation and setup image provenance."]}),"\n",(0,s.jsx)(r.h2,{id:"57-general-policies",children:"5.7 General Policies"}),"\n",(0,s.jsx)(r.h3,{id:"571-create-administrative-boundaries-between-resources-using-namespaces-manual",children:"5.7.1 Create administrative boundaries between resources using namespaces (Manual)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nFollow the documentation and create namespaces for objects in your deployment as you need\nthem."]}),"\n",(0,s.jsx)(r.h3,{id:"572-ensure-that-the-seccomp-profile-is-set-to-dockerdefault-in-your-pod-definitions-manual",children:"5.7.2 Ensure that the seccomp profile is set to docker/default in your Pod definitions (Manual)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nUse ",(0,s.jsx)(r.code,{children:"securityContext"})," to enable the docker/default seccomp profile in your pod definitions.\nAn example is as below:\nsecurityContext:\nseccompProfile:\ntype: RuntimeDefault"]}),"\n",(0,s.jsx)(r.h3,{id:"573-apply-securitycontext-to-your-pods-and-containers-manual",children:"5.7.3 Apply SecurityContext to your Pods and Containers (Manual)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nFollow the Kubernetes documentation and apply SecurityContexts to your Pods. For a\nsuggested list of SecurityContexts, you may refer to the CIS Security Benchmark for Docker\nContainers."]}),"\n",(0,s.jsx)(r.h3,{id:"574-the-default-namespace-should-not-be-used-manual",children:"5.7.4 The default namespace should not be used (Manual)"}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,s.jsxs)(r.p,{children:[(0,s.jsx)(r.strong,{children:"Remediation:"}),"\nEnsure that namespaces are created to allow for appropriate segregation of Kubernetes\nresources and that all new resources are created in a specific namespace."]})]})}function u(e={}){const{wrapper:r}={...(0,n.a)(),...e.components};return r?(0,s.jsx)(r,{...e,children:(0,s.jsx)(d,{...e})}):d(e)}},1151:(e,r,t)=>{t.d(r,{Z:()=>l,a:()=>a});var s=t(7294);const n={},i=s.createContext(n);function a(e){const r=s.useContext(i);return s.useMemo((function(){return"function"==typeof e?e(r):{...r,...e}}),[r,e])}function l(e){let r;return r=e.disableParentContext?"function"==typeof e.components?e.components(n):e.components||n:a(e.components),s.createElement(i.Provider,{value:r},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/ac75af2e.24e1c6b5.js b/assets/js/ac75af2e.1880f0c7.js similarity index 99% rename from assets/js/ac75af2e.24e1c6b5.js rename to assets/js/ac75af2e.1880f0c7.js index 6f200c637..321040e70 100644 --- a/assets/js/ac75af2e.24e1c6b5.js +++ b/assets/js/ac75af2e.1880f0c7.js @@ -1 +1 @@ -"use strict";(self.webpackChunkk_3_s_docs=self.webpackChunkk_3_s_docs||[]).push([[1199],{6455:(e,n,t)=>{t.r(n),t.d(n,{assets:()=>o,contentTitle:()=>d,default:()=>h,frontMatter:()=>i,metadata:()=>l,toc:()=>a});var s=t(5893),r=t(1151);const i={title:"Requirements"},d=void 0,l={id:"installation/requirements",title:"Requirements",description:"K3s is very lightweight, but has some minimum requirements as outlined below.",source:"@site/docs/installation/requirements.md",sourceDirName:"installation",slug:"/installation/requirements",permalink:"/installation/requirements",draft:!1,unlisted:!1,editUrl:"https://github.com/k3s-io/docs/edit/main/docs/installation/requirements.md",tags:[],version:"current",lastUpdatedAt:1723651727e3,frontMatter:{title:"Requirements"},sidebar:"mySidebar",previous:{title:"Installation",permalink:"/installation/"},next:{title:"Configuration Options",permalink:"/installation/configuration"}},o={},a=[{value:"Prerequisites",id:"prerequisites",level:2},{value:"Architecture",id:"architecture",level:2},{value:"Operating Systems",id:"operating-systems",level:2},{value:"Hardware",id:"hardware",level:2},{value:"Disks",id:"disks",level:4},{value:"Networking",id:"networking",level:2},{value:"Inbound Rules for K3s Nodes",id:"inbound-rules-for-k3s-nodes",level:3},{value:"Large Clusters",id:"large-clusters",level:2},{value:"CPU and Memory",id:"cpu-and-memory",level:3},{value:"Disks",id:"disks-1",level:3},{value:"Network",id:"network",level:3},{value:"Database",id:"database",level:3}];function c(e){const n={a:"a",admonition:"admonition",code:"code",h2:"h2",h3:"h3",h4:"h4",li:"li",p:"p",pre:"pre",strong:"strong",table:"table",tbody:"tbody",td:"td",th:"th",thead:"thead",tr:"tr",ul:"ul",...(0,r.a)(),...e.components},{TabItem:t,Tabs:i}=n;return t||u("TabItem",!0),i||u("Tabs",!0),(0,s.jsxs)(s.Fragment,{children:[(0,s.jsx)(n.p,{children:"K3s is very lightweight, but has some minimum requirements as outlined below."}),"\n",(0,s.jsx)(n.p,{children:"Whether you're configuring K3s to run in a container or as a native Linux service, each node running K3s should meet the following minimum requirements. These requirements are baseline for K3s and its packaged components, and do not include resources consumed by the workload itself."}),"\n",(0,s.jsx)(n.h2,{id:"prerequisites",children:"Prerequisites"}),"\n",(0,s.jsx)(n.p,{children:"Two nodes cannot have the same hostname."}),"\n",(0,s.jsxs)(n.p,{children:["If multiple nodes will have the same hostname, or if hostnames may be reused by an automated provisioning system, use the ",(0,s.jsx)(n.code,{children:"--with-node-id"})," option to append a random suffix for each node, or devise a unique name to pass with ",(0,s.jsx)(n.code,{children:"--node-name"})," or ",(0,s.jsx)(n.code,{children:"$K3S_NODE_NAME"})," for each node you add to the cluster."]}),"\n",(0,s.jsx)(n.h2,{id:"architecture",children:"Architecture"}),"\n",(0,s.jsx)(n.p,{children:"K3s is available for the following architectures:"}),"\n",(0,s.jsxs)(n.ul,{children:["\n",(0,s.jsx)(n.li,{children:"x86_64"}),"\n",(0,s.jsx)(n.li,{children:"armhf"}),"\n",(0,s.jsx)(n.li,{children:"arm64/aarch64"}),"\n",(0,s.jsx)(n.li,{children:"s390x"}),"\n"]}),"\n",(0,s.jsx)(n.admonition,{title:"ARM64 Page Size",type:"warning",children:(0,s.jsxs)(n.p,{children:["Prior to May 2023 releases (v1.24.14+k3s1, v1.25.10+k3s1, v1.26.5+k3s1, v1.27.2+k3s1), on ",(0,s.jsx)(n.code,{children:"aarch64/arm64"})," systems, the kernel must use 4k pages. ",(0,s.jsx)(n.strong,{children:"RHEL9"}),", ",(0,s.jsx)(n.strong,{children:"Ubuntu"}),", ",(0,s.jsx)(n.strong,{children:"Raspberry PI OS"}),", and ",(0,s.jsx)(n.strong,{children:"SLES"})," all meet this requirement."]})}),"\n",(0,s.jsx)(n.h2,{id:"operating-systems",children:"Operating Systems"}),"\n",(0,s.jsx)(n.p,{children:"K3s is expected to work on most modern Linux systems."}),"\n",(0,s.jsx)(n.p,{children:"Some OSs have additional setup requirements:"}),"\n",(0,s.jsxs)(i,{queryString:"os",children:[(0,s.jsxs)(t,{value:"suse",label:"SUSE Linux Enterprise / openSUSE",children:[(0,s.jsx)(n.p,{children:"It is recommended to turn off firewalld:"}),(0,s.jsx)(n.pre,{children:(0,s.jsx)(n.code,{className:"language-bash",children:"systemctl disable firewalld --now\n"})}),(0,s.jsx)(n.p,{children:"If you wish to keep firewalld enabled, by default, the following rules are required:"}),(0,s.jsx)(n.pre,{children:(0,s.jsx)(n.code,{className:"language-bash",children:"firewall-cmd --permanent --add-port=6443/tcp #apiserver\nfirewall-cmd --permanent --zone=trusted --add-source=10.42.0.0/16 #pods\nfirewall-cmd --permanent --zone=trusted --add-source=10.43.0.0/16 #services\nfirewall-cmd --reload\n"})}),(0,s.jsxs)(n.p,{children:["Additional ports may need to be opened depending on your setup. See ",(0,s.jsx)(n.a,{href:"#inbound-rules-for-k3s-nodes",children:"Inbound Rules"})," for more information. If you change the default CIDR for pods or services, you will need to update the firewall rules accordingly."]})]}),(0,s.jsxs)(t,{value:"rhel",label:"Red Hat Enterprise Linux / CentOS / Fedora",children:[(0,s.jsx)(n.p,{children:"It is recommended to turn off firewalld:"}),(0,s.jsx)(n.pre,{children:(0,s.jsx)(n.code,{className:"language-bash",children:"systemctl disable firewalld --now\n"})}),(0,s.jsx)(n.p,{children:"If you wish to keep firewalld enabled, by default, the following rules are required:"}),(0,s.jsx)(n.pre,{children:(0,s.jsx)(n.code,{className:"language-bash",children:"firewall-cmd --permanent --add-port=6443/tcp #apiserver\nfirewall-cmd --permanent --zone=trusted --add-source=10.42.0.0/16 #pods\nfirewall-cmd --permanent --zone=trusted --add-source=10.43.0.0/16 #services\nfirewall-cmd --reload\n"})}),(0,s.jsxs)(n.p,{children:["Additional ports may need to be opened depending on your setup. See ",(0,s.jsx)(n.a,{href:"#inbound-rules-for-k3s-nodes",children:"Inbound Rules"})," for more information. If you change the default CIDR for pods or services, you will need to update the firewall rules accordingly."]}),(0,s.jsx)(n.p,{children:"If enabled, it is required to disable nm-cloud-setup and reboot the node:"}),(0,s.jsx)(n.pre,{children:(0,s.jsx)(n.code,{className:"language-bash",children:"systemctl disable nm-cloud-setup.service nm-cloud-setup.timer\nreboot\n"})})]}),(0,s.jsxs)(t,{value:"debian",label:"Ubuntu / Debian",children:[(0,s.jsxs)(n.p,{children:["Older Debian release may suffer from a known iptables bug. See ",(0,s.jsx)(n.a,{href:"/known-issues#iptables",children:"Known Issues"}),"."]}),(0,s.jsx)(n.p,{children:"It is recommended to turn off ufw (uncomplicated firewall):"}),(0,s.jsx)(n.pre,{children:(0,s.jsx)(n.code,{className:"language-bash",children:"ufw disable\n"})}),(0,s.jsx)(n.p,{children:"If you wish to keep ufw enabled, by default, the following rules are required:"}),(0,s.jsx)(n.pre,{children:(0,s.jsx)(n.code,{className:"language-bash",children:"ufw allow 6443/tcp #apiserver\nufw allow from 10.42.0.0/16 to any #pods\nufw allow from 10.43.0.0/16 to any #services\n"})}),(0,s.jsxs)(n.p,{children:["Additional ports may need to be opened depending on your setup. See ",(0,s.jsx)(n.a,{href:"#inbound-rules-for-k3s-nodes",children:"Inbound Rules"})," for more information. If you change the default CIDR for pods or services, you will need to update the firewall rules accordingly."]})]}),(0,s.jsxs)(t,{value:"pi",label:"Raspberry Pi",children:[(0,s.jsxs)(n.p,{children:["Raspberry Pi OS is Debian based, and may suffer from a known iptables bug. See ",(0,s.jsx)(n.a,{href:"/known-issues#iptables",children:"Known Issues"}),"."]}),(0,s.jsxs)(n.p,{children:["Standard Raspberry Pi OS installations do not start with ",(0,s.jsx)(n.code,{children:"cgroups"})," enabled. ",(0,s.jsx)(n.strong,{children:"K3S"})," needs ",(0,s.jsx)(n.code,{children:"cgroups"})," to start the systemd service. ",(0,s.jsx)(n.code,{children:"cgroups"}),"can be enabled by appending ",(0,s.jsx)(n.code,{children:"cgroup_memory=1 cgroup_enable=memory"})," to ",(0,s.jsx)(n.code,{children:"/boot/cmdline.txt"}),"."]}),(0,s.jsx)(n.p,{children:"Example cmdline.txt:"}),(0,s.jsx)(n.pre,{children:(0,s.jsx)(n.code,{children:"console=serial0,115200 console=tty1 root=PARTUUID=58b06195-02 rootfstype=ext4 elevator=deadline fsck.repair=yes rootwait cgroup_memory=1 cgroup_enable=memory\n"})}),(0,s.jsx)(n.p,{children:"With Ubuntu 21.10 to Ubuntu 23.10, vxlan support on Raspberry Pi was moved into a separate kernel module. This step in not required for Ubuntu 24.04 and later."}),(0,s.jsx)(n.pre,{children:(0,s.jsx)(n.code,{className:"language-bash",children:"sudo apt install linux-modules-extra-raspi\n"})})]})]}),"\n",(0,s.jsxs)(n.p,{children:["For more information on which OSs were tested with Rancher managed K3s clusters, refer to the ",(0,s.jsx)(n.a,{href:"https://rancher.com/support-maintenance-terms/",children:"Rancher support and maintenance terms."})]}),"\n",(0,s.jsx)(n.h2,{id:"hardware",children:"Hardware"}),"\n",(0,s.jsx)(n.p,{children:"Hardware requirements scale based on the size of your deployments. Minimum recommendations are outlined here."}),"\n",(0,s.jsxs)(n.table,{children:[(0,s.jsx)(n.thead,{children:(0,s.jsxs)(n.tr,{children:[(0,s.jsx)(n.th,{children:"Spec"}),(0,s.jsx)(n.th,{children:"Minimum"}),(0,s.jsx)(n.th,{children:"Recommended"})]})}),(0,s.jsxs)(n.tbody,{children:[(0,s.jsxs)(n.tr,{children:[(0,s.jsx)(n.td,{children:"CPU"}),(0,s.jsx)(n.td,{children:"1 core"}),(0,s.jsx)(n.td,{children:"2 cores"})]}),(0,s.jsxs)(n.tr,{children:[(0,s.jsx)(n.td,{children:"RAM"}),(0,s.jsx)(n.td,{children:"512 MB"}),(0,s.jsx)(n.td,{children:"1 GB"})]})]})]}),"\n",(0,s.jsxs)(n.p,{children:[(0,s.jsx)(n.a,{href:"/reference/resource-profiling",children:"Resource Profiling"})," captures the results of tests to determine minimum resource requirements for the K3s agent, the K3s server with a workload, and the K3s server with one agent. It also contains analysis about what has the biggest impact on K3s server and agent utilization, and how the cluster datastore can be protected from interference from agents and workloads."]}),"\n",(0,s.jsx)(n.admonition,{title:"Raspberry Pi and embedded etcd",type:"info",children:(0,s.jsx)(n.p,{children:"If deploying K3s with embedded etcd on a Raspberry Pi, it is recommended that you use an external SSD. etcd is write intensive, and SD cards cannot handle the IO load."})}),"\n",(0,s.jsx)(n.h4,{id:"disks",children:"Disks"}),"\n",(0,s.jsx)(n.p,{children:"K3s performance depends on the performance of the database. To ensure optimal speed, we recommend using an SSD when possible. Disk performance will vary on ARM devices utilizing an SD card or eMMC."}),"\n",(0,s.jsx)(n.h2,{id:"networking",children:"Networking"}),"\n",(0,s.jsx)(n.p,{children:"The K3s server needs port 6443 to be accessible by all nodes."}),"\n",(0,s.jsx)(n.p,{children:"The nodes need to be able to reach other nodes over UDP port 8472 when using the Flannel VXLAN backend, or over UDP port 51820 (and 51821 if IPv6 is used) when using the Flannel WireGuard backend. The node should not listen on any other port. K3s uses reverse tunneling such that the nodes make outbound connections to the server and all kubelet traffic runs through that tunnel. However, if you do not use Flannel and provide your own custom CNI, then the ports needed by Flannel are not needed by K3s."}),"\n",(0,s.jsx)(n.p,{children:"If you wish to utilize the metrics server, all nodes must be accessible to each other on port 10250."}),"\n",(0,s.jsx)(n.p,{children:"If you plan on achieving high availability with embedded etcd, server nodes must be accessible to each other on ports 2379 and 2380."}),"\n",(0,s.jsx)(n.admonition,{title:"Important",type:"tip",children:(0,s.jsx)(n.p,{children:"The VXLAN port on nodes should not be exposed to the world as it opens up your cluster network to be accessed by anyone. Run your nodes behind a firewall/security group that disables access to port 8472."})}),"\n",(0,s.jsx)(n.admonition,{type:"danger",children:(0,s.jsxs)(n.p,{children:["Flannel relies on the ",(0,s.jsx)(n.a,{href:"https://www.cni.dev/plugins/current/main/bridge/",children:"Bridge CNI plugin"})," to create a L2 network that switches traffic. Rogue pods with ",(0,s.jsx)(n.code,{children:"NET_RAW"})," capabilities can abuse that L2 network to launch attacks such as ",(0,s.jsx)(n.a,{href:"https://static.sched.com/hosted_files/kccncna19/72/ARP%20DNS%20spoof.pdf",children:"ARP spoofing"}),". Therefore, as documented in the ",(0,s.jsx)(n.a,{href:"https://kubernetes.io/docs/concepts/security/pod-security-standards/",children:"Kubernetes docs"}),", please set a restricted profile that disables ",(0,s.jsx)(n.code,{children:"NET_RAW"})," on non-trustable pods."]})}),"\n",(0,s.jsx)(n.h3,{id:"inbound-rules-for-k3s-nodes",children:"Inbound Rules for K3s Nodes"}),"\n",(0,s.jsxs)(n.table,{children:[(0,s.jsx)(n.thead,{children:(0,s.jsxs)(n.tr,{children:[(0,s.jsx)(n.th,{children:"Protocol"}),(0,s.jsx)(n.th,{children:"Port"}),(0,s.jsx)(n.th,{children:"Source"}),(0,s.jsx)(n.th,{children:"Destination"}),(0,s.jsx)(n.th,{children:"Description"})]})}),(0,s.jsxs)(n.tbody,{children:[(0,s.jsxs)(n.tr,{children:[(0,s.jsx)(n.td,{children:"TCP"}),(0,s.jsx)(n.td,{children:"2379-2380"}),(0,s.jsx)(n.td,{children:"Servers"}),(0,s.jsx)(n.td,{children:"Servers"}),(0,s.jsx)(n.td,{children:"Required only for HA with embedded etcd"})]}),(0,s.jsxs)(n.tr,{children:[(0,s.jsx)(n.td,{children:"TCP"}),(0,s.jsx)(n.td,{children:"6443"}),(0,s.jsx)(n.td,{children:"Agents"}),(0,s.jsx)(n.td,{children:"Servers"}),(0,s.jsx)(n.td,{children:"K3s supervisor and Kubernetes API Server"})]}),(0,s.jsxs)(n.tr,{children:[(0,s.jsx)(n.td,{children:"UDP"}),(0,s.jsx)(n.td,{children:"8472"}),(0,s.jsx)(n.td,{children:"All nodes"}),(0,s.jsx)(n.td,{children:"All nodes"}),(0,s.jsx)(n.td,{children:"Required only for Flannel VXLAN"})]}),(0,s.jsxs)(n.tr,{children:[(0,s.jsx)(n.td,{children:"TCP"}),(0,s.jsx)(n.td,{children:"10250"}),(0,s.jsx)(n.td,{children:"All nodes"}),(0,s.jsx)(n.td,{children:"All nodes"}),(0,s.jsx)(n.td,{children:"Kubelet metrics"})]}),(0,s.jsxs)(n.tr,{children:[(0,s.jsx)(n.td,{children:"UDP"}),(0,s.jsx)(n.td,{children:"51820"}),(0,s.jsx)(n.td,{children:"All nodes"}),(0,s.jsx)(n.td,{children:"All nodes"}),(0,s.jsx)(n.td,{children:"Required only for Flannel Wireguard with IPv4"})]}),(0,s.jsxs)(n.tr,{children:[(0,s.jsx)(n.td,{children:"UDP"}),(0,s.jsx)(n.td,{children:"51821"}),(0,s.jsx)(n.td,{children:"All nodes"}),(0,s.jsx)(n.td,{children:"All nodes"}),(0,s.jsx)(n.td,{children:"Required only for Flannel Wireguard with IPv6"})]}),(0,s.jsxs)(n.tr,{children:[(0,s.jsx)(n.td,{children:"TCP"}),(0,s.jsx)(n.td,{children:"5001"}),(0,s.jsx)(n.td,{children:"All nodes"}),(0,s.jsx)(n.td,{children:"All nodes"}),(0,s.jsx)(n.td,{children:"Required only for embedded distributed registry (Spegel)"})]}),(0,s.jsxs)(n.tr,{children:[(0,s.jsx)(n.td,{children:"TCP"}),(0,s.jsx)(n.td,{children:"6443"}),(0,s.jsx)(n.td,{children:"All nodes"}),(0,s.jsx)(n.td,{children:"All nodes"}),(0,s.jsx)(n.td,{children:"Required only for embedded distributed registry (Spegel)"})]})]})]}),"\n",(0,s.jsx)(n.p,{children:"Typically, all outbound traffic is allowed."}),"\n",(0,s.jsx)(n.p,{children:"Additional changes to the firewall may be required depending on the OS used."}),"\n",(0,s.jsx)(n.h2,{id:"large-clusters",children:"Large Clusters"}),"\n",(0,s.jsx)(n.p,{children:"Hardware requirements are based on the size of your K3s cluster. For production and large clusters, we recommend using a high-availability setup with an external database. The following options are recommended for the external database in production:"}),"\n",(0,s.jsxs)(n.ul,{children:["\n",(0,s.jsx)(n.li,{children:"MySQL"}),"\n",(0,s.jsx)(n.li,{children:"PostgreSQL"}),"\n",(0,s.jsx)(n.li,{children:"etcd"}),"\n"]}),"\n",(0,s.jsx)(n.h3,{id:"cpu-and-memory",children:"CPU and Memory"}),"\n",(0,s.jsx)(n.p,{children:"The following are the minimum CPU and memory requirements for nodes in a high-availability K3s server:"}),"\n",(0,s.jsxs)(n.table,{children:[(0,s.jsx)(n.thead,{children:(0,s.jsxs)(n.tr,{children:[(0,s.jsx)(n.th,{style:{textAlign:"center"},children:"Deployment Size"}),(0,s.jsx)(n.th,{style:{textAlign:"center"},children:"Nodes"}),(0,s.jsx)(n.th,{style:{textAlign:"center"},children:"VCPUS"}),(0,s.jsx)(n.th,{style:{textAlign:"center"},children:"RAM"})]})}),(0,s.jsxs)(n.tbody,{children:[(0,s.jsxs)(n.tr,{children:[(0,s.jsx)(n.td,{style:{textAlign:"center"},children:"Small"}),(0,s.jsx)(n.td,{style:{textAlign:"center"},children:"Up to 10"}),(0,s.jsx)(n.td,{style:{textAlign:"center"},children:"2"}),(0,s.jsx)(n.td,{style:{textAlign:"center"},children:"4 GB"})]}),(0,s.jsxs)(n.tr,{children:[(0,s.jsx)(n.td,{style:{textAlign:"center"},children:"Medium"}),(0,s.jsx)(n.td,{style:{textAlign:"center"},children:"Up to 100"}),(0,s.jsx)(n.td,{style:{textAlign:"center"},children:"4"}),(0,s.jsx)(n.td,{style:{textAlign:"center"},children:"8 GB"})]}),(0,s.jsxs)(n.tr,{children:[(0,s.jsx)(n.td,{style:{textAlign:"center"},children:"Large"}),(0,s.jsx)(n.td,{style:{textAlign:"center"},children:"Up to 250"}),(0,s.jsx)(n.td,{style:{textAlign:"center"},children:"8"}),(0,s.jsx)(n.td,{style:{textAlign:"center"},children:"16 GB"})]}),(0,s.jsxs)(n.tr,{children:[(0,s.jsx)(n.td,{style:{textAlign:"center"},children:"X-Large"}),(0,s.jsx)(n.td,{style:{textAlign:"center"},children:"Up to 500"}),(0,s.jsx)(n.td,{style:{textAlign:"center"},children:"16"}),(0,s.jsx)(n.td,{style:{textAlign:"center"},children:"32 GB"})]}),(0,s.jsxs)(n.tr,{children:[(0,s.jsx)(n.td,{style:{textAlign:"center"},children:"XX-Large"}),(0,s.jsx)(n.td,{style:{textAlign:"center"},children:"500+"}),(0,s.jsx)(n.td,{style:{textAlign:"center"},children:"32"}),(0,s.jsx)(n.td,{style:{textAlign:"center"},children:"64 GB"})]})]})]}),"\n",(0,s.jsx)(n.h3,{id:"disks-1",children:"Disks"}),"\n",(0,s.jsx)(n.p,{children:"The cluster performance depends on database performance. To ensure optimal speed, we recommend always using SSD disks to back your K3s cluster. On cloud providers, you will also want to use the minimum size that allows the maximum IOPS."}),"\n",(0,s.jsx)(n.h3,{id:"network",children:"Network"}),"\n",(0,s.jsxs)(n.p,{children:["You should consider increasing the subnet size for the cluster CIDR so that you don't run out of IPs for the pods. You can do that by passing the ",(0,s.jsx)(n.code,{children:"--cluster-cidr"})," option to K3s server upon starting."]}),"\n",(0,s.jsx)(n.h3,{id:"database",children:"Database"}),"\n",(0,s.jsxs)(n.p,{children:["K3s supports different databases including MySQL, PostgreSQL, MariaDB, and etcd. See ",(0,s.jsx)(n.a,{href:"/datastore/",children:"Cluster Datastore"})," for more info."]}),"\n",(0,s.jsx)(n.p,{children:"The following is a sizing guide for the database resources you need to run large clusters:"}),"\n",(0,s.jsxs)(n.table,{children:[(0,s.jsx)(n.thead,{children:(0,s.jsxs)(n.tr,{children:[(0,s.jsx)(n.th,{style:{textAlign:"center"},children:"Deployment Size"}),(0,s.jsx)(n.th,{style:{textAlign:"center"},children:"Nodes"}),(0,s.jsx)(n.th,{style:{textAlign:"center"},children:"VCPUS"}),(0,s.jsx)(n.th,{style:{textAlign:"center"},children:"RAM"})]})}),(0,s.jsxs)(n.tbody,{children:[(0,s.jsxs)(n.tr,{children:[(0,s.jsx)(n.td,{style:{textAlign:"center"},children:"Small"}),(0,s.jsx)(n.td,{style:{textAlign:"center"},children:"Up to 10"}),(0,s.jsx)(n.td,{style:{textAlign:"center"},children:"1"}),(0,s.jsx)(n.td,{style:{textAlign:"center"},children:"2 GB"})]}),(0,s.jsxs)(n.tr,{children:[(0,s.jsx)(n.td,{style:{textAlign:"center"},children:"Medium"}),(0,s.jsx)(n.td,{style:{textAlign:"center"},children:"Up to 100"}),(0,s.jsx)(n.td,{style:{textAlign:"center"},children:"2"}),(0,s.jsx)(n.td,{style:{textAlign:"center"},children:"8 GB"})]}),(0,s.jsxs)(n.tr,{children:[(0,s.jsx)(n.td,{style:{textAlign:"center"},children:"Large"}),(0,s.jsx)(n.td,{style:{textAlign:"center"},children:"Up to 250"}),(0,s.jsx)(n.td,{style:{textAlign:"center"},children:"4"}),(0,s.jsx)(n.td,{style:{textAlign:"center"},children:"16 GB"})]}),(0,s.jsxs)(n.tr,{children:[(0,s.jsx)(n.td,{style:{textAlign:"center"},children:"X-Large"}),(0,s.jsx)(n.td,{style:{textAlign:"center"},children:"Up to 500"}),(0,s.jsx)(n.td,{style:{textAlign:"center"},children:"8"}),(0,s.jsx)(n.td,{style:{textAlign:"center"},children:"32 GB"})]}),(0,s.jsxs)(n.tr,{children:[(0,s.jsx)(n.td,{style:{textAlign:"center"},children:"XX-Large"}),(0,s.jsx)(n.td,{style:{textAlign:"center"},children:"500+"}),(0,s.jsx)(n.td,{style:{textAlign:"center"},children:"16"}),(0,s.jsx)(n.td,{style:{textAlign:"center"},children:"64 GB"})]})]})]})]})}function h(e={}){const{wrapper:n}={...(0,r.a)(),...e.components};return n?(0,s.jsx)(n,{...e,children:(0,s.jsx)(c,{...e})}):c(e)}function u(e,n){throw new Error("Expected "+(n?"component":"object")+" `"+e+"` to be defined: you likely forgot to import, pass, or provide it.")}},1151:(e,n,t)=>{t.d(n,{Z:()=>l,a:()=>d});var s=t(7294);const r={},i=s.createContext(r);function d(e){const n=s.useContext(i);return s.useMemo((function(){return"function"==typeof e?e(n):{...n,...e}}),[n,e])}function l(e){let n;return n=e.disableParentContext?"function"==typeof e.components?e.components(r):e.components||r:d(e.components),s.createElement(i.Provider,{value:n},e.children)}}}]); \ No newline at end of file +"use strict";(self.webpackChunkk_3_s_docs=self.webpackChunkk_3_s_docs||[]).push([[1199],{6455:(e,n,t)=>{t.r(n),t.d(n,{assets:()=>o,contentTitle:()=>d,default:()=>h,frontMatter:()=>i,metadata:()=>l,toc:()=>a});var s=t(5893),r=t(1151);const i={title:"Requirements"},d=void 0,l={id:"installation/requirements",title:"Requirements",description:"K3s is very lightweight, but has some minimum requirements as outlined below.",source:"@site/docs/installation/requirements.md",sourceDirName:"installation",slug:"/installation/requirements",permalink:"/installation/requirements",draft:!1,unlisted:!1,editUrl:"https://github.com/k3s-io/docs/edit/main/docs/installation/requirements.md",tags:[],version:"current",lastUpdatedAt:1723747404e3,frontMatter:{title:"Requirements"},sidebar:"mySidebar",previous:{title:"Installation",permalink:"/installation/"},next:{title:"Configuration Options",permalink:"/installation/configuration"}},o={},a=[{value:"Prerequisites",id:"prerequisites",level:2},{value:"Architecture",id:"architecture",level:2},{value:"Operating Systems",id:"operating-systems",level:2},{value:"Hardware",id:"hardware",level:2},{value:"Disks",id:"disks",level:4},{value:"Networking",id:"networking",level:2},{value:"Inbound Rules for K3s Nodes",id:"inbound-rules-for-k3s-nodes",level:3},{value:"Large Clusters",id:"large-clusters",level:2},{value:"CPU and Memory",id:"cpu-and-memory",level:3},{value:"Disks",id:"disks-1",level:3},{value:"Network",id:"network",level:3},{value:"Database",id:"database",level:3}];function c(e){const n={a:"a",admonition:"admonition",code:"code",h2:"h2",h3:"h3",h4:"h4",li:"li",p:"p",pre:"pre",strong:"strong",table:"table",tbody:"tbody",td:"td",th:"th",thead:"thead",tr:"tr",ul:"ul",...(0,r.a)(),...e.components},{TabItem:t,Tabs:i}=n;return t||u("TabItem",!0),i||u("Tabs",!0),(0,s.jsxs)(s.Fragment,{children:[(0,s.jsx)(n.p,{children:"K3s is very lightweight, but has some minimum requirements as outlined below."}),"\n",(0,s.jsx)(n.p,{children:"Whether you're configuring K3s to run in a container or as a native Linux service, each node running K3s should meet the following minimum requirements. These requirements are baseline for K3s and its packaged components, and do not include resources consumed by the workload itself."}),"\n",(0,s.jsx)(n.h2,{id:"prerequisites",children:"Prerequisites"}),"\n",(0,s.jsx)(n.p,{children:"Two nodes cannot have the same hostname."}),"\n",(0,s.jsxs)(n.p,{children:["If multiple nodes will have the same hostname, or if hostnames may be reused by an automated provisioning system, use the ",(0,s.jsx)(n.code,{children:"--with-node-id"})," option to append a random suffix for each node, or devise a unique name to pass with ",(0,s.jsx)(n.code,{children:"--node-name"})," or ",(0,s.jsx)(n.code,{children:"$K3S_NODE_NAME"})," for each node you add to the cluster."]}),"\n",(0,s.jsx)(n.h2,{id:"architecture",children:"Architecture"}),"\n",(0,s.jsx)(n.p,{children:"K3s is available for the following architectures:"}),"\n",(0,s.jsxs)(n.ul,{children:["\n",(0,s.jsx)(n.li,{children:"x86_64"}),"\n",(0,s.jsx)(n.li,{children:"armhf"}),"\n",(0,s.jsx)(n.li,{children:"arm64/aarch64"}),"\n",(0,s.jsx)(n.li,{children:"s390x"}),"\n"]}),"\n",(0,s.jsx)(n.admonition,{title:"ARM64 Page Size",type:"warning",children:(0,s.jsxs)(n.p,{children:["Prior to May 2023 releases (v1.24.14+k3s1, v1.25.10+k3s1, v1.26.5+k3s1, v1.27.2+k3s1), on ",(0,s.jsx)(n.code,{children:"aarch64/arm64"})," systems, the kernel must use 4k pages. ",(0,s.jsx)(n.strong,{children:"RHEL9"}),", ",(0,s.jsx)(n.strong,{children:"Ubuntu"}),", ",(0,s.jsx)(n.strong,{children:"Raspberry PI OS"}),", and ",(0,s.jsx)(n.strong,{children:"SLES"})," all meet this requirement."]})}),"\n",(0,s.jsx)(n.h2,{id:"operating-systems",children:"Operating Systems"}),"\n",(0,s.jsx)(n.p,{children:"K3s is expected to work on most modern Linux systems."}),"\n",(0,s.jsx)(n.p,{children:"Some OSs have additional setup requirements:"}),"\n",(0,s.jsxs)(i,{queryString:"os",children:[(0,s.jsxs)(t,{value:"suse",label:"SUSE Linux Enterprise / openSUSE",children:[(0,s.jsx)(n.p,{children:"It is recommended to turn off firewalld:"}),(0,s.jsx)(n.pre,{children:(0,s.jsx)(n.code,{className:"language-bash",children:"systemctl disable firewalld --now\n"})}),(0,s.jsx)(n.p,{children:"If you wish to keep firewalld enabled, by default, the following rules are required:"}),(0,s.jsx)(n.pre,{children:(0,s.jsx)(n.code,{className:"language-bash",children:"firewall-cmd --permanent --add-port=6443/tcp #apiserver\nfirewall-cmd --permanent --zone=trusted --add-source=10.42.0.0/16 #pods\nfirewall-cmd --permanent --zone=trusted --add-source=10.43.0.0/16 #services\nfirewall-cmd --reload\n"})}),(0,s.jsxs)(n.p,{children:["Additional ports may need to be opened depending on your setup. See ",(0,s.jsx)(n.a,{href:"#inbound-rules-for-k3s-nodes",children:"Inbound Rules"})," for more information. If you change the default CIDR for pods or services, you will need to update the firewall rules accordingly."]})]}),(0,s.jsxs)(t,{value:"rhel",label:"Red Hat Enterprise Linux / CentOS / Fedora",children:[(0,s.jsx)(n.p,{children:"It is recommended to turn off firewalld:"}),(0,s.jsx)(n.pre,{children:(0,s.jsx)(n.code,{className:"language-bash",children:"systemctl disable firewalld --now\n"})}),(0,s.jsx)(n.p,{children:"If you wish to keep firewalld enabled, by default, the following rules are required:"}),(0,s.jsx)(n.pre,{children:(0,s.jsx)(n.code,{className:"language-bash",children:"firewall-cmd --permanent --add-port=6443/tcp #apiserver\nfirewall-cmd --permanent --zone=trusted --add-source=10.42.0.0/16 #pods\nfirewall-cmd --permanent --zone=trusted --add-source=10.43.0.0/16 #services\nfirewall-cmd --reload\n"})}),(0,s.jsxs)(n.p,{children:["Additional ports may need to be opened depending on your setup. See ",(0,s.jsx)(n.a,{href:"#inbound-rules-for-k3s-nodes",children:"Inbound Rules"})," for more information. If you change the default CIDR for pods or services, you will need to update the firewall rules accordingly."]}),(0,s.jsx)(n.p,{children:"If enabled, it is required to disable nm-cloud-setup and reboot the node:"}),(0,s.jsx)(n.pre,{children:(0,s.jsx)(n.code,{className:"language-bash",children:"systemctl disable nm-cloud-setup.service nm-cloud-setup.timer\nreboot\n"})})]}),(0,s.jsxs)(t,{value:"debian",label:"Ubuntu / Debian",children:[(0,s.jsxs)(n.p,{children:["Older Debian release may suffer from a known iptables bug. See ",(0,s.jsx)(n.a,{href:"/known-issues#iptables",children:"Known Issues"}),"."]}),(0,s.jsx)(n.p,{children:"It is recommended to turn off ufw (uncomplicated firewall):"}),(0,s.jsx)(n.pre,{children:(0,s.jsx)(n.code,{className:"language-bash",children:"ufw disable\n"})}),(0,s.jsx)(n.p,{children:"If you wish to keep ufw enabled, by default, the following rules are required:"}),(0,s.jsx)(n.pre,{children:(0,s.jsx)(n.code,{className:"language-bash",children:"ufw allow 6443/tcp #apiserver\nufw allow from 10.42.0.0/16 to any #pods\nufw allow from 10.43.0.0/16 to any #services\n"})}),(0,s.jsxs)(n.p,{children:["Additional ports may need to be opened depending on your setup. See ",(0,s.jsx)(n.a,{href:"#inbound-rules-for-k3s-nodes",children:"Inbound Rules"})," for more information. If you change the default CIDR for pods or services, you will need to update the firewall rules accordingly."]})]}),(0,s.jsxs)(t,{value:"pi",label:"Raspberry Pi",children:[(0,s.jsxs)(n.p,{children:["Raspberry Pi OS is Debian based, and may suffer from a known iptables bug. See ",(0,s.jsx)(n.a,{href:"/known-issues#iptables",children:"Known Issues"}),"."]}),(0,s.jsxs)(n.p,{children:["Standard Raspberry Pi OS installations do not start with ",(0,s.jsx)(n.code,{children:"cgroups"})," enabled. ",(0,s.jsx)(n.strong,{children:"K3S"})," needs ",(0,s.jsx)(n.code,{children:"cgroups"})," to start the systemd service. ",(0,s.jsx)(n.code,{children:"cgroups"}),"can be enabled by appending ",(0,s.jsx)(n.code,{children:"cgroup_memory=1 cgroup_enable=memory"})," to ",(0,s.jsx)(n.code,{children:"/boot/cmdline.txt"}),"."]}),(0,s.jsx)(n.p,{children:"Example cmdline.txt:"}),(0,s.jsx)(n.pre,{children:(0,s.jsx)(n.code,{children:"console=serial0,115200 console=tty1 root=PARTUUID=58b06195-02 rootfstype=ext4 elevator=deadline fsck.repair=yes rootwait cgroup_memory=1 cgroup_enable=memory\n"})}),(0,s.jsx)(n.p,{children:"With Ubuntu 21.10 to Ubuntu 23.10, vxlan support on Raspberry Pi was moved into a separate kernel module. This step in not required for Ubuntu 24.04 and later."}),(0,s.jsx)(n.pre,{children:(0,s.jsx)(n.code,{className:"language-bash",children:"sudo apt install linux-modules-extra-raspi\n"})})]})]}),"\n",(0,s.jsxs)(n.p,{children:["For more information on which OSs were tested with Rancher managed K3s clusters, refer to the ",(0,s.jsx)(n.a,{href:"https://rancher.com/support-maintenance-terms/",children:"Rancher support and maintenance terms."})]}),"\n",(0,s.jsx)(n.h2,{id:"hardware",children:"Hardware"}),"\n",(0,s.jsx)(n.p,{children:"Hardware requirements scale based on the size of your deployments. Minimum recommendations are outlined here."}),"\n",(0,s.jsxs)(n.table,{children:[(0,s.jsx)(n.thead,{children:(0,s.jsxs)(n.tr,{children:[(0,s.jsx)(n.th,{children:"Spec"}),(0,s.jsx)(n.th,{children:"Minimum"}),(0,s.jsx)(n.th,{children:"Recommended"})]})}),(0,s.jsxs)(n.tbody,{children:[(0,s.jsxs)(n.tr,{children:[(0,s.jsx)(n.td,{children:"CPU"}),(0,s.jsx)(n.td,{children:"1 core"}),(0,s.jsx)(n.td,{children:"2 cores"})]}),(0,s.jsxs)(n.tr,{children:[(0,s.jsx)(n.td,{children:"RAM"}),(0,s.jsx)(n.td,{children:"512 MB"}),(0,s.jsx)(n.td,{children:"1 GB"})]})]})]}),"\n",(0,s.jsxs)(n.p,{children:[(0,s.jsx)(n.a,{href:"/reference/resource-profiling",children:"Resource Profiling"})," captures the results of tests to determine minimum resource requirements for the K3s agent, the K3s server with a workload, and the K3s server with one agent. It also contains analysis about what has the biggest impact on K3s server and agent utilization, and how the cluster datastore can be protected from interference from agents and workloads."]}),"\n",(0,s.jsx)(n.admonition,{title:"Raspberry Pi and embedded etcd",type:"info",children:(0,s.jsx)(n.p,{children:"If deploying K3s with embedded etcd on a Raspberry Pi, it is recommended that you use an external SSD. etcd is write intensive, and SD cards cannot handle the IO load."})}),"\n",(0,s.jsx)(n.h4,{id:"disks",children:"Disks"}),"\n",(0,s.jsx)(n.p,{children:"K3s performance depends on the performance of the database. To ensure optimal speed, we recommend using an SSD when possible. Disk performance will vary on ARM devices utilizing an SD card or eMMC."}),"\n",(0,s.jsx)(n.h2,{id:"networking",children:"Networking"}),"\n",(0,s.jsx)(n.p,{children:"The K3s server needs port 6443 to be accessible by all nodes."}),"\n",(0,s.jsx)(n.p,{children:"The nodes need to be able to reach other nodes over UDP port 8472 when using the Flannel VXLAN backend, or over UDP port 51820 (and 51821 if IPv6 is used) when using the Flannel WireGuard backend. The node should not listen on any other port. K3s uses reverse tunneling such that the nodes make outbound connections to the server and all kubelet traffic runs through that tunnel. However, if you do not use Flannel and provide your own custom CNI, then the ports needed by Flannel are not needed by K3s."}),"\n",(0,s.jsx)(n.p,{children:"If you wish to utilize the metrics server, all nodes must be accessible to each other on port 10250."}),"\n",(0,s.jsx)(n.p,{children:"If you plan on achieving high availability with embedded etcd, server nodes must be accessible to each other on ports 2379 and 2380."}),"\n",(0,s.jsx)(n.admonition,{title:"Important",type:"tip",children:(0,s.jsx)(n.p,{children:"The VXLAN port on nodes should not be exposed to the world as it opens up your cluster network to be accessed by anyone. Run your nodes behind a firewall/security group that disables access to port 8472."})}),"\n",(0,s.jsx)(n.admonition,{type:"danger",children:(0,s.jsxs)(n.p,{children:["Flannel relies on the ",(0,s.jsx)(n.a,{href:"https://www.cni.dev/plugins/current/main/bridge/",children:"Bridge CNI plugin"})," to create a L2 network that switches traffic. Rogue pods with ",(0,s.jsx)(n.code,{children:"NET_RAW"})," capabilities can abuse that L2 network to launch attacks such as ",(0,s.jsx)(n.a,{href:"https://static.sched.com/hosted_files/kccncna19/72/ARP%20DNS%20spoof.pdf",children:"ARP spoofing"}),". Therefore, as documented in the ",(0,s.jsx)(n.a,{href:"https://kubernetes.io/docs/concepts/security/pod-security-standards/",children:"Kubernetes docs"}),", please set a restricted profile that disables ",(0,s.jsx)(n.code,{children:"NET_RAW"})," on non-trustable pods."]})}),"\n",(0,s.jsx)(n.h3,{id:"inbound-rules-for-k3s-nodes",children:"Inbound Rules for K3s Nodes"}),"\n",(0,s.jsxs)(n.table,{children:[(0,s.jsx)(n.thead,{children:(0,s.jsxs)(n.tr,{children:[(0,s.jsx)(n.th,{children:"Protocol"}),(0,s.jsx)(n.th,{children:"Port"}),(0,s.jsx)(n.th,{children:"Source"}),(0,s.jsx)(n.th,{children:"Destination"}),(0,s.jsx)(n.th,{children:"Description"})]})}),(0,s.jsxs)(n.tbody,{children:[(0,s.jsxs)(n.tr,{children:[(0,s.jsx)(n.td,{children:"TCP"}),(0,s.jsx)(n.td,{children:"2379-2380"}),(0,s.jsx)(n.td,{children:"Servers"}),(0,s.jsx)(n.td,{children:"Servers"}),(0,s.jsx)(n.td,{children:"Required only for HA with embedded etcd"})]}),(0,s.jsxs)(n.tr,{children:[(0,s.jsx)(n.td,{children:"TCP"}),(0,s.jsx)(n.td,{children:"6443"}),(0,s.jsx)(n.td,{children:"Agents"}),(0,s.jsx)(n.td,{children:"Servers"}),(0,s.jsx)(n.td,{children:"K3s supervisor and Kubernetes API Server"})]}),(0,s.jsxs)(n.tr,{children:[(0,s.jsx)(n.td,{children:"UDP"}),(0,s.jsx)(n.td,{children:"8472"}),(0,s.jsx)(n.td,{children:"All nodes"}),(0,s.jsx)(n.td,{children:"All nodes"}),(0,s.jsx)(n.td,{children:"Required only for Flannel VXLAN"})]}),(0,s.jsxs)(n.tr,{children:[(0,s.jsx)(n.td,{children:"TCP"}),(0,s.jsx)(n.td,{children:"10250"}),(0,s.jsx)(n.td,{children:"All nodes"}),(0,s.jsx)(n.td,{children:"All nodes"}),(0,s.jsx)(n.td,{children:"Kubelet metrics"})]}),(0,s.jsxs)(n.tr,{children:[(0,s.jsx)(n.td,{children:"UDP"}),(0,s.jsx)(n.td,{children:"51820"}),(0,s.jsx)(n.td,{children:"All nodes"}),(0,s.jsx)(n.td,{children:"All nodes"}),(0,s.jsx)(n.td,{children:"Required only for Flannel Wireguard with IPv4"})]}),(0,s.jsxs)(n.tr,{children:[(0,s.jsx)(n.td,{children:"UDP"}),(0,s.jsx)(n.td,{children:"51821"}),(0,s.jsx)(n.td,{children:"All nodes"}),(0,s.jsx)(n.td,{children:"All nodes"}),(0,s.jsx)(n.td,{children:"Required only for Flannel Wireguard with IPv6"})]}),(0,s.jsxs)(n.tr,{children:[(0,s.jsx)(n.td,{children:"TCP"}),(0,s.jsx)(n.td,{children:"5001"}),(0,s.jsx)(n.td,{children:"All nodes"}),(0,s.jsx)(n.td,{children:"All nodes"}),(0,s.jsx)(n.td,{children:"Required only for embedded distributed registry (Spegel)"})]}),(0,s.jsxs)(n.tr,{children:[(0,s.jsx)(n.td,{children:"TCP"}),(0,s.jsx)(n.td,{children:"6443"}),(0,s.jsx)(n.td,{children:"All nodes"}),(0,s.jsx)(n.td,{children:"All nodes"}),(0,s.jsx)(n.td,{children:"Required only for embedded distributed registry (Spegel)"})]})]})]}),"\n",(0,s.jsx)(n.p,{children:"Typically, all outbound traffic is allowed."}),"\n",(0,s.jsx)(n.p,{children:"Additional changes to the firewall may be required depending on the OS used."}),"\n",(0,s.jsx)(n.h2,{id:"large-clusters",children:"Large Clusters"}),"\n",(0,s.jsx)(n.p,{children:"Hardware requirements are based on the size of your K3s cluster. For production and large clusters, we recommend using a high-availability setup with an external database. The following options are recommended for the external database in production:"}),"\n",(0,s.jsxs)(n.ul,{children:["\n",(0,s.jsx)(n.li,{children:"MySQL"}),"\n",(0,s.jsx)(n.li,{children:"PostgreSQL"}),"\n",(0,s.jsx)(n.li,{children:"etcd"}),"\n"]}),"\n",(0,s.jsx)(n.h3,{id:"cpu-and-memory",children:"CPU and Memory"}),"\n",(0,s.jsx)(n.p,{children:"The following are the minimum CPU and memory requirements for nodes in a high-availability K3s server:"}),"\n",(0,s.jsxs)(n.table,{children:[(0,s.jsx)(n.thead,{children:(0,s.jsxs)(n.tr,{children:[(0,s.jsx)(n.th,{style:{textAlign:"center"},children:"Deployment Size"}),(0,s.jsx)(n.th,{style:{textAlign:"center"},children:"Nodes"}),(0,s.jsx)(n.th,{style:{textAlign:"center"},children:"VCPUS"}),(0,s.jsx)(n.th,{style:{textAlign:"center"},children:"RAM"})]})}),(0,s.jsxs)(n.tbody,{children:[(0,s.jsxs)(n.tr,{children:[(0,s.jsx)(n.td,{style:{textAlign:"center"},children:"Small"}),(0,s.jsx)(n.td,{style:{textAlign:"center"},children:"Up to 10"}),(0,s.jsx)(n.td,{style:{textAlign:"center"},children:"2"}),(0,s.jsx)(n.td,{style:{textAlign:"center"},children:"4 GB"})]}),(0,s.jsxs)(n.tr,{children:[(0,s.jsx)(n.td,{style:{textAlign:"center"},children:"Medium"}),(0,s.jsx)(n.td,{style:{textAlign:"center"},children:"Up to 100"}),(0,s.jsx)(n.td,{style:{textAlign:"center"},children:"4"}),(0,s.jsx)(n.td,{style:{textAlign:"center"},children:"8 GB"})]}),(0,s.jsxs)(n.tr,{children:[(0,s.jsx)(n.td,{style:{textAlign:"center"},children:"Large"}),(0,s.jsx)(n.td,{style:{textAlign:"center"},children:"Up to 250"}),(0,s.jsx)(n.td,{style:{textAlign:"center"},children:"8"}),(0,s.jsx)(n.td,{style:{textAlign:"center"},children:"16 GB"})]}),(0,s.jsxs)(n.tr,{children:[(0,s.jsx)(n.td,{style:{textAlign:"center"},children:"X-Large"}),(0,s.jsx)(n.td,{style:{textAlign:"center"},children:"Up to 500"}),(0,s.jsx)(n.td,{style:{textAlign:"center"},children:"16"}),(0,s.jsx)(n.td,{style:{textAlign:"center"},children:"32 GB"})]}),(0,s.jsxs)(n.tr,{children:[(0,s.jsx)(n.td,{style:{textAlign:"center"},children:"XX-Large"}),(0,s.jsx)(n.td,{style:{textAlign:"center"},children:"500+"}),(0,s.jsx)(n.td,{style:{textAlign:"center"},children:"32"}),(0,s.jsx)(n.td,{style:{textAlign:"center"},children:"64 GB"})]})]})]}),"\n",(0,s.jsx)(n.h3,{id:"disks-1",children:"Disks"}),"\n",(0,s.jsx)(n.p,{children:"The cluster performance depends on database performance. To ensure optimal speed, we recommend always using SSD disks to back your K3s cluster. On cloud providers, you will also want to use the minimum size that allows the maximum IOPS."}),"\n",(0,s.jsx)(n.h3,{id:"network",children:"Network"}),"\n",(0,s.jsxs)(n.p,{children:["You should consider increasing the subnet size for the cluster CIDR so that you don't run out of IPs for the pods. You can do that by passing the ",(0,s.jsx)(n.code,{children:"--cluster-cidr"})," option to K3s server upon starting."]}),"\n",(0,s.jsx)(n.h3,{id:"database",children:"Database"}),"\n",(0,s.jsxs)(n.p,{children:["K3s supports different databases including MySQL, PostgreSQL, MariaDB, and etcd. See ",(0,s.jsx)(n.a,{href:"/datastore/",children:"Cluster Datastore"})," for more info."]}),"\n",(0,s.jsx)(n.p,{children:"The following is a sizing guide for the database resources you need to run large clusters:"}),"\n",(0,s.jsxs)(n.table,{children:[(0,s.jsx)(n.thead,{children:(0,s.jsxs)(n.tr,{children:[(0,s.jsx)(n.th,{style:{textAlign:"center"},children:"Deployment Size"}),(0,s.jsx)(n.th,{style:{textAlign:"center"},children:"Nodes"}),(0,s.jsx)(n.th,{style:{textAlign:"center"},children:"VCPUS"}),(0,s.jsx)(n.th,{style:{textAlign:"center"},children:"RAM"})]})}),(0,s.jsxs)(n.tbody,{children:[(0,s.jsxs)(n.tr,{children:[(0,s.jsx)(n.td,{style:{textAlign:"center"},children:"Small"}),(0,s.jsx)(n.td,{style:{textAlign:"center"},children:"Up to 10"}),(0,s.jsx)(n.td,{style:{textAlign:"center"},children:"1"}),(0,s.jsx)(n.td,{style:{textAlign:"center"},children:"2 GB"})]}),(0,s.jsxs)(n.tr,{children:[(0,s.jsx)(n.td,{style:{textAlign:"center"},children:"Medium"}),(0,s.jsx)(n.td,{style:{textAlign:"center"},children:"Up to 100"}),(0,s.jsx)(n.td,{style:{textAlign:"center"},children:"2"}),(0,s.jsx)(n.td,{style:{textAlign:"center"},children:"8 GB"})]}),(0,s.jsxs)(n.tr,{children:[(0,s.jsx)(n.td,{style:{textAlign:"center"},children:"Large"}),(0,s.jsx)(n.td,{style:{textAlign:"center"},children:"Up to 250"}),(0,s.jsx)(n.td,{style:{textAlign:"center"},children:"4"}),(0,s.jsx)(n.td,{style:{textAlign:"center"},children:"16 GB"})]}),(0,s.jsxs)(n.tr,{children:[(0,s.jsx)(n.td,{style:{textAlign:"center"},children:"X-Large"}),(0,s.jsx)(n.td,{style:{textAlign:"center"},children:"Up to 500"}),(0,s.jsx)(n.td,{style:{textAlign:"center"},children:"8"}),(0,s.jsx)(n.td,{style:{textAlign:"center"},children:"32 GB"})]}),(0,s.jsxs)(n.tr,{children:[(0,s.jsx)(n.td,{style:{textAlign:"center"},children:"XX-Large"}),(0,s.jsx)(n.td,{style:{textAlign:"center"},children:"500+"}),(0,s.jsx)(n.td,{style:{textAlign:"center"},children:"16"}),(0,s.jsx)(n.td,{style:{textAlign:"center"},children:"64 GB"})]})]})]})]})}function h(e={}){const{wrapper:n}={...(0,r.a)(),...e.components};return n?(0,s.jsx)(n,{...e,children:(0,s.jsx)(c,{...e})}):c(e)}function u(e,n){throw new Error("Expected "+(n?"component":"object")+" `"+e+"` to be defined: you likely forgot to import, pass, or provide it.")}},1151:(e,n,t)=>{t.d(n,{Z:()=>l,a:()=>d});var s=t(7294);const r={},i=s.createContext(r);function d(e){const n=s.useContext(i);return s.useMemo((function(){return"function"==typeof e?e(n):{...n,...e}}),[n,e])}function l(e){let n;return n=e.disableParentContext?"function"==typeof e.components?e.components(r):e.components||r:d(e.components),s.createElement(i.Provider,{value:n},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/b36bdd38.80268a8f.js b/assets/js/b36bdd38.c1d4835e.js similarity index 98% rename from assets/js/b36bdd38.80268a8f.js rename to assets/js/b36bdd38.c1d4835e.js index 5e5de40f0..d46b31dd2 100644 --- a/assets/js/b36bdd38.80268a8f.js +++ b/assets/js/b36bdd38.c1d4835e.js @@ -1 +1 @@ -"use strict";(self.webpackChunkk_3_s_docs=self.webpackChunkk_3_s_docs||[]).push([[6895],{5020:(e,s,t)=>{t.r(s),t.d(s,{assets:()=>o,contentTitle:()=>i,default:()=>h,frontMatter:()=>d,metadata:()=>a,toc:()=>l});var n=t(5893),r=t(1151);const d={title:"High Availability Embedded etcd"},i=void 0,a={id:"datastore/ha-embedded",title:"High Availability Embedded etcd",description:"Embedded etcd (HA) may have performance issues on slower disks such as Raspberry Pis running with SD cards.",source:"@site/docs/datastore/ha-embedded.md",sourceDirName:"datastore",slug:"/datastore/ha-embedded",permalink:"/datastore/ha-embedded",draft:!1,unlisted:!1,editUrl:"https://github.com/k3s-io/docs/edit/main/docs/datastore/ha-embedded.md",tags:[],version:"current",lastUpdatedAt:1723651727e3,frontMatter:{title:"High Availability Embedded etcd"},sidebar:"mySidebar",previous:{title:"Backup and Restore",permalink:"/datastore/backup-restore"},next:{title:"High Availability External DB",permalink:"/datastore/ha"}},o={},l=[{value:"Existing single-node clusters",id:"existing-single-node-clusters",level:2}];function c(e){const s={a:"a",admonition:"admonition",code:"code",h2:"h2",li:"li",p:"p",pre:"pre",strong:"strong",ul:"ul",...(0,r.a)(),...e.components},{Details:t}=s;return t||function(e,s){throw new Error("Expected "+(s?"component":"object")+" `"+e+"` to be defined: you likely forgot to import, pass, or provide it.")}("Details",!0),(0,n.jsxs)(n.Fragment,{children:[(0,n.jsx)(s.admonition,{type:"warning",children:(0,n.jsx)(s.p,{children:"Embedded etcd (HA) may have performance issues on slower disks such as Raspberry Pis running with SD cards."})}),"\n",(0,n.jsxs)(t,{children:[(0,n.jsx)("summary",{children:"Why An Odd Number Of Server Nodes?"}),(0,n.jsx)(s.p,{children:"HA embedded etcd cluster must be comprised of an odd number of server nodes for etcd to maintain quorum. For a cluster with n servers, quorum is (n/2)+1. For any odd-sized cluster, adding one node will always increase the number of nodes necessary for quorum. Although adding a node to an odd-sized cluster appears better since there are more machines, the fault tolerance is worse since exactly the same number of nodes may fail without losing quorum but there are more nodes that can fail."})]}),"\n",(0,n.jsx)(s.p,{children:"An HA K3s cluster with embedded etcd is composed of:"}),"\n",(0,n.jsxs)(s.ul,{children:["\n",(0,n.jsxs)(s.li,{children:["Three or more ",(0,n.jsx)(s.strong,{children:"server nodes"})," that will serve the Kubernetes API and run other control plane services, as well as host the embedded etcd datastore."]}),"\n",(0,n.jsxs)(s.li,{children:["Optional: Zero or more ",(0,n.jsx)(s.strong,{children:"agent nodes"})," that are designated to run your apps and services"]}),"\n",(0,n.jsxs)(s.li,{children:["Optional: A ",(0,n.jsx)(s.strong,{children:"fixed registration address"})," for agent nodes to register with the cluster"]}),"\n"]}),"\n",(0,n.jsx)(s.admonition,{type:"note",children:(0,n.jsxs)(s.p,{children:["To rapidly deploy large HA clusters, see ",(0,n.jsx)(s.a,{href:"/related-projects",children:"Related Projects"})]})}),"\n",(0,n.jsxs)(s.p,{children:["To get started, first launch a server node with the ",(0,n.jsx)(s.code,{children:"cluster-init"})," flag to enable clustering and a token that will be used as a shared secret to join additional servers to the cluster."]}),"\n",(0,n.jsx)(s.pre,{children:(0,n.jsx)(s.code,{className:"language-bash",children:"curl -sfL https://get.k3s.io | K3S_TOKEN=SECRET sh -s - server \\\n --cluster-init \\\n --tls-san= # Optional, needed if using a fixed registration address\n"})}),"\n",(0,n.jsx)(s.p,{children:"After launching the first server, join the second and third servers to the cluster using the shared secret:"}),"\n",(0,n.jsx)(s.pre,{children:(0,n.jsx)(s.code,{className:"language-bash",children:"curl -sfL https://get.k3s.io | K3S_TOKEN=SECRET sh -s - server \\\n --server https://:6443 \\\n --tls-san= # Optional, needed if using a fixed registration address\n"})}),"\n",(0,n.jsx)(s.p,{children:"Check to see that the second and third servers are now part of the cluster:"}),"\n",(0,n.jsx)(s.pre,{children:(0,n.jsx)(s.code,{className:"language-bash",children:"$ kubectl get nodes\nNAME STATUS ROLES AGE VERSION\nserver1 Ready control-plane,etcd,master 28m vX.Y.Z\nserver2 Ready control-plane,etcd,master 13m vX.Y.Z\nserver3 Ready control-plane,etcd,master 10m vX.Y.Z\n"})}),"\n",(0,n.jsxs)(s.p,{children:["Now you have a highly available control plane. Any successfully clustered servers can be used in the ",(0,n.jsx)(s.code,{children:"--server"})," argument to join additional server and agent nodes. Joining additional agent nodes to the cluster follows the same procedure as servers:"]}),"\n",(0,n.jsx)(s.pre,{children:(0,n.jsx)(s.code,{className:"language-bash",children:"curl -sfL https://get.k3s.io | K3S_TOKEN=SECRET sh -s - agent --server https://:6443\n"})}),"\n",(0,n.jsx)(s.p,{children:"There are a few config flags that must be the same in all server nodes:"}),"\n",(0,n.jsxs)(s.ul,{children:["\n",(0,n.jsxs)(s.li,{children:["Network related flags: ",(0,n.jsx)(s.code,{children:"--cluster-dns"}),", ",(0,n.jsx)(s.code,{children:"--cluster-domain"}),", ",(0,n.jsx)(s.code,{children:"--cluster-cidr"}),", ",(0,n.jsx)(s.code,{children:"--service-cidr"})]}),"\n",(0,n.jsxs)(s.li,{children:["Flags controlling the deployment of certain components: ",(0,n.jsx)(s.code,{children:"--disable-helm-controller"}),", ",(0,n.jsx)(s.code,{children:"--disable-kube-proxy"}),", ",(0,n.jsx)(s.code,{children:"--disable-network-policy"})," and any component passed to ",(0,n.jsx)(s.code,{children:"--disable"})]}),"\n",(0,n.jsxs)(s.li,{children:["Feature related flags: ",(0,n.jsx)(s.code,{children:"--secrets-encryption"})]}),"\n"]}),"\n",(0,n.jsx)(s.h2,{id:"existing-single-node-clusters",children:"Existing single-node clusters"}),"\n",(0,n.jsx)(s.admonition,{title:"Version Gate",type:"info",children:(0,n.jsxs)(s.p,{children:["Available as of ",(0,n.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/releases/tag/v1.22.2%2Bk3s1",children:"v1.22.2+k3s1"})]})}),"\n",(0,n.jsxs)(s.p,{children:["If you have an existing cluster using the default embedded SQLite database, you can convert it to etcd by simply restarting your K3s server with the ",(0,n.jsx)(s.code,{children:"--cluster-init"})," flag. Once you've done that, you'll be able to add additional instances as described above."]}),"\n",(0,n.jsxs)(s.p,{children:["If an etcd datastore is found on disk either because that node has either initialized or joined a cluster already, the datastore arguments (",(0,n.jsx)(s.code,{children:"--cluster-init"}),", ",(0,n.jsx)(s.code,{children:"--server"}),", ",(0,n.jsx)(s.code,{children:"--datastore-endpoint"}),", etc) are ignored."]})]})}function h(e={}){const{wrapper:s}={...(0,r.a)(),...e.components};return s?(0,n.jsx)(s,{...e,children:(0,n.jsx)(c,{...e})}):c(e)}},1151:(e,s,t)=>{t.d(s,{Z:()=>a,a:()=>i});var n=t(7294);const r={},d=n.createContext(r);function i(e){const s=n.useContext(d);return n.useMemo((function(){return"function"==typeof e?e(s):{...s,...e}}),[s,e])}function a(e){let s;return s=e.disableParentContext?"function"==typeof e.components?e.components(r):e.components||r:i(e.components),n.createElement(d.Provider,{value:s},e.children)}}}]); \ No newline at end of file +"use strict";(self.webpackChunkk_3_s_docs=self.webpackChunkk_3_s_docs||[]).push([[6895],{5020:(e,s,t)=>{t.r(s),t.d(s,{assets:()=>o,contentTitle:()=>i,default:()=>h,frontMatter:()=>d,metadata:()=>a,toc:()=>l});var n=t(5893),r=t(1151);const d={title:"High Availability Embedded etcd"},i=void 0,a={id:"datastore/ha-embedded",title:"High Availability Embedded etcd",description:"Embedded etcd (HA) may have performance issues on slower disks such as Raspberry Pis running with SD cards.",source:"@site/docs/datastore/ha-embedded.md",sourceDirName:"datastore",slug:"/datastore/ha-embedded",permalink:"/datastore/ha-embedded",draft:!1,unlisted:!1,editUrl:"https://github.com/k3s-io/docs/edit/main/docs/datastore/ha-embedded.md",tags:[],version:"current",lastUpdatedAt:1723747404e3,frontMatter:{title:"High Availability Embedded etcd"},sidebar:"mySidebar",previous:{title:"Backup and Restore",permalink:"/datastore/backup-restore"},next:{title:"High Availability External DB",permalink:"/datastore/ha"}},o={},l=[{value:"Existing single-node clusters",id:"existing-single-node-clusters",level:2}];function c(e){const s={a:"a",admonition:"admonition",code:"code",h2:"h2",li:"li",p:"p",pre:"pre",strong:"strong",ul:"ul",...(0,r.a)(),...e.components},{Details:t}=s;return t||function(e,s){throw new Error("Expected "+(s?"component":"object")+" `"+e+"` to be defined: you likely forgot to import, pass, or provide it.")}("Details",!0),(0,n.jsxs)(n.Fragment,{children:[(0,n.jsx)(s.admonition,{type:"warning",children:(0,n.jsx)(s.p,{children:"Embedded etcd (HA) may have performance issues on slower disks such as Raspberry Pis running with SD cards."})}),"\n",(0,n.jsxs)(t,{children:[(0,n.jsx)("summary",{children:"Why An Odd Number Of Server Nodes?"}),(0,n.jsx)(s.p,{children:"HA embedded etcd cluster must be comprised of an odd number of server nodes for etcd to maintain quorum. For a cluster with n servers, quorum is (n/2)+1. For any odd-sized cluster, adding one node will always increase the number of nodes necessary for quorum. Although adding a node to an odd-sized cluster appears better since there are more machines, the fault tolerance is worse since exactly the same number of nodes may fail without losing quorum but there are more nodes that can fail."})]}),"\n",(0,n.jsx)(s.p,{children:"An HA K3s cluster with embedded etcd is composed of:"}),"\n",(0,n.jsxs)(s.ul,{children:["\n",(0,n.jsxs)(s.li,{children:["Three or more ",(0,n.jsx)(s.strong,{children:"server nodes"})," that will serve the Kubernetes API and run other control plane services, as well as host the embedded etcd datastore."]}),"\n",(0,n.jsxs)(s.li,{children:["Optional: Zero or more ",(0,n.jsx)(s.strong,{children:"agent nodes"})," that are designated to run your apps and services"]}),"\n",(0,n.jsxs)(s.li,{children:["Optional: A ",(0,n.jsx)(s.strong,{children:"fixed registration address"})," for agent nodes to register with the cluster"]}),"\n"]}),"\n",(0,n.jsx)(s.admonition,{type:"note",children:(0,n.jsxs)(s.p,{children:["To rapidly deploy large HA clusters, see ",(0,n.jsx)(s.a,{href:"/related-projects",children:"Related Projects"})]})}),"\n",(0,n.jsxs)(s.p,{children:["To get started, first launch a server node with the ",(0,n.jsx)(s.code,{children:"cluster-init"})," flag to enable clustering and a token that will be used as a shared secret to join additional servers to the cluster."]}),"\n",(0,n.jsx)(s.pre,{children:(0,n.jsx)(s.code,{className:"language-bash",children:"curl -sfL https://get.k3s.io | K3S_TOKEN=SECRET sh -s - server \\\n --cluster-init \\\n --tls-san= # Optional, needed if using a fixed registration address\n"})}),"\n",(0,n.jsx)(s.p,{children:"After launching the first server, join the second and third servers to the cluster using the shared secret:"}),"\n",(0,n.jsx)(s.pre,{children:(0,n.jsx)(s.code,{className:"language-bash",children:"curl -sfL https://get.k3s.io | K3S_TOKEN=SECRET sh -s - server \\\n --server https://:6443 \\\n --tls-san= # Optional, needed if using a fixed registration address\n"})}),"\n",(0,n.jsx)(s.p,{children:"Check to see that the second and third servers are now part of the cluster:"}),"\n",(0,n.jsx)(s.pre,{children:(0,n.jsx)(s.code,{className:"language-bash",children:"$ kubectl get nodes\nNAME STATUS ROLES AGE VERSION\nserver1 Ready control-plane,etcd,master 28m vX.Y.Z\nserver2 Ready control-plane,etcd,master 13m vX.Y.Z\nserver3 Ready control-plane,etcd,master 10m vX.Y.Z\n"})}),"\n",(0,n.jsxs)(s.p,{children:["Now you have a highly available control plane. Any successfully clustered servers can be used in the ",(0,n.jsx)(s.code,{children:"--server"})," argument to join additional server and agent nodes. Joining additional agent nodes to the cluster follows the same procedure as servers:"]}),"\n",(0,n.jsx)(s.pre,{children:(0,n.jsx)(s.code,{className:"language-bash",children:"curl -sfL https://get.k3s.io | K3S_TOKEN=SECRET sh -s - agent --server https://:6443\n"})}),"\n",(0,n.jsx)(s.p,{children:"There are a few config flags that must be the same in all server nodes:"}),"\n",(0,n.jsxs)(s.ul,{children:["\n",(0,n.jsxs)(s.li,{children:["Network related flags: ",(0,n.jsx)(s.code,{children:"--cluster-dns"}),", ",(0,n.jsx)(s.code,{children:"--cluster-domain"}),", ",(0,n.jsx)(s.code,{children:"--cluster-cidr"}),", ",(0,n.jsx)(s.code,{children:"--service-cidr"})]}),"\n",(0,n.jsxs)(s.li,{children:["Flags controlling the deployment of certain components: ",(0,n.jsx)(s.code,{children:"--disable-helm-controller"}),", ",(0,n.jsx)(s.code,{children:"--disable-kube-proxy"}),", ",(0,n.jsx)(s.code,{children:"--disable-network-policy"})," and any component passed to ",(0,n.jsx)(s.code,{children:"--disable"})]}),"\n",(0,n.jsxs)(s.li,{children:["Feature related flags: ",(0,n.jsx)(s.code,{children:"--secrets-encryption"})]}),"\n"]}),"\n",(0,n.jsx)(s.h2,{id:"existing-single-node-clusters",children:"Existing single-node clusters"}),"\n",(0,n.jsx)(s.admonition,{title:"Version Gate",type:"info",children:(0,n.jsxs)(s.p,{children:["Available as of ",(0,n.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/releases/tag/v1.22.2%2Bk3s1",children:"v1.22.2+k3s1"})]})}),"\n",(0,n.jsxs)(s.p,{children:["If you have an existing cluster using the default embedded SQLite database, you can convert it to etcd by simply restarting your K3s server with the ",(0,n.jsx)(s.code,{children:"--cluster-init"})," flag. Once you've done that, you'll be able to add additional instances as described above."]}),"\n",(0,n.jsxs)(s.p,{children:["If an etcd datastore is found on disk either because that node has either initialized or joined a cluster already, the datastore arguments (",(0,n.jsx)(s.code,{children:"--cluster-init"}),", ",(0,n.jsx)(s.code,{children:"--server"}),", ",(0,n.jsx)(s.code,{children:"--datastore-endpoint"}),", etc) are ignored."]})]})}function h(e={}){const{wrapper:s}={...(0,r.a)(),...e.components};return s?(0,n.jsx)(s,{...e,children:(0,n.jsx)(c,{...e})}):c(e)}},1151:(e,s,t)=>{t.d(s,{Z:()=>a,a:()=>i});var n=t(7294);const r={},d=n.createContext(r);function i(e){const s=n.useContext(d);return n.useMemo((function(){return"function"==typeof e?e(s):{...s,...e}}),[s,e])}function a(e){let s;return s=e.disableParentContext?"function"==typeof e.components?e.components(r):e.components||r:i(e.components),n.createElement(d.Provider,{value:s},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/b8002741.78f49153.js b/assets/js/b8002741.1d77b91e.js similarity index 99% rename from assets/js/b8002741.78f49153.js rename to assets/js/b8002741.1d77b91e.js index 8c03adbd5..059a55547 100644 --- a/assets/js/b8002741.78f49153.js +++ b/assets/js/b8002741.1d77b91e.js @@ -1 +1 @@ -"use strict";(self.webpackChunkk_3_s_docs=self.webpackChunkk_3_s_docs||[]).push([[2573],{3338:(e,s,i)=>{i.r(s),i.d(s,{assets:()=>c,contentTitle:()=>l,default:()=>o,frontMatter:()=>n,metadata:()=>h,toc:()=>d});var r=i(5893),t=i(1151);const n={hide_table_of_contents:!0,sidebar_position:1},l="v1.30.X",h={id:"release-notes/v1.30.X",title:"v1.30.X",description:"Before upgrading from earlier releases, be sure to read the Kubernetes Urgent Upgrade Notes.",source:"@site/docs/release-notes/v1.30.X.md",sourceDirName:"release-notes",slug:"/release-notes/v1.30.X",permalink:"/release-notes/v1.30.X",draft:!1,unlisted:!1,editUrl:"https://github.com/k3s-io/docs/edit/main/docs/release-notes/v1.30.X.md",tags:[],version:"current",lastUpdatedAt:1723651727e3,sidebarPosition:1,frontMatter:{hide_table_of_contents:!0,sidebar_position:1},sidebar:"mySidebar",previous:{title:"Resource Profiling",permalink:"/reference/resource-profiling"},next:{title:"v1.29.X",permalink:"/release-notes/v1.29.X"}},c={},d=[{value:"Release v1.30.3+k3s1",id:"release-v1303k3s1",level:2},{value:"Changes since v1.30.2+k3s2:",id:"changes-since-v1302k3s2",level:3},{value:"Release v1.30.2+k3s2",id:"release-v1302k3s2",level:2},{value:"Changes since v1.30.2+k3s1:",id:"changes-since-v1302k3s1",level:3},{value:"Release v1.30.2+k3s1",id:"release-v1302k3s1",level:2},{value:"Changes since v1.30.1+k3s1:",id:"changes-since-v1301k3s1",level:3},{value:"Release v1.30.1+k3s1",id:"release-v1301k3s1",level:2},{value:"Changes since v1.30.0+k3s1:",id:"changes-since-v1300k3s1",level:3},{value:"Release v1.30.0+k3s1",id:"release-v1300k3s1",level:2},{value:"Changes since v1.29.4+k3s1:",id:"changes-since-v1294k3s1",level:3}];function a(e){const s={a:"a",admonition:"admonition",code:"code",h1:"h1",h2:"h2",h3:"h3",header:"header",hr:"hr",li:"li",p:"p",table:"table",tbody:"tbody",td:"td",th:"th",thead:"thead",tr:"tr",ul:"ul",...(0,t.a)(),...e.components};return(0,r.jsxs)(r.Fragment,{children:[(0,r.jsx)(s.header,{children:(0,r.jsx)(s.h1,{id:"v130x",children:"v1.30.X"})}),"\n",(0,r.jsx)(s.admonition,{title:"Upgrade Notice",type:"warning",children:(0,r.jsxs)(s.p,{children:["Before upgrading from earlier releases, be sure to read the Kubernetes ",(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.30.md#urgent-upgrade-notes",children:"Urgent Upgrade Notes"}),"."]})}),"\n",(0,r.jsxs)(s.table,{children:[(0,r.jsx)(s.thead,{children:(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.th,{children:"Version"}),(0,r.jsx)(s.th,{children:"Release date"}),(0,r.jsx)(s.th,{children:"Kubernetes"}),(0,r.jsx)(s.th,{children:"Kine"}),(0,r.jsx)(s.th,{children:"SQLite"}),(0,r.jsx)(s.th,{children:"Etcd"}),(0,r.jsx)(s.th,{children:"Containerd"}),(0,r.jsx)(s.th,{children:"Runc"}),(0,r.jsx)(s.th,{children:"Flannel"}),(0,r.jsx)(s.th,{children:"Metrics-server"}),(0,r.jsx)(s.th,{children:"Traefik"}),(0,r.jsx)(s.th,{children:"CoreDNS"}),(0,r.jsx)(s.th,{children:"Helm-controller"}),(0,r.jsx)(s.th,{children:"Local-path-provisioner"})]})}),(0,r.jsxs)(s.tbody,{children:[(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"/release-notes/v1.30.X#release-v1303k3s1",children:"v1.30.3+k3s1"})}),(0,r.jsx)(s.td,{children:"Jul 31 2024"}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.30.md#v1303",children:"v1.30.3"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/kine/releases/tag/v0.11.11",children:"v0.11.11"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://sqlite.org/releaselog/3_44_0.html",children:"3.44.0"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/etcd/releases/tag/v3.5.13-k3s1",children:"v3.5.13-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/containerd/releases/tag/v1.7.17-k3s1",children:"v1.7.17-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/opencontainers/runc/releases/tag/v1.1.12",children:"v1.1.12"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/flannel-io/flannel/releases/tag/v0.25.4",children:"v0.25.4"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.7.0",children:"v0.7.0"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/traefik/traefik/releases/tag/v2.10.7",children:"v2.10.7"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/coredns/coredns/releases/tag/v1.10.1",children:"v1.10.1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/helm-controller/releases/tag/v0.16.1",children:"v0.16.1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/rancher/local-path-provisioner/releases/tag/v0.0.28",children:"v0.0.28"})})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"/release-notes/v1.30.X#release-v1302k3s2",children:"v1.30.2+k3s2"})}),(0,r.jsx)(s.td,{children:"Jul 03 2024"}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.30.md#v1302",children:"v1.30.2"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/kine/releases/tag/v0.11.9",children:"v0.11.9"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://sqlite.org/releaselog/3_44_0.html",children:"3.44.0"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/etcd/releases/tag/v3.5.13-k3s1",children:"v3.5.13-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/containerd/releases/tag/v1.7.17-k3s1",children:"v1.7.17-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/opencontainers/runc/releases/tag/v1.1.12",children:"v1.1.12"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/flannel-io/flannel/releases/tag/v0.25.4",children:"v0.25.4"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.7.0",children:"v0.7.0"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/traefik/traefik/releases/tag/v2.10.7",children:"v2.10.7"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/coredns/coredns/releases/tag/v1.10.1",children:"v1.10.1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/helm-controller/releases/tag/v0.16.1",children:"v0.16.1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/rancher/local-path-provisioner/releases/tag/v0.0.27",children:"v0.0.27"})})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"/release-notes/v1.30.X#release-v1302k3s1",children:"v1.30.2+k3s1"})}),(0,r.jsx)(s.td,{children:"Jun 25 2024"}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.30.md#v1302",children:"v1.30.2"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/kine/releases/tag/v0.11.9",children:"v0.11.9"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://sqlite.org/releaselog/3_44_0.html",children:"3.44.0"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/etcd/releases/tag/v3.5.13-k3s1",children:"v3.5.13-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/containerd/releases/tag/v1.7.17-k3s1",children:"v1.7.17-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/opencontainers/runc/releases/tag/v1.1.12",children:"v1.1.12"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/flannel-io/flannel/releases/tag/v0.25.2",children:"v0.25.2"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.7.0",children:"v0.7.0"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/traefik/traefik/releases/tag/v2.10.7",children:"v2.10.7"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/coredns/coredns/releases/tag/v1.10.1",children:"v1.10.1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/helm-controller/releases/tag/v0.16.1",children:"v0.16.1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/rancher/local-path-provisioner/releases/tag/v0.0.27",children:"v0.0.27"})})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"/release-notes/v1.30.X#release-v1301k3s1",children:"v1.30.1+k3s1"})}),(0,r.jsx)(s.td,{children:"May 22 2024"}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.30.md#v1301",children:"v1.30.1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/kine/releases/tag/v0.11.8-0.20240430184817-f9ce6f8da97b",children:"v0.11.8-0.20240430184817-f9ce6f8da97b"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://sqlite.org/releaselog/3_44_0.html",children:"3.44.0"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/etcd/releases/tag/v3.5.9-k3s1",children:"v3.5.9-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/containerd/releases/tag/v1.7.15-k3s1",children:"v1.7.15-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/opencontainers/runc/releases/tag/v1.1.12-k3s1",children:"v1.1.12-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/flannel-io/flannel/releases/tag/v0.24.2",children:"v0.24.2"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.7.0",children:"v0.7.0"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/traefik/traefik/releases/tag/v2.10.7",children:"v2.10.7"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/coredns/coredns/releases/tag/v1.10.1",children:"v1.10.1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/helm-controller/releases/tag/v0.16.1-0.20240502205943-2f32059d43e6",children:"v0.16.1-0.20240502205943-2f32059d43e6"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/rancher/local-path-provisioner/releases/tag/v0.0.26",children:"v0.0.26"})})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"/release-notes/v1.30.X#release-v1300k3s1",children:"v1.30.0+k3s1"})}),(0,r.jsx)(s.td,{children:"May 10 2024"}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.30.md#v1300",children:"v1.30.0"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/kine/releases/tag/v0.11.7",children:"v0.11.8"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://sqlite.org/releaselog/3_44_0.html",children:"3.44.0"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/etcd/releases/tag/v3.5.9-k3s1",children:"v3.5.9-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/containerd/releases/tag/v1.7.15-k3s1",children:"v1.7.15-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/opencontainers/runc/releases/tag/v1.1.12",children:"v1.1.12"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/flannel-io/flannel/releases/tag/v0.24.2",children:"v0.24.2"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.7.0",children:"v0.7.0"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/traefik/traefik/releases/tag/v2.10.7",children:"v2.10.7"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/coredns/coredns/releases/tag/v1.10.1",children:"v1.10.1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/helm-controller/releases/tag/v0.15.9",children:"v0.16.1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/rancher/local-path-provisioner/releases/tag/v0.0.26",children:"v0.0.26"})})]})]})]}),"\n",(0,r.jsx)("br",{}),"\n",(0,r.jsxs)(s.h2,{id:"release-v1303k3s1",children:["Release ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/releases/tag/v1.30.3+k3s1",children:"v1.30.3+k3s1"})]}),"\n",(0,r.jsx)(s.p,{children:"This release updates Kubernetes to v1.30.3, and fixes a number of issues."}),"\n",(0,r.jsxs)(s.p,{children:["For more details on what's new, see the ",(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.30.md#changelog-since-v1302",children:"Kubernetes release notes"}),"."]}),"\n",(0,r.jsx)(s.h3,{id:"changes-since-v1302k3s2",children:"Changes since v1.30.2+k3s2:"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsxs)(s.li,{children:["Update channel server for k3s2 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10446",children:"(#10446)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Set correct release channel for e2e upgrade test ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10460",children:"(#10460)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Backports for 2024-07 release cycle ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10497",children:"(#10497)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:"Bump k3s-root to v0.14.0"}),"\n",(0,r.jsx)(s.li,{children:"Bump github.com/hashicorp/go-retryablehttp from 0.7.4 to 0.7.7"}),"\n",(0,r.jsx)(s.li,{children:"Bump Local Path Provisioner version"}),"\n",(0,r.jsx)(s.li,{children:"Ensure remotedialer kubelet connections use kubelet bind address"}),"\n",(0,r.jsx)(s.li,{children:"Chore: Bump Trivy version"}),"\n",(0,r.jsx)(s.li,{children:"Add etcd s3 config secret implementation"}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["July Test Backports ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10507",children:"(#10507)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Update to v1.30.3-k3s1 and Go 1.22.5 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10536",children:"(#10536)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Fix issues loading data-dir value from env vars or dropping config files ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10596",children:"(#10596)"})]}),"\n"]}),"\n",(0,r.jsx)(s.hr,{}),"\n",(0,r.jsxs)(s.h2,{id:"release-v1302k3s2",children:["Release ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/releases/tag/v1.30.2+k3s2",children:"v1.30.2+k3s2"})]}),"\n",(0,r.jsx)(s.p,{children:"This release updates Kubernetes to v1.30.2, and fixes a number of issues."}),"\n",(0,r.jsxs)(s.p,{children:["For more details on what's new, see the ",(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.30.md#changelog-since-v1302",children:"Kubernetes release notes"}),"."]}),"\n",(0,r.jsx)(s.h3,{id:"changes-since-v1302k3s1",children:"Changes since v1.30.2+k3s1:"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsxs)(s.li,{children:["Update stable channel to v1.29.6+k3s1 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10417",children:"(#10417)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Update flannel to v0.25.4 and fixed issue with IPv6 mask ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10422",children:"(#10422)"})]}),"\n"]}),"\n",(0,r.jsx)(s.hr,{}),"\n",(0,r.jsxs)(s.h2,{id:"release-v1302k3s1",children:["Release ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/releases/tag/v1.30.2+k3s1",children:"v1.30.2+k3s1"})]}),"\n",(0,r.jsx)(s.p,{children:"This release updates Kubernetes to v1.30.2, and fixes a number of issues."}),"\n",(0,r.jsxs)(s.p,{children:["For more details on what's new, see the ",(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.30.md#changelog-since-v1301",children:"Kubernetes release notes"}),"."]}),"\n",(0,r.jsx)(s.h3,{id:"changes-since-v1301k3s1",children:"Changes since v1.30.1+k3s1:"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsxs)(s.li,{children:["Fix bug when using tailscale config by file ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10074",children:"(#10074)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsxs)(s.li,{children:["Fix bug when using ",(0,r.jsx)(s.code,{children:"vpn-auth-file"})," in the agent"]}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Add WithSkipMissing to not fail import on missing blobs ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10136",children:"(#10136)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Use fixed stream server bind address for cri-dockerd ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9975",children:"(#9975)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Switch stargz over to cri registry config_path ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9977",children:"(#9977)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Bump to containerd v1.7.17, etcd v3.5.13 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10123",children:"(#10123)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Bump spegel version ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10118",children:"(#10118)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Fix issue installing artifacts from PR builds with multiple runs ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10122",children:"(#10122)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Fix issue with ",(0,r.jsx)(s.code,{children:"externalTrafficPolicy: Local"})," for single-stack services on dual-stack nodes ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9963",children:"(#9963)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Update local-path-provisioner helper script ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9964",children:"(#9964)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Add support for svclb pod PriorityClassName ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10045",children:"(#10045)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsxs)(s.li,{children:["ServiceLB now sets the priorityClassName on svclb pods to ",(0,r.jsx)(s.code,{children:"system-node-critical"})," by default. This can be overridden on a per-service basis via the ",(0,r.jsx)(s.code,{children:"svccontroller.k3s.cattle.io/priorityclassname"})," annotation."]}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Drop check for legacy traefik v1 chart ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9593",children:"(#9593)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:"K3s no longer automatically skips deploying traefik v2 if traefik v1 is present. All clusters should have been upgraded to v2 at some point over the last three years."}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Update kube-router version to v2.1.2 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10177",children:"(#10177)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Create ADR for branching strategy ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10147",children:"(#10147)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Bump minio-go to v7.0.70 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10081",children:"(#10081)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Bump kine to v0.11.9 to fix pagination ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10082",children:"(#10082)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Update valid resolv conf ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9948",children:"(#9948)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Add missing kernel config check ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10100",children:"(#10100)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Git workflow file name correction ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10131",children:"(#10131)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:"None"}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Follow directory symlinks in auto deploying manifests (#9288) ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10049",children:"(#10049)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:"Symlinked sub-directories are now respected when scanning Auto-Deploying Manifests (AddOns)"}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Fix bug: allow helm controller set owner reference ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10048",children:"(#10048)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Fix go.mod ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10192",children:"(#10192)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Bump flannel version to v0.25.2 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10146",children:"(#10146)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Test: add agent with auth file ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10119",children:"(#10119)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsxs)(s.li,{children:["Fix bug when using ",(0,r.jsx)(s.code,{children:"vpn-auth-file"})," in the agent"]}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Add extra log in e2e tests ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10145",children:"(#10145)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Update channel server for may 2024 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10137",children:"(#10137)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Bump klipper-helm image for tls secret support ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10187",children:"(#10187)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Updating the script binary_size_check to complete the command name by\u2026 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9992",children:"(#9992)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Fix issue with k3s-etcd informers not starting ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10047",children:"(#10047)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Enable serving supervisor metrics ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10019",children:"(#10019)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsxs)(s.li,{children:[(0,r.jsx)(s.code,{children:"--Enable-pprof"})," can now be set on agents to enable the debug/pprof endpoints. When set, agents will listen on the supervisor port."]}),"\n",(0,r.jsxs)(s.li,{children:[(0,r.jsx)(s.code,{children:"--Supervisor-metrics"})," can now be set on servers to enable serving internal metrics on the supervisor endpoint; when set agents will listen on the supervisor port."]}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Bump alpine from 3.18 to 3.20 in /conformance ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10210",children:"(#10210)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Bump alpine from 3.18 to 3.20 in /package ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10211",children:"(#10211)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Bump ubuntu from 22.04 to 24.04 in /tests/e2e/scripts ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10040",children:"(#10040)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Bump Trivy version ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10039",children:"(#10039)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Fix netpol crash when node remains tainted uninitialized ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10073",children:"(#10073)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Fix issue caused by sole server marked as failed under load ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10241",children:"(#10241)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:"The embedded load-balancer will now fall back to trying all servers with health-checks ignored, if all servers have been marked unavailable due to failed health checks."}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Add write-kubeconfig-group flag to server ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9233",children:"(#9233)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:"New flag in k3s server: --write-kubeconfig-group"}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Fix embedded mirror blocked by SAR RBAC and re-enable test ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10257",children:"(#10257)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Bump Local Path Provisioner version ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10268",children:"(#10268)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Fix: Use actual warningPeriod in certmonitor ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10271",children:"(#10271)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Fix bug that caused agents to bypass local loadbalancer ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10280",children:"(#10280)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Add ADR for support for etcd s3 config secret ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9364",children:"(#9364)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Add test for ",(0,r.jsx)(s.code,{children:"isValidResolvConf"})," ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10302",children:"(#10302)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Add snapshot retention etcd-s3-folder fix ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10293",children:"(#10293)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Expand GHA golang caching to include newest release branch ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10307",children:"(#10307)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Fix race condition panic in loadbalancer.nextServer ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10318",children:"(#10318)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Fix typo, use ",(0,r.jsx)(s.code,{children:"rancher/permissions"})," ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10296",children:"(#10296)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Update Kubernetes to v1.30.2 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10349",children:"(#10349)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Fix agent supervisor port using apiserver port instead ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10352",children:"(#10352)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Fix issue that allowed multiple simultaneous snapshots to be allowed ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10372",children:"(#10372)"})]}),"\n"]}),"\n",(0,r.jsx)(s.hr,{}),"\n",(0,r.jsxs)(s.h2,{id:"release-v1301k3s1",children:["Release ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/releases/tag/v1.30.1+k3s1",children:"v1.30.1+k3s1"})]}),"\n",(0,r.jsx)(s.p,{children:"This release updates Kubernetes to v1.30.1, and fixes a number of issues."}),"\n",(0,r.jsxs)(s.p,{children:["For more details on what's new, see the ",(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.30.md#changelog-since-v1300",children:"Kubernetes release notes"}),"."]}),"\n",(0,r.jsx)(s.h3,{id:"changes-since-v1300k3s1",children:"Changes since v1.30.0+k3s1:"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsxs)(s.li,{children:["Replace deprecated ruby function in e2e tests ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10084",children:"(#10084)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Update channels with 1.30 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10097",children:"(#10097)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Address 461 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10112",children:"(#10112)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Update to v1.30.1-k3s1 and Go 1.22.2 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10105",children:"(#10105)"})]}),"\n"]}),"\n",(0,r.jsx)(s.hr,{}),"\n",(0,r.jsxs)(s.h2,{id:"release-v1300k3s1",children:["Release ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/releases/tag/v1.30.0+k3s1",children:"v1.30.0+k3s1"})]}),"\n",(0,r.jsx)(s.p,{children:"This release is K3S's first in the v1.30 line. This release updates Kubernetes to v1.30.0."}),"\n",(0,r.jsxs)(s.p,{children:["For more details on what's new, see the ",(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.30.md#changelog-since-v1290",children:"Kubernetes release notes"}),"."]}),"\n",(0,r.jsx)(s.h3,{id:"changes-since-v1294k3s1",children:"Changes since v1.29.4+k3s1:"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsxs)(s.li,{children:["Kubernetes V1.30.0-k3s1 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10063",children:"(#10063)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Update stable channel to v1.29.4+k3s1 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10031",children:"(#10031)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Add E2E Split Server to Drone, support parallel testing in Drone ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9940",children:"(#9940)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Bump E2E opensuse leap to 15.6, fix btrfs test ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10057",children:"(#10057)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Remove deprecated ",(0,r.jsx)(s.code,{children:"pod-infra-container-image"})," kubelet flag ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7409",children:"(#7409)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Fix e2e tests ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10061",children:"(#10061)"})]}),"\n"]}),"\n",(0,r.jsx)(s.hr,{})]})}function o(e={}){const{wrapper:s}={...(0,t.a)(),...e.components};return s?(0,r.jsx)(s,{...e,children:(0,r.jsx)(a,{...e})}):a(e)}},1151:(e,s,i)=>{i.d(s,{Z:()=>h,a:()=>l});var r=i(7294);const t={},n=r.createContext(t);function l(e){const s=r.useContext(n);return r.useMemo((function(){return"function"==typeof e?e(s):{...s,...e}}),[s,e])}function h(e){let s;return s=e.disableParentContext?"function"==typeof e.components?e.components(t):e.components||t:l(e.components),r.createElement(n.Provider,{value:s},e.children)}}}]); \ No newline at end of file +"use strict";(self.webpackChunkk_3_s_docs=self.webpackChunkk_3_s_docs||[]).push([[2573],{3338:(e,s,i)=>{i.r(s),i.d(s,{assets:()=>c,contentTitle:()=>l,default:()=>o,frontMatter:()=>n,metadata:()=>h,toc:()=>d});var r=i(5893),t=i(1151);const n={hide_table_of_contents:!0,sidebar_position:1},l="v1.30.X",h={id:"release-notes/v1.30.X",title:"v1.30.X",description:"Before upgrading from earlier releases, be sure to read the Kubernetes Urgent Upgrade Notes.",source:"@site/docs/release-notes/v1.30.X.md",sourceDirName:"release-notes",slug:"/release-notes/v1.30.X",permalink:"/release-notes/v1.30.X",draft:!1,unlisted:!1,editUrl:"https://github.com/k3s-io/docs/edit/main/docs/release-notes/v1.30.X.md",tags:[],version:"current",lastUpdatedAt:1723747404e3,sidebarPosition:1,frontMatter:{hide_table_of_contents:!0,sidebar_position:1},sidebar:"mySidebar",previous:{title:"Resource Profiling",permalink:"/reference/resource-profiling"},next:{title:"v1.29.X",permalink:"/release-notes/v1.29.X"}},c={},d=[{value:"Release v1.30.3+k3s1",id:"release-v1303k3s1",level:2},{value:"Changes since v1.30.2+k3s2:",id:"changes-since-v1302k3s2",level:3},{value:"Release v1.30.2+k3s2",id:"release-v1302k3s2",level:2},{value:"Changes since v1.30.2+k3s1:",id:"changes-since-v1302k3s1",level:3},{value:"Release v1.30.2+k3s1",id:"release-v1302k3s1",level:2},{value:"Changes since v1.30.1+k3s1:",id:"changes-since-v1301k3s1",level:3},{value:"Release v1.30.1+k3s1",id:"release-v1301k3s1",level:2},{value:"Changes since v1.30.0+k3s1:",id:"changes-since-v1300k3s1",level:3},{value:"Release v1.30.0+k3s1",id:"release-v1300k3s1",level:2},{value:"Changes since v1.29.4+k3s1:",id:"changes-since-v1294k3s1",level:3}];function a(e){const s={a:"a",admonition:"admonition",code:"code",h1:"h1",h2:"h2",h3:"h3",header:"header",hr:"hr",li:"li",p:"p",table:"table",tbody:"tbody",td:"td",th:"th",thead:"thead",tr:"tr",ul:"ul",...(0,t.a)(),...e.components};return(0,r.jsxs)(r.Fragment,{children:[(0,r.jsx)(s.header,{children:(0,r.jsx)(s.h1,{id:"v130x",children:"v1.30.X"})}),"\n",(0,r.jsx)(s.admonition,{title:"Upgrade Notice",type:"warning",children:(0,r.jsxs)(s.p,{children:["Before upgrading from earlier releases, be sure to read the Kubernetes ",(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.30.md#urgent-upgrade-notes",children:"Urgent Upgrade Notes"}),"."]})}),"\n",(0,r.jsxs)(s.table,{children:[(0,r.jsx)(s.thead,{children:(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.th,{children:"Version"}),(0,r.jsx)(s.th,{children:"Release date"}),(0,r.jsx)(s.th,{children:"Kubernetes"}),(0,r.jsx)(s.th,{children:"Kine"}),(0,r.jsx)(s.th,{children:"SQLite"}),(0,r.jsx)(s.th,{children:"Etcd"}),(0,r.jsx)(s.th,{children:"Containerd"}),(0,r.jsx)(s.th,{children:"Runc"}),(0,r.jsx)(s.th,{children:"Flannel"}),(0,r.jsx)(s.th,{children:"Metrics-server"}),(0,r.jsx)(s.th,{children:"Traefik"}),(0,r.jsx)(s.th,{children:"CoreDNS"}),(0,r.jsx)(s.th,{children:"Helm-controller"}),(0,r.jsx)(s.th,{children:"Local-path-provisioner"})]})}),(0,r.jsxs)(s.tbody,{children:[(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"/release-notes/v1.30.X#release-v1303k3s1",children:"v1.30.3+k3s1"})}),(0,r.jsx)(s.td,{children:"Jul 31 2024"}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.30.md#v1303",children:"v1.30.3"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/kine/releases/tag/v0.11.11",children:"v0.11.11"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://sqlite.org/releaselog/3_44_0.html",children:"3.44.0"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/etcd/releases/tag/v3.5.13-k3s1",children:"v3.5.13-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/containerd/releases/tag/v1.7.17-k3s1",children:"v1.7.17-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/opencontainers/runc/releases/tag/v1.1.12",children:"v1.1.12"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/flannel-io/flannel/releases/tag/v0.25.4",children:"v0.25.4"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.7.0",children:"v0.7.0"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/traefik/traefik/releases/tag/v2.10.7",children:"v2.10.7"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/coredns/coredns/releases/tag/v1.10.1",children:"v1.10.1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/helm-controller/releases/tag/v0.16.1",children:"v0.16.1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/rancher/local-path-provisioner/releases/tag/v0.0.28",children:"v0.0.28"})})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"/release-notes/v1.30.X#release-v1302k3s2",children:"v1.30.2+k3s2"})}),(0,r.jsx)(s.td,{children:"Jul 03 2024"}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.30.md#v1302",children:"v1.30.2"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/kine/releases/tag/v0.11.9",children:"v0.11.9"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://sqlite.org/releaselog/3_44_0.html",children:"3.44.0"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/etcd/releases/tag/v3.5.13-k3s1",children:"v3.5.13-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/containerd/releases/tag/v1.7.17-k3s1",children:"v1.7.17-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/opencontainers/runc/releases/tag/v1.1.12",children:"v1.1.12"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/flannel-io/flannel/releases/tag/v0.25.4",children:"v0.25.4"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.7.0",children:"v0.7.0"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/traefik/traefik/releases/tag/v2.10.7",children:"v2.10.7"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/coredns/coredns/releases/tag/v1.10.1",children:"v1.10.1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/helm-controller/releases/tag/v0.16.1",children:"v0.16.1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/rancher/local-path-provisioner/releases/tag/v0.0.27",children:"v0.0.27"})})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"/release-notes/v1.30.X#release-v1302k3s1",children:"v1.30.2+k3s1"})}),(0,r.jsx)(s.td,{children:"Jun 25 2024"}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.30.md#v1302",children:"v1.30.2"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/kine/releases/tag/v0.11.9",children:"v0.11.9"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://sqlite.org/releaselog/3_44_0.html",children:"3.44.0"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/etcd/releases/tag/v3.5.13-k3s1",children:"v3.5.13-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/containerd/releases/tag/v1.7.17-k3s1",children:"v1.7.17-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/opencontainers/runc/releases/tag/v1.1.12",children:"v1.1.12"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/flannel-io/flannel/releases/tag/v0.25.2",children:"v0.25.2"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.7.0",children:"v0.7.0"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/traefik/traefik/releases/tag/v2.10.7",children:"v2.10.7"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/coredns/coredns/releases/tag/v1.10.1",children:"v1.10.1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/helm-controller/releases/tag/v0.16.1",children:"v0.16.1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/rancher/local-path-provisioner/releases/tag/v0.0.27",children:"v0.0.27"})})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"/release-notes/v1.30.X#release-v1301k3s1",children:"v1.30.1+k3s1"})}),(0,r.jsx)(s.td,{children:"May 22 2024"}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.30.md#v1301",children:"v1.30.1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/kine/releases/tag/v0.11.8-0.20240430184817-f9ce6f8da97b",children:"v0.11.8-0.20240430184817-f9ce6f8da97b"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://sqlite.org/releaselog/3_44_0.html",children:"3.44.0"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/etcd/releases/tag/v3.5.9-k3s1",children:"v3.5.9-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/containerd/releases/tag/v1.7.15-k3s1",children:"v1.7.15-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/opencontainers/runc/releases/tag/v1.1.12-k3s1",children:"v1.1.12-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/flannel-io/flannel/releases/tag/v0.24.2",children:"v0.24.2"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.7.0",children:"v0.7.0"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/traefik/traefik/releases/tag/v2.10.7",children:"v2.10.7"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/coredns/coredns/releases/tag/v1.10.1",children:"v1.10.1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/helm-controller/releases/tag/v0.16.1-0.20240502205943-2f32059d43e6",children:"v0.16.1-0.20240502205943-2f32059d43e6"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/rancher/local-path-provisioner/releases/tag/v0.0.26",children:"v0.0.26"})})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"/release-notes/v1.30.X#release-v1300k3s1",children:"v1.30.0+k3s1"})}),(0,r.jsx)(s.td,{children:"May 10 2024"}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.30.md#v1300",children:"v1.30.0"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/kine/releases/tag/v0.11.7",children:"v0.11.8"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://sqlite.org/releaselog/3_44_0.html",children:"3.44.0"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/etcd/releases/tag/v3.5.9-k3s1",children:"v3.5.9-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/containerd/releases/tag/v1.7.15-k3s1",children:"v1.7.15-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/opencontainers/runc/releases/tag/v1.1.12",children:"v1.1.12"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/flannel-io/flannel/releases/tag/v0.24.2",children:"v0.24.2"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.7.0",children:"v0.7.0"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/traefik/traefik/releases/tag/v2.10.7",children:"v2.10.7"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/coredns/coredns/releases/tag/v1.10.1",children:"v1.10.1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/helm-controller/releases/tag/v0.15.9",children:"v0.16.1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/rancher/local-path-provisioner/releases/tag/v0.0.26",children:"v0.0.26"})})]})]})]}),"\n",(0,r.jsx)("br",{}),"\n",(0,r.jsxs)(s.h2,{id:"release-v1303k3s1",children:["Release ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/releases/tag/v1.30.3+k3s1",children:"v1.30.3+k3s1"})]}),"\n",(0,r.jsx)(s.p,{children:"This release updates Kubernetes to v1.30.3, and fixes a number of issues."}),"\n",(0,r.jsxs)(s.p,{children:["For more details on what's new, see the ",(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.30.md#changelog-since-v1302",children:"Kubernetes release notes"}),"."]}),"\n",(0,r.jsx)(s.h3,{id:"changes-since-v1302k3s2",children:"Changes since v1.30.2+k3s2:"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsxs)(s.li,{children:["Update channel server for k3s2 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10446",children:"(#10446)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Set correct release channel for e2e upgrade test ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10460",children:"(#10460)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Backports for 2024-07 release cycle ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10497",children:"(#10497)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:"Bump k3s-root to v0.14.0"}),"\n",(0,r.jsx)(s.li,{children:"Bump github.com/hashicorp/go-retryablehttp from 0.7.4 to 0.7.7"}),"\n",(0,r.jsx)(s.li,{children:"Bump Local Path Provisioner version"}),"\n",(0,r.jsx)(s.li,{children:"Ensure remotedialer kubelet connections use kubelet bind address"}),"\n",(0,r.jsx)(s.li,{children:"Chore: Bump Trivy version"}),"\n",(0,r.jsx)(s.li,{children:"Add etcd s3 config secret implementation"}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["July Test Backports ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10507",children:"(#10507)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Update to v1.30.3-k3s1 and Go 1.22.5 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10536",children:"(#10536)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Fix issues loading data-dir value from env vars or dropping config files ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10596",children:"(#10596)"})]}),"\n"]}),"\n",(0,r.jsx)(s.hr,{}),"\n",(0,r.jsxs)(s.h2,{id:"release-v1302k3s2",children:["Release ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/releases/tag/v1.30.2+k3s2",children:"v1.30.2+k3s2"})]}),"\n",(0,r.jsx)(s.p,{children:"This release updates Kubernetes to v1.30.2, and fixes a number of issues."}),"\n",(0,r.jsxs)(s.p,{children:["For more details on what's new, see the ",(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.30.md#changelog-since-v1302",children:"Kubernetes release notes"}),"."]}),"\n",(0,r.jsx)(s.h3,{id:"changes-since-v1302k3s1",children:"Changes since v1.30.2+k3s1:"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsxs)(s.li,{children:["Update stable channel to v1.29.6+k3s1 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10417",children:"(#10417)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Update flannel to v0.25.4 and fixed issue with IPv6 mask ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10422",children:"(#10422)"})]}),"\n"]}),"\n",(0,r.jsx)(s.hr,{}),"\n",(0,r.jsxs)(s.h2,{id:"release-v1302k3s1",children:["Release ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/releases/tag/v1.30.2+k3s1",children:"v1.30.2+k3s1"})]}),"\n",(0,r.jsx)(s.p,{children:"This release updates Kubernetes to v1.30.2, and fixes a number of issues."}),"\n",(0,r.jsxs)(s.p,{children:["For more details on what's new, see the ",(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.30.md#changelog-since-v1301",children:"Kubernetes release notes"}),"."]}),"\n",(0,r.jsx)(s.h3,{id:"changes-since-v1301k3s1",children:"Changes since v1.30.1+k3s1:"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsxs)(s.li,{children:["Fix bug when using tailscale config by file ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10074",children:"(#10074)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsxs)(s.li,{children:["Fix bug when using ",(0,r.jsx)(s.code,{children:"vpn-auth-file"})," in the agent"]}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Add WithSkipMissing to not fail import on missing blobs ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10136",children:"(#10136)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Use fixed stream server bind address for cri-dockerd ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9975",children:"(#9975)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Switch stargz over to cri registry config_path ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9977",children:"(#9977)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Bump to containerd v1.7.17, etcd v3.5.13 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10123",children:"(#10123)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Bump spegel version ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10118",children:"(#10118)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Fix issue installing artifacts from PR builds with multiple runs ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10122",children:"(#10122)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Fix issue with ",(0,r.jsx)(s.code,{children:"externalTrafficPolicy: Local"})," for single-stack services on dual-stack nodes ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9963",children:"(#9963)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Update local-path-provisioner helper script ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9964",children:"(#9964)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Add support for svclb pod PriorityClassName ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10045",children:"(#10045)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsxs)(s.li,{children:["ServiceLB now sets the priorityClassName on svclb pods to ",(0,r.jsx)(s.code,{children:"system-node-critical"})," by default. This can be overridden on a per-service basis via the ",(0,r.jsx)(s.code,{children:"svccontroller.k3s.cattle.io/priorityclassname"})," annotation."]}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Drop check for legacy traefik v1 chart ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9593",children:"(#9593)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:"K3s no longer automatically skips deploying traefik v2 if traefik v1 is present. All clusters should have been upgraded to v2 at some point over the last three years."}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Update kube-router version to v2.1.2 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10177",children:"(#10177)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Create ADR for branching strategy ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10147",children:"(#10147)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Bump minio-go to v7.0.70 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10081",children:"(#10081)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Bump kine to v0.11.9 to fix pagination ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10082",children:"(#10082)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Update valid resolv conf ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9948",children:"(#9948)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Add missing kernel config check ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10100",children:"(#10100)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Git workflow file name correction ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10131",children:"(#10131)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:"None"}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Follow directory symlinks in auto deploying manifests (#9288) ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10049",children:"(#10049)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:"Symlinked sub-directories are now respected when scanning Auto-Deploying Manifests (AddOns)"}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Fix bug: allow helm controller set owner reference ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10048",children:"(#10048)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Fix go.mod ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10192",children:"(#10192)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Bump flannel version to v0.25.2 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10146",children:"(#10146)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Test: add agent with auth file ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10119",children:"(#10119)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsxs)(s.li,{children:["Fix bug when using ",(0,r.jsx)(s.code,{children:"vpn-auth-file"})," in the agent"]}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Add extra log in e2e tests ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10145",children:"(#10145)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Update channel server for may 2024 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10137",children:"(#10137)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Bump klipper-helm image for tls secret support ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10187",children:"(#10187)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Updating the script binary_size_check to complete the command name by\u2026 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9992",children:"(#9992)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Fix issue with k3s-etcd informers not starting ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10047",children:"(#10047)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Enable serving supervisor metrics ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10019",children:"(#10019)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsxs)(s.li,{children:[(0,r.jsx)(s.code,{children:"--Enable-pprof"})," can now be set on agents to enable the debug/pprof endpoints. When set, agents will listen on the supervisor port."]}),"\n",(0,r.jsxs)(s.li,{children:[(0,r.jsx)(s.code,{children:"--Supervisor-metrics"})," can now be set on servers to enable serving internal metrics on the supervisor endpoint; when set agents will listen on the supervisor port."]}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Bump alpine from 3.18 to 3.20 in /conformance ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10210",children:"(#10210)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Bump alpine from 3.18 to 3.20 in /package ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10211",children:"(#10211)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Bump ubuntu from 22.04 to 24.04 in /tests/e2e/scripts ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10040",children:"(#10040)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Bump Trivy version ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10039",children:"(#10039)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Fix netpol crash when node remains tainted uninitialized ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10073",children:"(#10073)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Fix issue caused by sole server marked as failed under load ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10241",children:"(#10241)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:"The embedded load-balancer will now fall back to trying all servers with health-checks ignored, if all servers have been marked unavailable due to failed health checks."}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Add write-kubeconfig-group flag to server ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9233",children:"(#9233)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:"New flag in k3s server: --write-kubeconfig-group"}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Fix embedded mirror blocked by SAR RBAC and re-enable test ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10257",children:"(#10257)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Bump Local Path Provisioner version ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10268",children:"(#10268)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Fix: Use actual warningPeriod in certmonitor ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10271",children:"(#10271)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Fix bug that caused agents to bypass local loadbalancer ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10280",children:"(#10280)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Add ADR for support for etcd s3 config secret ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9364",children:"(#9364)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Add test for ",(0,r.jsx)(s.code,{children:"isValidResolvConf"})," ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10302",children:"(#10302)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Add snapshot retention etcd-s3-folder fix ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10293",children:"(#10293)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Expand GHA golang caching to include newest release branch ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10307",children:"(#10307)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Fix race condition panic in loadbalancer.nextServer ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10318",children:"(#10318)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Fix typo, use ",(0,r.jsx)(s.code,{children:"rancher/permissions"})," ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10296",children:"(#10296)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Update Kubernetes to v1.30.2 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10349",children:"(#10349)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Fix agent supervisor port using apiserver port instead ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10352",children:"(#10352)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Fix issue that allowed multiple simultaneous snapshots to be allowed ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10372",children:"(#10372)"})]}),"\n"]}),"\n",(0,r.jsx)(s.hr,{}),"\n",(0,r.jsxs)(s.h2,{id:"release-v1301k3s1",children:["Release ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/releases/tag/v1.30.1+k3s1",children:"v1.30.1+k3s1"})]}),"\n",(0,r.jsx)(s.p,{children:"This release updates Kubernetes to v1.30.1, and fixes a number of issues."}),"\n",(0,r.jsxs)(s.p,{children:["For more details on what's new, see the ",(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.30.md#changelog-since-v1300",children:"Kubernetes release notes"}),"."]}),"\n",(0,r.jsx)(s.h3,{id:"changes-since-v1300k3s1",children:"Changes since v1.30.0+k3s1:"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsxs)(s.li,{children:["Replace deprecated ruby function in e2e tests ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10084",children:"(#10084)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Update channels with 1.30 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10097",children:"(#10097)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Address 461 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10112",children:"(#10112)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Update to v1.30.1-k3s1 and Go 1.22.2 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10105",children:"(#10105)"})]}),"\n"]}),"\n",(0,r.jsx)(s.hr,{}),"\n",(0,r.jsxs)(s.h2,{id:"release-v1300k3s1",children:["Release ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/releases/tag/v1.30.0+k3s1",children:"v1.30.0+k3s1"})]}),"\n",(0,r.jsx)(s.p,{children:"This release is K3S's first in the v1.30 line. This release updates Kubernetes to v1.30.0."}),"\n",(0,r.jsxs)(s.p,{children:["For more details on what's new, see the ",(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.30.md#changelog-since-v1290",children:"Kubernetes release notes"}),"."]}),"\n",(0,r.jsx)(s.h3,{id:"changes-since-v1294k3s1",children:"Changes since v1.29.4+k3s1:"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsxs)(s.li,{children:["Kubernetes V1.30.0-k3s1 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10063",children:"(#10063)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Update stable channel to v1.29.4+k3s1 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10031",children:"(#10031)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Add E2E Split Server to Drone, support parallel testing in Drone ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9940",children:"(#9940)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Bump E2E opensuse leap to 15.6, fix btrfs test ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10057",children:"(#10057)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Remove deprecated ",(0,r.jsx)(s.code,{children:"pod-infra-container-image"})," kubelet flag ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7409",children:"(#7409)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Fix e2e tests ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10061",children:"(#10061)"})]}),"\n"]}),"\n",(0,r.jsx)(s.hr,{})]})}function o(e={}){const{wrapper:s}={...(0,t.a)(),...e.components};return s?(0,r.jsx)(s,{...e,children:(0,r.jsx)(a,{...e})}):a(e)}},1151:(e,s,i)=>{i.d(s,{Z:()=>h,a:()=>l});var r=i(7294);const t={},n=r.createContext(t);function l(e){const s=r.useContext(n);return r.useMemo((function(){return"function"==typeof e?e(s):{...s,...e}}),[s,e])}function h(e){let s;return s=e.disableParentContext?"function"==typeof e.components?e.components(t):e.components||t:l(e.components),r.createElement(n.Provider,{value:s},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/b9a30a37.4bd0940f.js b/assets/js/b9a30a37.cd039b94.js similarity index 99% rename from assets/js/b9a30a37.4bd0940f.js rename to assets/js/b9a30a37.cd039b94.js index aa4ab4190..147ad99db 100644 --- a/assets/js/b9a30a37.4bd0940f.js +++ b/assets/js/b9a30a37.cd039b94.js @@ -1 +1 @@ -"use strict";(self.webpackChunkk_3_s_docs=self.webpackChunkk_3_s_docs||[]).push([[2038],{9763:(e,r,s)=>{s.r(r),s.d(r,{assets:()=>c,contentTitle:()=>a,default:()=>u,frontMatter:()=>i,metadata:()=>l,toc:()=>o});var t=s(5893),n=s(1151);const i={title:"CIS 1.8 Self Assessment Guide"},a=void 0,l={id:"security/self-assessment-1.8",title:"CIS 1.8 Self Assessment Guide",description:"Overview",source:"@site/docs/security/self-assessment-1.8.md",sourceDirName:"security",slug:"/security/self-assessment-1.8",permalink:"/security/self-assessment-1.8",draft:!1,unlisted:!1,editUrl:"https://github.com/k3s-io/docs/edit/main/docs/security/self-assessment-1.8.md",tags:[],version:"current",lastUpdatedAt:1723651727e3,frontMatter:{title:"CIS 1.8 Self Assessment Guide"},sidebar:"mySidebar",previous:{title:"CIS Hardening Guide",permalink:"/security/hardening-guide"},next:{title:"CIS 1.7 Self Assessment Guide",permalink:"/security/self-assessment-1.7"}},c={},o=[{value:"Overview",id:"overview",level:2},{value:"Testing controls methodology",id:"testing-controls-methodology",level:3},{value:"1.1 Control Plane Node Configuration Files",id:"11-control-plane-node-configuration-files",level:2},{value:"1.1.1 Ensure that the API server pod specification file permissions are set to 600 or more restrictive (Automated)",id:"111-ensure-that-the-api-server-pod-specification-file-permissions-are-set-to-600-or-more-restrictive-automated",level:3},{value:"1.1.2 Ensure that the API server pod specification file ownership is set to root (Automated)",id:"112-ensure-that-the-api-server-pod-specification-file-ownership-is-set-to-root-automated",level:3},{value:"1.1.3 Ensure that the controller manager pod specification file permissions are set to 600 or more restrictive (Automated)",id:"113-ensure-that-the-controller-manager-pod-specification-file-permissions-are-set-to-600-or-more-restrictive-automated",level:3},{value:"1.1.4 Ensure that the controller manager pod specification file ownership is set to root (Automated)",id:"114-ensure-that-the-controller-manager-pod-specification-file-ownership-is-set-to-root-automated",level:3},{value:"1.1.5 Ensure that the scheduler pod specification file permissions are set to 600 or more restrictive (Automated)",id:"115-ensure-that-the-scheduler-pod-specification-file-permissions-are-set-to-600-or-more-restrictive-automated",level:3},{value:"1.1.6 Ensure that the scheduler pod specification file ownership is set to root (Automated)",id:"116-ensure-that-the-scheduler-pod-specification-file-ownership-is-set-to-root-automated",level:3},{value:"1.1.7 Ensure that the etcd pod specification file permissions are set to 600 or more restrictive (Automated)",id:"117-ensure-that-the-etcd-pod-specification-file-permissions-are-set-to-600-or-more-restrictive-automated",level:3},{value:"1.1.8 Ensure that the etcd pod specification file ownership is set to root (Automated)",id:"118-ensure-that-the-etcd-pod-specification-file-ownership-is-set-to-root-automated",level:3},{value:"1.1.9 Ensure that the Container Network Interface file permissions are set to 600 or more restrictive (Automated)",id:"119-ensure-that-the-container-network-interface-file-permissions-are-set-to-600-or-more-restrictive-automated",level:3},{value:"1.1.10 Ensure that the Container Network Interface file ownership is set to root (Manual)",id:"1110-ensure-that-the-container-network-interface-file-ownership-is-set-to-root-manual",level:3},{value:"1.1.11 Ensure that the etcd data directory permissions are set to 700 or more restrictive (Automated)",id:"1111-ensure-that-the-etcd-data-directory-permissions-are-set-to-700-or-more-restrictive-automated",level:3},{value:"1.1.12 Ensure that the etcd data directory ownership is set to etcd (Automated)",id:"1112-ensure-that-the-etcd-data-directory-ownership-is-set-to-etcd-automated",level:3},{value:"1.1.13 Ensure that the admin.conf file permissions are set to 600 or more restrictive (Automated)",id:"1113-ensure-that-the-adminconf-file-permissions-are-set-to-600-or-more-restrictive-automated",level:3},{value:"1.1.14 Ensure that the admin.conf file ownership is set to root (Automated)",id:"1114-ensure-that-the-adminconf-file-ownership-is-set-to-root-automated",level:3},{value:"1.1.15 Ensure that the scheduler.conf file permissions are set to 600 or more restrictive (Automated)",id:"1115-ensure-that-the-schedulerconf-file-permissions-are-set-to-600-or-more-restrictive-automated",level:3},{value:"1.1.16 Ensure that the scheduler.conf file ownership is set to root (Automated)",id:"1116-ensure-that-the-schedulerconf-file-ownership-is-set-to-root-automated",level:3},{value:"1.1.17 Ensure that the controller-manager.conf file permissions are set to 600 or more restrictive (Automated)",id:"1117-ensure-that-the-controller-managerconf-file-permissions-are-set-to-600-or-more-restrictive-automated",level:3},{value:"1.1.18 Ensure that the controller-manager.conf file ownership is set to root (Automated)",id:"1118-ensure-that-the-controller-managerconf-file-ownership-is-set-to-root-automated",level:3},{value:"1.1.19 Ensure that the Kubernetes PKI directory and file ownership is set to root (Automated)",id:"1119-ensure-that-the-kubernetes-pki-directory-and-file-ownership-is-set-to-root-automated",level:3},{value:"1.1.20 Ensure that the Kubernetes PKI certificate file permissions are set to 600 or more restrictive (Manual)",id:"1120-ensure-that-the-kubernetes-pki-certificate-file-permissions-are-set-to-600-or-more-restrictive-manual",level:3},{value:"1.1.21 Ensure that the Kubernetes PKI key file permissions are set to 600 (Automated)",id:"1121-ensure-that-the-kubernetes-pki-key-file-permissions-are-set-to-600-automated",level:3},{value:"1.2 API Server",id:"12-api-server",level:2},{value:"1.2.1 Ensure that the --anonymous-auth argument is set to false (Automated)",id:"121-ensure-that-the---anonymous-auth-argument-is-set-to-false-automated",level:3},{value:"1.2.2 Ensure that the --token-auth-file parameter is not set (Automated)",id:"122-ensure-that-the---token-auth-file-parameter-is-not-set-automated",level:3},{value:"1.2.3 Ensure that the --DenyServiceExternalIPs is not set (Automated)",id:"123-ensure-that-the---denyserviceexternalips-is-not-set-automated",level:3},{value:"1.2.4 Ensure that the --kubelet-client-certificate and --kubelet-client-key arguments are set as appropriate (Automated)",id:"124-ensure-that-the---kubelet-client-certificate-and---kubelet-client-key-arguments-are-set-as-appropriate-automated",level:3},{value:"1.2.5 Ensure that the --kubelet-certificate-authority argument is set as appropriate (Automated)",id:"125-ensure-that-the---kubelet-certificate-authority-argument-is-set-as-appropriate-automated",level:3},{value:"1.2.6 Ensure that the --authorization-mode argument is not set to AlwaysAllow (Automated)",id:"126-ensure-that-the---authorization-mode-argument-is-not-set-to-alwaysallow-automated",level:3},{value:"1.2.7 Ensure that the --authorization-mode argument includes Node (Automated)",id:"127-ensure-that-the---authorization-mode-argument-includes-node-automated",level:3},{value:"1.2.8 Ensure that the --authorization-mode argument includes RBAC (Automated)",id:"128-ensure-that-the---authorization-mode-argument-includes-rbac-automated",level:3},{value:"1.2.9 Ensure that the admission control plugin EventRateLimit is set (Manual)",id:"129-ensure-that-the-admission-control-plugin-eventratelimit-is-set-manual",level:3},{value:"1.2.10 Ensure that the admission control plugin AlwaysAdmit is not set (Automated)",id:"1210-ensure-that-the-admission-control-plugin-alwaysadmit-is-not-set-automated",level:3},{value:"1.2.11 Ensure that the admission control plugin AlwaysPullImages is set (Manual)",id:"1211-ensure-that-the-admission-control-plugin-alwayspullimages-is-set-manual",level:3},{value:"1.2.12 Ensure that the admission control plugin SecurityContextDeny is set if PodSecurityPolicy is not used (Manual)",id:"1212-ensure-that-the-admission-control-plugin-securitycontextdeny-is-set-if-podsecuritypolicy-is-not-used-manual",level:3},{value:"1.2.13 Ensure that the admission control plugin ServiceAccount is set (Automated)",id:"1213-ensure-that-the-admission-control-plugin-serviceaccount-is-set-automated",level:3},{value:"1.2.14 Ensure that the admission control plugin NamespaceLifecycle is set (Automated)",id:"1214-ensure-that-the-admission-control-plugin-namespacelifecycle-is-set-automated",level:3},{value:"1.2.15 Ensure that the admission control plugin NodeRestriction is set (Automated)",id:"1215-ensure-that-the-admission-control-plugin-noderestriction-is-set-automated",level:3},{value:"1.2.16 Ensure that the --profiling argument is set to false (Automated)",id:"1216-ensure-that-the---profiling-argument-is-set-to-false-automated",level:3},{value:"1.2.17 Ensure that the --audit-log-path argument is set (Manual)",id:"1217-ensure-that-the---audit-log-path-argument-is-set-manual",level:3},{value:"1.2.18 Ensure that the --audit-log-maxage argument is set to 30 or as appropriate (Manual)",id:"1218-ensure-that-the---audit-log-maxage-argument-is-set-to-30-or-as-appropriate-manual",level:3},{value:"1.2.19 Ensure that the --audit-log-maxbackup argument is set to 10 or as appropriate (Manual)",id:"1219-ensure-that-the---audit-log-maxbackup-argument-is-set-to-10-or-as-appropriate-manual",level:3},{value:"1.2.20 Ensure that the --audit-log-maxsize argument is set to 100 or as appropriate (Manual)",id:"1220-ensure-that-the---audit-log-maxsize-argument-is-set-to-100-or-as-appropriate-manual",level:3},{value:"1.2.21 Ensure that the --request-timeout argument is set as appropriate (Manual)",id:"1221-ensure-that-the---request-timeout-argument-is-set-as-appropriate-manual",level:3},{value:"1.2.22 Ensure that the --service-account-lookup argument is set to true (Automated)",id:"1222-ensure-that-the---service-account-lookup-argument-is-set-to-true-automated",level:3},{value:"1.2.23 Ensure that the --service-account-key-file argument is set as appropriate (Automated)",id:"1223-ensure-that-the---service-account-key-file-argument-is-set-as-appropriate-automated",level:3},{value:"1.2.24 Ensure that the --etcd-certfile and --etcd-keyfile arguments are set as appropriate (Automated)",id:"1224-ensure-that-the---etcd-certfile-and---etcd-keyfile-arguments-are-set-as-appropriate-automated",level:3},{value:"1.2.25 Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate (Automated)",id:"1225-ensure-that-the---tls-cert-file-and---tls-private-key-file-arguments-are-set-as-appropriate-automated",level:3},{value:"1.2.26 Ensure that the --client-ca-file argument is set as appropriate (Automated)",id:"1226-ensure-that-the---client-ca-file-argument-is-set-as-appropriate-automated",level:3},{value:"1.2.27 Ensure that the --etcd-cafile argument is set as appropriate (Automated)",id:"1227-ensure-that-the---etcd-cafile-argument-is-set-as-appropriate-automated",level:3},{value:"1.2.28 Ensure that the --encryption-provider-config argument is set as appropriate (Manual)",id:"1228-ensure-that-the---encryption-provider-config-argument-is-set-as-appropriate-manual",level:3},{value:"1.2.29 Ensure that encryption providers are appropriately configured (Manual)",id:"1229-ensure-that-encryption-providers-are-appropriately-configured-manual",level:3},{value:"1.2.30 Ensure that the API Server only makes use of Strong Cryptographic Ciphers (Automated)",id:"1230-ensure-that-the-api-server-only-makes-use-of-strong-cryptographic-ciphers-automated",level:3},{value:"1.3 Controller Manager",id:"13-controller-manager",level:2},{value:"1.3.1 Ensure that the --terminated-pod-gc-threshold argument is set as appropriate (Manual)",id:"131-ensure-that-the---terminated-pod-gc-threshold-argument-is-set-as-appropriate-manual",level:3},{value:"1.3.2 Ensure that the --profiling argument is set to false (Automated)",id:"132-ensure-that-the---profiling-argument-is-set-to-false-automated",level:3},{value:"1.3.3 Ensure that the --use-service-account-credentials argument is set to true (Automated)",id:"133-ensure-that-the---use-service-account-credentials-argument-is-set-to-true-automated",level:3},{value:"1.3.4 Ensure that the --service-account-private-key-file argument is set as appropriate (Automated)",id:"134-ensure-that-the---service-account-private-key-file-argument-is-set-as-appropriate-automated",level:3},{value:"1.3.5 Ensure that the --root-ca-file argument is set as appropriate (Automated)",id:"135-ensure-that-the---root-ca-file-argument-is-set-as-appropriate-automated",level:3},{value:"1.3.6 Ensure that the RotateKubeletServerCertificate argument is set to true (Automated)",id:"136-ensure-that-the-rotatekubeletservercertificate-argument-is-set-to-true-automated",level:3},{value:"1.3.7 Ensure that the --bind-address argument is set to 127.0.0.1 (Automated)",id:"137-ensure-that-the---bind-address-argument-is-set-to-127001-automated",level:3},{value:"1.4 Scheduler",id:"14-scheduler",level:2},{value:"1.4.1 Ensure that the --profiling argument is set to false (Automated)",id:"141-ensure-that-the---profiling-argument-is-set-to-false-automated",level:3},{value:"1.4.2 Ensure that the --bind-address argument is set to 127.0.0.1 (Automated)",id:"142-ensure-that-the---bind-address-argument-is-set-to-127001-automated",level:3},{value:"2 Etcd Node Configuration",id:"2-etcd-node-configuration",level:2},{value:"2.1 Ensure that the --cert-file and --key-file arguments are set as appropriate (Automated)",id:"21-ensure-that-the---cert-file-and---key-file-arguments-are-set-as-appropriate-automated",level:3},{value:"2.2 Ensure that the --client-cert-auth argument is set to true (Automated)",id:"22-ensure-that-the---client-cert-auth-argument-is-set-to-true-automated",level:3},{value:"2.3 Ensure that the --auto-tls argument is not set to true (Automated)",id:"23-ensure-that-the---auto-tls-argument-is-not-set-to-true-automated",level:3},{value:"2.4 Ensure that the --peer-cert-file and --peer-key-file arguments are set as appropriate (Automated)",id:"24-ensure-that-the---peer-cert-file-and---peer-key-file-arguments-are-set-as-appropriate-automated",level:3},{value:"2.5 Ensure that the --peer-client-cert-auth argument is set to true (Automated)",id:"25-ensure-that-the---peer-client-cert-auth-argument-is-set-to-true-automated",level:3},{value:"2.6 Ensure that the --peer-auto-tls argument is not set to true (Automated)",id:"26-ensure-that-the---peer-auto-tls-argument-is-not-set-to-true-automated",level:3},{value:"2.7 Ensure that a unique Certificate Authority is used for etcd (Automated)",id:"27-ensure-that-a-unique-certificate-authority-is-used-for-etcd-automated",level:3},{value:"4.1 Worker Node Configuration Files",id:"41-worker-node-configuration-files",level:2},{value:"4.1.1 Ensure that the kubelet service file permissions are set to 600 or more restrictive (Automated)",id:"411-ensure-that-the-kubelet-service-file-permissions-are-set-to-600-or-more-restrictive-automated",level:3},{value:"4.1.2 Ensure that the kubelet service file ownership is set to root (Automated)",id:"412-ensure-that-the-kubelet-service-file-ownership-is-set-to-root-automated",level:3},{value:"4.1.3 If proxy kubeconfig file exists ensure permissions are set to 600 or more restrictive (Automated)",id:"413-if-proxy-kubeconfig-file-exists-ensure-permissions-are-set-to-600-or-more-restrictive-automated",level:3},{value:"4.1.4 If proxy kubeconfig file exists ensure ownership is set to root (Automated)",id:"414-if-proxy-kubeconfig-file-exists-ensure-ownership-is-set-to-root-automated",level:3},{value:"4.1.5 Ensure that the --kubeconfig kubelet.conf file permissions are set to 600 or more restrictive (Automated)",id:"415-ensure-that-the---kubeconfig-kubeletconf-file-permissions-are-set-to-600-or-more-restrictive-automated",level:3},{value:"4.1.6 Ensure that the --kubeconfig kubelet.conf file ownership is set to root (Automated)",id:"416-ensure-that-the---kubeconfig-kubeletconf-file-ownership-is-set-to-root-automated",level:3},{value:"4.1.7 Ensure that the certificate authorities file permissions are set to 600 or more restrictive (Automated)",id:"417-ensure-that-the-certificate-authorities-file-permissions-are-set-to-600-or-more-restrictive-automated",level:3},{value:"4.1.8 Ensure that the client certificate authorities file ownership is set to root (Automated)",id:"418-ensure-that-the-client-certificate-authorities-file-ownership-is-set-to-root-automated",level:3},{value:"4.1.9 Ensure that the kubelet --config configuration file has permissions set to 600 or more restrictive (Automated)",id:"419-ensure-that-the-kubelet---config-configuration-file-has-permissions-set-to-600-or-more-restrictive-automated",level:3},{value:"4.1.10 Ensure that the kubelet --config configuration file ownership is set to root (Automated)",id:"4110-ensure-that-the-kubelet---config-configuration-file-ownership-is-set-to-root-automated",level:3},{value:"4.2 Kubelet",id:"42-kubelet",level:2},{value:"4.2.1 Ensure that the --anonymous-auth argument is set to false (Automated)",id:"421-ensure-that-the---anonymous-auth-argument-is-set-to-false-automated",level:3},{value:"4.2.2 Ensure that the --authorization-mode argument is not set to AlwaysAllow (Automated)",id:"422-ensure-that-the---authorization-mode-argument-is-not-set-to-alwaysallow-automated",level:3},{value:"4.2.3 Ensure that the --client-ca-file argument is set as appropriate (Automated)",id:"423-ensure-that-the---client-ca-file-argument-is-set-as-appropriate-automated",level:3},{value:"4.2.4 Verify that the --read-only-port argument is set to 0 (Automated)",id:"424-verify-that-the---read-only-port-argument-is-set-to-0-automated",level:3},{value:"4.2.5 Ensure that the --streaming-connection-idle-timeout argument is not set to 0 (Manual)",id:"425-ensure-that-the---streaming-connection-idle-timeout-argument-is-not-set-to-0-manual",level:3},{value:"4.2.6 Ensure that the --make-iptables-util-chains argument is set to true (Automated)",id:"426-ensure-that-the---make-iptables-util-chains-argument-is-set-to-true-automated",level:3},{value:"4.2.7 Ensure that the --hostname-override argument is not set (Automated)",id:"427-ensure-that-the---hostname-override-argument-is-not-set-automated",level:3},{value:"4.2.8 Ensure that the eventRecordQPS argument is set to a level which ensures appropriate event capture (Manual)",id:"428-ensure-that-the-eventrecordqps-argument-is-set-to-a-level-which-ensures-appropriate-event-capture-manual",level:3},{value:"4.2.9 Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate (Automated)",id:"429-ensure-that-the---tls-cert-file-and---tls-private-key-file-arguments-are-set-as-appropriate-automated",level:3},{value:"4.2.10 Ensure that the --rotate-certificates argument is not set to false (Automated)",id:"4210-ensure-that-the---rotate-certificates-argument-is-not-set-to-false-automated",level:3},{value:"4.2.11 Verify that the RotateKubeletServerCertificate argument is set to true (Automated)",id:"4211-verify-that-the-rotatekubeletservercertificate-argument-is-set-to-true-automated",level:3},{value:"4.2.12 Ensure that the Kubelet only makes use of Strong Cryptographic Ciphers (Manual)",id:"4212-ensure-that-the-kubelet-only-makes-use-of-strong-cryptographic-ciphers-manual",level:3},{value:"4.2.13 Ensure that a limit is set on pod PIDs (Manual)",id:"4213-ensure-that-a-limit-is-set-on-pod-pids-manual",level:3},{value:"5.1 RBAC and Service Accounts",id:"51-rbac-and-service-accounts",level:2},{value:"5.1.1 Ensure that the cluster-admin role is only used where required (Manual)",id:"511-ensure-that-the-cluster-admin-role-is-only-used-where-required-manual",level:3},{value:"5.1.2 Minimize access to secrets (Manual)",id:"512-minimize-access-to-secrets-manual",level:3},{value:"5.1.3 Minimize wildcard use in Roles and ClusterRoles (Manual)",id:"513-minimize-wildcard-use-in-roles-and-clusterroles-manual",level:3},{value:"5.1.4 Minimize access to create pods (Manual)",id:"514-minimize-access-to-create-pods-manual",level:3},{value:"5.1.5 Ensure that default service accounts are not actively used. (Manual)",id:"515-ensure-that-default-service-accounts-are-not-actively-used-manual",level:3},{value:"5.1.6 Ensure that Service Account Tokens are only mounted where necessary (Manual)",id:"516-ensure-that-service-account-tokens-are-only-mounted-where-necessary-manual",level:3},{value:"5.1.7 Avoid use of system group (Manual)",id:"517-avoid-use-of-system-group-manual",level:3},{value:"5.1.8 Limit use of the Bind, Impersonate and Escalate permissions in the Kubernetes cluster (Manual)",id:"518-limit-use-of-the-bind-impersonate-and-escalate-permissions-in-the-kubernetes-cluster-manual",level:3},{value:"5.1.9 Minimize access to create persistent volumes (Manual)",id:"519-minimize-access-to-create-persistent-volumes-manual",level:3},{value:"5.1.10 Minimize access to the proxy sub-resource of nodes (Manual)",id:"5110-minimize-access-to-the-proxy-sub-resource-of-nodes-manual",level:3},{value:"5.1.11 Minimize access to the approval sub-resource of certificatesigningrequests objects (Manual)",id:"5111-minimize-access-to-the-approval-sub-resource-of-certificatesigningrequests-objects-manual",level:3},{value:"5.1.12 Minimize access to webhook configuration objects (Manual)",id:"5112-minimize-access-to-webhook-configuration-objects-manual",level:3},{value:"5.1.13 Minimize access to the service account token creation (Manual)",id:"5113-minimize-access-to-the-service-account-token-creation-manual",level:3},{value:"5.2 Pod Security Standards",id:"52-pod-security-standards",level:2},{value:"5.2.1 Ensure that the cluster has at least one active policy control mechanism in place (Manual)",id:"521-ensure-that-the-cluster-has-at-least-one-active-policy-control-mechanism-in-place-manual",level:3},{value:"5.2.2 Minimize the admission of privileged containers (Manual)",id:"522-minimize-the-admission-of-privileged-containers-manual",level:3},{value:"5.2.3 Minimize the admission of containers wishing to share the host process ID namespace (Automated)",id:"523-minimize-the-admission-of-containers-wishing-to-share-the-host-process-id-namespace-automated",level:3},{value:"5.2.4 Minimize the admission of containers wishing to share the host IPC namespace (Automated)",id:"524-minimize-the-admission-of-containers-wishing-to-share-the-host-ipc-namespace-automated",level:3},{value:"5.2.5 Minimize the admission of containers wishing to share the host network namespace (Automated)",id:"525-minimize-the-admission-of-containers-wishing-to-share-the-host-network-namespace-automated",level:3},{value:"5.2.6 Minimize the admission of containers with allowPrivilegeEscalation (Automated)",id:"526-minimize-the-admission-of-containers-with-allowprivilegeescalation-automated",level:3},{value:"5.2.7 Minimize the admission of root containers (Automated)",id:"527-minimize-the-admission-of-root-containers-automated",level:3},{value:"5.2.8 Minimize the admission of containers with the NET_RAW capability (Automated)",id:"528-minimize-the-admission-of-containers-with-the-net_raw-capability-automated",level:3},{value:"5.2.9 Minimize the admission of containers with added capabilities (Automated)",id:"529-minimize-the-admission-of-containers-with-added-capabilities-automated",level:3},{value:"5.2.10 Minimize the admission of containers with capabilities assigned (Manual)",id:"5210-minimize-the-admission-of-containers-with-capabilities-assigned-manual",level:3},{value:"5.2.11 Minimize the admission of Windows HostProcess containers (Manual)",id:"5211-minimize-the-admission-of-windows-hostprocess-containers-manual",level:3},{value:"5.2.12 Minimize the admission of HostPath volumes (Manual)",id:"5212-minimize-the-admission-of-hostpath-volumes-manual",level:3},{value:"5.2.13 Minimize the admission of containers which use HostPorts (Manual)",id:"5213-minimize-the-admission-of-containers-which-use-hostports-manual",level:3},{value:"5.3 Network Policies and CNI",id:"53-network-policies-and-cni",level:2},{value:"5.3.1 Ensure that the CNI in use supports NetworkPolicies (Manual)",id:"531-ensure-that-the-cni-in-use-supports-networkpolicies-manual",level:3},{value:"5.3.2 Ensure that all Namespaces have NetworkPolicies defined (Manual)",id:"532-ensure-that-all-namespaces-have-networkpolicies-defined-manual",level:3},{value:"5.4 Secrets Management",id:"54-secrets-management",level:2},{value:"5.4.1 Prefer using Secrets as files over Secrets as environment variables (Manual)",id:"541-prefer-using-secrets-as-files-over-secrets-as-environment-variables-manual",level:3},{value:"5.4.2 Consider external secret storage (Manual)",id:"542-consider-external-secret-storage-manual",level:3},{value:"5.5 Extensible Admission Control",id:"55-extensible-admission-control",level:2},{value:"5.5.1 Configure Image Provenance using ImagePolicyWebhook admission controller (Manual)",id:"551-configure-image-provenance-using-imagepolicywebhook-admission-controller-manual",level:3},{value:"5.7 General Policies",id:"57-general-policies",level:2},{value:"5.7.1 Create administrative boundaries between resources using namespaces (Manual)",id:"571-create-administrative-boundaries-between-resources-using-namespaces-manual",level:3},{value:"5.7.2 Ensure that the seccomp profile is set to docker/default in your Pod definitions (Manual)",id:"572-ensure-that-the-seccomp-profile-is-set-to-dockerdefault-in-your-pod-definitions-manual",level:3},{value:"5.7.3 Apply SecurityContext to your Pods and Containers (Manual)",id:"573-apply-securitycontext-to-your-pods-and-containers-manual",level:3},{value:"5.7.4 The default namespace should not be used (Manual)",id:"574-the-default-namespace-should-not-be-used-manual",level:3}];function d(e){const r={a:"a",code:"code",h2:"h2",h3:"h3",li:"li",p:"p",pre:"pre",strong:"strong",ul:"ul",...(0,n.a)(),...e.components},{Details:s}=r;return s||function(e,r){throw new Error("Expected "+(r?"component":"object")+" `"+e+"` to be defined: you likely forgot to import, pass, or provide it.")}("Details",!0),(0,t.jsxs)(t.Fragment,{children:[(0,t.jsx)(r.h2,{id:"overview",children:"Overview"}),"\n",(0,t.jsxs)(r.p,{children:["This document is a companion to the ",(0,t.jsx)(r.a,{href:"/security/hardening-guide",children:"K3s security hardening guide"}),". The hardening guide provides prescriptive guidance for hardening a production installation of K3s, and this benchmark guide is meant to help you evaluate the level of security of the hardened cluster against each control in the CIS Kubernetes Benchmark. It is to be used by K3s operators, security teams, auditors, and decision-makers."]}),"\n",(0,t.jsxs)(r.p,{children:["This guide is specific to the ",(0,t.jsx)(r.strong,{children:"v1.26-v1.29"})," release line of K3s and the ",(0,t.jsx)(r.strong,{children:"v1.8"})," release of the CIS Kubernetes Benchmark."]}),"\n",(0,t.jsxs)(r.p,{children:["For more information about each control, including detailed descriptions and remediations for failing tests, you can refer to the corresponding section of the CIS Kubernetes Benchmark v1.8. You can download the benchmark, after creating a free account, in ",(0,t.jsx)(r.a,{href:"https://www.cisecurity.org/benchmark/kubernetes/",children:"Center for Internet Security (CIS)"}),"."]}),"\n",(0,t.jsx)(r.h3,{id:"testing-controls-methodology",children:"Testing controls methodology"}),"\n",(0,t.jsx)(r.p,{children:"Each control in the CIS Kubernetes Benchmark was evaluated against a K3s cluster that was configured according to the accompanying hardening guide."}),"\n",(0,t.jsx)(r.p,{children:"Where control audits differ from the original CIS benchmark, the audit commands specific to K3s are provided for testing."}),"\n",(0,t.jsx)(r.p,{children:"These are the possible results for each control:"}),"\n",(0,t.jsxs)(r.ul,{children:["\n",(0,t.jsxs)(r.li,{children:[(0,t.jsx)(r.strong,{children:"Pass"})," - The K3s cluster under test passed the audit outlined in the benchmark."]}),"\n",(0,t.jsxs)(r.li,{children:[(0,t.jsx)(r.strong,{children:"Not Applicable"})," - The control is not applicable to K3s because of how it is designed to operate. The remediation section will explain why this is so."]}),"\n",(0,t.jsxs)(r.li,{children:[(0,t.jsx)(r.strong,{children:"Warn"})," - The control is manual in the CIS benchmark and it depends on the cluster's use case or some other factor that must be determined by the cluster operator. These controls have been evaluated to ensure K3s does not prevent their implementation, but no further configuration or auditing of the cluster under test has been performed."]}),"\n"]}),"\n",(0,t.jsx)(r.p,{children:'This guide makes the assumption that K3s is running as a Systemd unit. Your installation may vary and will require you to adjust the "audit" commands to fit your scenario.'}),"\n",(0,t.jsx)(r.h2,{id:"11-control-plane-node-configuration-files",children:"1.1 Control Plane Node Configuration Files"}),"\n",(0,t.jsx)(r.h3,{id:"111-ensure-that-the-api-server-pod-specification-file-permissions-are-set-to-600-or-more-restrictive-automated",children:"1.1.1 Ensure that the API server pod specification file permissions are set to 600 or more restrictive (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," Not Applicable"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Rationale:"})}),"\n",(0,t.jsx)(r.p,{children:"By default, K3s embeds the api server within the k3s process. There is no API server pod specification file."}),"\n",(0,t.jsxs)(r.h3,{id:"112-ensure-that-the-api-server-pod-specification-file-ownership-is-set-to-root-automated",children:["1.1.2 Ensure that the API server pod specification file ownership is set to root",":root"," (Automated)"]}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," Not Applicable"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Rationale:"})}),"\n",(0,t.jsx)(r.p,{children:"By default, K3s embeds the api server within the k3s process. There is no API server pod specification file."}),"\n",(0,t.jsx)(r.h3,{id:"113-ensure-that-the-controller-manager-pod-specification-file-permissions-are-set-to-600-or-more-restrictive-automated",children:"1.1.3 Ensure that the controller manager pod specification file permissions are set to 600 or more restrictive (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," Not Applicable"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Rationale:"})}),"\n",(0,t.jsx)(r.p,{children:"By default, K3s embeds the controller manager within the k3s process. There is no controller manager pod specification file."}),"\n",(0,t.jsxs)(r.h3,{id:"114-ensure-that-the-controller-manager-pod-specification-file-ownership-is-set-to-root-automated",children:["1.1.4 Ensure that the controller manager pod specification file ownership is set to root",":root"," (Automated)"]}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," Not Applicable"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Rationale:"})}),"\n",(0,t.jsx)(r.p,{children:"By default, K3s embeds the controller manager within the k3s process. There is no controller manager pod specification file."}),"\n",(0,t.jsx)(r.h3,{id:"115-ensure-that-the-scheduler-pod-specification-file-permissions-are-set-to-600-or-more-restrictive-automated",children:"1.1.5 Ensure that the scheduler pod specification file permissions are set to 600 or more restrictive (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," Not Applicable"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Rationale:"})}),"\n",(0,t.jsx)(r.p,{children:"By default, K3s embeds the scheduler within the k3s process. There is no scheduler pod specification file."}),"\n",(0,t.jsxs)(r.h3,{id:"116-ensure-that-the-scheduler-pod-specification-file-ownership-is-set-to-root-automated",children:["1.1.6 Ensure that the scheduler pod specification file ownership is set to root",":root"," (Automated)"]}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," Not Applicable"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Rationale:"})}),"\n",(0,t.jsx)(r.p,{children:"By default, K3s embeds the scheduler within the k3s process. There is no scheduler pod specification file."}),"\n",(0,t.jsx)(r.h3,{id:"117-ensure-that-the-etcd-pod-specification-file-permissions-are-set-to-600-or-more-restrictive-automated",children:"1.1.7 Ensure that the etcd pod specification file permissions are set to 600 or more restrictive (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," Not Applicable"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Rationale:"})}),"\n",(0,t.jsx)(r.p,{children:"By default, K3s embeds etcd within the k3s process. There is no etcd pod specification file."}),"\n",(0,t.jsxs)(r.h3,{id:"118-ensure-that-the-etcd-pod-specification-file-ownership-is-set-to-root-automated",children:["1.1.8 Ensure that the etcd pod specification file ownership is set to root",":root"," (Automated)"]}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," Not Applicable"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Rationale:"})}),"\n",(0,t.jsx)(r.p,{children:"By default, K3s embeds etcd within the k3s process. There is no etcd pod specification file."}),"\n",(0,t.jsx)(r.h3,{id:"119-ensure-that-the-container-network-interface-file-permissions-are-set-to-600-or-more-restrictive-automated",children:"1.1.9 Ensure that the Container Network Interface file permissions are set to 600 or more restrictive (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"find /var/lib/cni/networks -type f ! -name lock 2> /dev/null | xargs --no-run-if-empty stat -c permissions=%a\n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," permissions has permissions 600, expected 600 or more restrictive"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:"permissions=600\npermissions=600\npermissions=600\npermissions=600\npermissions=600\npermissions=600\n"})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsxs)(r.p,{children:["By default, K3s sets the CNI file permissions to 600.\nNote that for many CNIs, a lock file is created with permissions 750. This is expected and can be ignored.\nIf you modify your CNI configuration, ensure that the permissions are set to 600.\nFor example, ",(0,t.jsx)(r.code,{children:"chmod 600 /var/lib/cni/networks/"})]})]}),"\n",(0,t.jsxs)(r.h3,{id:"1110-ensure-that-the-container-network-interface-file-ownership-is-set-to-root-manual",children:["1.1.10 Ensure that the Container Network Interface file ownership is set to root",":root"," (Manual)"]}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," Not Applicable"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Rationale:"})}),"\n",(0,t.jsxs)(r.p,{children:["Run the below command (based on the file location on your system) on the control plane node.\nFor example,\n",(0,t.jsx)(r.code,{children:"chown root:root "})]}),"\n",(0,t.jsx)(r.h3,{id:"1111-ensure-that-the-etcd-data-directory-permissions-are-set-to-700-or-more-restrictive-automated",children:"1.1.11 Ensure that the etcd data directory permissions are set to 700 or more restrictive (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:'if [ "$(journalctl -u k3s | grep -m1 \'Managed etcd cluster\' | wc -l)" -gt 0 ]; then\n stat -c permissions=%a /var/lib/rancher/k3s/server/db/etcd\nelse\n echo "permissions=700"\nfi\n'})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," permissions has permissions 700, expected 700 or more restrictive"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:"permissions=700\n"})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsxs)(r.p,{children:["On the etcd server node, get the etcd data directory, passed as an argument --data-dir,\nfrom the command 'ps -ef | grep etcd'.\nRun the below command (based on the etcd data directory found above). For example,\n",(0,t.jsx)(r.code,{children:"chmod 700 /var/lib/etcd"})]})]}),"\n",(0,t.jsxs)(r.h3,{id:"1112-ensure-that-the-etcd-data-directory-ownership-is-set-to-etcd-automated",children:["1.1.12 Ensure that the etcd data directory ownership is set to etcd",":etcd"," (Automated)"]}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," Not Applicable"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Rationale:"})}),"\n",(0,t.jsxs)(r.p,{children:["For K3s, etcd is embedded within the k3s process. There is no separate etcd process.\nTherefore the etcd data directory ownership is managed by the k3s process and should be root",":root","."]}),"\n",(0,t.jsx)(r.h3,{id:"1113-ensure-that-the-adminconf-file-permissions-are-set-to-600-or-more-restrictive-automated",children:"1.1.13 Ensure that the admin.conf file permissions are set to 600 or more restrictive (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"/bin/sh -c 'if test -e /var/lib/rancher/k3s/server/cred/admin.kubeconfig; then stat -c permissions=%a /var/lib/rancher/k3s/server/cred/admin.kubeconfig; fi'\n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," permissions has permissions 600, expected 600 or more restrictive"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:"permissions=600\n"})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsxs)(r.p,{children:["Run the below command (based on the file location on your system) on the control plane node.\nFor example, ",(0,t.jsx)(r.code,{children:"chmod 600 /var/lib/rancher/k3s/server/cred/admin.kubeconfig"})]})]}),"\n",(0,t.jsxs)(r.h3,{id:"1114-ensure-that-the-adminconf-file-ownership-is-set-to-root-automated",children:["1.1.14 Ensure that the admin.conf file ownership is set to root",":root"," (Automated)"]}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"/bin/sh -c 'if test -e /var/lib/rancher/k3s/server/cred/admin.kubeconfig; then stat -c %U:%G /var/lib/rancher/k3s/server/cred/admin.kubeconfig; fi'\n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," 'root",":root","' is equal to 'root",":root","'"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:"root:root\n"})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsxs)(r.p,{children:["Run the below command (based on the file location on your system) on the control plane node.\nFor example, ",(0,t.jsx)(r.code,{children:"chown root:root /var/lib/rancher/k3s/server/cred/admin.kubeconfig"})]})]}),"\n",(0,t.jsx)(r.h3,{id:"1115-ensure-that-the-schedulerconf-file-permissions-are-set-to-600-or-more-restrictive-automated",children:"1.1.15 Ensure that the scheduler.conf file permissions are set to 600 or more restrictive (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"/bin/sh -c 'if test -e /var/lib/rancher/k3s/server/cred/scheduler.kubeconfig; then stat -c permissions=%a /var/lib/rancher/k3s/server/cred/scheduler.kubeconfig; fi'\n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," permissions has permissions 600, expected 600 or more restrictive"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:"permissions=600\n"})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsxs)(r.p,{children:["Run the below command (based on the file location on your system) on the control plane node.\nFor example,\n",(0,t.jsx)(r.code,{children:"chmod 600 /var/lib/rancher/k3s/server/cred/scheduler.kubeconfig"})]})]}),"\n",(0,t.jsxs)(r.h3,{id:"1116-ensure-that-the-schedulerconf-file-ownership-is-set-to-root-automated",children:["1.1.16 Ensure that the scheduler.conf file ownership is set to root",":root"," (Automated)"]}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"/bin/sh -c 'if test -e /var/lib/rancher/k3s/server/cred/scheduler.kubeconfig; then stat -c %U:%G /var/lib/rancher/k3s/server/cred/scheduler.kubeconfig; fi'\n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," 'root",":root","' is present"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:"root:root\n"})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsxs)(r.p,{children:["Run the below command (based on the file location on your system) on the control plane node.\nFor example,\n",(0,t.jsx)(r.code,{children:"chown root:root /var/lib/rancher/k3s/server/cred/scheduler.kubeconfig"})]})]}),"\n",(0,t.jsx)(r.h3,{id:"1117-ensure-that-the-controller-managerconf-file-permissions-are-set-to-600-or-more-restrictive-automated",children:"1.1.17 Ensure that the controller-manager.conf file permissions are set to 600 or more restrictive (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"/bin/sh -c 'if test -e /var/lib/rancher/k3s/server/cred/controller.kubeconfig; then stat -c permissions=%a /var/lib/rancher/k3s/server/cred/controller.kubeconfig; fi'\n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," permissions has permissions 600, expected 600 or more restrictive"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:"permissions=600\n"})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsxs)(r.p,{children:["Run the below command (based on the file location on your system) on the control plane node.\nFor example,\n",(0,t.jsx)(r.code,{children:"chmod 600 /var/lib/rancher/k3s/server/cred/controller.kubeconfig"})]})]}),"\n",(0,t.jsxs)(r.h3,{id:"1118-ensure-that-the-controller-managerconf-file-ownership-is-set-to-root-automated",children:["1.1.18 Ensure that the controller-manager.conf file ownership is set to root",":root"," (Automated)"]}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"stat -c %U:%G /var/lib/rancher/k3s/server/cred/controller.kubeconfig\n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," 'root",":root","' is equal to 'root",":root","'"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:"root:root\n"})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsxs)(r.p,{children:["Run the below command (based on the file location on your system) on the control plane node.\nFor example,\n",(0,t.jsx)(r.code,{children:"chown root:root /var/lib/rancher/k3s/server/cred/controller.kubeconfig"})]})]}),"\n",(0,t.jsxs)(r.h3,{id:"1119-ensure-that-the-kubernetes-pki-directory-and-file-ownership-is-set-to-root-automated",children:["1.1.19 Ensure that the Kubernetes PKI directory and file ownership is set to root",":root"," (Automated)"]}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"stat -c %U:%G /var/lib/rancher/k3s/server/tls\n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," 'root",":root","' is present"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:"root:root\n"})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsxs)(r.p,{children:["Run the below command (based on the file location on your system) on the control plane node.\nFor example,\n",(0,t.jsx)(r.code,{children:"chown -R root:root /var/lib/rancher/k3s/server/tls"})]})]}),"\n",(0,t.jsx)(r.h3,{id:"1120-ensure-that-the-kubernetes-pki-certificate-file-permissions-are-set-to-600-or-more-restrictive-manual",children:"1.1.20 Ensure that the Kubernetes PKI certificate file permissions are set to 600 or more restrictive (Manual)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Remediation:"}),"\nRun the below command (based on the file location on your system) on the master node.\nFor example,\n",(0,t.jsx)(r.code,{children:"chmod -R 600 /var/lib/rancher/k3s/server/tls/*.crt"})]}),"\n",(0,t.jsx)(r.h3,{id:"1121-ensure-that-the-kubernetes-pki-key-file-permissions-are-set-to-600-automated",children:"1.1.21 Ensure that the Kubernetes PKI key file permissions are set to 600 (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"/bin/sh -c 'stat -c permissions=%a /var/lib/rancher/k3s/server/tls/*.key'\n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," permissions has permissions 600, expected 600 or more restrictive"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:"permissions=600\npermissions=600\npermissions=600\npermissions=600\npermissions=600\npermissions=600\npermissions=600\npermissions=600\npermissions=600\npermissions=600\npermissions=600\npermissions=600\npermissions=600\npermissions=600\npermissions=600\npermissions=600\npermissions=600\n"})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsxs)(r.p,{children:["Run the below command (based on the file location on your system) on the master node.\nFor example,\n",(0,t.jsx)(r.code,{children:"chmod -R 600 /var/lib/rancher/k3s/server/tls/*.key"})]})]}),"\n",(0,t.jsx)(r.h2,{id:"12-api-server",children:"1.2 API Server"}),"\n",(0,t.jsx)(r.h3,{id:"121-ensure-that-the---anonymous-auth-argument-is-set-to-false-automated",children:"1.2.1 Ensure that the --anonymous-auth argument is set to false (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'anonymous-auth'\n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," '--anonymous-auth' is equal to 'false'"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:'Aug 09 19:06:17 server-0 k3s[2357]: time="2024-08-09T19:06:17Z" level=info msg="Running kube-apiserver --admission-control-config-file=/var/lib/rancher/k3s/server/psa.yaml --advertise-address=10.10.10.100 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --encryption-provider-config-automatic-reload=true --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsx)(r.p,{children:"By default, K3s sets the --anonymous-auth argument to false.\nIf this check fails, edit the K3s config file /etc/rancher/k3s/config.yaml and remove anything similar to below."}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{children:'kube-apiserver-arg:\n - "anonymous-auth=true"\n'})})]}),"\n",(0,t.jsx)(r.h3,{id:"122-ensure-that-the---token-auth-file-parameter-is-not-set-automated",children:"1.2.2 Ensure that the --token-auth-file parameter is not set (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s | grep 'Running kube-apiserver' | tail -n1\n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," '--token-auth-file' is not present"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:'Aug 09 19:06:17 server-0 k3s[2357]: time="2024-08-09T19:06:17Z" level=info msg="Running kube-apiserver --admission-control-config-file=/var/lib/rancher/k3s/server/psa.yaml --advertise-address=10.10.10.100 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --encryption-provider-config-automatic-reload=true --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsx)(r.p,{children:"Follow the documentation and configure alternate mechanisms for authentication.\nIf this check fails, edit the K3s config file /etc/rancher/k3s/config.yaml and remove anything similar to below."}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{children:'kube-apiserver-arg:\n - "token-auth-file="\n'})})]}),"\n",(0,t.jsx)(r.h3,{id:"123-ensure-that-the---denyserviceexternalips-is-not-set-automated",children:"1.2.3 Ensure that the --DenyServiceExternalIPs is not set (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s | grep 'Running kube-apiserver' | tail -n1\n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," '--enable-admission-plugins' does not have 'DenyServiceExternalIPs' OR '--enable-admission-plugins' is not present"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:'Aug 09 19:06:17 server-0 k3s[2357]: time="2024-08-09T19:06:17Z" level=info msg="Running kube-apiserver --admission-control-config-file=/var/lib/rancher/k3s/server/psa.yaml --advertise-address=10.10.10.100 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --encryption-provider-config-automatic-reload=true --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsx)(r.p,{children:"By default, K3s does not set DenyServiceExternalIPs.\nIf this check fails, edit the K3s config file /etc/rancher/k3s/config.yaml, remove any lines like below."}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{children:'kube-apiserver-arg:\n - "enable-admission-plugins=DenyServiceExternalIPs"\n'})})]}),"\n",(0,t.jsx)(r.h3,{id:"124-ensure-that-the---kubelet-client-certificate-and---kubelet-client-key-arguments-are-set-as-appropriate-automated",children:"1.2.4 Ensure that the --kubelet-client-certificate and --kubelet-client-key arguments are set as appropriate (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s | grep 'Running kube-apiserver' | tail -n1\n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," '--kubelet-client-certificate' is present AND '--kubelet-client-key' is present"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:'Aug 09 19:06:17 server-0 k3s[2357]: time="2024-08-09T19:06:17Z" level=info msg="Running kube-apiserver --admission-control-config-file=/var/lib/rancher/k3s/server/psa.yaml --advertise-address=10.10.10.100 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --encryption-provider-config-automatic-reload=true --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsx)(r.p,{children:"By default, K3s automatically provides the kubelet client certificate and key.\nThey are generated and located at /var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt and /var/lib/rancher/k3s/server/tls/client-kube-apiserver.key\nIf for some reason you need to provide your own certificate and key, you can set the\nbelow parameters in the K3s config file /etc/rancher/k3s/config.yaml."}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{children:'kube-apiserver-arg:\n - "kubelet-client-certificate="\n - "kubelet-client-key="\n'})})]}),"\n",(0,t.jsx)(r.h3,{id:"125-ensure-that-the---kubelet-certificate-authority-argument-is-set-as-appropriate-automated",children:"1.2.5 Ensure that the --kubelet-certificate-authority argument is set as appropriate (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'kubelet-certificate-authority'\n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," '--kubelet-certificate-authority' is present"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:'Aug 09 19:06:17 server-0 k3s[2357]: time="2024-08-09T19:06:17Z" level=info msg="Running kube-apiserver --admission-control-config-file=/var/lib/rancher/k3s/server/psa.yaml --advertise-address=10.10.10.100 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --encryption-provider-config-automatic-reload=true --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsx)(r.p,{children:"By default, K3s automatically provides the kubelet CA cert file, at /var/lib/rancher/k3s/server/tls/server-ca.crt.\nIf for some reason you need to provide your own ca certificate, look at using the k3s certificate command line tool.\nIf this check fails, edit the K3s config file /etc/rancher/k3s/config.yaml and remove any lines like below."}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{children:'kube-apiserver-arg:\n - "kubelet-certificate-authority="\n'})})]}),"\n",(0,t.jsx)(r.h3,{id:"126-ensure-that-the---authorization-mode-argument-is-not-set-to-alwaysallow-automated",children:"1.2.6 Ensure that the --authorization-mode argument is not set to AlwaysAllow (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'authorization-mode'\n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," '--authorization-mode' does not have 'AlwaysAllow'"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:'Aug 09 19:06:17 server-0 k3s[2357]: time="2024-08-09T19:06:17Z" level=info msg="Running kube-apiserver --admission-control-config-file=/var/lib/rancher/k3s/server/psa.yaml --advertise-address=10.10.10.100 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --encryption-provider-config-automatic-reload=true --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsx)(r.p,{children:"By default, K3s does not set the --authorization-mode to AlwaysAllow.\nIf this check fails, edit K3s config file /etc/rancher/k3s/config.yaml, remove any lines like below."}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{children:'kube-apiserver-arg:\n - "authorization-mode=AlwaysAllow"\n'})})]}),"\n",(0,t.jsx)(r.h3,{id:"127-ensure-that-the---authorization-mode-argument-includes-node-automated",children:"1.2.7 Ensure that the --authorization-mode argument includes Node (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'authorization-mode'\n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," '--authorization-mode' has 'Node'"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:'Aug 09 19:06:17 server-0 k3s[2357]: time="2024-08-09T19:06:17Z" level=info msg="Running kube-apiserver --admission-control-config-file=/var/lib/rancher/k3s/server/psa.yaml --advertise-address=10.10.10.100 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --encryption-provider-config-automatic-reload=true --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsx)(r.p,{children:"By default, K3s sets the --authorization-mode to Node and RBAC.\nIf this check fails, edit the K3s config file /etc/rancher/k3s/config.yaml,\nensure that you are not overriding authorization-mode."})]}),"\n",(0,t.jsx)(r.h3,{id:"128-ensure-that-the---authorization-mode-argument-includes-rbac-automated",children:"1.2.8 Ensure that the --authorization-mode argument includes RBAC (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'authorization-mode'\n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," '--authorization-mode' has 'RBAC'"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:'Aug 09 19:06:17 server-0 k3s[2357]: time="2024-08-09T19:06:17Z" level=info msg="Running kube-apiserver --admission-control-config-file=/var/lib/rancher/k3s/server/psa.yaml --advertise-address=10.10.10.100 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --encryption-provider-config-automatic-reload=true --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsx)(r.p,{children:"By default, K3s sets the --authorization-mode to Node and RBAC.\nIf this check fails, edit the K3s config file /etc/rancher/k3s/config.yaml,\nensure that you are not overriding authorization-mode."})]}),"\n",(0,t.jsx)(r.h3,{id:"129-ensure-that-the-admission-control-plugin-eventratelimit-is-set-manual",children:"1.2.9 Ensure that the admission control plugin EventRateLimit is set (Manual)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Remediation:"}),"\nFollow the Kubernetes documentation and set the desired limits in a configuration file.\nThen, edit the K3s config file /etc/rancher/k3s/config.yaml and set the below parameters."]}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{children:'kube-apiserver-arg:\n - "enable-admission-plugins=...,EventRateLimit,..."\n - "admission-control-config-file="\n'})}),"\n",(0,t.jsx)(r.h3,{id:"1210-ensure-that-the-admission-control-plugin-alwaysadmit-is-not-set-automated",children:"1.2.10 Ensure that the admission control plugin AlwaysAdmit is not set (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'enable-admission-plugins'\n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," '--enable-admission-plugins' does not have 'AlwaysAdmit' OR '--enable-admission-plugins' is not present"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:'Aug 09 19:06:17 server-0 k3s[2357]: time="2024-08-09T19:06:17Z" level=info msg="Running kube-apiserver --admission-control-config-file=/var/lib/rancher/k3s/server/psa.yaml --advertise-address=10.10.10.100 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --encryption-provider-config-automatic-reload=true --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsx)(r.p,{children:"By default, K3s does not set the --enable-admission-plugins to AlwaysAdmit.\nIf this check fails, edit K3s config file /etc/rancher/k3s/config.yaml, remove any lines like below."}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{children:'kube-apiserver-arg:\n - "enable-admission-plugins=AlwaysAdmit"\n'})})]}),"\n",(0,t.jsx)(r.h3,{id:"1211-ensure-that-the-admission-control-plugin-alwayspullimages-is-set-manual",children:"1.2.11 Ensure that the admission control plugin AlwaysPullImages is set (Manual)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Remediation:"}),'\nPermissive, per CIS guidelines,\n"This setting could impact offline or isolated clusters, which have images pre-loaded and\ndo not have access to a registry to pull in-use images. This setting is not appropriate for\nclusters which use this configuration."\nEdit the K3s config file /etc/rancher/k3s/config.yaml and set the below parameter.']}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{children:'kube-apiserver-arg:\n - "enable-admission-plugins=...,AlwaysPullImages,..."\n'})}),"\n",(0,t.jsx)(r.h3,{id:"1212-ensure-that-the-admission-control-plugin-securitycontextdeny-is-set-if-podsecuritypolicy-is-not-used-manual",children:"1.2.12 Ensure that the admission control plugin SecurityContextDeny is set if PodSecurityPolicy is not used (Manual)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," Not Applicable"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Rationale:"})}),"\n",(0,t.jsx)(r.p,{children:"Enabling Pod Security Policy is no longer supported on K3s v1.25+ and will cause applications to unexpectedly fail."}),"\n",(0,t.jsx)(r.h3,{id:"1213-ensure-that-the-admission-control-plugin-serviceaccount-is-set-automated",children:"1.2.13 Ensure that the admission control plugin ServiceAccount is set (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s | grep 'Running kube-apiserver' | tail -n1\n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," '--disable-admission-plugins' is present OR '--disable-admission-plugins' is not present"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:'Aug 09 19:06:17 server-0 k3s[2357]: time="2024-08-09T19:06:17Z" level=info msg="Running kube-apiserver --admission-control-config-file=/var/lib/rancher/k3s/server/psa.yaml --advertise-address=10.10.10.100 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --encryption-provider-config-automatic-reload=true --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsx)(r.p,{children:"By default, K3s does not set the --disable-admission-plugins to anything.\nFollow the documentation and create ServiceAccount objects as per your environment.\nIf this check fails, edit the K3s config file /etc/rancher/k3s/config.yaml and remove any lines like below."}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{children:'kube-apiserver-arg:\n - "disable-admission-plugins=ServiceAccount"\n'})})]}),"\n",(0,t.jsx)(r.h3,{id:"1214-ensure-that-the-admission-control-plugin-namespacelifecycle-is-set-automated",children:"1.2.14 Ensure that the admission control plugin NamespaceLifecycle is set (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s | grep 'Running kube-apiserver' | tail -n1\n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," '--disable-admission-plugins' is present OR '--disable-admission-plugins' is not present"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:'Aug 09 19:06:17 server-0 k3s[2357]: time="2024-08-09T19:06:17Z" level=info msg="Running kube-apiserver --admission-control-config-file=/var/lib/rancher/k3s/server/psa.yaml --advertise-address=10.10.10.100 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --encryption-provider-config-automatic-reload=true --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsx)(r.p,{children:"By default, K3s does not set the --disable-admission-plugins to anything.\nIf this check fails, edit the K3s config file /etc/rancher/k3s/config.yaml and remove any lines like below."}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{children:'kube-apiserver-arg:\n - "disable-admission-plugins=...,NamespaceLifecycle,..."\n'})})]}),"\n",(0,t.jsx)(r.h3,{id:"1215-ensure-that-the-admission-control-plugin-noderestriction-is-set-automated",children:"1.2.15 Ensure that the admission control plugin NodeRestriction is set (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'enable-admission-plugins'\n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," '--enable-admission-plugins' has 'NodeRestriction'"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:'Aug 09 19:06:17 server-0 k3s[2357]: time="2024-08-09T19:06:17Z" level=info msg="Running kube-apiserver --admission-control-config-file=/var/lib/rancher/k3s/server/psa.yaml --advertise-address=10.10.10.100 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --encryption-provider-config-automatic-reload=true --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsx)(r.p,{children:"By default, K3s sets the --enable-admission-plugins to NodeRestriction.\nIf using the K3s config file /etc/rancher/k3s/config.yaml, check that you are not overriding the admission plugins.\nIf you are, include NodeRestriction in the list."}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{children:'kube-apiserver-arg:\n - "enable-admission-plugins=...,NodeRestriction,..."\n'})})]}),"\n",(0,t.jsx)(r.h3,{id:"1216-ensure-that-the---profiling-argument-is-set-to-false-automated",children:"1.2.16 Ensure that the --profiling argument is set to false (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'profiling'\n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," '--profiling' is equal to 'false'"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:'Aug 09 19:06:17 server-0 k3s[2357]: time="2024-08-09T19:06:17Z" level=info msg="Running kube-apiserver --admission-control-config-file=/var/lib/rancher/k3s/server/psa.yaml --advertise-address=10.10.10.100 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --encryption-provider-config-automatic-reload=true --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsx)(r.p,{children:"By default, K3s sets the --profiling argument to false.\nIf this check fails, edit the K3s config file /etc/rancher/k3s/config.yaml and remove any lines like below."}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{children:'kube-apiserver-arg:\n - "profiling=true"\n'})})]}),"\n",(0,t.jsx)(r.h3,{id:"1217-ensure-that-the---audit-log-path-argument-is-set-manual",children:"1.2.17 Ensure that the --audit-log-path argument is set (Manual)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s | grep 'Running kube-apiserver' | tail -n1\n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," '--audit-log-path' is present"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:'Aug 09 19:06:17 server-0 k3s[2357]: time="2024-08-09T19:06:17Z" level=info msg="Running kube-apiserver --admission-control-config-file=/var/lib/rancher/k3s/server/psa.yaml --advertise-address=10.10.10.100 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --encryption-provider-config-automatic-reload=true --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsx)(r.p,{children:"Edit the K3s config file /etc/rancher/k3s/config.yaml and set the audit-log-path parameter to a suitable path and\nfile where you would like audit logs to be written, for example,"}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{children:'kube-apiserver-arg:\n - "audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log"\n'})})]}),"\n",(0,t.jsx)(r.h3,{id:"1218-ensure-that-the---audit-log-maxage-argument-is-set-to-30-or-as-appropriate-manual",children:"1.2.18 Ensure that the --audit-log-maxage argument is set to 30 or as appropriate (Manual)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s | grep 'Running kube-apiserver' | tail -n1\n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," '--audit-log-maxage' is greater or equal to 30"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:'Aug 09 19:06:17 server-0 k3s[2357]: time="2024-08-09T19:06:17Z" level=info msg="Running kube-apiserver --admission-control-config-file=/var/lib/rancher/k3s/server/psa.yaml --advertise-address=10.10.10.100 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --encryption-provider-config-automatic-reload=true --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsx)(r.p,{children:"Edit the K3s config file /etc/rancher/k3s/config.yaml on the control plane node and\nset the audit-log-maxage parameter to 30 or as an appropriate number of days, for example,"}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{children:'kube-apiserver-arg:\n - "audit-log-maxage=30"\n'})})]}),"\n",(0,t.jsx)(r.h3,{id:"1219-ensure-that-the---audit-log-maxbackup-argument-is-set-to-10-or-as-appropriate-manual",children:"1.2.19 Ensure that the --audit-log-maxbackup argument is set to 10 or as appropriate (Manual)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s | grep 'Running kube-apiserver' | tail -n1\n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," '--audit-log-maxbackup' is greater or equal to 10"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:'Aug 09 19:06:17 server-0 k3s[2357]: time="2024-08-09T19:06:17Z" level=info msg="Running kube-apiserver --admission-control-config-file=/var/lib/rancher/k3s/server/psa.yaml --advertise-address=10.10.10.100 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --encryption-provider-config-automatic-reload=true --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsx)(r.p,{children:"Edit the K3s config file /etc/rancher/k3s/config.yaml on the control plane node and\nset the audit-log-maxbackup parameter to 10 or to an appropriate value. For example,"}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{children:'kube-apiserver-arg:\n - "audit-log-maxbackup=10"\n'})})]}),"\n",(0,t.jsx)(r.h3,{id:"1220-ensure-that-the---audit-log-maxsize-argument-is-set-to-100-or-as-appropriate-manual",children:"1.2.20 Ensure that the --audit-log-maxsize argument is set to 100 or as appropriate (Manual)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s | grep 'Running kube-apiserver' | tail -n1\n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," '--audit-log-maxsize' is greater or equal to 100"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:'Aug 09 19:06:17 server-0 k3s[2357]: time="2024-08-09T19:06:17Z" level=info msg="Running kube-apiserver --admission-control-config-file=/var/lib/rancher/k3s/server/psa.yaml --advertise-address=10.10.10.100 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --encryption-provider-config-automatic-reload=true --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsx)(r.p,{children:"Edit the K3s config file /etc/rancher/k3s/config.yaml on the control plane node and\nset the audit-log-maxsize parameter to an appropriate size in MB. For example,"}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{children:'kube-apiserver-arg:\n - "audit-log-maxsize=100"\n'})})]}),"\n",(0,t.jsx)(r.h3,{id:"1221-ensure-that-the---request-timeout-argument-is-set-as-appropriate-manual",children:"1.2.21 Ensure that the --request-timeout argument is set as appropriate (Manual)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Remediation:"}),'\nPermissive, per CIS guidelines,\n"it is recommended to set this limit as appropriate and change the default limit of 60 seconds only if needed".\nEdit the K3s config file /etc/rancher/k3s/config.yaml\nand set the below parameter if needed. For example,']}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{children:'kube-apiserver-arg:\n - "request-timeout=300s"\n'})}),"\n",(0,t.jsx)(r.h3,{id:"1222-ensure-that-the---service-account-lookup-argument-is-set-to-true-automated",children:"1.2.22 Ensure that the --service-account-lookup argument is set to true (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s | grep 'Running kube-apiserver' | tail -n1\n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," '--service-account-lookup' is not present OR '--service-account-lookup' is present"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:'Aug 09 19:06:17 server-0 k3s[2357]: time="2024-08-09T19:06:17Z" level=info msg="Running kube-apiserver --admission-control-config-file=/var/lib/rancher/k3s/server/psa.yaml --advertise-address=10.10.10.100 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --encryption-provider-config-automatic-reload=true --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsx)(r.p,{children:"By default, K3s does not set the --service-account-lookup argument.\nEdit the K3s config file /etc/rancher/k3s/config.yaml and set the service-account-lookup. For example,"}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{children:'kube-apiserver-arg:\n - "service-account-lookup=true"\n'})}),(0,t.jsx)(r.p,{children:"Alternatively, you can delete the service-account-lookup parameter from this file so\nthat the default takes effect."})]}),"\n",(0,t.jsx)(r.h3,{id:"1223-ensure-that-the---service-account-key-file-argument-is-set-as-appropriate-automated",children:"1.2.23 Ensure that the --service-account-key-file argument is set as appropriate (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s | grep 'Running kube-apiserver' | tail -n1\n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," '--service-account-key-file' is present"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:'Aug 09 19:06:17 server-0 k3s[2357]: time="2024-08-09T19:06:17Z" level=info msg="Running kube-apiserver --admission-control-config-file=/var/lib/rancher/k3s/server/psa.yaml --advertise-address=10.10.10.100 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --encryption-provider-config-automatic-reload=true --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsx)(r.p,{children:"K3s automatically generates and sets the service account key file.\nIt is located at /var/lib/rancher/k3s/server/tls/service.key.\nIf this check fails, edit K3s config file /etc/rancher/k3s/config.yaml and remove any lines like below."}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{children:'kube-apiserver-arg:\n - "service-account-key-file="\n'})})]}),"\n",(0,t.jsx)(r.h3,{id:"1224-ensure-that-the---etcd-certfile-and---etcd-keyfile-arguments-are-set-as-appropriate-automated",children:"1.2.24 Ensure that the --etcd-certfile and --etcd-keyfile arguments are set as appropriate (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"if [ \"$(journalctl -u k3s | grep -m1 'Managed etcd cluster' | wc -l)\" -gt 0 ]; then\n journalctl -D /var/log/journal -u k3s | grep -m1 'Running kube-apiserver' | tail -n1\nelse\n echo \"--etcd-certfile AND --etcd-keyfile\"\nfi\n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," '--etcd-certfile' is present AND '--etcd-keyfile' is present"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:'Aug 09 19:06:17 server-0 k3s[2357]: time="2024-08-09T19:06:17Z" level=info msg="Running kube-apiserver --admission-control-config-file=/var/lib/rancher/k3s/server/psa.yaml --advertise-address=10.10.10.100 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --encryption-provider-config-automatic-reload=true --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsx)(r.p,{children:"K3s automatically generates and sets the etcd certificate and key files.\nThey are located at /var/lib/rancher/k3s/server/tls/etcd/client.crt and /var/lib/rancher/k3s/server/tls/etcd/client.key.\nIf this check fails, edit the K3s config file /etc/rancher/k3s/config.yaml and remove any lines like below."}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{children:'kube-apiserver-arg:\n - "etcd-certfile="\n - "etcd-keyfile="\n'})})]}),"\n",(0,t.jsx)(r.h3,{id:"1225-ensure-that-the---tls-cert-file-and---tls-private-key-file-arguments-are-set-as-appropriate-automated",children:"1.2.25 Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"journalctl -D /var/log/journal -u k3s | grep -A1 'Running kube-apiserver' | tail -n2\n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," '--tls-cert-file' is present AND '--tls-private-key-file' is present"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:'Aug 09 19:06:17 server-0 k3s[2357]: time="2024-08-09T19:06:17Z" level=info msg="Running kube-apiserver --admission-control-config-file=/var/lib/rancher/k3s/server/psa.yaml --advertise-address=10.10.10.100 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --encryption-provider-config-automatic-reload=true --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\nAug 09 19:06:17 server-0 k3s[2357]: time="2024-08-09T19:06:17Z" level=info msg="Running kube-scheduler --authentication-kubeconfig=/var/lib/rancher/k3s/server/cred/scheduler.kubeconfig --authorization-kubeconfig=/var/lib/rancher/k3s/server/cred/scheduler.kubeconfig --bind-address=127.0.0.1 --kubeconfig=/var/lib/rancher/k3s/server/cred/scheduler.kubeconfig --profiling=false --secure-port=10259"\n'})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsx)(r.p,{children:"By default, K3s automatically generates and provides the TLS certificate and private key for the apiserver.\nThey are generated and located at /var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt and /var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key\nIf this check fails, edit the K3s config file /etc/rancher/k3s/config.yaml and remove any lines like below."}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{children:'kube-apiserver-arg:\n - "tls-cert-file="\n - "tls-private-key-file="\n'})})]}),"\n",(0,t.jsx)(r.h3,{id:"1226-ensure-that-the---client-ca-file-argument-is-set-as-appropriate-automated",children:"1.2.26 Ensure that the --client-ca-file argument is set as appropriate (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'client-ca-file'\n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," '--client-ca-file' is present"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:'Aug 09 19:06:17 server-0 k3s[2357]: time="2024-08-09T19:06:17Z" level=info msg="Running kube-apiserver --admission-control-config-file=/var/lib/rancher/k3s/server/psa.yaml --advertise-address=10.10.10.100 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --encryption-provider-config-automatic-reload=true --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsx)(r.p,{children:"By default, K3s automatically provides the client certificate authority file.\nIt is generated and located at /var/lib/rancher/k3s/server/tls/client-ca.crt.\nIf for some reason you need to provide your own ca certificate, look at using the k3s certificate command line tool.\nIf this check fails, edit the K3s config file /etc/rancher/k3s/config.yaml and remove any lines like below."}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{children:'kube-apiserver-arg:\n - "client-ca-file="\n'})})]}),"\n",(0,t.jsx)(r.h3,{id:"1227-ensure-that-the---etcd-cafile-argument-is-set-as-appropriate-automated",children:"1.2.27 Ensure that the --etcd-cafile argument is set as appropriate (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'etcd-cafile'\n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," '--etcd-cafile' is present"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:'Aug 09 19:06:17 server-0 k3s[2357]: time="2024-08-09T19:06:17Z" level=info msg="Running kube-apiserver --admission-control-config-file=/var/lib/rancher/k3s/server/psa.yaml --advertise-address=10.10.10.100 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --encryption-provider-config-automatic-reload=true --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsx)(r.p,{children:"By default, K3s automatically provides the etcd certificate authority file.\nIt is generated and located at /var/lib/rancher/k3s/server/tls/client-ca.crt.\nIf for some reason you need to provide your own ca certificate, look at using the k3s certificate command line tool.\nIf this check fails, edit the K3s config file /etc/rancher/k3s/config.yaml and remove any lines like below."}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{children:'kube-apiserver-arg:\n - "etcd-cafile="\n'})})]}),"\n",(0,t.jsx)(r.h3,{id:"1228-ensure-that-the---encryption-provider-config-argument-is-set-as-appropriate-manual",children:"1.2.28 Ensure that the --encryption-provider-config argument is set as appropriate (Manual)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'encryption-provider-config'\n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," '--encryption-provider-config' is present"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:'Aug 09 19:06:17 server-0 k3s[2357]: time="2024-08-09T19:06:17Z" level=info msg="Running kube-apiserver --admission-control-config-file=/var/lib/rancher/k3s/server/psa.yaml --advertise-address=10.10.10.100 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --encryption-provider-config-automatic-reload=true --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsx)(r.p,{children:"K3s can be configured to use encryption providers to encrypt secrets at rest.\nEdit the K3s config file /etc/rancher/k3s/config.yaml on the control plane node and set the below parameter.\nsecrets-encryption: true\nSecrets encryption can then be managed with the k3s secrets-encrypt command line tool.\nIf needed, you can find the generated encryption config at /var/lib/rancher/k3s/server/cred/encryption-config.json."})]}),"\n",(0,t.jsx)(r.h3,{id:"1229-ensure-that-encryption-providers-are-appropriately-configured-manual",children:"1.2.29 Ensure that encryption providers are appropriately configured (Manual)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"ENCRYPTION_PROVIDER_CONFIG=$(journalctl -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep -- --encryption-provider-config | sed 's%.*encryption-provider-config[= ]\\([^ ]*\\).*%\\1%')\nif test -e $ENCRYPTION_PROVIDER_CONFIG; then grep -o 'providers\\\"\\:\\[.*\\]' $ENCRYPTION_PROVIDER_CONFIG | grep -o \"[A-Za-z]*\" | head -2 | tail -1 | sed 's/^/provider=/'; fi\n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," 'provider' contains valid elements from 'aescbc,kms,secretbox'"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:"provider=aescbc\n"})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsx)(r.p,{children:"K3s can be configured to use encryption providers to encrypt secrets at rest. K3s will utilize the aescbc provider.\nEdit the K3s config file /etc/rancher/k3s/config.yaml on the control plane node and set the below parameter.\nsecrets-encryption: true\nSecrets encryption can then be managed with the k3s secrets-encrypt command line tool.\nIf needed, you can find the generated encryption config at /var/lib/rancher/k3s/server/cred/encryption-config.json"})]}),"\n",(0,t.jsx)(r.h3,{id:"1230-ensure-that-the-api-server-only-makes-use-of-strong-cryptographic-ciphers-automated",children:"1.2.30 Ensure that the API Server only makes use of Strong Cryptographic Ciphers (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'tls-cipher-suites'\n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," '--tls-cipher-suites' contains valid elements from 'TLS_AES_128_GCM_SHA256,TLS_AES_256_GCM_SHA384,TLS_CHACHA20_POLY1305_SHA256,TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256,TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256,TLS_RSA_WITH_3DES_EDE_CBC_SHA,TLS_RSA_WITH_AES_128_CBC_SHA,TLS_RSA_WITH_AES_128_GCM_SHA256,TLS_RSA_WITH_AES_256_CBC_SHA,TLS_RSA_WITH_AES_256_GCM_SHA384'"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:'Aug 09 19:06:17 server-0 k3s[2357]: time="2024-08-09T19:06:17Z" level=info msg="Running kube-apiserver --admission-control-config-file=/var/lib/rancher/k3s/server/psa.yaml --advertise-address=10.10.10.100 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --encryption-provider-config-automatic-reload=true --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsxs)(r.p,{children:["By default, the K3s kube-apiserver complies with this test. Changes to these values may cause regression, therefore ensure that all apiserver clients support the new TLS configuration before applying it in production deployments.\nIf a custom TLS configuration is required, consider also creating a custom version of this rule that aligns with your requirements.\nIf this check fails, remove any custom configuration around ",(0,t.jsx)(r.code,{children:"tls-cipher-suites"})," or update the /etc/rancher/k3s/config.yaml file to match the default by adding the following:"]}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{children:'kube-apiserver-arg:\n - "tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305"\n'})})]}),"\n",(0,t.jsx)(r.h2,{id:"13-controller-manager",children:"1.3 Controller Manager"}),"\n",(0,t.jsx)(r.h3,{id:"131-ensure-that-the---terminated-pod-gc-threshold-argument-is-set-as-appropriate-manual",children:"1.3.1 Ensure that the --terminated-pod-gc-threshold argument is set as appropriate (Manual)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s | grep 'Running kube-controller-manager' | tail -n1 | grep 'terminated-pod-gc-threshold'\n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," '--terminated-pod-gc-threshold' is present"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:'Aug 09 19:06:17 server-0 k3s[2357]: time="2024-08-09T19:06:17Z" level=info msg="Running kube-controller-manager --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/k3s/server/tls/client-ca.nochain.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/k3s/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/k3s/server/tls/client-ca.nochain.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/k3s/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/k3s/server/tls/server-ca.nochain.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/k3s/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/k3s/server/tls/server-ca.nochain.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/k3s/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,tokencleaner,-service,-route,-cloud-node-lifecycle --kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/k3s/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --terminated-pod-gc-threshold=10 --use-service-account-credentials=true"\n'})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsx)(r.p,{children:"Edit the K3s config file /etc/rancher/k3s/config.yaml on the control plane node\nand set the --terminated-pod-gc-threshold to an appropriate threshold,"}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{children:'kube-controller-manager-arg:\n - "terminated-pod-gc-threshold=10"\n'})})]}),"\n",(0,t.jsx)(r.h3,{id:"132-ensure-that-the---profiling-argument-is-set-to-false-automated",children:"1.3.2 Ensure that the --profiling argument is set to false (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s | grep 'Running kube-controller-manager' | tail -n1 | grep 'profiling'\n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," '--profiling' is equal to 'false'"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:'Aug 09 19:06:17 server-0 k3s[2357]: time="2024-08-09T19:06:17Z" level=info msg="Running kube-controller-manager --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/k3s/server/tls/client-ca.nochain.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/k3s/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/k3s/server/tls/client-ca.nochain.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/k3s/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/k3s/server/tls/server-ca.nochain.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/k3s/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/k3s/server/tls/server-ca.nochain.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/k3s/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,tokencleaner,-service,-route,-cloud-node-lifecycle --kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/k3s/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --terminated-pod-gc-threshold=10 --use-service-account-credentials=true"\n'})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsx)(r.p,{children:"By default, K3s sets the --profiling argument to false.\nIf this check fails, edit the K3s config file /etc/rancher/k3s/config.yaml and remove any lines like below."}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{children:'kube-controller-manager-arg:\n - "profiling=true"\n'})})]}),"\n",(0,t.jsx)(r.h3,{id:"133-ensure-that-the---use-service-account-credentials-argument-is-set-to-true-automated",children:"1.3.3 Ensure that the --use-service-account-credentials argument is set to true (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s | grep 'Running kube-controller-manager' | tail -n1 | grep 'use-service-account-credentials'\n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," '--use-service-account-credentials' is not equal to 'false'"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:'Aug 09 19:06:17 server-0 k3s[2357]: time="2024-08-09T19:06:17Z" level=info msg="Running kube-controller-manager --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/k3s/server/tls/client-ca.nochain.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/k3s/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/k3s/server/tls/client-ca.nochain.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/k3s/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/k3s/server/tls/server-ca.nochain.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/k3s/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/k3s/server/tls/server-ca.nochain.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/k3s/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,tokencleaner,-service,-route,-cloud-node-lifecycle --kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/k3s/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --terminated-pod-gc-threshold=10 --use-service-account-credentials=true"\n'})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsx)(r.p,{children:"By default, K3s sets the --use-service-account-credentials argument to true.\nIf this check fails, edit the K3s config file /etc/rancher/k3s/config.yaml and remove any lines like below."}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{children:'kube-controller-manager-arg:\n - "use-service-account-credentials=false"\n'})})]}),"\n",(0,t.jsx)(r.h3,{id:"134-ensure-that-the---service-account-private-key-file-argument-is-set-as-appropriate-automated",children:"1.3.4 Ensure that the --service-account-private-key-file argument is set as appropriate (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s | grep 'Running kube-controller-manager' | tail -n1 | grep 'service-account-private-key-file'\n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," '--service-account-private-key-file' is present"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:'Aug 09 19:06:17 server-0 k3s[2357]: time="2024-08-09T19:06:17Z" level=info msg="Running kube-controller-manager --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/k3s/server/tls/client-ca.nochain.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/k3s/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/k3s/server/tls/client-ca.nochain.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/k3s/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/k3s/server/tls/server-ca.nochain.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/k3s/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/k3s/server/tls/server-ca.nochain.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/k3s/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,tokencleaner,-service,-route,-cloud-node-lifecycle --kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/k3s/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --terminated-pod-gc-threshold=10 --use-service-account-credentials=true"\n'})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsx)(r.p,{children:"By default, K3s automatically provides the service account private key file.\nIt is generated and located at /var/lib/rancher/k3s/server/tls/service.current.key.\nIf this check fails, edit the K3s config file /etc/rancher/k3s/config.yaml and remove any lines like below."}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{children:'kube-controller-manager-arg:\n - "service-account-private-key-file="\n'})})]}),"\n",(0,t.jsx)(r.h3,{id:"135-ensure-that-the---root-ca-file-argument-is-set-as-appropriate-automated",children:"1.3.5 Ensure that the --root-ca-file argument is set as appropriate (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s | grep 'Running kube-controller-manager' | tail -n1 | grep 'root-ca-file'\n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," '--root-ca-file' is present"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:'Aug 09 19:06:17 server-0 k3s[2357]: time="2024-08-09T19:06:17Z" level=info msg="Running kube-controller-manager --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/k3s/server/tls/client-ca.nochain.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/k3s/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/k3s/server/tls/client-ca.nochain.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/k3s/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/k3s/server/tls/server-ca.nochain.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/k3s/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/k3s/server/tls/server-ca.nochain.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/k3s/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,tokencleaner,-service,-route,-cloud-node-lifecycle --kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/k3s/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --terminated-pod-gc-threshold=10 --use-service-account-credentials=true"\n'})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsx)(r.p,{children:"By default, K3s automatically provides the root CA file.\nIt is generated and located at /var/lib/rancher/k3s/server/tls/server-ca.crt.\nIf for some reason you need to provide your own ca certificate, look at using the k3s certificate command line tool.\nIf this check fails, edit the K3s config file /etc/rancher/k3s/config.yaml and remove any lines like below."}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{children:'kube-controller-manager-arg:\n - "root-ca-file="\n'})})]}),"\n",(0,t.jsx)(r.h3,{id:"136-ensure-that-the-rotatekubeletservercertificate-argument-is-set-to-true-automated",children:"1.3.6 Ensure that the RotateKubeletServerCertificate argument is set to true (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s | grep 'Running kube-controller-manager' | tail -n1\n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," '--feature-gates' is present OR '--feature-gates' is not present"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:'Aug 09 19:06:17 server-0 k3s[2357]: time="2024-08-09T19:06:17Z" level=info msg="Running kube-controller-manager --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/k3s/server/tls/client-ca.nochain.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/k3s/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/k3s/server/tls/client-ca.nochain.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/k3s/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/k3s/server/tls/server-ca.nochain.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/k3s/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/k3s/server/tls/server-ca.nochain.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/k3s/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,tokencleaner,-service,-route,-cloud-node-lifecycle --kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/k3s/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --terminated-pod-gc-threshold=10 --use-service-account-credentials=true"\n'})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsx)(r.p,{children:"By default, K3s does not set the RotateKubeletServerCertificate feature gate.\nIf you have enabled this feature gate, you should remove it.\nIf this check fails, edit the K3s config file /etc/rancher/k3s/config.yaml, remove any lines like below."}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{children:'kube-controller-manager-arg:\n - "feature-gate=RotateKubeletServerCertificate"\n'})})]}),"\n",(0,t.jsx)(r.h3,{id:"137-ensure-that-the---bind-address-argument-is-set-to-127001-automated",children:"1.3.7 Ensure that the --bind-address argument is set to 127.0.0.1 (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s | grep 'Running kube-controller-manager' | tail -n1\n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," '--bind-address' is equal to '127.0.0.1' OR '--bind-address' is not present"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:'Aug 09 19:06:17 server-0 k3s[2357]: time="2024-08-09T19:06:17Z" level=info msg="Running kube-controller-manager --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/k3s/server/tls/client-ca.nochain.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/k3s/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/k3s/server/tls/client-ca.nochain.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/k3s/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/k3s/server/tls/server-ca.nochain.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/k3s/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/k3s/server/tls/server-ca.nochain.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/k3s/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,tokencleaner,-service,-route,-cloud-node-lifecycle --kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/k3s/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --terminated-pod-gc-threshold=10 --use-service-account-credentials=true"\n'})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsx)(r.p,{children:"By default, K3s sets the --bind-address argument to 127.0.0.1\nIf this check fails, edit the K3s config file /etc/rancher/k3s/config.yaml and remove any lines like below."}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{children:'kube-controller-manager-arg:\n - "bind-address="\n'})})]}),"\n",(0,t.jsx)(r.h2,{id:"14-scheduler",children:"1.4 Scheduler"}),"\n",(0,t.jsx)(r.h3,{id:"141-ensure-that-the---profiling-argument-is-set-to-false-automated",children:"1.4.1 Ensure that the --profiling argument is set to false (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"journalctl -D /var/log/journal -u k3s | grep 'Running kube-scheduler' | tail -n1 | grep 'profiling'\n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," '--profiling' is equal to 'false'"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:'Aug 09 19:06:17 server-0 k3s[2357]: time="2024-08-09T19:06:17Z" level=info msg="Running kube-scheduler --authentication-kubeconfig=/var/lib/rancher/k3s/server/cred/scheduler.kubeconfig --authorization-kubeconfig=/var/lib/rancher/k3s/server/cred/scheduler.kubeconfig --bind-address=127.0.0.1 --kubeconfig=/var/lib/rancher/k3s/server/cred/scheduler.kubeconfig --profiling=false --secure-port=10259"\n'})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsx)(r.p,{children:"By default, K3s sets the --profiling argument to false.\nIf this check fails, edit the K3s config file /etc/rancher/k3s/config.yaml and remove any lines like below."}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{children:'kube-scheduler-arg:\n - "profiling=true"\n'})})]}),"\n",(0,t.jsx)(r.h3,{id:"142-ensure-that-the---bind-address-argument-is-set-to-127001-automated",children:"1.4.2 Ensure that the --bind-address argument is set to 127.0.0.1 (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s | grep 'Running kube-scheduler' | tail -n1 | grep 'bind-address'\n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," '--bind-address' is equal to '127.0.0.1' OR '--bind-address' is not present"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:'Aug 09 19:06:17 server-0 k3s[2357]: time="2024-08-09T19:06:17Z" level=info msg="Running kube-scheduler --authentication-kubeconfig=/var/lib/rancher/k3s/server/cred/scheduler.kubeconfig --authorization-kubeconfig=/var/lib/rancher/k3s/server/cred/scheduler.kubeconfig --bind-address=127.0.0.1 --kubeconfig=/var/lib/rancher/k3s/server/cred/scheduler.kubeconfig --profiling=false --secure-port=10259"\n'})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsx)(r.p,{children:"By default, K3s sets the --bind-address argument to 127.0.0.1\nIf this check fails, edit the K3s config file /etc/rancher/k3s/config.yaml and remove any lines like below."}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{children:'kube-scheduler-arg:\n - "bind-address="\n'})})]}),"\n",(0,t.jsx)(r.h2,{id:"2-etcd-node-configuration",children:"2 Etcd Node Configuration"}),"\n",(0,t.jsx)(r.h3,{id:"21-ensure-that-the---cert-file-and---key-file-arguments-are-set-as-appropriate-automated",children:"2.1 Ensure that the --cert-file and --key-file arguments are set as appropriate (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," '.client-transport-security.cert-file' is equal to '/var/lib/rancher/k3s/server/tls/etcd/server-client.crt' AND '.client-transport-security.key-file' is equal to '/var/lib/rancher/k3s/server/tls/etcd/server-client.key'"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:"advertise-client-urls: https://10.10.10.100:2379\nclient-transport-security:\n cert-file: /var/lib/rancher/k3s/server/tls/etcd/server-client.crt\n client-cert-auth: true\n key-file: /var/lib/rancher/k3s/server/tls/etcd/server-client.key\n trusted-ca-file: /var/lib/rancher/k3s/server/tls/etcd/server-ca.crt\ndata-dir: /var/lib/rancher/k3s/server/db/etcd\nelection-timeout: 5000\nexperimental-initial-corrupt-check: true\nexperimental-watch-progress-notify-interval: 5000000000\nheartbeat-interval: 500\ninitial-advertise-peer-urls: https://10.10.10.100:2380\ninitial-cluster: server-0-11120bb0=https://10.10.10.100:2380\ninitial-cluster-state: new\nlisten-client-http-urls: https://127.0.0.1:2382\nlisten-client-urls: https://127.0.0.1:2379,https://10.10.10.100:2379\nlisten-metrics-urls: http://127.0.0.1:2381\nlisten-peer-urls: https://127.0.0.1:2380,https://10.10.10.100:2380\nlog-outputs:\n- stderr\nlogger: zap\nname: server-0-11120bb0\npeer-transport-security:\n cert-file: /var/lib/rancher/k3s/server/tls/etcd/peer-server-client.crt\n client-cert-auth: true\n key-file: /var/lib/rancher/k3s/server/tls/etcd/peer-server-client.key\n trusted-ca-file: /var/lib/rancher/k3s/server/tls/etcd/peer-ca.crt\nsnapshot-count: 10000\n"})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsx)(r.p,{children:"If running on with sqlite or a external DB, etcd checks are Not Applicable.\nWhen running with embedded-etcd, K3s generates cert and key files for etcd.\nThese are located in /var/lib/rancher/k3s/server/tls/etcd/.\nIf this check fails, ensure that the configuration file /var/lib/rancher/k3s/server/db/etcd/config\nhas not been modified to use custom cert and key files."})]}),"\n",(0,t.jsx)(r.h3,{id:"22-ensure-that-the---client-cert-auth-argument-is-set-to-true-automated",children:"2.2 Ensure that the --client-cert-auth argument is set to true (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," '.client-transport-security.client-cert-auth' is equal to 'true'"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:"advertise-client-urls: https://10.10.10.100:2379\nclient-transport-security:\n cert-file: /var/lib/rancher/k3s/server/tls/etcd/server-client.crt\n client-cert-auth: true\n key-file: /var/lib/rancher/k3s/server/tls/etcd/server-client.key\n trusted-ca-file: /var/lib/rancher/k3s/server/tls/etcd/server-ca.crt\ndata-dir: /var/lib/rancher/k3s/server/db/etcd\nelection-timeout: 5000\nexperimental-initial-corrupt-check: true\nexperimental-watch-progress-notify-interval: 5000000000\nheartbeat-interval: 500\ninitial-advertise-peer-urls: https://10.10.10.100:2380\ninitial-cluster: server-0-11120bb0=https://10.10.10.100:2380\ninitial-cluster-state: new\nlisten-client-http-urls: https://127.0.0.1:2382\nlisten-client-urls: https://127.0.0.1:2379,https://10.10.10.100:2379\nlisten-metrics-urls: http://127.0.0.1:2381\nlisten-peer-urls: https://127.0.0.1:2380,https://10.10.10.100:2380\nlog-outputs:\n- stderr\nlogger: zap\nname: server-0-11120bb0\npeer-transport-security:\n cert-file: /var/lib/rancher/k3s/server/tls/etcd/peer-server-client.crt\n client-cert-auth: true\n key-file: /var/lib/rancher/k3s/server/tls/etcd/peer-server-client.key\n trusted-ca-file: /var/lib/rancher/k3s/server/tls/etcd/peer-ca.crt\nsnapshot-count: 10000\n"})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsx)(r.p,{children:"If running on with sqlite or a external DB, etcd checks are Not Applicable.\nWhen running with embedded-etcd, K3s sets the --client-cert-auth parameter to true.\nIf this check fails, ensure that the configuration file /var/lib/rancher/k3s/server/db/etcd/config\nhas not been modified to disable client certificate authentication."})]}),"\n",(0,t.jsx)(r.h3,{id:"23-ensure-that-the---auto-tls-argument-is-not-set-to-true-automated",children:"2.3 Ensure that the --auto-tls argument is not set to true (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," '.client-transport-security.auto-tls' is present OR '.client-transport-security.auto-tls' is not present"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:"advertise-client-urls: https://10.10.10.100:2379\nclient-transport-security:\n cert-file: /var/lib/rancher/k3s/server/tls/etcd/server-client.crt\n client-cert-auth: true\n key-file: /var/lib/rancher/k3s/server/tls/etcd/server-client.key\n trusted-ca-file: /var/lib/rancher/k3s/server/tls/etcd/server-ca.crt\ndata-dir: /var/lib/rancher/k3s/server/db/etcd\nelection-timeout: 5000\nexperimental-initial-corrupt-check: true\nexperimental-watch-progress-notify-interval: 5000000000\nheartbeat-interval: 500\ninitial-advertise-peer-urls: https://10.10.10.100:2380\ninitial-cluster: server-0-11120bb0=https://10.10.10.100:2380\ninitial-cluster-state: new\nlisten-client-http-urls: https://127.0.0.1:2382\nlisten-client-urls: https://127.0.0.1:2379,https://10.10.10.100:2379\nlisten-metrics-urls: http://127.0.0.1:2381\nlisten-peer-urls: https://127.0.0.1:2380,https://10.10.10.100:2380\nlog-outputs:\n- stderr\nlogger: zap\nname: server-0-11120bb0\npeer-transport-security:\n cert-file: /var/lib/rancher/k3s/server/tls/etcd/peer-server-client.crt\n client-cert-auth: true\n key-file: /var/lib/rancher/k3s/server/tls/etcd/peer-server-client.key\n trusted-ca-file: /var/lib/rancher/k3s/server/tls/etcd/peer-ca.crt\nsnapshot-count: 10000\n"})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsx)(r.p,{children:"If running on with sqlite or a external DB, etcd checks are Not Applicable.\nWhen running with embedded-etcd, K3s does not set the --auto-tls parameter.\nIf this check fails, edit the etcd pod specification file /var/lib/rancher/k3s/server/db/etcd/config on the master\nnode and either remove the --auto-tls parameter or set it to false.\nclient-transport-security:\nauto-tls: false"})]}),"\n",(0,t.jsx)(r.h3,{id:"24-ensure-that-the---peer-cert-file-and---peer-key-file-arguments-are-set-as-appropriate-automated",children:"2.4 Ensure that the --peer-cert-file and --peer-key-file arguments are set as appropriate (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," '.peer-transport-security.cert-file' is equal to '/var/lib/rancher/k3s/server/tls/etcd/peer-server-client.crt' AND '.peer-transport-security.key-file' is equal to '/var/lib/rancher/k3s/server/tls/etcd/peer-server-client.key'"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:"advertise-client-urls: https://10.10.10.100:2379\nclient-transport-security:\n cert-file: /var/lib/rancher/k3s/server/tls/etcd/server-client.crt\n client-cert-auth: true\n key-file: /var/lib/rancher/k3s/server/tls/etcd/server-client.key\n trusted-ca-file: /var/lib/rancher/k3s/server/tls/etcd/server-ca.crt\ndata-dir: /var/lib/rancher/k3s/server/db/etcd\nelection-timeout: 5000\nexperimental-initial-corrupt-check: true\nexperimental-watch-progress-notify-interval: 5000000000\nheartbeat-interval: 500\ninitial-advertise-peer-urls: https://10.10.10.100:2380\ninitial-cluster: server-0-11120bb0=https://10.10.10.100:2380\ninitial-cluster-state: new\nlisten-client-http-urls: https://127.0.0.1:2382\nlisten-client-urls: https://127.0.0.1:2379,https://10.10.10.100:2379\nlisten-metrics-urls: http://127.0.0.1:2381\nlisten-peer-urls: https://127.0.0.1:2380,https://10.10.10.100:2380\nlog-outputs:\n- stderr\nlogger: zap\nname: server-0-11120bb0\npeer-transport-security:\n cert-file: /var/lib/rancher/k3s/server/tls/etcd/peer-server-client.crt\n client-cert-auth: true\n key-file: /var/lib/rancher/k3s/server/tls/etcd/peer-server-client.key\n trusted-ca-file: /var/lib/rancher/k3s/server/tls/etcd/peer-ca.crt\nsnapshot-count: 10000\n"})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsx)(r.p,{children:"If running on with sqlite or a external DB, etcd checks are Not Applicable.\nWhen running with embedded-etcd, K3s generates peer cert and key files for etcd.\nThese are located in /var/lib/rancher/k3s/server/tls/etcd/.\nIf this check fails, ensure that the configuration file /var/lib/rancher/k3s/server/db/etcd/config\nhas not been modified to use custom peer cert and key files."})]}),"\n",(0,t.jsx)(r.h3,{id:"25-ensure-that-the---peer-client-cert-auth-argument-is-set-to-true-automated",children:"2.5 Ensure that the --peer-client-cert-auth argument is set to true (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," '.peer-transport-security.client-cert-auth' is equal to 'true'"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:"advertise-client-urls: https://10.10.10.100:2379\nclient-transport-security:\n cert-file: /var/lib/rancher/k3s/server/tls/etcd/server-client.crt\n client-cert-auth: true\n key-file: /var/lib/rancher/k3s/server/tls/etcd/server-client.key\n trusted-ca-file: /var/lib/rancher/k3s/server/tls/etcd/server-ca.crt\ndata-dir: /var/lib/rancher/k3s/server/db/etcd\nelection-timeout: 5000\nexperimental-initial-corrupt-check: true\nexperimental-watch-progress-notify-interval: 5000000000\nheartbeat-interval: 500\ninitial-advertise-peer-urls: https://10.10.10.100:2380\ninitial-cluster: server-0-11120bb0=https://10.10.10.100:2380\ninitial-cluster-state: new\nlisten-client-http-urls: https://127.0.0.1:2382\nlisten-client-urls: https://127.0.0.1:2379,https://10.10.10.100:2379\nlisten-metrics-urls: http://127.0.0.1:2381\nlisten-peer-urls: https://127.0.0.1:2380,https://10.10.10.100:2380\nlog-outputs:\n- stderr\nlogger: zap\nname: server-0-11120bb0\npeer-transport-security:\n cert-file: /var/lib/rancher/k3s/server/tls/etcd/peer-server-client.crt\n client-cert-auth: true\n key-file: /var/lib/rancher/k3s/server/tls/etcd/peer-server-client.key\n trusted-ca-file: /var/lib/rancher/k3s/server/tls/etcd/peer-ca.crt\nsnapshot-count: 10000\n"})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsx)(r.p,{children:"If running on with sqlite or a external DB, etcd checks are Not Applicable.\nWhen running with embedded-etcd, K3s sets the --peer-cert-auth parameter to true.\nIf this check fails, ensure that the configuration file /var/lib/rancher/k3s/server/db/etcd/config\nhas not been modified to disable peer client certificate authentication."})]}),"\n",(0,t.jsx)(r.h3,{id:"26-ensure-that-the---peer-auto-tls-argument-is-not-set-to-true-automated",children:"2.6 Ensure that the --peer-auto-tls argument is not set to true (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," '.peer-transport-security.auto-tls' is present OR '.peer-transport-security.auto-tls' is not present"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:"advertise-client-urls: https://10.10.10.100:2379\nclient-transport-security:\n cert-file: /var/lib/rancher/k3s/server/tls/etcd/server-client.crt\n client-cert-auth: true\n key-file: /var/lib/rancher/k3s/server/tls/etcd/server-client.key\n trusted-ca-file: /var/lib/rancher/k3s/server/tls/etcd/server-ca.crt\ndata-dir: /var/lib/rancher/k3s/server/db/etcd\nelection-timeout: 5000\nexperimental-initial-corrupt-check: true\nexperimental-watch-progress-notify-interval: 5000000000\nheartbeat-interval: 500\ninitial-advertise-peer-urls: https://10.10.10.100:2380\ninitial-cluster: server-0-11120bb0=https://10.10.10.100:2380\ninitial-cluster-state: new\nlisten-client-http-urls: https://127.0.0.1:2382\nlisten-client-urls: https://127.0.0.1:2379,https://10.10.10.100:2379\nlisten-metrics-urls: http://127.0.0.1:2381\nlisten-peer-urls: https://127.0.0.1:2380,https://10.10.10.100:2380\nlog-outputs:\n- stderr\nlogger: zap\nname: server-0-11120bb0\npeer-transport-security:\n cert-file: /var/lib/rancher/k3s/server/tls/etcd/peer-server-client.crt\n client-cert-auth: true\n key-file: /var/lib/rancher/k3s/server/tls/etcd/peer-server-client.key\n trusted-ca-file: /var/lib/rancher/k3s/server/tls/etcd/peer-ca.crt\nsnapshot-count: 10000\n"})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsx)(r.p,{children:"If running on with sqlite or a external DB, etcd checks are Not Applicable.\nWhen running with embedded-etcd, K3s does not set the --peer-auto-tls parameter.\nIf this check fails, edit the etcd pod specification file /var/lib/rancher/k3s/server/db/etcd/config on the master\nnode and either remove the --peer-auto-tls parameter or set it to false.\npeer-transport-security:\nauto-tls: false"})]}),"\n",(0,t.jsx)(r.h3,{id:"27-ensure-that-a-unique-certificate-authority-is-used-for-etcd-automated",children:"2.7 Ensure that a unique Certificate Authority is used for etcd (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," '.peer-transport-security.trusted-ca-file' is equal to '/var/lib/rancher/k3s/server/tls/etcd/peer-ca.crt'"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:"advertise-client-urls: https://10.10.10.100:2379\nclient-transport-security:\n cert-file: /var/lib/rancher/k3s/server/tls/etcd/server-client.crt\n client-cert-auth: true\n key-file: /var/lib/rancher/k3s/server/tls/etcd/server-client.key\n trusted-ca-file: /var/lib/rancher/k3s/server/tls/etcd/server-ca.crt\ndata-dir: /var/lib/rancher/k3s/server/db/etcd\nelection-timeout: 5000\nexperimental-initial-corrupt-check: true\nexperimental-watch-progress-notify-interval: 5000000000\nheartbeat-interval: 500\ninitial-advertise-peer-urls: https://10.10.10.100:2380\ninitial-cluster: server-0-11120bb0=https://10.10.10.100:2380\ninitial-cluster-state: new\nlisten-client-http-urls: https://127.0.0.1:2382\nlisten-client-urls: https://127.0.0.1:2379,https://10.10.10.100:2379\nlisten-metrics-urls: http://127.0.0.1:2381\nlisten-peer-urls: https://127.0.0.1:2380,https://10.10.10.100:2380\nlog-outputs:\n- stderr\nlogger: zap\nname: server-0-11120bb0\npeer-transport-security:\n cert-file: /var/lib/rancher/k3s/server/tls/etcd/peer-server-client.crt\n client-cert-auth: true\n key-file: /var/lib/rancher/k3s/server/tls/etcd/peer-server-client.key\n trusted-ca-file: /var/lib/rancher/k3s/server/tls/etcd/peer-ca.crt\nsnapshot-count: 10000\n"})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsx)(r.p,{children:"If running on with sqlite or a external DB, etcd checks are Not Applicable.\nWhen running with embedded-etcd, K3s generates a unique certificate authority for etcd.\nThis is located at /var/lib/rancher/k3s/server/tls/etcd/peer-ca.crt.\nIf this check fails, ensure that the configuration file /var/lib/rancher/k3s/server/db/etcd/config\nhas not been modified to use a shared certificate authority."})]}),"\n",(0,t.jsx)(r.h2,{id:"41-worker-node-configuration-files",children:"4.1 Worker Node Configuration Files"}),"\n",(0,t.jsx)(r.h3,{id:"411-ensure-that-the-kubelet-service-file-permissions-are-set-to-600-or-more-restrictive-automated",children:"4.1.1 Ensure that the kubelet service file permissions are set to 600 or more restrictive (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," Not Applicable"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Rationale:"})}),"\n",(0,t.jsx)(r.p,{children:"The kubelet is embedded in the k3s process. There is no kubelet service file, all configuration is passed in as arguments at runtime."}),"\n",(0,t.jsxs)(r.h3,{id:"412-ensure-that-the-kubelet-service-file-ownership-is-set-to-root-automated",children:["4.1.2 Ensure that the kubelet service file ownership is set to root",":root"," (Automated)"]}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," Not Applicable"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Rationale:"})}),"\n",(0,t.jsx)(r.p,{children:"The kubelet is embedded in the k3s process. There is no kubelet service file, all configuration is passed in as arguments at runtime."}),"\n",(0,t.jsx)(r.p,{children:"All configuration is passed in as arguments at container run time."}),"\n",(0,t.jsx)(r.h3,{id:"413-if-proxy-kubeconfig-file-exists-ensure-permissions-are-set-to-600-or-more-restrictive-automated",children:"4.1.3 If proxy kubeconfig file exists ensure permissions are set to 600 or more restrictive (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"/bin/sh -c 'if test -e /var/lib/rancher/k3s/agent/kubeproxy.kubeconfig; then stat -c permissions=%a /var/lib/rancher/k3s/agent/kubeproxy.kubeconfig; fi' \n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," permissions has permissions 600, expected 600 or more restrictive"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:"permissions=600\n"})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsxs)(r.p,{children:["Run the below command (based on the file location on your system) on the each worker node.\nFor example,\n",(0,t.jsx)(r.code,{children:"chmod 600 /var/lib/rancher/k3s/agent/kubeproxy.kubeconfig"})]})]}),"\n",(0,t.jsxs)(r.h3,{id:"414-if-proxy-kubeconfig-file-exists-ensure-ownership-is-set-to-root-automated",children:["4.1.4 If proxy kubeconfig file exists ensure ownership is set to root",":root"," (Automated)"]}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"/bin/sh -c 'if test -e /var/lib/rancher/k3s/agent/kubeproxy.kubeconfig; then stat -c %U:%G /var/lib/rancher/k3s/agent/kubeproxy.kubeconfig; fi' \n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," 'root",":root","' is present"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:"root:root\n"})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsxs)(r.p,{children:["Run the below command (based on the file location on your system) on the each worker node.\nFor example, ",(0,t.jsx)(r.code,{children:"chown root:root /var/lib/rancher/k3s/agent/kubeproxy.kubeconfig"})]})]}),"\n",(0,t.jsx)(r.h3,{id:"415-ensure-that-the---kubeconfig-kubeletconf-file-permissions-are-set-to-600-or-more-restrictive-automated",children:"4.1.5 Ensure that the --kubeconfig kubelet.conf file permissions are set to 600 or more restrictive (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"/bin/sh -c 'if test -e /var/lib/rancher/k3s/agent/kubelet.kubeconfig; then stat -c permissions=%a /var/lib/rancher/k3s/agent/kubelet.kubeconfig; fi' \n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," permissions has permissions 600, expected 600 or more restrictive"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:"permissions=600\n"})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsxs)(r.p,{children:["Run the below command (based on the file location on your system) on the each worker node.\nFor example,\n",(0,t.jsx)(r.code,{children:"chmod 600 /var/lib/rancher/k3s/agent/kubelet.kubeconfig"})]})]}),"\n",(0,t.jsxs)(r.h3,{id:"416-ensure-that-the---kubeconfig-kubeletconf-file-ownership-is-set-to-root-automated",children:["4.1.6 Ensure that the --kubeconfig kubelet.conf file ownership is set to root",":root"," (Automated)"]}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"stat -c %U:%G /var/lib/rancher/k3s/agent/kubelet.kubeconfig\n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," 'root",":root","' is present"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:"root:root\n"})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsxs)(r.p,{children:["Run the below command (based on the file location on your system) on the each worker node.\nFor example,\n",(0,t.jsx)(r.code,{children:"chown root:root /var/lib/rancher/k3s/agent/kubelet.kubeconfig"})]})]}),"\n",(0,t.jsx)(r.h3,{id:"417-ensure-that-the-certificate-authorities-file-permissions-are-set-to-600-or-more-restrictive-automated",children:"4.1.7 Ensure that the certificate authorities file permissions are set to 600 or more restrictive (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"stat -c permissions=%a /var/lib/rancher/k3s/agent/client-ca.crt\n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," permissions has permissions 600, expected 600 or more restrictive"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:"permissions=600\n"})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsxs)(r.p,{children:["Run the following command to modify the file permissions of the\n--client-ca-file ",(0,t.jsx)(r.code,{children:"chmod 600 /var/lib/rancher/k3s/agent/client-ca.crt"})]})]}),"\n",(0,t.jsxs)(r.h3,{id:"418-ensure-that-the-client-certificate-authorities-file-ownership-is-set-to-root-automated",children:["4.1.8 Ensure that the client certificate authorities file ownership is set to root",":root"," (Automated)"]}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"stat -c %U:%G /var/lib/rancher/k3s/agent/client-ca.crt\n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," 'root",":root","' is equal to 'root",":root","'"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:"root:root\n"})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsxs)(r.p,{children:["Run the following command to modify the ownership of the --client-ca-file.\n",(0,t.jsx)(r.code,{children:"chown root:root /var/lib/rancher/k3s/agent/client-ca.crt"})]})]}),"\n",(0,t.jsx)(r.h3,{id:"419-ensure-that-the-kubelet---config-configuration-file-has-permissions-set-to-600-or-more-restrictive-automated",children:"4.1.9 Ensure that the kubelet --config configuration file has permissions set to 600 or more restrictive (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," Not Applicable"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Rationale:"})}),"\n",(0,t.jsx)(r.p,{children:"The kubelet is embedded in the k3s process. There is no kubelet config file, all configuration is passed in as arguments at runtime."}),"\n",(0,t.jsxs)(r.h3,{id:"4110-ensure-that-the-kubelet---config-configuration-file-ownership-is-set-to-root-automated",children:["4.1.10 Ensure that the kubelet --config configuration file ownership is set to root",":root"," (Automated)"]}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," Not Applicable"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Rationale:"})}),"\n",(0,t.jsx)(r.p,{children:"The kubelet is embedded in the k3s process. There is no kubelet config file, all configuration is passed in as arguments at runtime."}),"\n",(0,t.jsx)(r.h2,{id:"42-kubelet",children:"4.2 Kubelet"}),"\n",(0,t.jsx)(r.h3,{id:"421-ensure-that-the---anonymous-auth-argument-is-set-to-false-automated",children:"4.2.1 Ensure that the --anonymous-auth argument is set to false (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:'/bin/sh -c \'if test $(journalctl -D /var/log/journal -u k3s | grep "Running kube-apiserver" | wc -l) -gt 0; then journalctl -D /var/log/journal -u k3s | grep "Running kube-apiserver" | tail -n1 | grep "anonymous-auth" | grep -v grep; else echo "--anonymous-auth=false"; fi\' \n'})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," '--anonymous-auth' is equal to 'false'"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:'Aug 09 19:06:17 server-0 k3s[2357]: time="2024-08-09T19:06:17Z" level=info msg="Running kube-apiserver --admission-control-config-file=/var/lib/rancher/k3s/server/psa.yaml --advertise-address=10.10.10.100 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --encryption-provider-config-automatic-reload=true --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsx)(r.p,{children:"By default, K3s sets the --anonymous-auth to false. If you have set this to a different value, you\nshould set it back to false. If using the K3s config file /etc/rancher/k3s/config.yaml, remove any lines similar to below."}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{children:'kubelet-arg:\n - "anonymous-auth=true"\n'})}),(0,t.jsx)(r.p,{children:'If using the command line, edit the K3s service file and remove the below argument.\n--kubelet-arg="anonymous-auth=true"\nBased on your system, restart the k3s service. For example,\nsystemctl daemon-reload\nsystemctl restart k3s.service'})]}),"\n",(0,t.jsx)(r.h3,{id:"422-ensure-that-the---authorization-mode-argument-is-not-set-to-alwaysallow-automated",children:"4.2.2 Ensure that the --authorization-mode argument is not set to AlwaysAllow (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:'/bin/sh -c \'if test $(journalctl -D /var/log/journal -u k3s | grep "Running kube-apiserver" | wc -l) -gt 0; then journalctl -D /var/log/journal -u k3s | grep "Running kube-apiserver" | tail -n1 | grep "authorization-mode"; else echo "--authorization-mode=Webhook"; fi\' \n'})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," '--authorization-mode' does not have 'AlwaysAllow'"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:'Aug 09 19:06:17 server-0 k3s[2357]: time="2024-08-09T19:06:17Z" level=info msg="Running kube-apiserver --admission-control-config-file=/var/lib/rancher/k3s/server/psa.yaml --advertise-address=10.10.10.100 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --encryption-provider-config-automatic-reload=true --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsx)(r.p,{children:"By default, K3s does not set the --authorization-mode to AlwaysAllow.\nIf using the K3s config file /etc/rancher/k3s/config.yaml, remove any lines similar to below."}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{children:'kubelet-arg:\n - "authorization-mode=AlwaysAllow"\n'})}),(0,t.jsx)(r.p,{children:'If using the command line, edit the K3s service file and remove the below argument.\n--kubelet-arg="authorization-mode=AlwaysAllow"\nBased on your system, restart the k3s service. For example,\nsystemctl daemon-reload\nsystemctl restart k3s.service'})]}),"\n",(0,t.jsx)(r.h3,{id:"423-ensure-that-the---client-ca-file-argument-is-set-as-appropriate-automated",children:"4.2.3 Ensure that the --client-ca-file argument is set as appropriate (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:'/bin/sh -c \'if test $(journalctl -D /var/log/journal -u k3s | grep "Running kube-apiserver" | wc -l) -gt 0; then journalctl -D /var/log/journal -u k3s | grep "Running kube-apiserver" | tail -n1 | grep "client-ca-file"; else echo "--client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt"; fi\' \n'})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," '--client-ca-file' is present"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:'Aug 09 19:06:17 server-0 k3s[2357]: time="2024-08-09T19:06:17Z" level=info msg="Running kube-apiserver --admission-control-config-file=/var/lib/rancher/k3s/server/psa.yaml --advertise-address=10.10.10.100 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --encryption-provider-config-automatic-reload=true --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsx)(r.p,{children:"By default, K3s automatically provides the client ca certificate for the Kubelet.\nIt is generated and located at /var/lib/rancher/k3s/agent/client-ca.crt"})]}),"\n",(0,t.jsx)(r.h3,{id:"424-verify-that-the---read-only-port-argument-is-set-to-0-automated",children:"4.2.4 Verify that the --read-only-port argument is set to 0 (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s -u k3s-agent | grep 'Running kubelet' | tail -n1\n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," '--read-only-port' is equal to '0' OR '--read-only-port' is not present"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:'Aug 09 19:06:19 server-0 k3s[2357]: time="2024-08-09T19:06:19Z" level=info msg="Running kubelet --address=0.0.0.0 --allowed-unsafe-sysctls=net.ipv4.ip_forward,net.ipv6.conf.all.forwarding --anonymous-auth=false --authentication-token-webhook=true --authorization-mode=Webhook --cgroup-driver=systemd --client-ca-file=/var/lib/rancher/k3s/agent/client-ca.crt --cloud-provider=external --cluster-dns=10.43.0.10 --cluster-domain=cluster.local --container-runtime-endpoint=unix:///run/k3s/containerd/containerd.sock --containerd=/run/k3s/containerd/containerd.sock --event-qps=0 --eviction-hard=imagefs.available<5%,nodefs.available<5% --eviction-minimum-reclaim=imagefs.available=10%,nodefs.available=10% --fail-swap-on=false --feature-gates=CloudDualStackNodeIPs=true --healthz-bind-address=127.0.0.1 --hostname-override=server-0 --kubeconfig=/var/lib/rancher/k3s/agent/kubelet.kubeconfig --make-iptables-util-chains=true --node-ip=10.10.10.100 --node-labels= --pod-infra-container-image=rancher/mirrored-pause:3.6 --pod-manifest-path=/var/lib/rancher/k3s/agent/pod-manifests --protect-kernel-defaults=true --read-only-port=0 --resolv-conf=/run/systemd/resolve/resolv.conf --serialize-image-pulls=false --streaming-connection-idle-timeout=5m --tls-cert-file=/var/lib/rancher/k3s/agent/serving-kubelet.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/agent/serving-kubelet.key"\n'})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsx)(r.p,{children:"By default, K3s sets the --read-only-port to 0. If you have set this to a different value, you\nshould set it back to 0. If using the K3s config file /etc/rancher/k3s/config.yaml, remove any lines similar to below."}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{children:'kubelet-arg:\n - "read-only-port=XXXX"\n'})}),(0,t.jsx)(r.p,{children:'If using the command line, edit the K3s service file and remove the below argument.\n--kubelet-arg="read-only-port=XXXX"\nBased on your system, restart the k3s service. For example,\nsystemctl daemon-reload\nsystemctl restart k3s.service'})]}),"\n",(0,t.jsx)(r.h3,{id:"425-ensure-that-the---streaming-connection-idle-timeout-argument-is-not-set-to-0-manual",children:"4.2.5 Ensure that the --streaming-connection-idle-timeout argument is not set to 0 (Manual)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s -u k3s-agent | grep 'Running kubelet' | tail -n1\n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," '--streaming-connection-idle-timeout' is not equal to '0' OR '--streaming-connection-idle-timeout' is not present"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:'Aug 09 19:06:19 server-0 k3s[2357]: time="2024-08-09T19:06:19Z" level=info msg="Running kubelet --address=0.0.0.0 --allowed-unsafe-sysctls=net.ipv4.ip_forward,net.ipv6.conf.all.forwarding --anonymous-auth=false --authentication-token-webhook=true --authorization-mode=Webhook --cgroup-driver=systemd --client-ca-file=/var/lib/rancher/k3s/agent/client-ca.crt --cloud-provider=external --cluster-dns=10.43.0.10 --cluster-domain=cluster.local --container-runtime-endpoint=unix:///run/k3s/containerd/containerd.sock --containerd=/run/k3s/containerd/containerd.sock --event-qps=0 --eviction-hard=imagefs.available<5%,nodefs.available<5% --eviction-minimum-reclaim=imagefs.available=10%,nodefs.available=10% --fail-swap-on=false --feature-gates=CloudDualStackNodeIPs=true --healthz-bind-address=127.0.0.1 --hostname-override=server-0 --kubeconfig=/var/lib/rancher/k3s/agent/kubelet.kubeconfig --make-iptables-util-chains=true --node-ip=10.10.10.100 --node-labels= --pod-infra-container-image=rancher/mirrored-pause:3.6 --pod-manifest-path=/var/lib/rancher/k3s/agent/pod-manifests --protect-kernel-defaults=true --read-only-port=0 --resolv-conf=/run/systemd/resolve/resolv.conf --serialize-image-pulls=false --streaming-connection-idle-timeout=5m --tls-cert-file=/var/lib/rancher/k3s/agent/serving-kubelet.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/agent/serving-kubelet.key"\n'})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsx)(r.p,{children:"If using the K3s config file /etc/rancher/k3s/config.yaml, set the following parameter to an appropriate value."}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{children:'kubelet-arg:\n - "streaming-connection-idle-timeout=5m"\n'})}),(0,t.jsx)(r.p,{children:'If using the command line, run K3s with --kubelet-arg="streaming-connection-idle-timeout=5m".\nBased on your system, restart the k3s service. For example,\nsystemctl restart k3s.service'})]}),"\n",(0,t.jsx)(r.h3,{id:"426-ensure-that-the---make-iptables-util-chains-argument-is-set-to-true-automated",children:"4.2.6 Ensure that the --make-iptables-util-chains argument is set to true (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s -u k3s-agent | grep 'Running kubelet' | tail -n1\n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," '--make-iptables-util-chains' is equal to 'true' OR '--make-iptables-util-chains' is not present"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:'Aug 09 19:06:19 server-0 k3s[2357]: time="2024-08-09T19:06:19Z" level=info msg="Running kubelet --address=0.0.0.0 --allowed-unsafe-sysctls=net.ipv4.ip_forward,net.ipv6.conf.all.forwarding --anonymous-auth=false --authentication-token-webhook=true --authorization-mode=Webhook --cgroup-driver=systemd --client-ca-file=/var/lib/rancher/k3s/agent/client-ca.crt --cloud-provider=external --cluster-dns=10.43.0.10 --cluster-domain=cluster.local --container-runtime-endpoint=unix:///run/k3s/containerd/containerd.sock --containerd=/run/k3s/containerd/containerd.sock --event-qps=0 --eviction-hard=imagefs.available<5%,nodefs.available<5% --eviction-minimum-reclaim=imagefs.available=10%,nodefs.available=10% --fail-swap-on=false --feature-gates=CloudDualStackNodeIPs=true --healthz-bind-address=127.0.0.1 --hostname-override=server-0 --kubeconfig=/var/lib/rancher/k3s/agent/kubelet.kubeconfig --make-iptables-util-chains=true --node-ip=10.10.10.100 --node-labels= --pod-infra-container-image=rancher/mirrored-pause:3.6 --pod-manifest-path=/var/lib/rancher/k3s/agent/pod-manifests --protect-kernel-defaults=true --read-only-port=0 --resolv-conf=/run/systemd/resolve/resolv.conf --serialize-image-pulls=false --streaming-connection-idle-timeout=5m --tls-cert-file=/var/lib/rancher/k3s/agent/serving-kubelet.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/agent/serving-kubelet.key"\n'})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsx)(r.p,{children:"If using the K3s config file /etc/rancher/k3s/config.yaml, set the following parameter."}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{children:'kubelet-arg:\n - "make-iptables-util-chains=true"\n'})}),(0,t.jsx)(r.p,{children:'If using the command line, run K3s with --kubelet-arg="make-iptables-util-chains=true".\nBased on your system, restart the k3s service. For example,\nsystemctl restart k3s.service'})]}),"\n",(0,t.jsx)(r.h3,{id:"427-ensure-that-the---hostname-override-argument-is-not-set-automated",children:"4.2.7 Ensure that the --hostname-override argument is not set (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," Not Applicable"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Rationale:"})}),"\n",(0,t.jsx)(r.p,{children:"By default, K3s does set the --hostname-override argument. Per CIS guidelines, this is to comply\nwith cloud providers that require this flag to ensure that hostname matches node names."}),"\n",(0,t.jsx)(r.h3,{id:"428-ensure-that-the-eventrecordqps-argument-is-set-to-a-level-which-ensures-appropriate-event-capture-manual",children:"4.2.8 Ensure that the eventRecordQPS argument is set to a level which ensures appropriate event capture (Manual)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s -u k3s-agent | grep 'Running kubelet' | tail -n1\n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," '--event-qps' is greater or equal to 0 OR '--event-qps' is not present"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:'Aug 09 19:06:19 server-0 k3s[2357]: time="2024-08-09T19:06:19Z" level=info msg="Running kubelet --address=0.0.0.0 --allowed-unsafe-sysctls=net.ipv4.ip_forward,net.ipv6.conf.all.forwarding --anonymous-auth=false --authentication-token-webhook=true --authorization-mode=Webhook --cgroup-driver=systemd --client-ca-file=/var/lib/rancher/k3s/agent/client-ca.crt --cloud-provider=external --cluster-dns=10.43.0.10 --cluster-domain=cluster.local --container-runtime-endpoint=unix:///run/k3s/containerd/containerd.sock --containerd=/run/k3s/containerd/containerd.sock --event-qps=0 --eviction-hard=imagefs.available<5%,nodefs.available<5% --eviction-minimum-reclaim=imagefs.available=10%,nodefs.available=10% --fail-swap-on=false --feature-gates=CloudDualStackNodeIPs=true --healthz-bind-address=127.0.0.1 --hostname-override=server-0 --kubeconfig=/var/lib/rancher/k3s/agent/kubelet.kubeconfig --make-iptables-util-chains=true --node-ip=10.10.10.100 --node-labels= --pod-infra-container-image=rancher/mirrored-pause:3.6 --pod-manifest-path=/var/lib/rancher/k3s/agent/pod-manifests --protect-kernel-defaults=true --read-only-port=0 --resolv-conf=/run/systemd/resolve/resolv.conf --serialize-image-pulls=false --streaming-connection-idle-timeout=5m --tls-cert-file=/var/lib/rancher/k3s/agent/serving-kubelet.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/agent/serving-kubelet.key"\n'})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsx)(r.p,{children:"By default, K3s sets the event-qps to 0. Should you wish to change this,\nIf using the K3s config file /etc/rancher/k3s/config.yaml, set the following parameter to an appropriate value."}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{children:'kubelet-arg:\n - "event-qps="\n'})}),(0,t.jsx)(r.p,{children:'If using the command line, run K3s with --kubelet-arg="event-qps=".\nBased on your system, restart the k3s service. For example,\nsystemctl restart k3s.service'})]}),"\n",(0,t.jsx)(r.h3,{id:"429-ensure-that-the---tls-cert-file-and---tls-private-key-file-arguments-are-set-as-appropriate-automated",children:"4.2.9 Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s -u k3s-agent | grep 'Running kubelet' | tail -n1\n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," '--tls-cert-file' is present AND '--tls-private-key-file' is present"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:'Aug 09 19:06:19 server-0 k3s[2357]: time="2024-08-09T19:06:19Z" level=info msg="Running kubelet --address=0.0.0.0 --allowed-unsafe-sysctls=net.ipv4.ip_forward,net.ipv6.conf.all.forwarding --anonymous-auth=false --authentication-token-webhook=true --authorization-mode=Webhook --cgroup-driver=systemd --client-ca-file=/var/lib/rancher/k3s/agent/client-ca.crt --cloud-provider=external --cluster-dns=10.43.0.10 --cluster-domain=cluster.local --container-runtime-endpoint=unix:///run/k3s/containerd/containerd.sock --containerd=/run/k3s/containerd/containerd.sock --event-qps=0 --eviction-hard=imagefs.available<5%,nodefs.available<5% --eviction-minimum-reclaim=imagefs.available=10%,nodefs.available=10% --fail-swap-on=false --feature-gates=CloudDualStackNodeIPs=true --healthz-bind-address=127.0.0.1 --hostname-override=server-0 --kubeconfig=/var/lib/rancher/k3s/agent/kubelet.kubeconfig --make-iptables-util-chains=true --node-ip=10.10.10.100 --node-labels= --pod-infra-container-image=rancher/mirrored-pause:3.6 --pod-manifest-path=/var/lib/rancher/k3s/agent/pod-manifests --protect-kernel-defaults=true --read-only-port=0 --resolv-conf=/run/systemd/resolve/resolv.conf --serialize-image-pulls=false --streaming-connection-idle-timeout=5m --tls-cert-file=/var/lib/rancher/k3s/agent/serving-kubelet.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/agent/serving-kubelet.key"\n'})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsx)(r.p,{children:"By default, K3s automatically provides the TLS certificate and private key for the Kubelet.\nThey are generated and located at /var/lib/rancher/k3s/agent/serving-kubelet.crt and /var/lib/rancher/k3s/agent/serving-kubelet.key\nIf for some reason you need to provide your own certificate and key, you can set the\nbelow parameters in the K3s config file /etc/rancher/k3s/config.yaml."}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{children:'kubelet-arg:\n - "tls-cert-file="\n - "tls-private-key-file="\n'})})]}),"\n",(0,t.jsx)(r.h3,{id:"4210-ensure-that-the---rotate-certificates-argument-is-not-set-to-false-automated",children:"4.2.10 Ensure that the --rotate-certificates argument is not set to false (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s -u k3s-agent | grep 'Running kubelet' | tail -n1\n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," '.rotateCertificates' is present OR '.rotateCertificates' is not present"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:"apiVersion: v1\nclusters:\n- cluster:\n server: https://127.0.0.1:6443\n certificate-authority: /var/lib/rancher/k3s/agent/server-ca.crt\n name: local\ncontexts:\n- context:\n cluster: local\n namespace: default\n user: user\n name: Default\ncurrent-context: Default\nkind: Config\npreferences: {}\nusers:\n- name: user\n user:\n client-certificate: /var/lib/rancher/k3s/agent/client-kubelet.crt\n client-key: /var/lib/rancher/k3s/agent/client-kubelet.key\n"})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsxs)(r.p,{children:["By default, K3s does not set the --rotate-certificates argument. If you have set this flag with a value of ",(0,t.jsx)(r.code,{children:"false"}),", you should either set it to ",(0,t.jsx)(r.code,{children:"true"}),' or completely remove the flag.\nIf using the K3s config file /etc/rancher/k3s/config.yaml, remove any rotate-certificates parameter.\nIf using the command line, remove the K3s flag --kubelet-arg="rotate-certificates".\nBased on your system, restart the k3s service. For example,\nsystemctl restart k3s.service']})]}),"\n",(0,t.jsx)(r.h3,{id:"4211-verify-that-the-rotatekubeletservercertificate-argument-is-set-to-true-automated",children:"4.2.11 Verify that the RotateKubeletServerCertificate argument is set to true (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s -u k3s-agent | grep 'Running kubelet' | tail -n1\n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," '.featureGates.RotateKubeletServerCertificate' is present OR '.featureGates.RotateKubeletServerCertificate' is not present"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:"apiVersion: v1\nclusters:\n- cluster:\n server: https://127.0.0.1:6443\n certificate-authority: /var/lib/rancher/k3s/agent/server-ca.crt\n name: local\ncontexts:\n- context:\n cluster: local\n namespace: default\n user: user\n name: Default\ncurrent-context: Default\nkind: Config\npreferences: {}\nusers:\n- name: user\n user:\n client-certificate: /var/lib/rancher/k3s/agent/client-kubelet.crt\n client-key: /var/lib/rancher/k3s/agent/client-kubelet.key\n"})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsx)(r.p,{children:'By default, K3s does not set the RotateKubeletServerCertificate feature gate.\nIf you have enabled this feature gate, you should remove it.\nIf using the K3s config file /etc/rancher/k3s/config.yaml, remove any feature-gate=RotateKubeletServerCertificate parameter.\nIf using the command line, remove the K3s flag --kubelet-arg="feature-gate=RotateKubeletServerCertificate".\nBased on your system, restart the k3s service. For example,\nsystemctl restart k3s.service'})]}),"\n",(0,t.jsx)(r.h3,{id:"4212-ensure-that-the-kubelet-only-makes-use-of-strong-cryptographic-ciphers-manual",children:"4.2.12 Ensure that the Kubelet only makes use of Strong Cryptographic Ciphers (Manual)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s -u k3s-agent | grep 'Running kubelet' | tail -n1\n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," '--tls-cipher-suites' contains valid elements from 'TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256'"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:'Aug 09 19:06:19 server-0 k3s[2357]: time="2024-08-09T19:06:19Z" level=info msg="Running kubelet --address=0.0.0.0 --allowed-unsafe-sysctls=net.ipv4.ip_forward,net.ipv6.conf.all.forwarding --anonymous-auth=false --authentication-token-webhook=true --authorization-mode=Webhook --cgroup-driver=systemd --client-ca-file=/var/lib/rancher/k3s/agent/client-ca.crt --cloud-provider=external --cluster-dns=10.43.0.10 --cluster-domain=cluster.local --container-runtime-endpoint=unix:///run/k3s/containerd/containerd.sock --containerd=/run/k3s/containerd/containerd.sock --event-qps=0 --eviction-hard=imagefs.available<5%,nodefs.available<5% --eviction-minimum-reclaim=imagefs.available=10%,nodefs.available=10% --fail-swap-on=false --feature-gates=CloudDualStackNodeIPs=true --healthz-bind-address=127.0.0.1 --hostname-override=server-0 --kubeconfig=/var/lib/rancher/k3s/agent/kubelet.kubeconfig --make-iptables-util-chains=true --node-ip=10.10.10.100 --node-labels= --pod-infra-container-image=rancher/mirrored-pause:3.6 --pod-manifest-path=/var/lib/rancher/k3s/agent/pod-manifests --protect-kernel-defaults=true --read-only-port=0 --resolv-conf=/run/systemd/resolve/resolv.conf --serialize-image-pulls=false --streaming-connection-idle-timeout=5m --tls-cert-file=/var/lib/rancher/k3s/agent/serving-kubelet.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/agent/serving-kubelet.key"\n'})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsxs)(r.p,{children:["If using a K3s config file /etc/rancher/k3s/config.yaml, edit the file to set ",(0,t.jsx)(r.code,{children:"TLSCipherSuites"})," to"]}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{children:'kubelet-arg:\n - "tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305"\n'})}),(0,t.jsx)(r.p,{children:'or to a subset of these values.\nIf using the command line, add the K3s flag --kubelet-arg="tls-cipher-suites="\nBased on your system, restart the k3s service. For example,\nsystemctl restart k3s.service'})]}),"\n",(0,t.jsx)(r.h3,{id:"4213-ensure-that-a-limit-is-set-on-pod-pids-manual",children:"4.2.13 Ensure that a limit is set on pod PIDs (Manual)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Remediation:"}),"\nDecide on an appropriate level for this parameter and set it,\nIf using a K3s config file /etc/rancher/k3s/config.yaml, edit the file to set ",(0,t.jsx)(r.code,{children:"podPidsLimit"})," to"]}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{children:'kubelet-arg:\n - "pod-max-pids="\n'})}),"\n",(0,t.jsx)(r.h2,{id:"51-rbac-and-service-accounts",children:"5.1 RBAC and Service Accounts"}),"\n",(0,t.jsx)(r.h3,{id:"511-ensure-that-the-cluster-admin-role-is-only-used-where-required-manual",children:"5.1.1 Ensure that the cluster-admin role is only used where required (Manual)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Remediation:"}),"\nIdentify all clusterrolebindings to the cluster-admin role. Check if they are used and\nif they need this role or if they could use a role with fewer privileges.\nWhere possible, first bind users to a lower privileged role and then remove the\nclusterrolebinding to the cluster-admin role :\nkubectl delete clusterrolebinding [name]"]}),"\n",(0,t.jsx)(r.h3,{id:"512-minimize-access-to-secrets-manual",children:"5.1.2 Minimize access to secrets (Manual)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Remediation:"}),"\nWhere possible, remove get, list and watch access to Secret objects in the cluster."]}),"\n",(0,t.jsx)(r.h3,{id:"513-minimize-wildcard-use-in-roles-and-clusterroles-manual",children:"5.1.3 Minimize wildcard use in Roles and ClusterRoles (Manual)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Remediation:"}),"\nWhere possible replace any use of wildcards in clusterroles and roles with specific\nobjects or actions."]}),"\n",(0,t.jsx)(r.h3,{id:"514-minimize-access-to-create-pods-manual",children:"5.1.4 Minimize access to create pods (Manual)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Remediation:"}),"\nWhere possible, remove create access to pod objects in the cluster."]}),"\n",(0,t.jsx)(r.h3,{id:"515-ensure-that-default-service-accounts-are-not-actively-used-manual",children:"5.1.5 Ensure that default service accounts are not actively used. (Manual)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Remediation:"}),"\nCreate explicit service accounts wherever a Kubernetes workload requires specific access\nto the Kubernetes API server.\nModify the configuration of each default service account to include this value\nautomountServiceAccountToken: false"]}),"\n",(0,t.jsx)(r.h3,{id:"516-ensure-that-service-account-tokens-are-only-mounted-where-necessary-manual",children:"5.1.6 Ensure that Service Account Tokens are only mounted where necessary (Manual)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Remediation:"}),"\nModify the definition of pods and service accounts which do not need to mount service\naccount tokens to disable it."]}),"\n",(0,t.jsxs)(r.h3,{id:"517-avoid-use-of-system-group-manual",children:["5.1.7 Avoid use of system",":masters"," group (Manual)"]}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Remediation:"}),"\nRemove the system",":masters"," group from all users in the cluster."]}),"\n",(0,t.jsx)(r.h3,{id:"518-limit-use-of-the-bind-impersonate-and-escalate-permissions-in-the-kubernetes-cluster-manual",children:"5.1.8 Limit use of the Bind, Impersonate and Escalate permissions in the Kubernetes cluster (Manual)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Remediation:"}),"\nWhere possible, remove the impersonate, bind and escalate rights from subjects."]}),"\n",(0,t.jsx)(r.h3,{id:"519-minimize-access-to-create-persistent-volumes-manual",children:"5.1.9 Minimize access to create persistent volumes (Manual)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Remediation:"}),"\nWhere possible, remove create access to PersistentVolume objects in the cluster."]}),"\n",(0,t.jsx)(r.h3,{id:"5110-minimize-access-to-the-proxy-sub-resource-of-nodes-manual",children:"5.1.10 Minimize access to the proxy sub-resource of nodes (Manual)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Remediation:"}),"\nWhere possible, remove access to the proxy sub-resource of node objects."]}),"\n",(0,t.jsx)(r.h3,{id:"5111-minimize-access-to-the-approval-sub-resource-of-certificatesigningrequests-objects-manual",children:"5.1.11 Minimize access to the approval sub-resource of certificatesigningrequests objects (Manual)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Remediation:"}),"\nWhere possible, remove access to the approval sub-resource of certificatesigningrequest objects."]}),"\n",(0,t.jsx)(r.h3,{id:"5112-minimize-access-to-webhook-configuration-objects-manual",children:"5.1.12 Minimize access to webhook configuration objects (Manual)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Remediation:"}),"\nWhere possible, remove access to the validatingwebhookconfigurations or mutatingwebhookconfigurations objects"]}),"\n",(0,t.jsx)(r.h3,{id:"5113-minimize-access-to-the-service-account-token-creation-manual",children:"5.1.13 Minimize access to the service account token creation (Manual)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Remediation:"}),"\nWhere possible, remove access to the token sub-resource of serviceaccount objects."]}),"\n",(0,t.jsx)(r.h2,{id:"52-pod-security-standards",children:"5.2 Pod Security Standards"}),"\n",(0,t.jsx)(r.h3,{id:"521-ensure-that-the-cluster-has-at-least-one-active-policy-control-mechanism-in-place-manual",children:"5.2.1 Ensure that the cluster has at least one active policy control mechanism in place (Manual)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Remediation:"}),"\nEnsure that either Pod Security Admission or an external policy control system is in place\nfor every namespace which contains user workloads."]}),"\n",(0,t.jsx)(r.h3,{id:"522-minimize-the-admission-of-privileged-containers-manual",children:"5.2.2 Minimize the admission of privileged containers (Manual)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Remediation:"}),"\nAdd policies to each namespace in the cluster which has user workloads to restrict the\nadmission of privileged containers."]}),"\n",(0,t.jsx)(r.h3,{id:"523-minimize-the-admission-of-containers-wishing-to-share-the-host-process-id-namespace-automated",children:"5.2.3 Minimize the admission of containers wishing to share the host process ID namespace (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Remediation:"}),"\nAdd policies to each namespace in the cluster which has user workloads to restrict the\nadmission of ",(0,t.jsx)(r.code,{children:"hostPID"})," containers."]}),"\n",(0,t.jsx)(r.h3,{id:"524-minimize-the-admission-of-containers-wishing-to-share-the-host-ipc-namespace-automated",children:"5.2.4 Minimize the admission of containers wishing to share the host IPC namespace (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Remediation:"}),"\nAdd policies to each namespace in the cluster which has user workloads to restrict the\nadmission of ",(0,t.jsx)(r.code,{children:"hostIPC"})," containers."]}),"\n",(0,t.jsx)(r.h3,{id:"525-minimize-the-admission-of-containers-wishing-to-share-the-host-network-namespace-automated",children:"5.2.5 Minimize the admission of containers wishing to share the host network namespace (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Remediation:"}),"\nAdd policies to each namespace in the cluster which has user workloads to restrict the\nadmission of ",(0,t.jsx)(r.code,{children:"hostNetwork"})," containers."]}),"\n",(0,t.jsx)(r.h3,{id:"526-minimize-the-admission-of-containers-with-allowprivilegeescalation-automated",children:"5.2.6 Minimize the admission of containers with allowPrivilegeEscalation (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Remediation:"}),"\nAdd policies to each namespace in the cluster which has user workloads to restrict the\nadmission of containers with ",(0,t.jsx)(r.code,{children:".spec.allowPrivilegeEscalation"})," set to ",(0,t.jsx)(r.code,{children:"true"}),"."]}),"\n",(0,t.jsx)(r.h3,{id:"527-minimize-the-admission-of-root-containers-automated",children:"5.2.7 Minimize the admission of root containers (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Remediation:"}),"\nCreate a policy for each namespace in the cluster, ensuring that either ",(0,t.jsx)(r.code,{children:"MustRunAsNonRoot"}),"\nor ",(0,t.jsx)(r.code,{children:"MustRunAs"})," with the range of UIDs not including 0, is set."]}),"\n",(0,t.jsx)(r.h3,{id:"528-minimize-the-admission-of-containers-with-the-net_raw-capability-automated",children:"5.2.8 Minimize the admission of containers with the NET_RAW capability (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Remediation:"}),"\nAdd policies to each namespace in the cluster which has user workloads to restrict the\nadmission of containers with the ",(0,t.jsx)(r.code,{children:"NET_RAW"})," capability."]}),"\n",(0,t.jsx)(r.h3,{id:"529-minimize-the-admission-of-containers-with-added-capabilities-automated",children:"5.2.9 Minimize the admission of containers with added capabilities (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Remediation:"}),"\nEnsure that ",(0,t.jsx)(r.code,{children:"allowedCapabilities"})," is not present in policies for the cluster unless\nit is set to an empty array."]}),"\n",(0,t.jsx)(r.h3,{id:"5210-minimize-the-admission-of-containers-with-capabilities-assigned-manual",children:"5.2.10 Minimize the admission of containers with capabilities assigned (Manual)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Remediation:"}),"\nReview the use of capabilities in applications running on your cluster. Where a namespace\ncontains applications which do not require any Linux capabities to operate consider adding\na PSP which forbids the admission of containers which do not drop all capabilities."]}),"\n",(0,t.jsx)(r.h3,{id:"5211-minimize-the-admission-of-windows-hostprocess-containers-manual",children:"5.2.11 Minimize the admission of Windows HostProcess containers (Manual)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Remediation:"}),"\nAdd policies to each namespace in the cluster which has user workloads to restrict the\nadmission of containers that have ",(0,t.jsx)(r.code,{children:".securityContext.windowsOptions.hostProcess"})," set to ",(0,t.jsx)(r.code,{children:"true"}),"."]}),"\n",(0,t.jsx)(r.h3,{id:"5212-minimize-the-admission-of-hostpath-volumes-manual",children:"5.2.12 Minimize the admission of HostPath volumes (Manual)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Remediation:"}),"\nAdd policies to each namespace in the cluster which has user workloads to restrict the\nadmission of containers with ",(0,t.jsx)(r.code,{children:"hostPath"})," volumes."]}),"\n",(0,t.jsx)(r.h3,{id:"5213-minimize-the-admission-of-containers-which-use-hostports-manual",children:"5.2.13 Minimize the admission of containers which use HostPorts (Manual)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Remediation:"}),"\nAdd policies to each namespace in the cluster which has user workloads to restrict the\nadmission of containers which use ",(0,t.jsx)(r.code,{children:"hostPort"})," sections."]}),"\n",(0,t.jsx)(r.h2,{id:"53-network-policies-and-cni",children:"5.3 Network Policies and CNI"}),"\n",(0,t.jsx)(r.h3,{id:"531-ensure-that-the-cni-in-use-supports-networkpolicies-manual",children:"5.3.1 Ensure that the CNI in use supports NetworkPolicies (Manual)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Remediation:"}),"\nIf the CNI plugin in use does not support network policies, consideration should be given to\nmaking use of a different plugin, or finding an alternate mechanism for restricting traffic\nin the Kubernetes cluster."]}),"\n",(0,t.jsx)(r.h3,{id:"532-ensure-that-all-namespaces-have-networkpolicies-defined-manual",children:"5.3.2 Ensure that all Namespaces have NetworkPolicies defined (Manual)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Remediation:"}),"\nFollow the documentation and create NetworkPolicy objects as you need them."]}),"\n",(0,t.jsx)(r.h2,{id:"54-secrets-management",children:"5.4 Secrets Management"}),"\n",(0,t.jsx)(r.h3,{id:"541-prefer-using-secrets-as-files-over-secrets-as-environment-variables-manual",children:"5.4.1 Prefer using Secrets as files over Secrets as environment variables (Manual)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Remediation:"}),"\nIf possible, rewrite application code to read Secrets from mounted secret files, rather than\nfrom environment variables."]}),"\n",(0,t.jsx)(r.h3,{id:"542-consider-external-secret-storage-manual",children:"5.4.2 Consider external secret storage (Manual)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Remediation:"}),"\nRefer to the Secrets management options offered by your cloud provider or a third-party\nsecrets management solution."]}),"\n",(0,t.jsx)(r.h2,{id:"55-extensible-admission-control",children:"5.5 Extensible Admission Control"}),"\n",(0,t.jsx)(r.h3,{id:"551-configure-image-provenance-using-imagepolicywebhook-admission-controller-manual",children:"5.5.1 Configure Image Provenance using ImagePolicyWebhook admission controller (Manual)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Remediation:"}),"\nFollow the Kubernetes documentation and setup image provenance."]}),"\n",(0,t.jsx)(r.h2,{id:"57-general-policies",children:"5.7 General Policies"}),"\n",(0,t.jsx)(r.h3,{id:"571-create-administrative-boundaries-between-resources-using-namespaces-manual",children:"5.7.1 Create administrative boundaries between resources using namespaces (Manual)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Remediation:"}),"\nFollow the documentation and create namespaces for objects in your deployment as you need\nthem."]}),"\n",(0,t.jsx)(r.h3,{id:"572-ensure-that-the-seccomp-profile-is-set-to-dockerdefault-in-your-pod-definitions-manual",children:"5.7.2 Ensure that the seccomp profile is set to docker/default in your Pod definitions (Manual)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Remediation:"}),"\nUse ",(0,t.jsx)(r.code,{children:"securityContext"})," to enable the docker/default seccomp profile in your pod definitions.\nAn example is as below:\nsecurityContext:\nseccompProfile:\ntype: RuntimeDefault"]}),"\n",(0,t.jsx)(r.h3,{id:"573-apply-securitycontext-to-your-pods-and-containers-manual",children:"5.7.3 Apply SecurityContext to your Pods and Containers (Manual)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Remediation:"}),"\nFollow the Kubernetes documentation and apply SecurityContexts to your Pods. For a\nsuggested list of SecurityContexts, you may refer to the CIS Security Benchmark for Docker\nContainers."]}),"\n",(0,t.jsx)(r.h3,{id:"574-the-default-namespace-should-not-be-used-manual",children:"5.7.4 The default namespace should not be used (Manual)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Remediation:"}),"\nEnsure that namespaces are created to allow for appropriate segregation of Kubernetes\nresources and that all new resources are created in a specific namespace."]})]})}function u(e={}){const{wrapper:r}={...(0,n.a)(),...e.components};return r?(0,t.jsx)(r,{...e,children:(0,t.jsx)(d,{...e})}):d(e)}},1151:(e,r,s)=>{s.d(r,{Z:()=>l,a:()=>a});var t=s(7294);const n={},i=t.createContext(n);function a(e){const r=t.useContext(i);return t.useMemo((function(){return"function"==typeof e?e(r):{...r,...e}}),[r,e])}function l(e){let r;return r=e.disableParentContext?"function"==typeof e.components?e.components(n):e.components||n:a(e.components),t.createElement(i.Provider,{value:r},e.children)}}}]); \ No newline at end of file +"use strict";(self.webpackChunkk_3_s_docs=self.webpackChunkk_3_s_docs||[]).push([[2038],{9763:(e,r,s)=>{s.r(r),s.d(r,{assets:()=>c,contentTitle:()=>a,default:()=>u,frontMatter:()=>i,metadata:()=>l,toc:()=>o});var t=s(5893),n=s(1151);const i={title:"CIS 1.8 Self Assessment Guide"},a=void 0,l={id:"security/self-assessment-1.8",title:"CIS 1.8 Self Assessment Guide",description:"Overview",source:"@site/docs/security/self-assessment-1.8.md",sourceDirName:"security",slug:"/security/self-assessment-1.8",permalink:"/security/self-assessment-1.8",draft:!1,unlisted:!1,editUrl:"https://github.com/k3s-io/docs/edit/main/docs/security/self-assessment-1.8.md",tags:[],version:"current",lastUpdatedAt:1723747404e3,frontMatter:{title:"CIS 1.8 Self Assessment Guide"},sidebar:"mySidebar",previous:{title:"CIS Hardening Guide",permalink:"/security/hardening-guide"},next:{title:"CIS 1.7 Self Assessment Guide",permalink:"/security/self-assessment-1.7"}},c={},o=[{value:"Overview",id:"overview",level:2},{value:"Testing controls methodology",id:"testing-controls-methodology",level:3},{value:"1.1 Control Plane Node Configuration Files",id:"11-control-plane-node-configuration-files",level:2},{value:"1.1.1 Ensure that the API server pod specification file permissions are set to 600 or more restrictive (Automated)",id:"111-ensure-that-the-api-server-pod-specification-file-permissions-are-set-to-600-or-more-restrictive-automated",level:3},{value:"1.1.2 Ensure that the API server pod specification file ownership is set to root (Automated)",id:"112-ensure-that-the-api-server-pod-specification-file-ownership-is-set-to-root-automated",level:3},{value:"1.1.3 Ensure that the controller manager pod specification file permissions are set to 600 or more restrictive (Automated)",id:"113-ensure-that-the-controller-manager-pod-specification-file-permissions-are-set-to-600-or-more-restrictive-automated",level:3},{value:"1.1.4 Ensure that the controller manager pod specification file ownership is set to root (Automated)",id:"114-ensure-that-the-controller-manager-pod-specification-file-ownership-is-set-to-root-automated",level:3},{value:"1.1.5 Ensure that the scheduler pod specification file permissions are set to 600 or more restrictive (Automated)",id:"115-ensure-that-the-scheduler-pod-specification-file-permissions-are-set-to-600-or-more-restrictive-automated",level:3},{value:"1.1.6 Ensure that the scheduler pod specification file ownership is set to root (Automated)",id:"116-ensure-that-the-scheduler-pod-specification-file-ownership-is-set-to-root-automated",level:3},{value:"1.1.7 Ensure that the etcd pod specification file permissions are set to 600 or more restrictive (Automated)",id:"117-ensure-that-the-etcd-pod-specification-file-permissions-are-set-to-600-or-more-restrictive-automated",level:3},{value:"1.1.8 Ensure that the etcd pod specification file ownership is set to root (Automated)",id:"118-ensure-that-the-etcd-pod-specification-file-ownership-is-set-to-root-automated",level:3},{value:"1.1.9 Ensure that the Container Network Interface file permissions are set to 600 or more restrictive (Automated)",id:"119-ensure-that-the-container-network-interface-file-permissions-are-set-to-600-or-more-restrictive-automated",level:3},{value:"1.1.10 Ensure that the Container Network Interface file ownership is set to root (Manual)",id:"1110-ensure-that-the-container-network-interface-file-ownership-is-set-to-root-manual",level:3},{value:"1.1.11 Ensure that the etcd data directory permissions are set to 700 or more restrictive (Automated)",id:"1111-ensure-that-the-etcd-data-directory-permissions-are-set-to-700-or-more-restrictive-automated",level:3},{value:"1.1.12 Ensure that the etcd data directory ownership is set to etcd (Automated)",id:"1112-ensure-that-the-etcd-data-directory-ownership-is-set-to-etcd-automated",level:3},{value:"1.1.13 Ensure that the admin.conf file permissions are set to 600 or more restrictive (Automated)",id:"1113-ensure-that-the-adminconf-file-permissions-are-set-to-600-or-more-restrictive-automated",level:3},{value:"1.1.14 Ensure that the admin.conf file ownership is set to root (Automated)",id:"1114-ensure-that-the-adminconf-file-ownership-is-set-to-root-automated",level:3},{value:"1.1.15 Ensure that the scheduler.conf file permissions are set to 600 or more restrictive (Automated)",id:"1115-ensure-that-the-schedulerconf-file-permissions-are-set-to-600-or-more-restrictive-automated",level:3},{value:"1.1.16 Ensure that the scheduler.conf file ownership is set to root (Automated)",id:"1116-ensure-that-the-schedulerconf-file-ownership-is-set-to-root-automated",level:3},{value:"1.1.17 Ensure that the controller-manager.conf file permissions are set to 600 or more restrictive (Automated)",id:"1117-ensure-that-the-controller-managerconf-file-permissions-are-set-to-600-or-more-restrictive-automated",level:3},{value:"1.1.18 Ensure that the controller-manager.conf file ownership is set to root (Automated)",id:"1118-ensure-that-the-controller-managerconf-file-ownership-is-set-to-root-automated",level:3},{value:"1.1.19 Ensure that the Kubernetes PKI directory and file ownership is set to root (Automated)",id:"1119-ensure-that-the-kubernetes-pki-directory-and-file-ownership-is-set-to-root-automated",level:3},{value:"1.1.20 Ensure that the Kubernetes PKI certificate file permissions are set to 600 or more restrictive (Manual)",id:"1120-ensure-that-the-kubernetes-pki-certificate-file-permissions-are-set-to-600-or-more-restrictive-manual",level:3},{value:"1.1.21 Ensure that the Kubernetes PKI key file permissions are set to 600 (Automated)",id:"1121-ensure-that-the-kubernetes-pki-key-file-permissions-are-set-to-600-automated",level:3},{value:"1.2 API Server",id:"12-api-server",level:2},{value:"1.2.1 Ensure that the --anonymous-auth argument is set to false (Automated)",id:"121-ensure-that-the---anonymous-auth-argument-is-set-to-false-automated",level:3},{value:"1.2.2 Ensure that the --token-auth-file parameter is not set (Automated)",id:"122-ensure-that-the---token-auth-file-parameter-is-not-set-automated",level:3},{value:"1.2.3 Ensure that the --DenyServiceExternalIPs is not set (Automated)",id:"123-ensure-that-the---denyserviceexternalips-is-not-set-automated",level:3},{value:"1.2.4 Ensure that the --kubelet-client-certificate and --kubelet-client-key arguments are set as appropriate (Automated)",id:"124-ensure-that-the---kubelet-client-certificate-and---kubelet-client-key-arguments-are-set-as-appropriate-automated",level:3},{value:"1.2.5 Ensure that the --kubelet-certificate-authority argument is set as appropriate (Automated)",id:"125-ensure-that-the---kubelet-certificate-authority-argument-is-set-as-appropriate-automated",level:3},{value:"1.2.6 Ensure that the --authorization-mode argument is not set to AlwaysAllow (Automated)",id:"126-ensure-that-the---authorization-mode-argument-is-not-set-to-alwaysallow-automated",level:3},{value:"1.2.7 Ensure that the --authorization-mode argument includes Node (Automated)",id:"127-ensure-that-the---authorization-mode-argument-includes-node-automated",level:3},{value:"1.2.8 Ensure that the --authorization-mode argument includes RBAC (Automated)",id:"128-ensure-that-the---authorization-mode-argument-includes-rbac-automated",level:3},{value:"1.2.9 Ensure that the admission control plugin EventRateLimit is set (Manual)",id:"129-ensure-that-the-admission-control-plugin-eventratelimit-is-set-manual",level:3},{value:"1.2.10 Ensure that the admission control plugin AlwaysAdmit is not set (Automated)",id:"1210-ensure-that-the-admission-control-plugin-alwaysadmit-is-not-set-automated",level:3},{value:"1.2.11 Ensure that the admission control plugin AlwaysPullImages is set (Manual)",id:"1211-ensure-that-the-admission-control-plugin-alwayspullimages-is-set-manual",level:3},{value:"1.2.12 Ensure that the admission control plugin SecurityContextDeny is set if PodSecurityPolicy is not used (Manual)",id:"1212-ensure-that-the-admission-control-plugin-securitycontextdeny-is-set-if-podsecuritypolicy-is-not-used-manual",level:3},{value:"1.2.13 Ensure that the admission control plugin ServiceAccount is set (Automated)",id:"1213-ensure-that-the-admission-control-plugin-serviceaccount-is-set-automated",level:3},{value:"1.2.14 Ensure that the admission control plugin NamespaceLifecycle is set (Automated)",id:"1214-ensure-that-the-admission-control-plugin-namespacelifecycle-is-set-automated",level:3},{value:"1.2.15 Ensure that the admission control plugin NodeRestriction is set (Automated)",id:"1215-ensure-that-the-admission-control-plugin-noderestriction-is-set-automated",level:3},{value:"1.2.16 Ensure that the --profiling argument is set to false (Automated)",id:"1216-ensure-that-the---profiling-argument-is-set-to-false-automated",level:3},{value:"1.2.17 Ensure that the --audit-log-path argument is set (Manual)",id:"1217-ensure-that-the---audit-log-path-argument-is-set-manual",level:3},{value:"1.2.18 Ensure that the --audit-log-maxage argument is set to 30 or as appropriate (Manual)",id:"1218-ensure-that-the---audit-log-maxage-argument-is-set-to-30-or-as-appropriate-manual",level:3},{value:"1.2.19 Ensure that the --audit-log-maxbackup argument is set to 10 or as appropriate (Manual)",id:"1219-ensure-that-the---audit-log-maxbackup-argument-is-set-to-10-or-as-appropriate-manual",level:3},{value:"1.2.20 Ensure that the --audit-log-maxsize argument is set to 100 or as appropriate (Manual)",id:"1220-ensure-that-the---audit-log-maxsize-argument-is-set-to-100-or-as-appropriate-manual",level:3},{value:"1.2.21 Ensure that the --request-timeout argument is set as appropriate (Manual)",id:"1221-ensure-that-the---request-timeout-argument-is-set-as-appropriate-manual",level:3},{value:"1.2.22 Ensure that the --service-account-lookup argument is set to true (Automated)",id:"1222-ensure-that-the---service-account-lookup-argument-is-set-to-true-automated",level:3},{value:"1.2.23 Ensure that the --service-account-key-file argument is set as appropriate (Automated)",id:"1223-ensure-that-the---service-account-key-file-argument-is-set-as-appropriate-automated",level:3},{value:"1.2.24 Ensure that the --etcd-certfile and --etcd-keyfile arguments are set as appropriate (Automated)",id:"1224-ensure-that-the---etcd-certfile-and---etcd-keyfile-arguments-are-set-as-appropriate-automated",level:3},{value:"1.2.25 Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate (Automated)",id:"1225-ensure-that-the---tls-cert-file-and---tls-private-key-file-arguments-are-set-as-appropriate-automated",level:3},{value:"1.2.26 Ensure that the --client-ca-file argument is set as appropriate (Automated)",id:"1226-ensure-that-the---client-ca-file-argument-is-set-as-appropriate-automated",level:3},{value:"1.2.27 Ensure that the --etcd-cafile argument is set as appropriate (Automated)",id:"1227-ensure-that-the---etcd-cafile-argument-is-set-as-appropriate-automated",level:3},{value:"1.2.28 Ensure that the --encryption-provider-config argument is set as appropriate (Manual)",id:"1228-ensure-that-the---encryption-provider-config-argument-is-set-as-appropriate-manual",level:3},{value:"1.2.29 Ensure that encryption providers are appropriately configured (Manual)",id:"1229-ensure-that-encryption-providers-are-appropriately-configured-manual",level:3},{value:"1.2.30 Ensure that the API Server only makes use of Strong Cryptographic Ciphers (Automated)",id:"1230-ensure-that-the-api-server-only-makes-use-of-strong-cryptographic-ciphers-automated",level:3},{value:"1.3 Controller Manager",id:"13-controller-manager",level:2},{value:"1.3.1 Ensure that the --terminated-pod-gc-threshold argument is set as appropriate (Manual)",id:"131-ensure-that-the---terminated-pod-gc-threshold-argument-is-set-as-appropriate-manual",level:3},{value:"1.3.2 Ensure that the --profiling argument is set to false (Automated)",id:"132-ensure-that-the---profiling-argument-is-set-to-false-automated",level:3},{value:"1.3.3 Ensure that the --use-service-account-credentials argument is set to true (Automated)",id:"133-ensure-that-the---use-service-account-credentials-argument-is-set-to-true-automated",level:3},{value:"1.3.4 Ensure that the --service-account-private-key-file argument is set as appropriate (Automated)",id:"134-ensure-that-the---service-account-private-key-file-argument-is-set-as-appropriate-automated",level:3},{value:"1.3.5 Ensure that the --root-ca-file argument is set as appropriate (Automated)",id:"135-ensure-that-the---root-ca-file-argument-is-set-as-appropriate-automated",level:3},{value:"1.3.6 Ensure that the RotateKubeletServerCertificate argument is set to true (Automated)",id:"136-ensure-that-the-rotatekubeletservercertificate-argument-is-set-to-true-automated",level:3},{value:"1.3.7 Ensure that the --bind-address argument is set to 127.0.0.1 (Automated)",id:"137-ensure-that-the---bind-address-argument-is-set-to-127001-automated",level:3},{value:"1.4 Scheduler",id:"14-scheduler",level:2},{value:"1.4.1 Ensure that the --profiling argument is set to false (Automated)",id:"141-ensure-that-the---profiling-argument-is-set-to-false-automated",level:3},{value:"1.4.2 Ensure that the --bind-address argument is set to 127.0.0.1 (Automated)",id:"142-ensure-that-the---bind-address-argument-is-set-to-127001-automated",level:3},{value:"2 Etcd Node Configuration",id:"2-etcd-node-configuration",level:2},{value:"2.1 Ensure that the --cert-file and --key-file arguments are set as appropriate (Automated)",id:"21-ensure-that-the---cert-file-and---key-file-arguments-are-set-as-appropriate-automated",level:3},{value:"2.2 Ensure that the --client-cert-auth argument is set to true (Automated)",id:"22-ensure-that-the---client-cert-auth-argument-is-set-to-true-automated",level:3},{value:"2.3 Ensure that the --auto-tls argument is not set to true (Automated)",id:"23-ensure-that-the---auto-tls-argument-is-not-set-to-true-automated",level:3},{value:"2.4 Ensure that the --peer-cert-file and --peer-key-file arguments are set as appropriate (Automated)",id:"24-ensure-that-the---peer-cert-file-and---peer-key-file-arguments-are-set-as-appropriate-automated",level:3},{value:"2.5 Ensure that the --peer-client-cert-auth argument is set to true (Automated)",id:"25-ensure-that-the---peer-client-cert-auth-argument-is-set-to-true-automated",level:3},{value:"2.6 Ensure that the --peer-auto-tls argument is not set to true (Automated)",id:"26-ensure-that-the---peer-auto-tls-argument-is-not-set-to-true-automated",level:3},{value:"2.7 Ensure that a unique Certificate Authority is used for etcd (Automated)",id:"27-ensure-that-a-unique-certificate-authority-is-used-for-etcd-automated",level:3},{value:"4.1 Worker Node Configuration Files",id:"41-worker-node-configuration-files",level:2},{value:"4.1.1 Ensure that the kubelet service file permissions are set to 600 or more restrictive (Automated)",id:"411-ensure-that-the-kubelet-service-file-permissions-are-set-to-600-or-more-restrictive-automated",level:3},{value:"4.1.2 Ensure that the kubelet service file ownership is set to root (Automated)",id:"412-ensure-that-the-kubelet-service-file-ownership-is-set-to-root-automated",level:3},{value:"4.1.3 If proxy kubeconfig file exists ensure permissions are set to 600 or more restrictive (Automated)",id:"413-if-proxy-kubeconfig-file-exists-ensure-permissions-are-set-to-600-or-more-restrictive-automated",level:3},{value:"4.1.4 If proxy kubeconfig file exists ensure ownership is set to root (Automated)",id:"414-if-proxy-kubeconfig-file-exists-ensure-ownership-is-set-to-root-automated",level:3},{value:"4.1.5 Ensure that the --kubeconfig kubelet.conf file permissions are set to 600 or more restrictive (Automated)",id:"415-ensure-that-the---kubeconfig-kubeletconf-file-permissions-are-set-to-600-or-more-restrictive-automated",level:3},{value:"4.1.6 Ensure that the --kubeconfig kubelet.conf file ownership is set to root (Automated)",id:"416-ensure-that-the---kubeconfig-kubeletconf-file-ownership-is-set-to-root-automated",level:3},{value:"4.1.7 Ensure that the certificate authorities file permissions are set to 600 or more restrictive (Automated)",id:"417-ensure-that-the-certificate-authorities-file-permissions-are-set-to-600-or-more-restrictive-automated",level:3},{value:"4.1.8 Ensure that the client certificate authorities file ownership is set to root (Automated)",id:"418-ensure-that-the-client-certificate-authorities-file-ownership-is-set-to-root-automated",level:3},{value:"4.1.9 Ensure that the kubelet --config configuration file has permissions set to 600 or more restrictive (Automated)",id:"419-ensure-that-the-kubelet---config-configuration-file-has-permissions-set-to-600-or-more-restrictive-automated",level:3},{value:"4.1.10 Ensure that the kubelet --config configuration file ownership is set to root (Automated)",id:"4110-ensure-that-the-kubelet---config-configuration-file-ownership-is-set-to-root-automated",level:3},{value:"4.2 Kubelet",id:"42-kubelet",level:2},{value:"4.2.1 Ensure that the --anonymous-auth argument is set to false (Automated)",id:"421-ensure-that-the---anonymous-auth-argument-is-set-to-false-automated",level:3},{value:"4.2.2 Ensure that the --authorization-mode argument is not set to AlwaysAllow (Automated)",id:"422-ensure-that-the---authorization-mode-argument-is-not-set-to-alwaysallow-automated",level:3},{value:"4.2.3 Ensure that the --client-ca-file argument is set as appropriate (Automated)",id:"423-ensure-that-the---client-ca-file-argument-is-set-as-appropriate-automated",level:3},{value:"4.2.4 Verify that the --read-only-port argument is set to 0 (Automated)",id:"424-verify-that-the---read-only-port-argument-is-set-to-0-automated",level:3},{value:"4.2.5 Ensure that the --streaming-connection-idle-timeout argument is not set to 0 (Manual)",id:"425-ensure-that-the---streaming-connection-idle-timeout-argument-is-not-set-to-0-manual",level:3},{value:"4.2.6 Ensure that the --make-iptables-util-chains argument is set to true (Automated)",id:"426-ensure-that-the---make-iptables-util-chains-argument-is-set-to-true-automated",level:3},{value:"4.2.7 Ensure that the --hostname-override argument is not set (Automated)",id:"427-ensure-that-the---hostname-override-argument-is-not-set-automated",level:3},{value:"4.2.8 Ensure that the eventRecordQPS argument is set to a level which ensures appropriate event capture (Manual)",id:"428-ensure-that-the-eventrecordqps-argument-is-set-to-a-level-which-ensures-appropriate-event-capture-manual",level:3},{value:"4.2.9 Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate (Automated)",id:"429-ensure-that-the---tls-cert-file-and---tls-private-key-file-arguments-are-set-as-appropriate-automated",level:3},{value:"4.2.10 Ensure that the --rotate-certificates argument is not set to false (Automated)",id:"4210-ensure-that-the---rotate-certificates-argument-is-not-set-to-false-automated",level:3},{value:"4.2.11 Verify that the RotateKubeletServerCertificate argument is set to true (Automated)",id:"4211-verify-that-the-rotatekubeletservercertificate-argument-is-set-to-true-automated",level:3},{value:"4.2.12 Ensure that the Kubelet only makes use of Strong Cryptographic Ciphers (Manual)",id:"4212-ensure-that-the-kubelet-only-makes-use-of-strong-cryptographic-ciphers-manual",level:3},{value:"4.2.13 Ensure that a limit is set on pod PIDs (Manual)",id:"4213-ensure-that-a-limit-is-set-on-pod-pids-manual",level:3},{value:"5.1 RBAC and Service Accounts",id:"51-rbac-and-service-accounts",level:2},{value:"5.1.1 Ensure that the cluster-admin role is only used where required (Manual)",id:"511-ensure-that-the-cluster-admin-role-is-only-used-where-required-manual",level:3},{value:"5.1.2 Minimize access to secrets (Manual)",id:"512-minimize-access-to-secrets-manual",level:3},{value:"5.1.3 Minimize wildcard use in Roles and ClusterRoles (Manual)",id:"513-minimize-wildcard-use-in-roles-and-clusterroles-manual",level:3},{value:"5.1.4 Minimize access to create pods (Manual)",id:"514-minimize-access-to-create-pods-manual",level:3},{value:"5.1.5 Ensure that default service accounts are not actively used. (Manual)",id:"515-ensure-that-default-service-accounts-are-not-actively-used-manual",level:3},{value:"5.1.6 Ensure that Service Account Tokens are only mounted where necessary (Manual)",id:"516-ensure-that-service-account-tokens-are-only-mounted-where-necessary-manual",level:3},{value:"5.1.7 Avoid use of system group (Manual)",id:"517-avoid-use-of-system-group-manual",level:3},{value:"5.1.8 Limit use of the Bind, Impersonate and Escalate permissions in the Kubernetes cluster (Manual)",id:"518-limit-use-of-the-bind-impersonate-and-escalate-permissions-in-the-kubernetes-cluster-manual",level:3},{value:"5.1.9 Minimize access to create persistent volumes (Manual)",id:"519-minimize-access-to-create-persistent-volumes-manual",level:3},{value:"5.1.10 Minimize access to the proxy sub-resource of nodes (Manual)",id:"5110-minimize-access-to-the-proxy-sub-resource-of-nodes-manual",level:3},{value:"5.1.11 Minimize access to the approval sub-resource of certificatesigningrequests objects (Manual)",id:"5111-minimize-access-to-the-approval-sub-resource-of-certificatesigningrequests-objects-manual",level:3},{value:"5.1.12 Minimize access to webhook configuration objects (Manual)",id:"5112-minimize-access-to-webhook-configuration-objects-manual",level:3},{value:"5.1.13 Minimize access to the service account token creation (Manual)",id:"5113-minimize-access-to-the-service-account-token-creation-manual",level:3},{value:"5.2 Pod Security Standards",id:"52-pod-security-standards",level:2},{value:"5.2.1 Ensure that the cluster has at least one active policy control mechanism in place (Manual)",id:"521-ensure-that-the-cluster-has-at-least-one-active-policy-control-mechanism-in-place-manual",level:3},{value:"5.2.2 Minimize the admission of privileged containers (Manual)",id:"522-minimize-the-admission-of-privileged-containers-manual",level:3},{value:"5.2.3 Minimize the admission of containers wishing to share the host process ID namespace (Automated)",id:"523-minimize-the-admission-of-containers-wishing-to-share-the-host-process-id-namespace-automated",level:3},{value:"5.2.4 Minimize the admission of containers wishing to share the host IPC namespace (Automated)",id:"524-minimize-the-admission-of-containers-wishing-to-share-the-host-ipc-namespace-automated",level:3},{value:"5.2.5 Minimize the admission of containers wishing to share the host network namespace (Automated)",id:"525-minimize-the-admission-of-containers-wishing-to-share-the-host-network-namespace-automated",level:3},{value:"5.2.6 Minimize the admission of containers with allowPrivilegeEscalation (Automated)",id:"526-minimize-the-admission-of-containers-with-allowprivilegeescalation-automated",level:3},{value:"5.2.7 Minimize the admission of root containers (Automated)",id:"527-minimize-the-admission-of-root-containers-automated",level:3},{value:"5.2.8 Minimize the admission of containers with the NET_RAW capability (Automated)",id:"528-minimize-the-admission-of-containers-with-the-net_raw-capability-automated",level:3},{value:"5.2.9 Minimize the admission of containers with added capabilities (Automated)",id:"529-minimize-the-admission-of-containers-with-added-capabilities-automated",level:3},{value:"5.2.10 Minimize the admission of containers with capabilities assigned (Manual)",id:"5210-minimize-the-admission-of-containers-with-capabilities-assigned-manual",level:3},{value:"5.2.11 Minimize the admission of Windows HostProcess containers (Manual)",id:"5211-minimize-the-admission-of-windows-hostprocess-containers-manual",level:3},{value:"5.2.12 Minimize the admission of HostPath volumes (Manual)",id:"5212-minimize-the-admission-of-hostpath-volumes-manual",level:3},{value:"5.2.13 Minimize the admission of containers which use HostPorts (Manual)",id:"5213-minimize-the-admission-of-containers-which-use-hostports-manual",level:3},{value:"5.3 Network Policies and CNI",id:"53-network-policies-and-cni",level:2},{value:"5.3.1 Ensure that the CNI in use supports NetworkPolicies (Manual)",id:"531-ensure-that-the-cni-in-use-supports-networkpolicies-manual",level:3},{value:"5.3.2 Ensure that all Namespaces have NetworkPolicies defined (Manual)",id:"532-ensure-that-all-namespaces-have-networkpolicies-defined-manual",level:3},{value:"5.4 Secrets Management",id:"54-secrets-management",level:2},{value:"5.4.1 Prefer using Secrets as files over Secrets as environment variables (Manual)",id:"541-prefer-using-secrets-as-files-over-secrets-as-environment-variables-manual",level:3},{value:"5.4.2 Consider external secret storage (Manual)",id:"542-consider-external-secret-storage-manual",level:3},{value:"5.5 Extensible Admission Control",id:"55-extensible-admission-control",level:2},{value:"5.5.1 Configure Image Provenance using ImagePolicyWebhook admission controller (Manual)",id:"551-configure-image-provenance-using-imagepolicywebhook-admission-controller-manual",level:3},{value:"5.7 General Policies",id:"57-general-policies",level:2},{value:"5.7.1 Create administrative boundaries between resources using namespaces (Manual)",id:"571-create-administrative-boundaries-between-resources-using-namespaces-manual",level:3},{value:"5.7.2 Ensure that the seccomp profile is set to docker/default in your Pod definitions (Manual)",id:"572-ensure-that-the-seccomp-profile-is-set-to-dockerdefault-in-your-pod-definitions-manual",level:3},{value:"5.7.3 Apply SecurityContext to your Pods and Containers (Manual)",id:"573-apply-securitycontext-to-your-pods-and-containers-manual",level:3},{value:"5.7.4 The default namespace should not be used (Manual)",id:"574-the-default-namespace-should-not-be-used-manual",level:3}];function d(e){const r={a:"a",code:"code",h2:"h2",h3:"h3",li:"li",p:"p",pre:"pre",strong:"strong",ul:"ul",...(0,n.a)(),...e.components},{Details:s}=r;return s||function(e,r){throw new Error("Expected "+(r?"component":"object")+" `"+e+"` to be defined: you likely forgot to import, pass, or provide it.")}("Details",!0),(0,t.jsxs)(t.Fragment,{children:[(0,t.jsx)(r.h2,{id:"overview",children:"Overview"}),"\n",(0,t.jsxs)(r.p,{children:["This document is a companion to the ",(0,t.jsx)(r.a,{href:"/security/hardening-guide",children:"K3s security hardening guide"}),". The hardening guide provides prescriptive guidance for hardening a production installation of K3s, and this benchmark guide is meant to help you evaluate the level of security of the hardened cluster against each control in the CIS Kubernetes Benchmark. It is to be used by K3s operators, security teams, auditors, and decision-makers."]}),"\n",(0,t.jsxs)(r.p,{children:["This guide is specific to the ",(0,t.jsx)(r.strong,{children:"v1.26-v1.29"})," release line of K3s and the ",(0,t.jsx)(r.strong,{children:"v1.8"})," release of the CIS Kubernetes Benchmark."]}),"\n",(0,t.jsxs)(r.p,{children:["For more information about each control, including detailed descriptions and remediations for failing tests, you can refer to the corresponding section of the CIS Kubernetes Benchmark v1.8. You can download the benchmark, after creating a free account, in ",(0,t.jsx)(r.a,{href:"https://www.cisecurity.org/benchmark/kubernetes/",children:"Center for Internet Security (CIS)"}),"."]}),"\n",(0,t.jsx)(r.h3,{id:"testing-controls-methodology",children:"Testing controls methodology"}),"\n",(0,t.jsx)(r.p,{children:"Each control in the CIS Kubernetes Benchmark was evaluated against a K3s cluster that was configured according to the accompanying hardening guide."}),"\n",(0,t.jsx)(r.p,{children:"Where control audits differ from the original CIS benchmark, the audit commands specific to K3s are provided for testing."}),"\n",(0,t.jsx)(r.p,{children:"These are the possible results for each control:"}),"\n",(0,t.jsxs)(r.ul,{children:["\n",(0,t.jsxs)(r.li,{children:[(0,t.jsx)(r.strong,{children:"Pass"})," - The K3s cluster under test passed the audit outlined in the benchmark."]}),"\n",(0,t.jsxs)(r.li,{children:[(0,t.jsx)(r.strong,{children:"Not Applicable"})," - The control is not applicable to K3s because of how it is designed to operate. The remediation section will explain why this is so."]}),"\n",(0,t.jsxs)(r.li,{children:[(0,t.jsx)(r.strong,{children:"Warn"})," - The control is manual in the CIS benchmark and it depends on the cluster's use case or some other factor that must be determined by the cluster operator. These controls have been evaluated to ensure K3s does not prevent their implementation, but no further configuration or auditing of the cluster under test has been performed."]}),"\n"]}),"\n",(0,t.jsx)(r.p,{children:'This guide makes the assumption that K3s is running as a Systemd unit. Your installation may vary and will require you to adjust the "audit" commands to fit your scenario.'}),"\n",(0,t.jsx)(r.h2,{id:"11-control-plane-node-configuration-files",children:"1.1 Control Plane Node Configuration Files"}),"\n",(0,t.jsx)(r.h3,{id:"111-ensure-that-the-api-server-pod-specification-file-permissions-are-set-to-600-or-more-restrictive-automated",children:"1.1.1 Ensure that the API server pod specification file permissions are set to 600 or more restrictive (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," Not Applicable"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Rationale:"})}),"\n",(0,t.jsx)(r.p,{children:"By default, K3s embeds the api server within the k3s process. There is no API server pod specification file."}),"\n",(0,t.jsxs)(r.h3,{id:"112-ensure-that-the-api-server-pod-specification-file-ownership-is-set-to-root-automated",children:["1.1.2 Ensure that the API server pod specification file ownership is set to root",":root"," (Automated)"]}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," Not Applicable"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Rationale:"})}),"\n",(0,t.jsx)(r.p,{children:"By default, K3s embeds the api server within the k3s process. There is no API server pod specification file."}),"\n",(0,t.jsx)(r.h3,{id:"113-ensure-that-the-controller-manager-pod-specification-file-permissions-are-set-to-600-or-more-restrictive-automated",children:"1.1.3 Ensure that the controller manager pod specification file permissions are set to 600 or more restrictive (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," Not Applicable"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Rationale:"})}),"\n",(0,t.jsx)(r.p,{children:"By default, K3s embeds the controller manager within the k3s process. There is no controller manager pod specification file."}),"\n",(0,t.jsxs)(r.h3,{id:"114-ensure-that-the-controller-manager-pod-specification-file-ownership-is-set-to-root-automated",children:["1.1.4 Ensure that the controller manager pod specification file ownership is set to root",":root"," (Automated)"]}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," Not Applicable"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Rationale:"})}),"\n",(0,t.jsx)(r.p,{children:"By default, K3s embeds the controller manager within the k3s process. There is no controller manager pod specification file."}),"\n",(0,t.jsx)(r.h3,{id:"115-ensure-that-the-scheduler-pod-specification-file-permissions-are-set-to-600-or-more-restrictive-automated",children:"1.1.5 Ensure that the scheduler pod specification file permissions are set to 600 or more restrictive (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," Not Applicable"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Rationale:"})}),"\n",(0,t.jsx)(r.p,{children:"By default, K3s embeds the scheduler within the k3s process. There is no scheduler pod specification file."}),"\n",(0,t.jsxs)(r.h3,{id:"116-ensure-that-the-scheduler-pod-specification-file-ownership-is-set-to-root-automated",children:["1.1.6 Ensure that the scheduler pod specification file ownership is set to root",":root"," (Automated)"]}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," Not Applicable"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Rationale:"})}),"\n",(0,t.jsx)(r.p,{children:"By default, K3s embeds the scheduler within the k3s process. There is no scheduler pod specification file."}),"\n",(0,t.jsx)(r.h3,{id:"117-ensure-that-the-etcd-pod-specification-file-permissions-are-set-to-600-or-more-restrictive-automated",children:"1.1.7 Ensure that the etcd pod specification file permissions are set to 600 or more restrictive (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," Not Applicable"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Rationale:"})}),"\n",(0,t.jsx)(r.p,{children:"By default, K3s embeds etcd within the k3s process. There is no etcd pod specification file."}),"\n",(0,t.jsxs)(r.h3,{id:"118-ensure-that-the-etcd-pod-specification-file-ownership-is-set-to-root-automated",children:["1.1.8 Ensure that the etcd pod specification file ownership is set to root",":root"," (Automated)"]}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," Not Applicable"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Rationale:"})}),"\n",(0,t.jsx)(r.p,{children:"By default, K3s embeds etcd within the k3s process. There is no etcd pod specification file."}),"\n",(0,t.jsx)(r.h3,{id:"119-ensure-that-the-container-network-interface-file-permissions-are-set-to-600-or-more-restrictive-automated",children:"1.1.9 Ensure that the Container Network Interface file permissions are set to 600 or more restrictive (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"find /var/lib/cni/networks -type f ! -name lock 2> /dev/null | xargs --no-run-if-empty stat -c permissions=%a\n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," permissions has permissions 600, expected 600 or more restrictive"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:"permissions=600\npermissions=600\npermissions=600\npermissions=600\npermissions=600\npermissions=600\n"})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsxs)(r.p,{children:["By default, K3s sets the CNI file permissions to 600.\nNote that for many CNIs, a lock file is created with permissions 750. This is expected and can be ignored.\nIf you modify your CNI configuration, ensure that the permissions are set to 600.\nFor example, ",(0,t.jsx)(r.code,{children:"chmod 600 /var/lib/cni/networks/"})]})]}),"\n",(0,t.jsxs)(r.h3,{id:"1110-ensure-that-the-container-network-interface-file-ownership-is-set-to-root-manual",children:["1.1.10 Ensure that the Container Network Interface file ownership is set to root",":root"," (Manual)"]}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," Not Applicable"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Rationale:"})}),"\n",(0,t.jsxs)(r.p,{children:["Run the below command (based on the file location on your system) on the control plane node.\nFor example,\n",(0,t.jsx)(r.code,{children:"chown root:root "})]}),"\n",(0,t.jsx)(r.h3,{id:"1111-ensure-that-the-etcd-data-directory-permissions-are-set-to-700-or-more-restrictive-automated",children:"1.1.11 Ensure that the etcd data directory permissions are set to 700 or more restrictive (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:'if [ "$(journalctl -u k3s | grep -m1 \'Managed etcd cluster\' | wc -l)" -gt 0 ]; then\n stat -c permissions=%a /var/lib/rancher/k3s/server/db/etcd\nelse\n echo "permissions=700"\nfi\n'})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," permissions has permissions 700, expected 700 or more restrictive"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:"permissions=700\n"})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsxs)(r.p,{children:["On the etcd server node, get the etcd data directory, passed as an argument --data-dir,\nfrom the command 'ps -ef | grep etcd'.\nRun the below command (based on the etcd data directory found above). For example,\n",(0,t.jsx)(r.code,{children:"chmod 700 /var/lib/etcd"})]})]}),"\n",(0,t.jsxs)(r.h3,{id:"1112-ensure-that-the-etcd-data-directory-ownership-is-set-to-etcd-automated",children:["1.1.12 Ensure that the etcd data directory ownership is set to etcd",":etcd"," (Automated)"]}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," Not Applicable"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Rationale:"})}),"\n",(0,t.jsxs)(r.p,{children:["For K3s, etcd is embedded within the k3s process. There is no separate etcd process.\nTherefore the etcd data directory ownership is managed by the k3s process and should be root",":root","."]}),"\n",(0,t.jsx)(r.h3,{id:"1113-ensure-that-the-adminconf-file-permissions-are-set-to-600-or-more-restrictive-automated",children:"1.1.13 Ensure that the admin.conf file permissions are set to 600 or more restrictive (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"/bin/sh -c 'if test -e /var/lib/rancher/k3s/server/cred/admin.kubeconfig; then stat -c permissions=%a /var/lib/rancher/k3s/server/cred/admin.kubeconfig; fi'\n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," permissions has permissions 600, expected 600 or more restrictive"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:"permissions=600\n"})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsxs)(r.p,{children:["Run the below command (based on the file location on your system) on the control plane node.\nFor example, ",(0,t.jsx)(r.code,{children:"chmod 600 /var/lib/rancher/k3s/server/cred/admin.kubeconfig"})]})]}),"\n",(0,t.jsxs)(r.h3,{id:"1114-ensure-that-the-adminconf-file-ownership-is-set-to-root-automated",children:["1.1.14 Ensure that the admin.conf file ownership is set to root",":root"," (Automated)"]}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"/bin/sh -c 'if test -e /var/lib/rancher/k3s/server/cred/admin.kubeconfig; then stat -c %U:%G /var/lib/rancher/k3s/server/cred/admin.kubeconfig; fi'\n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," 'root",":root","' is equal to 'root",":root","'"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:"root:root\n"})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsxs)(r.p,{children:["Run the below command (based on the file location on your system) on the control plane node.\nFor example, ",(0,t.jsx)(r.code,{children:"chown root:root /var/lib/rancher/k3s/server/cred/admin.kubeconfig"})]})]}),"\n",(0,t.jsx)(r.h3,{id:"1115-ensure-that-the-schedulerconf-file-permissions-are-set-to-600-or-more-restrictive-automated",children:"1.1.15 Ensure that the scheduler.conf file permissions are set to 600 or more restrictive (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"/bin/sh -c 'if test -e /var/lib/rancher/k3s/server/cred/scheduler.kubeconfig; then stat -c permissions=%a /var/lib/rancher/k3s/server/cred/scheduler.kubeconfig; fi'\n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," permissions has permissions 600, expected 600 or more restrictive"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:"permissions=600\n"})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsxs)(r.p,{children:["Run the below command (based on the file location on your system) on the control plane node.\nFor example,\n",(0,t.jsx)(r.code,{children:"chmod 600 /var/lib/rancher/k3s/server/cred/scheduler.kubeconfig"})]})]}),"\n",(0,t.jsxs)(r.h3,{id:"1116-ensure-that-the-schedulerconf-file-ownership-is-set-to-root-automated",children:["1.1.16 Ensure that the scheduler.conf file ownership is set to root",":root"," (Automated)"]}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"/bin/sh -c 'if test -e /var/lib/rancher/k3s/server/cred/scheduler.kubeconfig; then stat -c %U:%G /var/lib/rancher/k3s/server/cred/scheduler.kubeconfig; fi'\n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," 'root",":root","' is present"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:"root:root\n"})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsxs)(r.p,{children:["Run the below command (based on the file location on your system) on the control plane node.\nFor example,\n",(0,t.jsx)(r.code,{children:"chown root:root /var/lib/rancher/k3s/server/cred/scheduler.kubeconfig"})]})]}),"\n",(0,t.jsx)(r.h3,{id:"1117-ensure-that-the-controller-managerconf-file-permissions-are-set-to-600-or-more-restrictive-automated",children:"1.1.17 Ensure that the controller-manager.conf file permissions are set to 600 or more restrictive (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"/bin/sh -c 'if test -e /var/lib/rancher/k3s/server/cred/controller.kubeconfig; then stat -c permissions=%a /var/lib/rancher/k3s/server/cred/controller.kubeconfig; fi'\n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," permissions has permissions 600, expected 600 or more restrictive"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:"permissions=600\n"})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsxs)(r.p,{children:["Run the below command (based on the file location on your system) on the control plane node.\nFor example,\n",(0,t.jsx)(r.code,{children:"chmod 600 /var/lib/rancher/k3s/server/cred/controller.kubeconfig"})]})]}),"\n",(0,t.jsxs)(r.h3,{id:"1118-ensure-that-the-controller-managerconf-file-ownership-is-set-to-root-automated",children:["1.1.18 Ensure that the controller-manager.conf file ownership is set to root",":root"," (Automated)"]}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"stat -c %U:%G /var/lib/rancher/k3s/server/cred/controller.kubeconfig\n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," 'root",":root","' is equal to 'root",":root","'"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:"root:root\n"})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsxs)(r.p,{children:["Run the below command (based on the file location on your system) on the control plane node.\nFor example,\n",(0,t.jsx)(r.code,{children:"chown root:root /var/lib/rancher/k3s/server/cred/controller.kubeconfig"})]})]}),"\n",(0,t.jsxs)(r.h3,{id:"1119-ensure-that-the-kubernetes-pki-directory-and-file-ownership-is-set-to-root-automated",children:["1.1.19 Ensure that the Kubernetes PKI directory and file ownership is set to root",":root"," (Automated)"]}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"stat -c %U:%G /var/lib/rancher/k3s/server/tls\n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," 'root",":root","' is present"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:"root:root\n"})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsxs)(r.p,{children:["Run the below command (based on the file location on your system) on the control plane node.\nFor example,\n",(0,t.jsx)(r.code,{children:"chown -R root:root /var/lib/rancher/k3s/server/tls"})]})]}),"\n",(0,t.jsx)(r.h3,{id:"1120-ensure-that-the-kubernetes-pki-certificate-file-permissions-are-set-to-600-or-more-restrictive-manual",children:"1.1.20 Ensure that the Kubernetes PKI certificate file permissions are set to 600 or more restrictive (Manual)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Remediation:"}),"\nRun the below command (based on the file location on your system) on the master node.\nFor example,\n",(0,t.jsx)(r.code,{children:"chmod -R 600 /var/lib/rancher/k3s/server/tls/*.crt"})]}),"\n",(0,t.jsx)(r.h3,{id:"1121-ensure-that-the-kubernetes-pki-key-file-permissions-are-set-to-600-automated",children:"1.1.21 Ensure that the Kubernetes PKI key file permissions are set to 600 (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"/bin/sh -c 'stat -c permissions=%a /var/lib/rancher/k3s/server/tls/*.key'\n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," permissions has permissions 600, expected 600 or more restrictive"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:"permissions=600\npermissions=600\npermissions=600\npermissions=600\npermissions=600\npermissions=600\npermissions=600\npermissions=600\npermissions=600\npermissions=600\npermissions=600\npermissions=600\npermissions=600\npermissions=600\npermissions=600\npermissions=600\npermissions=600\n"})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsxs)(r.p,{children:["Run the below command (based on the file location on your system) on the master node.\nFor example,\n",(0,t.jsx)(r.code,{children:"chmod -R 600 /var/lib/rancher/k3s/server/tls/*.key"})]})]}),"\n",(0,t.jsx)(r.h2,{id:"12-api-server",children:"1.2 API Server"}),"\n",(0,t.jsx)(r.h3,{id:"121-ensure-that-the---anonymous-auth-argument-is-set-to-false-automated",children:"1.2.1 Ensure that the --anonymous-auth argument is set to false (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'anonymous-auth'\n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," '--anonymous-auth' is equal to 'false'"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:'Aug 09 19:06:17 server-0 k3s[2357]: time="2024-08-09T19:06:17Z" level=info msg="Running kube-apiserver --admission-control-config-file=/var/lib/rancher/k3s/server/psa.yaml --advertise-address=10.10.10.100 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --encryption-provider-config-automatic-reload=true --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsx)(r.p,{children:"By default, K3s sets the --anonymous-auth argument to false.\nIf this check fails, edit the K3s config file /etc/rancher/k3s/config.yaml and remove anything similar to below."}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{children:'kube-apiserver-arg:\n - "anonymous-auth=true"\n'})})]}),"\n",(0,t.jsx)(r.h3,{id:"122-ensure-that-the---token-auth-file-parameter-is-not-set-automated",children:"1.2.2 Ensure that the --token-auth-file parameter is not set (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s | grep 'Running kube-apiserver' | tail -n1\n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," '--token-auth-file' is not present"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:'Aug 09 19:06:17 server-0 k3s[2357]: time="2024-08-09T19:06:17Z" level=info msg="Running kube-apiserver --admission-control-config-file=/var/lib/rancher/k3s/server/psa.yaml --advertise-address=10.10.10.100 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --encryption-provider-config-automatic-reload=true --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsx)(r.p,{children:"Follow the documentation and configure alternate mechanisms for authentication.\nIf this check fails, edit the K3s config file /etc/rancher/k3s/config.yaml and remove anything similar to below."}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{children:'kube-apiserver-arg:\n - "token-auth-file="\n'})})]}),"\n",(0,t.jsx)(r.h3,{id:"123-ensure-that-the---denyserviceexternalips-is-not-set-automated",children:"1.2.3 Ensure that the --DenyServiceExternalIPs is not set (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s | grep 'Running kube-apiserver' | tail -n1\n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," '--enable-admission-plugins' does not have 'DenyServiceExternalIPs' OR '--enable-admission-plugins' is not present"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:'Aug 09 19:06:17 server-0 k3s[2357]: time="2024-08-09T19:06:17Z" level=info msg="Running kube-apiserver --admission-control-config-file=/var/lib/rancher/k3s/server/psa.yaml --advertise-address=10.10.10.100 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --encryption-provider-config-automatic-reload=true --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsx)(r.p,{children:"By default, K3s does not set DenyServiceExternalIPs.\nIf this check fails, edit the K3s config file /etc/rancher/k3s/config.yaml, remove any lines like below."}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{children:'kube-apiserver-arg:\n - "enable-admission-plugins=DenyServiceExternalIPs"\n'})})]}),"\n",(0,t.jsx)(r.h3,{id:"124-ensure-that-the---kubelet-client-certificate-and---kubelet-client-key-arguments-are-set-as-appropriate-automated",children:"1.2.4 Ensure that the --kubelet-client-certificate and --kubelet-client-key arguments are set as appropriate (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s | grep 'Running kube-apiserver' | tail -n1\n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," '--kubelet-client-certificate' is present AND '--kubelet-client-key' is present"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:'Aug 09 19:06:17 server-0 k3s[2357]: time="2024-08-09T19:06:17Z" level=info msg="Running kube-apiserver --admission-control-config-file=/var/lib/rancher/k3s/server/psa.yaml --advertise-address=10.10.10.100 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --encryption-provider-config-automatic-reload=true --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsx)(r.p,{children:"By default, K3s automatically provides the kubelet client certificate and key.\nThey are generated and located at /var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt and /var/lib/rancher/k3s/server/tls/client-kube-apiserver.key\nIf for some reason you need to provide your own certificate and key, you can set the\nbelow parameters in the K3s config file /etc/rancher/k3s/config.yaml."}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{children:'kube-apiserver-arg:\n - "kubelet-client-certificate="\n - "kubelet-client-key="\n'})})]}),"\n",(0,t.jsx)(r.h3,{id:"125-ensure-that-the---kubelet-certificate-authority-argument-is-set-as-appropriate-automated",children:"1.2.5 Ensure that the --kubelet-certificate-authority argument is set as appropriate (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'kubelet-certificate-authority'\n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," '--kubelet-certificate-authority' is present"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:'Aug 09 19:06:17 server-0 k3s[2357]: time="2024-08-09T19:06:17Z" level=info msg="Running kube-apiserver --admission-control-config-file=/var/lib/rancher/k3s/server/psa.yaml --advertise-address=10.10.10.100 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --encryption-provider-config-automatic-reload=true --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsx)(r.p,{children:"By default, K3s automatically provides the kubelet CA cert file, at /var/lib/rancher/k3s/server/tls/server-ca.crt.\nIf for some reason you need to provide your own ca certificate, look at using the k3s certificate command line tool.\nIf this check fails, edit the K3s config file /etc/rancher/k3s/config.yaml and remove any lines like below."}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{children:'kube-apiserver-arg:\n - "kubelet-certificate-authority="\n'})})]}),"\n",(0,t.jsx)(r.h3,{id:"126-ensure-that-the---authorization-mode-argument-is-not-set-to-alwaysallow-automated",children:"1.2.6 Ensure that the --authorization-mode argument is not set to AlwaysAllow (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'authorization-mode'\n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," '--authorization-mode' does not have 'AlwaysAllow'"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:'Aug 09 19:06:17 server-0 k3s[2357]: time="2024-08-09T19:06:17Z" level=info msg="Running kube-apiserver --admission-control-config-file=/var/lib/rancher/k3s/server/psa.yaml --advertise-address=10.10.10.100 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --encryption-provider-config-automatic-reload=true --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsx)(r.p,{children:"By default, K3s does not set the --authorization-mode to AlwaysAllow.\nIf this check fails, edit K3s config file /etc/rancher/k3s/config.yaml, remove any lines like below."}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{children:'kube-apiserver-arg:\n - "authorization-mode=AlwaysAllow"\n'})})]}),"\n",(0,t.jsx)(r.h3,{id:"127-ensure-that-the---authorization-mode-argument-includes-node-automated",children:"1.2.7 Ensure that the --authorization-mode argument includes Node (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'authorization-mode'\n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," '--authorization-mode' has 'Node'"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:'Aug 09 19:06:17 server-0 k3s[2357]: time="2024-08-09T19:06:17Z" level=info msg="Running kube-apiserver --admission-control-config-file=/var/lib/rancher/k3s/server/psa.yaml --advertise-address=10.10.10.100 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --encryption-provider-config-automatic-reload=true --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsx)(r.p,{children:"By default, K3s sets the --authorization-mode to Node and RBAC.\nIf this check fails, edit the K3s config file /etc/rancher/k3s/config.yaml,\nensure that you are not overriding authorization-mode."})]}),"\n",(0,t.jsx)(r.h3,{id:"128-ensure-that-the---authorization-mode-argument-includes-rbac-automated",children:"1.2.8 Ensure that the --authorization-mode argument includes RBAC (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'authorization-mode'\n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," '--authorization-mode' has 'RBAC'"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:'Aug 09 19:06:17 server-0 k3s[2357]: time="2024-08-09T19:06:17Z" level=info msg="Running kube-apiserver --admission-control-config-file=/var/lib/rancher/k3s/server/psa.yaml --advertise-address=10.10.10.100 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --encryption-provider-config-automatic-reload=true --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsx)(r.p,{children:"By default, K3s sets the --authorization-mode to Node and RBAC.\nIf this check fails, edit the K3s config file /etc/rancher/k3s/config.yaml,\nensure that you are not overriding authorization-mode."})]}),"\n",(0,t.jsx)(r.h3,{id:"129-ensure-that-the-admission-control-plugin-eventratelimit-is-set-manual",children:"1.2.9 Ensure that the admission control plugin EventRateLimit is set (Manual)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Remediation:"}),"\nFollow the Kubernetes documentation and set the desired limits in a configuration file.\nThen, edit the K3s config file /etc/rancher/k3s/config.yaml and set the below parameters."]}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{children:'kube-apiserver-arg:\n - "enable-admission-plugins=...,EventRateLimit,..."\n - "admission-control-config-file="\n'})}),"\n",(0,t.jsx)(r.h3,{id:"1210-ensure-that-the-admission-control-plugin-alwaysadmit-is-not-set-automated",children:"1.2.10 Ensure that the admission control plugin AlwaysAdmit is not set (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'enable-admission-plugins'\n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," '--enable-admission-plugins' does not have 'AlwaysAdmit' OR '--enable-admission-plugins' is not present"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:'Aug 09 19:06:17 server-0 k3s[2357]: time="2024-08-09T19:06:17Z" level=info msg="Running kube-apiserver --admission-control-config-file=/var/lib/rancher/k3s/server/psa.yaml --advertise-address=10.10.10.100 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --encryption-provider-config-automatic-reload=true --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsx)(r.p,{children:"By default, K3s does not set the --enable-admission-plugins to AlwaysAdmit.\nIf this check fails, edit K3s config file /etc/rancher/k3s/config.yaml, remove any lines like below."}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{children:'kube-apiserver-arg:\n - "enable-admission-plugins=AlwaysAdmit"\n'})})]}),"\n",(0,t.jsx)(r.h3,{id:"1211-ensure-that-the-admission-control-plugin-alwayspullimages-is-set-manual",children:"1.2.11 Ensure that the admission control plugin AlwaysPullImages is set (Manual)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Remediation:"}),'\nPermissive, per CIS guidelines,\n"This setting could impact offline or isolated clusters, which have images pre-loaded and\ndo not have access to a registry to pull in-use images. This setting is not appropriate for\nclusters which use this configuration."\nEdit the K3s config file /etc/rancher/k3s/config.yaml and set the below parameter.']}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{children:'kube-apiserver-arg:\n - "enable-admission-plugins=...,AlwaysPullImages,..."\n'})}),"\n",(0,t.jsx)(r.h3,{id:"1212-ensure-that-the-admission-control-plugin-securitycontextdeny-is-set-if-podsecuritypolicy-is-not-used-manual",children:"1.2.12 Ensure that the admission control plugin SecurityContextDeny is set if PodSecurityPolicy is not used (Manual)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," Not Applicable"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Rationale:"})}),"\n",(0,t.jsx)(r.p,{children:"Enabling Pod Security Policy is no longer supported on K3s v1.25+ and will cause applications to unexpectedly fail."}),"\n",(0,t.jsx)(r.h3,{id:"1213-ensure-that-the-admission-control-plugin-serviceaccount-is-set-automated",children:"1.2.13 Ensure that the admission control plugin ServiceAccount is set (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s | grep 'Running kube-apiserver' | tail -n1\n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," '--disable-admission-plugins' is present OR '--disable-admission-plugins' is not present"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:'Aug 09 19:06:17 server-0 k3s[2357]: time="2024-08-09T19:06:17Z" level=info msg="Running kube-apiserver --admission-control-config-file=/var/lib/rancher/k3s/server/psa.yaml --advertise-address=10.10.10.100 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --encryption-provider-config-automatic-reload=true --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsx)(r.p,{children:"By default, K3s does not set the --disable-admission-plugins to anything.\nFollow the documentation and create ServiceAccount objects as per your environment.\nIf this check fails, edit the K3s config file /etc/rancher/k3s/config.yaml and remove any lines like below."}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{children:'kube-apiserver-arg:\n - "disable-admission-plugins=ServiceAccount"\n'})})]}),"\n",(0,t.jsx)(r.h3,{id:"1214-ensure-that-the-admission-control-plugin-namespacelifecycle-is-set-automated",children:"1.2.14 Ensure that the admission control plugin NamespaceLifecycle is set (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s | grep 'Running kube-apiserver' | tail -n1\n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," '--disable-admission-plugins' is present OR '--disable-admission-plugins' is not present"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:'Aug 09 19:06:17 server-0 k3s[2357]: time="2024-08-09T19:06:17Z" level=info msg="Running kube-apiserver --admission-control-config-file=/var/lib/rancher/k3s/server/psa.yaml --advertise-address=10.10.10.100 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --encryption-provider-config-automatic-reload=true --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsx)(r.p,{children:"By default, K3s does not set the --disable-admission-plugins to anything.\nIf this check fails, edit the K3s config file /etc/rancher/k3s/config.yaml and remove any lines like below."}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{children:'kube-apiserver-arg:\n - "disable-admission-plugins=...,NamespaceLifecycle,..."\n'})})]}),"\n",(0,t.jsx)(r.h3,{id:"1215-ensure-that-the-admission-control-plugin-noderestriction-is-set-automated",children:"1.2.15 Ensure that the admission control plugin NodeRestriction is set (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'enable-admission-plugins'\n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," '--enable-admission-plugins' has 'NodeRestriction'"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:'Aug 09 19:06:17 server-0 k3s[2357]: time="2024-08-09T19:06:17Z" level=info msg="Running kube-apiserver --admission-control-config-file=/var/lib/rancher/k3s/server/psa.yaml --advertise-address=10.10.10.100 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --encryption-provider-config-automatic-reload=true --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsx)(r.p,{children:"By default, K3s sets the --enable-admission-plugins to NodeRestriction.\nIf using the K3s config file /etc/rancher/k3s/config.yaml, check that you are not overriding the admission plugins.\nIf you are, include NodeRestriction in the list."}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{children:'kube-apiserver-arg:\n - "enable-admission-plugins=...,NodeRestriction,..."\n'})})]}),"\n",(0,t.jsx)(r.h3,{id:"1216-ensure-that-the---profiling-argument-is-set-to-false-automated",children:"1.2.16 Ensure that the --profiling argument is set to false (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'profiling'\n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," '--profiling' is equal to 'false'"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:'Aug 09 19:06:17 server-0 k3s[2357]: time="2024-08-09T19:06:17Z" level=info msg="Running kube-apiserver --admission-control-config-file=/var/lib/rancher/k3s/server/psa.yaml --advertise-address=10.10.10.100 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --encryption-provider-config-automatic-reload=true --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsx)(r.p,{children:"By default, K3s sets the --profiling argument to false.\nIf this check fails, edit the K3s config file /etc/rancher/k3s/config.yaml and remove any lines like below."}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{children:'kube-apiserver-arg:\n - "profiling=true"\n'})})]}),"\n",(0,t.jsx)(r.h3,{id:"1217-ensure-that-the---audit-log-path-argument-is-set-manual",children:"1.2.17 Ensure that the --audit-log-path argument is set (Manual)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s | grep 'Running kube-apiserver' | tail -n1\n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," '--audit-log-path' is present"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:'Aug 09 19:06:17 server-0 k3s[2357]: time="2024-08-09T19:06:17Z" level=info msg="Running kube-apiserver --admission-control-config-file=/var/lib/rancher/k3s/server/psa.yaml --advertise-address=10.10.10.100 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --encryption-provider-config-automatic-reload=true --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsx)(r.p,{children:"Edit the K3s config file /etc/rancher/k3s/config.yaml and set the audit-log-path parameter to a suitable path and\nfile where you would like audit logs to be written, for example,"}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{children:'kube-apiserver-arg:\n - "audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log"\n'})})]}),"\n",(0,t.jsx)(r.h3,{id:"1218-ensure-that-the---audit-log-maxage-argument-is-set-to-30-or-as-appropriate-manual",children:"1.2.18 Ensure that the --audit-log-maxage argument is set to 30 or as appropriate (Manual)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s | grep 'Running kube-apiserver' | tail -n1\n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," '--audit-log-maxage' is greater or equal to 30"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:'Aug 09 19:06:17 server-0 k3s[2357]: time="2024-08-09T19:06:17Z" level=info msg="Running kube-apiserver --admission-control-config-file=/var/lib/rancher/k3s/server/psa.yaml --advertise-address=10.10.10.100 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --encryption-provider-config-automatic-reload=true --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsx)(r.p,{children:"Edit the K3s config file /etc/rancher/k3s/config.yaml on the control plane node and\nset the audit-log-maxage parameter to 30 or as an appropriate number of days, for example,"}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{children:'kube-apiserver-arg:\n - "audit-log-maxage=30"\n'})})]}),"\n",(0,t.jsx)(r.h3,{id:"1219-ensure-that-the---audit-log-maxbackup-argument-is-set-to-10-or-as-appropriate-manual",children:"1.2.19 Ensure that the --audit-log-maxbackup argument is set to 10 or as appropriate (Manual)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s | grep 'Running kube-apiserver' | tail -n1\n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," '--audit-log-maxbackup' is greater or equal to 10"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:'Aug 09 19:06:17 server-0 k3s[2357]: time="2024-08-09T19:06:17Z" level=info msg="Running kube-apiserver --admission-control-config-file=/var/lib/rancher/k3s/server/psa.yaml --advertise-address=10.10.10.100 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --encryption-provider-config-automatic-reload=true --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsx)(r.p,{children:"Edit the K3s config file /etc/rancher/k3s/config.yaml on the control plane node and\nset the audit-log-maxbackup parameter to 10 or to an appropriate value. For example,"}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{children:'kube-apiserver-arg:\n - "audit-log-maxbackup=10"\n'})})]}),"\n",(0,t.jsx)(r.h3,{id:"1220-ensure-that-the---audit-log-maxsize-argument-is-set-to-100-or-as-appropriate-manual",children:"1.2.20 Ensure that the --audit-log-maxsize argument is set to 100 or as appropriate (Manual)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s | grep 'Running kube-apiserver' | tail -n1\n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," '--audit-log-maxsize' is greater or equal to 100"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:'Aug 09 19:06:17 server-0 k3s[2357]: time="2024-08-09T19:06:17Z" level=info msg="Running kube-apiserver --admission-control-config-file=/var/lib/rancher/k3s/server/psa.yaml --advertise-address=10.10.10.100 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --encryption-provider-config-automatic-reload=true --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsx)(r.p,{children:"Edit the K3s config file /etc/rancher/k3s/config.yaml on the control plane node and\nset the audit-log-maxsize parameter to an appropriate size in MB. For example,"}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{children:'kube-apiserver-arg:\n - "audit-log-maxsize=100"\n'})})]}),"\n",(0,t.jsx)(r.h3,{id:"1221-ensure-that-the---request-timeout-argument-is-set-as-appropriate-manual",children:"1.2.21 Ensure that the --request-timeout argument is set as appropriate (Manual)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Remediation:"}),'\nPermissive, per CIS guidelines,\n"it is recommended to set this limit as appropriate and change the default limit of 60 seconds only if needed".\nEdit the K3s config file /etc/rancher/k3s/config.yaml\nand set the below parameter if needed. For example,']}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{children:'kube-apiserver-arg:\n - "request-timeout=300s"\n'})}),"\n",(0,t.jsx)(r.h3,{id:"1222-ensure-that-the---service-account-lookup-argument-is-set-to-true-automated",children:"1.2.22 Ensure that the --service-account-lookup argument is set to true (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s | grep 'Running kube-apiserver' | tail -n1\n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," '--service-account-lookup' is not present OR '--service-account-lookup' is present"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:'Aug 09 19:06:17 server-0 k3s[2357]: time="2024-08-09T19:06:17Z" level=info msg="Running kube-apiserver --admission-control-config-file=/var/lib/rancher/k3s/server/psa.yaml --advertise-address=10.10.10.100 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --encryption-provider-config-automatic-reload=true --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsx)(r.p,{children:"By default, K3s does not set the --service-account-lookup argument.\nEdit the K3s config file /etc/rancher/k3s/config.yaml and set the service-account-lookup. For example,"}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{children:'kube-apiserver-arg:\n - "service-account-lookup=true"\n'})}),(0,t.jsx)(r.p,{children:"Alternatively, you can delete the service-account-lookup parameter from this file so\nthat the default takes effect."})]}),"\n",(0,t.jsx)(r.h3,{id:"1223-ensure-that-the---service-account-key-file-argument-is-set-as-appropriate-automated",children:"1.2.23 Ensure that the --service-account-key-file argument is set as appropriate (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s | grep 'Running kube-apiserver' | tail -n1\n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," '--service-account-key-file' is present"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:'Aug 09 19:06:17 server-0 k3s[2357]: time="2024-08-09T19:06:17Z" level=info msg="Running kube-apiserver --admission-control-config-file=/var/lib/rancher/k3s/server/psa.yaml --advertise-address=10.10.10.100 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --encryption-provider-config-automatic-reload=true --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsx)(r.p,{children:"K3s automatically generates and sets the service account key file.\nIt is located at /var/lib/rancher/k3s/server/tls/service.key.\nIf this check fails, edit K3s config file /etc/rancher/k3s/config.yaml and remove any lines like below."}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{children:'kube-apiserver-arg:\n - "service-account-key-file="\n'})})]}),"\n",(0,t.jsx)(r.h3,{id:"1224-ensure-that-the---etcd-certfile-and---etcd-keyfile-arguments-are-set-as-appropriate-automated",children:"1.2.24 Ensure that the --etcd-certfile and --etcd-keyfile arguments are set as appropriate (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"if [ \"$(journalctl -u k3s | grep -m1 'Managed etcd cluster' | wc -l)\" -gt 0 ]; then\n journalctl -D /var/log/journal -u k3s | grep -m1 'Running kube-apiserver' | tail -n1\nelse\n echo \"--etcd-certfile AND --etcd-keyfile\"\nfi\n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," '--etcd-certfile' is present AND '--etcd-keyfile' is present"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:'Aug 09 19:06:17 server-0 k3s[2357]: time="2024-08-09T19:06:17Z" level=info msg="Running kube-apiserver --admission-control-config-file=/var/lib/rancher/k3s/server/psa.yaml --advertise-address=10.10.10.100 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --encryption-provider-config-automatic-reload=true --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsx)(r.p,{children:"K3s automatically generates and sets the etcd certificate and key files.\nThey are located at /var/lib/rancher/k3s/server/tls/etcd/client.crt and /var/lib/rancher/k3s/server/tls/etcd/client.key.\nIf this check fails, edit the K3s config file /etc/rancher/k3s/config.yaml and remove any lines like below."}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{children:'kube-apiserver-arg:\n - "etcd-certfile="\n - "etcd-keyfile="\n'})})]}),"\n",(0,t.jsx)(r.h3,{id:"1225-ensure-that-the---tls-cert-file-and---tls-private-key-file-arguments-are-set-as-appropriate-automated",children:"1.2.25 Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"journalctl -D /var/log/journal -u k3s | grep -A1 'Running kube-apiserver' | tail -n2\n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," '--tls-cert-file' is present AND '--tls-private-key-file' is present"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:'Aug 09 19:06:17 server-0 k3s[2357]: time="2024-08-09T19:06:17Z" level=info msg="Running kube-apiserver --admission-control-config-file=/var/lib/rancher/k3s/server/psa.yaml --advertise-address=10.10.10.100 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --encryption-provider-config-automatic-reload=true --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\nAug 09 19:06:17 server-0 k3s[2357]: time="2024-08-09T19:06:17Z" level=info msg="Running kube-scheduler --authentication-kubeconfig=/var/lib/rancher/k3s/server/cred/scheduler.kubeconfig --authorization-kubeconfig=/var/lib/rancher/k3s/server/cred/scheduler.kubeconfig --bind-address=127.0.0.1 --kubeconfig=/var/lib/rancher/k3s/server/cred/scheduler.kubeconfig --profiling=false --secure-port=10259"\n'})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsx)(r.p,{children:"By default, K3s automatically generates and provides the TLS certificate and private key for the apiserver.\nThey are generated and located at /var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt and /var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key\nIf this check fails, edit the K3s config file /etc/rancher/k3s/config.yaml and remove any lines like below."}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{children:'kube-apiserver-arg:\n - "tls-cert-file="\n - "tls-private-key-file="\n'})})]}),"\n",(0,t.jsx)(r.h3,{id:"1226-ensure-that-the---client-ca-file-argument-is-set-as-appropriate-automated",children:"1.2.26 Ensure that the --client-ca-file argument is set as appropriate (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'client-ca-file'\n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," '--client-ca-file' is present"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:'Aug 09 19:06:17 server-0 k3s[2357]: time="2024-08-09T19:06:17Z" level=info msg="Running kube-apiserver --admission-control-config-file=/var/lib/rancher/k3s/server/psa.yaml --advertise-address=10.10.10.100 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --encryption-provider-config-automatic-reload=true --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsx)(r.p,{children:"By default, K3s automatically provides the client certificate authority file.\nIt is generated and located at /var/lib/rancher/k3s/server/tls/client-ca.crt.\nIf for some reason you need to provide your own ca certificate, look at using the k3s certificate command line tool.\nIf this check fails, edit the K3s config file /etc/rancher/k3s/config.yaml and remove any lines like below."}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{children:'kube-apiserver-arg:\n - "client-ca-file="\n'})})]}),"\n",(0,t.jsx)(r.h3,{id:"1227-ensure-that-the---etcd-cafile-argument-is-set-as-appropriate-automated",children:"1.2.27 Ensure that the --etcd-cafile argument is set as appropriate (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'etcd-cafile'\n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," '--etcd-cafile' is present"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:'Aug 09 19:06:17 server-0 k3s[2357]: time="2024-08-09T19:06:17Z" level=info msg="Running kube-apiserver --admission-control-config-file=/var/lib/rancher/k3s/server/psa.yaml --advertise-address=10.10.10.100 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --encryption-provider-config-automatic-reload=true --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsx)(r.p,{children:"By default, K3s automatically provides the etcd certificate authority file.\nIt is generated and located at /var/lib/rancher/k3s/server/tls/client-ca.crt.\nIf for some reason you need to provide your own ca certificate, look at using the k3s certificate command line tool.\nIf this check fails, edit the K3s config file /etc/rancher/k3s/config.yaml and remove any lines like below."}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{children:'kube-apiserver-arg:\n - "etcd-cafile="\n'})})]}),"\n",(0,t.jsx)(r.h3,{id:"1228-ensure-that-the---encryption-provider-config-argument-is-set-as-appropriate-manual",children:"1.2.28 Ensure that the --encryption-provider-config argument is set as appropriate (Manual)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'encryption-provider-config'\n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," '--encryption-provider-config' is present"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:'Aug 09 19:06:17 server-0 k3s[2357]: time="2024-08-09T19:06:17Z" level=info msg="Running kube-apiserver --admission-control-config-file=/var/lib/rancher/k3s/server/psa.yaml --advertise-address=10.10.10.100 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --encryption-provider-config-automatic-reload=true --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsx)(r.p,{children:"K3s can be configured to use encryption providers to encrypt secrets at rest.\nEdit the K3s config file /etc/rancher/k3s/config.yaml on the control plane node and set the below parameter.\nsecrets-encryption: true\nSecrets encryption can then be managed with the k3s secrets-encrypt command line tool.\nIf needed, you can find the generated encryption config at /var/lib/rancher/k3s/server/cred/encryption-config.json."})]}),"\n",(0,t.jsx)(r.h3,{id:"1229-ensure-that-encryption-providers-are-appropriately-configured-manual",children:"1.2.29 Ensure that encryption providers are appropriately configured (Manual)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"ENCRYPTION_PROVIDER_CONFIG=$(journalctl -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep -- --encryption-provider-config | sed 's%.*encryption-provider-config[= ]\\([^ ]*\\).*%\\1%')\nif test -e $ENCRYPTION_PROVIDER_CONFIG; then grep -o 'providers\\\"\\:\\[.*\\]' $ENCRYPTION_PROVIDER_CONFIG | grep -o \"[A-Za-z]*\" | head -2 | tail -1 | sed 's/^/provider=/'; fi\n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," 'provider' contains valid elements from 'aescbc,kms,secretbox'"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:"provider=aescbc\n"})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsx)(r.p,{children:"K3s can be configured to use encryption providers to encrypt secrets at rest. K3s will utilize the aescbc provider.\nEdit the K3s config file /etc/rancher/k3s/config.yaml on the control plane node and set the below parameter.\nsecrets-encryption: true\nSecrets encryption can then be managed with the k3s secrets-encrypt command line tool.\nIf needed, you can find the generated encryption config at /var/lib/rancher/k3s/server/cred/encryption-config.json"})]}),"\n",(0,t.jsx)(r.h3,{id:"1230-ensure-that-the-api-server-only-makes-use-of-strong-cryptographic-ciphers-automated",children:"1.2.30 Ensure that the API Server only makes use of Strong Cryptographic Ciphers (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"journalctl -D /var/log/journal -u k3s | grep 'Running kube-apiserver' | tail -n1 | grep 'tls-cipher-suites'\n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," '--tls-cipher-suites' contains valid elements from 'TLS_AES_128_GCM_SHA256,TLS_AES_256_GCM_SHA384,TLS_CHACHA20_POLY1305_SHA256,TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256,TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256,TLS_RSA_WITH_3DES_EDE_CBC_SHA,TLS_RSA_WITH_AES_128_CBC_SHA,TLS_RSA_WITH_AES_128_GCM_SHA256,TLS_RSA_WITH_AES_256_CBC_SHA,TLS_RSA_WITH_AES_256_GCM_SHA384'"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:'Aug 09 19:06:17 server-0 k3s[2357]: time="2024-08-09T19:06:17Z" level=info msg="Running kube-apiserver --admission-control-config-file=/var/lib/rancher/k3s/server/psa.yaml --advertise-address=10.10.10.100 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --encryption-provider-config-automatic-reload=true --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsxs)(r.p,{children:["By default, the K3s kube-apiserver complies with this test. Changes to these values may cause regression, therefore ensure that all apiserver clients support the new TLS configuration before applying it in production deployments.\nIf a custom TLS configuration is required, consider also creating a custom version of this rule that aligns with your requirements.\nIf this check fails, remove any custom configuration around ",(0,t.jsx)(r.code,{children:"tls-cipher-suites"})," or update the /etc/rancher/k3s/config.yaml file to match the default by adding the following:"]}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{children:'kube-apiserver-arg:\n - "tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305"\n'})})]}),"\n",(0,t.jsx)(r.h2,{id:"13-controller-manager",children:"1.3 Controller Manager"}),"\n",(0,t.jsx)(r.h3,{id:"131-ensure-that-the---terminated-pod-gc-threshold-argument-is-set-as-appropriate-manual",children:"1.3.1 Ensure that the --terminated-pod-gc-threshold argument is set as appropriate (Manual)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s | grep 'Running kube-controller-manager' | tail -n1 | grep 'terminated-pod-gc-threshold'\n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," '--terminated-pod-gc-threshold' is present"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:'Aug 09 19:06:17 server-0 k3s[2357]: time="2024-08-09T19:06:17Z" level=info msg="Running kube-controller-manager --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/k3s/server/tls/client-ca.nochain.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/k3s/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/k3s/server/tls/client-ca.nochain.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/k3s/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/k3s/server/tls/server-ca.nochain.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/k3s/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/k3s/server/tls/server-ca.nochain.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/k3s/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,tokencleaner,-service,-route,-cloud-node-lifecycle --kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/k3s/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --terminated-pod-gc-threshold=10 --use-service-account-credentials=true"\n'})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsx)(r.p,{children:"Edit the K3s config file /etc/rancher/k3s/config.yaml on the control plane node\nand set the --terminated-pod-gc-threshold to an appropriate threshold,"}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{children:'kube-controller-manager-arg:\n - "terminated-pod-gc-threshold=10"\n'})})]}),"\n",(0,t.jsx)(r.h3,{id:"132-ensure-that-the---profiling-argument-is-set-to-false-automated",children:"1.3.2 Ensure that the --profiling argument is set to false (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s | grep 'Running kube-controller-manager' | tail -n1 | grep 'profiling'\n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," '--profiling' is equal to 'false'"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:'Aug 09 19:06:17 server-0 k3s[2357]: time="2024-08-09T19:06:17Z" level=info msg="Running kube-controller-manager --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/k3s/server/tls/client-ca.nochain.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/k3s/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/k3s/server/tls/client-ca.nochain.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/k3s/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/k3s/server/tls/server-ca.nochain.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/k3s/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/k3s/server/tls/server-ca.nochain.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/k3s/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,tokencleaner,-service,-route,-cloud-node-lifecycle --kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/k3s/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --terminated-pod-gc-threshold=10 --use-service-account-credentials=true"\n'})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsx)(r.p,{children:"By default, K3s sets the --profiling argument to false.\nIf this check fails, edit the K3s config file /etc/rancher/k3s/config.yaml and remove any lines like below."}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{children:'kube-controller-manager-arg:\n - "profiling=true"\n'})})]}),"\n",(0,t.jsx)(r.h3,{id:"133-ensure-that-the---use-service-account-credentials-argument-is-set-to-true-automated",children:"1.3.3 Ensure that the --use-service-account-credentials argument is set to true (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s | grep 'Running kube-controller-manager' | tail -n1 | grep 'use-service-account-credentials'\n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," '--use-service-account-credentials' is not equal to 'false'"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:'Aug 09 19:06:17 server-0 k3s[2357]: time="2024-08-09T19:06:17Z" level=info msg="Running kube-controller-manager --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/k3s/server/tls/client-ca.nochain.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/k3s/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/k3s/server/tls/client-ca.nochain.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/k3s/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/k3s/server/tls/server-ca.nochain.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/k3s/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/k3s/server/tls/server-ca.nochain.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/k3s/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,tokencleaner,-service,-route,-cloud-node-lifecycle --kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/k3s/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --terminated-pod-gc-threshold=10 --use-service-account-credentials=true"\n'})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsx)(r.p,{children:"By default, K3s sets the --use-service-account-credentials argument to true.\nIf this check fails, edit the K3s config file /etc/rancher/k3s/config.yaml and remove any lines like below."}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{children:'kube-controller-manager-arg:\n - "use-service-account-credentials=false"\n'})})]}),"\n",(0,t.jsx)(r.h3,{id:"134-ensure-that-the---service-account-private-key-file-argument-is-set-as-appropriate-automated",children:"1.3.4 Ensure that the --service-account-private-key-file argument is set as appropriate (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s | grep 'Running kube-controller-manager' | tail -n1 | grep 'service-account-private-key-file'\n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," '--service-account-private-key-file' is present"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:'Aug 09 19:06:17 server-0 k3s[2357]: time="2024-08-09T19:06:17Z" level=info msg="Running kube-controller-manager --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/k3s/server/tls/client-ca.nochain.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/k3s/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/k3s/server/tls/client-ca.nochain.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/k3s/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/k3s/server/tls/server-ca.nochain.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/k3s/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/k3s/server/tls/server-ca.nochain.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/k3s/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,tokencleaner,-service,-route,-cloud-node-lifecycle --kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/k3s/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --terminated-pod-gc-threshold=10 --use-service-account-credentials=true"\n'})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsx)(r.p,{children:"By default, K3s automatically provides the service account private key file.\nIt is generated and located at /var/lib/rancher/k3s/server/tls/service.current.key.\nIf this check fails, edit the K3s config file /etc/rancher/k3s/config.yaml and remove any lines like below."}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{children:'kube-controller-manager-arg:\n - "service-account-private-key-file="\n'})})]}),"\n",(0,t.jsx)(r.h3,{id:"135-ensure-that-the---root-ca-file-argument-is-set-as-appropriate-automated",children:"1.3.5 Ensure that the --root-ca-file argument is set as appropriate (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s | grep 'Running kube-controller-manager' | tail -n1 | grep 'root-ca-file'\n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," '--root-ca-file' is present"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:'Aug 09 19:06:17 server-0 k3s[2357]: time="2024-08-09T19:06:17Z" level=info msg="Running kube-controller-manager --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/k3s/server/tls/client-ca.nochain.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/k3s/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/k3s/server/tls/client-ca.nochain.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/k3s/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/k3s/server/tls/server-ca.nochain.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/k3s/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/k3s/server/tls/server-ca.nochain.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/k3s/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,tokencleaner,-service,-route,-cloud-node-lifecycle --kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/k3s/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --terminated-pod-gc-threshold=10 --use-service-account-credentials=true"\n'})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsx)(r.p,{children:"By default, K3s automatically provides the root CA file.\nIt is generated and located at /var/lib/rancher/k3s/server/tls/server-ca.crt.\nIf for some reason you need to provide your own ca certificate, look at using the k3s certificate command line tool.\nIf this check fails, edit the K3s config file /etc/rancher/k3s/config.yaml and remove any lines like below."}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{children:'kube-controller-manager-arg:\n - "root-ca-file="\n'})})]}),"\n",(0,t.jsx)(r.h3,{id:"136-ensure-that-the-rotatekubeletservercertificate-argument-is-set-to-true-automated",children:"1.3.6 Ensure that the RotateKubeletServerCertificate argument is set to true (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s | grep 'Running kube-controller-manager' | tail -n1\n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," '--feature-gates' is present OR '--feature-gates' is not present"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:'Aug 09 19:06:17 server-0 k3s[2357]: time="2024-08-09T19:06:17Z" level=info msg="Running kube-controller-manager --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/k3s/server/tls/client-ca.nochain.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/k3s/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/k3s/server/tls/client-ca.nochain.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/k3s/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/k3s/server/tls/server-ca.nochain.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/k3s/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/k3s/server/tls/server-ca.nochain.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/k3s/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,tokencleaner,-service,-route,-cloud-node-lifecycle --kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/k3s/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --terminated-pod-gc-threshold=10 --use-service-account-credentials=true"\n'})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsx)(r.p,{children:"By default, K3s does not set the RotateKubeletServerCertificate feature gate.\nIf you have enabled this feature gate, you should remove it.\nIf this check fails, edit the K3s config file /etc/rancher/k3s/config.yaml, remove any lines like below."}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{children:'kube-controller-manager-arg:\n - "feature-gate=RotateKubeletServerCertificate"\n'})})]}),"\n",(0,t.jsx)(r.h3,{id:"137-ensure-that-the---bind-address-argument-is-set-to-127001-automated",children:"1.3.7 Ensure that the --bind-address argument is set to 127.0.0.1 (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s | grep 'Running kube-controller-manager' | tail -n1\n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," '--bind-address' is equal to '127.0.0.1' OR '--bind-address' is not present"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:'Aug 09 19:06:17 server-0 k3s[2357]: time="2024-08-09T19:06:17Z" level=info msg="Running kube-controller-manager --allocate-node-cidrs=true --authentication-kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --authorization-kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --bind-address=127.0.0.1 --cluster-cidr=10.42.0.0/16 --cluster-signing-kube-apiserver-client-cert-file=/var/lib/rancher/k3s/server/tls/client-ca.nochain.crt --cluster-signing-kube-apiserver-client-key-file=/var/lib/rancher/k3s/server/tls/client-ca.key --cluster-signing-kubelet-client-cert-file=/var/lib/rancher/k3s/server/tls/client-ca.nochain.crt --cluster-signing-kubelet-client-key-file=/var/lib/rancher/k3s/server/tls/client-ca.key --cluster-signing-kubelet-serving-cert-file=/var/lib/rancher/k3s/server/tls/server-ca.nochain.crt --cluster-signing-kubelet-serving-key-file=/var/lib/rancher/k3s/server/tls/server-ca.key --cluster-signing-legacy-unknown-cert-file=/var/lib/rancher/k3s/server/tls/server-ca.nochain.crt --cluster-signing-legacy-unknown-key-file=/var/lib/rancher/k3s/server/tls/server-ca.key --configure-cloud-routes=false --controllers=*,tokencleaner,-service,-route,-cloud-node-lifecycle --kubeconfig=/var/lib/rancher/k3s/server/cred/controller.kubeconfig --profiling=false --root-ca-file=/var/lib/rancher/k3s/server/tls/server-ca.crt --secure-port=10257 --service-account-private-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --terminated-pod-gc-threshold=10 --use-service-account-credentials=true"\n'})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsx)(r.p,{children:"By default, K3s sets the --bind-address argument to 127.0.0.1\nIf this check fails, edit the K3s config file /etc/rancher/k3s/config.yaml and remove any lines like below."}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{children:'kube-controller-manager-arg:\n - "bind-address="\n'})})]}),"\n",(0,t.jsx)(r.h2,{id:"14-scheduler",children:"1.4 Scheduler"}),"\n",(0,t.jsx)(r.h3,{id:"141-ensure-that-the---profiling-argument-is-set-to-false-automated",children:"1.4.1 Ensure that the --profiling argument is set to false (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"journalctl -D /var/log/journal -u k3s | grep 'Running kube-scheduler' | tail -n1 | grep 'profiling'\n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," '--profiling' is equal to 'false'"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:'Aug 09 19:06:17 server-0 k3s[2357]: time="2024-08-09T19:06:17Z" level=info msg="Running kube-scheduler --authentication-kubeconfig=/var/lib/rancher/k3s/server/cred/scheduler.kubeconfig --authorization-kubeconfig=/var/lib/rancher/k3s/server/cred/scheduler.kubeconfig --bind-address=127.0.0.1 --kubeconfig=/var/lib/rancher/k3s/server/cred/scheduler.kubeconfig --profiling=false --secure-port=10259"\n'})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsx)(r.p,{children:"By default, K3s sets the --profiling argument to false.\nIf this check fails, edit the K3s config file /etc/rancher/k3s/config.yaml and remove any lines like below."}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{children:'kube-scheduler-arg:\n - "profiling=true"\n'})})]}),"\n",(0,t.jsx)(r.h3,{id:"142-ensure-that-the---bind-address-argument-is-set-to-127001-automated",children:"1.4.2 Ensure that the --bind-address argument is set to 127.0.0.1 (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s | grep 'Running kube-scheduler' | tail -n1 | grep 'bind-address'\n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," '--bind-address' is equal to '127.0.0.1' OR '--bind-address' is not present"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:'Aug 09 19:06:17 server-0 k3s[2357]: time="2024-08-09T19:06:17Z" level=info msg="Running kube-scheduler --authentication-kubeconfig=/var/lib/rancher/k3s/server/cred/scheduler.kubeconfig --authorization-kubeconfig=/var/lib/rancher/k3s/server/cred/scheduler.kubeconfig --bind-address=127.0.0.1 --kubeconfig=/var/lib/rancher/k3s/server/cred/scheduler.kubeconfig --profiling=false --secure-port=10259"\n'})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsx)(r.p,{children:"By default, K3s sets the --bind-address argument to 127.0.0.1\nIf this check fails, edit the K3s config file /etc/rancher/k3s/config.yaml and remove any lines like below."}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{children:'kube-scheduler-arg:\n - "bind-address="\n'})})]}),"\n",(0,t.jsx)(r.h2,{id:"2-etcd-node-configuration",children:"2 Etcd Node Configuration"}),"\n",(0,t.jsx)(r.h3,{id:"21-ensure-that-the---cert-file-and---key-file-arguments-are-set-as-appropriate-automated",children:"2.1 Ensure that the --cert-file and --key-file arguments are set as appropriate (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," '.client-transport-security.cert-file' is equal to '/var/lib/rancher/k3s/server/tls/etcd/server-client.crt' AND '.client-transport-security.key-file' is equal to '/var/lib/rancher/k3s/server/tls/etcd/server-client.key'"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:"advertise-client-urls: https://10.10.10.100:2379\nclient-transport-security:\n cert-file: /var/lib/rancher/k3s/server/tls/etcd/server-client.crt\n client-cert-auth: true\n key-file: /var/lib/rancher/k3s/server/tls/etcd/server-client.key\n trusted-ca-file: /var/lib/rancher/k3s/server/tls/etcd/server-ca.crt\ndata-dir: /var/lib/rancher/k3s/server/db/etcd\nelection-timeout: 5000\nexperimental-initial-corrupt-check: true\nexperimental-watch-progress-notify-interval: 5000000000\nheartbeat-interval: 500\ninitial-advertise-peer-urls: https://10.10.10.100:2380\ninitial-cluster: server-0-11120bb0=https://10.10.10.100:2380\ninitial-cluster-state: new\nlisten-client-http-urls: https://127.0.0.1:2382\nlisten-client-urls: https://127.0.0.1:2379,https://10.10.10.100:2379\nlisten-metrics-urls: http://127.0.0.1:2381\nlisten-peer-urls: https://127.0.0.1:2380,https://10.10.10.100:2380\nlog-outputs:\n- stderr\nlogger: zap\nname: server-0-11120bb0\npeer-transport-security:\n cert-file: /var/lib/rancher/k3s/server/tls/etcd/peer-server-client.crt\n client-cert-auth: true\n key-file: /var/lib/rancher/k3s/server/tls/etcd/peer-server-client.key\n trusted-ca-file: /var/lib/rancher/k3s/server/tls/etcd/peer-ca.crt\nsnapshot-count: 10000\n"})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsx)(r.p,{children:"If running on with sqlite or a external DB, etcd checks are Not Applicable.\nWhen running with embedded-etcd, K3s generates cert and key files for etcd.\nThese are located in /var/lib/rancher/k3s/server/tls/etcd/.\nIf this check fails, ensure that the configuration file /var/lib/rancher/k3s/server/db/etcd/config\nhas not been modified to use custom cert and key files."})]}),"\n",(0,t.jsx)(r.h3,{id:"22-ensure-that-the---client-cert-auth-argument-is-set-to-true-automated",children:"2.2 Ensure that the --client-cert-auth argument is set to true (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," '.client-transport-security.client-cert-auth' is equal to 'true'"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:"advertise-client-urls: https://10.10.10.100:2379\nclient-transport-security:\n cert-file: /var/lib/rancher/k3s/server/tls/etcd/server-client.crt\n client-cert-auth: true\n key-file: /var/lib/rancher/k3s/server/tls/etcd/server-client.key\n trusted-ca-file: /var/lib/rancher/k3s/server/tls/etcd/server-ca.crt\ndata-dir: /var/lib/rancher/k3s/server/db/etcd\nelection-timeout: 5000\nexperimental-initial-corrupt-check: true\nexperimental-watch-progress-notify-interval: 5000000000\nheartbeat-interval: 500\ninitial-advertise-peer-urls: https://10.10.10.100:2380\ninitial-cluster: server-0-11120bb0=https://10.10.10.100:2380\ninitial-cluster-state: new\nlisten-client-http-urls: https://127.0.0.1:2382\nlisten-client-urls: https://127.0.0.1:2379,https://10.10.10.100:2379\nlisten-metrics-urls: http://127.0.0.1:2381\nlisten-peer-urls: https://127.0.0.1:2380,https://10.10.10.100:2380\nlog-outputs:\n- stderr\nlogger: zap\nname: server-0-11120bb0\npeer-transport-security:\n cert-file: /var/lib/rancher/k3s/server/tls/etcd/peer-server-client.crt\n client-cert-auth: true\n key-file: /var/lib/rancher/k3s/server/tls/etcd/peer-server-client.key\n trusted-ca-file: /var/lib/rancher/k3s/server/tls/etcd/peer-ca.crt\nsnapshot-count: 10000\n"})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsx)(r.p,{children:"If running on with sqlite or a external DB, etcd checks are Not Applicable.\nWhen running with embedded-etcd, K3s sets the --client-cert-auth parameter to true.\nIf this check fails, ensure that the configuration file /var/lib/rancher/k3s/server/db/etcd/config\nhas not been modified to disable client certificate authentication."})]}),"\n",(0,t.jsx)(r.h3,{id:"23-ensure-that-the---auto-tls-argument-is-not-set-to-true-automated",children:"2.3 Ensure that the --auto-tls argument is not set to true (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," '.client-transport-security.auto-tls' is present OR '.client-transport-security.auto-tls' is not present"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:"advertise-client-urls: https://10.10.10.100:2379\nclient-transport-security:\n cert-file: /var/lib/rancher/k3s/server/tls/etcd/server-client.crt\n client-cert-auth: true\n key-file: /var/lib/rancher/k3s/server/tls/etcd/server-client.key\n trusted-ca-file: /var/lib/rancher/k3s/server/tls/etcd/server-ca.crt\ndata-dir: /var/lib/rancher/k3s/server/db/etcd\nelection-timeout: 5000\nexperimental-initial-corrupt-check: true\nexperimental-watch-progress-notify-interval: 5000000000\nheartbeat-interval: 500\ninitial-advertise-peer-urls: https://10.10.10.100:2380\ninitial-cluster: server-0-11120bb0=https://10.10.10.100:2380\ninitial-cluster-state: new\nlisten-client-http-urls: https://127.0.0.1:2382\nlisten-client-urls: https://127.0.0.1:2379,https://10.10.10.100:2379\nlisten-metrics-urls: http://127.0.0.1:2381\nlisten-peer-urls: https://127.0.0.1:2380,https://10.10.10.100:2380\nlog-outputs:\n- stderr\nlogger: zap\nname: server-0-11120bb0\npeer-transport-security:\n cert-file: /var/lib/rancher/k3s/server/tls/etcd/peer-server-client.crt\n client-cert-auth: true\n key-file: /var/lib/rancher/k3s/server/tls/etcd/peer-server-client.key\n trusted-ca-file: /var/lib/rancher/k3s/server/tls/etcd/peer-ca.crt\nsnapshot-count: 10000\n"})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsx)(r.p,{children:"If running on with sqlite or a external DB, etcd checks are Not Applicable.\nWhen running with embedded-etcd, K3s does not set the --auto-tls parameter.\nIf this check fails, edit the etcd pod specification file /var/lib/rancher/k3s/server/db/etcd/config on the master\nnode and either remove the --auto-tls parameter or set it to false.\nclient-transport-security:\nauto-tls: false"})]}),"\n",(0,t.jsx)(r.h3,{id:"24-ensure-that-the---peer-cert-file-and---peer-key-file-arguments-are-set-as-appropriate-automated",children:"2.4 Ensure that the --peer-cert-file and --peer-key-file arguments are set as appropriate (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," '.peer-transport-security.cert-file' is equal to '/var/lib/rancher/k3s/server/tls/etcd/peer-server-client.crt' AND '.peer-transport-security.key-file' is equal to '/var/lib/rancher/k3s/server/tls/etcd/peer-server-client.key'"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:"advertise-client-urls: https://10.10.10.100:2379\nclient-transport-security:\n cert-file: /var/lib/rancher/k3s/server/tls/etcd/server-client.crt\n client-cert-auth: true\n key-file: /var/lib/rancher/k3s/server/tls/etcd/server-client.key\n trusted-ca-file: /var/lib/rancher/k3s/server/tls/etcd/server-ca.crt\ndata-dir: /var/lib/rancher/k3s/server/db/etcd\nelection-timeout: 5000\nexperimental-initial-corrupt-check: true\nexperimental-watch-progress-notify-interval: 5000000000\nheartbeat-interval: 500\ninitial-advertise-peer-urls: https://10.10.10.100:2380\ninitial-cluster: server-0-11120bb0=https://10.10.10.100:2380\ninitial-cluster-state: new\nlisten-client-http-urls: https://127.0.0.1:2382\nlisten-client-urls: https://127.0.0.1:2379,https://10.10.10.100:2379\nlisten-metrics-urls: http://127.0.0.1:2381\nlisten-peer-urls: https://127.0.0.1:2380,https://10.10.10.100:2380\nlog-outputs:\n- stderr\nlogger: zap\nname: server-0-11120bb0\npeer-transport-security:\n cert-file: /var/lib/rancher/k3s/server/tls/etcd/peer-server-client.crt\n client-cert-auth: true\n key-file: /var/lib/rancher/k3s/server/tls/etcd/peer-server-client.key\n trusted-ca-file: /var/lib/rancher/k3s/server/tls/etcd/peer-ca.crt\nsnapshot-count: 10000\n"})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsx)(r.p,{children:"If running on with sqlite or a external DB, etcd checks are Not Applicable.\nWhen running with embedded-etcd, K3s generates peer cert and key files for etcd.\nThese are located in /var/lib/rancher/k3s/server/tls/etcd/.\nIf this check fails, ensure that the configuration file /var/lib/rancher/k3s/server/db/etcd/config\nhas not been modified to use custom peer cert and key files."})]}),"\n",(0,t.jsx)(r.h3,{id:"25-ensure-that-the---peer-client-cert-auth-argument-is-set-to-true-automated",children:"2.5 Ensure that the --peer-client-cert-auth argument is set to true (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," '.peer-transport-security.client-cert-auth' is equal to 'true'"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:"advertise-client-urls: https://10.10.10.100:2379\nclient-transport-security:\n cert-file: /var/lib/rancher/k3s/server/tls/etcd/server-client.crt\n client-cert-auth: true\n key-file: /var/lib/rancher/k3s/server/tls/etcd/server-client.key\n trusted-ca-file: /var/lib/rancher/k3s/server/tls/etcd/server-ca.crt\ndata-dir: /var/lib/rancher/k3s/server/db/etcd\nelection-timeout: 5000\nexperimental-initial-corrupt-check: true\nexperimental-watch-progress-notify-interval: 5000000000\nheartbeat-interval: 500\ninitial-advertise-peer-urls: https://10.10.10.100:2380\ninitial-cluster: server-0-11120bb0=https://10.10.10.100:2380\ninitial-cluster-state: new\nlisten-client-http-urls: https://127.0.0.1:2382\nlisten-client-urls: https://127.0.0.1:2379,https://10.10.10.100:2379\nlisten-metrics-urls: http://127.0.0.1:2381\nlisten-peer-urls: https://127.0.0.1:2380,https://10.10.10.100:2380\nlog-outputs:\n- stderr\nlogger: zap\nname: server-0-11120bb0\npeer-transport-security:\n cert-file: /var/lib/rancher/k3s/server/tls/etcd/peer-server-client.crt\n client-cert-auth: true\n key-file: /var/lib/rancher/k3s/server/tls/etcd/peer-server-client.key\n trusted-ca-file: /var/lib/rancher/k3s/server/tls/etcd/peer-ca.crt\nsnapshot-count: 10000\n"})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsx)(r.p,{children:"If running on with sqlite or a external DB, etcd checks are Not Applicable.\nWhen running with embedded-etcd, K3s sets the --peer-cert-auth parameter to true.\nIf this check fails, ensure that the configuration file /var/lib/rancher/k3s/server/db/etcd/config\nhas not been modified to disable peer client certificate authentication."})]}),"\n",(0,t.jsx)(r.h3,{id:"26-ensure-that-the---peer-auto-tls-argument-is-not-set-to-true-automated",children:"2.6 Ensure that the --peer-auto-tls argument is not set to true (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," '.peer-transport-security.auto-tls' is present OR '.peer-transport-security.auto-tls' is not present"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:"advertise-client-urls: https://10.10.10.100:2379\nclient-transport-security:\n cert-file: /var/lib/rancher/k3s/server/tls/etcd/server-client.crt\n client-cert-auth: true\n key-file: /var/lib/rancher/k3s/server/tls/etcd/server-client.key\n trusted-ca-file: /var/lib/rancher/k3s/server/tls/etcd/server-ca.crt\ndata-dir: /var/lib/rancher/k3s/server/db/etcd\nelection-timeout: 5000\nexperimental-initial-corrupt-check: true\nexperimental-watch-progress-notify-interval: 5000000000\nheartbeat-interval: 500\ninitial-advertise-peer-urls: https://10.10.10.100:2380\ninitial-cluster: server-0-11120bb0=https://10.10.10.100:2380\ninitial-cluster-state: new\nlisten-client-http-urls: https://127.0.0.1:2382\nlisten-client-urls: https://127.0.0.1:2379,https://10.10.10.100:2379\nlisten-metrics-urls: http://127.0.0.1:2381\nlisten-peer-urls: https://127.0.0.1:2380,https://10.10.10.100:2380\nlog-outputs:\n- stderr\nlogger: zap\nname: server-0-11120bb0\npeer-transport-security:\n cert-file: /var/lib/rancher/k3s/server/tls/etcd/peer-server-client.crt\n client-cert-auth: true\n key-file: /var/lib/rancher/k3s/server/tls/etcd/peer-server-client.key\n trusted-ca-file: /var/lib/rancher/k3s/server/tls/etcd/peer-ca.crt\nsnapshot-count: 10000\n"})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsx)(r.p,{children:"If running on with sqlite or a external DB, etcd checks are Not Applicable.\nWhen running with embedded-etcd, K3s does not set the --peer-auto-tls parameter.\nIf this check fails, edit the etcd pod specification file /var/lib/rancher/k3s/server/db/etcd/config on the master\nnode and either remove the --peer-auto-tls parameter or set it to false.\npeer-transport-security:\nauto-tls: false"})]}),"\n",(0,t.jsx)(r.h3,{id:"27-ensure-that-a-unique-certificate-authority-is-used-for-etcd-automated",children:"2.7 Ensure that a unique Certificate Authority is used for etcd (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," '.peer-transport-security.trusted-ca-file' is equal to '/var/lib/rancher/k3s/server/tls/etcd/peer-ca.crt'"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:"advertise-client-urls: https://10.10.10.100:2379\nclient-transport-security:\n cert-file: /var/lib/rancher/k3s/server/tls/etcd/server-client.crt\n client-cert-auth: true\n key-file: /var/lib/rancher/k3s/server/tls/etcd/server-client.key\n trusted-ca-file: /var/lib/rancher/k3s/server/tls/etcd/server-ca.crt\ndata-dir: /var/lib/rancher/k3s/server/db/etcd\nelection-timeout: 5000\nexperimental-initial-corrupt-check: true\nexperimental-watch-progress-notify-interval: 5000000000\nheartbeat-interval: 500\ninitial-advertise-peer-urls: https://10.10.10.100:2380\ninitial-cluster: server-0-11120bb0=https://10.10.10.100:2380\ninitial-cluster-state: new\nlisten-client-http-urls: https://127.0.0.1:2382\nlisten-client-urls: https://127.0.0.1:2379,https://10.10.10.100:2379\nlisten-metrics-urls: http://127.0.0.1:2381\nlisten-peer-urls: https://127.0.0.1:2380,https://10.10.10.100:2380\nlog-outputs:\n- stderr\nlogger: zap\nname: server-0-11120bb0\npeer-transport-security:\n cert-file: /var/lib/rancher/k3s/server/tls/etcd/peer-server-client.crt\n client-cert-auth: true\n key-file: /var/lib/rancher/k3s/server/tls/etcd/peer-server-client.key\n trusted-ca-file: /var/lib/rancher/k3s/server/tls/etcd/peer-ca.crt\nsnapshot-count: 10000\n"})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsx)(r.p,{children:"If running on with sqlite or a external DB, etcd checks are Not Applicable.\nWhen running with embedded-etcd, K3s generates a unique certificate authority for etcd.\nThis is located at /var/lib/rancher/k3s/server/tls/etcd/peer-ca.crt.\nIf this check fails, ensure that the configuration file /var/lib/rancher/k3s/server/db/etcd/config\nhas not been modified to use a shared certificate authority."})]}),"\n",(0,t.jsx)(r.h2,{id:"41-worker-node-configuration-files",children:"4.1 Worker Node Configuration Files"}),"\n",(0,t.jsx)(r.h3,{id:"411-ensure-that-the-kubelet-service-file-permissions-are-set-to-600-or-more-restrictive-automated",children:"4.1.1 Ensure that the kubelet service file permissions are set to 600 or more restrictive (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," Not Applicable"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Rationale:"})}),"\n",(0,t.jsx)(r.p,{children:"The kubelet is embedded in the k3s process. There is no kubelet service file, all configuration is passed in as arguments at runtime."}),"\n",(0,t.jsxs)(r.h3,{id:"412-ensure-that-the-kubelet-service-file-ownership-is-set-to-root-automated",children:["4.1.2 Ensure that the kubelet service file ownership is set to root",":root"," (Automated)"]}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," Not Applicable"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Rationale:"})}),"\n",(0,t.jsx)(r.p,{children:"The kubelet is embedded in the k3s process. There is no kubelet service file, all configuration is passed in as arguments at runtime."}),"\n",(0,t.jsx)(r.p,{children:"All configuration is passed in as arguments at container run time."}),"\n",(0,t.jsx)(r.h3,{id:"413-if-proxy-kubeconfig-file-exists-ensure-permissions-are-set-to-600-or-more-restrictive-automated",children:"4.1.3 If proxy kubeconfig file exists ensure permissions are set to 600 or more restrictive (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"/bin/sh -c 'if test -e /var/lib/rancher/k3s/agent/kubeproxy.kubeconfig; then stat -c permissions=%a /var/lib/rancher/k3s/agent/kubeproxy.kubeconfig; fi' \n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," permissions has permissions 600, expected 600 or more restrictive"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:"permissions=600\n"})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsxs)(r.p,{children:["Run the below command (based on the file location on your system) on the each worker node.\nFor example,\n",(0,t.jsx)(r.code,{children:"chmod 600 /var/lib/rancher/k3s/agent/kubeproxy.kubeconfig"})]})]}),"\n",(0,t.jsxs)(r.h3,{id:"414-if-proxy-kubeconfig-file-exists-ensure-ownership-is-set-to-root-automated",children:["4.1.4 If proxy kubeconfig file exists ensure ownership is set to root",":root"," (Automated)"]}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"/bin/sh -c 'if test -e /var/lib/rancher/k3s/agent/kubeproxy.kubeconfig; then stat -c %U:%G /var/lib/rancher/k3s/agent/kubeproxy.kubeconfig; fi' \n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," 'root",":root","' is present"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:"root:root\n"})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsxs)(r.p,{children:["Run the below command (based on the file location on your system) on the each worker node.\nFor example, ",(0,t.jsx)(r.code,{children:"chown root:root /var/lib/rancher/k3s/agent/kubeproxy.kubeconfig"})]})]}),"\n",(0,t.jsx)(r.h3,{id:"415-ensure-that-the---kubeconfig-kubeletconf-file-permissions-are-set-to-600-or-more-restrictive-automated",children:"4.1.5 Ensure that the --kubeconfig kubelet.conf file permissions are set to 600 or more restrictive (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"/bin/sh -c 'if test -e /var/lib/rancher/k3s/agent/kubelet.kubeconfig; then stat -c permissions=%a /var/lib/rancher/k3s/agent/kubelet.kubeconfig; fi' \n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," permissions has permissions 600, expected 600 or more restrictive"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:"permissions=600\n"})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsxs)(r.p,{children:["Run the below command (based on the file location on your system) on the each worker node.\nFor example,\n",(0,t.jsx)(r.code,{children:"chmod 600 /var/lib/rancher/k3s/agent/kubelet.kubeconfig"})]})]}),"\n",(0,t.jsxs)(r.h3,{id:"416-ensure-that-the---kubeconfig-kubeletconf-file-ownership-is-set-to-root-automated",children:["4.1.6 Ensure that the --kubeconfig kubelet.conf file ownership is set to root",":root"," (Automated)"]}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"stat -c %U:%G /var/lib/rancher/k3s/agent/kubelet.kubeconfig\n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," 'root",":root","' is present"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:"root:root\n"})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsxs)(r.p,{children:["Run the below command (based on the file location on your system) on the each worker node.\nFor example,\n",(0,t.jsx)(r.code,{children:"chown root:root /var/lib/rancher/k3s/agent/kubelet.kubeconfig"})]})]}),"\n",(0,t.jsx)(r.h3,{id:"417-ensure-that-the-certificate-authorities-file-permissions-are-set-to-600-or-more-restrictive-automated",children:"4.1.7 Ensure that the certificate authorities file permissions are set to 600 or more restrictive (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"stat -c permissions=%a /var/lib/rancher/k3s/agent/client-ca.crt\n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," permissions has permissions 600, expected 600 or more restrictive"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:"permissions=600\n"})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsxs)(r.p,{children:["Run the following command to modify the file permissions of the\n--client-ca-file ",(0,t.jsx)(r.code,{children:"chmod 600 /var/lib/rancher/k3s/agent/client-ca.crt"})]})]}),"\n",(0,t.jsxs)(r.h3,{id:"418-ensure-that-the-client-certificate-authorities-file-ownership-is-set-to-root-automated",children:["4.1.8 Ensure that the client certificate authorities file ownership is set to root",":root"," (Automated)"]}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"stat -c %U:%G /var/lib/rancher/k3s/agent/client-ca.crt\n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," 'root",":root","' is equal to 'root",":root","'"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:"root:root\n"})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsxs)(r.p,{children:["Run the following command to modify the ownership of the --client-ca-file.\n",(0,t.jsx)(r.code,{children:"chown root:root /var/lib/rancher/k3s/agent/client-ca.crt"})]})]}),"\n",(0,t.jsx)(r.h3,{id:"419-ensure-that-the-kubelet---config-configuration-file-has-permissions-set-to-600-or-more-restrictive-automated",children:"4.1.9 Ensure that the kubelet --config configuration file has permissions set to 600 or more restrictive (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," Not Applicable"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Rationale:"})}),"\n",(0,t.jsx)(r.p,{children:"The kubelet is embedded in the k3s process. There is no kubelet config file, all configuration is passed in as arguments at runtime."}),"\n",(0,t.jsxs)(r.h3,{id:"4110-ensure-that-the-kubelet---config-configuration-file-ownership-is-set-to-root-automated",children:["4.1.10 Ensure that the kubelet --config configuration file ownership is set to root",":root"," (Automated)"]}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," Not Applicable"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Rationale:"})}),"\n",(0,t.jsx)(r.p,{children:"The kubelet is embedded in the k3s process. There is no kubelet config file, all configuration is passed in as arguments at runtime."}),"\n",(0,t.jsx)(r.h2,{id:"42-kubelet",children:"4.2 Kubelet"}),"\n",(0,t.jsx)(r.h3,{id:"421-ensure-that-the---anonymous-auth-argument-is-set-to-false-automated",children:"4.2.1 Ensure that the --anonymous-auth argument is set to false (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:'/bin/sh -c \'if test $(journalctl -D /var/log/journal -u k3s | grep "Running kube-apiserver" | wc -l) -gt 0; then journalctl -D /var/log/journal -u k3s | grep "Running kube-apiserver" | tail -n1 | grep "anonymous-auth" | grep -v grep; else echo "--anonymous-auth=false"; fi\' \n'})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," '--anonymous-auth' is equal to 'false'"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:'Aug 09 19:06:17 server-0 k3s[2357]: time="2024-08-09T19:06:17Z" level=info msg="Running kube-apiserver --admission-control-config-file=/var/lib/rancher/k3s/server/psa.yaml --advertise-address=10.10.10.100 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --encryption-provider-config-automatic-reload=true --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsx)(r.p,{children:"By default, K3s sets the --anonymous-auth to false. If you have set this to a different value, you\nshould set it back to false. If using the K3s config file /etc/rancher/k3s/config.yaml, remove any lines similar to below."}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{children:'kubelet-arg:\n - "anonymous-auth=true"\n'})}),(0,t.jsx)(r.p,{children:'If using the command line, edit the K3s service file and remove the below argument.\n--kubelet-arg="anonymous-auth=true"\nBased on your system, restart the k3s service. For example,\nsystemctl daemon-reload\nsystemctl restart k3s.service'})]}),"\n",(0,t.jsx)(r.h3,{id:"422-ensure-that-the---authorization-mode-argument-is-not-set-to-alwaysallow-automated",children:"4.2.2 Ensure that the --authorization-mode argument is not set to AlwaysAllow (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:'/bin/sh -c \'if test $(journalctl -D /var/log/journal -u k3s | grep "Running kube-apiserver" | wc -l) -gt 0; then journalctl -D /var/log/journal -u k3s | grep "Running kube-apiserver" | tail -n1 | grep "authorization-mode"; else echo "--authorization-mode=Webhook"; fi\' \n'})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," '--authorization-mode' does not have 'AlwaysAllow'"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:'Aug 09 19:06:17 server-0 k3s[2357]: time="2024-08-09T19:06:17Z" level=info msg="Running kube-apiserver --admission-control-config-file=/var/lib/rancher/k3s/server/psa.yaml --advertise-address=10.10.10.100 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --encryption-provider-config-automatic-reload=true --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsx)(r.p,{children:"By default, K3s does not set the --authorization-mode to AlwaysAllow.\nIf using the K3s config file /etc/rancher/k3s/config.yaml, remove any lines similar to below."}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{children:'kubelet-arg:\n - "authorization-mode=AlwaysAllow"\n'})}),(0,t.jsx)(r.p,{children:'If using the command line, edit the K3s service file and remove the below argument.\n--kubelet-arg="authorization-mode=AlwaysAllow"\nBased on your system, restart the k3s service. For example,\nsystemctl daemon-reload\nsystemctl restart k3s.service'})]}),"\n",(0,t.jsx)(r.h3,{id:"423-ensure-that-the---client-ca-file-argument-is-set-as-appropriate-automated",children:"4.2.3 Ensure that the --client-ca-file argument is set as appropriate (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:'/bin/sh -c \'if test $(journalctl -D /var/log/journal -u k3s | grep "Running kube-apiserver" | wc -l) -gt 0; then journalctl -D /var/log/journal -u k3s | grep "Running kube-apiserver" | tail -n1 | grep "client-ca-file"; else echo "--client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt"; fi\' \n'})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," '--client-ca-file' is present"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:'Aug 09 19:06:17 server-0 k3s[2357]: time="2024-08-09T19:06:17Z" level=info msg="Running kube-apiserver --admission-control-config-file=/var/lib/rancher/k3s/server/psa.yaml --advertise-address=10.10.10.100 --advertise-port=6443 --allow-privileged=true --anonymous-auth=false --api-audiences=https://kubernetes.default.svc.cluster.local,k3s --audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=100 --audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log --audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml --authorization-mode=Node,RBAC --bind-address=127.0.0.1 --cert-dir=/var/lib/rancher/k3s/server/tls/temporary-certs --client-ca-file=/var/lib/rancher/k3s/server/tls/client-ca.crt --egress-selector-config-file=/var/lib/rancher/k3s/server/etc/egress-selector-config.yaml --enable-admission-plugins=NodeRestriction --enable-aggregator-routing=true --enable-bootstrap-token-auth=true --encryption-provider-config=/var/lib/rancher/k3s/server/cred/encryption-config.json --encryption-provider-config-automatic-reload=true --etcd-cafile=/var/lib/rancher/k3s/server/tls/etcd/server-ca.crt --etcd-certfile=/var/lib/rancher/k3s/server/tls/etcd/client.crt --etcd-keyfile=/var/lib/rancher/k3s/server/tls/etcd/client.key --etcd-servers=https://127.0.0.1:2379 --kubelet-certificate-authority=/var/lib/rancher/k3s/server/tls/server-ca.crt --kubelet-client-certificate=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.crt --kubelet-client-key=/var/lib/rancher/k3s/server/tls/client-kube-apiserver.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --profiling=false --proxy-client-cert-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.crt --proxy-client-key-file=/var/lib/rancher/k3s/server/tls/client-auth-proxy.key --requestheader-allowed-names=system:auth-proxy --requestheader-client-ca-file=/var/lib/rancher/k3s/server/tls/request-header-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6444 --service-account-issuer=https://kubernetes.default.svc.cluster.local --service-account-key-file=/var/lib/rancher/k3s/server/tls/service.key --service-account-signing-key-file=/var/lib/rancher/k3s/server/tls/service.current.key --service-cluster-ip-range=10.43.0.0/16 --service-node-port-range=30000-32767 --storage-backend=etcd3 --tls-cert-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/server/tls/serving-kube-apiserver.key"\n'})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsx)(r.p,{children:"By default, K3s automatically provides the client ca certificate for the Kubelet.\nIt is generated and located at /var/lib/rancher/k3s/agent/client-ca.crt"})]}),"\n",(0,t.jsx)(r.h3,{id:"424-verify-that-the---read-only-port-argument-is-set-to-0-automated",children:"4.2.4 Verify that the --read-only-port argument is set to 0 (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s -u k3s-agent | grep 'Running kubelet' | tail -n1\n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," '--read-only-port' is equal to '0' OR '--read-only-port' is not present"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:'Aug 09 19:06:19 server-0 k3s[2357]: time="2024-08-09T19:06:19Z" level=info msg="Running kubelet --address=0.0.0.0 --allowed-unsafe-sysctls=net.ipv4.ip_forward,net.ipv6.conf.all.forwarding --anonymous-auth=false --authentication-token-webhook=true --authorization-mode=Webhook --cgroup-driver=systemd --client-ca-file=/var/lib/rancher/k3s/agent/client-ca.crt --cloud-provider=external --cluster-dns=10.43.0.10 --cluster-domain=cluster.local --container-runtime-endpoint=unix:///run/k3s/containerd/containerd.sock --containerd=/run/k3s/containerd/containerd.sock --event-qps=0 --eviction-hard=imagefs.available<5%,nodefs.available<5% --eviction-minimum-reclaim=imagefs.available=10%,nodefs.available=10% --fail-swap-on=false --feature-gates=CloudDualStackNodeIPs=true --healthz-bind-address=127.0.0.1 --hostname-override=server-0 --kubeconfig=/var/lib/rancher/k3s/agent/kubelet.kubeconfig --make-iptables-util-chains=true --node-ip=10.10.10.100 --node-labels= --pod-infra-container-image=rancher/mirrored-pause:3.6 --pod-manifest-path=/var/lib/rancher/k3s/agent/pod-manifests --protect-kernel-defaults=true --read-only-port=0 --resolv-conf=/run/systemd/resolve/resolv.conf --serialize-image-pulls=false --streaming-connection-idle-timeout=5m --tls-cert-file=/var/lib/rancher/k3s/agent/serving-kubelet.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/agent/serving-kubelet.key"\n'})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsx)(r.p,{children:"By default, K3s sets the --read-only-port to 0. If you have set this to a different value, you\nshould set it back to 0. If using the K3s config file /etc/rancher/k3s/config.yaml, remove any lines similar to below."}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{children:'kubelet-arg:\n - "read-only-port=XXXX"\n'})}),(0,t.jsx)(r.p,{children:'If using the command line, edit the K3s service file and remove the below argument.\n--kubelet-arg="read-only-port=XXXX"\nBased on your system, restart the k3s service. For example,\nsystemctl daemon-reload\nsystemctl restart k3s.service'})]}),"\n",(0,t.jsx)(r.h3,{id:"425-ensure-that-the---streaming-connection-idle-timeout-argument-is-not-set-to-0-manual",children:"4.2.5 Ensure that the --streaming-connection-idle-timeout argument is not set to 0 (Manual)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s -u k3s-agent | grep 'Running kubelet' | tail -n1\n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," '--streaming-connection-idle-timeout' is not equal to '0' OR '--streaming-connection-idle-timeout' is not present"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:'Aug 09 19:06:19 server-0 k3s[2357]: time="2024-08-09T19:06:19Z" level=info msg="Running kubelet --address=0.0.0.0 --allowed-unsafe-sysctls=net.ipv4.ip_forward,net.ipv6.conf.all.forwarding --anonymous-auth=false --authentication-token-webhook=true --authorization-mode=Webhook --cgroup-driver=systemd --client-ca-file=/var/lib/rancher/k3s/agent/client-ca.crt --cloud-provider=external --cluster-dns=10.43.0.10 --cluster-domain=cluster.local --container-runtime-endpoint=unix:///run/k3s/containerd/containerd.sock --containerd=/run/k3s/containerd/containerd.sock --event-qps=0 --eviction-hard=imagefs.available<5%,nodefs.available<5% --eviction-minimum-reclaim=imagefs.available=10%,nodefs.available=10% --fail-swap-on=false --feature-gates=CloudDualStackNodeIPs=true --healthz-bind-address=127.0.0.1 --hostname-override=server-0 --kubeconfig=/var/lib/rancher/k3s/agent/kubelet.kubeconfig --make-iptables-util-chains=true --node-ip=10.10.10.100 --node-labels= --pod-infra-container-image=rancher/mirrored-pause:3.6 --pod-manifest-path=/var/lib/rancher/k3s/agent/pod-manifests --protect-kernel-defaults=true --read-only-port=0 --resolv-conf=/run/systemd/resolve/resolv.conf --serialize-image-pulls=false --streaming-connection-idle-timeout=5m --tls-cert-file=/var/lib/rancher/k3s/agent/serving-kubelet.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/agent/serving-kubelet.key"\n'})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsx)(r.p,{children:"If using the K3s config file /etc/rancher/k3s/config.yaml, set the following parameter to an appropriate value."}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{children:'kubelet-arg:\n - "streaming-connection-idle-timeout=5m"\n'})}),(0,t.jsx)(r.p,{children:'If using the command line, run K3s with --kubelet-arg="streaming-connection-idle-timeout=5m".\nBased on your system, restart the k3s service. For example,\nsystemctl restart k3s.service'})]}),"\n",(0,t.jsx)(r.h3,{id:"426-ensure-that-the---make-iptables-util-chains-argument-is-set-to-true-automated",children:"4.2.6 Ensure that the --make-iptables-util-chains argument is set to true (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s -u k3s-agent | grep 'Running kubelet' | tail -n1\n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," '--make-iptables-util-chains' is equal to 'true' OR '--make-iptables-util-chains' is not present"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:'Aug 09 19:06:19 server-0 k3s[2357]: time="2024-08-09T19:06:19Z" level=info msg="Running kubelet --address=0.0.0.0 --allowed-unsafe-sysctls=net.ipv4.ip_forward,net.ipv6.conf.all.forwarding --anonymous-auth=false --authentication-token-webhook=true --authorization-mode=Webhook --cgroup-driver=systemd --client-ca-file=/var/lib/rancher/k3s/agent/client-ca.crt --cloud-provider=external --cluster-dns=10.43.0.10 --cluster-domain=cluster.local --container-runtime-endpoint=unix:///run/k3s/containerd/containerd.sock --containerd=/run/k3s/containerd/containerd.sock --event-qps=0 --eviction-hard=imagefs.available<5%,nodefs.available<5% --eviction-minimum-reclaim=imagefs.available=10%,nodefs.available=10% --fail-swap-on=false --feature-gates=CloudDualStackNodeIPs=true --healthz-bind-address=127.0.0.1 --hostname-override=server-0 --kubeconfig=/var/lib/rancher/k3s/agent/kubelet.kubeconfig --make-iptables-util-chains=true --node-ip=10.10.10.100 --node-labels= --pod-infra-container-image=rancher/mirrored-pause:3.6 --pod-manifest-path=/var/lib/rancher/k3s/agent/pod-manifests --protect-kernel-defaults=true --read-only-port=0 --resolv-conf=/run/systemd/resolve/resolv.conf --serialize-image-pulls=false --streaming-connection-idle-timeout=5m --tls-cert-file=/var/lib/rancher/k3s/agent/serving-kubelet.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/agent/serving-kubelet.key"\n'})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsx)(r.p,{children:"If using the K3s config file /etc/rancher/k3s/config.yaml, set the following parameter."}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{children:'kubelet-arg:\n - "make-iptables-util-chains=true"\n'})}),(0,t.jsx)(r.p,{children:'If using the command line, run K3s with --kubelet-arg="make-iptables-util-chains=true".\nBased on your system, restart the k3s service. For example,\nsystemctl restart k3s.service'})]}),"\n",(0,t.jsx)(r.h3,{id:"427-ensure-that-the---hostname-override-argument-is-not-set-automated",children:"4.2.7 Ensure that the --hostname-override argument is not set (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," Not Applicable"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Rationale:"})}),"\n",(0,t.jsx)(r.p,{children:"By default, K3s does set the --hostname-override argument. Per CIS guidelines, this is to comply\nwith cloud providers that require this flag to ensure that hostname matches node names."}),"\n",(0,t.jsx)(r.h3,{id:"428-ensure-that-the-eventrecordqps-argument-is-set-to-a-level-which-ensures-appropriate-event-capture-manual",children:"4.2.8 Ensure that the eventRecordQPS argument is set to a level which ensures appropriate event capture (Manual)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s -u k3s-agent | grep 'Running kubelet' | tail -n1\n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," '--event-qps' is greater or equal to 0 OR '--event-qps' is not present"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:'Aug 09 19:06:19 server-0 k3s[2357]: time="2024-08-09T19:06:19Z" level=info msg="Running kubelet --address=0.0.0.0 --allowed-unsafe-sysctls=net.ipv4.ip_forward,net.ipv6.conf.all.forwarding --anonymous-auth=false --authentication-token-webhook=true --authorization-mode=Webhook --cgroup-driver=systemd --client-ca-file=/var/lib/rancher/k3s/agent/client-ca.crt --cloud-provider=external --cluster-dns=10.43.0.10 --cluster-domain=cluster.local --container-runtime-endpoint=unix:///run/k3s/containerd/containerd.sock --containerd=/run/k3s/containerd/containerd.sock --event-qps=0 --eviction-hard=imagefs.available<5%,nodefs.available<5% --eviction-minimum-reclaim=imagefs.available=10%,nodefs.available=10% --fail-swap-on=false --feature-gates=CloudDualStackNodeIPs=true --healthz-bind-address=127.0.0.1 --hostname-override=server-0 --kubeconfig=/var/lib/rancher/k3s/agent/kubelet.kubeconfig --make-iptables-util-chains=true --node-ip=10.10.10.100 --node-labels= --pod-infra-container-image=rancher/mirrored-pause:3.6 --pod-manifest-path=/var/lib/rancher/k3s/agent/pod-manifests --protect-kernel-defaults=true --read-only-port=0 --resolv-conf=/run/systemd/resolve/resolv.conf --serialize-image-pulls=false --streaming-connection-idle-timeout=5m --tls-cert-file=/var/lib/rancher/k3s/agent/serving-kubelet.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/agent/serving-kubelet.key"\n'})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsx)(r.p,{children:"By default, K3s sets the event-qps to 0. Should you wish to change this,\nIf using the K3s config file /etc/rancher/k3s/config.yaml, set the following parameter to an appropriate value."}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{children:'kubelet-arg:\n - "event-qps="\n'})}),(0,t.jsx)(r.p,{children:'If using the command line, run K3s with --kubelet-arg="event-qps=".\nBased on your system, restart the k3s service. For example,\nsystemctl restart k3s.service'})]}),"\n",(0,t.jsx)(r.h3,{id:"429-ensure-that-the---tls-cert-file-and---tls-private-key-file-arguments-are-set-as-appropriate-automated",children:"4.2.9 Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s -u k3s-agent | grep 'Running kubelet' | tail -n1\n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," '--tls-cert-file' is present AND '--tls-private-key-file' is present"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:'Aug 09 19:06:19 server-0 k3s[2357]: time="2024-08-09T19:06:19Z" level=info msg="Running kubelet --address=0.0.0.0 --allowed-unsafe-sysctls=net.ipv4.ip_forward,net.ipv6.conf.all.forwarding --anonymous-auth=false --authentication-token-webhook=true --authorization-mode=Webhook --cgroup-driver=systemd --client-ca-file=/var/lib/rancher/k3s/agent/client-ca.crt --cloud-provider=external --cluster-dns=10.43.0.10 --cluster-domain=cluster.local --container-runtime-endpoint=unix:///run/k3s/containerd/containerd.sock --containerd=/run/k3s/containerd/containerd.sock --event-qps=0 --eviction-hard=imagefs.available<5%,nodefs.available<5% --eviction-minimum-reclaim=imagefs.available=10%,nodefs.available=10% --fail-swap-on=false --feature-gates=CloudDualStackNodeIPs=true --healthz-bind-address=127.0.0.1 --hostname-override=server-0 --kubeconfig=/var/lib/rancher/k3s/agent/kubelet.kubeconfig --make-iptables-util-chains=true --node-ip=10.10.10.100 --node-labels= --pod-infra-container-image=rancher/mirrored-pause:3.6 --pod-manifest-path=/var/lib/rancher/k3s/agent/pod-manifests --protect-kernel-defaults=true --read-only-port=0 --resolv-conf=/run/systemd/resolve/resolv.conf --serialize-image-pulls=false --streaming-connection-idle-timeout=5m --tls-cert-file=/var/lib/rancher/k3s/agent/serving-kubelet.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/agent/serving-kubelet.key"\n'})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsx)(r.p,{children:"By default, K3s automatically provides the TLS certificate and private key for the Kubelet.\nThey are generated and located at /var/lib/rancher/k3s/agent/serving-kubelet.crt and /var/lib/rancher/k3s/agent/serving-kubelet.key\nIf for some reason you need to provide your own certificate and key, you can set the\nbelow parameters in the K3s config file /etc/rancher/k3s/config.yaml."}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{children:'kubelet-arg:\n - "tls-cert-file="\n - "tls-private-key-file="\n'})})]}),"\n",(0,t.jsx)(r.h3,{id:"4210-ensure-that-the---rotate-certificates-argument-is-not-set-to-false-automated",children:"4.2.10 Ensure that the --rotate-certificates argument is not set to false (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s -u k3s-agent | grep 'Running kubelet' | tail -n1\n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," '.rotateCertificates' is present OR '.rotateCertificates' is not present"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:"apiVersion: v1\nclusters:\n- cluster:\n server: https://127.0.0.1:6443\n certificate-authority: /var/lib/rancher/k3s/agent/server-ca.crt\n name: local\ncontexts:\n- context:\n cluster: local\n namespace: default\n user: user\n name: Default\ncurrent-context: Default\nkind: Config\npreferences: {}\nusers:\n- name: user\n user:\n client-certificate: /var/lib/rancher/k3s/agent/client-kubelet.crt\n client-key: /var/lib/rancher/k3s/agent/client-kubelet.key\n"})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsxs)(r.p,{children:["By default, K3s does not set the --rotate-certificates argument. If you have set this flag with a value of ",(0,t.jsx)(r.code,{children:"false"}),", you should either set it to ",(0,t.jsx)(r.code,{children:"true"}),' or completely remove the flag.\nIf using the K3s config file /etc/rancher/k3s/config.yaml, remove any rotate-certificates parameter.\nIf using the command line, remove the K3s flag --kubelet-arg="rotate-certificates".\nBased on your system, restart the k3s service. For example,\nsystemctl restart k3s.service']})]}),"\n",(0,t.jsx)(r.h3,{id:"4211-verify-that-the-rotatekubeletservercertificate-argument-is-set-to-true-automated",children:"4.2.11 Verify that the RotateKubeletServerCertificate argument is set to true (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s -u k3s-agent | grep 'Running kubelet' | tail -n1\n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," '.featureGates.RotateKubeletServerCertificate' is present OR '.featureGates.RotateKubeletServerCertificate' is not present"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:"apiVersion: v1\nclusters:\n- cluster:\n server: https://127.0.0.1:6443\n certificate-authority: /var/lib/rancher/k3s/agent/server-ca.crt\n name: local\ncontexts:\n- context:\n cluster: local\n namespace: default\n user: user\n name: Default\ncurrent-context: Default\nkind: Config\npreferences: {}\nusers:\n- name: user\n user:\n client-certificate: /var/lib/rancher/k3s/agent/client-kubelet.crt\n client-key: /var/lib/rancher/k3s/agent/client-kubelet.key\n"})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsx)(r.p,{children:'By default, K3s does not set the RotateKubeletServerCertificate feature gate.\nIf you have enabled this feature gate, you should remove it.\nIf using the K3s config file /etc/rancher/k3s/config.yaml, remove any feature-gate=RotateKubeletServerCertificate parameter.\nIf using the command line, remove the K3s flag --kubelet-arg="feature-gate=RotateKubeletServerCertificate".\nBased on your system, restart the k3s service. For example,\nsystemctl restart k3s.service'})]}),"\n",(0,t.jsx)(r.h3,{id:"4212-ensure-that-the-kubelet-only-makes-use-of-strong-cryptographic-ciphers-manual",children:"4.2.12 Ensure that the Kubelet only makes use of Strong Cryptographic Ciphers (Manual)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," PASS"]}),"\n",(0,t.jsx)(r.p,{children:(0,t.jsx)(r.strong,{children:"Audit:"})}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-bash",children:"journalctl -u k3s -u k3s-agent | grep 'Running kubelet' | tail -n1\n"})}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Expected Result:"})," '--tls-cipher-suites' contains valid elements from 'TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256'"]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Returned Value:"})}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{className:"language-console",children:'Aug 09 19:06:19 server-0 k3s[2357]: time="2024-08-09T19:06:19Z" level=info msg="Running kubelet --address=0.0.0.0 --allowed-unsafe-sysctls=net.ipv4.ip_forward,net.ipv6.conf.all.forwarding --anonymous-auth=false --authentication-token-webhook=true --authorization-mode=Webhook --cgroup-driver=systemd --client-ca-file=/var/lib/rancher/k3s/agent/client-ca.crt --cloud-provider=external --cluster-dns=10.43.0.10 --cluster-domain=cluster.local --container-runtime-endpoint=unix:///run/k3s/containerd/containerd.sock --containerd=/run/k3s/containerd/containerd.sock --event-qps=0 --eviction-hard=imagefs.available<5%,nodefs.available<5% --eviction-minimum-reclaim=imagefs.available=10%,nodefs.available=10% --fail-swap-on=false --feature-gates=CloudDualStackNodeIPs=true --healthz-bind-address=127.0.0.1 --hostname-override=server-0 --kubeconfig=/var/lib/rancher/k3s/agent/kubelet.kubeconfig --make-iptables-util-chains=true --node-ip=10.10.10.100 --node-labels= --pod-infra-container-image=rancher/mirrored-pause:3.6 --pod-manifest-path=/var/lib/rancher/k3s/agent/pod-manifests --protect-kernel-defaults=true --read-only-port=0 --resolv-conf=/run/systemd/resolve/resolv.conf --serialize-image-pulls=false --streaming-connection-idle-timeout=5m --tls-cert-file=/var/lib/rancher/k3s/agent/serving-kubelet.crt --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 --tls-private-key-file=/var/lib/rancher/k3s/agent/serving-kubelet.key"\n'})})]}),"\n",(0,t.jsxs)(s,{children:[(0,t.jsx)("summary",{children:(0,t.jsx)("b",{children:"Remediation:"})}),(0,t.jsxs)(r.p,{children:["If using a K3s config file /etc/rancher/k3s/config.yaml, edit the file to set ",(0,t.jsx)(r.code,{children:"TLSCipherSuites"})," to"]}),(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{children:'kubelet-arg:\n - "tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305"\n'})}),(0,t.jsx)(r.p,{children:'or to a subset of these values.\nIf using the command line, add the K3s flag --kubelet-arg="tls-cipher-suites="\nBased on your system, restart the k3s service. For example,\nsystemctl restart k3s.service'})]}),"\n",(0,t.jsx)(r.h3,{id:"4213-ensure-that-a-limit-is-set-on-pod-pids-manual",children:"4.2.13 Ensure that a limit is set on pod PIDs (Manual)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Remediation:"}),"\nDecide on an appropriate level for this parameter and set it,\nIf using a K3s config file /etc/rancher/k3s/config.yaml, edit the file to set ",(0,t.jsx)(r.code,{children:"podPidsLimit"})," to"]}),"\n",(0,t.jsx)(r.pre,{children:(0,t.jsx)(r.code,{children:'kubelet-arg:\n - "pod-max-pids="\n'})}),"\n",(0,t.jsx)(r.h2,{id:"51-rbac-and-service-accounts",children:"5.1 RBAC and Service Accounts"}),"\n",(0,t.jsx)(r.h3,{id:"511-ensure-that-the-cluster-admin-role-is-only-used-where-required-manual",children:"5.1.1 Ensure that the cluster-admin role is only used where required (Manual)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Remediation:"}),"\nIdentify all clusterrolebindings to the cluster-admin role. Check if they are used and\nif they need this role or if they could use a role with fewer privileges.\nWhere possible, first bind users to a lower privileged role and then remove the\nclusterrolebinding to the cluster-admin role :\nkubectl delete clusterrolebinding [name]"]}),"\n",(0,t.jsx)(r.h3,{id:"512-minimize-access-to-secrets-manual",children:"5.1.2 Minimize access to secrets (Manual)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Remediation:"}),"\nWhere possible, remove get, list and watch access to Secret objects in the cluster."]}),"\n",(0,t.jsx)(r.h3,{id:"513-minimize-wildcard-use-in-roles-and-clusterroles-manual",children:"5.1.3 Minimize wildcard use in Roles and ClusterRoles (Manual)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Remediation:"}),"\nWhere possible replace any use of wildcards in clusterroles and roles with specific\nobjects or actions."]}),"\n",(0,t.jsx)(r.h3,{id:"514-minimize-access-to-create-pods-manual",children:"5.1.4 Minimize access to create pods (Manual)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Remediation:"}),"\nWhere possible, remove create access to pod objects in the cluster."]}),"\n",(0,t.jsx)(r.h3,{id:"515-ensure-that-default-service-accounts-are-not-actively-used-manual",children:"5.1.5 Ensure that default service accounts are not actively used. (Manual)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Remediation:"}),"\nCreate explicit service accounts wherever a Kubernetes workload requires specific access\nto the Kubernetes API server.\nModify the configuration of each default service account to include this value\nautomountServiceAccountToken: false"]}),"\n",(0,t.jsx)(r.h3,{id:"516-ensure-that-service-account-tokens-are-only-mounted-where-necessary-manual",children:"5.1.6 Ensure that Service Account Tokens are only mounted where necessary (Manual)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Remediation:"}),"\nModify the definition of pods and service accounts which do not need to mount service\naccount tokens to disable it."]}),"\n",(0,t.jsxs)(r.h3,{id:"517-avoid-use-of-system-group-manual",children:["5.1.7 Avoid use of system",":masters"," group (Manual)"]}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Remediation:"}),"\nRemove the system",":masters"," group from all users in the cluster."]}),"\n",(0,t.jsx)(r.h3,{id:"518-limit-use-of-the-bind-impersonate-and-escalate-permissions-in-the-kubernetes-cluster-manual",children:"5.1.8 Limit use of the Bind, Impersonate and Escalate permissions in the Kubernetes cluster (Manual)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Remediation:"}),"\nWhere possible, remove the impersonate, bind and escalate rights from subjects."]}),"\n",(0,t.jsx)(r.h3,{id:"519-minimize-access-to-create-persistent-volumes-manual",children:"5.1.9 Minimize access to create persistent volumes (Manual)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Remediation:"}),"\nWhere possible, remove create access to PersistentVolume objects in the cluster."]}),"\n",(0,t.jsx)(r.h3,{id:"5110-minimize-access-to-the-proxy-sub-resource-of-nodes-manual",children:"5.1.10 Minimize access to the proxy sub-resource of nodes (Manual)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Remediation:"}),"\nWhere possible, remove access to the proxy sub-resource of node objects."]}),"\n",(0,t.jsx)(r.h3,{id:"5111-minimize-access-to-the-approval-sub-resource-of-certificatesigningrequests-objects-manual",children:"5.1.11 Minimize access to the approval sub-resource of certificatesigningrequests objects (Manual)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Remediation:"}),"\nWhere possible, remove access to the approval sub-resource of certificatesigningrequest objects."]}),"\n",(0,t.jsx)(r.h3,{id:"5112-minimize-access-to-webhook-configuration-objects-manual",children:"5.1.12 Minimize access to webhook configuration objects (Manual)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Remediation:"}),"\nWhere possible, remove access to the validatingwebhookconfigurations or mutatingwebhookconfigurations objects"]}),"\n",(0,t.jsx)(r.h3,{id:"5113-minimize-access-to-the-service-account-token-creation-manual",children:"5.1.13 Minimize access to the service account token creation (Manual)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Remediation:"}),"\nWhere possible, remove access to the token sub-resource of serviceaccount objects."]}),"\n",(0,t.jsx)(r.h2,{id:"52-pod-security-standards",children:"5.2 Pod Security Standards"}),"\n",(0,t.jsx)(r.h3,{id:"521-ensure-that-the-cluster-has-at-least-one-active-policy-control-mechanism-in-place-manual",children:"5.2.1 Ensure that the cluster has at least one active policy control mechanism in place (Manual)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Remediation:"}),"\nEnsure that either Pod Security Admission or an external policy control system is in place\nfor every namespace which contains user workloads."]}),"\n",(0,t.jsx)(r.h3,{id:"522-minimize-the-admission-of-privileged-containers-manual",children:"5.2.2 Minimize the admission of privileged containers (Manual)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Remediation:"}),"\nAdd policies to each namespace in the cluster which has user workloads to restrict the\nadmission of privileged containers."]}),"\n",(0,t.jsx)(r.h3,{id:"523-minimize-the-admission-of-containers-wishing-to-share-the-host-process-id-namespace-automated",children:"5.2.3 Minimize the admission of containers wishing to share the host process ID namespace (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Remediation:"}),"\nAdd policies to each namespace in the cluster which has user workloads to restrict the\nadmission of ",(0,t.jsx)(r.code,{children:"hostPID"})," containers."]}),"\n",(0,t.jsx)(r.h3,{id:"524-minimize-the-admission-of-containers-wishing-to-share-the-host-ipc-namespace-automated",children:"5.2.4 Minimize the admission of containers wishing to share the host IPC namespace (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Remediation:"}),"\nAdd policies to each namespace in the cluster which has user workloads to restrict the\nadmission of ",(0,t.jsx)(r.code,{children:"hostIPC"})," containers."]}),"\n",(0,t.jsx)(r.h3,{id:"525-minimize-the-admission-of-containers-wishing-to-share-the-host-network-namespace-automated",children:"5.2.5 Minimize the admission of containers wishing to share the host network namespace (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Remediation:"}),"\nAdd policies to each namespace in the cluster which has user workloads to restrict the\nadmission of ",(0,t.jsx)(r.code,{children:"hostNetwork"})," containers."]}),"\n",(0,t.jsx)(r.h3,{id:"526-minimize-the-admission-of-containers-with-allowprivilegeescalation-automated",children:"5.2.6 Minimize the admission of containers with allowPrivilegeEscalation (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Remediation:"}),"\nAdd policies to each namespace in the cluster which has user workloads to restrict the\nadmission of containers with ",(0,t.jsx)(r.code,{children:".spec.allowPrivilegeEscalation"})," set to ",(0,t.jsx)(r.code,{children:"true"}),"."]}),"\n",(0,t.jsx)(r.h3,{id:"527-minimize-the-admission-of-root-containers-automated",children:"5.2.7 Minimize the admission of root containers (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Remediation:"}),"\nCreate a policy for each namespace in the cluster, ensuring that either ",(0,t.jsx)(r.code,{children:"MustRunAsNonRoot"}),"\nor ",(0,t.jsx)(r.code,{children:"MustRunAs"})," with the range of UIDs not including 0, is set."]}),"\n",(0,t.jsx)(r.h3,{id:"528-minimize-the-admission-of-containers-with-the-net_raw-capability-automated",children:"5.2.8 Minimize the admission of containers with the NET_RAW capability (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Remediation:"}),"\nAdd policies to each namespace in the cluster which has user workloads to restrict the\nadmission of containers with the ",(0,t.jsx)(r.code,{children:"NET_RAW"})," capability."]}),"\n",(0,t.jsx)(r.h3,{id:"529-minimize-the-admission-of-containers-with-added-capabilities-automated",children:"5.2.9 Minimize the admission of containers with added capabilities (Automated)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Remediation:"}),"\nEnsure that ",(0,t.jsx)(r.code,{children:"allowedCapabilities"})," is not present in policies for the cluster unless\nit is set to an empty array."]}),"\n",(0,t.jsx)(r.h3,{id:"5210-minimize-the-admission-of-containers-with-capabilities-assigned-manual",children:"5.2.10 Minimize the admission of containers with capabilities assigned (Manual)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Remediation:"}),"\nReview the use of capabilities in applications running on your cluster. Where a namespace\ncontains applications which do not require any Linux capabities to operate consider adding\na PSP which forbids the admission of containers which do not drop all capabilities."]}),"\n",(0,t.jsx)(r.h3,{id:"5211-minimize-the-admission-of-windows-hostprocess-containers-manual",children:"5.2.11 Minimize the admission of Windows HostProcess containers (Manual)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Remediation:"}),"\nAdd policies to each namespace in the cluster which has user workloads to restrict the\nadmission of containers that have ",(0,t.jsx)(r.code,{children:".securityContext.windowsOptions.hostProcess"})," set to ",(0,t.jsx)(r.code,{children:"true"}),"."]}),"\n",(0,t.jsx)(r.h3,{id:"5212-minimize-the-admission-of-hostpath-volumes-manual",children:"5.2.12 Minimize the admission of HostPath volumes (Manual)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Remediation:"}),"\nAdd policies to each namespace in the cluster which has user workloads to restrict the\nadmission of containers with ",(0,t.jsx)(r.code,{children:"hostPath"})," volumes."]}),"\n",(0,t.jsx)(r.h3,{id:"5213-minimize-the-admission-of-containers-which-use-hostports-manual",children:"5.2.13 Minimize the admission of containers which use HostPorts (Manual)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Remediation:"}),"\nAdd policies to each namespace in the cluster which has user workloads to restrict the\nadmission of containers which use ",(0,t.jsx)(r.code,{children:"hostPort"})," sections."]}),"\n",(0,t.jsx)(r.h2,{id:"53-network-policies-and-cni",children:"5.3 Network Policies and CNI"}),"\n",(0,t.jsx)(r.h3,{id:"531-ensure-that-the-cni-in-use-supports-networkpolicies-manual",children:"5.3.1 Ensure that the CNI in use supports NetworkPolicies (Manual)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Remediation:"}),"\nIf the CNI plugin in use does not support network policies, consideration should be given to\nmaking use of a different plugin, or finding an alternate mechanism for restricting traffic\nin the Kubernetes cluster."]}),"\n",(0,t.jsx)(r.h3,{id:"532-ensure-that-all-namespaces-have-networkpolicies-defined-manual",children:"5.3.2 Ensure that all Namespaces have NetworkPolicies defined (Manual)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Remediation:"}),"\nFollow the documentation and create NetworkPolicy objects as you need them."]}),"\n",(0,t.jsx)(r.h2,{id:"54-secrets-management",children:"5.4 Secrets Management"}),"\n",(0,t.jsx)(r.h3,{id:"541-prefer-using-secrets-as-files-over-secrets-as-environment-variables-manual",children:"5.4.1 Prefer using Secrets as files over Secrets as environment variables (Manual)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Remediation:"}),"\nIf possible, rewrite application code to read Secrets from mounted secret files, rather than\nfrom environment variables."]}),"\n",(0,t.jsx)(r.h3,{id:"542-consider-external-secret-storage-manual",children:"5.4.2 Consider external secret storage (Manual)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Remediation:"}),"\nRefer to the Secrets management options offered by your cloud provider or a third-party\nsecrets management solution."]}),"\n",(0,t.jsx)(r.h2,{id:"55-extensible-admission-control",children:"5.5 Extensible Admission Control"}),"\n",(0,t.jsx)(r.h3,{id:"551-configure-image-provenance-using-imagepolicywebhook-admission-controller-manual",children:"5.5.1 Configure Image Provenance using ImagePolicyWebhook admission controller (Manual)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Remediation:"}),"\nFollow the Kubernetes documentation and setup image provenance."]}),"\n",(0,t.jsx)(r.h2,{id:"57-general-policies",children:"5.7 General Policies"}),"\n",(0,t.jsx)(r.h3,{id:"571-create-administrative-boundaries-between-resources-using-namespaces-manual",children:"5.7.1 Create administrative boundaries between resources using namespaces (Manual)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Remediation:"}),"\nFollow the documentation and create namespaces for objects in your deployment as you need\nthem."]}),"\n",(0,t.jsx)(r.h3,{id:"572-ensure-that-the-seccomp-profile-is-set-to-dockerdefault-in-your-pod-definitions-manual",children:"5.7.2 Ensure that the seccomp profile is set to docker/default in your Pod definitions (Manual)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Remediation:"}),"\nUse ",(0,t.jsx)(r.code,{children:"securityContext"})," to enable the docker/default seccomp profile in your pod definitions.\nAn example is as below:\nsecurityContext:\nseccompProfile:\ntype: RuntimeDefault"]}),"\n",(0,t.jsx)(r.h3,{id:"573-apply-securitycontext-to-your-pods-and-containers-manual",children:"5.7.3 Apply SecurityContext to your Pods and Containers (Manual)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Remediation:"}),"\nFollow the Kubernetes documentation and apply SecurityContexts to your Pods. For a\nsuggested list of SecurityContexts, you may refer to the CIS Security Benchmark for Docker\nContainers."]}),"\n",(0,t.jsx)(r.h3,{id:"574-the-default-namespace-should-not-be-used-manual",children:"5.7.4 The default namespace should not be used (Manual)"}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Result:"})," WARN"]}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.strong,{children:"Remediation:"}),"\nEnsure that namespaces are created to allow for appropriate segregation of Kubernetes\nresources and that all new resources are created in a specific namespace."]})]})}function u(e={}){const{wrapper:r}={...(0,n.a)(),...e.components};return r?(0,t.jsx)(r,{...e,children:(0,t.jsx)(d,{...e})}):d(e)}},1151:(e,r,s)=>{s.d(r,{Z:()=>l,a:()=>a});var t=s(7294);const n={},i=t.createContext(n);function a(e){const r=t.useContext(i);return t.useMemo((function(){return"function"==typeof e?e(r):{...r,...e}}),[r,e])}function l(e){let r;return r=e.disableParentContext?"function"==typeof e.components?e.components(n):e.components||n:a(e.components),t.createElement(i.Provider,{value:r},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/ba3a957c.2a21b03c.js b/assets/js/ba3a957c.93432ecf.js similarity index 98% rename from assets/js/ba3a957c.2a21b03c.js rename to assets/js/ba3a957c.93432ecf.js index 9b32b02bf..07ab228cc 100644 --- a/assets/js/ba3a957c.2a21b03c.js +++ b/assets/js/ba3a957c.93432ecf.js @@ -1 +1 @@ -"use strict";(self.webpackChunkk_3_s_docs=self.webpackChunkk_3_s_docs||[]).push([[8776],{615:(e,t,a)=>{a.r(t),a.d(t,{assets:()=>i,contentTitle:()=>o,default:()=>h,frontMatter:()=>n,metadata:()=>d,toc:()=>c});var s=a(5893),r=a(1151);const n={title:"Backup and Restore"},o=void 0,d={id:"datastore/backup-restore",title:"Backup and Restore",description:"The way K3s is backed up and restored depends on which type of datastore is used.",source:"@site/docs/datastore/backup-restore.md",sourceDirName:"datastore",slug:"/datastore/backup-restore",permalink:"/datastore/backup-restore",draft:!1,unlisted:!1,editUrl:"https://github.com/k3s-io/docs/edit/main/docs/datastore/backup-restore.md",tags:[],version:"current",lastUpdatedAt:1723651727e3,frontMatter:{title:"Backup and Restore"},sidebar:"mySidebar",previous:{title:"Cluster Datastore",permalink:"/datastore/"},next:{title:"High Availability Embedded etcd",permalink:"/datastore/ha-embedded"}},i={},c=[{value:"Backup and Restore with SQLite",id:"backup-and-restore-with-sqlite",level:2},{value:"Backup and Restore with External Datastore",id:"backup-and-restore-with-external-datastore",level:2},{value:"Backup and Restore with Embedded etcd Datastore",id:"backup-and-restore-with-embedded-etcd-datastore",level:2}];function l(e){const t={a:"a",admonition:"admonition",code:"code",h2:"h2",li:"li",p:"p",ul:"ul",...(0,r.a)(),...e.components};return(0,s.jsxs)(s.Fragment,{children:[(0,s.jsx)(t.p,{children:"The way K3s is backed up and restored depends on which type of datastore is used."}),"\n",(0,s.jsx)(t.admonition,{type:"warning",children:(0,s.jsxs)(t.p,{children:["In addition to backing up the datastore itself, you must also back up the server token file at ",(0,s.jsx)(t.code,{children:"/var/lib/rancher/k3s/server/token"}),".\nYou must restore this file, or pass its value into the ",(0,s.jsx)(t.code,{children:"--token"})," option, when restoring from backup.\nIf you do not use the same token value when restoring, the snapshot will be unusable, as the token is used to encrypt confidential data within the datastore itself."]})}),"\n",(0,s.jsx)(t.h2,{id:"backup-and-restore-with-sqlite",children:"Backup and Restore with SQLite"}),"\n",(0,s.jsx)(t.p,{children:"No special commands are required to back up or restore the SQLite datastore."}),"\n",(0,s.jsxs)(t.ul,{children:["\n",(0,s.jsxs)(t.li,{children:["To back up the SQLite datastore, take a copy of ",(0,s.jsx)(t.code,{children:"/var/lib/rancher/k3s/server/db/"}),"."]}),"\n",(0,s.jsxs)(t.li,{children:["To restore the SQLite datastore, restore the contents of ",(0,s.jsx)(t.code,{children:"/var/lib/rancher/k3s/server/db"})," (and the token, as discussed above)."]}),"\n"]}),"\n",(0,s.jsx)(t.h2,{id:"backup-and-restore-with-external-datastore",children:"Backup and Restore with External Datastore"}),"\n",(0,s.jsx)(t.p,{children:"When an external datastore is used, backup and restore operations are handled outside of K3s. The database administrator will need to back up the external database, or restore it from a snapshot or dump."}),"\n",(0,s.jsx)(t.p,{children:"We recommend configuring the database to take recurring snapshots."}),"\n",(0,s.jsx)(t.p,{children:"For details on taking database snapshots and restoring your database from them, refer to the official database documentation:"}),"\n",(0,s.jsxs)(t.ul,{children:["\n",(0,s.jsx)(t.li,{children:(0,s.jsx)(t.a,{href:"https://dev.mysql.com/doc/refman/8.0/en/replication-snapshot-method.html",children:"Official MySQL documentation"})}),"\n",(0,s.jsx)(t.li,{children:(0,s.jsx)(t.a,{href:"https://www.postgresql.org/docs/8.3/backup-dump.html",children:"Official PostgreSQL documentation"})}),"\n",(0,s.jsx)(t.li,{children:(0,s.jsx)(t.a,{href:"https://etcd.io/docs/latest/op-guide/recovery/",children:"Official etcd documentation"})}),"\n"]}),"\n",(0,s.jsx)(t.h2,{id:"backup-and-restore-with-embedded-etcd-datastore",children:"Backup and Restore with Embedded etcd Datastore"}),"\n",(0,s.jsxs)(t.p,{children:["See the ",(0,s.jsxs)(t.a,{href:"/cli/etcd-snapshot",children:[(0,s.jsx)(t.code,{children:"k3s etcd-snapshot"})," command documentation"]})," for information on performing backup and restore operations on the embedded etcd datastore."]})]})}function h(e={}){const{wrapper:t}={...(0,r.a)(),...e.components};return t?(0,s.jsx)(t,{...e,children:(0,s.jsx)(l,{...e})}):l(e)}},1151:(e,t,a)=>{a.d(t,{Z:()=>d,a:()=>o});var s=a(7294);const r={},n=s.createContext(r);function o(e){const t=s.useContext(n);return s.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function d(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(r):e.components||r:o(e.components),s.createElement(n.Provider,{value:t},e.children)}}}]); \ No newline at end of file +"use strict";(self.webpackChunkk_3_s_docs=self.webpackChunkk_3_s_docs||[]).push([[8776],{615:(e,t,a)=>{a.r(t),a.d(t,{assets:()=>i,contentTitle:()=>o,default:()=>h,frontMatter:()=>n,metadata:()=>d,toc:()=>c});var s=a(5893),r=a(1151);const n={title:"Backup and Restore"},o=void 0,d={id:"datastore/backup-restore",title:"Backup and Restore",description:"The way K3s is backed up and restored depends on which type of datastore is used.",source:"@site/docs/datastore/backup-restore.md",sourceDirName:"datastore",slug:"/datastore/backup-restore",permalink:"/datastore/backup-restore",draft:!1,unlisted:!1,editUrl:"https://github.com/k3s-io/docs/edit/main/docs/datastore/backup-restore.md",tags:[],version:"current",lastUpdatedAt:1723747404e3,frontMatter:{title:"Backup and Restore"},sidebar:"mySidebar",previous:{title:"Cluster Datastore",permalink:"/datastore/"},next:{title:"High Availability Embedded etcd",permalink:"/datastore/ha-embedded"}},i={},c=[{value:"Backup and Restore with SQLite",id:"backup-and-restore-with-sqlite",level:2},{value:"Backup and Restore with External Datastore",id:"backup-and-restore-with-external-datastore",level:2},{value:"Backup and Restore with Embedded etcd Datastore",id:"backup-and-restore-with-embedded-etcd-datastore",level:2}];function l(e){const t={a:"a",admonition:"admonition",code:"code",h2:"h2",li:"li",p:"p",ul:"ul",...(0,r.a)(),...e.components};return(0,s.jsxs)(s.Fragment,{children:[(0,s.jsx)(t.p,{children:"The way K3s is backed up and restored depends on which type of datastore is used."}),"\n",(0,s.jsx)(t.admonition,{type:"warning",children:(0,s.jsxs)(t.p,{children:["In addition to backing up the datastore itself, you must also back up the server token file at ",(0,s.jsx)(t.code,{children:"/var/lib/rancher/k3s/server/token"}),".\nYou must restore this file, or pass its value into the ",(0,s.jsx)(t.code,{children:"--token"})," option, when restoring from backup.\nIf you do not use the same token value when restoring, the snapshot will be unusable, as the token is used to encrypt confidential data within the datastore itself."]})}),"\n",(0,s.jsx)(t.h2,{id:"backup-and-restore-with-sqlite",children:"Backup and Restore with SQLite"}),"\n",(0,s.jsx)(t.p,{children:"No special commands are required to back up or restore the SQLite datastore."}),"\n",(0,s.jsxs)(t.ul,{children:["\n",(0,s.jsxs)(t.li,{children:["To back up the SQLite datastore, take a copy of ",(0,s.jsx)(t.code,{children:"/var/lib/rancher/k3s/server/db/"}),"."]}),"\n",(0,s.jsxs)(t.li,{children:["To restore the SQLite datastore, restore the contents of ",(0,s.jsx)(t.code,{children:"/var/lib/rancher/k3s/server/db"})," (and the token, as discussed above)."]}),"\n"]}),"\n",(0,s.jsx)(t.h2,{id:"backup-and-restore-with-external-datastore",children:"Backup and Restore with External Datastore"}),"\n",(0,s.jsx)(t.p,{children:"When an external datastore is used, backup and restore operations are handled outside of K3s. The database administrator will need to back up the external database, or restore it from a snapshot or dump."}),"\n",(0,s.jsx)(t.p,{children:"We recommend configuring the database to take recurring snapshots."}),"\n",(0,s.jsx)(t.p,{children:"For details on taking database snapshots and restoring your database from them, refer to the official database documentation:"}),"\n",(0,s.jsxs)(t.ul,{children:["\n",(0,s.jsx)(t.li,{children:(0,s.jsx)(t.a,{href:"https://dev.mysql.com/doc/refman/8.0/en/replication-snapshot-method.html",children:"Official MySQL documentation"})}),"\n",(0,s.jsx)(t.li,{children:(0,s.jsx)(t.a,{href:"https://www.postgresql.org/docs/8.3/backup-dump.html",children:"Official PostgreSQL documentation"})}),"\n",(0,s.jsx)(t.li,{children:(0,s.jsx)(t.a,{href:"https://etcd.io/docs/latest/op-guide/recovery/",children:"Official etcd documentation"})}),"\n"]}),"\n",(0,s.jsx)(t.h2,{id:"backup-and-restore-with-embedded-etcd-datastore",children:"Backup and Restore with Embedded etcd Datastore"}),"\n",(0,s.jsxs)(t.p,{children:["See the ",(0,s.jsxs)(t.a,{href:"/cli/etcd-snapshot",children:[(0,s.jsx)(t.code,{children:"k3s etcd-snapshot"})," command documentation"]})," for information on performing backup and restore operations on the embedded etcd datastore."]})]})}function h(e={}){const{wrapper:t}={...(0,r.a)(),...e.components};return t?(0,s.jsx)(t,{...e,children:(0,s.jsx)(l,{...e})}):l(e)}},1151:(e,t,a)=>{a.d(t,{Z:()=>d,a:()=>o});var s=a(7294);const r={},n=s.createContext(r);function o(e){const t=s.useContext(n);return s.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function d(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(r):e.components||r:o(e.components),s.createElement(n.Provider,{value:t},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/d123a91e.554acc6a.js b/assets/js/d123a91e.edce91c7.js similarity index 99% rename from assets/js/d123a91e.554acc6a.js rename to assets/js/d123a91e.edce91c7.js index e73d3d510..c224ad439 100644 --- a/assets/js/d123a91e.554acc6a.js +++ b/assets/js/d123a91e.edce91c7.js @@ -1 +1 @@ -"use strict";(self.webpackChunkk_3_s_docs=self.webpackChunkk_3_s_docs||[]).push([[855],{5418:(e,s,t)=>{t.r(s),t.d(s,{assets:()=>c,contentTitle:()=>l,default:()=>o,frontMatter:()=>i,metadata:()=>h,toc:()=>d});var r=t(5893),n=t(1151);const i={hide_table_of_contents:!0,sidebar_position:7},l="v1.24.X",h={id:"release-notes/v1.24.X",title:"v1.24.X",description:"Before upgrading from earlier releases, be sure to read the Kubernetes Urgent Upgrade Notes.",source:"@site/docs/release-notes/v1.24.X.md",sourceDirName:"release-notes",slug:"/release-notes/v1.24.X",permalink:"/release-notes/v1.24.X",draft:!1,unlisted:!1,editUrl:"https://github.com/k3s-io/docs/edit/main/docs/release-notes/v1.24.X.md",tags:[],version:"current",lastUpdatedAt:1723651727e3,sidebarPosition:7,frontMatter:{hide_table_of_contents:!0,sidebar_position:7},sidebar:"mySidebar",previous:{title:"v1.25.X",permalink:"/release-notes/v1.25.X"},next:{title:"Related Projects",permalink:"/related-projects"}},c={},d=[{value:"Release v1.24.17+k3s1",id:"release-v12417k3s1",level:2},{value:"Changes since v1.24.16+k3s1:",id:"changes-since-v12416k3s1",level:3},{value:"Release v1.24.16+k3s1",id:"release-v12416k3s1",level:2},{value:"Changes since v1.24.14+k3s1:",id:"changes-since-v12414k3s1",level:3},{value:"Release v1.24.15+k3s1",id:"release-v12415k3s1",level:2},{value:"Changes since v1.24.14+k3s1:",id:"changes-since-v12414k3s1-1",level:3},{value:"Release v1.24.14+k3s1",id:"release-v12414k3s1",level:2},{value:"Changes since v1.24.13+k3s1:",id:"changes-since-v12413k3s1",level:3},{value:"Release v1.24.13+k3s1",id:"release-v12413k3s1",level:2},{value:"Changes since v1.24.12+k3s1:",id:"changes-since-v12412k3s1",level:3},{value:"Release v1.24.12+k3s1",id:"release-v12412k3s1",level:2},{value:"Changes since v1.24.11+k3s1:",id:"changes-since-v12411k3s1",level:3},{value:"Release v1.24.11+k3s1",id:"release-v12411k3s1",level:2},{value:"Changes since v1.24.10+k3s1:",id:"changes-since-v12410k3s1",level:3},{value:"Release v1.24.10+k3s1",id:"release-v12410k3s1",level:2},{value:"Changes since v1.24.9+k3s2:",id:"changes-since-v1249k3s2",level:3},{value:"Release v1.24.9+k3s2",id:"release-v1249k3s2",level:2},{value:"Changes since v1.24.9+k3s1:",id:"changes-since-v1249k3s1",level:3},{value:"Release v1.24.9+k3s1",id:"release-v1249k3s1",level:2},{value:"\u26a0\ufe0f WARNING",id:"\ufe0f-warning",level:2},{value:"Changes since v1.24.8+k3s1:",id:"changes-since-v1248k3s1",level:3},{value:"Release v1.24.8+k3s1",id:"release-v1248k3s1",level:2},{value:"Changes since v1.24.7+k3s1:",id:"changes-since-v1247k3s1",level:3},{value:"Release v1.24.7+k3s1",id:"release-v1247k3s1",level:2},{value:"Changes since v1.24.6+k3s1:",id:"changes-since-v1246k3s1",level:3},{value:"Release v1.24.6+k3s1",id:"release-v1246k3s1",level:2},{value:"Changes since v1.24.4+k3s1:",id:"changes-since-v1244k3s1",level:3},{value:"Release v1.24.4+k3s1",id:"release-v1244k3s1",level:2},{value:"Changes since v1.24.3+k3s1:",id:"changes-since-v1243k3s1",level:3},{value:"Release v1.24.3+k3s1",id:"release-v1243k3s1",level:2},{value:"Changes since v1.24.2+k3s2:",id:"changes-since-v1242k3s2",level:3},{value:"Release v1.24.2+k3s2",id:"release-v1242k3s2",level:2},{value:"Changes since v1.24.2+k3s1:",id:"changes-since-v1242k3s1",level:3},{value:"Release v1.24.2+k3s1",id:"release-v1242k3s1",level:2},{value:"Changes since v1.24.1+k3s1:",id:"changes-since-v1241k3s1",level:3},{value:"Release v1.24.1+k3s1",id:"release-v1241k3s1",level:2},{value:"Changes since v1.24.0+k3s1:",id:"changes-since-v1240k3s1",level:3}];function a(e){const s={a:"a",admonition:"admonition",blockquote:"blockquote",code:"code",h1:"h1",h2:"h2",h3:"h3",header:"header",hr:"hr",li:"li",p:"p",strong:"strong",table:"table",tbody:"tbody",td:"td",th:"th",thead:"thead",tr:"tr",ul:"ul",...(0,n.a)(),...e.components};return(0,r.jsxs)(r.Fragment,{children:[(0,r.jsx)(s.header,{children:(0,r.jsx)(s.h1,{id:"v124x",children:"v1.24.X"})}),"\n",(0,r.jsx)(s.admonition,{title:"Upgrade Notice",type:"warning",children:(0,r.jsxs)(s.p,{children:["Before upgrading from earlier releases, be sure to read the Kubernetes ",(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.24.md#urgent-upgrade-notes",children:"Urgent Upgrade Notes"}),"."]})}),"\n",(0,r.jsxs)(s.table,{children:[(0,r.jsx)(s.thead,{children:(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.th,{children:"Version"}),(0,r.jsx)(s.th,{children:"Release date"}),(0,r.jsx)(s.th,{children:"Kubernetes"}),(0,r.jsx)(s.th,{children:"Kine"}),(0,r.jsx)(s.th,{children:"SQLite"}),(0,r.jsx)(s.th,{children:"Etcd"}),(0,r.jsx)(s.th,{children:"Containerd"}),(0,r.jsx)(s.th,{children:"Runc"}),(0,r.jsx)(s.th,{children:"Flannel"}),(0,r.jsx)(s.th,{children:"Metrics-server"}),(0,r.jsx)(s.th,{children:"Traefik"}),(0,r.jsx)(s.th,{children:"CoreDNS"}),(0,r.jsx)(s.th,{children:"Helm-controller"}),(0,r.jsx)(s.th,{children:"Local-path-provisioner"})]})}),(0,r.jsxs)(s.tbody,{children:[(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"/release-notes/v1.24.X#release-v12417k3s1",children:"v1.24.17+k3s1"})}),(0,r.jsx)(s.td,{children:"Sep 05 2023"}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.24.md#v12417",children:"v1.24.17"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/kine/releases/tag/v0.10.2",children:"v0.10.2"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://sqlite.org/releaselog/3_42_0.html",children:"3.42.0"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/etcd/releases/tag/v3.5.3-k3s1",children:"v3.5.3-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/containerd/releases/tag/v1.7.3-k3s1",children:"v1.7.3-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/opencontainers/runc/releases/tag/v1.1.8",children:"v1.1.8"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/flannel-io/flannel/releases/tag/v0.21.3-k3s1.23",children:"v0.21.3-k3s1.23"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.6.3",children:"v0.6.3"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/traefik/traefik/releases/tag/v2.9.10",children:"v2.9.10"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/coredns/coredns/releases/tag/v1.10.1",children:"v1.10.1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/helm-controller/releases/tag/v0.15.4",children:"v0.15.4"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/rancher/local-path-provisioner/releases/tag/v0.0.24",children:"v0.0.24"})})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"/release-notes/v1.24.X#release-v12416k3s1",children:"v1.24.16+k3s1"})}),(0,r.jsx)(s.td,{children:"Jul 27 2023"}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.24.md#v12416",children:"v1.24.16"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/kine/releases/tag/v0.10.1",children:"v0.10.1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://sqlite.org/releaselog/3_39_2.html",children:"3.39.2"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/etcd/releases/tag/v3.5.3-k3s1",children:"v3.5.3-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/containerd/releases/tag/v1.7.1-k3s1",children:"v1.7.1-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/opencontainers/runc/releases/tag/v1.1.7",children:"v1.1.7"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/flannel-io/flannel/releases/tag/v0.21.3-k3s1.23",children:"v0.21.3-k3s1.23"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.6.3",children:"v0.6.3"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/traefik/traefik/releases/tag/v2.9.10",children:"v2.9.10"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/coredns/coredns/releases/tag/v1.10.1",children:"v1.10.1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/helm-controller/releases/tag/v0.15.2",children:"v0.15.2"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/rancher/local-path-provisioner/releases/tag/v0.0.24",children:"v0.0.24"})})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"/release-notes/v1.24.X#release-v12415k3s1",children:"v1.24.15+k3s1"})}),(0,r.jsx)(s.td,{children:"Jun 26 2023"}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.24.md#v12415",children:"v1.24.15"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/kine/releases/tag/v0.10.1",children:"v0.10.1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://sqlite.org/releaselog/3_39_2.html",children:"3.39.2"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/etcd/releases/tag/v3.5.3-k3s1",children:"v3.5.3-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/containerd/releases/tag/v1.7.1-k3s1",children:"v1.7.1-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/opencontainers/runc/releases/tag/v1.1.7",children:"v1.1.7"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/flannel-io/flannel/releases/tag/v0.21.3-k3s1.23",children:"v0.21.3-k3s1.23"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.6.3",children:"v0.6.3"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/traefik/traefik/releases/tag/v2.9.10",children:"v2.9.10"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/coredns/coredns/releases/tag/v1.10.1",children:"v1.10.1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/helm-controller/releases/tag/v0.15.0",children:"v0.15.0"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/rancher/local-path-provisioner/releases/tag/v0.0.24",children:"v0.0.24"})})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"/release-notes/v1.24.X#release-v12414k3s1",children:"v1.24.14+k3s1"})}),(0,r.jsx)(s.td,{children:"May 26 2023"}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.24.md#v12414",children:"v1.24.14"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/kine/releases/tag/v0.10.1",children:"v0.10.1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://sqlite.org/releaselog/3_39_2.html",children:"3.39.2"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/etcd/releases/tag/v3.5.3-k3s1",children:"v3.5.3-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/containerd/releases/tag/v1.7.1-k3s1",children:"v1.7.1-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/opencontainers/runc/releases/tag/v1.1.7",children:"v1.1.7"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/flannel-io/flannel/releases/tag/v0.21.3-k3s1.23",children:"v0.21.3-k3s1.23"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.6.2",children:"v0.6.2"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/traefik/traefik/releases/tag/v2.9.10",children:"v2.9.10"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/coredns/coredns/releases/tag/v1.10.1",children:"v1.10.1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/helm-controller/releases/tag/v0.14.0",children:"v0.14.0"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/rancher/local-path-provisioner/releases/tag/v0.0.24",children:"v0.0.24"})})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"/release-notes/v1.24.X#release-v12413k3s1",children:"v1.24.13+k3s1"})}),(0,r.jsx)(s.td,{children:"Apr 20 2023"}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.24.md#v12413",children:"v1.24.13"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/kine/releases/tag/v0.9.9",children:"v0.9.9"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://sqlite.org/releaselog/3_39_2.html",children:"3.39.2"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/etcd/releases/tag/v3.5.3-k3s1",children:"v3.5.3-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/containerd/releases/tag/v1.6.19-k3s1",children:"v1.6.19-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/opencontainers/runc/releases/tag/v1.1.5",children:"v1.1.5"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/flannel-io/flannel/releases/tag/v0.21.3-k3s1.23",children:"v0.21.3-k3s1.23"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.6.2",children:"v0.6.2"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/traefik/traefik/releases/tag/v2.9.4",children:"v2.9.4"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/coredns/coredns/releases/tag/v1.10.1",children:"v1.10.1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/helm-controller/releases/tag/v0.13.3",children:"v0.13.3"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/rancher/local-path-provisioner/releases/tag/v0.0.24",children:"v0.0.24"})})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"/release-notes/v1.24.X#release-v12412k3s1",children:"v1.24.12+k3s1"})}),(0,r.jsx)(s.td,{children:"Mar 27 2023"}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.24.md#v12412",children:"v1.24.12"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/kine/releases/tag/v0.9.9",children:"v0.9.9"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://sqlite.org/releaselog/3_39_2.html",children:"3.39.2"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/etcd/releases/tag/v3.5.3-k3s1",children:"v3.5.3-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/containerd/releases/tag/v1.6.19-k3s1",children:"v1.6.19-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/opencontainers/runc/releases/tag/v1.1.4",children:"v1.1.4"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/flannel-io/flannel/releases/tag/v0.21.3-k3s1.23",children:"v0.21.3-k3s1.23"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.6.2",children:"v0.6.2"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/traefik/traefik/releases/tag/v2.9.4",children:"v2.9.4"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/coredns/coredns/releases/tag/v1.9.4",children:"v1.9.4"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/helm-controller/releases/tag/v0.13.1",children:"v0.13.1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/rancher/local-path-provisioner/releases/tag/v0.0.23",children:"v0.0.23"})})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"/release-notes/v1.24.X#release-v12411k3s1",children:"v1.24.11+k3s1"})}),(0,r.jsx)(s.td,{children:"Mar 10 2023"}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.24.md#v12411",children:"v1.24.11"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/kine/releases/tag/v0.9.9",children:"v0.9.9"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://sqlite.org/releaselog/3_39_2.html",children:"3.39.2"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/etcd/releases/tag/v3.5.3-k3s1",children:"v3.5.3-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/containerd/releases/tag/v1.6.15-k3s1",children:"v1.6.15-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/opencontainers/runc/releases/tag/v1.1.4",children:"v1.1.4"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/flannel-io/flannel/releases/tag/v0.21.1-k3s1.23",children:"v0.21.1-k3s1.23"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.6.2",children:"v0.6.2"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/traefik/traefik/releases/tag/v2.9.4",children:"v2.9.4"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/coredns/coredns/releases/tag/v1.9.4",children:"v1.9.4"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/helm-controller/releases/tag/v0.13.1",children:"v0.13.1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/rancher/local-path-provisioner/releases/tag/v0.0.23",children:"v0.0.23"})})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"/release-notes/v1.24.X#release-v12410k3s1",children:"v1.24.10+k3s1"})}),(0,r.jsx)(s.td,{children:"Jan 26 2023"}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.24.md#v12410",children:"v1.24.10"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/kine/releases/tag/v0.9.6",children:"v0.9.6"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://sqlite.org/releaselog/3_39_2.html",children:"3.39.2"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/etcd/releases/tag/v3.5.3-k3s1",children:"v3.5.3-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/containerd/releases/tag/v1.6.15-k3s1",children:"v1.6.15-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/opencontainers/runc/releases/tag/v1.1.4",children:"v1.1.4"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/flannel-io/flannel/releases/tag/v0.20.2-k3s1.23",children:"v0.20.2-k3s1.23"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.6.2",children:"v0.6.2"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/traefik/traefik/releases/tag/v2.9.4",children:"v2.9.4"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/coredns/coredns/releases/tag/v1.9.4",children:"v1.9.4"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/helm-controller/releases/tag/v0.13.1",children:"v0.13.1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/rancher/local-path-provisioner/releases/tag/v0.0.23",children:"v0.0.23"})})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"/release-notes/v1.24.X#release-v1249k3s2",children:"v1.24.9+k3s2"})}),(0,r.jsx)(s.td,{children:"Jan 11 2023"}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.24.md#v1249",children:"v1.24.9"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/kine/releases/tag/v0.9.6",children:"v0.9.6"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://sqlite.org/releaselog/3_39_2.html",children:"3.39.2"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/etcd/releases/tag/v3.5.3-k3s1",children:"v3.5.3-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/containerd/releases/tag/v1.6.14-k3s1",children:"v1.6.14-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/opencontainers/runc/releases/tag/v1.1.4",children:"v1.1.4"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/flannel-io/flannel/releases/tag/v0.20.2-k3s1.23",children:"v0.20.2-k3s1.23"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.6.2",children:"v0.6.2"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/traefik/traefik/releases/tag/v2.9.4",children:"v2.9.4"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/coredns/coredns/releases/tag/v1.9.4",children:"v1.9.4"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/helm-controller/releases/tag/v0.13.1",children:"v0.13.1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/rancher/local-path-provisioner/releases/tag/v0.0.23",children:"v0.0.23"})})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"/release-notes/v1.24.X#release-v1249k3s1",children:"v1.24.9+k3s1"})}),(0,r.jsx)(s.td,{children:"Dec 20 2022"}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.24.md#v1249",children:"v1.24.9"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/kine/releases/tag/v0.9.6",children:"v0.9.6"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://sqlite.org/releaselog/3_39_2.html",children:"3.39.2"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/etcd/releases/tag/v3.5.3-k3s1",children:"v3.5.3-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/containerd/releases/tag/v1.6.12-k3s1",children:"v1.6.12-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/opencontainers/runc/releases/tag/v1.1.4",children:"v1.1.4"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/flannel-io/flannel/releases/tag/v0.20.2-k3s1.23",children:"v0.20.2-k3s1.23"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.6.2",children:"v0.6.2"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/traefik/traefik/releases/tag/v2.9.4",children:"v2.9.4"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/coredns/coredns/releases/tag/v1.9.4",children:"v1.9.4"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/helm-controller/releases/tag/v0.13.1",children:"v0.13.1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/rancher/local-path-provisioner/releases/tag/v0.0.23",children:"v0.0.23"})})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"/release-notes/v1.24.X#release-v1248k3s1",children:"v1.24.8+k3s1"})}),(0,r.jsx)(s.td,{children:"Nov 18 2022"}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.24.md#v1248",children:"v1.24.8"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/kine/releases/tag/v0.9.6",children:"v0.9.6"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://sqlite.org/releaselog/3_39_2.html",children:"3.39.2"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/etcd/releases/tag/v3.5.3-k3s1",children:"v3.5.3-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/containerd/releases/tag/v1.6.8-k3s1",children:"v1.6.8-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/opencontainers/runc/releases/tag/v1.1.4",children:"v1.1.4"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/flannel-io/flannel/releases/tag/v0.20.1-k3s1.23",children:"v0.20.1-k3s1.23"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.6.1",children:"v0.6.1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/traefik/traefik/releases/tag/v2.9.4",children:"v2.9.4"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/coredns/coredns/releases/tag/v1.9.4",children:"v1.9.4"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/helm-controller/releases/tag/v0.13.0",children:"v0.13.0"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/rancher/local-path-provisioner/releases/tag/v0.0.23",children:"v0.0.23"})})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"/release-notes/v1.24.X#release-v1247k3s1",children:"v1.24.7+k3s1"})}),(0,r.jsx)(s.td,{children:"Oct 25 2022"}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.24.md#v1247",children:"v1.24.7"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/kine/releases/tag/v0.9.3",children:"v0.9.3"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://sqlite.org/releaselog/3_36_0.html",children:"3.36.0"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/etcd/releases/tag/v3.5.3-k3s1",children:"v3.5.3-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/containerd/releases/tag/v1.6.8-k3s1",children:"v1.6.8-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/opencontainers/runc/releases/tag/v1.1.4",children:"v1.1.4"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/flannel-io/flannel/releases/tag/v0.19.2",children:"v0.19.2"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.6.1",children:"v0.6.1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/traefik/traefik/releases/tag/v2.9.1",children:"v2.9.1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/coredns/coredns/releases/tag/v1.9.1",children:"v1.9.1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/helm-controller/releases/tag/v0.12.3",children:"v0.12.3"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/rancher/local-path-provisioner/releases/tag/v0.0.21",children:"v0.0.21"})})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"/release-notes/v1.24.X#release-v1246k3s1",children:"v1.24.6+k3s1"})}),(0,r.jsx)(s.td,{children:"Sep 28 2022"}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.24.md#v1246",children:"v1.24.6"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/kine/releases/tag/v0.9.3",children:"v0.9.3"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://sqlite.org/releaselog/3_36_0.html",children:"3.36.0"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/etcd/releases/tag/v3.5.3-k3s1",children:"v3.5.3-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/containerd/releases/tag/v1.6.8-k3s1",children:"v1.6.8-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/opencontainers/runc/releases/tag/v1.1.4",children:"v1.1.4"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/flannel-io/flannel/releases/tag/v0.19.2",children:"v0.19.2"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.5.2",children:"v0.5.2"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/traefik/traefik/releases/tag/v2.6.2",children:"v2.6.2"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/coredns/coredns/releases/tag/v1.9.1",children:"v1.9.1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/helm-controller/releases/tag/v0.12.3",children:"v0.12.3"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/rancher/local-path-provisioner/releases/tag/v0.0.21",children:"v0.0.21"})})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"/release-notes/v1.24.X#release-v1244k3s1",children:"v1.24.4+k3s1"})}),(0,r.jsx)(s.td,{children:"Aug 25 2022"}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.24.md#v1244",children:"v1.24.4"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/kine/releases/tag/v0.9.3",children:"v0.9.3"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://sqlite.org/releaselog/3_36_0.html",children:"3.36.0"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/etcd/releases/tag/v3.5.3-k3s1",children:"v3.5.3-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/containerd/releases/tag/v1.5.13-k3s1",children:"v1.5.13-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/opencontainers/runc/releases/tag/v1.1.3",children:"v1.1.3"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/flannel-io/flannel/releases/tag/v0.19.1",children:"v0.19.1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.5.2",children:"v0.5.2"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/traefik/traefik/releases/tag/v2.6.2",children:"v2.6.2"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/coredns/coredns/releases/tag/v1.9.1",children:"v1.9.1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/helm-controller/releases/tag/v0.12.3",children:"v0.12.3"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/rancher/local-path-provisioner/releases/tag/v0.0.21",children:"v0.0.21"})})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"/release-notes/v1.24.X#release-v1243k3s1",children:"v1.24.3+k3s1"})}),(0,r.jsx)(s.td,{children:"Jul 19 2022"}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.24.md#v1243",children:"v1.24.3"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/kine/releases/tag/v0.9.3",children:"v0.9.3"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://sqlite.org/releaselog/3_36_0.html",children:"3.36.0"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/etcd/releases/tag/v3.5.3-k3s1",children:"v3.5.3-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/containerd/releases/tag/v1.5.13-k3s1",children:"v1.5.13-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/opencontainers/runc/releases/tag/v1.1.3",children:"v1.1.3"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/flannel-io/flannel/releases/tag/v0.18.1",children:"v0.18.1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.5.2",children:"v0.5.2"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/traefik/traefik/releases/tag/v2.6.2",children:"v2.6.2"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/coredns/coredns/releases/tag/v1.9.1",children:"v1.9.1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/helm-controller/releases/tag/v0.12.3",children:"v0.12.3"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/rancher/local-path-provisioner/releases/tag/v0.0.21",children:"v0.0.21"})})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"/release-notes/v1.24.X#release-v1242k3s2",children:"v1.24.2+k3s2"})}),(0,r.jsx)(s.td,{children:"Jul 06 2022"}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.24.md#v1242",children:"v1.24.2"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/kine/releases/tag/v0.9.3",children:"v0.9.3"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://sqlite.org/releaselog/3_36_0.html",children:"3.36.0"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/etcd/releases/tag/v3.5.3-k3s1",children:"v3.5.3-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/containerd/releases/tag/v1.5.13-k3s1",children:"v1.5.13-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/opencontainers/runc/releases/tag/v1.1.2",children:"v1.1.2"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/flannel-io/flannel/releases/tag/v0.18.1",children:"v0.18.1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.5.2",children:"v0.5.2"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/traefik/traefik/releases/tag/v2.6.2",children:"v2.6.2"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/coredns/coredns/releases/tag/v1.9.1",children:"v1.9.1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/helm-controller/releases/tag/v0.12.3",children:"v0.12.3"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/rancher/local-path-provisioner/releases/tag/v0.0.21",children:"v0.0.21"})})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"/release-notes/v1.24.X#release-v1242k3s1",children:"v1.24.2+k3s1"})}),(0,r.jsx)(s.td,{children:"Jun 27 2022"}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.24.md#v1242",children:"v1.24.2"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/kine/releases/tag/v0.9.1",children:"v0.9.1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://sqlite.org/releaselog/3_36_0.html",children:"3.36.0"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/etcd/releases/tag/v3.5.3-k3s1",children:"v3.5.3-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/containerd/releases/tag/v1.6.6-k3s1",children:"v1.6.6-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/opencontainers/runc/releases/tag/v1.1.2",children:"v1.1.2"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/flannel-io/flannel/releases/tag/v0.18.1",children:"v0.18.1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.5.2",children:"v0.5.2"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/traefik/traefik/releases/tag/v2.6.2",children:"v2.6.2"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/coredns/coredns/releases/tag/v1.9.1",children:"v1.9.1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/helm-controller/releases/tag/v0.12.3",children:"v0.12.3"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/rancher/local-path-provisioner/releases/tag/v0.0.21",children:"v0.0.21"})})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"/release-notes/v1.24.X#release-v1241k3s1",children:"v1.24.1+k3s1"})}),(0,r.jsx)(s.td,{children:"Jun 11 2022"}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.24.md#v1241",children:"v1.24.1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/kine/releases/tag/v0.9.1",children:"v0.9.1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://sqlite.org/releaselog/3_36_0.html",children:"3.36.0"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/etcd/releases/tag/v3.5.3-k3s1",children:"v3.5.3-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/containerd/releases/tag/v1.5.11-k3s1",children:"v1.5.11-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/opencontainers/runc/releases/tag/v1.1.1",children:"v1.1.1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/flannel-io/flannel/releases/tag/v0.17.0",children:"v0.17.0"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.5.2",children:"v0.5.2"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/traefik/traefik/releases/tag/v2.6.2",children:"v2.6.2"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/coredns/coredns/releases/tag/v1.9.1",children:"v1.9.1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/helm-controller/releases/tag/v0.12.1",children:"v0.12.1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/rancher/local-path-provisioner/releases/tag/v0.0.21",children:"v0.0.21"})})]})]})]}),"\n",(0,r.jsx)("br",{}),"\n",(0,r.jsxs)(s.h2,{id:"release-v12417k3s1",children:["Release ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/releases/tag/v1.24.17+k3s1",children:"v1.24.17+k3s1"})]}),"\n",(0,r.jsx)(s.p,{children:"This release updates Kubernetes to v1.24.17, and fixes a number of issues."}),"\n",(0,r.jsx)(s.admonition,{title:"IMPORTANT",type:"warning",children:(0,r.jsxs)(s.p,{children:["This release includes support for remediating CVE-2023-32187, a potential Denial of Service attack vector on K3s servers. See ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/security/advisories/GHSA-m4hf-6vgr-75r2",children:"https://github.com/k3s-io/k3s/security/advisories/GHSA-m4hf-6vgr-75r2"})," for more information, including mandatory steps necessary to harden clusters against this vulnerability."]})}),"\n",(0,r.jsxs)(s.p,{children:["For more details on what's new, see the ",(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.24.md#changelog-since-v12416",children:"Kubernetes release notes"}),"."]}),"\n",(0,r.jsx)(s.h3,{id:"changes-since-v12416k3s1",children:"Changes since v1.24.16+k3s1:"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsxs)(s.li,{children:["Update cni plugins version to v1.3.0 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8087",children:"(#8087)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Etcd snapshots retention when node name changes ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8124",children:"(#8124)"})]}),"\n",(0,r.jsxs)(s.li,{children:["August Test Backports ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8128",children:"(#8128)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Backports for 2023-08 release ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8135",children:"(#8135)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:"K3s's external apiserver listener now declines to add to its certificate any subject names not associated with the kubernetes apiserver service, server nodes, or values of the --tls-san option. This prevents the certificate's SAN list from being filled with unwanted entries."}),"\n",(0,r.jsxs)(s.li,{children:["K3s no longer enables the apiserver's ",(0,r.jsx)(s.code,{children:"enable-aggregator-routing"})," flag when the egress proxy is not being used to route connections to in-cluster endpoints."]}),"\n",(0,r.jsx)(s.li,{children:"Updated the embedded containerd to v1.7.3+k3s1"}),"\n",(0,r.jsx)(s.li,{children:"Updated the embedded runc to v1.1.8"}),"\n",(0,r.jsxs)(s.li,{children:["User-provided containerd config templates may now use ",(0,r.jsx)(s.code,{children:'{{ template "base" . }}'})," to include the default K3s template content. This makes it easier to maintain user configuration if the only need is to add additional sections to the file."]}),"\n",(0,r.jsx)(s.li,{children:"Bump docker/docker module version to fix issues with cri-dockerd caused by recent releases of golang rejecting invalid host headers sent by the docker client."}),"\n",(0,r.jsx)(s.li,{children:"Updated kine to v0.10.2"}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["K3s etcd-snapshot delete fail to delete local file when called with s3 flag ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8146",children:"(#8146)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Fix for cluster-reset backup from s3 when etcd snapshots are disabled ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8168",children:"(#8168)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Fixed the etcd retention to delete orphaned snapshots based on the date ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8191",children:"(#8191)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Additional backports for 2023-08 release ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8214",children:"(#8214)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsxs)(s.li,{children:["The version of ",(0,r.jsx)(s.code,{children:"helm"})," used by the bundled helm controller's job image has been updated to v3.12.3"]}),"\n",(0,r.jsx)(s.li,{children:"Bumped dynamiclistener to address an issue that could cause the apiserver/supervisor listener on 6443 to stop serving requests on etcd-only nodes."}),"\n",(0,r.jsx)(s.li,{children:"The K3s external apiserver/supervisor listener on 6443 now sends a complete certificate chain in the TLS handshake."}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Fix runc version bump ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8243",children:"(#8243)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Update to v1.24.17 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8240",children:"(#8240)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Add new CLI flag to enable TLS SAN CN filtering ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8260",children:"(#8260)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsxs)(s.li,{children:["Added a new ",(0,r.jsx)(s.code,{children:"--tls-san-security"})," option. This flag defaults to false, but can be set to true to disable automatically adding SANs to the server's TLS certificate to satisfy any hostname requested by a client."]}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Add RWMutex to address controller ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8276",children:"(#8276)"})]}),"\n"]}),"\n",(0,r.jsx)(s.hr,{}),"\n",(0,r.jsxs)(s.h2,{id:"release-v12416k3s1",children:["Release ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/releases/tag/v1.24.16+k3s1",children:"v1.24.16+k3s1"})]}),"\n",(0,r.jsx)(s.p,{children:"This release updates Kubernetes to v1.24.16, and fixes a number of issues."}),"\n",(0,r.jsxs)(s.p,{children:["For more details on what's new, see the ",(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.24.md#changelog-since-v12415",children:"Kubernetes release notes"}),"."]}),"\n",(0,r.jsx)(s.h3,{id:"changes-since-v12414k3s1",children:"Changes since v1.24.14+k3s1:"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsxs)(s.li,{children:["Fix code spell check ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7861",children:"(#7861)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Remove file_windows.go ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7857",children:"(#7857)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Allow k3s to customize apiServerPort on helm-controller ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7872",children:"(#7872)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Fix rootless node password ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7899",children:"(#7899)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Backports for 2023-07 release ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7910",children:"(#7910)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:"Resolved an issue that caused agents joined with kubeadm-style bootstrap tokens to fail to rejoin the cluster when their node object is deleted."}),"\n",(0,r.jsxs)(s.li,{children:["The ",(0,r.jsx)(s.code,{children:"k3s certificate rotate-ca"})," command now supports the data-dir flag."]}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Adding cli to custom klipper helm image ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7916",children:"(#7916)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:"The default helm-controller job image can now be overridden with the --helm-job-image CLI flag"}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Generation of certs and keys for etcd gated if etcd is disabled ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7946",children:"(#7946)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Don't use zgrep in ",(0,r.jsx)(s.code,{children:"check-config"})," if apparmor profile is enforced ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7955",children:"(#7955)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Fix image_scan.sh script and download trivy version (#7950) ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7970",children:"(#7970)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Adjust default kubeconfig file permissions ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7985",children:"(#7985)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Update to v1.24.16 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8023",children:"(#8023)"})]}),"\n"]}),"\n",(0,r.jsx)(s.hr,{}),"\n",(0,r.jsxs)(s.h2,{id:"release-v12415k3s1",children:["Release ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/releases/tag/v1.24.15+k3s1",children:"v1.24.15+k3s1"})]}),"\n",(0,r.jsx)(s.p,{children:"This release updates Kubernetes to v1.24.15, and fixes a number of issues."}),"\n",(0,r.jsxs)(s.p,{children:["For more details on what's new, see the ",(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.24.md#changelog-since-v12414",children:"Kubernetes release notes"}),"."]}),"\n",(0,r.jsx)(s.h3,{id:"changes-since-v12414k3s1-1",children:"Changes since v1.24.14+k3s1:"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsxs)(s.li,{children:["E2E Backports - June ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7726",children:"(#7726)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:"Shortcircuit commands with version or help flags #7683"}),"\n",(0,r.jsx)(s.li,{children:"Add Rotation certification Check, remove func to restart agents #7097"}),"\n",(0,r.jsx)(s.li,{children:"E2E: Sudo for RunCmdOnNode #7686"}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Fix spelling check ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7753",children:"(#7753)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Backport version bumps and bugfixes ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7719",children:"(#7719)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:"The bundled metrics-server has been bumped to v0.6.3, and now uses only secure TLS ciphers by default."}),"\n",(0,r.jsxs)(s.li,{children:["The ",(0,r.jsx)(s.code,{children:"coredns-custom"})," ConfigMap now allows for ",(0,r.jsx)(s.code,{children:"*.override"})," sections to be included in the ",(0,r.jsx)(s.code,{children:".:53"})," default server block."]}),"\n",(0,r.jsx)(s.li,{children:"The K3s core controllers (supervisor, deploy, and helm) no longer use the admin kubeconfig. This makes it easier to determine from access and audit logs which actions are performed by the system, and which are performed by an administrative user."}),"\n",(0,r.jsx)(s.li,{children:"Bumped klipper-lb image to v0.4.4 to resolve an issue that prevented access to ServiceLB ports from localhost when the Service ExternalTrafficPolicy was set to Local."}),"\n",(0,r.jsx)(s.li,{children:"Make LB image configurable when compiling k3s"}),"\n",(0,r.jsx)(s.li,{children:"K3s now allows nodes to join the cluster even if the node password secret cannot be created at the time the node joins. The secret create will be retried in the background. This resolves a potential deadlock created by fail-closed validating webhooks that block secret creation, where the webhook is unavailable until new nodes join the cluster to run the webhook pod."}),"\n",(0,r.jsx)(s.li,{children:"The bundled containerd's aufs/devmapper/zfs snapshotter plugins have been restored. These were unintentionally omitted when moving containerd back into the k3s multicall binary in the previous release."}),"\n",(0,r.jsx)(s.li,{children:"The embedded helm controller has been bumped to v0.15.0, and now supports creating the chart's target namespace if it does not exist."}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Remove unused libvirt config ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7759",children:"(#7759)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Add format command on Makefile ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7764",children:"(#7764)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Update Kubernetes to v1.24.15 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7785",children:"(#7785)"})]}),"\n"]}),"\n",(0,r.jsx)(s.hr,{}),"\n",(0,r.jsxs)(s.h2,{id:"release-v12414k3s1",children:["Release ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/releases/tag/v1.24.14+k3s1",children:"v1.24.14+k3s1"})]}),"\n",(0,r.jsx)(s.p,{children:"This release updates Kubernetes to v1.24.14, and fixes a number of issues."}),"\n",(0,r.jsxs)(s.p,{children:["For more details on what's new, see the ",(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.24.md#changelog-since-v12413",children:"Kubernetes release notes"}),"."]}),"\n",(0,r.jsx)(s.h3,{id:"changes-since-v12413k3s1",children:"Changes since v1.24.13+k3s1:"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsxs)(s.li,{children:["Add E2E testing in Drone ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7376",children:"(#7376)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Add integration tests for etc-snapshot server flags ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7379",children:"(#7379)"})]}),"\n",(0,r.jsxs)(s.li,{children:["CLI + Config Enhancement ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7407",children:"(#7407)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsxs)(s.li,{children:[(0,r.jsx)(s.code,{children:"--Tls-sans"})," now accepts multiple arguments: ",(0,r.jsx)(s.code,{children:'--tls-sans="foo,bar"'})]}),"\n",(0,r.jsxs)(s.li,{children:[(0,r.jsx)(s.code,{children:"Prefer-bundled-bin: true"})," now works properly when set in ",(0,r.jsx)(s.code,{children:"config.yaml.d"})," files"]}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Migrate netutil methods into /utils/net.go ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7435",children:"(#7435)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Bump Runc + Containerd + Docker for CVE fixes ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7453",children:"(#7453)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Bump kube-router version to fix a bug when a port name is used ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7462",children:"(#7462)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Kube flags and longhorn tests 1.24 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7467",children:"(#7467)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Local-storage: Fix permission ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7472",children:"(#7472)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Backport version bumps and bugfixes ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7516",children:"(#7516)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:'K3s now retries the cluster join operation when receiving a "too many learners" error from etcd. This most frequently occurred when attempting to add multiple servers at the same time.'}),"\n",(0,r.jsx)(s.li,{children:"K3s once again supports aarch64 nodes with page size > 4k"}),"\n",(0,r.jsx)(s.li,{children:"The packaged Traefik version has been bumped to v2.9.10 / chart 21.2.0"}),"\n",(0,r.jsxs)(s.li,{children:["K3s now prints a more meaningful error when attempting to run from a filesystem mounted ",(0,r.jsx)(s.code,{children:"noexec"}),"."]}),"\n",(0,r.jsxs)(s.li,{children:["K3s now exits with a proper error message when the server token uses a bootstrap token ",(0,r.jsx)(s.code,{children:"id.secret"})," format."]}),"\n",(0,r.jsx)(s.li,{children:"Fixed an issue where Addon, HelmChart, and HelmChartConfig CRDs were created without structural schema, allowing the creation of custom resources of these types with invalid content."}),"\n",(0,r.jsx)(s.li,{children:"Servers started with the (experimental) --disable-agent flag no longer attempt to run the tunnel authorizer agent component."}),"\n",(0,r.jsx)(s.li,{children:"Fixed an regression that prevented the pod and cluster egress-selector modes from working properly."}),"\n",(0,r.jsx)(s.li,{children:"K3s now correctly passes through etcd-args to the temporary etcd that is used to extract cluster bootstrap data when restarting managed etcd nodes."}),"\n",(0,r.jsx)(s.li,{children:"K3s now properly handles errors obtaining the current etcd cluster member list when a new server is joining the managed etcd cluster."}),"\n",(0,r.jsxs)(s.li,{children:["The embedded kine version has been bumped to v0.10.1. This replaces the legacy ",(0,r.jsx)(s.code,{children:"lib/pq"})," postgres driver with ",(0,r.jsx)(s.code,{children:"pgx"}),"."]}),"\n",(0,r.jsx)(s.li,{children:"The bundled CNI plugins have been upgraded to v1.2.0-k3s1. The bandwidth and firewall plugins are now included in the bundle."}),"\n",(0,r.jsx)(s.li,{children:"The embedded Helm controller now supports authenticating to chart repositories via credentials stored in a Secret, as well as passing repo CAs via ConfigMap."}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Bump containerd/runc to v1.7.1-k3s1/v1.1.7 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7536",children:"(#7536)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:"The bundled containerd and runc versions have been bumped to v1.7.1-k3s1/v1.1.7"}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Wrap error stating that it is coming from netpol ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7549",children:"(#7549)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Update to v1.24.14-k3s1 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7577",children:"(#7577)"})]}),"\n"]}),"\n",(0,r.jsx)(s.hr,{}),"\n",(0,r.jsxs)(s.h2,{id:"release-v12413k3s1",children:["Release ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/releases/tag/v1.24.13+k3s1",children:"v1.24.13+k3s1"})]}),"\n",(0,r.jsx)(s.p,{children:"This release updates Kubernetes to v1.24.13, and fixes a number of issues."}),"\n",(0,r.jsxs)(s.p,{children:["For more details on what's new, see the ",(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.24.md#changelog-since-v12412",children:"Kubernetes release notes"}),"."]}),"\n",(0,r.jsx)(s.h3,{id:"changes-since-v12412k3s1",children:"Changes since v1.24.12+k3s1:"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsxs)(s.li,{children:["Enhance ",(0,r.jsx)(s.code,{children:"check-config"})," ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7165",children:"(#7165)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Remove deprecated nodeSelector label beta.kubernetes.io/os (#6970) ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7122",children:"(#7122)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Backport version bumps and bugfixes ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7229",children:"(#7229)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:"The bundled local-path-provisioner version has been bumped to v0.0.24"}),"\n",(0,r.jsx)(s.li,{children:"The bundled runc version has been bumped to v1.1.5"}),"\n",(0,r.jsx)(s.li,{children:"The bundled coredns version has been bumped to v1.10.1"}),"\n",(0,r.jsx)(s.li,{children:"When using an external datastore, K3s now locks the bootstrap key while creating initial cluster bootstrap data, preventing a race condition when multiple servers attempted to initialize the cluster simultaneously."}),"\n",(0,r.jsx)(s.li,{children:"The client load-balancer that maintains connections to active server nodes now closes connections to servers when they are removed from the cluster. This ensures that agent components immediately reconnect to a current cluster member."}),"\n",(0,r.jsx)(s.li,{children:"Fixed a race condition during cluster reset that could cause the operation to hang and time out."}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Updated kube-router to move the default ACCEPT rule at the end of the chain ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7222",children:"(#7222)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:"The embedded kube-router controller has been updated to fix a regression that caused traffic from pods to be blocked by any default drop/deny rules present on the host. Users should still confirm that any externally-managed firewall rules explicitly allow traffic to/from pod and service networks, but this returns the old behavior that was relied upon by some users."}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Update klipper lb and helm-controller ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7241",children:"(#7241)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Update Kube-router ACCEPT rule insertion and install script to clean rules before start ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7277",children:"(#7277)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:"The embedded kube-router controller has been updated to fix a regression that caused traffic from pods to be blocked by any default drop/deny rules present on the host. Users should still confirm that any externally-managed firewall rules explicitly allow traffic to/from pod and service networks, but this returns the old behavior that was relied upon by some users."}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Update to v1.24.13-k3s1 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7284",children:"(#7284)"})]}),"\n"]}),"\n",(0,r.jsx)(s.hr,{}),"\n",(0,r.jsxs)(s.h2,{id:"release-v12412k3s1",children:["Release ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/releases/tag/v1.24.12+k3s1",children:"v1.24.12+k3s1"})]}),"\n",(0,r.jsx)(s.p,{children:"This release updates Kubernetes to v1.24.12, and fixes a number of issues."}),"\n",(0,r.jsxs)(s.p,{children:["For more details on what's new, see the ",(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.24.md#changelog-since-v12411",children:"Kubernetes release notes"}),"."]}),"\n",(0,r.jsx)(s.h3,{id:"changes-since-v12411k3s1",children:"Changes since v1.24.11+k3s1:"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsxs)(s.li,{children:["Update flannel and kube-router ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7063",children:"(#7063)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Bump various dependencies for CVEs ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7042",children:"(#7042)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Enable dependabot ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7046",children:"(#7046)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Wait for kubelet port to be ready before setting ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7065",children:"(#7065)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:"The agent tunnel authorizer now waits for the kubelet to be ready before reading the kubelet port from the node object."}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Improve support for rotating the default self-signed certs ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7080",children:"(#7080)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsxs)(s.li,{children:["The ",(0,r.jsx)(s.code,{children:"k3s certificate rotate-ca"})," checks now support rotating self-signed certificates without the ",(0,r.jsx)(s.code,{children:"--force"})," option."]}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Adds a warning about editing to the containerd config.toml file ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7076",children:"(#7076)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Update to v1.24.12-k3s1 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7105",children:"(#7105)"})]}),"\n"]}),"\n",(0,r.jsx)(s.hr,{}),"\n",(0,r.jsxs)(s.h2,{id:"release-v12411k3s1",children:["Release ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/releases/tag/v1.24.11+k3s1",children:"v1.24.11+k3s1"})]}),"\n",(0,r.jsx)(s.p,{children:"This release updates Kubernetes to v1.24.11, and fixes a number of issues."}),"\n",(0,r.jsxs)(s.p,{children:["For more details on what's new, see the ",(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.24.md#changelog-since-v12410",children:"Kubernetes release notes"}),"."]}),"\n",(0,r.jsx)(s.h3,{id:"changes-since-v12410k3s1",children:"Changes since v1.24.10+k3s1:"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsxs)(s.li,{children:["Add jitter to scheduled snapshots and retry harder on conflicts ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6783",children:"(#6783)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:"Scheduled etcd snapshots are now offset by a short random delay of up to several seconds. This should prevent multi-server clusters from executing pathological behavior when attempting to simultaneously update the snapshot list ConfigMap. The snapshot controller will also be more persistent in attempting to update the snapshot list."}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Bump cri-dockerd ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6799",children:"(#6799)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:"The embedded cri-dockerd has been updated to v0.3.1"}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Bugfix: do not break cert-manager when pprof is enabled ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6838",children:"(#6838)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Bump vagrant boxes to fedora37 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6859",children:"(#6859)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Fix cronjob example ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6865",children:"(#6865)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Ensure flag type consistency ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6868",children:"(#6868)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Wait for cri-dockerd socket ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6854",children:"(#6854)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Consolidate E2E tests ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6888",children:"(#6888)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Ignore value conflicts when reencrypting secrets ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6918",children:"(#6918)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Allow ServiceLB to honor ",(0,r.jsx)(s.code,{children:"ExternalTrafficPolicy=Local"})," ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6908",children:"(#6908)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:"ServiceLB now honors the Service's ExternalTrafficPolicy. When set to Local, the LoadBalancer will only advertise addresses of Nodes with a Pod for the Service, and will not forward traffic to other cluster members."}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Use default address family when adding kubernetes service address to SAN list ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6905",children:"(#6905)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:"The apiserver advertised address and IP SAN entry are now set correctly on clusters that use IPv6 as the default IP family."}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Fix issue with servicelb startup failure when validating webhooks block creation ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6920",children:"(#6920)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:"The embedded cloud controller manager will no longer attempt to unconditionally re-create its namespace and serviceaccount on startup. This resolves an issue that could cause a deadlocked cluster when fail-closed webhooks are in use."}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Backport user-provided CA cert and ",(0,r.jsx)(s.code,{children:"kubeadm"})," bootstrap token support ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6930",children:"(#6930)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsxs)(s.li,{children:["K3s now functions properly when the cluster CA certificates are signed by an existing root or intermediate CA. You can find a sample script for generating such certificates before K3s starts in the github repo at ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/blob/master/contrib/util/certs.sh",children:"contrib/util/certs.sh"}),"."]}),"\n",(0,r.jsxs)(s.li,{children:["K3s now supports ",(0,r.jsx)(s.code,{children:"kubeadm"})," style join tokens. ",(0,r.jsx)(s.code,{children:"k3s token create"})," now creates join token secrets, optionally with a limited TTL."]}),"\n",(0,r.jsx)(s.li,{children:"K3s agents joined with an expired or deleted token stay in the cluster using existing client certificates via the NodeAuthorization admission plugin, unless their Node object is deleted from the cluster."}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Fix access to hostNetwork port on NodeIP when egress-selector-mode=agent ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6937",children:"(#6937)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:"Fixed an issue that would cause the apiserver egress proxy to attempt to use the agent tunnel to connect to service endpoints even in agent or disabled mode."}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Update flannel to v0.21.1 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6925",children:"(#6925)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Allow for multiple sets of leader-elected controllers ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6942",children:"(#6942)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:"Fixed an issue where leader-elected controllers for managed etcd did not run on etcd-only nodes"}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Fix etcd and ca-cert rotate issues ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6955",children:"(#6955)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Fix ServiceLB dual-stack ingress IP listing ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6988",children:"(#6988)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:"Resolved an issue with ServiceLB that would cause it to advertise node IPv6 addresses, even if the cluster or service was not enabled for dual-stack operation."}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Bump kine to v0.9.9 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6976",children:"(#6976)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsxs)(s.li,{children:["The embedded kine version has been bumped to v0.9.9. Compaction log messages are now omitted at ",(0,r.jsx)(s.code,{children:"info"})," level for increased visibility."]}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Update to v1.24.11-k3s1 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7009",children:"(#7009)"})]}),"\n"]}),"\n",(0,r.jsx)(s.hr,{}),"\n",(0,r.jsxs)(s.h2,{id:"release-v12410k3s1",children:["Release ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/releases/tag/v1.24.10+k3s1",children:"v1.24.10+k3s1"})]}),"\n",(0,r.jsx)(s.p,{children:"This release updates Kubernetes to v1.24.10+k3s1, and fixes a number of issues."}),"\n",(0,r.jsxs)(s.p,{children:["For more details on what's new, see the ",(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.24.md#changelog-since-v1249",children:"Kubernetes release notes"}),"."]}),"\n",(0,r.jsx)(s.h3,{id:"changes-since-v1249k3s2",children:"Changes since v1.24.9+k3s2:"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsxs)(s.li,{children:["Pass through default tls-cipher-suites ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6731",children:"(#6731)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:"The K3s default cipher suites are now explicitly passed in to kube-apiserver, ensuring that all listeners use these values."}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Bump containerd to v1.6.15-k3s1 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6736",children:"(#6736)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:"The embedded containerd version has been bumped to v1.6.15-k3s1"}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Bump action/download-artifact to v3 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6748",children:"(#6748)"})]}),"\n"]}),"\n",(0,r.jsx)(s.hr,{}),"\n",(0,r.jsxs)(s.h2,{id:"release-v1249k3s2",children:["Release ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/releases/tag/v1.24.9+k3s2",children:"v1.24.9+k3s2"})]}),"\n",(0,r.jsx)(s.p,{children:"This release updates containerd to v1.6.14 to resolve an issue where pods would lose their CNI information when containerd was restarted."}),"\n",(0,r.jsx)(s.h3,{id:"changes-since-v1249k3s1",children:"Changes since v1.24.9+k3s1:"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsxs)(s.li,{children:["Backport missing E2E test commits ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6616",children:"(#6616)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Bump containerd to v1.6.14-k3s1 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6695",children:"(#6695)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsxs)(s.li,{children:["The embedded containerd version has been bumped to v1.6.14-k3s1. This includes a backported fix for ",(0,r.jsx)(s.a,{href:"https://github.com/containerd/containerd/issues/7843",children:"containerd/7843"})," which caused pods to lose their CNI info when containerd was restarted, which in turn caused the kubelet to recreate the pod."]}),"\n"]}),"\n"]}),"\n"]}),"\n",(0,r.jsx)(s.hr,{}),"\n",(0,r.jsxs)(s.h2,{id:"release-v1249k3s1",children:["Release ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/releases/tag/v1.24.9+k3s1",children:"v1.24.9+k3s1"})]}),"\n",(0,r.jsxs)(s.blockquote,{children:["\n",(0,r.jsx)(s.h2,{id:"\ufe0f-warning",children:"\u26a0\ufe0f WARNING"}),"\n",(0,r.jsxs)(s.p,{children:["This release is affected by ",(0,r.jsx)(s.a,{href:"https://github.com/containerd/containerd/issues/7843",children:"https://github.com/containerd/containerd/issues/7843"}),", which causes the kubelet to restart all pods whenever K3s is restarted. For this reason, we have removed this K3s release from the channel server. Please use ",(0,r.jsx)(s.code,{children:"v1.24.9+k3s2"})," instead."]}),"\n"]}),"\n",(0,r.jsx)(s.p,{children:"This release updates Kubernetes to v1.24.9, and fixes a number of issues."}),"\n",(0,r.jsxs)(s.p,{children:[(0,r.jsx)(s.strong,{children:"Breaking Change:"})," K3s no longer includes ",(0,r.jsx)(s.code,{children:"swanctl"})," and ",(0,r.jsx)(s.code,{children:"charon"})," binaries. If you are using the ipsec flannel backend, please ensure that the strongswan ",(0,r.jsx)(s.code,{children:"swanctl"})," and ",(0,r.jsx)(s.code,{children:"charon"})," packages are installed on your node before upgrading K3s to this release."]}),"\n",(0,r.jsxs)(s.p,{children:["For more details on what's new, see the ",(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.24.md#changelog-since-v1248",children:"Kubernetes release notes"}),"."]}),"\n",(0,r.jsx)(s.h3,{id:"changes-since-v1248k3s1",children:"Changes since v1.24.8+k3s1:"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsxs)(s.li,{children:["Remove stuff which belongs in the windows executor implementation ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6502",children:"(#6502)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Github CI Updates ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6535",children:"(#6535)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Fix log for flannelExternalIP use case ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6540",children:"(#6540)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Switch from Google Buckets to AWS S3 Buckets ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6570",children:"(#6570)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Change secrets-encryption flag to GA ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6591",children:"(#6591)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Update flannel to v0.20.2 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6589",children:"(#6589)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Backports for 2022-12 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6599",children:"(#6599)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:"Added new prefer-bundled-bin flag which force K3s to use its bundle binaries over that of the host tools"}),"\n",(0,r.jsx)(s.li,{children:"The embedded containerd version has been updated to v1.6.10-k3s1"}),"\n",(0,r.jsxs)(s.li,{children:["The rootless ",(0,r.jsx)(s.code,{children:"port-driver"}),", ",(0,r.jsx)(s.code,{children:"cidr"}),", ",(0,r.jsx)(s.code,{children:"mtu"}),", ",(0,r.jsx)(s.code,{children:"enable-ipv6"}),", and ",(0,r.jsx)(s.code,{children:"disable-host-loopback"})," settings can now be configured via environment variables."]}),"\n",(0,r.jsxs)(s.li,{children:["The embedded Load-Balancer controller image has been bumped to klipper-lb",":v0",".4.0, which includes support for the ",(0,r.jsx)(s.a,{href:"https://kubernetes.io/docs/reference/kubernetes-api/service-resources/service-v1/#:~:text=loadBalancerSourceRanges",children:"LoadBalancerSourceRanges"})," field."]}),"\n",(0,r.jsxs)(s.li,{children:["The embedded Helm controller image has been bumped to klipper-helm",":v0",".7.4-build20221121"]}),"\n",(0,r.jsxs)(s.li,{children:["The embedded cloud-controller-manager's metrics listener on port 10258 is now disabled when the ",(0,r.jsx)(s.code,{children:"--disable-cloud-controller"})," flag is set."]}),"\n",(0,r.jsx)(s.li,{children:"Deployments for K3s packaged components now have consistent upgrade strategy and revisionHistoryLimit settings, and will not override scaling decisions by hardcoding the replica count."}),"\n",(0,r.jsx)(s.li,{children:"The packaged metrics-server has been bumped to v0.6.2"}),"\n",(0,r.jsx)(s.li,{children:"The embedded k3s-root version has been bumped to v0.12.0, based on buildroot 2022.08.1."}),"\n",(0,r.jsxs)(s.li,{children:["The embedded swanctl and charon binaries have been removed. If you are using the ipsec flannel backend, please ensure that the strongswan ",(0,r.jsx)(s.code,{children:"swanctl"})," and ",(0,r.jsx)(s.code,{children:"charon"})," packages are installed on your node before upgrading k3s."]}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Update node12->node16 based GH actions ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6595",children:"(#6595)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Update to v1.24.9-k3s1 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6623",children:"(#6623)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Bump containerd to v1.6.12-k3s1 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6630",children:"(#6630)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:"The embedded containerd version has been bumped to v1.6.12"}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Preload iptable_filter/ip6table_filter ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6647",children:"(#6647)"})]}),"\n"]}),"\n",(0,r.jsx)(s.hr,{}),"\n",(0,r.jsxs)(s.h2,{id:"release-v1248k3s1",children:["Release ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/releases/tag/v1.24.8+k3s1",children:"v1.24.8+k3s1"})]}),"\n",(0,r.jsx)(s.p,{children:"This release updates Kubernetes to v1.24.8, and fixes a number of issues."}),"\n",(0,r.jsxs)(s.p,{children:["For more details on what's new, see the ",(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.24.md#changelog-since-v1247",children:"Kubernetes release notes"}),"."]}),"\n",(0,r.jsx)(s.h3,{id:"changes-since-v1247k3s1",children:"Changes since v1.24.7+k3s1:"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsxs)(s.li,{children:["Add the gateway parameter in netplan ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6341",children:"(#6341)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Add a netpol test for podSelector & ingress type ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6348",children:"(#6348)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Upgrade kube-router to v1.5.1 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6356",children:"(#6356)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Bump install tests OS images ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6379",children:"(#6379)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Add test for node-external-ip config parameter ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6363",children:"(#6363)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Update Flannel to v0.20.1 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6418",children:"(#6418)"})]}),"\n",(0,r.jsx)(s.li,{children:"Backports for 2022-11"}),"\n",(0,r.jsx)(s.li,{children:"The packaged traefik helm chart has been bumped to v19.0.0, enabling ingressclass support by default."}),"\n",(0,r.jsx)(s.li,{children:"The packaged local-path-provisioner has been bumped to v0.0.23"}),"\n",(0,r.jsx)(s.li,{children:"The packaged coredns has been bumped to v1.9.4"}),"\n",(0,r.jsx)(s.li,{children:"Fix incorrect defer usage"}),"\n",(0,r.jsx)(s.li,{children:"The bundled traefik has been updated to v2.9.4 / helm chart v18.3.0"}),"\n",(0,r.jsx)(s.li,{children:"Use debugger-friendly compile settings if debug is set"}),"\n",(0,r.jsx)(s.li,{children:"Add test for node-external-ip config parameter"}),"\n",(0,r.jsx)(s.li,{children:"Convert containerd config.toml.tmpl linux template to v2 syntax"}),"\n",(0,r.jsx)(s.li,{children:"Replace fedora-coreos with fedora 36 for install tests"}),"\n",(0,r.jsx)(s.li,{children:"Fixed an issue that would prevent the deploy controller from handling manifests that include resource types that are no longer supported by the apiserver."}),"\n",(0,r.jsx)(s.li,{children:"The embedded helm controller has been bumped to v0.13.0"}),"\n",(0,r.jsx)(s.li,{children:"The bundled traefik helm chart has been updated to v18.0.0"}),"\n",(0,r.jsx)(s.li,{children:"Add hardened cluster and upgrade tests"}),"\n",(0,r.jsxs)(s.li,{children:["Bump kine to v0.9.6 / sqlite3 v3.39.2 (",(0,r.jsx)(s.a,{href:"https://nvd.nist.gov/vuln/detail/cve-2022-35737",children:"cve-2022-35737"}),")"]}),"\n",(0,r.jsxs)(s.li,{children:["Bumped dynamiclistener library to v0.3.5 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6411",children:"(#6411)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Add some helping logs to avoid wrong configs ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6432",children:"(#6432)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Change the priority of address types depending on flannel-external-ip ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6434",children:"(#6434)"})]}),"\n",(0,r.jsxs)(s.li,{children:["log kube-router version when starting netpol controller ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6439",children:"(#6439)"})]}),"\n",(0,r.jsxs)(s.li,{children:["K3s now indicates specifically which cluster-level configuration flags are out of sync when critical configuration differs between server nodes. ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6446",children:"(#6446)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Pull traefik helm chart directly from GH ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6469",children:"(#6469)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Update to v1.24.8 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6479",children:"(#6479)"})]}),"\n",(0,r.jsxs)(s.li,{children:["The packaged traefik helm chart has been bumped to 19.0.4 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6495",children:"(#6495)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Move traefik chart repo again ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6509",children:"(#6509)"})]}),"\n"]}),"\n",(0,r.jsx)(s.hr,{}),"\n",(0,r.jsxs)(s.h2,{id:"release-v1247k3s1",children:["Release ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/releases/tag/v1.24.7+k3s1",children:"v1.24.7+k3s1"})]}),"\n",(0,r.jsx)(s.p,{children:"This release updates Kubernetes to v1.24.7, and fixes a number of issues."}),"\n",(0,r.jsxs)(s.p,{children:["The K3s ",(0,r.jsx)(s.a,{href:"https://docs.k3s.io/security/hardening-guide",children:"CIS Hardening Guide"})," has been updated to include configuration changes required to support embedding ServiceLB in the cloud controller manager. If you have followed the hardening guide, please update your policies and RBAC in accordingly."]}),"\n",(0,r.jsxs)(s.p,{children:["For more details on what's new, see the ",(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.24.md#changelog-since-v1246",children:"Kubernetes release notes"}),"."]}),"\n",(0,r.jsx)(s.h3,{id:"changes-since-v1246k3s1",children:"Changes since v1.24.6+k3s1:"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsxs)(s.li,{children:["Add flannel-external-ip when there is a k3s node-external-ip ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6189",children:"(#6189)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Backports for 2022-10 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6227",children:"(#6227)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:"The embedded metrics-server version has been bumped to v0.6.1"}),"\n",(0,r.jsx)(s.li,{children:"The ServiceLB (klipper-lb) service controller is now integrated into the K3s stub cloud controller manager."}),"\n",(0,r.jsx)(s.li,{children:"Events recorded to the cluster by embedded controllers are now properly formatted in the service logs."}),"\n",(0,r.jsxs)(s.li,{children:["Fixed an issue with the apiserver network proxy that caused ",(0,r.jsx)(s.code,{children:"kubectl exec"})," to occasionally fail with ",(0,r.jsx)(s.code,{children:"error dialing backend: EOF"})]}),"\n",(0,r.jsxs)(s.li,{children:["Fixed an issue with the apiserver network proxy that caused ",(0,r.jsx)(s.code,{children:"kubectl exec"})," and ",(0,r.jsx)(s.code,{children:"kubectl logs"})," to fail when a custom kubelet port was used, and the custom port was blocked by firewall or security group rules."]}),"\n",(0,r.jsx)(s.li,{children:"The embedded Traefik version has been bumped to v2.9.1 / chart 12.0.0"}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Replace deprecated ioutil package ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6235",children:"(#6235)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Fix dualStack test ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6250",children:"(#6250)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Update to v1.24.7-k3s1 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6270",children:"(#6270)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Add ServiceAccount for svclb pods ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6276",children:"(#6276)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Return ProviderID in URI format ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6287",children:"(#6287)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Corrected CCM RBAC to allow for removal of legacy service finalizer during upgrades. ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6307",children:"(#6307)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Added a new --flannel-external-ip flag. ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6322",children:"(#6322)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:"When enabled, Flannel traffic will now use the nodes external IPs, instead of internal."}),"\n",(0,r.jsx)(s.li,{children:"This is meant for use with distributed clusters that are not all on the same local network."}),"\n"]}),"\n"]}),"\n"]}),"\n",(0,r.jsx)(s.hr,{}),"\n",(0,r.jsxs)(s.h2,{id:"release-v1246k3s1",children:["Release ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/releases/tag/v1.24.6+k3s1",children:"v1.24.6+k3s1"})]}),"\n",(0,r.jsx)(s.p,{children:"This release updates Kubernetes to v1.24.6, and fixes a number of issues."}),"\n",(0,r.jsxs)(s.p,{children:["For more details on what's new, see the ",(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.24.md#changelog-since-v1244",children:"Kubernetes release notes"}),"."]}),"\n",(0,r.jsx)(s.h3,{id:"changes-since-v1244k3s1",children:"Changes since v1.24.4+k3s1:"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsxs)(s.li,{children:["Remove ",(0,r.jsx)(s.code,{children:"--containerd"})," flag from windows kubelet args ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6028",children:"(#6028)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Mark v1.24.4+k3s1 as stable ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6036",children:"(#6036)"})]}),"\n",(0,r.jsxs)(s.li,{children:["E2E: Add support for CentOS 7 and Rocky 8 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6015",children:"(#6015)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Convert install tests to run PR build of k3s ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6003",children:"(#6003)"})]}),"\n",(0,r.jsxs)(s.li,{children:["CI: update Fedora 34 -> 35 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/5996",children:"(#5996)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Fix dualStack test and change ipv6 network prefix ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6023",children:"(#6023)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Fix e2e tests ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6018",children:"(#6018)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Update Flannel version to fix older iptables version issue. ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6088",children:"(#6088)"})]}),"\n",(0,r.jsxs)(s.li,{children:["The bundled version of runc has been bumped to v1.1.4 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6072",children:"(#6072)"})]}),"\n",(0,r.jsxs)(s.li,{children:["The embedded containerd version has been bumped to v1.6.8-k3s1 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6079",children:"(#6079)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Bulk Backport of Testing Changes ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6085",children:"(#6085)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Add validation check to confirm correct golang version for Kubernetes ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6113",children:"(#6113)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Update to v1.24.5 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6143",children:"(#6143)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Update to v1.24.6-k3s1 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6164",children:"(#6164)"})]}),"\n"]}),"\n",(0,r.jsx)(s.hr,{}),"\n",(0,r.jsxs)(s.h2,{id:"release-v1244k3s1",children:["Release ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/releases/tag/v1.24.4+k3s1",children:"v1.24.4+k3s1"})]}),"\n",(0,r.jsx)(s.p,{children:"This release updates Kubernetes to v1.24.4, and fixes a number of issues."}),"\n",(0,r.jsxs)(s.p,{children:["This release restores use of the ",(0,r.jsx)(s.code,{children:"--docker"})," flag to the v1.24 branch. See ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/blob/master/docs/adrs/cri-dockerd.md",children:"docs/adrs/cri-dockerd.md"})," for more information."]}),"\n",(0,r.jsxs)(s.p,{children:["For more details on what's new, see the ",(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.24.md#changelog-since-v1243",children:"Kubernetes release notes"}),"."]}),"\n",(0,r.jsx)(s.h3,{id:"changes-since-v1243k3s1",children:"Changes since v1.24.3+k3s1:"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsxs)(s.li,{children:["Put the terraform tests into their own packages and cleanup the test runs ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/5861",children:"(#5861)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Bumped rootlesskit to v1.0.1 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/5773",children:"(#5773)"})]}),"\n",(0,r.jsxs)(s.li,{children:["The initial health-check time for the etcd datastore has been raised from 10 to 30 seconds. ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/5882",children:"(#5882)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Fixed a regression that caused systemd cgroup driver autoconfiguration to fail on server nodes. ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/5851",children:"(#5851)"})]}),"\n",(0,r.jsxs)(s.li,{children:["The embedded network policy controller has been updated to kube-router v1.5.0 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/5789",children:"(#5789)"})]}),"\n",(0,r.jsxs)(s.li,{children:["The configured service CIDR is now passed to the Kubernetes controller-manager via the ",(0,r.jsx)(s.code,{children:"--service-cluster-ip-range"})," flag. Previously this value was only passed to the apiserver. ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/5894",children:"(#5894)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Updated dynamiclistener to fix a regression that prevented certificate renewal from working properly. ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/5896",children:"(#5896)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Promote v1.24.3+k3s1 to stable ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/5889",children:"(#5889)"})]}),"\n",(0,r.jsxs)(s.li,{children:["ADR: Depreciating and Removing Old Flags ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/5890",children:"(#5890)"})]}),"\n",(0,r.jsxs)(s.li,{children:["K3s no longer sets containerd's ",(0,r.jsx)(s.code,{children:"enable_unprivileged_icmp"})," and ",(0,r.jsx)(s.code,{children:"enable_unprivileged_ports"})," options on kernels that do not support them. ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/5913",children:"(#5913)"})]}),"\n",(0,r.jsxs)(s.li,{children:["The etcd error on incorrect peer urls now correctly includes the expected https and 2380 port. ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/5909",children:"(#5909)"})]}),"\n",(0,r.jsxs)(s.li,{children:["When set, the agent-token value is now written to ",(0,r.jsx)(s.code,{children:"$datadir/server/agent-token"}),", in the same manner as the default (server) token is written to ",(0,r.jsx)(s.code,{children:"$datadir/server/token"})," ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/5906",children:"(#5906)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Deprecated flags now warn of their v1.25 removal ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/5937",children:"(#5937)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Fix secrets reencryption for clusters with 8K+ secrets ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/5936",children:"(#5936)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Bumped minio-go to v7.0.33. This adds support for IMDSv2 credentials. ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/5928",children:"(#5928)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Upgrade GH Actions macos-10.15 to macos-12 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/5953",children:"(#5953)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Added dualstack IP auto detection ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/5920",children:"(#5920)"})]}),"\n",(0,r.jsxs)(s.li,{children:["The ",(0,r.jsx)(s.code,{children:"--docker"})," flag has been restored to k3s, as a shortcut to enabling embedded cri-dockerd ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/5916",children:"(#5916)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Update MAINTAINERS with new folks and departures ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/5948",children:"(#5948)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Removing checkbox indicating backports ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/5947",children:"(#5947)"})]}),"\n",(0,r.jsxs)(s.li,{children:["fix checkError in terraform/testutils ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/5893",children:"(#5893)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Add scripts to run e2e test using ansible ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/5134",children:"(#5134)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Updated flannel to v0.19.1 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/5962",children:"(#5962)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Update run scripts ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/5979",children:"(#5979)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Convert install/cgroup tests to yaml based config ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/5992",children:"(#5992)"})]}),"\n",(0,r.jsxs)(s.li,{children:["E2E: Local cluster testing ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/5977",children:"(#5977)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Add nightly install github action ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/5998",children:"(#5998)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Convert codespell from Drone to GH actions ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6004",children:"(#6004)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Update to v1.24.4 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6014",children:"(#6014)"})]}),"\n"]}),"\n",(0,r.jsx)(s.hr,{}),"\n",(0,r.jsxs)(s.h2,{id:"release-v1243k3s1",children:["Release ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/releases/tag/v1.24.3+k3s1",children:"v1.24.3+k3s1"})]}),"\n",(0,r.jsx)(s.p,{children:"This release updates Kubernetes to v1.24.3, and fixes a number of issues."}),"\n",(0,r.jsxs)(s.p,{children:["For more details on what's new, see the ",(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.24.md#changelog-since-v1242",children:"Kubernetes release notes"}),"."]}),"\n",(0,r.jsx)(s.h3,{id:"changes-since-v1242k3s2",children:"Changes since v1.24.2+k3s2:"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsxs)(s.li,{children:["Updated rancher/remotedialer to address a potential memory leak. ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/5784",children:"(#5784)"})]}),"\n",(0,r.jsxs)(s.li,{children:["The embedded runc binary has been bumped to v1.1.3 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/5783",children:"(#5783)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Fixed a regression that caused some containerd labels to be empty in cadvisor pod metrics ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/5812",children:"(#5812)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Replace dapper testing with regular docker ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/5805",children:"(#5805)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Promote v1.23.8+k3s2 to stable ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/5814",children:"(#5814)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Fixed an issue that would cause etcd restore to fail when restoring a snapshot made with secrets encryption enabled if the --secrets-encryption command was not included in the config file or restore command. ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/5817",children:"(#5817)"})]}),"\n",(0,r.jsx)(s.li,{children:"Fix deletion of svclb DaemonSet when Service is deleted"}),"\n",(0,r.jsxs)(s.li,{children:["Fixed a regression that caused ServiceLB DaemonSets to remain present after their corresponding Services were deleted.\r\nManual cleanup of orphaned ",(0,r.jsx)(s.code,{children:"svclb-*"})," DaemonSets from the ",(0,r.jsx)(s.code,{children:"kube-system"})," namespace may be necessary if any LoadBalancer Services were deleted while running an affected release. ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/5824",children:"(#5824)"})]}),"\n",(0,r.jsx)(s.li,{children:"Address issues with etcd snapshots"}),"\n",(0,r.jsx)(s.li,{children:"Scheduled etcd snapshots are now compressed when snapshot compression is enabled."}),"\n",(0,r.jsx)(s.li,{children:"The default etcd snapshot timeout has been raised to 5 minutes.\r\nOnly one scheduled etcd snapshot will run at a time. If another snapshot would occur while the previous snapshot is still in progress, an error will be logged and the second scheduled snapshot will be skipped."}),"\n",(0,r.jsxs)(s.li,{children:["S3 objects for etcd snapshots are now labeled with the correct content-type when compression is not enabled. ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/5833",children:"(#5833)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Update to v1.24.3 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/5870",children:"(#5870)"})]}),"\n"]}),"\n",(0,r.jsx)(s.hr,{}),"\n",(0,r.jsxs)(s.h2,{id:"release-v1242k3s2",children:["Release ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/releases/tag/v1.24.2+k3s2",children:"v1.24.2+k3s2"})]}),"\n",(0,r.jsx)(s.p,{children:"This fixes several issues in the v1.24.2+k3s1 and prior releases."}),"\n",(0,r.jsx)(s.h3,{id:"changes-since-v1242k3s1",children:"Changes since v1.24.2+k3s1:"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsxs)(s.li,{children:["Bumped kine to fix an issue where namespaced lists that included a field-selector on metadata.name would fail to return results when using a sql storage backend. (",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/5795",children:"#5795"}),")"]}),"\n",(0,r.jsxs)(s.li,{children:["K3s will no longer log panics after upgrading directly from much older kubernetes releases, or when deploying services with ",(0,r.jsx)(s.code,{children:"type: externalname"}),". (",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/5771",children:"#5771"}),")"]}),"\n",(0,r.jsxs)(s.li,{children:["Fixed an issue that prevented ",(0,r.jsx)(s.code,{children:"kubectl logs"})," and other functionality that requires a connection to the agent from working correctly when the server's ",(0,r.jsx)(s.code,{children:"--bind-address"})," flag was used, or when k3s is used behind a http proxy. (",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/5780",children:"#5780"}),")"]}),"\n",(0,r.jsxs)(s.li,{children:["Fixed an issue that prevented newer versions of k3s from joining clusters that do not have egress-selector-mode support. (",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/5785",children:"#5785"}),")"]}),"\n",(0,r.jsxs)(s.li,{children:["Remove go-powershell dead dependency (",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/5777",children:"#5777"}),")"]}),"\n"]}),"\n",(0,r.jsx)(s.hr,{}),"\n",(0,r.jsxs)(s.h2,{id:"release-v1242k3s1",children:["Release ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/releases/tag/v1.24.2+k3s1",children:"v1.24.2+k3s1"})]}),"\n",(0,r.jsx)(s.p,{children:"This release updates Kubernetes to v1.24.2, and fixes a number of issues."}),"\n",(0,r.jsxs)(s.p,{children:["For more details on what's new, see the ",(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.24.md#changelog-since-v1241",children:"Kubernetes release notes"}),"."]}),"\n",(0,r.jsx)(s.h3,{id:"changes-since-v1241k3s1",children:"Changes since v1.24.1+k3s1:"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsxs)(s.li,{children:["Remove kube-ipvs0 interface when cleaning up ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/5644",children:"(#5644)"})]}),"\n",(0,r.jsxs)(s.li,{children:["The ",(0,r.jsx)(s.code,{children:"--flannel-wireguard-mode"})," switch was added to the k3s cli to configure the wireguard tunnel mode with the wireguard native backend ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/5552",children:"(#5552)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Introduce the flannelcniconf flag to set the desired flannel cni configuration ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/5656",children:"(#5656)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Integration Test: Startup ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/5630",children:"(#5630)"})]}),"\n",(0,r.jsxs)(s.li,{children:["E2E Improvements and groundwork for test-pad tool ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/5593",children:"(#5593)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Update SECURITY.md ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/5607",children:"(#5607)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Introduce --enable-pprof flag to optionally run pprof server ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/5527",children:"(#5527)"})]}),"\n",(0,r.jsxs)(s.li,{children:["E2E: Dualstack test ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/5617",children:"(#5617)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Pods created by ServiceLB are now all placed in the ",(0,r.jsx)(s.code,{children:"kube-system"})," namespace, instead of in the same namespace as the Service. This allows for ",(0,r.jsx)(s.a,{href:"https://kubernetes.io/docs/tasks/configure-pod-container/enforce-standards-namespace-labels/",children:"enforcing Pod Security Standards"})," in user namespaces without breaking ServiceLB. ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/5657",children:"(#5657)"})]}),"\n",(0,r.jsxs)(s.li,{children:["E2E: testpad prep, add alternate scripts location ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/5692",children:"(#5692)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Add arm tests and upgrade tests ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/5526",children:"(#5526)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Delay service readiness until after startuphooks have finished ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/5649",children:"(#5649)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Disable urfave markdown/man docs generation ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/5566",children:"(#5566)"})]}),"\n",(0,r.jsxs)(s.li,{children:["The embedded etcd snapshot controller will no longer fail to process snapshot files containing characters that are invalid for use in ConfigMap keys. ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/5702",children:"(#5702)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Environment variables prefixed with ",(0,r.jsx)(s.code,{children:"CONTAINERD_"})," now take priority over other existing variables, when passed through to containerd. ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/5706",children:"(#5706)"})]}),"\n",(0,r.jsxs)(s.li,{children:["The embedded etcd instance no longer accepts connections from other nodes while resetting or restoring. ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/5542",children:"(#5542)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Enable compatibility tests for k3s s390x ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/5658",children:"(#5658)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Containerd: Enable enable_unprivileged_ports and enable_unprivileged_\u2026 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/5538",children:"(#5538)"})]}),"\n",(0,r.jsxs)(s.li,{children:["The embedded Helm controller now properly updates Chart deployments when HelmChartConfig resources are updated or deleted. ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/5731",children:"(#5731)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Update to v1.24.2 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/5749",children:"(#5749)"})]}),"\n"]}),"\n",(0,r.jsx)(s.hr,{}),"\n",(0,r.jsxs)(s.h2,{id:"release-v1241k3s1",children:["Release ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/releases/tag/v1.24.1+k3s1",children:"v1.24.1+k3s1"})]}),"\n",(0,r.jsx)(s.p,{children:"This release updates Kubernetes to v1.24.1, and fixes a number of issues."}),"\n",(0,r.jsxs)(s.p,{children:["For more details on what's new, see the ",(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.24.md#changelog-since-v1240",children:"Kubernetes release notes"}),"."]}),"\n",(0,r.jsx)(s.h3,{id:"changes-since-v1240k3s1",children:"Changes since v1.24.0+k3s1:"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsxs)(s.li,{children:["Objects will be removed from Kubernetes when they are removed from manifest files. ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/5560",children:"(#5560)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Remove errant unversioned etcd go.mod entry ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/5548",children:"(#5548)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Pass the node-ip values to kubelet ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/5579",children:"(#5579)"})]}),"\n",(0,r.jsxs)(s.li,{children:["The integrated apiserver network proxy's operational mode can now be set with ",(0,r.jsx)(s.code,{children:"--egress-selector-mode"}),". ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/5577",children:"(#5577)"})]}),"\n",(0,r.jsxs)(s.li,{children:["remove dweomer from maintainers ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/5582",children:"(#5582)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Bump dynamiclistener to v0.3.3 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/5554",children:"(#5554)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Update to v1.24.1-k3s1 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/5616",children:"(#5616)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Re-add ",(0,r.jsx)(s.code,{children:"--cloud-provider=external"})," kubelet arg ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/5628",children:"(#5628)"})]}),"\n",(0,r.jsxs)(s.li,{children:['Revert "Give kubelet the node-ip value (#5579)" ',(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/5636",children:"(#5636)"})]}),"\n"]}),"\n",(0,r.jsx)(s.hr,{})]})}function o(e={}){const{wrapper:s}={...(0,n.a)(),...e.components};return s?(0,r.jsx)(s,{...e,children:(0,r.jsx)(a,{...e})}):a(e)}},1151:(e,s,t)=>{t.d(s,{Z:()=>h,a:()=>l});var r=t(7294);const n={},i=r.createContext(n);function l(e){const s=r.useContext(i);return r.useMemo((function(){return"function"==typeof e?e(s):{...s,...e}}),[s,e])}function h(e){let s;return s=e.disableParentContext?"function"==typeof e.components?e.components(n):e.components||n:l(e.components),r.createElement(i.Provider,{value:s},e.children)}}}]); \ No newline at end of file +"use strict";(self.webpackChunkk_3_s_docs=self.webpackChunkk_3_s_docs||[]).push([[855],{5418:(e,s,t)=>{t.r(s),t.d(s,{assets:()=>c,contentTitle:()=>l,default:()=>o,frontMatter:()=>i,metadata:()=>h,toc:()=>d});var r=t(5893),n=t(1151);const i={hide_table_of_contents:!0,sidebar_position:7},l="v1.24.X",h={id:"release-notes/v1.24.X",title:"v1.24.X",description:"Before upgrading from earlier releases, be sure to read the Kubernetes Urgent Upgrade Notes.",source:"@site/docs/release-notes/v1.24.X.md",sourceDirName:"release-notes",slug:"/release-notes/v1.24.X",permalink:"/release-notes/v1.24.X",draft:!1,unlisted:!1,editUrl:"https://github.com/k3s-io/docs/edit/main/docs/release-notes/v1.24.X.md",tags:[],version:"current",lastUpdatedAt:1723747404e3,sidebarPosition:7,frontMatter:{hide_table_of_contents:!0,sidebar_position:7},sidebar:"mySidebar",previous:{title:"v1.25.X",permalink:"/release-notes/v1.25.X"},next:{title:"Related Projects",permalink:"/related-projects"}},c={},d=[{value:"Release v1.24.17+k3s1",id:"release-v12417k3s1",level:2},{value:"Changes since v1.24.16+k3s1:",id:"changes-since-v12416k3s1",level:3},{value:"Release v1.24.16+k3s1",id:"release-v12416k3s1",level:2},{value:"Changes since v1.24.14+k3s1:",id:"changes-since-v12414k3s1",level:3},{value:"Release v1.24.15+k3s1",id:"release-v12415k3s1",level:2},{value:"Changes since v1.24.14+k3s1:",id:"changes-since-v12414k3s1-1",level:3},{value:"Release v1.24.14+k3s1",id:"release-v12414k3s1",level:2},{value:"Changes since v1.24.13+k3s1:",id:"changes-since-v12413k3s1",level:3},{value:"Release v1.24.13+k3s1",id:"release-v12413k3s1",level:2},{value:"Changes since v1.24.12+k3s1:",id:"changes-since-v12412k3s1",level:3},{value:"Release v1.24.12+k3s1",id:"release-v12412k3s1",level:2},{value:"Changes since v1.24.11+k3s1:",id:"changes-since-v12411k3s1",level:3},{value:"Release v1.24.11+k3s1",id:"release-v12411k3s1",level:2},{value:"Changes since v1.24.10+k3s1:",id:"changes-since-v12410k3s1",level:3},{value:"Release v1.24.10+k3s1",id:"release-v12410k3s1",level:2},{value:"Changes since v1.24.9+k3s2:",id:"changes-since-v1249k3s2",level:3},{value:"Release v1.24.9+k3s2",id:"release-v1249k3s2",level:2},{value:"Changes since v1.24.9+k3s1:",id:"changes-since-v1249k3s1",level:3},{value:"Release v1.24.9+k3s1",id:"release-v1249k3s1",level:2},{value:"\u26a0\ufe0f WARNING",id:"\ufe0f-warning",level:2},{value:"Changes since v1.24.8+k3s1:",id:"changes-since-v1248k3s1",level:3},{value:"Release v1.24.8+k3s1",id:"release-v1248k3s1",level:2},{value:"Changes since v1.24.7+k3s1:",id:"changes-since-v1247k3s1",level:3},{value:"Release v1.24.7+k3s1",id:"release-v1247k3s1",level:2},{value:"Changes since v1.24.6+k3s1:",id:"changes-since-v1246k3s1",level:3},{value:"Release v1.24.6+k3s1",id:"release-v1246k3s1",level:2},{value:"Changes since v1.24.4+k3s1:",id:"changes-since-v1244k3s1",level:3},{value:"Release v1.24.4+k3s1",id:"release-v1244k3s1",level:2},{value:"Changes since v1.24.3+k3s1:",id:"changes-since-v1243k3s1",level:3},{value:"Release v1.24.3+k3s1",id:"release-v1243k3s1",level:2},{value:"Changes since v1.24.2+k3s2:",id:"changes-since-v1242k3s2",level:3},{value:"Release v1.24.2+k3s2",id:"release-v1242k3s2",level:2},{value:"Changes since v1.24.2+k3s1:",id:"changes-since-v1242k3s1",level:3},{value:"Release v1.24.2+k3s1",id:"release-v1242k3s1",level:2},{value:"Changes since v1.24.1+k3s1:",id:"changes-since-v1241k3s1",level:3},{value:"Release v1.24.1+k3s1",id:"release-v1241k3s1",level:2},{value:"Changes since v1.24.0+k3s1:",id:"changes-since-v1240k3s1",level:3}];function a(e){const s={a:"a",admonition:"admonition",blockquote:"blockquote",code:"code",h1:"h1",h2:"h2",h3:"h3",header:"header",hr:"hr",li:"li",p:"p",strong:"strong",table:"table",tbody:"tbody",td:"td",th:"th",thead:"thead",tr:"tr",ul:"ul",...(0,n.a)(),...e.components};return(0,r.jsxs)(r.Fragment,{children:[(0,r.jsx)(s.header,{children:(0,r.jsx)(s.h1,{id:"v124x",children:"v1.24.X"})}),"\n",(0,r.jsx)(s.admonition,{title:"Upgrade Notice",type:"warning",children:(0,r.jsxs)(s.p,{children:["Before upgrading from earlier releases, be sure to read the Kubernetes ",(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.24.md#urgent-upgrade-notes",children:"Urgent Upgrade Notes"}),"."]})}),"\n",(0,r.jsxs)(s.table,{children:[(0,r.jsx)(s.thead,{children:(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.th,{children:"Version"}),(0,r.jsx)(s.th,{children:"Release date"}),(0,r.jsx)(s.th,{children:"Kubernetes"}),(0,r.jsx)(s.th,{children:"Kine"}),(0,r.jsx)(s.th,{children:"SQLite"}),(0,r.jsx)(s.th,{children:"Etcd"}),(0,r.jsx)(s.th,{children:"Containerd"}),(0,r.jsx)(s.th,{children:"Runc"}),(0,r.jsx)(s.th,{children:"Flannel"}),(0,r.jsx)(s.th,{children:"Metrics-server"}),(0,r.jsx)(s.th,{children:"Traefik"}),(0,r.jsx)(s.th,{children:"CoreDNS"}),(0,r.jsx)(s.th,{children:"Helm-controller"}),(0,r.jsx)(s.th,{children:"Local-path-provisioner"})]})}),(0,r.jsxs)(s.tbody,{children:[(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"/release-notes/v1.24.X#release-v12417k3s1",children:"v1.24.17+k3s1"})}),(0,r.jsx)(s.td,{children:"Sep 05 2023"}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.24.md#v12417",children:"v1.24.17"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/kine/releases/tag/v0.10.2",children:"v0.10.2"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://sqlite.org/releaselog/3_42_0.html",children:"3.42.0"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/etcd/releases/tag/v3.5.3-k3s1",children:"v3.5.3-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/containerd/releases/tag/v1.7.3-k3s1",children:"v1.7.3-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/opencontainers/runc/releases/tag/v1.1.8",children:"v1.1.8"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/flannel-io/flannel/releases/tag/v0.21.3-k3s1.23",children:"v0.21.3-k3s1.23"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.6.3",children:"v0.6.3"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/traefik/traefik/releases/tag/v2.9.10",children:"v2.9.10"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/coredns/coredns/releases/tag/v1.10.1",children:"v1.10.1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/helm-controller/releases/tag/v0.15.4",children:"v0.15.4"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/rancher/local-path-provisioner/releases/tag/v0.0.24",children:"v0.0.24"})})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"/release-notes/v1.24.X#release-v12416k3s1",children:"v1.24.16+k3s1"})}),(0,r.jsx)(s.td,{children:"Jul 27 2023"}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.24.md#v12416",children:"v1.24.16"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/kine/releases/tag/v0.10.1",children:"v0.10.1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://sqlite.org/releaselog/3_39_2.html",children:"3.39.2"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/etcd/releases/tag/v3.5.3-k3s1",children:"v3.5.3-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/containerd/releases/tag/v1.7.1-k3s1",children:"v1.7.1-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/opencontainers/runc/releases/tag/v1.1.7",children:"v1.1.7"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/flannel-io/flannel/releases/tag/v0.21.3-k3s1.23",children:"v0.21.3-k3s1.23"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.6.3",children:"v0.6.3"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/traefik/traefik/releases/tag/v2.9.10",children:"v2.9.10"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/coredns/coredns/releases/tag/v1.10.1",children:"v1.10.1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/helm-controller/releases/tag/v0.15.2",children:"v0.15.2"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/rancher/local-path-provisioner/releases/tag/v0.0.24",children:"v0.0.24"})})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"/release-notes/v1.24.X#release-v12415k3s1",children:"v1.24.15+k3s1"})}),(0,r.jsx)(s.td,{children:"Jun 26 2023"}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.24.md#v12415",children:"v1.24.15"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/kine/releases/tag/v0.10.1",children:"v0.10.1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://sqlite.org/releaselog/3_39_2.html",children:"3.39.2"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/etcd/releases/tag/v3.5.3-k3s1",children:"v3.5.3-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/containerd/releases/tag/v1.7.1-k3s1",children:"v1.7.1-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/opencontainers/runc/releases/tag/v1.1.7",children:"v1.1.7"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/flannel-io/flannel/releases/tag/v0.21.3-k3s1.23",children:"v0.21.3-k3s1.23"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.6.3",children:"v0.6.3"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/traefik/traefik/releases/tag/v2.9.10",children:"v2.9.10"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/coredns/coredns/releases/tag/v1.10.1",children:"v1.10.1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/helm-controller/releases/tag/v0.15.0",children:"v0.15.0"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/rancher/local-path-provisioner/releases/tag/v0.0.24",children:"v0.0.24"})})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"/release-notes/v1.24.X#release-v12414k3s1",children:"v1.24.14+k3s1"})}),(0,r.jsx)(s.td,{children:"May 26 2023"}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.24.md#v12414",children:"v1.24.14"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/kine/releases/tag/v0.10.1",children:"v0.10.1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://sqlite.org/releaselog/3_39_2.html",children:"3.39.2"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/etcd/releases/tag/v3.5.3-k3s1",children:"v3.5.3-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/containerd/releases/tag/v1.7.1-k3s1",children:"v1.7.1-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/opencontainers/runc/releases/tag/v1.1.7",children:"v1.1.7"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/flannel-io/flannel/releases/tag/v0.21.3-k3s1.23",children:"v0.21.3-k3s1.23"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.6.2",children:"v0.6.2"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/traefik/traefik/releases/tag/v2.9.10",children:"v2.9.10"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/coredns/coredns/releases/tag/v1.10.1",children:"v1.10.1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/helm-controller/releases/tag/v0.14.0",children:"v0.14.0"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/rancher/local-path-provisioner/releases/tag/v0.0.24",children:"v0.0.24"})})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"/release-notes/v1.24.X#release-v12413k3s1",children:"v1.24.13+k3s1"})}),(0,r.jsx)(s.td,{children:"Apr 20 2023"}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.24.md#v12413",children:"v1.24.13"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/kine/releases/tag/v0.9.9",children:"v0.9.9"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://sqlite.org/releaselog/3_39_2.html",children:"3.39.2"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/etcd/releases/tag/v3.5.3-k3s1",children:"v3.5.3-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/containerd/releases/tag/v1.6.19-k3s1",children:"v1.6.19-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/opencontainers/runc/releases/tag/v1.1.5",children:"v1.1.5"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/flannel-io/flannel/releases/tag/v0.21.3-k3s1.23",children:"v0.21.3-k3s1.23"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.6.2",children:"v0.6.2"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/traefik/traefik/releases/tag/v2.9.4",children:"v2.9.4"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/coredns/coredns/releases/tag/v1.10.1",children:"v1.10.1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/helm-controller/releases/tag/v0.13.3",children:"v0.13.3"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/rancher/local-path-provisioner/releases/tag/v0.0.24",children:"v0.0.24"})})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"/release-notes/v1.24.X#release-v12412k3s1",children:"v1.24.12+k3s1"})}),(0,r.jsx)(s.td,{children:"Mar 27 2023"}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.24.md#v12412",children:"v1.24.12"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/kine/releases/tag/v0.9.9",children:"v0.9.9"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://sqlite.org/releaselog/3_39_2.html",children:"3.39.2"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/etcd/releases/tag/v3.5.3-k3s1",children:"v3.5.3-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/containerd/releases/tag/v1.6.19-k3s1",children:"v1.6.19-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/opencontainers/runc/releases/tag/v1.1.4",children:"v1.1.4"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/flannel-io/flannel/releases/tag/v0.21.3-k3s1.23",children:"v0.21.3-k3s1.23"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.6.2",children:"v0.6.2"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/traefik/traefik/releases/tag/v2.9.4",children:"v2.9.4"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/coredns/coredns/releases/tag/v1.9.4",children:"v1.9.4"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/helm-controller/releases/tag/v0.13.1",children:"v0.13.1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/rancher/local-path-provisioner/releases/tag/v0.0.23",children:"v0.0.23"})})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"/release-notes/v1.24.X#release-v12411k3s1",children:"v1.24.11+k3s1"})}),(0,r.jsx)(s.td,{children:"Mar 10 2023"}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.24.md#v12411",children:"v1.24.11"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/kine/releases/tag/v0.9.9",children:"v0.9.9"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://sqlite.org/releaselog/3_39_2.html",children:"3.39.2"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/etcd/releases/tag/v3.5.3-k3s1",children:"v3.5.3-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/containerd/releases/tag/v1.6.15-k3s1",children:"v1.6.15-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/opencontainers/runc/releases/tag/v1.1.4",children:"v1.1.4"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/flannel-io/flannel/releases/tag/v0.21.1-k3s1.23",children:"v0.21.1-k3s1.23"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.6.2",children:"v0.6.2"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/traefik/traefik/releases/tag/v2.9.4",children:"v2.9.4"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/coredns/coredns/releases/tag/v1.9.4",children:"v1.9.4"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/helm-controller/releases/tag/v0.13.1",children:"v0.13.1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/rancher/local-path-provisioner/releases/tag/v0.0.23",children:"v0.0.23"})})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"/release-notes/v1.24.X#release-v12410k3s1",children:"v1.24.10+k3s1"})}),(0,r.jsx)(s.td,{children:"Jan 26 2023"}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.24.md#v12410",children:"v1.24.10"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/kine/releases/tag/v0.9.6",children:"v0.9.6"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://sqlite.org/releaselog/3_39_2.html",children:"3.39.2"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/etcd/releases/tag/v3.5.3-k3s1",children:"v3.5.3-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/containerd/releases/tag/v1.6.15-k3s1",children:"v1.6.15-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/opencontainers/runc/releases/tag/v1.1.4",children:"v1.1.4"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/flannel-io/flannel/releases/tag/v0.20.2-k3s1.23",children:"v0.20.2-k3s1.23"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.6.2",children:"v0.6.2"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/traefik/traefik/releases/tag/v2.9.4",children:"v2.9.4"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/coredns/coredns/releases/tag/v1.9.4",children:"v1.9.4"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/helm-controller/releases/tag/v0.13.1",children:"v0.13.1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/rancher/local-path-provisioner/releases/tag/v0.0.23",children:"v0.0.23"})})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"/release-notes/v1.24.X#release-v1249k3s2",children:"v1.24.9+k3s2"})}),(0,r.jsx)(s.td,{children:"Jan 11 2023"}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.24.md#v1249",children:"v1.24.9"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/kine/releases/tag/v0.9.6",children:"v0.9.6"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://sqlite.org/releaselog/3_39_2.html",children:"3.39.2"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/etcd/releases/tag/v3.5.3-k3s1",children:"v3.5.3-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/containerd/releases/tag/v1.6.14-k3s1",children:"v1.6.14-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/opencontainers/runc/releases/tag/v1.1.4",children:"v1.1.4"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/flannel-io/flannel/releases/tag/v0.20.2-k3s1.23",children:"v0.20.2-k3s1.23"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.6.2",children:"v0.6.2"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/traefik/traefik/releases/tag/v2.9.4",children:"v2.9.4"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/coredns/coredns/releases/tag/v1.9.4",children:"v1.9.4"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/helm-controller/releases/tag/v0.13.1",children:"v0.13.1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/rancher/local-path-provisioner/releases/tag/v0.0.23",children:"v0.0.23"})})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"/release-notes/v1.24.X#release-v1249k3s1",children:"v1.24.9+k3s1"})}),(0,r.jsx)(s.td,{children:"Dec 20 2022"}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.24.md#v1249",children:"v1.24.9"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/kine/releases/tag/v0.9.6",children:"v0.9.6"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://sqlite.org/releaselog/3_39_2.html",children:"3.39.2"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/etcd/releases/tag/v3.5.3-k3s1",children:"v3.5.3-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/containerd/releases/tag/v1.6.12-k3s1",children:"v1.6.12-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/opencontainers/runc/releases/tag/v1.1.4",children:"v1.1.4"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/flannel-io/flannel/releases/tag/v0.20.2-k3s1.23",children:"v0.20.2-k3s1.23"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.6.2",children:"v0.6.2"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/traefik/traefik/releases/tag/v2.9.4",children:"v2.9.4"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/coredns/coredns/releases/tag/v1.9.4",children:"v1.9.4"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/helm-controller/releases/tag/v0.13.1",children:"v0.13.1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/rancher/local-path-provisioner/releases/tag/v0.0.23",children:"v0.0.23"})})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"/release-notes/v1.24.X#release-v1248k3s1",children:"v1.24.8+k3s1"})}),(0,r.jsx)(s.td,{children:"Nov 18 2022"}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.24.md#v1248",children:"v1.24.8"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/kine/releases/tag/v0.9.6",children:"v0.9.6"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://sqlite.org/releaselog/3_39_2.html",children:"3.39.2"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/etcd/releases/tag/v3.5.3-k3s1",children:"v3.5.3-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/containerd/releases/tag/v1.6.8-k3s1",children:"v1.6.8-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/opencontainers/runc/releases/tag/v1.1.4",children:"v1.1.4"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/flannel-io/flannel/releases/tag/v0.20.1-k3s1.23",children:"v0.20.1-k3s1.23"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.6.1",children:"v0.6.1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/traefik/traefik/releases/tag/v2.9.4",children:"v2.9.4"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/coredns/coredns/releases/tag/v1.9.4",children:"v1.9.4"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/helm-controller/releases/tag/v0.13.0",children:"v0.13.0"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/rancher/local-path-provisioner/releases/tag/v0.0.23",children:"v0.0.23"})})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"/release-notes/v1.24.X#release-v1247k3s1",children:"v1.24.7+k3s1"})}),(0,r.jsx)(s.td,{children:"Oct 25 2022"}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.24.md#v1247",children:"v1.24.7"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/kine/releases/tag/v0.9.3",children:"v0.9.3"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://sqlite.org/releaselog/3_36_0.html",children:"3.36.0"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/etcd/releases/tag/v3.5.3-k3s1",children:"v3.5.3-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/containerd/releases/tag/v1.6.8-k3s1",children:"v1.6.8-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/opencontainers/runc/releases/tag/v1.1.4",children:"v1.1.4"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/flannel-io/flannel/releases/tag/v0.19.2",children:"v0.19.2"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.6.1",children:"v0.6.1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/traefik/traefik/releases/tag/v2.9.1",children:"v2.9.1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/coredns/coredns/releases/tag/v1.9.1",children:"v1.9.1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/helm-controller/releases/tag/v0.12.3",children:"v0.12.3"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/rancher/local-path-provisioner/releases/tag/v0.0.21",children:"v0.0.21"})})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"/release-notes/v1.24.X#release-v1246k3s1",children:"v1.24.6+k3s1"})}),(0,r.jsx)(s.td,{children:"Sep 28 2022"}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.24.md#v1246",children:"v1.24.6"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/kine/releases/tag/v0.9.3",children:"v0.9.3"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://sqlite.org/releaselog/3_36_0.html",children:"3.36.0"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/etcd/releases/tag/v3.5.3-k3s1",children:"v3.5.3-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/containerd/releases/tag/v1.6.8-k3s1",children:"v1.6.8-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/opencontainers/runc/releases/tag/v1.1.4",children:"v1.1.4"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/flannel-io/flannel/releases/tag/v0.19.2",children:"v0.19.2"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.5.2",children:"v0.5.2"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/traefik/traefik/releases/tag/v2.6.2",children:"v2.6.2"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/coredns/coredns/releases/tag/v1.9.1",children:"v1.9.1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/helm-controller/releases/tag/v0.12.3",children:"v0.12.3"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/rancher/local-path-provisioner/releases/tag/v0.0.21",children:"v0.0.21"})})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"/release-notes/v1.24.X#release-v1244k3s1",children:"v1.24.4+k3s1"})}),(0,r.jsx)(s.td,{children:"Aug 25 2022"}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.24.md#v1244",children:"v1.24.4"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/kine/releases/tag/v0.9.3",children:"v0.9.3"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://sqlite.org/releaselog/3_36_0.html",children:"3.36.0"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/etcd/releases/tag/v3.5.3-k3s1",children:"v3.5.3-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/containerd/releases/tag/v1.5.13-k3s1",children:"v1.5.13-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/opencontainers/runc/releases/tag/v1.1.3",children:"v1.1.3"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/flannel-io/flannel/releases/tag/v0.19.1",children:"v0.19.1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.5.2",children:"v0.5.2"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/traefik/traefik/releases/tag/v2.6.2",children:"v2.6.2"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/coredns/coredns/releases/tag/v1.9.1",children:"v1.9.1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/helm-controller/releases/tag/v0.12.3",children:"v0.12.3"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/rancher/local-path-provisioner/releases/tag/v0.0.21",children:"v0.0.21"})})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"/release-notes/v1.24.X#release-v1243k3s1",children:"v1.24.3+k3s1"})}),(0,r.jsx)(s.td,{children:"Jul 19 2022"}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.24.md#v1243",children:"v1.24.3"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/kine/releases/tag/v0.9.3",children:"v0.9.3"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://sqlite.org/releaselog/3_36_0.html",children:"3.36.0"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/etcd/releases/tag/v3.5.3-k3s1",children:"v3.5.3-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/containerd/releases/tag/v1.5.13-k3s1",children:"v1.5.13-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/opencontainers/runc/releases/tag/v1.1.3",children:"v1.1.3"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/flannel-io/flannel/releases/tag/v0.18.1",children:"v0.18.1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.5.2",children:"v0.5.2"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/traefik/traefik/releases/tag/v2.6.2",children:"v2.6.2"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/coredns/coredns/releases/tag/v1.9.1",children:"v1.9.1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/helm-controller/releases/tag/v0.12.3",children:"v0.12.3"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/rancher/local-path-provisioner/releases/tag/v0.0.21",children:"v0.0.21"})})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"/release-notes/v1.24.X#release-v1242k3s2",children:"v1.24.2+k3s2"})}),(0,r.jsx)(s.td,{children:"Jul 06 2022"}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.24.md#v1242",children:"v1.24.2"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/kine/releases/tag/v0.9.3",children:"v0.9.3"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://sqlite.org/releaselog/3_36_0.html",children:"3.36.0"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/etcd/releases/tag/v3.5.3-k3s1",children:"v3.5.3-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/containerd/releases/tag/v1.5.13-k3s1",children:"v1.5.13-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/opencontainers/runc/releases/tag/v1.1.2",children:"v1.1.2"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/flannel-io/flannel/releases/tag/v0.18.1",children:"v0.18.1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.5.2",children:"v0.5.2"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/traefik/traefik/releases/tag/v2.6.2",children:"v2.6.2"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/coredns/coredns/releases/tag/v1.9.1",children:"v1.9.1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/helm-controller/releases/tag/v0.12.3",children:"v0.12.3"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/rancher/local-path-provisioner/releases/tag/v0.0.21",children:"v0.0.21"})})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"/release-notes/v1.24.X#release-v1242k3s1",children:"v1.24.2+k3s1"})}),(0,r.jsx)(s.td,{children:"Jun 27 2022"}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.24.md#v1242",children:"v1.24.2"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/kine/releases/tag/v0.9.1",children:"v0.9.1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://sqlite.org/releaselog/3_36_0.html",children:"3.36.0"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/etcd/releases/tag/v3.5.3-k3s1",children:"v3.5.3-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/containerd/releases/tag/v1.6.6-k3s1",children:"v1.6.6-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/opencontainers/runc/releases/tag/v1.1.2",children:"v1.1.2"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/flannel-io/flannel/releases/tag/v0.18.1",children:"v0.18.1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.5.2",children:"v0.5.2"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/traefik/traefik/releases/tag/v2.6.2",children:"v2.6.2"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/coredns/coredns/releases/tag/v1.9.1",children:"v1.9.1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/helm-controller/releases/tag/v0.12.3",children:"v0.12.3"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/rancher/local-path-provisioner/releases/tag/v0.0.21",children:"v0.0.21"})})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"/release-notes/v1.24.X#release-v1241k3s1",children:"v1.24.1+k3s1"})}),(0,r.jsx)(s.td,{children:"Jun 11 2022"}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.24.md#v1241",children:"v1.24.1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/kine/releases/tag/v0.9.1",children:"v0.9.1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://sqlite.org/releaselog/3_36_0.html",children:"3.36.0"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/etcd/releases/tag/v3.5.3-k3s1",children:"v3.5.3-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/containerd/releases/tag/v1.5.11-k3s1",children:"v1.5.11-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/opencontainers/runc/releases/tag/v1.1.1",children:"v1.1.1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/flannel-io/flannel/releases/tag/v0.17.0",children:"v0.17.0"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.5.2",children:"v0.5.2"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/traefik/traefik/releases/tag/v2.6.2",children:"v2.6.2"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/coredns/coredns/releases/tag/v1.9.1",children:"v1.9.1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/helm-controller/releases/tag/v0.12.1",children:"v0.12.1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/rancher/local-path-provisioner/releases/tag/v0.0.21",children:"v0.0.21"})})]})]})]}),"\n",(0,r.jsx)("br",{}),"\n",(0,r.jsxs)(s.h2,{id:"release-v12417k3s1",children:["Release ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/releases/tag/v1.24.17+k3s1",children:"v1.24.17+k3s1"})]}),"\n",(0,r.jsx)(s.p,{children:"This release updates Kubernetes to v1.24.17, and fixes a number of issues."}),"\n",(0,r.jsx)(s.admonition,{title:"IMPORTANT",type:"warning",children:(0,r.jsxs)(s.p,{children:["This release includes support for remediating CVE-2023-32187, a potential Denial of Service attack vector on K3s servers. See ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/security/advisories/GHSA-m4hf-6vgr-75r2",children:"https://github.com/k3s-io/k3s/security/advisories/GHSA-m4hf-6vgr-75r2"})," for more information, including mandatory steps necessary to harden clusters against this vulnerability."]})}),"\n",(0,r.jsxs)(s.p,{children:["For more details on what's new, see the ",(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.24.md#changelog-since-v12416",children:"Kubernetes release notes"}),"."]}),"\n",(0,r.jsx)(s.h3,{id:"changes-since-v12416k3s1",children:"Changes since v1.24.16+k3s1:"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsxs)(s.li,{children:["Update cni plugins version to v1.3.0 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8087",children:"(#8087)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Etcd snapshots retention when node name changes ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8124",children:"(#8124)"})]}),"\n",(0,r.jsxs)(s.li,{children:["August Test Backports ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8128",children:"(#8128)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Backports for 2023-08 release ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8135",children:"(#8135)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:"K3s's external apiserver listener now declines to add to its certificate any subject names not associated with the kubernetes apiserver service, server nodes, or values of the --tls-san option. This prevents the certificate's SAN list from being filled with unwanted entries."}),"\n",(0,r.jsxs)(s.li,{children:["K3s no longer enables the apiserver's ",(0,r.jsx)(s.code,{children:"enable-aggregator-routing"})," flag when the egress proxy is not being used to route connections to in-cluster endpoints."]}),"\n",(0,r.jsx)(s.li,{children:"Updated the embedded containerd to v1.7.3+k3s1"}),"\n",(0,r.jsx)(s.li,{children:"Updated the embedded runc to v1.1.8"}),"\n",(0,r.jsxs)(s.li,{children:["User-provided containerd config templates may now use ",(0,r.jsx)(s.code,{children:'{{ template "base" . }}'})," to include the default K3s template content. This makes it easier to maintain user configuration if the only need is to add additional sections to the file."]}),"\n",(0,r.jsx)(s.li,{children:"Bump docker/docker module version to fix issues with cri-dockerd caused by recent releases of golang rejecting invalid host headers sent by the docker client."}),"\n",(0,r.jsx)(s.li,{children:"Updated kine to v0.10.2"}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["K3s etcd-snapshot delete fail to delete local file when called with s3 flag ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8146",children:"(#8146)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Fix for cluster-reset backup from s3 when etcd snapshots are disabled ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8168",children:"(#8168)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Fixed the etcd retention to delete orphaned snapshots based on the date ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8191",children:"(#8191)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Additional backports for 2023-08 release ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8214",children:"(#8214)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsxs)(s.li,{children:["The version of ",(0,r.jsx)(s.code,{children:"helm"})," used by the bundled helm controller's job image has been updated to v3.12.3"]}),"\n",(0,r.jsx)(s.li,{children:"Bumped dynamiclistener to address an issue that could cause the apiserver/supervisor listener on 6443 to stop serving requests on etcd-only nodes."}),"\n",(0,r.jsx)(s.li,{children:"The K3s external apiserver/supervisor listener on 6443 now sends a complete certificate chain in the TLS handshake."}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Fix runc version bump ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8243",children:"(#8243)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Update to v1.24.17 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8240",children:"(#8240)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Add new CLI flag to enable TLS SAN CN filtering ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8260",children:"(#8260)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsxs)(s.li,{children:["Added a new ",(0,r.jsx)(s.code,{children:"--tls-san-security"})," option. This flag defaults to false, but can be set to true to disable automatically adding SANs to the server's TLS certificate to satisfy any hostname requested by a client."]}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Add RWMutex to address controller ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8276",children:"(#8276)"})]}),"\n"]}),"\n",(0,r.jsx)(s.hr,{}),"\n",(0,r.jsxs)(s.h2,{id:"release-v12416k3s1",children:["Release ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/releases/tag/v1.24.16+k3s1",children:"v1.24.16+k3s1"})]}),"\n",(0,r.jsx)(s.p,{children:"This release updates Kubernetes to v1.24.16, and fixes a number of issues."}),"\n",(0,r.jsxs)(s.p,{children:["For more details on what's new, see the ",(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.24.md#changelog-since-v12415",children:"Kubernetes release notes"}),"."]}),"\n",(0,r.jsx)(s.h3,{id:"changes-since-v12414k3s1",children:"Changes since v1.24.14+k3s1:"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsxs)(s.li,{children:["Fix code spell check ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7861",children:"(#7861)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Remove file_windows.go ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7857",children:"(#7857)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Allow k3s to customize apiServerPort on helm-controller ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7872",children:"(#7872)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Fix rootless node password ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7899",children:"(#7899)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Backports for 2023-07 release ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7910",children:"(#7910)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:"Resolved an issue that caused agents joined with kubeadm-style bootstrap tokens to fail to rejoin the cluster when their node object is deleted."}),"\n",(0,r.jsxs)(s.li,{children:["The ",(0,r.jsx)(s.code,{children:"k3s certificate rotate-ca"})," command now supports the data-dir flag."]}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Adding cli to custom klipper helm image ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7916",children:"(#7916)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:"The default helm-controller job image can now be overridden with the --helm-job-image CLI flag"}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Generation of certs and keys for etcd gated if etcd is disabled ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7946",children:"(#7946)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Don't use zgrep in ",(0,r.jsx)(s.code,{children:"check-config"})," if apparmor profile is enforced ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7955",children:"(#7955)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Fix image_scan.sh script and download trivy version (#7950) ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7970",children:"(#7970)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Adjust default kubeconfig file permissions ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7985",children:"(#7985)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Update to v1.24.16 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8023",children:"(#8023)"})]}),"\n"]}),"\n",(0,r.jsx)(s.hr,{}),"\n",(0,r.jsxs)(s.h2,{id:"release-v12415k3s1",children:["Release ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/releases/tag/v1.24.15+k3s1",children:"v1.24.15+k3s1"})]}),"\n",(0,r.jsx)(s.p,{children:"This release updates Kubernetes to v1.24.15, and fixes a number of issues."}),"\n",(0,r.jsxs)(s.p,{children:["For more details on what's new, see the ",(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.24.md#changelog-since-v12414",children:"Kubernetes release notes"}),"."]}),"\n",(0,r.jsx)(s.h3,{id:"changes-since-v12414k3s1-1",children:"Changes since v1.24.14+k3s1:"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsxs)(s.li,{children:["E2E Backports - June ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7726",children:"(#7726)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:"Shortcircuit commands with version or help flags #7683"}),"\n",(0,r.jsx)(s.li,{children:"Add Rotation certification Check, remove func to restart agents #7097"}),"\n",(0,r.jsx)(s.li,{children:"E2E: Sudo for RunCmdOnNode #7686"}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Fix spelling check ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7753",children:"(#7753)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Backport version bumps and bugfixes ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7719",children:"(#7719)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:"The bundled metrics-server has been bumped to v0.6.3, and now uses only secure TLS ciphers by default."}),"\n",(0,r.jsxs)(s.li,{children:["The ",(0,r.jsx)(s.code,{children:"coredns-custom"})," ConfigMap now allows for ",(0,r.jsx)(s.code,{children:"*.override"})," sections to be included in the ",(0,r.jsx)(s.code,{children:".:53"})," default server block."]}),"\n",(0,r.jsx)(s.li,{children:"The K3s core controllers (supervisor, deploy, and helm) no longer use the admin kubeconfig. This makes it easier to determine from access and audit logs which actions are performed by the system, and which are performed by an administrative user."}),"\n",(0,r.jsx)(s.li,{children:"Bumped klipper-lb image to v0.4.4 to resolve an issue that prevented access to ServiceLB ports from localhost when the Service ExternalTrafficPolicy was set to Local."}),"\n",(0,r.jsx)(s.li,{children:"Make LB image configurable when compiling k3s"}),"\n",(0,r.jsx)(s.li,{children:"K3s now allows nodes to join the cluster even if the node password secret cannot be created at the time the node joins. The secret create will be retried in the background. This resolves a potential deadlock created by fail-closed validating webhooks that block secret creation, where the webhook is unavailable until new nodes join the cluster to run the webhook pod."}),"\n",(0,r.jsx)(s.li,{children:"The bundled containerd's aufs/devmapper/zfs snapshotter plugins have been restored. These were unintentionally omitted when moving containerd back into the k3s multicall binary in the previous release."}),"\n",(0,r.jsx)(s.li,{children:"The embedded helm controller has been bumped to v0.15.0, and now supports creating the chart's target namespace if it does not exist."}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Remove unused libvirt config ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7759",children:"(#7759)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Add format command on Makefile ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7764",children:"(#7764)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Update Kubernetes to v1.24.15 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7785",children:"(#7785)"})]}),"\n"]}),"\n",(0,r.jsx)(s.hr,{}),"\n",(0,r.jsxs)(s.h2,{id:"release-v12414k3s1",children:["Release ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/releases/tag/v1.24.14+k3s1",children:"v1.24.14+k3s1"})]}),"\n",(0,r.jsx)(s.p,{children:"This release updates Kubernetes to v1.24.14, and fixes a number of issues."}),"\n",(0,r.jsxs)(s.p,{children:["For more details on what's new, see the ",(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.24.md#changelog-since-v12413",children:"Kubernetes release notes"}),"."]}),"\n",(0,r.jsx)(s.h3,{id:"changes-since-v12413k3s1",children:"Changes since v1.24.13+k3s1:"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsxs)(s.li,{children:["Add E2E testing in Drone ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7376",children:"(#7376)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Add integration tests for etc-snapshot server flags ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7379",children:"(#7379)"})]}),"\n",(0,r.jsxs)(s.li,{children:["CLI + Config Enhancement ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7407",children:"(#7407)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsxs)(s.li,{children:[(0,r.jsx)(s.code,{children:"--Tls-sans"})," now accepts multiple arguments: ",(0,r.jsx)(s.code,{children:'--tls-sans="foo,bar"'})]}),"\n",(0,r.jsxs)(s.li,{children:[(0,r.jsx)(s.code,{children:"Prefer-bundled-bin: true"})," now works properly when set in ",(0,r.jsx)(s.code,{children:"config.yaml.d"})," files"]}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Migrate netutil methods into /utils/net.go ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7435",children:"(#7435)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Bump Runc + Containerd + Docker for CVE fixes ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7453",children:"(#7453)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Bump kube-router version to fix a bug when a port name is used ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7462",children:"(#7462)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Kube flags and longhorn tests 1.24 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7467",children:"(#7467)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Local-storage: Fix permission ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7472",children:"(#7472)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Backport version bumps and bugfixes ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7516",children:"(#7516)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:'K3s now retries the cluster join operation when receiving a "too many learners" error from etcd. This most frequently occurred when attempting to add multiple servers at the same time.'}),"\n",(0,r.jsx)(s.li,{children:"K3s once again supports aarch64 nodes with page size > 4k"}),"\n",(0,r.jsx)(s.li,{children:"The packaged Traefik version has been bumped to v2.9.10 / chart 21.2.0"}),"\n",(0,r.jsxs)(s.li,{children:["K3s now prints a more meaningful error when attempting to run from a filesystem mounted ",(0,r.jsx)(s.code,{children:"noexec"}),"."]}),"\n",(0,r.jsxs)(s.li,{children:["K3s now exits with a proper error message when the server token uses a bootstrap token ",(0,r.jsx)(s.code,{children:"id.secret"})," format."]}),"\n",(0,r.jsx)(s.li,{children:"Fixed an issue where Addon, HelmChart, and HelmChartConfig CRDs were created without structural schema, allowing the creation of custom resources of these types with invalid content."}),"\n",(0,r.jsx)(s.li,{children:"Servers started with the (experimental) --disable-agent flag no longer attempt to run the tunnel authorizer agent component."}),"\n",(0,r.jsx)(s.li,{children:"Fixed an regression that prevented the pod and cluster egress-selector modes from working properly."}),"\n",(0,r.jsx)(s.li,{children:"K3s now correctly passes through etcd-args to the temporary etcd that is used to extract cluster bootstrap data when restarting managed etcd nodes."}),"\n",(0,r.jsx)(s.li,{children:"K3s now properly handles errors obtaining the current etcd cluster member list when a new server is joining the managed etcd cluster."}),"\n",(0,r.jsxs)(s.li,{children:["The embedded kine version has been bumped to v0.10.1. This replaces the legacy ",(0,r.jsx)(s.code,{children:"lib/pq"})," postgres driver with ",(0,r.jsx)(s.code,{children:"pgx"}),"."]}),"\n",(0,r.jsx)(s.li,{children:"The bundled CNI plugins have been upgraded to v1.2.0-k3s1. The bandwidth and firewall plugins are now included in the bundle."}),"\n",(0,r.jsx)(s.li,{children:"The embedded Helm controller now supports authenticating to chart repositories via credentials stored in a Secret, as well as passing repo CAs via ConfigMap."}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Bump containerd/runc to v1.7.1-k3s1/v1.1.7 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7536",children:"(#7536)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:"The bundled containerd and runc versions have been bumped to v1.7.1-k3s1/v1.1.7"}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Wrap error stating that it is coming from netpol ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7549",children:"(#7549)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Update to v1.24.14-k3s1 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7577",children:"(#7577)"})]}),"\n"]}),"\n",(0,r.jsx)(s.hr,{}),"\n",(0,r.jsxs)(s.h2,{id:"release-v12413k3s1",children:["Release ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/releases/tag/v1.24.13+k3s1",children:"v1.24.13+k3s1"})]}),"\n",(0,r.jsx)(s.p,{children:"This release updates Kubernetes to v1.24.13, and fixes a number of issues."}),"\n",(0,r.jsxs)(s.p,{children:["For more details on what's new, see the ",(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.24.md#changelog-since-v12412",children:"Kubernetes release notes"}),"."]}),"\n",(0,r.jsx)(s.h3,{id:"changes-since-v12412k3s1",children:"Changes since v1.24.12+k3s1:"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsxs)(s.li,{children:["Enhance ",(0,r.jsx)(s.code,{children:"check-config"})," ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7165",children:"(#7165)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Remove deprecated nodeSelector label beta.kubernetes.io/os (#6970) ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7122",children:"(#7122)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Backport version bumps and bugfixes ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7229",children:"(#7229)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:"The bundled local-path-provisioner version has been bumped to v0.0.24"}),"\n",(0,r.jsx)(s.li,{children:"The bundled runc version has been bumped to v1.1.5"}),"\n",(0,r.jsx)(s.li,{children:"The bundled coredns version has been bumped to v1.10.1"}),"\n",(0,r.jsx)(s.li,{children:"When using an external datastore, K3s now locks the bootstrap key while creating initial cluster bootstrap data, preventing a race condition when multiple servers attempted to initialize the cluster simultaneously."}),"\n",(0,r.jsx)(s.li,{children:"The client load-balancer that maintains connections to active server nodes now closes connections to servers when they are removed from the cluster. This ensures that agent components immediately reconnect to a current cluster member."}),"\n",(0,r.jsx)(s.li,{children:"Fixed a race condition during cluster reset that could cause the operation to hang and time out."}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Updated kube-router to move the default ACCEPT rule at the end of the chain ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7222",children:"(#7222)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:"The embedded kube-router controller has been updated to fix a regression that caused traffic from pods to be blocked by any default drop/deny rules present on the host. Users should still confirm that any externally-managed firewall rules explicitly allow traffic to/from pod and service networks, but this returns the old behavior that was relied upon by some users."}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Update klipper lb and helm-controller ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7241",children:"(#7241)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Update Kube-router ACCEPT rule insertion and install script to clean rules before start ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7277",children:"(#7277)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:"The embedded kube-router controller has been updated to fix a regression that caused traffic from pods to be blocked by any default drop/deny rules present on the host. Users should still confirm that any externally-managed firewall rules explicitly allow traffic to/from pod and service networks, but this returns the old behavior that was relied upon by some users."}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Update to v1.24.13-k3s1 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7284",children:"(#7284)"})]}),"\n"]}),"\n",(0,r.jsx)(s.hr,{}),"\n",(0,r.jsxs)(s.h2,{id:"release-v12412k3s1",children:["Release ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/releases/tag/v1.24.12+k3s1",children:"v1.24.12+k3s1"})]}),"\n",(0,r.jsx)(s.p,{children:"This release updates Kubernetes to v1.24.12, and fixes a number of issues."}),"\n",(0,r.jsxs)(s.p,{children:["For more details on what's new, see the ",(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.24.md#changelog-since-v12411",children:"Kubernetes release notes"}),"."]}),"\n",(0,r.jsx)(s.h3,{id:"changes-since-v12411k3s1",children:"Changes since v1.24.11+k3s1:"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsxs)(s.li,{children:["Update flannel and kube-router ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7063",children:"(#7063)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Bump various dependencies for CVEs ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7042",children:"(#7042)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Enable dependabot ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7046",children:"(#7046)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Wait for kubelet port to be ready before setting ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7065",children:"(#7065)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:"The agent tunnel authorizer now waits for the kubelet to be ready before reading the kubelet port from the node object."}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Improve support for rotating the default self-signed certs ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7080",children:"(#7080)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsxs)(s.li,{children:["The ",(0,r.jsx)(s.code,{children:"k3s certificate rotate-ca"})," checks now support rotating self-signed certificates without the ",(0,r.jsx)(s.code,{children:"--force"})," option."]}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Adds a warning about editing to the containerd config.toml file ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7076",children:"(#7076)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Update to v1.24.12-k3s1 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7105",children:"(#7105)"})]}),"\n"]}),"\n",(0,r.jsx)(s.hr,{}),"\n",(0,r.jsxs)(s.h2,{id:"release-v12411k3s1",children:["Release ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/releases/tag/v1.24.11+k3s1",children:"v1.24.11+k3s1"})]}),"\n",(0,r.jsx)(s.p,{children:"This release updates Kubernetes to v1.24.11, and fixes a number of issues."}),"\n",(0,r.jsxs)(s.p,{children:["For more details on what's new, see the ",(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.24.md#changelog-since-v12410",children:"Kubernetes release notes"}),"."]}),"\n",(0,r.jsx)(s.h3,{id:"changes-since-v12410k3s1",children:"Changes since v1.24.10+k3s1:"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsxs)(s.li,{children:["Add jitter to scheduled snapshots and retry harder on conflicts ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6783",children:"(#6783)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:"Scheduled etcd snapshots are now offset by a short random delay of up to several seconds. This should prevent multi-server clusters from executing pathological behavior when attempting to simultaneously update the snapshot list ConfigMap. The snapshot controller will also be more persistent in attempting to update the snapshot list."}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Bump cri-dockerd ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6799",children:"(#6799)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:"The embedded cri-dockerd has been updated to v0.3.1"}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Bugfix: do not break cert-manager when pprof is enabled ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6838",children:"(#6838)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Bump vagrant boxes to fedora37 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6859",children:"(#6859)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Fix cronjob example ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6865",children:"(#6865)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Ensure flag type consistency ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6868",children:"(#6868)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Wait for cri-dockerd socket ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6854",children:"(#6854)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Consolidate E2E tests ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6888",children:"(#6888)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Ignore value conflicts when reencrypting secrets ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6918",children:"(#6918)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Allow ServiceLB to honor ",(0,r.jsx)(s.code,{children:"ExternalTrafficPolicy=Local"})," ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6908",children:"(#6908)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:"ServiceLB now honors the Service's ExternalTrafficPolicy. When set to Local, the LoadBalancer will only advertise addresses of Nodes with a Pod for the Service, and will not forward traffic to other cluster members."}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Use default address family when adding kubernetes service address to SAN list ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6905",children:"(#6905)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:"The apiserver advertised address and IP SAN entry are now set correctly on clusters that use IPv6 as the default IP family."}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Fix issue with servicelb startup failure when validating webhooks block creation ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6920",children:"(#6920)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:"The embedded cloud controller manager will no longer attempt to unconditionally re-create its namespace and serviceaccount on startup. This resolves an issue that could cause a deadlocked cluster when fail-closed webhooks are in use."}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Backport user-provided CA cert and ",(0,r.jsx)(s.code,{children:"kubeadm"})," bootstrap token support ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6930",children:"(#6930)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsxs)(s.li,{children:["K3s now functions properly when the cluster CA certificates are signed by an existing root or intermediate CA. You can find a sample script for generating such certificates before K3s starts in the github repo at ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/blob/master/contrib/util/certs.sh",children:"contrib/util/certs.sh"}),"."]}),"\n",(0,r.jsxs)(s.li,{children:["K3s now supports ",(0,r.jsx)(s.code,{children:"kubeadm"})," style join tokens. ",(0,r.jsx)(s.code,{children:"k3s token create"})," now creates join token secrets, optionally with a limited TTL."]}),"\n",(0,r.jsx)(s.li,{children:"K3s agents joined with an expired or deleted token stay in the cluster using existing client certificates via the NodeAuthorization admission plugin, unless their Node object is deleted from the cluster."}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Fix access to hostNetwork port on NodeIP when egress-selector-mode=agent ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6937",children:"(#6937)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:"Fixed an issue that would cause the apiserver egress proxy to attempt to use the agent tunnel to connect to service endpoints even in agent or disabled mode."}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Update flannel to v0.21.1 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6925",children:"(#6925)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Allow for multiple sets of leader-elected controllers ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6942",children:"(#6942)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:"Fixed an issue where leader-elected controllers for managed etcd did not run on etcd-only nodes"}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Fix etcd and ca-cert rotate issues ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6955",children:"(#6955)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Fix ServiceLB dual-stack ingress IP listing ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6988",children:"(#6988)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:"Resolved an issue with ServiceLB that would cause it to advertise node IPv6 addresses, even if the cluster or service was not enabled for dual-stack operation."}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Bump kine to v0.9.9 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6976",children:"(#6976)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsxs)(s.li,{children:["The embedded kine version has been bumped to v0.9.9. Compaction log messages are now omitted at ",(0,r.jsx)(s.code,{children:"info"})," level for increased visibility."]}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Update to v1.24.11-k3s1 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7009",children:"(#7009)"})]}),"\n"]}),"\n",(0,r.jsx)(s.hr,{}),"\n",(0,r.jsxs)(s.h2,{id:"release-v12410k3s1",children:["Release ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/releases/tag/v1.24.10+k3s1",children:"v1.24.10+k3s1"})]}),"\n",(0,r.jsx)(s.p,{children:"This release updates Kubernetes to v1.24.10+k3s1, and fixes a number of issues."}),"\n",(0,r.jsxs)(s.p,{children:["For more details on what's new, see the ",(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.24.md#changelog-since-v1249",children:"Kubernetes release notes"}),"."]}),"\n",(0,r.jsx)(s.h3,{id:"changes-since-v1249k3s2",children:"Changes since v1.24.9+k3s2:"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsxs)(s.li,{children:["Pass through default tls-cipher-suites ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6731",children:"(#6731)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:"The K3s default cipher suites are now explicitly passed in to kube-apiserver, ensuring that all listeners use these values."}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Bump containerd to v1.6.15-k3s1 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6736",children:"(#6736)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:"The embedded containerd version has been bumped to v1.6.15-k3s1"}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Bump action/download-artifact to v3 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6748",children:"(#6748)"})]}),"\n"]}),"\n",(0,r.jsx)(s.hr,{}),"\n",(0,r.jsxs)(s.h2,{id:"release-v1249k3s2",children:["Release ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/releases/tag/v1.24.9+k3s2",children:"v1.24.9+k3s2"})]}),"\n",(0,r.jsx)(s.p,{children:"This release updates containerd to v1.6.14 to resolve an issue where pods would lose their CNI information when containerd was restarted."}),"\n",(0,r.jsx)(s.h3,{id:"changes-since-v1249k3s1",children:"Changes since v1.24.9+k3s1:"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsxs)(s.li,{children:["Backport missing E2E test commits ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6616",children:"(#6616)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Bump containerd to v1.6.14-k3s1 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6695",children:"(#6695)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsxs)(s.li,{children:["The embedded containerd version has been bumped to v1.6.14-k3s1. This includes a backported fix for ",(0,r.jsx)(s.a,{href:"https://github.com/containerd/containerd/issues/7843",children:"containerd/7843"})," which caused pods to lose their CNI info when containerd was restarted, which in turn caused the kubelet to recreate the pod."]}),"\n"]}),"\n"]}),"\n"]}),"\n",(0,r.jsx)(s.hr,{}),"\n",(0,r.jsxs)(s.h2,{id:"release-v1249k3s1",children:["Release ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/releases/tag/v1.24.9+k3s1",children:"v1.24.9+k3s1"})]}),"\n",(0,r.jsxs)(s.blockquote,{children:["\n",(0,r.jsx)(s.h2,{id:"\ufe0f-warning",children:"\u26a0\ufe0f WARNING"}),"\n",(0,r.jsxs)(s.p,{children:["This release is affected by ",(0,r.jsx)(s.a,{href:"https://github.com/containerd/containerd/issues/7843",children:"https://github.com/containerd/containerd/issues/7843"}),", which causes the kubelet to restart all pods whenever K3s is restarted. For this reason, we have removed this K3s release from the channel server. Please use ",(0,r.jsx)(s.code,{children:"v1.24.9+k3s2"})," instead."]}),"\n"]}),"\n",(0,r.jsx)(s.p,{children:"This release updates Kubernetes to v1.24.9, and fixes a number of issues."}),"\n",(0,r.jsxs)(s.p,{children:[(0,r.jsx)(s.strong,{children:"Breaking Change:"})," K3s no longer includes ",(0,r.jsx)(s.code,{children:"swanctl"})," and ",(0,r.jsx)(s.code,{children:"charon"})," binaries. If you are using the ipsec flannel backend, please ensure that the strongswan ",(0,r.jsx)(s.code,{children:"swanctl"})," and ",(0,r.jsx)(s.code,{children:"charon"})," packages are installed on your node before upgrading K3s to this release."]}),"\n",(0,r.jsxs)(s.p,{children:["For more details on what's new, see the ",(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.24.md#changelog-since-v1248",children:"Kubernetes release notes"}),"."]}),"\n",(0,r.jsx)(s.h3,{id:"changes-since-v1248k3s1",children:"Changes since v1.24.8+k3s1:"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsxs)(s.li,{children:["Remove stuff which belongs in the windows executor implementation ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6502",children:"(#6502)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Github CI Updates ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6535",children:"(#6535)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Fix log for flannelExternalIP use case ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6540",children:"(#6540)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Switch from Google Buckets to AWS S3 Buckets ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6570",children:"(#6570)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Change secrets-encryption flag to GA ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6591",children:"(#6591)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Update flannel to v0.20.2 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6589",children:"(#6589)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Backports for 2022-12 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6599",children:"(#6599)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:"Added new prefer-bundled-bin flag which force K3s to use its bundle binaries over that of the host tools"}),"\n",(0,r.jsx)(s.li,{children:"The embedded containerd version has been updated to v1.6.10-k3s1"}),"\n",(0,r.jsxs)(s.li,{children:["The rootless ",(0,r.jsx)(s.code,{children:"port-driver"}),", ",(0,r.jsx)(s.code,{children:"cidr"}),", ",(0,r.jsx)(s.code,{children:"mtu"}),", ",(0,r.jsx)(s.code,{children:"enable-ipv6"}),", and ",(0,r.jsx)(s.code,{children:"disable-host-loopback"})," settings can now be configured via environment variables."]}),"\n",(0,r.jsxs)(s.li,{children:["The embedded Load-Balancer controller image has been bumped to klipper-lb",":v0",".4.0, which includes support for the ",(0,r.jsx)(s.a,{href:"https://kubernetes.io/docs/reference/kubernetes-api/service-resources/service-v1/#:~:text=loadBalancerSourceRanges",children:"LoadBalancerSourceRanges"})," field."]}),"\n",(0,r.jsxs)(s.li,{children:["The embedded Helm controller image has been bumped to klipper-helm",":v0",".7.4-build20221121"]}),"\n",(0,r.jsxs)(s.li,{children:["The embedded cloud-controller-manager's metrics listener on port 10258 is now disabled when the ",(0,r.jsx)(s.code,{children:"--disable-cloud-controller"})," flag is set."]}),"\n",(0,r.jsx)(s.li,{children:"Deployments for K3s packaged components now have consistent upgrade strategy and revisionHistoryLimit settings, and will not override scaling decisions by hardcoding the replica count."}),"\n",(0,r.jsx)(s.li,{children:"The packaged metrics-server has been bumped to v0.6.2"}),"\n",(0,r.jsx)(s.li,{children:"The embedded k3s-root version has been bumped to v0.12.0, based on buildroot 2022.08.1."}),"\n",(0,r.jsxs)(s.li,{children:["The embedded swanctl and charon binaries have been removed. If you are using the ipsec flannel backend, please ensure that the strongswan ",(0,r.jsx)(s.code,{children:"swanctl"})," and ",(0,r.jsx)(s.code,{children:"charon"})," packages are installed on your node before upgrading k3s."]}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Update node12->node16 based GH actions ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6595",children:"(#6595)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Update to v1.24.9-k3s1 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6623",children:"(#6623)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Bump containerd to v1.6.12-k3s1 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6630",children:"(#6630)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:"The embedded containerd version has been bumped to v1.6.12"}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Preload iptable_filter/ip6table_filter ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6647",children:"(#6647)"})]}),"\n"]}),"\n",(0,r.jsx)(s.hr,{}),"\n",(0,r.jsxs)(s.h2,{id:"release-v1248k3s1",children:["Release ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/releases/tag/v1.24.8+k3s1",children:"v1.24.8+k3s1"})]}),"\n",(0,r.jsx)(s.p,{children:"This release updates Kubernetes to v1.24.8, and fixes a number of issues."}),"\n",(0,r.jsxs)(s.p,{children:["For more details on what's new, see the ",(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.24.md#changelog-since-v1247",children:"Kubernetes release notes"}),"."]}),"\n",(0,r.jsx)(s.h3,{id:"changes-since-v1247k3s1",children:"Changes since v1.24.7+k3s1:"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsxs)(s.li,{children:["Add the gateway parameter in netplan ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6341",children:"(#6341)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Add a netpol test for podSelector & ingress type ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6348",children:"(#6348)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Upgrade kube-router to v1.5.1 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6356",children:"(#6356)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Bump install tests OS images ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6379",children:"(#6379)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Add test for node-external-ip config parameter ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6363",children:"(#6363)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Update Flannel to v0.20.1 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6418",children:"(#6418)"})]}),"\n",(0,r.jsx)(s.li,{children:"Backports for 2022-11"}),"\n",(0,r.jsx)(s.li,{children:"The packaged traefik helm chart has been bumped to v19.0.0, enabling ingressclass support by default."}),"\n",(0,r.jsx)(s.li,{children:"The packaged local-path-provisioner has been bumped to v0.0.23"}),"\n",(0,r.jsx)(s.li,{children:"The packaged coredns has been bumped to v1.9.4"}),"\n",(0,r.jsx)(s.li,{children:"Fix incorrect defer usage"}),"\n",(0,r.jsx)(s.li,{children:"The bundled traefik has been updated to v2.9.4 / helm chart v18.3.0"}),"\n",(0,r.jsx)(s.li,{children:"Use debugger-friendly compile settings if debug is set"}),"\n",(0,r.jsx)(s.li,{children:"Add test for node-external-ip config parameter"}),"\n",(0,r.jsx)(s.li,{children:"Convert containerd config.toml.tmpl linux template to v2 syntax"}),"\n",(0,r.jsx)(s.li,{children:"Replace fedora-coreos with fedora 36 for install tests"}),"\n",(0,r.jsx)(s.li,{children:"Fixed an issue that would prevent the deploy controller from handling manifests that include resource types that are no longer supported by the apiserver."}),"\n",(0,r.jsx)(s.li,{children:"The embedded helm controller has been bumped to v0.13.0"}),"\n",(0,r.jsx)(s.li,{children:"The bundled traefik helm chart has been updated to v18.0.0"}),"\n",(0,r.jsx)(s.li,{children:"Add hardened cluster and upgrade tests"}),"\n",(0,r.jsxs)(s.li,{children:["Bump kine to v0.9.6 / sqlite3 v3.39.2 (",(0,r.jsx)(s.a,{href:"https://nvd.nist.gov/vuln/detail/cve-2022-35737",children:"cve-2022-35737"}),")"]}),"\n",(0,r.jsxs)(s.li,{children:["Bumped dynamiclistener library to v0.3.5 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6411",children:"(#6411)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Add some helping logs to avoid wrong configs ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6432",children:"(#6432)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Change the priority of address types depending on flannel-external-ip ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6434",children:"(#6434)"})]}),"\n",(0,r.jsxs)(s.li,{children:["log kube-router version when starting netpol controller ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6439",children:"(#6439)"})]}),"\n",(0,r.jsxs)(s.li,{children:["K3s now indicates specifically which cluster-level configuration flags are out of sync when critical configuration differs between server nodes. ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6446",children:"(#6446)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Pull traefik helm chart directly from GH ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6469",children:"(#6469)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Update to v1.24.8 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6479",children:"(#6479)"})]}),"\n",(0,r.jsxs)(s.li,{children:["The packaged traefik helm chart has been bumped to 19.0.4 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6495",children:"(#6495)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Move traefik chart repo again ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6509",children:"(#6509)"})]}),"\n"]}),"\n",(0,r.jsx)(s.hr,{}),"\n",(0,r.jsxs)(s.h2,{id:"release-v1247k3s1",children:["Release ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/releases/tag/v1.24.7+k3s1",children:"v1.24.7+k3s1"})]}),"\n",(0,r.jsx)(s.p,{children:"This release updates Kubernetes to v1.24.7, and fixes a number of issues."}),"\n",(0,r.jsxs)(s.p,{children:["The K3s ",(0,r.jsx)(s.a,{href:"https://docs.k3s.io/security/hardening-guide",children:"CIS Hardening Guide"})," has been updated to include configuration changes required to support embedding ServiceLB in the cloud controller manager. If you have followed the hardening guide, please update your policies and RBAC in accordingly."]}),"\n",(0,r.jsxs)(s.p,{children:["For more details on what's new, see the ",(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.24.md#changelog-since-v1246",children:"Kubernetes release notes"}),"."]}),"\n",(0,r.jsx)(s.h3,{id:"changes-since-v1246k3s1",children:"Changes since v1.24.6+k3s1:"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsxs)(s.li,{children:["Add flannel-external-ip when there is a k3s node-external-ip ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6189",children:"(#6189)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Backports for 2022-10 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6227",children:"(#6227)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:"The embedded metrics-server version has been bumped to v0.6.1"}),"\n",(0,r.jsx)(s.li,{children:"The ServiceLB (klipper-lb) service controller is now integrated into the K3s stub cloud controller manager."}),"\n",(0,r.jsx)(s.li,{children:"Events recorded to the cluster by embedded controllers are now properly formatted in the service logs."}),"\n",(0,r.jsxs)(s.li,{children:["Fixed an issue with the apiserver network proxy that caused ",(0,r.jsx)(s.code,{children:"kubectl exec"})," to occasionally fail with ",(0,r.jsx)(s.code,{children:"error dialing backend: EOF"})]}),"\n",(0,r.jsxs)(s.li,{children:["Fixed an issue with the apiserver network proxy that caused ",(0,r.jsx)(s.code,{children:"kubectl exec"})," and ",(0,r.jsx)(s.code,{children:"kubectl logs"})," to fail when a custom kubelet port was used, and the custom port was blocked by firewall or security group rules."]}),"\n",(0,r.jsx)(s.li,{children:"The embedded Traefik version has been bumped to v2.9.1 / chart 12.0.0"}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Replace deprecated ioutil package ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6235",children:"(#6235)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Fix dualStack test ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6250",children:"(#6250)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Update to v1.24.7-k3s1 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6270",children:"(#6270)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Add ServiceAccount for svclb pods ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6276",children:"(#6276)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Return ProviderID in URI format ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6287",children:"(#6287)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Corrected CCM RBAC to allow for removal of legacy service finalizer during upgrades. ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6307",children:"(#6307)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Added a new --flannel-external-ip flag. ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6322",children:"(#6322)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:"When enabled, Flannel traffic will now use the nodes external IPs, instead of internal."}),"\n",(0,r.jsx)(s.li,{children:"This is meant for use with distributed clusters that are not all on the same local network."}),"\n"]}),"\n"]}),"\n"]}),"\n",(0,r.jsx)(s.hr,{}),"\n",(0,r.jsxs)(s.h2,{id:"release-v1246k3s1",children:["Release ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/releases/tag/v1.24.6+k3s1",children:"v1.24.6+k3s1"})]}),"\n",(0,r.jsx)(s.p,{children:"This release updates Kubernetes to v1.24.6, and fixes a number of issues."}),"\n",(0,r.jsxs)(s.p,{children:["For more details on what's new, see the ",(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.24.md#changelog-since-v1244",children:"Kubernetes release notes"}),"."]}),"\n",(0,r.jsx)(s.h3,{id:"changes-since-v1244k3s1",children:"Changes since v1.24.4+k3s1:"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsxs)(s.li,{children:["Remove ",(0,r.jsx)(s.code,{children:"--containerd"})," flag from windows kubelet args ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6028",children:"(#6028)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Mark v1.24.4+k3s1 as stable ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6036",children:"(#6036)"})]}),"\n",(0,r.jsxs)(s.li,{children:["E2E: Add support for CentOS 7 and Rocky 8 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6015",children:"(#6015)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Convert install tests to run PR build of k3s ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6003",children:"(#6003)"})]}),"\n",(0,r.jsxs)(s.li,{children:["CI: update Fedora 34 -> 35 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/5996",children:"(#5996)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Fix dualStack test and change ipv6 network prefix ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6023",children:"(#6023)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Fix e2e tests ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6018",children:"(#6018)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Update Flannel version to fix older iptables version issue. ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6088",children:"(#6088)"})]}),"\n",(0,r.jsxs)(s.li,{children:["The bundled version of runc has been bumped to v1.1.4 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6072",children:"(#6072)"})]}),"\n",(0,r.jsxs)(s.li,{children:["The embedded containerd version has been bumped to v1.6.8-k3s1 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6079",children:"(#6079)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Bulk Backport of Testing Changes ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6085",children:"(#6085)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Add validation check to confirm correct golang version for Kubernetes ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6113",children:"(#6113)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Update to v1.24.5 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6143",children:"(#6143)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Update to v1.24.6-k3s1 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6164",children:"(#6164)"})]}),"\n"]}),"\n",(0,r.jsx)(s.hr,{}),"\n",(0,r.jsxs)(s.h2,{id:"release-v1244k3s1",children:["Release ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/releases/tag/v1.24.4+k3s1",children:"v1.24.4+k3s1"})]}),"\n",(0,r.jsx)(s.p,{children:"This release updates Kubernetes to v1.24.4, and fixes a number of issues."}),"\n",(0,r.jsxs)(s.p,{children:["This release restores use of the ",(0,r.jsx)(s.code,{children:"--docker"})," flag to the v1.24 branch. See ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/blob/master/docs/adrs/cri-dockerd.md",children:"docs/adrs/cri-dockerd.md"})," for more information."]}),"\n",(0,r.jsxs)(s.p,{children:["For more details on what's new, see the ",(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.24.md#changelog-since-v1243",children:"Kubernetes release notes"}),"."]}),"\n",(0,r.jsx)(s.h3,{id:"changes-since-v1243k3s1",children:"Changes since v1.24.3+k3s1:"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsxs)(s.li,{children:["Put the terraform tests into their own packages and cleanup the test runs ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/5861",children:"(#5861)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Bumped rootlesskit to v1.0.1 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/5773",children:"(#5773)"})]}),"\n",(0,r.jsxs)(s.li,{children:["The initial health-check time for the etcd datastore has been raised from 10 to 30 seconds. ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/5882",children:"(#5882)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Fixed a regression that caused systemd cgroup driver autoconfiguration to fail on server nodes. ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/5851",children:"(#5851)"})]}),"\n",(0,r.jsxs)(s.li,{children:["The embedded network policy controller has been updated to kube-router v1.5.0 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/5789",children:"(#5789)"})]}),"\n",(0,r.jsxs)(s.li,{children:["The configured service CIDR is now passed to the Kubernetes controller-manager via the ",(0,r.jsx)(s.code,{children:"--service-cluster-ip-range"})," flag. Previously this value was only passed to the apiserver. ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/5894",children:"(#5894)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Updated dynamiclistener to fix a regression that prevented certificate renewal from working properly. ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/5896",children:"(#5896)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Promote v1.24.3+k3s1 to stable ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/5889",children:"(#5889)"})]}),"\n",(0,r.jsxs)(s.li,{children:["ADR: Depreciating and Removing Old Flags ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/5890",children:"(#5890)"})]}),"\n",(0,r.jsxs)(s.li,{children:["K3s no longer sets containerd's ",(0,r.jsx)(s.code,{children:"enable_unprivileged_icmp"})," and ",(0,r.jsx)(s.code,{children:"enable_unprivileged_ports"})," options on kernels that do not support them. ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/5913",children:"(#5913)"})]}),"\n",(0,r.jsxs)(s.li,{children:["The etcd error on incorrect peer urls now correctly includes the expected https and 2380 port. ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/5909",children:"(#5909)"})]}),"\n",(0,r.jsxs)(s.li,{children:["When set, the agent-token value is now written to ",(0,r.jsx)(s.code,{children:"$datadir/server/agent-token"}),", in the same manner as the default (server) token is written to ",(0,r.jsx)(s.code,{children:"$datadir/server/token"})," ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/5906",children:"(#5906)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Deprecated flags now warn of their v1.25 removal ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/5937",children:"(#5937)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Fix secrets reencryption for clusters with 8K+ secrets ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/5936",children:"(#5936)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Bumped minio-go to v7.0.33. This adds support for IMDSv2 credentials. ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/5928",children:"(#5928)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Upgrade GH Actions macos-10.15 to macos-12 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/5953",children:"(#5953)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Added dualstack IP auto detection ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/5920",children:"(#5920)"})]}),"\n",(0,r.jsxs)(s.li,{children:["The ",(0,r.jsx)(s.code,{children:"--docker"})," flag has been restored to k3s, as a shortcut to enabling embedded cri-dockerd ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/5916",children:"(#5916)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Update MAINTAINERS with new folks and departures ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/5948",children:"(#5948)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Removing checkbox indicating backports ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/5947",children:"(#5947)"})]}),"\n",(0,r.jsxs)(s.li,{children:["fix checkError in terraform/testutils ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/5893",children:"(#5893)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Add scripts to run e2e test using ansible ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/5134",children:"(#5134)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Updated flannel to v0.19.1 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/5962",children:"(#5962)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Update run scripts ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/5979",children:"(#5979)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Convert install/cgroup tests to yaml based config ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/5992",children:"(#5992)"})]}),"\n",(0,r.jsxs)(s.li,{children:["E2E: Local cluster testing ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/5977",children:"(#5977)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Add nightly install github action ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/5998",children:"(#5998)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Convert codespell from Drone to GH actions ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6004",children:"(#6004)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Update to v1.24.4 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6014",children:"(#6014)"})]}),"\n"]}),"\n",(0,r.jsx)(s.hr,{}),"\n",(0,r.jsxs)(s.h2,{id:"release-v1243k3s1",children:["Release ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/releases/tag/v1.24.3+k3s1",children:"v1.24.3+k3s1"})]}),"\n",(0,r.jsx)(s.p,{children:"This release updates Kubernetes to v1.24.3, and fixes a number of issues."}),"\n",(0,r.jsxs)(s.p,{children:["For more details on what's new, see the ",(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.24.md#changelog-since-v1242",children:"Kubernetes release notes"}),"."]}),"\n",(0,r.jsx)(s.h3,{id:"changes-since-v1242k3s2",children:"Changes since v1.24.2+k3s2:"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsxs)(s.li,{children:["Updated rancher/remotedialer to address a potential memory leak. ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/5784",children:"(#5784)"})]}),"\n",(0,r.jsxs)(s.li,{children:["The embedded runc binary has been bumped to v1.1.3 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/5783",children:"(#5783)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Fixed a regression that caused some containerd labels to be empty in cadvisor pod metrics ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/5812",children:"(#5812)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Replace dapper testing with regular docker ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/5805",children:"(#5805)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Promote v1.23.8+k3s2 to stable ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/5814",children:"(#5814)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Fixed an issue that would cause etcd restore to fail when restoring a snapshot made with secrets encryption enabled if the --secrets-encryption command was not included in the config file or restore command. ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/5817",children:"(#5817)"})]}),"\n",(0,r.jsx)(s.li,{children:"Fix deletion of svclb DaemonSet when Service is deleted"}),"\n",(0,r.jsxs)(s.li,{children:["Fixed a regression that caused ServiceLB DaemonSets to remain present after their corresponding Services were deleted.\r\nManual cleanup of orphaned ",(0,r.jsx)(s.code,{children:"svclb-*"})," DaemonSets from the ",(0,r.jsx)(s.code,{children:"kube-system"})," namespace may be necessary if any LoadBalancer Services were deleted while running an affected release. ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/5824",children:"(#5824)"})]}),"\n",(0,r.jsx)(s.li,{children:"Address issues with etcd snapshots"}),"\n",(0,r.jsx)(s.li,{children:"Scheduled etcd snapshots are now compressed when snapshot compression is enabled."}),"\n",(0,r.jsx)(s.li,{children:"The default etcd snapshot timeout has been raised to 5 minutes.\r\nOnly one scheduled etcd snapshot will run at a time. If another snapshot would occur while the previous snapshot is still in progress, an error will be logged and the second scheduled snapshot will be skipped."}),"\n",(0,r.jsxs)(s.li,{children:["S3 objects for etcd snapshots are now labeled with the correct content-type when compression is not enabled. ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/5833",children:"(#5833)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Update to v1.24.3 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/5870",children:"(#5870)"})]}),"\n"]}),"\n",(0,r.jsx)(s.hr,{}),"\n",(0,r.jsxs)(s.h2,{id:"release-v1242k3s2",children:["Release ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/releases/tag/v1.24.2+k3s2",children:"v1.24.2+k3s2"})]}),"\n",(0,r.jsx)(s.p,{children:"This fixes several issues in the v1.24.2+k3s1 and prior releases."}),"\n",(0,r.jsx)(s.h3,{id:"changes-since-v1242k3s1",children:"Changes since v1.24.2+k3s1:"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsxs)(s.li,{children:["Bumped kine to fix an issue where namespaced lists that included a field-selector on metadata.name would fail to return results when using a sql storage backend. (",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/5795",children:"#5795"}),")"]}),"\n",(0,r.jsxs)(s.li,{children:["K3s will no longer log panics after upgrading directly from much older kubernetes releases, or when deploying services with ",(0,r.jsx)(s.code,{children:"type: externalname"}),". (",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/5771",children:"#5771"}),")"]}),"\n",(0,r.jsxs)(s.li,{children:["Fixed an issue that prevented ",(0,r.jsx)(s.code,{children:"kubectl logs"})," and other functionality that requires a connection to the agent from working correctly when the server's ",(0,r.jsx)(s.code,{children:"--bind-address"})," flag was used, or when k3s is used behind a http proxy. (",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/5780",children:"#5780"}),")"]}),"\n",(0,r.jsxs)(s.li,{children:["Fixed an issue that prevented newer versions of k3s from joining clusters that do not have egress-selector-mode support. (",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/5785",children:"#5785"}),")"]}),"\n",(0,r.jsxs)(s.li,{children:["Remove go-powershell dead dependency (",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/5777",children:"#5777"}),")"]}),"\n"]}),"\n",(0,r.jsx)(s.hr,{}),"\n",(0,r.jsxs)(s.h2,{id:"release-v1242k3s1",children:["Release ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/releases/tag/v1.24.2+k3s1",children:"v1.24.2+k3s1"})]}),"\n",(0,r.jsx)(s.p,{children:"This release updates Kubernetes to v1.24.2, and fixes a number of issues."}),"\n",(0,r.jsxs)(s.p,{children:["For more details on what's new, see the ",(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.24.md#changelog-since-v1241",children:"Kubernetes release notes"}),"."]}),"\n",(0,r.jsx)(s.h3,{id:"changes-since-v1241k3s1",children:"Changes since v1.24.1+k3s1:"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsxs)(s.li,{children:["Remove kube-ipvs0 interface when cleaning up ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/5644",children:"(#5644)"})]}),"\n",(0,r.jsxs)(s.li,{children:["The ",(0,r.jsx)(s.code,{children:"--flannel-wireguard-mode"})," switch was added to the k3s cli to configure the wireguard tunnel mode with the wireguard native backend ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/5552",children:"(#5552)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Introduce the flannelcniconf flag to set the desired flannel cni configuration ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/5656",children:"(#5656)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Integration Test: Startup ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/5630",children:"(#5630)"})]}),"\n",(0,r.jsxs)(s.li,{children:["E2E Improvements and groundwork for test-pad tool ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/5593",children:"(#5593)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Update SECURITY.md ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/5607",children:"(#5607)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Introduce --enable-pprof flag to optionally run pprof server ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/5527",children:"(#5527)"})]}),"\n",(0,r.jsxs)(s.li,{children:["E2E: Dualstack test ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/5617",children:"(#5617)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Pods created by ServiceLB are now all placed in the ",(0,r.jsx)(s.code,{children:"kube-system"})," namespace, instead of in the same namespace as the Service. This allows for ",(0,r.jsx)(s.a,{href:"https://kubernetes.io/docs/tasks/configure-pod-container/enforce-standards-namespace-labels/",children:"enforcing Pod Security Standards"})," in user namespaces without breaking ServiceLB. ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/5657",children:"(#5657)"})]}),"\n",(0,r.jsxs)(s.li,{children:["E2E: testpad prep, add alternate scripts location ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/5692",children:"(#5692)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Add arm tests and upgrade tests ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/5526",children:"(#5526)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Delay service readiness until after startuphooks have finished ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/5649",children:"(#5649)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Disable urfave markdown/man docs generation ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/5566",children:"(#5566)"})]}),"\n",(0,r.jsxs)(s.li,{children:["The embedded etcd snapshot controller will no longer fail to process snapshot files containing characters that are invalid for use in ConfigMap keys. ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/5702",children:"(#5702)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Environment variables prefixed with ",(0,r.jsx)(s.code,{children:"CONTAINERD_"})," now take priority over other existing variables, when passed through to containerd. ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/5706",children:"(#5706)"})]}),"\n",(0,r.jsxs)(s.li,{children:["The embedded etcd instance no longer accepts connections from other nodes while resetting or restoring. ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/5542",children:"(#5542)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Enable compatibility tests for k3s s390x ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/5658",children:"(#5658)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Containerd: Enable enable_unprivileged_ports and enable_unprivileged_\u2026 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/5538",children:"(#5538)"})]}),"\n",(0,r.jsxs)(s.li,{children:["The embedded Helm controller now properly updates Chart deployments when HelmChartConfig resources are updated or deleted. ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/5731",children:"(#5731)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Update to v1.24.2 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/5749",children:"(#5749)"})]}),"\n"]}),"\n",(0,r.jsx)(s.hr,{}),"\n",(0,r.jsxs)(s.h2,{id:"release-v1241k3s1",children:["Release ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/releases/tag/v1.24.1+k3s1",children:"v1.24.1+k3s1"})]}),"\n",(0,r.jsx)(s.p,{children:"This release updates Kubernetes to v1.24.1, and fixes a number of issues."}),"\n",(0,r.jsxs)(s.p,{children:["For more details on what's new, see the ",(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.24.md#changelog-since-v1240",children:"Kubernetes release notes"}),"."]}),"\n",(0,r.jsx)(s.h3,{id:"changes-since-v1240k3s1",children:"Changes since v1.24.0+k3s1:"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsxs)(s.li,{children:["Objects will be removed from Kubernetes when they are removed from manifest files. ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/5560",children:"(#5560)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Remove errant unversioned etcd go.mod entry ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/5548",children:"(#5548)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Pass the node-ip values to kubelet ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/5579",children:"(#5579)"})]}),"\n",(0,r.jsxs)(s.li,{children:["The integrated apiserver network proxy's operational mode can now be set with ",(0,r.jsx)(s.code,{children:"--egress-selector-mode"}),". ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/5577",children:"(#5577)"})]}),"\n",(0,r.jsxs)(s.li,{children:["remove dweomer from maintainers ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/5582",children:"(#5582)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Bump dynamiclistener to v0.3.3 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/5554",children:"(#5554)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Update to v1.24.1-k3s1 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/5616",children:"(#5616)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Re-add ",(0,r.jsx)(s.code,{children:"--cloud-provider=external"})," kubelet arg ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/5628",children:"(#5628)"})]}),"\n",(0,r.jsxs)(s.li,{children:['Revert "Give kubelet the node-ip value (#5579)" ',(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/5636",children:"(#5636)"})]}),"\n"]}),"\n",(0,r.jsx)(s.hr,{})]})}function o(e={}){const{wrapper:s}={...(0,n.a)(),...e.components};return s?(0,r.jsx)(s,{...e,children:(0,r.jsx)(a,{...e})}):a(e)}},1151:(e,s,t)=>{t.d(s,{Z:()=>h,a:()=>l});var r=t(7294);const n={},i=r.createContext(n);function l(e){const s=r.useContext(i);return r.useMemo((function(){return"function"==typeof e?e(s):{...s,...e}}),[s,e])}function h(e){let s;return s=e.disableParentContext?"function"==typeof e.components?e.components(n):e.components||n:l(e.components),r.createElement(i.Provider,{value:s},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/d8ab3227.723abb2d.js b/assets/js/d8ab3227.2d5c0764.js similarity index 99% rename from assets/js/d8ab3227.723abb2d.js rename to assets/js/d8ab3227.2d5c0764.js index 7b599429d..5b6ddd61f 100644 --- a/assets/js/d8ab3227.723abb2d.js +++ b/assets/js/d8ab3227.2d5c0764.js @@ -1 +1 @@ -"use strict";(self.webpackChunkk_3_s_docs=self.webpackChunkk_3_s_docs||[]).push([[6501],{7953:(e,n,t)=>{t.r(n),t.d(n,{assets:()=>a,contentTitle:()=>o,default:()=>h,frontMatter:()=>r,metadata:()=>l,toc:()=>d});var i=t(5893),s=t(1151);const r={title:"Distributed hybrid or multicloud cluster"},o=void 0,l={id:"networking/distributed-multicloud",title:"Distributed hybrid or multicloud cluster",description:"A K3s cluster can still be deployed on nodes which do not share a common private network and are not directly connected (e.g. nodes in different public clouds). There are two options to achieve this: the embedded k3s multicloud solution and the integration with the tailscale VPN provider.",source:"@site/docs/networking/distributed-multicloud.md",sourceDirName:"networking",slug:"/networking/distributed-multicloud",permalink:"/networking/distributed-multicloud",draft:!1,unlisted:!1,editUrl:"https://github.com/k3s-io/docs/edit/main/docs/networking/distributed-multicloud.md",tags:[],version:"current",lastUpdatedAt:1723651727e3,frontMatter:{title:"Distributed hybrid or multicloud cluster"},sidebar:"mySidebar",previous:{title:"Basic Network Options",permalink:"/networking/basic-network-options"},next:{title:"Multus and IPAM plugins",permalink:"/networking/multus-ipams"}},a={},d=[{value:"Embedded k3s multicloud solution",id:"embedded-k3s-multicloud-solution",level:3},{value:"Integration with the Tailscale VPN provider (experimental)",id:"integration-with-the-tailscale-vpn-provider-experimental",level:3}];function c(e){const n={a:"a",admonition:"admonition",code:"code",h3:"h3",li:"li",ol:"ol",p:"p",pre:"pre",...(0,s.a)(),...e.components};return(0,i.jsxs)(i.Fragment,{children:[(0,i.jsxs)(n.p,{children:["A K3s cluster can still be deployed on nodes which do not share a common private network and are not directly connected (e.g. nodes in different public clouds). There are two options to achieve this: the embedded k3s multicloud solution and the integration with the ",(0,i.jsx)(n.code,{children:"tailscale"})," VPN provider."]}),"\n",(0,i.jsx)(n.admonition,{type:"warning",children:(0,i.jsx)(n.p,{children:"The latency between nodes will increase as external connectivity requires more hops. This will reduce the network performance and could also impact the health of the cluster if latency is too high."})}),"\n",(0,i.jsx)(n.admonition,{type:"warning",children:(0,i.jsx)(n.p,{children:"Embedded etcd is not supported in this type of deployment. If using embedded etcd, all server nodes must be reachable to each other via their private IPs. Agents may be distributed over multiple networks, but all servers should be in the same location."})}),"\n",(0,i.jsx)(n.h3,{id:"embedded-k3s-multicloud-solution",children:"Embedded k3s multicloud solution"}),"\n",(0,i.jsx)(n.p,{children:"K3s uses wireguard to establish a VPN mesh for cluster traffic. Nodes must each have a unique IP through which they can be reached (usually a public IP). K3s supervisor traffic will use a websocket tunnel, and cluster (CNI) traffic will use a wireguard tunnel."}),"\n",(0,i.jsx)(n.p,{children:"To enable this type of deployment, you must add the following parameters on servers:"}),"\n",(0,i.jsx)(n.pre,{children:(0,i.jsx)(n.code,{className:"language-bash",children:"--node-external-ip= --flannel-backend=wireguard-native --flannel-external-ip\n"})}),"\n",(0,i.jsx)(n.p,{children:"and on agents:"}),"\n",(0,i.jsx)(n.pre,{children:(0,i.jsx)(n.code,{className:"language-bash",children:"--node-external-ip=\n"})}),"\n",(0,i.jsxs)(n.p,{children:["where ",(0,i.jsx)(n.code,{children:"SERVER_EXTERNAL_IP"})," is the IP through which we can reach the server node and ",(0,i.jsx)(n.code,{children:"AGENT_EXTERNAL_IP"})," is the IP through which we can reach the agent node. Note that the ",(0,i.jsx)(n.code,{children:"K3S_URL"})," config parameter in the agent should use the ",(0,i.jsx)(n.code,{children:"SERVER_EXTERNAL_IP"})," to be able to connect to it. Remember to check the ",(0,i.jsx)(n.a,{href:"/installation/requirements#networking",children:"Networking Requirements"})," and allow access to the listed ports on both internal and external addresses."]}),"\n",(0,i.jsxs)(n.p,{children:["Both ",(0,i.jsx)(n.code,{children:"SERVER_EXTERNAL_IP"})," and ",(0,i.jsx)(n.code,{children:"AGENT_EXTERNAL_IP"})," must have connectivity between them and are normally public IPs."]}),"\n",(0,i.jsxs)(n.admonition,{title:"Dynamic IPs",type:"info",children:[(0,i.jsxs)(n.p,{children:["If nodes are assigned dynamic IPs and the IP changes (e.g. in AWS), you must modify the ",(0,i.jsx)(n.code,{children:"--node-external-ip"})," parameter to reflect the new IP. If running K3s as a service, you must modify ",(0,i.jsx)(n.code,{children:"/etc/systemd/system/k3s.service"})," then run:"]}),(0,i.jsx)(n.pre,{children:(0,i.jsx)(n.code,{className:"language-bash",children:"systemctl daemon-reload\nsystemctl restart k3s\n"})})]}),"\n",(0,i.jsx)(n.h3,{id:"integration-with-the-tailscale-vpn-provider-experimental",children:"Integration with the Tailscale VPN provider (experimental)"}),"\n",(0,i.jsx)(n.p,{children:"Available in v1.27.3, v1.26.6, v1.25.11 and newer."}),"\n",(0,i.jsxs)(n.p,{children:["K3s can integrate with ",(0,i.jsx)(n.a,{href:"https://tailscale.com/",children:"Tailscale"})," so that nodes use the Tailscale VPN service to build a mesh between nodes."]}),"\n",(0,i.jsx)(n.p,{children:"There are four steps to be done with Tailscale before deploying K3s:"}),"\n",(0,i.jsxs)(n.ol,{children:["\n",(0,i.jsxs)(n.li,{children:["\n",(0,i.jsx)(n.p,{children:"Log in to your Tailscale account"}),"\n"]}),"\n",(0,i.jsxs)(n.li,{children:["\n",(0,i.jsxs)(n.p,{children:["In ",(0,i.jsx)(n.code,{children:"Settings > Keys"}),", generate an auth key ($AUTH-KEY), which may be reusable for all nodes in your cluster"]}),"\n"]}),"\n",(0,i.jsxs)(n.li,{children:["\n",(0,i.jsxs)(n.p,{children:["Decide on the podCIDR the cluster will use (by default ",(0,i.jsx)(n.code,{children:"10.42.0.0/16"}),"). Append the CIDR (or CIDRs for dual-stack) in Access controls with the stanza:"]}),"\n"]}),"\n"]}),"\n",(0,i.jsx)(n.pre,{children:(0,i.jsx)(n.code,{className:"language-yaml",children:'"autoApprovers": {\n "routes": {\n "10.42.0.0/16": ["your_account@xyz.com"],\n "2001:cafe:42::/56": ["your_account@xyz.com"],\n },\n },\n'})}),"\n",(0,i.jsxs)(n.ol,{start:"4",children:["\n",(0,i.jsx)(n.li,{children:"Install Tailscale in your nodes:"}),"\n"]}),"\n",(0,i.jsx)(n.pre,{children:(0,i.jsx)(n.code,{className:"language-bash",children:"curl -fsSL https://tailscale.com/install.sh | sh\n"})}),"\n",(0,i.jsx)(n.p,{children:"To deploy K3s with Tailscale integration enabled, you must add the following parameter on each of your nodes:"}),"\n",(0,i.jsx)(n.pre,{children:(0,i.jsx)(n.code,{className:"language-bash",children:'--vpn-auth="name=tailscale,joinKey=$AUTH-KEY\n'})}),"\n",(0,i.jsx)(n.p,{children:"or provide that information in a file and use the parameter:"}),"\n",(0,i.jsx)(n.pre,{children:(0,i.jsx)(n.code,{className:"language-bash",children:"--vpn-auth-file=$PATH_TO_FILE\n"})}),"\n",(0,i.jsxs)(n.p,{children:["Optionally, if you have your own Tailscale server (e.g. headscale), you can connect to it by appending ",(0,i.jsx)(n.code,{children:",controlServerURL=$URL"})," to the vpn-auth parameters"]}),"\n",(0,i.jsx)(n.admonition,{type:"warning",children:(0,i.jsxs)(n.p,{children:["If you plan on running several K3s clusters using the same tailscale network, please create appropriate ",(0,i.jsx)(n.a,{href:"https://tailscale.com/kb/1018/acls/",children:"ACLs"})," to avoid IP conflicts or use different podCIDR subnets for each cluster."]})})]})}function h(e={}){const{wrapper:n}={...(0,s.a)(),...e.components};return n?(0,i.jsx)(n,{...e,children:(0,i.jsx)(c,{...e})}):c(e)}},1151:(e,n,t)=>{t.d(n,{Z:()=>l,a:()=>o});var i=t(7294);const s={},r=i.createContext(s);function o(e){const n=i.useContext(r);return i.useMemo((function(){return"function"==typeof e?e(n):{...n,...e}}),[n,e])}function l(e){let n;return n=e.disableParentContext?"function"==typeof e.components?e.components(s):e.components||s:o(e.components),i.createElement(r.Provider,{value:n},e.children)}}}]); \ No newline at end of file +"use strict";(self.webpackChunkk_3_s_docs=self.webpackChunkk_3_s_docs||[]).push([[6501],{7953:(e,n,t)=>{t.r(n),t.d(n,{assets:()=>a,contentTitle:()=>o,default:()=>h,frontMatter:()=>r,metadata:()=>l,toc:()=>d});var i=t(5893),s=t(1151);const r={title:"Distributed hybrid or multicloud cluster"},o=void 0,l={id:"networking/distributed-multicloud",title:"Distributed hybrid or multicloud cluster",description:"A K3s cluster can still be deployed on nodes which do not share a common private network and are not directly connected (e.g. nodes in different public clouds). There are two options to achieve this: the embedded k3s multicloud solution and the integration with the tailscale VPN provider.",source:"@site/docs/networking/distributed-multicloud.md",sourceDirName:"networking",slug:"/networking/distributed-multicloud",permalink:"/networking/distributed-multicloud",draft:!1,unlisted:!1,editUrl:"https://github.com/k3s-io/docs/edit/main/docs/networking/distributed-multicloud.md",tags:[],version:"current",lastUpdatedAt:1723747404e3,frontMatter:{title:"Distributed hybrid or multicloud cluster"},sidebar:"mySidebar",previous:{title:"Basic Network Options",permalink:"/networking/basic-network-options"},next:{title:"Multus and IPAM plugins",permalink:"/networking/multus-ipams"}},a={},d=[{value:"Embedded k3s multicloud solution",id:"embedded-k3s-multicloud-solution",level:3},{value:"Integration with the Tailscale VPN provider (experimental)",id:"integration-with-the-tailscale-vpn-provider-experimental",level:3}];function c(e){const n={a:"a",admonition:"admonition",code:"code",h3:"h3",li:"li",ol:"ol",p:"p",pre:"pre",...(0,s.a)(),...e.components};return(0,i.jsxs)(i.Fragment,{children:[(0,i.jsxs)(n.p,{children:["A K3s cluster can still be deployed on nodes which do not share a common private network and are not directly connected (e.g. nodes in different public clouds). There are two options to achieve this: the embedded k3s multicloud solution and the integration with the ",(0,i.jsx)(n.code,{children:"tailscale"})," VPN provider."]}),"\n",(0,i.jsx)(n.admonition,{type:"warning",children:(0,i.jsx)(n.p,{children:"The latency between nodes will increase as external connectivity requires more hops. This will reduce the network performance and could also impact the health of the cluster if latency is too high."})}),"\n",(0,i.jsx)(n.admonition,{type:"warning",children:(0,i.jsx)(n.p,{children:"Embedded etcd is not supported in this type of deployment. If using embedded etcd, all server nodes must be reachable to each other via their private IPs. Agents may be distributed over multiple networks, but all servers should be in the same location."})}),"\n",(0,i.jsx)(n.h3,{id:"embedded-k3s-multicloud-solution",children:"Embedded k3s multicloud solution"}),"\n",(0,i.jsx)(n.p,{children:"K3s uses wireguard to establish a VPN mesh for cluster traffic. Nodes must each have a unique IP through which they can be reached (usually a public IP). K3s supervisor traffic will use a websocket tunnel, and cluster (CNI) traffic will use a wireguard tunnel."}),"\n",(0,i.jsx)(n.p,{children:"To enable this type of deployment, you must add the following parameters on servers:"}),"\n",(0,i.jsx)(n.pre,{children:(0,i.jsx)(n.code,{className:"language-bash",children:"--node-external-ip= --flannel-backend=wireguard-native --flannel-external-ip\n"})}),"\n",(0,i.jsx)(n.p,{children:"and on agents:"}),"\n",(0,i.jsx)(n.pre,{children:(0,i.jsx)(n.code,{className:"language-bash",children:"--node-external-ip=\n"})}),"\n",(0,i.jsxs)(n.p,{children:["where ",(0,i.jsx)(n.code,{children:"SERVER_EXTERNAL_IP"})," is the IP through which we can reach the server node and ",(0,i.jsx)(n.code,{children:"AGENT_EXTERNAL_IP"})," is the IP through which we can reach the agent node. Note that the ",(0,i.jsx)(n.code,{children:"K3S_URL"})," config parameter in the agent should use the ",(0,i.jsx)(n.code,{children:"SERVER_EXTERNAL_IP"})," to be able to connect to it. Remember to check the ",(0,i.jsx)(n.a,{href:"/installation/requirements#networking",children:"Networking Requirements"})," and allow access to the listed ports on both internal and external addresses."]}),"\n",(0,i.jsxs)(n.p,{children:["Both ",(0,i.jsx)(n.code,{children:"SERVER_EXTERNAL_IP"})," and ",(0,i.jsx)(n.code,{children:"AGENT_EXTERNAL_IP"})," must have connectivity between them and are normally public IPs."]}),"\n",(0,i.jsxs)(n.admonition,{title:"Dynamic IPs",type:"info",children:[(0,i.jsxs)(n.p,{children:["If nodes are assigned dynamic IPs and the IP changes (e.g. in AWS), you must modify the ",(0,i.jsx)(n.code,{children:"--node-external-ip"})," parameter to reflect the new IP. If running K3s as a service, you must modify ",(0,i.jsx)(n.code,{children:"/etc/systemd/system/k3s.service"})," then run:"]}),(0,i.jsx)(n.pre,{children:(0,i.jsx)(n.code,{className:"language-bash",children:"systemctl daemon-reload\nsystemctl restart k3s\n"})})]}),"\n",(0,i.jsx)(n.h3,{id:"integration-with-the-tailscale-vpn-provider-experimental",children:"Integration with the Tailscale VPN provider (experimental)"}),"\n",(0,i.jsx)(n.p,{children:"Available in v1.27.3, v1.26.6, v1.25.11 and newer."}),"\n",(0,i.jsxs)(n.p,{children:["K3s can integrate with ",(0,i.jsx)(n.a,{href:"https://tailscale.com/",children:"Tailscale"})," so that nodes use the Tailscale VPN service to build a mesh between nodes."]}),"\n",(0,i.jsx)(n.p,{children:"There are four steps to be done with Tailscale before deploying K3s:"}),"\n",(0,i.jsxs)(n.ol,{children:["\n",(0,i.jsxs)(n.li,{children:["\n",(0,i.jsx)(n.p,{children:"Log in to your Tailscale account"}),"\n"]}),"\n",(0,i.jsxs)(n.li,{children:["\n",(0,i.jsxs)(n.p,{children:["In ",(0,i.jsx)(n.code,{children:"Settings > Keys"}),", generate an auth key ($AUTH-KEY), which may be reusable for all nodes in your cluster"]}),"\n"]}),"\n",(0,i.jsxs)(n.li,{children:["\n",(0,i.jsxs)(n.p,{children:["Decide on the podCIDR the cluster will use (by default ",(0,i.jsx)(n.code,{children:"10.42.0.0/16"}),"). Append the CIDR (or CIDRs for dual-stack) in Access controls with the stanza:"]}),"\n"]}),"\n"]}),"\n",(0,i.jsx)(n.pre,{children:(0,i.jsx)(n.code,{className:"language-yaml",children:'"autoApprovers": {\n "routes": {\n "10.42.0.0/16": ["your_account@xyz.com"],\n "2001:cafe:42::/56": ["your_account@xyz.com"],\n },\n },\n'})}),"\n",(0,i.jsxs)(n.ol,{start:"4",children:["\n",(0,i.jsx)(n.li,{children:"Install Tailscale in your nodes:"}),"\n"]}),"\n",(0,i.jsx)(n.pre,{children:(0,i.jsx)(n.code,{className:"language-bash",children:"curl -fsSL https://tailscale.com/install.sh | sh\n"})}),"\n",(0,i.jsx)(n.p,{children:"To deploy K3s with Tailscale integration enabled, you must add the following parameter on each of your nodes:"}),"\n",(0,i.jsx)(n.pre,{children:(0,i.jsx)(n.code,{className:"language-bash",children:'--vpn-auth="name=tailscale,joinKey=$AUTH-KEY\n'})}),"\n",(0,i.jsx)(n.p,{children:"or provide that information in a file and use the parameter:"}),"\n",(0,i.jsx)(n.pre,{children:(0,i.jsx)(n.code,{className:"language-bash",children:"--vpn-auth-file=$PATH_TO_FILE\n"})}),"\n",(0,i.jsxs)(n.p,{children:["Optionally, if you have your own Tailscale server (e.g. headscale), you can connect to it by appending ",(0,i.jsx)(n.code,{children:",controlServerURL=$URL"})," to the vpn-auth parameters"]}),"\n",(0,i.jsx)(n.admonition,{type:"warning",children:(0,i.jsxs)(n.p,{children:["If you plan on running several K3s clusters using the same tailscale network, please create appropriate ",(0,i.jsx)(n.a,{href:"https://tailscale.com/kb/1018/acls/",children:"ACLs"})," to avoid IP conflicts or use different podCIDR subnets for each cluster."]})})]})}function h(e={}){const{wrapper:n}={...(0,s.a)(),...e.components};return n?(0,i.jsx)(n,{...e,children:(0,i.jsx)(c,{...e})}):c(e)}},1151:(e,n,t)=>{t.d(n,{Z:()=>l,a:()=>o});var i=t(7294);const s={},r=i.createContext(s);function o(e){const n=i.useContext(r);return i.useMemo((function(){return"function"==typeof e?e(n):{...n,...e}}),[n,e])}function l(e){let n;return n=e.disableParentContext?"function"==typeof e.components?e.components(s):e.components||s:o(e.components),i.createElement(r.Provider,{value:n},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/d8ed1217.bdadc90c.js b/assets/js/d8ed1217.b39ce582.js similarity index 99% rename from assets/js/d8ed1217.bdadc90c.js rename to assets/js/d8ed1217.b39ce582.js index 72291d94c..9e0030c9a 100644 --- a/assets/js/d8ed1217.bdadc90c.js +++ b/assets/js/d8ed1217.b39ce582.js @@ -1 +1 @@ -"use strict";(self.webpackChunkk_3_s_docs=self.webpackChunkk_3_s_docs||[]).push([[2745],{7803:(e,n,t)=>{t.r(n),t.d(n,{assets:()=>o,contentTitle:()=>r,default:()=>c,frontMatter:()=>a,metadata:()=>l,toc:()=>d});var s=t(5893),i=t(1151);const a={title:"Manual Upgrades"},r=void 0,l={id:"upgrades/manual",title:"Manual Upgrades",description:"You can upgrade K3s by using the installation script, or by manually installing the binary of the desired version.",source:"@site/docs/upgrades/manual.md",sourceDirName:"upgrades",slug:"/upgrades/manual",permalink:"/upgrades/manual",draft:!1,unlisted:!1,editUrl:"https://github.com/k3s-io/docs/edit/main/docs/upgrades/manual.md",tags:[],version:"current",lastUpdatedAt:1723651727e3,frontMatter:{title:"Manual Upgrades"},sidebar:"mySidebar",previous:{title:"Stopping K3s",permalink:"/upgrades/killall"},next:{title:"Automated Upgrades",permalink:"/upgrades/automated"}},o={},d=[{value:"Release Channels",id:"release-channels",level:3},{value:"Upgrade K3s Using the Installation Script",id:"upgrade-k3s-using-the-installation-script",level:3},{value:"Upgrade K3s Using the Binary",id:"upgrade-k3s-using-the-binary",level:3}];function h(e){const n={a:"a",admonition:"admonition",code:"code",h3:"h3",li:"li",mdxAdmonitionTitle:"mdxAdmonitionTitle",ol:"ol",p:"p",pre:"pre",table:"table",tbody:"tbody",td:"td",th:"th",thead:"thead",tr:"tr",...(0,i.a)(),...e.components};return(0,s.jsxs)(s.Fragment,{children:[(0,s.jsx)(n.p,{children:"You can upgrade K3s by using the installation script, or by manually installing the binary of the desired version."}),"\n",(0,s.jsx)(n.admonition,{type:"note",children:(0,s.jsx)(n.p,{children:"When upgrading, upgrade server nodes first one at a time, then any agent nodes."})}),"\n",(0,s.jsx)(n.h3,{id:"release-channels",children:"Release Channels"}),"\n",(0,s.jsxs)(n.p,{children:["Upgrades performed via the installation script or using our ",(0,s.jsx)(n.a,{href:"/upgrades/automated",children:"automated upgrades"})," feature can be tied to different release channels. The following channels are available:"]}),"\n",(0,s.jsxs)(n.table,{children:[(0,s.jsx)(n.thead,{children:(0,s.jsxs)(n.tr,{children:[(0,s.jsx)(n.th,{children:"Channel"}),(0,s.jsx)(n.th,{children:"Description"})]})}),(0,s.jsxs)(n.tbody,{children:[(0,s.jsxs)(n.tr,{children:[(0,s.jsx)(n.td,{children:"stable"}),(0,s.jsx)(n.td,{children:"(Default) Stable is recommended for production environments. These releases have been through a period of community hardening."})]}),(0,s.jsxs)(n.tr,{children:[(0,s.jsx)(n.td,{children:"latest"}),(0,s.jsx)(n.td,{children:"Latest is recommended for trying out the latest features. These releases have not yet been through a period of community hardening."})]}),(0,s.jsxs)(n.tr,{children:[(0,s.jsx)(n.td,{children:"v1.26 (example)"}),(0,s.jsx)(n.td,{children:"There is a release channel tied to each Kubernetes minor version, including versions that are end-of-life. These channels will select the latest patch available, not necessarily a stable release."})]})]})]}),"\n",(0,s.jsxs)(n.p,{children:["For an exhaustive and up-to-date list of channels, you can visit the ",(0,s.jsx)(n.a,{href:"https://update.k3s.io/v1-release/channels",children:"k3s channel service API"}),". For more technical details on how channels work, you see the ",(0,s.jsx)(n.a,{href:"https://github.com/rancher/channelserver",children:"channelserver project"}),"."]}),"\n",(0,s.jsx)(n.admonition,{type:"tip",children:(0,s.jsxs)(n.p,{children:["When attempting to upgrade to a new version of K3s, the ",(0,s.jsx)(n.a,{href:"https://kubernetes.io/docs/setup/release/version-skew-policy/",children:"Kubernetes version skew policy"})," applies. Ensure that your plan does not skip intermediate minor versions when upgrading. The system-upgrade-controller itself will not protect against unsupported changes to the Kubernetes version."]})}),"\n",(0,s.jsx)(n.h3,{id:"upgrade-k3s-using-the-installation-script",children:"Upgrade K3s Using the Installation Script"}),"\n",(0,s.jsx)(n.p,{children:"To upgrade K3s from an older version you can re-run the installation script using the same configuration options you originally used when running the install script."}),"\n",(0,s.jsxs)(n.admonition,{title:"Note",type:"info",children:[(0,s.jsxs)(n.p,{children:["The ",(0,s.jsx)(n.code,{children:"INSTALL_K3S_EXEC"})," variable, ",(0,s.jsx)(n.code,{children:"K3S_"})," variables, and trailing shell arguments are all used by the install script to generate the systemd unit and environment file.\nIf you set configuration when originally running the install script, but do not set it again when re-running the install script, the original values will be lost."]}),(0,s.jsxs)(n.p,{children:["The contents of the ",(0,s.jsx)(n.a,{href:"/installation/configuration#configuration-file",children:"configuration file"})," are not managed by the install script.\nIf you want your configuration to be independent from the install script, you should use a configuration file instead of passing environment variables or arguments to the install script."]})]}),"\n",(0,s.jsx)(n.p,{children:"Running the install script will:"}),"\n",(0,s.jsxs)(n.ol,{children:["\n",(0,s.jsx)(n.li,{children:"Download the new k3s binary"}),"\n",(0,s.jsx)(n.li,{children:"Update the systemd unit or openrc init script to reflect the args passed to the install script"}),"\n",(0,s.jsx)(n.li,{children:"Restart the k3s service"}),"\n"]}),"\n",(0,s.jsx)(n.p,{children:"For example, to upgrade to the current stable release:"}),"\n",(0,s.jsx)(n.pre,{children:(0,s.jsx)(n.code,{className:"language-sh",children:"curl -sfL https://get.k3s.io | sh -s - \n"})}),"\n",(0,s.jsx)(n.p,{children:"If you want to upgrade to a newer version in a specific channel (such as latest) you can specify the channel:"}),"\n",(0,s.jsx)(n.pre,{children:(0,s.jsx)(n.code,{className:"language-sh",children:"curl -sfL https://get.k3s.io | INSTALL_K3S_CHANNEL=latest sh -s - \n"})}),"\n",(0,s.jsx)(n.p,{children:"If you want to upgrade to a specific version you can run the following command:"}),"\n",(0,s.jsx)(n.pre,{children:(0,s.jsx)(n.code,{className:"language-sh",children:"curl -sfL https://get.k3s.io | INSTALL_K3S_VERSION=vX.Y.Z+k3s1 sh -s - \n"})}),"\n",(0,s.jsxs)(n.admonition,{type:"tip",children:[(0,s.jsx)(n.mdxAdmonitionTitle,{}),(0,s.jsxs)(n.p,{children:["If you want to download the new version of k3s, but not start it, you can use the ",(0,s.jsx)(n.code,{children:"INSTALL_K3S_SKIP_START=true"})," environment variable."]})]}),"\n",(0,s.jsx)(n.h3,{id:"upgrade-k3s-using-the-binary",children:"Upgrade K3s Using the Binary"}),"\n",(0,s.jsx)(n.p,{children:"To upgrade K3s manually, you can download the desired version of the K3s binary and replace the existing binary with the new one."}),"\n",(0,s.jsxs)(n.ol,{children:["\n",(0,s.jsxs)(n.li,{children:["Download the desired version of the K3s binary from ",(0,s.jsx)(n.a,{href:"https://github.com/k3s-io/k3s/releases",children:"releases"})]}),"\n",(0,s.jsxs)(n.li,{children:["Copy the downloaded binary to ",(0,s.jsx)(n.code,{children:"/usr/local/bin/k3s"})," (or your desired location)"]}),"\n",(0,s.jsx)(n.li,{children:"Stop the old k3s binary"}),"\n",(0,s.jsx)(n.li,{children:"Launch the new k3s binary"}),"\n"]})]})}function c(e={}){const{wrapper:n}={...(0,i.a)(),...e.components};return n?(0,s.jsx)(n,{...e,children:(0,s.jsx)(h,{...e})}):h(e)}},1151:(e,n,t)=>{t.d(n,{Z:()=>l,a:()=>r});var s=t(7294);const i={},a=s.createContext(i);function r(e){const n=s.useContext(a);return s.useMemo((function(){return"function"==typeof e?e(n):{...n,...e}}),[n,e])}function l(e){let n;return n=e.disableParentContext?"function"==typeof e.components?e.components(i):e.components||i:r(e.components),s.createElement(a.Provider,{value:n},e.children)}}}]); \ No newline at end of file +"use strict";(self.webpackChunkk_3_s_docs=self.webpackChunkk_3_s_docs||[]).push([[2745],{7803:(e,n,t)=>{t.r(n),t.d(n,{assets:()=>o,contentTitle:()=>r,default:()=>c,frontMatter:()=>a,metadata:()=>l,toc:()=>d});var s=t(5893),i=t(1151);const a={title:"Manual Upgrades"},r=void 0,l={id:"upgrades/manual",title:"Manual Upgrades",description:"You can upgrade K3s by using the installation script, or by manually installing the binary of the desired version.",source:"@site/docs/upgrades/manual.md",sourceDirName:"upgrades",slug:"/upgrades/manual",permalink:"/upgrades/manual",draft:!1,unlisted:!1,editUrl:"https://github.com/k3s-io/docs/edit/main/docs/upgrades/manual.md",tags:[],version:"current",lastUpdatedAt:1723747404e3,frontMatter:{title:"Manual Upgrades"},sidebar:"mySidebar",previous:{title:"Stopping K3s",permalink:"/upgrades/killall"},next:{title:"Automated Upgrades",permalink:"/upgrades/automated"}},o={},d=[{value:"Release Channels",id:"release-channels",level:3},{value:"Upgrade K3s Using the Installation Script",id:"upgrade-k3s-using-the-installation-script",level:3},{value:"Upgrade K3s Using the Binary",id:"upgrade-k3s-using-the-binary",level:3}];function h(e){const n={a:"a",admonition:"admonition",code:"code",h3:"h3",li:"li",mdxAdmonitionTitle:"mdxAdmonitionTitle",ol:"ol",p:"p",pre:"pre",table:"table",tbody:"tbody",td:"td",th:"th",thead:"thead",tr:"tr",...(0,i.a)(),...e.components};return(0,s.jsxs)(s.Fragment,{children:[(0,s.jsx)(n.p,{children:"You can upgrade K3s by using the installation script, or by manually installing the binary of the desired version."}),"\n",(0,s.jsx)(n.admonition,{type:"note",children:(0,s.jsx)(n.p,{children:"When upgrading, upgrade server nodes first one at a time, then any agent nodes."})}),"\n",(0,s.jsx)(n.h3,{id:"release-channels",children:"Release Channels"}),"\n",(0,s.jsxs)(n.p,{children:["Upgrades performed via the installation script or using our ",(0,s.jsx)(n.a,{href:"/upgrades/automated",children:"automated upgrades"})," feature can be tied to different release channels. The following channels are available:"]}),"\n",(0,s.jsxs)(n.table,{children:[(0,s.jsx)(n.thead,{children:(0,s.jsxs)(n.tr,{children:[(0,s.jsx)(n.th,{children:"Channel"}),(0,s.jsx)(n.th,{children:"Description"})]})}),(0,s.jsxs)(n.tbody,{children:[(0,s.jsxs)(n.tr,{children:[(0,s.jsx)(n.td,{children:"stable"}),(0,s.jsx)(n.td,{children:"(Default) Stable is recommended for production environments. These releases have been through a period of community hardening."})]}),(0,s.jsxs)(n.tr,{children:[(0,s.jsx)(n.td,{children:"latest"}),(0,s.jsx)(n.td,{children:"Latest is recommended for trying out the latest features. These releases have not yet been through a period of community hardening."})]}),(0,s.jsxs)(n.tr,{children:[(0,s.jsx)(n.td,{children:"v1.26 (example)"}),(0,s.jsx)(n.td,{children:"There is a release channel tied to each Kubernetes minor version, including versions that are end-of-life. These channels will select the latest patch available, not necessarily a stable release."})]})]})]}),"\n",(0,s.jsxs)(n.p,{children:["For an exhaustive and up-to-date list of channels, you can visit the ",(0,s.jsx)(n.a,{href:"https://update.k3s.io/v1-release/channels",children:"k3s channel service API"}),". For more technical details on how channels work, you see the ",(0,s.jsx)(n.a,{href:"https://github.com/rancher/channelserver",children:"channelserver project"}),"."]}),"\n",(0,s.jsx)(n.admonition,{type:"tip",children:(0,s.jsxs)(n.p,{children:["When attempting to upgrade to a new version of K3s, the ",(0,s.jsx)(n.a,{href:"https://kubernetes.io/docs/setup/release/version-skew-policy/",children:"Kubernetes version skew policy"})," applies. Ensure that your plan does not skip intermediate minor versions when upgrading. The system-upgrade-controller itself will not protect against unsupported changes to the Kubernetes version."]})}),"\n",(0,s.jsx)(n.h3,{id:"upgrade-k3s-using-the-installation-script",children:"Upgrade K3s Using the Installation Script"}),"\n",(0,s.jsx)(n.p,{children:"To upgrade K3s from an older version you can re-run the installation script using the same configuration options you originally used when running the install script."}),"\n",(0,s.jsxs)(n.admonition,{title:"Note",type:"info",children:[(0,s.jsxs)(n.p,{children:["The ",(0,s.jsx)(n.code,{children:"INSTALL_K3S_EXEC"})," variable, ",(0,s.jsx)(n.code,{children:"K3S_"})," variables, and trailing shell arguments are all used by the install script to generate the systemd unit and environment file.\nIf you set configuration when originally running the install script, but do not set it again when re-running the install script, the original values will be lost."]}),(0,s.jsxs)(n.p,{children:["The contents of the ",(0,s.jsx)(n.a,{href:"/installation/configuration#configuration-file",children:"configuration file"})," are not managed by the install script.\nIf you want your configuration to be independent from the install script, you should use a configuration file instead of passing environment variables or arguments to the install script."]})]}),"\n",(0,s.jsx)(n.p,{children:"Running the install script will:"}),"\n",(0,s.jsxs)(n.ol,{children:["\n",(0,s.jsx)(n.li,{children:"Download the new k3s binary"}),"\n",(0,s.jsx)(n.li,{children:"Update the systemd unit or openrc init script to reflect the args passed to the install script"}),"\n",(0,s.jsx)(n.li,{children:"Restart the k3s service"}),"\n"]}),"\n",(0,s.jsx)(n.p,{children:"For example, to upgrade to the current stable release:"}),"\n",(0,s.jsx)(n.pre,{children:(0,s.jsx)(n.code,{className:"language-sh",children:"curl -sfL https://get.k3s.io | sh -s - \n"})}),"\n",(0,s.jsx)(n.p,{children:"If you want to upgrade to a newer version in a specific channel (such as latest) you can specify the channel:"}),"\n",(0,s.jsx)(n.pre,{children:(0,s.jsx)(n.code,{className:"language-sh",children:"curl -sfL https://get.k3s.io | INSTALL_K3S_CHANNEL=latest sh -s - \n"})}),"\n",(0,s.jsx)(n.p,{children:"If you want to upgrade to a specific version you can run the following command:"}),"\n",(0,s.jsx)(n.pre,{children:(0,s.jsx)(n.code,{className:"language-sh",children:"curl -sfL https://get.k3s.io | INSTALL_K3S_VERSION=vX.Y.Z+k3s1 sh -s - \n"})}),"\n",(0,s.jsxs)(n.admonition,{type:"tip",children:[(0,s.jsx)(n.mdxAdmonitionTitle,{}),(0,s.jsxs)(n.p,{children:["If you want to download the new version of k3s, but not start it, you can use the ",(0,s.jsx)(n.code,{children:"INSTALL_K3S_SKIP_START=true"})," environment variable."]})]}),"\n",(0,s.jsx)(n.h3,{id:"upgrade-k3s-using-the-binary",children:"Upgrade K3s Using the Binary"}),"\n",(0,s.jsx)(n.p,{children:"To upgrade K3s manually, you can download the desired version of the K3s binary and replace the existing binary with the new one."}),"\n",(0,s.jsxs)(n.ol,{children:["\n",(0,s.jsxs)(n.li,{children:["Download the desired version of the K3s binary from ",(0,s.jsx)(n.a,{href:"https://github.com/k3s-io/k3s/releases",children:"releases"})]}),"\n",(0,s.jsxs)(n.li,{children:["Copy the downloaded binary to ",(0,s.jsx)(n.code,{children:"/usr/local/bin/k3s"})," (or your desired location)"]}),"\n",(0,s.jsx)(n.li,{children:"Stop the old k3s binary"}),"\n",(0,s.jsx)(n.li,{children:"Launch the new k3s binary"}),"\n"]})]})}function c(e={}){const{wrapper:n}={...(0,i.a)(),...e.components};return n?(0,s.jsx)(n,{...e,children:(0,s.jsx)(h,{...e})}):h(e)}},1151:(e,n,t)=>{t.d(n,{Z:()=>l,a:()=>r});var s=t(7294);const i={},a=s.createContext(i);function r(e){const n=s.useContext(a);return s.useMemo((function(){return"function"==typeof e?e(n):{...n,...e}}),[n,e])}function l(e){let n;return n=e.disableParentContext?"function"==typeof e.components?e.components(i):e.components||i:r(e.components),s.createElement(a.Provider,{value:n},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/dd22e55f.481c7226.js b/assets/js/dd22e55f.ec13b5f1.js similarity index 99% rename from assets/js/dd22e55f.481c7226.js rename to assets/js/dd22e55f.ec13b5f1.js index 6b31a5b05..624d94d45 100644 --- a/assets/js/dd22e55f.481c7226.js +++ b/assets/js/dd22e55f.ec13b5f1.js @@ -1 +1 @@ -"use strict";(self.webpackChunkk_3_s_docs=self.webpackChunkk_3_s_docs||[]).push([[5668],{4840:(e,s,i)=>{i.r(s),i.d(s,{assets:()=>c,contentTitle:()=>l,default:()=>o,frontMatter:()=>t,metadata:()=>h,toc:()=>d});var r=i(5893),n=i(1151);const t={hide_table_of_contents:!0,sidebar_position:4},l="v1.27.X",h={id:"release-notes/v1.27.X",title:"v1.27.X",description:"Before upgrading from earlier releases, be sure to read the Kubernetes Urgent Upgrade Notes.",source:"@site/docs/release-notes/v1.27.X.md",sourceDirName:"release-notes",slug:"/release-notes/v1.27.X",permalink:"/release-notes/v1.27.X",draft:!1,unlisted:!1,editUrl:"https://github.com/k3s-io/docs/edit/main/docs/release-notes/v1.27.X.md",tags:[],version:"current",lastUpdatedAt:1723651727e3,sidebarPosition:4,frontMatter:{hide_table_of_contents:!0,sidebar_position:4},sidebar:"mySidebar",previous:{title:"v1.28.X",permalink:"/release-notes/v1.28.X"},next:{title:"v1.26.X",permalink:"/release-notes/v1.26.X"}},c={},d=[{value:"Release v1.27.16+k3s1",id:"release-v12716k3s1",level:2},{value:"Changes since v1.27.15+k3s2:",id:"changes-since-v12715k3s2",level:3},{value:"Release v1.27.15+k3s2",id:"release-v12715k3s2",level:2},{value:"Changes since v1.27.15+k3s1:",id:"changes-since-v12715k3s1",level:3},{value:"Release v1.27.15+k3s1",id:"release-v12715k3s1",level:2},{value:"Changes since v1.27.14+k3s1:",id:"changes-since-v12714k3s1",level:3},{value:"Release v1.27.14+k3s1",id:"release-v12714k3s1",level:2},{value:"Changes since v1.27.13+k3s1:",id:"changes-since-v12713k3s1",level:3},{value:"Release v1.27.13+k3s1",id:"release-v12713k3s1",level:2},{value:"Changes since v1.27.12+k3s1:",id:"changes-since-v12712k3s1",level:3},{value:"Release v1.27.12+k3s1",id:"release-v12712k3s1",level:2},{value:"Changes since v1.27.11+k3s1:",id:"changes-since-v12711k3s1",level:3},{value:"Release v1.27.11+k3s1",id:"release-v12711k3s1",level:2},{value:"Changes since v1.27.10+k3s2:",id:"changes-since-v12710k3s2",level:3},{value:"Release v1.27.10+k3s2",id:"release-v12710k3s2",level:2},{value:"Changes since v1.27.9+k3s1:",id:"changes-since-v1279k3s1",level:3},{value:"Release v1.27.9+k3s1",id:"release-v1279k3s1",level:2},{value:"Changes since v1.27.8+k3s2:",id:"changes-since-v1278k3s2",level:3},{value:"Release v1.27.8+k3s2",id:"release-v1278k3s2",level:2},{value:"Changes since v1.27.7+k3s2:",id:"changes-since-v1277k3s2",level:3},{value:"Release v1.27.7+k3s2",id:"release-v1277k3s2",level:2},{value:"Changes since v1.27.7+k3s1:",id:"changes-since-v1277k3s1",level:3},{value:"Release v1.27.7+k3s1",id:"release-v1277k3s1",level:2},{value:"Changes since v1.27.6+k3s1:",id:"changes-since-v1276k3s1",level:3},{value:"Release v1.27.6+k3s1",id:"release-v1276k3s1",level:2},{value:"Changes since v1.27.5+k3s1:",id:"changes-since-v1275k3s1",level:3},{value:"Release v1.27.5+k3s1",id:"release-v1275k3s1",level:2},{value:"Changes since v1.27.4+k3s1:",id:"changes-since-v1274k3s1",level:3},{value:"Release v1.27.4+k3s1",id:"release-v1274k3s1",level:2},{value:"Changes since v1.27.3+k3s1:",id:"changes-since-v1273k3s1",level:3},{value:"Release v1.27.3+k3s1",id:"release-v1273k3s1",level:2},{value:"Changes since v1.27.2+k3s1:",id:"changes-since-v1272k3s1",level:3},{value:"Release v1.27.2+k3s1",id:"release-v1272k3s1",level:2},{value:"Changes since v1.27.1+k3s1:",id:"changes-since-v1271k3s1",level:3},{value:"Release v1.27.1+k3s1",id:"release-v1271k3s1",level:2},{value:"Changes since v1.26.4+k3s1:",id:"changes-since-v1264k3s1",level:3}];function a(e){const s={a:"a",admonition:"admonition",br:"br",code:"code",h1:"h1",h2:"h2",h3:"h3",header:"header",hr:"hr",li:"li",p:"p",strong:"strong",table:"table",tbody:"tbody",td:"td",th:"th",thead:"thead",tr:"tr",ul:"ul",...(0,n.a)(),...e.components};return(0,r.jsxs)(r.Fragment,{children:[(0,r.jsx)(s.header,{children:(0,r.jsx)(s.h1,{id:"v127x",children:"v1.27.X"})}),"\n",(0,r.jsx)(s.admonition,{title:"Upgrade Notice",type:"warning",children:(0,r.jsxs)(s.p,{children:["Before upgrading from earlier releases, be sure to read the Kubernetes ",(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.27.md#urgent-upgrade-notes",children:"Urgent Upgrade Notes"}),"."]})}),"\n",(0,r.jsxs)(s.table,{children:[(0,r.jsx)(s.thead,{children:(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.th,{children:"Version"}),(0,r.jsx)(s.th,{children:"Release date"}),(0,r.jsx)(s.th,{children:"Kubernetes"}),(0,r.jsx)(s.th,{children:"Kine"}),(0,r.jsx)(s.th,{children:"SQLite"}),(0,r.jsx)(s.th,{children:"Etcd"}),(0,r.jsx)(s.th,{children:"Containerd"}),(0,r.jsx)(s.th,{children:"Runc"}),(0,r.jsx)(s.th,{children:"Flannel"}),(0,r.jsx)(s.th,{children:"Metrics-server"}),(0,r.jsx)(s.th,{children:"Traefik"}),(0,r.jsx)(s.th,{children:"CoreDNS"}),(0,r.jsx)(s.th,{children:"Helm-controller"}),(0,r.jsx)(s.th,{children:"Local-path-provisioner"})]})}),(0,r.jsxs)(s.tbody,{children:[(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"/release-notes/v1.27.X#release-v12716k3s1",children:"v1.27.16+k3s1"})}),(0,r.jsx)(s.td,{children:"Jul 31 2024"}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.27.md#v12716",children:"v1.27.16"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/kine/releases/tag/v0.11.11",children:"v0.11.11"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://sqlite.org/releaselog/3_44_0.html",children:"3.44.0"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/etcd/releases/tag/v3.5.13-k3s1",children:"v3.5.13-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/containerd/releases/tag/v1.7.17-k3s2.27",children:"v1.7.17-k3s2.27"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/opencontainers/runc/releases/tag/v1.1.12",children:"v1.1.12"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/flannel-io/flannel/releases/tag/v0.25.4",children:"v0.25.4"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.7.0",children:"v0.7.0"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/traefik/traefik/releases/tag/v2.10.7",children:"v2.10.7"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/coredns/coredns/releases/tag/v1.10.1",children:"v1.10.1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/helm-controller/releases/tag/v0.15.10",children:"v0.15.10"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/rancher/local-path-provisioner/releases/tag/v0.0.28",children:"v0.0.28"})})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"/release-notes/v1.27.X#release-v12715k3s2",children:"v1.27.15+k3s2"})}),(0,r.jsx)(s.td,{children:"Jul 03 2024"}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.27.md#v12715",children:"v1.27.15"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/kine/releases/tag/v0.11.9",children:"v0.11.9"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://sqlite.org/releaselog/3_44_0.html",children:"3.44.0"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/etcd/releases/tag/v3.5.13-k3s1",children:"v3.5.13-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/containerd/releases/tag/v1.7.17-k3s2.27",children:"v1.7.17-k3s2.27"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/opencontainers/runc/releases/tag/v1.1.12",children:"v1.1.12"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/flannel-io/flannel/releases/tag/v0.25.4",children:"v0.25.4"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.7.0",children:"v0.7.0"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/traefik/traefik/releases/tag/v2.10.7",children:"v2.10.7"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/coredns/coredns/releases/tag/v1.10.1",children:"v1.10.1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/helm-controller/releases/tag/v0.15.10",children:"v0.15.10"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/rancher/local-path-provisioner/releases/tag/v0.0.27",children:"v0.0.27"})})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"/release-notes/v1.27.X#release-v12715k3s1",children:"v1.27.15+k3s1"})}),(0,r.jsx)(s.td,{children:"Jun 25 2024"}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.27.md#v12715",children:"v1.27.15"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/kine/releases/tag/v0.11.9",children:"v0.11.9"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://sqlite.org/releaselog/3_44_0.html",children:"3.44.0"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/etcd/releases/tag/v3.5.13-k3s1",children:"v3.5.13-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/containerd/releases/tag/v1.7.17-k3s2.27",children:"v1.7.17-k3s2.27"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/opencontainers/runc/releases/tag/v1.1.12",children:"v1.1.12"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/flannel-io/flannel/releases/tag/v0.25.2",children:"v0.25.2"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.7.0",children:"v0.7.0"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/traefik/traefik/releases/tag/v2.10.7",children:"v2.10.7"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/coredns/coredns/releases/tag/v1.10.1",children:"v1.10.1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/helm-controller/releases/tag/v0.15.10",children:"v0.15.10"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/rancher/local-path-provisioner/releases/tag/v0.0.27",children:"v0.0.27"})})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"/release-notes/v1.27.X#release-v12714k3s1",children:"v1.27.14+k3s1"})}),(0,r.jsx)(s.td,{children:"May 22 2024"}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.27.md#v12714",children:"v1.27.14"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/kine/releases/tag/v0.11.7",children:"v0.11.7"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://sqlite.org/releaselog/3_44_0.html",children:"3.44.0"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/etcd/releases/tag/v3.5.9-k3s1",children:"v3.5.9-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/containerd/releases/tag/v1.7.15-k3s1.27",children:"v1.7.15-k3s1.27"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/opencontainers/runc/releases/tag/v1.1.12-k3s1",children:"v1.1.12-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/flannel-io/flannel/releases/tag/v0.24.2",children:"v0.24.2"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.7.0",children:"v0.7.0"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/traefik/traefik/releases/tag/v2.10.7",children:"v2.10.7"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/coredns/coredns/releases/tag/v1.10.1",children:"v1.10.1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/helm-controller/releases/tag/v0.15.9",children:"v0.15.9"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/rancher/local-path-provisioner/releases/tag/v0.0.26",children:"v0.0.26"})})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"/release-notes/v1.27.X#release-v12713k3s1",children:"v1.27.13+k3s1"})}),(0,r.jsx)(s.td,{children:"Apr 25 2024"}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.27.md#v12713",children:"v1.27.13"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/kine/releases/tag/v0.11.7",children:"v0.11.7"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://sqlite.org/releaselog/3_44_0.html",children:"3.44.0"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/etcd/releases/tag/v3.5.9-k3s1",children:"v3.5.9-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/containerd/releases/tag/v1.7.15-k3s1.27",children:"v1.7.15-k3s1.27"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/opencontainers/runc/releases/tag/v1.1.12",children:"v1.1.12"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/flannel-io/flannel/releases/tag/v0.24.2",children:"v0.24.2"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.7.0",children:"v0.7.0"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/traefik/traefik/releases/tag/v2.10.7",children:"v2.10.7"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/coredns/coredns/releases/tag/v1.10.1",children:"v1.10.1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/helm-controller/releases/tag/v0.15.9",children:"v0.15.9"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/rancher/local-path-provisioner/releases/tag/v0.0.26",children:"v0.0.26"})})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"/release-notes/v1.27.X#release-v12712k3s1",children:"v1.27.12+k3s1"})}),(0,r.jsx)(s.td,{children:"Mar 25 2024"}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.27.md#v12712",children:"v1.27.12"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/kine/releases/tag/v0.11.4",children:"v0.11.4"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://sqlite.org/releaselog/3_44_0.html",children:"3.44.0"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/etcd/releases/tag/v3.5.9-k3s1",children:"v3.5.9-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/containerd/releases/tag/v1.7.11-k3s2.27",children:"v1.7.11-k3s2.27"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/opencontainers/runc/releases/tag/v1.1.12-k3s1",children:"v1.1.12-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/flannel-io/flannel/releases/tag/v0.24.2",children:"v0.24.2"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.7.0",children:"v0.7.0"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/traefik/traefik/releases/tag/v2.10.5",children:"v2.10.5"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/coredns/coredns/releases/tag/v1.10.1",children:"v1.10.1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/helm-controller/releases/tag/v0.15.9",children:"v0.15.9"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/rancher/local-path-provisioner/releases/tag/v0.0.26",children:"v0.0.26"})})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"/release-notes/v1.27.X#release-v12711k3s1",children:"v1.27.11+k3s1"})}),(0,r.jsx)(s.td,{children:"Feb 29 2024"}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.27.md#v12711",children:"v1.27.11"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/kine/releases/tag/v0.11.4",children:"v0.11.4"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://sqlite.org/releaselog/3_44_0.html",children:"3.44.0"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/etcd/releases/tag/v3.5.9-k3s1",children:"v3.5.9-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/containerd/releases/tag/v1.7.11-k3s2.27",children:"v1.7.11-k3s2.27"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/runc/releases/tag/v1.1.12-k3s1",children:"v1.1.12-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/flannel-io/flannel/releases/tag/v0.24.2",children:"v0.24.2"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.6.3",children:"v0.6.3"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/traefik/traefik/releases/tag/v2.10.5",children:"v2.10.5"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/coredns/coredns/releases/tag/v1.10.1",children:"v1.10.1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/helm-controller/releases/tag/v0.15.8",children:"v0.15.8"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/rancher/local-path-provisioner/releases/tag/v0.0.26",children:"v0.0.26"})})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"/release-notes/v1.27.X#release-v12710k3s2",children:"v1.27.10+k3s2"})}),(0,r.jsx)(s.td,{children:"Feb 06 2024"}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.27.md#v12710",children:"v1.27.10"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/kine/releases/tag/v0.11.0",children:"v0.11.0"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://sqlite.org/releaselog/3_42_0.html",children:"3.42.0"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/etcd/releases/tag/v3.5.9-k3s1",children:"v3.5.9-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/containerd/releases/tag/v1.7.11-k3s2.27",children:"v1.7.11-k3s2.27"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/opencontainers/runc/releases/tag/v1.1.12-k3s1",children:"v1.1.12-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/flannel-io/flannel/releases/tag/v0.22.2",children:"v0.22.2"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.6.3",children:"v0.6.3"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/traefik/traefik/releases/tag/v2.10.5",children:"v2.10.5"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/coredns/coredns/releases/tag/v1.10.1",children:"v1.10.1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/helm-controller/releases/tag/v0.15.8",children:"v0.15.8"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/rancher/local-path-provisioner/releases/tag/v0.0.24",children:"v0.0.24"})})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"/release-notes/v1.27.X#release-v1279k3s1",children:"v1.27.9+k3s1"})}),(0,r.jsx)(s.td,{children:"Dec 27 2023"}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.27.md#v1279",children:"v1.27.9"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/kine/releases/tag/v0.11.0",children:"v0.11.0"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://sqlite.org/releaselog/3_42_0.html",children:"3.42.0"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/etcd/releases/tag/v3.5.9-k3s1",children:"v3.5.9-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/containerd/releases/tag/v1.7.11-k3s2.27",children:"v1.7.11-k3s2.27"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/opencontainers/runc/releases/tag/v1.1.10",children:"v1.1.10"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/flannel-io/flannel/releases/tag/v0.22.2",children:"v0.22.2"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.6.3",children:"v0.6.3"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/traefik/traefik/releases/tag/v2.10.5",children:"v2.10.5"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/coredns/coredns/releases/tag/v1.10.1",children:"v1.10.1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/helm-controller/releases/tag/v0.15.4",children:"v0.15.4"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/rancher/local-path-provisioner/releases/tag/v0.0.24",children:"v0.0.24"})})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"/release-notes/v1.27.X#release-v1278k3s2",children:"v1.27.8+k3s2"})}),(0,r.jsx)(s.td,{children:"Dec 07 2023"}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.27.md#v1278",children:"v1.27.8"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/kine/releases/tag/v0.11.0",children:"v0.11.0"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://sqlite.org/releaselog/3_42_0.html",children:"3.42.0"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/etcd/releases/tag/v3.5.9-k3s1",children:"v3.5.9-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/containerd/releases/tag/v1.7.7-k3s1.27",children:"v1.7.7-k3s1.27"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/opencontainers/runc/releases/tag/v1.1.8",children:"v1.1.8"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/flannel-io/flannel/releases/tag/v0.22.2",children:"v0.22.2"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.6.3",children:"v0.6.3"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/traefik/traefik/releases/tag/v2.10.5",children:"v2.10.5"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/coredns/coredns/releases/tag/v1.10.1",children:"v1.10.1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/helm-controller/releases/tag/v0.15.4",children:"v0.15.4"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/rancher/local-path-provisioner/releases/tag/v0.0.24",children:"v0.0.24"})})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"/release-notes/v1.27.X#release-v1277k3s2",children:"v1.27.7+k3s2"})}),(0,r.jsx)(s.td,{children:"Nov 08 2023"}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.27.md#v1277",children:"v1.27.7"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/kine/releases/tag/v0.10.3",children:"v0.10.3"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://sqlite.org/releaselog/3_42_0.html",children:"3.42.0"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/etcd/releases/tag/v3.5.9-k3s1",children:"v3.5.9-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/containerd/releases/tag/v1.7.7-k3s1.27",children:"v1.7.7-k3s1.27"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/opencontainers/runc/releases/tag/v1.1.8",children:"v1.1.8"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/flannel-io/flannel/releases/tag/v0.22.2",children:"v0.22.2"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.6.3",children:"v0.6.3"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/traefik/traefik/releases/tag/v2.10.5",children:"v2.10.5"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/coredns/coredns/releases/tag/v1.10.1",children:"v1.10.1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/helm-controller/releases/tag/v0.15.4",children:"v0.15.4"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/rancher/local-path-provisioner/releases/tag/v0.0.24",children:"v0.0.24"})})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"/release-notes/v1.27.X#release-v1277k3s1",children:"v1.27.7+k3s1"})}),(0,r.jsx)(s.td,{children:"Oct 30 2023"}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.27.md#v1277",children:"v1.27.7"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/kine/releases/tag/v0.10.3",children:"v0.10.3"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://sqlite.org/releaselog/3_42_0.html",children:"3.42.0"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/etcd/releases/tag/v3.5.9-k3s1",children:"v3.5.9-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/containerd/releases/tag/v1.7.7-k3s1.27",children:"v1.7.7-k3s1.27"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/opencontainers/runc/releases/tag/v1.1.8",children:"v1.1.8"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/flannel-io/flannel/releases/tag/v0.22.2",children:"v0.22.2"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.6.3",children:"v0.6.3"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/traefik/traefik/releases/tag/v2.10.5",children:"v2.10.5"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/coredns/coredns/releases/tag/v1.10.1",children:"v1.10.1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/helm-controller/releases/tag/v0.15.4",children:"v0.15.4"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/rancher/local-path-provisioner/releases/tag/v0.0.24",children:"v0.0.24"})})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"/release-notes/v1.27.X#release-v1276k3s1",children:"v1.27.6+k3s1"})}),(0,r.jsx)(s.td,{children:"Sep 20 2023"}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.27.md#v1276",children:"v1.27.6"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/kine/releases/tag/v0.10.3",children:"v0.10.3"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://sqlite.org/releaselog/3_42_0.html",children:"3.42.0"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/etcd/releases/tag/v3.5.9-k3s1",children:"v3.5.9-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/containerd/releases/tag/v1.7.6-k3s1.27",children:"v1.7.6-k3s1.27"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/opencontainers/runc/releases/tag/v1.1.8",children:"v1.1.8"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/flannel-io/flannel/releases/tag/v0.22.2",children:"v0.22.2"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.6.3",children:"v0.6.3"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/traefik/traefik/releases/tag/v2.9.10",children:"v2.9.10"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/coredns/coredns/releases/tag/v1.10.1",children:"v1.10.1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/helm-controller/releases/tag/v0.15.4",children:"v0.15.4"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/rancher/local-path-provisioner/releases/tag/v0.0.24",children:"v0.0.24"})})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"/release-notes/v1.27.X#release-v1275k3s1",children:"v1.27.5+k3s1"})}),(0,r.jsx)(s.td,{children:"Sep 05 2023"}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.27.md#v1275",children:"v1.27.5"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/kine/releases/tag/v0.10.2",children:"v0.10.2"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://sqlite.org/releaselog/3_42_0.html",children:"3.42.0"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/etcd/releases/tag/v3.5.9-k3s1",children:"v3.5.9-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/containerd/releases/tag/v1.7.3-k3s1",children:"v1.7.3-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/opencontainers/runc/releases/tag/v1.1.8",children:"v1.1.8"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/flannel-io/flannel/releases/tag/v0.22.2",children:"v0.22.2"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.6.3",children:"v0.6.3"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/traefik/traefik/releases/tag/v2.9.10",children:"v2.9.10"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/coredns/coredns/releases/tag/v1.10.1",children:"v1.10.1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/helm-controller/releases/tag/v0.15.4",children:"v0.15.4"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/rancher/local-path-provisioner/releases/tag/v0.0.24",children:"v0.0.24"})})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"/release-notes/v1.27.X#release-v1274k3s1",children:"v1.27.4+k3s1"})}),(0,r.jsx)(s.td,{children:"Jul 27 2023"}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.27.md#v1274",children:"v1.27.4"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/kine/releases/tag/v0.10.1",children:"v0.10.1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://sqlite.org/releaselog/3_39_2.html",children:"3.39.2"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/etcd/releases/tag/v3.5.7-k3s1",children:"v3.5.7-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/containerd/releases/tag/v1.7.1-k3s1",children:"v1.7.1-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/opencontainers/runc/releases/tag/v1.1.7",children:"v1.1.7"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/flannel-io/flannel/releases/tag/v0.22.0",children:"v0.22.0"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.6.3",children:"v0.6.3"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/traefik/traefik/releases/tag/v2.9.10",children:"v2.9.10"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/coredns/coredns/releases/tag/v1.10.1",children:"v1.10.1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/helm-controller/releases/tag/v0.15.2",children:"v0.15.2"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/rancher/local-path-provisioner/releases/tag/v0.0.24",children:"v0.0.24"})})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"/release-notes/v1.27.X#release-v1273k3s1",children:"v1.27.3+k3s1"})}),(0,r.jsx)(s.td,{children:"Jun 26 2023"}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.27.md#v1273",children:"v1.27.3"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/kine/releases/tag/v0.10.1",children:"v0.10.1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://sqlite.org/releaselog/3_39_2.html",children:"3.39.2"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/etcd/releases/tag/v3.5.7-k3s1",children:"v3.5.7-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/containerd/releases/tag/v1.7.1-k3s1",children:"v1.7.1-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/opencontainers/runc/releases/tag/v1.1.7",children:"v1.1.7"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/flannel-io/flannel/releases/tag/v0.22.0",children:"v0.22.0"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.6.3",children:"v0.6.3"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/traefik/traefik/releases/tag/v2.9.10",children:"v2.9.10"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/coredns/coredns/releases/tag/v1.10.1",children:"v1.10.1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/helm-controller/releases/tag/v0.15.0",children:"v0.15.0"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/rancher/local-path-provisioner/releases/tag/v0.0.24",children:"v0.0.24"})})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"/release-notes/v1.27.X#release-v1272k3s1",children:"v1.27.2+k3s1"})}),(0,r.jsx)(s.td,{children:"May 26 2023"}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.27.md#v1272",children:"v1.27.2"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/kine/releases/tag/v0.10.1",children:"v0.10.1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://sqlite.org/releaselog/3_39_2.html",children:"3.39.2"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/etcd/releases/tag/v3.5.7-k3s1",children:"v3.5.7-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/containerd/releases/tag/v1.7.1-k3s1",children:"v1.7.1-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/opencontainers/runc/releases/tag/v1.1.7",children:"v1.1.7"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/flannel-io/flannel/releases/tag/v0.21.4",children:"v0.21.4"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.6.2",children:"v0.6.2"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/traefik/traefik/releases/tag/v2.9.10",children:"v2.9.10"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/coredns/coredns/releases/tag/v1.10.1",children:"v1.10.1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/helm-controller/releases/tag/v0.14.0",children:"v0.14.0"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/rancher/local-path-provisioner/releases/tag/v0.0.24",children:"v0.0.24"})})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"/release-notes/v1.27.X#release-v1271k3s1",children:"v1.27.1+k3s1"})}),(0,r.jsx)(s.td,{children:"Apr 27 2023"}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.27.md#v1271",children:"v1.27.1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/kine/releases/tag/v0.9.9",children:"v0.9.9"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://sqlite.org/releaselog/3_39_2.html",children:"3.39.2"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/etcd/releases/tag/v3.5.7-k3s1",children:"v3.5.7-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/containerd/releases/tag/v1.6.19-k3s1",children:"v1.6.19-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/opencontainers/runc/releases/tag/v1.1.5",children:"v1.1.5"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/flannel-io/flannel/releases/tag/v0.21.4",children:"v0.21.4"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.6.2",children:"v0.6.2"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/traefik/traefik/releases/tag/v2.9.4",children:"v2.9.4"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/coredns/coredns/releases/tag/v1.10.1",children:"v1.10.1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/helm-controller/releases/tag/v0.13.3",children:"v0.13.3"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/rancher/local-path-provisioner/releases/tag/v0.0.24",children:"v0.0.24"})})]})]})]}),"\n",(0,r.jsx)("br",{}),"\n",(0,r.jsxs)(s.h2,{id:"release-v12716k3s1",children:["Release ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/releases/tag/v1.27.16+k3s1",children:"v1.27.16+k3s1"})]}),"\n",(0,r.jsx)(s.p,{children:"This release updates Kubernetes to v1.27.16, and fixes a number of issues."}),"\n",(0,r.jsxs)(s.p,{children:["For more details on what's new, see the ",(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.27.md#changelog-since-v12715",children:"Kubernetes release notes"}),"."]}),"\n",(0,r.jsx)(s.h3,{id:"changes-since-v12715k3s2",children:"Changes since v1.27.15+k3s2:"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsxs)(s.li,{children:["Backports for 2024-07 release cycle ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10500",children:"(#10500)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:"Bump k3s-root to v0.14.0"}),"\n",(0,r.jsx)(s.li,{children:"Bump github.com/hashicorp/go-retryablehttp from 0.7.4 to 0.7.7"}),"\n",(0,r.jsx)(s.li,{children:"Bump Local Path Provisioner version"}),"\n",(0,r.jsx)(s.li,{children:"Ensure remotedialer kubelet connections use kubelet bind address"}),"\n",(0,r.jsx)(s.li,{children:"Chore: Bump Trivy version"}),"\n",(0,r.jsx)(s.li,{children:"Add etcd s3 config secret implementation"}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["July Test Backports ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10510",children:"(#10510)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Update to v1.27.16-k3s1 and Go 1.22.5 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10542",children:"(#10542)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Fix issues loading data-dir value from env vars or dropping config files ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10599",children:"(#10599)"})]}),"\n"]}),"\n",(0,r.jsx)(s.hr,{}),"\n",(0,r.jsxs)(s.h2,{id:"release-v12715k3s2",children:["Release ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/releases/tag/v1.27.15+k3s2",children:"v1.27.15+k3s2"})]}),"\n",(0,r.jsx)(s.p,{children:"This release updates Kubernetes to v1.27.15, and fixes a number of issues."}),"\n",(0,r.jsxs)(s.p,{children:["For more details on what's new, see the ",(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.27.md#changelog-since-v12715",children:"Kubernetes release notes"}),"."]}),"\n",(0,r.jsx)(s.h3,{id:"changes-since-v12715k3s1",children:"Changes since v1.27.15+k3s1:"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsxs)(s.li,{children:["Update flannel to v0.25.4 and fixed issue with IPv6 mask ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10429",children:"(#10429)"})]}),"\n"]}),"\n",(0,r.jsx)(s.hr,{}),"\n",(0,r.jsxs)(s.h2,{id:"release-v12715k3s1",children:["Release ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/releases/tag/v1.27.15+k3s1",children:"v1.27.15+k3s1"})]}),"\n",(0,r.jsx)(s.p,{children:"This release updates Kubernetes to v1.27.15, and fixes a number of issues."}),"\n",(0,r.jsxs)(s.p,{children:["For more details on what's new, see the ",(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.27.md#changelog-since-v12714",children:"Kubernetes release notes"}),"."]}),"\n",(0,r.jsx)(s.h3,{id:"changes-since-v12714k3s1",children:"Changes since v1.27.14+k3s1:"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsxs)(s.li,{children:["Replace deprecated ruby function ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10089",children:"(#10089)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Fix bug when using tailscale config by file ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10143",children:"(#10143)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Bump flannel version to v0.25.2 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10222",children:"(#10222)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Update kube-router version to v2.1.2 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10183",children:"(#10183)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Improve tailscale test & add extra log in e2e tests ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10214",children:"(#10214)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Backports for 2024-06 release cycle ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10259",children:"(#10259)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:"Add WithSkipMissing to not fail import on missing blobs"}),"\n",(0,r.jsx)(s.li,{children:"Use fixed stream server bind address for cri-dockerd"}),"\n",(0,r.jsx)(s.li,{children:"Switch stargz over to cri registry config_path"}),"\n",(0,r.jsx)(s.li,{children:"Bump to containerd v1.7.17, etcd v3.5.13"}),"\n",(0,r.jsx)(s.li,{children:"Bump spegel version"}),"\n",(0,r.jsx)(s.li,{children:"Fix issue with externalTrafficPolicy: Local for single-stack services on dual-stack nodes"}),"\n",(0,r.jsxs)(s.li,{children:["ServiceLB now sets the priorityClassName on svclb pods to ",(0,r.jsx)(s.code,{children:"system-node-critical"})," by default. This can be overridden on a per-service basis via the ",(0,r.jsx)(s.code,{children:"svccontroller.k3s.cattle.io/priorityclassname"})," annotation."]}),"\n",(0,r.jsx)(s.li,{children:"Bump minio-go to v7.0.70"}),"\n",(0,r.jsx)(s.li,{children:"Bump kine to v0.11.9 to fix pagination"}),"\n",(0,r.jsx)(s.li,{children:"Update valid resolv conf"}),"\n",(0,r.jsx)(s.li,{children:"Add missing kernel config check"}),"\n",(0,r.jsx)(s.li,{children:"Symlinked sub-directories are now respected when scanning Auto-Deploying Manifests (AddOns)"}),"\n",(0,r.jsx)(s.li,{children:"Fix bug: allow helm controller set owner reference"}),"\n",(0,r.jsx)(s.li,{children:"Bump klipper-helm image for tls secret support"}),"\n",(0,r.jsx)(s.li,{children:"Fix issue with k3s-etcd informers not starting"}),"\n",(0,r.jsxs)(s.li,{children:[(0,r.jsx)(s.code,{children:"--Enable-pprof"})," can now be set on agents to enable the debug/pprof endpoints. When set, agents will listen on the supervisor port."]}),"\n",(0,r.jsxs)(s.li,{children:[(0,r.jsx)(s.code,{children:"--Supervisor-metrics"})," can now be set on servers to enable serving internal metrics on the supervisor endpoint; when set agents will listen on the supervisor port."]}),"\n",(0,r.jsx)(s.li,{children:"Fix netpol crash when node remains tainted uninitialized"}),"\n",(0,r.jsx)(s.li,{children:"The embedded load-balancer will now fall back to trying all servers with health-checks ignored, if all servers have been marked unavailable due to failed health checks."}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["More backports for 2024-06 release cycle ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10290",children:"(#10290)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Add snapshot retention etcd-s3-folder fix ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10314",children:"(#10314)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Add test for ",(0,r.jsx)(s.code,{children:"isValidResolvConf"})," (#10302) ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10332",children:"(#10332)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Fix race condition panic in loadbalancer.nextServer ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10324",children:"(#10324)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Fix typo, use ",(0,r.jsx)(s.code,{children:"rancher/permissions"})," ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10297",children:"(#10297)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Update Kubernetes to v1.27.15 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10346",children:"(#10346)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:"Update Kubernetes to v1.27.15"}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Fix agent supervisor port using apiserver port instead ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10356",children:"(#10356)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Fix issue that allowed multiple simultaneous snapshots to be allowed ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10378",children:"(#10378)"})]}),"\n"]}),"\n",(0,r.jsx)(s.hr,{}),"\n",(0,r.jsxs)(s.h2,{id:"release-v12714k3s1",children:["Release ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/releases/tag/v1.27.14+k3s1",children:"v1.27.14+k3s1"})]}),"\n",(0,r.jsx)(s.p,{children:"This release updates Kubernetes to v1.27.14, and fixes a number of issues."}),"\n",(0,r.jsxs)(s.p,{children:["For more details on what's new, see the ",(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.27.md#changelog-since-v12713",children:"Kubernetes release notes"}),"."]}),"\n",(0,r.jsx)(s.h3,{id:"changes-since-v12713k3s1",children:"Changes since v1.27.13+k3s1:"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsxs)(s.li,{children:["Bump E2E opensuse leap to 15.6, fix btrfs test ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10096",children:"(#10096)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Windows changes ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10113",children:"(#10113)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Update to v1.27.14-k3s1 and Go 1.21.9 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10103",children:"(#10103)"})]}),"\n"]}),"\n",(0,r.jsx)(s.hr,{}),"\n",(0,r.jsxs)(s.h2,{id:"release-v12713k3s1",children:["Release ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/releases/tag/v1.27.13+k3s1",children:"v1.27.13+k3s1"})]}),"\n",(0,r.jsx)(s.p,{children:"This release updates Kubernetes to v1.27.13, and fixes a number of issues."}),"\n",(0,r.jsxs)(s.p,{children:["For more details on what's new, see the ",(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.27.md#changelog-since-v12712",children:"Kubernetes release notes"}),"."]}),"\n",(0,r.jsx)(s.h3,{id:"changes-since-v12712k3s1",children:"Changes since v1.27.12+k3s1:"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsxs)(s.li,{children:["Add a new error when kine is with disable apiserver or disable etcd ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9803",children:"(#9803)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Remove old pinned dependencies ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9828",children:"(#9828)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Transition from deprecated pointer library to ptr ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9825",children:"(#9825)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Golang caching and E2E ubuntu 23.10 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9822",children:"(#9822)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Add tls for kine ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9850",children:"(#9850)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Bump spegel to v0.0.20-k3s1 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9881",children:"(#9881)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Backports for 2024-04 release cycle ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9912",children:"(#9912)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:"Send error response if member list cannot be retrieved"}),"\n",(0,r.jsx)(s.li,{children:"The k3s stub cloud provider now respects the kubelet's requested provider-id, instance type, and topology labels"}),"\n",(0,r.jsx)(s.li,{children:"Fix error when image has already been pulled"}),"\n",(0,r.jsx)(s.li,{children:"Add /etc/passwd and /etc/group to k3s docker image"}),"\n",(0,r.jsx)(s.li,{children:"Fix etcd snapshot reconcile for agentless servers"}),"\n",(0,r.jsx)(s.li,{children:"Add health-check support to loadbalancer"}),"\n",(0,r.jsx)(s.li,{children:"Add certificate expiry check, events, and metrics"}),"\n",(0,r.jsx)(s.li,{children:"Add workaround for containerd hosts.toml bug when passing config for default registry endpoint"}),"\n",(0,r.jsx)(s.li,{children:"Add supervisor cert/key to rotate list"}),"\n",(0,r.jsx)(s.li,{children:"The embedded containerd has been bumped to v1.7.15"}),"\n",(0,r.jsx)(s.li,{children:"The embedded cri-dockerd has been bumped to v0.3.12"}),"\n",(0,r.jsxs)(s.li,{children:["The ",(0,r.jsx)(s.code,{children:"k3s etcd-snapshot"})," command has been reworked for improved consistency. All snapshots operations are now performed by the server process, with the CLI acting as a client to initiate and report results. As a side effect, the CLI is now less noisy when managing snapshots."]}),"\n",(0,r.jsx)(s.li,{children:"Improve etcd load-balancer startup behavior"}),"\n",(0,r.jsx)(s.li,{children:"Actually fix agent certificate rotation"}),"\n",(0,r.jsx)(s.li,{children:"Traefik has been bumped to v2.10.7."}),"\n",(0,r.jsx)(s.li,{children:"Traefik pod annotations are now set properly in the default chart values."}),"\n",(0,r.jsx)(s.li,{children:"The system-default-registry value now supports RFC2732 IPv6 literals."}),"\n",(0,r.jsxs)(s.li,{children:["The local-path provisioner now defaults to creating ",(0,r.jsx)(s.code,{children:"local"})," volumes, instead of ",(0,r.jsx)(s.code,{children:"hostPath"}),"."]}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Allow LPP to read helper logs ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9939",children:"(#9939)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Update kube-router to v2.1.0 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9943",children:"(#9943)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Update to v1.27.13-k3s1 and Go 1.21.9 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9958",children:"(#9958)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Fix on-demand snapshots timing out; not honoring folder ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9995",children:"(#9995)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Make /db/info available anonymously from localhost ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10003",children:"(#10003)"})]}),"\n"]}),"\n",(0,r.jsx)(s.hr,{}),"\n",(0,r.jsxs)(s.h2,{id:"release-v12712k3s1",children:["Release ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/releases/tag/v1.27.12+k3s1",children:"v1.27.12+k3s1"})]}),"\n",(0,r.jsx)(s.p,{children:"This release updates Kubernetes to v1.27.12, and fixes a number of issues."}),"\n",(0,r.jsxs)(s.p,{children:["For more details on what's new, see the ",(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.27.md#changelog-since-v12711",children:"Kubernetes release notes"}),"."]}),"\n",(0,r.jsx)(s.h3,{id:"changes-since-v12711k3s1",children:"Changes since v1.27.11+k3s1:"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsxs)(s.li,{children:["Add an integration test for flannel-backend=none ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9609",children:"(#9609)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Install and Unit test backports ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9642",children:"(#9642)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Update klipper-lb image version ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9606",children:"(#9606)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Adjust first node-ip based on configured clusterCIDR ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9632",children:"(#9632)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Improve tailscale e2e test ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9654",children:"(#9654)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Backports for 2024-03 release cycle ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9670",children:"(#9670)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:"Fix: use correct wasm shims names"}),"\n",(0,r.jsx)(s.li,{children:"The embedded flannel cni-plugin binary is now built and versioned separate from the rest of the cni plugins and the embedded flannel controller."}),"\n",(0,r.jsx)(s.li,{children:"Bump spegel to v0.0.18-k3s3"}),"\n",(0,r.jsx)(s.li,{children:"Adds wildcard registry support"}),"\n",(0,r.jsx)(s.li,{children:"Fixes issue with excessive CPU utilization while waiting for containerd to start"}),"\n",(0,r.jsx)(s.li,{children:"Add env var to allow spegel mirroring of latest tag"}),"\n",(0,r.jsx)(s.li,{children:"Tweak netpol node wait logs"}),"\n",(0,r.jsx)(s.li,{children:"Fix coredns NodeHosts on dual-stack clusters"}),"\n",(0,r.jsx)(s.li,{children:"Bump helm-controller/klipper-helm versions"}),"\n",(0,r.jsx)(s.li,{children:"Fix snapshot prune"}),"\n",(0,r.jsx)(s.li,{children:"Fix issue with etcd node name missing hostname"}),"\n",(0,r.jsx)(s.li,{children:"Rootless mode should also bind service nodePort to host for LoadBalancer type, matching UX of rootful mode."}),"\n",(0,r.jsxs)(s.li,{children:["To enable raw output for the ",(0,r.jsx)(s.code,{children:"check-config"})," subcommand, you may now set NO_COLOR=1"]}),"\n",(0,r.jsx)(s.li,{children:"Fix additional corner cases in registries handling"}),"\n",(0,r.jsx)(s.li,{children:"Bump metrics-server to v0.7.0"}),"\n",(0,r.jsx)(s.li,{children:"K3s will now warn and suppress duplicate entries in the mirror endpoint list for a registry. Containerd does not support listing the same endpoint multiple times as a mirror for a single upstream registry."}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Docker and E2E Test Backports ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9708",children:"(#9708)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Fix wildcard entry upstream fallback ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9734",children:"(#9734)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Update to v1.27.12-k3s1 and Go 1.21.8 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9745",children:"(#9745)"})]}),"\n"]}),"\n",(0,r.jsx)(s.hr,{}),"\n",(0,r.jsxs)(s.h2,{id:"release-v12711k3s1",children:["Release ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/releases/tag/v1.27.11+k3s1",children:"v1.27.11+k3s1"})]}),"\n",(0,r.jsx)(s.p,{children:"This release updates Kubernetes to v1.27.11, and fixes a number of issues."}),"\n",(0,r.jsxs)(s.p,{children:["For more details on what's new, see the ",(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.27.md#changelog-since-v12710",children:"Kubernetes release notes"}),"."]}),"\n",(0,r.jsx)(s.h3,{id:"changes-since-v12710k3s2",children:"Changes since v1.27.10+k3s2:"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsxs)(s.li,{children:["Chore: bump Local Path Provisioner version ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9427",children:"(#9427)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Bump cri-dockerd to fix compat with Docker Engine 25 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9291",children:"(#9291)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Auto Dependency Bump ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9420",children:"(#9420)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Runtimes refactor using exec.LookPath ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9430",children:"(#9430)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:"Directories containing runtimes need to be included in the $PATH environment variable for effective runtime detection."}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Changed how lastHeartBeatTime works in the etcd condition ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9425",children:"(#9425)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Allow executors to define containerd and docker behavior ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9253",children:"(#9253)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Update Kube-router to v2.0.1 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9405",children:"(#9405)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Backports for 2024-02 release cycle ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9463",children:"(#9463)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Bump flannel version + remove multiclustercidr ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9407",children:"(#9407)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Enable longer http timeout requests ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9445",children:"(#9445)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Test_UnitApplyContainerdQoSClassConfigFileIfPresent ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9441",children:"(#9441)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Support PR testing installs ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9470",children:"(#9470)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Update Kubernetes to v1.27.11 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9491",children:"(#9491)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Fix drone publish for arm ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9509",children:"(#9509)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Remove failing Drone step ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9515",children:"(#9515)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Restore original order of agent startup functions ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9546",children:"(#9546)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Fix netpol startup when flannel is disabled ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9579",children:"(#9579)"})]}),"\n"]}),"\n",(0,r.jsx)(s.hr,{}),"\n",(0,r.jsxs)(s.h2,{id:"release-v12710k3s2",children:["Release ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/releases/tag/v1.27.10+k3s2",children:"v1.27.10+k3s2"})]}),"\n",(0,r.jsx)(s.p,{children:"This release updates Kubernetes to v1.27.10, and fixes a number of issues."}),"\n",(0,r.jsxs)(s.p,{children:["For more details on what's new, see the ",(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.27.md#changelog-since-v1279",children:"Kubernetes release notes"}),"."]}),"\n",(0,r.jsx)(s.p,{children:(0,r.jsx)(s.strong,{children:"Important Notes"})}),"\n",(0,r.jsxs)(s.p,{children:["Addresses the runc CVE: ",(0,r.jsx)(s.a,{href:"https://nvd.nist.gov/vuln/detail/CVE-2024-21626",children:"CVE-2024-21626"})," by updating runc to v1.1.12."]}),"\n",(0,r.jsx)(s.h3,{id:"changes-since-v1279k3s1",children:"Changes since v1.27.9+k3s1:"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsxs)(s.li,{children:["Add a retry around updating a secrets-encrypt node annotations ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9124",children:"(#9124)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Added support for env *_PROXY variables for agent loadbalancer ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9117",children:"(#9117)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Wait for taint to be gone in the node before starting the netpol controller ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9176",children:"(#9176)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Etcd condition ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9182",children:"(#9182)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Backports for 2024-01 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9211",children:"(#9211)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Move proxy dialer out of init() and fix crash ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9220",children:"(#9220)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Pin opa version for missing dependency chain ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9217",children:"(#9217)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Etcd node is nil ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9229",children:"(#9229)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Update to v1.27.10 and Go 1.20.13 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9261",children:"(#9261)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Use ",(0,r.jsx)(s.code,{children:"ipFamilyPolicy: RequireDualStack"})," for dual-stack kube-dns ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9270",children:"(#9270)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Backports for 2024-01 k3s2 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9337",children:"(#9337)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:"Bump runc to v1.1.12 and helm-controller to v0.15.7"}),"\n",(0,r.jsx)(s.li,{children:"Fix handling of bare hostname or IP as endpoint address in registries.yaml"}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Bump helm-controller to fix issue with ChartContent ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9347",children:"(#9347)"})]}),"\n"]}),"\n",(0,r.jsx)(s.hr,{}),"\n",(0,r.jsxs)(s.h2,{id:"release-v1279k3s1",children:["Release ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/releases/tag/v1.27.9+k3s1",children:"v1.27.9+k3s1"})]}),"\n",(0,r.jsx)(s.p,{children:"This release updates Kubernetes to v1.27.9, and fixes a number of issues."}),"\n",(0,r.jsxs)(s.p,{children:["For more details on what's new, see the ",(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.27.md#changelog-since-v1278",children:"Kubernetes release notes"}),"."]}),"\n",(0,r.jsx)(s.h3,{id:"changes-since-v1278k3s2",children:"Changes since v1.27.8+k3s2:"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsxs)(s.li,{children:["Bump containerd/runc to v1.7.10-k3s1/v1.1.10 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8963",children:"(#8963)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Fix overlapping address range ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9018",children:"(#9018)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Runtimes backport ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9013",children:"(#9013)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:"Added runtime classes for wasm/nvidia/crun"}),"\n",(0,r.jsx)(s.li,{children:"Added default runtime flag for containerd"}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Bump containerd to v1.7.11 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9041",children:"(#9041)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Update to v1.27.9-k3s1 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9078",children:"(#9078)"})]}),"\n"]}),"\n",(0,r.jsx)(s.hr,{}),"\n",(0,r.jsxs)(s.h2,{id:"release-v1278k3s2",children:["Release ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/releases/tag/v1.27.8+k3s2",children:"v1.27.8+k3s2"})]}),"\n",(0,r.jsx)(s.p,{children:"This release updates Kubernetes to v1.27.8, and fixes a number of issues."}),"\n",(0,r.jsxs)(s.p,{children:["For more details on what's new, see the ",(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.27.md#changelog-since-v1277",children:"Kubernetes release notes"}),"."]}),"\n",(0,r.jsx)(s.h3,{id:"changes-since-v1277k3s2",children:"Changes since v1.27.7+k3s2:"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsxs)(s.li,{children:["Etcd status condition ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8821",children:"(#8821)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Add warning for removal of multiclustercidr flag ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8759",children:"(#8759)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Backports for 2023-11 release ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8878",children:"(#8878)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsxs)(s.li,{children:["New timezone info in Docker image allows the use of ",(0,r.jsx)(s.code,{children:"spec.timeZone"})," in CronJobs"]}),"\n",(0,r.jsx)(s.li,{children:"Bumped kine to v0.11.0 to resolve issues with postgres and NATS, fix performance of watch channels under heavy load, and improve compatibility with the reference implementation."}),"\n",(0,r.jsxs)(s.li,{children:["Containerd may now be configured to use rdt or blockio configuration by defining ",(0,r.jsx)(s.code,{children:"rdt_config.yaml"})," or ",(0,r.jsx)(s.code,{children:"blockio_config.yaml"})," files."]}),"\n",(0,r.jsx)(s.li,{children:"Add agent flag disable-apiserver-lb, agent will not start load balance proxy."}),"\n",(0,r.jsx)(s.li,{children:"Improved ingress IP ordering from ServiceLB"}),"\n",(0,r.jsx)(s.li,{children:"Disable helm CRD installation for disable-helm-controller"}),"\n",(0,r.jsx)(s.li,{children:"Omit snapshot list configmap entries for snapshots without extra metadata"}),"\n",(0,r.jsx)(s.li,{children:"Add jitter to client config retry to avoid hammering servers when they are starting up"}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Handle nil pointer when runtime core is not ready in etcd ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8887",children:"(#8887)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Improve dualStack log ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8828",children:"(#8828)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Bump dynamiclistener; reduce snapshot controller log spew ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8902",children:"(#8902)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:"Bumped dynamiclistener to address a race condition that could cause a server to fail to sync its certificates into the Kubernetes secret"}),"\n",(0,r.jsx)(s.li,{children:"Reduced etcd snapshot log spam during initial cluster startup"}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Remove depends_on for e2e step; fix cert rotate e2e ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8907",children:"(#8907)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Fix etcd snapshot S3 issues ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8937",children:"(#8937)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:"Don't apply S3 retention if S3 client failed to initialize"}),"\n",(0,r.jsx)(s.li,{children:"Don't request metadata when listing S3 snapshots"}),"\n",(0,r.jsx)(s.li,{children:"Print key instead of file path in snapshot metadata log message"}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Update to v1.27.8 and Go to 1.20.11 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8921",children:"(#8921)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Remove s390x ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8999",children:"(#8999)"})]}),"\n"]}),"\n",(0,r.jsx)(s.hr,{}),"\n",(0,r.jsxs)(s.h2,{id:"release-v1277k3s2",children:["Release ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/releases/tag/v1.27.7+k3s2",children:"v1.27.7+k3s2"})]}),"\n",(0,r.jsx)(s.p,{children:"This release updates Kubernetes to v1.27.7, and fixes a number of issues."}),"\n",(0,r.jsxs)(s.p,{children:["For more details on what's new, see the ",(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.27.md#changelog-since-v1277",children:"Kubernetes release notes"}),"."]}),"\n",(0,r.jsx)(s.h3,{id:"changes-since-v1277k3s1",children:"Changes since v1.27.7+k3s1:"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsxs)(s.li,{children:["Fix SystemdCgroup in templates_linux.go ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8765",children:"(#8765)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:"Fixed an issue with identifying additional container runtimes"}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Update traefik chart to v25.0.0 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8775",children:"(#8775)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Update traefik to fix registry value ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8789",children:"(#8789)"})]}),"\n"]}),"\n",(0,r.jsx)(s.hr,{}),"\n",(0,r.jsxs)(s.h2,{id:"release-v1277k3s1",children:["Release ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/releases/tag/v1.27.7+k3s1",children:"v1.27.7+k3s1"})]}),"\n",(0,r.jsx)(s.p,{children:"This release updates Kubernetes to v1.27.7, and fixes a number of issues."}),"\n",(0,r.jsxs)(s.p,{children:["For more details on what's new, see the ",(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.27.md#changelog-since-v1276",children:"Kubernetes release notes"}),"."]}),"\n",(0,r.jsx)(s.h3,{id:"changes-since-v1276k3s1",children:"Changes since v1.27.6+k3s1:"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsxs)(s.li,{children:["Fix error reporting ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8411",children:"(#8411)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Add context to flannel errors ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8419",children:"(#8419)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Include the interface name in the error message ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8435",children:"(#8435)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Update kube-router ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8443",children:"(#8443)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Add extraArgs to tailscale ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8464",children:"(#8464)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Added error when cluster reset while using server flag ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8455",children:"(#8455)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:"The user will receive a error when --cluster-reset with the --server flag"}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Cluster reset from non bootstrap nodes ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8451",children:"(#8451)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Take IPFamily precedence based on order ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8504",children:"(#8504)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Fix spellcheck problem ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8509",children:"(#8509)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Network defaults are duplicated, remove one ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8551",children:"(#8551)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Advertise address integration test ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8516",children:"(#8516)"})]}),"\n",(0,r.jsxs)(s.li,{children:["System agent push tags fix ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8569",children:"(#8569)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Fixed tailscale node IP dualstack mode in case of IPv4 only node ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8558",children:"(#8558)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Server Token Rotation ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8576",children:"(#8576)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsxs)(s.li,{children:["Users can now rotate the server token using ",(0,r.jsx)(s.code,{children:"k3s token rotate -t --new-token "}),". After command succeeds, all server nodes must be restarted with the new token."]}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["E2E Domain Drone Cleanup ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8582",children:"(#8582)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Clear remove annotations on cluster reset ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8587",children:"(#8587)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:"Fixed an issue that could cause k3s to attempt to remove members from the etcd cluster immediately following a cluster-reset/restore, if they were queued for removal at the time the snapshot was taken."}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Use IPv6 in case is the first configured IP with dualstack ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8597",children:"(#8597)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Backports for 2023-10 release ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8615",children:"(#8615)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Update kube-router package in build script ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8634",children:"(#8634)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Add etcd-only/control-plane-only server test and fix control-plane-only server crash ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8642",children:"(#8642)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Use ",(0,r.jsx)(s.code,{children:"version.Program"})," not K3s in token rotate logs ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8656",children:"(#8656)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Windows agent support ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8650",children:"(#8650)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Fix CloudDualStackNodeIPs feature-gate inconsistency ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8669",children:"(#8669)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Add --image-service-endpoint flag (#8279) ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8662",children:"(#8662)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsxs)(s.li,{children:["Add ",(0,r.jsx)(s.code,{children:"--image-service-endpoint"})," flag to specify an external image service socket."]}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Backport etcd fixes ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8690",children:"(#8690)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:"Re-enable etcd endpoint auto-sync"}),"\n",(0,r.jsx)(s.li,{children:"Manually requeue configmap reconcile when no nodes have reconciled snapshots"}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Update to v1.27.7 and Go to v1.20.10 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8681",children:"(#8681)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Fix s3 snapshot restore ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8733",children:"(#8733)"})]}),"\n"]}),"\n",(0,r.jsx)(s.hr,{}),"\n",(0,r.jsxs)(s.h2,{id:"release-v1276k3s1",children:["Release ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/releases/tag/v1.27.6+k3s1",children:"v1.27.6+k3s1"})]}),"\n",(0,r.jsx)(s.p,{children:"This release updates Kubernetes to v1.27.6, and fixes a number of issues."}),"\n",(0,r.jsxs)(s.p,{children:["For more details on what's new, see the ",(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.27.md#changelog-since-v1275",children:"Kubernetes release notes"}),"."]}),"\n",(0,r.jsx)(s.h3,{id:"changes-since-v1275k3s1",children:"Changes since v1.27.5+k3s1:"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsxs)(s.li,{children:["Bump kine to v0.10.3 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8324",children:"(#8324)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Update to v1.27.6 and Go to 1.20.8 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8356",children:"(#8356)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:"Bump embedded containerd to v1.7.6"}),"\n",(0,r.jsx)(s.li,{children:"Bump embedded stargz-snapshotter plugin to latest"}),"\n",(0,r.jsx)(s.li,{children:"Fixed intermittent drone CI failures due to race conditions in test environment setup scripts"}),"\n",(0,r.jsx)(s.li,{children:"Fixed CI failures due to changes to api discovery changes in Kubernetes 1.28"}),"\n"]}),"\n"]}),"\n"]}),"\n",(0,r.jsx)(s.hr,{}),"\n",(0,r.jsxs)(s.h2,{id:"release-v1275k3s1",children:["Release ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/releases/tag/v1.27.5+k3s1",children:"v1.27.5+k3s1"})]}),"\n",(0,r.jsx)(s.p,{children:"This release updates Kubernetes to v1.27.5, and fixes a number of issues."}),"\n",(0,r.jsx)(s.admonition,{title:"Important",type:"warning",children:(0,r.jsxs)(s.p,{children:["This release includes support for remediating CVE-2023-32187, a potential Denial of Service attack vector on K3s servers. See ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/security/advisories/GHSA-m4hf-6vgr-75r2",children:"https://github.com/k3s-io/k3s/security/advisories/GHSA-m4hf-6vgr-75r2"})," for more information, including mandatory steps necessary to harden clusters against this vulnerability."]})}),"\n",(0,r.jsxs)(s.p,{children:["For more details on what's new, see the ",(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.27.md#changelog-since-v1274",children:"Kubernetes release notes"}),"."]}),"\n",(0,r.jsx)(s.h3,{id:"changes-since-v1274k3s1",children:"Changes since v1.27.4+k3s1:"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsxs)(s.li,{children:["Update cni plugins version to v1.3.0 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8056",children:"(#8056)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:"Upgraded cni-plugins to v1.3.0"}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Update flannel to v0.22.1 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8057",children:"(#8057)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:"Update flannel to v0.22.1"}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["ADR on secrets encryption v3 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7938",children:"(#7938)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Unit test for MustFindString ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8013",children:"(#8013)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Add support for using base template in etc/containerd/config.toml.tmpl ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7991",children:"(#7991)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsxs)(s.li,{children:["User-provided containerd config templates may now use ",(0,r.jsx)(s.code,{children:'{{ template "base" . }}'})," to include the default K3s template content. This makes it easier to maintain user configuration if the only need is to add additional sections to the file."]}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Make apiserver egress args conditional on egress-selector-mode ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7972",children:"(#7972)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsxs)(s.li,{children:["K3s no longer enables the apiserver's ",(0,r.jsx)(s.code,{children:"enable-aggregator-routing"})," flag when the egress proxy is not being used to route connections to in-cluster endpoints."]}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Security bump to ",(0,r.jsx)(s.code,{children:"docker/distribution"})," ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8047",children:"(#8047)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Fix coreos multiple installs ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8083",children:"(#8083)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Update stable channel to v1.27.4+k3s1 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8067",children:"(#8067)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Fix tailscale bug with ip modes ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8077",children:"(#8077)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Consolidate CopyFile functions ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8079",children:"(#8079)"})]}),"\n",(0,r.jsxs)(s.li,{children:["E2E: Support GOCOVER for more tests + fixes ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8080",children:"(#8080)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Fix typo in terraform/README.md ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8090",children:"(#8090)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Add FilterCN function to prevent SAN Stuffing ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8085",children:"(#8085)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:"K3s's external apiserver listener now declines to add to its certificate any subject names not associated with the kubernetes apiserver service, server nodes, or values of the --tls-san option. This prevents the certificate's SAN list from being filled with unwanted entries."}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Bump docker/docker to master commit; cri-dockerd to 0.3.4 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8092",children:"(#8092)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:"Bump docker/docker module version to fix issues with cri-dockerd caused by recent releases of golang rejecting invalid host headers sent by the docker client."}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Bump versions for etcd, containerd, runc ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8109",children:"(#8109)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:"Updated the embedded containerd to v1.7.3+k3s1"}),"\n",(0,r.jsx)(s.li,{children:"Updated the embedded runc to v1.1.8"}),"\n",(0,r.jsx)(s.li,{children:"Updated the embedded etcd to v3.5.9+k3s1"}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Etcd snapshots retention when node name changes ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8099",children:"(#8099)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Bump kine to v0.10.2 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8125",children:"(#8125)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:"Updated kine to v0.10.2"}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Remove terraform package ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8136",children:"(#8136)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Fix etcd-snapshot delete when etcd-s3 is true ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8110",children:"(#8110)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Add --disable-cloud-controller and --disable-kube-proxy test ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8018",children:"(#8018)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Use ",(0,r.jsx)(s.code,{children:"go list -m"})," instead of grep to look up versions ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8138",children:"(#8138)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Use VERSION_K8S in tests instead of grep go.mod ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8147",children:"(#8147)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Fix for Kubeflag Integration test ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8154",children:"(#8154)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Fix for cluster-reset backup from s3 when etcd snapshots are disabled ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8155",children:"(#8155)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Run integration test CI in parallel ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8156",children:"(#8156)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Bump Trivy version ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8150",children:"(#8150)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Bump Trivy version ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8178",children:"(#8178)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Fixed the etcd retention to delete orphaned snapshots based on the date ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8177",children:"(#8177)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Bump dynamiclistener ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8193",children:"(#8193)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:"Bumped dynamiclistener to address an issue that could cause the apiserver/supervisor listener on 6443 to stop serving requests on etcd-only nodes."}),"\n",(0,r.jsx)(s.li,{children:"The K3s external apiserver/supervisor listener on 6443 now sends a complete certificate chain in the TLS handshake."}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Bump helm-controller/klipper-helm versions ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8204",children:"(#8204)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsxs)(s.li,{children:["The version of ",(0,r.jsx)(s.code,{children:"helm"})," used by the bundled helm controller's job image has been updated to v3.12.3"]}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["E2E: Add test for ",(0,r.jsx)(s.code,{children:"k3s token"})," ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8184",children:"(#8184)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Move flannel to 0.22.2 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8219",children:"(#8219)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:"Move flannel to v0.22.2"}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Update to v1.27.5 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8236",children:"(#8236)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Add new CLI flag to enable TLS SAN CN filtering ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8257",children:"(#8257)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsxs)(s.li,{children:["Added a new ",(0,r.jsx)(s.code,{children:"--tls-san-security"})," option. This flag defaults to false, but can be set to true to disable automatically adding SANs to the server's TLS certificate to satisfy any hostname requested by a client."]}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Add RWMutex to address controller ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8273",children:"(#8273)"})]}),"\n"]}),"\n",(0,r.jsx)(s.hr,{}),"\n",(0,r.jsxs)(s.h2,{id:"release-v1274k3s1",children:["Release ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/releases/tag/v1.27.4+k3s1",children:"v1.27.4+k3s1"})]}),"\n",(0,r.jsxs)(s.p,{children:["This release updates Kubernetes to v1.27.4, and fixes a number of issues.",(0,r.jsx)(s.br,{}),"\n","\u200b\r\nFor more details on what's new, see the ",(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.27.md#changelog-since-v1273",children:"Kubernetes release notes"}),".\r\n\u200b"]}),"\n",(0,r.jsx)(s.h3,{id:"changes-since-v1273k3s1",children:"Changes since v1.27.3+k3s1:"}),"\n",(0,r.jsx)(s.p,{children:"\u200b"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsxs)(s.li,{children:["Pkg imported more than once ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7803",children:"(#7803)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Faster K3s Binary Build Option ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7805",children:"(#7805)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Update stable channel to v1.27.3+k3s1 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7827",children:"(#7827)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Adding cli to custom klipper helm image ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7682",children:"(#7682)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:"The default helm-controller job image can now be overridden with the --helm-job-image CLI flag"}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Check if we are on ipv4, ipv6 or dualStack when doing tailscale ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7838",children:"(#7838)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Remove file_windows.go ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7845",children:"(#7845)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Add a k3s data directory location specified by the cli ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7791",children:"(#7791)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Fix e2e startup flaky test ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7839",children:"(#7839)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Allow k3s to customize apiServerPort on helm-controller ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7834",children:"(#7834)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Fall back to basic/bearer auth when node identity auth is rejected ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7836",children:"(#7836)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:"Resolved an issue that caused agents joined with kubeadm-style bootstrap tokens to fail to rejoin the cluster when their node object is deleted."}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Fix code spell check ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7858",children:"(#7858)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Add e2e s3 test ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7833",children:"(#7833)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Warn that v1.28 will deprecate reencrypt/prepare ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7848",children:"(#7848)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Support setting control server URL for Tailscale ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7807",children:"(#7807)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:"Support connecting tailscale to a separate server (e.g. headscale)"}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Improve for K3s release Docs ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7864",children:"(#7864)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Fix rootless node password location ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7887",children:"(#7887)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Bump google.golang.org/grpc from 1.51.0 to 1.53.0 in /tests/terraform ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7879",children:"(#7879)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Add retry for clone step ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7862",children:"(#7862)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Generation of certificates and keys for etcd gated if etcd is disabled. ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6998",children:"(#6998)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Don't use zgrep in ",(0,r.jsx)(s.code,{children:"check-config"})," if apparmor profile is enforced ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7939",children:"(#7939)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Fix image_scan.sh script and download trivy version ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7950",children:"(#7950)"})]}),"\n",(0,r.jsxs)(s.li,{children:['Revert "Warn that v1.28 will deprecate reencrypt/prepare" ',(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7977",children:"(#7977)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Adjust default kubeconfig file permissions ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7978",children:"(#7978)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Fix update go version command on release documentation ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8028",children:"(#8028)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Update to v1.27.4 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8014",children:"(#8014)"}),"\r\n\u200b"]}),"\n"]}),"\n",(0,r.jsx)(s.hr,{}),"\n",(0,r.jsxs)(s.h2,{id:"release-v1273k3s1",children:["Release ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/releases/tag/v1.27.3+k3s1",children:"v1.27.3+k3s1"})]}),"\n",(0,r.jsx)(s.p,{children:"This release updates Kubernetes to v1.27.3, and fixes a number of issues."}),"\n",(0,r.jsxs)(s.p,{children:["For more details on what's new, see the ",(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.27.md#changelog-since-v1272",children:"Kubernetes release notes"}),"."]}),"\n",(0,r.jsx)(s.h3,{id:"changes-since-v1272k3s1",children:"Changes since v1.27.2+k3s1:"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsxs)(s.li,{children:["Update flannel version ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7628",children:"(#7628)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:"Update flannel to v0.22.0"}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Add el9 selinux rpm ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7635",children:"(#7635)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Update channels ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7634",children:"(#7634)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Allow coredns override extensions ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7583",children:"(#7583)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsxs)(s.li,{children:["The ",(0,r.jsx)(s.code,{children:"coredns-custom"})," ConfigMap now allows for ",(0,r.jsx)(s.code,{children:"*.override"})," sections to be included in the ",(0,r.jsx)(s.code,{children:".:53"})," default server block."]}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Bump klipper-lb to v0.4.4 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7617",children:"(#7617)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:"Bumped klipper-lb image to v0.4.4 to resolve an issue that prevented access to ServiceLB ports from localhost when the Service ExternalTrafficPolicy was set to Local."}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Bump metrics-server to v0.6.3 and update tls-cipher-suites ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7564",children:"(#7564)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:"The bundled metrics-server has been bumped to v0.6.3, and now uses only secure TLS ciphers by default."}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Do not use the admin kubeconfig for the supervisor and core controllers ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7616",children:"(#7616)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:"The K3s core controllers (supervisor, deploy, and helm) no longer use the admin kubeconfig. This makes it easier to determine from access and audit logs which actions are performed by the system, and which are performed by an administrative user."}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Bump golang",":alpine"," image version ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7619",children:"(#7619)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Make LB image configurable when compiling k3s ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7626",children:"(#7626)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Bump vagrant libvirt with fix for plugin installs ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7605",children:"(#7605)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Add format command on Makefile ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7437",children:"(#7437)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Use el8 rpm for fedora 38 and 39 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7664",children:"(#7664)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Check variant before version to decide rpm target and packager closes #7666 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7667",children:"(#7667)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Test Coverage Reports for E2E tests ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7526",children:"(#7526)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Soft-fail on node password verification if the secret cannot be created ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7655",children:"(#7655)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:"K3s now allows nodes to join the cluster even if the node password secret cannot be created at the time the node joins. The secret create will be retried in the background. This resolves a potential deadlock created by fail-closed validating webhooks that block secret creation, where the webhook is unavailable until new nodes join the cluster to run the webhook pod."}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Enable containerd aufs/devmapper/zfs snapshotter plugins ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7661",children:"(#7661)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:"The bundled containerd's aufs/devmapper/zfs snapshotter plugins have been restored. These were unintentionally omitted when moving containerd back into the k3s multicall binary in the previous release."}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Bump docker go.mod ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7681",children:"(#7681)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Shortcircuit commands with version or help flags ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7683",children:"(#7683)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsxs)(s.li,{children:["Non root users can now call ",(0,r.jsx)(s.code,{children:"k3s --help"})," and ",(0,r.jsx)(s.code,{children:"k3s --version"})," commands without running into permission errors over the default config file."]}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Bump Trivy version ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7672",children:"(#7672)"})]}),"\n",(0,r.jsxs)(s.li,{children:["E2E: Capture coverage of K3s subcommands ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7686",children:"(#7686)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Integrate tailscale into k3s ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7352",children:"(#7352)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:"Integration of tailscale VPN into k3s"}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Add private registry e2e test ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7653",children:"(#7653)"})]}),"\n",(0,r.jsxs)(s.li,{children:["E2E: Remove unnecessary daemonset addition/deletion ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7696",children:"(#7696)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Add issue template for OS validation ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7695",children:"(#7695)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Fix spelling check ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7740",children:"(#7740)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Remove useless libvirt config ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7745",children:"(#7745)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Bump helm-controller to v0.15.0 for create-namespace support ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7716",children:"(#7716)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:"The embedded helm controller has been bumped to v0.15.0, and now supports creating the chart's target namespace if it does not exist."}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Fix error logging in tailscale ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7776",children:"(#7776)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Add commands to remove advertised routes of tailscale in k3s-killall.sh ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7777",children:"(#7777)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Update Kubernetes to v1.27.3 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7790",children:"(#7790)"})]}),"\n"]}),"\n",(0,r.jsx)(s.hr,{}),"\n",(0,r.jsxs)(s.h2,{id:"release-v1272k3s1",children:["Release ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/releases/tag/v1.27.2+k3s1",children:"v1.27.2+k3s1"})]}),"\n",(0,r.jsx)(s.p,{children:"This release updates Kubernetes to v1.27.2, and fixes a number of issues."}),"\n",(0,r.jsxs)(s.p,{children:["For more details on what's new, see the ",(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.27.md#changelog-since-v1271",children:"Kubernetes release notes"}),"."]}),"\n",(0,r.jsx)(s.h3,{id:"changes-since-v1271k3s1",children:"Changes since v1.27.1+k3s1:"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsxs)(s.li,{children:["Ensure that klog verbosity is set to the same level as logrus ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7303",children:"(#7303)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Create CRDs with schema ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7308",children:"(#7308)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:"Fixed an issue where Addon, HelmChart, and HelmChartConfig CRDs were created without structural schema, allowing the creation of custom resources of these types with invalid content."}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Bump k3s-root for aarch64 page size fix ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7364",children:"(#7364)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:"K3s once again supports aarch64 nodes with page size > 4k"}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Bump Runc and Containerd ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7339",children:"(#7339)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Add integration tests for etc-snapshot server flags and refactor /tests/integration/integration.go/K3sStartServer ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7300",children:"(#7300)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Bump traefik to v2.9.10 / chart 21.2.0 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7324",children:"(#7324)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:"The packaged Traefik version has been bumped to v2.9.10 / chart 21.2.0"}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Add longhorn storage test ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6445",children:"(#6445)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Improve error message when CLI wrapper Exec fails ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7373",children:"(#7373)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsxs)(s.li,{children:["K3s now prints a more meaningful error when attempting to run from a filesystem mounted ",(0,r.jsx)(s.code,{children:"noexec"}),"."]}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Fix issues with ",(0,r.jsx)(s.code,{children:"--disable-agent"})," and ",(0,r.jsx)(s.code,{children:"--egress-selector-mode=pod|cluster"})," ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7331",children:"(#7331)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:"Servers started with the (experimental) --disable-agent flag no longer attempt to run the tunnel authorizer agent component."}),"\n",(0,r.jsx)(s.li,{children:"Fixed an regression that prevented the pod and cluster egress-selector modes from working properly."}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:['Retry cluster join on "too many learners" error ',(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7351",children:"(#7351)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:'K3s now retries the cluster join operation when receiving a "too many learners" error from etcd. This most frequently occurred when attempting to add multiple servers at the same time.'}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Fix MemberList error handling and incorrect etcd-arg passthrough ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7371",children:"(#7371)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:"K3s now correctly passes through etcd-args to the temporary etcd that is used to extract cluster bootstrap data when restarting managed etcd nodes."}),"\n",(0,r.jsx)(s.li,{children:"K3s now properly handles errors obtaining the current etcd cluster member list when a new server is joining the managed etcd cluster."}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Bump Trivy version ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7383",children:"(#7383)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Handle multiple arguments with StringSlice flags ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7380",children:"(#7380)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Add v1.27 channel ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7387",children:"(#7387)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Enable FindString to search dotD config files ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7323",children:"(#7323)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Migrate netutil methods into /util/net.go ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7422",children:"(#7422)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Local-storage: Fix permission ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7217",children:"(#7217)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Bump cni plugins to v1.2.0-k3s1 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7425",children:"(#7425)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:"The bundled CNI plugins have been upgraded to v1.2.0-k3s1. The bandwidth and firewall plugins are now included in the bundle."}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Add dependabot label and reviewer ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7423",children:"(#7423)"})]}),"\n",(0,r.jsxs)(s.li,{children:["E2E: Startup test cleanup + RunCommand Enhancement ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7388",children:"(#7388)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Fail to validate server tokens that use bootstrap id/secret format ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7389",children:"(#7389)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsxs)(s.li,{children:["K3s now exits with a proper error message when the server token uses a bootstrap token ",(0,r.jsx)(s.code,{children:"id.secret"})," format."]}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Fix token startup test ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7442",children:"(#7442)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Bump kine to v0.10.1 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7414",children:"(#7414)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsxs)(s.li,{children:["The embedded kine version has been bumped to v0.10.1. This replaces the legacy ",(0,r.jsx)(s.code,{children:"lib/pq"})," postgres driver with ",(0,r.jsx)(s.code,{children:"pgx"}),"."]}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Add kube-* server flags integration tests ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7416",children:"(#7416)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Add support for ",(0,r.jsx)(s.code,{children:"-cover"})," + integration test code coverage ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7415",children:"(#7415)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Bump kube-router version to fix a bug when a port name is used ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7454",children:"(#7454)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Consistently use constant-time comparison of password hashes instead of bare password strings ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7455",children:"(#7455)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Bump containerd to v1.7.0 and move back into multicall binary ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7418",children:"(#7418)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsxs)(s.li,{children:["The embedded containerd version has been bumped to ",(0,r.jsx)(s.code,{children:"v1.7.0-k3s1"}),", and has been reintegrated into the main k3s binary for a significant savings in release artifact size."]}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Adding PITS and Getdeck Beiboot as adopters thanks to Schille and Miw\u2026 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7524",children:"(#7524)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Bump helm-controller version for repo auth/ca support ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7525",children:"(#7525)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:"The embedded Helm controller now supports authenticating to chart repositories via credentials stored in a Secret, as well as passing repo CAs via ConfigMap."}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Bump containerd/runc to v1.7.1-k3s1/v1.1.7 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7533",children:"(#7533)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:"The bundled containerd and runc versions have been bumped to v1.7.1-k3s1/v1.1.7"}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Wrap error stating that it is coming from netpol ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7539",children:"(#7539)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Add Rotation certification Check, remove func to restart agents ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7097",children:"(#7097)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Bump alpine from 3.17 to 3.18 in /package ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7550",children:"(#7550)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Bump alpine from 3.17 to 3.18 in /conformance ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7551",children:"(#7551)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Add '-all' flag to apply to inactive systemd units ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7567",children:"(#7567)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Update to v1.27.2-k3s1 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7575",children:"(#7575)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Fix iptables rules clean during upgrade ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7591",children:"(#7591)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Pin emicklei/go-restful to v3.9.0 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7597",children:"(#7597)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Add el9 selinux rpm ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7443",children:"(#7443)"})]}),"\n",(0,r.jsxs)(s.li,{children:['Revert "Add el9 selinux rpm (#7443)" ',(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7608",children:"(#7608)"})]}),"\n"]}),"\n",(0,r.jsx)(s.hr,{}),"\n",(0,r.jsxs)(s.h2,{id:"release-v1271k3s1",children:["Release ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/releases/tag/v1.27.1+k3s1",children:"v1.27.1+k3s1"})]}),"\n",(0,r.jsx)(s.p,{children:"This release is K3S's first in the v1.27 line. This release updates Kubernetes to v1.27.1."}),"\n",(0,r.jsxs)(s.p,{children:["Before upgrading from earlier releases, be sure to read the Kubernetes ",(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.27.md#urgent-upgrade-notes",children:"Urgent Upgrade Notes"}),"."]}),"\n",(0,r.jsx)(s.h3,{id:"changes-since-v1264k3s1",children:"Changes since v1.26.4+k3s1:"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsxs)(s.li,{children:["Kubernetes 1.27.1 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7271",children:"(#7271)"})]}),"\n",(0,r.jsxs)(s.li,{children:["V1.27.1 CLI Deprecation ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7311",children:"(#7311)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsxs)(s.li,{children:[(0,r.jsx)(s.code,{children:"--flannel-backed=wireguard"})," has been completely replaced with ",(0,r.jsx)(s.code,{children:"--flannel-backend=wireguard-native"})]}),"\n",(0,r.jsxs)(s.li,{children:["The ",(0,r.jsx)(s.code,{children:"k3s etcd-snapshot"})," command will now print a help message, to save a snapshot use: ",(0,r.jsx)(s.code,{children:"k3s etcd-snapshot save"})]}),"\n",(0,r.jsxs)(s.li,{children:["The following flags will now cause fatal errors (with full removal coming in v1.28.0):","\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsxs)(s.li,{children:[(0,r.jsx)(s.code,{children:"--flannel-backed=ipsec"}),": replaced with ",(0,r.jsx)(s.code,{children:"--flannel-backend=wireguard-native"})," ",(0,r.jsx)(s.a,{href:"https://docs.k3s.io/installation/network-options#migrating-from-wireguard-or-ipsec-to-wireguard-native",children:"see docs for more info."})]}),"\n",(0,r.jsxs)(s.li,{children:["Supplying multiple ",(0,r.jsx)(s.code,{children:"--flannel-backend"})," values is no longer valid. Use ",(0,r.jsx)(s.code,{children:"--flannel-conf"})," instead."]}),"\n"]}),"\n"]}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Changed command -v redirection for iptables bin check ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7315",children:"(#7315)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Update channel server for april 2023 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7327",children:"(#7327)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Bump cri-dockerd ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7347",children:"(#7347)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Cleanup help messages ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7369",children:"(#7369)"})]}),"\n"]}),"\n",(0,r.jsx)(s.hr,{})]})}function o(e={}){const{wrapper:s}={...(0,n.a)(),...e.components};return s?(0,r.jsx)(s,{...e,children:(0,r.jsx)(a,{...e})}):a(e)}},1151:(e,s,i)=>{i.d(s,{Z:()=>h,a:()=>l});var r=i(7294);const n={},t=r.createContext(n);function l(e){const s=r.useContext(t);return r.useMemo((function(){return"function"==typeof e?e(s):{...s,...e}}),[s,e])}function h(e){let s;return s=e.disableParentContext?"function"==typeof e.components?e.components(n):e.components||n:l(e.components),r.createElement(t.Provider,{value:s},e.children)}}}]); \ No newline at end of file +"use strict";(self.webpackChunkk_3_s_docs=self.webpackChunkk_3_s_docs||[]).push([[5668],{4840:(e,s,i)=>{i.r(s),i.d(s,{assets:()=>c,contentTitle:()=>l,default:()=>o,frontMatter:()=>t,metadata:()=>h,toc:()=>d});var r=i(5893),n=i(1151);const t={hide_table_of_contents:!0,sidebar_position:4},l="v1.27.X",h={id:"release-notes/v1.27.X",title:"v1.27.X",description:"Before upgrading from earlier releases, be sure to read the Kubernetes Urgent Upgrade Notes.",source:"@site/docs/release-notes/v1.27.X.md",sourceDirName:"release-notes",slug:"/release-notes/v1.27.X",permalink:"/release-notes/v1.27.X",draft:!1,unlisted:!1,editUrl:"https://github.com/k3s-io/docs/edit/main/docs/release-notes/v1.27.X.md",tags:[],version:"current",lastUpdatedAt:1723747404e3,sidebarPosition:4,frontMatter:{hide_table_of_contents:!0,sidebar_position:4},sidebar:"mySidebar",previous:{title:"v1.28.X",permalink:"/release-notes/v1.28.X"},next:{title:"v1.26.X",permalink:"/release-notes/v1.26.X"}},c={},d=[{value:"Release v1.27.16+k3s1",id:"release-v12716k3s1",level:2},{value:"Changes since v1.27.15+k3s2:",id:"changes-since-v12715k3s2",level:3},{value:"Release v1.27.15+k3s2",id:"release-v12715k3s2",level:2},{value:"Changes since v1.27.15+k3s1:",id:"changes-since-v12715k3s1",level:3},{value:"Release v1.27.15+k3s1",id:"release-v12715k3s1",level:2},{value:"Changes since v1.27.14+k3s1:",id:"changes-since-v12714k3s1",level:3},{value:"Release v1.27.14+k3s1",id:"release-v12714k3s1",level:2},{value:"Changes since v1.27.13+k3s1:",id:"changes-since-v12713k3s1",level:3},{value:"Release v1.27.13+k3s1",id:"release-v12713k3s1",level:2},{value:"Changes since v1.27.12+k3s1:",id:"changes-since-v12712k3s1",level:3},{value:"Release v1.27.12+k3s1",id:"release-v12712k3s1",level:2},{value:"Changes since v1.27.11+k3s1:",id:"changes-since-v12711k3s1",level:3},{value:"Release v1.27.11+k3s1",id:"release-v12711k3s1",level:2},{value:"Changes since v1.27.10+k3s2:",id:"changes-since-v12710k3s2",level:3},{value:"Release v1.27.10+k3s2",id:"release-v12710k3s2",level:2},{value:"Changes since v1.27.9+k3s1:",id:"changes-since-v1279k3s1",level:3},{value:"Release v1.27.9+k3s1",id:"release-v1279k3s1",level:2},{value:"Changes since v1.27.8+k3s2:",id:"changes-since-v1278k3s2",level:3},{value:"Release v1.27.8+k3s2",id:"release-v1278k3s2",level:2},{value:"Changes since v1.27.7+k3s2:",id:"changes-since-v1277k3s2",level:3},{value:"Release v1.27.7+k3s2",id:"release-v1277k3s2",level:2},{value:"Changes since v1.27.7+k3s1:",id:"changes-since-v1277k3s1",level:3},{value:"Release v1.27.7+k3s1",id:"release-v1277k3s1",level:2},{value:"Changes since v1.27.6+k3s1:",id:"changes-since-v1276k3s1",level:3},{value:"Release v1.27.6+k3s1",id:"release-v1276k3s1",level:2},{value:"Changes since v1.27.5+k3s1:",id:"changes-since-v1275k3s1",level:3},{value:"Release v1.27.5+k3s1",id:"release-v1275k3s1",level:2},{value:"Changes since v1.27.4+k3s1:",id:"changes-since-v1274k3s1",level:3},{value:"Release v1.27.4+k3s1",id:"release-v1274k3s1",level:2},{value:"Changes since v1.27.3+k3s1:",id:"changes-since-v1273k3s1",level:3},{value:"Release v1.27.3+k3s1",id:"release-v1273k3s1",level:2},{value:"Changes since v1.27.2+k3s1:",id:"changes-since-v1272k3s1",level:3},{value:"Release v1.27.2+k3s1",id:"release-v1272k3s1",level:2},{value:"Changes since v1.27.1+k3s1:",id:"changes-since-v1271k3s1",level:3},{value:"Release v1.27.1+k3s1",id:"release-v1271k3s1",level:2},{value:"Changes since v1.26.4+k3s1:",id:"changes-since-v1264k3s1",level:3}];function a(e){const s={a:"a",admonition:"admonition",br:"br",code:"code",h1:"h1",h2:"h2",h3:"h3",header:"header",hr:"hr",li:"li",p:"p",strong:"strong",table:"table",tbody:"tbody",td:"td",th:"th",thead:"thead",tr:"tr",ul:"ul",...(0,n.a)(),...e.components};return(0,r.jsxs)(r.Fragment,{children:[(0,r.jsx)(s.header,{children:(0,r.jsx)(s.h1,{id:"v127x",children:"v1.27.X"})}),"\n",(0,r.jsx)(s.admonition,{title:"Upgrade Notice",type:"warning",children:(0,r.jsxs)(s.p,{children:["Before upgrading from earlier releases, be sure to read the Kubernetes ",(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.27.md#urgent-upgrade-notes",children:"Urgent Upgrade Notes"}),"."]})}),"\n",(0,r.jsxs)(s.table,{children:[(0,r.jsx)(s.thead,{children:(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.th,{children:"Version"}),(0,r.jsx)(s.th,{children:"Release date"}),(0,r.jsx)(s.th,{children:"Kubernetes"}),(0,r.jsx)(s.th,{children:"Kine"}),(0,r.jsx)(s.th,{children:"SQLite"}),(0,r.jsx)(s.th,{children:"Etcd"}),(0,r.jsx)(s.th,{children:"Containerd"}),(0,r.jsx)(s.th,{children:"Runc"}),(0,r.jsx)(s.th,{children:"Flannel"}),(0,r.jsx)(s.th,{children:"Metrics-server"}),(0,r.jsx)(s.th,{children:"Traefik"}),(0,r.jsx)(s.th,{children:"CoreDNS"}),(0,r.jsx)(s.th,{children:"Helm-controller"}),(0,r.jsx)(s.th,{children:"Local-path-provisioner"})]})}),(0,r.jsxs)(s.tbody,{children:[(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"/release-notes/v1.27.X#release-v12716k3s1",children:"v1.27.16+k3s1"})}),(0,r.jsx)(s.td,{children:"Jul 31 2024"}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.27.md#v12716",children:"v1.27.16"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/kine/releases/tag/v0.11.11",children:"v0.11.11"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://sqlite.org/releaselog/3_44_0.html",children:"3.44.0"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/etcd/releases/tag/v3.5.13-k3s1",children:"v3.5.13-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/containerd/releases/tag/v1.7.17-k3s2.27",children:"v1.7.17-k3s2.27"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/opencontainers/runc/releases/tag/v1.1.12",children:"v1.1.12"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/flannel-io/flannel/releases/tag/v0.25.4",children:"v0.25.4"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.7.0",children:"v0.7.0"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/traefik/traefik/releases/tag/v2.10.7",children:"v2.10.7"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/coredns/coredns/releases/tag/v1.10.1",children:"v1.10.1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/helm-controller/releases/tag/v0.15.10",children:"v0.15.10"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/rancher/local-path-provisioner/releases/tag/v0.0.28",children:"v0.0.28"})})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"/release-notes/v1.27.X#release-v12715k3s2",children:"v1.27.15+k3s2"})}),(0,r.jsx)(s.td,{children:"Jul 03 2024"}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.27.md#v12715",children:"v1.27.15"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/kine/releases/tag/v0.11.9",children:"v0.11.9"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://sqlite.org/releaselog/3_44_0.html",children:"3.44.0"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/etcd/releases/tag/v3.5.13-k3s1",children:"v3.5.13-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/containerd/releases/tag/v1.7.17-k3s2.27",children:"v1.7.17-k3s2.27"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/opencontainers/runc/releases/tag/v1.1.12",children:"v1.1.12"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/flannel-io/flannel/releases/tag/v0.25.4",children:"v0.25.4"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.7.0",children:"v0.7.0"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/traefik/traefik/releases/tag/v2.10.7",children:"v2.10.7"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/coredns/coredns/releases/tag/v1.10.1",children:"v1.10.1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/helm-controller/releases/tag/v0.15.10",children:"v0.15.10"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/rancher/local-path-provisioner/releases/tag/v0.0.27",children:"v0.0.27"})})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"/release-notes/v1.27.X#release-v12715k3s1",children:"v1.27.15+k3s1"})}),(0,r.jsx)(s.td,{children:"Jun 25 2024"}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.27.md#v12715",children:"v1.27.15"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/kine/releases/tag/v0.11.9",children:"v0.11.9"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://sqlite.org/releaselog/3_44_0.html",children:"3.44.0"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/etcd/releases/tag/v3.5.13-k3s1",children:"v3.5.13-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/containerd/releases/tag/v1.7.17-k3s2.27",children:"v1.7.17-k3s2.27"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/opencontainers/runc/releases/tag/v1.1.12",children:"v1.1.12"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/flannel-io/flannel/releases/tag/v0.25.2",children:"v0.25.2"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.7.0",children:"v0.7.0"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/traefik/traefik/releases/tag/v2.10.7",children:"v2.10.7"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/coredns/coredns/releases/tag/v1.10.1",children:"v1.10.1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/helm-controller/releases/tag/v0.15.10",children:"v0.15.10"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/rancher/local-path-provisioner/releases/tag/v0.0.27",children:"v0.0.27"})})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"/release-notes/v1.27.X#release-v12714k3s1",children:"v1.27.14+k3s1"})}),(0,r.jsx)(s.td,{children:"May 22 2024"}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.27.md#v12714",children:"v1.27.14"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/kine/releases/tag/v0.11.7",children:"v0.11.7"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://sqlite.org/releaselog/3_44_0.html",children:"3.44.0"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/etcd/releases/tag/v3.5.9-k3s1",children:"v3.5.9-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/containerd/releases/tag/v1.7.15-k3s1.27",children:"v1.7.15-k3s1.27"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/opencontainers/runc/releases/tag/v1.1.12-k3s1",children:"v1.1.12-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/flannel-io/flannel/releases/tag/v0.24.2",children:"v0.24.2"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.7.0",children:"v0.7.0"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/traefik/traefik/releases/tag/v2.10.7",children:"v2.10.7"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/coredns/coredns/releases/tag/v1.10.1",children:"v1.10.1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/helm-controller/releases/tag/v0.15.9",children:"v0.15.9"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/rancher/local-path-provisioner/releases/tag/v0.0.26",children:"v0.0.26"})})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"/release-notes/v1.27.X#release-v12713k3s1",children:"v1.27.13+k3s1"})}),(0,r.jsx)(s.td,{children:"Apr 25 2024"}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.27.md#v12713",children:"v1.27.13"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/kine/releases/tag/v0.11.7",children:"v0.11.7"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://sqlite.org/releaselog/3_44_0.html",children:"3.44.0"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/etcd/releases/tag/v3.5.9-k3s1",children:"v3.5.9-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/containerd/releases/tag/v1.7.15-k3s1.27",children:"v1.7.15-k3s1.27"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/opencontainers/runc/releases/tag/v1.1.12",children:"v1.1.12"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/flannel-io/flannel/releases/tag/v0.24.2",children:"v0.24.2"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.7.0",children:"v0.7.0"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/traefik/traefik/releases/tag/v2.10.7",children:"v2.10.7"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/coredns/coredns/releases/tag/v1.10.1",children:"v1.10.1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/helm-controller/releases/tag/v0.15.9",children:"v0.15.9"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/rancher/local-path-provisioner/releases/tag/v0.0.26",children:"v0.0.26"})})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"/release-notes/v1.27.X#release-v12712k3s1",children:"v1.27.12+k3s1"})}),(0,r.jsx)(s.td,{children:"Mar 25 2024"}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.27.md#v12712",children:"v1.27.12"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/kine/releases/tag/v0.11.4",children:"v0.11.4"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://sqlite.org/releaselog/3_44_0.html",children:"3.44.0"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/etcd/releases/tag/v3.5.9-k3s1",children:"v3.5.9-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/containerd/releases/tag/v1.7.11-k3s2.27",children:"v1.7.11-k3s2.27"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/opencontainers/runc/releases/tag/v1.1.12-k3s1",children:"v1.1.12-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/flannel-io/flannel/releases/tag/v0.24.2",children:"v0.24.2"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.7.0",children:"v0.7.0"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/traefik/traefik/releases/tag/v2.10.5",children:"v2.10.5"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/coredns/coredns/releases/tag/v1.10.1",children:"v1.10.1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/helm-controller/releases/tag/v0.15.9",children:"v0.15.9"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/rancher/local-path-provisioner/releases/tag/v0.0.26",children:"v0.0.26"})})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"/release-notes/v1.27.X#release-v12711k3s1",children:"v1.27.11+k3s1"})}),(0,r.jsx)(s.td,{children:"Feb 29 2024"}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.27.md#v12711",children:"v1.27.11"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/kine/releases/tag/v0.11.4",children:"v0.11.4"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://sqlite.org/releaselog/3_44_0.html",children:"3.44.0"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/etcd/releases/tag/v3.5.9-k3s1",children:"v3.5.9-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/containerd/releases/tag/v1.7.11-k3s2.27",children:"v1.7.11-k3s2.27"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/runc/releases/tag/v1.1.12-k3s1",children:"v1.1.12-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/flannel-io/flannel/releases/tag/v0.24.2",children:"v0.24.2"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.6.3",children:"v0.6.3"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/traefik/traefik/releases/tag/v2.10.5",children:"v2.10.5"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/coredns/coredns/releases/tag/v1.10.1",children:"v1.10.1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/helm-controller/releases/tag/v0.15.8",children:"v0.15.8"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/rancher/local-path-provisioner/releases/tag/v0.0.26",children:"v0.0.26"})})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"/release-notes/v1.27.X#release-v12710k3s2",children:"v1.27.10+k3s2"})}),(0,r.jsx)(s.td,{children:"Feb 06 2024"}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.27.md#v12710",children:"v1.27.10"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/kine/releases/tag/v0.11.0",children:"v0.11.0"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://sqlite.org/releaselog/3_42_0.html",children:"3.42.0"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/etcd/releases/tag/v3.5.9-k3s1",children:"v3.5.9-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/containerd/releases/tag/v1.7.11-k3s2.27",children:"v1.7.11-k3s2.27"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/opencontainers/runc/releases/tag/v1.1.12-k3s1",children:"v1.1.12-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/flannel-io/flannel/releases/tag/v0.22.2",children:"v0.22.2"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.6.3",children:"v0.6.3"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/traefik/traefik/releases/tag/v2.10.5",children:"v2.10.5"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/coredns/coredns/releases/tag/v1.10.1",children:"v1.10.1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/helm-controller/releases/tag/v0.15.8",children:"v0.15.8"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/rancher/local-path-provisioner/releases/tag/v0.0.24",children:"v0.0.24"})})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"/release-notes/v1.27.X#release-v1279k3s1",children:"v1.27.9+k3s1"})}),(0,r.jsx)(s.td,{children:"Dec 27 2023"}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.27.md#v1279",children:"v1.27.9"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/kine/releases/tag/v0.11.0",children:"v0.11.0"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://sqlite.org/releaselog/3_42_0.html",children:"3.42.0"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/etcd/releases/tag/v3.5.9-k3s1",children:"v3.5.9-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/containerd/releases/tag/v1.7.11-k3s2.27",children:"v1.7.11-k3s2.27"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/opencontainers/runc/releases/tag/v1.1.10",children:"v1.1.10"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/flannel-io/flannel/releases/tag/v0.22.2",children:"v0.22.2"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.6.3",children:"v0.6.3"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/traefik/traefik/releases/tag/v2.10.5",children:"v2.10.5"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/coredns/coredns/releases/tag/v1.10.1",children:"v1.10.1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/helm-controller/releases/tag/v0.15.4",children:"v0.15.4"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/rancher/local-path-provisioner/releases/tag/v0.0.24",children:"v0.0.24"})})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"/release-notes/v1.27.X#release-v1278k3s2",children:"v1.27.8+k3s2"})}),(0,r.jsx)(s.td,{children:"Dec 07 2023"}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.27.md#v1278",children:"v1.27.8"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/kine/releases/tag/v0.11.0",children:"v0.11.0"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://sqlite.org/releaselog/3_42_0.html",children:"3.42.0"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/etcd/releases/tag/v3.5.9-k3s1",children:"v3.5.9-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/containerd/releases/tag/v1.7.7-k3s1.27",children:"v1.7.7-k3s1.27"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/opencontainers/runc/releases/tag/v1.1.8",children:"v1.1.8"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/flannel-io/flannel/releases/tag/v0.22.2",children:"v0.22.2"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.6.3",children:"v0.6.3"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/traefik/traefik/releases/tag/v2.10.5",children:"v2.10.5"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/coredns/coredns/releases/tag/v1.10.1",children:"v1.10.1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/helm-controller/releases/tag/v0.15.4",children:"v0.15.4"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/rancher/local-path-provisioner/releases/tag/v0.0.24",children:"v0.0.24"})})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"/release-notes/v1.27.X#release-v1277k3s2",children:"v1.27.7+k3s2"})}),(0,r.jsx)(s.td,{children:"Nov 08 2023"}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.27.md#v1277",children:"v1.27.7"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/kine/releases/tag/v0.10.3",children:"v0.10.3"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://sqlite.org/releaselog/3_42_0.html",children:"3.42.0"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/etcd/releases/tag/v3.5.9-k3s1",children:"v3.5.9-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/containerd/releases/tag/v1.7.7-k3s1.27",children:"v1.7.7-k3s1.27"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/opencontainers/runc/releases/tag/v1.1.8",children:"v1.1.8"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/flannel-io/flannel/releases/tag/v0.22.2",children:"v0.22.2"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.6.3",children:"v0.6.3"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/traefik/traefik/releases/tag/v2.10.5",children:"v2.10.5"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/coredns/coredns/releases/tag/v1.10.1",children:"v1.10.1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/helm-controller/releases/tag/v0.15.4",children:"v0.15.4"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/rancher/local-path-provisioner/releases/tag/v0.0.24",children:"v0.0.24"})})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"/release-notes/v1.27.X#release-v1277k3s1",children:"v1.27.7+k3s1"})}),(0,r.jsx)(s.td,{children:"Oct 30 2023"}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.27.md#v1277",children:"v1.27.7"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/kine/releases/tag/v0.10.3",children:"v0.10.3"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://sqlite.org/releaselog/3_42_0.html",children:"3.42.0"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/etcd/releases/tag/v3.5.9-k3s1",children:"v3.5.9-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/containerd/releases/tag/v1.7.7-k3s1.27",children:"v1.7.7-k3s1.27"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/opencontainers/runc/releases/tag/v1.1.8",children:"v1.1.8"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/flannel-io/flannel/releases/tag/v0.22.2",children:"v0.22.2"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.6.3",children:"v0.6.3"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/traefik/traefik/releases/tag/v2.10.5",children:"v2.10.5"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/coredns/coredns/releases/tag/v1.10.1",children:"v1.10.1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/helm-controller/releases/tag/v0.15.4",children:"v0.15.4"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/rancher/local-path-provisioner/releases/tag/v0.0.24",children:"v0.0.24"})})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"/release-notes/v1.27.X#release-v1276k3s1",children:"v1.27.6+k3s1"})}),(0,r.jsx)(s.td,{children:"Sep 20 2023"}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.27.md#v1276",children:"v1.27.6"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/kine/releases/tag/v0.10.3",children:"v0.10.3"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://sqlite.org/releaselog/3_42_0.html",children:"3.42.0"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/etcd/releases/tag/v3.5.9-k3s1",children:"v3.5.9-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/containerd/releases/tag/v1.7.6-k3s1.27",children:"v1.7.6-k3s1.27"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/opencontainers/runc/releases/tag/v1.1.8",children:"v1.1.8"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/flannel-io/flannel/releases/tag/v0.22.2",children:"v0.22.2"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.6.3",children:"v0.6.3"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/traefik/traefik/releases/tag/v2.9.10",children:"v2.9.10"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/coredns/coredns/releases/tag/v1.10.1",children:"v1.10.1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/helm-controller/releases/tag/v0.15.4",children:"v0.15.4"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/rancher/local-path-provisioner/releases/tag/v0.0.24",children:"v0.0.24"})})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"/release-notes/v1.27.X#release-v1275k3s1",children:"v1.27.5+k3s1"})}),(0,r.jsx)(s.td,{children:"Sep 05 2023"}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.27.md#v1275",children:"v1.27.5"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/kine/releases/tag/v0.10.2",children:"v0.10.2"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://sqlite.org/releaselog/3_42_0.html",children:"3.42.0"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/etcd/releases/tag/v3.5.9-k3s1",children:"v3.5.9-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/containerd/releases/tag/v1.7.3-k3s1",children:"v1.7.3-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/opencontainers/runc/releases/tag/v1.1.8",children:"v1.1.8"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/flannel-io/flannel/releases/tag/v0.22.2",children:"v0.22.2"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.6.3",children:"v0.6.3"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/traefik/traefik/releases/tag/v2.9.10",children:"v2.9.10"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/coredns/coredns/releases/tag/v1.10.1",children:"v1.10.1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/helm-controller/releases/tag/v0.15.4",children:"v0.15.4"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/rancher/local-path-provisioner/releases/tag/v0.0.24",children:"v0.0.24"})})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"/release-notes/v1.27.X#release-v1274k3s1",children:"v1.27.4+k3s1"})}),(0,r.jsx)(s.td,{children:"Jul 27 2023"}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.27.md#v1274",children:"v1.27.4"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/kine/releases/tag/v0.10.1",children:"v0.10.1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://sqlite.org/releaselog/3_39_2.html",children:"3.39.2"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/etcd/releases/tag/v3.5.7-k3s1",children:"v3.5.7-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/containerd/releases/tag/v1.7.1-k3s1",children:"v1.7.1-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/opencontainers/runc/releases/tag/v1.1.7",children:"v1.1.7"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/flannel-io/flannel/releases/tag/v0.22.0",children:"v0.22.0"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.6.3",children:"v0.6.3"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/traefik/traefik/releases/tag/v2.9.10",children:"v2.9.10"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/coredns/coredns/releases/tag/v1.10.1",children:"v1.10.1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/helm-controller/releases/tag/v0.15.2",children:"v0.15.2"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/rancher/local-path-provisioner/releases/tag/v0.0.24",children:"v0.0.24"})})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"/release-notes/v1.27.X#release-v1273k3s1",children:"v1.27.3+k3s1"})}),(0,r.jsx)(s.td,{children:"Jun 26 2023"}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.27.md#v1273",children:"v1.27.3"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/kine/releases/tag/v0.10.1",children:"v0.10.1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://sqlite.org/releaselog/3_39_2.html",children:"3.39.2"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/etcd/releases/tag/v3.5.7-k3s1",children:"v3.5.7-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/containerd/releases/tag/v1.7.1-k3s1",children:"v1.7.1-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/opencontainers/runc/releases/tag/v1.1.7",children:"v1.1.7"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/flannel-io/flannel/releases/tag/v0.22.0",children:"v0.22.0"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.6.3",children:"v0.6.3"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/traefik/traefik/releases/tag/v2.9.10",children:"v2.9.10"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/coredns/coredns/releases/tag/v1.10.1",children:"v1.10.1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/helm-controller/releases/tag/v0.15.0",children:"v0.15.0"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/rancher/local-path-provisioner/releases/tag/v0.0.24",children:"v0.0.24"})})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"/release-notes/v1.27.X#release-v1272k3s1",children:"v1.27.2+k3s1"})}),(0,r.jsx)(s.td,{children:"May 26 2023"}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.27.md#v1272",children:"v1.27.2"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/kine/releases/tag/v0.10.1",children:"v0.10.1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://sqlite.org/releaselog/3_39_2.html",children:"3.39.2"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/etcd/releases/tag/v3.5.7-k3s1",children:"v3.5.7-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/containerd/releases/tag/v1.7.1-k3s1",children:"v1.7.1-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/opencontainers/runc/releases/tag/v1.1.7",children:"v1.1.7"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/flannel-io/flannel/releases/tag/v0.21.4",children:"v0.21.4"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.6.2",children:"v0.6.2"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/traefik/traefik/releases/tag/v2.9.10",children:"v2.9.10"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/coredns/coredns/releases/tag/v1.10.1",children:"v1.10.1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/helm-controller/releases/tag/v0.14.0",children:"v0.14.0"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/rancher/local-path-provisioner/releases/tag/v0.0.24",children:"v0.0.24"})})]}),(0,r.jsxs)(s.tr,{children:[(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"/release-notes/v1.27.X#release-v1271k3s1",children:"v1.27.1+k3s1"})}),(0,r.jsx)(s.td,{children:"Apr 27 2023"}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.27.md#v1271",children:"v1.27.1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/kine/releases/tag/v0.9.9",children:"v0.9.9"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://sqlite.org/releaselog/3_39_2.html",children:"3.39.2"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/etcd/releases/tag/v3.5.7-k3s1",children:"v3.5.7-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/containerd/releases/tag/v1.6.19-k3s1",children:"v1.6.19-k3s1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/opencontainers/runc/releases/tag/v1.1.5",children:"v1.1.5"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/flannel-io/flannel/releases/tag/v0.21.4",children:"v0.21.4"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/kubernetes-sigs/metrics-server/releases/tag/v0.6.2",children:"v0.6.2"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/traefik/traefik/releases/tag/v2.9.4",children:"v2.9.4"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/coredns/coredns/releases/tag/v1.10.1",children:"v1.10.1"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/helm-controller/releases/tag/v0.13.3",children:"v0.13.3"})}),(0,r.jsx)(s.td,{children:(0,r.jsx)(s.a,{href:"https://github.com/rancher/local-path-provisioner/releases/tag/v0.0.24",children:"v0.0.24"})})]})]})]}),"\n",(0,r.jsx)("br",{}),"\n",(0,r.jsxs)(s.h2,{id:"release-v12716k3s1",children:["Release ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/releases/tag/v1.27.16+k3s1",children:"v1.27.16+k3s1"})]}),"\n",(0,r.jsx)(s.p,{children:"This release updates Kubernetes to v1.27.16, and fixes a number of issues."}),"\n",(0,r.jsxs)(s.p,{children:["For more details on what's new, see the ",(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.27.md#changelog-since-v12715",children:"Kubernetes release notes"}),"."]}),"\n",(0,r.jsx)(s.h3,{id:"changes-since-v12715k3s2",children:"Changes since v1.27.15+k3s2:"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsxs)(s.li,{children:["Backports for 2024-07 release cycle ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10500",children:"(#10500)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:"Bump k3s-root to v0.14.0"}),"\n",(0,r.jsx)(s.li,{children:"Bump github.com/hashicorp/go-retryablehttp from 0.7.4 to 0.7.7"}),"\n",(0,r.jsx)(s.li,{children:"Bump Local Path Provisioner version"}),"\n",(0,r.jsx)(s.li,{children:"Ensure remotedialer kubelet connections use kubelet bind address"}),"\n",(0,r.jsx)(s.li,{children:"Chore: Bump Trivy version"}),"\n",(0,r.jsx)(s.li,{children:"Add etcd s3 config secret implementation"}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["July Test Backports ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10510",children:"(#10510)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Update to v1.27.16-k3s1 and Go 1.22.5 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10542",children:"(#10542)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Fix issues loading data-dir value from env vars or dropping config files ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10599",children:"(#10599)"})]}),"\n"]}),"\n",(0,r.jsx)(s.hr,{}),"\n",(0,r.jsxs)(s.h2,{id:"release-v12715k3s2",children:["Release ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/releases/tag/v1.27.15+k3s2",children:"v1.27.15+k3s2"})]}),"\n",(0,r.jsx)(s.p,{children:"This release updates Kubernetes to v1.27.15, and fixes a number of issues."}),"\n",(0,r.jsxs)(s.p,{children:["For more details on what's new, see the ",(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.27.md#changelog-since-v12715",children:"Kubernetes release notes"}),"."]}),"\n",(0,r.jsx)(s.h3,{id:"changes-since-v12715k3s1",children:"Changes since v1.27.15+k3s1:"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsxs)(s.li,{children:["Update flannel to v0.25.4 and fixed issue with IPv6 mask ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10429",children:"(#10429)"})]}),"\n"]}),"\n",(0,r.jsx)(s.hr,{}),"\n",(0,r.jsxs)(s.h2,{id:"release-v12715k3s1",children:["Release ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/releases/tag/v1.27.15+k3s1",children:"v1.27.15+k3s1"})]}),"\n",(0,r.jsx)(s.p,{children:"This release updates Kubernetes to v1.27.15, and fixes a number of issues."}),"\n",(0,r.jsxs)(s.p,{children:["For more details on what's new, see the ",(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.27.md#changelog-since-v12714",children:"Kubernetes release notes"}),"."]}),"\n",(0,r.jsx)(s.h3,{id:"changes-since-v12714k3s1",children:"Changes since v1.27.14+k3s1:"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsxs)(s.li,{children:["Replace deprecated ruby function ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10089",children:"(#10089)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Fix bug when using tailscale config by file ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10143",children:"(#10143)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Bump flannel version to v0.25.2 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10222",children:"(#10222)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Update kube-router version to v2.1.2 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10183",children:"(#10183)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Improve tailscale test & add extra log in e2e tests ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10214",children:"(#10214)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Backports for 2024-06 release cycle ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10259",children:"(#10259)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:"Add WithSkipMissing to not fail import on missing blobs"}),"\n",(0,r.jsx)(s.li,{children:"Use fixed stream server bind address for cri-dockerd"}),"\n",(0,r.jsx)(s.li,{children:"Switch stargz over to cri registry config_path"}),"\n",(0,r.jsx)(s.li,{children:"Bump to containerd v1.7.17, etcd v3.5.13"}),"\n",(0,r.jsx)(s.li,{children:"Bump spegel version"}),"\n",(0,r.jsx)(s.li,{children:"Fix issue with externalTrafficPolicy: Local for single-stack services on dual-stack nodes"}),"\n",(0,r.jsxs)(s.li,{children:["ServiceLB now sets the priorityClassName on svclb pods to ",(0,r.jsx)(s.code,{children:"system-node-critical"})," by default. This can be overridden on a per-service basis via the ",(0,r.jsx)(s.code,{children:"svccontroller.k3s.cattle.io/priorityclassname"})," annotation."]}),"\n",(0,r.jsx)(s.li,{children:"Bump minio-go to v7.0.70"}),"\n",(0,r.jsx)(s.li,{children:"Bump kine to v0.11.9 to fix pagination"}),"\n",(0,r.jsx)(s.li,{children:"Update valid resolv conf"}),"\n",(0,r.jsx)(s.li,{children:"Add missing kernel config check"}),"\n",(0,r.jsx)(s.li,{children:"Symlinked sub-directories are now respected when scanning Auto-Deploying Manifests (AddOns)"}),"\n",(0,r.jsx)(s.li,{children:"Fix bug: allow helm controller set owner reference"}),"\n",(0,r.jsx)(s.li,{children:"Bump klipper-helm image for tls secret support"}),"\n",(0,r.jsx)(s.li,{children:"Fix issue with k3s-etcd informers not starting"}),"\n",(0,r.jsxs)(s.li,{children:[(0,r.jsx)(s.code,{children:"--Enable-pprof"})," can now be set on agents to enable the debug/pprof endpoints. When set, agents will listen on the supervisor port."]}),"\n",(0,r.jsxs)(s.li,{children:[(0,r.jsx)(s.code,{children:"--Supervisor-metrics"})," can now be set on servers to enable serving internal metrics on the supervisor endpoint; when set agents will listen on the supervisor port."]}),"\n",(0,r.jsx)(s.li,{children:"Fix netpol crash when node remains tainted uninitialized"}),"\n",(0,r.jsx)(s.li,{children:"The embedded load-balancer will now fall back to trying all servers with health-checks ignored, if all servers have been marked unavailable due to failed health checks."}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["More backports for 2024-06 release cycle ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10290",children:"(#10290)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Add snapshot retention etcd-s3-folder fix ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10314",children:"(#10314)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Add test for ",(0,r.jsx)(s.code,{children:"isValidResolvConf"})," (#10302) ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10332",children:"(#10332)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Fix race condition panic in loadbalancer.nextServer ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10324",children:"(#10324)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Fix typo, use ",(0,r.jsx)(s.code,{children:"rancher/permissions"})," ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10297",children:"(#10297)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Update Kubernetes to v1.27.15 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10346",children:"(#10346)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:"Update Kubernetes to v1.27.15"}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Fix agent supervisor port using apiserver port instead ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10356",children:"(#10356)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Fix issue that allowed multiple simultaneous snapshots to be allowed ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10378",children:"(#10378)"})]}),"\n"]}),"\n",(0,r.jsx)(s.hr,{}),"\n",(0,r.jsxs)(s.h2,{id:"release-v12714k3s1",children:["Release ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/releases/tag/v1.27.14+k3s1",children:"v1.27.14+k3s1"})]}),"\n",(0,r.jsx)(s.p,{children:"This release updates Kubernetes to v1.27.14, and fixes a number of issues."}),"\n",(0,r.jsxs)(s.p,{children:["For more details on what's new, see the ",(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.27.md#changelog-since-v12713",children:"Kubernetes release notes"}),"."]}),"\n",(0,r.jsx)(s.h3,{id:"changes-since-v12713k3s1",children:"Changes since v1.27.13+k3s1:"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsxs)(s.li,{children:["Bump E2E opensuse leap to 15.6, fix btrfs test ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10096",children:"(#10096)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Windows changes ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10113",children:"(#10113)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Update to v1.27.14-k3s1 and Go 1.21.9 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10103",children:"(#10103)"})]}),"\n"]}),"\n",(0,r.jsx)(s.hr,{}),"\n",(0,r.jsxs)(s.h2,{id:"release-v12713k3s1",children:["Release ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/releases/tag/v1.27.13+k3s1",children:"v1.27.13+k3s1"})]}),"\n",(0,r.jsx)(s.p,{children:"This release updates Kubernetes to v1.27.13, and fixes a number of issues."}),"\n",(0,r.jsxs)(s.p,{children:["For more details on what's new, see the ",(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.27.md#changelog-since-v12712",children:"Kubernetes release notes"}),"."]}),"\n",(0,r.jsx)(s.h3,{id:"changes-since-v12712k3s1",children:"Changes since v1.27.12+k3s1:"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsxs)(s.li,{children:["Add a new error when kine is with disable apiserver or disable etcd ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9803",children:"(#9803)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Remove old pinned dependencies ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9828",children:"(#9828)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Transition from deprecated pointer library to ptr ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9825",children:"(#9825)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Golang caching and E2E ubuntu 23.10 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9822",children:"(#9822)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Add tls for kine ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9850",children:"(#9850)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Bump spegel to v0.0.20-k3s1 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9881",children:"(#9881)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Backports for 2024-04 release cycle ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9912",children:"(#9912)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:"Send error response if member list cannot be retrieved"}),"\n",(0,r.jsx)(s.li,{children:"The k3s stub cloud provider now respects the kubelet's requested provider-id, instance type, and topology labels"}),"\n",(0,r.jsx)(s.li,{children:"Fix error when image has already been pulled"}),"\n",(0,r.jsx)(s.li,{children:"Add /etc/passwd and /etc/group to k3s docker image"}),"\n",(0,r.jsx)(s.li,{children:"Fix etcd snapshot reconcile for agentless servers"}),"\n",(0,r.jsx)(s.li,{children:"Add health-check support to loadbalancer"}),"\n",(0,r.jsx)(s.li,{children:"Add certificate expiry check, events, and metrics"}),"\n",(0,r.jsx)(s.li,{children:"Add workaround for containerd hosts.toml bug when passing config for default registry endpoint"}),"\n",(0,r.jsx)(s.li,{children:"Add supervisor cert/key to rotate list"}),"\n",(0,r.jsx)(s.li,{children:"The embedded containerd has been bumped to v1.7.15"}),"\n",(0,r.jsx)(s.li,{children:"The embedded cri-dockerd has been bumped to v0.3.12"}),"\n",(0,r.jsxs)(s.li,{children:["The ",(0,r.jsx)(s.code,{children:"k3s etcd-snapshot"})," command has been reworked for improved consistency. All snapshots operations are now performed by the server process, with the CLI acting as a client to initiate and report results. As a side effect, the CLI is now less noisy when managing snapshots."]}),"\n",(0,r.jsx)(s.li,{children:"Improve etcd load-balancer startup behavior"}),"\n",(0,r.jsx)(s.li,{children:"Actually fix agent certificate rotation"}),"\n",(0,r.jsx)(s.li,{children:"Traefik has been bumped to v2.10.7."}),"\n",(0,r.jsx)(s.li,{children:"Traefik pod annotations are now set properly in the default chart values."}),"\n",(0,r.jsx)(s.li,{children:"The system-default-registry value now supports RFC2732 IPv6 literals."}),"\n",(0,r.jsxs)(s.li,{children:["The local-path provisioner now defaults to creating ",(0,r.jsx)(s.code,{children:"local"})," volumes, instead of ",(0,r.jsx)(s.code,{children:"hostPath"}),"."]}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Allow LPP to read helper logs ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9939",children:"(#9939)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Update kube-router to v2.1.0 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9943",children:"(#9943)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Update to v1.27.13-k3s1 and Go 1.21.9 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9958",children:"(#9958)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Fix on-demand snapshots timing out; not honoring folder ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9995",children:"(#9995)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Make /db/info available anonymously from localhost ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/10003",children:"(#10003)"})]}),"\n"]}),"\n",(0,r.jsx)(s.hr,{}),"\n",(0,r.jsxs)(s.h2,{id:"release-v12712k3s1",children:["Release ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/releases/tag/v1.27.12+k3s1",children:"v1.27.12+k3s1"})]}),"\n",(0,r.jsx)(s.p,{children:"This release updates Kubernetes to v1.27.12, and fixes a number of issues."}),"\n",(0,r.jsxs)(s.p,{children:["For more details on what's new, see the ",(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.27.md#changelog-since-v12711",children:"Kubernetes release notes"}),"."]}),"\n",(0,r.jsx)(s.h3,{id:"changes-since-v12711k3s1",children:"Changes since v1.27.11+k3s1:"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsxs)(s.li,{children:["Add an integration test for flannel-backend=none ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9609",children:"(#9609)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Install and Unit test backports ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9642",children:"(#9642)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Update klipper-lb image version ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9606",children:"(#9606)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Adjust first node-ip based on configured clusterCIDR ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9632",children:"(#9632)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Improve tailscale e2e test ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9654",children:"(#9654)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Backports for 2024-03 release cycle ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9670",children:"(#9670)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:"Fix: use correct wasm shims names"}),"\n",(0,r.jsx)(s.li,{children:"The embedded flannel cni-plugin binary is now built and versioned separate from the rest of the cni plugins and the embedded flannel controller."}),"\n",(0,r.jsx)(s.li,{children:"Bump spegel to v0.0.18-k3s3"}),"\n",(0,r.jsx)(s.li,{children:"Adds wildcard registry support"}),"\n",(0,r.jsx)(s.li,{children:"Fixes issue with excessive CPU utilization while waiting for containerd to start"}),"\n",(0,r.jsx)(s.li,{children:"Add env var to allow spegel mirroring of latest tag"}),"\n",(0,r.jsx)(s.li,{children:"Tweak netpol node wait logs"}),"\n",(0,r.jsx)(s.li,{children:"Fix coredns NodeHosts on dual-stack clusters"}),"\n",(0,r.jsx)(s.li,{children:"Bump helm-controller/klipper-helm versions"}),"\n",(0,r.jsx)(s.li,{children:"Fix snapshot prune"}),"\n",(0,r.jsx)(s.li,{children:"Fix issue with etcd node name missing hostname"}),"\n",(0,r.jsx)(s.li,{children:"Rootless mode should also bind service nodePort to host for LoadBalancer type, matching UX of rootful mode."}),"\n",(0,r.jsxs)(s.li,{children:["To enable raw output for the ",(0,r.jsx)(s.code,{children:"check-config"})," subcommand, you may now set NO_COLOR=1"]}),"\n",(0,r.jsx)(s.li,{children:"Fix additional corner cases in registries handling"}),"\n",(0,r.jsx)(s.li,{children:"Bump metrics-server to v0.7.0"}),"\n",(0,r.jsx)(s.li,{children:"K3s will now warn and suppress duplicate entries in the mirror endpoint list for a registry. Containerd does not support listing the same endpoint multiple times as a mirror for a single upstream registry."}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Docker and E2E Test Backports ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9708",children:"(#9708)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Fix wildcard entry upstream fallback ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9734",children:"(#9734)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Update to v1.27.12-k3s1 and Go 1.21.8 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9745",children:"(#9745)"})]}),"\n"]}),"\n",(0,r.jsx)(s.hr,{}),"\n",(0,r.jsxs)(s.h2,{id:"release-v12711k3s1",children:["Release ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/releases/tag/v1.27.11+k3s1",children:"v1.27.11+k3s1"})]}),"\n",(0,r.jsx)(s.p,{children:"This release updates Kubernetes to v1.27.11, and fixes a number of issues."}),"\n",(0,r.jsxs)(s.p,{children:["For more details on what's new, see the ",(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.27.md#changelog-since-v12710",children:"Kubernetes release notes"}),"."]}),"\n",(0,r.jsx)(s.h3,{id:"changes-since-v12710k3s2",children:"Changes since v1.27.10+k3s2:"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsxs)(s.li,{children:["Chore: bump Local Path Provisioner version ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9427",children:"(#9427)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Bump cri-dockerd to fix compat with Docker Engine 25 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9291",children:"(#9291)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Auto Dependency Bump ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9420",children:"(#9420)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Runtimes refactor using exec.LookPath ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9430",children:"(#9430)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:"Directories containing runtimes need to be included in the $PATH environment variable for effective runtime detection."}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Changed how lastHeartBeatTime works in the etcd condition ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9425",children:"(#9425)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Allow executors to define containerd and docker behavior ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9253",children:"(#9253)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Update Kube-router to v2.0.1 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9405",children:"(#9405)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Backports for 2024-02 release cycle ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9463",children:"(#9463)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Bump flannel version + remove multiclustercidr ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9407",children:"(#9407)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Enable longer http timeout requests ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9445",children:"(#9445)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Test_UnitApplyContainerdQoSClassConfigFileIfPresent ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9441",children:"(#9441)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Support PR testing installs ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9470",children:"(#9470)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Update Kubernetes to v1.27.11 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9491",children:"(#9491)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Fix drone publish for arm ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9509",children:"(#9509)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Remove failing Drone step ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9515",children:"(#9515)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Restore original order of agent startup functions ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9546",children:"(#9546)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Fix netpol startup when flannel is disabled ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9579",children:"(#9579)"})]}),"\n"]}),"\n",(0,r.jsx)(s.hr,{}),"\n",(0,r.jsxs)(s.h2,{id:"release-v12710k3s2",children:["Release ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/releases/tag/v1.27.10+k3s2",children:"v1.27.10+k3s2"})]}),"\n",(0,r.jsx)(s.p,{children:"This release updates Kubernetes to v1.27.10, and fixes a number of issues."}),"\n",(0,r.jsxs)(s.p,{children:["For more details on what's new, see the ",(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.27.md#changelog-since-v1279",children:"Kubernetes release notes"}),"."]}),"\n",(0,r.jsx)(s.p,{children:(0,r.jsx)(s.strong,{children:"Important Notes"})}),"\n",(0,r.jsxs)(s.p,{children:["Addresses the runc CVE: ",(0,r.jsx)(s.a,{href:"https://nvd.nist.gov/vuln/detail/CVE-2024-21626",children:"CVE-2024-21626"})," by updating runc to v1.1.12."]}),"\n",(0,r.jsx)(s.h3,{id:"changes-since-v1279k3s1",children:"Changes since v1.27.9+k3s1:"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsxs)(s.li,{children:["Add a retry around updating a secrets-encrypt node annotations ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9124",children:"(#9124)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Added support for env *_PROXY variables for agent loadbalancer ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9117",children:"(#9117)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Wait for taint to be gone in the node before starting the netpol controller ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9176",children:"(#9176)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Etcd condition ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9182",children:"(#9182)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Backports for 2024-01 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9211",children:"(#9211)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Move proxy dialer out of init() and fix crash ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9220",children:"(#9220)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Pin opa version for missing dependency chain ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9217",children:"(#9217)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Etcd node is nil ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9229",children:"(#9229)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Update to v1.27.10 and Go 1.20.13 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9261",children:"(#9261)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Use ",(0,r.jsx)(s.code,{children:"ipFamilyPolicy: RequireDualStack"})," for dual-stack kube-dns ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9270",children:"(#9270)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Backports for 2024-01 k3s2 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9337",children:"(#9337)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:"Bump runc to v1.1.12 and helm-controller to v0.15.7"}),"\n",(0,r.jsx)(s.li,{children:"Fix handling of bare hostname or IP as endpoint address in registries.yaml"}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Bump helm-controller to fix issue with ChartContent ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9347",children:"(#9347)"})]}),"\n"]}),"\n",(0,r.jsx)(s.hr,{}),"\n",(0,r.jsxs)(s.h2,{id:"release-v1279k3s1",children:["Release ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/releases/tag/v1.27.9+k3s1",children:"v1.27.9+k3s1"})]}),"\n",(0,r.jsx)(s.p,{children:"This release updates Kubernetes to v1.27.9, and fixes a number of issues."}),"\n",(0,r.jsxs)(s.p,{children:["For more details on what's new, see the ",(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.27.md#changelog-since-v1278",children:"Kubernetes release notes"}),"."]}),"\n",(0,r.jsx)(s.h3,{id:"changes-since-v1278k3s2",children:"Changes since v1.27.8+k3s2:"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsxs)(s.li,{children:["Bump containerd/runc to v1.7.10-k3s1/v1.1.10 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8963",children:"(#8963)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Fix overlapping address range ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9018",children:"(#9018)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Runtimes backport ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9013",children:"(#9013)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:"Added runtime classes for wasm/nvidia/crun"}),"\n",(0,r.jsx)(s.li,{children:"Added default runtime flag for containerd"}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Bump containerd to v1.7.11 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9041",children:"(#9041)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Update to v1.27.9-k3s1 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/9078",children:"(#9078)"})]}),"\n"]}),"\n",(0,r.jsx)(s.hr,{}),"\n",(0,r.jsxs)(s.h2,{id:"release-v1278k3s2",children:["Release ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/releases/tag/v1.27.8+k3s2",children:"v1.27.8+k3s2"})]}),"\n",(0,r.jsx)(s.p,{children:"This release updates Kubernetes to v1.27.8, and fixes a number of issues."}),"\n",(0,r.jsxs)(s.p,{children:["For more details on what's new, see the ",(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.27.md#changelog-since-v1277",children:"Kubernetes release notes"}),"."]}),"\n",(0,r.jsx)(s.h3,{id:"changes-since-v1277k3s2",children:"Changes since v1.27.7+k3s2:"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsxs)(s.li,{children:["Etcd status condition ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8821",children:"(#8821)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Add warning for removal of multiclustercidr flag ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8759",children:"(#8759)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Backports for 2023-11 release ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8878",children:"(#8878)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsxs)(s.li,{children:["New timezone info in Docker image allows the use of ",(0,r.jsx)(s.code,{children:"spec.timeZone"})," in CronJobs"]}),"\n",(0,r.jsx)(s.li,{children:"Bumped kine to v0.11.0 to resolve issues with postgres and NATS, fix performance of watch channels under heavy load, and improve compatibility with the reference implementation."}),"\n",(0,r.jsxs)(s.li,{children:["Containerd may now be configured to use rdt or blockio configuration by defining ",(0,r.jsx)(s.code,{children:"rdt_config.yaml"})," or ",(0,r.jsx)(s.code,{children:"blockio_config.yaml"})," files."]}),"\n",(0,r.jsx)(s.li,{children:"Add agent flag disable-apiserver-lb, agent will not start load balance proxy."}),"\n",(0,r.jsx)(s.li,{children:"Improved ingress IP ordering from ServiceLB"}),"\n",(0,r.jsx)(s.li,{children:"Disable helm CRD installation for disable-helm-controller"}),"\n",(0,r.jsx)(s.li,{children:"Omit snapshot list configmap entries for snapshots without extra metadata"}),"\n",(0,r.jsx)(s.li,{children:"Add jitter to client config retry to avoid hammering servers when they are starting up"}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Handle nil pointer when runtime core is not ready in etcd ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8887",children:"(#8887)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Improve dualStack log ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8828",children:"(#8828)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Bump dynamiclistener; reduce snapshot controller log spew ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8902",children:"(#8902)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:"Bumped dynamiclistener to address a race condition that could cause a server to fail to sync its certificates into the Kubernetes secret"}),"\n",(0,r.jsx)(s.li,{children:"Reduced etcd snapshot log spam during initial cluster startup"}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Remove depends_on for e2e step; fix cert rotate e2e ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8907",children:"(#8907)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Fix etcd snapshot S3 issues ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8937",children:"(#8937)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:"Don't apply S3 retention if S3 client failed to initialize"}),"\n",(0,r.jsx)(s.li,{children:"Don't request metadata when listing S3 snapshots"}),"\n",(0,r.jsx)(s.li,{children:"Print key instead of file path in snapshot metadata log message"}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Update to v1.27.8 and Go to 1.20.11 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8921",children:"(#8921)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Remove s390x ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8999",children:"(#8999)"})]}),"\n"]}),"\n",(0,r.jsx)(s.hr,{}),"\n",(0,r.jsxs)(s.h2,{id:"release-v1277k3s2",children:["Release ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/releases/tag/v1.27.7+k3s2",children:"v1.27.7+k3s2"})]}),"\n",(0,r.jsx)(s.p,{children:"This release updates Kubernetes to v1.27.7, and fixes a number of issues."}),"\n",(0,r.jsxs)(s.p,{children:["For more details on what's new, see the ",(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.27.md#changelog-since-v1277",children:"Kubernetes release notes"}),"."]}),"\n",(0,r.jsx)(s.h3,{id:"changes-since-v1277k3s1",children:"Changes since v1.27.7+k3s1:"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsxs)(s.li,{children:["Fix SystemdCgroup in templates_linux.go ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8765",children:"(#8765)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:"Fixed an issue with identifying additional container runtimes"}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Update traefik chart to v25.0.0 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8775",children:"(#8775)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Update traefik to fix registry value ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8789",children:"(#8789)"})]}),"\n"]}),"\n",(0,r.jsx)(s.hr,{}),"\n",(0,r.jsxs)(s.h2,{id:"release-v1277k3s1",children:["Release ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/releases/tag/v1.27.7+k3s1",children:"v1.27.7+k3s1"})]}),"\n",(0,r.jsx)(s.p,{children:"This release updates Kubernetes to v1.27.7, and fixes a number of issues."}),"\n",(0,r.jsxs)(s.p,{children:["For more details on what's new, see the ",(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.27.md#changelog-since-v1276",children:"Kubernetes release notes"}),"."]}),"\n",(0,r.jsx)(s.h3,{id:"changes-since-v1276k3s1",children:"Changes since v1.27.6+k3s1:"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsxs)(s.li,{children:["Fix error reporting ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8411",children:"(#8411)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Add context to flannel errors ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8419",children:"(#8419)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Include the interface name in the error message ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8435",children:"(#8435)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Update kube-router ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8443",children:"(#8443)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Add extraArgs to tailscale ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8464",children:"(#8464)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Added error when cluster reset while using server flag ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8455",children:"(#8455)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:"The user will receive a error when --cluster-reset with the --server flag"}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Cluster reset from non bootstrap nodes ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8451",children:"(#8451)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Take IPFamily precedence based on order ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8504",children:"(#8504)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Fix spellcheck problem ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8509",children:"(#8509)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Network defaults are duplicated, remove one ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8551",children:"(#8551)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Advertise address integration test ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8516",children:"(#8516)"})]}),"\n",(0,r.jsxs)(s.li,{children:["System agent push tags fix ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8569",children:"(#8569)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Fixed tailscale node IP dualstack mode in case of IPv4 only node ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8558",children:"(#8558)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Server Token Rotation ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8576",children:"(#8576)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsxs)(s.li,{children:["Users can now rotate the server token using ",(0,r.jsx)(s.code,{children:"k3s token rotate -t --new-token "}),". After command succeeds, all server nodes must be restarted with the new token."]}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["E2E Domain Drone Cleanup ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8582",children:"(#8582)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Clear remove annotations on cluster reset ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8587",children:"(#8587)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:"Fixed an issue that could cause k3s to attempt to remove members from the etcd cluster immediately following a cluster-reset/restore, if they were queued for removal at the time the snapshot was taken."}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Use IPv6 in case is the first configured IP with dualstack ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8597",children:"(#8597)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Backports for 2023-10 release ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8615",children:"(#8615)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Update kube-router package in build script ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8634",children:"(#8634)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Add etcd-only/control-plane-only server test and fix control-plane-only server crash ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8642",children:"(#8642)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Use ",(0,r.jsx)(s.code,{children:"version.Program"})," not K3s in token rotate logs ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8656",children:"(#8656)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Windows agent support ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8650",children:"(#8650)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Fix CloudDualStackNodeIPs feature-gate inconsistency ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8669",children:"(#8669)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Add --image-service-endpoint flag (#8279) ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8662",children:"(#8662)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsxs)(s.li,{children:["Add ",(0,r.jsx)(s.code,{children:"--image-service-endpoint"})," flag to specify an external image service socket."]}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Backport etcd fixes ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8690",children:"(#8690)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:"Re-enable etcd endpoint auto-sync"}),"\n",(0,r.jsx)(s.li,{children:"Manually requeue configmap reconcile when no nodes have reconciled snapshots"}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Update to v1.27.7 and Go to v1.20.10 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8681",children:"(#8681)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Fix s3 snapshot restore ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8733",children:"(#8733)"})]}),"\n"]}),"\n",(0,r.jsx)(s.hr,{}),"\n",(0,r.jsxs)(s.h2,{id:"release-v1276k3s1",children:["Release ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/releases/tag/v1.27.6+k3s1",children:"v1.27.6+k3s1"})]}),"\n",(0,r.jsx)(s.p,{children:"This release updates Kubernetes to v1.27.6, and fixes a number of issues."}),"\n",(0,r.jsxs)(s.p,{children:["For more details on what's new, see the ",(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.27.md#changelog-since-v1275",children:"Kubernetes release notes"}),"."]}),"\n",(0,r.jsx)(s.h3,{id:"changes-since-v1275k3s1",children:"Changes since v1.27.5+k3s1:"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsxs)(s.li,{children:["Bump kine to v0.10.3 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8324",children:"(#8324)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Update to v1.27.6 and Go to 1.20.8 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8356",children:"(#8356)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:"Bump embedded containerd to v1.7.6"}),"\n",(0,r.jsx)(s.li,{children:"Bump embedded stargz-snapshotter plugin to latest"}),"\n",(0,r.jsx)(s.li,{children:"Fixed intermittent drone CI failures due to race conditions in test environment setup scripts"}),"\n",(0,r.jsx)(s.li,{children:"Fixed CI failures due to changes to api discovery changes in Kubernetes 1.28"}),"\n"]}),"\n"]}),"\n"]}),"\n",(0,r.jsx)(s.hr,{}),"\n",(0,r.jsxs)(s.h2,{id:"release-v1275k3s1",children:["Release ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/releases/tag/v1.27.5+k3s1",children:"v1.27.5+k3s1"})]}),"\n",(0,r.jsx)(s.p,{children:"This release updates Kubernetes to v1.27.5, and fixes a number of issues."}),"\n",(0,r.jsx)(s.admonition,{title:"Important",type:"warning",children:(0,r.jsxs)(s.p,{children:["This release includes support for remediating CVE-2023-32187, a potential Denial of Service attack vector on K3s servers. See ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/security/advisories/GHSA-m4hf-6vgr-75r2",children:"https://github.com/k3s-io/k3s/security/advisories/GHSA-m4hf-6vgr-75r2"})," for more information, including mandatory steps necessary to harden clusters against this vulnerability."]})}),"\n",(0,r.jsxs)(s.p,{children:["For more details on what's new, see the ",(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.27.md#changelog-since-v1274",children:"Kubernetes release notes"}),"."]}),"\n",(0,r.jsx)(s.h3,{id:"changes-since-v1274k3s1",children:"Changes since v1.27.4+k3s1:"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsxs)(s.li,{children:["Update cni plugins version to v1.3.0 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8056",children:"(#8056)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:"Upgraded cni-plugins to v1.3.0"}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Update flannel to v0.22.1 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8057",children:"(#8057)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:"Update flannel to v0.22.1"}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["ADR on secrets encryption v3 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7938",children:"(#7938)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Unit test for MustFindString ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8013",children:"(#8013)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Add support for using base template in etc/containerd/config.toml.tmpl ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7991",children:"(#7991)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsxs)(s.li,{children:["User-provided containerd config templates may now use ",(0,r.jsx)(s.code,{children:'{{ template "base" . }}'})," to include the default K3s template content. This makes it easier to maintain user configuration if the only need is to add additional sections to the file."]}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Make apiserver egress args conditional on egress-selector-mode ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7972",children:"(#7972)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsxs)(s.li,{children:["K3s no longer enables the apiserver's ",(0,r.jsx)(s.code,{children:"enable-aggregator-routing"})," flag when the egress proxy is not being used to route connections to in-cluster endpoints."]}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Security bump to ",(0,r.jsx)(s.code,{children:"docker/distribution"})," ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8047",children:"(#8047)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Fix coreos multiple installs ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8083",children:"(#8083)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Update stable channel to v1.27.4+k3s1 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8067",children:"(#8067)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Fix tailscale bug with ip modes ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8077",children:"(#8077)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Consolidate CopyFile functions ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8079",children:"(#8079)"})]}),"\n",(0,r.jsxs)(s.li,{children:["E2E: Support GOCOVER for more tests + fixes ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8080",children:"(#8080)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Fix typo in terraform/README.md ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8090",children:"(#8090)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Add FilterCN function to prevent SAN Stuffing ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8085",children:"(#8085)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:"K3s's external apiserver listener now declines to add to its certificate any subject names not associated with the kubernetes apiserver service, server nodes, or values of the --tls-san option. This prevents the certificate's SAN list from being filled with unwanted entries."}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Bump docker/docker to master commit; cri-dockerd to 0.3.4 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8092",children:"(#8092)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:"Bump docker/docker module version to fix issues with cri-dockerd caused by recent releases of golang rejecting invalid host headers sent by the docker client."}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Bump versions for etcd, containerd, runc ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8109",children:"(#8109)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:"Updated the embedded containerd to v1.7.3+k3s1"}),"\n",(0,r.jsx)(s.li,{children:"Updated the embedded runc to v1.1.8"}),"\n",(0,r.jsx)(s.li,{children:"Updated the embedded etcd to v3.5.9+k3s1"}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Etcd snapshots retention when node name changes ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8099",children:"(#8099)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Bump kine to v0.10.2 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8125",children:"(#8125)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:"Updated kine to v0.10.2"}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Remove terraform package ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8136",children:"(#8136)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Fix etcd-snapshot delete when etcd-s3 is true ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8110",children:"(#8110)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Add --disable-cloud-controller and --disable-kube-proxy test ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8018",children:"(#8018)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Use ",(0,r.jsx)(s.code,{children:"go list -m"})," instead of grep to look up versions ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8138",children:"(#8138)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Use VERSION_K8S in tests instead of grep go.mod ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8147",children:"(#8147)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Fix for Kubeflag Integration test ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8154",children:"(#8154)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Fix for cluster-reset backup from s3 when etcd snapshots are disabled ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8155",children:"(#8155)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Run integration test CI in parallel ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8156",children:"(#8156)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Bump Trivy version ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8150",children:"(#8150)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Bump Trivy version ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8178",children:"(#8178)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Fixed the etcd retention to delete orphaned snapshots based on the date ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8177",children:"(#8177)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Bump dynamiclistener ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8193",children:"(#8193)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:"Bumped dynamiclistener to address an issue that could cause the apiserver/supervisor listener on 6443 to stop serving requests on etcd-only nodes."}),"\n",(0,r.jsx)(s.li,{children:"The K3s external apiserver/supervisor listener on 6443 now sends a complete certificate chain in the TLS handshake."}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Bump helm-controller/klipper-helm versions ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8204",children:"(#8204)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsxs)(s.li,{children:["The version of ",(0,r.jsx)(s.code,{children:"helm"})," used by the bundled helm controller's job image has been updated to v3.12.3"]}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["E2E: Add test for ",(0,r.jsx)(s.code,{children:"k3s token"})," ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8184",children:"(#8184)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Move flannel to 0.22.2 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8219",children:"(#8219)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:"Move flannel to v0.22.2"}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Update to v1.27.5 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8236",children:"(#8236)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Add new CLI flag to enable TLS SAN CN filtering ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8257",children:"(#8257)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsxs)(s.li,{children:["Added a new ",(0,r.jsx)(s.code,{children:"--tls-san-security"})," option. This flag defaults to false, but can be set to true to disable automatically adding SANs to the server's TLS certificate to satisfy any hostname requested by a client."]}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Add RWMutex to address controller ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8273",children:"(#8273)"})]}),"\n"]}),"\n",(0,r.jsx)(s.hr,{}),"\n",(0,r.jsxs)(s.h2,{id:"release-v1274k3s1",children:["Release ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/releases/tag/v1.27.4+k3s1",children:"v1.27.4+k3s1"})]}),"\n",(0,r.jsxs)(s.p,{children:["This release updates Kubernetes to v1.27.4, and fixes a number of issues.",(0,r.jsx)(s.br,{}),"\n","\u200b\r\nFor more details on what's new, see the ",(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.27.md#changelog-since-v1273",children:"Kubernetes release notes"}),".\r\n\u200b"]}),"\n",(0,r.jsx)(s.h3,{id:"changes-since-v1273k3s1",children:"Changes since v1.27.3+k3s1:"}),"\n",(0,r.jsx)(s.p,{children:"\u200b"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsxs)(s.li,{children:["Pkg imported more than once ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7803",children:"(#7803)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Faster K3s Binary Build Option ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7805",children:"(#7805)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Update stable channel to v1.27.3+k3s1 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7827",children:"(#7827)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Adding cli to custom klipper helm image ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7682",children:"(#7682)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:"The default helm-controller job image can now be overridden with the --helm-job-image CLI flag"}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Check if we are on ipv4, ipv6 or dualStack when doing tailscale ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7838",children:"(#7838)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Remove file_windows.go ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7845",children:"(#7845)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Add a k3s data directory location specified by the cli ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7791",children:"(#7791)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Fix e2e startup flaky test ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7839",children:"(#7839)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Allow k3s to customize apiServerPort on helm-controller ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7834",children:"(#7834)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Fall back to basic/bearer auth when node identity auth is rejected ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7836",children:"(#7836)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:"Resolved an issue that caused agents joined with kubeadm-style bootstrap tokens to fail to rejoin the cluster when their node object is deleted."}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Fix code spell check ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7858",children:"(#7858)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Add e2e s3 test ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7833",children:"(#7833)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Warn that v1.28 will deprecate reencrypt/prepare ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7848",children:"(#7848)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Support setting control server URL for Tailscale ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7807",children:"(#7807)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:"Support connecting tailscale to a separate server (e.g. headscale)"}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Improve for K3s release Docs ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7864",children:"(#7864)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Fix rootless node password location ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7887",children:"(#7887)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Bump google.golang.org/grpc from 1.51.0 to 1.53.0 in /tests/terraform ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7879",children:"(#7879)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Add retry for clone step ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7862",children:"(#7862)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Generation of certificates and keys for etcd gated if etcd is disabled. ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6998",children:"(#6998)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Don't use zgrep in ",(0,r.jsx)(s.code,{children:"check-config"})," if apparmor profile is enforced ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7939",children:"(#7939)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Fix image_scan.sh script and download trivy version ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7950",children:"(#7950)"})]}),"\n",(0,r.jsxs)(s.li,{children:['Revert "Warn that v1.28 will deprecate reencrypt/prepare" ',(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7977",children:"(#7977)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Adjust default kubeconfig file permissions ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7978",children:"(#7978)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Fix update go version command on release documentation ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8028",children:"(#8028)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Update to v1.27.4 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/8014",children:"(#8014)"}),"\r\n\u200b"]}),"\n"]}),"\n",(0,r.jsx)(s.hr,{}),"\n",(0,r.jsxs)(s.h2,{id:"release-v1273k3s1",children:["Release ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/releases/tag/v1.27.3+k3s1",children:"v1.27.3+k3s1"})]}),"\n",(0,r.jsx)(s.p,{children:"This release updates Kubernetes to v1.27.3, and fixes a number of issues."}),"\n",(0,r.jsxs)(s.p,{children:["For more details on what's new, see the ",(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.27.md#changelog-since-v1272",children:"Kubernetes release notes"}),"."]}),"\n",(0,r.jsx)(s.h3,{id:"changes-since-v1272k3s1",children:"Changes since v1.27.2+k3s1:"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsxs)(s.li,{children:["Update flannel version ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7628",children:"(#7628)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:"Update flannel to v0.22.0"}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Add el9 selinux rpm ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7635",children:"(#7635)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Update channels ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7634",children:"(#7634)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Allow coredns override extensions ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7583",children:"(#7583)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsxs)(s.li,{children:["The ",(0,r.jsx)(s.code,{children:"coredns-custom"})," ConfigMap now allows for ",(0,r.jsx)(s.code,{children:"*.override"})," sections to be included in the ",(0,r.jsx)(s.code,{children:".:53"})," default server block."]}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Bump klipper-lb to v0.4.4 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7617",children:"(#7617)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:"Bumped klipper-lb image to v0.4.4 to resolve an issue that prevented access to ServiceLB ports from localhost when the Service ExternalTrafficPolicy was set to Local."}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Bump metrics-server to v0.6.3 and update tls-cipher-suites ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7564",children:"(#7564)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:"The bundled metrics-server has been bumped to v0.6.3, and now uses only secure TLS ciphers by default."}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Do not use the admin kubeconfig for the supervisor and core controllers ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7616",children:"(#7616)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:"The K3s core controllers (supervisor, deploy, and helm) no longer use the admin kubeconfig. This makes it easier to determine from access and audit logs which actions are performed by the system, and which are performed by an administrative user."}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Bump golang",":alpine"," image version ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7619",children:"(#7619)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Make LB image configurable when compiling k3s ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7626",children:"(#7626)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Bump vagrant libvirt with fix for plugin installs ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7605",children:"(#7605)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Add format command on Makefile ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7437",children:"(#7437)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Use el8 rpm for fedora 38 and 39 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7664",children:"(#7664)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Check variant before version to decide rpm target and packager closes #7666 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7667",children:"(#7667)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Test Coverage Reports for E2E tests ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7526",children:"(#7526)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Soft-fail on node password verification if the secret cannot be created ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7655",children:"(#7655)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:"K3s now allows nodes to join the cluster even if the node password secret cannot be created at the time the node joins. The secret create will be retried in the background. This resolves a potential deadlock created by fail-closed validating webhooks that block secret creation, where the webhook is unavailable until new nodes join the cluster to run the webhook pod."}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Enable containerd aufs/devmapper/zfs snapshotter plugins ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7661",children:"(#7661)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:"The bundled containerd's aufs/devmapper/zfs snapshotter plugins have been restored. These were unintentionally omitted when moving containerd back into the k3s multicall binary in the previous release."}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Bump docker go.mod ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7681",children:"(#7681)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Shortcircuit commands with version or help flags ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7683",children:"(#7683)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsxs)(s.li,{children:["Non root users can now call ",(0,r.jsx)(s.code,{children:"k3s --help"})," and ",(0,r.jsx)(s.code,{children:"k3s --version"})," commands without running into permission errors over the default config file."]}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Bump Trivy version ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7672",children:"(#7672)"})]}),"\n",(0,r.jsxs)(s.li,{children:["E2E: Capture coverage of K3s subcommands ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7686",children:"(#7686)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Integrate tailscale into k3s ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7352",children:"(#7352)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:"Integration of tailscale VPN into k3s"}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Add private registry e2e test ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7653",children:"(#7653)"})]}),"\n",(0,r.jsxs)(s.li,{children:["E2E: Remove unnecessary daemonset addition/deletion ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7696",children:"(#7696)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Add issue template for OS validation ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7695",children:"(#7695)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Fix spelling check ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7740",children:"(#7740)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Remove useless libvirt config ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7745",children:"(#7745)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Bump helm-controller to v0.15.0 for create-namespace support ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7716",children:"(#7716)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:"The embedded helm controller has been bumped to v0.15.0, and now supports creating the chart's target namespace if it does not exist."}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Fix error logging in tailscale ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7776",children:"(#7776)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Add commands to remove advertised routes of tailscale in k3s-killall.sh ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7777",children:"(#7777)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Update Kubernetes to v1.27.3 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7790",children:"(#7790)"})]}),"\n"]}),"\n",(0,r.jsx)(s.hr,{}),"\n",(0,r.jsxs)(s.h2,{id:"release-v1272k3s1",children:["Release ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/releases/tag/v1.27.2+k3s1",children:"v1.27.2+k3s1"})]}),"\n",(0,r.jsx)(s.p,{children:"This release updates Kubernetes to v1.27.2, and fixes a number of issues."}),"\n",(0,r.jsxs)(s.p,{children:["For more details on what's new, see the ",(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.27.md#changelog-since-v1271",children:"Kubernetes release notes"}),"."]}),"\n",(0,r.jsx)(s.h3,{id:"changes-since-v1271k3s1",children:"Changes since v1.27.1+k3s1:"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsxs)(s.li,{children:["Ensure that klog verbosity is set to the same level as logrus ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7303",children:"(#7303)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Create CRDs with schema ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7308",children:"(#7308)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:"Fixed an issue where Addon, HelmChart, and HelmChartConfig CRDs were created without structural schema, allowing the creation of custom resources of these types with invalid content."}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Bump k3s-root for aarch64 page size fix ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7364",children:"(#7364)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:"K3s once again supports aarch64 nodes with page size > 4k"}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Bump Runc and Containerd ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7339",children:"(#7339)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Add integration tests for etc-snapshot server flags and refactor /tests/integration/integration.go/K3sStartServer ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7300",children:"(#7300)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Bump traefik to v2.9.10 / chart 21.2.0 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7324",children:"(#7324)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:"The packaged Traefik version has been bumped to v2.9.10 / chart 21.2.0"}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Add longhorn storage test ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/6445",children:"(#6445)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Improve error message when CLI wrapper Exec fails ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7373",children:"(#7373)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsxs)(s.li,{children:["K3s now prints a more meaningful error when attempting to run from a filesystem mounted ",(0,r.jsx)(s.code,{children:"noexec"}),"."]}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Fix issues with ",(0,r.jsx)(s.code,{children:"--disable-agent"})," and ",(0,r.jsx)(s.code,{children:"--egress-selector-mode=pod|cluster"})," ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7331",children:"(#7331)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:"Servers started with the (experimental) --disable-agent flag no longer attempt to run the tunnel authorizer agent component."}),"\n",(0,r.jsx)(s.li,{children:"Fixed an regression that prevented the pod and cluster egress-selector modes from working properly."}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:['Retry cluster join on "too many learners" error ',(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7351",children:"(#7351)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:'K3s now retries the cluster join operation when receiving a "too many learners" error from etcd. This most frequently occurred when attempting to add multiple servers at the same time.'}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Fix MemberList error handling and incorrect etcd-arg passthrough ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7371",children:"(#7371)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:"K3s now correctly passes through etcd-args to the temporary etcd that is used to extract cluster bootstrap data when restarting managed etcd nodes."}),"\n",(0,r.jsx)(s.li,{children:"K3s now properly handles errors obtaining the current etcd cluster member list when a new server is joining the managed etcd cluster."}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Bump Trivy version ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7383",children:"(#7383)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Handle multiple arguments with StringSlice flags ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7380",children:"(#7380)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Add v1.27 channel ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7387",children:"(#7387)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Enable FindString to search dotD config files ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7323",children:"(#7323)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Migrate netutil methods into /util/net.go ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7422",children:"(#7422)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Local-storage: Fix permission ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7217",children:"(#7217)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Bump cni plugins to v1.2.0-k3s1 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7425",children:"(#7425)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:"The bundled CNI plugins have been upgraded to v1.2.0-k3s1. The bandwidth and firewall plugins are now included in the bundle."}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Add dependabot label and reviewer ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7423",children:"(#7423)"})]}),"\n",(0,r.jsxs)(s.li,{children:["E2E: Startup test cleanup + RunCommand Enhancement ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7388",children:"(#7388)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Fail to validate server tokens that use bootstrap id/secret format ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7389",children:"(#7389)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsxs)(s.li,{children:["K3s now exits with a proper error message when the server token uses a bootstrap token ",(0,r.jsx)(s.code,{children:"id.secret"})," format."]}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Fix token startup test ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7442",children:"(#7442)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Bump kine to v0.10.1 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7414",children:"(#7414)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsxs)(s.li,{children:["The embedded kine version has been bumped to v0.10.1. This replaces the legacy ",(0,r.jsx)(s.code,{children:"lib/pq"})," postgres driver with ",(0,r.jsx)(s.code,{children:"pgx"}),"."]}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Add kube-* server flags integration tests ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7416",children:"(#7416)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Add support for ",(0,r.jsx)(s.code,{children:"-cover"})," + integration test code coverage ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7415",children:"(#7415)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Bump kube-router version to fix a bug when a port name is used ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7454",children:"(#7454)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Consistently use constant-time comparison of password hashes instead of bare password strings ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7455",children:"(#7455)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Bump containerd to v1.7.0 and move back into multicall binary ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7418",children:"(#7418)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsxs)(s.li,{children:["The embedded containerd version has been bumped to ",(0,r.jsx)(s.code,{children:"v1.7.0-k3s1"}),", and has been reintegrated into the main k3s binary for a significant savings in release artifact size."]}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Adding PITS and Getdeck Beiboot as adopters thanks to Schille and Miw\u2026 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7524",children:"(#7524)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Bump helm-controller version for repo auth/ca support ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7525",children:"(#7525)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:"The embedded Helm controller now supports authenticating to chart repositories via credentials stored in a Secret, as well as passing repo CAs via ConfigMap."}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Bump containerd/runc to v1.7.1-k3s1/v1.1.7 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7533",children:"(#7533)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsx)(s.li,{children:"The bundled containerd and runc versions have been bumped to v1.7.1-k3s1/v1.1.7"}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Wrap error stating that it is coming from netpol ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7539",children:"(#7539)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Add Rotation certification Check, remove func to restart agents ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7097",children:"(#7097)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Bump alpine from 3.17 to 3.18 in /package ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7550",children:"(#7550)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Bump alpine from 3.17 to 3.18 in /conformance ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7551",children:"(#7551)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Add '-all' flag to apply to inactive systemd units ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7567",children:"(#7567)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Update to v1.27.2-k3s1 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7575",children:"(#7575)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Fix iptables rules clean during upgrade ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7591",children:"(#7591)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Pin emicklei/go-restful to v3.9.0 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7597",children:"(#7597)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Add el9 selinux rpm ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7443",children:"(#7443)"})]}),"\n",(0,r.jsxs)(s.li,{children:['Revert "Add el9 selinux rpm (#7443)" ',(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7608",children:"(#7608)"})]}),"\n"]}),"\n",(0,r.jsx)(s.hr,{}),"\n",(0,r.jsxs)(s.h2,{id:"release-v1271k3s1",children:["Release ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/releases/tag/v1.27.1+k3s1",children:"v1.27.1+k3s1"})]}),"\n",(0,r.jsx)(s.p,{children:"This release is K3S's first in the v1.27 line. This release updates Kubernetes to v1.27.1."}),"\n",(0,r.jsxs)(s.p,{children:["Before upgrading from earlier releases, be sure to read the Kubernetes ",(0,r.jsx)(s.a,{href:"https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.27.md#urgent-upgrade-notes",children:"Urgent Upgrade Notes"}),"."]}),"\n",(0,r.jsx)(s.h3,{id:"changes-since-v1264k3s1",children:"Changes since v1.26.4+k3s1:"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsxs)(s.li,{children:["Kubernetes 1.27.1 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7271",children:"(#7271)"})]}),"\n",(0,r.jsxs)(s.li,{children:["V1.27.1 CLI Deprecation ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7311",children:"(#7311)"}),"\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsxs)(s.li,{children:[(0,r.jsx)(s.code,{children:"--flannel-backed=wireguard"})," has been completely replaced with ",(0,r.jsx)(s.code,{children:"--flannel-backend=wireguard-native"})]}),"\n",(0,r.jsxs)(s.li,{children:["The ",(0,r.jsx)(s.code,{children:"k3s etcd-snapshot"})," command will now print a help message, to save a snapshot use: ",(0,r.jsx)(s.code,{children:"k3s etcd-snapshot save"})]}),"\n",(0,r.jsxs)(s.li,{children:["The following flags will now cause fatal errors (with full removal coming in v1.28.0):","\n",(0,r.jsxs)(s.ul,{children:["\n",(0,r.jsxs)(s.li,{children:[(0,r.jsx)(s.code,{children:"--flannel-backed=ipsec"}),": replaced with ",(0,r.jsx)(s.code,{children:"--flannel-backend=wireguard-native"})," ",(0,r.jsx)(s.a,{href:"https://docs.k3s.io/installation/network-options#migrating-from-wireguard-or-ipsec-to-wireguard-native",children:"see docs for more info."})]}),"\n",(0,r.jsxs)(s.li,{children:["Supplying multiple ",(0,r.jsx)(s.code,{children:"--flannel-backend"})," values is no longer valid. Use ",(0,r.jsx)(s.code,{children:"--flannel-conf"})," instead."]}),"\n"]}),"\n"]}),"\n"]}),"\n"]}),"\n",(0,r.jsxs)(s.li,{children:["Changed command -v redirection for iptables bin check ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7315",children:"(#7315)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Update channel server for april 2023 ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7327",children:"(#7327)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Bump cri-dockerd ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7347",children:"(#7347)"})]}),"\n",(0,r.jsxs)(s.li,{children:["Cleanup help messages ",(0,r.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/pull/7369",children:"(#7369)"})]}),"\n"]}),"\n",(0,r.jsx)(s.hr,{})]})}function o(e={}){const{wrapper:s}={...(0,n.a)(),...e.components};return s?(0,r.jsx)(s,{...e,children:(0,r.jsx)(a,{...e})}):a(e)}},1151:(e,s,i)=>{i.d(s,{Z:()=>h,a:()=>l});var r=i(7294);const n={},t=r.createContext(n);function l(e){const s=r.useContext(t);return r.useMemo((function(){return"function"==typeof e?e(s):{...s,...e}}),[s,e])}function h(e){let s;return s=e.disableParentContext?"function"==typeof e.components?e.components(n):e.components||n:l(e.components),r.createElement(t.Provider,{value:s},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/e7c9153a.46b96717.js b/assets/js/e7c9153a.1081e35f.js similarity index 98% rename from assets/js/e7c9153a.46b96717.js rename to assets/js/e7c9153a.1081e35f.js index 4c4922eca..62c47cc5c 100644 --- a/assets/js/e7c9153a.46b96717.js +++ b/assets/js/e7c9153a.1081e35f.js @@ -1 +1 @@ -"use strict";(self.webpackChunkk_3_s_docs=self.webpackChunkk_3_s_docs||[]).push([[7544],{1875:(e,t,s)=>{s.r(t),s.d(t,{assets:()=>l,contentTitle:()=>a,default:()=>p,frontMatter:()=>i,metadata:()=>r,toc:()=>c});var o=s(5893),n=s(1151);const i={title:"Related Projects"},a=void 0,r={id:"related-projects",title:"Related Projects",description:"Projects implementing the K3s distribution are welcome additions to help expand the community. This page will introduce you to a range of projects that are related to K3s and can help you further explore its capabilities and potential applications.",source:"@site/docs/related-projects.md",sourceDirName:".",slug:"/related-projects",permalink:"/related-projects",draft:!1,unlisted:!1,editUrl:"https://github.com/k3s-io/docs/edit/main/docs/related-projects.md",tags:[],version:"current",lastUpdatedAt:1723651727e3,frontMatter:{title:"Related Projects"},sidebar:"mySidebar",previous:{title:"v1.24.X",permalink:"/release-notes/v1.24.X"},next:{title:"Known Issues",permalink:"/known-issues"}},l={},c=[{value:"k3s-ansible",id:"k3s-ansible",level:2},{value:"k3sup",id:"k3sup",level:2},{value:"autok3s",id:"autok3s",level:2}];function d(e){const t={a:"a",h2:"h2",p:"p",...(0,n.a)(),...e.components};return(0,o.jsxs)(o.Fragment,{children:[(0,o.jsx)(t.p,{children:"Projects implementing the K3s distribution are welcome additions to help expand the community. This page will introduce you to a range of projects that are related to K3s and can help you further explore its capabilities and potential applications."}),"\n",(0,o.jsx)(t.p,{children:"These projects showcase the versatility and adaptability of K3s in various environments, as well as extensions of K3s. They are all useful in creating large scale High Availability (HA) Kubernetes clusters."}),"\n",(0,o.jsx)(t.h2,{id:"k3s-ansible",children:"k3s-ansible"}),"\n",(0,o.jsxs)(t.p,{children:["For users seeking to bootstrap a multi-node K3s cluster and familiar with ansible, take a look at ",(0,o.jsx)(t.a,{href:"https://github.com/k3s-io/k3s-ansible",children:"k3s-io/k3s-ansible"})," repository. This set of ansible playbooks provides a convenient way to install K3s on your nodes, allowing you to focus on the configuration of your cluster rather than the installation process."]}),"\n",(0,o.jsx)(t.h2,{id:"k3sup",children:"k3sup"}),"\n",(0,o.jsxs)(t.p,{children:["Another project that simplifies the process of setting up a K3s cluster is ",(0,o.jsx)(t.a,{href:"https://github.com/alexellis/k3sup",children:"k3sup"}),". This project,written in golang, only requires ssh access to your nodes. It also provides a convenient way to deploy K3s with external datastores, not just the embedded etcd."]}),"\n",(0,o.jsx)(t.h2,{id:"autok3s",children:"autok3s"}),"\n",(0,o.jsxs)(t.p,{children:["Another provisioning tool, ",(0,o.jsx)(t.a,{href:"https://github.com/cnrancher/autok3s",children:"autok3s"}),", provides a GUI for provising k3s cluster across a range of cloud providers, VMs, and local machines. This tool is useful for users who prefer a graphical interface for provising K3s clusters."]})]})}function p(e={}){const{wrapper:t}={...(0,n.a)(),...e.components};return t?(0,o.jsx)(t,{...e,children:(0,o.jsx)(d,{...e})}):d(e)}},1151:(e,t,s)=>{s.d(t,{Z:()=>r,a:()=>a});var o=s(7294);const n={},i=o.createContext(n);function a(e){const t=o.useContext(i);return o.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function r(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(n):e.components||n:a(e.components),o.createElement(i.Provider,{value:t},e.children)}}}]); \ No newline at end of file +"use strict";(self.webpackChunkk_3_s_docs=self.webpackChunkk_3_s_docs||[]).push([[7544],{1875:(e,t,s)=>{s.r(t),s.d(t,{assets:()=>l,contentTitle:()=>a,default:()=>p,frontMatter:()=>i,metadata:()=>r,toc:()=>c});var o=s(5893),n=s(1151);const i={title:"Related Projects"},a=void 0,r={id:"related-projects",title:"Related Projects",description:"Projects implementing the K3s distribution are welcome additions to help expand the community. This page will introduce you to a range of projects that are related to K3s and can help you further explore its capabilities and potential applications.",source:"@site/docs/related-projects.md",sourceDirName:".",slug:"/related-projects",permalink:"/related-projects",draft:!1,unlisted:!1,editUrl:"https://github.com/k3s-io/docs/edit/main/docs/related-projects.md",tags:[],version:"current",lastUpdatedAt:1723747404e3,frontMatter:{title:"Related Projects"},sidebar:"mySidebar",previous:{title:"v1.24.X",permalink:"/release-notes/v1.24.X"},next:{title:"Known Issues",permalink:"/known-issues"}},l={},c=[{value:"k3s-ansible",id:"k3s-ansible",level:2},{value:"k3sup",id:"k3sup",level:2},{value:"autok3s",id:"autok3s",level:2}];function d(e){const t={a:"a",h2:"h2",p:"p",...(0,n.a)(),...e.components};return(0,o.jsxs)(o.Fragment,{children:[(0,o.jsx)(t.p,{children:"Projects implementing the K3s distribution are welcome additions to help expand the community. This page will introduce you to a range of projects that are related to K3s and can help you further explore its capabilities and potential applications."}),"\n",(0,o.jsx)(t.p,{children:"These projects showcase the versatility and adaptability of K3s in various environments, as well as extensions of K3s. They are all useful in creating large scale High Availability (HA) Kubernetes clusters."}),"\n",(0,o.jsx)(t.h2,{id:"k3s-ansible",children:"k3s-ansible"}),"\n",(0,o.jsxs)(t.p,{children:["For users seeking to bootstrap a multi-node K3s cluster and familiar with ansible, take a look at ",(0,o.jsx)(t.a,{href:"https://github.com/k3s-io/k3s-ansible",children:"k3s-io/k3s-ansible"})," repository. This set of ansible playbooks provides a convenient way to install K3s on your nodes, allowing you to focus on the configuration of your cluster rather than the installation process."]}),"\n",(0,o.jsx)(t.h2,{id:"k3sup",children:"k3sup"}),"\n",(0,o.jsxs)(t.p,{children:["Another project that simplifies the process of setting up a K3s cluster is ",(0,o.jsx)(t.a,{href:"https://github.com/alexellis/k3sup",children:"k3sup"}),". This project,written in golang, only requires ssh access to your nodes. It also provides a convenient way to deploy K3s with external datastores, not just the embedded etcd."]}),"\n",(0,o.jsx)(t.h2,{id:"autok3s",children:"autok3s"}),"\n",(0,o.jsxs)(t.p,{children:["Another provisioning tool, ",(0,o.jsx)(t.a,{href:"https://github.com/cnrancher/autok3s",children:"autok3s"}),", provides a GUI for provising k3s cluster across a range of cloud providers, VMs, and local machines. This tool is useful for users who prefer a graphical interface for provising K3s clusters."]})]})}function p(e={}){const{wrapper:t}={...(0,n.a)(),...e.components};return t?(0,o.jsx)(t,{...e,children:(0,o.jsx)(d,{...e})}):d(e)}},1151:(e,t,s)=>{s.d(t,{Z:()=>r,a:()=>a});var o=s(7294);const n={},i=o.createContext(n);function a(e){const t=o.useContext(i);return o.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function r(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(n):e.components||n:a(e.components),o.createElement(i.Provider,{value:t},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/ea0a4c6d.7bb66b21.js b/assets/js/ea0a4c6d.819fb6e3.js similarity index 99% rename from assets/js/ea0a4c6d.7bb66b21.js rename to assets/js/ea0a4c6d.819fb6e3.js index 101f1bca9..6fc710663 100644 --- a/assets/js/ea0a4c6d.7bb66b21.js +++ b/assets/js/ea0a4c6d.819fb6e3.js @@ -1 +1 @@ -"use strict";(self.webpackChunkk_3_s_docs=self.webpackChunkk_3_s_docs||[]).push([[791],{9555:(e,n,t)=>{t.r(n),t.d(n,{assets:()=>d,contentTitle:()=>o,default:()=>h,frontMatter:()=>a,metadata:()=>i,toc:()=>l});var s=t(5893),r=t(1151);const a={title:"High Availability External DB"},o=void 0,i={id:"datastore/ha",title:"High Availability External DB",description:"This section describes how to install a high-availability K3s cluster with an external database.",source:"@site/docs/datastore/ha.md",sourceDirName:"datastore",slug:"/datastore/ha",permalink:"/datastore/ha",draft:!1,unlisted:!1,editUrl:"https://github.com/k3s-io/docs/edit/main/docs/datastore/ha.md",tags:[],version:"current",lastUpdatedAt:1723651727e3,frontMatter:{title:"High Availability External DB"},sidebar:"mySidebar",previous:{title:"High Availability Embedded etcd",permalink:"/datastore/ha-embedded"},next:{title:"Cluster Load Balancer",permalink:"/datastore/cluster-loadbalancer"}},d={},l=[{value:"Installation Outline",id:"installation-outline",level:2},{value:"1. Create an External Datastore",id:"1-create-an-external-datastore",level:3},{value:"2. Launch Server Nodes",id:"2-launch-server-nodes",level:3},{value:"3. Optional: Join Additional Server Nodes",id:"3-optional-join-additional-server-nodes",level:3},{value:"4. Optional: Configure a Fixed Registration Address",id:"4-optional-configure-a-fixed-registration-address",level:3},{value:"5. Optional: Join Agent Nodes",id:"5-optional-join-agent-nodes",level:3}];function c(e){const n={a:"a",admonition:"admonition",code:"code",h2:"h2",h3:"h3",li:"li",p:"p",pre:"pre",strong:"strong",ul:"ul",...(0,r.a)(),...e.components};return(0,s.jsxs)(s.Fragment,{children:[(0,s.jsx)(n.p,{children:"This section describes how to install a high-availability K3s cluster with an external database."}),"\n",(0,s.jsx)(n.admonition,{type:"note",children:(0,s.jsxs)(n.p,{children:["To rapidly deploy large HA clusters, see ",(0,s.jsx)(n.a,{href:"/related-projects",children:"Related Projects"})]})}),"\n",(0,s.jsx)(n.p,{children:"Single server clusters can meet a variety of use cases, but for environments where uptime of the Kubernetes control plane is critical, you can run K3s in an HA configuration. An HA K3s cluster is composed of:"}),"\n",(0,s.jsxs)(n.ul,{children:["\n",(0,s.jsxs)(n.li,{children:["Two or more ",(0,s.jsx)(n.strong,{children:"server nodes"})," that will serve the Kubernetes API and run other control plane services"]}),"\n",(0,s.jsxs)(n.li,{children:["An ",(0,s.jsx)(n.strong,{children:"external datastore"})," (as opposed to the embedded SQLite datastore used in single-server setups)"]}),"\n",(0,s.jsxs)(n.li,{children:["Optional: Zero or more ",(0,s.jsx)(n.strong,{children:"agent nodes"})," that are designated to run your apps and services"]}),"\n",(0,s.jsxs)(n.li,{children:["Optional: A ",(0,s.jsx)(n.strong,{children:"fixed registration address"})," for agent nodes to register with the cluster"]}),"\n"]}),"\n",(0,s.jsxs)(n.p,{children:["For more details on how these components work together, refer to the ",(0,s.jsx)(n.a,{href:"/architecture#high-availability-k3s",children:"architecture section."})]}),"\n",(0,s.jsx)(n.h2,{id:"installation-outline",children:"Installation Outline"}),"\n",(0,s.jsx)(n.p,{children:"Setting up an HA cluster requires the following steps:"}),"\n",(0,s.jsx)(n.h3,{id:"1-create-an-external-datastore",children:"1. Create an External Datastore"}),"\n",(0,s.jsxs)(n.p,{children:["You will first need to create an external datastore for the cluster. See the ",(0,s.jsx)(n.a,{href:"/datastore/",children:"Cluster Datastore Options"})," documentation for more details."]}),"\n",(0,s.jsx)(n.h3,{id:"2-launch-server-nodes",children:"2. Launch Server Nodes"}),"\n",(0,s.jsxs)(n.p,{children:["K3s requires two or more server nodes for this HA configuration. See the ",(0,s.jsx)(n.a,{href:"/installation/requirements",children:"Requirements"})," guide for minimum machine requirements."]}),"\n",(0,s.jsxs)(n.p,{children:["When running the ",(0,s.jsx)(n.code,{children:"k3s server"})," command on these nodes, you must set the ",(0,s.jsx)(n.code,{children:"datastore-endpoint"})," parameter so that K3s knows how to connect to the external datastore. The ",(0,s.jsx)(n.code,{children:"token"})," parameter can also be used to set a deterministic token when adding nodes. When empty, this token will be generated automatically for further use."]}),"\n",(0,s.jsxs)(n.p,{children:["For example, a command like the following could be used to install the K3s server with a MySQL database as the external datastore and ",(0,s.jsx)(n.a,{href:"/cli/server#cluster-options",children:"set a token"}),":"]}),"\n",(0,s.jsx)(n.pre,{children:(0,s.jsx)(n.code,{className:"language-bash",children:'curl -sfL https://get.k3s.io | sh -s - server \\\n --token=SECRET \\\n --datastore-endpoint="mysql://username:password@tcp(hostname:3306)/database-name" \\\n --tls-san= # Optional, needed if using a fixed registration address\n'})}),"\n",(0,s.jsxs)(n.p,{children:["The datastore endpoint format differs based on the database type. For details, refer to the section on ",(0,s.jsx)(n.a,{href:"/datastore/#datastore-endpoint-format-and-functionality",children:"datastore endpoint formats."})]}),"\n",(0,s.jsxs)(n.p,{children:["To configure TLS certificates when launching server nodes, refer to the ",(0,s.jsx)(n.a,{href:"/datastore/#external-datastore-configuration-parameters",children:"datastore configuration guide."})]}),"\n",(0,s.jsx)(n.admonition,{type:"note",children:(0,s.jsxs)(n.p,{children:["The same installation options available to single-server installs are also available for high-availability installs. For more details, see the ",(0,s.jsx)(n.a,{href:"/installation/configuration",children:"Configuration Options"})," documentation."]})}),"\n",(0,s.jsxs)(n.p,{children:["By default, server nodes will be schedulable and thus your workloads can get launched on them. If you wish to have a dedicated control plane where no user workloads will run, you can use taints. The ",(0,s.jsx)(n.code,{children:"node-taint"})," parameter will allow you to configure nodes with taints, for example ",(0,s.jsx)(n.code,{children:"--node-taint CriticalAddonsOnly=true:NoExecute"}),"."]}),"\n",(0,s.jsxs)(n.p,{children:["Once you've launched the ",(0,s.jsx)(n.code,{children:"k3s server"})," process on all server nodes, ensure that the cluster has come up properly with ",(0,s.jsx)(n.code,{children:"k3s kubectl get nodes"}),". You should see your server nodes in the Ready state."]}),"\n",(0,s.jsx)(n.h3,{id:"3-optional-join-additional-server-nodes",children:"3. Optional: Join Additional Server Nodes"}),"\n",(0,s.jsx)(n.p,{children:"The same example command in Step 2 can be used to join additional server nodes, where the token from the first node needs to be used."}),"\n",(0,s.jsxs)(n.p,{children:["If the first server node was started without the ",(0,s.jsx)(n.code,{children:"--token"})," CLI flag or ",(0,s.jsx)(n.code,{children:"K3S_TOKEN"})," variable, the token value can be retrieved from any server already joined to the cluster:"]}),"\n",(0,s.jsx)(n.pre,{children:(0,s.jsx)(n.code,{className:"language-bash",children:"cat /var/lib/rancher/k3s/server/token\n"})}),"\n",(0,s.jsxs)(n.p,{children:["Additional server nodes can then be added ",(0,s.jsx)(n.a,{href:"/cli/server#cluster-options",children:"using the token"}),":"]}),"\n",(0,s.jsx)(n.pre,{children:(0,s.jsx)(n.code,{className:"language-bash",children:'curl -sfL https://get.k3s.io | sh -s - server \\\n --token=SECRET \\\n --datastore-endpoint="mysql://username:password@tcp(hostname:3306)/database-name"\n'})}),"\n",(0,s.jsx)(n.p,{children:"There are a few config flags that must be the same in all server nodes:"}),"\n",(0,s.jsxs)(n.ul,{children:["\n",(0,s.jsxs)(n.li,{children:["Network related flags: ",(0,s.jsx)(n.code,{children:"--cluster-dns"}),", ",(0,s.jsx)(n.code,{children:"--cluster-domain"}),", ",(0,s.jsx)(n.code,{children:"--cluster-cidr"}),", ",(0,s.jsx)(n.code,{children:"--service-cidr"})]}),"\n",(0,s.jsxs)(n.li,{children:["Flags controlling the deployment of certain components: ",(0,s.jsx)(n.code,{children:"--disable-helm-controller"}),", ",(0,s.jsx)(n.code,{children:"--disable-kube-proxy"}),", ",(0,s.jsx)(n.code,{children:"--disable-network-policy"})," and any component passed to ",(0,s.jsx)(n.code,{children:"--disable"})]}),"\n",(0,s.jsxs)(n.li,{children:["Feature related flags: ",(0,s.jsx)(n.code,{children:"--secrets-encryption"})]}),"\n"]}),"\n",(0,s.jsx)(n.admonition,{type:"note",children:(0,s.jsx)(n.p,{children:"Ensure that you retain a copy of this token as it is required when restoring from backup and adding nodes. Previously, K3s did not enforce the use of a token when using external SQL datastores."})}),"\n",(0,s.jsx)(n.h3,{id:"4-optional-configure-a-fixed-registration-address",children:"4. Optional: Configure a Fixed Registration Address"}),"\n",(0,s.jsx)(n.p,{children:"Agent nodes need a URL to register against. This can be the IP or hostname of any server node, but in many cases those may change over time. For example, if running your cluster in a cloud that supports scaling groups, nodes may be created and destroyed over time, changing to different IPs from the initial set of server nodes. It would be best to have a stable endpoint in front of the server nodes that will not change over time. This endpoint can be set up using any number approaches, such as:"}),"\n",(0,s.jsxs)(n.ul,{children:["\n",(0,s.jsx)(n.li,{children:"A layer-4 (TCP) load balancer"}),"\n",(0,s.jsx)(n.li,{children:"Round-robin DNS"}),"\n",(0,s.jsx)(n.li,{children:"Virtual or elastic IP addresses"}),"\n"]}),"\n",(0,s.jsxs)(n.p,{children:["See ",(0,s.jsx)(n.a,{href:"/datastore/cluster-loadbalancer",children:"Cluster Loadbalancer"})," for example configurations."]}),"\n",(0,s.jsxs)(n.p,{children:["This endpoint can also be used for accessing the Kubernetes API. So you can, for example, modify your ",(0,s.jsx)(n.a,{href:"https://kubernetes.io/docs/concepts/configuration/organize-cluster-access-kubeconfig/",children:"kubeconfig"})," file to point to it instead of a specific node."]}),"\n",(0,s.jsxs)(n.p,{children:["To avoid certificate errors in such a configuration, you should configure the server with the ",(0,s.jsx)(n.code,{children:"--tls-san=YOUR_IP_OR_HOSTNAME_HERE"})," option. This option adds an additional hostname or IP as a Subject Alternative Name in the TLS cert, and it can be specified multiple times if you would like to access via both the IP and the hostname."]}),"\n",(0,s.jsx)(n.h3,{id:"5-optional-join-agent-nodes",children:"5. Optional: Join Agent Nodes"}),"\n",(0,s.jsx)(n.p,{children:"Because K3s server nodes are schedulable by default, agent nodes are not required for a HA K3s cluster. However, you may wish to have dedicated agent nodes to run your apps and services."}),"\n",(0,s.jsx)(n.p,{children:"Joining agent nodes in an HA cluster is the same as joining agent nodes in a single server cluster. You just need to specify the URL the agent should register to (either one of the server IPs or a fixed registration address) and the token it should use."}),"\n",(0,s.jsx)(n.pre,{children:(0,s.jsx)(n.code,{className:"language-bash",children:"K3S_TOKEN=SECRET k3s agent --server https://server-or-fixed-registration-address:6443\n"})})]})}function h(e={}){const{wrapper:n}={...(0,r.a)(),...e.components};return n?(0,s.jsx)(n,{...e,children:(0,s.jsx)(c,{...e})}):c(e)}},1151:(e,n,t)=>{t.d(n,{Z:()=>i,a:()=>o});var s=t(7294);const r={},a=s.createContext(r);function o(e){const n=s.useContext(a);return s.useMemo((function(){return"function"==typeof e?e(n):{...n,...e}}),[n,e])}function i(e){let n;return n=e.disableParentContext?"function"==typeof e.components?e.components(r):e.components||r:o(e.components),s.createElement(a.Provider,{value:n},e.children)}}}]); \ No newline at end of file +"use strict";(self.webpackChunkk_3_s_docs=self.webpackChunkk_3_s_docs||[]).push([[791],{9555:(e,n,t)=>{t.r(n),t.d(n,{assets:()=>d,contentTitle:()=>o,default:()=>h,frontMatter:()=>a,metadata:()=>i,toc:()=>l});var s=t(5893),r=t(1151);const a={title:"High Availability External DB"},o=void 0,i={id:"datastore/ha",title:"High Availability External DB",description:"This section describes how to install a high-availability K3s cluster with an external database.",source:"@site/docs/datastore/ha.md",sourceDirName:"datastore",slug:"/datastore/ha",permalink:"/datastore/ha",draft:!1,unlisted:!1,editUrl:"https://github.com/k3s-io/docs/edit/main/docs/datastore/ha.md",tags:[],version:"current",lastUpdatedAt:1723747404e3,frontMatter:{title:"High Availability External DB"},sidebar:"mySidebar",previous:{title:"High Availability Embedded etcd",permalink:"/datastore/ha-embedded"},next:{title:"Cluster Load Balancer",permalink:"/datastore/cluster-loadbalancer"}},d={},l=[{value:"Installation Outline",id:"installation-outline",level:2},{value:"1. Create an External Datastore",id:"1-create-an-external-datastore",level:3},{value:"2. Launch Server Nodes",id:"2-launch-server-nodes",level:3},{value:"3. Optional: Join Additional Server Nodes",id:"3-optional-join-additional-server-nodes",level:3},{value:"4. Optional: Configure a Fixed Registration Address",id:"4-optional-configure-a-fixed-registration-address",level:3},{value:"5. Optional: Join Agent Nodes",id:"5-optional-join-agent-nodes",level:3}];function c(e){const n={a:"a",admonition:"admonition",code:"code",h2:"h2",h3:"h3",li:"li",p:"p",pre:"pre",strong:"strong",ul:"ul",...(0,r.a)(),...e.components};return(0,s.jsxs)(s.Fragment,{children:[(0,s.jsx)(n.p,{children:"This section describes how to install a high-availability K3s cluster with an external database."}),"\n",(0,s.jsx)(n.admonition,{type:"note",children:(0,s.jsxs)(n.p,{children:["To rapidly deploy large HA clusters, see ",(0,s.jsx)(n.a,{href:"/related-projects",children:"Related Projects"})]})}),"\n",(0,s.jsx)(n.p,{children:"Single server clusters can meet a variety of use cases, but for environments where uptime of the Kubernetes control plane is critical, you can run K3s in an HA configuration. An HA K3s cluster is composed of:"}),"\n",(0,s.jsxs)(n.ul,{children:["\n",(0,s.jsxs)(n.li,{children:["Two or more ",(0,s.jsx)(n.strong,{children:"server nodes"})," that will serve the Kubernetes API and run other control plane services"]}),"\n",(0,s.jsxs)(n.li,{children:["An ",(0,s.jsx)(n.strong,{children:"external datastore"})," (as opposed to the embedded SQLite datastore used in single-server setups)"]}),"\n",(0,s.jsxs)(n.li,{children:["Optional: Zero or more ",(0,s.jsx)(n.strong,{children:"agent nodes"})," that are designated to run your apps and services"]}),"\n",(0,s.jsxs)(n.li,{children:["Optional: A ",(0,s.jsx)(n.strong,{children:"fixed registration address"})," for agent nodes to register with the cluster"]}),"\n"]}),"\n",(0,s.jsxs)(n.p,{children:["For more details on how these components work together, refer to the ",(0,s.jsx)(n.a,{href:"/architecture#high-availability-k3s",children:"architecture section."})]}),"\n",(0,s.jsx)(n.h2,{id:"installation-outline",children:"Installation Outline"}),"\n",(0,s.jsx)(n.p,{children:"Setting up an HA cluster requires the following steps:"}),"\n",(0,s.jsx)(n.h3,{id:"1-create-an-external-datastore",children:"1. Create an External Datastore"}),"\n",(0,s.jsxs)(n.p,{children:["You will first need to create an external datastore for the cluster. See the ",(0,s.jsx)(n.a,{href:"/datastore/",children:"Cluster Datastore Options"})," documentation for more details."]}),"\n",(0,s.jsx)(n.h3,{id:"2-launch-server-nodes",children:"2. Launch Server Nodes"}),"\n",(0,s.jsxs)(n.p,{children:["K3s requires two or more server nodes for this HA configuration. See the ",(0,s.jsx)(n.a,{href:"/installation/requirements",children:"Requirements"})," guide for minimum machine requirements."]}),"\n",(0,s.jsxs)(n.p,{children:["When running the ",(0,s.jsx)(n.code,{children:"k3s server"})," command on these nodes, you must set the ",(0,s.jsx)(n.code,{children:"datastore-endpoint"})," parameter so that K3s knows how to connect to the external datastore. The ",(0,s.jsx)(n.code,{children:"token"})," parameter can also be used to set a deterministic token when adding nodes. When empty, this token will be generated automatically for further use."]}),"\n",(0,s.jsxs)(n.p,{children:["For example, a command like the following could be used to install the K3s server with a MySQL database as the external datastore and ",(0,s.jsx)(n.a,{href:"/cli/server#cluster-options",children:"set a token"}),":"]}),"\n",(0,s.jsx)(n.pre,{children:(0,s.jsx)(n.code,{className:"language-bash",children:'curl -sfL https://get.k3s.io | sh -s - server \\\n --token=SECRET \\\n --datastore-endpoint="mysql://username:password@tcp(hostname:3306)/database-name" \\\n --tls-san= # Optional, needed if using a fixed registration address\n'})}),"\n",(0,s.jsxs)(n.p,{children:["The datastore endpoint format differs based on the database type. For details, refer to the section on ",(0,s.jsx)(n.a,{href:"/datastore/#datastore-endpoint-format-and-functionality",children:"datastore endpoint formats."})]}),"\n",(0,s.jsxs)(n.p,{children:["To configure TLS certificates when launching server nodes, refer to the ",(0,s.jsx)(n.a,{href:"/datastore/#external-datastore-configuration-parameters",children:"datastore configuration guide."})]}),"\n",(0,s.jsx)(n.admonition,{type:"note",children:(0,s.jsxs)(n.p,{children:["The same installation options available to single-server installs are also available for high-availability installs. For more details, see the ",(0,s.jsx)(n.a,{href:"/installation/configuration",children:"Configuration Options"})," documentation."]})}),"\n",(0,s.jsxs)(n.p,{children:["By default, server nodes will be schedulable and thus your workloads can get launched on them. If you wish to have a dedicated control plane where no user workloads will run, you can use taints. The ",(0,s.jsx)(n.code,{children:"node-taint"})," parameter will allow you to configure nodes with taints, for example ",(0,s.jsx)(n.code,{children:"--node-taint CriticalAddonsOnly=true:NoExecute"}),"."]}),"\n",(0,s.jsxs)(n.p,{children:["Once you've launched the ",(0,s.jsx)(n.code,{children:"k3s server"})," process on all server nodes, ensure that the cluster has come up properly with ",(0,s.jsx)(n.code,{children:"k3s kubectl get nodes"}),". You should see your server nodes in the Ready state."]}),"\n",(0,s.jsx)(n.h3,{id:"3-optional-join-additional-server-nodes",children:"3. Optional: Join Additional Server Nodes"}),"\n",(0,s.jsx)(n.p,{children:"The same example command in Step 2 can be used to join additional server nodes, where the token from the first node needs to be used."}),"\n",(0,s.jsxs)(n.p,{children:["If the first server node was started without the ",(0,s.jsx)(n.code,{children:"--token"})," CLI flag or ",(0,s.jsx)(n.code,{children:"K3S_TOKEN"})," variable, the token value can be retrieved from any server already joined to the cluster:"]}),"\n",(0,s.jsx)(n.pre,{children:(0,s.jsx)(n.code,{className:"language-bash",children:"cat /var/lib/rancher/k3s/server/token\n"})}),"\n",(0,s.jsxs)(n.p,{children:["Additional server nodes can then be added ",(0,s.jsx)(n.a,{href:"/cli/server#cluster-options",children:"using the token"}),":"]}),"\n",(0,s.jsx)(n.pre,{children:(0,s.jsx)(n.code,{className:"language-bash",children:'curl -sfL https://get.k3s.io | sh -s - server \\\n --token=SECRET \\\n --datastore-endpoint="mysql://username:password@tcp(hostname:3306)/database-name"\n'})}),"\n",(0,s.jsx)(n.p,{children:"There are a few config flags that must be the same in all server nodes:"}),"\n",(0,s.jsxs)(n.ul,{children:["\n",(0,s.jsxs)(n.li,{children:["Network related flags: ",(0,s.jsx)(n.code,{children:"--cluster-dns"}),", ",(0,s.jsx)(n.code,{children:"--cluster-domain"}),", ",(0,s.jsx)(n.code,{children:"--cluster-cidr"}),", ",(0,s.jsx)(n.code,{children:"--service-cidr"})]}),"\n",(0,s.jsxs)(n.li,{children:["Flags controlling the deployment of certain components: ",(0,s.jsx)(n.code,{children:"--disable-helm-controller"}),", ",(0,s.jsx)(n.code,{children:"--disable-kube-proxy"}),", ",(0,s.jsx)(n.code,{children:"--disable-network-policy"})," and any component passed to ",(0,s.jsx)(n.code,{children:"--disable"})]}),"\n",(0,s.jsxs)(n.li,{children:["Feature related flags: ",(0,s.jsx)(n.code,{children:"--secrets-encryption"})]}),"\n"]}),"\n",(0,s.jsx)(n.admonition,{type:"note",children:(0,s.jsx)(n.p,{children:"Ensure that you retain a copy of this token as it is required when restoring from backup and adding nodes. Previously, K3s did not enforce the use of a token when using external SQL datastores."})}),"\n",(0,s.jsx)(n.h3,{id:"4-optional-configure-a-fixed-registration-address",children:"4. Optional: Configure a Fixed Registration Address"}),"\n",(0,s.jsx)(n.p,{children:"Agent nodes need a URL to register against. This can be the IP or hostname of any server node, but in many cases those may change over time. For example, if running your cluster in a cloud that supports scaling groups, nodes may be created and destroyed over time, changing to different IPs from the initial set of server nodes. It would be best to have a stable endpoint in front of the server nodes that will not change over time. This endpoint can be set up using any number approaches, such as:"}),"\n",(0,s.jsxs)(n.ul,{children:["\n",(0,s.jsx)(n.li,{children:"A layer-4 (TCP) load balancer"}),"\n",(0,s.jsx)(n.li,{children:"Round-robin DNS"}),"\n",(0,s.jsx)(n.li,{children:"Virtual or elastic IP addresses"}),"\n"]}),"\n",(0,s.jsxs)(n.p,{children:["See ",(0,s.jsx)(n.a,{href:"/datastore/cluster-loadbalancer",children:"Cluster Loadbalancer"})," for example configurations."]}),"\n",(0,s.jsxs)(n.p,{children:["This endpoint can also be used for accessing the Kubernetes API. So you can, for example, modify your ",(0,s.jsx)(n.a,{href:"https://kubernetes.io/docs/concepts/configuration/organize-cluster-access-kubeconfig/",children:"kubeconfig"})," file to point to it instead of a specific node."]}),"\n",(0,s.jsxs)(n.p,{children:["To avoid certificate errors in such a configuration, you should configure the server with the ",(0,s.jsx)(n.code,{children:"--tls-san=YOUR_IP_OR_HOSTNAME_HERE"})," option. This option adds an additional hostname or IP as a Subject Alternative Name in the TLS cert, and it can be specified multiple times if you would like to access via both the IP and the hostname."]}),"\n",(0,s.jsx)(n.h3,{id:"5-optional-join-agent-nodes",children:"5. Optional: Join Agent Nodes"}),"\n",(0,s.jsx)(n.p,{children:"Because K3s server nodes are schedulable by default, agent nodes are not required for a HA K3s cluster. However, you may wish to have dedicated agent nodes to run your apps and services."}),"\n",(0,s.jsx)(n.p,{children:"Joining agent nodes in an HA cluster is the same as joining agent nodes in a single server cluster. You just need to specify the URL the agent should register to (either one of the server IPs or a fixed registration address) and the token it should use."}),"\n",(0,s.jsx)(n.pre,{children:(0,s.jsx)(n.code,{className:"language-bash",children:"K3S_TOKEN=SECRET k3s agent --server https://server-or-fixed-registration-address:6443\n"})})]})}function h(e={}){const{wrapper:n}={...(0,r.a)(),...e.components};return n?(0,s.jsx)(n,{...e,children:(0,s.jsx)(c,{...e})}):c(e)}},1151:(e,n,t)=>{t.d(n,{Z:()=>i,a:()=>o});var s=t(7294);const r={},a=s.createContext(r);function o(e){const n=s.useContext(a);return s.useMemo((function(){return"function"==typeof e?e(n):{...n,...e}}),[n,e])}function i(e){let n;return n=e.disableParentContext?"function"==typeof e.components?e.components(r):e.components||r:o(e.components),s.createElement(a.Provider,{value:n},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/ec6f9153.2a3b87b8.js b/assets/js/ec6f9153.14fed77a.js similarity index 99% rename from assets/js/ec6f9153.2a3b87b8.js rename to assets/js/ec6f9153.14fed77a.js index 83b2d884a..4b8adec4a 100644 --- a/assets/js/ec6f9153.2a3b87b8.js +++ b/assets/js/ec6f9153.14fed77a.js @@ -1 +1 @@ -"use strict";(self.webpackChunkk_3_s_docs=self.webpackChunkk_3_s_docs||[]).push([[750],{4987:(e,r,n)=>{n.r(r),n.d(r,{assets:()=>o,contentTitle:()=>t,default:()=>c,frontMatter:()=>s,metadata:()=>l,toc:()=>d});var a=n(5893),i=n(1151);const s={title:"Air-Gap Install"},t=void 0,l={id:"installation/airgap",title:"Air-Gap Install",description:"You can install K3s in an air-gapped environment using two different methods. An air-gapped environment is any environment that is not directly connected to the Internet. You can either deploy a private registry and mirror docker.io, or you can manually deploy images such as for small clusters.",source:"@site/docs/installation/airgap.md",sourceDirName:"installation",slug:"/installation/airgap",permalink:"/installation/airgap",draft:!1,unlisted:!1,editUrl:"https://github.com/k3s-io/docs/edit/main/docs/installation/airgap.md",tags:[],version:"current",lastUpdatedAt:1723651727e3,frontMatter:{title:"Air-Gap Install"},sidebar:"mySidebar",previous:{title:"Embedded Registry Mirror",permalink:"/installation/registry-mirror"},next:{title:"Managing Server Roles",permalink:"/installation/server-roles"}},o={},d=[{value:"Load Images",id:"load-images",level:2},{value:"Private Registry Method",id:"private-registry-method",level:3},{value:"Create the Registry YAML and Push Images",id:"create-the-registry-yaml-and-push-images",level:4},{value:"Manually Deploy Images Method",id:"manually-deploy-images-method",level:3},{value:"Prepare the Images Directory and Airgap Image Tarball",id:"prepare-the-images-directory-and-airgap-image-tarball",level:4},{value:"Embedded Registry Mirror",id:"embedded-registry-mirror",level:3},{value:"Install K3s",id:"install-k3s",level:2},{value:"Prerequisites",id:"prerequisites",level:3},{value:"Binaries",id:"binaries",level:4},{value:"Default Network Route",id:"default-network-route",level:4},{value:"SELinux RPM",id:"selinux-rpm",level:4},{value:"Installing K3s in an Air-Gapped Environment",id:"installing-k3s-in-an-air-gapped-environment",level:3},{value:"Upgrading",id:"upgrading",level:2},{value:"Install Script Method",id:"install-script-method",level:3},{value:"Automated Upgrades Method",id:"automated-upgrades-method",level:3}];function h(e){const r={a:"a",admonition:"admonition",code:"code",h2:"h2",h3:"h3",h4:"h4",li:"li",ol:"ol",p:"p",pre:"pre",ul:"ul",...(0,i.a)(),...e.components},{TabItem:n,Tabs:s}=r;return n||u("TabItem",!0),s||u("Tabs",!0),(0,a.jsxs)(a.Fragment,{children:[(0,a.jsx)(r.p,{children:"You can install K3s in an air-gapped environment using two different methods. An air-gapped environment is any environment that is not directly connected to the Internet. You can either deploy a private registry and mirror docker.io, or you can manually deploy images such as for small clusters."}),"\n",(0,a.jsx)(r.h2,{id:"load-images",children:"Load Images"}),"\n",(0,a.jsx)(r.h3,{id:"private-registry-method",children:"Private Registry Method"}),"\n",(0,a.jsx)(r.p,{children:"These steps assume you have already created nodes in your air-gap environment,\nare using the bundled containerd as the container runtime,\nand have a OCI-compliant private registry available in your environment."}),"\n",(0,a.jsxs)(r.p,{children:["If you have not yet set up a private Docker registry, refer to the ",(0,a.jsx)(r.a,{href:"https://docs.docker.com/registry/deploying/#run-an-externally-accessible-registry",children:"official Registry documentation"}),"."]}),"\n",(0,a.jsx)(r.h4,{id:"create-the-registry-yaml-and-push-images",children:"Create the Registry YAML and Push Images"}),"\n",(0,a.jsxs)(r.ol,{children:["\n",(0,a.jsxs)(r.li,{children:["Obtain the images archive for your architecture from the ",(0,a.jsx)(r.a,{href:"https://github.com/k3s-io/k3s/releases",children:"releases"})," page for the version of K3s you will be running."]}),"\n",(0,a.jsxs)(r.li,{children:["Use ",(0,a.jsx)(r.code,{children:"docker image load k3s-airgap-images-amd64.tar.zst"})," to import images from the tar file into docker."]}),"\n",(0,a.jsxs)(r.li,{children:["Use ",(0,a.jsx)(r.code,{children:"docker tag"})," and ",(0,a.jsx)(r.code,{children:"docker push"})," to retag and push the loaded images to your private registry."]}),"\n",(0,a.jsxs)(r.li,{children:["Follow the ",(0,a.jsx)(r.a,{href:"/installation/private-registry",children:"Private Registry Configuration"})," guide to create and configure the ",(0,a.jsx)(r.code,{children:"registries.yaml"})," file."]}),"\n",(0,a.jsxs)(r.li,{children:["Proceed to the ",(0,a.jsx)(r.a,{href:"#install-k3s",children:"Install K3s"})," section below."]}),"\n"]}),"\n",(0,a.jsx)(r.h3,{id:"manually-deploy-images-method",children:"Manually Deploy Images Method"}),"\n",(0,a.jsx)(r.p,{children:"These steps assume you have already created nodes in your air-gap environment,\nare using the bundled containerd as the container runtime,\nand cannot or do not want to use a private registry."}),"\n",(0,a.jsx)(r.p,{children:"This method requires you to manually deploy the necessary images to each node, and is appropriate for edge deployments where running a private registry is not practical."}),"\n",(0,a.jsx)(r.h4,{id:"prepare-the-images-directory-and-airgap-image-tarball",children:"Prepare the Images Directory and Airgap Image Tarball"}),"\n",(0,a.jsxs)(r.ol,{children:["\n",(0,a.jsxs)(r.li,{children:["Obtain the images archive for your architecture from the ",(0,a.jsx)(r.a,{href:"https://github.com/k3s-io/k3s/releases",children:"releases"})," page for the version of K3s you will be running."]}),"\n",(0,a.jsx)(r.li,{children:"Download the imagess archive to the agent's images directory, for example:"}),"\n"]}),"\n",(0,a.jsx)(r.pre,{children:(0,a.jsx)(r.code,{className:"language-bash",children:'sudo mkdir -p /var/lib/rancher/k3s/agent/images/\nsudo curl -L -o /var/lib/rancher/k3s/agent/images/k3s-airgap-images-amd64.tar.zst "https://github.com/k3s-io/k3s/releases/download/v1.29.1-rc2%2Bk3s1/k3s-airgap-images-amd64.tar.zst"\n'})}),"\n",(0,a.jsxs)(r.ol,{start:"3",children:["\n",(0,a.jsxs)(r.li,{children:["Proceed to the ",(0,a.jsx)(r.a,{href:"#install-k3s",children:"Install K3s"})," section below."]}),"\n"]}),"\n",(0,a.jsx)(r.h3,{id:"embedded-registry-mirror",children:"Embedded Registry Mirror"}),"\n",(0,a.jsx)(r.admonition,{title:"Version Gate",type:"info",children:(0,a.jsx)(r.p,{children:"The Embedded Registry Mirror is available as an experimental feature as of January 2024 releases: v1.26.13+k3s1, v1.27.10+k3s1, v1.28.6+k3s1, v1.29.1+k3s1"})}),"\n",(0,a.jsx)(r.p,{children:"K3s includes an embedded distributed OCI-compliant registry mirror.\nWhen enabled and properly configured, images available in the containerd image store on any node\ncan be pulled by other cluster members without access to an external image registry."}),"\n",(0,a.jsxs)(r.p,{children:["The mirrored images may be sourced from an upstream registry, registry mirror, or airgap image tarball.\nFor more information on enabling the embedded distributed registry mirror, see the ",(0,a.jsx)(r.a,{href:"/installation/registry-mirror",children:"Embedded Registry Mirror"})," documentation."]}),"\n",(0,a.jsx)(r.h2,{id:"install-k3s",children:"Install K3s"}),"\n",(0,a.jsx)(r.h3,{id:"prerequisites",children:"Prerequisites"}),"\n",(0,a.jsxs)(r.p,{children:["Before installing K3s, complete the ",(0,a.jsx)(r.a,{href:"#private-registry-method",children:"Private Registry Method"})," or the ",(0,a.jsx)(r.a,{href:"#manually-deploy-images-method",children:"Manually Deploy Images Method"})," above to prepopulate the images that K3s needs to install."]}),"\n",(0,a.jsx)(r.h4,{id:"binaries",children:"Binaries"}),"\n",(0,a.jsxs)(r.ul,{children:["\n",(0,a.jsxs)(r.li,{children:["Download the K3s binary from the ",(0,a.jsx)(r.a,{href:"https://github.com/k3s-io/k3s/releases",children:"releases"})," page, matching the same version used to get the airgap images. Place the binary in ",(0,a.jsx)(r.code,{children:"/usr/local/bin"})," on each air-gapped node and ensure it is executable."]}),"\n",(0,a.jsxs)(r.li,{children:["Download the K3s install script at ",(0,a.jsx)(r.a,{href:"https://get.k3s.io",children:"get.k3s.io"}),". Place the install script anywhere on each air-gapped node, and name it ",(0,a.jsx)(r.code,{children:"install.sh"}),"."]}),"\n"]}),"\n",(0,a.jsx)(r.h4,{id:"default-network-route",children:"Default Network Route"}),"\n",(0,a.jsx)(r.p,{children:"If your nodes do not have an interface with a default route, a default route must be configured; even a black-hole route via a dummy interface will suffice. K3s requires a default route in order to auto-detect the node's primary IP, and for kube-proxy ClusterIP routing to function properly. To add a dummy route, do the following:"}),"\n",(0,a.jsx)(r.pre,{children:(0,a.jsx)(r.code,{children:"ip link add dummy0 type dummy\nip link set dummy0 up\nip addr add 203.0.113.254/31 dev dummy0\nip route add default via 203.0.113.255 dev dummy0 metric 1000\n"})}),"\n",(0,a.jsxs)(r.p,{children:["When running the K3s script with the ",(0,a.jsx)(r.code,{children:"INSTALL_K3S_SKIP_DOWNLOAD"})," environment variable, K3s will use the local version of the script and binary."]}),"\n",(0,a.jsx)(r.h4,{id:"selinux-rpm",children:"SELinux RPM"}),"\n",(0,a.jsxs)(r.p,{children:["If you intend to deploy K3s with SELinux enabled, you will need also install the appropriate k3s-selinux RPM on all nodes. The latest version of the RPM can be found ",(0,a.jsx)(r.a,{href:"https://github.com/k3s-io/k3s-selinux/releases/latest",children:"here"}),". For example, on CentOS 8:"]}),"\n",(0,a.jsx)(r.pre,{children:(0,a.jsx)(r.code,{className:"language-bash",children:"On internet accessible machine:\ncurl -LO https://github.com/k3s-io/k3s-selinux/releases/download/v1.4.stable.1/k3s-selinux-1.4-1.el8.noarch.rpm\n\n# Transfer RPM to air-gapped machine\nOn air-gapped machine:\nsudo yum install ./k3s-selinux-1.4-1.el8.noarch.rpm\n"})}),"\n",(0,a.jsxs)(r.p,{children:["See the ",(0,a.jsx)(r.a,{href:"/advanced#selinux-support",children:"SELinux"})," section for more information."]}),"\n",(0,a.jsx)(r.h3,{id:"installing-k3s-in-an-air-gapped-environment",children:"Installing K3s in an Air-Gapped Environment"}),"\n",(0,a.jsx)(r.p,{children:"You can install K3s on one or more servers as described below."}),"\n",(0,a.jsxs)(s,{queryString:"airgap-cluster",children:[(0,a.jsxs)(n,{value:"Single Server Configuration",default:!0,children:[(0,a.jsx)(r.p,{children:"To install K3s on a single server, simply do the following on the server node:"}),(0,a.jsx)(r.pre,{children:(0,a.jsx)(r.code,{className:"language-bash",children:"INSTALL_K3S_SKIP_DOWNLOAD=true ./install.sh\n"})}),(0,a.jsx)(r.p,{children:"To add additional agents, do the following on each agent node:"}),(0,a.jsx)(r.pre,{children:(0,a.jsx)(r.code,{className:"language-bash",children:"INSTALL_K3S_SKIP_DOWNLOAD=true K3S_URL=https://:6443 K3S_TOKEN= ./install.sh\n"})}),(0,a.jsx)(r.admonition,{type:"note",children:(0,a.jsxs)(r.p,{children:["The token from the server is typically found at ",(0,a.jsx)(r.code,{children:"/var/lib/rancher/k3s/server/token"}),"."]})})]}),(0,a.jsxs)(n,{value:"High Availability Configuration",default:!0,children:[(0,a.jsxs)(r.p,{children:["Reference the ",(0,a.jsx)(r.a,{href:"/datastore/ha",children:"High Availability with an External DB"})," or ",(0,a.jsx)(r.a,{href:"/datastore/ha-embedded",children:"High Availability with Embedded DB"})," guides. You will be tweaking install commands so you specify ",(0,a.jsx)(r.code,{children:"INSTALL_K3S_SKIP_DOWNLOAD=true"})," and run your install script locally instead of via curl. You will also utilize ",(0,a.jsx)(r.code,{children:"INSTALL_K3S_EXEC='args'"})," to supply any arguments to k3s."]}),(0,a.jsx)(r.p,{children:"For example, step two of the High Availability with an External DB guide mentions the following:"}),(0,a.jsx)(r.pre,{children:(0,a.jsx)(r.code,{className:"language-bash",children:'curl -sfL https://get.k3s.io | sh -s - server \\\n --token=SECRET \\\n --datastore-endpoint="mysql://username:password@tcp(hostname:3306)/database-name"\n'})}),(0,a.jsx)(r.p,{children:"Instead, you would modify such examples like below:"}),(0,a.jsx)(r.pre,{children:(0,a.jsx)(r.code,{className:"language-bash",children:"INSTALL_K3S_SKIP_DOWNLOAD=true INSTALL_K3S_EXEC='server --token=SECRET' \\\nK3S_DATASTORE_ENDPOINT='mysql://username:password@tcp(hostname:3306)/database-name' \\\n./install.sh\n"})})]})]}),"\n",(0,a.jsx)(r.admonition,{type:"note",children:(0,a.jsxs)(r.p,{children:["K3s's ",(0,a.jsx)(r.code,{children:"--resolv-conf"})," flag is passed through to the kubelet, which may help with configuring pod DNS resolution in air-gap networks where the host does not have upstream nameservers configured."]})}),"\n",(0,a.jsx)(r.h2,{id:"upgrading",children:"Upgrading"}),"\n",(0,a.jsx)(r.h3,{id:"install-script-method",children:"Install Script Method"}),"\n",(0,a.jsx)(r.p,{children:"Upgrading an air-gap environment can be accomplished in the following manner:"}),"\n",(0,a.jsxs)(r.ol,{children:["\n",(0,a.jsxs)(r.li,{children:["Download the new air-gap images (tar file) from the ",(0,a.jsx)(r.a,{href:"https://github.com/k3s-io/k3s/releases",children:"releases"})," page for the version of K3s you will be upgrading to. Place the tar in the ",(0,a.jsx)(r.code,{children:"/var/lib/rancher/k3s/agent/images/"})," directory on each\nnode. Delete the old tar file."]}),"\n",(0,a.jsxs)(r.li,{children:["Copy and replace the old K3s binary in ",(0,a.jsx)(r.code,{children:"/usr/local/bin"})," on each node. Copy over the install script at ",(0,a.jsx)(r.a,{href:"https://get.k3s.io",children:"https://get.k3s.io"})," (as it is possible it has changed since the last release). Run the script again just as you had done in the past\nwith the same environment variables."]}),"\n",(0,a.jsx)(r.li,{children:"Restart the K3s service (if not restarted automatically by installer)."}),"\n"]}),"\n",(0,a.jsx)(r.h3,{id:"automated-upgrades-method",children:"Automated Upgrades Method"}),"\n",(0,a.jsxs)(r.p,{children:["K3s supports ",(0,a.jsx)(r.a,{href:"/upgrades/automated",children:"automated upgrades"}),". To enable this in air-gapped environments, you must ensure the required images are available in your private registry."]}),"\n",(0,a.jsxs)(r.p,{children:["You will need the version of rancher/k3s-upgrade that corresponds to the version of K3s you intend to upgrade to. Note, the image tag replaces the ",(0,a.jsx)(r.code,{children:"+"})," in the K3s release with a ",(0,a.jsx)(r.code,{children:"-"})," because Docker images do not support ",(0,a.jsx)(r.code,{children:"+"}),"."]}),"\n",(0,a.jsxs)(r.p,{children:["You will also need the versions of system-upgrade-controller and kubectl that are specified in the system-upgrade-controller manifest YAML that you will deploy. Check for the latest release of the system-upgrade-controller ",(0,a.jsx)(r.a,{href:"https://github.com/rancher/system-upgrade-controller/releases/latest",children:"here"})," and download the system-upgrade-controller.yaml to determine the versions you need to push to your private registry. For example, in release v0.4.0 of the system-upgrade-controller, these images are specified in the manifest YAML:"]}),"\n",(0,a.jsx)(r.pre,{children:(0,a.jsx)(r.code,{children:"rancher/system-upgrade-controller:v0.4.0\nrancher/kubectl:v0.17.0\n"})}),"\n",(0,a.jsxs)(r.p,{children:["Once you have added the necessary rancher/k3s-upgrade, rancher/system-upgrade-controller, and rancher/kubectl images to your private registry, follow the ",(0,a.jsx)(r.a,{href:"/upgrades/automated",children:"automated upgrades"})," guide."]})]})}function c(e={}){const{wrapper:r}={...(0,i.a)(),...e.components};return r?(0,a.jsx)(r,{...e,children:(0,a.jsx)(h,{...e})}):h(e)}function u(e,r){throw new Error("Expected "+(r?"component":"object")+" `"+e+"` to be defined: you likely forgot to import, pass, or provide it.")}},1151:(e,r,n)=>{n.d(r,{Z:()=>l,a:()=>t});var a=n(7294);const i={},s=a.createContext(i);function t(e){const r=a.useContext(s);return a.useMemo((function(){return"function"==typeof e?e(r):{...r,...e}}),[r,e])}function l(e){let r;return r=e.disableParentContext?"function"==typeof e.components?e.components(i):e.components||i:t(e.components),a.createElement(s.Provider,{value:r},e.children)}}}]); \ No newline at end of file +"use strict";(self.webpackChunkk_3_s_docs=self.webpackChunkk_3_s_docs||[]).push([[750],{4987:(e,r,n)=>{n.r(r),n.d(r,{assets:()=>o,contentTitle:()=>t,default:()=>c,frontMatter:()=>s,metadata:()=>l,toc:()=>d});var a=n(5893),i=n(1151);const s={title:"Air-Gap Install"},t=void 0,l={id:"installation/airgap",title:"Air-Gap Install",description:"You can install K3s in an air-gapped environment using two different methods. An air-gapped environment is any environment that is not directly connected to the Internet. You can either deploy a private registry and mirror docker.io, or you can manually deploy images such as for small clusters.",source:"@site/docs/installation/airgap.md",sourceDirName:"installation",slug:"/installation/airgap",permalink:"/installation/airgap",draft:!1,unlisted:!1,editUrl:"https://github.com/k3s-io/docs/edit/main/docs/installation/airgap.md",tags:[],version:"current",lastUpdatedAt:1723747404e3,frontMatter:{title:"Air-Gap Install"},sidebar:"mySidebar",previous:{title:"Embedded Registry Mirror",permalink:"/installation/registry-mirror"},next:{title:"Managing Server Roles",permalink:"/installation/server-roles"}},o={},d=[{value:"Load Images",id:"load-images",level:2},{value:"Private Registry Method",id:"private-registry-method",level:3},{value:"Create the Registry YAML and Push Images",id:"create-the-registry-yaml-and-push-images",level:4},{value:"Manually Deploy Images Method",id:"manually-deploy-images-method",level:3},{value:"Prepare the Images Directory and Airgap Image Tarball",id:"prepare-the-images-directory-and-airgap-image-tarball",level:4},{value:"Embedded Registry Mirror",id:"embedded-registry-mirror",level:3},{value:"Install K3s",id:"install-k3s",level:2},{value:"Prerequisites",id:"prerequisites",level:3},{value:"Binaries",id:"binaries",level:4},{value:"Default Network Route",id:"default-network-route",level:4},{value:"SELinux RPM",id:"selinux-rpm",level:4},{value:"Installing K3s in an Air-Gapped Environment",id:"installing-k3s-in-an-air-gapped-environment",level:3},{value:"Upgrading",id:"upgrading",level:2},{value:"Install Script Method",id:"install-script-method",level:3},{value:"Automated Upgrades Method",id:"automated-upgrades-method",level:3}];function h(e){const r={a:"a",admonition:"admonition",code:"code",h2:"h2",h3:"h3",h4:"h4",li:"li",ol:"ol",p:"p",pre:"pre",ul:"ul",...(0,i.a)(),...e.components},{TabItem:n,Tabs:s}=r;return n||u("TabItem",!0),s||u("Tabs",!0),(0,a.jsxs)(a.Fragment,{children:[(0,a.jsx)(r.p,{children:"You can install K3s in an air-gapped environment using two different methods. An air-gapped environment is any environment that is not directly connected to the Internet. You can either deploy a private registry and mirror docker.io, or you can manually deploy images such as for small clusters."}),"\n",(0,a.jsx)(r.h2,{id:"load-images",children:"Load Images"}),"\n",(0,a.jsx)(r.h3,{id:"private-registry-method",children:"Private Registry Method"}),"\n",(0,a.jsx)(r.p,{children:"These steps assume you have already created nodes in your air-gap environment,\nare using the bundled containerd as the container runtime,\nand have a OCI-compliant private registry available in your environment."}),"\n",(0,a.jsxs)(r.p,{children:["If you have not yet set up a private Docker registry, refer to the ",(0,a.jsx)(r.a,{href:"https://docs.docker.com/registry/deploying/#run-an-externally-accessible-registry",children:"official Registry documentation"}),"."]}),"\n",(0,a.jsx)(r.h4,{id:"create-the-registry-yaml-and-push-images",children:"Create the Registry YAML and Push Images"}),"\n",(0,a.jsxs)(r.ol,{children:["\n",(0,a.jsxs)(r.li,{children:["Obtain the images archive for your architecture from the ",(0,a.jsx)(r.a,{href:"https://github.com/k3s-io/k3s/releases",children:"releases"})," page for the version of K3s you will be running."]}),"\n",(0,a.jsxs)(r.li,{children:["Use ",(0,a.jsx)(r.code,{children:"docker image load k3s-airgap-images-amd64.tar.zst"})," to import images from the tar file into docker."]}),"\n",(0,a.jsxs)(r.li,{children:["Use ",(0,a.jsx)(r.code,{children:"docker tag"})," and ",(0,a.jsx)(r.code,{children:"docker push"})," to retag and push the loaded images to your private registry."]}),"\n",(0,a.jsxs)(r.li,{children:["Follow the ",(0,a.jsx)(r.a,{href:"/installation/private-registry",children:"Private Registry Configuration"})," guide to create and configure the ",(0,a.jsx)(r.code,{children:"registries.yaml"})," file."]}),"\n",(0,a.jsxs)(r.li,{children:["Proceed to the ",(0,a.jsx)(r.a,{href:"#install-k3s",children:"Install K3s"})," section below."]}),"\n"]}),"\n",(0,a.jsx)(r.h3,{id:"manually-deploy-images-method",children:"Manually Deploy Images Method"}),"\n",(0,a.jsx)(r.p,{children:"These steps assume you have already created nodes in your air-gap environment,\nare using the bundled containerd as the container runtime,\nand cannot or do not want to use a private registry."}),"\n",(0,a.jsx)(r.p,{children:"This method requires you to manually deploy the necessary images to each node, and is appropriate for edge deployments where running a private registry is not practical."}),"\n",(0,a.jsx)(r.h4,{id:"prepare-the-images-directory-and-airgap-image-tarball",children:"Prepare the Images Directory and Airgap Image Tarball"}),"\n",(0,a.jsxs)(r.ol,{children:["\n",(0,a.jsxs)(r.li,{children:["Obtain the images archive for your architecture from the ",(0,a.jsx)(r.a,{href:"https://github.com/k3s-io/k3s/releases",children:"releases"})," page for the version of K3s you will be running."]}),"\n",(0,a.jsx)(r.li,{children:"Download the imagess archive to the agent's images directory, for example:"}),"\n"]}),"\n",(0,a.jsx)(r.pre,{children:(0,a.jsx)(r.code,{className:"language-bash",children:'sudo mkdir -p /var/lib/rancher/k3s/agent/images/\nsudo curl -L -o /var/lib/rancher/k3s/agent/images/k3s-airgap-images-amd64.tar.zst "https://github.com/k3s-io/k3s/releases/download/v1.29.1-rc2%2Bk3s1/k3s-airgap-images-amd64.tar.zst"\n'})}),"\n",(0,a.jsxs)(r.ol,{start:"3",children:["\n",(0,a.jsxs)(r.li,{children:["Proceed to the ",(0,a.jsx)(r.a,{href:"#install-k3s",children:"Install K3s"})," section below."]}),"\n"]}),"\n",(0,a.jsx)(r.h3,{id:"embedded-registry-mirror",children:"Embedded Registry Mirror"}),"\n",(0,a.jsx)(r.admonition,{title:"Version Gate",type:"info",children:(0,a.jsx)(r.p,{children:"The Embedded Registry Mirror is available as an experimental feature as of January 2024 releases: v1.26.13+k3s1, v1.27.10+k3s1, v1.28.6+k3s1, v1.29.1+k3s1"})}),"\n",(0,a.jsx)(r.p,{children:"K3s includes an embedded distributed OCI-compliant registry mirror.\nWhen enabled and properly configured, images available in the containerd image store on any node\ncan be pulled by other cluster members without access to an external image registry."}),"\n",(0,a.jsxs)(r.p,{children:["The mirrored images may be sourced from an upstream registry, registry mirror, or airgap image tarball.\nFor more information on enabling the embedded distributed registry mirror, see the ",(0,a.jsx)(r.a,{href:"/installation/registry-mirror",children:"Embedded Registry Mirror"})," documentation."]}),"\n",(0,a.jsx)(r.h2,{id:"install-k3s",children:"Install K3s"}),"\n",(0,a.jsx)(r.h3,{id:"prerequisites",children:"Prerequisites"}),"\n",(0,a.jsxs)(r.p,{children:["Before installing K3s, complete the ",(0,a.jsx)(r.a,{href:"#private-registry-method",children:"Private Registry Method"})," or the ",(0,a.jsx)(r.a,{href:"#manually-deploy-images-method",children:"Manually Deploy Images Method"})," above to prepopulate the images that K3s needs to install."]}),"\n",(0,a.jsx)(r.h4,{id:"binaries",children:"Binaries"}),"\n",(0,a.jsxs)(r.ul,{children:["\n",(0,a.jsxs)(r.li,{children:["Download the K3s binary from the ",(0,a.jsx)(r.a,{href:"https://github.com/k3s-io/k3s/releases",children:"releases"})," page, matching the same version used to get the airgap images. Place the binary in ",(0,a.jsx)(r.code,{children:"/usr/local/bin"})," on each air-gapped node and ensure it is executable."]}),"\n",(0,a.jsxs)(r.li,{children:["Download the K3s install script at ",(0,a.jsx)(r.a,{href:"https://get.k3s.io",children:"get.k3s.io"}),". Place the install script anywhere on each air-gapped node, and name it ",(0,a.jsx)(r.code,{children:"install.sh"}),"."]}),"\n"]}),"\n",(0,a.jsx)(r.h4,{id:"default-network-route",children:"Default Network Route"}),"\n",(0,a.jsx)(r.p,{children:"If your nodes do not have an interface with a default route, a default route must be configured; even a black-hole route via a dummy interface will suffice. K3s requires a default route in order to auto-detect the node's primary IP, and for kube-proxy ClusterIP routing to function properly. To add a dummy route, do the following:"}),"\n",(0,a.jsx)(r.pre,{children:(0,a.jsx)(r.code,{children:"ip link add dummy0 type dummy\nip link set dummy0 up\nip addr add 203.0.113.254/31 dev dummy0\nip route add default via 203.0.113.255 dev dummy0 metric 1000\n"})}),"\n",(0,a.jsxs)(r.p,{children:["When running the K3s script with the ",(0,a.jsx)(r.code,{children:"INSTALL_K3S_SKIP_DOWNLOAD"})," environment variable, K3s will use the local version of the script and binary."]}),"\n",(0,a.jsx)(r.h4,{id:"selinux-rpm",children:"SELinux RPM"}),"\n",(0,a.jsxs)(r.p,{children:["If you intend to deploy K3s with SELinux enabled, you will need also install the appropriate k3s-selinux RPM on all nodes. The latest version of the RPM can be found ",(0,a.jsx)(r.a,{href:"https://github.com/k3s-io/k3s-selinux/releases/latest",children:"here"}),". For example, on CentOS 8:"]}),"\n",(0,a.jsx)(r.pre,{children:(0,a.jsx)(r.code,{className:"language-bash",children:"On internet accessible machine:\ncurl -LO https://github.com/k3s-io/k3s-selinux/releases/download/v1.4.stable.1/k3s-selinux-1.4-1.el8.noarch.rpm\n\n# Transfer RPM to air-gapped machine\nOn air-gapped machine:\nsudo yum install ./k3s-selinux-1.4-1.el8.noarch.rpm\n"})}),"\n",(0,a.jsxs)(r.p,{children:["See the ",(0,a.jsx)(r.a,{href:"/advanced#selinux-support",children:"SELinux"})," section for more information."]}),"\n",(0,a.jsx)(r.h3,{id:"installing-k3s-in-an-air-gapped-environment",children:"Installing K3s in an Air-Gapped Environment"}),"\n",(0,a.jsx)(r.p,{children:"You can install K3s on one or more servers as described below."}),"\n",(0,a.jsxs)(s,{queryString:"airgap-cluster",children:[(0,a.jsxs)(n,{value:"Single Server Configuration",default:!0,children:[(0,a.jsx)(r.p,{children:"To install K3s on a single server, simply do the following on the server node:"}),(0,a.jsx)(r.pre,{children:(0,a.jsx)(r.code,{className:"language-bash",children:"INSTALL_K3S_SKIP_DOWNLOAD=true ./install.sh\n"})}),(0,a.jsx)(r.p,{children:"To add additional agents, do the following on each agent node:"}),(0,a.jsx)(r.pre,{children:(0,a.jsx)(r.code,{className:"language-bash",children:"INSTALL_K3S_SKIP_DOWNLOAD=true K3S_URL=https://:6443 K3S_TOKEN= ./install.sh\n"})}),(0,a.jsx)(r.admonition,{type:"note",children:(0,a.jsxs)(r.p,{children:["The token from the server is typically found at ",(0,a.jsx)(r.code,{children:"/var/lib/rancher/k3s/server/token"}),"."]})})]}),(0,a.jsxs)(n,{value:"High Availability Configuration",default:!0,children:[(0,a.jsxs)(r.p,{children:["Reference the ",(0,a.jsx)(r.a,{href:"/datastore/ha",children:"High Availability with an External DB"})," or ",(0,a.jsx)(r.a,{href:"/datastore/ha-embedded",children:"High Availability with Embedded DB"})," guides. You will be tweaking install commands so you specify ",(0,a.jsx)(r.code,{children:"INSTALL_K3S_SKIP_DOWNLOAD=true"})," and run your install script locally instead of via curl. You will also utilize ",(0,a.jsx)(r.code,{children:"INSTALL_K3S_EXEC='args'"})," to supply any arguments to k3s."]}),(0,a.jsx)(r.p,{children:"For example, step two of the High Availability with an External DB guide mentions the following:"}),(0,a.jsx)(r.pre,{children:(0,a.jsx)(r.code,{className:"language-bash",children:'curl -sfL https://get.k3s.io | sh -s - server \\\n --token=SECRET \\\n --datastore-endpoint="mysql://username:password@tcp(hostname:3306)/database-name"\n'})}),(0,a.jsx)(r.p,{children:"Instead, you would modify such examples like below:"}),(0,a.jsx)(r.pre,{children:(0,a.jsx)(r.code,{className:"language-bash",children:"INSTALL_K3S_SKIP_DOWNLOAD=true INSTALL_K3S_EXEC='server --token=SECRET' \\\nK3S_DATASTORE_ENDPOINT='mysql://username:password@tcp(hostname:3306)/database-name' \\\n./install.sh\n"})})]})]}),"\n",(0,a.jsx)(r.admonition,{type:"note",children:(0,a.jsxs)(r.p,{children:["K3s's ",(0,a.jsx)(r.code,{children:"--resolv-conf"})," flag is passed through to the kubelet, which may help with configuring pod DNS resolution in air-gap networks where the host does not have upstream nameservers configured."]})}),"\n",(0,a.jsx)(r.h2,{id:"upgrading",children:"Upgrading"}),"\n",(0,a.jsx)(r.h3,{id:"install-script-method",children:"Install Script Method"}),"\n",(0,a.jsx)(r.p,{children:"Upgrading an air-gap environment can be accomplished in the following manner:"}),"\n",(0,a.jsxs)(r.ol,{children:["\n",(0,a.jsxs)(r.li,{children:["Download the new air-gap images (tar file) from the ",(0,a.jsx)(r.a,{href:"https://github.com/k3s-io/k3s/releases",children:"releases"})," page for the version of K3s you will be upgrading to. Place the tar in the ",(0,a.jsx)(r.code,{children:"/var/lib/rancher/k3s/agent/images/"})," directory on each\nnode. Delete the old tar file."]}),"\n",(0,a.jsxs)(r.li,{children:["Copy and replace the old K3s binary in ",(0,a.jsx)(r.code,{children:"/usr/local/bin"})," on each node. Copy over the install script at ",(0,a.jsx)(r.a,{href:"https://get.k3s.io",children:"https://get.k3s.io"})," (as it is possible it has changed since the last release). Run the script again just as you had done in the past\nwith the same environment variables."]}),"\n",(0,a.jsx)(r.li,{children:"Restart the K3s service (if not restarted automatically by installer)."}),"\n"]}),"\n",(0,a.jsx)(r.h3,{id:"automated-upgrades-method",children:"Automated Upgrades Method"}),"\n",(0,a.jsxs)(r.p,{children:["K3s supports ",(0,a.jsx)(r.a,{href:"/upgrades/automated",children:"automated upgrades"}),". To enable this in air-gapped environments, you must ensure the required images are available in your private registry."]}),"\n",(0,a.jsxs)(r.p,{children:["You will need the version of rancher/k3s-upgrade that corresponds to the version of K3s you intend to upgrade to. Note, the image tag replaces the ",(0,a.jsx)(r.code,{children:"+"})," in the K3s release with a ",(0,a.jsx)(r.code,{children:"-"})," because Docker images do not support ",(0,a.jsx)(r.code,{children:"+"}),"."]}),"\n",(0,a.jsxs)(r.p,{children:["You will also need the versions of system-upgrade-controller and kubectl that are specified in the system-upgrade-controller manifest YAML that you will deploy. Check for the latest release of the system-upgrade-controller ",(0,a.jsx)(r.a,{href:"https://github.com/rancher/system-upgrade-controller/releases/latest",children:"here"})," and download the system-upgrade-controller.yaml to determine the versions you need to push to your private registry. For example, in release v0.4.0 of the system-upgrade-controller, these images are specified in the manifest YAML:"]}),"\n",(0,a.jsx)(r.pre,{children:(0,a.jsx)(r.code,{children:"rancher/system-upgrade-controller:v0.4.0\nrancher/kubectl:v0.17.0\n"})}),"\n",(0,a.jsxs)(r.p,{children:["Once you have added the necessary rancher/k3s-upgrade, rancher/system-upgrade-controller, and rancher/kubectl images to your private registry, follow the ",(0,a.jsx)(r.a,{href:"/upgrades/automated",children:"automated upgrades"})," guide."]})]})}function c(e={}){const{wrapper:r}={...(0,i.a)(),...e.components};return r?(0,a.jsx)(r,{...e,children:(0,a.jsx)(h,{...e})}):h(e)}function u(e,r){throw new Error("Expected "+(r?"component":"object")+" `"+e+"` to be defined: you likely forgot to import, pass, or provide it.")}},1151:(e,r,n)=>{n.d(r,{Z:()=>l,a:()=>t});var a=n(7294);const i={},s=a.createContext(i);function t(e){const r=a.useContext(s);return a.useMemo((function(){return"function"==typeof e?e(r):{...r,...e}}),[r,e])}function l(e){let r;return r=e.disableParentContext?"function"==typeof e.components?e.components(i):e.components||i:t(e.components),a.createElement(s.Provider,{value:r},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/ee75e821.44621843.js b/assets/js/ee75e821.38c6645f.js similarity index 97% rename from assets/js/ee75e821.44621843.js rename to assets/js/ee75e821.38c6645f.js index 0ef470cb3..d364c2aa0 100644 --- a/assets/js/ee75e821.44621843.js +++ b/assets/js/ee75e821.38c6645f.js @@ -1 +1 @@ -"use strict";(self.webpackChunkk_3_s_docs=self.webpackChunkk_3_s_docs||[]).push([[7893],{5380:(n,e,t)=>{t.r(e),t.d(e,{assets:()=>a,contentTitle:()=>s,default:()=>u,frontMatter:()=>r,metadata:()=>c,toc:()=>l});var i=t(5893),o=t(1151);const r={title:"Networking"},s=void 0,c={id:"networking/networking",title:"Networking",description:"This section contains instructions for configuring networking in K3s.",source:"@site/docs/networking/networking.md",sourceDirName:"networking",slug:"/networking/",permalink:"/networking/",draft:!1,unlisted:!1,editUrl:"https://github.com/k3s-io/docs/edit/main/docs/networking/networking.md",tags:[],version:"current",lastUpdatedAt:1723651727e3,frontMatter:{title:"Networking"},sidebar:"mySidebar",previous:{title:"Volumes and Storage",permalink:"/storage"},next:{title:"Basic Network Options",permalink:"/networking/basic-network-options"}},a={},l=[];function d(n){const e={a:"a",p:"p",...(0,o.a)(),...n.components};return(0,i.jsxs)(i.Fragment,{children:[(0,i.jsx)(e.p,{children:"This section contains instructions for configuring networking in K3s."}),"\n",(0,i.jsxs)(e.p,{children:[(0,i.jsx)(e.a,{href:"/networking/basic-network-options",children:"Basic Network Options"})," covers the basic networking configuration of the cluster such as flannel and single/dual stack configurations"]}),"\n",(0,i.jsxs)(e.p,{children:[(0,i.jsx)(e.a,{href:"/networking/distributed-multicloud",children:"Hybrid/Multicloud cluster"})," provides guidance on the options available to span the k3s cluster over remote or hybrid nodes"]}),"\n",(0,i.jsxs)(e.p,{children:[(0,i.jsx)(e.a,{href:"/networking/multus-ipams",children:"Multus and IPAM plugins"})," provides guidance to leverage Multus in K3s in order to have multiple interfaces per pod"]}),"\n",(0,i.jsxs)(e.p,{children:[(0,i.jsx)(e.a,{href:"/networking/networking-services",children:"Networking services: dns, ingress, etc"})," explains how CoreDNS, Traefik, Network Policy controller and ServiceLB controller work within k3s"]})]})}function u(n={}){const{wrapper:e}={...(0,o.a)(),...n.components};return e?(0,i.jsx)(e,{...n,children:(0,i.jsx)(d,{...n})}):d(n)}},1151:(n,e,t)=>{t.d(e,{Z:()=>c,a:()=>s});var i=t(7294);const o={},r=i.createContext(o);function s(n){const e=i.useContext(r);return i.useMemo((function(){return"function"==typeof n?n(e):{...e,...n}}),[e,n])}function c(n){let e;return e=n.disableParentContext?"function"==typeof n.components?n.components(o):n.components||o:s(n.components),i.createElement(r.Provider,{value:e},n.children)}}}]); \ No newline at end of file +"use strict";(self.webpackChunkk_3_s_docs=self.webpackChunkk_3_s_docs||[]).push([[7893],{5380:(n,e,t)=>{t.r(e),t.d(e,{assets:()=>a,contentTitle:()=>s,default:()=>u,frontMatter:()=>r,metadata:()=>c,toc:()=>l});var i=t(5893),o=t(1151);const r={title:"Networking"},s=void 0,c={id:"networking/networking",title:"Networking",description:"This section contains instructions for configuring networking in K3s.",source:"@site/docs/networking/networking.md",sourceDirName:"networking",slug:"/networking/",permalink:"/networking/",draft:!1,unlisted:!1,editUrl:"https://github.com/k3s-io/docs/edit/main/docs/networking/networking.md",tags:[],version:"current",lastUpdatedAt:1723747404e3,frontMatter:{title:"Networking"},sidebar:"mySidebar",previous:{title:"Volumes and Storage",permalink:"/storage"},next:{title:"Basic Network Options",permalink:"/networking/basic-network-options"}},a={},l=[];function d(n){const e={a:"a",p:"p",...(0,o.a)(),...n.components};return(0,i.jsxs)(i.Fragment,{children:[(0,i.jsx)(e.p,{children:"This section contains instructions for configuring networking in K3s."}),"\n",(0,i.jsxs)(e.p,{children:[(0,i.jsx)(e.a,{href:"/networking/basic-network-options",children:"Basic Network Options"})," covers the basic networking configuration of the cluster such as flannel and single/dual stack configurations"]}),"\n",(0,i.jsxs)(e.p,{children:[(0,i.jsx)(e.a,{href:"/networking/distributed-multicloud",children:"Hybrid/Multicloud cluster"})," provides guidance on the options available to span the k3s cluster over remote or hybrid nodes"]}),"\n",(0,i.jsxs)(e.p,{children:[(0,i.jsx)(e.a,{href:"/networking/multus-ipams",children:"Multus and IPAM plugins"})," provides guidance to leverage Multus in K3s in order to have multiple interfaces per pod"]}),"\n",(0,i.jsxs)(e.p,{children:[(0,i.jsx)(e.a,{href:"/networking/networking-services",children:"Networking services: dns, ingress, etc"})," explains how CoreDNS, Traefik, Network Policy controller and ServiceLB controller work within k3s"]})]})}function u(n={}){const{wrapper:e}={...(0,o.a)(),...n.components};return e?(0,i.jsx)(e,{...n,children:(0,i.jsx)(d,{...n})}):d(n)}},1151:(n,e,t)=>{t.d(e,{Z:()=>c,a:()=>s});var i=t(7294);const o={},r=i.createContext(o);function s(n){const e=i.useContext(r);return i.useMemo((function(){return"function"==typeof n?n(e):{...e,...n}}),[e,n])}function c(n){let e;return e=n.disableParentContext?"function"==typeof n.components?n.components(o):n.components||o:s(n.components),i.createElement(r.Provider,{value:e},n.children)}}}]); \ No newline at end of file diff --git a/assets/js/f319c6ab.e79e5c25.js b/assets/js/f319c6ab.6ea89cd8.js similarity index 99% rename from assets/js/f319c6ab.e79e5c25.js rename to assets/js/f319c6ab.6ea89cd8.js index c6ab58a7b..72ec70cf8 100644 --- a/assets/js/f319c6ab.e79e5c25.js +++ b/assets/js/f319c6ab.6ea89cd8.js @@ -1 +1 @@ -"use strict";(self.webpackChunkk_3_s_docs=self.webpackChunkk_3_s_docs||[]).push([[8379],{1328:(e,s,n)=>{n.r(s),n.d(s,{assets:()=>l,contentTitle:()=>o,default:()=>u,frontMatter:()=>r,metadata:()=>a,toc:()=>d});var t=n(5893),i=n(1151);const r={title:"Known Issues"},o=void 0,a={id:"known-issues",title:"Known Issues",description:"The Known Issues are updated periodically and designed to inform you about any issues that may not be immediately addressed in the next upcoming release.",source:"@site/docs/known-issues.md",sourceDirName:".",slug:"/known-issues",permalink:"/known-issues",draft:!1,unlisted:!1,editUrl:"https://github.com/k3s-io/docs/edit/main/docs/known-issues.md",tags:[],version:"current",lastUpdatedAt:1723651727e3,frontMatter:{title:"Known Issues"},sidebar:"mySidebar",previous:{title:"Related Projects",permalink:"/related-projects"},next:{title:"FAQ",permalink:"/faq"}},l={},d=[{value:"Snap Docker",id:"snap-docker",level:3},{value:"Iptables",id:"iptables",level:3},{value:"Rootless Mode",id:"rootless-mode",level:3},{value:"Upgrading Hardened Clusters from v1.24.x to v1.25.x",id:"hardened-125",level:3}];function c(e){const s={a:"a",admonition:"admonition",code:"code",h3:"h3",li:"li",ol:"ol",p:"p",pre:"pre",...(0,i.a)(),...e.components};return(0,t.jsxs)(t.Fragment,{children:[(0,t.jsx)(s.p,{children:"The Known Issues are updated periodically and designed to inform you about any issues that may not be immediately addressed in the next upcoming release."}),"\n",(0,t.jsx)(s.h3,{id:"snap-docker",children:"Snap Docker"}),"\n",(0,t.jsx)(s.p,{children:"If you plan to use K3s with docker, Docker installed via a snap package is not recommended as it has been known to cause issues running K3s."}),"\n",(0,t.jsx)(s.h3,{id:"iptables",children:"Iptables"}),"\n",(0,t.jsx)(s.p,{children:"If you are running iptables v1.6.1 and older in nftables mode you might encounter issues. We recommend utilizing newer iptables (such as 1.6.1+) to avoid issues or running iptables legacy mode."}),"\n",(0,t.jsx)(s.pre,{children:(0,t.jsx)(s.code,{children:"update-alternatives --set iptables /usr/sbin/iptables-legacy\nupdate-alternatives --set ip6tables /usr/sbin/ip6tables-legacy\n"})}),"\n",(0,t.jsxs)(s.p,{children:["Iptables versions 1.8.0-1.8.4 have known issues that can cause K3s to fail. Several popular Linux distributions ship with these versions by default. One bug causes the accumulation of duplicate rules, which negatively affects the performance and stability of the node. See ",(0,t.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/issues/3117",children:"Issue #3117"})," for information on how to determine if you are affected by this problem."]}),"\n",(0,t.jsxs)(s.p,{children:["K3s includes a working version of iptables (v1.8.8) which functions properly. You can tell K3s to use its bundled version of iptables by starting K3s with the ",(0,t.jsx)(s.code,{children:"--prefer-bundled-bin"})," option, or by uninstalling the iptables/nftables packages from your operating system."]}),"\n",(0,t.jsx)(s.admonition,{title:"Version Gate",type:"info",children:(0,t.jsxs)(s.p,{children:["The ",(0,t.jsx)(s.code,{children:"--prefer-bundled-bin"})," flag is available starting with the 2022-12 releases (v1.26.0+k3s1, v1.25.5+k3s1, v1.24.9+k3s1, v1.23.15+k3s1)."]})}),"\n",(0,t.jsx)(s.h3,{id:"rootless-mode",children:"Rootless Mode"}),"\n",(0,t.jsxs)(s.p,{children:["Running K3s with Rootless mode is experimental and has several ",(0,t.jsx)(s.a,{href:"/advanced#known-issues-with-rootless-mode",children:"known issues."})]}),"\n",(0,t.jsx)(s.h3,{id:"hardened-125",children:"Upgrading Hardened Clusters from v1.24.x to v1.25.x"}),"\n",(0,t.jsxs)(s.p,{children:["Kubernetes removed PodSecurityPolicy from v1.25 in favor of Pod Security Standards. You can read more about PSS in the ",(0,t.jsx)(s.a,{href:"https://kubernetes.io/docs/concepts/security/pod-security-standards/",children:"upstream documentation"}),". For K3S, there are some manual steps that must be taken if any ",(0,t.jsx)(s.code,{children:"PodSecurityPolicy"})," has been configured on the nodes."]}),"\n",(0,t.jsxs)(s.ol,{children:["\n",(0,t.jsxs)(s.li,{children:["On all nodes, update the ",(0,t.jsx)(s.code,{children:"kube-apiserver-arg"})," value to remove the ",(0,t.jsx)(s.code,{children:"PodSecurityPolicy"})," admission-plugin. Add the following arg value instead: ",(0,t.jsx)(s.code,{children:"'admission-control-config-file=/var/lib/rancher/k3s/server/psa.yaml'"}),", but do NOT restart or upgrade K3S yet. Below is an example of what a configuration file might look like after this update for the node to be hardened:"]}),"\n"]}),"\n",(0,t.jsx)(s.pre,{children:(0,t.jsx)(s.code,{className:"language-yaml",children:"protect-kernel-defaults: true\nsecrets-encryption: true\nkube-apiserver-arg:\n - 'admission-control-config-file=/var/lib/rancher/k3s/server/psa.yaml'\n - 'audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log'\n - 'audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml'\n - 'audit-log-maxage=30'\n - 'audit-log-maxbackup=10'\n - 'audit-log-maxsize=100'\nkube-controller-manager-arg:\n - 'terminated-pod-gc-threshold=10'\n - 'use-service-account-credentials=true'\nkubelet-arg:\n - 'streaming-connection-idle-timeout=5m'\n - 'make-iptables-util-chains=true'\n"})}),"\n",(0,t.jsxs)(s.ol,{start:"2",children:["\n",(0,t.jsxs)(s.li,{children:["Create the ",(0,t.jsx)(s.code,{children:"/var/lib/rancher/k3s/server/psa.yaml"})," file with the following contents. You may want to exempt more namespaces as well. The below example exempts ",(0,t.jsx)(s.code,{children:"kube-system"})," (required), ",(0,t.jsx)(s.code,{children:"cis-operator-system"})," (optional, but useful for when running security scans through Rancher), and ",(0,t.jsx)(s.code,{children:"system-upgrade"})," (required if doing ",(0,t.jsx)(s.a,{href:"/upgrades/automated",children:"Automated Upgrades"}),")."]}),"\n"]}),"\n",(0,t.jsx)(s.pre,{children:(0,t.jsx)(s.code,{className:"language-yaml",children:'apiVersion: apiserver.config.k8s.io/v1\nkind: AdmissionConfiguration\nplugins:\n- name: PodSecurity\n configuration:\n apiVersion: pod-security.admission.config.k8s.io/v1beta1\n kind: PodSecurityConfiguration\n defaults:\n enforce: "restricted"\n enforce-version: "latest"\n audit: "restricted"\n audit-version: "latest"\n warn: "restricted"\n warn-version: "latest"\n exemptions:\n usernames: []\n runtimeClasses: []\n namespaces: [kube-system, cis-operator-system, system-upgrade]\n'})}),"\n",(0,t.jsxs)(s.ol,{start:"3",children:["\n",(0,t.jsxs)(s.li,{children:["Perform the upgrade as normal. If doing ",(0,t.jsx)(s.a,{href:"/upgrades/automated",children:"Automated Upgrades"}),", ensure that the namespace where the ",(0,t.jsx)(s.code,{children:"system-upgrade-controller"})," pod is running in is setup to be privileged in accordance with the ",(0,t.jsx)(s.a,{href:"https://kubernetes.io/docs/concepts/security/pod-security-admission/#pod-security-levels",children:"Pod Security levels"}),":"]}),"\n"]}),"\n",(0,t.jsx)(s.pre,{children:(0,t.jsx)(s.code,{className:"language-yaml",children:"apiVersion: v1\nkind: Namespace\nmetadata:\n name: system-upgrade\n labels:\n # This value must be privileged for the controller to run successfully.\n pod-security.kubernetes.io/enforce: privileged\n pod-security.kubernetes.io/enforce-version: v1.25\n # We are setting these to our _desired_ `enforce` level, but note that these below values can be any of the available options.\n pod-security.kubernetes.io/audit: privileged\n pod-security.kubernetes.io/audit-version: v1.25\n pod-security.kubernetes.io/warn: privileged\n pod-security.kubernetes.io/warn-version: v1.25\n"})}),"\n",(0,t.jsxs)(s.ol,{start:"4",children:["\n",(0,t.jsxs)(s.li,{children:["After the upgrade is complete, remove any remaining PSP resources from the cluster. In many cases, there may be PodSecurityPolicies and associated RBAC resources in custom files used for hardening within ",(0,t.jsx)(s.code,{children:"/var/lib/rancher/k3s/server/manifests/"}),". Remove those resources and k3s will update automatically. Sometimes, due to timing, some of these may be left in the cluster, in which case you will need to delete them manually. If the ",(0,t.jsx)(s.a,{href:"/security/hardening-guide",children:"Hardening Guide"})," was previously followed, you should be able to delete them via the following:"]}),"\n"]}),"\n",(0,t.jsx)(s.pre,{children:(0,t.jsx)(s.code,{className:"language-sh",children:"# Get the resources associated with PSPs\n$ kubectl get roles,clusterroles,rolebindings,clusterrolebindings -A | grep -i psp\n\n# Delete those resources:\n$ kubectl delete clusterrole.rbac.authorization.k8s.io/psp:restricted-psp clusterrole.rbac.authorization.k8s.io/psp:svclb-psp clusterrole.rbac.authorization.k8s.io/psp:system-unrestricted-psp clusterrolebinding.rbac.authorization.k8s.io/default:restricted-psp clusterrolebinding.rbac.authorization.k8s.io/system-unrestricted-node-psp-rolebinding && kubectl delete -n kube-system rolebinding.rbac.authorization.k8s.io/svclb-psp-rolebinding rolebinding.rbac.authorization.k8s.io/system-unrestricted-svc-acct-psp-rolebinding\n"})})]})}function u(e={}){const{wrapper:s}={...(0,i.a)(),...e.components};return s?(0,t.jsx)(s,{...e,children:(0,t.jsx)(c,{...e})}):c(e)}},1151:(e,s,n)=>{n.d(s,{Z:()=>a,a:()=>o});var t=n(7294);const i={},r=t.createContext(i);function o(e){const s=t.useContext(r);return t.useMemo((function(){return"function"==typeof e?e(s):{...s,...e}}),[s,e])}function a(e){let s;return s=e.disableParentContext?"function"==typeof e.components?e.components(i):e.components||i:o(e.components),t.createElement(r.Provider,{value:s},e.children)}}}]); \ No newline at end of file +"use strict";(self.webpackChunkk_3_s_docs=self.webpackChunkk_3_s_docs||[]).push([[8379],{1328:(e,s,n)=>{n.r(s),n.d(s,{assets:()=>l,contentTitle:()=>o,default:()=>u,frontMatter:()=>r,metadata:()=>a,toc:()=>d});var t=n(5893),i=n(1151);const r={title:"Known Issues"},o=void 0,a={id:"known-issues",title:"Known Issues",description:"The Known Issues are updated periodically and designed to inform you about any issues that may not be immediately addressed in the next upcoming release.",source:"@site/docs/known-issues.md",sourceDirName:".",slug:"/known-issues",permalink:"/known-issues",draft:!1,unlisted:!1,editUrl:"https://github.com/k3s-io/docs/edit/main/docs/known-issues.md",tags:[],version:"current",lastUpdatedAt:1723747404e3,frontMatter:{title:"Known Issues"},sidebar:"mySidebar",previous:{title:"Related Projects",permalink:"/related-projects"},next:{title:"FAQ",permalink:"/faq"}},l={},d=[{value:"Snap Docker",id:"snap-docker",level:3},{value:"Iptables",id:"iptables",level:3},{value:"Rootless Mode",id:"rootless-mode",level:3},{value:"Upgrading Hardened Clusters from v1.24.x to v1.25.x",id:"hardened-125",level:3}];function c(e){const s={a:"a",admonition:"admonition",code:"code",h3:"h3",li:"li",ol:"ol",p:"p",pre:"pre",...(0,i.a)(),...e.components};return(0,t.jsxs)(t.Fragment,{children:[(0,t.jsx)(s.p,{children:"The Known Issues are updated periodically and designed to inform you about any issues that may not be immediately addressed in the next upcoming release."}),"\n",(0,t.jsx)(s.h3,{id:"snap-docker",children:"Snap Docker"}),"\n",(0,t.jsx)(s.p,{children:"If you plan to use K3s with docker, Docker installed via a snap package is not recommended as it has been known to cause issues running K3s."}),"\n",(0,t.jsx)(s.h3,{id:"iptables",children:"Iptables"}),"\n",(0,t.jsx)(s.p,{children:"If you are running iptables v1.6.1 and older in nftables mode you might encounter issues. We recommend utilizing newer iptables (such as 1.6.1+) to avoid issues or running iptables legacy mode."}),"\n",(0,t.jsx)(s.pre,{children:(0,t.jsx)(s.code,{children:"update-alternatives --set iptables /usr/sbin/iptables-legacy\nupdate-alternatives --set ip6tables /usr/sbin/ip6tables-legacy\n"})}),"\n",(0,t.jsxs)(s.p,{children:["Iptables versions 1.8.0-1.8.4 have known issues that can cause K3s to fail. Several popular Linux distributions ship with these versions by default. One bug causes the accumulation of duplicate rules, which negatively affects the performance and stability of the node. See ",(0,t.jsx)(s.a,{href:"https://github.com/k3s-io/k3s/issues/3117",children:"Issue #3117"})," for information on how to determine if you are affected by this problem."]}),"\n",(0,t.jsxs)(s.p,{children:["K3s includes a working version of iptables (v1.8.8) which functions properly. You can tell K3s to use its bundled version of iptables by starting K3s with the ",(0,t.jsx)(s.code,{children:"--prefer-bundled-bin"})," option, or by uninstalling the iptables/nftables packages from your operating system."]}),"\n",(0,t.jsx)(s.admonition,{title:"Version Gate",type:"info",children:(0,t.jsxs)(s.p,{children:["The ",(0,t.jsx)(s.code,{children:"--prefer-bundled-bin"})," flag is available starting with the 2022-12 releases (v1.26.0+k3s1, v1.25.5+k3s1, v1.24.9+k3s1, v1.23.15+k3s1)."]})}),"\n",(0,t.jsx)(s.h3,{id:"rootless-mode",children:"Rootless Mode"}),"\n",(0,t.jsxs)(s.p,{children:["Running K3s with Rootless mode is experimental and has several ",(0,t.jsx)(s.a,{href:"/advanced#known-issues-with-rootless-mode",children:"known issues."})]}),"\n",(0,t.jsx)(s.h3,{id:"hardened-125",children:"Upgrading Hardened Clusters from v1.24.x to v1.25.x"}),"\n",(0,t.jsxs)(s.p,{children:["Kubernetes removed PodSecurityPolicy from v1.25 in favor of Pod Security Standards. You can read more about PSS in the ",(0,t.jsx)(s.a,{href:"https://kubernetes.io/docs/concepts/security/pod-security-standards/",children:"upstream documentation"}),". For K3S, there are some manual steps that must be taken if any ",(0,t.jsx)(s.code,{children:"PodSecurityPolicy"})," has been configured on the nodes."]}),"\n",(0,t.jsxs)(s.ol,{children:["\n",(0,t.jsxs)(s.li,{children:["On all nodes, update the ",(0,t.jsx)(s.code,{children:"kube-apiserver-arg"})," value to remove the ",(0,t.jsx)(s.code,{children:"PodSecurityPolicy"})," admission-plugin. Add the following arg value instead: ",(0,t.jsx)(s.code,{children:"'admission-control-config-file=/var/lib/rancher/k3s/server/psa.yaml'"}),", but do NOT restart or upgrade K3S yet. Below is an example of what a configuration file might look like after this update for the node to be hardened:"]}),"\n"]}),"\n",(0,t.jsx)(s.pre,{children:(0,t.jsx)(s.code,{className:"language-yaml",children:"protect-kernel-defaults: true\nsecrets-encryption: true\nkube-apiserver-arg:\n - 'admission-control-config-file=/var/lib/rancher/k3s/server/psa.yaml'\n - 'audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log'\n - 'audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml'\n - 'audit-log-maxage=30'\n - 'audit-log-maxbackup=10'\n - 'audit-log-maxsize=100'\nkube-controller-manager-arg:\n - 'terminated-pod-gc-threshold=10'\n - 'use-service-account-credentials=true'\nkubelet-arg:\n - 'streaming-connection-idle-timeout=5m'\n - 'make-iptables-util-chains=true'\n"})}),"\n",(0,t.jsxs)(s.ol,{start:"2",children:["\n",(0,t.jsxs)(s.li,{children:["Create the ",(0,t.jsx)(s.code,{children:"/var/lib/rancher/k3s/server/psa.yaml"})," file with the following contents. You may want to exempt more namespaces as well. The below example exempts ",(0,t.jsx)(s.code,{children:"kube-system"})," (required), ",(0,t.jsx)(s.code,{children:"cis-operator-system"})," (optional, but useful for when running security scans through Rancher), and ",(0,t.jsx)(s.code,{children:"system-upgrade"})," (required if doing ",(0,t.jsx)(s.a,{href:"/upgrades/automated",children:"Automated Upgrades"}),")."]}),"\n"]}),"\n",(0,t.jsx)(s.pre,{children:(0,t.jsx)(s.code,{className:"language-yaml",children:'apiVersion: apiserver.config.k8s.io/v1\nkind: AdmissionConfiguration\nplugins:\n- name: PodSecurity\n configuration:\n apiVersion: pod-security.admission.config.k8s.io/v1beta1\n kind: PodSecurityConfiguration\n defaults:\n enforce: "restricted"\n enforce-version: "latest"\n audit: "restricted"\n audit-version: "latest"\n warn: "restricted"\n warn-version: "latest"\n exemptions:\n usernames: []\n runtimeClasses: []\n namespaces: [kube-system, cis-operator-system, system-upgrade]\n'})}),"\n",(0,t.jsxs)(s.ol,{start:"3",children:["\n",(0,t.jsxs)(s.li,{children:["Perform the upgrade as normal. If doing ",(0,t.jsx)(s.a,{href:"/upgrades/automated",children:"Automated Upgrades"}),", ensure that the namespace where the ",(0,t.jsx)(s.code,{children:"system-upgrade-controller"})," pod is running in is setup to be privileged in accordance with the ",(0,t.jsx)(s.a,{href:"https://kubernetes.io/docs/concepts/security/pod-security-admission/#pod-security-levels",children:"Pod Security levels"}),":"]}),"\n"]}),"\n",(0,t.jsx)(s.pre,{children:(0,t.jsx)(s.code,{className:"language-yaml",children:"apiVersion: v1\nkind: Namespace\nmetadata:\n name: system-upgrade\n labels:\n # This value must be privileged for the controller to run successfully.\n pod-security.kubernetes.io/enforce: privileged\n pod-security.kubernetes.io/enforce-version: v1.25\n # We are setting these to our _desired_ `enforce` level, but note that these below values can be any of the available options.\n pod-security.kubernetes.io/audit: privileged\n pod-security.kubernetes.io/audit-version: v1.25\n pod-security.kubernetes.io/warn: privileged\n pod-security.kubernetes.io/warn-version: v1.25\n"})}),"\n",(0,t.jsxs)(s.ol,{start:"4",children:["\n",(0,t.jsxs)(s.li,{children:["After the upgrade is complete, remove any remaining PSP resources from the cluster. In many cases, there may be PodSecurityPolicies and associated RBAC resources in custom files used for hardening within ",(0,t.jsx)(s.code,{children:"/var/lib/rancher/k3s/server/manifests/"}),". Remove those resources and k3s will update automatically. Sometimes, due to timing, some of these may be left in the cluster, in which case you will need to delete them manually. If the ",(0,t.jsx)(s.a,{href:"/security/hardening-guide",children:"Hardening Guide"})," was previously followed, you should be able to delete them via the following:"]}),"\n"]}),"\n",(0,t.jsx)(s.pre,{children:(0,t.jsx)(s.code,{className:"language-sh",children:"# Get the resources associated with PSPs\n$ kubectl get roles,clusterroles,rolebindings,clusterrolebindings -A | grep -i psp\n\n# Delete those resources:\n$ kubectl delete clusterrole.rbac.authorization.k8s.io/psp:restricted-psp clusterrole.rbac.authorization.k8s.io/psp:svclb-psp clusterrole.rbac.authorization.k8s.io/psp:system-unrestricted-psp clusterrolebinding.rbac.authorization.k8s.io/default:restricted-psp clusterrolebinding.rbac.authorization.k8s.io/system-unrestricted-node-psp-rolebinding && kubectl delete -n kube-system rolebinding.rbac.authorization.k8s.io/svclb-psp-rolebinding rolebinding.rbac.authorization.k8s.io/system-unrestricted-svc-acct-psp-rolebinding\n"})})]})}function u(e={}){const{wrapper:s}={...(0,i.a)(),...e.components};return s?(0,t.jsx)(s,{...e,children:(0,t.jsx)(c,{...e})}):c(e)}},1151:(e,s,n)=>{n.d(s,{Z:()=>a,a:()=>o});var t=n(7294);const i={},r=t.createContext(i);function o(e){const s=t.useContext(r);return t.useMemo((function(){return"function"==typeof e?e(s):{...s,...e}}),[s,e])}function a(e){let s;return s=e.disableParentContext?"function"==typeof e.components?e.components(i):e.components||i:o(e.components),t.createElement(r.Provider,{value:s},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/f8eefdc6.89458a5c.js b/assets/js/f8eefdc6.8ca85eee.js similarity index 98% rename from assets/js/f8eefdc6.89458a5c.js rename to assets/js/f8eefdc6.8ca85eee.js index 666a70f21..95c7280e9 100644 --- a/assets/js/f8eefdc6.89458a5c.js +++ b/assets/js/f8eefdc6.8ca85eee.js @@ -1 +1 @@ -"use strict";(self.webpackChunkk_3_s_docs=self.webpackChunkk_3_s_docs||[]).push([[5234],{2435:(e,n,t)=>{t.r(n),t.d(n,{assets:()=>d,contentTitle:()=>r,default:()=>h,frontMatter:()=>i,metadata:()=>l,toc:()=>a});var s=t(5893),o=t(1151);const i={title:"Managing Server Roles"},r=void 0,l={id:"installation/server-roles",title:"Managing Server Roles",description:"Starting the K3s server with --cluster-init will run all control-plane components, including the apiserver, controller-manager, scheduler, and etcd. It is possible to disable specific components in order to split the control-plane and etcd roles on to separate nodes.",source:"@site/docs/installation/server-roles.md",sourceDirName:"installation",slug:"/installation/server-roles",permalink:"/installation/server-roles",draft:!1,unlisted:!1,editUrl:"https://github.com/k3s-io/docs/edit/main/docs/installation/server-roles.md",tags:[],version:"current",lastUpdatedAt:1723651727e3,frontMatter:{title:"Managing Server Roles"},sidebar:"mySidebar",previous:{title:"Air-Gap Install",permalink:"/installation/airgap"},next:{title:"Managing Packaged Components",permalink:"/installation/packaged-components"}},d={},a=[{value:"Dedicated etcd Nodes",id:"dedicated-etcd-nodes",level:2},{value:"Dedicated control-plane Nodes",id:"dedicated-control-plane-nodes",level:2},{value:"Adding Roles To Existing Servers",id:"adding-roles-to-existing-servers",level:2},{value:"Configuration File Syntax",id:"configuration-file-syntax",level:2}];function c(e){const n={a:"a",admonition:"admonition",code:"code",h2:"h2",p:"p",pre:"pre",...(0,o.a)(),...e.components};return(0,s.jsxs)(s.Fragment,{children:[(0,s.jsxs)(n.p,{children:["Starting the K3s server with ",(0,s.jsx)(n.code,{children:"--cluster-init"})," will run all control-plane components, including the apiserver, controller-manager, scheduler, and etcd. It is possible to disable specific components in order to split the control-plane and etcd roles on to separate nodes."]}),"\n",(0,s.jsx)(n.admonition,{type:"info",children:(0,s.jsx)(n.p,{children:"This document is only relevant when using embedded etcd. When not using embedded etcd, all servers will have the control-plane role and run control-plane components."})}),"\n",(0,s.jsxs)(n.h2,{id:"dedicated-etcd-nodes",children:["Dedicated ",(0,s.jsx)(n.code,{children:"etcd"})," Nodes"]}),"\n",(0,s.jsxs)(n.p,{children:["To create a server with only the ",(0,s.jsx)(n.code,{children:"etcd"})," role, start K3s with all the control-plane components disabled:"]}),"\n",(0,s.jsx)(n.pre,{children:(0,s.jsx)(n.code,{children:"curl -fL https://get.k3s.io | sh -s - server --cluster-init --disable-apiserver --disable-controller-manager --disable-scheduler\n"})}),"\n",(0,s.jsxs)(n.p,{children:["This first node will start etcd, and wait for additional ",(0,s.jsx)(n.code,{children:"etcd"})," and/or ",(0,s.jsx)(n.code,{children:"control-plane"})," nodes to join. The cluster will not be usable until you join an additional server with the ",(0,s.jsx)(n.code,{children:"control-plane"})," components enabled."]}),"\n",(0,s.jsxs)(n.h2,{id:"dedicated-control-plane-nodes",children:["Dedicated ",(0,s.jsx)(n.code,{children:"control-plane"})," Nodes"]}),"\n",(0,s.jsx)(n.admonition,{type:"note",children:(0,s.jsxs)(n.p,{children:["A dedicated ",(0,s.jsx)(n.code,{children:"control-plane"})," node cannot be the first server in the cluster; there must be an existing node with the ",(0,s.jsx)(n.code,{children:"etcd"})," role before joining dedicated ",(0,s.jsx)(n.code,{children:"control-plane"})," nodes."]})}),"\n",(0,s.jsxs)(n.p,{children:["To create a server with only the ",(0,s.jsx)(n.code,{children:"control-plane"})," role, start k3s with etcd disabled:"]}),"\n",(0,s.jsx)(n.pre,{children:(0,s.jsx)(n.code,{className:"language-bash",children:"curl -fL https://get.k3s.io | sh -s - server --token --disable-etcd --server https://:6443 \n"})}),"\n",(0,s.jsxs)(n.p,{children:["After creating dedicated server nodes, the selected roles will be visible in ",(0,s.jsx)(n.code,{children:"kubectl get node"}),":"]}),"\n",(0,s.jsx)(n.pre,{children:(0,s.jsx)(n.code,{className:"language-bash",children:"$ kubectl get nodes\nNAME STATUS ROLES AGE VERSION\nk3s-server-1 Ready etcd 5h39m v1.20.4+k3s1\nk3s-server-2 Ready control-plane,master 5h39m v1.20.4+k3s1\n"})}),"\n",(0,s.jsx)(n.h2,{id:"adding-roles-to-existing-servers",children:"Adding Roles To Existing Servers"}),"\n",(0,s.jsxs)(n.p,{children:["Roles can be added to existing dedicated nodes by restarting K3s with the disable flags removed. For example ,if you want to add the ",(0,s.jsx)(n.code,{children:"control-plane"})," role to a dedicated ",(0,s.jsx)(n.code,{children:"etcd"})," node, you can remove the ",(0,s.jsx)(n.code,{children:"--disable-apiserver --disable-controller-manager --disable-scheduler"})," flags from the systemd unit or config file, and restart the service."]}),"\n",(0,s.jsx)(n.h2,{id:"configuration-file-syntax",children:"Configuration File Syntax"}),"\n",(0,s.jsxs)(n.p,{children:["As with all other CLI flags, you can use the ",(0,s.jsx)(n.a,{href:"/installation/configuration#configuration-file",children:"Configuration File"})," to disable components, instead of passing the options as CLI flags. For example, to create a dedicated ",(0,s.jsx)(n.code,{children:"etcd"})," node, you can place the following values in ",(0,s.jsx)(n.code,{children:"/etc/rancher/k3s/config.yaml"}),":"]}),"\n",(0,s.jsx)(n.pre,{children:(0,s.jsx)(n.code,{className:"language-yaml",children:"cluster-init: true\ndisable-apiserver: true\ndisable-controller-manager: true\ndisable-scheduler: true\n"})})]})}function h(e={}){const{wrapper:n}={...(0,o.a)(),...e.components};return n?(0,s.jsx)(n,{...e,children:(0,s.jsx)(c,{...e})}):c(e)}},1151:(e,n,t)=>{t.d(n,{Z:()=>l,a:()=>r});var s=t(7294);const o={},i=s.createContext(o);function r(e){const n=s.useContext(i);return s.useMemo((function(){return"function"==typeof e?e(n):{...n,...e}}),[n,e])}function l(e){let n;return n=e.disableParentContext?"function"==typeof e.components?e.components(o):e.components||o:r(e.components),s.createElement(i.Provider,{value:n},e.children)}}}]); \ No newline at end of file +"use strict";(self.webpackChunkk_3_s_docs=self.webpackChunkk_3_s_docs||[]).push([[5234],{2435:(e,n,t)=>{t.r(n),t.d(n,{assets:()=>d,contentTitle:()=>r,default:()=>h,frontMatter:()=>i,metadata:()=>l,toc:()=>a});var s=t(5893),o=t(1151);const i={title:"Managing Server Roles"},r=void 0,l={id:"installation/server-roles",title:"Managing Server Roles",description:"Starting the K3s server with --cluster-init will run all control-plane components, including the apiserver, controller-manager, scheduler, and etcd. It is possible to disable specific components in order to split the control-plane and etcd roles on to separate nodes.",source:"@site/docs/installation/server-roles.md",sourceDirName:"installation",slug:"/installation/server-roles",permalink:"/installation/server-roles",draft:!1,unlisted:!1,editUrl:"https://github.com/k3s-io/docs/edit/main/docs/installation/server-roles.md",tags:[],version:"current",lastUpdatedAt:1723747404e3,frontMatter:{title:"Managing Server Roles"},sidebar:"mySidebar",previous:{title:"Air-Gap Install",permalink:"/installation/airgap"},next:{title:"Managing Packaged Components",permalink:"/installation/packaged-components"}},d={},a=[{value:"Dedicated etcd Nodes",id:"dedicated-etcd-nodes",level:2},{value:"Dedicated control-plane Nodes",id:"dedicated-control-plane-nodes",level:2},{value:"Adding Roles To Existing Servers",id:"adding-roles-to-existing-servers",level:2},{value:"Configuration File Syntax",id:"configuration-file-syntax",level:2}];function c(e){const n={a:"a",admonition:"admonition",code:"code",h2:"h2",p:"p",pre:"pre",...(0,o.a)(),...e.components};return(0,s.jsxs)(s.Fragment,{children:[(0,s.jsxs)(n.p,{children:["Starting the K3s server with ",(0,s.jsx)(n.code,{children:"--cluster-init"})," will run all control-plane components, including the apiserver, controller-manager, scheduler, and etcd. It is possible to disable specific components in order to split the control-plane and etcd roles on to separate nodes."]}),"\n",(0,s.jsx)(n.admonition,{type:"info",children:(0,s.jsx)(n.p,{children:"This document is only relevant when using embedded etcd. When not using embedded etcd, all servers will have the control-plane role and run control-plane components."})}),"\n",(0,s.jsxs)(n.h2,{id:"dedicated-etcd-nodes",children:["Dedicated ",(0,s.jsx)(n.code,{children:"etcd"})," Nodes"]}),"\n",(0,s.jsxs)(n.p,{children:["To create a server with only the ",(0,s.jsx)(n.code,{children:"etcd"})," role, start K3s with all the control-plane components disabled:"]}),"\n",(0,s.jsx)(n.pre,{children:(0,s.jsx)(n.code,{children:"curl -fL https://get.k3s.io | sh -s - server --cluster-init --disable-apiserver --disable-controller-manager --disable-scheduler\n"})}),"\n",(0,s.jsxs)(n.p,{children:["This first node will start etcd, and wait for additional ",(0,s.jsx)(n.code,{children:"etcd"})," and/or ",(0,s.jsx)(n.code,{children:"control-plane"})," nodes to join. The cluster will not be usable until you join an additional server with the ",(0,s.jsx)(n.code,{children:"control-plane"})," components enabled."]}),"\n",(0,s.jsxs)(n.h2,{id:"dedicated-control-plane-nodes",children:["Dedicated ",(0,s.jsx)(n.code,{children:"control-plane"})," Nodes"]}),"\n",(0,s.jsx)(n.admonition,{type:"note",children:(0,s.jsxs)(n.p,{children:["A dedicated ",(0,s.jsx)(n.code,{children:"control-plane"})," node cannot be the first server in the cluster; there must be an existing node with the ",(0,s.jsx)(n.code,{children:"etcd"})," role before joining dedicated ",(0,s.jsx)(n.code,{children:"control-plane"})," nodes."]})}),"\n",(0,s.jsxs)(n.p,{children:["To create a server with only the ",(0,s.jsx)(n.code,{children:"control-plane"})," role, start k3s with etcd disabled:"]}),"\n",(0,s.jsx)(n.pre,{children:(0,s.jsx)(n.code,{className:"language-bash",children:"curl -fL https://get.k3s.io | sh -s - server --token --disable-etcd --server https://:6443 \n"})}),"\n",(0,s.jsxs)(n.p,{children:["After creating dedicated server nodes, the selected roles will be visible in ",(0,s.jsx)(n.code,{children:"kubectl get node"}),":"]}),"\n",(0,s.jsx)(n.pre,{children:(0,s.jsx)(n.code,{className:"language-bash",children:"$ kubectl get nodes\nNAME STATUS ROLES AGE VERSION\nk3s-server-1 Ready etcd 5h39m v1.20.4+k3s1\nk3s-server-2 Ready control-plane,master 5h39m v1.20.4+k3s1\n"})}),"\n",(0,s.jsx)(n.h2,{id:"adding-roles-to-existing-servers",children:"Adding Roles To Existing Servers"}),"\n",(0,s.jsxs)(n.p,{children:["Roles can be added to existing dedicated nodes by restarting K3s with the disable flags removed. For example ,if you want to add the ",(0,s.jsx)(n.code,{children:"control-plane"})," role to a dedicated ",(0,s.jsx)(n.code,{children:"etcd"})," node, you can remove the ",(0,s.jsx)(n.code,{children:"--disable-apiserver --disable-controller-manager --disable-scheduler"})," flags from the systemd unit or config file, and restart the service."]}),"\n",(0,s.jsx)(n.h2,{id:"configuration-file-syntax",children:"Configuration File Syntax"}),"\n",(0,s.jsxs)(n.p,{children:["As with all other CLI flags, you can use the ",(0,s.jsx)(n.a,{href:"/installation/configuration#configuration-file",children:"Configuration File"})," to disable components, instead of passing the options as CLI flags. For example, to create a dedicated ",(0,s.jsx)(n.code,{children:"etcd"})," node, you can place the following values in ",(0,s.jsx)(n.code,{children:"/etc/rancher/k3s/config.yaml"}),":"]}),"\n",(0,s.jsx)(n.pre,{children:(0,s.jsx)(n.code,{className:"language-yaml",children:"cluster-init: true\ndisable-apiserver: true\ndisable-controller-manager: true\ndisable-scheduler: true\n"})})]})}function h(e={}){const{wrapper:n}={...(0,o.a)(),...e.components};return n?(0,s.jsx)(n,{...e,children:(0,s.jsx)(c,{...e})}):c(e)}},1151:(e,n,t)=>{t.d(n,{Z:()=>l,a:()=>r});var s=t(7294);const o={},i=s.createContext(o);function r(e){const n=s.useContext(i);return s.useMemo((function(){return"function"==typeof e?e(n):{...n,...e}}),[n,e])}function l(e){let n;return n=e.disableParentContext?"function"==typeof e.components?e.components(o):e.components||o:r(e.components),s.createElement(i.Provider,{value:n},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/fc39421f.1fa14bac.js b/assets/js/fc39421f.62f3dc5b.js similarity index 99% rename from assets/js/fc39421f.1fa14bac.js rename to assets/js/fc39421f.62f3dc5b.js index a780f794a..bca1a273c 100644 --- a/assets/js/fc39421f.1fa14bac.js +++ b/assets/js/fc39421f.62f3dc5b.js @@ -1 +1 @@ -"use strict";(self.webpackChunkk_3_s_docs=self.webpackChunkk_3_s_docs||[]).push([[9778],{8573:(e,r,s)=>{s.r(r),s.d(r,{assets:()=>o,contentTitle:()=>d,default:()=>h,frontMatter:()=>i,metadata:()=>l,toc:()=>a});var n=s(5893),t=s(1151);const i={title:"Resource Profiling"},d=void 0,l={id:"reference/resource-profiling",title:"Resource Profiling",description:"This section captures the results of tests to determine minimum resource requirements for K3s.",source:"@site/docs/reference/resource-profiling.md",sourceDirName:"reference",slug:"/reference/resource-profiling",permalink:"/reference/resource-profiling",draft:!1,unlisted:!1,editUrl:"https://github.com/k3s-io/docs/edit/main/docs/reference/resource-profiling.md",tags:[],version:"current",lastUpdatedAt:1723651727e3,frontMatter:{title:"Resource Profiling"},sidebar:"mySidebar",previous:{title:"Flag Deprecation",permalink:"/reference/flag-deprecation"},next:{title:"v1.30.X",permalink:"/release-notes/v1.30.X"}},o={},a=[{value:"Scope of Resource Testing",id:"scope-of-resource-testing",level:2},{value:"Components Included for Baseline Measurements",id:"components-included-for-baseline-measurements",level:2},{value:"Methodology",id:"methodology",level:2},{value:"Environment",id:"environment",level:2},{value:"Baseline Resource Requirements",id:"baseline-resource-requirements",level:2},{value:"K3s Server with a Workload",id:"k3s-server-with-a-workload",level:3},{value:"K3s Cluster with a Single Agent",id:"k3s-cluster-with-a-single-agent",level:3},{value:"K3s Server",id:"k3s-server",level:4},{value:"K3s Agent",id:"k3s-agent",level:3},{value:"Analysis",id:"analysis",level:2},{value:"Primary Resource Utilization Drivers",id:"primary-resource-utilization-drivers",level:3},{value:"Preventing Agents and Workloads from Interfering with the Cluster Datastore",id:"preventing-agents-and-workloads-from-interfering-with-the-cluster-datastore",level:3}];function c(e){const r={a:"a",code:"code",h2:"h2",h3:"h3",h4:"h4",li:"li",p:"p",table:"table",tbody:"tbody",td:"td",th:"th",thead:"thead",tr:"tr",ul:"ul",...(0,t.a)(),...e.components};return(0,n.jsxs)(n.Fragment,{children:[(0,n.jsx)(r.p,{children:"This section captures the results of tests to determine minimum resource requirements for K3s."}),"\n",(0,n.jsx)(r.p,{children:"The results are summarized as follows:"}),"\n",(0,n.jsxs)(r.table,{children:[(0,n.jsx)(r.thead,{children:(0,n.jsxs)(r.tr,{children:[(0,n.jsx)(r.th,{children:"Components"}),(0,n.jsx)(r.th,{children:"Processor"}),(0,n.jsx)(r.th,{children:"Min CPU"}),(0,n.jsx)(r.th,{children:"Min RAM with Kine/SQLite"}),(0,n.jsx)(r.th,{children:"Min RAM with Embedded etcd"})]})}),(0,n.jsxs)(r.tbody,{children:[(0,n.jsxs)(r.tr,{children:[(0,n.jsx)(r.td,{children:"K3s server with a workload"}),(0,n.jsx)(r.td,{children:"Intel 8375C CPU, 2.90 GHz"}),(0,n.jsx)(r.td,{children:"6% of a core"}),(0,n.jsx)(r.td,{children:"1596 M"}),(0,n.jsx)(r.td,{children:"1606 M"})]}),(0,n.jsxs)(r.tr,{children:[(0,n.jsx)(r.td,{children:"K3s cluster with a single agent"}),(0,n.jsx)(r.td,{children:"Intel 8375C CPU, 2.90 GHz"}),(0,n.jsx)(r.td,{children:"5% of a core"}),(0,n.jsx)(r.td,{children:"1428 M"}),(0,n.jsx)(r.td,{children:"1450 M"})]}),(0,n.jsxs)(r.tr,{children:[(0,n.jsx)(r.td,{children:"K3s agent"}),(0,n.jsx)(r.td,{children:"Intel 8375C CPU, 2.90 GHz"}),(0,n.jsx)(r.td,{children:"3% of a core"}),(0,n.jsx)(r.td,{children:"275 M"}),(0,n.jsx)(r.td,{children:"275 M"})]}),(0,n.jsxs)(r.tr,{children:[(0,n.jsx)(r.td,{children:"K3s server with a workload"}),(0,n.jsx)(r.td,{children:"Pi4B BCM2711, 1.50 GHz"}),(0,n.jsx)(r.td,{children:"30% of a core"}),(0,n.jsx)(r.td,{children:"1588 M"}),(0,n.jsx)(r.td,{children:"1613 M"})]}),(0,n.jsxs)(r.tr,{children:[(0,n.jsx)(r.td,{children:"K3s cluster with a single agent"}),(0,n.jsx)(r.td,{children:"Pi4B BCM2711, 1.50 GHz"}),(0,n.jsx)(r.td,{children:"25% of a core"}),(0,n.jsx)(r.td,{children:"1215 M"}),(0,n.jsx)(r.td,{children:"1413 M"})]}),(0,n.jsxs)(r.tr,{children:[(0,n.jsx)(r.td,{children:"K3s agent"}),(0,n.jsx)(r.td,{children:"Pi4B BCM2711, 1.50 GHz"}),(0,n.jsx)(r.td,{children:"10% of a core"}),(0,n.jsx)(r.td,{children:"268 M"}),(0,n.jsx)(r.td,{children:"268 M"})]})]})]}),"\n",(0,n.jsxs)(r.ul,{children:["\n",(0,n.jsx)(r.li,{children:(0,n.jsx)(r.a,{href:"#scope-of-resource-testing",children:"Scope of Resource Testing"})}),"\n",(0,n.jsx)(r.li,{children:(0,n.jsx)(r.a,{href:"#components-included-for-baseline-measurements",children:"Components Included for Baseline Measurements"})}),"\n",(0,n.jsx)(r.li,{children:(0,n.jsx)(r.a,{href:"#methodology",children:"Methodology"})}),"\n",(0,n.jsx)(r.li,{children:(0,n.jsx)(r.a,{href:"#environment",children:"Environment"})}),"\n",(0,n.jsxs)(r.li,{children:[(0,n.jsx)(r.a,{href:"#baseline-resource-requirements",children:"Baseline Resource Requirements"}),"\n",(0,n.jsxs)(r.ul,{children:["\n",(0,n.jsx)(r.li,{children:(0,n.jsx)(r.a,{href:"#k3s-server-with-a-workload",children:"K3s Server with a Workload"})}),"\n",(0,n.jsx)(r.li,{children:(0,n.jsx)(r.a,{href:"#k3s-cluster-with-a-single-agent",children:"K3s Cluster with a Single Agent"})}),"\n",(0,n.jsx)(r.li,{children:(0,n.jsx)(r.a,{href:"#k3s-agent",children:"K3s Agent"})}),"\n"]}),"\n"]}),"\n",(0,n.jsxs)(r.li,{children:[(0,n.jsx)(r.a,{href:"#analysis",children:"Analysis"}),"\n",(0,n.jsxs)(r.ul,{children:["\n",(0,n.jsx)(r.li,{children:(0,n.jsx)(r.a,{href:"#primary-resource-utilization-drivers",children:"Primary Resource Utilization Drivers"})}),"\n",(0,n.jsx)(r.li,{children:(0,n.jsx)(r.a,{href:"#preventing-agents-and-workloads-from-interfering-with-the-cluster-datastore",children:"Preventing Agents and Workloads from Interfering with the Cluster Datastore"})}),"\n"]}),"\n"]}),"\n"]}),"\n",(0,n.jsx)(r.h2,{id:"scope-of-resource-testing",children:"Scope of Resource Testing"}),"\n",(0,n.jsx)(r.p,{children:"The resource tests were intended to address the following problem statements:"}),"\n",(0,n.jsxs)(r.ul,{children:["\n",(0,n.jsx)(r.li,{children:"On a single-node cluster, determine the legitimate minimum amount of CPU, memory, and IOPs that should be set aside to run the entire K3s stack server stack, assuming that a real workload will be deployed on the cluster."}),"\n",(0,n.jsx)(r.li,{children:"On an agent (worker) node, determine the legitimate minimum amount of CPU, memory, and IOPs that should be set aside for the Kubernetes and K3s control plane components (the kubelet and k3s agent)."}),"\n"]}),"\n",(0,n.jsx)(r.h2,{id:"components-included-for-baseline-measurements",children:"Components Included for Baseline Measurements"}),"\n",(0,n.jsx)(r.p,{children:"The tested components are:"}),"\n",(0,n.jsxs)(r.ul,{children:["\n",(0,n.jsx)(r.li,{children:"K3s v1.26.5 with all packaged components enabled"}),"\n",(0,n.jsx)(r.li,{children:"Prometheus + Grafana monitoring stack"}),"\n",(0,n.jsx)(r.li,{children:(0,n.jsx)(r.a,{href:"https://kubernetes.io/docs/tasks/run-application/run-stateless-application-deployment/",children:"Kubernetes Example Nginx Deployment"})}),"\n"]}),"\n",(0,n.jsx)(r.p,{children:"These are baseline figures for a stable system using only K3s packaged components (Traefik Ingress, Klipper lb, local-path storage) running a standard monitoring stack (Prometheus and Grafana) and the Guestbook example app."}),"\n",(0,n.jsx)(r.p,{children:"Resource figures including IOPS are for the Kubernetes datastore and control plane only, and do not include overhead for system-level management agents or logging, container image management, or any workload-specific requirements."}),"\n",(0,n.jsx)(r.h2,{id:"methodology",children:"Methodology"}),"\n",(0,n.jsxs)(r.p,{children:["A standalone instance of Prometheus v2.43.0 was used to collect host CPU, memory, and disk IO statistics using ",(0,n.jsx)(r.code,{children:"prometheus-node-exporter"})," installed via apt."]}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.code,{children:"systemd-cgtop"})," was used to spot-check systemd cgroup-level CPU and memory utilization. ",(0,n.jsx)(r.code,{children:"system.slice/k3s.service"})," tracks resource utilization for both K3s and containerd, while individual pods are under the ",(0,n.jsx)(r.code,{children:"kubepods"})," hierarchy."]}),"\n",(0,n.jsxs)(r.p,{children:["Additional detailed K3s memory utilization data was collected from ",(0,n.jsx)(r.code,{children:"kubectl top node"})," using the integrated metrics-server for the server and agent processes."]}),"\n",(0,n.jsx)(r.p,{children:"Utilization figures were based on 95th percentile readings from steady state operation on nodes running the described workloads."}),"\n",(0,n.jsx)(r.h2,{id:"environment",children:"Environment"}),"\n",(0,n.jsxs)(r.table,{children:[(0,n.jsx)(r.thead,{children:(0,n.jsxs)(r.tr,{children:[(0,n.jsx)(r.th,{children:"Arch"}),(0,n.jsx)(r.th,{children:"OS"}),(0,n.jsx)(r.th,{children:"System"}),(0,n.jsx)(r.th,{children:"CPU"}),(0,n.jsx)(r.th,{children:"RAM"}),(0,n.jsx)(r.th,{children:"Disk"})]})}),(0,n.jsxs)(r.tbody,{children:[(0,n.jsxs)(r.tr,{children:[(0,n.jsx)(r.td,{children:"x86_64"}),(0,n.jsx)(r.td,{children:"Ubuntu 22.04"}),(0,n.jsx)(r.td,{children:"AWS c6id.xlarge"}),(0,n.jsx)(r.td,{children:"Intel Xeon Platinum 8375C CPU, 4 Core 2.90 GHz"}),(0,n.jsx)(r.td,{children:"8 GB"}),(0,n.jsx)(r.td,{children:"NVME SSD"})]}),(0,n.jsxs)(r.tr,{children:[(0,n.jsx)(r.td,{children:"aarch64"}),(0,n.jsx)(r.td,{children:"Raspberry Pi OS 11"}),(0,n.jsx)(r.td,{children:"Raspberry Pi 4 Model B"}),(0,n.jsx)(r.td,{children:"BCM2711, 4 Core 1.50 GHz"}),(0,n.jsx)(r.td,{children:"8 GB"}),(0,n.jsx)(r.td,{children:"UHS-III SDXC"})]})]})]}),"\n",(0,n.jsx)(r.h2,{id:"baseline-resource-requirements",children:"Baseline Resource Requirements"}),"\n",(0,n.jsx)(r.p,{children:"This section captures the results of tests to determine minimum resource requirements for basic K3s operation."}),"\n",(0,n.jsx)(r.h3,{id:"k3s-server-with-a-workload",children:"K3s Server with a Workload"}),"\n",(0,n.jsxs)(r.p,{children:["These are the requirements for a single-node cluster in which the K3s server shares resources with a ",(0,n.jsx)(r.a,{href:"https://kubernetes.io/docs/tasks/run-application/run-stateless-application-deployment/",children:"simple workload"}),"."]}),"\n",(0,n.jsx)(r.p,{children:"The CPU requirements are:"}),"\n",(0,n.jsxs)(r.table,{children:[(0,n.jsx)(r.thead,{children:(0,n.jsxs)(r.tr,{children:[(0,n.jsx)(r.th,{children:"System"}),(0,n.jsx)(r.th,{children:"CPU Core Usage"})]})}),(0,n.jsxs)(r.tbody,{children:[(0,n.jsxs)(r.tr,{children:[(0,n.jsx)(r.td,{children:"Intel 8375C"}),(0,n.jsx)(r.td,{children:"6% of a core"})]}),(0,n.jsxs)(r.tr,{children:[(0,n.jsx)(r.td,{children:"Pi4B"}),(0,n.jsx)(r.td,{children:"30% of a core"})]})]})]}),"\n",(0,n.jsx)(r.p,{children:"The Memory Requirements are:"}),"\n",(0,n.jsxs)(r.table,{children:[(0,n.jsx)(r.thead,{children:(0,n.jsxs)(r.tr,{children:[(0,n.jsx)(r.th,{children:"Tested Datastore"}),(0,n.jsx)(r.th,{children:"System"}),(0,n.jsx)(r.th,{children:"Memory"})]})}),(0,n.jsxs)(r.tbody,{children:[(0,n.jsxs)(r.tr,{children:[(0,n.jsx)(r.td,{children:"Kine/SQLite"}),(0,n.jsx)(r.td,{children:"Intel 8375C"}),(0,n.jsx)(r.td,{children:"1596 M"})]}),(0,n.jsxs)(r.tr,{children:[(0,n.jsx)(r.td,{}),(0,n.jsx)(r.td,{children:"Pi4B"}),(0,n.jsx)(r.td,{children:"1588 M"})]}),(0,n.jsxs)(r.tr,{children:[(0,n.jsx)(r.td,{children:"Embedded etcd"}),(0,n.jsx)(r.td,{children:"Intel 8375C"}),(0,n.jsx)(r.td,{children:"1606 M"})]}),(0,n.jsxs)(r.tr,{children:[(0,n.jsx)(r.td,{}),(0,n.jsx)(r.td,{children:"Pi4B"}),(0,n.jsx)(r.td,{children:"1613 M"})]})]})]}),"\n",(0,n.jsx)(r.p,{children:"The Disk requirements are:"}),"\n",(0,n.jsxs)(r.table,{children:[(0,n.jsx)(r.thead,{children:(0,n.jsxs)(r.tr,{children:[(0,n.jsx)(r.th,{children:"Tested Datastore"}),(0,n.jsx)(r.th,{children:"IOPS"}),(0,n.jsx)(r.th,{children:"KiB/sec"}),(0,n.jsx)(r.th,{children:"Latency"})]})}),(0,n.jsxs)(r.tbody,{children:[(0,n.jsxs)(r.tr,{children:[(0,n.jsx)(r.td,{children:"Kine/SQLite"}),(0,n.jsx)(r.td,{children:"10"}),(0,n.jsx)(r.td,{children:"500"}),(0,n.jsx)(r.td,{children:"< 10 ms"})]}),(0,n.jsxs)(r.tr,{children:[(0,n.jsx)(r.td,{children:"Embedded etcd"}),(0,n.jsx)(r.td,{children:"50"}),(0,n.jsx)(r.td,{children:"250"}),(0,n.jsx)(r.td,{children:"< 5 ms"})]})]})]}),"\n",(0,n.jsx)(r.h3,{id:"k3s-cluster-with-a-single-agent",children:"K3s Cluster with a Single Agent"}),"\n",(0,n.jsx)(r.p,{children:"These are the baseline requirements for a K3s cluster with a K3s server node and a K3s agent, but no workload."}),"\n",(0,n.jsx)(r.h4,{id:"k3s-server",children:"K3s Server"}),"\n",(0,n.jsx)(r.p,{children:"The CPU requirements are:"}),"\n",(0,n.jsxs)(r.table,{children:[(0,n.jsx)(r.thead,{children:(0,n.jsxs)(r.tr,{children:[(0,n.jsx)(r.th,{children:"System"}),(0,n.jsx)(r.th,{children:"CPU Core Usage"})]})}),(0,n.jsxs)(r.tbody,{children:[(0,n.jsxs)(r.tr,{children:[(0,n.jsx)(r.td,{children:"Intel 8375C"}),(0,n.jsx)(r.td,{children:"5% of a core"})]}),(0,n.jsxs)(r.tr,{children:[(0,n.jsx)(r.td,{children:"Pi4B"}),(0,n.jsx)(r.td,{children:"25% of a core"})]})]})]}),"\n",(0,n.jsx)(r.p,{children:"The Memory Requirements are:"}),"\n",(0,n.jsxs)(r.table,{children:[(0,n.jsx)(r.thead,{children:(0,n.jsxs)(r.tr,{children:[(0,n.jsx)(r.th,{children:"Tested Datastore"}),(0,n.jsx)(r.th,{children:"System"}),(0,n.jsx)(r.th,{children:"Memory"})]})}),(0,n.jsxs)(r.tbody,{children:[(0,n.jsxs)(r.tr,{children:[(0,n.jsx)(r.td,{children:"Kine/SQLite"}),(0,n.jsx)(r.td,{children:"Intel 8375C"}),(0,n.jsx)(r.td,{children:"1428 M"})]}),(0,n.jsxs)(r.tr,{children:[(0,n.jsx)(r.td,{}),(0,n.jsx)(r.td,{children:"Pi4B"}),(0,n.jsx)(r.td,{children:"1215 M"})]}),(0,n.jsxs)(r.tr,{children:[(0,n.jsx)(r.td,{children:"Embedded etcd"}),(0,n.jsx)(r.td,{children:"Intel 8375C"}),(0,n.jsx)(r.td,{children:"1450 M"})]}),(0,n.jsxs)(r.tr,{children:[(0,n.jsx)(r.td,{}),(0,n.jsx)(r.td,{children:"Pi4B"}),(0,n.jsx)(r.td,{children:"1413 M"})]})]})]}),"\n",(0,n.jsx)(r.h3,{id:"k3s-agent",children:"K3s Agent"}),"\n",(0,n.jsx)(r.p,{children:"The requirements are:"}),"\n",(0,n.jsxs)(r.table,{children:[(0,n.jsx)(r.thead,{children:(0,n.jsxs)(r.tr,{children:[(0,n.jsx)(r.th,{children:"System"}),(0,n.jsx)(r.th,{children:"CPU Core Usage"}),(0,n.jsx)(r.th,{children:"RAM"})]})}),(0,n.jsxs)(r.tbody,{children:[(0,n.jsxs)(r.tr,{children:[(0,n.jsx)(r.td,{children:"Intel 8375C"}),(0,n.jsx)(r.td,{children:"3% of a core"}),(0,n.jsx)(r.td,{children:"275 M"})]}),(0,n.jsxs)(r.tr,{children:[(0,n.jsx)(r.td,{children:"Pi4B"}),(0,n.jsx)(r.td,{children:"5% of a core"}),(0,n.jsx)(r.td,{children:"268 M"})]})]})]}),"\n",(0,n.jsx)(r.h2,{id:"analysis",children:"Analysis"}),"\n",(0,n.jsx)(r.p,{children:"This section captures what has the biggest impact on K3s server and agent utilization, and how the cluster datastore can be protected from interference from agents and workloads."}),"\n",(0,n.jsx)(r.h3,{id:"primary-resource-utilization-drivers",children:"Primary Resource Utilization Drivers"}),"\n",(0,n.jsx)(r.p,{children:"K3s server utilization figures are primarily driven by support of the Kubernetes datastore (kine or etcd), API Server, Controller-Manager, and Scheduler control loops, as well as any management tasks necessary to effect changes to the state of the system. Operations that place additional load on the Kubernetes control plane, such as creating/modifying/deleting resources, will cause temporary spikes in utilization. Using operators or apps that make extensive use of the Kubernetes datastore (such as Rancher or other Operator-type applications) will increase the server's resource requirements. Scaling up the cluster by adding additional nodes or creating many cluster resources will increase the server's resource requirements."}),"\n",(0,n.jsx)(r.p,{children:"K3s agent utilization figures are primarily driven by support of container lifecycle management control loops. Operations that involve managing images, provisioning storage, or creating/destroying containers will cause temporary spikes in utilization. Image pulls in particular are typically highly CPU and IO bound, as they involve decompressing image content to disk. If possible, workload storage (pod ephemeral storage and volumes) should be isolated from the agent components (/var/lib/rancher/k3s/agent) to ensure that there are no resource conflicts."}),"\n",(0,n.jsx)(r.h3,{id:"preventing-agents-and-workloads-from-interfering-with-the-cluster-datastore",children:"Preventing Agents and Workloads from Interfering with the Cluster Datastore"}),"\n",(0,n.jsx)(r.p,{children:"When running in an environment where the server is also hosting workload pods, care should be taken to ensure that agent and workload IOPS do not interfere with the datastore."}),"\n",(0,n.jsx)(r.p,{children:"This can be best accomplished by placing the server components (/var/lib/rancher/k3s/server) on a different storage medium than the agent components (/var/lib/rancher/k3s/agent), which include the containerd image store."}),"\n",(0,n.jsx)(r.p,{children:"Workload storage (pod ephemeral storage and volumes) should also be isolated from the datastore."}),"\n",(0,n.jsx)(r.p,{children:"Failure to meet datastore throughput and latency requirements may result in delayed response from the control plane and/or failure of the control plane to maintain system state."})]})}function h(e={}){const{wrapper:r}={...(0,t.a)(),...e.components};return r?(0,n.jsx)(r,{...e,children:(0,n.jsx)(c,{...e})}):c(e)}},1151:(e,r,s)=>{s.d(r,{Z:()=>l,a:()=>d});var n=s(7294);const t={},i=n.createContext(t);function d(e){const r=n.useContext(i);return n.useMemo((function(){return"function"==typeof e?e(r):{...r,...e}}),[r,e])}function l(e){let r;return r=e.disableParentContext?"function"==typeof e.components?e.components(t):e.components||t:d(e.components),n.createElement(i.Provider,{value:r},e.children)}}}]); \ No newline at end of file +"use strict";(self.webpackChunkk_3_s_docs=self.webpackChunkk_3_s_docs||[]).push([[9778],{8573:(e,r,s)=>{s.r(r),s.d(r,{assets:()=>o,contentTitle:()=>d,default:()=>h,frontMatter:()=>i,metadata:()=>l,toc:()=>a});var n=s(5893),t=s(1151);const i={title:"Resource Profiling"},d=void 0,l={id:"reference/resource-profiling",title:"Resource Profiling",description:"This section captures the results of tests to determine minimum resource requirements for K3s.",source:"@site/docs/reference/resource-profiling.md",sourceDirName:"reference",slug:"/reference/resource-profiling",permalink:"/reference/resource-profiling",draft:!1,unlisted:!1,editUrl:"https://github.com/k3s-io/docs/edit/main/docs/reference/resource-profiling.md",tags:[],version:"current",lastUpdatedAt:1723747404e3,frontMatter:{title:"Resource Profiling"},sidebar:"mySidebar",previous:{title:"Flag Deprecation",permalink:"/reference/flag-deprecation"},next:{title:"v1.30.X",permalink:"/release-notes/v1.30.X"}},o={},a=[{value:"Scope of Resource Testing",id:"scope-of-resource-testing",level:2},{value:"Components Included for Baseline Measurements",id:"components-included-for-baseline-measurements",level:2},{value:"Methodology",id:"methodology",level:2},{value:"Environment",id:"environment",level:2},{value:"Baseline Resource Requirements",id:"baseline-resource-requirements",level:2},{value:"K3s Server with a Workload",id:"k3s-server-with-a-workload",level:3},{value:"K3s Cluster with a Single Agent",id:"k3s-cluster-with-a-single-agent",level:3},{value:"K3s Server",id:"k3s-server",level:4},{value:"K3s Agent",id:"k3s-agent",level:3},{value:"Analysis",id:"analysis",level:2},{value:"Primary Resource Utilization Drivers",id:"primary-resource-utilization-drivers",level:3},{value:"Preventing Agents and Workloads from Interfering with the Cluster Datastore",id:"preventing-agents-and-workloads-from-interfering-with-the-cluster-datastore",level:3}];function c(e){const r={a:"a",code:"code",h2:"h2",h3:"h3",h4:"h4",li:"li",p:"p",table:"table",tbody:"tbody",td:"td",th:"th",thead:"thead",tr:"tr",ul:"ul",...(0,t.a)(),...e.components};return(0,n.jsxs)(n.Fragment,{children:[(0,n.jsx)(r.p,{children:"This section captures the results of tests to determine minimum resource requirements for K3s."}),"\n",(0,n.jsx)(r.p,{children:"The results are summarized as follows:"}),"\n",(0,n.jsxs)(r.table,{children:[(0,n.jsx)(r.thead,{children:(0,n.jsxs)(r.tr,{children:[(0,n.jsx)(r.th,{children:"Components"}),(0,n.jsx)(r.th,{children:"Processor"}),(0,n.jsx)(r.th,{children:"Min CPU"}),(0,n.jsx)(r.th,{children:"Min RAM with Kine/SQLite"}),(0,n.jsx)(r.th,{children:"Min RAM with Embedded etcd"})]})}),(0,n.jsxs)(r.tbody,{children:[(0,n.jsxs)(r.tr,{children:[(0,n.jsx)(r.td,{children:"K3s server with a workload"}),(0,n.jsx)(r.td,{children:"Intel 8375C CPU, 2.90 GHz"}),(0,n.jsx)(r.td,{children:"6% of a core"}),(0,n.jsx)(r.td,{children:"1596 M"}),(0,n.jsx)(r.td,{children:"1606 M"})]}),(0,n.jsxs)(r.tr,{children:[(0,n.jsx)(r.td,{children:"K3s cluster with a single agent"}),(0,n.jsx)(r.td,{children:"Intel 8375C CPU, 2.90 GHz"}),(0,n.jsx)(r.td,{children:"5% of a core"}),(0,n.jsx)(r.td,{children:"1428 M"}),(0,n.jsx)(r.td,{children:"1450 M"})]}),(0,n.jsxs)(r.tr,{children:[(0,n.jsx)(r.td,{children:"K3s agent"}),(0,n.jsx)(r.td,{children:"Intel 8375C CPU, 2.90 GHz"}),(0,n.jsx)(r.td,{children:"3% of a core"}),(0,n.jsx)(r.td,{children:"275 M"}),(0,n.jsx)(r.td,{children:"275 M"})]}),(0,n.jsxs)(r.tr,{children:[(0,n.jsx)(r.td,{children:"K3s server with a workload"}),(0,n.jsx)(r.td,{children:"Pi4B BCM2711, 1.50 GHz"}),(0,n.jsx)(r.td,{children:"30% of a core"}),(0,n.jsx)(r.td,{children:"1588 M"}),(0,n.jsx)(r.td,{children:"1613 M"})]}),(0,n.jsxs)(r.tr,{children:[(0,n.jsx)(r.td,{children:"K3s cluster with a single agent"}),(0,n.jsx)(r.td,{children:"Pi4B BCM2711, 1.50 GHz"}),(0,n.jsx)(r.td,{children:"25% of a core"}),(0,n.jsx)(r.td,{children:"1215 M"}),(0,n.jsx)(r.td,{children:"1413 M"})]}),(0,n.jsxs)(r.tr,{children:[(0,n.jsx)(r.td,{children:"K3s agent"}),(0,n.jsx)(r.td,{children:"Pi4B BCM2711, 1.50 GHz"}),(0,n.jsx)(r.td,{children:"10% of a core"}),(0,n.jsx)(r.td,{children:"268 M"}),(0,n.jsx)(r.td,{children:"268 M"})]})]})]}),"\n",(0,n.jsxs)(r.ul,{children:["\n",(0,n.jsx)(r.li,{children:(0,n.jsx)(r.a,{href:"#scope-of-resource-testing",children:"Scope of Resource Testing"})}),"\n",(0,n.jsx)(r.li,{children:(0,n.jsx)(r.a,{href:"#components-included-for-baseline-measurements",children:"Components Included for Baseline Measurements"})}),"\n",(0,n.jsx)(r.li,{children:(0,n.jsx)(r.a,{href:"#methodology",children:"Methodology"})}),"\n",(0,n.jsx)(r.li,{children:(0,n.jsx)(r.a,{href:"#environment",children:"Environment"})}),"\n",(0,n.jsxs)(r.li,{children:[(0,n.jsx)(r.a,{href:"#baseline-resource-requirements",children:"Baseline Resource Requirements"}),"\n",(0,n.jsxs)(r.ul,{children:["\n",(0,n.jsx)(r.li,{children:(0,n.jsx)(r.a,{href:"#k3s-server-with-a-workload",children:"K3s Server with a Workload"})}),"\n",(0,n.jsx)(r.li,{children:(0,n.jsx)(r.a,{href:"#k3s-cluster-with-a-single-agent",children:"K3s Cluster with a Single Agent"})}),"\n",(0,n.jsx)(r.li,{children:(0,n.jsx)(r.a,{href:"#k3s-agent",children:"K3s Agent"})}),"\n"]}),"\n"]}),"\n",(0,n.jsxs)(r.li,{children:[(0,n.jsx)(r.a,{href:"#analysis",children:"Analysis"}),"\n",(0,n.jsxs)(r.ul,{children:["\n",(0,n.jsx)(r.li,{children:(0,n.jsx)(r.a,{href:"#primary-resource-utilization-drivers",children:"Primary Resource Utilization Drivers"})}),"\n",(0,n.jsx)(r.li,{children:(0,n.jsx)(r.a,{href:"#preventing-agents-and-workloads-from-interfering-with-the-cluster-datastore",children:"Preventing Agents and Workloads from Interfering with the Cluster Datastore"})}),"\n"]}),"\n"]}),"\n"]}),"\n",(0,n.jsx)(r.h2,{id:"scope-of-resource-testing",children:"Scope of Resource Testing"}),"\n",(0,n.jsx)(r.p,{children:"The resource tests were intended to address the following problem statements:"}),"\n",(0,n.jsxs)(r.ul,{children:["\n",(0,n.jsx)(r.li,{children:"On a single-node cluster, determine the legitimate minimum amount of CPU, memory, and IOPs that should be set aside to run the entire K3s stack server stack, assuming that a real workload will be deployed on the cluster."}),"\n",(0,n.jsx)(r.li,{children:"On an agent (worker) node, determine the legitimate minimum amount of CPU, memory, and IOPs that should be set aside for the Kubernetes and K3s control plane components (the kubelet and k3s agent)."}),"\n"]}),"\n",(0,n.jsx)(r.h2,{id:"components-included-for-baseline-measurements",children:"Components Included for Baseline Measurements"}),"\n",(0,n.jsx)(r.p,{children:"The tested components are:"}),"\n",(0,n.jsxs)(r.ul,{children:["\n",(0,n.jsx)(r.li,{children:"K3s v1.26.5 with all packaged components enabled"}),"\n",(0,n.jsx)(r.li,{children:"Prometheus + Grafana monitoring stack"}),"\n",(0,n.jsx)(r.li,{children:(0,n.jsx)(r.a,{href:"https://kubernetes.io/docs/tasks/run-application/run-stateless-application-deployment/",children:"Kubernetes Example Nginx Deployment"})}),"\n"]}),"\n",(0,n.jsx)(r.p,{children:"These are baseline figures for a stable system using only K3s packaged components (Traefik Ingress, Klipper lb, local-path storage) running a standard monitoring stack (Prometheus and Grafana) and the Guestbook example app."}),"\n",(0,n.jsx)(r.p,{children:"Resource figures including IOPS are for the Kubernetes datastore and control plane only, and do not include overhead for system-level management agents or logging, container image management, or any workload-specific requirements."}),"\n",(0,n.jsx)(r.h2,{id:"methodology",children:"Methodology"}),"\n",(0,n.jsxs)(r.p,{children:["A standalone instance of Prometheus v2.43.0 was used to collect host CPU, memory, and disk IO statistics using ",(0,n.jsx)(r.code,{children:"prometheus-node-exporter"})," installed via apt."]}),"\n",(0,n.jsxs)(r.p,{children:[(0,n.jsx)(r.code,{children:"systemd-cgtop"})," was used to spot-check systemd cgroup-level CPU and memory utilization. ",(0,n.jsx)(r.code,{children:"system.slice/k3s.service"})," tracks resource utilization for both K3s and containerd, while individual pods are under the ",(0,n.jsx)(r.code,{children:"kubepods"})," hierarchy."]}),"\n",(0,n.jsxs)(r.p,{children:["Additional detailed K3s memory utilization data was collected from ",(0,n.jsx)(r.code,{children:"kubectl top node"})," using the integrated metrics-server for the server and agent processes."]}),"\n",(0,n.jsx)(r.p,{children:"Utilization figures were based on 95th percentile readings from steady state operation on nodes running the described workloads."}),"\n",(0,n.jsx)(r.h2,{id:"environment",children:"Environment"}),"\n",(0,n.jsxs)(r.table,{children:[(0,n.jsx)(r.thead,{children:(0,n.jsxs)(r.tr,{children:[(0,n.jsx)(r.th,{children:"Arch"}),(0,n.jsx)(r.th,{children:"OS"}),(0,n.jsx)(r.th,{children:"System"}),(0,n.jsx)(r.th,{children:"CPU"}),(0,n.jsx)(r.th,{children:"RAM"}),(0,n.jsx)(r.th,{children:"Disk"})]})}),(0,n.jsxs)(r.tbody,{children:[(0,n.jsxs)(r.tr,{children:[(0,n.jsx)(r.td,{children:"x86_64"}),(0,n.jsx)(r.td,{children:"Ubuntu 22.04"}),(0,n.jsx)(r.td,{children:"AWS c6id.xlarge"}),(0,n.jsx)(r.td,{children:"Intel Xeon Platinum 8375C CPU, 4 Core 2.90 GHz"}),(0,n.jsx)(r.td,{children:"8 GB"}),(0,n.jsx)(r.td,{children:"NVME SSD"})]}),(0,n.jsxs)(r.tr,{children:[(0,n.jsx)(r.td,{children:"aarch64"}),(0,n.jsx)(r.td,{children:"Raspberry Pi OS 11"}),(0,n.jsx)(r.td,{children:"Raspberry Pi 4 Model B"}),(0,n.jsx)(r.td,{children:"BCM2711, 4 Core 1.50 GHz"}),(0,n.jsx)(r.td,{children:"8 GB"}),(0,n.jsx)(r.td,{children:"UHS-III SDXC"})]})]})]}),"\n",(0,n.jsx)(r.h2,{id:"baseline-resource-requirements",children:"Baseline Resource Requirements"}),"\n",(0,n.jsx)(r.p,{children:"This section captures the results of tests to determine minimum resource requirements for basic K3s operation."}),"\n",(0,n.jsx)(r.h3,{id:"k3s-server-with-a-workload",children:"K3s Server with a Workload"}),"\n",(0,n.jsxs)(r.p,{children:["These are the requirements for a single-node cluster in which the K3s server shares resources with a ",(0,n.jsx)(r.a,{href:"https://kubernetes.io/docs/tasks/run-application/run-stateless-application-deployment/",children:"simple workload"}),"."]}),"\n",(0,n.jsx)(r.p,{children:"The CPU requirements are:"}),"\n",(0,n.jsxs)(r.table,{children:[(0,n.jsx)(r.thead,{children:(0,n.jsxs)(r.tr,{children:[(0,n.jsx)(r.th,{children:"System"}),(0,n.jsx)(r.th,{children:"CPU Core Usage"})]})}),(0,n.jsxs)(r.tbody,{children:[(0,n.jsxs)(r.tr,{children:[(0,n.jsx)(r.td,{children:"Intel 8375C"}),(0,n.jsx)(r.td,{children:"6% of a core"})]}),(0,n.jsxs)(r.tr,{children:[(0,n.jsx)(r.td,{children:"Pi4B"}),(0,n.jsx)(r.td,{children:"30% of a core"})]})]})]}),"\n",(0,n.jsx)(r.p,{children:"The Memory Requirements are:"}),"\n",(0,n.jsxs)(r.table,{children:[(0,n.jsx)(r.thead,{children:(0,n.jsxs)(r.tr,{children:[(0,n.jsx)(r.th,{children:"Tested Datastore"}),(0,n.jsx)(r.th,{children:"System"}),(0,n.jsx)(r.th,{children:"Memory"})]})}),(0,n.jsxs)(r.tbody,{children:[(0,n.jsxs)(r.tr,{children:[(0,n.jsx)(r.td,{children:"Kine/SQLite"}),(0,n.jsx)(r.td,{children:"Intel 8375C"}),(0,n.jsx)(r.td,{children:"1596 M"})]}),(0,n.jsxs)(r.tr,{children:[(0,n.jsx)(r.td,{}),(0,n.jsx)(r.td,{children:"Pi4B"}),(0,n.jsx)(r.td,{children:"1588 M"})]}),(0,n.jsxs)(r.tr,{children:[(0,n.jsx)(r.td,{children:"Embedded etcd"}),(0,n.jsx)(r.td,{children:"Intel 8375C"}),(0,n.jsx)(r.td,{children:"1606 M"})]}),(0,n.jsxs)(r.tr,{children:[(0,n.jsx)(r.td,{}),(0,n.jsx)(r.td,{children:"Pi4B"}),(0,n.jsx)(r.td,{children:"1613 M"})]})]})]}),"\n",(0,n.jsx)(r.p,{children:"The Disk requirements are:"}),"\n",(0,n.jsxs)(r.table,{children:[(0,n.jsx)(r.thead,{children:(0,n.jsxs)(r.tr,{children:[(0,n.jsx)(r.th,{children:"Tested Datastore"}),(0,n.jsx)(r.th,{children:"IOPS"}),(0,n.jsx)(r.th,{children:"KiB/sec"}),(0,n.jsx)(r.th,{children:"Latency"})]})}),(0,n.jsxs)(r.tbody,{children:[(0,n.jsxs)(r.tr,{children:[(0,n.jsx)(r.td,{children:"Kine/SQLite"}),(0,n.jsx)(r.td,{children:"10"}),(0,n.jsx)(r.td,{children:"500"}),(0,n.jsx)(r.td,{children:"< 10 ms"})]}),(0,n.jsxs)(r.tr,{children:[(0,n.jsx)(r.td,{children:"Embedded etcd"}),(0,n.jsx)(r.td,{children:"50"}),(0,n.jsx)(r.td,{children:"250"}),(0,n.jsx)(r.td,{children:"< 5 ms"})]})]})]}),"\n",(0,n.jsx)(r.h3,{id:"k3s-cluster-with-a-single-agent",children:"K3s Cluster with a Single Agent"}),"\n",(0,n.jsx)(r.p,{children:"These are the baseline requirements for a K3s cluster with a K3s server node and a K3s agent, but no workload."}),"\n",(0,n.jsx)(r.h4,{id:"k3s-server",children:"K3s Server"}),"\n",(0,n.jsx)(r.p,{children:"The CPU requirements are:"}),"\n",(0,n.jsxs)(r.table,{children:[(0,n.jsx)(r.thead,{children:(0,n.jsxs)(r.tr,{children:[(0,n.jsx)(r.th,{children:"System"}),(0,n.jsx)(r.th,{children:"CPU Core Usage"})]})}),(0,n.jsxs)(r.tbody,{children:[(0,n.jsxs)(r.tr,{children:[(0,n.jsx)(r.td,{children:"Intel 8375C"}),(0,n.jsx)(r.td,{children:"5% of a core"})]}),(0,n.jsxs)(r.tr,{children:[(0,n.jsx)(r.td,{children:"Pi4B"}),(0,n.jsx)(r.td,{children:"25% of a core"})]})]})]}),"\n",(0,n.jsx)(r.p,{children:"The Memory Requirements are:"}),"\n",(0,n.jsxs)(r.table,{children:[(0,n.jsx)(r.thead,{children:(0,n.jsxs)(r.tr,{children:[(0,n.jsx)(r.th,{children:"Tested Datastore"}),(0,n.jsx)(r.th,{children:"System"}),(0,n.jsx)(r.th,{children:"Memory"})]})}),(0,n.jsxs)(r.tbody,{children:[(0,n.jsxs)(r.tr,{children:[(0,n.jsx)(r.td,{children:"Kine/SQLite"}),(0,n.jsx)(r.td,{children:"Intel 8375C"}),(0,n.jsx)(r.td,{children:"1428 M"})]}),(0,n.jsxs)(r.tr,{children:[(0,n.jsx)(r.td,{}),(0,n.jsx)(r.td,{children:"Pi4B"}),(0,n.jsx)(r.td,{children:"1215 M"})]}),(0,n.jsxs)(r.tr,{children:[(0,n.jsx)(r.td,{children:"Embedded etcd"}),(0,n.jsx)(r.td,{children:"Intel 8375C"}),(0,n.jsx)(r.td,{children:"1450 M"})]}),(0,n.jsxs)(r.tr,{children:[(0,n.jsx)(r.td,{}),(0,n.jsx)(r.td,{children:"Pi4B"}),(0,n.jsx)(r.td,{children:"1413 M"})]})]})]}),"\n",(0,n.jsx)(r.h3,{id:"k3s-agent",children:"K3s Agent"}),"\n",(0,n.jsx)(r.p,{children:"The requirements are:"}),"\n",(0,n.jsxs)(r.table,{children:[(0,n.jsx)(r.thead,{children:(0,n.jsxs)(r.tr,{children:[(0,n.jsx)(r.th,{children:"System"}),(0,n.jsx)(r.th,{children:"CPU Core Usage"}),(0,n.jsx)(r.th,{children:"RAM"})]})}),(0,n.jsxs)(r.tbody,{children:[(0,n.jsxs)(r.tr,{children:[(0,n.jsx)(r.td,{children:"Intel 8375C"}),(0,n.jsx)(r.td,{children:"3% of a core"}),(0,n.jsx)(r.td,{children:"275 M"})]}),(0,n.jsxs)(r.tr,{children:[(0,n.jsx)(r.td,{children:"Pi4B"}),(0,n.jsx)(r.td,{children:"5% of a core"}),(0,n.jsx)(r.td,{children:"268 M"})]})]})]}),"\n",(0,n.jsx)(r.h2,{id:"analysis",children:"Analysis"}),"\n",(0,n.jsx)(r.p,{children:"This section captures what has the biggest impact on K3s server and agent utilization, and how the cluster datastore can be protected from interference from agents and workloads."}),"\n",(0,n.jsx)(r.h3,{id:"primary-resource-utilization-drivers",children:"Primary Resource Utilization Drivers"}),"\n",(0,n.jsx)(r.p,{children:"K3s server utilization figures are primarily driven by support of the Kubernetes datastore (kine or etcd), API Server, Controller-Manager, and Scheduler control loops, as well as any management tasks necessary to effect changes to the state of the system. Operations that place additional load on the Kubernetes control plane, such as creating/modifying/deleting resources, will cause temporary spikes in utilization. Using operators or apps that make extensive use of the Kubernetes datastore (such as Rancher or other Operator-type applications) will increase the server's resource requirements. Scaling up the cluster by adding additional nodes or creating many cluster resources will increase the server's resource requirements."}),"\n",(0,n.jsx)(r.p,{children:"K3s agent utilization figures are primarily driven by support of container lifecycle management control loops. Operations that involve managing images, provisioning storage, or creating/destroying containers will cause temporary spikes in utilization. Image pulls in particular are typically highly CPU and IO bound, as they involve decompressing image content to disk. If possible, workload storage (pod ephemeral storage and volumes) should be isolated from the agent components (/var/lib/rancher/k3s/agent) to ensure that there are no resource conflicts."}),"\n",(0,n.jsx)(r.h3,{id:"preventing-agents-and-workloads-from-interfering-with-the-cluster-datastore",children:"Preventing Agents and Workloads from Interfering with the Cluster Datastore"}),"\n",(0,n.jsx)(r.p,{children:"When running in an environment where the server is also hosting workload pods, care should be taken to ensure that agent and workload IOPS do not interfere with the datastore."}),"\n",(0,n.jsx)(r.p,{children:"This can be best accomplished by placing the server components (/var/lib/rancher/k3s/server) on a different storage medium than the agent components (/var/lib/rancher/k3s/agent), which include the containerd image store."}),"\n",(0,n.jsx)(r.p,{children:"Workload storage (pod ephemeral storage and volumes) should also be isolated from the datastore."}),"\n",(0,n.jsx)(r.p,{children:"Failure to meet datastore throughput and latency requirements may result in delayed response from the control plane and/or failure of the control plane to maintain system state."})]})}function h(e={}){const{wrapper:r}={...(0,t.a)(),...e.components};return r?(0,n.jsx)(r,{...e,children:(0,n.jsx)(c,{...e})}):c(e)}},1151:(e,r,s)=>{s.d(r,{Z:()=>l,a:()=>d});var n=s(7294);const t={},i=n.createContext(t);function d(e){const r=n.useContext(i);return n.useMemo((function(){return"function"==typeof e?e(r):{...r,...e}}),[r,e])}function l(e){let r;return r=e.disableParentContext?"function"==typeof e.components?e.components(t):e.components||t:d(e.components),n.createElement(i.Provider,{value:r},e.children)}}}]); \ No newline at end of file diff --git a/assets/js/main.aa151b84.js b/assets/js/main.3ba14b94.js similarity index 98% rename from assets/js/main.aa151b84.js rename to assets/js/main.3ba14b94.js index 7a151830d..ce605d169 100644 --- a/assets/js/main.aa151b84.js +++ b/assets/js/main.3ba14b94.js @@ -1,2 +1,2 @@ -/*! For license information please see main.aa151b84.js.LICENSE.txt */ -(self.webpackChunkk_3_s_docs=self.webpackChunkk_3_s_docs||[]).push([[179],{1728:(e,t,n)=>{"use strict";function r(e){var t,n,a="";if("string"==typeof e||"number"==typeof e)a+=e;else if("object"==typeof e)if(Array.isArray(e))for(t=0;ta});const a=function(){for(var e,t,n=0,a="";n{"use strict";n.d(t,{Z:()=>p});n(7294);var r=n(8356),a=n.n(r),o=n(6887);const i={"0480b142":[()=>n.e(836).then(n.bind(n,9665)),"@site/docs/faq.md",9665],"06dc01b4":[()=>n.e(9233).then(n.bind(n,6516)),"@site/docs/networking/basic-network-options.md",6516],"0759a3f5":[()=>n.e(2409).then(n.bind(n,2714)),"@site/docs/release-notes/v1.29.X.md",2714],"0ce5aa86":[()=>n.e(1620).then(n.bind(n,3012)),"@site/docs/release-notes/v1.26.X.md",3012],"0e4359fd":[()=>n.e(9751).then(n.bind(n,8495)),"@site/docs/helm.md",8495],"10b61a3f":[()=>n.e(4902).then(n.bind(n,8040)),"@site/docs/installation/private-registry.md",8040],"138e0e15":[()=>n.e(9524).then(n.t.bind(n,536,19)),"@generated/@easyops-cn/docusaurus-search-local/default/__plugin.json",536],17035653:[()=>n.e(8380).then(n.bind(n,4877)),"@site/docs/networking/multus-ipams.md",4877],17896441:[()=>Promise.all([n.e(532),n.e(7236),n.e(7918)]).then(n.bind(n,3354)),"@theme/DocItem",3354],"179ec51e":[()=>n.e(7176).then(n.bind(n,6790)),"@site/docs/cli/secrets-encrypt.md",6790],"1a4e3797":[()=>Promise.all([n.e(532),n.e(7920)]).then(n.bind(n,2027)),"@theme/SearchPage",2027],"1be8dcfa":[()=>n.e(7628).then(n.bind(n,2023)),"@site/docs/cli/agent.md",2023],"1e924268":[()=>n.e(8614).then(n.bind(n,770)),"@site/docs/installation/installation.md",770],"22dd74f7":[()=>n.e(4980).then(n.t.bind(n,5904,19)),"@generated/docusaurus-plugin-content-docs/default/p/index-466.json",5904],"2a65762c":[()=>n.e(1430).then(n.bind(n,7084)),"@site/docs/cli/token.md",7084],"2f797aa4":[()=>n.e(101).then(n.bind(n,3989)),"@site/docs/release-notes/v1.28.X.md",3989],"36f34ab4":[()=>n.e(6155).then(n.bind(n,7406)),"@site/docs/cli/etcd-snapshot.md",7406],"395f47e2":[()=>n.e(6801).then(n.bind(n,793)),"@site/docs/advanced.md",793],"41765d36":[()=>n.e(1615).then(n.bind(n,99)),"@site/docs/storage.md",99],"43077f1d":[()=>n.e(8397).then(n.bind(n,8104)),"@site/docs/cluster-access.md",8104],"43e5cb58":[()=>n.e(4804).then(n.bind(n,8446)),"@site/docs/networking/networking-services.md",8446],"4455f95b":[()=>n.e(1340).then(n.bind(n,2644)),"@site/docs/cli/server.md",2644],"4a667cf9":[()=>n.e(9477).then(n.bind(n,8676)),"@site/docs/datastore/cluster-loadbalancer.md",8676],"4aae9e46":[()=>n.e(4443).then(n.bind(n,557)),"@site/docs/upgrades/killall.md",557],"4e366d5e":[()=>n.e(3595).then(n.bind(n,882)),"@site/docs/upgrades/upgrades.md",882],"4fea1ac4":[()=>n.e(1073).then(n.bind(n,8544)),"@site/docs/installation/uninstall.md",8544],"5159b4a0":[()=>n.e(9478).then(n.bind(n,7477)),"@site/docs/installation/registry-mirror.md",7477],"5281b7a2":[()=>n.e(5927).then(n.bind(n,6506)),"@site/docs/architecture.md",6506],"57d35c99":[()=>n.e(8005).then(n.bind(n,3548)),"@site/docs/security/secrets-encryption.md",3548],"5e95c892":[()=>n.e(9661).then(n.bind(n,1892)),"@theme/DocsRoot",1892],"5ea4afd8":[()=>n.e(9075).then(n.bind(n,7902)),"@site/docs/security/self-assessment-1.7.md",7902],"65c5030c":[()=>n.e(7733).then(n.bind(n,215)),"@site/docs/installation/packaged-components.md",215],"6ab2c2e0":[()=>n.e(981).then(n.bind(n,9414)),"@site/docs/reference/env-variables.md",9414],"6e9804bc":[()=>n.e(393).then(n.bind(n,1218)),"@site/docs/cli/certificate.md",1218],"72e14192":[()=>n.e(7239).then(n.bind(n,1658)),"@site/docs/quick-start.md",1658],"7b8e2475":[()=>n.e(79).then(n.bind(n,6498)),"@site/docs/security/security.md",6498],82406859:[()=>n.e(3319).then(n.bind(n,6758)),"@site/docs/upgrades/automated.md",6758],"82f1aa93":[()=>n.e(7709).then(n.bind(n,1587)),"@site/docs/security/hardening-guide.md",1587],"914a16f4":[()=>n.e(7626).then(n.bind(n,6050)),"@site/docs/reference/flag-deprecation.md",6050],"97c4f258":[()=>n.e(305).then(n.bind(n,8486)),"@site/docs/installation/configuration.md",8486],"9e39b1cd":[()=>n.e(7813).then(n.bind(n,4016)),"@site/docs/cli/cli.md",4016],"9e7a009d":[()=>n.e(7251).then(n.bind(n,6253)),"@site/docs/release-notes/v1.25.X.md",6253],"9f491e05":[()=>n.e(3189).then(n.bind(n,9297)),"@site/docs/security/self-assessment-1.23.md",9297],a09c2993:[()=>n.e(4128).then(n.bind(n,8152)),"@site/docs/introduction.md",8152],a7bd4aaa:[()=>n.e(8518).then(n.bind(n,4974)),"@theme/DocVersionRoot",4974],a94703ab:[()=>Promise.all([n.e(532),n.e(4368)]).then(n.bind(n,4547)),"@theme/DocRoot",4547],ab388925:[()=>n.e(4548).then(n.bind(n,9027)),"@site/docs/datastore/datastore.md",9027],ab60f49a:[()=>n.e(3555).then(n.bind(n,2688)),"@site/docs/security/self-assessment-1.24.md",2688],aba21aa0:[()=>n.e(3629).then(n.t.bind(n,1765,19)),"@generated/docusaurus-plugin-content-docs/default/__plugin.json",1765],ac75af2e:[()=>n.e(1199).then(n.bind(n,6455)),"@site/docs/installation/requirements.md",6455],b36bdd38:[()=>n.e(6895).then(n.bind(n,5020)),"@site/docs/datastore/ha-embedded.md",5020],b8002741:[()=>n.e(2573).then(n.bind(n,3338)),"@site/docs/release-notes/v1.30.X.md",3338],b9a30a37:[()=>n.e(2038).then(n.bind(n,9763)),"@site/docs/security/self-assessment-1.8.md",9763],ba3a957c:[()=>n.e(8776).then(n.bind(n,615)),"@site/docs/datastore/backup-restore.md",615],d123a91e:[()=>n.e(855).then(n.bind(n,5418)),"@site/docs/release-notes/v1.24.X.md",5418],d8ab3227:[()=>n.e(6501).then(n.bind(n,7953)),"@site/docs/networking/distributed-multicloud.md",7953],d8ed1217:[()=>n.e(2745).then(n.bind(n,7803)),"@site/docs/upgrades/manual.md",7803],dd22e55f:[()=>n.e(5668).then(n.bind(n,4840)),"@site/docs/release-notes/v1.27.X.md",4840],e7c9153a:[()=>n.e(7544).then(n.bind(n,1875)),"@site/docs/related-projects.md",1875],ea0a4c6d:[()=>n.e(791).then(n.bind(n,9555)),"@site/docs/datastore/ha.md",9555],ec6f9153:[()=>n.e(750).then(n.bind(n,4987)),"@site/docs/installation/airgap.md",4987],ee75e821:[()=>n.e(7893).then(n.bind(n,5380)),"@site/docs/networking/networking.md",5380],f319c6ab:[()=>n.e(8379).then(n.bind(n,1328)),"@site/docs/known-issues.md",1328],f8eefdc6:[()=>n.e(5234).then(n.bind(n,2435)),"@site/docs/installation/server-roles.md",2435],fc39421f:[()=>n.e(9778).then(n.bind(n,8573)),"@site/docs/reference/resource-profiling.md",8573]};var s=n(5893);function l(e){let{error:t,retry:n,pastDelay:r}=e;return t?(0,s.jsxs)("div",{style:{textAlign:"center",color:"#fff",backgroundColor:"#fa383e",borderColor:"#fa383e",borderStyle:"solid",borderRadius:"0.25rem",borderWidth:"1px",boxSizing:"border-box",display:"block",padding:"1rem",flex:"0 0 50%",marginLeft:"25%",marginRight:"25%",marginTop:"5rem",maxWidth:"50%",width:"100%"},children:[(0,s.jsx)("p",{children:String(t)}),(0,s.jsx)("div",{children:(0,s.jsx)("button",{type:"button",onClick:n,children:"Retry"})})]}):r?(0,s.jsx)("div",{style:{display:"flex",justifyContent:"center",alignItems:"center",height:"100vh"},children:(0,s.jsx)("svg",{id:"loader",style:{width:128,height:110,position:"absolute",top:"calc(100vh - 64%)"},viewBox:"0 0 45 45",xmlns:"http://www.w3.org/2000/svg",stroke:"#61dafb",children:(0,s.jsxs)("g",{fill:"none",fillRule:"evenodd",transform:"translate(1 1)",strokeWidth:"2",children:[(0,s.jsxs)("circle",{cx:"22",cy:"22",r:"6",strokeOpacity:"0",children:[(0,s.jsx)("animate",{attributeName:"r",begin:"1.5s",dur:"3s",values:"6;22",calcMode:"linear",repeatCount:"indefinite"}),(0,s.jsx)("animate",{attributeName:"stroke-opacity",begin:"1.5s",dur:"3s",values:"1;0",calcMode:"linear",repeatCount:"indefinite"}),(0,s.jsx)("animate",{attributeName:"stroke-width",begin:"1.5s",dur:"3s",values:"2;0",calcMode:"linear",repeatCount:"indefinite"})]}),(0,s.jsxs)("circle",{cx:"22",cy:"22",r:"6",strokeOpacity:"0",children:[(0,s.jsx)("animate",{attributeName:"r",begin:"3s",dur:"3s",values:"6;22",calcMode:"linear",repeatCount:"indefinite"}),(0,s.jsx)("animate",{attributeName:"stroke-opacity",begin:"3s",dur:"3s",values:"1;0",calcMode:"linear",repeatCount:"indefinite"}),(0,s.jsx)("animate",{attributeName:"stroke-width",begin:"3s",dur:"3s",values:"2;0",calcMode:"linear",repeatCount:"indefinite"})]}),(0,s.jsx)("circle",{cx:"22",cy:"22",r:"8",children:(0,s.jsx)("animate",{attributeName:"r",begin:"0s",dur:"1.5s",values:"6;1;2;3;4;5;6",calcMode:"linear",repeatCount:"indefinite"})})]})})}):null}var c=n(9670),u=n(226);function d(e,t){if("*"===e)return a()({loading:l,loader:()=>n.e(1772).then(n.bind(n,1772)),modules:["@theme/NotFound"],webpack:()=>[1772],render(e,t){const n=e.default;return(0,s.jsx)(u.z,{value:{plugin:{name:"native",id:"default"}},children:(0,s.jsx)(n,{...t})})}});const r=o[`${e}-${t}`],d={},p=[],f=[],h=(0,c.Z)(r);return Object.entries(h).forEach((e=>{let[t,n]=e;const r=i[n];r&&(d[t]=r[0],p.push(r[1]),f.push(r[2]))})),a().Map({loading:l,loader:d,modules:p,webpack:()=>f,render(t,n){const a=JSON.parse(JSON.stringify(r));Object.entries(t).forEach((t=>{let[n,r]=t;const o=r.default;if(!o)throw new Error(`The page component at ${e} doesn't have a default export. This makes it impossible to render anything. Consider default-exporting a React component.`);"object"!=typeof o&&"function"!=typeof o||Object.keys(r).filter((e=>"default"!==e)).forEach((e=>{o[e]=r[e]}));let i=a;const s=n.split(".");s.slice(0,-1).forEach((e=>{i=i[e]})),i[s[s.length-1]]=o}));const o=a.__comp;delete a.__comp;const i=a.__context;delete a.__context;const l=a.__props;return delete a.__props,(0,s.jsx)(u.z,{value:i,children:(0,s.jsx)(o,{...a,...l,...n})})}})}const p=[{path:"/search",component:d("/search","822"),exact:!0},{path:"/",component:d("/","a79"),routes:[{path:"/",component:d("/","fc8"),routes:[{path:"/",component:d("/","6f4"),routes:[{path:"/advanced",component:d("/advanced","f55"),exact:!0,sidebar:"mySidebar"},{path:"/architecture",component:d("/architecture","189"),exact:!0,sidebar:"mySidebar"},{path:"/cli",component:d("/cli","c9b"),exact:!0,sidebar:"mySidebar"},{path:"/cli/agent",component:d("/cli/agent","dc4"),exact:!0,sidebar:"mySidebar"},{path:"/cli/certificate",component:d("/cli/certificate","97e"),exact:!0,sidebar:"mySidebar"},{path:"/cli/etcd-snapshot",component:d("/cli/etcd-snapshot","77b"),exact:!0,sidebar:"mySidebar"},{path:"/cli/secrets-encrypt",component:d("/cli/secrets-encrypt","ae9"),exact:!0,sidebar:"mySidebar"},{path:"/cli/server",component:d("/cli/server","5d8"),exact:!0,sidebar:"mySidebar"},{path:"/cli/token",component:d("/cli/token","4e2"),exact:!0,sidebar:"mySidebar"},{path:"/cluster-access",component:d("/cluster-access","a8c"),exact:!0,sidebar:"mySidebar"},{path:"/datastore",component:d("/datastore","640"),exact:!0,sidebar:"mySidebar"},{path:"/datastore/backup-restore",component:d("/datastore/backup-restore","d42"),exact:!0,sidebar:"mySidebar"},{path:"/datastore/cluster-loadbalancer",component:d("/datastore/cluster-loadbalancer","3ed"),exact:!0,sidebar:"mySidebar"},{path:"/datastore/ha",component:d("/datastore/ha","e5b"),exact:!0,sidebar:"mySidebar"},{path:"/datastore/ha-embedded",component:d("/datastore/ha-embedded","691"),exact:!0,sidebar:"mySidebar"},{path:"/faq",component:d("/faq","daf"),exact:!0,sidebar:"mySidebar"},{path:"/helm",component:d("/helm","58f"),exact:!0,sidebar:"mySidebar"},{path:"/installation",component:d("/installation","e6f"),exact:!0,sidebar:"mySidebar"},{path:"/installation/airgap",component:d("/installation/airgap","bed"),exact:!0,sidebar:"mySidebar"},{path:"/installation/configuration",component:d("/installation/configuration","748"),exact:!0,sidebar:"mySidebar"},{path:"/installation/packaged-components",component:d("/installation/packaged-components","558"),exact:!0,sidebar:"mySidebar"},{path:"/installation/private-registry",component:d("/installation/private-registry","824"),exact:!0,sidebar:"mySidebar"},{path:"/installation/registry-mirror",component:d("/installation/registry-mirror","c3f"),exact:!0,sidebar:"mySidebar"},{path:"/installation/requirements",component:d("/installation/requirements","e0d"),exact:!0,sidebar:"mySidebar"},{path:"/installation/server-roles",component:d("/installation/server-roles","2a6"),exact:!0,sidebar:"mySidebar"},{path:"/installation/uninstall",component:d("/installation/uninstall","d62"),exact:!0,sidebar:"mySidebar"},{path:"/known-issues",component:d("/known-issues","cbb"),exact:!0,sidebar:"mySidebar"},{path:"/networking",component:d("/networking","8b7"),exact:!0,sidebar:"mySidebar"},{path:"/networking/basic-network-options",component:d("/networking/basic-network-options","b13"),exact:!0,sidebar:"mySidebar"},{path:"/networking/distributed-multicloud",component:d("/networking/distributed-multicloud","be3"),exact:!0,sidebar:"mySidebar"},{path:"/networking/multus-ipams",component:d("/networking/multus-ipams","0ec"),exact:!0,sidebar:"mySidebar"},{path:"/networking/networking-services",component:d("/networking/networking-services","596"),exact:!0,sidebar:"mySidebar"},{path:"/quick-start",component:d("/quick-start","35c"),exact:!0,sidebar:"mySidebar"},{path:"/reference/env-variables",component:d("/reference/env-variables","7df"),exact:!0,sidebar:"mySidebar"},{path:"/reference/flag-deprecation",component:d("/reference/flag-deprecation","1e0"),exact:!0,sidebar:"mySidebar"},{path:"/reference/resource-profiling",component:d("/reference/resource-profiling","1db"),exact:!0,sidebar:"mySidebar"},{path:"/related-projects",component:d("/related-projects","47a"),exact:!0,sidebar:"mySidebar"},{path:"/release-notes/v1.24.X",component:d("/release-notes/v1.24.X","199"),exact:!0,sidebar:"mySidebar"},{path:"/release-notes/v1.25.X",component:d("/release-notes/v1.25.X","868"),exact:!0,sidebar:"mySidebar"},{path:"/release-notes/v1.26.X",component:d("/release-notes/v1.26.X","46e"),exact:!0,sidebar:"mySidebar"},{path:"/release-notes/v1.27.X",component:d("/release-notes/v1.27.X","e6d"),exact:!0,sidebar:"mySidebar"},{path:"/release-notes/v1.28.X",component:d("/release-notes/v1.28.X","449"),exact:!0,sidebar:"mySidebar"},{path:"/release-notes/v1.29.X",component:d("/release-notes/v1.29.X","2a4"),exact:!0,sidebar:"mySidebar"},{path:"/release-notes/v1.30.X",component:d("/release-notes/v1.30.X","3c1"),exact:!0,sidebar:"mySidebar"},{path:"/security",component:d("/security","d57"),exact:!0,sidebar:"mySidebar"},{path:"/security/hardening-guide",component:d("/security/hardening-guide","efe"),exact:!0,sidebar:"mySidebar"},{path:"/security/secrets-encryption",component:d("/security/secrets-encryption","bcb"),exact:!0,sidebar:"mySidebar"},{path:"/security/self-assessment-1.23",component:d("/security/self-assessment-1.23","901"),exact:!0},{path:"/security/self-assessment-1.24",component:d("/security/self-assessment-1.24","53a"),exact:!0,sidebar:"mySidebar"},{path:"/security/self-assessment-1.7",component:d("/security/self-assessment-1.7","435"),exact:!0,sidebar:"mySidebar"},{path:"/security/self-assessment-1.8",component:d("/security/self-assessment-1.8","1ef"),exact:!0,sidebar:"mySidebar"},{path:"/storage",component:d("/storage","3a6"),exact:!0,sidebar:"mySidebar"},{path:"/upgrades",component:d("/upgrades","222"),exact:!0,sidebar:"mySidebar"},{path:"/upgrades/automated",component:d("/upgrades/automated","bf8"),exact:!0,sidebar:"mySidebar"},{path:"/upgrades/killall",component:d("/upgrades/killall","44c"),exact:!0,sidebar:"mySidebar"},{path:"/upgrades/manual",component:d("/upgrades/manual","f6c"),exact:!0,sidebar:"mySidebar"},{path:"/",component:d("/","0c1"),exact:!0,sidebar:"mySidebar"}]}]}]},{path:"*",component:d("*")}]},8934:(e,t,n)=>{"use strict";n.d(t,{_:()=>o,t:()=>i});var r=n(7294),a=n(5893);const o=r.createContext(!1);function i(e){let{children:t}=e;const[n,i]=(0,r.useState)(!1);return(0,r.useEffect)((()=>{i(!0)}),[]),(0,a.jsx)(o.Provider,{value:n,children:t})}},2849:(e,t,n)=>{"use strict";var r=n(7294),a=n(745),o=n(405),i=n(3727),s=n(6809),l=n(412);const c=[n(2497),n(3310),n(8320),n(2295)];var u=n(723),d=n(6550),p=n(8790),f=n(5893);function h(e){let{children:t}=e;return(0,f.jsx)(f.Fragment,{children:t})}var m=n(5742),g=n(2263),y=n(4996),b=n(6668),v=n(1944),w=n(4711),k=n(9727);const x="default";var S=n(8780),E=n(197);function _(){const{i18n:{currentLocale:e,defaultLocale:t,localeConfigs:n}}=(0,g.Z)(),r=(0,w.l)(),a=n[e].htmlLang,o=e=>e.replace("-","_");return(0,f.jsxs)(m.Z,{children:[Object.entries(n).map((e=>{let[t,{htmlLang:n}]=e;return(0,f.jsx)("link",{rel:"alternate",href:r.createUrl({locale:t,fullyQualified:!0}),hrefLang:n},t)})),(0,f.jsx)("link",{rel:"alternate",href:r.createUrl({locale:t,fullyQualified:!0}),hrefLang:"x-default"}),(0,f.jsx)("meta",{property:"og:locale",content:o(a)}),Object.values(n).filter((e=>a!==e.htmlLang)).map((e=>(0,f.jsx)("meta",{property:"og:locale:alternate",content:o(e.htmlLang)},`meta-og-${e.htmlLang}`)))]})}function C(e){let{permalink:t}=e;const{siteConfig:{url:n}}=(0,g.Z)(),r=function(){const{siteConfig:{url:e,baseUrl:t,trailingSlash:n}}=(0,g.Z)(),{pathname:r}=(0,d.TH)();return e+(0,S.Do)((0,y.ZP)(r),{trailingSlash:n,baseUrl:t})}(),a=t?`${n}${t}`:r;return(0,f.jsxs)(m.Z,{children:[(0,f.jsx)("meta",{property:"og:url",content:a}),(0,f.jsx)("link",{rel:"canonical",href:a})]})}function T(){const{i18n:{currentLocale:e}}=(0,g.Z)(),{metadata:t,image:n}=(0,b.L)();return(0,f.jsxs)(f.Fragment,{children:[(0,f.jsxs)(m.Z,{children:[(0,f.jsx)("meta",{name:"twitter:card",content:"summary_large_image"}),(0,f.jsx)("body",{className:k.h})]}),n&&(0,f.jsx)(v.d,{image:n}),(0,f.jsx)(C,{}),(0,f.jsx)(_,{}),(0,f.jsx)(E.Z,{tag:x,locale:e}),(0,f.jsx)(m.Z,{children:t.map(((e,t)=>(0,f.jsx)("meta",{...e},t)))})]})}const j=new Map;var L=n(8934),R=n(8940),N=n(469);function P(e){for(var t=arguments.length,n=new Array(t>1?t-1:0),r=1;r{const r=t.default?.[e]??t[e];return r?.(...n)}));return()=>a.forEach((e=>e?.()))}const A=function(e){let{children:t,location:n,previousLocation:r}=e;return(0,N.Z)((()=>{r!==n&&(!function(e){let{location:t,previousLocation:n}=e;if(!n)return;const r=t.pathname===n.pathname,a=t.hash===n.hash,o=t.search===n.search;if(r&&a&&!o)return;const{hash:i}=t;if(i){const e=decodeURIComponent(i.substring(1)),t=document.getElementById(e);t?.scrollIntoView()}else window.scrollTo(0,0)}({location:n,previousLocation:r}),P("onRouteDidUpdate",{previousLocation:r,location:n}))}),[r,n]),t};function O(e){const t=Array.from(new Set([e,decodeURI(e)])).map((e=>(0,p.f)(u.Z,e))).flat();return Promise.all(t.map((e=>e.route.component.preload?.())))}class I extends r.Component{previousLocation;routeUpdateCleanupCb;constructor(e){super(e),this.previousLocation=null,this.routeUpdateCleanupCb=l.Z.canUseDOM?P("onRouteUpdate",{previousLocation:null,location:this.props.location}):()=>{},this.state={nextRouteHasLoaded:!0}}shouldComponentUpdate(e,t){if(e.location===this.props.location)return t.nextRouteHasLoaded;const n=e.location;return this.previousLocation=this.props.location,this.setState({nextRouteHasLoaded:!1}),this.routeUpdateCleanupCb=P("onRouteUpdate",{previousLocation:this.previousLocation,location:n}),O(n.pathname).then((()=>{this.routeUpdateCleanupCb(),this.setState({nextRouteHasLoaded:!0})})).catch((e=>{console.warn(e),window.location.reload()})),!1}render(){const{children:e,location:t}=this.props;return(0,f.jsx)(A,{previousLocation:this.previousLocation,location:t,children:(0,f.jsx)(d.AW,{location:t,render:()=>e})})}}const D=I,F="__docusaurus-base-url-issue-banner-container",M="__docusaurus-base-url-issue-banner",z="__docusaurus-base-url-issue-banner-suggestion-container";function B(e){return`\ndocument.addEventListener('DOMContentLoaded', function maybeInsertBanner() {\n var shouldInsert = typeof window['docusaurus'] === 'undefined';\n shouldInsert && insertBanner();\n});\n\nfunction insertBanner() {\n var bannerContainer = document.createElement('div');\n bannerContainer.id = '${F}';\n var bannerHtml = ${JSON.stringify(function(e){return`\n
\n

Your Docusaurus site did not load properly.

\n

A very common reason is a wrong site baseUrl configuration.

\n

Current configured baseUrl = ${e} ${"/"===e?" (default value)":""}

\n

We suggest trying baseUrl =

\n
\n`}(e)).replace(/{let{route:t}=e;return!0===t.exact})))return j.set(e.pathname,e.pathname),e;const t=e.pathname.trim().replace(/(?:\/index)?\.html$/,"")||"/";return j.set(e.pathname,t),{...e,pathname:t}}((0,d.TH)());return(0,f.jsx)(D,{location:e,children:V})}function G(){return(0,f.jsx)(H.Z,{children:(0,f.jsx)(R.M,{children:(0,f.jsxs)(L.t,{children:[(0,f.jsxs)(h,{children:[(0,f.jsx)(q,{}),(0,f.jsx)(T,{}),(0,f.jsx)(U,{}),(0,f.jsx)(W,{})]}),(0,f.jsx)(Z,{})]})})})}var X=n(6887);const K=function(e){try{return document.createElement("link").relList.supports(e)}catch{return!1}}("prefetch")?function(e){return new Promise(((t,n)=>{if("undefined"==typeof document)return void n();const r=document.createElement("link");r.setAttribute("rel","prefetch"),r.setAttribute("href",e),r.onload=()=>t(),r.onerror=()=>n();const a=document.getElementsByTagName("head")[0]??document.getElementsByName("script")[0]?.parentNode;a?.appendChild(r)}))}:function(e){return new Promise(((t,n)=>{const r=new XMLHttpRequest;r.open("GET",e,!0),r.withCredentials=!0,r.onload=()=>{200===r.status?t():n()},r.send(null)}))};var Y=n(9670);const J=new Set,ee=new Set,te=()=>navigator.connection?.effectiveType.includes("2g")||navigator.connection?.saveData,ne={prefetch:e=>{if(!(e=>!te()&&!ee.has(e)&&!J.has(e))(e))return!1;J.add(e);const t=(0,p.f)(u.Z,e).flatMap((e=>{return t=e.route.path,Object.entries(X).filter((e=>{let[n]=e;return n.replace(/-[^-]+$/,"")===t})).flatMap((e=>{let[,t]=e;return Object.values((0,Y.Z)(t))}));var t}));return Promise.all(t.map((e=>{const t=n.gca(e);return t&&!t.includes("undefined")?K(t).catch((()=>{})):Promise.resolve()})))},preload:e=>!!(e=>!te()&&!ee.has(e))(e)&&(ee.add(e),O(e))},re=Object.freeze(ne);function ae(e){let{children:t}=e;return"hash"===s.default.future.experimental_router?(0,f.jsx)(i.UT,{children:t}):(0,f.jsx)(i.VK,{children:t})}const oe=Boolean(!0);if(l.Z.canUseDOM){window.docusaurus=re;const e=document.getElementById("__docusaurus"),t=(0,f.jsx)(o.B6,{children:(0,f.jsx)(ae,{children:(0,f.jsx)(G,{})})}),n=(e,t)=>{console.error("Docusaurus React Root onRecoverableError:",e,t)},i=()=>{if(window.docusaurusRoot)window.docusaurusRoot.render(t);else if(oe)window.docusaurusRoot=a.hydrateRoot(e,t,{onRecoverableError:n});else{const r=a.createRoot(e,{onRecoverableError:n});r.render(t),window.docusaurusRoot=r}};O(window.location.pathname).then((()=>{(0,r.startTransition)(i)}))}},8940:(e,t,n)=>{"use strict";n.d(t,{_:()=>d,M:()=>p});var r=n(7294),a=n(6809);const o=JSON.parse('{"docusaurus-plugin-content-docs":{"default":{"path":"/","versions":[{"name":"current","label":"Next","isLast":true,"path":"/","mainDocId":"introduction","docs":[{"id":"advanced","path":"/advanced","sidebar":"mySidebar"},{"id":"architecture","path":"/architecture","sidebar":"mySidebar"},{"id":"cli/agent","path":"/cli/agent","sidebar":"mySidebar"},{"id":"cli/certificate","path":"/cli/certificate","sidebar":"mySidebar"},{"id":"cli/cli","path":"/cli/","sidebar":"mySidebar"},{"id":"cli/etcd-snapshot","path":"/cli/etcd-snapshot","sidebar":"mySidebar"},{"id":"cli/secrets-encrypt","path":"/cli/secrets-encrypt","sidebar":"mySidebar"},{"id":"cli/server","path":"/cli/server","sidebar":"mySidebar"},{"id":"cli/token","path":"/cli/token","sidebar":"mySidebar"},{"id":"cluster-access","path":"/cluster-access","sidebar":"mySidebar"},{"id":"datastore/backup-restore","path":"/datastore/backup-restore","sidebar":"mySidebar"},{"id":"datastore/cluster-loadbalancer","path":"/datastore/cluster-loadbalancer","sidebar":"mySidebar"},{"id":"datastore/datastore","path":"/datastore/","sidebar":"mySidebar"},{"id":"datastore/ha","path":"/datastore/ha","sidebar":"mySidebar"},{"id":"datastore/ha-embedded","path":"/datastore/ha-embedded","sidebar":"mySidebar"},{"id":"faq","path":"/faq","sidebar":"mySidebar"},{"id":"helm","path":"/helm","sidebar":"mySidebar"},{"id":"installation/airgap","path":"/installation/airgap","sidebar":"mySidebar"},{"id":"installation/configuration","path":"/installation/configuration","sidebar":"mySidebar"},{"id":"installation/installation","path":"/installation/","sidebar":"mySidebar"},{"id":"installation/packaged-components","path":"/installation/packaged-components","sidebar":"mySidebar"},{"id":"installation/private-registry","path":"/installation/private-registry","sidebar":"mySidebar"},{"id":"installation/registry-mirror","path":"/installation/registry-mirror","sidebar":"mySidebar"},{"id":"installation/requirements","path":"/installation/requirements","sidebar":"mySidebar"},{"id":"installation/server-roles","path":"/installation/server-roles","sidebar":"mySidebar"},{"id":"installation/uninstall","path":"/installation/uninstall","sidebar":"mySidebar"},{"id":"introduction","path":"/","sidebar":"mySidebar"},{"id":"known-issues","path":"/known-issues","sidebar":"mySidebar"},{"id":"networking/basic-network-options","path":"/networking/basic-network-options","sidebar":"mySidebar"},{"id":"networking/distributed-multicloud","path":"/networking/distributed-multicloud","sidebar":"mySidebar"},{"id":"networking/multus-ipams","path":"/networking/multus-ipams","sidebar":"mySidebar"},{"id":"networking/networking","path":"/networking/","sidebar":"mySidebar"},{"id":"networking/networking-services","path":"/networking/networking-services","sidebar":"mySidebar"},{"id":"quick-start","path":"/quick-start","sidebar":"mySidebar"},{"id":"reference/env-variables","path":"/reference/env-variables","sidebar":"mySidebar"},{"id":"reference/flag-deprecation","path":"/reference/flag-deprecation","sidebar":"mySidebar"},{"id":"reference/resource-profiling","path":"/reference/resource-profiling","sidebar":"mySidebar"},{"id":"related-projects","path":"/related-projects","sidebar":"mySidebar"},{"id":"release-notes/v1.24.X","path":"/release-notes/v1.24.X","sidebar":"mySidebar"},{"id":"release-notes/v1.25.X","path":"/release-notes/v1.25.X","sidebar":"mySidebar"},{"id":"release-notes/v1.26.X","path":"/release-notes/v1.26.X","sidebar":"mySidebar"},{"id":"release-notes/v1.27.X","path":"/release-notes/v1.27.X","sidebar":"mySidebar"},{"id":"release-notes/v1.28.X","path":"/release-notes/v1.28.X","sidebar":"mySidebar"},{"id":"release-notes/v1.29.X","path":"/release-notes/v1.29.X","sidebar":"mySidebar"},{"id":"release-notes/v1.30.X","path":"/release-notes/v1.30.X","sidebar":"mySidebar"},{"id":"security/hardening-guide","path":"/security/hardening-guide","sidebar":"mySidebar"},{"id":"security/secrets-encryption","path":"/security/secrets-encryption","sidebar":"mySidebar"},{"id":"security/security","path":"/security/","sidebar":"mySidebar"},{"id":"security/self-assessment-1.23","path":"/security/self-assessment-1.23"},{"id":"security/self-assessment-1.24","path":"/security/self-assessment-1.24","sidebar":"mySidebar"},{"id":"security/self-assessment-1.7","path":"/security/self-assessment-1.7","sidebar":"mySidebar"},{"id":"security/self-assessment-1.8","path":"/security/self-assessment-1.8","sidebar":"mySidebar"},{"id":"storage","path":"/storage","sidebar":"mySidebar"},{"id":"upgrades/automated","path":"/upgrades/automated","sidebar":"mySidebar"},{"id":"upgrades/killall","path":"/upgrades/killall","sidebar":"mySidebar"},{"id":"upgrades/manual","path":"/upgrades/manual","sidebar":"mySidebar"},{"id":"upgrades/upgrades","path":"/upgrades/","sidebar":"mySidebar"}],"draftIds":[],"sidebars":{"mySidebar":{"link":{"path":"/","label":"introduction"}}}}],"breadcrumbs":true}}}'),i=JSON.parse('{"defaultLocale":"en","locales":["en","zh","kr"],"path":"i18n","currentLocale":"en","localeConfigs":{"en":{"label":"English","direction":"ltr","htmlLang":"en","calendar":"gregory","path":"en"},"zh":{"label":"\u7b80\u4f53\u4e2d\u6587","direction":"ltr","htmlLang":"zh","calendar":"gregory","path":"zh"},"kr":{"label":"\ud55c\uad6d\uc5b4","direction":"ltr","htmlLang":"kr","calendar":"gregory","path":"kr"}}}');var s=n(7529);const l=JSON.parse('{"docusaurusVersion":"3.5.1","siteVersion":"0.0.1","pluginVersions":{"docusaurus-plugin-content-docs":{"type":"package","name":"@docusaurus/plugin-content-docs","version":"3.5.1"},"docusaurus-plugin-content-pages":{"type":"package","name":"@docusaurus/plugin-content-pages","version":"3.5.1"},"docusaurus-plugin-sitemap":{"type":"package","name":"@docusaurus/plugin-sitemap","version":"3.5.1"},"docusaurus-theme-classic":{"type":"package","name":"@docusaurus/theme-classic","version":"3.5.1"},"docusaurus-plugin-client-redirects":{"type":"package","name":"@docusaurus/plugin-client-redirects","version":"3.5.1"},"docusaurus-theme-mermaid":{"type":"package","name":"@docusaurus/theme-mermaid","version":"3.5.1"},"@easyops-cn/docusaurus-search-local":{"type":"package","name":"@easyops-cn/docusaurus-search-local","version":"0.44.4"}}}');var c=n(5893);const u={siteConfig:a.default,siteMetadata:l,globalData:o,i18n:i,codeTranslations:s},d=r.createContext(u);function p(e){let{children:t}=e;return(0,c.jsx)(d.Provider,{value:u,children:t})}},4763:(e,t,n)=>{"use strict";n.d(t,{Z:()=>m});var r=n(7294),a=n(412),o=n(5742),i=n(8780),s=n(8947),l=n(226),c=n(5893);function u(e){let{error:t,tryAgain:n}=e;return(0,c.jsxs)("div",{style:{display:"flex",flexDirection:"column",justifyContent:"center",alignItems:"flex-start",minHeight:"100vh",width:"100%",maxWidth:"80ch",fontSize:"20px",margin:"0 auto",padding:"1rem"},children:[(0,c.jsx)("h1",{style:{fontSize:"3rem"},children:"This page crashed"}),(0,c.jsx)("button",{type:"button",onClick:n,style:{margin:"1rem 0",fontSize:"2rem",cursor:"pointer",borderRadius:20,padding:"1rem"},children:"Try again"}),(0,c.jsx)(d,{error:t})]})}function d(e){let{error:t}=e;const n=(0,i.BN)(t).map((e=>e.message)).join("\n\nCause:\n");return(0,c.jsx)("p",{style:{whiteSpace:"pre-wrap"},children:n})}function p(e){let{children:t}=e;return(0,c.jsx)(l.z,{value:{plugin:{name:"docusaurus-core-error-boundary",id:"default"}},children:t})}function f(e){let{error:t,tryAgain:n}=e;return(0,c.jsx)(p,{children:(0,c.jsxs)(m,{fallback:()=>(0,c.jsx)(u,{error:t,tryAgain:n}),children:[(0,c.jsx)(o.Z,{children:(0,c.jsx)("title",{children:"Page Error"})}),(0,c.jsx)(s.Z,{children:(0,c.jsx)(u,{error:t,tryAgain:n})})]})})}const h=e=>(0,c.jsx)(f,{...e});class m extends r.Component{constructor(e){super(e),this.state={error:null}}componentDidCatch(e){a.Z.canUseDOM&&this.setState({error:e})}render(){const{children:e}=this.props,{error:t}=this.state;if(t){const e={error:t,tryAgain:()=>this.setState({error:null})};return(this.props.fallback??h)(e)}return e??null}}},412:(e,t,n)=>{"use strict";n.d(t,{Z:()=>a});const r="undefined"!=typeof window&&"document"in window&&"createElement"in window.document,a={canUseDOM:r,canUseEventListeners:r&&("addEventListener"in window||"attachEvent"in window),canUseIntersectionObserver:r&&"IntersectionObserver"in window,canUseViewport:r&&"screen"in window}},5742:(e,t,n)=>{"use strict";n.d(t,{Z:()=>o});n(7294);var r=n(405),a=n(5893);function o(e){return(0,a.jsx)(r.ql,{...e})}},3692:(e,t,n)=>{"use strict";n.d(t,{Z:()=>f});var r=n(7294),a=n(3727),o=n(8780),i=n(2263),s=n(3919),l=n(412),c=n(8138),u=n(4996),d=n(5893);function p(e,t){let{isNavLink:n,to:p,href:f,activeClassName:h,isActive:m,"data-noBrokenLinkCheck":g,autoAddBaseUrl:y=!0,...b}=e;const{siteConfig:v}=(0,i.Z)(),{trailingSlash:w,baseUrl:k}=v,x=v.future.experimental_router,{withBaseUrl:S}=(0,u.Cg)(),E=(0,c.Z)(),_=(0,r.useRef)(null);(0,r.useImperativeHandle)(t,(()=>_.current));const C=p||f;const T=(0,s.Z)(C),j=C?.replace("pathname://","");let L=void 0!==j?(R=j,y&&(e=>e.startsWith("/"))(R)?S(R):R):void 0;var R;"hash"===x&&L?.startsWith("./")&&(L=L?.slice(1)),L&&T&&(L=(0,o.Do)(L,{trailingSlash:w,baseUrl:k}));const N=(0,r.useRef)(!1),P=n?a.OL:a.rU,A=l.Z.canUseIntersectionObserver,O=(0,r.useRef)(),I=()=>{N.current||null==L||(window.docusaurus.preload(L),N.current=!0)};(0,r.useEffect)((()=>(!A&&T&&l.Z.canUseDOM&&null!=L&&window.docusaurus.prefetch(L),()=>{A&&O.current&&O.current.disconnect()})),[O,L,A,T]);const D=L?.startsWith("#")??!1,F=!b.target||"_self"===b.target,M=!L||!T||!F||D&&"hash"!==x;g||!D&&M||E.collectLink(L),b.id&&E.collectAnchor(b.id);const z={};return M?(0,d.jsx)("a",{ref:_,href:L,...C&&!T&&{target:"_blank",rel:"noopener noreferrer"},...b,...z}):(0,d.jsx)(P,{...b,onMouseEnter:I,onTouchStart:I,innerRef:e=>{_.current=e,A&&e&&T&&(O.current=new window.IntersectionObserver((t=>{t.forEach((t=>{e===t.target&&(t.isIntersecting||t.intersectionRatio>0)&&(O.current.unobserve(e),O.current.disconnect(),null!=L&&window.docusaurus.prefetch(L))}))})),O.current.observe(e))},to:L,...n&&{isActive:m,activeClassName:h},...z})}const f=r.forwardRef(p)},5999:(e,t,n)=>{"use strict";n.d(t,{Z:()=>c,I:()=>l});var r=n(7294),a=n(5893);function o(e,t){const n=e.split(/(\{\w+\})/).map(((e,n)=>{if(n%2==1){const n=t?.[e.slice(1,-1)];if(void 0!==n)return n}return e}));return n.some((e=>(0,r.isValidElement)(e)))?n.map(((e,t)=>(0,r.isValidElement)(e)?r.cloneElement(e,{key:t}):e)).filter((e=>""!==e)):n.join("")}var i=n(7529);function s(e){let{id:t,message:n}=e;if(void 0===t&&void 0===n)throw new Error("Docusaurus translation declarations must have at least a translation id or a default translation message");return i[t??n]??n??t}function l(e,t){let{message:n,id:r}=e;return o(s({message:n,id:r}),t)}function c(e){let{children:t,id:n,values:r}=e;if(t&&"string"!=typeof t)throw console.warn("Illegal children",t),new Error("The Docusaurus component only accept simple string values");const i=s({message:t,id:n});return(0,a.jsx)(a.Fragment,{children:o(i,r)})}},9935:(e,t,n)=>{"use strict";n.d(t,{m:()=>r});const r="default"},3919:(e,t,n)=>{"use strict";function r(e){return/^(?:\w*:|\/\/)/.test(e)}function a(e){return void 0!==e&&!r(e)}n.d(t,{Z:()=>a,b:()=>r})},4996:(e,t,n)=>{"use strict";n.d(t,{Cg:()=>i,ZP:()=>s});var r=n(7294),a=n(2263),o=n(3919);function i(){const{siteConfig:e}=(0,a.Z)(),{baseUrl:t,url:n}=e,i=e.future.experimental_router,s=(0,r.useCallback)(((e,r)=>function(e){let{siteUrl:t,baseUrl:n,url:r,options:{forcePrependBaseUrl:a=!1,absolute:i=!1}={},router:s}=e;if(!r||r.startsWith("#")||(0,o.b)(r))return r;if("hash"===s)return r.startsWith("/")?`.${r}`:`./${r}`;if(a)return n+r.replace(/^\//,"");if(r===n.replace(/\/$/,""))return n;const l=r.startsWith(n)?r:n+r.replace(/^\//,"");return i?t+l:l}({siteUrl:n,baseUrl:t,url:e,options:r,router:i})),[n,t,i]);return{withBaseUrl:s}}function s(e,t){void 0===t&&(t={});const{withBaseUrl:n}=i();return n(e,t)}},8138:(e,t,n)=>{"use strict";n.d(t,{Z:()=>i});var r=n(7294);n(5893);const a=r.createContext({collectAnchor:()=>{},collectLink:()=>{}}),o=()=>(0,r.useContext)(a);function i(){return o()}},2263:(e,t,n)=>{"use strict";n.d(t,{Z:()=>o});var r=n(7294),a=n(8940);function o(){return(0,r.useContext)(a._)}},2389:(e,t,n)=>{"use strict";n.d(t,{Z:()=>o});var r=n(7294),a=n(8934);function o(){return(0,r.useContext)(a._)}},469:(e,t,n)=>{"use strict";n.d(t,{Z:()=>a});var r=n(7294);const a=n(412).Z.canUseDOM?r.useLayoutEffect:r.useEffect},9670:(e,t,n)=>{"use strict";n.d(t,{Z:()=>a});const r=e=>"object"==typeof e&&!!e&&Object.keys(e).length>0;function a(e){const t={};return function e(n,a){Object.entries(n).forEach((n=>{let[o,i]=n;const s=a?`${a}.${o}`:o;r(i)?e(i,s):t[s]=i}))}(e),t}},226:(e,t,n)=>{"use strict";n.d(t,{_:()=>o,z:()=>i});var r=n(7294),a=n(5893);const o=r.createContext(null);function i(e){let{children:t,value:n}=e;const i=r.useContext(o),s=(0,r.useMemo)((()=>function(e){let{parent:t,value:n}=e;if(!t){if(!n)throw new Error("Unexpected: no Docusaurus route context found");if(!("plugin"in n))throw new Error("Unexpected: Docusaurus topmost route context has no `plugin` attribute");return n}const r={...t.data,...n?.data};return{plugin:t.plugin,data:r}}({parent:i,value:n})),[i,n]);return(0,a.jsx)(o.Provider,{value:s,children:t})}},298:(e,t,n)=>{"use strict";n.d(t,{J:()=>b,L5:()=>g});var r=n(7294),a=n(143),o=n(9935),i=n(6668),s=n(812),l=n(902),c=n(5893);const u=e=>`docs-preferred-version-${e}`,d={save:(e,t,n)=>{(0,s.WA)(u(e),{persistence:t}).set(n)},read:(e,t)=>(0,s.WA)(u(e),{persistence:t}).get(),clear:(e,t)=>{(0,s.WA)(u(e),{persistence:t}).del()}},p=e=>Object.fromEntries(e.map((e=>[e,{preferredVersionName:null}])));const f=r.createContext(null);function h(){const e=(0,a._r)(),t=(0,i.L)().docs.versionPersistence,n=(0,r.useMemo)((()=>Object.keys(e)),[e]),[o,s]=(0,r.useState)((()=>p(n)));(0,r.useEffect)((()=>{s(function(e){let{pluginIds:t,versionPersistence:n,allDocsData:r}=e;function a(e){const t=d.read(e,n);return r[e].versions.some((e=>e.name===t))?{preferredVersionName:t}:(d.clear(e,n),{preferredVersionName:null})}return Object.fromEntries(t.map((e=>[e,a(e)])))}({allDocsData:e,versionPersistence:t,pluginIds:n}))}),[e,t,n]);return[o,(0,r.useMemo)((()=>({savePreferredVersion:function(e,n){d.save(e,t,n),s((t=>({...t,[e]:{preferredVersionName:n}})))}})),[t])]}function m(e){let{children:t}=e;const n=h();return(0,c.jsx)(f.Provider,{value:n,children:t})}function g(e){let{children:t}=e;return(0,c.jsx)(m,{children:t})}function y(){const e=(0,r.useContext)(f);if(!e)throw new l.i6("DocsPreferredVersionContextProvider");return e}function b(e){void 0===e&&(e=o.m);const t=(0,a.zh)(e),[n,i]=y(),{preferredVersionName:s}=n[e];return{preferredVersion:t.versions.find((e=>e.name===s))??null,savePreferredVersionName:(0,r.useCallback)((t=>{i.savePreferredVersion(e,t)}),[i,e])}}},4731:(e,t,n)=>{"use strict";n.d(t,{V:()=>c,b:()=>l});var r=n(7294),a=n(902),o=n(5893);const i=Symbol("EmptyContext"),s=r.createContext(i);function l(e){let{children:t,name:n,items:a}=e;const i=(0,r.useMemo)((()=>n&&a?{name:n,items:a}:null),[n,a]);return(0,o.jsx)(s.Provider,{value:i,children:t})}function c(){const e=(0,r.useContext)(s);if(e===i)throw new a.i6("DocsSidebarProvider");return e}},9690:(e,t,n)=>{"use strict";n.d(t,{LM:()=>p,MN:()=>_,SN:()=>E,_F:()=>g,f:()=>b,jA:()=>f,lO:()=>k,oz:()=>x,s1:()=>w,vY:()=>S});var r=n(7294),a=n(6550),o=n(8790),i=n(143),s=n(8596),l=n(7392),c=n(298),u=n(3797),d=n(4731);function p(e){return"link"!==e.type||e.unlisted?"category"===e.type?function(e){if(e.href&&!e.linkUnlisted)return e.href;for(const t of e.items){const e=p(t);if(e)return e}}(e):void 0:e.href}function f(){const{pathname:e}=(0,a.TH)(),t=(0,d.V)();if(!t)throw new Error("Unexpected: cant find current sidebar in context");const n=v({sidebarItems:t.items,pathname:e,onlyCategories:!0}).slice(-1)[0];if(!n)throw new Error(`${e} is not associated with a category. useCurrentSidebarCategory() should only be used on category index pages.`);return n}const h=(e,t)=>void 0!==e&&(0,s.Mg)(e,t),m=(e,t)=>e.some((e=>g(e,t)));function g(e,t){return"link"===e.type?h(e.href,t):"category"===e.type&&(h(e.href,t)||m(e.items,t))}function y(e,t){switch(e.type){case"category":return g(e,t)||e.items.some((e=>y(e,t)));case"link":return!e.unlisted||g(e,t);default:return!0}}function b(e,t){return(0,r.useMemo)((()=>e.filter((e=>y(e,t)))),[e,t])}function v(e){let{sidebarItems:t,pathname:n,onlyCategories:r=!1}=e;const a=[];return function e(t){for(const o of t)if("category"===o.type&&((0,s.Mg)(o.href,n)||e(o.items))||"link"===o.type&&(0,s.Mg)(o.href,n)){return r&&"category"!==o.type||a.unshift(o),!0}return!1}(t),a}function w(){const e=(0,d.V)(),{pathname:t}=(0,a.TH)(),n=(0,i.gA)()?.pluginData.breadcrumbs;return!1!==n&&e?v({sidebarItems:e.items,pathname:t}):null}function k(e){const{activeVersion:t}=(0,i.Iw)(e),{preferredVersion:n}=(0,c.J)(e),a=(0,i.yW)(e);return(0,r.useMemo)((()=>(0,l.jj)([t,n,a].filter(Boolean))),[t,n,a])}function x(e,t){const n=k(t);return(0,r.useMemo)((()=>{const t=n.flatMap((e=>e.sidebars?Object.entries(e.sidebars):[])),r=t.find((t=>t[0]===e));if(!r)throw new Error(`Can't find any sidebar with id "${e}" in version${n.length>1?"s":""} ${n.map((e=>e.name)).join(", ")}".\nAvailable sidebar ids are:\n- ${t.map((e=>e[0])).join("\n- ")}`);return r[1]}),[e,n])}function S(e,t){const n=k(t);return(0,r.useMemo)((()=>{const t=n.flatMap((e=>e.docs)),r=t.find((t=>t.id===e));if(!r){if(n.flatMap((e=>e.draftIds)).includes(e))return null;throw new Error(`Couldn't find any doc with id "${e}" in version${n.length>1?"s":""} "${n.map((e=>e.name)).join(", ")}".\nAvailable doc ids are:\n- ${(0,l.jj)(t.map((e=>e.id))).join("\n- ")}`)}return r}),[e,n])}function E(e){let{route:t}=e;const n=(0,a.TH)(),r=(0,u.E)(),i=t.routes,s=i.find((e=>(0,a.LX)(n.pathname,e)));if(!s)return null;const l=s.sidebar,c=l?r.docsSidebars[l]:void 0;return{docElement:(0,o.H)(i),sidebarName:l,sidebarItems:c}}function _(e){return e.filter((e=>!("category"===e.type||"link"===e.type)||!!p(e)))}},3797:(e,t,n)=>{"use strict";n.d(t,{E:()=>l,q:()=>s});var r=n(7294),a=n(902),o=n(5893);const i=r.createContext(null);function s(e){let{children:t,version:n}=e;return(0,o.jsx)(i.Provider,{value:n,children:t})}function l(){const e=(0,r.useContext)(i);if(null===e)throw new a.i6("DocsVersionProvider");return e}},143:(e,t,n)=>{"use strict";n.d(t,{MN:()=>c.MN,Iw:()=>y,gA:()=>h,_r:()=>p,jA:()=>c.jA,Jo:()=>b,zh:()=>f,J:()=>u.J,yW:()=>g,gB:()=>m});var r=n(6550),a=n(2263),o=n(9935);function i(e,t){void 0===t&&(t={});const n=function(){const{globalData:e}=(0,a.Z)();return e}()[e];if(!n&&t.failfast)throw new Error(`Docusaurus plugin global data not found for "${e}" plugin.`);return n}const s=e=>e.versions.find((e=>e.isLast));function l(e,t){const n=function(e,t){return[...e.versions].sort(((e,t)=>e.path===t.path?0:e.path.includes(t.path)?-1:t.path.includes(e.path)?1:0)).find((e=>!!(0,r.LX)(t,{path:e.path,exact:!1,strict:!1})))}(e,t),a=n?.docs.find((e=>!!(0,r.LX)(t,{path:e.path,exact:!0,strict:!1})));return{activeVersion:n,activeDoc:a,alternateDocVersions:a?function(t){const n={};return e.versions.forEach((e=>{e.docs.forEach((r=>{r.id===t&&(n[e.name]=r)}))})),n}(a.id):{}}}var c=n(9690),u=n(298);const d={},p=()=>i("docusaurus-plugin-content-docs")??d,f=e=>{try{return function(e,t,n){void 0===t&&(t=o.m),void 0===n&&(n={});const r=i(e),a=r?.[t];if(!a&&n.failfast)throw new Error(`Docusaurus plugin global data not found for "${e}" plugin with id "${t}".`);return a}("docusaurus-plugin-content-docs",e,{failfast:!0})}catch(t){throw new Error("You are using a feature of the Docusaurus docs plugin, but this plugin does not seem to be enabled"+("Default"===e?"":` (pluginId=${e}`),{cause:t})}};function h(e){void 0===e&&(e={});const t=p(),{pathname:n}=(0,r.TH)();return function(e,t,n){void 0===n&&(n={});const a=Object.entries(e).sort(((e,t)=>t[1].path.localeCompare(e[1].path))).find((e=>{let[,n]=e;return!!(0,r.LX)(t,{path:n.path,exact:!1,strict:!1})})),o=a?{pluginId:a[0],pluginData:a[1]}:void 0;if(!o&&n.failfast)throw new Error(`Can't find active docs plugin for "${t}" pathname, while it was expected to be found. Maybe you tried to use a docs feature that can only be used on a docs-related page? Existing docs plugin paths are: ${Object.values(e).map((e=>e.path)).join(", ")}`);return o}(t,n,e)}function m(e){return f(e).versions}function g(e){const t=f(e);return s(t)}function y(e){const t=f(e),{pathname:n}=(0,r.TH)();return l(t,n)}function b(e){const t=f(e),{pathname:n}=(0,r.TH)();return function(e,t){const n=s(e);return{latestDocSuggestion:l(e,t).alternateDocVersions[n.name],latestVersionSuggestion:n}}(t,n)}},8320:(e,t,n)=>{"use strict";n.r(t),n.d(t,{default:()=>o});var r=n(4865),a=n.n(r);a().configure({showSpinner:!1});const o={onRouteUpdate(e){let{location:t,previousLocation:n}=e;if(n&&t.pathname!==n.pathname){const e=window.setTimeout((()=>{a().start()}),200);return()=>window.clearTimeout(e)}},onRouteDidUpdate(){a().done()}}},3310:(e,t,n)=>{"use strict";n.r(t);var r=n(2573),a=n(6809);!function(e){const{themeConfig:{prism:t}}=a.default,{additionalLanguages:r}=t;globalThis.Prism=e,r.forEach((e=>{"php"===e&&n(6854),n(6726)(`./prism-${e}`)})),delete globalThis.Prism}(r.p1)},2503:(e,t,n)=>{"use strict";n.d(t,{Z:()=>u});n(7294);var r=n(512),a=n(5999),o=n(6668),i=n(3692),s=n(8138);const l={anchorWithStickyNavbar:"anchorWithStickyNavbar_LWe7",anchorWithHideOnScrollNavbar:"anchorWithHideOnScrollNavbar_WYt5"};var c=n(5893);function u(e){let{as:t,id:n,...u}=e;const d=(0,s.Z)(),{navbar:{hideOnScroll:p}}=(0,o.L)();if("h1"===t||!n)return(0,c.jsx)(t,{...u,id:void 0});d.collectAnchor(n);const f=(0,a.I)({id:"theme.common.headingLinkTitle",message:"Direct link to {heading}",description:"Title for link to heading"},{heading:"string"==typeof u.children?u.children:n});return(0,c.jsxs)(t,{...u,className:(0,r.Z)("anchor",p?l.anchorWithHideOnScrollNavbar:l.anchorWithStickyNavbar,u.className),id:n,children:[u.children,(0,c.jsx)(i.Z,{className:"hash-link",to:`#${n}`,"aria-label":f,title:f,children:"\u200b"})]})}},9471:(e,t,n)=>{"use strict";n.d(t,{Z:()=>o});n(7294);const r={iconExternalLink:"iconExternalLink_nPIU"};var a=n(5893);function o(e){let{width:t=13.5,height:n=13.5}=e;return(0,a.jsx)("svg",{width:t,height:n,"aria-hidden":"true",viewBox:"0 0 24 24",className:r.iconExternalLink,children:(0,a.jsx)("path",{fill:"currentColor",d:"M21 13v10h-21v-19h12v2h-10v15h17v-8h2zm3-12h-10.988l4.035 4-6.977 7.07 2.828 2.828 6.977-7.07 4.125 4.172v-11z"})})}},8947:(e,t,n)=>{"use strict";n.d(t,{Z:()=>Pt});var r=n(7294),a=n(512),o=n(4763),i=n(1944),s=n(6550),l=n(5999),c=n(5936),u=n(5893);const d="__docusaurus_skipToContent_fallback";function p(e){e.setAttribute("tabindex","-1"),e.focus(),e.removeAttribute("tabindex")}function f(){const e=(0,r.useRef)(null),{action:t}=(0,s.k6)(),n=(0,r.useCallback)((e=>{e.preventDefault();const t=document.querySelector("main:first-of-type")??document.getElementById(d);t&&p(t)}),[]);return(0,c.S)((n=>{let{location:r}=n;e.current&&!r.hash&&"PUSH"===t&&p(e.current)})),{containerRef:e,onClick:n}}const h=(0,l.I)({id:"theme.common.skipToMainContent",description:"The skip to content label used for accessibility, allowing to rapidly navigate to main content with keyboard tab/enter navigation",message:"Skip to main content"});function m(e){const t=e.children??h,{containerRef:n,onClick:r}=f();return(0,u.jsx)("div",{ref:n,role:"region","aria-label":h,children:(0,u.jsx)("a",{...e,href:`#${d}`,onClick:r,children:t})})}var g=n(5281),y=n(9727);const b={skipToContent:"skipToContent_fXgn"};function v(){return(0,u.jsx)(m,{className:b.skipToContent})}var w=n(6668),k=n(9689);function x(e){let{width:t=21,height:n=21,color:r="currentColor",strokeWidth:a=1.2,className:o,...i}=e;return(0,u.jsx)("svg",{viewBox:"0 0 15 15",width:t,height:n,...i,children:(0,u.jsx)("g",{stroke:r,strokeWidth:a,children:(0,u.jsx)("path",{d:"M.75.75l13.5 13.5M14.25.75L.75 14.25"})})})}const S={closeButton:"closeButton_CVFx"};function E(e){return(0,u.jsx)("button",{type:"button","aria-label":(0,l.I)({id:"theme.AnnouncementBar.closeButtonAriaLabel",message:"Close",description:"The ARIA label for close button of announcement bar"}),...e,className:(0,a.Z)("clean-btn close",S.closeButton,e.className),children:(0,u.jsx)(x,{width:14,height:14,strokeWidth:3.1})})}const _={content:"content_knG7"};function C(e){const{announcementBar:t}=(0,w.L)(),{content:n}=t;return(0,u.jsx)("div",{...e,className:(0,a.Z)(_.content,e.className),dangerouslySetInnerHTML:{__html:n}})}const T={announcementBar:"announcementBar_mb4j",announcementBarPlaceholder:"announcementBarPlaceholder_vyr4",announcementBarClose:"announcementBarClose_gvF7",announcementBarContent:"announcementBarContent_xLdY"};function j(){const{announcementBar:e}=(0,w.L)(),{isActive:t,close:n}=(0,k.n)();if(!t)return null;const{backgroundColor:r,textColor:a,isCloseable:o}=e;return(0,u.jsxs)("div",{className:T.announcementBar,style:{backgroundColor:r,color:a},role:"banner",children:[o&&(0,u.jsx)("div",{className:T.announcementBarPlaceholder}),(0,u.jsx)(C,{className:T.announcementBarContent}),o&&(0,u.jsx)(E,{onClick:n,className:T.announcementBarClose})]})}var L=n(3163),R=n(2466);var N=n(902),P=n(3102);const A=r.createContext(null);function O(e){let{children:t}=e;const n=function(){const e=(0,L.e)(),t=(0,P.HY)(),[n,a]=(0,r.useState)(!1),o=null!==t.component,i=(0,N.D9)(o);return(0,r.useEffect)((()=>{o&&!i&&a(!0)}),[o,i]),(0,r.useEffect)((()=>{o?e.shown||a(!0):a(!1)}),[e.shown,o]),(0,r.useMemo)((()=>[n,a]),[n])}();return(0,u.jsx)(A.Provider,{value:n,children:t})}function I(e){if(e.component){const t=e.component;return(0,u.jsx)(t,{...e.props})}}function D(){const e=(0,r.useContext)(A);if(!e)throw new N.i6("NavbarSecondaryMenuDisplayProvider");const[t,n]=e,a=(0,r.useCallback)((()=>n(!1)),[n]),o=(0,P.HY)();return(0,r.useMemo)((()=>({shown:t,hide:a,content:I(o)})),[a,o,t])}function F(e){let{header:t,primaryMenu:n,secondaryMenu:r}=e;const{shown:o}=D();return(0,u.jsxs)("div",{className:"navbar-sidebar",children:[t,(0,u.jsxs)("div",{className:(0,a.Z)("navbar-sidebar__items",{"navbar-sidebar__items--show-secondary":o}),children:[(0,u.jsx)("div",{className:"navbar-sidebar__item menu",children:n}),(0,u.jsx)("div",{className:"navbar-sidebar__item menu",children:r})]})]})}var M=n(2949),z=n(2389);function B(e){return(0,u.jsx)("svg",{viewBox:"0 0 24 24",width:24,height:24,...e,children:(0,u.jsx)("path",{fill:"currentColor",d:"M12,9c1.65,0,3,1.35,3,3s-1.35,3-3,3s-3-1.35-3-3S10.35,9,12,9 M12,7c-2.76,0-5,2.24-5,5s2.24,5,5,5s5-2.24,5-5 S14.76,7,12,7L12,7z M2,13l2,0c0.55,0,1-0.45,1-1s-0.45-1-1-1l-2,0c-0.55,0-1,0.45-1,1S1.45,13,2,13z M20,13l2,0c0.55,0,1-0.45,1-1 s-0.45-1-1-1l-2,0c-0.55,0-1,0.45-1,1S19.45,13,20,13z M11,2v2c0,0.55,0.45,1,1,1s1-0.45,1-1V2c0-0.55-0.45-1-1-1S11,1.45,11,2z M11,20v2c0,0.55,0.45,1,1,1s1-0.45,1-1v-2c0-0.55-0.45-1-1-1C11.45,19,11,19.45,11,20z M5.99,4.58c-0.39-0.39-1.03-0.39-1.41,0 c-0.39,0.39-0.39,1.03,0,1.41l1.06,1.06c0.39,0.39,1.03,0.39,1.41,0s0.39-1.03,0-1.41L5.99,4.58z M18.36,16.95 c-0.39-0.39-1.03-0.39-1.41,0c-0.39,0.39-0.39,1.03,0,1.41l1.06,1.06c0.39,0.39,1.03,0.39,1.41,0c0.39-0.39,0.39-1.03,0-1.41 L18.36,16.95z M19.42,5.99c0.39-0.39,0.39-1.03,0-1.41c-0.39-0.39-1.03-0.39-1.41,0l-1.06,1.06c-0.39,0.39-0.39,1.03,0,1.41 s1.03,0.39,1.41,0L19.42,5.99z M7.05,18.36c0.39-0.39,0.39-1.03,0-1.41c-0.39-0.39-1.03-0.39-1.41,0l-1.06,1.06 c-0.39,0.39-0.39,1.03,0,1.41s1.03,0.39,1.41,0L7.05,18.36z"})})}function $(e){return(0,u.jsx)("svg",{viewBox:"0 0 24 24",width:24,height:24,...e,children:(0,u.jsx)("path",{fill:"currentColor",d:"M9.37,5.51C9.19,6.15,9.1,6.82,9.1,7.5c0,4.08,3.32,7.4,7.4,7.4c0.68,0,1.35-0.09,1.99-0.27C17.45,17.19,14.93,19,12,19 c-3.86,0-7-3.14-7-7C5,9.07,6.81,6.55,9.37,5.51z M12,3c-4.97,0-9,4.03-9,9s4.03,9,9,9s9-4.03,9-9c0-0.46-0.04-0.92-0.1-1.36 c-0.98,1.37-2.58,2.26-4.4,2.26c-2.98,0-5.4-2.42-5.4-5.4c0-1.81,0.89-3.42,2.26-4.4C12.92,3.04,12.46,3,12,3L12,3z"})})}const U={toggle:"toggle_vylO",toggleButton:"toggleButton_gllP",darkToggleIcon:"darkToggleIcon_wfgR",lightToggleIcon:"lightToggleIcon_pyhR",toggleButtonDisabled:"toggleButtonDisabled_aARS"};function q(e){let{className:t,buttonClassName:n,value:r,onChange:o}=e;const i=(0,z.Z)(),s=(0,l.I)({message:"Switch between dark and light mode (currently {mode})",id:"theme.colorToggle.ariaLabel",description:"The ARIA label for the navbar color mode toggle"},{mode:"dark"===r?(0,l.I)({message:"dark mode",id:"theme.colorToggle.ariaLabel.mode.dark",description:"The name for the dark color mode"}):(0,l.I)({message:"light mode",id:"theme.colorToggle.ariaLabel.mode.light",description:"The name for the light color mode"})});return(0,u.jsx)("div",{className:(0,a.Z)(U.toggle,t),children:(0,u.jsxs)("button",{className:(0,a.Z)("clean-btn",U.toggleButton,!i&&U.toggleButtonDisabled,n),type:"button",onClick:()=>o("dark"===r?"light":"dark"),disabled:!i,title:s,"aria-label":s,"aria-live":"polite",children:[(0,u.jsx)(B,{className:(0,a.Z)(U.toggleIcon,U.lightToggleIcon)}),(0,u.jsx)($,{className:(0,a.Z)(U.toggleIcon,U.darkToggleIcon)})]})})}const H=r.memo(q),Q={darkNavbarColorModeToggle:"darkNavbarColorModeToggle_X3D1"};function Z(e){let{className:t}=e;const n=(0,w.L)().navbar.style,r=(0,w.L)().colorMode.disableSwitch,{colorMode:a,setColorMode:o}=(0,M.I)();return r?null:(0,u.jsx)(H,{className:t,buttonClassName:"dark"===n?Q.darkNavbarColorModeToggle:void 0,value:a,onChange:o})}var V=n(1327);function W(){return(0,u.jsx)(V.Z,{className:"navbar__brand",imageClassName:"navbar__logo",titleClassName:"navbar__title text--truncate"})}function G(){const e=(0,L.e)();return(0,u.jsx)("button",{type:"button","aria-label":(0,l.I)({id:"theme.docs.sidebar.closeSidebarButtonAriaLabel",message:"Close navigation bar",description:"The ARIA label for close button of mobile sidebar"}),className:"clean-btn navbar-sidebar__close",onClick:()=>e.toggle(),children:(0,u.jsx)(x,{color:"var(--ifm-color-emphasis-600)"})})}function X(){return(0,u.jsxs)("div",{className:"navbar-sidebar__brand",children:[(0,u.jsx)(W,{}),(0,u.jsx)("a",{href:"https://github.com/k3s-io/k3s",target:"_blank",rel:"noopener noreferrer",className:"margin-right--md header-github-link"}),(0,u.jsx)(Z,{className:"margin-right--md"}),(0,u.jsx)(G,{})]})}var K=n(3692),Y=n(4996),J=n(3919);function ee(e,t){return void 0!==e&&void 0!==t&&new RegExp(e,"gi").test(t)}var te=n(9471);function ne(e){let{activeBasePath:t,activeBaseRegex:n,to:r,href:a,label:o,html:i,isDropdownLink:s,prependBaseUrlToHref:l,...c}=e;const d=(0,Y.ZP)(r),p=(0,Y.ZP)(t),f=(0,Y.ZP)(a,{forcePrependBaseUrl:!0}),h=o&&a&&!(0,J.Z)(a),m=i?{dangerouslySetInnerHTML:{__html:i}}:{children:(0,u.jsxs)(u.Fragment,{children:[o,h&&(0,u.jsx)(te.Z,{...s&&{width:12,height:12}})]})};return a?(0,u.jsx)(K.Z,{href:l?f:a,...c,...m}):(0,u.jsx)(K.Z,{to:d,isNavLink:!0,...(t||n)&&{isActive:(e,t)=>n?ee(n,t.pathname):t.pathname.startsWith(p)},...c,...m})}function re(e){let{className:t,isDropdownItem:n=!1,...r}=e;const o=(0,u.jsx)(ne,{className:(0,a.Z)(n?"dropdown__link":"navbar__item navbar__link",t),isDropdownLink:n,...r});return n?(0,u.jsx)("li",{children:o}):o}function ae(e){let{className:t,isDropdownItem:n,...r}=e;return(0,u.jsx)("li",{className:"menu__list-item",children:(0,u.jsx)(ne,{className:(0,a.Z)("menu__link",t),...r})})}function oe(e){let{mobile:t=!1,position:n,...r}=e;const a=t?ae:re;return(0,u.jsx)(a,{...r,activeClassName:r.activeClassName??(t?"menu__link--active":"navbar__link--active")})}var ie=n(6043),se=n(8596),le=n(2263);const ce={dropdownNavbarItemMobile:"dropdownNavbarItemMobile_S0Fm"};function ue(e,t){return e.some((e=>function(e,t){return!!(0,se.Mg)(e.to,t)||!!ee(e.activeBaseRegex,t)||!(!e.activeBasePath||!t.startsWith(e.activeBasePath))}(e,t)))}function de(e){let{items:t,position:n,className:o,onClick:i,...s}=e;const l=(0,r.useRef)(null),[c,d]=(0,r.useState)(!1);return(0,r.useEffect)((()=>{const e=e=>{l.current&&!l.current.contains(e.target)&&d(!1)};return document.addEventListener("mousedown",e),document.addEventListener("touchstart",e),document.addEventListener("focusin",e),()=>{document.removeEventListener("mousedown",e),document.removeEventListener("touchstart",e),document.removeEventListener("focusin",e)}}),[l]),(0,u.jsxs)("div",{ref:l,className:(0,a.Z)("navbar__item","dropdown","dropdown--hoverable",{"dropdown--right":"right"===n,"dropdown--show":c}),children:[(0,u.jsx)(ne,{"aria-haspopup":"true","aria-expanded":c,role:"button",href:s.to?void 0:"#",className:(0,a.Z)("navbar__link",o),...s,onClick:s.to?void 0:e=>e.preventDefault(),onKeyDown:e=>{"Enter"===e.key&&(e.preventDefault(),d(!c))},children:s.children??s.label}),(0,u.jsx)("ul",{className:"dropdown__menu",children:t.map(((e,t)=>(0,r.createElement)(We,{isDropdownItem:!0,activeClassName:"dropdown__link--active",...e,key:t})))})]})}function pe(e){let{items:t,className:n,position:o,onClick:i,...l}=e;const c=function(){const{siteConfig:{baseUrl:e}}=(0,le.Z)(),{pathname:t}=(0,s.TH)();return t.replace(e,"/")}(),d=ue(t,c),{collapsed:p,toggleCollapsed:f,setCollapsed:h}=(0,ie.u)({initialState:()=>!d});return(0,r.useEffect)((()=>{d&&h(!d)}),[c,d,h]),(0,u.jsxs)("li",{className:(0,a.Z)("menu__list-item",{"menu__list-item--collapsed":p}),children:[(0,u.jsx)(ne,{role:"button",className:(0,a.Z)(ce.dropdownNavbarItemMobile,"menu__link menu__link--sublist menu__link--sublist-caret",n),...l,onClick:e=>{e.preventDefault(),f()},children:l.children??l.label}),(0,u.jsx)(ie.z,{lazy:!0,as:"ul",className:"menu__list",collapsed:p,children:t.map(((e,t)=>(0,r.createElement)(We,{mobile:!0,isDropdownItem:!0,onClick:i,activeClassName:"menu__link--active",...e,key:t})))})]})}function fe(e){let{mobile:t=!1,...n}=e;const r=t?pe:de;return(0,u.jsx)(r,{...n})}var he=n(4711);function me(e){let{width:t=20,height:n=20,...r}=e;return(0,u.jsx)("svg",{viewBox:"0 0 24 24",width:t,height:n,"aria-hidden":!0,...r,children:(0,u.jsx)("path",{fill:"currentColor",d:"M12.87 15.07l-2.54-2.51.03-.03c1.74-1.94 2.98-4.17 3.71-6.53H17V4h-7V2H8v2H1v1.99h11.17C11.5 7.92 10.44 9.75 9 11.35 8.07 10.32 7.3 9.19 6.69 8h-2c.73 1.63 1.73 3.17 2.98 4.56l-5.09 5.02L4 19l5-5 3.11 3.11.76-2.04zM18.5 10h-2L12 22h2l1.12-3h4.75L21 22h2l-4.5-12zm-2.62 7l1.62-4.33L19.12 17h-3.24z"})})}const ge="iconLanguage_nlXk";var ye=n(1029),be=n(1728);var ve=n(143),we=n(22),ke=n(8202),xe=n(3545),Se=n(3926),Ee=n(1073),_e=n(2539),Ce=n(726);const Te='',je='',Le='',Re='',Ne='',Pe='',Ae='',Oe={searchBar:"searchBar_RVTs",dropdownMenu:"dropdownMenu_qbY6",searchBarLeft:"searchBarLeft_MXDe",suggestion:"suggestion_fB_2",cursor:"cursor_eG29",hitTree:"hitTree_kk6K",hitIcon:"hitIcon_a7Zy",hitPath:"hitPath_ieM4",noResultsIcon:"noResultsIcon_EBY5",hitFooter:"hitFooter_E9YW",hitWrapper:"hitWrapper_sAK8",hitTitle:"hitTitle_vyVt",hitAction:"hitAction_NqkB",hideAction:"hideAction_vcyE",noResults:"noResults_l6Q3",searchBarContainer:"searchBarContainer_NW3z",searchBarLoadingRing:"searchBarLoadingRing_YnHq",searchClearButton:"searchClearButton_qk4g",searchIndexLoading:"searchIndexLoading_EJ1f",searchHintContainer:"searchHintContainer_Pkmr",searchHint:"searchHint_iIMx",focused:"focused_OWtg",input:"input_FOTf",hint:"hint_URu1",suggestions:"suggestions_X8XU",dataset:"dataset_QiCy",empty:"empty_eITn"};function Ie(e){let{document:t,type:n,page:r,metadata:a,tokens:o,isInterOfTree:i,isLastOfTree:s}=e;const l=n===xe.P.Title,c=n===xe.P.Keywords,u=l||c,d=n===xe.P.Heading,p=[];i?p.push(Pe):s&&p.push(Ae);const f=p.map((e=>`${e}`)),h=`${u?Te:d?je:Le}`,m=[`${c?(0,_e.C)(t.s,o):(0,Ce.o)(t.t,(0,Ee.m)(a,"t"),o)}`];if(!i&&!s&&ye.H6){const e=r?r.b?.concat(r.t).concat(t.s&&t.s!==r.t?t.s:[]):t.b;m.push(`${(0,Se.e)(e??[])}`)}else u||m.push(`${(0,_e.C)(r.t||(t.u.startsWith("/docs/api-reference/")?"API Reference":""),o)}`);const g=`${Re}`;return[...f,h,``,...m,"",g].join("")}function De(){return`${Ne}${(0,l.I)({id:"theme.SearchBar.noResultsText",message:"No results"})}`}var Fe=n(311),Me=n(51);async function ze(){const e=await Promise.all([n.e(8443),n.e(5525)]).then(n.t.bind(n,8443,23)),t=e.default;return t.noConflict?t.noConflict():e.noConflict&&e.noConflict(),t}const Be="_highlight";const $e=function(e){let{handleSearchBarToggle:t}=e;const a=(0,z.Z)(),{siteConfig:{baseUrl:o},i18n:{currentLocale:i}}=(0,le.Z)(),c=(0,ve.gA)();let d=o;try{const{preferredVersion:e}=function(){return n(143).J(...arguments)}(c?.pluginId??ye.gQ);e&&!e.isLast&&(d=e.path+"/")}catch(M){if(ye.l9&&!(M instanceof N.i6))throw M}const p=(0,s.k6)(),f=(0,s.TH)(),h=(0,r.useRef)(null),m=(0,r.useRef)(new Map),g=(0,r.useRef)(!1),[y,b]=(0,r.useState)(!1),[v,w]=(0,r.useState)(!1),[k,x]=(0,r.useState)(""),S=(0,r.useRef)(null),E=(0,r.useRef)(""),[_,C]=(0,r.useState)("");(0,r.useEffect)((()=>{if(!Array.isArray(ye.Kc))return;let e="";if(f.pathname.startsWith(d)){const t=f.pathname.substring(d.length);let n;for(const e of ye.Kc){const r="string"==typeof e?e:e.path;if(t===r||t.startsWith(`${r}/`)){n=r;break}}n&&(e=n)}E.current!==e&&(m.current.delete(e),E.current=e),C(e)}),[f.pathname,d]);const T=!!ye.hG&&Array.isArray(ye.Kc)&&""===_,j=(0,r.useCallback)((async()=>{if(T||m.current.get(_))return;m.current.set(_,"loading"),S.current?.autocomplete.destroy(),b(!0);const[{wrappedIndexes:e,zhDictionary:t},n]=await Promise.all([(0,we.w)(d,_),ze()]);if(S.current=n(h.current,{hint:!1,autoselect:!0,openOnFocus:!0,cssClasses:{root:(0,be.Z)(Oe.searchBar,{[Oe.searchBarLeft]:"left"===ye.pu}),noPrefix:!0,dropdownMenu:Oe.dropdownMenu,input:Oe.input,hint:Oe.hint,suggestions:Oe.suggestions,suggestion:Oe.suggestion,cursor:Oe.cursor,dataset:Oe.dataset,empty:Oe.empty}},[{source:(0,ke.v)(e,t,ye.qo),templates:{suggestion:Ie,empty:De,footer:e=>{let{query:t,isEmpty:n}=e;if(n&&(!_||!ye.pQ))return;const r=(e=>{let{query:t,isEmpty:n}=e;const r=document.createElement("a"),a=new URLSearchParams;let s;if(a.set("q",t),_){const e=_&&Array.isArray(ye.Kc)?ye.Kc.find((e=>"string"==typeof e?e===_:e.path===_)):_,t=e?(0,Me._)(e,i).label:_;s=ye.pQ&&n?(0,l.I)({id:"theme.SearchBar.seeAllOutsideContext",message:'See all results outside "{context}"'},{context:t}):(0,l.I)({id:"theme.SearchBar.searchInContext",message:'See all results within "{context}"'},{context:t})}else s=(0,l.I)({id:"theme.SearchBar.seeAll",message:"See all results"});if(!_||!Array.isArray(ye.Kc)||ye.pQ&&n||a.set("ctx",_),d!==o){if(!d.startsWith(o))throw new Error(`Version url '${d}' does not start with base url '${o}', this is a bug of \`@easyops-cn/docusaurus-search-local\`, please report it.`);a.set("version",d.substring(o.length))}const c=`${o}search/?${a.toString()}`;return r.href=c,r.textContent=s,r.addEventListener("click",(e=>{e.ctrlKey||e.metaKey||(e.preventDefault(),S.current?.autocomplete.close(),p.push(c))})),r})({query:t,isEmpty:n}),a=document.createElement("div");return a.className=Oe.hitFooter,a.appendChild(r),a}}}]).on("autocomplete:selected",(function(e,t){let{document:{u:n,h:r},tokens:a}=t;h.current?.blur();let o=n;if(ye.vc&&a.length>0){const e=new URLSearchParams;for(const t of a)e.append(Be,t);o+=`?${e.toString()}`}r&&(o+=r),p.push(o)})).on("autocomplete:closed",(()=>{h.current?.blur()})),m.current.set(_,"done"),b(!1),g.current){const e=h.current;e.value&&S.current?.autocomplete.open(),e.focus()}}),[T,_,d,o,p]);(0,r.useEffect)((()=>{if(!ye.vc)return;const e=a?new URLSearchParams(f.search).getAll(Be):[];setTimeout((()=>{const t=document.querySelector("article");if(!t)return;const n=new ye.vc(t);n.unmark(),0!==e.length&&n.mark(e),x(e.join(" ")),S.current?.autocomplete.setVal(e.join(" "))}))}),[a,f.search,f.pathname]);const[L,R]=(0,r.useState)(!1),P=(0,r.useCallback)((()=>{g.current=!0,j(),R(!0),t?.(!0)}),[t,j]),A=(0,r.useCallback)((()=>{R(!1),t?.(!1)}),[t]),O=(0,r.useCallback)((()=>{j()}),[j]),I=(0,r.useCallback)((e=>{x(e.target.value),e.target.value&&w(!0)}),[]),D=!!a&&/mac/i.test(navigator.userAgentData?.platform??navigator.platform);(0,r.useEffect)((()=>{if(!ye.AY)return;const e=e=>{!(D?e.metaKey:e.ctrlKey)||"k"!==e.key&&"K"!==e.key||(e.preventDefault(),h.current?.focus(),P())};return document.addEventListener("keydown",e),()=>{document.removeEventListener("keydown",e)}}),[D,P]);const F=(0,r.useCallback)((()=>{const e=new URLSearchParams(f.search);e.delete(Be);const t=e.toString(),n=f.pathname+(""!=t?`?${t}`:"")+f.hash;n!=f.pathname+f.search+f.hash&&p.push(n),x(""),S.current?.autocomplete.setVal("")}),[f.pathname,f.search,f.hash,p]);return(0,u.jsxs)("div",{className:(0,be.Z)("navbar__search",Oe.searchBarContainer,{[Oe.searchIndexLoading]:y&&v,[Oe.focused]:L}),hidden:T,dir:"ltr",children:[(0,u.jsx)("input",{placeholder:(0,l.I)({id:"theme.SearchBar.label",message:"Search",description:"The ARIA label and placeholder for search button"}),"aria-label":"Search",className:"navbar__search-input",onMouseEnter:O,onFocus:P,onBlur:A,onChange:I,ref:h,value:k}),(0,u.jsx)(Fe.Z,{className:Oe.searchBarLoadingRing}),ye.AY&&ye.t_&&(""!==k?(0,u.jsx)("button",{className:Oe.searchClearButton,onClick:F,children:"\u2715"}):a&&(0,u.jsxs)("div",{className:Oe.searchHintContainer,children:[(0,u.jsx)("kbd",{className:Oe.searchHint,children:D?"\u2318":"ctrl"}),(0,u.jsx)("kbd",{className:Oe.searchHint,children:"K"})]}))]})},Ue={navbarSearchContainer:"navbarSearchContainer_Bca1"};function qe(e){let{children:t,className:n}=e;return(0,u.jsx)("div",{className:(0,a.Z)(n,Ue.navbarSearchContainer),children:t})}var He=n(9690);var Qe=n(298);function Ze(e,t){return t.alternateDocVersions[e.name]??function(e){return e.docs.find((t=>t.id===e.mainDocId))}(e)}const Ve={default:oe,localeDropdown:function(e){let{mobile:t,dropdownItemsBefore:n,dropdownItemsAfter:r,queryString:a="",...o}=e;const{i18n:{currentLocale:i,locales:c,localeConfigs:d}}=(0,le.Z)(),p=(0,he.l)(),{search:f,hash:h}=(0,s.TH)(),m=[...n,...c.map((e=>{const n=`${`pathname://${p.createUrl({locale:e,fullyQualified:!1})}`}${f}${h}${a}`;return{label:d[e].label,lang:d[e].htmlLang,to:n,target:"_self",autoAddBaseUrl:!1,className:e===i?t?"menu__link--active":"dropdown__link--active":""}})),...r],g=t?(0,l.I)({message:"Languages",id:"theme.navbar.mobileLanguageDropdown.label",description:"The label for the mobile language switcher dropdown"}):d[i].label;return(0,u.jsx)(fe,{...o,mobile:t,label:(0,u.jsxs)(u.Fragment,{children:[(0,u.jsx)(me,{className:ge}),g]}),items:m})},search:function(e){let{mobile:t,className:n}=e;return t?null:(0,u.jsx)(qe,{className:n,children:(0,u.jsx)($e,{})})},dropdown:fe,html:function(e){let{value:t,className:n,mobile:r=!1,isDropdownItem:o=!1}=e;const i=o?"li":"div";return(0,u.jsx)(i,{className:(0,a.Z)({navbar__item:!r&&!o,"menu__list-item":r},n),dangerouslySetInnerHTML:{__html:t}})},doc:function(e){let{docId:t,label:n,docsPluginId:r,...a}=e;const{activeDoc:o}=(0,ve.Iw)(r),i=(0,He.vY)(t,r),s=o?.path===i?.path;return null===i||i.unlisted&&!s?null:(0,u.jsx)(oe,{exact:!0,...a,isActive:()=>s||!!o?.sidebar&&o.sidebar===i.sidebar,label:n??i.id,to:i.path})},docSidebar:function(e){let{sidebarId:t,label:n,docsPluginId:r,...a}=e;const{activeDoc:o}=(0,ve.Iw)(r),i=(0,He.oz)(t,r).link;if(!i)throw new Error(`DocSidebarNavbarItem: Sidebar with ID "${t}" doesn't have anything to be linked to.`);return(0,u.jsx)(oe,{exact:!0,...a,isActive:()=>o?.sidebar===t,label:n??i.label,to:i.path})},docsVersion:function(e){let{label:t,to:n,docsPluginId:r,...a}=e;const o=(0,He.lO)(r)[0],i=t??o.label,s=n??(e=>e.docs.find((t=>t.id===e.mainDocId)))(o).path;return(0,u.jsx)(oe,{...a,label:i,to:s})},docsVersionDropdown:function(e){let{mobile:t,docsPluginId:n,dropdownActiveClassDisabled:r,dropdownItemsBefore:a,dropdownItemsAfter:o,...i}=e;const{search:c,hash:d}=(0,s.TH)(),p=(0,ve.Iw)(n),f=(0,ve.gB)(n),{savePreferredVersionName:h}=(0,Qe.J)(n),m=[...a,...f.map((function(e){const t=Ze(e,p);return{label:e.label,to:`${t.path}${c}${d}`,isActive:()=>e===p.activeVersion,onClick:()=>h(e.name)}})),...o],g=(0,He.lO)(n)[0],y=t&&m.length>1?(0,l.I)({id:"theme.navbar.mobileVersionsDropdown.label",message:"Versions",description:"The label for the navbar versions dropdown on mobile view"}):g.label,b=t&&m.length>1?void 0:Ze(g,p).path;return m.length<=1?(0,u.jsx)(oe,{...i,mobile:t,label:y,to:b,isActive:r?()=>!1:void 0}):(0,u.jsx)(fe,{...i,mobile:t,label:y,to:b,items:m,isActive:r?()=>!1:void 0})}};function We(e){let{type:t,...n}=e;const r=function(e,t){return e&&"default"!==e?e:"items"in t?"dropdown":"default"}(t,n),a=Ve[r];if(!a)throw new Error(`No NavbarItem component found for type "${t}".`);return(0,u.jsx)(a,{...n})}function Ge(){const e=(0,L.e)(),t=(0,w.L)().navbar.items;return(0,u.jsx)("ul",{className:"menu__list",children:t.map(((t,n)=>(0,r.createElement)(We,{mobile:!0,...t,onClick:()=>e.toggle(),key:n})))})}function Xe(e){return(0,u.jsx)("button",{...e,type:"button",className:"clean-btn navbar-sidebar__back",children:(0,u.jsx)(l.Z,{id:"theme.navbar.mobileSidebarSecondaryMenu.backButtonLabel",description:"The label of the back button to return to main menu, inside the mobile navbar sidebar secondary menu (notably used to display the docs sidebar)",children:"\u2190 Back to main menu"})})}function Ke(){const e=0===(0,w.L)().navbar.items.length,t=D();return(0,u.jsxs)(u.Fragment,{children:[!e&&(0,u.jsx)(Xe,{onClick:()=>t.hide()}),t.content]})}function Ye(){const e=(0,L.e)();var t;return void 0===(t=e.shown)&&(t=!0),(0,r.useEffect)((()=>(document.body.style.overflow=t?"hidden":"visible",()=>{document.body.style.overflow="visible"})),[t]),e.shouldRender?(0,u.jsx)(F,{header:(0,u.jsx)(X,{}),primaryMenu:(0,u.jsx)(Ge,{}),secondaryMenu:(0,u.jsx)(Ke,{})}):null}const Je={navbarHideable:"navbarHideable_m1mJ",navbarHidden:"navbarHidden_jGov"};function et(e){return(0,u.jsx)("div",{role:"presentation",...e,className:(0,a.Z)("navbar-sidebar__backdrop",e.className)})}function tt(e){let{children:t}=e;const{navbar:{hideOnScroll:n,style:o}}=(0,w.L)(),i=(0,L.e)(),{navbarRef:s,isNavbarVisible:d}=function(e){const[t,n]=(0,r.useState)(e),a=(0,r.useRef)(!1),o=(0,r.useRef)(0),i=(0,r.useCallback)((e=>{null!==e&&(o.current=e.getBoundingClientRect().height)}),[]);return(0,R.RF)(((t,r)=>{let{scrollY:i}=t;if(!e)return;if(i=s?n(!1):i+c{if(!e)return;const r=t.location.hash;if(r?document.getElementById(r.substring(1)):void 0)return a.current=!0,void n(!1);n(!0)})),{navbarRef:i,isNavbarVisible:t}}(n);return(0,u.jsxs)("nav",{ref:s,"aria-label":(0,l.I)({id:"theme.NavBar.navAriaLabel",message:"Main",description:"The ARIA label for the main navigation"}),className:(0,a.Z)("navbar","navbar--fixed-top",n&&[Je.navbarHideable,!d&&Je.navbarHidden],{"navbar--dark":"dark"===o,"navbar--primary":"primary"===o,"navbar-sidebar--show":i.shown}),children:[t,(0,u.jsx)(et,{onClick:i.toggle}),(0,u.jsx)(Ye,{})]})}var nt=n(3087);const rt="right";function at(e){let{width:t=30,height:n=30,className:r,...a}=e;return(0,u.jsx)("svg",{className:r,width:t,height:n,viewBox:"0 0 30 30","aria-hidden":"true",...a,children:(0,u.jsx)("path",{stroke:"currentColor",strokeLinecap:"round",strokeMiterlimit:"10",strokeWidth:"2",d:"M4 7h22M4 15h22M4 23h22"})})}function ot(){const{toggle:e,shown:t}=(0,L.e)();return(0,u.jsx)("button",{onClick:e,"aria-label":(0,l.I)({id:"theme.docs.sidebar.toggleSidebarButtonAriaLabel",message:"Toggle navigation bar",description:"The ARIA label for hamburger menu button of mobile navigation"}),"aria-expanded":t,className:"navbar__toggle clean-btn",type:"button",children:(0,u.jsx)(at,{})})}const it={colorModeToggle:"colorModeToggle_DEke"};function st(e){let{items:t}=e;return(0,u.jsx)(u.Fragment,{children:t.map(((e,t)=>(0,u.jsx)(nt.QW,{onError:t=>new Error(`A theme navbar item failed to render.\nPlease double-check the following navbar item (themeConfig.navbar.items) of your Docusaurus config:\n${JSON.stringify(e,null,2)}`,{cause:t}),children:(0,u.jsx)(We,{...e})},t)))})}function lt(e){let{left:t,right:n}=e;return(0,u.jsxs)("div",{className:"navbar__inner",children:[(0,u.jsx)("div",{className:"navbar__items",children:t}),(0,u.jsx)("div",{className:"navbar__items navbar__items--right",children:n})]})}function ct(){const e=(0,L.e)(),t=(0,w.L)().navbar.items,[n,r]=function(e){function t(e){return"left"===(e.position??rt)}return[e.filter(t),e.filter((e=>!t(e)))]}(t),a=t.find((e=>"search"===e.type));return(0,u.jsx)(lt,{left:(0,u.jsxs)(u.Fragment,{children:[!e.disabled&&(0,u.jsx)(ot,{}),(0,u.jsx)(W,{}),(0,u.jsx)(st,{items:n})]}),right:(0,u.jsxs)(u.Fragment,{children:[(0,u.jsx)(st,{items:r}),(0,u.jsx)(Z,{className:it.colorModeToggle}),!a&&(0,u.jsx)(qe,{children:(0,u.jsx)($e,{})})]})})}function ut(){return(0,u.jsx)(tt,{children:(0,u.jsx)(ct,{})})}function dt(e){let{item:t}=e;const{to:n,href:r,label:a,prependBaseUrlToHref:o,...i}=t,s=(0,Y.ZP)(n),l=(0,Y.ZP)(r,{forcePrependBaseUrl:!0});return(0,u.jsxs)(K.Z,{className:"footer__link-item",...r?{href:o?l:r}:{to:s},...i,children:[a,r&&!(0,J.Z)(r)&&(0,u.jsx)(te.Z,{})]})}function pt(e){let{item:t}=e;return t.html?(0,u.jsx)("li",{className:"footer__item",dangerouslySetInnerHTML:{__html:t.html}}):(0,u.jsx)("li",{className:"footer__item",children:(0,u.jsx)(dt,{item:t})},t.href??t.to)}function ft(e){let{column:t}=e;return(0,u.jsxs)("div",{className:"col footer__col",children:[(0,u.jsx)("div",{className:"footer__title",children:t.title}),(0,u.jsx)("ul",{className:"footer__items clean-list",children:t.items.map(((e,t)=>(0,u.jsx)(pt,{item:e},t)))})]})}function ht(e){let{columns:t}=e;return(0,u.jsx)("div",{className:"row footer__links",children:t.map(((e,t)=>(0,u.jsx)(ft,{column:e},t)))})}function mt(){return(0,u.jsx)("span",{className:"footer__link-separator",children:"\xb7"})}function gt(e){let{item:t}=e;return t.html?(0,u.jsx)("span",{className:"footer__link-item",dangerouslySetInnerHTML:{__html:t.html}}):(0,u.jsx)(dt,{item:t})}function yt(e){let{links:t}=e;return(0,u.jsx)("div",{className:"footer__links text--center",children:(0,u.jsx)("div",{className:"footer__links",children:t.map(((e,n)=>(0,u.jsxs)(r.Fragment,{children:[(0,u.jsx)(gt,{item:e}),t.length!==n+1&&(0,u.jsx)(mt,{})]},n)))})})}function bt(e){let{links:t}=e;return function(e){return"title"in e[0]}(t)?(0,u.jsx)(ht,{columns:t}):(0,u.jsx)(yt,{links:t})}var vt=n(9965);const wt={footerLogoLink:"footerLogoLink_BH7S"};function kt(e){let{logo:t}=e;const{withBaseUrl:n}=(0,Y.Cg)(),r={light:n(t.src),dark:n(t.srcDark??t.src)};return(0,u.jsx)(vt.Z,{className:(0,a.Z)("footer__logo",t.className),alt:t.alt,sources:r,width:t.width,height:t.height,style:t.style})}function xt(e){let{logo:t}=e;return t.href?(0,u.jsx)(K.Z,{href:t.href,className:wt.footerLogoLink,target:t.target,children:(0,u.jsx)(kt,{logo:t})}):(0,u.jsx)(kt,{logo:t})}function St(e){let{copyright:t}=e;return(0,u.jsx)("div",{className:"footer__copyright",dangerouslySetInnerHTML:{__html:t}})}function Et(e){let{style:t,links:n,logo:r,copyright:o}=e;return(0,u.jsx)("footer",{className:(0,a.Z)("footer",{"footer--dark":"dark"===t}),children:(0,u.jsxs)("div",{className:"container container-fluid",children:[n,(r||o)&&(0,u.jsxs)("div",{className:"footer__bottom text--center",children:[r&&(0,u.jsx)("div",{className:"margin-bottom--sm",children:r}),o]})]})})}function _t(){const{footer:e}=(0,w.L)();if(!e)return null;const{copyright:t,links:n,logo:r,style:a}=e;return(0,u.jsx)(Et,{style:a,links:n&&n.length>0&&(0,u.jsx)(bt,{links:n}),logo:r&&(0,u.jsx)(xt,{logo:r}),copyright:t&&(0,u.jsx)(St,{copyright:t})})}const Ct=r.memo(_t),Tt=(0,N.Qc)([M.S,k.p,R.OC,Qe.L5,i.VC,function(e){let{children:t}=e;return(0,u.jsx)(P.n2,{children:(0,u.jsx)(L.M,{children:(0,u.jsx)(O,{children:t})})})}]);function jt(e){let{children:t}=e;return(0,u.jsx)(Tt,{children:t})}var Lt=n(2503);function Rt(e){let{error:t,tryAgain:n}=e;return(0,u.jsx)("main",{className:"container margin-vert--xl",children:(0,u.jsx)("div",{className:"row",children:(0,u.jsxs)("div",{className:"col col--6 col--offset-3",children:[(0,u.jsx)(Lt.Z,{as:"h1",className:"hero__title",children:(0,u.jsx)(l.Z,{id:"theme.ErrorPageContent.title",description:"The title of the fallback page when the page crashed",children:"This page crashed."})}),(0,u.jsx)("div",{className:"margin-vert--lg",children:(0,u.jsx)(nt.Cw,{onClick:n,className:"button button--primary shadow--lw"})}),(0,u.jsx)("hr",{}),(0,u.jsx)("div",{className:"margin-vert--md",children:(0,u.jsx)(nt.aG,{error:t})})]})})})}const Nt={mainWrapper:"mainWrapper_z2l0"};function Pt(e){const{children:t,noFooter:n,wrapperClassName:r,title:s,description:l}=e;return(0,y.t)(),(0,u.jsxs)(jt,{children:[(0,u.jsx)(i.d,{title:s,description:l}),(0,u.jsx)(v,{}),(0,u.jsx)(j,{}),(0,u.jsx)(ut,{}),(0,u.jsx)("div",{id:d,className:(0,a.Z)(g.k.wrapper.main,Nt.mainWrapper,r),children:(0,u.jsx)(o.Z,{fallback:e=>(0,u.jsx)(Rt,{...e}),children:t})}),!n&&(0,u.jsx)(Ct,{})]})}},1327:(e,t,n)=>{"use strict";n.d(t,{Z:()=>u});n(7294);var r=n(3692),a=n(4996),o=n(2263),i=n(6668),s=n(9965),l=n(5893);function c(e){let{logo:t,alt:n,imageClassName:r}=e;const o={light:(0,a.ZP)(t.src),dark:(0,a.ZP)(t.srcDark||t.src)},i=(0,l.jsx)(s.Z,{className:t.className,sources:o,height:t.height,width:t.width,alt:n,style:t.style});return r?(0,l.jsx)("div",{className:r,children:i}):i}function u(e){const{siteConfig:{title:t}}=(0,o.Z)(),{navbar:{title:n,logo:s}}=(0,i.L)(),{imageClassName:u,titleClassName:d,...p}=e,f=(0,a.ZP)(s?.href||"/"),h=n?"":t,m=s?.alt??h;return(0,l.jsxs)(r.Z,{to:f,...p,...s?.target&&{target:s.target},children:[s&&(0,l.jsx)(c,{logo:s,alt:m,imageClassName:u}),null!=n&&(0,l.jsx)("b",{className:d,children:n})]})}},197:(e,t,n)=>{"use strict";n.d(t,{Z:()=>o});n(7294);var r=n(5742),a=n(5893);function o(e){let{locale:t,version:n,tag:o}=e;const i=t;return(0,a.jsxs)(r.Z,{children:[t&&(0,a.jsx)("meta",{name:"docusaurus_locale",content:t}),n&&(0,a.jsx)("meta",{name:"docusaurus_version",content:n}),o&&(0,a.jsx)("meta",{name:"docusaurus_tag",content:o}),i&&(0,a.jsx)("meta",{name:"docsearch:language",content:i}),n&&(0,a.jsx)("meta",{name:"docsearch:version",content:n}),o&&(0,a.jsx)("meta",{name:"docsearch:docusaurus_tag",content:o})]})}},9965:(e,t,n)=>{"use strict";n.d(t,{Z:()=>u});var r=n(7294),a=n(512),o=n(2389),i=n(2949);const s={themedComponent:"themedComponent_mlkZ","themedComponent--light":"themedComponent--light_NVdE","themedComponent--dark":"themedComponent--dark_xIcU"};var l=n(5893);function c(e){let{className:t,children:n}=e;const c=(0,o.Z)(),{colorMode:u}=(0,i.I)();return(0,l.jsx)(l.Fragment,{children:(c?"dark"===u?["dark"]:["light"]:["light","dark"]).map((e=>{const o=n({theme:e,className:(0,a.Z)(t,s.themedComponent,s[`themedComponent--${e}`])});return(0,l.jsx)(r.Fragment,{children:o},e)}))})}function u(e){const{sources:t,className:n,alt:r,...a}=e;return(0,l.jsx)(c,{className:n,children:e=>{let{theme:n,className:o}=e;return(0,l.jsx)("img",{src:t[n],alt:r,className:o,...a})}})}},6043:(e,t,n)=>{"use strict";n.d(t,{u:()=>c,z:()=>y});var r=n(7294),a=n(412),o=n(469),i=n(1442),s=n(5893);const l="ease-in-out";function c(e){let{initialState:t}=e;const[n,a]=(0,r.useState)(t??!1),o=(0,r.useCallback)((()=>{a((e=>!e))}),[]);return{collapsed:n,setCollapsed:a,toggleCollapsed:o}}const u={display:"none",overflow:"hidden",height:"0px"},d={display:"block",overflow:"visible",height:"auto"};function p(e,t){const n=t?u:d;e.style.display=n.display,e.style.overflow=n.overflow,e.style.height=n.height}function f(e){let{collapsibleRef:t,collapsed:n,animation:a}=e;const o=(0,r.useRef)(!1);(0,r.useEffect)((()=>{const e=t.current;function r(){const t=e.scrollHeight,n=a?.duration??function(e){if((0,i.n)())return 1;const t=e/36;return Math.round(10*(4+15*t**.25+t/5))}(t);return{transition:`height ${n}ms ${a?.easing??l}`,height:`${t}px`}}function s(){const t=r();e.style.transition=t.transition,e.style.height=t.height}if(!o.current)return p(e,n),void(o.current=!0);return e.style.willChange="height",function(){const t=requestAnimationFrame((()=>{n?(s(),requestAnimationFrame((()=>{e.style.height=u.height,e.style.overflow=u.overflow}))):(e.style.display="block",requestAnimationFrame((()=>{s()})))}));return()=>cancelAnimationFrame(t)}()}),[t,n,a])}function h(e){if(!a.Z.canUseDOM)return e?u:d}function m(e){let{as:t="div",collapsed:n,children:a,animation:o,onCollapseTransitionEnd:i,className:l,disableSSRStyle:c}=e;const u=(0,r.useRef)(null);return f({collapsibleRef:u,collapsed:n,animation:o}),(0,s.jsx)(t,{ref:u,style:c?void 0:h(n),onTransitionEnd:e=>{"height"===e.propertyName&&(p(u.current,n),i?.(n))},className:l,children:a})}function g(e){let{collapsed:t,...n}=e;const[a,i]=(0,r.useState)(!t),[l,c]=(0,r.useState)(t);return(0,o.Z)((()=>{t||i(!0)}),[t]),(0,o.Z)((()=>{a&&c(t)}),[a,t]),a?(0,s.jsx)(m,{...n,collapsed:l}):null}function y(e){let{lazy:t,...n}=e;const r=t?g:m;return(0,s.jsx)(r,{...n})}},9689:(e,t,n)=>{"use strict";n.d(t,{n:()=>m,p:()=>h});var r=n(7294),a=n(2389),o=n(812),i=n(902),s=n(6668),l=n(5893);const c=(0,o.WA)("docusaurus.announcement.dismiss"),u=(0,o.WA)("docusaurus.announcement.id"),d=()=>"true"===c.get(),p=e=>c.set(String(e)),f=r.createContext(null);function h(e){let{children:t}=e;const n=function(){const{announcementBar:e}=(0,s.L)(),t=(0,a.Z)(),[n,o]=(0,r.useState)((()=>!!t&&d()));(0,r.useEffect)((()=>{o(d())}),[]);const i=(0,r.useCallback)((()=>{p(!0),o(!0)}),[]);return(0,r.useEffect)((()=>{if(!e)return;const{id:t}=e;let n=u.get();"annoucement-bar"===n&&(n="announcement-bar");const r=t!==n;u.set(t),r&&p(!1),!r&&d()||o(!1)}),[e]),(0,r.useMemo)((()=>({isActive:!!e&&!n,close:i})),[e,n,i])}();return(0,l.jsx)(f.Provider,{value:n,children:t})}function m(){const e=(0,r.useContext)(f);if(!e)throw new i.i6("AnnouncementBarProvider");return e}},2949:(e,t,n)=>{"use strict";n.d(t,{I:()=>y,S:()=>g});var r=n(7294),a=n(412),o=n(902),i=n(812),s=n(6668),l=n(5893);const c=r.createContext(void 0),u="theme",d=(0,i.WA)(u),p={light:"light",dark:"dark"},f=e=>e===p.dark?p.dark:p.light,h=e=>a.Z.canUseDOM?f(document.documentElement.getAttribute("data-theme")):f(e),m=e=>{d.set(f(e))};function g(e){let{children:t}=e;const n=function(){const{colorMode:{defaultMode:e,disableSwitch:t,respectPrefersColorScheme:n}}=(0,s.L)(),[a,o]=(0,r.useState)(h(e));(0,r.useEffect)((()=>{t&&d.del()}),[t]);const i=(0,r.useCallback)((function(t,r){void 0===r&&(r={});const{persist:a=!0}=r;t?(o(t),a&&m(t)):(o(n?window.matchMedia("(prefers-color-scheme: dark)").matches?p.dark:p.light:e),d.del())}),[n,e]);(0,r.useEffect)((()=>{document.documentElement.setAttribute("data-theme",f(a))}),[a]),(0,r.useEffect)((()=>{if(t)return;const e=e=>{if(e.key!==u)return;const t=d.get();null!==t&&i(f(t))};return window.addEventListener("storage",e),()=>window.removeEventListener("storage",e)}),[t,i]);const l=(0,r.useRef)(!1);return(0,r.useEffect)((()=>{if(t&&!n)return;const e=window.matchMedia("(prefers-color-scheme: dark)"),r=()=>{window.matchMedia("print").matches||l.current?l.current=window.matchMedia("print").matches:i(null)};return e.addListener(r),()=>e.removeListener(r)}),[i,t,n]),(0,r.useMemo)((()=>({colorMode:a,setColorMode:i,get isDarkTheme(){return a===p.dark},setLightTheme(){i(p.light)},setDarkTheme(){i(p.dark)}})),[a,i])}();return(0,l.jsx)(c.Provider,{value:n,children:t})}function y(){const e=(0,r.useContext)(c);if(null==e)throw new o.i6("ColorModeProvider","Please see https://docusaurus.io/docs/api/themes/configuration#use-color-mode.");return e}},3163:(e,t,n)=>{"use strict";n.d(t,{M:()=>p,e:()=>f});var r=n(7294),a=n(3102),o=n(7524),i=n(1980),s=n(6668),l=n(902),c=n(5893);const u=r.createContext(void 0);function d(){const e=function(){const e=(0,a.HY)(),{items:t}=(0,s.L)().navbar;return 0===t.length&&!e.component}(),t=(0,o.i)(),n=!e&&"mobile"===t,[l,c]=(0,r.useState)(!1);(0,i.Rb)((()=>{if(l)return c(!1),!1}));const u=(0,r.useCallback)((()=>{c((e=>!e))}),[]);return(0,r.useEffect)((()=>{"desktop"===t&&c(!1)}),[t]),(0,r.useMemo)((()=>({disabled:e,shouldRender:n,toggle:u,shown:l})),[e,n,u,l])}function p(e){let{children:t}=e;const n=d();return(0,c.jsx)(u.Provider,{value:n,children:t})}function f(){const e=r.useContext(u);if(void 0===e)throw new l.i6("NavbarMobileSidebarProvider");return e}},3102:(e,t,n)=>{"use strict";n.d(t,{HY:()=>l,Zo:()=>c,n2:()=>s});var r=n(7294),a=n(902),o=n(5893);const i=r.createContext(null);function s(e){let{children:t}=e;const n=(0,r.useState)({component:null,props:null});return(0,o.jsx)(i.Provider,{value:n,children:t})}function l(){const e=(0,r.useContext)(i);if(!e)throw new a.i6("NavbarSecondaryMenuContentProvider");return e[0]}function c(e){let{component:t,props:n}=e;const o=(0,r.useContext)(i);if(!o)throw new a.i6("NavbarSecondaryMenuContentProvider");const[,s]=o,l=(0,a.Ql)(n);return(0,r.useEffect)((()=>{s({component:t,props:l})}),[s,t,l]),(0,r.useEffect)((()=>()=>s({component:null,props:null})),[s]),null}},9727:(e,t,n)=>{"use strict";n.d(t,{h:()=>a,t:()=>o});var r=n(7294);const a="navigation-with-keyboard";function o(){(0,r.useEffect)((()=>{function e(e){"keydown"===e.type&&"Tab"===e.key&&document.body.classList.add(a),"mousedown"===e.type&&document.body.classList.remove(a)}return document.addEventListener("keydown",e),document.addEventListener("mousedown",e),()=>{document.body.classList.remove(a),document.removeEventListener("keydown",e),document.removeEventListener("mousedown",e)}}),[])}},7524:(e,t,n)=>{"use strict";n.d(t,{i:()=>s});var r=n(7294),a=n(412);const o={desktop:"desktop",mobile:"mobile",ssr:"ssr"},i=996;function s(e){let{desktopBreakpoint:t=i}=void 0===e?{}:e;const[n,s]=(0,r.useState)((()=>"ssr"));return(0,r.useEffect)((()=>{function e(){s(function(e){if(!a.Z.canUseDOM)throw new Error("getWindowSize() should only be called after React hydration");return window.innerWidth>e?o.desktop:o.mobile}(t))}return e(),window.addEventListener("resize",e),()=>{window.removeEventListener("resize",e)}}),[t]),n}},5281:(e,t,n)=>{"use strict";n.d(t,{k:()=>r});const r={page:{blogListPage:"blog-list-page",blogPostPage:"blog-post-page",blogTagsListPage:"blog-tags-list-page",blogTagPostListPage:"blog-tags-post-list-page",blogAuthorsListPage:"blog-authors-list-page",blogAuthorsPostsPage:"blog-authors-posts-page",docsDocPage:"docs-doc-page",docsTagsListPage:"docs-tags-list-page",docsTagDocListPage:"docs-tags-doc-list-page",mdxPage:"mdx-page"},wrapper:{main:"main-wrapper",blogPages:"blog-wrapper",docsPages:"docs-wrapper",mdxPages:"mdx-wrapper"},common:{editThisPage:"theme-edit-this-page",lastUpdated:"theme-last-updated",backToTopButton:"theme-back-to-top-button",codeBlock:"theme-code-block",admonition:"theme-admonition",unlistedBanner:"theme-unlisted-banner",draftBanner:"theme-draft-banner",admonitionType:e=>`theme-admonition-${e}`},layout:{},docs:{docVersionBanner:"theme-doc-version-banner",docVersionBadge:"theme-doc-version-badge",docBreadcrumbs:"theme-doc-breadcrumbs",docMarkdown:"theme-doc-markdown",docTocMobile:"theme-doc-toc-mobile",docTocDesktop:"theme-doc-toc-desktop",docFooter:"theme-doc-footer",docFooterTagsRow:"theme-doc-footer-tags-row",docFooterEditMetaRow:"theme-doc-footer-edit-meta-row",docSidebarContainer:"theme-doc-sidebar-container",docSidebarMenu:"theme-doc-sidebar-menu",docSidebarItemCategory:"theme-doc-sidebar-item-category",docSidebarItemLink:"theme-doc-sidebar-item-link",docSidebarItemCategoryLevel:e=>`theme-doc-sidebar-item-category-level-${e}`,docSidebarItemLinkLevel:e=>`theme-doc-sidebar-item-link-level-${e}`},blog:{blogFooterTagsRow:"theme-blog-footer-tags-row",blogFooterEditMetaRow:"theme-blog-footer-edit-meta-row"},pages:{pageFooterEditMetaRow:"theme-pages-footer-edit-meta-row"}}},1442:(e,t,n)=>{"use strict";function r(){return window.matchMedia("(prefers-reduced-motion: reduce)").matches}n.d(t,{n:()=>r})},3087:(e,t,n)=>{"use strict";n.d(t,{aG:()=>u,Ac:()=>c,Cw:()=>l,QW:()=>d});var r=n(7294),a=n(5999),o=n(8780);const i={errorBoundaryError:"errorBoundaryError_a6uf",errorBoundaryFallback:"errorBoundaryFallback_VBag"};var s=n(5893);function l(e){return(0,s.jsx)("button",{type:"button",...e,children:(0,s.jsx)(a.Z,{id:"theme.ErrorPageContent.tryAgain",description:"The label of the button to try again rendering when the React error boundary captures an error",children:"Try again"})})}function c(e){let{error:t,tryAgain:n}=e;return(0,s.jsxs)("div",{className:i.errorBoundaryFallback,children:[(0,s.jsx)("p",{children:t.message}),(0,s.jsx)(l,{onClick:n})]})}function u(e){let{error:t}=e;const n=(0,o.BN)(t).map((e=>e.message)).join("\n\nCause:\n");return(0,s.jsx)("p",{className:i.errorBoundaryError,children:n})}class d extends r.Component{componentDidCatch(e,t){throw this.props.onError(e,t)}render(){return this.props.children}}},1980:(e,t,n)=>{"use strict";n.d(t,{Rb:()=>i,_X:()=>l});var r=n(7294),a=n(6550),o=n(902);function i(e){!function(e){const t=(0,a.k6)(),n=(0,o.zX)(e);(0,r.useEffect)((()=>t.block(((e,t)=>n(e,t)))),[t,n])}(((t,n)=>{if("POP"===n)return e(t,n)}))}function s(e){const t=(0,a.k6)();return(0,r.useSyncExternalStore)(t.listen,(()=>e(t)),(()=>e(t)))}function l(e){return s((t=>null===e?null:new URLSearchParams(t.location.search).get(e)))}},7392:(e,t,n)=>{"use strict";function r(e,t){return void 0===t&&(t=(e,t)=>e===t),e.filter(((n,r)=>e.findIndex((e=>t(e,n)))!==r))}function a(e){return Array.from(new Set(e))}n.d(t,{jj:()=>a,lx:()=>r})},1944:(e,t,n)=>{"use strict";n.d(t,{FG:()=>f,d:()=>d,VC:()=>h});var r=n(7294),a=n(512),o=n(5742),i=n(226);function s(){const e=r.useContext(i._);if(!e)throw new Error("Unexpected: no Docusaurus route context found");return e}var l=n(4996),c=n(2263);var u=n(5893);function d(e){let{title:t,description:n,keywords:r,image:a,children:i}=e;const s=function(e){const{siteConfig:t}=(0,c.Z)(),{title:n,titleDelimiter:r}=t;return e?.trim().length?`${e.trim()} ${r} ${n}`:n}(t),{withBaseUrl:d}=(0,l.Cg)(),p=a?d(a,{absolute:!0}):void 0;return(0,u.jsxs)(o.Z,{children:[t&&(0,u.jsx)("title",{children:s}),t&&(0,u.jsx)("meta",{property:"og:title",content:s}),n&&(0,u.jsx)("meta",{name:"description",content:n}),n&&(0,u.jsx)("meta",{property:"og:description",content:n}),r&&(0,u.jsx)("meta",{name:"keywords",content:Array.isArray(r)?r.join(","):r}),p&&(0,u.jsx)("meta",{property:"og:image",content:p}),p&&(0,u.jsx)("meta",{name:"twitter:image",content:p}),i]})}const p=r.createContext(void 0);function f(e){let{className:t,children:n}=e;const i=r.useContext(p),s=(0,a.Z)(i,t);return(0,u.jsxs)(p.Provider,{value:s,children:[(0,u.jsx)(o.Z,{children:(0,u.jsx)("html",{className:s})}),n]})}function h(e){let{children:t}=e;const n=s(),r=`plugin-${n.plugin.name.replace(/docusaurus-(?:plugin|theme)-(?:content-)?/gi,"")}`;const o=`plugin-id-${n.plugin.id}`;return(0,u.jsx)(f,{className:(0,a.Z)(r,o),children:t})}},902:(e,t,n)=>{"use strict";n.d(t,{D9:()=>s,Qc:()=>u,Ql:()=>c,i6:()=>l,zX:()=>i});var r=n(7294),a=n(469),o=n(5893);function i(e){const t=(0,r.useRef)(e);return(0,a.Z)((()=>{t.current=e}),[e]),(0,r.useCallback)((function(){return t.current(...arguments)}),[])}function s(e){const t=(0,r.useRef)();return(0,a.Z)((()=>{t.current=e})),t.current}class l extends Error{constructor(e,t){super(),this.name="ReactContextError",this.message=`Hook ${this.stack?.split("\n")[1]?.match(/at (?:\w+\.)?(?\w+)/)?.groups.name??""} is called outside the <${e}>. ${t??""}`}}function c(e){const t=Object.entries(e);return t.sort(((e,t)=>e[0].localeCompare(t[0]))),(0,r.useMemo)((()=>e),t.flat())}function u(e){return t=>{let{children:n}=t;return(0,o.jsx)(o.Fragment,{children:e.reduceRight(((e,t)=>(0,o.jsx)(t,{children:e})),n)})}}},8596:(e,t,n)=>{"use strict";n.d(t,{Mg:()=>i,Ns:()=>s});var r=n(7294),a=n(723),o=n(2263);function i(e,t){const n=e=>(!e||e.endsWith("/")?e:`${e}/`)?.toLowerCase();return n(e)===n(t)}function s(){const{baseUrl:e}=(0,o.Z)().siteConfig;return(0,r.useMemo)((()=>function(e){let{baseUrl:t,routes:n}=e;function r(e){return e.path===t&&!0===e.exact}function a(e){return e.path===t&&!e.exact}return function e(t){if(0===t.length)return;return t.find(r)||e(t.filter(a).flatMap((e=>e.routes??[])))}(n)}({routes:a.Z,baseUrl:e})),[e])}},2466:(e,t,n)=>{"use strict";n.d(t,{Ct:()=>m,OC:()=>u,RF:()=>f,o5:()=>h});var r=n(7294),a=n(412),o=n(2389),i=n(469),s=n(902),l=n(5893);const c=r.createContext(void 0);function u(e){let{children:t}=e;const n=function(){const e=(0,r.useRef)(!0);return(0,r.useMemo)((()=>({scrollEventsEnabledRef:e,enableScrollEvents:()=>{e.current=!0},disableScrollEvents:()=>{e.current=!1}})),[])}();return(0,l.jsx)(c.Provider,{value:n,children:t})}function d(){const e=(0,r.useContext)(c);if(null==e)throw new s.i6("ScrollControllerProvider");return e}const p=()=>a.Z.canUseDOM?{scrollX:window.pageXOffset,scrollY:window.pageYOffset}:null;function f(e,t){void 0===t&&(t=[]);const{scrollEventsEnabledRef:n}=d(),a=(0,r.useRef)(p()),o=(0,s.zX)(e);(0,r.useEffect)((()=>{const e=()=>{if(!n.current)return;const e=p();o(e,a.current),a.current=e},t={passive:!0};return e(),window.addEventListener("scroll",e,t),()=>window.removeEventListener("scroll",e,t)}),[o,n,...t])}function h(){const e=d(),t=function(){const e=(0,r.useRef)({elem:null,top:0}),t=(0,r.useCallback)((t=>{e.current={elem:t,top:t.getBoundingClientRect().top}}),[]),n=(0,r.useCallback)((()=>{const{current:{elem:t,top:n}}=e;if(!t)return{restored:!1};const r=t.getBoundingClientRect().top-n;return r&&window.scrollBy({left:0,top:r}),e.current={elem:null,top:0},{restored:0!==r}}),[]);return(0,r.useMemo)((()=>({save:t,restore:n})),[n,t])}(),n=(0,r.useRef)(void 0),a=(0,r.useCallback)((r=>{t.save(r),e.disableScrollEvents(),n.current=()=>{const{restored:r}=t.restore();if(n.current=void 0,r){const t=()=>{e.enableScrollEvents(),window.removeEventListener("scroll",t)};window.addEventListener("scroll",t)}else e.enableScrollEvents()}}),[e,t]);return(0,i.Z)((()=>{queueMicrotask((()=>n.current?.()))})),{blockElementScrollPositionUntilNextRender:a}}function m(){const e=(0,r.useRef)(null),t=(0,o.Z)()&&"smooth"===getComputedStyle(document.documentElement).scrollBehavior;return{startScroll:n=>{e.current=t?function(e){return window.scrollTo({top:e,behavior:"smooth"}),()=>{}}(n):function(e){let t=null;const n=document.documentElement.scrollTop>e;return function r(){const a=document.documentElement.scrollTop;(n&&a>e||!n&&at&&cancelAnimationFrame(t)}(n)},cancelScroll:()=>e.current?.()}}},812:(e,t,n)=>{"use strict";n.d(t,{WA:()=>u,Nk:()=>d});var r=n(7294);const a=JSON.parse('{"d":"localStorage","u":""}'),o=a.d;function i(e){let{key:t,oldValue:n,newValue:r,storage:a}=e;if(n===r)return;const o=document.createEvent("StorageEvent");o.initStorageEvent("storage",!1,!1,t,n,r,window.location.href,a),window.dispatchEvent(o)}function s(e){if(void 0===e&&(e=o),"undefined"==typeof window)throw new Error("Browser storage is not available on Node.js/Docusaurus SSR process.");if("none"===e)return null;try{return window[e]}catch(n){return t=n,l||(console.warn("Docusaurus browser storage is not available.\nPossible reasons: running Docusaurus in an iframe, in an incognito browser session, or using too strict browser privacy settings.",t),l=!0),null}var t}let l=!1;const c={get:()=>null,set:()=>{},del:()=>{},listen:()=>()=>{}};function u(e,t){const n=`${e}${a.u}`;if("undefined"==typeof window)return function(e){function t(){throw new Error(`Illegal storage API usage for storage key "${e}".\nDocusaurus storage APIs are not supposed to be called on the server-rendering process.\nPlease only call storage APIs in effects and event handlers.`)}return{get:t,set:t,del:t,listen:t}}(n);const r=s(t?.persistence);return null===r?c:{get:()=>{try{return r.getItem(n)}catch(e){return console.error(`Docusaurus storage error, can't get key=${n}`,e),null}},set:e=>{try{const t=r.getItem(n);r.setItem(n,e),i({key:n,oldValue:t,newValue:e,storage:r})}catch(t){console.error(`Docusaurus storage error, can't set ${n}=${e}`,t)}},del:()=>{try{const e=r.getItem(n);r.removeItem(n),i({key:n,oldValue:e,newValue:null,storage:r})}catch(e){console.error(`Docusaurus storage error, can't delete key=${n}`,e)}},listen:e=>{try{const t=t=>{t.storageArea===r&&t.key===n&&e(t)};return window.addEventListener("storage",t),()=>window.removeEventListener("storage",t)}catch(t){return console.error(`Docusaurus storage error, can't listen for changes of key=${n}`,t),()=>{}}}}}function d(e,t){const n=(0,r.useRef)((()=>null===e?c:u(e,t))).current(),a=(0,r.useCallback)((e=>"undefined"==typeof window?()=>{}:n.listen(e)),[n]);return[(0,r.useSyncExternalStore)(a,(()=>"undefined"==typeof window?null:n.get()),(()=>null)),n]}},4711:(e,t,n)=>{"use strict";n.d(t,{l:()=>i});var r=n(2263),a=n(6550),o=n(8780);function i(){const{siteConfig:{baseUrl:e,url:t,trailingSlash:n},i18n:{defaultLocale:i,currentLocale:s}}=(0,r.Z)(),{pathname:l}=(0,a.TH)(),c=(0,o.Do)(l,{trailingSlash:n,baseUrl:e}),u=s===i?e:e.replace(`/${s}/`,"/"),d=c.replace(e,"");return{createUrl:function(e){let{locale:n,fullyQualified:r}=e;return`${r?t:""}${function(e){return e===i?`${u}`:`${u}${e}/`}(n)}${d}`}}}},5936:(e,t,n)=>{"use strict";n.d(t,{S:()=>i});var r=n(7294),a=n(6550),o=n(902);function i(e){const t=(0,a.TH)(),n=(0,o.D9)(t),i=(0,o.zX)(e);(0,r.useEffect)((()=>{n&&t!==n&&i({location:t,previousLocation:n})}),[i,t,n])}},6668:(e,t,n)=>{"use strict";n.d(t,{L:()=>a});var r=n(2263);function a(){return(0,r.Z)().siteConfig.themeConfig}},8802:(e,t,n)=>{"use strict";Object.defineProperty(t,"__esModule",{value:!0}),t.addTrailingSlash=a,t.default=function(e,t){const{trailingSlash:n,baseUrl:r}=t;if(e.startsWith("#"))return e;if(void 0===n)return e;const[i]=e.split(/[#?]/),s="/"===i||i===r?i:(l=i,c=n,c?a(l):o(l));var l,c;return e.replace(i,s)},t.addLeadingSlash=function(e){return(0,r.addPrefix)(e,"/")},t.removeTrailingSlash=o;const r=n(5913);function a(e){return e.endsWith("/")?e:`${e}/`}function o(e){return(0,r.removeSuffix)(e,"/")}},4143:(e,t)=>{"use strict";Object.defineProperty(t,"__esModule",{value:!0}),t.getErrorCausalChain=function e(t){if(t.cause)return[t,...e(t.cause)];return[t]}},8780:(e,t,n)=>{"use strict";t.BN=t.Do=void 0;const r=n(7582);var a=n(8802);Object.defineProperty(t,"Do",{enumerable:!0,get:function(){return r.__importDefault(a).default}});var o=n(5913);var i=n(4143);Object.defineProperty(t,"BN",{enumerable:!0,get:function(){return i.getErrorCausalChain}})},5913:(e,t)=>{"use strict";Object.defineProperty(t,"__esModule",{value:!0}),t.addPrefix=function(e,t){return e.startsWith(t)?e:`${t}${e}`},t.removeSuffix=function(e,t){if(""===t)return e;return e.endsWith(t)?e.slice(0,-t.length):e},t.addSuffix=function(e,t){return e.endsWith(t)?e:`${e}${t}`},t.removePrefix=function(e,t){return e.startsWith(t)?e.slice(t.length):e}},311:(e,t,n)=>{"use strict";n.d(t,{Z:()=>i});n(7294);var r=n(1728);const a={loadingRing:"loadingRing_RJI3","loading-ring":"loading-ring_FB5o"};var o=n(5893);function i(e){let{className:t}=e;return(0,o.jsxs)("div",{className:(0,r.Z)(a.loadingRing,t),children:[(0,o.jsx)("div",{}),(0,o.jsx)("div",{}),(0,o.jsx)("div",{}),(0,o.jsx)("div",{})]})}},22:(e,t,n)=>{"use strict";n.d(t,{w:()=>s});var r=n(1336),a=n.n(r),o=n(1029);const i=new Map;function s(e,t){const n=`${e}${t}`;let r=i.get(n);return r||(r=async function(e,t){{const n=`${e}${o.J.replace("{dir}",t?`-${t.replace(/\//g,"-")}`:"")}`;if(new URL(n,location.origin).origin!==location.origin)throw new Error("Unexpected version url");const r=await(await fetch(n)).json(),i=r.map(((e,t)=>{let{documents:n,index:r}=e;return{type:t,documents:n,index:a().Index.load(r)}})),s=r.reduce(((e,t)=>{for(const n of t.index.invertedIndex)/\p{Unified_Ideograph}/u.test(n[0][0])&&e.add(n[0]);return e}),new Set);return{wrappedIndexes:i,zhDictionary:Array.from(s)}}return{wrappedIndexes:[],zhDictionary:[]}}(e,t),i.set(n,r)),r}},8202:(e,t,n)=>{"use strict";n.d(t,{v:()=>c});var r=n(1336),a=n.n(r);var o=n(1029);function i(e){return s(e).concat(s(e.filter((e=>{const t=e[e.length-1];return!t.trailing&&t.maybeTyping})),!0))}function s(e,t){return e.map((e=>({tokens:e.map((e=>e.value)),term:e.map((e=>({value:e.value,presence:a().Query.presence.REQUIRED,wildcard:(t?e.trailing||e.maybeTyping:e.trailing)?a().Query.wildcard.TRAILING:a().Query.wildcard.NONE})))})))}var l=n(3545);function c(e,t,n){return function(r,s){const c=function(e,t){if(1===t.length&&["ja","jp","th"].includes(t[0]))return a()[t[0]].tokenizer(e).map((e=>e.toString()));let n=/[^-\s]+/g;return t.includes("zh")&&(n=/\w+|\p{Unified_Ideograph}+/gu),e.toLowerCase().match(n)||[]}(r,o.dK);if(0===c.length)return void s([]);const u=function(e,t){const n=function(e,t){const n=[];return function e(r,a){if(0===r.length)return void n.push(a);const o=r[0];if(/\p{Unified_Ideograph}/u.test(o)){const n=function(e,t){const n=[];return function e(r,a){let o=0,i=!1;for(const s of t)if(r.substr(0,s.length)===s){const t={missed:a.missed,term:a.term.concat({value:s})};r.length>s.length?e(r.substr(s.length),t):n.push(t),i=!0}else for(let t=s.length-1;t>o;t-=1){const l=s.substr(0,t);if(r.substr(0,t)===l){o=t;const s={missed:a.missed,term:a.term.concat({value:l,trailing:!0})};r.length>t?e(r.substr(t),s):n.push(s),i=!0;break}}i||(r.length>0?e(r.substr(1),{missed:a.missed+1,term:a.term}):a.term.length>0&&n.push(a))}(e,{missed:0,term:[]}),n.sort(((e,t)=>{const n=e.missed>0?1:0,r=t.missed>0?1:0;return n!==r?n-r:e.term.length-t.term.length})).map((e=>e.term))}(o,t);for(const t of n){const n=a.concat(...t);e(r.slice(1),n)}}else{const t=a.concat({value:o});e(r.slice(1),t)}}(e,[]),n}(e,t);if(0===n.length)return[{tokens:e,term:e.map((e=>({value:e,presence:a().Query.presence.REQUIRED,wildcard:a().Query.wildcard.LEADING|a().Query.wildcard.TRAILING})))}];for(const a of n)a[a.length-1].maybeTyping=!0;const r=[];for(const i of o.dK)if("en"===i)o._k||r.unshift(a().stopWordFilter);else{const e=a()[i];e.stopWordFilter&&r.unshift(e.stopWordFilter)}let s;if(r.length>0){const e=e=>r.reduce(((e,t)=>e.filter((e=>t(e.value)))),e);s=[];const t=[];for(const r of n){const n=e(r);s.push(n),n.length0&&t.push(n)}n.push(...t)}else s=n.slice();const l=[];for(const a of s)if(a.length>2)for(let e=a.length-1;e>=0;e-=1)l.push(a.slice(0,e).concat(a.slice(e+1)));return i(n).concat(i(l))}(c,t),d=[];e:for(const{term:t,tokens:a}of u)for(const{documents:r,index:o,type:i}of e)if(d.push(...o.query((e=>{for(const n of t)e.term(n.value,{wildcard:n.wildcard,presence:n.presence})})).slice(0,n).filter((e=>!d.some((t=>t.document.i.toString()===e.ref)))).slice(0,n-d.length).map((t=>{const n=r.find((e=>e.i.toString()===t.ref));return{document:n,type:i,page:i!==l.P.Title&&e[0].documents.find((e=>e.i===n.p)),metadata:t.matchData.metadata,tokens:a,score:t.score}}))),d.length>=n)break e;!function(e){e.forEach(((e,t)=>{e.index=t})),e.sort(((t,n)=>{let r=t.type!==l.P.Heading&&t.type!==l.P.Content&&t.type!==l.P.Description||!t.page?t.index:e.findIndex((e=>e.document===t.page)),a=n.type!==l.P.Heading&&n.type!==l.P.Content&&n.type!==l.P.Description||!n.page?n.index:e.findIndex((e=>e.document===n.page));if(-1===r&&(r=t.index),-1===a&&(a=n.index),r===a){const e=(0===n.type?1:0)-(0===t.type?1:0);return 0===e?t.index-n.index:e}return r-a}))}(d),function(e){e.forEach(((t,n)=>{n>0&&t.page&&e.slice(0,n).some((e=>(e.type===l.P.Keywords?e.page:e.document)===t.page))&&(n{"use strict";function r(e){return e.join(" \u203a ")}n.d(t,{e:()=>r})},1690:(e,t,n)=>{"use strict";function r(e){return e.replace(/&/g,"&").replace(//g,">").replace(/"/g,""").replace(/'/g,"'")}n.d(t,{X:()=>r})},1073:(e,t,n)=>{"use strict";function r(e,t){const n=[];for(const r of Object.values(e))r[t]&&n.push(...r[t].position);return n.sort(((e,t)=>e[0]-t[0]||t[1]-e[1]))}n.d(t,{m:()=>r})},2539:(e,t,n)=>{"use strict";n.d(t,{C:()=>a});var r=n(1690);function a(e,t,n){const o=[];for(const i of t){const n=e.toLowerCase().indexOf(i);if(n>=0){n>0&&o.push(a(e.substr(0,n),t)),o.push(`${(0,r.X)(e.substr(n,i.length))}`);const s=n+i.length;s${(0,r.X)(e)}`:(0,r.X)(e):o.join("")}},726:(e,t,n)=>{"use strict";n.d(t,{o:()=>l});var r=n(1690),a=n(2539);const o=/\w+|\p{Unified_Ideograph}/u;function i(e){const t=[];let n=0,r=e;for(;r.length>0;){const a=r.match(o);if(!a){t.push(r);break}a.index>0&&t.push(r.substring(0,a.index)),t.push(a[0]),n+=a.index+a[0].length,r=e.substring(n)}return t}var s=n(1029);function l(e,t,n,o){void 0===o&&(o=s.Hk);const{chunkIndex:l,chunks:c}=function(e,t,n){const o=[];let s=0,l=0,c=-1;for(;sl){const t=i(e.substring(l,u)).map((e=>({html:(0,r.X)(e),textLength:e.length})));for(const e of t)o.push(e)}-1===c&&(c=o.length),l=u+d,o.push({html:(0,a.C)(e.substring(u,l),n,!0),textLength:d})}}if(l({html:(0,r.X)(e),textLength:e.length})));for(const e of t)o.push(e)}return{chunkIndex:c,chunks:o}}(e,t,n),u=c.slice(0,l),d=c[l],p=[d.html],f=c.slice(l+1);let h=d.textLength,m=0,g=0,y=!1,b=!1;for(;h0){const e=u.pop();h+e.textLength<=o?(p.unshift(e.html),m+=e.textLength,h+=e.textLength):(y=!0,u.length=0)}else{if(!(f.length>0))break;{const e=f.shift();h+e.textLength<=o?(p.push(e.html),g+=e.textLength,h+=e.textLength):(b=!0,f.length=0)}}return(y||u.length>0)&&p.unshift("\u2026"),(b||f.length>0)&&p.push("\u2026"),p.join("")}},51:(e,t,n)=>{"use strict";function r(e,t){if("string"==typeof e)return{label:e,path:e};{const{label:n,path:r}=e;return"string"==typeof n?{label:n,path:r}:Object.prototype.hasOwnProperty.call(n,t)?{label:n[t],path:r}:{label:r,path:r}}}n.d(t,{_:()=>r})},1029:(e,t,n)=>{"use strict";n.d(t,{vc:()=>a(),gQ:()=>h,H6:()=>u,hG:()=>y,l9:()=>m,dK:()=>o,_k:()=>i,pu:()=>f,AY:()=>d,t_:()=>p,Kc:()=>g,J:()=>s,Hk:()=>c,qo:()=>l,pQ:()=>b});n(1336);var r=n(813),a=n.n(r);const o=["en"],i=!1,s="search-index{dir}.json?_=a7c800c0",l=8,c=50,u=!1,d=!0,p=!0,f="right",h=void 0,m=!0,g=null,y=!1,b=!1},3545:(e,t,n)=>{"use strict";var r;n.d(t,{P:()=>r}),function(e){e[e.Title=0]="Title",e[e.Heading=1]="Heading",e[e.Description=2]="Description",e[e.Keywords=3]="Keywords",e[e.Content=4]="Content"}(r||(r={}))},9318:(e,t,n)=>{"use strict";n.d(t,{lX:()=>w,q_:()=>C,ob:()=>f,PP:()=>j,Ep:()=>p});var r=n(7462);function a(e){return"/"===e.charAt(0)}function o(e,t){for(var n=t,r=n+1,a=e.length;r=0;p--){var f=i[p];"."===f?o(i,p):".."===f?(o(i,p),d++):d&&(o(i,p),d--)}if(!c)for(;d--;d)i.unshift("..");!c||""===i[0]||i[0]&&a(i[0])||i.unshift("");var h=i.join("/");return n&&"/"!==h.substr(-1)&&(h+="/"),h};var s=n(8776);function l(e){return"/"===e.charAt(0)?e:"/"+e}function c(e){return"/"===e.charAt(0)?e.substr(1):e}function u(e,t){return function(e,t){return 0===e.toLowerCase().indexOf(t.toLowerCase())&&-1!=="/?#".indexOf(e.charAt(t.length))}(e,t)?e.substr(t.length):e}function d(e){return"/"===e.charAt(e.length-1)?e.slice(0,-1):e}function p(e){var t=e.pathname,n=e.search,r=e.hash,a=t||"/";return n&&"?"!==n&&(a+="?"===n.charAt(0)?n:"?"+n),r&&"#"!==r&&(a+="#"===r.charAt(0)?r:"#"+r),a}function f(e,t,n,a){var o;"string"==typeof e?(o=function(e){var t=e||"/",n="",r="",a=t.indexOf("#");-1!==a&&(r=t.substr(a),t=t.substr(0,a));var o=t.indexOf("?");return-1!==o&&(n=t.substr(o),t=t.substr(0,o)),{pathname:t,search:"?"===n?"":n,hash:"#"===r?"":r}}(e),o.state=t):(void 0===(o=(0,r.Z)({},e)).pathname&&(o.pathname=""),o.search?"?"!==o.search.charAt(0)&&(o.search="?"+o.search):o.search="",o.hash?"#"!==o.hash.charAt(0)&&(o.hash="#"+o.hash):o.hash="",void 0!==t&&void 0===o.state&&(o.state=t));try{o.pathname=decodeURI(o.pathname)}catch(s){throw s instanceof URIError?new URIError('Pathname "'+o.pathname+'" could not be decoded. This is likely caused by an invalid percent-encoding.'):s}return n&&(o.key=n),a?o.pathname?"/"!==o.pathname.charAt(0)&&(o.pathname=i(o.pathname,a.pathname)):o.pathname=a.pathname:o.pathname||(o.pathname="/"),o}function h(){var e=null;var t=[];return{setPrompt:function(t){return e=t,function(){e===t&&(e=null)}},confirmTransitionTo:function(t,n,r,a){if(null!=e){var o="function"==typeof e?e(t,n):e;"string"==typeof o?"function"==typeof r?r(o,a):a(!0):a(!1!==o)}else a(!0)},appendListener:function(e){var n=!0;function r(){n&&e.apply(void 0,arguments)}return t.push(r),function(){n=!1,t=t.filter((function(e){return e!==r}))}},notifyListeners:function(){for(var e=arguments.length,n=new Array(e),r=0;rt?n.splice(t,n.length-t,a):n.push(a),d({action:r,location:a,index:t,entries:n})}}))},replace:function(e,t){var r="REPLACE",a=f(e,t,m(),w.location);u.confirmTransitionTo(a,r,n,(function(e){e&&(w.entries[w.index]=a,d({action:r,location:a}))}))},go:v,goBack:function(){v(-1)},goForward:function(){v(1)},canGo:function(e){var t=w.index+e;return t>=0&&t{"use strict";var r=n(9864),a={childContextTypes:!0,contextType:!0,contextTypes:!0,defaultProps:!0,displayName:!0,getDefaultProps:!0,getDerivedStateFromError:!0,getDerivedStateFromProps:!0,mixins:!0,propTypes:!0,type:!0},o={name:!0,length:!0,prototype:!0,caller:!0,callee:!0,arguments:!0,arity:!0},i={$$typeof:!0,compare:!0,defaultProps:!0,displayName:!0,propTypes:!0,type:!0},s={};function l(e){return r.isMemo(e)?i:s[e.$$typeof]||a}s[r.ForwardRef]={$$typeof:!0,render:!0,defaultProps:!0,displayName:!0,propTypes:!0},s[r.Memo]=i;var c=Object.defineProperty,u=Object.getOwnPropertyNames,d=Object.getOwnPropertySymbols,p=Object.getOwnPropertyDescriptor,f=Object.getPrototypeOf,h=Object.prototype;e.exports=function e(t,n,r){if("string"!=typeof n){if(h){var a=f(n);a&&a!==h&&e(t,a,r)}var i=u(n);d&&(i=i.concat(d(n)));for(var s=l(t),m=l(n),g=0;g{"use strict";e.exports=function(e,t,n,r,a,o,i,s){if(!e){var l;if(void 0===t)l=new Error("Minified exception occurred; use the non-minified dev environment for the full error message and additional helpful warnings.");else{var c=[n,r,a,o,i,s],u=0;(l=new Error(t.replace(/%s/g,(function(){return c[u++]})))).name="Invariant Violation"}throw l.framesToPop=1,l}}},5826:e=>{e.exports=Array.isArray||function(e){return"[object Array]"==Object.prototype.toString.call(e)}},1336:(e,t,n)=>{var r,a;!function(){var o,i,s,l,c,u,d,p,f,h,m,g,y,b,v,w,k,x,S,E,_,C,T,j,L,R,N,P,A,O,I=function(e){var t=new I.Builder;return t.pipeline.add(I.trimmer,I.stopWordFilter,I.stemmer),t.searchPipeline.add(I.stemmer),e.call(t,t),t.build()};I.version="2.3.9",I.utils={},I.utils.warn=(o=this,function(e){o.console&&console.warn&&console.warn(e)}),I.utils.asString=function(e){return null==e?"":e.toString()},I.utils.clone=function(e){if(null==e)return e;for(var t=Object.create(null),n=Object.keys(e),r=0;r0){var l=I.utils.clone(t)||{};l.position=[i,s],l.index=a.length,a.push(new I.Token(n.slice(i,o),l))}i=o+1}}return a},I.tokenizer.separator=/[\s\-]+/,I.Pipeline=function(){this._stack=[]},I.Pipeline.registeredFunctions=Object.create(null),I.Pipeline.registerFunction=function(e,t){t in this.registeredFunctions&&I.utils.warn("Overwriting existing registered function: "+t),e.label=t,I.Pipeline.registeredFunctions[e.label]=e},I.Pipeline.warnIfFunctionNotRegistered=function(e){e.label&&e.label in this.registeredFunctions||I.utils.warn("Function is not registered with pipeline. This may cause problems when serialising the index.\n",e)},I.Pipeline.load=function(e){var t=new I.Pipeline;return e.forEach((function(e){var n=I.Pipeline.registeredFunctions[e];if(!n)throw new Error("Cannot load unregistered function: "+e);t.add(n)})),t},I.Pipeline.prototype.add=function(){Array.prototype.slice.call(arguments).forEach((function(e){I.Pipeline.warnIfFunctionNotRegistered(e),this._stack.push(e)}),this)},I.Pipeline.prototype.after=function(e,t){I.Pipeline.warnIfFunctionNotRegistered(t);var n=this._stack.indexOf(e);if(-1==n)throw new Error("Cannot find existingFn");n+=1,this._stack.splice(n,0,t)},I.Pipeline.prototype.before=function(e,t){I.Pipeline.warnIfFunctionNotRegistered(t);var n=this._stack.indexOf(e);if(-1==n)throw new Error("Cannot find existingFn");this._stack.splice(n,0,t)},I.Pipeline.prototype.remove=function(e){var t=this._stack.indexOf(e);-1!=t&&this._stack.splice(t,1)},I.Pipeline.prototype.run=function(e){for(var t=this._stack.length,n=0;n1&&(oe&&(n=a),o!=e);)r=n-t,a=t+Math.floor(r/2),o=this.elements[2*a];return o==e||o>e?2*a:os?c+=2:i==s&&(t+=n[l+1]*r[c+1],l+=2,c+=2);return t},I.Vector.prototype.similarity=function(e){return this.dot(e)/this.magnitude()||0},I.Vector.prototype.toArray=function(){for(var e=new Array(this.elements.length/2),t=1,n=0;t0){var o,i=a.str.charAt(0);i in a.node.edges?o=a.node.edges[i]:(o=new I.TokenSet,a.node.edges[i]=o),1==a.str.length&&(o.final=!0),r.push({node:o,editsRemaining:a.editsRemaining,str:a.str.slice(1)})}if(0!=a.editsRemaining){if("*"in a.node.edges)var s=a.node.edges["*"];else{s=new I.TokenSet;a.node.edges["*"]=s}if(0==a.str.length&&(s.final=!0),r.push({node:s,editsRemaining:a.editsRemaining-1,str:a.str}),a.str.length>1&&r.push({node:a.node,editsRemaining:a.editsRemaining-1,str:a.str.slice(1)}),1==a.str.length&&(a.node.final=!0),a.str.length>=1){if("*"in a.node.edges)var l=a.node.edges["*"];else{l=new I.TokenSet;a.node.edges["*"]=l}1==a.str.length&&(l.final=!0),r.push({node:l,editsRemaining:a.editsRemaining-1,str:a.str.slice(1)})}if(a.str.length>1){var c,u=a.str.charAt(0),d=a.str.charAt(1);d in a.node.edges?c=a.node.edges[d]:(c=new I.TokenSet,a.node.edges[d]=c),1==a.str.length&&(c.final=!0),r.push({node:c,editsRemaining:a.editsRemaining-1,str:u+a.str.slice(2)})}}}return n},I.TokenSet.fromString=function(e){for(var t=new I.TokenSet,n=t,r=0,a=e.length;r=e;t--){var n=this.uncheckedNodes[t],r=n.child.toString();r in this.minimizedNodes?n.parent.edges[n.char]=this.minimizedNodes[r]:(n.child._str=r,this.minimizedNodes[r]=n.child),this.uncheckedNodes.pop()}},I.Index=function(e){this.invertedIndex=e.invertedIndex,this.fieldVectors=e.fieldVectors,this.tokenSet=e.tokenSet,this.fields=e.fields,this.pipeline=e.pipeline},I.Index.prototype.search=function(e){return this.query((function(t){new I.QueryParser(e,t).parse()}))},I.Index.prototype.query=function(e){for(var t=new I.Query(this.fields),n=Object.create(null),r=Object.create(null),a=Object.create(null),o=Object.create(null),i=Object.create(null),s=0;s1?1:e},I.Builder.prototype.k1=function(e){this._k1=e},I.Builder.prototype.add=function(e,t){var n=e[this._ref],r=Object.keys(this._fields);this._documents[n]=t||{},this.documentCount+=1;for(var a=0;a=this.length)return I.QueryLexer.EOS;var e=this.str.charAt(this.pos);return this.pos+=1,e},I.QueryLexer.prototype.width=function(){return this.pos-this.start},I.QueryLexer.prototype.ignore=function(){this.start==this.pos&&(this.pos+=1),this.start=this.pos},I.QueryLexer.prototype.backup=function(){this.pos-=1},I.QueryLexer.prototype.acceptDigitRun=function(){var e,t;do{t=(e=this.next()).charCodeAt(0)}while(t>47&&t<58);e!=I.QueryLexer.EOS&&this.backup()},I.QueryLexer.prototype.more=function(){return this.pos1&&(e.backup(),e.emit(I.QueryLexer.TERM)),e.ignore(),e.more())return I.QueryLexer.lexText},I.QueryLexer.lexEditDistance=function(e){return e.ignore(),e.acceptDigitRun(),e.emit(I.QueryLexer.EDIT_DISTANCE),I.QueryLexer.lexText},I.QueryLexer.lexBoost=function(e){return e.ignore(),e.acceptDigitRun(),e.emit(I.QueryLexer.BOOST),I.QueryLexer.lexText},I.QueryLexer.lexEOS=function(e){e.width()>0&&e.emit(I.QueryLexer.TERM)},I.QueryLexer.termSeparator=I.tokenizer.separator,I.QueryLexer.lexText=function(e){for(;;){var t=e.next();if(t==I.QueryLexer.EOS)return I.QueryLexer.lexEOS;if(92!=t.charCodeAt(0)){if(":"==t)return I.QueryLexer.lexField;if("~"==t)return e.backup(),e.width()>0&&e.emit(I.QueryLexer.TERM),I.QueryLexer.lexEditDistance;if("^"==t)return e.backup(),e.width()>0&&e.emit(I.QueryLexer.TERM),I.QueryLexer.lexBoost;if("+"==t&&1===e.width())return e.emit(I.QueryLexer.PRESENCE),I.QueryLexer.lexText;if("-"==t&&1===e.width())return e.emit(I.QueryLexer.PRESENCE),I.QueryLexer.lexText;if(t.match(I.QueryLexer.termSeparator))return I.QueryLexer.lexTerm}else e.escapeCharacter()}},I.QueryParser=function(e,t){this.lexer=new I.QueryLexer(e),this.query=t,this.currentClause={},this.lexemeIdx=0},I.QueryParser.prototype.parse=function(){this.lexer.run(),this.lexemes=this.lexer.lexemes;for(var e=I.QueryParser.parseClause;e;)e=e(this);return this.query},I.QueryParser.prototype.peekLexeme=function(){return this.lexemes[this.lexemeIdx]},I.QueryParser.prototype.consumeLexeme=function(){var e=this.peekLexeme();return this.lexemeIdx+=1,e},I.QueryParser.prototype.nextClause=function(){var e=this.currentClause;this.query.clause(e),this.currentClause={}},I.QueryParser.parseClause=function(e){var t=e.peekLexeme();if(null!=t)switch(t.type){case I.QueryLexer.PRESENCE:return I.QueryParser.parsePresence;case I.QueryLexer.FIELD:return I.QueryParser.parseField;case I.QueryLexer.TERM:return I.QueryParser.parseTerm;default:var n="expected either a field or a term, found "+t.type;throw t.str.length>=1&&(n+=" with value '"+t.str+"'"),new I.QueryParseError(n,t.start,t.end)}},I.QueryParser.parsePresence=function(e){var t=e.consumeLexeme();if(null!=t){switch(t.str){case"-":e.currentClause.presence=I.Query.presence.PROHIBITED;break;case"+":e.currentClause.presence=I.Query.presence.REQUIRED;break;default:var n="unrecognised presence operator'"+t.str+"'";throw new I.QueryParseError(n,t.start,t.end)}var r=e.peekLexeme();if(null==r){n="expecting term or field, found nothing";throw new I.QueryParseError(n,t.start,t.end)}switch(r.type){case I.QueryLexer.FIELD:return I.QueryParser.parseField;case I.QueryLexer.TERM:return I.QueryParser.parseTerm;default:n="expecting term or field, found '"+r.type+"'";throw new I.QueryParseError(n,r.start,r.end)}}},I.QueryParser.parseField=function(e){var t=e.consumeLexeme();if(null!=t){if(-1==e.query.allFields.indexOf(t.str)){var n=e.query.allFields.map((function(e){return"'"+e+"'"})).join(", "),r="unrecognised field '"+t.str+"', possible fields: "+n;throw new I.QueryParseError(r,t.start,t.end)}e.currentClause.fields=[t.str];var a=e.peekLexeme();if(null==a){r="expecting term, found nothing";throw new I.QueryParseError(r,t.start,t.end)}if(a.type===I.QueryLexer.TERM)return I.QueryParser.parseTerm;r="expecting term, found '"+a.type+"'";throw new I.QueryParseError(r,a.start,a.end)}},I.QueryParser.parseTerm=function(e){var t=e.consumeLexeme();if(null!=t){e.currentClause.term=t.str.toLowerCase(),-1!=t.str.indexOf("*")&&(e.currentClause.usePipeline=!1);var n=e.peekLexeme();if(null!=n)switch(n.type){case I.QueryLexer.TERM:return e.nextClause(),I.QueryParser.parseTerm;case I.QueryLexer.FIELD:return e.nextClause(),I.QueryParser.parseField;case I.QueryLexer.EDIT_DISTANCE:return I.QueryParser.parseEditDistance;case I.QueryLexer.BOOST:return I.QueryParser.parseBoost;case I.QueryLexer.PRESENCE:return e.nextClause(),I.QueryParser.parsePresence;default:var r="Unexpected lexeme type '"+n.type+"'";throw new I.QueryParseError(r,n.start,n.end)}else e.nextClause()}},I.QueryParser.parseEditDistance=function(e){var t=e.consumeLexeme();if(null!=t){var n=parseInt(t.str,10);if(isNaN(n)){var r="edit distance must be numeric";throw new I.QueryParseError(r,t.start,t.end)}e.currentClause.editDistance=n;var a=e.peekLexeme();if(null!=a)switch(a.type){case I.QueryLexer.TERM:return e.nextClause(),I.QueryParser.parseTerm;case I.QueryLexer.FIELD:return e.nextClause(),I.QueryParser.parseField;case I.QueryLexer.EDIT_DISTANCE:return I.QueryParser.parseEditDistance;case I.QueryLexer.BOOST:return I.QueryParser.parseBoost;case I.QueryLexer.PRESENCE:return e.nextClause(),I.QueryParser.parsePresence;default:r="Unexpected lexeme type '"+a.type+"'";throw new I.QueryParseError(r,a.start,a.end)}else e.nextClause()}},I.QueryParser.parseBoost=function(e){var t=e.consumeLexeme();if(null!=t){var n=parseInt(t.str,10);if(isNaN(n)){var r="boost must be numeric";throw new I.QueryParseError(r,t.start,t.end)}e.currentClause.boost=n;var a=e.peekLexeme();if(null!=a)switch(a.type){case I.QueryLexer.TERM:return e.nextClause(),I.QueryParser.parseTerm;case I.QueryLexer.FIELD:return e.nextClause(),I.QueryParser.parseField;case I.QueryLexer.EDIT_DISTANCE:return I.QueryParser.parseEditDistance;case I.QueryLexer.BOOST:return I.QueryParser.parseBoost;case I.QueryLexer.PRESENCE:return e.nextClause(),I.QueryParser.parsePresence;default:r="Unexpected lexeme type '"+a.type+"'";throw new I.QueryParseError(r,a.start,a.end)}else e.nextClause()}},void 0===(a="function"==typeof(r=function(){return I})?r.call(t,n,t,e):r)||(e.exports=a)}()},813:function(e){e.exports=function(){"use strict";var e="function"==typeof Symbol&&"symbol"==typeof Symbol.iterator?function(e){return typeof e}:function(e){return e&&"function"==typeof Symbol&&e.constructor===Symbol&&e!==Symbol.prototype?"symbol":typeof e},t=function(e,t){if(!(e instanceof t))throw new TypeError("Cannot call a class as a function")},n=function(){function e(e,t){for(var n=0;n1&&void 0!==arguments[1])||arguments[1],a=arguments.length>2&&void 0!==arguments[2]?arguments[2]:[],o=arguments.length>3&&void 0!==arguments[3]?arguments[3]:5e3;t(this,e),this.ctx=n,this.iframes=r,this.exclude=a,this.iframesTimeout=o}return n(e,[{key:"getContexts",value:function(){var e=[];return(void 0!==this.ctx&&this.ctx?NodeList.prototype.isPrototypeOf(this.ctx)?Array.prototype.slice.call(this.ctx):Array.isArray(this.ctx)?this.ctx:"string"==typeof this.ctx?Array.prototype.slice.call(document.querySelectorAll(this.ctx)):[this.ctx]:[]).forEach((function(t){var n=e.filter((function(e){return e.contains(t)})).length>0;-1!==e.indexOf(t)||n||e.push(t)})),e}},{key:"getIframeContents",value:function(e,t){var n=arguments.length>2&&void 0!==arguments[2]?arguments[2]:function(){},r=void 0;try{var a=e.contentWindow;if(r=a.document,!a||!r)throw new Error("iframe inaccessible")}catch(o){n()}r&&t(r)}},{key:"isIframeBlank",value:function(e){var t="about:blank",n=e.getAttribute("src").trim();return e.contentWindow.location.href===t&&n!==t&&n}},{key:"observeIframeLoad",value:function(e,t,n){var r=this,a=!1,o=null,i=function i(){if(!a){a=!0,clearTimeout(o);try{r.isIframeBlank(e)||(e.removeEventListener("load",i),r.getIframeContents(e,t,n))}catch(s){n()}}};e.addEventListener("load",i),o=setTimeout(i,this.iframesTimeout)}},{key:"onIframeReady",value:function(e,t,n){try{"complete"===e.contentWindow.document.readyState?this.isIframeBlank(e)?this.observeIframeLoad(e,t,n):this.getIframeContents(e,t,n):this.observeIframeLoad(e,t,n)}catch(r){n()}}},{key:"waitForIframes",value:function(e,t){var n=this,r=0;this.forEachIframe(e,(function(){return!0}),(function(e){r++,n.waitForIframes(e.querySelector("html"),(function(){--r||t()}))}),(function(e){e||t()}))}},{key:"forEachIframe",value:function(t,n,r){var a=this,o=arguments.length>3&&void 0!==arguments[3]?arguments[3]:function(){},i=t.querySelectorAll("iframe"),s=i.length,l=0;i=Array.prototype.slice.call(i);var c=function(){--s<=0&&o(l)};s||c(),i.forEach((function(t){e.matches(t,a.exclude)?c():a.onIframeReady(t,(function(e){n(t)&&(l++,r(e)),c()}),c)}))}},{key:"createIterator",value:function(e,t,n){return document.createNodeIterator(e,t,n,!1)}},{key:"createInstanceOnIframe",value:function(t){return new e(t.querySelector("html"),this.iframes)}},{key:"compareNodeIframe",value:function(e,t,n){if(e.compareDocumentPosition(n)&Node.DOCUMENT_POSITION_PRECEDING){if(null===t)return!0;if(t.compareDocumentPosition(n)&Node.DOCUMENT_POSITION_FOLLOWING)return!0}return!1}},{key:"getIteratorNode",value:function(e){var t=e.previousNode();return{prevNode:t,node:(null===t||e.nextNode())&&e.nextNode()}}},{key:"checkIframeFilter",value:function(e,t,n,r){var a=!1,o=!1;return r.forEach((function(e,t){e.val===n&&(a=t,o=e.handled)})),this.compareNodeIframe(e,t,n)?(!1!==a||o?!1===a||o||(r[a].handled=!0):r.push({val:n,handled:!0}),!0):(!1===a&&r.push({val:n,handled:!1}),!1)}},{key:"handleOpenIframes",value:function(e,t,n,r){var a=this;e.forEach((function(e){e.handled||a.getIframeContents(e.val,(function(e){a.createInstanceOnIframe(e).forEachNode(t,n,r)}))}))}},{key:"iterateThroughNodes",value:function(e,t,n,r,a){for(var o=this,i=this.createIterator(t,e,r),s=[],l=[],c=void 0,u=void 0,d=function(){var e=o.getIteratorNode(i);return u=e.prevNode,c=e.node};d();)this.iframes&&this.forEachIframe(t,(function(e){return o.checkIframeFilter(c,u,e,s)}),(function(t){o.createInstanceOnIframe(t).forEachNode(e,(function(e){return l.push(e)}),r)})),l.push(c);l.forEach((function(e){n(e)})),this.iframes&&this.handleOpenIframes(s,e,n,r),a()}},{key:"forEachNode",value:function(e,t,n){var r=this,a=arguments.length>3&&void 0!==arguments[3]?arguments[3]:function(){},o=this.getContexts(),i=o.length;i||a(),o.forEach((function(o){var s=function(){r.iterateThroughNodes(e,o,t,n,(function(){--i<=0&&a()}))};r.iframes?r.waitForIframes(o,s):s()}))}}],[{key:"matches",value:function(e,t){var n="string"==typeof t?[t]:t,r=e.matches||e.matchesSelector||e.msMatchesSelector||e.mozMatchesSelector||e.oMatchesSelector||e.webkitMatchesSelector;if(r){var a=!1;return n.every((function(t){return!r.call(e,t)||(a=!0,!1)})),a}return!1}}]),e}(),o=function(){function o(e){t(this,o),this.ctx=e,this.ie=!1;var n=window.navigator.userAgent;(n.indexOf("MSIE")>-1||n.indexOf("Trident")>-1)&&(this.ie=!0)}return n(o,[{key:"log",value:function(t){var n=arguments.length>1&&void 0!==arguments[1]?arguments[1]:"debug",r=this.opt.log;this.opt.debug&&"object"===(void 0===r?"undefined":e(r))&&"function"==typeof r[n]&&r[n]("mark.js: "+t)}},{key:"escapeStr",value:function(e){return e.replace(/[\-\[\]\/\{\}\(\)\*\+\?\.\\\^\$\|]/g,"\\$&")}},{key:"createRegExp",value:function(e){return"disabled"!==this.opt.wildcards&&(e=this.setupWildcardsRegExp(e)),e=this.escapeStr(e),Object.keys(this.opt.synonyms).length&&(e=this.createSynonymsRegExp(e)),(this.opt.ignoreJoiners||this.opt.ignorePunctuation.length)&&(e=this.setupIgnoreJoinersRegExp(e)),this.opt.diacritics&&(e=this.createDiacriticsRegExp(e)),e=this.createMergedBlanksRegExp(e),(this.opt.ignoreJoiners||this.opt.ignorePunctuation.length)&&(e=this.createJoinersRegExp(e)),"disabled"!==this.opt.wildcards&&(e=this.createWildcardsRegExp(e)),e=this.createAccuracyRegExp(e)}},{key:"createSynonymsRegExp",value:function(e){var t=this.opt.synonyms,n=this.opt.caseSensitive?"":"i",r=this.opt.ignoreJoiners||this.opt.ignorePunctuation.length?"\0":"";for(var a in t)if(t.hasOwnProperty(a)){var o=t[a],i="disabled"!==this.opt.wildcards?this.setupWildcardsRegExp(a):this.escapeStr(a),s="disabled"!==this.opt.wildcards?this.setupWildcardsRegExp(o):this.escapeStr(o);""!==i&&""!==s&&(e=e.replace(new RegExp("("+this.escapeStr(i)+"|"+this.escapeStr(s)+")","gm"+n),r+"("+this.processSynomyms(i)+"|"+this.processSynomyms(s)+")"+r))}return e}},{key:"processSynomyms",value:function(e){return(this.opt.ignoreJoiners||this.opt.ignorePunctuation.length)&&(e=this.setupIgnoreJoinersRegExp(e)),e}},{key:"setupWildcardsRegExp",value:function(e){return(e=e.replace(/(?:\\)*\?/g,(function(e){return"\\"===e.charAt(0)?"?":"\x01"}))).replace(/(?:\\)*\*/g,(function(e){return"\\"===e.charAt(0)?"*":"\x02"}))}},{key:"createWildcardsRegExp",value:function(e){var t="withSpaces"===this.opt.wildcards;return e.replace(/\u0001/g,t?"[\\S\\s]?":"\\S?").replace(/\u0002/g,t?"[\\S\\s]*?":"\\S*")}},{key:"setupIgnoreJoinersRegExp",value:function(e){return e.replace(/[^(|)\\]/g,(function(e,t,n){var r=n.charAt(t+1);return/[(|)\\]/.test(r)||""===r?e:e+"\0"}))}},{key:"createJoinersRegExp",value:function(e){var t=[],n=this.opt.ignorePunctuation;return Array.isArray(n)&&n.length&&t.push(this.escapeStr(n.join(""))),this.opt.ignoreJoiners&&t.push("\\u00ad\\u200b\\u200c\\u200d"),t.length?e.split(/\u0000+/).join("["+t.join("")+"]*"):e}},{key:"createDiacriticsRegExp",value:function(e){var t=this.opt.caseSensitive?"":"i",n=this.opt.caseSensitive?["a\xe0\xe1\u1ea3\xe3\u1ea1\u0103\u1eb1\u1eaf\u1eb3\u1eb5\u1eb7\xe2\u1ea7\u1ea5\u1ea9\u1eab\u1ead\xe4\xe5\u0101\u0105","A\xc0\xc1\u1ea2\xc3\u1ea0\u0102\u1eb0\u1eae\u1eb2\u1eb4\u1eb6\xc2\u1ea6\u1ea4\u1ea8\u1eaa\u1eac\xc4\xc5\u0100\u0104","c\xe7\u0107\u010d","C\xc7\u0106\u010c","d\u0111\u010f","D\u0110\u010e","e\xe8\xe9\u1ebb\u1ebd\u1eb9\xea\u1ec1\u1ebf\u1ec3\u1ec5\u1ec7\xeb\u011b\u0113\u0119","E\xc8\xc9\u1eba\u1ebc\u1eb8\xca\u1ec0\u1ebe\u1ec2\u1ec4\u1ec6\xcb\u011a\u0112\u0118","i\xec\xed\u1ec9\u0129\u1ecb\xee\xef\u012b","I\xcc\xcd\u1ec8\u0128\u1eca\xce\xcf\u012a","l\u0142","L\u0141","n\xf1\u0148\u0144","N\xd1\u0147\u0143","o\xf2\xf3\u1ecf\xf5\u1ecd\xf4\u1ed3\u1ed1\u1ed5\u1ed7\u1ed9\u01a1\u1edf\u1ee1\u1edb\u1edd\u1ee3\xf6\xf8\u014d","O\xd2\xd3\u1ece\xd5\u1ecc\xd4\u1ed2\u1ed0\u1ed4\u1ed6\u1ed8\u01a0\u1ede\u1ee0\u1eda\u1edc\u1ee2\xd6\xd8\u014c","r\u0159","R\u0158","s\u0161\u015b\u0219\u015f","S\u0160\u015a\u0218\u015e","t\u0165\u021b\u0163","T\u0164\u021a\u0162","u\xf9\xfa\u1ee7\u0169\u1ee5\u01b0\u1eeb\u1ee9\u1eed\u1eef\u1ef1\xfb\xfc\u016f\u016b","U\xd9\xda\u1ee6\u0168\u1ee4\u01af\u1eea\u1ee8\u1eec\u1eee\u1ef0\xdb\xdc\u016e\u016a","y\xfd\u1ef3\u1ef7\u1ef9\u1ef5\xff","Y\xdd\u1ef2\u1ef6\u1ef8\u1ef4\u0178","z\u017e\u017c\u017a","Z\u017d\u017b\u0179"]:["a\xe0\xe1\u1ea3\xe3\u1ea1\u0103\u1eb1\u1eaf\u1eb3\u1eb5\u1eb7\xe2\u1ea7\u1ea5\u1ea9\u1eab\u1ead\xe4\xe5\u0101\u0105A\xc0\xc1\u1ea2\xc3\u1ea0\u0102\u1eb0\u1eae\u1eb2\u1eb4\u1eb6\xc2\u1ea6\u1ea4\u1ea8\u1eaa\u1eac\xc4\xc5\u0100\u0104","c\xe7\u0107\u010dC\xc7\u0106\u010c","d\u0111\u010fD\u0110\u010e","e\xe8\xe9\u1ebb\u1ebd\u1eb9\xea\u1ec1\u1ebf\u1ec3\u1ec5\u1ec7\xeb\u011b\u0113\u0119E\xc8\xc9\u1eba\u1ebc\u1eb8\xca\u1ec0\u1ebe\u1ec2\u1ec4\u1ec6\xcb\u011a\u0112\u0118","i\xec\xed\u1ec9\u0129\u1ecb\xee\xef\u012bI\xcc\xcd\u1ec8\u0128\u1eca\xce\xcf\u012a","l\u0142L\u0141","n\xf1\u0148\u0144N\xd1\u0147\u0143","o\xf2\xf3\u1ecf\xf5\u1ecd\xf4\u1ed3\u1ed1\u1ed5\u1ed7\u1ed9\u01a1\u1edf\u1ee1\u1edb\u1edd\u1ee3\xf6\xf8\u014dO\xd2\xd3\u1ece\xd5\u1ecc\xd4\u1ed2\u1ed0\u1ed4\u1ed6\u1ed8\u01a0\u1ede\u1ee0\u1eda\u1edc\u1ee2\xd6\xd8\u014c","r\u0159R\u0158","s\u0161\u015b\u0219\u015fS\u0160\u015a\u0218\u015e","t\u0165\u021b\u0163T\u0164\u021a\u0162","u\xf9\xfa\u1ee7\u0169\u1ee5\u01b0\u1eeb\u1ee9\u1eed\u1eef\u1ef1\xfb\xfc\u016f\u016bU\xd9\xda\u1ee6\u0168\u1ee4\u01af\u1eea\u1ee8\u1eec\u1eee\u1ef0\xdb\xdc\u016e\u016a","y\xfd\u1ef3\u1ef7\u1ef9\u1ef5\xffY\xdd\u1ef2\u1ef6\u1ef8\u1ef4\u0178","z\u017e\u017c\u017aZ\u017d\u017b\u0179"],r=[];return e.split("").forEach((function(a){n.every((function(n){if(-1!==n.indexOf(a)){if(r.indexOf(n)>-1)return!1;e=e.replace(new RegExp("["+n+"]","gm"+t),"["+n+"]"),r.push(n)}return!0}))})),e}},{key:"createMergedBlanksRegExp",value:function(e){return e.replace(/[\s]+/gim,"[\\s]+")}},{key:"createAccuracyRegExp",value:function(e){var t=this,n="!\"#$%&'()*+,-./:;<=>?@[\\]^_`{|}~\xa1\xbf",r=this.opt.accuracy,a="string"==typeof r?r:r.value,o="string"==typeof r?[]:r.limiters,i="";switch(o.forEach((function(e){i+="|"+t.escapeStr(e)})),a){case"partially":default:return"()("+e+")";case"complementary":return"()([^"+(i="\\s"+(i||this.escapeStr(n)))+"]*"+e+"[^"+i+"]*)";case"exactly":return"(^|\\s"+i+")("+e+")(?=$|\\s"+i+")"}}},{key:"getSeparatedKeywords",value:function(e){var t=this,n=[];return e.forEach((function(e){t.opt.separateWordSearch?e.split(" ").forEach((function(e){e.trim()&&-1===n.indexOf(e)&&n.push(e)})):e.trim()&&-1===n.indexOf(e)&&n.push(e)})),{keywords:n.sort((function(e,t){return t.length-e.length})),length:n.length}}},{key:"isNumeric",value:function(e){return Number(parseFloat(e))==e}},{key:"checkRanges",value:function(e){var t=this;if(!Array.isArray(e)||"[object Object]"!==Object.prototype.toString.call(e[0]))return this.log("markRanges() will only accept an array of objects"),this.opt.noMatch(e),[];var n=[],r=0;return e.sort((function(e,t){return e.start-t.start})).forEach((function(e){var a=t.callNoMatchOnInvalidRanges(e,r),o=a.start,i=a.end;a.valid&&(e.start=o,e.length=i-o,n.push(e),r=i)})),n}},{key:"callNoMatchOnInvalidRanges",value:function(e,t){var n=void 0,r=void 0,a=!1;return e&&void 0!==e.start?(r=(n=parseInt(e.start,10))+parseInt(e.length,10),this.isNumeric(e.start)&&this.isNumeric(e.length)&&r-t>0&&r-n>0?a=!0:(this.log("Ignoring invalid or overlapping range: "+JSON.stringify(e)),this.opt.noMatch(e))):(this.log("Ignoring invalid range: "+JSON.stringify(e)),this.opt.noMatch(e)),{start:n,end:r,valid:a}}},{key:"checkWhitespaceRanges",value:function(e,t,n){var r=void 0,a=!0,o=n.length,i=t-o,s=parseInt(e.start,10)-i;return(r=(s=s>o?o:s)+parseInt(e.length,10))>o&&(r=o,this.log("End range automatically set to the max value of "+o)),s<0||r-s<0||s>o||r>o?(a=!1,this.log("Invalid range: "+JSON.stringify(e)),this.opt.noMatch(e)):""===n.substring(s,r).replace(/\s+/g,"")&&(a=!1,this.log("Skipping whitespace only range: "+JSON.stringify(e)),this.opt.noMatch(e)),{start:s,end:r,valid:a}}},{key:"getTextNodes",value:function(e){var t=this,n="",r=[];this.iterator.forEachNode(NodeFilter.SHOW_TEXT,(function(e){r.push({start:n.length,end:(n+=e.textContent).length,node:e})}),(function(e){return t.matchesExclude(e.parentNode)?NodeFilter.FILTER_REJECT:NodeFilter.FILTER_ACCEPT}),(function(){e({value:n,nodes:r})}))}},{key:"matchesExclude",value:function(e){return a.matches(e,this.opt.exclude.concat(["script","style","title","head","html"]))}},{key:"wrapRangeInTextNode",value:function(e,t,n){var r=this.opt.element?this.opt.element:"mark",a=e.splitText(t),o=a.splitText(n-t),i=document.createElement(r);return i.setAttribute("data-markjs","true"),this.opt.className&&i.setAttribute("class",this.opt.className),i.textContent=a.textContent,a.parentNode.replaceChild(i,a),o}},{key:"wrapRangeInMappedTextNode",value:function(e,t,n,r,a){var o=this;e.nodes.every((function(i,s){var l=e.nodes[s+1];if(void 0===l||l.start>t){if(!r(i.node))return!1;var c=t-i.start,u=(n>i.end?i.end:n)-i.start,d=e.value.substr(0,i.start),p=e.value.substr(u+i.start);if(i.node=o.wrapRangeInTextNode(i.node,c,u),e.value=d+p,e.nodes.forEach((function(t,n){n>=s&&(e.nodes[n].start>0&&n!==s&&(e.nodes[n].start-=u),e.nodes[n].end-=u)})),n-=u,a(i.node.previousSibling,i.start),!(n>i.end))return!1;t=i.end}return!0}))}},{key:"wrapMatches",value:function(e,t,n,r,a){var o=this,i=0===t?0:t+1;this.getTextNodes((function(t){t.nodes.forEach((function(t){t=t.node;for(var a=void 0;null!==(a=e.exec(t.textContent))&&""!==a[i];)if(n(a[i],t)){var s=a.index;if(0!==i)for(var l=1;l{"use strict";n.r(t)},2295:(e,t,n)=>{"use strict";n.r(t)},4865:function(e,t,n){var r,a;r=function(){var e,t,n={version:"0.2.0"},r=n.settings={minimum:.08,easing:"ease",positionUsing:"",speed:200,trickle:!0,trickleRate:.02,trickleSpeed:800,showSpinner:!0,barSelector:'[role="bar"]',spinnerSelector:'[role="spinner"]',parent:"body",template:'
'};function a(e,t,n){return en?n:e}function o(e){return 100*(-1+e)}function i(e,t,n){var a;return(a="translate3d"===r.positionUsing?{transform:"translate3d("+o(e)+"%,0,0)"}:"translate"===r.positionUsing?{transform:"translate("+o(e)+"%,0)"}:{"margin-left":o(e)+"%"}).transition="all "+t+"ms "+n,a}n.configure=function(e){var t,n;for(t in e)void 0!==(n=e[t])&&e.hasOwnProperty(t)&&(r[t]=n);return this},n.status=null,n.set=function(e){var t=n.isStarted();e=a(e,r.minimum,1),n.status=1===e?null:e;var o=n.render(!t),c=o.querySelector(r.barSelector),u=r.speed,d=r.easing;return o.offsetWidth,s((function(t){""===r.positionUsing&&(r.positionUsing=n.getPositioningCSS()),l(c,i(e,u,d)),1===e?(l(o,{transition:"none",opacity:1}),o.offsetWidth,setTimeout((function(){l(o,{transition:"all "+u+"ms linear",opacity:0}),setTimeout((function(){n.remove(),t()}),u)}),u)):setTimeout(t,u)})),this},n.isStarted=function(){return"number"==typeof n.status},n.start=function(){n.status||n.set(0);var e=function(){setTimeout((function(){n.status&&(n.trickle(),e())}),r.trickleSpeed)};return r.trickle&&e(),this},n.done=function(e){return e||n.status?n.inc(.3+.5*Math.random()).set(1):this},n.inc=function(e){var t=n.status;return t?("number"!=typeof e&&(e=(1-t)*a(Math.random()*t,.1,.95)),t=a(t+e,0,.994),n.set(t)):n.start()},n.trickle=function(){return n.inc(Math.random()*r.trickleRate)},e=0,t=0,n.promise=function(r){return r&&"resolved"!==r.state()?(0===t&&n.start(),e++,t++,r.always((function(){0==--t?(e=0,n.done()):n.set((e-t)/e)})),this):this},n.render=function(e){if(n.isRendered())return document.getElementById("nprogress");u(document.documentElement,"nprogress-busy");var t=document.createElement("div");t.id="nprogress",t.innerHTML=r.template;var a,i=t.querySelector(r.barSelector),s=e?"-100":o(n.status||0),c=document.querySelector(r.parent);return l(i,{transition:"all 0 linear",transform:"translate3d("+s+"%,0,0)"}),r.showSpinner||(a=t.querySelector(r.spinnerSelector))&&f(a),c!=document.body&&u(c,"nprogress-custom-parent"),c.appendChild(t),t},n.remove=function(){d(document.documentElement,"nprogress-busy"),d(document.querySelector(r.parent),"nprogress-custom-parent");var e=document.getElementById("nprogress");e&&f(e)},n.isRendered=function(){return!!document.getElementById("nprogress")},n.getPositioningCSS=function(){var e=document.body.style,t="WebkitTransform"in e?"Webkit":"MozTransform"in e?"Moz":"msTransform"in e?"ms":"OTransform"in e?"O":"";return t+"Perspective"in e?"translate3d":t+"Transform"in e?"translate":"margin"};var s=function(){var e=[];function t(){var n=e.shift();n&&n(t)}return function(n){e.push(n),1==e.length&&t()}}(),l=function(){var e=["Webkit","O","Moz","ms"],t={};function n(e){return e.replace(/^-ms-/,"ms-").replace(/-([\da-z])/gi,(function(e,t){return t.toUpperCase()}))}function r(t){var n=document.body.style;if(t in n)return t;for(var r,a=e.length,o=t.charAt(0).toUpperCase()+t.slice(1);a--;)if((r=e[a]+o)in n)return r;return t}function a(e){return e=n(e),t[e]||(t[e]=r(e))}function o(e,t,n){t=a(t),e.style[t]=n}return function(e,t){var n,r,a=arguments;if(2==a.length)for(n in t)void 0!==(r=t[n])&&t.hasOwnProperty(n)&&o(e,n,r);else o(e,a[1],a[2])}}();function c(e,t){return("string"==typeof e?e:p(e)).indexOf(" "+t+" ")>=0}function u(e,t){var n=p(e),r=n+t;c(n,t)||(e.className=r.substring(1))}function d(e,t){var n,r=p(e);c(e,t)&&(n=r.replace(" "+t+" "," "),e.className=n.substring(1,n.length-1))}function p(e){return(" "+(e.className||"")+" ").replace(/\s+/gi," ")}function f(e){e&&e.parentNode&&e.parentNode.removeChild(e)}return n},void 0===(a="function"==typeof r?r.call(t,n,t,e):r)||(e.exports=a)},9901:e=>{e.exports&&(e.exports={core:{meta:{path:"components/prism-core.js",option:"mandatory"},core:"Core"},themes:{meta:{path:"themes/{id}.css",link:"index.html?theme={id}",exclusive:!0},prism:{title:"Default",option:"default"},"prism-dark":"Dark","prism-funky":"Funky","prism-okaidia":{title:"Okaidia",owner:"ocodia"},"prism-twilight":{title:"Twilight",owner:"remybach"},"prism-coy":{title:"Coy",owner:"tshedor"},"prism-solarizedlight":{title:"Solarized Light",owner:"hectormatos2011 "},"prism-tomorrow":{title:"Tomorrow Night",owner:"Rosey"}},languages:{meta:{path:"components/prism-{id}",noCSS:!0,examplesPath:"examples/prism-{id}",addCheckAll:!0},markup:{title:"Markup",alias:["html","xml","svg","mathml","ssml","atom","rss"],aliasTitles:{html:"HTML",xml:"XML",svg:"SVG",mathml:"MathML",ssml:"SSML",atom:"Atom",rss:"RSS"},option:"default"},css:{title:"CSS",option:"default",modify:"markup"},clike:{title:"C-like",option:"default"},javascript:{title:"JavaScript",require:"clike",modify:"markup",optional:"regex",alias:"js",option:"default"},abap:{title:"ABAP",owner:"dellagustin"},abnf:{title:"ABNF",owner:"RunDevelopment"},actionscript:{title:"ActionScript",require:"javascript",modify:"markup",owner:"Golmote"},ada:{title:"Ada",owner:"Lucretia"},agda:{title:"Agda",owner:"xy-ren"},al:{title:"AL",owner:"RunDevelopment"},antlr4:{title:"ANTLR4",alias:"g4",owner:"RunDevelopment"},apacheconf:{title:"Apache Configuration",owner:"GuiTeK"},apex:{title:"Apex",require:["clike","sql"],owner:"RunDevelopment"},apl:{title:"APL",owner:"ngn"},applescript:{title:"AppleScript",owner:"Golmote"},aql:{title:"AQL",owner:"RunDevelopment"},arduino:{title:"Arduino",require:"cpp",alias:"ino",owner:"dkern"},arff:{title:"ARFF",owner:"Golmote"},armasm:{title:"ARM Assembly",alias:"arm-asm",owner:"RunDevelopment"},arturo:{title:"Arturo",alias:"art",optional:["bash","css","javascript","markup","markdown","sql"],owner:"drkameleon"},asciidoc:{alias:"adoc",title:"AsciiDoc",owner:"Golmote"},aspnet:{title:"ASP.NET (C#)",require:["markup","csharp"],owner:"nauzilus"},asm6502:{title:"6502 Assembly",owner:"kzurawel"},asmatmel:{title:"Atmel AVR Assembly",owner:"cerkit"},autohotkey:{title:"AutoHotkey",owner:"aviaryan"},autoit:{title:"AutoIt",owner:"Golmote"},avisynth:{title:"AviSynth",alias:"avs",owner:"Zinfidel"},"avro-idl":{title:"Avro IDL",alias:"avdl",owner:"RunDevelopment"},awk:{title:"AWK",alias:"gawk",aliasTitles:{gawk:"GAWK"},owner:"RunDevelopment"},bash:{title:"Bash",alias:["sh","shell"],aliasTitles:{sh:"Shell",shell:"Shell"},owner:"zeitgeist87"},basic:{title:"BASIC",owner:"Golmote"},batch:{title:"Batch",owner:"Golmote"},bbcode:{title:"BBcode",alias:"shortcode",aliasTitles:{shortcode:"Shortcode"},owner:"RunDevelopment"},bbj:{title:"BBj",owner:"hyyan"},bicep:{title:"Bicep",owner:"johnnyreilly"},birb:{title:"Birb",require:"clike",owner:"Calamity210"},bison:{title:"Bison",require:"c",owner:"Golmote"},bnf:{title:"BNF",alias:"rbnf",aliasTitles:{rbnf:"RBNF"},owner:"RunDevelopment"},bqn:{title:"BQN",owner:"yewscion"},brainfuck:{title:"Brainfuck",owner:"Golmote"},brightscript:{title:"BrightScript",owner:"RunDevelopment"},bro:{title:"Bro",owner:"wayward710"},bsl:{title:"BSL (1C:Enterprise)",alias:"oscript",aliasTitles:{oscript:"OneScript"},owner:"Diversus23"},c:{title:"C",require:"clike",owner:"zeitgeist87"},csharp:{title:"C#",require:"clike",alias:["cs","dotnet"],owner:"mvalipour"},cpp:{title:"C++",require:"c",owner:"zeitgeist87"},cfscript:{title:"CFScript",require:"clike",alias:"cfc",owner:"mjclemente"},chaiscript:{title:"ChaiScript",require:["clike","cpp"],owner:"RunDevelopment"},cil:{title:"CIL",owner:"sbrl"},cilkc:{title:"Cilk/C",require:"c",alias:"cilk-c",owner:"OpenCilk"},cilkcpp:{title:"Cilk/C++",require:"cpp",alias:["cilk-cpp","cilk"],owner:"OpenCilk"},clojure:{title:"Clojure",owner:"troglotit"},cmake:{title:"CMake",owner:"mjrogozinski"},cobol:{title:"COBOL",owner:"RunDevelopment"},coffeescript:{title:"CoffeeScript",require:"javascript",alias:"coffee",owner:"R-osey"},concurnas:{title:"Concurnas",alias:"conc",owner:"jasontatton"},csp:{title:"Content-Security-Policy",owner:"ScottHelme"},cooklang:{title:"Cooklang",owner:"ahue"},coq:{title:"Coq",owner:"RunDevelopment"},crystal:{title:"Crystal",require:"ruby",owner:"MakeNowJust"},"css-extras":{title:"CSS Extras",require:"css",modify:"css",owner:"milesj"},csv:{title:"CSV",owner:"RunDevelopment"},cue:{title:"CUE",owner:"RunDevelopment"},cypher:{title:"Cypher",owner:"RunDevelopment"},d:{title:"D",require:"clike",owner:"Golmote"},dart:{title:"Dart",require:"clike",owner:"Golmote"},dataweave:{title:"DataWeave",owner:"machaval"},dax:{title:"DAX",owner:"peterbud"},dhall:{title:"Dhall",owner:"RunDevelopment"},diff:{title:"Diff",owner:"uranusjr"},django:{title:"Django/Jinja2",require:"markup-templating",alias:"jinja2",owner:"romanvm"},"dns-zone-file":{title:"DNS zone file",owner:"RunDevelopment",alias:"dns-zone"},docker:{title:"Docker",alias:"dockerfile",owner:"JustinBeckwith"},dot:{title:"DOT (Graphviz)",alias:"gv",optional:"markup",owner:"RunDevelopment"},ebnf:{title:"EBNF",owner:"RunDevelopment"},editorconfig:{title:"EditorConfig",owner:"osipxd"},eiffel:{title:"Eiffel",owner:"Conaclos"},ejs:{title:"EJS",require:["javascript","markup-templating"],owner:"RunDevelopment",alias:"eta",aliasTitles:{eta:"Eta"}},elixir:{title:"Elixir",owner:"Golmote"},elm:{title:"Elm",owner:"zwilias"},etlua:{title:"Embedded Lua templating",require:["lua","markup-templating"],owner:"RunDevelopment"},erb:{title:"ERB",require:["ruby","markup-templating"],owner:"Golmote"},erlang:{title:"Erlang",owner:"Golmote"},"excel-formula":{title:"Excel Formula",alias:["xlsx","xls"],owner:"RunDevelopment"},fsharp:{title:"F#",require:"clike",owner:"simonreynolds7"},factor:{title:"Factor",owner:"catb0t"},false:{title:"False",owner:"edukisto"},"firestore-security-rules":{title:"Firestore security rules",require:"clike",owner:"RunDevelopment"},flow:{title:"Flow",require:"javascript",owner:"Golmote"},fortran:{title:"Fortran",owner:"Golmote"},ftl:{title:"FreeMarker Template Language",require:"markup-templating",owner:"RunDevelopment"},gml:{title:"GameMaker Language",alias:"gamemakerlanguage",require:"clike",owner:"LiarOnce"},gap:{title:"GAP (CAS)",owner:"RunDevelopment"},gcode:{title:"G-code",owner:"RunDevelopment"},gdscript:{title:"GDScript",owner:"RunDevelopment"},gedcom:{title:"GEDCOM",owner:"Golmote"},gettext:{title:"gettext",alias:"po",owner:"RunDevelopment"},gherkin:{title:"Gherkin",owner:"hason"},git:{title:"Git",owner:"lgiraudel"},glsl:{title:"GLSL",require:"c",owner:"Golmote"},gn:{title:"GN",alias:"gni",owner:"RunDevelopment"},"linker-script":{title:"GNU Linker Script",alias:"ld",owner:"RunDevelopment"},go:{title:"Go",require:"clike",owner:"arnehormann"},"go-module":{title:"Go module",alias:"go-mod",owner:"RunDevelopment"},gradle:{title:"Gradle",require:"clike",owner:"zeabdelkhalek-badido18"},graphql:{title:"GraphQL",optional:"markdown",owner:"Golmote"},groovy:{title:"Groovy",require:"clike",owner:"robfletcher"},haml:{title:"Haml",require:"ruby",optional:["css","css-extras","coffeescript","erb","javascript","less","markdown","scss","textile"],owner:"Golmote"},handlebars:{title:"Handlebars",require:"markup-templating",alias:["hbs","mustache"],aliasTitles:{mustache:"Mustache"},owner:"Golmote"},haskell:{title:"Haskell",alias:"hs",owner:"bholst"},haxe:{title:"Haxe",require:"clike",optional:"regex",owner:"Golmote"},hcl:{title:"HCL",owner:"outsideris"},hlsl:{title:"HLSL",require:"c",owner:"RunDevelopment"},hoon:{title:"Hoon",owner:"matildepark"},http:{title:"HTTP",optional:["csp","css","hpkp","hsts","javascript","json","markup","uri"],owner:"danielgtaylor"},hpkp:{title:"HTTP Public-Key-Pins",owner:"ScottHelme"},hsts:{title:"HTTP Strict-Transport-Security",owner:"ScottHelme"},ichigojam:{title:"IchigoJam",owner:"BlueCocoa"},icon:{title:"Icon",owner:"Golmote"},"icu-message-format":{title:"ICU Message Format",owner:"RunDevelopment"},idris:{title:"Idris",alias:"idr",owner:"KeenS",require:"haskell"},ignore:{title:".ignore",owner:"osipxd",alias:["gitignore","hgignore","npmignore"],aliasTitles:{gitignore:".gitignore",hgignore:".hgignore",npmignore:".npmignore"}},inform7:{title:"Inform 7",owner:"Golmote"},ini:{title:"Ini",owner:"aviaryan"},io:{title:"Io",owner:"AlesTsurko"},j:{title:"J",owner:"Golmote"},java:{title:"Java",require:"clike",owner:"sherblot"},javadoc:{title:"JavaDoc",require:["markup","java","javadoclike"],modify:"java",optional:"scala",owner:"RunDevelopment"},javadoclike:{title:"JavaDoc-like",modify:["java","javascript","php"],owner:"RunDevelopment"},javastacktrace:{title:"Java stack trace",owner:"RunDevelopment"},jexl:{title:"Jexl",owner:"czosel"},jolie:{title:"Jolie",require:"clike",owner:"thesave"},jq:{title:"JQ",owner:"RunDevelopment"},jsdoc:{title:"JSDoc",require:["javascript","javadoclike","typescript"],modify:"javascript",optional:["actionscript","coffeescript"],owner:"RunDevelopment"},"js-extras":{title:"JS Extras",require:"javascript",modify:"javascript",optional:["actionscript","coffeescript","flow","n4js","typescript"],owner:"RunDevelopment"},json:{title:"JSON",alias:"webmanifest",aliasTitles:{webmanifest:"Web App Manifest"},owner:"CupOfTea696"},json5:{title:"JSON5",require:"json",owner:"RunDevelopment"},jsonp:{title:"JSONP",require:"json",owner:"RunDevelopment"},jsstacktrace:{title:"JS stack trace",owner:"sbrl"},"js-templates":{title:"JS Templates",require:"javascript",modify:"javascript",optional:["css","css-extras","graphql","markdown","markup","sql"],owner:"RunDevelopment"},julia:{title:"Julia",owner:"cdagnino"},keepalived:{title:"Keepalived Configure",owner:"dev-itsheng"},keyman:{title:"Keyman",owner:"mcdurdin"},kotlin:{title:"Kotlin",alias:["kt","kts"],aliasTitles:{kts:"Kotlin Script"},require:"clike",owner:"Golmote"},kumir:{title:"KuMir (\u041a\u0443\u041c\u0438\u0440)",alias:"kum",owner:"edukisto"},kusto:{title:"Kusto",owner:"RunDevelopment"},latex:{title:"LaTeX",alias:["tex","context"],aliasTitles:{tex:"TeX",context:"ConTeXt"},owner:"japborst"},latte:{title:"Latte",require:["clike","markup-templating","php"],owner:"nette"},less:{title:"Less",require:"css",optional:"css-extras",owner:"Golmote"},lilypond:{title:"LilyPond",require:"scheme",alias:"ly",owner:"RunDevelopment"},liquid:{title:"Liquid",require:"markup-templating",owner:"cinhtau"},lisp:{title:"Lisp",alias:["emacs","elisp","emacs-lisp"],owner:"JuanCaicedo"},livescript:{title:"LiveScript",owner:"Golmote"},llvm:{title:"LLVM IR",owner:"porglezomp"},log:{title:"Log file",optional:"javastacktrace",owner:"RunDevelopment"},lolcode:{title:"LOLCODE",owner:"Golmote"},lua:{title:"Lua",owner:"Golmote"},magma:{title:"Magma (CAS)",owner:"RunDevelopment"},makefile:{title:"Makefile",owner:"Golmote"},markdown:{title:"Markdown",require:"markup",optional:"yaml",alias:"md",owner:"Golmote"},"markup-templating":{title:"Markup templating",require:"markup",owner:"Golmote"},mata:{title:"Mata",owner:"RunDevelopment"},matlab:{title:"MATLAB",owner:"Golmote"},maxscript:{title:"MAXScript",owner:"RunDevelopment"},mel:{title:"MEL",owner:"Golmote"},mermaid:{title:"Mermaid",owner:"RunDevelopment"},metafont:{title:"METAFONT",owner:"LaeriExNihilo"},mizar:{title:"Mizar",owner:"Golmote"},mongodb:{title:"MongoDB",owner:"airs0urce",require:"javascript"},monkey:{title:"Monkey",owner:"Golmote"},moonscript:{title:"MoonScript",alias:"moon",owner:"RunDevelopment"},n1ql:{title:"N1QL",owner:"TMWilds"},n4js:{title:"N4JS",require:"javascript",optional:"jsdoc",alias:"n4jsd",owner:"bsmith-n4"},"nand2tetris-hdl":{title:"Nand To Tetris HDL",owner:"stephanmax"},naniscript:{title:"Naninovel Script",owner:"Elringus",alias:"nani"},nasm:{title:"NASM",owner:"rbmj"},neon:{title:"NEON",owner:"nette"},nevod:{title:"Nevod",owner:"nezaboodka"},nginx:{title:"nginx",owner:"volado"},nim:{title:"Nim",owner:"Golmote"},nix:{title:"Nix",owner:"Golmote"},nsis:{title:"NSIS",owner:"idleberg"},objectivec:{title:"Objective-C",require:"c",alias:"objc",owner:"uranusjr"},ocaml:{title:"OCaml",owner:"Golmote"},odin:{title:"Odin",owner:"edukisto"},opencl:{title:"OpenCL",require:"c",modify:["c","cpp"],owner:"Milania1"},openqasm:{title:"OpenQasm",alias:"qasm",owner:"RunDevelopment"},oz:{title:"Oz",owner:"Golmote"},parigp:{title:"PARI/GP",owner:"Golmote"},parser:{title:"Parser",require:"markup",owner:"Golmote"},pascal:{title:"Pascal",alias:"objectpascal",aliasTitles:{objectpascal:"Object Pascal"},owner:"Golmote"},pascaligo:{title:"Pascaligo",owner:"DefinitelyNotAGoat"},psl:{title:"PATROL Scripting Language",owner:"bertysentry"},pcaxis:{title:"PC-Axis",alias:"px",owner:"RunDevelopment"},peoplecode:{title:"PeopleCode",alias:"pcode",owner:"RunDevelopment"},perl:{title:"Perl",owner:"Golmote"},php:{title:"PHP",require:"markup-templating",owner:"milesj"},phpdoc:{title:"PHPDoc",require:["php","javadoclike"],modify:"php",owner:"RunDevelopment"},"php-extras":{title:"PHP Extras",require:"php",modify:"php",owner:"milesj"},"plant-uml":{title:"PlantUML",alias:"plantuml",owner:"RunDevelopment"},plsql:{title:"PL/SQL",require:"sql",owner:"Golmote"},powerquery:{title:"PowerQuery",alias:["pq","mscript"],owner:"peterbud"},powershell:{title:"PowerShell",owner:"nauzilus"},processing:{title:"Processing",require:"clike",owner:"Golmote"},prolog:{title:"Prolog",owner:"Golmote"},promql:{title:"PromQL",owner:"arendjr"},properties:{title:".properties",owner:"Golmote"},protobuf:{title:"Protocol Buffers",require:"clike",owner:"just-boris"},pug:{title:"Pug",require:["markup","javascript"],optional:["coffeescript","ejs","handlebars","less","livescript","markdown","scss","stylus","twig"],owner:"Golmote"},puppet:{title:"Puppet",owner:"Golmote"},pure:{title:"Pure",optional:["c","cpp","fortran"],owner:"Golmote"},purebasic:{title:"PureBasic",require:"clike",alias:"pbfasm",owner:"HeX0R101"},purescript:{title:"PureScript",require:"haskell",alias:"purs",owner:"sriharshachilakapati"},python:{title:"Python",alias:"py",owner:"multipetros"},qsharp:{title:"Q#",require:"clike",alias:"qs",owner:"fedonman"},q:{title:"Q (kdb+ database)",owner:"Golmote"},qml:{title:"QML",require:"javascript",owner:"RunDevelopment"},qore:{title:"Qore",require:"clike",owner:"temnroegg"},r:{title:"R",owner:"Golmote"},racket:{title:"Racket",require:"scheme",alias:"rkt",owner:"RunDevelopment"},cshtml:{title:"Razor C#",alias:"razor",require:["markup","csharp"],optional:["css","css-extras","javascript","js-extras"],owner:"RunDevelopment"},jsx:{title:"React JSX",require:["markup","javascript"],optional:["jsdoc","js-extras","js-templates"],owner:"vkbansal"},tsx:{title:"React TSX",require:["jsx","typescript"]},reason:{title:"Reason",require:"clike",owner:"Golmote"},regex:{title:"Regex",owner:"RunDevelopment"},rego:{title:"Rego",owner:"JordanSh"},renpy:{title:"Ren'py",alias:"rpy",owner:"HyuchiaDiego"},rescript:{title:"ReScript",alias:"res",owner:"vmarcosp"},rest:{title:"reST (reStructuredText)",owner:"Golmote"},rip:{title:"Rip",owner:"ravinggenius"},roboconf:{title:"Roboconf",owner:"Golmote"},robotframework:{title:"Robot Framework",alias:"robot",owner:"RunDevelopment"},ruby:{title:"Ruby",require:"clike",alias:"rb",owner:"samflores"},rust:{title:"Rust",owner:"Golmote"},sas:{title:"SAS",optional:["groovy","lua","sql"],owner:"Golmote"},sass:{title:"Sass (Sass)",require:"css",optional:"css-extras",owner:"Golmote"},scss:{title:"Sass (SCSS)",require:"css",optional:"css-extras",owner:"MoOx"},scala:{title:"Scala",require:"java",owner:"jozic"},scheme:{title:"Scheme",owner:"bacchus123"},"shell-session":{title:"Shell session",require:"bash",alias:["sh-session","shellsession"],owner:"RunDevelopment"},smali:{title:"Smali",owner:"RunDevelopment"},smalltalk:{title:"Smalltalk",owner:"Golmote"},smarty:{title:"Smarty",require:"markup-templating",optional:"php",owner:"Golmote"},sml:{title:"SML",alias:"smlnj",aliasTitles:{smlnj:"SML/NJ"},owner:"RunDevelopment"},solidity:{title:"Solidity (Ethereum)",alias:"sol",require:"clike",owner:"glachaud"},"solution-file":{title:"Solution file",alias:"sln",owner:"RunDevelopment"},soy:{title:"Soy (Closure Template)",require:"markup-templating",owner:"Golmote"},sparql:{title:"SPARQL",require:"turtle",owner:"Triply-Dev",alias:"rq"},"splunk-spl":{title:"Splunk SPL",owner:"RunDevelopment"},sqf:{title:"SQF: Status Quo Function (Arma 3)",require:"clike",owner:"RunDevelopment"},sql:{title:"SQL",owner:"multipetros"},squirrel:{title:"Squirrel",require:"clike",owner:"RunDevelopment"},stan:{title:"Stan",owner:"RunDevelopment"},stata:{title:"Stata Ado",require:["mata","java","python"],owner:"RunDevelopment"},iecst:{title:"Structured Text (IEC 61131-3)",owner:"serhioromano"},stylus:{title:"Stylus",owner:"vkbansal"},supercollider:{title:"SuperCollider",alias:"sclang",owner:"RunDevelopment"},swift:{title:"Swift",owner:"chrischares"},systemd:{title:"Systemd configuration file",owner:"RunDevelopment"},"t4-templating":{title:"T4 templating",owner:"RunDevelopment"},"t4-cs":{title:"T4 Text Templates (C#)",require:["t4-templating","csharp"],alias:"t4",owner:"RunDevelopment"},"t4-vb":{title:"T4 Text Templates (VB)",require:["t4-templating","vbnet"],owner:"RunDevelopment"},tap:{title:"TAP",owner:"isaacs",require:"yaml"},tcl:{title:"Tcl",owner:"PeterChaplin"},tt2:{title:"Template Toolkit 2",require:["clike","markup-templating"],owner:"gflohr"},textile:{title:"Textile",require:"markup",optional:"css",owner:"Golmote"},toml:{title:"TOML",owner:"RunDevelopment"},tremor:{title:"Tremor",alias:["trickle","troy"],owner:"darach",aliasTitles:{trickle:"trickle",troy:"troy"}},turtle:{title:"Turtle",alias:"trig",aliasTitles:{trig:"TriG"},owner:"jakubklimek"},twig:{title:"Twig",require:"markup-templating",owner:"brandonkelly"},typescript:{title:"TypeScript",require:"javascript",optional:"js-templates",alias:"ts",owner:"vkbansal"},typoscript:{title:"TypoScript",alias:"tsconfig",aliasTitles:{tsconfig:"TSConfig"},owner:"dkern"},unrealscript:{title:"UnrealScript",alias:["uscript","uc"],owner:"RunDevelopment"},uorazor:{title:"UO Razor Script",owner:"jaseowns"},uri:{title:"URI",alias:"url",aliasTitles:{url:"URL"},owner:"RunDevelopment"},v:{title:"V",require:"clike",owner:"taggon"},vala:{title:"Vala",require:"clike",optional:"regex",owner:"TemplarVolk"},vbnet:{title:"VB.Net",require:"basic",owner:"Bigsby"},velocity:{title:"Velocity",require:"markup",owner:"Golmote"},verilog:{title:"Verilog",owner:"a-rey"},vhdl:{title:"VHDL",owner:"a-rey"},vim:{title:"vim",owner:"westonganger"},"visual-basic":{title:"Visual Basic",alias:["vb","vba"],aliasTitles:{vba:"VBA"},owner:"Golmote"},warpscript:{title:"WarpScript",owner:"RunDevelopment"},wasm:{title:"WebAssembly",owner:"Golmote"},"web-idl":{title:"Web IDL",alias:"webidl",owner:"RunDevelopment"},wgsl:{title:"WGSL",owner:"Dr4gonthree"},wiki:{title:"Wiki markup",require:"markup",owner:"Golmote"},wolfram:{title:"Wolfram language",alias:["mathematica","nb","wl"],aliasTitles:{mathematica:"Mathematica",nb:"Mathematica Notebook"},owner:"msollami"},wren:{title:"Wren",owner:"clsource"},xeora:{title:"Xeora",require:"markup",alias:"xeoracube",aliasTitles:{xeoracube:"XeoraCube"},owner:"freakmaxi"},"xml-doc":{title:"XML doc (.net)",require:"markup",modify:["csharp","fsharp","vbnet"],owner:"RunDevelopment"},xojo:{title:"Xojo (REALbasic)",owner:"Golmote"},xquery:{title:"XQuery",require:"markup",owner:"Golmote"},yaml:{title:"YAML",alias:"yml",owner:"hason"},yang:{title:"YANG",owner:"RunDevelopment"},zig:{title:"Zig",owner:"RunDevelopment"}},plugins:{meta:{path:"plugins/{id}/prism-{id}",link:"plugins/{id}/"},"line-highlight":{title:"Line Highlight",description:"Highlights specific lines and/or line ranges."},"line-numbers":{title:"Line Numbers",description:"Line number at the beginning of code lines.",owner:"kuba-kubula"},"show-invisibles":{title:"Show Invisibles",description:"Show hidden characters such as tabs and line breaks.",optional:["autolinker","data-uri-highlight"]},autolinker:{title:"Autolinker",description:"Converts URLs and emails in code to clickable links. Parses Markdown links in comments."},wpd:{title:"WebPlatform Docs",description:'Makes tokens link to WebPlatform.org documentation. The links open in a new tab.'},"custom-class":{title:"Custom Class",description:"This plugin allows you to prefix Prism's default classes (.comment can become .namespace--comment) or replace them with your defined ones (like .editor__comment). You can even add new classes.",owner:"dvkndn",noCSS:!0},"file-highlight":{title:"File Highlight",description:"Fetch external files and highlight them with Prism. Used on the Prism website itself.",noCSS:!0},"show-language":{title:"Show Language",description:"Display the highlighted language in code blocks (inline code does not show the label).",owner:"nauzilus",noCSS:!0,require:"toolbar"},"jsonp-highlight":{title:"JSONP Highlight",description:"Fetch content with JSONP and highlight some interesting content (e.g. GitHub/Gists or Bitbucket API).",noCSS:!0,owner:"nauzilus"},"highlight-keywords":{title:"Highlight Keywords",description:"Adds special CSS classes for each keyword for fine-grained highlighting.",owner:"vkbansal",noCSS:!0},"remove-initial-line-feed":{title:"Remove initial line feed",description:"Removes the initial line feed in code blocks.",owner:"Golmote",noCSS:!0},"inline-color":{title:"Inline color",description:"Adds a small inline preview for colors in style sheets.",require:"css-extras",owner:"RunDevelopment"},previewers:{title:"Previewers",description:"Previewers for angles, colors, gradients, easing and time.",require:"css-extras",owner:"Golmote"},autoloader:{title:"Autoloader",description:"Automatically loads the needed languages to highlight the code blocks.",owner:"Golmote",noCSS:!0},"keep-markup":{title:"Keep Markup",description:"Prevents custom markup from being dropped out during highlighting.",owner:"Golmote",optional:"normalize-whitespace",noCSS:!0},"command-line":{title:"Command Line",description:"Display a command line with a prompt and, optionally, the output/response from the commands.",owner:"chriswells0"},"unescaped-markup":{title:"Unescaped Markup",description:"Write markup without having to escape anything."},"normalize-whitespace":{title:"Normalize Whitespace",description:"Supports multiple operations to normalize whitespace in code blocks.",owner:"zeitgeist87",optional:"unescaped-markup",noCSS:!0},"data-uri-highlight":{title:"Data-URI Highlight",description:"Highlights data-URI contents.",owner:"Golmote",noCSS:!0},toolbar:{title:"Toolbar",description:"Attach a toolbar for plugins to easily register buttons on the top of a code block.",owner:"mAAdhaTTah"},"copy-to-clipboard":{title:"Copy to Clipboard Button",description:"Add a button that copies the code block to the clipboard when clicked.",owner:"mAAdhaTTah",require:"toolbar",noCSS:!0},"download-button":{title:"Download Button",description:"A button in the toolbar of a code block adding a convenient way to download a code file.",owner:"Golmote",require:"toolbar",noCSS:!0},"match-braces":{title:"Match braces",description:"Highlights matching braces.",owner:"RunDevelopment"},"diff-highlight":{title:"Diff Highlight",description:"Highlights the code inside diff blocks.",owner:"RunDevelopment",require:"diff"},"filter-highlight-all":{title:"Filter highlightAll",description:"Filters the elements the highlightAll and highlightAllUnder methods actually highlight.",owner:"RunDevelopment",noCSS:!0},treeview:{title:"Treeview",description:"A language with special styles to highlight file system tree structures.",owner:"Golmote"}}})},2885:(e,t,n)=>{const r=n(9901),a=n(9642),o=new Set;function i(e){void 0===e?e=Object.keys(r.languages).filter((e=>"meta"!=e)):Array.isArray(e)||(e=[e]);const t=[...o,...Object.keys(Prism.languages)];a(r,e,t).load((e=>{if(!(e in r.languages))return void(i.silent||console.warn("Language does not exist: "+e));const t="./prism-"+e;delete n.c[n(6500).resolve(t)],delete Prism.languages[e],n(6500)(t),o.add(e)}))}i.silent=!1,e.exports=i},6854:()=>{!function(e){function t(e,t){return"___"+e.toUpperCase()+t+"___"}Object.defineProperties(e.languages["markup-templating"]={},{buildPlaceholders:{value:function(n,r,a,o){if(n.language===r){var i=n.tokenStack=[];n.code=n.code.replace(a,(function(e){if("function"==typeof o&&!o(e))return e;for(var a,s=i.length;-1!==n.code.indexOf(a=t(r,s));)++s;return i[s]=e,a})),n.grammar=e.languages.markup}}},tokenizePlaceholders:{value:function(n,r){if(n.language===r&&n.tokenStack){n.grammar=e.languages[r];var a=0,o=Object.keys(n.tokenStack);!function i(s){for(var l=0;l=o.length);l++){var c=s[l];if("string"==typeof c||c.content&&"string"==typeof c.content){var u=o[a],d=n.tokenStack[u],p="string"==typeof c?c:c.content,f=t(r,u),h=p.indexOf(f);if(h>-1){++a;var m=p.substring(0,h),g=new e.Token(r,e.tokenize(d,n.grammar),"language-"+r,d),y=p.substring(h+f.length),b=[];m&&b.push.apply(b,i([m])),b.push(g),y&&b.push.apply(b,i([y])),"string"==typeof c?s.splice.apply(s,[l,1].concat(b)):c.content=b}}else c.content&&i(c.content)}return s}(n.tokens)}}}})}(Prism)},6726:(e,t,n)=>{var r={"./":2885};function a(e){var t=o(e);return n(t)}function o(e){if(!n.o(r,e)){var t=new Error("Cannot find module '"+e+"'");throw t.code="MODULE_NOT_FOUND",t}return r[e]}a.keys=function(){return Object.keys(r)},a.resolve=o,e.exports=a,a.id=6726},6500:(e,t,n)=>{var r={"./":2885};function a(e){var t=o(e);return n(t)}function o(e){if(!n.o(r,e)){var t=new Error("Cannot find module '"+e+"'");throw t.code="MODULE_NOT_FOUND",t}return r[e]}a.keys=function(){return Object.keys(r)},a.resolve=o,e.exports=a,a.id=6500},9642:e=>{"use strict";var t=function(){var e=function(){};function t(e,t){Array.isArray(e)?e.forEach(t):null!=e&&t(e,0)}function n(e){for(var t={},n=0,r=e.length;n "));var s={},l=e[r];if(l){function c(t){if(!(t in e))throw new Error(r+" depends on an unknown component "+t);if(!(t in s))for(var i in a(t,o),s[t]=!0,n[t])s[i]=!0}t(l.require,c),t(l.optional,c),t(l.modify,c)}n[r]=s,o.pop()}}return function(e){var t=n[e];return t||(a(e,r),t=n[e]),t}}function a(e){for(var t in e)return!0;return!1}return function(o,i,s){var l=function(e){var t={};for(var n in e){var r=e[n];for(var a in r)if("meta"!=a){var o=r[a];t[a]="string"==typeof o?{title:o}:o}}return t}(o),c=function(e){var n;return function(r){if(r in e)return r;if(!n)for(var a in n={},e){var o=e[a];t(o&&o.alias,(function(t){if(t in n)throw new Error(t+" cannot be alias for both "+a+" and "+n[t]);if(t in e)throw new Error(t+" cannot be alias of "+a+" because it is a component.");n[t]=a}))}return n[r]||r}}(l);i=i.map(c),s=(s||[]).map(c);var u=n(i),d=n(s);i.forEach((function e(n){var r=l[n];t(r&&r.require,(function(t){t in d||(u[t]=!0,e(t))}))}));for(var p,f=r(l),h=u;a(h);){for(var m in p={},h){var g=l[m];t(g&&g.modify,(function(e){e in d&&(p[e]=!0)}))}for(var y in d)if(!(y in u))for(var b in f(y))if(b in u){p[y]=!0;break}for(var v in h=p)u[v]=!0}var w={getIds:function(){var e=[];return w.load((function(t){e.push(t)})),e},load:function(t,n){return function(t,n,r,a){var o=a?a.series:void 0,i=a?a.parallel:e,s={},l={};function c(e){if(e in s)return s[e];l[e]=!0;var a,u=[];for(var d in t(e))d in n&&u.push(d);if(0===u.length)a=r(e);else{var p=i(u.map((function(e){var t=c(e);return delete l[e],t})));o?a=o(p,(function(){return r(e)})):r(e)}return s[e]=a}for(var u in n)c(u);var d=[];for(var p in l)d.push(s[p]);return i(d)}(f,u,t,n)}};return w}}();e.exports=t},2703:(e,t,n)=>{"use strict";var r=n(414);function a(){}function o(){}o.resetWarningCache=a,e.exports=function(){function e(e,t,n,a,o,i){if(i!==r){var s=new Error("Calling PropTypes validators directly is not supported by the `prop-types` package. Use PropTypes.checkPropTypes() to call them. Read more at http://fb.me/use-check-prop-types");throw s.name="Invariant Violation",s}}function t(){return e}e.isRequired=e;var n={array:e,bigint:e,bool:e,func:e,number:e,object:e,string:e,symbol:e,any:e,arrayOf:t,element:e,elementType:e,instanceOf:t,node:e,objectOf:t,oneOf:t,oneOfType:t,shape:t,exact:t,checkPropTypes:o,resetWarningCache:a};return n.PropTypes=n,n}},5697:(e,t,n)=>{e.exports=n(2703)()},414:e=>{"use strict";e.exports="SECRET_DO_NOT_PASS_THIS_OR_YOU_WILL_BE_FIRED"},4448:(e,t,n)=>{"use strict";var r=n(7294),a=n(3840);function o(e){for(var t="https://reactjs.org/docs/error-decoder.html?invariant="+e,n=1;n