Skip to content

Commit 2fd3565

Browse files
jimmidysonjimmidyson
committed
feat: CIS benchmark improvements
Pulling in most of the changes from #1132. This commit does not include Kubelet CSR Approver because that requires more invasive changes (e.g. deploying the `kubelet-csr-approver` service and reconfiguring kubelet after initial startup.
1 parent 2fa88f6 commit 2fd3565

16 files changed

+431
-37
lines changed

‎charts/cluster-api-runtime-extensions-nutanix/defaultclusterclasses/aws-cluster-class.yaml

Lines changed: 59 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -84,25 +84,74 @@ spec:
8484
clusterConfiguration:
8585
apiServer:
8686
extraArgs:
87+
admission-control-config-file: /etc/kubernetes/admission.yaml
8788
cloud-provider: external
89+
enable-admission-plugins: DenyServiceExternalIPs,EventRateLimit,NodeRestriction
8890
profiling: "false"
91+
service-account-lookup: "true"
92+
extraVolumes:
93+
- hostPath: /etc/kubernetes/admission.yaml
94+
mountPath: /etc/kubernetes/admission.yaml
95+
name: admission-config
96+
pathType: File
97+
readOnly: true
98+
- hostPath: /etc/kubernetes/eventratelimit-config.yaml
99+
mountPath: /etc/kubernetes/eventratelimit-config.yaml
100+
name: eventratelimit-config
101+
pathType: File
102+
readOnly: true
89103
controllerManager:
90104
extraArgs:
91105
cloud-provider: external
92106
profiling: "false"
107+
terminated-pod-gc-threshold: "10000"
93108
scheduler:
94109
extraArgs:
95110
profiling: "false"
111+
files:
112+
- content: |
113+
apiVersion: apiserver.config.k8s.io/v1
114+
kind: AdmissionConfiguration
115+
plugins:
116+
- name: EventRateLimit
117+
path: /etc/kubernetes/eventratelimit-config.yaml
118+
path: /etc/kubernetes/admission.yaml
119+
permissions: "0600"
120+
- content: |
121+
apiVersion: eventratelimit.admission.k8s.io/v1alpha1
122+
kind: Configuration
123+
limits:
124+
- type: Server
125+
qps: 10000
126+
burst: 40000
127+
path: /etc/kubernetes/eventratelimit-config.yaml
128+
permissions: "0600"
96129
initConfiguration:
97130
nodeRegistration:
98131
kubeletExtraArgs:
99132
cloud-provider: external
133+
event-qps: "5"
134+
make-iptables-util-chains: "true"
135+
pod-max-pids: "4096"
136+
read-only-port: "0"
137+
streaming-connection-idle-timeout: 5m
138+
tls-cipher-suites: TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256
100139
name: '{{ ds.meta_data.local_hostname }}'
101140
joinConfiguration:
102141
nodeRegistration:
103142
kubeletExtraArgs:
104143
cloud-provider: external
144+
event-qps: "5"
145+
make-iptables-util-chains: "true"
146+
pod-max-pids: "4096"
147+
read-only-port: "0"
148+
streaming-connection-idle-timeout: 5m
149+
tls-cipher-suites: TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256
105150
name: '{{ ds.meta_data.local_hostname }}'
151+
postKubeadmCommands:
152+
- chmod 600 "$(systemctl show -P FragmentPath kubelet.service)"
153+
- chmod 600 $(systemctl show -P DropInPaths kubelet.service)
154+
- chmod 600 /var/lib/kubelet/config.yaml
106155
---
107156
apiVersion: infrastructure.cluster.x-k8s.io/v1beta2
108157
kind: AWSMachineTemplate
@@ -141,4 +190,14 @@ spec:
141190
nodeRegistration:
142191
kubeletExtraArgs:
143192
cloud-provider: external
193+
event-qps: "5"
194+
make-iptables-util-chains: "true"
195+
pod-max-pids: "4096"
196+
read-only-port: "0"
197+
streaming-connection-idle-timeout: 5m
198+
tls-cipher-suites: TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256
144199
name: '{{ ds.meta_data.local_hostname }}'
200+
postKubeadmCommands:
201+
- chmod 600 "$(systemctl show -P FragmentPath kubelet.service)"
202+
- chmod 600 $(systemctl show -P DropInPaths kubelet.service)
203+
- chmod 600 /var/lib/kubelet/config.yaml

‎charts/cluster-api-runtime-extensions-nutanix/defaultclusterclasses/docker-cluster-class.yaml

Lines changed: 65 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -83,17 +83,68 @@ spec:
8383
clusterConfiguration:
8484
apiServer:
8585
extraArgs:
86+
admission-control-config-file: /etc/kubernetes/admission.yaml
87+
enable-admission-plugins: DenyServiceExternalIPs,EventRateLimit,NodeRestriction
8688
profiling: "false"
89+
service-account-lookup: "true"
90+
extraVolumes:
91+
- hostPath: /etc/kubernetes/admission.yaml
92+
mountPath: /etc/kubernetes/admission.yaml
93+
name: admission-config
94+
pathType: File
95+
readOnly: true
96+
- hostPath: /etc/kubernetes/eventratelimit-config.yaml
97+
mountPath: /etc/kubernetes/eventratelimit-config.yaml
98+
name: eventratelimit-config
99+
pathType: File
100+
readOnly: true
87101
controllerManager:
88102
extraArgs:
89103
profiling: "false"
104+
terminated-pod-gc-threshold: "10000"
90105
scheduler:
91106
extraArgs:
92107
profiling: "false"
108+
files:
109+
- content: |
110+
apiVersion: apiserver.config.k8s.io/v1
111+
kind: AdmissionConfiguration
112+
plugins:
113+
- name: EventRateLimit
114+
path: /etc/kubernetes/eventratelimit-config.yaml
115+
path: /etc/kubernetes/admission.yaml
116+
permissions: "0600"
117+
- content: |
118+
apiVersion: eventratelimit.admission.k8s.io/v1alpha1
119+
kind: Configuration
120+
limits:
121+
- type: Server
122+
qps: 10000
123+
burst: 40000
124+
path: /etc/kubernetes/eventratelimit-config.yaml
125+
permissions: "0600"
93126
initConfiguration:
94-
nodeRegistration: {}
127+
nodeRegistration:
128+
kubeletExtraArgs:
129+
event-qps: "5"
130+
make-iptables-util-chains: "true"
131+
pod-max-pids: "4096"
132+
read-only-port: "0"
133+
streaming-connection-idle-timeout: 5m
134+
tls-cipher-suites: TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256
95135
joinConfiguration:
96-
nodeRegistration: {}
136+
nodeRegistration:
137+
kubeletExtraArgs:
138+
event-qps: "5"
139+
make-iptables-util-chains: "true"
140+
pod-max-pids: "4096"
141+
read-only-port: "0"
142+
streaming-connection-idle-timeout: 5m
143+
tls-cipher-suites: TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256
144+
postKubeadmCommands:
145+
- chmod 600 "$(systemctl show -P FragmentPath kubelet.service)"
146+
- chmod 600 $(systemctl show -P DropInPaths kubelet.service)
147+
- chmod 600 /var/lib/kubelet/config.yaml
97148
---
98149
apiVersion: infrastructure.cluster.x-k8s.io/v1beta1
99150
kind: DockerMachineTemplate
@@ -131,4 +182,15 @@ spec:
131182
template:
132183
spec:
133184
joinConfiguration:
134-
nodeRegistration: {}
185+
nodeRegistration:
186+
kubeletExtraArgs:
187+
event-qps: "5"
188+
make-iptables-util-chains: "true"
189+
pod-max-pids: "4096"
190+
read-only-port: "0"
191+
streaming-connection-idle-timeout: 5m
192+
tls-cipher-suites: TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256
193+
postKubeadmCommands:
194+
- chmod 600 "$(systemctl show -P FragmentPath kubelet.service)"
195+
- chmod 600 $(systemctl show -P DropInPaths kubelet.service)
196+
- chmod 600 /var/lib/kubelet/config.yaml

‎charts/cluster-api-runtime-extensions-nutanix/defaultclusterclasses/nutanix-cluster-class.yaml

Lines changed: 57 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -11,10 +11,18 @@ spec:
1111
nodeRegistration:
1212
kubeletExtraArgs:
1313
cloud-provider: external
14+
event-qps: "5"
1415
eviction-hard: nodefs.available<10%,nodefs.inodesFree<5%,imagefs.available<15%,memory.available<100Mi,imagefs.inodesFree<10%
15-
tls-cipher-suites: TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256
16+
make-iptables-util-chains: "true"
17+
pod-max-pids: "4096"
18+
read-only-port: "0"
19+
streaming-connection-idle-timeout: 5m
20+
tls-cipher-suites: TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256
1621
postKubeadmCommands:
1722
- echo "after kubeadm call" > /var/log/postkubeadm.log
23+
- chmod 600 "$(systemctl show -P FragmentPath kubelet.service)"
24+
- chmod 600 $(systemctl show -P DropInPaths kubelet.service)
25+
- chmod 600 /var/lib/kubelet/config.yaml
1826
preKubeadmCommands:
1927
- echo "before kubeadm call" > /var/log/prekubeadm.log
2028
- hostnamectl set-hostname "{{ ds.meta_data.hostname }}"
@@ -123,13 +131,28 @@ spec:
123131
clusterConfiguration:
124132
apiServer:
125133
extraArgs:
134+
admission-control-config-file: /etc/kubernetes/admission.yaml
126135
cloud-provider: external
136+
enable-admission-plugins: DenyServiceExternalIPs,EventRateLimit,NodeRestriction
127137
profiling: "false"
138+
service-account-lookup: "true"
128139
tls-cipher-suites: TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256
140+
extraVolumes:
141+
- hostPath: /etc/kubernetes/admission.yaml
142+
mountPath: /etc/kubernetes/admission.yaml
143+
name: admission-config
144+
pathType: File
145+
readOnly: true
146+
- hostPath: /etc/kubernetes/eventratelimit-config.yaml
147+
mountPath: /etc/kubernetes/eventratelimit-config.yaml
148+
name: eventratelimit-config
149+
pathType: File
150+
readOnly: true
129151
controllerManager:
130152
extraArgs:
131153
cloud-provider: external
132154
profiling: "false"
155+
terminated-pod-gc-threshold: "10000"
133156
tls-cipher-suites: TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256
134157
scheduler:
135158
extraArgs:
@@ -200,18 +223,45 @@ spec:
200223
path: /etc/kubernetes/admin.conf
201224
name: kubeconfig
202225
path: /etc/kubernetes/manifests/kube-vip.yaml
226+
- content: |
227+
apiVersion: apiserver.config.k8s.io/v1
228+
kind: AdmissionConfiguration
229+
plugins:
230+
- name: EventRateLimit
231+
path: /etc/kubernetes/eventratelimit-config.yaml
232+
path: /etc/kubernetes/admission.yaml
233+
permissions: "0600"
234+
- content: |
235+
apiVersion: eventratelimit.admission.k8s.io/v1alpha1
236+
kind: Configuration
237+
limits:
238+
- type: Server
239+
qps: 10000
240+
burst: 40000
241+
path: /etc/kubernetes/eventratelimit-config.yaml
242+
permissions: "0600"
203243
initConfiguration:
204244
nodeRegistration:
205245
kubeletExtraArgs:
206246
cloud-provider: external
247+
event-qps: "5"
207248
eviction-hard: nodefs.available<10%,nodefs.inodesFree<5%,imagefs.available<15%,memory.available<100Mi,imagefs.inodesFree<10%
208-
tls-cipher-suites: TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256
249+
make-iptables-util-chains: "true"
250+
pod-max-pids: "4096"
251+
read-only-port: "0"
252+
streaming-connection-idle-timeout: 5m
253+
tls-cipher-suites: TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256
209254
joinConfiguration:
210255
nodeRegistration:
211256
kubeletExtraArgs:
212257
cloud-provider: external
258+
event-qps: "5"
213259
eviction-hard: nodefs.available<10%,nodefs.inodesFree<5%,imagefs.available<15%,memory.available<100Mi,imagefs.inodesFree<10%
214-
tls-cipher-suites: TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256
260+
make-iptables-util-chains: "true"
261+
pod-max-pids: "4096"
262+
read-only-port: "0"
263+
streaming-connection-idle-timeout: 5m
264+
tls-cipher-suites: TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256
215265
postKubeadmCommands:
216266
- echo export KUBECONFIG=/etc/kubernetes/admin.conf >> /root/.bashrc
217267
- echo "after kubeadm call" > /var/log/postkubeadm.log
@@ -223,6 +273,10 @@ spec:
223273
- echo "127.0.0.1 {{ ds.meta_data.hostname }}" >> /etc/hosts
224274
useExperimentalRetryJoin: true
225275
verbosity: 10
276+
postKubeadmCommands:
277+
- chmod 600 "$(systemctl show -P FragmentPath kubelet.service)"
278+
- chmod 600 $(systemctl show -P DropInPaths kubelet.service)
279+
- chmod 600 /var/lib/kubelet/config.yaml
226280
---
227281
apiVersion: infrastructure.cluster.x-k8s.io/v1beta1
228282
kind: NutanixClusterTemplate

‎hack/examples/overlays/clusterclasses/aws/kustomization.yaml.tmpl

Lines changed: 25 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -68,5 +68,29 @@ patches:
6868
# BEGIN CIS patches
6969
- target:
7070
kind: KubeadmControlPlaneTemplate
71-
path: ../../../patches/disable-kubeadmcontrolplane-profiling.yaml
71+
path: ../../../patches/cis-kubeadmcontrolplanetemplate.yaml
72+
- target:
73+
kind: KubeadmConfigTemplate
74+
path: ../../../patches/cis-kubeadmconfigtemplate.yaml
75+
- target:
76+
kind: KubeadmControlPlaneTemplate
77+
path: ../../../patches/initialize-postkubeadmcommands.yaml
78+
- target:
79+
kind: KubeadmControlPlaneTemplate
80+
path: ../../../patches/cis-kubelet-file-permissions.yaml
81+
- target:
82+
kind: KubeadmConfigTemplate
83+
path: ../../../patches/initialize-postkubeadmcommands.yaml
84+
- target:
85+
kind: KubeadmConfigTemplate
86+
path: ../../../patches/cis-kubelet-file-permissions.yaml
87+
- target:
88+
kind: KubeadmControlPlaneTemplate
89+
path: ../../../patches/initialize-files.yaml
90+
- target:
91+
kind: KubeadmControlPlaneTemplate
92+
path: ../../../patches/initialize-extravolumes.yaml
93+
- target:
94+
kind: KubeadmControlPlaneTemplate
95+
path: ../../../patches/cis-admissionconfiguration.yaml
7296
# END CIS patches

‎hack/examples/overlays/clusterclasses/docker/kustomization.yaml.tmpl

Lines changed: 25 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -29,5 +29,29 @@ patches:
2929
# BEGIN CIS patches
3030
- target:
3131
kind: KubeadmControlPlaneTemplate
32-
path: ../../../patches/disable-kubeadmcontrolplane-profiling.yaml
32+
path: ../../../patches/cis-kubeadmcontrolplanetemplate.yaml
33+
- target:
34+
kind: KubeadmConfigTemplate
35+
path: ../../../patches/cis-kubeadmconfigtemplate.yaml
36+
- target:
37+
kind: KubeadmControlPlaneTemplate
38+
path: ../../../patches/initialize-postkubeadmcommands.yaml
39+
- target:
40+
kind: KubeadmControlPlaneTemplate
41+
path: ../../../patches/cis-kubelet-file-permissions.yaml
42+
- target:
43+
kind: KubeadmConfigTemplate
44+
path: ../../../patches/initialize-postkubeadmcommands.yaml
45+
- target:
46+
kind: KubeadmConfigTemplate
47+
path: ../../../patches/cis-kubelet-file-permissions.yaml
48+
- target:
49+
kind: KubeadmControlPlaneTemplate
50+
path: ../../../patches/initialize-files.yaml
51+
- target:
52+
kind: KubeadmControlPlaneTemplate
53+
path: ../../../patches/initialize-extravolumes.yaml
54+
- target:
55+
kind: KubeadmControlPlaneTemplate
56+
path: ../../../patches/cis-admissionconfiguration.yaml
3357
# END CIS patches

‎hack/examples/overlays/clusterclasses/nutanix/kustomization.yaml.tmpl

Lines changed: 19 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -29,5 +29,23 @@ patches:
2929
# BEGIN CIS patches
3030
- target:
3131
kind: KubeadmControlPlaneTemplate
32-
path: ../../../patches/disable-kubeadmcontrolplane-profiling.yaml
32+
path: ../../../patches/cis-kubeadmcontrolplanetemplate.yaml
33+
- target:
34+
kind: KubeadmConfigTemplate
35+
path: ../../../patches/cis-kubeadmconfigtemplate.yaml
36+
- target:
37+
kind: KubeadmControlPlaneTemplate
38+
path: ../../../patches/initialize-postkubeadmcommands.yaml
39+
- target:
40+
kind: KubeadmControlPlaneTemplate
41+
path: ../../../patches/cis-kubelet-file-permissions.yaml
42+
- target:
43+
kind: KubeadmConfigTemplate
44+
path: ../../../patches/cis-kubelet-file-permissions.yaml
45+
- target:
46+
kind: KubeadmControlPlaneTemplate
47+
path: ../../../patches/initialize-extravolumes.yaml
48+
- target:
49+
kind: KubeadmControlPlaneTemplate
50+
path: ../../../patches/cis-admissionconfiguration.yaml
3351
# END CIS patches

0 commit comments

Comments
 (0)