Our IT department have setup a Kubernetes cluster for our development work using kops, and we've run kube-bench on it to see what security issues need to be addressed.

Currently there's a lot of failed checks relating to the certificate authority used inside the cluster, e.g:

[FAIL] 1.1.20 Ensure that the --token-auth-file parameter is not set (Scored)
[FAIL] 1.1.21 Ensure that the --kubelet-certificate-authority argument is set as appropriate (Scored)
[FAIL] 1.1.22 Ensure that the --kubelet-client-certificate and --kubelet-client-key arguments are set as appropriate (Scored)

How important is it to address those issues? What are the security implications of leaving those checks unaddressed?


Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Browse other questions tagged or ask your own question.