(Scored) Audit docker inspect kube-apiserver | jq -e '.[0].Args[] | match("--anonymous-auth=false").string' Returned Value: --anonymous-auth=false Result: Pass 1.1.2 - Ensure that the --basic-auth-file (Scored) Audit docker inspect kube-apiserver | jq -e '.[0].Args[] | match("--basic-auth-file=.*").string' Returned Value: null Result: Pass 1.1.3 - Ensure that the --insecure-allow-any-token argument Audit docker inspect kube-apiserver | jq -e '.[0].Args[] | match("--insecure-allow-any-token").string' Returned Value: null Result: Pass 1.1.4 - Ensure that the --kubelet-https argument is set

secret: <32-byte base64 encoded string> - identity: {} Where aescbc is the key type, and secret is populated with a 32-byte base64 encoded string. Remediation Generate a key and an empty - name: key1 secret: <32-byte base64 encoded string> - identity: {} Where secret is the 32-byte base64-encoded string generated in the first step. 1.1.3 - Install the audit log configuration

to the path to the cert file for the certificate authority. --kubelet-certificate-authority=string> Audit: /bin/ps -ef | grep kube-apiserver | grep -v grep Expected result: CIS Benchmark Rancher

to the path to the cert file for the certificate authority. --kubelet-certificate-authority=string> Audit: /bin/ps -ef | grep kube-apiserver | grep -v grep Expected result: CIS 1.5 Benchmark -

~/snap/docker directory hierarchy.) 3. Encode your credentials in base64 and store the resulting string. ENCODED_CREDS=$(base64 -w 0 config.json) Take a look at the encoded credentials. echo $ENCODED_CREDS