Rancher CIS Kubernetes v.1.4.0 Benchmark Self Assessment Rancher v2.2.x Version 1.1.0 - August 2019 Authors Taylor Price Overview The following document scores a Kubernetes 1.13.x RKE cluster provisioned provisioned according to the Rancher v2.2.x hardening guide against the CIS 1.4.0 Kubernetes benchmark. This document is a companion to the Rancher v2.2.x security hardening guide. The hardening guide installation of Rancher, and this benchmark guide is meant to help you evaluate the level of security of the hardened cluster against each control in the benchmark. Because Rancher and RKE install Kubernetes

CIS Benchmark Rancher Self-Assessment Guide - v2.4 CIS Benchmark Rancher Self-Assessment Guide - v2.4 1 4 5 6 6 14 29 33 34 34 37 37 38 38 42 49 49 50 52 Contents CIS Kubernetes Benchmark Benchmark v1.5 - Rancher v2.4 with Kubernetes v1.15 Controls 1 Master Node Security Configuration 1.1 Master Node Configuration Files 1.2 API Server 1.3 Controller Manager 1.4 Scheduler 2 Etcd Node Policies and CNI CIS Benchmark Rancher Self-Assessment Guide - v2.4 2 53 5.6 General Policies CIS Benchmark Rancher Self-Assessment Guide - v2.4 3 CIS Kubernetes Benchmark v1.5 - Rancher v2.4 with

CIS 1.6 Benchmark - Self- Assessment Guide - Rancher v2.5.4 CIS 1.6 Benchmark - Self-Assessment Guide - Rancher v2.5.4 1 8 9 10 10 10 11 12 15 17 17 18 18 18 19 19 19 20 20 20 21 21 Contents CIS 1.6 Kubernetes Benchmark - Rancher v2.5.4 with Kubernetes v1.18 Controls 1.1 Etcd Node Configuration Files 1.1.11 Ensure that the etcd data directory permissions are set to 700 or more that the scheduler.conf file permissions are set to 644 or more restrictive (Automated) CIS 1.6 Benchmark - Self-Assessment Guide - Rancher v2.5.4 2 21 21 22 23 23 24 26 27 29 31 33 34 36 37

CIS 1.5 Benchmark - Self- Assessment Guide - Rancher v2.5 CIS 1.5 Benchmark - Self-Assessment Guide - Rancher v2.5 1 4 5 6 6 14 29 33 34 34 37 37 38 38 42 49 49 50 Contents CIS v1 v1.5 Kubernetes Benchmark - Rancher v2.5 with Kubernetes v1.15 Controls 1 Master Node Security Configuration 1.1 Master Node Configuration Files 1.2 API Server 1.3 Controller Manager 1.4 Scheduler 5.2 Pod Security Policies CIS 1.5 Benchmark - Self-Assessment Guide - Rancher v2.5 2 52 53 5.3 Network Policies and CNI 5.6 General Policies CIS 1.5 Benchmark - Self-Assessment Guide - Rancher v2

pyarmor benchmark Here it’s sample output: INFO Start benchmark test ... INFO Obfuscate module mode: 1 INFO Obfuscate code mode: 1 INFO Obfuscate wrap mode: 1 INFO Benchmark bootstrap bootstrap ... INFO Benchmark bootstrap OK. INFO Run benchmark test ... Test script: bfoo.py Obfuscated script: obfoo.py -------------------------------------- load_pytransform: 28.429590911694085 ms -------------------------------------- INFO Remove test path: .\.benchtest INFO Finish benchmark test. The total extra init time is about 40ms. It includes the time of loading dynamic library

pyarmor benchmark Here it’s sample output: INFO Start benchmark test ... INFO Obfuscate module mode: 1 INFO Obfuscate code mode: 1 INFO Obfuscate wrap mode: 1 INFO Benchmark bootstrap bootstrap ... INFO Benchmark bootstrap OK. INFO Run benchmark test ... Test script: bfoo.py Obfuscated script: obfoo.py -------------------------------------- load_pytransform: 28.429590911694085 ms -------------------------------------- INFO Remove test path: .\.benchtest INFO Finish benchmark test. The total extra init time is about 40ms. It includes the time of loading dynamic library

pyarmor benchmark Here it’s sample output: INFO Start benchmark test ... INFO Obfuscate module mode: 1 INFO Obfuscate code mode: 1 INFO Obfuscate wrap mode: 1 INFO Benchmark bootstrap bootstrap ... INFO Benchmark bootstrap OK. INFO Run benchmark test ... Test script: bfoo.py Obfuscated script: obfoo.py -------------------------------------- load_pytransform: 28.429590911694085 ms -------------------------------------- INFO Remove test path: .\.benchtest INFO Finish benchmark test. The total extra init time is about 40ms. It includes the time of loading dynamic library

scripts: pyarmor benchmark Here it’s sample output: INFO Start benchmark test ... INFO Obfuscate module mode: 1 INFO Obfuscate code mode: 1 INFO Obfuscate wrap mode: 1 INFO Benchmark bootstrap ... INFO Benchmark bootstrap OK. INFO Run benchmark test ... Test script: bfoo.py Obfuscated script: obfoo.py -------------------------------------- load_pytransform: 28.429590911694085 ms init_pytransform: 005587302296800045 ms -------------------------------------- INFO Remove test path: .\.benchtest INFO Finish benchmark test. The total extra init time is about 40ms. It includes the time of loading dynamic library

scripts: pyarmor benchmark Here it’s sample output: INFO Start benchmark test ... INFO Obfuscate module mode: 1 INFO Obfuscate code mode: 1 INFO Obfuscate wrap mode: 1 INFO Benchmark bootstrap ... INFO Benchmark bootstrap OK. INFO Run benchmark test ... Test script: bfoo.py Obfuscated script: obfoo.py -------------------------------------- load_pytransform: 28.429590911694085 ms init_pytransform: 005587302296800045 ms -------------------------------------- INFO Remove test path: .\.benchtest INFO Finish benchmark test. The total extra init time is about 40ms. It includes the time of loading dynamic library

Show project information check Check consistency of project The other commands: benchmark Run benchmark test in current machine register Make registration file work download Download check /path/to/project banchmark Check the performance of obfuscated scripts. SYNOPSIS: pyarmor benchmark OPTIONS: Whether to obfuscate the whole module Whether to obfuscate each function default mode: pyarmor benchmark Test performance with no wrap mode: pyarmor benchmark --wrap-mode 0 Check the test scripts which saved in the path .benchtest: pyarmor benchmark --debug --help-platform