CIS Calico Benchmark

This recommendation verifies that Calico is running the latest stable version on the Calico network policy engine. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Calico network policy engine vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check Calico version
calicoctl version
kubectl get pods -n calico-system -o wide 2>/dev/null || kubectl get pods -n kube-system -l k8s-app=calico-node -o wide

# Update Calico
kubectl apply -f https://raw.githubusercontent.com/projectcalico/calico/v3.27.0/manifests/calico.yaml
# Or via Helm:
helm upgrade calico projectcalico/tigera-operator --version v3.27.0

This recommendation verifies that the installation mode and IP pools are configured on the Calico network policy engine. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Calico network policy engine vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check Calico installation type
kubectl get installation default -o yaml 2>/dev/null | head -20
calicoctl get felixconfiguration default -o yaml

# Configure Calico installation
kubectl apply -f - << 'EOF'
apiVersion: operator.tigera.io/v1
kind: Installation
metadata:
  name: default
spec:
  calicoNetwork:
    bgp: Disabled
    ipPools:
    - cidr: 192.168.0.0/16
      encapsulation: VXLAN
      natOutgoing: Enabled
EOF

This recommendation verifies that a default-deny global network policy is configured on the Calico network policy engine. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Calico network policy engine vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check default network policies
kubectl get networkpolicies --all-namespaces
calicoctl get globalnetworkpolicy -o wide 2>/dev/null

# Configure default-deny global policy
calicoctl apply -f - << 'EOF'
apiVersion: projectcalico.org/v3
kind: GlobalNetworkPolicy
metadata:
  name: default-deny
spec:
  selector: all()
  types:
  - Ingress
  - Egress
EOF
# Then create allow policies per workload

This recommendation verifies that namespace-scoped policies with least privilege are applied on the Calico network policy engine. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Calico network policy engine vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check Calico network policies for namespaces
calicoctl get networkpolicy --all-namespaces -o wide
kubectl get networkpolicies -n kube-system

# Create namespace-scoped policies
calicoctl apply -f - << 'EOF'
apiVersion: projectcalico.org/v3
kind: NetworkPolicy
metadata:
  name: allow-app-traffic
  namespace: production
spec:
  selector: app == 'web'
  ingress:
  - action: Allow
    protocol: TCP
    source:
      selector: app == 'frontend'
    destination:
      ports: [8080]
  egress:
  - action: Allow
    protocol: TCP
    destination:
      selector: app == 'database'
      ports: [5432]
EOF

This recommendation verifies that WireGuard encryption is enabled for pod traffic on the Calico network policy engine. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Calico network policy engine vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check WireGuard encryption
calicoctl get felixconfiguration default -o yaml | grep -i wireguard
wg show 2>/dev/null

# Enable WireGuard encryption
calicoctl patch felixconfiguration default --type='merge' \
  -p '{"spec":{"wireguardEnabled":true}}'
# Verify:
calicoctl get felixconfiguration default -o yaml | grep wireguardEnabled
wg show

This recommendation verifies that Typha communication is TLS-encrypted on the Calico network policy engine. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Calico network policy engine vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check Typha TLS
kubectl get configmap -n calico-system typha-config -o yaml 2>/dev/null | grep -i tls

# Configure Typha with TLS
# Calico operator manages TLS automatically
# Verify TLS certificates:
kubectl get secret -n calico-system | grep typha
# For manual installs, configure:
# FELIX_TYPHACN, FELIX_TYPHACAFILE, FELIX_TYPHACERTFILE, FELIX_TYPHAKEYFILE

This recommendation verifies that flow logs are enabled on the Calico network policy engine. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Calico network policy engine vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check flow logs
calicoctl get felixconfiguration default -o yaml | grep -i flowLogs

# Enable flow logs
calicoctl patch felixconfiguration default --type='merge' \
  -p '{"spec":{"flowLogsEnabled":true,"flowLogsFlushInterval":"15s"}}'
# For Calico Enterprise:
# Flow logs integrate with Elasticsearch/Kibana dashboards

This recommendation verifies that DNS and policy action logging is configured on the Calico network policy engine. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Calico network policy engine vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check DNS policy logging
calicoctl get felixconfiguration default -o yaml | grep -i log
kubectl logs -n calico-system -l k8s-app=calico-node --tail=20 2>/dev/null

# Configure DNS and policy logging
calicoctl patch felixconfiguration default --type='merge' \
  -p '{"spec":{"policySyncPathPrefix":"/var/run/nodeagent","logSeverityScreen":"Info"}}'
# Enable per-policy logging:
# Add log action to network policies:
# - action: Log
#   metadata:
#     annotations:
#       log-prefix: "POLICY-HIT"

This recommendation verifies that IP pools use appropriate encapsulation and NAT settings on the Calico network policy engine. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Calico network policy engine vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check IP pools
calicoctl get ippools -o wide
calicoctl get ippools -o yaml | grep -E 'cidr|nat|encapsulation'

# Configure IP pools with security
calicoctl apply -f - << 'EOF'
apiVersion: projectcalico.org/v3
kind: IPPool
metadata:
  name: production-pool
spec:
  cidr: 10.244.0.0/16
  ipipMode: Never
  vxlanMode: Always
  natOutgoing: true
  blockSize: 26
  nodeSelector: "!all()"
EOF
# Disable unused IP pools

This recommendation verifies that BGP peering is secured with authentication on the Calico network policy engine. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Calico network policy engine vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check BGP configuration
calicoctl get bgpConfiguration default -o yaml 2>/dev/null
calicoctl get bgpPeer -o wide 2>/dev/null

# Secure BGP peering
# If BGP is used, configure explicit peers:
calicoctl apply -f - << 'EOF'
apiVersion: projectcalico.org/v3
kind: BGPPeer
metadata:
  name: rack-peer
spec:
  peerIP: 10.0.0.1
  asNumber: 64512
  password:
    secretKeyRef:
      name: bgp-secrets
      key: peer-password
EOF
# If BGP not needed, disable:
calicoctl patch bgpconfiguration default -p '{"spec":{"nodeToNodeMeshEnabled":false}}'

This recommendation verifies that Felix failsafe and default endpoint actions are configured on the Calico network policy engine. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Calico network policy engine vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check Felix configuration
calicoctl get felixconfiguration default -o yaml | grep -E 'failsafe|defaultEndpoint'

# Configure Felix security settings
calicoctl patch felixconfiguration default --type='merge' -p '{
  "spec": {
    "defaultEndpointToHostAction": "Drop",
    "failsafeInboundHostPorts": [{"protocol":"tcp","port":22}],
    "failsafeOutboundHostPorts": [{"protocol":"udp","port":53},{"protocol":"tcp","port":443}]
  }
}'

This recommendation verifies that host endpoint protection is enabled on the Calico network policy engine. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Calico network policy engine vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check host endpoint protection
calicoctl get hostendpoint -o wide 2>/dev/null

# Configure host endpoint protection
calicoctl apply -f - << 'EOF'
apiVersion: projectcalico.org/v3
kind: HostEndpoint
metadata:
  name: worker-node-eth0
  labels:
    role: worker
spec:
  interfaceName: eth0
  node: worker-1
  expectedIPs:
  - 10.0.1.10
EOF
# Apply host protection policy:
calicoctl apply -f - << 'EOF'
apiVersion: projectcalico.org/v3
kind: GlobalNetworkPolicy
metadata:
  name: host-default-deny
spec:
  selector: role == 'worker'
  types: [Ingress, Egress]
  applyOnForward: true
EOF

This setting ensures that Calico CRD RBAC is restricted to administrators on the Calico network policy engine. Restricting this capability limits potential abuse and enforces the principle of least privilege across the environment.

Unrestricted access to this capability could allow unauthorized users or processes to perform actions beyond their intended scope. Applying least-privilege principles to the Calico network policy engine is essential for defense in depth.

# Check Calico RBAC
kubectl get clusterroles | grep calico
kubectl get clusterrolebindings | grep calico

# Restrict Calico RBAC
# Review default ClusterRoles:
kubectl get clusterrole calico-node -o yaml | head -30
# Ensure only admin users can manage Calico CRDs:
kubectl auth can-i create globalnetworkpolicies --as=developer 2>&1

This recommendation verifies that policy tiers enforce proper ordering on the Calico network policy engine. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Calico network policy engine vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check tier configuration
calicoctl get tier -o wide 2>/dev/null

# Configure policy tiers (Calico Enterprise)
# Tiers enforce policy ordering:
calicoctl apply -f - << 'EOF'
apiVersion: projectcalico.org/v3
kind: Tier
metadata:
  name: security
spec:
  order: 100
EOF
# Security team policies in security tier take precedence
# App team policies in default tier