CIS K3s Benchmark

This recommendation verifies that K3s is running the latest stable version on the K3s lightweight Kubernetes distribution. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the K3s lightweight Kubernetes distribution vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Verify K3s version
k3s --version
kubectl get nodes -o wide

# Update K3s to latest stable
curl -sfL https://get.k3s.io | INSTALL_K3S_CHANNEL=stable sh -
systemctl restart k3s

This recommendation verifies that K3s is configured with security hardening flags on the K3s lightweight Kubernetes distribution. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the K3s lightweight Kubernetes distribution vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check K3s service configuration
systemctl status k3s
ps -eo user,pid,args | grep k3s | grep -v grep

# Configure K3s with security flags
curl -sfL https://get.k3s.io | sh -s - server \
  --protect-kernel-defaults \
  --secrets-encryption \
  --kube-apiserver-arg=anonymous-auth=false \
  --kube-apiserver-arg=audit-log-path=/var/log/k3s-audit.log

This recommendation verifies that anonymous authentication is disabled on the K3s lightweight Kubernetes distribution. Disabling or removing unnecessary components reduces the attack surface and limits potential vectors for exploitation.

Running unnecessary components on the K3s lightweight Kubernetes distribution increases the attack surface and the risk of exploitation. Disabling or removing them follows the principle of least functionality and reduces exposure to known vulnerabilities.

# Check API server authentication
k3s kubectl auth can-i --list --as=system:anonymous
grep 'anonymous-auth' /etc/systemd/system/k3s.service

# Disable anonymous authentication
# Add to K3s server flags:
# --kube-apiserver-arg=anonymous-auth=false
# Verify:
kubectl get --raw /api/v1/namespaces --as=system:anonymous 2>&1 | grep -i forbid

This recommendation verifies that RBAC with least privilege is configured on the K3s lightweight Kubernetes distribution. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the K3s lightweight Kubernetes distribution vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check RBAC configuration
kubectl get clusterrolebindings -o custom-columns=NAME:.metadata.name,ROLE:.roleRef.name,SUBJECTS:.subjects | head -20
kubectl auth can-i --list --as=system:serviceaccount:default:default

# Configure RBAC least privilege
kubectl delete clusterrolebinding permissive-binding 2>/dev/null
# Create namespace-scoped roles:
kubectl create role app-reader --verb=get,list,watch --resource=pods,services -n app-ns
kubectl create rolebinding app-reader-binding --role=app-reader --serviceaccount=app-ns:app-sa -n app-ns
# Restrict default service account:
kubectl patch serviceaccount default -n default -p '{"automountServiceAccountToken":false}'

This recommendation verifies that secrets encryption at rest is enabled on the K3s lightweight Kubernetes distribution. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the K3s lightweight Kubernetes distribution vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check secrets encryption
k3s secrets-encrypt status
ls -la /var/lib/rancher/k3s/server/cred/encryption-config.json 2>/dev/null

# Enable secrets encryption at rest
k3s secrets-encrypt enable
k3s secrets-encrypt reencrypt
# Verify:
k3s secrets-encrypt status
# Check encryption config:
cat /var/lib/rancher/k3s/server/cred/encryption-config.json | python3 -m json.tool

This recommendation verifies that TLS certificates are properly configured and rotated on the K3s lightweight Kubernetes distribution. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the K3s lightweight Kubernetes distribution vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check TLS certificate configuration
ls -la /var/lib/rancher/k3s/server/tls/
openssl x509 -in /var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt -noout -dates

# Configure custom TLS certificates
# Use --tls-san for additional SANs:
curl -sfL https://get.k3s.io | sh -s - server \
  --tls-san=k3s.example.com \
  --tls-san=10.0.1.100
# Rotate certificates:
k3s certificate rotate
systemctl restart k3s
# Monitor cert expiry:
openssl x509 -in /var/lib/rancher/k3s/server/tls/serving-kube-apiserver.crt -noout -enddate

This recommendation verifies that API server audit logging is enabled on the K3s lightweight Kubernetes distribution. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the K3s lightweight Kubernetes distribution vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check audit logging
grep 'audit-log' /etc/systemd/system/k3s.service
ls -la /var/log/k3s-audit.log 2>/dev/null

# Enable audit logging
# Create audit policy:
cat > /etc/rancher/k3s/audit-policy.yaml << 'EOF'
apiVersion: audit.k8s.io/v1
kind: Policy
rules:
- level: Metadata
  resources:
  - group: ""
    resources: ["secrets", "configmaps"]
- level: RequestResponse
  users: ["system:admin"]
- level: Metadata
EOF
# Add flags:
# --kube-apiserver-arg=audit-policy-file=/etc/rancher/k3s/audit-policy.yaml
# --kube-apiserver-arg=audit-log-path=/var/log/k3s-audit.log
# --kube-apiserver-arg=audit-log-maxage=30
# --kube-apiserver-arg=audit-log-maxsize=100

This recommendation verifies that K3s service logs are forwarded and rotated on the K3s lightweight Kubernetes distribution. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the K3s lightweight Kubernetes distribution vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check K3s logging
journalctl -u k3s --no-pager | tail -20
kubectl logs -n kube-system -l app=traefik | head -10

# Configure centralized logging
# K3s logs to journald by default
# Forward to syslog:
cat > /etc/rsyslog.d/k3s.conf << 'EOF'
if $programname == 'k3s' then /var/log/k3s.log
& stop
EOF
systemctl restart rsyslog
# Configure log rotation:
cat > /etc/logrotate.d/k3s << 'EOF'
/var/log/k3s*.log {
    daily
    rotate 30
    compress
    missingok
}
EOF

This recommendation verifies that default-deny network policies are applied on the K3s lightweight Kubernetes distribution. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the K3s lightweight Kubernetes distribution vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check network policies
kubectl get networkpolicies --all-namespaces
kubectl get pods -n kube-system -l app.kubernetes.io/name=traefik

# Configure default-deny network policies
kubectl apply -f - << 'EOF'
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: default-deny-all
  namespace: default
spec:
  podSelector: {}
  policyTypes:
  - Ingress
  - Egress
EOF
# Then allow specific traffic per application

This recommendation ensures that Pod Security Standards are enforced on the K3s lightweight Kubernetes distribution. Enforcing this requirement establishes a minimum security standard and prevents insecure configurations.

Without this enforcement, the K3s lightweight Kubernetes distribution may accept insecure configurations that weaken overall security posture. Mandating this control ensures consistent protection against common attack vectors.

# Check Pod Security Standards
kubectl get ns --show-labels | grep pod-security
kubectl describe ns kube-system | grep pod-security

# Enforce Pod Security Standards
kubectl label ns default pod-security.kubernetes.io/enforce=restricted
kubectl label ns default pod-security.kubernetes.io/warn=restricted
kubectl label ns default pod-security.kubernetes.io/audit=restricted
# Configure K3s default PSA:
# --kube-apiserver-arg=enable-admission-plugins=PodSecurity

This setting ensures that kubeconfig file permissions are restricted on the K3s lightweight Kubernetes distribution. Restricting this capability limits potential abuse and enforces the principle of least privilege across the environment.

Unrestricted access to this capability could allow unauthorized users or processes to perform actions beyond their intended scope. Applying least-privilege principles to the K3s lightweight Kubernetes distribution is essential for defense in depth.

# Check kubeconfig permissions
stat -c '%a %U %G' /etc/rancher/k3s/k3s.yaml
find /var/lib/rancher/k3s -name '*.kubeconfig' -exec stat -c '%a %n' {} \;

# Restrict kubeconfig permissions
chmod 600 /etc/rancher/k3s/k3s.yaml
chown root:root /etc/rancher/k3s/k3s.yaml
chmod 700 /var/lib/rancher/k3s/server/cred
chmod 600 /var/lib/rancher/k3s/server/cred/*

This setting ensures that data directory permissions are restricted on the K3s lightweight Kubernetes distribution. Restricting this capability limits potential abuse and enforces the principle of least privilege across the environment.

Unrestricted access to this capability could allow unauthorized users or processes to perform actions beyond their intended scope. Applying least-privilege principles to the K3s lightweight Kubernetes distribution is essential for defense in depth.

# Check data directory permissions
stat -c '%a %U %G' /var/lib/rancher/k3s
find /var/lib/rancher/k3s/server -maxdepth 1 -type d -exec stat -c '%a %n' {} \;

# Restrict data directory permissions
chmod 750 /var/lib/rancher/k3s
chmod 700 /var/lib/rancher/k3s/server
chmod 700 /var/lib/rancher/k3s/server/tls
chmod 600 /var/lib/rancher/k3s/server/tls/*.key

This recommendation verifies that automated etcd snapshots are configured on the K3s lightweight Kubernetes distribution. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the K3s lightweight Kubernetes distribution vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check etcd snapshot configuration
k3s etcd-snapshot list 2>/dev/null
grep 'etcd-snapshot' /etc/systemd/system/k3s.service

# Configure automated etcd snapshots
# Add to K3s server flags:
# --etcd-snapshot-schedule-cron='0 */6 * * *'
# --etcd-snapshot-retention=10
# --etcd-snapshot-dir=/var/lib/rancher/k3s/server/db/snapshots
# Manual snapshot:
k3s etcd-snapshot save --name=manual-$(date +%F)

This recommendation verifies that unnecessary bundled components are disabled on the K3s lightweight Kubernetes distribution. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the K3s lightweight Kubernetes distribution vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check disabled components
grep -E 'disable|no-deploy' /etc/systemd/system/k3s.service

# Disable unnecessary components
# If Traefik not needed:
curl -sfL https://get.k3s.io | sh -s - server \
  --disable=traefik \
  --disable=servicelb
# If using external metrics:
# --disable=metrics-server
# Verify:
kubectl get pods -n kube-system