CIS Rancher Benchmark

This recommendation verifies that external authentication provider is configured on the Rancher Kubernetes management platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Rancher Kubernetes management platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check Rancher authentication configuration:
kubectl get setting auth-provider-name -o jsonpath='{.value}'

# Check local auth:
curl -sk https://rancher.example.com/v3/settings/auth-provider-name | jq '.value'

# Configure external authentication (LDAP/AD):
# Rancher UI > Global Settings > Authentication
# Provider: Active Directory / LDAP / SAML / GitHub

# Via API:
curl -sk -X PUT https://rancher.example.com/v3/settings/auth-provider-name \
  -H 'Authorization: Bearer $RANCHER_TOKEN' \
  -d '{"value": "activedirectory"}'

This recommendation verifies that global roles follow least-privilege principles on the Rancher Kubernetes management platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Rancher Kubernetes management platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# List global roles:
kubectl get globalroles -o custom-columns=NAME:.metadata.name,RULES:.rules

# Check admin users:
curl -sk -H "Authorization: Bearer $RANCHER_TOKEN" \
  https://rancher.example.com/v3/users?role=admin | jq '.data[].username'

# Create restricted global role:
curl -sk -X POST -H "Authorization: Bearer $RANCHER_TOKEN" \
  https://rancher.example.com/v3/globalroles \
  -d '{"name": "restricted-user", "rules": [{"apiGroups": ["management.cattle.io"], "resources": ["clusters"], "verbs": ["get", "list"]}]}'

This recommendation verifies that session timeout is configured on the Rancher Kubernetes management platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Rancher Kubernetes management platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check session settings:
curl -sk -H "Authorization: Bearer $RANCHER_TOKEN" \
  https://rancher.example.com/v3/settings/auth-token-max-ttl-minutes | jq '.value'
curl -sk -H "Authorization: Bearer $RANCHER_TOKEN" \
  https://rancher.example.com/v3/settings/auth-user-session-ttl-minutes | jq '.value'

# Set session timeout to 30 minutes:
curl -sk -X PUT -H "Authorization: Bearer $RANCHER_TOKEN" \
  https://rancher.example.com/v3/settings/auth-user-session-ttl-minutes \
  -d '{"value": "30"}'

# Set max token TTL:
curl -sk -X PUT -H "Authorization: Bearer $RANCHER_TOKEN" \
  https://rancher.example.com/v3/settings/auth-token-max-ttl-minutes \
  -d '{"value": "720"}'

This recommendation verifies that CIS hardening profile is enabled on managed clusters on the Rancher Kubernetes management platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Rancher Kubernetes management platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check cluster RKE2/K3s hardening profile:
kubectl get clusters.management.cattle.io -o jsonpath='{range .items[*]}{.metadata.name}{"\t"}{.spec.rkeConfig.machineGlobalConfig.profile}{"\n"}{end}'

# Set CIS hardening profile on RKE2 cluster:
# Rancher UI > Cluster > Edit Config > Advanced
# Profile: cis-1.23

# Via cluster YAML:
spec:
  rkeConfig:
    machineGlobalConfig:
      profile: cis-1.8
      protect-kernel-defaults: true

This recommendation verifies that authorized cluster endpoints use valid certificates on the Rancher Kubernetes management platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Rancher Kubernetes management platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check cluster authorized endpoint:
curl -sk -H "Authorization: Bearer $RANCHER_TOKEN" \
  https://rancher.example.com/v3/clusters | \
  jq '.data[] | {name: .name, authorizedEndpoint: .localClusterAuthEndpoint}'

# Enable authorized cluster endpoint:
curl -sk -X PUT -H "Authorization: Bearer $RANCHER_TOKEN" \
  https://rancher.example.com/v3/clusters/$CLUSTER_ID \
  -d '{"localClusterAuthEndpoint": {"enabled": true, "caCerts": "...", "fqdn": "cluster.example.com"}}'

# Rotate cluster certificates:
kubectl get secret -n cattle-system tls-rancher-ingress -o yaml

This recommendation verifies that project network isolation is enabled on the Rancher Kubernetes management platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Rancher Kubernetes management platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check project network isolation:
kubectl get projects.management.cattle.io -A -o custom-columns=NAME:.metadata.name,ISOLATION:.spec.containerDefaultResourceLimit

# Check network policies:
kubectl get networkpolicies -A --no-headers | wc -l

# Enable project network isolation:
# Rancher UI > Cluster > Projects/Namespaces > Project > Edit
# Enable: Project Network Isolation

# Apply network policy:
kubectl apply -f - <<'EOF'
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: deny-all
spec:
  podSelector: {}
  policyTypes:
  - Ingress
  - Egress
EOF

This recommendation ensures that Pod Security Admission is enforced on the Rancher Kubernetes management platform. Enforcing this requirement establishes a minimum security standard and prevents insecure configurations.

Without this enforcement, the Rancher Kubernetes management platform may accept insecure configurations that weaken overall security posture. Mandating this control ensures consistent protection against common attack vectors.

# Check PSA enforcement:
kubectl get namespaces -o custom-columns=NAME:.metadata.name,PSA:.metadata.labels.pod-security\.kubernetes\.io/enforce

# Check OPA Gatekeeper:
kubectl get constrainttemplates --no-headers | wc -l

# Apply Pod Security Admission:
kubectl label namespace production \
  pod-security.kubernetes.io/enforce=restricted \
  pod-security.kubernetes.io/audit=restricted \
  pod-security.kubernetes.io/warn=restricted

# Install OPA Gatekeeper via Rancher:
# Apps > Charts > OPA Gatekeeper > Install

This recommendation verifies that private container registries are configured on the Rancher Kubernetes management platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Rancher Kubernetes management platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check private registry configuration:
curl -sk -H "Authorization: Bearer $RANCHER_TOKEN" \
  https://rancher.example.com/v3/settings/system-default-registry | jq '.value'

# Set default system registry:
curl -sk -X PUT -H "Authorization: Bearer $RANCHER_TOKEN" \
  https://rancher.example.com/v3/settings/system-default-registry \
  -d '{"value": "registry.example.com"}'

# Configure registries.yaml on nodes:
mkdir -p /etc/rancher/rke2
cat > /etc/rancher/rke2/registries.yaml <<'EOF'
mirrors:
  docker.io:
    endpoint:
      - "https://registry.example.com"
configs:
  "registry.example.com":
    tls:
      ca_file: /etc/rancher/ssl/ca.crt
EOF

This recommendation verifies that only approved Helm chart repositories are used on the Rancher Kubernetes management platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Rancher Kubernetes management platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check catalog/helm chart repos:
curl -sk -H "Authorization: Bearer $RANCHER_TOKEN" \
  https://rancher.example.com/v3/catalogs | \
  jq '.data[] | {name: .name, url: .url, branch: .branch}'

# Remove untrusted catalogs:
curl -sk -X DELETE -H "Authorization: Bearer $RANCHER_TOKEN" \
  https://rancher.example.com/v3/catalogs/$CATALOG_ID

# Use only approved Helm repos:
helm repo add stable https://charts.helm.sh/stable --force-update
helm repo update

This recommendation verifies that etcd encryption at rest is enabled on the Rancher Kubernetes management platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Rancher Kubernetes management platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check etcd encryption:
kubectl get apiserver -o yaml | grep -A5 encryption

# RKE2/K3s check:
ps aux | grep kube-apiserver | grep encryption-provider-config

# Enable etcd encryption at rest (RKE2):
# /etc/rancher/rke2/config.yaml:
# secrets-encryption: true

systemctl restart rke2-server

# Verify:
rke2 secrets-encrypt status

This recommendation verifies that automated etcd backups are configured on the Rancher Kubernetes management platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Rancher Kubernetes management platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check backup configuration:
curl -sk -H "Authorization: Bearer $RANCHER_TOKEN" \
  https://rancher.example.com/v3/etcdbackups | \
  jq '.data[] | {name: .name, created: .created, state: .state}'

# Configure automated etcd backups:
# Rancher UI > Cluster > Snapshots > Recurring Snapshots
# Schedule: Every 6 hours
# Retention: 12 snapshots

# S3 backup target:
curl -sk -X POST -H "Authorization: Bearer $RANCHER_TOKEN" \
  https://rancher.example.com/v3/clusters/$CLUSTER_ID?action=backupEtcd \
  -d '{"s3BackupTarget": {"bucketName": "rancher-backups", "endpoint": "s3.amazonaws.com", "accessKey": "...", "secretKey": "..."}}'

This recommendation verifies that Rancher audit logging is enabled on the Rancher Kubernetes management platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Rancher Kubernetes management platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check Rancher audit log settings:
curl -sk -H "Authorization: Bearer $RANCHER_TOKEN" \
  https://rancher.example.com/v3/settings/audit-log | jq '.value'

# Check API audit log level:
curl -sk -H "Authorization: Bearer $RANCHER_TOKEN" \
  https://rancher.example.com/v3/settings/audit-level | jq '.value'

# Enable audit logging at level 2 (metadata):
curl -sk -X PUT -H "Authorization: Bearer $RANCHER_TOKEN" \
  https://rancher.example.com/v3/settings/audit-level \
  -d '{"value": "2"}'

# Configure cluster audit policy for Kubernetes:
# RKE2 config.yaml:
# kube-apiserver-arg:
#   - audit-policy-file=/etc/rancher/audit-policy.yaml
#   - audit-log-path=/var/log/kube-audit/audit.log
#   - audit-log-maxage=30

This recommendation verifies that monitoring stack is deployed with security alerting on the Rancher Kubernetes management platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Rancher Kubernetes management platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check Rancher monitoring:
kubectl get pods -n cattle-monitoring-system --no-headers
kubectl get servicemonitors -A --no-headers | wc -l

# Install Rancher Monitoring (Prometheus + Grafana):
# Rancher UI > Apps > Charts > Monitoring > Install

# Configure alerting:
kubectl apply -f - <<'EOF'
apiVersion: monitoring.coreos.com/v1
kind: PrometheusRule
metadata:
  name: security-alerts
  namespace: cattle-monitoring-system
spec:
  groups:
  - name: security
    rules:
    - alert: UnauthorizedAccess
      expr: apiserver_audit_event_total{verb=~"create|delete",code=~"401|403"} > 10
      for: 5m
EOF

This recommendation verifies that Rancher uses valid TLS certificates on the Rancher Kubernetes management platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Rancher Kubernetes management platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check Rancher TLS configuration:
kubectl get ingress -n cattle-system rancher -o jsonpath='{.spec.tls[*].secretName}'

# Check certificate expiry:
openssl s_client -connect rancher.example.com:443 -brief 2>/dev/null | head -3

# Rotate Rancher TLS certificate:
kubectl -n cattle-system create secret tls tls-rancher-ingress \
  --cert=tls.crt --key=tls.key --dry-run=client -o yaml | kubectl apply -f -

# For Let's Encrypt:
# Install cert-manager from Rancher Apps
kubectl apply -f https://github.com/cert-manager/cert-manager/releases/download/v1.14.0/cert-manager.yaml

This recommendation verifies that Fleet GitOps uses approved repositories only on the Rancher Kubernetes management platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Rancher Kubernetes management platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check Fleet (GitOps) configurations:
kubectl get gitrepos -A -o custom-columns=NAME:.metadata.name,REPO:.spec.repo,BRANCH:.spec.branch

# Check deployment status:
kubectl get bundles -A --no-headers | head -10

# Configure Fleet with approved repositories only:
kubectl apply -f - <<'EOF'
apiVersion: fleet.cattle.io/v1alpha1
kind: GitRepo
metadata:
  name: approved-configs
  namespace: fleet-default
spec:
  repo: https://git.example.com/fleet/configs
  branch: main
  paths:
  - /manifests
  targets:
  - clusterSelector:
      matchLabels:
        env: production
EOF