[Release-1.26] - [RKE2] CIS Benchmark 1.24 requires file permissions to be 600 instead of 644

[dereknola]

Backport fix for [RKE2] CIS Benchmark 1.24 requires file permissions to be 600 instead of 644

• [RKE2] CIS Benchmark 1.24 requires file permissions to be 600 instead of 644 #4473

[aganesh-suse]

Validated on release-1.26 branch with commit 6929197

Environment Details

Infrastructure

• Cloud
• Hosted

Node(s) CPU architecture, OS, and Version:

cat /etc/os-release | grep PRETTY
PRETTY_NAME="Ubuntu 22.04.2 LTS"

Cluster Configuration:

1 server, 1 agent

Config.yaml:

token: secret
write-kubeconfig-mode: "0644"
node-external-ip: 1.1.1.1
profile: "cis"

Testing Steps

1. Copy config.yaml

$ sudo mkdir -p /etc/rancher/rke2 && sudo cp config.yaml /etc/rancher/rke2

2. Install RKE2

curl -sfL https://get.rke2.io | sudo INSTALL_RKE2_COMMIT='69291975b23b181b6bd35a87b47b03b770304e3b' INSTALL_RKE2_TYPE='server' INSTALL_RKE2_METHOD=tar sh -

3. Follow https://docs.rke2.io/security/hardening_guide

$ sudo useradd -r -c "etcd user" -s /sbin/nologin -M etcd -U
$ sudo cp -f /usr/local/share/rke2/rke2-cis-sysctl.conf /etc/sysctl.d/60-rke2-cis.conf 
$ cat /etc/sysctl.d/60-rke2-cis.conf 
vm.panic_on_oom=0
vm.overcommit_memory=1
kernel.panic=10
kernel.panic_on_oops=1
$ sudo systemctl restart systemd-sysctl 
$ sudo systemctl enable --now rke2-server
or 
$ sudo systemctl enable --now rke2-agent

4. Verify files in following directories have a permission of 600.

/var/lib/rancher/rke2/agent/pod-manifests/
/var/lib/rancher/rke2/server/cred
/var/lib/rancher/rke2/agent/

Validation Results:

• rke2 version used for validation:

rke2 -v
rke2 version v1.26.9+dev.69291975 (69291975b23b181b6bd35a87b47b03b770304e3b)
go version go1.20.8 X:boringcrypto

Verify files in following directories have a permission of 600:

$ sudo ls -lrt /var/lib/rancher/rke2/agent/pod-manifests/ 
total 36
-rw------- 1 root root  3338 Oct  5 17:56 etcd.yaml
-rw------- 1 root root 10195 Oct  5 17:57 kube-apiserver.yaml
-rw------- 1 root root  5873 Oct  5 17:57 kube-controller-manager.yaml
-rw------- 1 root root  2729 Oct  5 17:57 kube-scheduler.yaml
-rw------- 1 root root  3765 Oct  5 17:57 cloud-controller-manager.yaml
-rw------- 1 root root  2442 Oct  5 17:58 kube-proxy.yaml

$ sudo ls -lrt /var/lib/rancher/rke2/server/cred 
total 40
-rw------- 1 root root 485 Oct  5 17:56 supervisor.kubeconfig
-rw------- 1 root root 485 Oct  5 17:56 controller.kubeconfig
-rw------- 1 root root 475 Oct  5 17:56 admin.kubeconfig
-rw------- 1 root root 483 Oct  5 17:56 scheduler.kubeconfig
-rw------- 1 root root 493 Oct  5 17:56 api-server.kubeconfig
-rw------- 1 root root 507 Oct  5 17:56 cloud-controller.kubeconfig
-rw------- 1 root root  61 Oct  5 17:56 passwd
-rw------- 1 root root  97 Oct  5 17:56 ipsec.psk
-rw------- 1 root root  70 Oct  5 17:56 encryption-state.json
-rw------- 1 root root 245 Oct  5 17:56 encryption-config.json

$ sudo ls -lrt /var/lib/rancher/rke2/agent/ 
total 72
drwxr-xr-x  2 root root 4096 Oct  5 17:56 images
-rw-------  1 root root  570 Oct  5 17:56 client-ca.crt
-rw-------  1 root root  570 Oct  5 17:56 server-ca.crt
-rw-------  1 root root  227 Oct  5 17:56 serving-kubelet.key
-rw-------  1 root root 1230 Oct  5 17:56 serving-kubelet.crt
-rw-------  1 root root  464 Oct  5 17:56 kubelet.kubeconfig
-rw-------  1 root root  227 Oct  5 17:56 client-kubelet.key
-rw-------  1 root root 1193 Oct  5 17:56 client-kubelet.crt
-rw-------  1 root root  470 Oct  5 17:56 kubeproxy.kubeconfig
-rw-------  1 root root  227 Oct  5 17:56 client-kube-proxy.key
-rw-------  1 root root 1149 Oct  5 17:56 client-kube-proxy.crt
-rw-------  1 root root  480 Oct  5 17:56 rke2controller.kubeconfig
-rw-------  1 root root  227 Oct  5 17:56 client-rke2-controller.key
-rw-------  1 root root 1153 Oct  5 17:56 client-rke2-controller.crt
drwx------  3 root root 4096 Oct  5 17:56 etc
drwxr-xr-x  2 root root 4096 Oct  5 17:57 logs
drwx------ 15 root root 4096 Oct  5 17:57 containerd
drwx------  2 root root 4096 Oct  5 17:58 pod-manifests

Cluster Status:

$ kubectl get nodes
NAME               STATUS   ROLES                       AGE   VERSION
ip-1                Ready    <none>                      12m   v1.26.9+rke2r1
ip-2                Ready    control-plane,etcd,master   14m   v1.26.9+rke2r1

$ kubectl get pods -A
NAMESPACE     NAME                                                    READY   STATUS      RESTARTS   AGE
kube-system   cloud-controller-manager-ip-2                           1/1     Running     0          13m
kube-system   etcd-ip-2                                               1/1     Running     0          13m
kube-system   helm-install-rke2-canal-gjjdg                           0/1     Completed   0          14m
kube-system   helm-install-rke2-coredns-fzhwj                         0/1     Completed   0          14m
kube-system   helm-install-rke2-ingress-nginx-54nhj                   0/1     Completed   0          14m
kube-system   helm-install-rke2-metrics-server-q76kd                  0/1     Completed   0          14m
kube-system   helm-install-rke2-snapshot-controller-crd-x678s         0/1     Completed   0          14m
kube-system   helm-install-rke2-snapshot-controller-sthbq             0/1     Completed   1          14m
kube-system   helm-install-rke2-snapshot-validation-webhook-s9r99     0/1     Completed   0          14m
kube-system   kube-apiserver-ip-2                                     1/1     Running     0          13m
kube-system   kube-controller-manager-ip-2                            1/1     Running     0          13m
kube-system   kube-proxy-ip-1                                         1/1     Running     0          12m
kube-system   kube-proxy-ip-2                                         1/1     Running     0          13m
kube-system   kube-scheduler-ip-2                                     1/1     Running     0          13m
kube-system   rke2-canal-4xndp                                        2/2     Running     0          12m
kube-system   rke2-canal-p2r8z                                        2/2     Running     0          13m
kube-system   rke2-coredns-rke2-coredns-7c98b7488c-kr9bc              1/1     Running     0          12m
kube-system   rke2-coredns-rke2-coredns-7c98b7488c-twn7n              1/1     Running     0          13m
kube-system   rke2-coredns-rke2-coredns-autoscaler-65b5bfc754-q72bd   1/1     Running     0          13m
kube-system   rke2-ingress-nginx-controller-bhlmn                     1/1     Running     0          12m
kube-system   rke2-ingress-nginx-controller-jlkh5                     1/1     Running     0          12m
kube-system   rke2-metrics-server-5bf59cdccb-x7szx                    1/1     Running     0          13m
kube-system   rke2-snapshot-controller-6f7bbb497d-89s78               1/1     Running     0          12m
kube-system   rke2-snapshot-validation-webhook-65b5675d5c-5s7ht       1/1     Running     0          13m