CIS Compliant Hardening of a k3s Cluster created with vitobotta/hetzner-k3s

[vatro]

Hi! :) Great tool 👍

I'm currently working on a small cluster primarily for serving "standard" websites, still, the cluster should be reasonably hardened. I've ran the kube-bench scan which led me to this k3s CIS hardening guides:

• https://docs.k3s.io/security/hardening-guide
• https://docs.k3s.io/security/self-assessment-1.8
• https://docs.k3s.io/security/self-assessment-1.7

The amount of measures to be considered / to be taken is quite huge. It would be nice to have some basic guidance / recommendations on this topic, like "CIS Compliant Hardening - Basic".

Thanks + keep up the great work! 😁🚀

[vitobotta]

Hi there, did kube-bench highlight any specific issues that you're interested in? I haven't had the opportunity to tweak any of these settings yet because I assumed the default values for k3s are suitable for the type of workloads I run.

[vatro]

In this (older) Reddit post (k3s vs RKE2) comments from people who sound reliable on this matter suggest using RKE2 for production clusters for various reasons. I'm kinda new to this space, so I cannot elaborate / have my own strong opinion on this, but offering k3s/RKE2 option could be a great move for your tool: who wouldn't want CIS compliant security out-of-the-box? 🤔 Looking at RKE2 requirements I don't see any hurdles concerning min. server specs, they align with smallest Hetzner servers. It seems one major difference would be the obligatory 'etcd' as backend, the rest of master / worker setup shouldn't differ much (? just a guess atm) (see below).

[vitobotta]

K3s is generally simpler and works well in most cases. RKE2 does provide improved security for certain aspects, but most individuals don't require that level of criticality that governments etc need.

[vatro]

I understand that full CIS compliance is most probably over-the-top for most workloads.

I've did some more research concerning:

the rest of master / worker setup shouldn't differ much (? just a guess atm).

turns out the setup process for RKE2 is quite different and way more involved compared to k3s.

I've then let Perplexity analyze (deep) your repo concerning converting hetzner-k3s to hetzner-rke2 complexity with the result: "a moderate to high complexity undertaking that would require approximately 3-4 months of focused development effort"

I'll just drop it here in case you want to take a look at it:
Converting_hetzner-k3s_to_hetzner-rke2_Complexity.md

Now, I think it may not be worth the effort, but that's on you to decide.

I think it may be worth the effort to nail down the most basic / crucial CIS compliance adjustments following the official k3s hardening guides and put them inside "Security Recommendations". A "cis-mode", where those adjustments which can be automated are, would also be cool imho.

[vitobotta]

I will look into it at some point, but it's not something that has been requested before in 3 years I have been working with hetzner-k3s. You are the first person to inquiry about this aspect :)

[vatro]

ok, I'm kinda glad to hear that 😅