vania-janet/multiturn-rag-retrieval-data huggingface dataset:
Version 1.22 CIS Kubernetes benchmark 

The Center for Internet Security (CIS) publishes the [CIS Kubernetes Benchmark](https://www.cisecurity.org/benchmark/kubernetes/) as a framework of specific steps to configure Kubernetes more securely and with standards that are commensurate to various industry regulations. This document contains the results of the version 1.5 CIS Kubernetes benchmark for clusters that run Kubernetes version 1.22. For more information or help understanding the benchmark, see [Using the benchmark](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark).



 1 Master node security configuration 

Review the Master node security configuration results of the version 1.5 CIS Kubernetes benchmark.



 1.1 Master node configuration files 



Section 1.1 Master node benchmark results

 Section Recommendation Scored/Not Scored Level Result Responsibility 

 1.1.1 Ensure that the API server pod specification file permissions are set to 644 or more restrictive. Scored 1 Pass IBM 
 1.1.2 Ensure that the API server pod specification file ownership is set to root:root. Scored 1 Pass IBM 
 1.1.3 Ensure that the controller manager pod specification file permissions are set to 644 or more restrictive. Scored 1 Pass IBM 
 1.1.4 Ensure that the controller manager pod specification file ownership is set to root:root. Scored 1 Pass IBM 
 1.1.5 Ensure that the scheduler pod specification file permissions are set to 644 or more restrictive. Scored 1 Pass IBM 
 1.1.6 Ensure that the scheduler pod specification file ownership is set to root:root. Scored 1 Pass IBM 
 1.1.7 Ensure that the etcd pod specification file permissions are set to 644 or more restrictive. Scored 1 Pass IBM 
 1.1.8 Ensure that the etcd pod specification file ownership is set to root:root. Scored 1 Pass IBM 
 1.1.9 Ensure that the Container Network Interface file permissions are set to 644 or more restrictive. Not Scored 1 Pass IBM
[Version 1.23 CIS Kubernetes benchmark](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-123cis-benchmark-123)



* [1 Master node security configuration](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-123cis-section-1-123)



* [1.1 Master node configuration files](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-123cis-benchmark-11-123)
* [1.2 API server](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-123cis-benchmark-12-123)
* [1.3 Controller manager](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-123cis-benchmark-13-123)
* [1.4 Scheduler](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-123cis-benchmark-14-123)



* [2 Etcd node configuration](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-123cis-section-2-123)
* [3 Control plane configuration](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-123cis-section-3-123)



* [3.1 Authentication and authorization](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-123cis-benchmark-31-123)
* [3.2 Logging](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-123cis-benchmark-32-123)



* [4 Worker node security configuration](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark-123cis-section-4-123)
Version 1.20 CIS Kubernetes benchmark 

The Center for Internet Security (CIS) publishes the [CIS Kubernetes Benchmark](https://www.cisecurity.org/benchmark/kubernetes/) as a framework of specific steps to configure Kubernetes more securely and with standards that are commensurate to various industry regulations. This document contains the results of the version 1.5 CIS Kubernetes benchmark for clusters that run Kubernetes version 1.20. For more information or help understanding the benchmark, see [Using the benchmark](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark).



 1 Master node security configuration 

Review the Master node security configuration results of the version 1.5 CIS Kubernetes benchmark.



 1.1 Master node configuration files 



Section 1.1 Master node benchmark results

 Section Recommendation Scored/Not Scored Level Result Responsibility 

 1.1.1 Ensure that the API server pod specification file permissions are set to 644 or more restrictive. Scored 1 Pass IBM 
 1.1.2 Ensure that the API server pod specification file ownership is set to root:root. Scored 1 Pass IBM 
 1.1.3 Ensure that the controller manager pod specification file permissions are set to 644 or more restrictive. Scored 1 Pass IBM 
 1.1.4 Ensure that the controller manager pod specification file ownership is set to root:root. Scored 1 Pass IBM 
 1.1.5 Ensure that the scheduler pod specification file permissions are set to 644 or more restrictive. Scored 1 Pass IBM 
 1.1.6 Ensure that the scheduler pod specification file ownership is set to root:root. Scored 1 Pass IBM 
 1.1.7 Ensure that the etcd pod specification file permissions are set to 644 or more restrictive. Scored 1 Pass IBM 
 1.1.8 Ensure that the etcd pod specification file ownership is set to root:root. Scored 1 Pass IBM 
 1.1.9 Ensure that the Container Network Interface file permissions are set to 644 or more restrictive. Not Scored 1 Pass IBM
Version 1.25 CIS Kubernetes benchmark 

The Center for Internet Security (CIS) publishes the [CIS Kubernetes Benchmark](https://www.cisecurity.org/benchmark/kubernetes/) as a framework of specific steps to configure Kubernetes more securely and with standards that are commensurate to various industry regulations. This document contains the results of the version 1.5 CIS Kubernetes benchmark for clusters that run Kubernetes version 1.25. For more information or help understanding the benchmark, see [Using the benchmark](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmark).



 1 Master node security configuration 

Review the Master node security configuration results of the version 1.5 CIS Kubernetes benchmark.



 1.1 Master node configuration files 



Section 1.1 Master node benchmark results

 Section Recommendation Scored? Level Result Responsibility 

 1.1.1 Ensure that the API server pod specification file permissions are set to 644 or more restrictive. Scored 1 Pass IBM 
 1.1.2 Ensure that the API server pod specification file ownership is set to root:root. Scored 1 Pass IBM 
 1.1.3 Ensure that the controller manager pod specification file permissions are set to 644 or more restrictive. Scored 1 Pass IBM 
 1.1.4 Ensure that the controller manager pod specification file ownership is set to root:root. Scored 1 Pass IBM 
 1.1.5 Ensure that the scheduler pod specification file permissions are set to 644 or more restrictive. Scored 1 Pass IBM 
 1.1.6 Ensure that the scheduler pod specification file ownership is set to root:root. Scored 1 Pass IBM 
 1.1.7 Ensure that the etcd pod specification file permissions are set to 644 or more restrictive. Scored 1 Pass IBM 
 1.1.8 Ensure that the etcd pod specification file ownership is set to root:root. Scored 1 Pass IBM 
 1.1.9 Ensure that the Container Network Interface file permissions are set to 644 or more restrictive. Not Scored 1 Pass IBM
Kubernetes version 1.27 CIS Kubernetes Benchmark 

The Center for Internet Security (CIS) publishes the [CIS Kubernetes Benchmark](https://www.cisecurity.org/benchmark/kubernetes/) as a framework of specific steps to configure Kubernetes more securely and with standards that are commensurate to various industry regulations. This document contains the results of the version 1.5 CIS Kubernetes benchmark for clusters that run Kubernetes version 1.27. For more information or help understanding the benchmark, see [Using the benchmark](https://cloud.ibm.com/docs/containers?topic=containers-cis-benchmarkcis-benchmark-use).



 1 Master node security configuration 

Review the Master node security configuration results of the version 1.5 CIS Kubernetes benchmark.



 1.1 Master node configuration files 



Section 1.1 Master node benchmark results

 Section Recommendation Scored? Level Result Responsibility 

 1.1.1 Ensure that the API server pod specification file permissions are set to 644 or more restrictive Scored 1 Pass IBM 
 1.1.2 Ensure that the API server pod specification file ownership is set to root:root Scored 1 Pass IBM 
 1.1.3 Ensure that the controller manager pod specification file permissions are set to 644 or more restrictive Scored 1 Pass IBM 
 1.1.4 Ensure that the controller manager pod specification file ownership is set to root:root Scored 1 Pass IBM 
 1.1.5 Ensure that the scheduler pod specification file permissions are set to 644 or more restrictive Scored 1 Pass IBM 
 1.1.6 Ensure that the scheduler pod specification file ownership is set to root:root Scored 1 Pass IBM 
 1.1.7 Ensure that the etcd pod specification file permissions are set to 644 or more restrictive Scored 1 Pass IBM 
 1.1.8 Ensure that the etcd pod specification file ownership is set to root:root Scored 1 Pass IBM 
 1.1.9 Ensure that the Container Network Interface file permissions are set to 644 or more restrictive Not Scored 1 Pass IBM 
 1.1.10 Ensure that the Container Network Interface file ownership is set to root:root Not Scored 1 Pass IBM
Version 4.7 is unsupported.



 Red Hat OpenShift on IBM Cloud version 4.7 CIS Kubernetes Benchmark 

The Center for Internet Security (CIS) publishes the [CIS Kubernetes Benchmark](https://www.cisecurity.org/benchmark/kubernetes/) as a framework of specific steps to configure Kubernetes more securely and with standards that are commensurate to various industry regulations. This document contains the results of the version 1.5 CIS Kubernetes benchmark for clusters that run Red Hat OpenShift on IBM Cloud version 4.7. For more information or help understanding the benchmark, see [Using the benchmark](https://cloud.ibm.com/docs/openshift?topic=openshift-cis-benchmark).



 1 Master node security configuration 

Review the Master node security configuration results of the version 1.5 CIS Kubernetes benchmark.



 1.1 Master node configuration files 



Section 1.1 Master node benchmark results

 Section Recommendation Scored/Not Scored Level Result Responsibility 

 1.1.1 Ensure that the API server pod specification file permissions are set to 644 or more restrictive. Scored 1 Pass IBM 
 1.1.2 Ensure that the API server pod specification file ownership is set to root:root. Scored 1 Pass IBM 
 1.1.3 Ensure that the controller manager pod specification file permissions are set to 644 or more restrictive. Scored 1 Pass IBM 
 1.1.4 Ensure that the controller manager pod specification file ownership is set to root:root. Scored 1 Pass IBM 
 1.1.5 Ensure that the scheduler pod specification file permissions are set to 644 or more restrictive. Scored 1 Pass IBM 
 1.1.6 Ensure that the scheduler pod specification file ownership is set to root:root. Scored 1 Pass IBM 
 1.1.7 Ensure that the etcd pod specification file permissions are set to 644 or more restrictive. Scored 1 Pass IBM 
 1.1.8 Ensure that the etcd pod specification file ownership is set to root:root. Scored 1 Pass IBM
Red Hat OpenShift on IBM Cloud version 4.6 CIS Kubernetes Benchmark 

Version 4.6 is unsupported.

The Center for Internet Security (CIS) publishes the [CIS Kubernetes Benchmark](https://www.cisecurity.org/benchmark/kubernetes/) as a framework of specific steps to configure Kubernetes more securely and with standards that are commensurate to various industry regulations. This document contains the results of the version 1.5 CIS Kubernetes benchmark for clusters that run Red Hat OpenShift on IBM Cloud version 4.6. For more information or help understanding the benchmark, see [Using the benchmark](https://cloud.ibm.com/docs/openshift?topic=openshift-cis-benchmark).



 1 Master node security configuration 

Review the Master node security configuration results of the version 1.5 CIS Kubernetes benchmark.



 1.1 Master node configuration files 



Section 1.1 Master node benchmark results

 Section Recommendation Scored/Not Scored Level Result Responsibility 

 1.1.1 Ensure that the API server pod specification file permissions are set to 644 or more restrictive. Scored 1 Pass IBM 
 1.1.2 Ensure that the API server pod specification file ownership is set to root:root. Scored 1 Pass IBM 
 1.1.3 Ensure that the controller manager pod specification file permissions are set to 644 or more restrictive. Scored 1 Pass IBM 
 1.1.4 Ensure that the controller manager pod specification file ownership is set to root:root. Scored 1 Pass IBM 
 1.1.5 Ensure that the scheduler pod specification file permissions are set to 644 or more restrictive. Scored 1 Pass IBM 
 1.1.6 Ensure that the scheduler pod specification file ownership is set to root:root. Scored 1 Pass IBM 
 1.1.7 Ensure that the etcd pod specification file permissions are set to 644 or more restrictive. Scored 1 Pass IBM 
 1.1.8 Ensure that the etcd pod specification file ownership is set to root:root. Scored 1 Pass IBM
Red Hat OpenShift on IBM Cloud version 4.10 CIS Kubernetes Benchmark 

The Center for Internet Security (CIS) publishes the [CIS Kubernetes Benchmark](https://www.cisecurity.org/benchmark/kubernetes/) as a framework of specific steps to configure Kubernetes more securely and with standards that are commensurate to various industry regulations. This document contains the results of the version 1.5 CIS Kubernetes benchmark for clusters that run Red Hat OpenShift on IBM Cloud version 4.10. For more information or help understanding the benchmark, see [Using the benchmark](https://cloud.ibm.com/docs/openshift?topic=openshift-cis-benchmark).



 1 Master node security configuration 

Review the Master node security configuration results of the version 1.5 CIS Kubernetes benchmark.



 1.1 Master node configuration files 



Section 1.1 Master node benchmark results

 Section Recommendation Scored/Not Scored Level Result Responsibility 

 1.1.1 Ensure that the API server pod specification file permissions are set to 644 or more restrictive Scored 1 Pass IBM 
 1.1.2 Ensure that the API server pod specification file ownership is set to root:root. Scored 1 Pass IBM 
 1.1.3 Ensure that the controller manager pod specification file permissions are set to 644 or more restrictive. Scored 1 Pass IBM 
 1.1.4 Ensure that the controller manager pod specification file ownership is set to root:root. Scored 1 Pass IBM 
 1.1.5 Ensure that the scheduler pod specification file permissions are set to 644 or more restrictive. Scored 1 Pass IBM 
 1.1.6 Ensure that the scheduler pod specification file ownership is set to root:root. Scored 1 Pass IBM 
 1.1.7 Ensure that the etcd pod specification file permissions are set to 644 or more restrictive. Scored 1 Pass IBM 
 1.1.8 Ensure that the etcd pod specification file ownership is set to root:root. Scored 1 Pass IBM 
 1.1.9 Ensure that the Container Network Interface file permissions are set to 644 or more restrictive.
[Red Hat OpenShift on IBM Cloud version 4.6 CIS Kubernetes Benchmark](https://cloud.ibm.com/docs/openshift?topic=openshift-cis-benchmark-46cis-benchmark-46)



* [1 Master node security configuration](https://cloud.ibm.com/docs/openshift?topic=openshift-cis-benchmark-46cis-section-1-46)



* [1.1 Master node configuration files](https://cloud.ibm.com/docs/openshift?topic=openshift-cis-benchmark-46cis-benchmark-11-46)
* [1.2 API server](https://cloud.ibm.com/docs/openshift?topic=openshift-cis-benchmark-46cis-benchmark-12-46)
* [1.3 Controller manager](https://cloud.ibm.com/docs/openshift?topic=openshift-cis-benchmark-46cis-benchmark-13-46)
* [1.4 Scheduler](https://cloud.ibm.com/docs/openshift?topic=openshift-cis-benchmark-46cis-benchmark-14-46)



* [2 Etcd node configuration](https://cloud.ibm.com/docs/openshift?topic=openshift-cis-benchmark-46cis-section-2-46)
* [3 Control plane configuration](https://cloud.ibm.com/docs/openshift?topic=openshift-cis-benchmark-46cis-section-3-46)



* [3.1 Authentication and authorization](https://cloud.ibm.com/docs/openshift?topic=openshift-cis-benchmark-46cis-benchmark-31-46)
* [3.2 Logging](https://cloud.ibm.com/docs/openshift?topic=openshift-cis-benchmark-46cis-benchmark-32-46)
Red Hat OpenShift on IBM Cloud version 4.9 CIS Kubernetes Benchmark 

This version is deprecated.

The Center for Internet Security (CIS) publishes the [CIS Kubernetes Benchmark](https://www.cisecurity.org/benchmark/kubernetes/) as a framework of specific steps to configure Kubernetes more securely and with standards that are commensurate to various industry regulations. This document contains the results of the version 1.5 CIS Kubernetes benchmark for clusters that run Red Hat OpenShift on IBM Cloud version 4.9. For more information or help understanding the benchmark, see [Using the benchmark](https://cloud.ibm.com/docs/openshift?topic=openshift-cis-benchmark).



 1 Master node security configuration 

Review the Master node security configuration results of the version 1.5 CIS Kubernetes benchmark.



 1.1 Master node configuration files 



Section 1.1 Master node benchmark results

 Section Recommendation Scored/Not Scored Level Result Responsibility 

 1.1.1 Ensure that the API server pod specification file permissions are set to 644 or more restrictive. Scored 1 Pass IBM 
 1.1.2 Ensure that the API server pod specification file ownership is set to root:root. Scored 1 Pass IBM 
 1.1.3 Ensure that the controller manager pod specification file permissions are set to 644 or more restrictive. Scored 1 Pass IBM 
 1.1.4 Ensure that the controller manager pod specification file ownership is set to root:root. Scored 1 Pass IBM 
 1.1.5 Ensure that the scheduler pod specification file permissions are set to 644 or more restrictive. Scored 1 Pass IBM 
 1.1.6 Ensure that the scheduler pod specification file ownership is set to root:root. Scored 1 Pass IBM 
 1.1.7 Ensure that the etcd pod specification file permissions are set to 644 or more restrictive. Scored 1 Pass IBM 
 1.1.8 Ensure that the etcd pod specification file ownership is set to root:root. Scored 1 Pass IBM
p



 Red Hat OpenShift on IBM Cloud version 4.8 CIS Kubernetes Benchmark 

This version is deprecated.

The Center for Internet Security (CIS) publishes the [CIS Kubernetes Benchmark](https://www.cisecurity.org/benchmark/kubernetes/) as a framework of specific steps to configure Kubernetes more securely and with standards that are commensurate to various industry regulations. This document contains the results of the version 1.5 CIS Kubernetes benchmark for clusters that run Red Hat OpenShift on IBM Cloud version 4.8 For more information or help understanding the benchmark, see [Using the benchmark](https://cloud.ibm.com/docs/openshift?topic=openshift-cis-benchmark).



 1 Master node security configuration 

Review the Master node security configuration results of the version 1.5 CIS Kubernetes benchmark.



 1.1 Master node configuration files 



Section 1.1 Master node benchmark results

 Section Recommendation Scored/Not Scored Level Result Responsibility 

 1.1.1 Ensure that the API server pod specification file permissions are set to 644 or more restrictive. Scored 1 Pass IBM 
 1.1.2 Ensure that the API server pod specification file ownership is set to root:root. Scored 1 Pass IBM 
 1.1.3 Ensure that the controller manager pod specification file permissions are set to 644 or more restrictive. Scored 1 Pass IBM 
 1.1.4 Ensure that the controller manager pod specification file ownership is set to root:root. Scored 1 Pass IBM 
 1.1.5 Ensure that the scheduler pod specification file permissions are set to 644 or more restrictive. Scored 1 Pass IBM 
 1.1.6 Ensure that the scheduler pod specification file ownership is set to root:root. Scored 1 Pass IBM 
 1.1.7 Ensure that the etcd pod specification file permissions are set to 644 or more restrictive. Scored 1 Pass IBM 
 1.1.8 Ensure that the etcd pod specification file ownership is set to root:root. Scored 1 Pass IBM
[Red Hat OpenShift on IBM Cloud version 4.8 CIS Kubernetes Benchmark](https://cloud.ibm.com/docs/openshift?topic=openshift-cis-benchmark-48cis-benchmark-48)



* [1 Master node security configuration](https://cloud.ibm.com/docs/openshift?topic=openshift-cis-benchmark-48cis-section-1-48)



* [1.1 Master node configuration files](https://cloud.ibm.com/docs/openshift?topic=openshift-cis-benchmark-48cis-benchmark-11-48)
* [1.2 API server](https://cloud.ibm.com/docs/openshift?topic=openshift-cis-benchmark-48cis-benchmark-12-48)
* [1.3 Controller manager](https://cloud.ibm.com/docs/openshift?topic=openshift-cis-benchmark-48cis-benchmark-13-48)
* [1.4 Scheduler](https://cloud.ibm.com/docs/openshift?topic=openshift-cis-benchmark-48cis-benchmark-14-48)



* [2 Etcd node configuration](https://cloud.ibm.com/docs/openshift?topic=openshift-cis-benchmark-48cis-section-2-48)
* [3 Control plane configuration](https://cloud.ibm.com/docs/openshift?topic=openshift-cis-benchmark-48cis-section-3-48)



* [3.1 Authentication and authorization](https://cloud.ibm.com/docs/openshift?topic=openshift-cis-benchmark-48cis-benchmark-31-48)
* [3.2 Logging](https://cloud.ibm.com/docs/openshift?topic=openshift-cis-benchmark-48cis-benchmark-32-48)
To review the results of the CIS Kubernetes benchmark for Section 4: Worker node security configuration, you can run the test yourself. Because you own the worker nodes and are partially [responsible](https://cloud.ibm.com/docs/containers?topic=containers-responsibilities_iks) for their compliance, you might make configuration changes that you want to validate on your own.

Before you begin: [Log in to your account. If applicable, target the appropriate resource group. Set the context for your cluster.](https://cloud.ibm.com/docs/containers?topic=containers-access_cluster)



1. Create a namespace for the resources to run the benchmark.

kubectl create ns ibm-kube-bench-test
2. Create a ConfigMap with the config and node configuration files from the [kube-samples](https://github.com/IBM-Cloud/kube-samples/tree/master/cis-kube-benchmark/cis-1.5/ibm) GitHub repository.



1. Download the the config and node configuration files into a local directory called ibm. You can also clone the repository and navigate into the ibm directory.



* [config file](https://raw.githubusercontent.com/IBM-Cloud/kube-samples/master/cis-kube-benchmark/cis-1.5/ibm/config.yaml)
* [node file](https://raw.githubusercontent.com/IBM-Cloud/kube-samples/master/cis-kube-benchmark/cis-1.5/ibm/node.yaml)



2. Create the ConfigMap by using the --from-file option to specify the ibm directory where your downloaded the configuration files.

kubectl create cm kube-bench-node -n ibm-kube-bench-test --from-file ibm



3. Create a job to run the benchmark test based on the configurations that you previously created.