Description of problem: The customer was asked by the security department to follow security recommendations that are a result of OpenSCAP Security test. They can change these settings for the cluster, but we do not have probably tested these changes regularly so I am creating this Bugzilla to establish discussion about this topic with the engineering. Security recommendations: - Change the owner and group of /var/lib/etcd to root:root - Change the permissions of /etc/origin/master/master-config.yaml to 0600 - Change the permissions of /etc/origin/master/scheduler.json to 0600 - Add RotateKubeletServerCertificate=true to the master-config.yaml file Change these kubelet arguments for both master and node: - Disable cadvisor port by setting cadvisor-port to 0 - Disable Read-only port by settings read-only-port to 0
Can you advise if these guidelines are needed from a Red Hat point of view?