Deploying Product in CIS hardened OS or K3s

CIS-hardened OS

To successfully deploy a GetVisibility product on an operating system that has been hardened according to the CIS (Center for Internet Security) standards, there are no specific additional requirements to follow.
The product can be deployed in a standard manner.

Additional OS-hardening

If the customer has employed an "in-house" hardening process that goes beyond the official CIS recommendations, it is important to perform certain checks.

1. One key aspect to verify is the configuration of the /etc/fstab file. Ensure that the /var partition is not mounted with the noexec flag, as this could impact the functionality of the product.

CIS Hardened K3s

Our product requires several exemptions to function properly on Kubernetes K3s clusters that have been hardened in accordance with the CIS (Center for Internet Security) standards.

Specifically, the Pod Security Admission (PSA) policy needs exemptions for the cattle-monitoring-system and default namespaces. All settings within this PSA policy should be configured to the "baseline" level rather than "restricted."

The relevant configuration file for these settings is typically located at /var/lib/rancher/k3s/server/psa.yaml.
To confirm the exact location of this file in a hardened K3s environment, it is advisable to check the /etc/systemd/system/k3s.service file, which should provide the details necessary to locate and modify the psa.yaml file as detailed below.

psa.yaml:

The cattle-monitoring-system, specifically the pushprox-k3s-server-client, requires an exemption to effectively collect metrics from the nodes. Similarly, the default namespace also needs exemptions to allow multiple containers to communicate with the host.

Additionally, it is necessary to temporarily disable network policies.
This decision will be revisited after the installation of Cilium, as it will then be easier to configure and ensure that all necessary communications are properly set up.

Concerning other hardening methods, there are no critical impacts to be expected.

However, it is important to ensure that there is sufficient disk space available, especially if audit logs are to be stored on the same partition as the application. This is to prevent any potential issues related to storage constraints, which could affect the application's performance or data integrity.