38_check_control_plane_security.yml - Usage Guide

Read-Only Security

Purpose

Auto-detects kubeadm or k3s configuration on the first control-plane host and checks:

  • Anonymous authentication
  • Node,RBAC authorization and AlwaysAllow
  • Insecure port and profiling
  • Audit policy/backend
  • Secret encryption-at-rest provider order
  • NodeRestriction admission plugin
  • Minimum TLS version
  • File permissions on admin.conf, k3s.yaml, and private keys

Key material inside encryption providers is never written to output.

Variables

Variable Default Description
control_plane_security_fail_on_critical false Fails the playbook on a critical finding

How to run 

ansible-playbook -i inventories/musteri_a/hosts.ini playbooks/38_check_control_plane_security.yml

ansible-playbook -i inventories/musteri_a/hosts.ini playbooks/38_check_control_plane_security.yml \
  --extra-vars 'control_plane_security_fail_on_critical=true'

Distribution vendors may apply some settings in different ways; warnings should be evaluated together with the cluster configuration.

Official references: Encrypting Confidential Data at Rest, Kubernetes Auditing