Sysctls are required for cis-hardening to work

[KoltesDigital]

Summary

These six sysctls are required, matching the source code.

It's well hidden in your documentation and it only mentions two of them.

What Should Happen Instead?

Enabling cis-hardening should set them, or at least give a hint about them.

Reproduction Steps

1. Install a fresh Ubuntu Server 23.04.
2. sudo snap install microk8s --classic --channel=1.28
3. sudo microk8s enable cis-hardening
4. sudo reboot
5. Observe that it's unstable.

Introspection Report

None

Can you suggest a fix?

I could if you agree first on what should be done.

Are you interested in contributing with a fix?

Depends on its scope. I spent many hours to track down that issue, I could give some more.

[ktsakalozos]

Hi @KoltesDigital, thank you for reporting this and finding the root of the cause in this issue.

Assuming that anyone enabling CIS-hardening has some level of expertise we could ask him to check that the node is setup correctly and perform any changes. The microk8s snap could perform these checks/changes too but this is an approach we would rather avoid as it would mean we would need to break snap isolation and touch the host operating system.

So the action items we should have is to:

• update the cis-hardening message to inform the users of the extra configuration they potentially need to perform https://github.com/canonical/microk8s-core-addons/blob/main/addons/cis-hardening/enable#L387
• update the docs page https://microk8s.io/docs/how-to-cis-harden

Would this be enough @KoltesDigital? Wdyt?

[KoltesDigital]

Hi @ktsakalozos,

Updating the docs is mandatory of course :)

I didn't thought about snap isolation. So I guess a message after install is the best available solution.

Would it be violated if the enable script only checks, not touches, the host OS? With the aim of displaying the message only when the OS isn't already configured.

[ktsakalozos]

@KoltesDigital we are patching the deployment message in the addon and the docs. I am keeping this issue open incase you are interested in contributing some logic to improve the messaging by inspect the OS. Thank you.

[stale]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.