Skip to content

Add ip[6]tables support for Pod Identity feature #133

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 2 commits into
base: main
Choose a base branch
from
Open

Add ip[6]tables support for Pod Identity feature #133

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
baf52c6
Add ip[6]tables support for Pod Identity feature
guessi Dec 16, 2024
69cd3f1
Merge branch 'aws-samples:main' into fix-issue-123
guessi Sep 22, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 10 additions & 2 deletions cis-bottlerocket-benchmark-eks/bottlerocket-cis-bootstrap-image/bootstrap-script.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,9 +8,13 @@ iptables -P INPUT DROP
iptables -P OUTPUT DROP
iptables -P FORWARD DROP

# Allow inbound traffic for kubelet (so kubectl logs/exec works)
# 3.4.1.1.1 Allow inbound traffic for kubelet (so kubectl logs/exec works)
iptables -I INPUT -p tcp -m tcp --dport 10250 -j ACCEPT

# 3.4.1.1.2 Allow inbound traffic to communicate with Pod Identity
iptables -I INPUT -d 169.254.170.23/32 -p tcp -m tcp --dport 80 -m comment --comment "Allow communicate with Pod Identity" -j ACCEPT
iptables -I INPUT -d 169.254.170.23/32 -p tcp -m tcp --dport 2703 -m comment --comment "Allow communicate with Pod Identity" -j ACCEPT

# 3.4.1.2 Ensure IPv4 loopback traffic is configured (Automated)
iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT
Expand All @@ -32,9 +36,13 @@ ip6tables -P INPUT DROP
ip6tables -P OUTPUT DROP
ip6tables -P FORWARD DROP

# Allow inbound traffic for kubelet on ipv6 if needed (so kubectl logs/exec works)
# 3.4.2.1.1 Allow inbound traffic for kubelet on ipv6 if needed (so kubectl logs/exec works)
ip6tables -A INPUT -p tcp --destination-port 10250 -j ACCEPT

# 3.4.2.1.2 Allow inbound traffic to communicate with Pod Identity
ip6tables -I INPUT -d fd00:ec2::23/128 -p tcp -m tcp --dport 80 -m comment --comment "Allow communicate with Pod Identity" -j ACCEPT
ip6tables -I INPUT -d fd00:ec2::23/128 -p tcp -m tcp --dport 2703 -m comment --comment "Allow communicate with Pod Identity" -j ACCEPT

# 3.4.2.2 Ensure IPv6 loopback traffic is configured (Automated)
ip6tables -A INPUT -i lo -j ACCEPT
ip6tables -A OUTPUT -o lo -j ACCEPT
Expand Down
58 changes: 56 additions & 2 deletions cis-bottlerocket-benchmark-eks/bottlerocket-cis-validating-image/validating-script.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,7 +8,7 @@ echo "This tool validates the Amazon EKS optimized AMI against CIS Bottlerocket


Num_Of_Checks_Passed=0
Total_Num_Of_Checks=26
Total_Num_Of_Checks=30

function checkSysctlConfig()
{
Expand Down Expand Up @@ -285,6 +285,33 @@ else
echo "Error Message: inputChain=$inputChain ForwardChain=$ForwardChain OutputChain=$OutputChain"
fi

RECOMMENDATION="3.4.1.1.1 Allow inbound traffic for kubelet"
InputKubeletAccept=$(iptables -L INPUT -v -n | grep "ACCEPT" | grep "dpt:10250")
if [[ ! -z "$InputKubeletAccept" ]];
then
echo "[PASS] $RECOMMENDATION"
Num_Of_Checks_Passed=$((Num_Of_Checks_Passed+1))
else
echo "[FAIL] $RECOMMENDATION"
echo "Error Message: Rule for allowing inbound traffic for kubelet not found"
fi
#echo $InputKubeletAccept


RECOMMENDATION="3.4.1.1.2 Allow inbound traffic to communicate with Pod Identity"
InputPodIdentityAccept1=$(iptables -L INPUT -v -n | grep "ACCEPT" | grep "169.254.170.23" | grep "dpt:80")
InputPodIdentityAccept2=$(iptables -L INPUT -v -n | grep "ACCEPT" | grep "169.254.170.23" | grep "dpt:2703")
if [[ ! -z "$InputPodIdentityAccept1" ]] && [[ ! -z "$InputPodIdentityAccept2" ]];
then
echo "[PASS] $RECOMMENDATION"
Num_Of_Checks_Passed=$((Num_Of_Checks_Passed+1))
else
echo "[FAIL] $RECOMMENDATION"
echo "Error Message: Rule for allowing inbound traffic for Pod Identity not found"
fi
#echo $InputPodIdentityAccept


RECOMMENDATION="3.4.1.2 Ensure IPv4 loopback traffic is configured (Automated)"
InputAccept=$(iptables -L INPUT -v -n | grep "ACCEPT all" | awk '{print $8}')
if [[ -z "$InputAccept" ]];
Expand Down Expand Up @@ -396,6 +423,33 @@ else
fi


RECOMMENDATION="3.4.2.1.1 Allow inbound traffic for kubelet"
InputKubeletAccept=$(ip6tables -L INPUT -v -n | grep "ACCEPT" | grep "dpt:10250")
if [[ ! -z "$InputKubeletAccept" ]];
then
echo "[PASS] $RECOMMENDATION"
Num_Of_Checks_Passed=$((Num_Of_Checks_Passed+1))
else
echo "[FAIL] $RECOMMENDATION"
echo "Error Message: Rule for allowing inbound traffic for kubelet not found"
fi
#echo $InputKubeletAccept


RECOMMENDATION="3.4.2.1.2 Allow inbound traffic to communicate with Pod Identity"
InputPodIdentityAccept1=$(ip6tables -L INPUT -v -n | grep "ACCEPT" | grep "fd00:ec2::23" | grep "dpt:80")
InputPodIdentityAccept2=$(ip6tables -L INPUT -v -n | grep "ACCEPT" | grep "fd00:ec2::23" | grep "dpt:2703")
if [[ ! -z "$InputPodIdentityAccept1" ]] && [[ ! -z "$InputPodIdentityAccept2" ]];
then
echo "[PASS] $RECOMMENDATION"
Num_Of_Checks_Passed=$((Num_Of_Checks_Passed+1))
else
echo "[FAIL] $RECOMMENDATION"
echo "Error Message: Rule for allowing inbound traffic for Pod Identity not found"
fi
#echo $InputPodIdentityAccept


RECOMMENDATION="3.4.2.2 Ensure IPv6 loopback traffic is configured (Automated)"
InputAccept=$(ip6tables -L INPUT -v -n | grep "ACCEPT all" | awk '{print $7}')
if [[ -z "$InputAccept" ]];
Expand Down Expand Up @@ -506,4 +560,4 @@ else
echo "Error Message: journal permissions=$journal_perms"
fi

echo "$Num_Of_Checks_Passed/$Total_Num_Of_Checks checks passed"
echo "$Num_Of_Checks_Passed/$Total_Num_Of_Checks checks passed"