kubeone installation issues in a hardened environment

[dharapvj]

What happened?

When attempted to use kubeone to install kuberenetes in a security hardened environment, i encountered following issues:

1. /etc/kubeone/proxy-env - Permission denied
2. ssh - administratively provibited.

Expected behavior

kubeone installation should proceed without any issues and succeed.

How to reproduce the issue?

Issue 1

1. set umask to 0027 in the control plane nodes.
2. set some proxy values in kubeone.yaml
3. run kubeone apply. kubeone uses sudo to create the proxy-env file which gets created fine but the regular login user does not have access to it (because of umask others do not have access to /etc/kubeone directory and the file within)

Issue 2

1. On the control plane machines, edit /etc/ssh/sshd_config to add DisableForwarding yes
2. Restart sshd service by sudo systemctl restart sshd.service
3. run kubeone apply.
4. You will not be able to reach control plane machine during the csr-approval stage with error administratively prohibited

What KubeOne version are you using?

Kubeone v1.10.0

What cloud provider are you running on?

vsphere

What operating system are you running in your cluster?

RHEL

[dharapvj]

For issue 1 - I think this is the line where we will face issues since the regular ssh user will not have read rights to proxy-env file.

kubeone/pkg/scripts/proxy.go

Line 66 in d148423

grep = /etc/kubeone/proxy-env | sed 's/$/#kubeone/' >> $envtmp

Possible fix is to add below line after creation of proxy-env file..

# file: pkg/scripts/proxy.go

sudo chmod o=rx -R /etc/kubeone

[kron4eg]

DisableForwarding no is required, as we route all the kube-api requests via the ssh tunnels.

[dharapvj]

Can we add this requirement here then?

Also - I think we should have mentioned these SSHD kubeone requirements in requirements section

[dharapvj]

PR for updating the docs

I see that the sshd requirements link is already present in the requirements section.. in last bullet. I had missed it earlier. So no change needed in requirements section