what's the detailed usage of k3s-serving secret and the dynamic-cert.json

[A491382]

just found there are many different certs or keys in the /var/lib/rancher/k3s/server/tls , I know it's using for the tls strategy , but I also found there is a file called dynamic-cert.json , I google what's the usage of it , but still not clear about it . And when google, there are some articles aobut the cert rotate , they said there is a secret named k3s-serving . I checked the secret , found there are cert and key in it , so I just want to know , we have so many certs and keys in the tls folder , what's the usage about the k3s-serving secret and the dynamic-cert.json , thanks

[brandond]

K3s uses dynamiclistener for its 6443 listener. It's part of that.

[A491382]

got it ,thanks @brandond

[mateuszdrab]

I almost had a heart attack seeing really weird FQDNs in the certificate presented by my K3s server.
I think those names were issued in response to dodgy requests coming into the port with SNI field set.

Is that how it works? A little read-me would help there :)

I removed the file and the names are gone... phew

[brandond]

All recent releases restrict the SANs that are automatically added to the cert. If you continue to see this, upgrade.

[mateuszdrab]

All recent releases restrict the SANs that are automatically added to the cert. If you continue to see this, upgrade.

Cool, I'm waiting for 1.27.13 (for the snapshot event flood fix back port) or Rancher to support 1.28

I'm running 1.27 but I think those domains were added long time ago, I just never noticed.

[markmaker]

Following the hardening guide, should this file also have mode 0600?

_Mark

[brandond]

No, why would you need to do that? Both the server and the server/tls dir are already 0700, so it doesn't matter if the file itself is 0644. This is just basic unix filesystem permissions stuff.

root@k3s-server-001:~# ls -lad /var/lib/rancher/k3s/server /var/lib/rancher/k3s/server/tls/ /var/lib/rancher/k3s/server/tls/dynamic-cert.json
drwx------ 8 root root 4096 May  1 17:19 /var/lib/rancher/k3s/server
drwx------ 4 root root 4096 May  1 17:19 /var/lib/rancher/k3s/server/tls/
-rw-r--r-- 1 root root 4085 May  1 17:19 /var/lib/rancher/k3s/server/tls/dynamic-cert.json

[markmaker]

I understand, so you're saying the CIS hardening guide is mere cargo cult? 🤣

It says:

Control 1.1.20

Ensure that the Kubernetes PKI certificate file permissions are set to 600 or more restrictive (Manual)
Details

Remediation
K3s PKI certificate files are stored in /var/lib/rancher/k3s/server/tls/ with permission 644. To remediate, run the following command:

chmod -R 600 /var/lib/rancher/k3s/server/tls/*.crt