Commit Graph
748 Commits
Author SHA1 Message Date
2cf2876a10 Update Running in an EKS cluster documentation (#621)
Co-authored-by: Neha Viswanathan <nviswanathan@axway.com>
Co-authored-by: Liz Rice <liz@lizrice.com>
2020-05-15 09:53:24 +01:00
Craig JellickandLiz Rice 305283f9d4 Fix OpenShift table layout (#612)
Co-authored-by: Liz Rice <liz@lizrice.com>
2020-05-14 18:04:14 +01:00
Huang HuangandLiz Rice 4557ca00f1 Fix a typo in 1.1.11 of cis-1.5 (#605)
Co-authored-by: Liz Rice <liz@lizrice.com>
2020-05-14 17:44:43 +01:00
Paul McCarthyandLiz Rice 582ce02ce6 Removed references to dep from README.md (#607)
Looks like this project now uses Go modules so `dep` steps are not needed.

Co-authored-by: Liz Rice <liz@lizrice.com>
2020-05-14 17:34:47 +01:00
Gábor LiptákandLiz Rice 82614d9b3f Correct typo (#616)
Co-authored-by: Liz Rice <liz@lizrice.com>
2020-05-14 17:25:47 +01:00
Liz Rice d8234ff07c docs: update params for logging to screen (#618)
We're now following the normal behaviour of glog, which means specifying --logtostderr to get the output written to screen. See https://godoc.org/github.com/golang/glog
2020-05-11 10:18:30 +01:00
Liz Rice 7e87c980b2 docs: CIS benchmarks are not frequent (#617)
Correct misleading comment about anticipated CIS benchmarks for every Kubernetes release - bad assumption!
2020-05-06 14:42:40 +01:00
Liz Rice 7cd6b32ebb docs: notes in README for common misunderstandings (#602)
Added a Please Note section to document common misunderstandings that often lead to incorrect issue filings
2020-04-07 14:04:42 +01:00
Daniel SuttonandLiz Rice 71bc8f544c bumped to gloang 1.14.0 (#594)
Signed-off-by: Daniel Sutton <daniel@ducksecops.uk>

Co-authored-by: Liz Rice <liz@lizrice.com>
v0.3.0
2020-03-16 13:18:27 +00:00
9efd942bcc Add config paths for microk8s (#556)
* Add config paths for microk8s

* Fix order for kube-proxy conf path and fix yaml linting issue

Co-authored-by: Mathis Kretz <mathis@bespinian.io>
Co-authored-by: Liz Rice <liz@lizrice.com>
2020-03-16 12:37:32 +00:00
yoavrotems 60f2fb592a Add option to do bitmask (#565)
* Add option to do bitwise and between two value in order to compare permissions

* Update test.go

Removed self debug note

* Update test_test.go

FIx typo

* Update test.go

* Update test.go

Switched between max and requested value, because accidentally assigned them oppositely  and remove old function relate to octal base

* Update test_test.go

* Update test_test.go
2020-03-16 12:25:46 +00:00
Liz Rice 451721a1cf Add GKE into list of support tests (#597)
Also adds links to the Kubernetes benchmarks

Fixes #596
2020-03-11 17:48:07 +02:00
Roberto RojasandLiz Rice b403b364fe Get Kubernetes Version: Adds Retry Logic (#593)
* Closes #551

* Closes #551

* Update cmd/kubernetes_version.go

Co-Authored-By: Liz Rice <liz@lizrice.com>

* Closes #551

Co-authored-by: Liz Rice <liz@lizrice.com>
2020-03-05 10:34:44 -05:00
Liz RiceandRoberto Rojas 06303f6a7a Add warn reason (#547)
* Update check.go

Added new warn_reason value which gives a brief explanation about why the not scored tests failed

* Update common.go

Changed when a not scored test fails because it has a wrong syntax audit command or just running something that can't be run the print the failure. but if the test just fails because it doesn't line up with the cis hardening recommendations then print the remediation text.

* Update check/check.go

fix typo

Co-Authored-By: Liz Rice <liz@lizrice.com>

* Update check.go

* Update common.go

* Update check.go

added back os.Exit(1) to  exitWithError

* Update job-master.data

Change some tests output to fit warn reason. (No change to the summary)

* Update job-node.data

Changed some tests output to fit warn reason. (No change to the summary)

* Update job.data

Change some tests output to fit warn reason. (No change to the summary)

* Update common.go

Keep to old way to print manual test output

Co-authored-by: Liz Rice <liz@lizrice.com>
Co-authored-by: Roberto Rojas <robertojrojas@gmail.com>
2020-03-05 12:20:26 +00:00
Huang HuangandRoberto Rojas 70988356c8 Support config files which use .yml file extension (#586)
Co-authored-by: Roberto Rojas <robertojrojas@gmail.com>
2020-03-03 12:03:21 -05:00
Huang HuangandRoberto Rojas 0b07f40c9b Support parse boolean flag with no value (#579)
* Support parse boolean flag with no value

* Add test for parse boolean flag with false value

Co-authored-by: Roberto Rojas <robertojrojas@gmail.com>
2020-03-03 11:54:38 -05:00
Abubakr-Sadik Nii Nai DavisandRoberto Rojas d988b81540 CIS GKE 1.0.0 benchmark (#570)
* Add initial commit for CIS GKE 1.0 benchmark

* Update README with GKE instructions

* Fix YAML linter issues

* Set GKE benchmark k8s version to gke-1.0

* Add tests for gke-1.0

Co-authored-by: Roberto Rojas <robertojrojas@gmail.com>
2020-03-03 09:51:48 -05:00
Thorsten Schifferdecker 237f8cf818 fix small typo (#592)
proykubeconfig -> proxykubeconfig
2020-03-02 16:35:01 +00:00
Huang Huang 65fb352e0e Change to checking --disable-admission-plugins for cis-1.4-1.1.27 and cis-1.5-1.2.14 (#584)
Fixes #582
2020-02-18 09:37:50 -05:00
Huang Huang 17cd104788 Fixes issue #574: change the PATH in container (#577)
* Fixes issue #574: change the PATH in container

And change to use `/usr/local/mount-from-host/bin` as mount path.
Fixes #574

* Fix integration tests
2020-02-12 12:18:44 -05:00
Nick Smith 77f66511e7 Set all host-mounted volumes to be read-only. (#569)
By setting all host-mounted volumes to be read-only we reduce the likelihood
any host filesystem is modified by running kube-bench.
2020-01-28 10:45:31 -05:00
LukasAuerbeckandLiz Rice 037bb14729 added 444, 440, 400 and 000 file permission checks for all benchmarks (#563)
Co-authored-by: Liz Rice <liz@lizrice.com>
v0.2.3
2020-01-22 14:40:01 +00:00
mustafa-reanandLiz Rice 89f8e454ba Resolved bug in master.yml for cis-1.5 for the apiserverbin variable name (#567)
Co-authored-by: Liz Rice <liz@lizrice.com>
2020-01-22 14:00:23 +00:00
Roberto Rojas 813dc6ef47 Integration Tests: Adds generateDiff Function (#561)
* Adds Diff function: Fixes #559

* changes as per PR review
2020-01-21 10:36:04 -05:00
Manuel RügerandLiz Rice 27d326614f Dockerfile: Use go 1.13 and alpine 3.11 bases (#560)
Co-authored-by: Liz Rice <liz@lizrice.com>
2020-01-14 14:55:11 +00:00
4925adbe6b Update .goreleaser.yml (#549)
goreleaser updated and got some functions deprecated.
• ARCHIVES
      • DEPRECATED: `archive` should not be used anymore, check https://goreleaser.com/deprecations#archive for more info.
• LINUX PACKAGES WITH NFPM
      • DEPRECATED: `nfpm` should not be used anymore, check https://goreleaser.com/deprecations#nfpm for more info.

Co-authored-by: Liz Rice <liz@lizrice.com>
Co-authored-by: Roberto Rojas <robertojrojas@gmail.com>
2020-01-13 12:56:26 -05:00
Roberto RojasandLiz Rice efcd63aa38 Integration Test: Improves performance and Reliability (#555)
* Fixes #552: Improves performance and reliability.

Co-Authored-By: Liz Rice <liz@lizrice.com>
2020-01-09 09:57:40 -05:00
Murali PaluruandLiz Rice b677c86868 remove always true for logtostderr (#548)
* remove always true for logtostderr

* update README for log collection instructions

Co-authored-by: Liz Rice <liz@lizrice.com>
2020-01-07 13:04:06 +00:00
Murali Paluru 48e33d33e5 fix mismatching checks, tests (#544) 2020-01-07 12:31:07 +00:00
James Ward 5f34058dc7 Support Linting YAML as part of Travis CI build (#554)
* add yamllint command to travis CI

installs and runs a linter across the YAML in the
project to ensure consistency in the written YAML.

this uses yamllint and the default yamllint config with
"truthy" and "line-length" disabled.

* run dos2unix on CRLF files

* YAMLLINT: remove trailing spaces

* YAMLLint: add YAML document start

* YAMLLint: too many spaces around bracket

* YAMLLint: fix indentation

* YAMLLint: remove duplicate key

* YAMLLint: newline at end of file

* YAMLLint: Too few spaces after comma

* YAMLLint: too many spaces after colon
2020-01-06 09:18:25 +00:00
Liz Riceands-nirali dc14cb14b0 Update tests for check states (#550)
- Tests that did not increase coverage and were redundant are removed.
- New tests reflecting the meaning of the state as explained in the
  README are added.

Co-authored-by: s-nirali <25746945+s-nirali@users.noreply.github.com>
2020-01-03 14:02:49 +00:00
ca749ccb32 Adding a section for Azure Kubernetes Service (#495)
* Adding a section for Azure Kubernetes Service

steps to run kube bench on AKS worker nodes

* Update README.md

* Update README.md

Co-authored-by: Roberto Rojas <robertojrojas@gmail.com>
Co-authored-by: Liz Rice <liz@lizrice.com>
v0.0.1-alpha.0
2019-12-20 12:17:00 +00:00
Zeid Marouf 299ab36a13 doc: fix ECR image build instructions for EKS mode (#531) 2019-12-20 12:00:38 +00:00
Roberto Rojas 9fc13ca02e Fixes Issue #538 (#539)
* Adds openshift to autodetect node type

* detect okd node units

* OCP fixes
2019-12-13 11:04:58 -05:00
Roberto Rojas 13193d75b0 Fixes Issue #535 (#537)
* isEtcd should not run on openshift 3.10/3.11

* adds openssl

* fixed tests

* fixes bugs

* adds isEtcd tests
2019-12-13 10:09:30 -05:00
Roberto Rojas 62af68f3f5 fixes issue #536 (#540) 2019-12-12 16:51:35 -05:00
Huang Huang 4a07f87e6f Fix remediations about file permission (#534)
* Fix remediation of 2.2.3 in cis-1.3

* Fix remediation of 4.1.1 in cis-1.5
2019-12-10 13:57:07 -05:00
Mateus Caruccio 6e1c39237a Openshift configs (#526)
* Adds openshift to autodetect node type

* detect okd node units
2019-12-09 09:07:44 -05:00
Roberto RojasandLiz Rice af976e6f50 Fixes Issue #494 - add tests for CIS 1.5 (#530)
* Initial commit.

* Add master and node config.

* Add section 5 of CIS 1.5.1.

* Split sections into section files

* Fix YAML issues.

* adds target translation

* adds target translation

* adds cis-1.5 mapping

* fixed tests

* fixes are per PR

* fixed intergration test

* integration kind test file to appropriate ks8 version

* fixed etcd text

* fixed README

* fixed text

* etcd: fixed grep path

* etcd: fixes

* fixed error message bug

* Update README.md

Co-Authored-By: Liz Rice <liz@lizrice.com>

* Update README.md

Co-Authored-By: Liz Rice <liz@lizrice.com>

* fixes as per PR review
v0.2.2
2019-12-05 15:55:44 -05:00
Huang Huang 7015f4b4b5 Fix remediation of 2.2.3 (#527) 2019-12-04 07:06:50 -08:00
Liz Rice f2caa1f0ec Add run subcommand (#529)
* test: fix TestGetConfigFilePath

This test wasn't correctly creating the test file due to the wrong directory permissions on the temp file. This wasn't detected due to a lack of error checking.

Also, the code was only checking for file not exist rather than lack of permission to read file (or any other error).

The combination of these two things means the test wasn't checking what it thought it was checking, and passed more by luck than judgment.

* add getYamlFilesFromDir

* add getTestYamlFiles and test

* docs: Update master / node help text

* return path + filename from getYamlFilesFromDir

* subcommand run to run specific section files
2019-12-02 15:40:44 +00:00
Roberto Rojas 8780e5cb59 adds kube-bench version to docker build hook (#524) v0.2.1 2019-11-27 20:06:42 +00:00
gy741 230d286708 Use COPY instead of ADD in Dockerfile (#502) 2019-11-27 11:25:19 -05:00
Roberto Rojas 9c6d4de860 Issue #421: Merges PR #422 with master (#523)
* Add kubeconfig location of kube-proxy for AKS

* Add job for AKS node

* Automate ca file permission check

* removed job-aks.yaml as other PRs added needed features

* fixed integration test due to merge changes
2019-11-27 15:30:29 +00:00
Roberto Rojas e2f61fad13 Fixes issue #391: Replaced calling docker directly by using "make build-docker" (#522)
replaced calling docker directly by using "make build-docker"
2019-11-26 08:20:05 -08:00
Roberto Rojas 47c5661034 Fixes issue #439: Adds integration testing using KIND (#520)
* Fixes issue #439: Adds integration testing using KIND

* try integration tests

* started using ticker and timeouts

* trying built container image

* adds load image into KIND

* adds comparison

* fixes as per PR review
v0.2.0
2019-11-16 09:39:47 -05:00
John Schnake 6ffd382711 Add option to output in JUnit format (#516)
If running these checks in a CI system it may be beneficial
to output in a more standardized format such as JUnit for
parsing by other tools in a consistent manner.

Fixes #460

Signed-off-by: John Schnake <jschnake@vmware.com>
2019-11-13 08:03:04 -05:00
Roberto Rojas b92d30bd11 Fixes issue #517: Determines Kubernetes version using the REST API (#518)
* Fixes issue #517: Determines Kubernetes version using the REST API

* fixes

* fixes

* adds tests

* fixes

* added more tests

* kubernetes_version_test: Add a missing case for invalid certs

Signed-off-by: Simarpreet Singh <simar@linux.com>

* kubernetes_version_test: Remove un-needed casts

Signed-off-by: Simarpreet Singh <simar@linux.com>

* fixes as per PR review

* fixes as per PR review
2019-11-12 13:47:42 -08:00
Liz Rice 9a950d2d9a docs: Note about not changing license etc (#514) 2019-11-06 16:44:14 +01:00
Jonathan RauandLiz Rice 51aa10e354 Update EKS Config & Create EKS Guide (#489)
* Change EKS Readme

* Fix readme formatting

* Update README.md

Co-Authored-By: Liz Rice <liz@lizrice.com>

* Update README.md

Co-Authored-By: Liz Rice <liz@lizrice.com>

* Update README.md
v0.1.0
2019-11-06 07:34:43 +01:00