github/kube-bench
1
0
Fork 0
mirror of https://github.com/aquasecurity/kube-bench.git synced 2026-04-15 06:56:51 +00:00
Code Issues Packages Projects Releases Wiki Activity
473 Commits 13 Branches 100 Tags
ff427f8b0c19ea8504f905e017d0fbcd22d400e7
Commit Graph
69 Commits
Author SHA1 Message Date
Yoav Hizkiahou 3aa28c4c32 Printing the actual test result of failed tests - when a flag is raised 
fix #110
 2019-05-15 10:14:11 +03:00
Daniel Pacak 5fb133cd02 Adjust the semantics of scored and unscored flags 2019-05-01 22:52:56 +02:00
Daniel Pacak 306e1960af Add flags to further filter CIS checks to run 2019-05-01 22:52:56 +02:00
Liz Rice de623220e1 No need to load config just to check if components are running. 
This also allows for there to be no master.yaml file, for environments where such a thing doesn’t need to exist
 2019-04-11 18:34:22 +01:00
Liz Rice 596dae03d9 Don't assume master if 0 master binaries specified 2019-04-11 17:19:50 +01:00
Liz RiceandGitHub 9246be924d Merge branch 'master' into features/autodetect-nodetype 2019-03-13 20:36:19 -07:00
Cyril Tovena 5baf81a70a Adds master node detection and a root command that automatically detect checks to run. 
The root command will run node checks and if possible master checks.
I've also added some Makefile targets to improve local testing and improve the documentation.
 2019-03-12 19:32:05 -04:00
Abubakr-Sadik Nii Nai Davis a88b0703d8 Add kubeconfig variable substitution for kubelet and proxy. 
There are checks for the kubeconfig for both kubelet and proxy which
the current kube-bench implementation does not check for properly.
kube-bench checks the wrong files.

This PR adds support for variable substitution for all the config file
types are that should be checked in the CIS benchmarks.

This PR also fixes a buggy in CIS 1.3.0 check 2.2.9, which checks for
ownership of the kubelet config file /var/lib/kubelet/config.yaml but
recommends changing ownership of kubelet kubeconfig file
/etc/kubernetes/kubelet.conf as remediation.
 2019-02-27 22:15:14 +00:00
Abubakr-Sadik Nii Nai Davis 911e9051dc Merge remote-tracking branch 'origin/master' into ocp-configs 2019-02-15 19:48:53 +00:00
Abubakr-Sadik Nii Nai Davis e899e941f7 Add OCP 3.10 benchmarks. 2019-02-15 19:44:39 +00:00
Weston SteimelandAbubakr-Sadik Nii Nai Davis 42ed8628de Only get runningVersion if --version has not been provided 
Signed-off-by: Weston Steimel <weston.steimel@gmail.com>
 2019-02-15 19:43:13 +00:00
Yoav Hizkiahou 49f745af8e Support new check type - skip: 
If a check is marked with type "skip", it will be marked as Info.

Support scored property:
If a check is not scored and is not marked with type skip, it will be marked as Warn.
 2019-01-29 19:05:12 +02:00
Weston Steimel 42f4152058 Only get runningVersion if --version has not been provided 
Signed-off-by: Weston Steimel <weston.steimel@gmail.com>
 2019-01-24 00:34:09 +00:00
Abubakr-Sadik Nii Nai Davis ed21839464 Add getServiceFiles function. 
The CIS benchmark check for node checks 2 config files for kubelet:
  - kubelet config file (kubelet.conf)
  - kubelet systemd unitfile (10-kubeadm.conf)

The getServiceFiles function gets candidates for kubelet systemd
unitfile and returns valid untifiles.
 2018-10-23 02:26:38 +00:00
Liz Rice ccc2b6c9ae Shouldn't need kubelet or kubectl if version specified 2018-07-26 12:03:09 +01:00
Liz Rice 9d0141871a Use new utility function for finding correct config files. 
Improve order of message output
Remove unnecessary local variable
 2018-06-29 12:20:29 +01:00
Liz Rice 223ac14642 Don't override version specified on command line 2018-06-29 10:35:44 +01:00
Liz RiceandGitHub 0b4872104d Merge branch 'master' into feature/issue-107 2018-04-16 17:15:30 +01:00
Will Medlar 9469b1c124 Allow kubernetes version and config directory to be specified (resolves #107) 2018-04-12 15:01:58 -04:00
Abubakr-Sadik Nii Nai Davis ade064006e Add extra output manipulation flags, --noremediations, --nosummary and 
--noresults.

These flags disable printing sections of the final output of kube-bench.
 2018-04-10 20:01:47 +00:00
Liz Rice 728cb0765f Use 1.8 tests for k8s 1.9 and 1.10 2018-04-04 10:49:05 +01:00
Philippe ALEXANDRE f091c8adea Remove the old lines of fmt.Sprintf in cmd/common.go 2018-03-27 15:33:01 +02:00
Philippe ALEXANDRE c86d0ff81b Replace fmt.Sprintf by filepath.Join 2018-03-23 09:27:48 +01:00
Liz RiceandGitHub 58b6358a02 Merge branch 'master' into u/jaxxstorm/golint 2018-01-30 19:46:44 +00:00
Lee Briggs 94a1f3c41f Lint all code for golint tests 2018-01-11 10:01:58 -08:00
Abubakr-Sadik Nii Nai Davis 64aaef7997 Fixed expected return for getKubeVersion. 2017-11-28 17:47:57 +00:00
Abubakr-Sadik Nii Nai Davis 04f044e3b9 Add support for merging general and kubernetes version specific config files. 
This change unifies all config files, podspecs and unitfiles under
a single component configuration key; `config`.
 2017-11-28 17:38:34 +00:00
Liz Rice 730871f330 Fix kubeVersion regex tests 2017-11-21 13:19:09 +00:00
Abubakr-Sadik Nii Nai Davis f90dd925b8 Exit kube-bench if we can't get valid kubernetes server version and 
improve error messages.
 2017-11-03 13:11:10 +00:00
Steven Logue 909e6cc874 created database.go file and moved DB function into it 2017-11-01 10:15:31 -07:00
Liz RiceandGitHub 1faeb55b67 Merge branch 'master' into master 2017-11-01 14:46:48 +00:00
Steven Logue d79a2a5478 added support for saving scan results to pgsql 2017-10-31 13:08:46 -07:00
Abubakr-Sadik Nii Nai Davis 592dc81974 Remove unused variables. 2017-10-24 12:02:22 +00:00
Abubakr-Sadik Nii Nai Davis cec1d9d6b3 Combine config reading functions into single function. 2017-10-24 12:01:02 +00:00
Abubakr-Sadik Nii Nai Davis e227934c88 Add function to get unit files for kubernetes components. 2017-10-15 13:20:01 +00:00
Abubakr-Sadik Nii Nai Davis 6ce0c5bf60 Add function to get pod specs for kubernetes components. 2017-10-15 13:19:57 +00:00
Abubakr-Sadik Nii Nai Davis 018ad12a64 Log benchmark definition file at verbosity level 1. 2017-09-26 23:33:47 +00:00
Abubakr-Sadik Nii Nai Davis a95d083049 Remove call to verifyKubeVersion. 
This functionality is fulfilled by getKubeVersion.
 2017-09-26 23:20:28 +00:00
Abubakr-Sadik Nii Nai Davis d9e1eee2cd Merge remote-tracking branch 'origin/master' into support for multiple 
Kubernetes versions.
 2017-09-20 00:39:30 +00:00
Abubakr-Sadik Nii Nai Davis 56fa20103a Add function to retrieve Kubernetes server version. 
The server version is used to load the correct benchmark check
to run against the Kubernetes cluster.
 2017-09-17 19:49:13 +00:00
Liz Rice e4a89123e0 Move message about which config file we’re using into a log at the start 2017-08-31 17:38:11 +01:00
Liz Rice a3197f8efe Reorder YAML to make a bit more sense. Allow for optional components, and a config file that we don’t think exists. 2017-08-31 14:45:16 +01:00
Liz Rice f5550fd8bd Node type is now verified by looking for running binaries from a set of options 2017-08-31 14:43:35 +01:00
Liz Rice 6a5a62b278 Autodetect the binaries and config files from a set of options 2017-08-30 18:37:01 +01:00
Liz Rice 7600dd9dd6 Make the ps / fakeps function global so we don’t have to pass it around so much 2017-08-30 17:51:28 +01:00
Liz Rice 6b9f117f87 Allow for multiple words in executable names 2017-08-15 17:00:35 +01:00
Liz Rice 34f8b8e980 Simplify verifying binaries and config files 2017-08-15 16:44:40 +01:00
Liz Rice 96c469669c Use kubectl to check the kubernetes version 2017-08-11 17:59:57 +01:00
Liz RiceandGitHub 2b4047a3c1 Merge pull request #28 from ttousai/errorhandling 
Improve error handling.
 2017-08-07 10:06:32 +01:00
Abubakr-Sadik Nii Nai Davis f88de572f6 Improve error handling. 2017-07-25 00:34:07 +00:00