mirror of
https://github.com/aquasecurity/kube-bench.git
synced 2026-02-28 16:50:21 +00:00
Compare commits
49 Commits
| Author | SHA1 | Date | |
|---|---|---|---|
|
c379df19b0 | ||
|
2275eea93f | ||
|
|
ec9779f56e | ||
|
3b7438e2f2 | ||
|
|
1d7449db34 | ||
|
|
5df39eed02 | ||
|
|
46baf8f8b5 | ||
|
|
4f79d62149 | ||
|
|
268fafd495 | ||
|
|
bab1237a44 | ||
|
|
d44f865ef3 | ||
|
|
e3da299e0c | ||
|
|
81f0d9c6e3 | ||
|
|
312cdb1c6d | ||
|
|
0f12dca76d | ||
|
|
87820b9775 | ||
|
85849a3c1f | ||
|
43caaab00a | ||
|
|
5efb3e3b00 | ||
|
|
27df1f60ed | ||
|
9d0e3491a0 | ||
|
|
9d577d94b4 | ||
|
|
df3577519c | ||
|
e64f61fa7f | ||
|
|
5e80f41066 | ||
|
|
a8c69b57e8 | ||
|
|
ff6443e279 | ||
|
ddb677bc69 | ||
|
|
d1c3e3163b | ||
|
|
53ef773944 | ||
|
|
31019c44da | ||
|
|
ff427f8b0c | ||
|
|
91da82aaa8 | ||
|
|
c4be2ee03d | ||
|
|
e7a8c14715 | ||
|
|
9f9514d8c6 | ||
|
|
e33e44b676 | ||
|
|
12e48297a6 | ||
|
|
240c8ad5b0 | ||
|
|
74fd7cd595 | ||
|
|
3aa28c4c32 | ||
|
|
02d5654cc1 | ||
|
|
caf3fbd0a0 | ||
|
|
c152088254 | ||
|
|
c361b9b82f | ||
|
|
b9b4d47b3e | ||
|
22e835f0f5 | ||
|
|
7ec10211a5 | ||
|
7c6b9680b4 |
@@ -5,7 +5,9 @@
|
||||
|
||||
<img src="images/kube-bench.png" width="200" alt="kube-bench logo">
|
||||
|
||||
kube-bench is a Go application that checks whether Kubernetes is deployed securely by running the checks documented in the [CIS Kubernetes Benchmark](https://www.cisecurity.org/benchmark/kubernetes/).
|
||||
kube-bench is a Go application that checks whether Kubernetes is deployed securely by running the checks documented in the [CIS Kubernetes Benchmark](https://www.cisecurity.org/benchmark/kubernetes/).
|
||||
|
||||
Note that it is impossible to inspect the master nodes of managed clusters, e.g. GKE, EKS and AKS, using kube-bench as one does not have access to such nodes, although it is still possible to use kube-bench to check worker node configuration in these environments.
|
||||
|
||||
Tests are configured with YAML files, making this tool easy to update as test specifications evolve.
|
||||
|
||||
@@ -131,6 +133,8 @@ kube-bench includes a set of test files for Red Hat's OpenShift hardening guide
|
||||
|
||||
Kubernetes config and binary file locations and names can vary from installation to installation, so these are configurable in the `cfg/config.yaml` file.
|
||||
|
||||
Any settings in the version-specific config file `cfg/<version>/config.yaml` take precedence over settings in the main `cfg/config.yaml` file.
|
||||
|
||||
For each type of node (*master*, *node* or *federated*) there is a list of components, and for each component there is a set of binaries (*bins*) and config files (*confs*) that kube-bench will look for (in the order they are listed). If your installation uses a different binary name or config file location for a Kubernetes component, you can add it to `cfg/config.yaml`.
|
||||
|
||||
* **bins** - If there is a *bins* list for a component, at least one of these binaries must be running. The tests will consider the parameters for the first binary in the list found to be running.
|
||||
|
||||
@@ -9,10 +9,6 @@ node:
|
||||
- "/var/lib/kubelet/kubeconfig"
|
||||
|
||||
kubelet:
|
||||
bins:
|
||||
- "hyperkube kubelet"
|
||||
- "kubelet"
|
||||
defaultconf: "/etc/kubernetes/kubelet/kubelet-config.json"
|
||||
defaultsvc: "/etc/systemd/system/kubelet.service"
|
||||
defaultkubeconfig: "/var/lib/kubelet/kubeconfig"
|
||||
|
||||
|
||||
@@ -1,29 +1,2 @@
|
||||
---
|
||||
## Controls Files.
|
||||
# These are YAML files that hold all the details for running checks.
|
||||
#
|
||||
## Uncomment to use different control file paths.
|
||||
# masterControls: ./cfg/master.yaml
|
||||
# nodeControls: ./cfg/node.yaml
|
||||
# federatedControls: ./cfg/federated.yaml
|
||||
|
||||
master:
|
||||
apiserver:
|
||||
defaultconf: /etc/kubernetes/manifests/kube-apiserver.yaml
|
||||
|
||||
scheduler:
|
||||
defaultconf: /etc/kubernetes/manifests/kube-scheduler.yaml
|
||||
|
||||
controllermanager:
|
||||
defaultconf: /etc/kubernetes/manifests/kube-controller-manager.yaml
|
||||
|
||||
etcd:
|
||||
defaultconf: /etc/kubernetes/manifests/etcd.yaml
|
||||
|
||||
node:
|
||||
kubelet:
|
||||
defaultconf: /etc/kubernetes/kubelet.conf
|
||||
defaultsvc: /etc/systemd/system/kubelet.service.d/10-kubeadm.conf
|
||||
|
||||
proxy:
|
||||
defaultconf: /etc/kubernetes/addons/kube-proxy-daemonset.yaml
|
||||
## Version-specific settings that override the values in cfg/config.yaml
|
||||
|
||||
@@ -1,29 +1,2 @@
|
||||
---
|
||||
## Controls Files.
|
||||
# These are YAML files that hold all the details for running checks.
|
||||
#
|
||||
## Uncomment to use different control file paths.
|
||||
# masterControls: ./cfg/master.yaml
|
||||
# nodeControls: ./cfg/node.yaml
|
||||
# federatedControls: ./cfg/federated.yaml
|
||||
|
||||
master:
|
||||
apiserver:
|
||||
defaultconf: /etc/kubernetes/manifests/kube-apiserver.yaml
|
||||
|
||||
scheduler:
|
||||
defaultconf: /etc/kubernetes/manifests/kube-scheduler.yaml
|
||||
|
||||
controllermanager:
|
||||
defaultconf: /etc/kubernetes/manifests/kube-controller-manager.yaml
|
||||
|
||||
etcd:
|
||||
defaultconf: /etc/kubernetes/manifests/etcd.yaml
|
||||
|
||||
node:
|
||||
kubelet:
|
||||
defaultconf: /etc/kubernetes/kubelet.conf
|
||||
defaultsvc: /etc/systemd/system/kubelet.service.d/10-kubeadm.conf
|
||||
|
||||
proxy:
|
||||
defaultconf: /etc/kubernetes/addons/kube-proxy-daemonset.yaml
|
||||
## Version-specific settings that override the values in cfg/config.yaml
|
||||
@@ -220,12 +220,15 @@ groups:
|
||||
text: "Ensure that the admission control plugin NamespaceLifecycle is set (Scored)"
|
||||
audit: "ps -ef | grep $apiserverbin | grep -v grep"
|
||||
tests:
|
||||
bin_op: or
|
||||
test_items:
|
||||
- flag: "--disable-admission-plugins"
|
||||
compare:
|
||||
op: nothave
|
||||
value: "NamespaceLifecycle"
|
||||
set: true
|
||||
- flag: "--disable-admission-plugins"
|
||||
set: false
|
||||
remediation: |
|
||||
Edit the API server pod specification file $apiserverconf
|
||||
on the master node and set the --disable-admission-plugins parameter to
|
||||
|
||||
@@ -1,42 +1,2 @@
|
||||
---
|
||||
## Controls Files.
|
||||
# These are YAML files that hold all the details for running checks.
|
||||
#
|
||||
## Uncomment to use different control file paths.
|
||||
# masterControls: ./cfg/master.yaml
|
||||
# nodeControls: ./cfg/node.yaml
|
||||
# federatedControls: ./cfg/federated.yaml
|
||||
|
||||
master:
|
||||
apiserver:
|
||||
confs:
|
||||
- /etc/kubernetes/manifests/kube-apiserver.yaml
|
||||
- /etc/kubernetes/manifests/kube-apiserver.manifest
|
||||
defaultconf: /etc/kubernetes/manifests/kube-apiserver.yaml
|
||||
|
||||
scheduler:
|
||||
confs:
|
||||
- /etc/kubernetes/manifests/kube-scheduler.yaml
|
||||
- /etc/kubernetes/manifests/kube-scheduler.manifest
|
||||
defaultconf: /etc/kubernetes/manifests/kube-scheduler.yaml
|
||||
|
||||
controllermanager:
|
||||
confs:
|
||||
- /etc/kubernetes/manifests/kube-controller-manager.yaml
|
||||
- /etc/kubernetes/manifests/kube-controller-manager.manifest
|
||||
defaultconf: /etc/kubernetes/manifests/kube-controller-manager.yaml
|
||||
|
||||
etcd:
|
||||
confs:
|
||||
- /etc/kubernetes/manifests/etcd.yaml
|
||||
- /etc/kubernetes/manifests/etcd.manifest
|
||||
defaultconf: /etc/kubernetes/manifests/etcd.yaml
|
||||
|
||||
node:
|
||||
kubelet:
|
||||
defaultconf: /var/lib/kubelet/config.yaml
|
||||
defaultsvc: /etc/systemd/system/kubelet.service.d/10-kubeadm.conf
|
||||
defaultkubeconfig: /etc/kubernetes/kubelet.conf
|
||||
|
||||
proxy:
|
||||
defaultconf: /etc/kubernetes/addons/kube-proxy-daemonset.yaml
|
||||
## Version-specific settings that override the values in cfg/config.yaml
|
||||
|
||||
@@ -27,9 +27,9 @@ master:
|
||||
- "hyperkube kube-apiserver"
|
||||
- "apiserver"
|
||||
confs:
|
||||
- /etc/kubernetes/apiserver.conf
|
||||
- /etc/kubernetes/apiserver
|
||||
defaultconf: /etc/kubernetes/apiserver
|
||||
- /etc/kubernetes/manifests/kube-apiserver.yaml
|
||||
- /etc/kubernetes/manifests/kube-apiserver.manifest
|
||||
defaultconf: /etc/kubernetes/manifests/kube-apiserver.yaml
|
||||
|
||||
scheduler:
|
||||
bins:
|
||||
@@ -37,10 +37,10 @@ master:
|
||||
- "hyperkube scheduler"
|
||||
- "hyperkube kube-scheduler"
|
||||
- "scheduler"
|
||||
confs:
|
||||
- /etc/kubernetes/scheduler.conf
|
||||
- /etc/kubernetes/scheduler
|
||||
defaultconf: /etc/kubernetes/scheduler
|
||||
confs:
|
||||
- /etc/kubernetes/manifests/kube-scheduler.yaml
|
||||
- /etc/kubernetes/manifests/kube-scheduler.manifest
|
||||
defaultconf: /etc/kubernetes/manifests/kube-scheduler.yaml
|
||||
|
||||
controllermanager:
|
||||
bins:
|
||||
@@ -49,17 +49,19 @@ master:
|
||||
- "hyperkube kube-controller-manager"
|
||||
- "controller-manager"
|
||||
confs:
|
||||
- /etc/kubernetes/controller-manager.conf
|
||||
- /etc/kubernetes/controller-manager
|
||||
defaultconf: /etc/kubernetes/controller-manager
|
||||
- /etc/kubernetes/manifests/kube-controller-manager.yaml
|
||||
- /etc/kubernetes/manifests/kube-controller-manager.manifest
|
||||
defaultconf: /etc/kubernetes/manifests/kube-controller-manager.yaml
|
||||
|
||||
etcd:
|
||||
optional: true
|
||||
bins:
|
||||
- "etcd"
|
||||
confs:
|
||||
- /etc/kubernetes/manifests/etcd.yaml
|
||||
- /etc/kubernetes/manifests/etcd.manifest
|
||||
- /etc/etcd/etcd.conf
|
||||
defaultconf: /etc/etcd/etcd.conf
|
||||
defaultconf: /etc/kubernetes/manifests/etcd.yaml
|
||||
|
||||
flanneld:
|
||||
optional: true
|
||||
@@ -81,6 +83,10 @@ node:
|
||||
bins:
|
||||
- "hyperkube kubelet"
|
||||
- "kubelet"
|
||||
confs:
|
||||
- "/var/lib/kubelet/config.yaml"
|
||||
- "/etc/kubernetes/kubelet/kubelet-config.json"
|
||||
- "/home/kubernetes/kubelet-config.yaml"
|
||||
defaultconf: "/var/lib/kubelet/config.yaml"
|
||||
defaultsvc: "/etc/systemd/system/kubelet.service.d/10-kubeadm.conf"
|
||||
defaultkubeconfig: "/etc/kubernetes/kubelet.conf"
|
||||
@@ -93,6 +99,7 @@ node:
|
||||
confs:
|
||||
- /etc/kubernetes/proxy
|
||||
- /etc/kubernetes/addons/kube-proxy-daemonset.yaml
|
||||
defaultconf: /etc/kubernetes/addons/kube-proxy-daemonset.yaml
|
||||
defaultkubeconfig: "/etc/kubernetes/proxy.conf"
|
||||
|
||||
federated:
|
||||
|
||||
@@ -1,16 +1,21 @@
|
||||
---
|
||||
## Controls Files.
|
||||
# These are YAML files that hold all the details for running checks.
|
||||
#
|
||||
## Uncomment to use different control file paths.
|
||||
# masterControls: ./cfg/master.yaml
|
||||
# nodeControls: ./cfg/node.yaml
|
||||
# federatedControls: ./cfg/federated.yaml
|
||||
## Version-specific settings that override the values in cfg/config.yaml
|
||||
|
||||
master:
|
||||
apiserver:
|
||||
bins:
|
||||
- openshift start master api
|
||||
- hypershift openshift-kube-apiserver
|
||||
|
||||
scheduler:
|
||||
bins:
|
||||
- "openshift start master controllers"
|
||||
confs:
|
||||
- /etc/origin/master/scheduler.json
|
||||
|
||||
controllermanager:
|
||||
bins:
|
||||
- "openshift start master controllers"
|
||||
|
||||
etcd:
|
||||
bins:
|
||||
|
||||
@@ -196,7 +196,7 @@ groups:
|
||||
- id: 7.15
|
||||
text: "Verify that the RotateKubeletServerCertificate argument is set to true"
|
||||
audit: "grep -B1 RotateKubeletServerCertificate=true /etc/origin/node/node-config.yaml"
|
||||
test:
|
||||
tests:
|
||||
test_items:
|
||||
- flag: "RotateKubeletServerCertificate=true"
|
||||
compare:
|
||||
|
||||
27
cfg/ocp-3.11/config.yaml
Normal file
27
cfg/ocp-3.11/config.yaml
Normal file
@@ -0,0 +1,27 @@
|
||||
---
|
||||
## Version-specific settings that override the values in cfg/config.yaml
|
||||
|
||||
master:
|
||||
apiserver:
|
||||
bins:
|
||||
- openshift start master api
|
||||
- hypershift openshift-kube-apiserver
|
||||
|
||||
scheduler:
|
||||
bins:
|
||||
- "openshift start master controllers"
|
||||
confs:
|
||||
- /etc/origin/master/scheduler.json
|
||||
|
||||
controllermanager:
|
||||
bins:
|
||||
- "openshift start master controllers"
|
||||
|
||||
etcd:
|
||||
bins:
|
||||
- openshift start etcd
|
||||
|
||||
node:
|
||||
proxy:
|
||||
bins:
|
||||
- openshift start network
|
||||
113
cfg/ocp-3.11/federated.yaml
Normal file
113
cfg/ocp-3.11/federated.yaml
Normal file
@@ -0,0 +1,113 @@
|
||||
---
|
||||
controls:
|
||||
id: 3
|
||||
text: "Federated Deployments"
|
||||
type: "federated"
|
||||
groups:
|
||||
- id: 3.1
|
||||
text: "Federated API Server"
|
||||
checks:
|
||||
- id: 3.1.1
|
||||
text: "Ensure that the --anonymous-auth argument is set to false (Scored)"
|
||||
type: "skip"
|
||||
scored: true
|
||||
|
||||
- id: 3.1.2
|
||||
text: "Ensure that the --basic-auth-file argument is not set (Scored)"
|
||||
type: "skip"
|
||||
scored: true
|
||||
|
||||
- id: 3.1.3
|
||||
text: "Ensure that the --insecure-allow-any-token argument is not set (Scored)"
|
||||
type: "skip"
|
||||
scored: true
|
||||
|
||||
- id: 3.1.4
|
||||
text: "Ensure that the --insecure-bind-address argument is not set (Scored)"
|
||||
type: "skip"
|
||||
scored: true
|
||||
|
||||
- id: 3.1.5
|
||||
text: "Ensure that the --insecure-port argument is set to 0 (Scored)"
|
||||
type: "skip"
|
||||
scored: true
|
||||
|
||||
- id: 3.1.6
|
||||
text: "Ensure that the --secure-port argument is not set to 0 (Scored)"
|
||||
type: "skip"
|
||||
scored: true
|
||||
|
||||
- id: 3.1.7
|
||||
text: "Ensure that the --profiling argument is set to false (Scored)"
|
||||
type: "skip"
|
||||
scored: true
|
||||
|
||||
- id: 3.1.8
|
||||
text: "Ensure that the admission control policy is not set to AlwaysAdmit (Scored)"
|
||||
type: "skip"
|
||||
scored: true
|
||||
|
||||
- id: 3.1.9
|
||||
text: "Ensure that the admission control policy is set to NamespaceLifecycle (Scored)"
|
||||
type: "skip"
|
||||
scored: true
|
||||
|
||||
- id: 3.1.10
|
||||
text: "Ensure that the --audit-log-path argument is set as appropriate (Scored)"
|
||||
type: "skip"
|
||||
scored: true
|
||||
|
||||
- id: 3.1.11
|
||||
text: "Ensure that the --audit-log-maxage argument is set to 30 or as appropriate (Scored)"
|
||||
type: "skip"
|
||||
scored: true
|
||||
|
||||
- id: 3.1.12
|
||||
text: "Ensure that the --audit-log-maxbackup argument is set to 10 or as appropriate (Scored)"
|
||||
type: "skip"
|
||||
scored: true
|
||||
|
||||
- id: 3.1.13
|
||||
text: "Ensure that the --audit-log-maxsize argument is set to 100 or as appropriate (Scored)"
|
||||
type: "skip"
|
||||
scored: true
|
||||
|
||||
- id: 3.1.14
|
||||
text: "Ensure that the --authorization-mode argument is not set to AlwaysAllow (Scored)"
|
||||
type: "skip"
|
||||
scored: true
|
||||
|
||||
- id: 3.1.15
|
||||
text: "Ensure that the --token-auth-file parameter is not set (Scored)"
|
||||
type: "skip"
|
||||
scored: true
|
||||
|
||||
- id: 3.1.16
|
||||
text: "Ensure that the --service-account-lookup argument is set to true (Scored)"
|
||||
type: "skip"
|
||||
scored: true
|
||||
|
||||
- id: 3.1.17
|
||||
text: "Ensure that the --service-account-key-file argument is set as appropriate (Scored)"
|
||||
type: "skip"
|
||||
scored: true
|
||||
|
||||
- id: 3.1.18
|
||||
text: "Ensure that the --etcd-certfile and --etcd-keyfile arguments are set as appropriate (Scored)"
|
||||
type: "skip"
|
||||
scored: true
|
||||
|
||||
- id: 3.1.19
|
||||
text: "Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate (Scored)"
|
||||
type: "skip"
|
||||
scored: true
|
||||
|
||||
|
||||
- id: 3.2
|
||||
text: "Federation Controller Manager"
|
||||
checks:
|
||||
- id: 3.2.1
|
||||
text: "Ensure that the --profiling argument is set to false (Scored)"
|
||||
type: "skip"
|
||||
scored: true
|
||||
|
||||
1454
cfg/ocp-3.11/master.yaml
Normal file
1454
cfg/ocp-3.11/master.yaml
Normal file
File diff suppressed because it is too large
Load Diff
376
cfg/ocp-3.11/node.yaml
Normal file
376
cfg/ocp-3.11/node.yaml
Normal file
@@ -0,0 +1,376 @@
|
||||
---
|
||||
controls:
|
||||
id: 2
|
||||
text: "Worker Node Security Configuration"
|
||||
type: "node"
|
||||
groups:
|
||||
- id: 7
|
||||
text: "Kubelet"
|
||||
checks:
|
||||
- id: 7.1
|
||||
text: "Use Security Context Constraints to manage privileged containers as needed"
|
||||
type: "skip"
|
||||
scored: true
|
||||
|
||||
- id: 7.2
|
||||
text: "Ensure anonymous-auth is not disabled"
|
||||
type: "skip"
|
||||
scored: true
|
||||
|
||||
- id: 7.3
|
||||
text: "Verify that the --authorization-mode argument is set to WebHook"
|
||||
audit: "grep -A1 authorization-mode /etc/origin/node/node-config.yaml"
|
||||
tests:
|
||||
bin_op: or
|
||||
test_items:
|
||||
- flag: "authorization-mode"
|
||||
set: false
|
||||
- flag: "authorization-mode: Webhook"
|
||||
compare:
|
||||
op: has
|
||||
value: "Webhook"
|
||||
set: true
|
||||
remediation: |
|
||||
Edit the Openshift node config file /etc/origin/node/node-config.yaml and remove authorization-mode under
|
||||
kubeletArguments in /etc/origin/node/node-config.yaml or set it to "Webhook".
|
||||
scored: true
|
||||
|
||||
- id: 7.4
|
||||
text: "Verify the OpenShift default for the client-ca-file argument"
|
||||
audit: "grep -A1 client-ca-file /etc/origin/node/node-config.yaml"
|
||||
tests:
|
||||
test_items:
|
||||
- flag: "client-ca-file"
|
||||
set: false
|
||||
remediation: |
|
||||
Edit the Openshift node config file /etc/origin/node/node-config.yaml and remove any configuration returned by the following:
|
||||
grep -A1 client-ca-file /etc/origin/node/node-config.yaml
|
||||
|
||||
Reset to the OpenShift default.
|
||||
See https://github.com/openshift/openshift-ansible/blob/release-3.10/roles/openshift_node_group/templates/node-config.yaml.j2#L65
|
||||
The config file does not have this defined in kubeletArgument, but in PodManifestConfig.
|
||||
scored: true
|
||||
|
||||
- id: 7.5
|
||||
text: "Verify the OpenShift default setting for the read-only-port argument"
|
||||
audit: "grep -A1 read-only-port /etc/origin/node/node-config.yaml"
|
||||
tests:
|
||||
bin_op: or
|
||||
test_items:
|
||||
- flag: "read-only-port"
|
||||
set: false
|
||||
- flag: "read-only-port: 0"
|
||||
compare:
|
||||
op: has
|
||||
value: "0"
|
||||
set: true
|
||||
remediation: |
|
||||
Edit the Openshift node config file /etc/origin/node/node-config.yaml and removed so that the OpenShift default is applied.
|
||||
scored: true
|
||||
|
||||
- id: 7.6
|
||||
text: "Adjust the streaming-connection-idle-timeout argument"
|
||||
audit: "grep -A1 streaming-connection-idle-timeout /etc/origin/node/node-config.yaml"
|
||||
tests:
|
||||
bin_op: or
|
||||
test_items:
|
||||
- flag: "streaming-connection-idle-timeout"
|
||||
set: false
|
||||
- flag: "5m"
|
||||
set: false
|
||||
remediation: |
|
||||
Edit the Openshift node config file /etc/origin/node/node-config.yaml and set the streaming-connection-timeout
|
||||
value like the following in node-config.yaml.
|
||||
|
||||
kubeletArguments:
|
||||
streaming-connection-idle-timeout:
|
||||
- "5m"
|
||||
scored: true
|
||||
|
||||
- id: 7.7
|
||||
text: "Verify the OpenShift defaults for the protect-kernel-defaults argument"
|
||||
type: "skip"
|
||||
scored: true
|
||||
|
||||
- id: 7.8
|
||||
text: "Verify the OpenShift default value of true for the make-iptables-util-chains argument"
|
||||
audit: "grep -A1 make-iptables-util-chains /etc/origin/node/node-config.yaml"
|
||||
tests:
|
||||
bin_op: or
|
||||
test_items:
|
||||
- flag: "make-iptables-util-chains"
|
||||
set: false
|
||||
- flag: "make-iptables-util-chains: true"
|
||||
compare:
|
||||
op: has
|
||||
value: "true"
|
||||
set: true
|
||||
remediation: |
|
||||
Edit the Openshift node config file /etc/origin/node/node-config.yaml and reset make-iptables-util-chains to the OpenShift
|
||||
default value of true.
|
||||
scored: true
|
||||
|
||||
- id: 7.9
|
||||
text: "Verify that the --keep-terminated-pod-volumes argument is set to false"
|
||||
audit: "grep -A1 keep-terminated-pod-volumes /etc/origin/node/node-config.yaml"
|
||||
tests:
|
||||
test_items:
|
||||
- flag: "keep-terminated-pod-volumes: false"
|
||||
compare:
|
||||
op: has
|
||||
value: "false"
|
||||
set: true
|
||||
remediation: |
|
||||
Reset to the OpenShift defaults
|
||||
scored: true
|
||||
|
||||
- id: 7.10
|
||||
text: "Verify the OpenShift defaults for the hostname-override argument"
|
||||
type: "skip"
|
||||
scored: true
|
||||
|
||||
- id: 7.11
|
||||
text: "Set the --event-qps argument to 0"
|
||||
audit: "grep -A1 event-qps /etc/origin/node/node-config.yaml"
|
||||
tests:
|
||||
bin_op: or
|
||||
test_items:
|
||||
- flag: "event-qps"
|
||||
set: false
|
||||
- flag: "event-qps: 0"
|
||||
compare:
|
||||
op: has
|
||||
value: "0"
|
||||
set: true
|
||||
remediation: |
|
||||
Edit the Openshift node config file /etc/origin/node/node-config.yaml set the event-qps argument to 0 in
|
||||
the kubeletArguments section of.
|
||||
scored: true
|
||||
|
||||
- id: 7.12
|
||||
text: "Verify the OpenShift cert-dir flag for HTTPS traffic"
|
||||
audit: "grep -A1 cert-dir /etc/origin/node/node-config.yaml"
|
||||
tests:
|
||||
test_items:
|
||||
- flag: "/etc/origin/node/certificates"
|
||||
compare:
|
||||
op: has
|
||||
value: "/etc/origin/node/certificates"
|
||||
set: true
|
||||
remediation: |
|
||||
Reset to the OpenShift default values.
|
||||
scored: true
|
||||
|
||||
- id: 7.13
|
||||
text: "Verify the OpenShift default of 0 for the cadvisor-port argument"
|
||||
audit: "grep -A1 cadvisor-port /etc/origin/node/node-config.yaml"
|
||||
tests:
|
||||
bin_op: or
|
||||
test_items:
|
||||
- flag: "cadvisor-port"
|
||||
set: false
|
||||
- flag: "cadvisor-port: 0"
|
||||
compare:
|
||||
op: has
|
||||
value: "0"
|
||||
set: true
|
||||
remediation: |
|
||||
Edit the Openshift node config file /etc/origin/node/node-config.yaml and remove the cadvisor-port flag
|
||||
if it is set in the kubeletArguments section.
|
||||
scored: true
|
||||
|
||||
- id: 7.14
|
||||
text: "Verify that the RotateKubeletClientCertificate argument is set to true"
|
||||
audit: "grep -B1 RotateKubeletClientCertificate=true /etc/origin/node/node-config.yaml"
|
||||
tests:
|
||||
test_items:
|
||||
- flag: "RotateKubeletClientCertificate=true"
|
||||
compare:
|
||||
op: has
|
||||
value: "true"
|
||||
set: true
|
||||
remediation: |
|
||||
Edit the Openshift node config file /etc/origin/node/node-config.yaml and set RotateKubeletClientCertificate to true.
|
||||
scored: true
|
||||
|
||||
- id: 7.15
|
||||
text: "Verify that the RotateKubeletServerCertificate argument is set to true"
|
||||
audit: "grep -B1 RotateKubeletServerCertificate=true /etc/origin/node/node-config.yaml"
|
||||
tests:
|
||||
test_items:
|
||||
- flag: "RotateKubeletServerCertificate=true"
|
||||
compare:
|
||||
op: has
|
||||
value: "true"
|
||||
set: true
|
||||
remediation: |
|
||||
Edit the Openshift node config file /etc/origin/node/node-config.yaml and set RotateKubeletServerCertificate to true.
|
||||
scored: true
|
||||
|
||||
|
||||
- id: 8
|
||||
text: "Configuration Files"
|
||||
checks:
|
||||
- id: 8.1
|
||||
text: "Verify the OpenShift default permissions for the kubelet.conf file"
|
||||
audit: "stat -c %a /etc/origin/node/node.kubeconfig"
|
||||
tests:
|
||||
bin_op: or
|
||||
test_items:
|
||||
- flag: "644"
|
||||
compare:
|
||||
op: eq
|
||||
value: "644"
|
||||
set: true
|
||||
- flag: "640"
|
||||
compare:
|
||||
op: eq
|
||||
value: "640"
|
||||
set: true
|
||||
- flag: "600"
|
||||
compare:
|
||||
op: eq
|
||||
value: "600"
|
||||
set: true
|
||||
remediation: |
|
||||
Run the below command on each worker node.
|
||||
chmod 644 /etc/origin/node/node.kubeconfig
|
||||
scored: true
|
||||
|
||||
- id: 8.2
|
||||
text: "Verify the kubeconfig file ownership of root:root"
|
||||
audit: "stat -c %U:%G /etc/origin/node/node.kubeconfig"
|
||||
tests:
|
||||
test_items:
|
||||
- flag: "root:root"
|
||||
compare:
|
||||
op: eq
|
||||
value: root:root
|
||||
set: true
|
||||
remediation: |
|
||||
Run the below command on each worker node.
|
||||
chown root:root /etc/origin/node/node.kubeconfig
|
||||
scored: true
|
||||
|
||||
- id: 8.3
|
||||
text: "Verify the kubelet service file permissions of 644"
|
||||
audit: "stat -c %a /etc/systemd/system/atomic-openshift-node.service"
|
||||
tests:
|
||||
bin_op: or
|
||||
test_items:
|
||||
- flag: "644"
|
||||
compare:
|
||||
op: eq
|
||||
value: "644"
|
||||
set: true
|
||||
- flag: "640"
|
||||
compare:
|
||||
op: eq
|
||||
value: "640"
|
||||
set: true
|
||||
- flag: "600"
|
||||
compare:
|
||||
op: eq
|
||||
value: "600"
|
||||
set: true
|
||||
remediation: |
|
||||
Run the below command on each worker node.
|
||||
chmod 644 /etc/systemd/system/atomic-openshift-node.service
|
||||
scored: true
|
||||
|
||||
- id: 8.4
|
||||
text: "Verify the kubelet service file ownership of root:root"
|
||||
audit: "stat -c %U:%G /etc/systemd/system/atomic-openshift-node.service"
|
||||
tests:
|
||||
test_items:
|
||||
- flag: "root:root"
|
||||
compare:
|
||||
op: eq
|
||||
value: root:root
|
||||
set: true
|
||||
remediation: |
|
||||
Run the below command on each worker node.
|
||||
chown root:root /etc/systemd/system/atomic-openshift-node.service
|
||||
scored: true
|
||||
|
||||
- id: 8.5
|
||||
text: "Verify the OpenShift default permissions for the proxy kubeconfig file"
|
||||
audit: "stat -c %a /etc/origin/node/node.kubeconfig"
|
||||
tests:
|
||||
bin_op: or
|
||||
test_items:
|
||||
- flag: "644"
|
||||
compare:
|
||||
op: eq
|
||||
value: "644"
|
||||
set: true
|
||||
- flag: "640"
|
||||
compare:
|
||||
op: eq
|
||||
value: "640"
|
||||
set: true
|
||||
- flag: "600"
|
||||
compare:
|
||||
op: eq
|
||||
value: "600"
|
||||
set: true
|
||||
remediation: |
|
||||
Run the below command on each worker node.
|
||||
chmod 644 /etc/origin/node/node.kubeconfig
|
||||
scored: true
|
||||
|
||||
- id: 8.6
|
||||
text: "Verify the proxy kubeconfig file ownership of root:root"
|
||||
audit: "stat -c %U:%G /etc/origin/node/node.kubeconfig"
|
||||
tests:
|
||||
test_items:
|
||||
- flag: "root:root"
|
||||
compare:
|
||||
op: eq
|
||||
value: root:root
|
||||
set: true
|
||||
remediation: |
|
||||
Run the below command on each worker node.
|
||||
chown root:root /etc/origin/node/node.kubeconfig
|
||||
scored: true
|
||||
|
||||
- id: 8.7
|
||||
text: "Verify the OpenShift default permissions for the certificate authorities file."
|
||||
audit: "stat -c %a /etc/origin/node/client-ca.crt"
|
||||
tests:
|
||||
bin_op: or
|
||||
test_items:
|
||||
- flag: "644"
|
||||
compare:
|
||||
op: eq
|
||||
value: "644"
|
||||
set: true
|
||||
- flag: "640"
|
||||
compare:
|
||||
op: eq
|
||||
value: "640"
|
||||
set: true
|
||||
- flag: "600"
|
||||
compare:
|
||||
op: eq
|
||||
value: "600"
|
||||
set: true
|
||||
remediation: |
|
||||
Run the below command on each worker node.
|
||||
chmod 644 /etc/origin/node/client-ca.crt
|
||||
scored: true
|
||||
|
||||
- id: 8.8
|
||||
text: "Verify the client certificate authorities file ownership of root:root"
|
||||
audit: "stat -c %U:%G /etc/origin/node/client-ca.crt"
|
||||
tests:
|
||||
test_items:
|
||||
- flag: "root:root"
|
||||
compare:
|
||||
op: eq
|
||||
value: root:root
|
||||
set: true
|
||||
remediation: |
|
||||
Run the below command on each worker node.
|
||||
chown root:root /etc/origin/node/client-ca.crt
|
||||
scored: true
|
||||
@@ -62,16 +62,17 @@ func handleError(err error, context string) (errmsg string) {
|
||||
type Check struct {
|
||||
ID string `yaml:"id" json:"test_number"`
|
||||
Text string `json:"test_desc"`
|
||||
Audit string `json:"omit"`
|
||||
Audit string `json:"audit"`
|
||||
Type string `json:"type"`
|
||||
Commands []*exec.Cmd `json:"omit"`
|
||||
Tests *tests `json:"omit"`
|
||||
Set bool `json:"omit"`
|
||||
Remediation string `json:"-"`
|
||||
Remediation string `json:"remediation"`
|
||||
TestInfo []string `json:"test_info"`
|
||||
State `json:"status"`
|
||||
ActualValue string `json:"actual_value"`
|
||||
Scored bool `json:"scored"`
|
||||
ExpectedResult string `json:"expected_result"`
|
||||
}
|
||||
|
||||
// Runner wraps the basic Run method.
|
||||
@@ -188,6 +189,7 @@ func (c *Check) run() State {
|
||||
finalOutput := c.Tests.execute(out.String())
|
||||
if finalOutput != nil {
|
||||
c.ActualValue = finalOutput.actualResult
|
||||
c.ExpectedResult = finalOutput.ExpectedResult
|
||||
if finalOutput.testResult {
|
||||
c.State = PASS
|
||||
} else {
|
||||
|
||||
@@ -103,13 +103,26 @@ type: "master"
|
||||
groups:
|
||||
- id: G1
|
||||
checks:
|
||||
- id: G1/C1
|
||||
- id: G1/C1
|
||||
- id: G2
|
||||
checks:
|
||||
- id: G2/C1
|
||||
- id: G2/C1
|
||||
text: "Verify that the SomeSampleFlag argument is set to true"
|
||||
audit: "grep -B1 SomeSampleFlag=true /this/is/a/file/path"
|
||||
tests:
|
||||
test_items:
|
||||
- flag: "SomeSampleFlag=true"
|
||||
compare:
|
||||
op: has
|
||||
value: "true"
|
||||
set: true
|
||||
remediation: |
|
||||
Edit the config file /this/is/a/file/path and set SomeSampleFlag to true.
|
||||
scored: true
|
||||
`)
|
||||
// and
|
||||
controls, _ := NewControls(MASTER, in)
|
||||
controls, err := NewControls(MASTER, in)
|
||||
assert.NoError(t, err)
|
||||
// and
|
||||
runner.On("Run", controls.Groups[0].Checks[0]).Return(PASS)
|
||||
runner.On("Run", controls.Groups[1].Checks[0]).Return(FAIL)
|
||||
@@ -130,6 +143,12 @@ groups:
|
||||
G2 := controls.Groups[1]
|
||||
assert.Equal(t, "G2", G2.ID)
|
||||
assert.Equal(t, "G2/C1", G2.Checks[0].ID)
|
||||
assert.Equal(t, "has", G2.Checks[0].Tests.TestItems[0].Compare.Op)
|
||||
assert.Equal(t, "true", G2.Checks[0].Tests.TestItems[0].Compare.Value)
|
||||
assert.Equal(t, true, G2.Checks[0].Tests.TestItems[0].Set)
|
||||
assert.Equal(t, "SomeSampleFlag=true", G2.Checks[0].Tests.TestItems[0].Flag)
|
||||
assert.Equal(t, "Edit the config file /this/is/a/file/path and set SomeSampleFlag to true.\n", G2.Checks[0].Remediation)
|
||||
assert.Equal(t, true, G2.Checks[0].Scored)
|
||||
assertEqualGroupSummary(t, 0, 1, 0, 0, G2)
|
||||
// and
|
||||
assert.Equal(t, 1, controls.Summary.Pass)
|
||||
@@ -139,7 +158,6 @@ groups:
|
||||
// and
|
||||
runner.AssertExpectations(t)
|
||||
})
|
||||
|
||||
}
|
||||
|
||||
func assertEqualGroupSummary(t *testing.T, pass, fail, info, warn int, actual *Group) {
|
||||
|
||||
@@ -58,6 +58,7 @@ type compare struct {
|
||||
type testOutput struct {
|
||||
testResult bool
|
||||
actualResult string
|
||||
ExpectedResult string
|
||||
}
|
||||
|
||||
func failTestItem(s string) *testOutput {
|
||||
@@ -135,9 +136,10 @@ func (t *testItem) execute(s string) *testOutput {
|
||||
}
|
||||
}
|
||||
|
||||
result.actualResult = strings.ToLower(flagVal)
|
||||
expectedResultPattern := ""
|
||||
switch t.Compare.Op {
|
||||
case "eq":
|
||||
expectedResultPattern = "'%s' is equal to '%s'"
|
||||
value := strings.ToLower(flagVal)
|
||||
// Do case insensitive comparaison for booleans ...
|
||||
if value == "false" || value == "true" {
|
||||
@@ -147,6 +149,7 @@ func (t *testItem) execute(s string) *testOutput {
|
||||
}
|
||||
|
||||
case "noteq":
|
||||
expectedResultPattern = "'%s' is not equal to '%s'"
|
||||
value := strings.ToLower(flagVal)
|
||||
// Do case insensitive comparaison for booleans ...
|
||||
if value == "false" || value == "true" {
|
||||
@@ -156,32 +159,41 @@ func (t *testItem) execute(s string) *testOutput {
|
||||
}
|
||||
|
||||
case "gt":
|
||||
expectedResultPattern = "%s is greater then %s"
|
||||
a, b := toNumeric(flagVal, t.Compare.Value)
|
||||
result.testResult = a > b
|
||||
|
||||
case "gte":
|
||||
expectedResultPattern = "%s is greater or equal to %s"
|
||||
a, b := toNumeric(flagVal, t.Compare.Value)
|
||||
result.testResult = a >= b
|
||||
|
||||
case "lt":
|
||||
expectedResultPattern = "%s is lower then %s"
|
||||
a, b := toNumeric(flagVal, t.Compare.Value)
|
||||
result.testResult = a < b
|
||||
|
||||
case "lte":
|
||||
expectedResultPattern = "%s is lower or equal to %s"
|
||||
a, b := toNumeric(flagVal, t.Compare.Value)
|
||||
result.testResult = a <= b
|
||||
|
||||
case "has":
|
||||
expectedResultPattern = "'%s' has '%s'"
|
||||
result.testResult = strings.Contains(flagVal, t.Compare.Value)
|
||||
|
||||
case "nothave":
|
||||
expectedResultPattern = " '%s' not have '%s'"
|
||||
result.testResult = !strings.Contains(flagVal, t.Compare.Value)
|
||||
}
|
||||
|
||||
result.ExpectedResult = fmt.Sprintf(expectedResultPattern, t.Flag, t.Compare.Value)
|
||||
} else {
|
||||
result.ExpectedResult = fmt.Sprintf("'%s' is present", t.Flag)
|
||||
result.testResult = isset
|
||||
}
|
||||
|
||||
} else {
|
||||
result.ExpectedResult = fmt.Sprintf("'%s' is not present", t.Flag)
|
||||
notset := !match
|
||||
result.testResult = notset
|
||||
}
|
||||
@@ -207,8 +219,11 @@ func (ts *tests) execute(s string) *testOutput {
|
||||
return finalOutput
|
||||
}
|
||||
|
||||
expectedResultArr := make([]string, len(res))
|
||||
|
||||
for i, t := range ts.TestItems {
|
||||
res[i] = *(t.execute(s))
|
||||
expectedResultArr[i] = res[i].ExpectedResult
|
||||
}
|
||||
|
||||
var result bool
|
||||
@@ -222,16 +237,25 @@ func (ts *tests) execute(s string) *testOutput {
|
||||
for i := range res {
|
||||
result = result && res[i].testResult
|
||||
}
|
||||
// Generate an AND expected result
|
||||
finalOutput.ExpectedResult = strings.Join(expectedResultArr, " AND ")
|
||||
|
||||
case or:
|
||||
result = false
|
||||
for i := range res {
|
||||
result = result || res[i].testResult
|
||||
}
|
||||
// Generate an OR expected result
|
||||
finalOutput.ExpectedResult = strings.Join(expectedResultArr, " OR ")
|
||||
}
|
||||
|
||||
finalOutput.testResult = result
|
||||
finalOutput.actualResult = res[0].actualResult
|
||||
|
||||
if finalOutput.actualResult == "" {
|
||||
finalOutput.actualResult = s
|
||||
}
|
||||
|
||||
return finalOutput
|
||||
}
|
||||
|
||||
|
||||
@@ -15,10 +15,12 @@
|
||||
package cmd
|
||||
|
||||
import (
|
||||
"bufio"
|
||||
"fmt"
|
||||
"io/ioutil"
|
||||
"os"
|
||||
"path/filepath"
|
||||
"strings"
|
||||
|
||||
"github.com/aquasecurity/kube-bench/check"
|
||||
"github.com/golang/glog"
|
||||
@@ -111,7 +113,7 @@ func runChecks(nodetype check.NodeType) {
|
||||
exitWithError(fmt.Errorf("failed to output in JSON format: %v", err))
|
||||
}
|
||||
|
||||
fmt.Println(string(out))
|
||||
PrintOutput(string(out), outputFile)
|
||||
} else {
|
||||
// if we want to store in PostgreSQL, convert to JSON and save it
|
||||
if (summary.Fail > 0 || summary.Warn > 0 || summary.Pass > 0 || summary.Info > 0) && pgSQL {
|
||||
@@ -142,6 +144,10 @@ func prettyPrint(r *check.Controls, summary check.Summary) {
|
||||
colorPrint(check.INFO, fmt.Sprintf("%s %s\n", g.ID, g.Text))
|
||||
for _, c := range g.Checks {
|
||||
colorPrint(c.State, fmt.Sprintf("%s %s\n", c.ID, c.Text))
|
||||
|
||||
if includeTestOutput && c.State == check.FAIL && len(c.ActualValue) > 0 {
|
||||
printRawOutput(c.ActualValue)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
@@ -240,3 +246,32 @@ func isMaster() bool {
|
||||
}
|
||||
return true
|
||||
}
|
||||
|
||||
func printRawOutput(output string) {
|
||||
for _, row := range strings.Split(output, "\n") {
|
||||
fmt.Println(fmt.Sprintf("\t %s", row))
|
||||
}
|
||||
}
|
||||
|
||||
func writeOutputToFile(output string, outputFile string) error {
|
||||
file, err := os.Create(outputFile)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
defer file.Close()
|
||||
|
||||
w := bufio.NewWriter(file)
|
||||
fmt.Fprintln(w, output)
|
||||
return w.Flush()
|
||||
}
|
||||
|
||||
func PrintOutput(output string, outputFile string) {
|
||||
if len(outputFile) == 0 {
|
||||
fmt.Println(output)
|
||||
} else {
|
||||
err := writeOutputToFile(output, outputFile)
|
||||
if err != nil {
|
||||
exitWithError(fmt.Errorf("Failed to write to output file %s: %v", outputFile, err))
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
@@ -47,6 +47,8 @@ var (
|
||||
noSummary bool
|
||||
noRemediations bool
|
||||
filterOpts FilterOpts
|
||||
includeTestOutput bool
|
||||
outputFile string
|
||||
)
|
||||
|
||||
// RootCmd represents the base command when called without any subcommands
|
||||
@@ -87,6 +89,8 @@ func init() {
|
||||
RootCmd.PersistentFlags().BoolVar(&pgSQL, "pgsql", false, "Save the results to PostgreSQL")
|
||||
RootCmd.PersistentFlags().BoolVar(&filterOpts.Scored, "scored", true, "Run the scored CIS checks")
|
||||
RootCmd.PersistentFlags().BoolVar(&filterOpts.Unscored, "unscored", true, "Run the unscored CIS checks")
|
||||
RootCmd.PersistentFlags().BoolVar(&includeTestOutput, "include-test-output", false, "Prints the actual result when test fails")
|
||||
RootCmd.PersistentFlags().StringVar(&outputFile, "outputfile", "", "Writes the JSON results to output file")
|
||||
|
||||
RootCmd.PersistentFlags().StringVarP(
|
||||
&filterOpts.CheckList,
|
||||
|
||||
@@ -241,11 +241,11 @@ func getKubeConfigFiles(v *viper.Viper) map[string]string {
|
||||
glog.V(2).Info(fmt.Sprintf("Using default kubeconfig file name '%s' for component %s", kubeconfig, component))
|
||||
} else {
|
||||
// Default the service file name that we'll substitute to the name of the component
|
||||
glog.V(2).Info(fmt.Sprintf("Missing service file for %s", component))
|
||||
glog.V(2).Info(fmt.Sprintf("Missing kubeconfig file for %s", component))
|
||||
kubeconfig = component
|
||||
}
|
||||
} else {
|
||||
glog.V(2).Info(fmt.Sprintf("Component %s uses service file '%s'", component, kubeconfig))
|
||||
glog.V(2).Info(fmt.Sprintf("Component %s uses kubeconfig file '%s'", component, kubeconfig))
|
||||
}
|
||||
|
||||
kubeconfigmap[component] = kubeconfig
|
||||
|
||||
23
cmd/version.go
Normal file
23
cmd/version.go
Normal file
@@ -0,0 +1,23 @@
|
||||
package cmd
|
||||
|
||||
import (
|
||||
"fmt"
|
||||
"github.com/spf13/cobra"
|
||||
)
|
||||
|
||||
var KubeBenchVersion string
|
||||
|
||||
// versionCmd represents the version command
|
||||
var versionCmd = &cobra.Command{
|
||||
Use: "version",
|
||||
Short: "Shows the version of kube-bench.",
|
||||
Long: `Shows the version of kube-bench.`,
|
||||
Run: func(cmd *cobra.Command, args []string) {
|
||||
fmt.Println(KubeBenchVersion)
|
||||
},
|
||||
}
|
||||
|
||||
func init() {
|
||||
RootCmd.AddCommand(versionCmd)
|
||||
}
|
||||
|
||||
379
docs/README.md
Normal file
379
docs/README.md
Normal file
@@ -0,0 +1,379 @@
|
||||
# Test and config files
|
||||
|
||||
`kube-bench` runs checks specified in `controls` files that are a YAML
|
||||
representation of the CIS Kubernetes Benchmark checks. There is a
|
||||
`controls` file per kubernetes version and node type.
|
||||
|
||||
kube-bench automatically selects which `controls` to use based on the detected
|
||||
node type and the version of kubernetes a cluster is running. This behaviour
|
||||
can be overridden by specifying the `master` or `node` subcommand and the
|
||||
`--version` flag on the command line.
|
||||
|
||||
For example:
|
||||
run kube-bench against a master with version auto-detection:
|
||||
|
||||
```
|
||||
kube-bench master
|
||||
```
|
||||
|
||||
or run kube-bench against a node with the node `controls` for kubernetes
|
||||
version 1.12:
|
||||
```
|
||||
kube-bench node --version 1.12
|
||||
```
|
||||
|
||||
`controls` for the various versions of kubernetes can be found in directories
|
||||
with same name as the kubernetes versions under `cfg/`, for example `cfg/1.12`.
|
||||
`controls` are also organized by distribution under the `cfg` directory for
|
||||
example `cfg/ocp-3.10`.
|
||||
|
||||
|
||||
## Controls
|
||||
|
||||
`controls` is a YAML document that contains checks that must be run against a
|
||||
specific kubernetes node type, master or node and version.
|
||||
|
||||
`controls` is the fundamental input to `kube-bench`. The following is an example
|
||||
of a basic `controls`:
|
||||
|
||||
```
|
||||
---
|
||||
controls:
|
||||
id: 1
|
||||
text: "Master Node Security Configuration"
|
||||
type: "master"
|
||||
groups:
|
||||
- id: 1.1
|
||||
text: API Server
|
||||
checks:
|
||||
- id: 1.1.1
|
||||
text: "Ensure that the --allow-privileged argument is set (Scored)"
|
||||
audit: "ps -ef | grep kube-apiserver | grep -v grep"
|
||||
tests:
|
||||
bin_op: or
|
||||
test_items:
|
||||
- flag: "--allow-privileged"
|
||||
set: true
|
||||
- flag: "--some-other-flag"
|
||||
set: false
|
||||
remediation: "Edit the /etc/kubernetes/config file on the master node and
|
||||
set the KUBE_ALLOW_PRIV parameter to '--allow-privileged=false'"
|
||||
scored: true
|
||||
- id: 1.2
|
||||
text: Scheduler
|
||||
checks:
|
||||
- id: 1.2.1
|
||||
text: "Ensure that the --profiling argument is set to false (Scored)"
|
||||
audit: "ps -ef | grep kube-scheduler | grep -v grep"
|
||||
tests:
|
||||
bin_op: or
|
||||
test_items:
|
||||
- flag: "--profiling"
|
||||
set: true
|
||||
- flag: "--some-other-flag"
|
||||
set: false
|
||||
remediation: "Edit the /etc/kubernetes/config file on the master node and
|
||||
set the KUBE_ALLOW_PRIV parameter to '--allow-privileged=false'"
|
||||
scored: true
|
||||
```
|
||||
|
||||
`controls` is composed of a hierachy of groups, sub-groups and checks. Each of
|
||||
the `controls` components have an id and a text description which are displayed
|
||||
in the `kube-bench` output.
|
||||
|
||||
`type` specifies what kubernetes node type a `controls` is for. Possible values
|
||||
for `type` are `master` and `node`.
|
||||
|
||||
## Groups
|
||||
|
||||
`groups` is list of subgroups which test the various kubernetes components
|
||||
that run on the node type specified in the `controls`.
|
||||
|
||||
For example one subgroup checks parameters passed to the apiserver binary, while
|
||||
another subgroup checks parameters passed to the controller-manager binary.
|
||||
|
||||
```
|
||||
groups:
|
||||
- id: 1.1
|
||||
text: API Server
|
||||
...
|
||||
- id: 1.2
|
||||
text: Scheduler
|
||||
...
|
||||
```
|
||||
|
||||
These subgroups have `id`, `text` fields which serve the same purposes described
|
||||
in the previous paragraphs. The most important part of the subgroup is the
|
||||
`checks` field which is the collection of actual `check`s that form the subgroup.
|
||||
|
||||
This is an example of a subgroup and checks in the subgroup.
|
||||
|
||||
```
|
||||
id: 1.1
|
||||
text: API Server
|
||||
checks:
|
||||
- id: 1.1.1
|
||||
text: "Ensure that the --allow-privileged argument is set (Scored)"
|
||||
audit: "ps -ef | grep kube-apiserver | grep -v grep"
|
||||
tests:
|
||||
...
|
||||
- id: 1.1.2
|
||||
text: "Ensure that the --anonymous-auth argument is set to false (Not Scored)"
|
||||
audit: "ps -ef | grep kube-apiserver | grep -v grep"
|
||||
tests:
|
||||
...
|
||||
```
|
||||
|
||||
`kube-bench` supports running a subgroup by specifying the subgroup `id` on the
|
||||
command line, with the flag `--group` or `-g`.
|
||||
|
||||
## Check
|
||||
|
||||
The CIS Kubernetes Benchmark recommends configurations to harden kubernetes
|
||||
components. These recommendations are usually configuration options, and can be
|
||||
specified by flags to kubernetes binaries, or in configuration files.
|
||||
|
||||
The Benchmark also provides commands to audit a kubernetes installation, identify
|
||||
places where the cluster security can be improved, and steps to remediate these
|
||||
identified problems.
|
||||
|
||||
In `kube-bench`, `check` objects embody these recommendations. This an example
|
||||
`check` object:
|
||||
|
||||
```
|
||||
id: 1.1.1
|
||||
text: "Ensure that the --anonymous-auth argument is set to false (Not Scored)"
|
||||
audit: "ps -ef | grep kube-apiserver | grep -v grep"
|
||||
tests:
|
||||
test_items:
|
||||
- flag: "--anonymous-auth"
|
||||
compare:
|
||||
op: eq
|
||||
value: false
|
||||
set: true
|
||||
remediation: |
|
||||
Edit the API server pod specification file kube-apiserver
|
||||
on the master node and set the below parameter.
|
||||
--anonymous-auth=false
|
||||
scored: false
|
||||
```
|
||||
|
||||
A `check` object has an `id`, a `text`, an `audit` , a `tests`,`remediation`
|
||||
and `scored` fields.
|
||||
|
||||
`kube-bench` supports running individual checks by specifying the check's `id`
|
||||
as a comma-delimited list on the command line with the `--check` flag.
|
||||
|
||||
The `audit` field specifies the command to run for a check. The output of this
|
||||
command is then evaluated for conformance with the CIS Kubernetes Benchmark
|
||||
recommendation.
|
||||
|
||||
The audit is evaluated against a criteria specified by the `tests`
|
||||
object. `tests` contain `bin_op` and `test_items`.
|
||||
|
||||
`test_items` specify the criteria(s) the `audit` command's output should meet to
|
||||
pass a check. This criteria is made up of keywords extracted from the output of
|
||||
the `audit` command and operations that compare the these keywords against
|
||||
values expected by the CIS Kubernetes Benchmark.
|
||||
|
||||
The are two ways to extract keywords from the output of the `audit` command,
|
||||
`flag` and `path`.
|
||||
|
||||
`flag` is used when the keyword is a command line flag. The associated `audit`
|
||||
command is usually a `ps` command and a `grep` for the binary whose flag we are
|
||||
checking:
|
||||
|
||||
```
|
||||
ps -ef | grep somebinary | grep -v grep
|
||||
```
|
||||
|
||||
Here is an example usage of the `flag` option:
|
||||
|
||||
```
|
||||
...
|
||||
audit: "ps -ef | grep kube-apiserver | grep -v grep"
|
||||
tests:
|
||||
test_items:
|
||||
- flag: "--anonymous-auth"
|
||||
...
|
||||
```
|
||||
|
||||
`path` is used when the keyword is an option set in a JSON or YAML config file.
|
||||
The associated `audit` command is usually `cat /path/to/config-yaml-or-json`.
|
||||
For example:
|
||||
|
||||
```
|
||||
...
|
||||
|
||||
text: "Ensure that the --anonymous-auth argument is set to false (Not Scored)"
|
||||
audit: "cat /path/to/some/config"
|
||||
tests:
|
||||
test_items:
|
||||
- path: "{.someoption.value}"
|
||||
...
|
||||
```
|
||||
|
||||
`test_item` compares the output of the audit command and keywords using the
|
||||
`set` and `compare` fields.
|
||||
|
||||
```
|
||||
test_items:
|
||||
- flag: "--anonymous-auth"
|
||||
compare:
|
||||
op: eq
|
||||
value: false
|
||||
set: true
|
||||
```
|
||||
|
||||
`set` checks if a keyword is present in the output of the audit command or in
|
||||
a config file. The possible values for `set` are true and false.
|
||||
|
||||
If `set` is true, the check passes only if the keyword is present in the output
|
||||
of the audit command, or config file. If `set` is false, the check passes only
|
||||
if the keyword is not present in the output of the audit command, or config file.
|
||||
|
||||
`compare` has two fields `op` and `value` to compare keywords with expected
|
||||
value. `op` specifies which operation is used for the comparison , and `value`
|
||||
specifies the value to compare against.
|
||||
|
||||
> To use `compare`, `set` must true. The comparison will be ignored if `set` is
|
||||
> false
|
||||
|
||||
The `op` (operations) currently supported in `kube-bench` are:
|
||||
- `eq`: tests if the keyword is equal to the compared value.
|
||||
- `noteq`: tests if the keyword is unequal to the compared value.
|
||||
- `gt`: tests if the keyword is greater than the compared value.
|
||||
- `gte`: tests if the keyword is greater than or equal to the compared value.
|
||||
- `lt`: tests if the keyword is less than the compared value.
|
||||
- `lte`: tests if the keyword is less than or equal to the compared value.
|
||||
- `has`: tests if the keyword contains the compared value.
|
||||
- `nothave`: tests if the keyword does not contain the compared value.
|
||||
|
||||
## Configuration and Variables
|
||||
|
||||
Kubernetes component configuration and binary file locations and names
|
||||
vary based on cluster deployment methods and kubernetes distribution used.
|
||||
For this reason, the locations of these binaries and config files are configurable
|
||||
by editing the `cfg/config.yaml` file and these binaries and files can be
|
||||
referenced in a `controls` file via variables.
|
||||
|
||||
The `cfg/config.yaml` file is a global configuration file. Configuration files
|
||||
can be created for specific Kubernetes versions (distributions). Values in the
|
||||
version specific config overwrite similar values in `cfg/config.yaml`.
|
||||
|
||||
For example, the kube-apiserver in Redhat OCP distribution is run as
|
||||
`hypershift openshift-kube-apiserver` instead of the default `kube-apiserver`.
|
||||
This difference can be specified by editing the `master.apiserver.defaultbin`
|
||||
entry `cfg/ocp-3.10/config.yaml`.
|
||||
|
||||
Below is the structure of `cfg/config.yaml`:
|
||||
|
||||
```
|
||||
nodetype
|
||||
|-- components
|
||||
|-- component1
|
||||
|-- component1
|
||||
|-- bins
|
||||
|-- defaultbin (optional)
|
||||
|-- confs
|
||||
|-- defaultconf (optional)
|
||||
|-- svcs
|
||||
|-- defaultsvc (optional)
|
||||
|-- kubeconfig
|
||||
|-- defaultkubeconfig (optional)
|
||||
```
|
||||
|
||||
Every node type has a subsection that specifies the main configurations items.
|
||||
|
||||
- `components`: A list of components for the node type. For example master
|
||||
will have an entry for **apiserver**, **scheduler** and **controllermanager**.
|
||||
|
||||
Each component has the following entries:
|
||||
|
||||
- `bins`: A list of candidate binaries for a component. `kube-bench` checks this
|
||||
list and selects the first binary that is running on the node, if none is
|
||||
running, `kube-bench` terminates.
|
||||
|
||||
If `defaultbin` is specified, `kube-bench` ignores the `bins` list (if it is
|
||||
specified) and verifies the binary specified with `defaultbin` is running on
|
||||
the node. `kube-bench` terminates if this binary is not running.
|
||||
|
||||
The selected binary for a component can be referenced in `controls` using a
|
||||
variable in the form `$<component>bin`. In the example below, we reference
|
||||
the selected API server binary with the variable `$apiserverbin` in an `audit`
|
||||
command.
|
||||
|
||||
```
|
||||
id: 1.1.1
|
||||
text: "Ensure that the --anonymous-auth argument is set to false (Scored)"
|
||||
audit: "ps -ef | grep $apiserverbin | grep -v grep"
|
||||
...
|
||||
```
|
||||
|
||||
- `confs`: A list of candidate configuration files for a component. `kube-bench`
|
||||
checks this list and selects the first config fille that is found on the node,
|
||||
if none of the config files exists `kube-bench` terminates.
|
||||
|
||||
If `defaultconf`is specified for a component, `kube-bench` ignores the `confs`
|
||||
list (if it is specified) and verifies the config specified by `defaultconf`
|
||||
exists on the node. `kube-bench` terminates if this file does not exist.
|
||||
|
||||
The selected config for a component can be referenced in `controls` using a
|
||||
variable in the form `$<component>conf`. In the example below we reference the
|
||||
selected API server config file with the variable `$apiserverconf` in an `audit`
|
||||
command.
|
||||
|
||||
```
|
||||
id: 1.4.1
|
||||
text: "Ensure that the API server pod specification file permissions are
|
||||
set to 644 or more restrictive (Scored)"
|
||||
audit: "/bin/sh -c 'if test -e $apiserverconf; then stat -c %a $apiserverconf; fi'"
|
||||
|
||||
```
|
||||
|
||||
- `svcs`: A list of candidates unitfiles for a component. `kube-bench` checks this
|
||||
list and selects the first unitfile that is found on the node, if none of the
|
||||
unitfiles exists `kube-bench` terminates.
|
||||
|
||||
If `defaultsvc`is specified for a component, `kube-bench` ignores the `svcs`
|
||||
list (if it is specified) and verifies the unitfile specified by `defaultsvc`
|
||||
exists on the node. `kube-bench` terminates if this file does not exist.
|
||||
|
||||
The selected unitfile for a component can be referenced in `controls` via a
|
||||
variable in the form `$<component>svc`. In the example below, the selected
|
||||
kubelet unitfile is referenced with `$kubeletsvc` in the `remediation` of the
|
||||
`check`.
|
||||
|
||||
```
|
||||
id: 2.1.1
|
||||
...
|
||||
remediation: |
|
||||
Edit the kubelet service file $kubeletsvc
|
||||
on each worker node and set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable.
|
||||
--allow-privileged=false
|
||||
Based on your system, restart the kubelet service. For example:
|
||||
systemctl daemon-reload
|
||||
systemctl restart kubelet.service
|
||||
...
|
||||
```
|
||||
|
||||
- `kubeconfig`: A list of candidate kubeconfig files for a component. `kube-bench`
|
||||
checks this list and selects the first file that is found on the node, if none
|
||||
of the files exists `kube-bench` terminates.
|
||||
|
||||
If `defaultkubeconfig` is specified for a component, `kube-bench` ignores the
|
||||
`kubeconfig` list (if it is specified) and verifies the kubeconfig file exists on
|
||||
the node. `kube-bench` terminates if this file does not exist.
|
||||
|
||||
The selected kubeconfig for a component can be referenced in `controls` with
|
||||
a variable in the form `$<component>kubeconfig`. In the example below, the
|
||||
selected kubelet kubeconfig is referenced with `$kubeletkubeconfig` in the
|
||||
`audit` command.
|
||||
|
||||
```
|
||||
id: 2.2.1
|
||||
text: "Ensure that the kubelet.conf file permissions are set to 644 or
|
||||
more restrictive (Scored)"
|
||||
audit: "/bin/sh -c 'if test -e $kubeletkubeconfig; then stat -c %a $kubeletkubeconfig; fi'"
|
||||
...
|
||||
```
|
||||
3
makefile
3
makefile
@@ -2,6 +2,7 @@ SOURCES := $(shell find . -name '*.go')
|
||||
BINARY := kube-bench
|
||||
DOCKER_REGISTRY ?= aquasec
|
||||
VERSION ?= $(shell git rev-parse --short=7 HEAD)
|
||||
KUBEBENCH_VERSION ?= $(shell git describe --tags --abbrev=0)
|
||||
IMAGE_NAME ?= $(DOCKER_REGISTRY)/$(BINARY):$(VERSION)
|
||||
TARGET_OS := linux
|
||||
BUILD_OS := linux
|
||||
@@ -22,7 +23,7 @@ KIND_CONTAINER_NAME=$(KIND_PROFILE)-control-plane
|
||||
build: kube-bench
|
||||
|
||||
$(BINARY): $(SOURCES)
|
||||
GOOS=$(TARGET_OS) go build -o $(BINARY) .
|
||||
GOOS=$(TARGET_OS) go build -ldflags "-X github.com/aquasecurity/kube-bench/cmd.KubeBenchVersion=$(KUBEBENCH_VERSION)" -o $(BINARY) .
|
||||
|
||||
# builds the current dev docker version
|
||||
build-docker:
|
||||
|
||||
Reference in New Issue
Block a user