Merge pull request #238 from Kuqd/features/autodetect-nodetype

Adds master node detection - thanks @Kuqd!
Merge branch 'master' into features/autodetect-nodetype
2026-02-25 23:34:03 +00:00 · 2019-03-18 18:43:13 +00:00 · 2019-03-13 20:36:19 -07:00 · 2019-03-12 19:32:05 -04:00 · 2019-03-07 14:53:22 +00:00 · 2019-03-07 11:18:06 +00:00
27 changed files with 4627 additions and 204 deletions
--- a/.gitignore
+++ b/.gitignore
@@ -2,3 +2,5 @@ kube-bench
 *.swp
 vendor
 dist
+.vscode/
+hack/kind.test.yaml
--- a/Gopkg.lock
+++ b/Gopkg.lock
@@ -2,23 +2,30 @@


 [[projects]]
+  digest = "1:938a2672d6ebbb7f7bc63eee3e4b9464c16ffcf77ec8913d3edbf32b4e3984dd"
  name = "github.com/fatih/color"
  packages = ["."]
+  pruneopts = "UT"
  revision = "570b54cabe6b8eb0bc2dfce68d964677d63b5260"
  version = "v1.5.0"

 [[projects]]
+  digest = "1:38c783cf85b9454cc02a1a8319239800ed0af6c1c864adf19cea0539e134adad"
  name = "github.com/fsnotify/fsnotify"
  packages = ["."]
+  pruneopts = "UT"
  revision = "4da3e2cfbabc9f751898f250b49f2439785783a1"

 [[projects]]
  branch = "master"
+  digest = "1:1ba1d79f2810270045c328ae5d674321db34e3aae468eb4233883b473c5c0467"
  name = "github.com/golang/glog"
  packages = ["."]
+  pruneopts = "UT"
  revision = "23def4e6c14b4da8ac2ed8007337bc5eb5007998"

 [[projects]]
+  digest = "1:145eff5207977eb95c3649a27cdc2e467d8a1c104810bc12b6a53745a91d823a"
  name = "github.com/hashicorp/hcl"
  packages = [
    ".",
@@ -29,106 +36,140 @@
    "hcl/token",
    "json/parser",
    "json/scanner",
-    "json/token"
+    "json/token",
  ]
+  pruneopts = "UT"
  revision = "23c074d0eceb2b8a5bfdbb271ab780cde70f05a8"

 [[projects]]
+  digest = "1:870d441fe217b8e689d7949fef6e43efbc787e50f200cb1e70dbca9204a1d6be"
  name = "github.com/inconshreveable/mousetrap"
  packages = ["."]
+  pruneopts = "UT"
  revision = "76626ae9c91c4f2a10f34cad8ce83ea42c93bb75"
  version = "v1.0"

 [[projects]]
+  digest = "1:510a2b056950ed12b4f3ac704ee1b34fd1920cb5b26f60f98d069de89c60adb7"
  name = "github.com/jinzhu/gorm"
  packages = [
    ".",
-    "dialects/postgres"
+    "dialects/postgres",
  ]
+  pruneopts = "UT"
  revision = "5174cc5c242a728b435ea2be8a2f7f998e15429b"
  version = "v1.0"

 [[projects]]
+  digest = "1:2cf1e05311b662e68d938f6655c6c5a44ae0e6b3995e390c75fcd8224afa48df"
  name = "github.com/jinzhu/inflection"
  packages = ["."]
+  pruneopts = "UT"
  revision = "1c35d901db3da928c72a72d8458480cc9ade058f"

 [[projects]]
+  digest = "1:38dd5cee5306173bfe78f8c401edec1e08f772551bee95a85617b4e39347e366"
  name = "github.com/lib/pq"
  packages = [
    ".",
    "hstore",
-    "oid"
+    "oid",
  ]
+  pruneopts = "UT"
  revision = "83612a56d3dd153a94a629cd64925371c9adad78"

 [[projects]]
+  digest = "1:9cbfcfd1ec741817698b844d17b523f54682a5f7c8683b1ec62b6b6542143240"
  name = "github.com/magiconair/properties"
  packages = ["."]
+  pruneopts = "UT"
  revision = "49d762b9817ba1c2e9d0c69183c2b4a8b8f1d934"

 [[projects]]
+  digest = "1:31fcf8f5f8f6cc36ef11182c0a0f63ba464e1a7ad9f0e92a7cf46f38bfc0adfd"
  name = "github.com/mattn/go-colorable"
  packages = ["."]
+  pruneopts = "UT"
  revision = "5411d3eea5978e6cdc258b30de592b60df6aba96"

 [[projects]]
+  digest = "1:fa610f9fe6a93f4a75e64c83673dfff9bf1a34bbb21e6102021b6bc7850834a3"
  name = "github.com/mattn/go-isatty"
  packages = ["."]
+  pruneopts = "UT"
  revision = "57fdcb988a5c543893cc61bce354a6e24ab70022"

 [[projects]]
+  digest = "1:56a0bd1a1f3809171d1abe0bfd389558be0cd672e858e1f831b88f806aa8764f"
  name = "github.com/mitchellh/mapstructure"
  packages = ["."]
+  pruneopts = "UT"
  revision = "06020f85339e21b2478f756a78e295255ffa4d6a"

 [[projects]]
+  digest = "1:128af710970a788bb2348dbcdde6b86fa41f92086297f909d659b6d3affc2902"
  name = "github.com/pelletier/go-toml"
  packages = ["."]
+  pruneopts = "UT"
  revision = "0131db6d737cfbbfb678f8b7d92e55e27ce46224"

 [[projects]]
+  digest = "1:1fccaaeae58b2a2f1af4dbf7eee92ff14f222e161d143bfd20082ef664f91216"
  name = "github.com/spf13/afero"
  packages = [
    ".",
-    "mem"
+    "mem",
  ]
+  pruneopts = "UT"
  revision = "57afd63c68602b63ed976de00dd066ccb3c319db"

 [[projects]]
+  digest = "1:9b28ee2984c69d78afe2ce52b1650ba91a6381f355ff08c1d0e53d9e66bd62fe"
  name = "github.com/spf13/cast"
  packages = ["."]
+  pruneopts = "UT"
  revision = "acbeb36b902d72a7a4c18e8f3241075e7ab763e4"
  version = "v1.1.0"

 [[projects]]
+  digest = "1:7ffc0983035bc7e297da3688d9fe19d60a420e9c38bef23f845c53788ed6a05e"
  name = "github.com/spf13/cobra"
  packages = ["."]
+  pruneopts = "UT"
  revision = "7b2c5ac9fc04fc5efafb60700713d4fa609b777b"
  version = "v0.0.1"

 [[projects]]
+  digest = "1:9f28b7e326b8cd1db556678b7ce679cf9bf888647e40922f91d9d40f451f942b"
  name = "github.com/spf13/jwalterweatherman"
  packages = ["."]
+  pruneopts = "UT"
  revision = "12bd96e66386c1960ab0f74ced1362f66f552f7b"

 [[projects]]
+  digest = "1:772bf4d1907ccb275aaa532ec6cb0d85fc61bd05648af28551590af3ea4e2d53"
  name = "github.com/spf13/pflag"
  packages = ["."]
+  pruneopts = "UT"
  revision = "4c012f6dcd9546820e378d0bdda4d8fc772cdfea"

 [[projects]]
+  digest = "1:f8e1a678a2571e265f4bf91a3e5e32aa6b1474a55cb0ea849750cc177b664d96"
  name = "github.com/spf13/viper"
  packages = ["."]
+  pruneopts = "UT"
  revision = "25b30aa063fc18e48662b86996252eabdcf2f0c7"
  version = "v1.0.0"

 [[projects]]
+  digest = "1:c9c0ba9ea00233c41b91e441cfd490f34b129bbfebcb1858979623bd8de07f72"
  name = "golang.org/x/sys"
  packages = ["unix"]
+  pruneopts = "UT"
  revision = "e24f485414aeafb646f6fca458b0bf869c0880a1"

 [[projects]]
+  digest = "1:8029e9743749d4be5bc9f7d42ea1659471767860f0cdc34d37c3111bd308a295"
  name = "golang.org/x/text"
  packages = [
    "internal/gen",
@@ -136,18 +177,29 @@
    "internal/ucd",
    "transform",
    "unicode/cldr",
-    "unicode/norm"
+    "unicode/norm",
  ]
+  pruneopts = "UT"
  revision = "e19ae1496984b1c655b8044a65c0300a3c878dd3"

 [[projects]]
+  digest = "1:cb130999076da4717267c51235d62b63228c330ad86160255cbe3276de4c9892"
  name = "gopkg.in/yaml.v2"
  packages = ["."]
+  pruneopts = "UT"
  revision = "c95af922eae69f190717a0b7148960af8c55a072"

 [solve-meta]
  analyzer-name = "dep"
  analyzer-version = 1
-  inputs-digest = "8d9a1b665b338530deef434f168913ba1184f835aa5bfed3a213a14c613bc17e"
+  input-imports = [
+    "github.com/fatih/color",
+    "github.com/golang/glog",
+    "github.com/jinzhu/gorm",
+    "github.com/jinzhu/gorm/dialects/postgres",
+    "github.com/spf13/cobra",
+    "github.com/spf13/viper",
+    "gopkg.in/yaml.v2",
+  ]
  solver-name = "gps-cdcl"
  solver-version = 1
--- a/README.md
+++ b/README.md
@@ -28,45 +28,50 @@ You can choose to
 You can avoid installing kube-bench on the host by running it inside a container using the host PID namespace and mounting the `/etc` and `/var` directories where the configuration and other files are located on the host, so that kube-bench can check their existence and permissions.

 ```
-docker run --pid=host -v /etc:/etc:ro -v /var:/var:ro -t aquasec/kube-bench:latest <master|node>
+docker run --pid=host -v /etc:/etc:ro -v /var:/var:ro -t aquasec/kube-bench:latest [master|node]
 ```

 You can even use your own configs by mounting them over the default ones in `/opt/kube-bench/cfg/`

 ```
-docker run --pid=host -v /etc:/etc:ro -v /var:/var:ro -t -v path/to/my-config.yaml:/opt/kube-bench/cfg/config.yaml aquasec/kube-bench:latest <master|node>
+docker run --pid=host -v /etc:/etc:ro -v /var:/var:ro -t -v path/to/my-config.yaml:/opt/kube-bench/cfg/config.yaml aquasec/kube-bench:latest [master|node]
 ```

 > Note: the tests require either the kubelet or kubectl binary in the path in order to know the Kubernetes version. You can pass `-v $(which kubectl):/usr/bin/kubectl` to the above invocations to resolve this.

 ### Running in a kubernetes cluster

-You can run kube-bench inside a pod, but it will need access to the host's PID namespace in order to check the running processes, as well as access to some directories on the host where config files and other files are stored. 
+You can run kube-bench inside a pod, but it will need access to the host's PID namespace in order to check the running processes, as well as access to some directories on the host where config files and other files are stored.

-To run the tests on the master node, the pod needs to be scheduled on that node. This involves setting a nodeSelector and tolerations in the pod spec.
+Master nodes are automatically detected by kube-bench and will run master checks when possible.
+The detection is done by verifying that mandatory components for master are running. (see [config file](#configuration).

-The supplied `job-node.yaml` and `job-master.yaml` files can be applied to run the tests as a job. For example:
+The supplied `job.yaml` file can be applied to run the tests as a job. For example:

 ```bash
-$ kubectl apply -f job-master.yaml 
-job.batch/kube-bench-master created
+$ kubectl apply -f job.yaml
+job.batch/kube-bench created

 $ kubectl get pods
 NAME                      READY   STATUS              RESTARTS   AGE
-kube-bench-master-j76s9   0/1     ContainerCreating   0          3s
+kube-bench-j76s9   0/1     ContainerCreating   0          3s

 # Wait for a few seconds for the job to complete
 $ kubectl get pods
 NAME                      READY   STATUS      RESTARTS   AGE
-kube-bench-master-j76s9   0/1     Completed   0          11s
+kube-bench-j76s9   0/1     Completed   0          11s

 # The results are held in the pod's logs
-k logs kube-bench-master-j76s9
+k logs kube-bench-j76s9
 [INFO] 1 Master Node Security Configuration
 [INFO] 1.1 API Server
 ...
 ```

+You can still force to run specific master or node checks using respectively `job-master.yaml` and `job-node.yaml`.
+
+To run the tests on the master node, the pod needs to be scheduled on that node. This involves setting a nodeSelector and tolerations in the pod spec.
+
 The default labels applied to master nodes has changed since Kubernetes 1.11, so if you are using an older version you may need to modify the nodeSelector and tolerations to run the job on the master node.

 ### Installing from a container
@@ -77,7 +82,7 @@ This command copies the kube-bench binary and configuration files to your host f
 docker run --rm -v `pwd`:/host aquasec/kube-bench:latest install
 ```

-You can then run `./kube-bench <master|node>`.
+You can then run `./kube-bench [master|node]`.

 ### Installing from sources

@@ -93,8 +98,8 @@ go build -o kube-bench .
 # See all supported options
 ./kube-bench --help

-# Run the all checks on a master node
-./kube-bench master
+# Run the all checks
+./kube-bench

 ```

@@ -170,3 +175,17 @@ These operations are:
 Going forward we plan to release updates to kube-bench to add support for new releases of the Benchmark, which in turn we can anticipate being made for each new Kubernetes release.

 We welcome PRs and issue reports.
+
+# Testing locally with kind
+
+Our makefile contains targets to test your current version of kube-bench inside a [Kind](https://kind.sigs.k8s.io/) cluster. This can be very handy if you don't want to run a real kubernetes cluster for development purpose.
+
+First you'll need to create the cluster using `make kind-test-cluster` this will create a new cluster if it cannot be found on your machine. By default the cluster is named `kube-bench` but you can change the name by using the environment variable `KIND_PROFILE`.
+
+*If kind cannot be found on your system the target will try to install it using `go get`*
+
+Next you'll have to build the kube-bench docker image using `make build-docker`, then we will be able to push the docker image to the cluster using `make kind-push`.
+
+Finally we can use the `make kind-run` target to run the current version of kube-bench in the cluster and follow the logs of pods created. (Ctrl+C to exit)
+
+Everytime you want to test a change, you'll need to rebuild the docker image and push it to cluster before running it again. ( `make build-docker kind-push kind-run` )
--- a/cfg/1.11/node.yaml
+++ b/cfg/1.11/node.yaml
@@ -10,7 +10,7 @@ groups:
  checks:
  - id: 2.1.1
    text: "Ensure that the --allow-privileged argument is set to false (Scored)"
-    audit: "ps -ef | grep $kubeletbin | grep -v grep"
+    audit: "ps -fC $kubeletbin"
    tests:
      test_items:
      - flag: "--allow-privileged"
@@ -19,7 +19,7 @@ groups:
          value: false
        set: true
    remediation: |
-      Edit the kubelet service file $kubeletconf
+      Edit the kubelet service file $kubeletsvc
      on each worker node and set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable.
      --allow-privileged=false
      Based on your system, restart the kubelet service. For example:
@@ -29,7 +29,7 @@ groups:

  - id: 2.1.2
    text: "Ensure that the --anonymous-auth argument is set to false (Scored)"
-    audit: "ps -ef | grep $kubeletbin | grep -v grep"
+    audit: "ps -fC $kubeletbin"
    tests:
      test_items:
      - flag: "--anonymous-auth"
@@ -41,7 +41,7 @@ groups:
      If using a Kubelet config file, edit the file to set authentication: anonymous: enabled to
      false .
      If using executable arguments, edit the kubelet service file
-      $kubeletconf on each worker node and
+      $kubeletsvc on each worker node and
      set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable.
      --anonymous-auth=false
      Based on your system, restart the kubelet service. For example:
@@ -51,7 +51,7 @@ groups:

  - id: 2.1.3
    text: "Ensure that the --authorization-mode argument is not set to AlwaysAllow (Scored)"
-    audit: "ps -ef | grep $kubeletbin | grep -v grep"
+    audit: "ps -fC $kubeletbin"
    tests:
      test_items:
      - flag: "--authorization-mode"
@@ -62,7 +62,7 @@ groups:
    remediation: |
      If using a Kubelet config file, edit the file to set authorization: mode to Webhook.
      If using executable arguments, edit the kubelet service file
-      $kubeletconf on each worker node and
+      $kubeletsvc on each worker node and
      set the below parameter in KUBELET_AUTHZ_ARGS variable.
      --authorization-mode=Webhook
      Based on your system, restart the kubelet service. For example:
@@ -72,7 +72,7 @@ groups:

  - id: 2.1.4
    text: "Ensure that the --client-ca-file argument is set as appropriate (Scored)"
-    audit: "ps -ef | grep $kubeletbin | grep -v grep"
+    audit: "ps -fC $kubeletbin"
    tests:
      test_items:
      - flag: "--client-ca-file"
@@ -81,7 +81,7 @@ groups:
      If using a Kubelet config file, edit the file to set authentication: x509: clientCAFile to
      the location of the client CA file.
      If using command line arguments, edit the kubelet service file
-      $kubeletconf on each worker node and
+      $kubeletsvc on each worker node and
      set the below parameter in KUBELET_AUTHZ_ARGS variable.
      --client-ca-file=<path/to/client-ca-file>
      Based on your system, restart the kubelet service. For example:
@@ -91,7 +91,7 @@ groups:

  - id: 2.1.5
    text: "Ensure that the --read-only-port argument is set to 0 (Scored)"
-    audit: "ps -ef | grep $kubeletbin | grep -v grep"
+    audit: "ps -fC $kubeletbin"
    tests:
      test_items:
      - flag: "--read-only-port"
@@ -102,7 +102,7 @@ groups:
    remediation: |
      If using a Kubelet config file, edit the file to set readOnlyPort to 0 .
      If using command line arguments, edit the kubelet service file
-      $kubeletconf on each worker node and
+      $kubeletsvc on each worker node and
      set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable.
      --read-only-port=0
      Based on your system, restart the kubelet service. For example:
@@ -112,7 +112,7 @@ groups:

  - id: 2.1.6
    text: "Ensure that the --streaming-connection-idle-timeout argument is not set to 0 (Scored)"
-    audit: "ps -ef | grep $kubeletbin | grep -v grep"
+    audit: "ps -fC $kubeletbin"
    tests:
      test_items:
      - flag: "--streaming-connection-idle-timeout"
@@ -124,7 +124,7 @@ groups:
      If using a Kubelet config file, edit the file to set streamingConnectionIdleTimeout to a
      value other than 0.
      If using command line arguments, edit the kubelet service file
-      $kubeletconf on each worker node and
+      $kubeletsvc on each worker node and
      set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable.
      --streaming-connection-idle-timeout=5m
      Based on your system, restart the kubelet service. For example:
@@ -134,7 +134,7 @@ groups:

  - id: 2.1.7
    text: "Ensure that the --protect-kernel-defaults argument is set to true (Scored)"
-    audit: "ps -ef | grep $kubeletbin | grep -v grep"
+    audit: "ps -fC $kubeletbin"
    tests:
      test_items:
      - flag: "--protect-kernel-defaults"
@@ -145,7 +145,7 @@ groups:
    remediation: |
      If using a Kubelet config file, edit the file to set protectKernelDefaults: true .
      If using command line arguments, edit the kubelet service file
-      $kubeletconf on each worker node and
+      $kubeletsvc on each worker node and
      set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable.
      --protect-kernel-defaults=true
      Based on your system, restart the kubelet service. For example:
@@ -155,7 +155,7 @@ groups:

  - id: 2.1.8
    text: "Ensure that the --make-iptables-util-chains argument is set to true (Scored)"
-    audit: "ps -ef | grep $kubeletbin | grep -v grep"
+    audit: "ps -fC $kubeletbin"
    tests:
      bin_op: or
      test_items:
@@ -169,7 +169,7 @@ groups:
    remediation: |
      If using a Kubelet config file, edit the file to set makeIPTablesUtilChains: true .
      If using command line arguments, edit the kubelet service file
-      $kubeletconf on each worker node and
+      $kubeletsvc on each worker node and
      remove the --make-iptables-util-chains argument from the
      KUBELET_SYSTEM_PODS_ARGS variable.
      Based on your system, restart the kubelet service. For example:
@@ -179,13 +179,13 @@ groups:

  - id: 2.1.9
    text: "Ensure that the --hostname-override argument is not set (Scored)"
-    audit: "ps -ef | grep $kubeletbin | grep -v grep"
+    audit: "ps -fC $kubeletbin"
    tests:
      test_items:
      - flag: "--hostname-override"
        set: false
    remediation: |
-      Edit the kubelet service file $kubeletconf
+      Edit the kubelet service file $kubeletsvc
      on each worker node and remove the --hostname-override argument from the
      KUBELET_SYSTEM_PODS_ARGS variable.
      Based on your system, restart the kubelet service. For example:
@@ -195,7 +195,7 @@ groups:

  - id: 2.1.10
    text: "Ensure that the --event-qps argument is set to 0 (Scored)"
-    audit: "ps -ef | grep $kubeletbin | grep -v grep"
+    audit: "ps -fC $kubeletbin"
    tests:
      test_items:
      - flag: "--event-qps"
@@ -206,7 +206,7 @@ groups:
    remediation: |
      If using a Kubelet config file, edit the file to set eventRecordQPS: 0 .
      If using command line arguments, edit the kubelet service file
-      $kubeletconf on each worker node and
+      $kubeletsvc on each worker node and
      set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable.
      --event-qps=0
      Based on your system, restart the kubelet service. For example:
@@ -216,7 +216,7 @@ groups:

  - id: 2.1.11
    text: "Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate (Scored)"
-    audit: "ps -ef | grep $kubeletbin | grep -v grep"
+    audit: "ps -fC $kubeletbin"
    tests:
      bin_op: and
      test_items:
@@ -229,7 +229,7 @@ groups:
      file to use to identify this Kubelet, and tlsPrivateKeyFile to the location of the
      corresponding private key file.
      If using command line arguments, edit the kubelet service file
-      $kubeletconf on each worker node and
+      $kubeletsvc on each worker node and
      set the below parameters in KUBELET_CERTIFICATE_ARGS variable.
      --tls-cert-file=<path/to/tls-certificate-file>
      file=<path/to/tls-key-file>
@@ -240,7 +240,7 @@ groups:

  - id: 2.1.12
    text: "Ensure that the --cadvisor-port argument is set to 0 (Scored)"
-    audit: "ps -ef | grep $kubeletbin | grep -v grep"
+    audit: "ps -fC $kubeletbin"
    tests:
      bin_op: or
      test_items:
@@ -252,7 +252,7 @@ groups:
      - flag: "--cadvisor-port"
        set: false
    remediation: |
-      Edit the kubelet service file $kubeletconf
+      Edit the kubelet service file $kubeletsvc
      on each worker node and set the below parameter in KUBELET_CADVISOR_ARGS variable.
      --cadvisor-port=0
      Based on your system, restart the kubelet service. For example:
@@ -262,7 +262,7 @@ groups:

  - id: 2.1.13
    text: "Ensure that the --rotate-certificates argument is not set to false (Scored)"
-    audit: "ps -ef | grep $kubeletbin | grep -v grep"
+    audit: "ps -fC $kubeletbin"
    tests:
      test_items:
      - flag: "--rotate-certificates"
@@ -272,7 +272,7 @@ groups:
        set: true
    remediation: |
      If using a Kubelet config file, edit the file to add the line rotateCertificates: true.
-      If using command line arguments, edit the kubelet service file $kubeletconf 
+      If using command line arguments, edit the kubelet service file $kubeletsvc 
      on each worker node and add --rotate-certificates=true argument to the KUBELET_CERTIFICATE_ARGS variable.
      Based on your system, restart the kubelet service. For example:
      systemctl daemon-reload
@@ -281,7 +281,7 @@ groups:

  - id: 2.1.14
    text: "Ensure that the RotateKubeletServerCertificate argument is set to true (Scored)"
-    audit: "ps -ef | grep $kubeletbin | grep -v grep"
+    audit: "ps -fC $kubeletbin"
    tests:
      test_items:
      - flag: "RotateKubeletServerCertificate"
@@ -290,7 +290,7 @@ groups:
          value: true
        set: true
    remediation: |
-      Edit the kubelet service file $kubeletconf
+      Edit the kubelet service file $kubeletsvc
      on each worker node and set the below parameter in KUBELET_CERTIFICATE_ARGS variable.
      --feature-gates=RotateKubeletServerCertificate=true
      Based on your system, restart the kubelet service. For example:
@@ -300,7 +300,7 @@ groups:

  - id: 2.1.15
    text: "Ensure that the Kubelet only makes use of Strong Cryptographic Ciphers (Not Scored)"
-    audit: "ps -ef | grep $kubeletbin | grep -v grep"
+    audit: "ps -fC $kubeletbin"
    tests:
      test_items:
      - flag: "--tls-cipher-suites"
@@ -320,7 +320,7 @@ groups:
    - id: 2.2.1
      text: "Ensure that the kubelet.conf file permissions are set to 644 or
      more restrictive (Scored)"
-      audit: "/bin/sh -c 'if test -e $kubeletconf; then stat -c %a $kubeletconf; fi'"
+      audit: "/bin/sh -c 'if test -e $kubeletkubeconfig; then stat -c %a $kubeletkubeconfig; fi'"
      tests:
        bin_op: or
        test_items:
@@ -342,12 +342,12 @@ groups:
      remediation: |
        Run the below command (based on the file location on your system) on the each worker
        node. For example,
-        chmod 644 $kubeletconf
+        chmod 644 $kubeletkubeconfig
      scored: true

    - id: 2.2.2
      text: "Ensure that the kubelet.conf file ownership is set to root:root (Scored)"
-      audit: "/bin/sh -c 'if test -e $kubeletconf; then stat -c %U:%G $kubeletconf; fi'"
+      audit: "/bin/sh -c 'if test -e $kubeletkubeconfig; then stat -c %U:%G $kubeletkubeconfig; fi'"
      tests:
        test_items:
          - flag: "root:root"
@@ -358,7 +358,7 @@ groups:
      remediation: |
        Run the below command (based on the file location on your system) on the each worker
        node. For example,
-        chown root:root $kubeletconf
+        chown root:root $kubeletkubeconfig
      scored: true

    - id: 2.2.3
@@ -404,7 +404,7 @@ groups:

    - id: 2.2.5
      text: "Ensure that the proxy kubeconfig file permissions are set to 644 or more restrictive (Scored)"
-      audit: "/bin/sh -c 'if test -e $proxyconf; then stat -c %a $proxyconf; fi'"
+      audit: "/bin/sh -c 'if test -e $proxykubeconfig; then stat -c %a $proxykubeconfig; fi'"
      tests:
        bin_op: or
        test_items:
@@ -426,12 +426,12 @@ groups:
      remediation: |
        Run the below command (based on the file location on your system) on the each worker
        node. For example,
-        chmod 644 $proxyconf
+        chmod 644 $proxykubeconfig
      scored: true

    - id: 2.2.6
      text: "Ensure that the proxy kubeconfig file ownership is set to root:root (Scored)"
-      audit: "/bin/sh -c 'if test -e $proxyconf; then stat -c %U:%G $proxyconf; fi'"
+      audit: "/bin/sh -c 'if test -e $proxykubeconfig; then stat -c %U:%G $proxykubeconfig; fi'"
      tests:
        test_items:
        - flag: "root:root"
@@ -439,7 +439,7 @@ groups:
      remediation: |
          Run the below command (based on the file location on your system) on the each worker
          node. For example,
-          chown root:root $proxyconf
+          chown root:root $proxykubeconfig
      scored: true

    - id: 2.2.7
@@ -462,19 +462,19 @@ groups:

    - id: 2.2.9
      text: "Ensure that the kubelet configuration file ownership is set to root:root (Scored)"
-      audit: "/bin/sh -c 'if test -e /var/lib/kubelet/config.yaml; then stat -c %U:%G /var/lib/kubelet/config.yaml; fi'"
+      audit: "/bin/sh -c 'if test -e $kubeletconf; then stat -c %U:%G $kubeletconf; fi'"
      tests:
        test_items:
        - flag: "root:root"
          set: true
      remediation: |
        Run the following command (using the config file location identied in the Audit step)
-        chown root:root /etc/kubernetes/kubelet.conf
+        chown root:root $kubeletconf
      scored: true

    - id: 2.2.10
      text: "Ensure that the kubelet configuration file has permissions set to 644 or more restrictive (Scored)"
-      audit: "/bin/sh -c 'if test -e /var/lib/kubelet/config.yaml; then stat -c %a /var/lib/kubelet/config.yaml; fi'"
+      audit: "/bin/sh -c 'if test -e $kubeletconf; then stat -c %a $kubeletconf; fi'"
      tests:
        bin_op: or
        test_items:
@@ -495,5 +495,5 @@ groups:
          set: true
      remediation: |
        Run the following command (using the config file location identied in the Audit step)
-        chmod 644 /var/lib/kubelet/config.yaml
+        chmod 644 $kubeletconf
      scored: true
--- a/cfg/1.13/config.yaml
+++ b/cfg/1.13/config.yaml
@@ -0,0 +1,29 @@
+---
+## Controls Files.
+# These are YAML files that hold all the details for running checks.
+#
+## Uncomment to use different control file paths.
+# masterControls: ./cfg/master.yaml
+# nodeControls: ./cfg/node.yaml
+# federatedControls: ./cfg/federated.yaml
+
+master:
+  apiserver:
+    defaultconf: /etc/kubernetes/manifests/kube-apiserver.yaml
+
+  scheduler:
+    defaultconf: /etc/kubernetes/manifests/kube-scheduler.yaml
+
+  controllermanager:
+    defaultconf: /etc/kubernetes/manifests/kube-controller-manager.yaml
+
+  etcd:
+    defaultconf: /etc/kubernetes/manifests/etcd.yaml
+
+node:
+  kubelet:
+    defaultconf: /etc/kubernetes/kubelet.conf
+    defaultsvc: /etc/systemd/system/kubelet.service.d/10-kubeadm.conf
+
+  proxy:
+    defaultconf: /etc/kubernetes/addons/kube-proxy-daemonset.yaml
--- a/cfg/1.13/master.yaml
+++ b/cfg/1.13/master.yaml
--- a/cfg/1.13/node.yaml
+++ b/cfg/1.13/node.yaml
@@ -0,0 +1,480 @@
+---
+controls:
+version: 1.13
+id: 2
+text: "Worker Node Security Configuration"
+type: "node"
+groups:
+- id: 2.1
+  text: "Kubelet"
+  checks:
+  - id: 2.1.1
+    text: "Ensure that the --anonymous-auth argument is set to false (Scored)"
+    audit: "ps -fC $kubeletbin"
+    tests:
+      test_items:
+      - flag: "--anonymous-auth"
+        compare:
+          op: eq
+          value: false
+        set: true
+    remediation: |
+      If using a Kubelet config file, edit the file to set authentication: anonymous: enabled to
+      false .
+      If using executable arguments, edit the kubelet service file
+      $kubeletconf on each worker node and
+      set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable.
+      --anonymous-auth=false
+      Based on your system, restart the kubelet service. For example:
+      systemctl daemon-reload
+      systemctl restart kubelet.service
+    scored: true
+
+  - id: 2.1.2
+    text: "Ensure that the --authorization-mode argument is not set to AlwaysAllow (Scored)"
+    audit: "ps -fC $kubeletbin"
+    tests:
+      test_items:
+      - flag: "--authorization-mode"
+        compare:
+          op: nothave
+          value: "AlwaysAllow"
+        set: true
+    remediation: |
+      If using a Kubelet config file, edit the file to set authorization: mode to Webhook.
+      If using executable arguments, edit the kubelet service file
+      $kubeletsvc on each worker node and
+      set the below parameter in KUBELET_AUTHZ_ARGS variable.
+      --authorization-mode=Webhook
+      Based on your system, restart the kubelet service. For example:
+      systemctl daemon-reload
+      systemctl restart kubelet.service
+    scored: true
+
+  - id: 2.1.3
+    text: "Ensure that the --client-ca-file argument is set as appropriate (Scored)"
+    audit: "ps -fC $kubeletbin"
+    tests:
+      test_items:
+      - flag: "--client-ca-file"
+        set: true
+    remediation: |
+      If using a Kubelet config file, edit the file to set authentication: x509: clientCAFile to
+      the location of the client CA file.
+      If using command line arguments, edit the kubelet service file
+      $kubeletsvc on each worker node and
+      set the below parameter in KUBELET_AUTHZ_ARGS variable.
+      --client-ca-file=<path/to/client-ca-file>
+      Based on your system, restart the kubelet service. For example:
+      systemctl daemon-reload
+      systemctl restart kubelet.service
+    scored: true
+
+  - id: 2.1.4
+    text: "Ensure that the --read-only-port argument is set to 0 (Scored)"
+    audit: "ps -fC $kubeletbin"
+    tests:
+      test_items:
+      - flag: "--read-only-port"
+        compare:
+          op: eq
+          value: 0
+        set: true
+    remediation: |
+      If using a Kubelet config file, edit the file to set readOnlyPort to 0 .
+      If using command line arguments, edit the kubelet service file
+      $kubeletsvc on each worker node and
+      set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable.
+      --read-only-port=0
+      Based on your system, restart the kubelet service. For example:
+      systemctl daemon-reload
+      systemctl restart kubelet.service
+    scored: true
+
+  - id: 2.1.5
+    text: "Ensure that the --streaming-connection-idle-timeout argument is not set to 0 (Scored)"
+    audit: "ps -fC $kubeletbin"
+    tests:
+      test_items:
+      - flag: "--streaming-connection-idle-timeout"
+        compare:
+          op: noteq
+          value: 0
+        set: true
+    remediation: |
+      If using a Kubelet config file, edit the file to set streamingConnectionIdleTimeout to a
+      value other than 0.
+      If using command line arguments, edit the kubelet service file
+      $kubeletsvc on each worker node and
+      set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable.
+      --streaming-connection-idle-timeout=5m
+      Based on your system, restart the kubelet service. For example:
+      systemctl daemon-reload
+      systemctl restart kubelet.service
+    scored: true
+
+  - id: 2.1.6
+    text: "Ensure that the --protect-kernel-defaults argument is set to true (Scored)"
+    audit: "ps -fC $kubeletbin"
+    tests:
+      test_items:
+      - flag: "--protect-kernel-defaults"
+        compare:
+          op: eq
+          value: true
+        set: true
+    remediation: |
+      If using a Kubelet config file, edit the file to set protectKernelDefaults: true .
+      If using command line arguments, edit the kubelet service file
+      $kubeletsvc on each worker node and
+      set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable.
+      --protect-kernel-defaults=true
+      Based on your system, restart the kubelet service. For example:
+      systemctl daemon-reload
+      systemctl restart kubelet.service
+    scored: true
+
+  - id: 2.1.7
+    text: "Ensure that the --make-iptables-util-chains argument is set to true (Scored)"
+    audit: "ps -fC $kubeletbin"
+    tests:
+      bin_op: or
+      test_items:
+      - flag: "--make-iptables-util-chains"
+        compare:
+          op: eq
+          value: true
+        set: true
+      - flag: "--make-iptables-util-chains"
+        set: false
+    remediation: |
+      If using a Kubelet config file, edit the file to set makeIPTablesUtilChains: true .
+      If using command line arguments, edit the kubelet service file
+      $kubeletsvc on each worker node and
+      remove the --make-iptables-util-chains argument from the
+      KUBELET_SYSTEM_PODS_ARGS variable.
+      Based on your system, restart the kubelet service. For example:
+      systemctl daemon-reload
+      systemctl restart kubelet.service
+    scored: true
+
+  - id: 2.1.8
+    text: "Ensure that the --hostname-override argument is not set (Scored)"
+    audit: "ps -fC $kubeletbin"
+    tests:
+      test_items:
+      - flag: "--hostname-override"
+        set: false
+    remediation: |
+      Edit the kubelet service file $kubeletsvc
+      on each worker node and remove the --hostname-override argument from the
+      KUBELET_SYSTEM_PODS_ARGS variable.
+      Based on your system, restart the kubelet service. For example:
+      systemctl daemon-reload
+      systemctl restart kubelet.service
+    scored: true
+
+  - id: 2.1.9
+    text: "Ensure that the --event-qps argument is set to 0 (Scored)"
+    audit: "ps -fC $kubeletbin"
+    tests:
+      test_items:
+      - flag: "--event-qps"
+        compare:
+          op: eq
+          value: 0
+        set: true
+    remediation: |
+      If using a Kubelet config file, edit the file to set eventRecordQPS: 0 .
+      If using command line arguments, edit the kubelet service file
+      $kubeletsvc on each worker node and
+      set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable.
+      --event-qps=0
+      Based on your system, restart the kubelet service. For example:
+      systemctl daemon-reload
+      systemctl restart kubelet.service
+    scored: true
+
+  - id: 2.1.10
+    text: "Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate (Scored)"
+    audit: "ps -fC $kubeletbin"
+    tests:
+      bin_op: and
+      test_items:
+      - flag: "--tls-cert-file"
+        set: true
+      - flag: "--tls-private-key-file"
+        set: true
+    remediation: |
+      If using a Kubelet config file, edit the file to set tlsCertFile to the location of the certificate
+      file to use to identify this Kubelet, and tlsPrivateKeyFile to the location of the
+      corresponding private key file.
+      If using command line arguments, edit the kubelet service file
+      $kubeletsvc on each worker node and
+      set the below parameters in KUBELET_CERTIFICATE_ARGS variable.
+      --tls-cert-file=<path/to/tls-certificate-file>
+      file=<path/to/tls-key-file>
+      Based on your system, restart the kubelet service. For example:
+      systemctl daemon-reload
+      systemctl restart kubelet.service
+    scored: true
+
+  - id: 2.1.11
+    text: "Ensure that the --cadvisor-port argument is set to 0 (Scored)"
+    audit: "ps -fC $kubeletbin"
+    tests:
+      bin_op: or
+      test_items:
+      - flag: "--cadvisor-port"
+        compare:
+          op: eq
+          value: 0
+        set: true
+      - flag: "--cadvisor-port"
+        set: false
+    remediation: |
+      Edit the kubelet service file $kubeletsvc
+      on each worker node and set the below parameter in KUBELET_CADVISOR_ARGS variable.
+      --cadvisor-port=0
+      Based on your system, restart the kubelet service. For example:
+      systemctl daemon-reload
+      systemctl restart kubelet.service
+    scored: true
+
+  - id: 2.1.12
+    text: "Ensure that the --rotate-certificates argument is not set to false (Scored)"
+    audit: "ps -fC $kubeletbin"
+    tests:
+      test_items:
+      - flag: "--rotate-certificates"
+        compare:
+          op: eq
+          value: true
+        set: true
+    remediation: |
+      If using a Kubelet config file, edit the file to add the line rotateCertificates: true.
+      If using command line arguments, edit the kubelet service file $kubeletsvc 
+      on each worker node and add --rotate-certificates=true argument to the KUBELET_CERTIFICATE_ARGS variable.
+      Based on your system, restart the kubelet service. For example:
+      systemctl daemon-reload
+      systemctl restart kubelet.service
+    scored: true
+
+  - id: 2.1.13
+    text: "Ensure that the RotateKubeletServerCertificate argument is set to true (Scored)"
+    audit: "ps -fC $kubeletbin"
+    tests:
+      test_items:
+      - flag: "RotateKubeletServerCertificate"
+        compare:
+          op: eq
+          value: true
+        set: true
+    remediation: |
+      Edit the kubelet service file $kubeletsvc
+      on each worker node and set the below parameter in KUBELET_CERTIFICATE_ARGS variable.
+      --feature-gates=RotateKubeletServerCertificate=true
+      Based on your system, restart the kubelet service. For example:
+      systemctl daemon-reload
+      systemctl restart kubelet.service
+    scored: true
+
+  - id: 2.1.14
+    text: "Ensure that the Kubelet only makes use of Strong Cryptographic Ciphers (Not Scored)"
+    audit: "ps -fC $kubeletbin"
+    tests:
+      test_items:
+      - flag: "--tls-cipher-suites"
+        compare:
+          op: eq
+          value: "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256"
+        set: true
+    remediation: |
+      If using a Kubelet config file, edit the file to set TLSCipherSuites: to TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 ,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 ,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 ,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256
+      If using executable arguments, edit the kubelet service file $kubeletconf on each worker node and set the below parameter.
+      --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256
+    scored: false
+
+- id: 2.2
+  text: "Configuration Files"
+  checks:
+    - id: 2.2.1
+      text: "Ensure that the kubelet.conf file permissions are set to 644 or
+      more restrictive (Scored)"
+      audit: "/bin/sh -c 'if test -e $kubeletkubeconfig; then stat -c %a $kubeletkubeconfig; fi'"
+      tests:
+        bin_op: or
+        test_items:
+          - flag: "644"
+            compare:
+              op: eq
+              value: "644"
+            set: true
+          - flag: "640"
+            compare:
+              op: eq
+              value: "640"
+            set: true
+          - flag: "600"
+            compare:
+              op: eq
+              value: "600"
+            set: true
+      remediation: |
+        Run the below command (based on the file location on your system) on the each worker
+        node. For example,
+        chmod 644 $kubeletkubeconfig
+      scored: true
+
+    - id: 2.2.2
+      text: "Ensure that the kubelet.conf file ownership is set to root:root (Scored)"
+      audit: "/bin/sh -c 'if test -e $kubeletkubeconfig; then stat -c %U:%G $kubeletkubeconfig; fi'"
+      tests:
+        test_items:
+          - flag: "root:root"
+            compare:
+              op: eq
+              value: root:root
+            set: true
+      remediation: |
+        Run the below command (based on the file location on your system) on the each worker
+        node. For example,
+        chown root:root $kubeletkubeconfig
+      scored: true
+
+    - id: 2.2.3
+      text: "Ensure that the kubelet service file permissions are set to 644 or
+      more restrictive (Scored)"
+      audit: "/bin/sh -c 'if test -e $kubeletsvc; then stat -c %a $kubeletsvc; fi'"
+      tests:
+        bin_op: or
+        test_items:
+        - flag: "644"
+          compare:
+            op: eq
+            value: 644
+          set: true
+        - flag: "640"
+          compare:
+            op: eq
+            value: "640"
+          set: true
+        - flag: "600"
+          compare:
+            op: eq
+            value: "600"
+          set: true
+      remediation: |
+        Run the below command (based on the file location on your system) on the each worker
+        node. For example,
+        chmod 755 $kubeletsvc
+      scored: true
+
+    - id: 2.2.4
+      text: "Ensure that the kubelet service file ownership is set to root:root (Scored)"
+      audit: "/bin/sh -c 'if test -e $kubeletsvc; then stat -c %U:%G $kubeletsvc; fi'"
+      tests:
+        test_items:
+        - flag: "root:root"
+          set: true
+      remediation: |
+        Run the below command (based on the file location on your system) on the each worker
+        node. For example,
+        chown root:root $kubeletsvc
+      scored: true
+
+    - id: 2.2.5
+      text: "Ensure that the proxy kubeconfig file permissions are set to 644 or more restrictive (Scored)"
+      audit: "/bin/sh -c 'if test -e $proxykubeconfig; then stat -c %a $proxykubeconfig; fi'"
+      tests:
+        bin_op: or
+        test_items:
+        - flag: "644"
+          compare:
+            op: eq
+            value: "644"
+          set: true
+        - flag: "640"
+          compare:
+            op: eq
+            value: "640"
+          set: true
+        - flag: "600"
+          compare:
+            op: eq
+            value: "600"
+          set: true
+      remediation: |
+        Run the below command (based on the file location on your system) on the each worker
+        node. For example,
+        chmod 644 $proxykubeconfig
+      scored: true
+
+    - id: 2.2.6
+      text: "Ensure that the proxy kubeconfig file ownership is set to root:root (Scored)"
+      audit: "/bin/sh -c 'if test -e $proxykubeconfig; then stat -c %U:%G $proxykubeconfig; fi'"
+      tests:
+        test_items:
+        - flag: "root:root"
+          set: true
+      remediation: |
+          Run the below command (based on the file location on your system) on the each worker
+          node. For example,
+          chown root:root $proxykubeconfig
+      scored: true
+
+    - id: 2.2.7
+      text: "Ensure that the certificate authorities file permissions are set to
+      644 or more restrictive (Scored)"
+      type: manual
+      remediation: |
+        Run the following command to modify the file permissions of the --client-ca-file
+        chmod 644 <filename>
+      scored: true
+
+    - id: 2.2.8
+      text: "Ensure that the client certificate authorities file ownership is set to root:root (Scored)"
+      audit: "/bin/sh -c 'if test -e $ca-file; then stat -c %U:%G $ca-file; fi'"
+      type: manual
+      remediation: |
+        Run the following command to modify the ownership of the --client-ca-file .
+        chown root:root <filename>
+      scored: true
+
+    - id: 2.2.9
+      text: "Ensure that the kubelet configuration file ownership is set to root:root (Scored)"
+      audit: "/bin/sh -c 'if test -e $kubeletconf; then stat -c %U:%G $kubeletconf; fi'"
+      tests:
+        test_items:
+        - flag: "root:root"
+          set: true
+      remediation: |
+        Run the following command (using the config file location identied in the Audit step)
+        chown root:root $kubeletconf
+      scored: true
+
+    - id: 2.2.10
+      text: "Ensure that the kubelet configuration file has permissions set to 644 or more restrictive (Scored)"
+      audit: "/bin/sh -c 'if test -e $kubeletconf; then stat -c %a $kubeletconf; fi'"
+      tests:
+        bin_op: or
+        test_items:
+        - flag: "644"
+          compare:
+            op: eq
+            value: "644"
+          set: true
+        - flag: "640"
+          compare:
+            op: eq
+            value: "640"
+          set: true
+        - flag: "600"
+          compare:
+            op: eq
+            value: "600"
+          set: true
+      remediation: |
+        Run the following command (using the config file location identied in the Audit step)
+        chmod 644 $kubeletconf
+      scored: true
--- a/cfg/1.8/config.yaml
+++ b/cfg/1.8/config.yaml
@@ -34,11 +34,9 @@ master:

 node:
  kubelet:
-    confs:
-     - /etc/systemd/system/kubelet.service.d/10-kubeadm.conf
-    defaultconf: /etc/systemd/system/kubelet.service.d/10-kubeadm.conf
+    defaultconf: /var/lib/kubelet/config.yaml
+    defaultsvc: /etc/systemd/system/kubelet.service.d/10-kubeadm.conf
+    defaultkubeconfig: /etc/kubernetes/kubelet.conf
  
  proxy:
-    confs:
-      - /etc/kubernetes/addons/kube-proxy-daemonset.yaml
    defaultconf: /etc/kubernetes/addons/kube-proxy-daemonset.yaml
--- a/cfg/1.8/node.yaml
+++ b/cfg/1.8/node.yaml
@@ -10,7 +10,7 @@ groups:
  checks:
  - id: 2.1.1
    text: "Ensure that the --allow-privileged argument is set to false (Scored)"
-    audit: "ps -ef | grep $kubeletbin | grep -v grep"
+    audit: "ps -fC $kubeletbin"
    tests:
      test_items:
      - flag: "--allow-privileged"
@@ -19,7 +19,7 @@ groups:
          value: false
        set: true
    remediation: |
-      Edit the kubelet service file $kubeletconf
+      Edit the kubelet service file $kubeletsvc
      on each worker node and set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable.
      --allow-privileged=false
      Based on your system, restart the kubelet service. For example:
@@ -29,7 +29,7 @@ groups:

  - id: 2.1.2
    text: "Ensure that the --anonymous-auth argument is set to false (Scored)"
-    audit: "ps -ef | grep $kubeletbin | grep -v grep"
+    audit: "ps -fC $kubeletbin"
    tests:
      test_items:
      - flag: "--anonymous-auth"
@@ -38,7 +38,7 @@ groups:
          value: false
        set: true
    remediation: |
-      Edit the kubelet service file $kubeletconf
+      Edit the kubelet service file $kubeletsvc
      on each worker node and set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable.
      --anonymous-auth=false
      Based on your system, restart the kubelet service. For example:
@@ -48,7 +48,7 @@ groups:

  - id: 2.1.3
    text: "Ensure that the --authorization-mode argument is not set to AlwaysAllow (Scored)"
-    audit: "ps -ef | grep $kubeletbin | grep -v grep"
+    audit: "ps -fC $kubeletbin"
    tests:
      test_items:
      - flag: "--authorization-mode"
@@ -57,7 +57,7 @@ groups:
          value: "AlwaysAllow"
        set: true
    remediation: |
-      Edit the kubelet service file $kubeletconf
+      Edit the kubelet service file $kubeletsvc
      on each worker node and set the below parameter in KUBELET_AUTHZ_ARGS variable.
      --authorization-mode=Webhook
      Based on your system, restart the kubelet service. For example:
@@ -67,13 +67,13 @@ groups:

  - id: 2.1.4
    text: "Ensure that the --client-ca-file argument is set as appropriate (Scored)"
-    audit: "ps -ef | grep $kubeletbin | grep -v grep"
+    audit: "ps -fC $kubeletbin"
    tests:
      test_items:
      - flag: "--client-ca-file"
        set: true 
    remediation: |
-      Edit the kubelet service file $kubeletconf
+      Edit the kubelet service file $kubeletsvc
      on each worker node and set the below parameter in KUBELET_AUTHZ_ARGS variable.
      --client-ca-file=<path/to/client-ca-file>
      Based on your system, restart the kubelet service. For example:
@@ -83,7 +83,7 @@ groups:

  - id: 2.1.5
    text: "Ensure that the --read-only-port argument is set to 0 (Scored)"
-    audit: "ps -ef | grep $kubeletbin | grep -v grep"
+    audit: "ps -fC $kubeletbin"
    tests:
      test_items:
      - flag: "--read-only-port"
@@ -92,7 +92,7 @@ groups:
          value: 0
        set: true 
    remediation: |
-      Edit the kubelet service file $kubeletconf
+      Edit the kubelet service file $kubeletsvc
      on each worker node and set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable.
      --read-only-port=0
      Based on your system, restart the kubelet service. For example:
@@ -102,7 +102,7 @@ groups:

  - id: 2.1.6
    text: "Ensure that the --streaming-connection-idle-timeout argument is not set to 0 (Scored)"
-    audit: "ps -ef | grep $kubeletbin | grep -v grep"
+    audit: "ps -fC $kubeletbin"
    tests:
      test_items:
      - flag: "--streaming-connection-idle-timeout"
@@ -111,7 +111,7 @@ groups:
          value: 0
        set: true
    remediation: |
-      Edit the kubelet service file $kubeletconf
+      Edit the kubelet service file $kubeletsvc
      on each worker node and set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable.
      --streaming-connection-idle-timeout=5m
      Based on your system, restart the kubelet service. For example:
@@ -121,7 +121,7 @@ groups:

  - id: 2.1.7
    text: "Ensure that the --protect-kernel-defaults argument is set to true (Scored)"
-    audit: "ps -ef | grep $kubeletbin | grep -v grep"
+    audit: "ps -fC $kubeletbin"
    tests:
      test_items:
      - flag: "--protect-kernel-defaults"
@@ -130,7 +130,7 @@ groups:
          value: true
        set: true
    remediation: |
-      Edit the kubelet service file $kubeletconf
+      Edit the kubelet service file $kubeletsvc
      on each worker node and set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable.
      --protect-kernel-defaults=true
      Based on your system, restart the kubelet service. For example:
@@ -140,7 +140,7 @@ groups:

  - id: 2.1.8
    text: "Ensure that the --make-iptables-util-chains argument is set to true (Scored)"
-    audit: "ps -ef | grep $kubeletbin | grep -v grep"
+    audit: "ps -fC $kubeletbin"
    tests:
      bin_op: or
      test_items:
@@ -150,7 +150,7 @@ groups:
          value: true
        set: true
    remediation: |
-      Edit the kubelet service file $kubeletconf
+      Edit the kubelet service file $kubeletsvc
      on each worker node and remove the --make-iptables-util-chains argument from the
      KUBELET_SYSTEM_PODS_ARGS variable.
      Based on your system, restart the kubelet service. For example:
@@ -160,7 +160,7 @@ groups:

  - id: 2.1.9
    text: "Ensure that the --keep-terminated-pod-volumes argument is set to false (Scored)"
-    audit: "ps -ef | grep $kubeletbin | grep -v grep"
+    audit: "ps -fC $kubeletbin"
    tests:
      test_items:
      - flag: "--keep-terminated-pod-volumes"
@@ -169,7 +169,7 @@ groups:
          value: false
        set: true
    remediation: |
-      Edit the kubelet service file $kubeletconf
+      Edit the kubelet service file $kubeletsvc
      on each worker node and set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable.
      --keep-terminated-pod-volumes=false
      Based on your system, restart the kubelet service. For example:
@@ -179,13 +179,13 @@ groups:

  - id: 2.1.10
    text: "Ensure that the --hostname-override argument is not set (Scored)"
-    audit: "ps -ef | grep $kubeletbin | grep -v grep"
+    audit: "ps -fC $kubeletbin"
    tests:
      test_items:
      - flag: "--hostname-override"
        set: false
    remediation: |
-      Edit the kubelet service file $kubeletconf
+      Edit the kubelet service file $kubeletsvc
      on each worker node and remove the --hostname-override argument from the
      KUBELET_SYSTEM_PODS_ARGS variable.
      Based on your system, restart the kubelet service. For example:
@@ -195,7 +195,7 @@ groups:

  - id: 2.1.11
    text: "Ensure that the --event-qps argument is set to 0 (Scored)"
-    audit: "ps -ef | grep $kubeletbin | grep -v grep"
+    audit: "ps -fC $kubeletbin"
    tests:
      test_items:
      - flag: "--event-qps"
@@ -204,7 +204,7 @@ groups:
          value: 0
        set: true
    remediation: |
-      Edit the kubelet service file $kubeletconf
+      Edit the kubelet service file $kubeletsvc
      on each worker node and set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable.
      --event-qps=0
      Based on your system, restart the kubelet service. For example:
@@ -214,7 +214,7 @@ groups:

  - id: 2.1.12
    text: "Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate (Scored)"
-    audit: "ps -ef | grep $kubeletbin | grep -v grep"
+    audit: "ps -fC $kubeletbin"
    tests:
      test_items:
      - flag: "--tls-cert-file"
@@ -223,8 +223,7 @@ groups:
        set: true
    remediation: |
      Follow the Kubernetes documentation and set up the TLS connection on the Kubelet.
-      Then edit the kubelet service file /etc/systemd/system/kubelet.service.d/10-
-      kubeadm.conf on each worker node and set the below parameters in
+      Then edit the kubelet service file $kubeletsvc on each worker node and set the below parameters in
      KUBELET_CERTIFICATE_ARGS variable.
      --tls-cert-file=<path/to/tls-certificate-file>
      file=<path/to/tls-key-file>
@@ -236,7 +235,7 @@ groups:

  - id: 2.1.13
    text: "Ensure that the --cadvisor-port argument is set to 0 (Scored)"
-    audit: "ps -ef | grep $kubeletbin | grep -v grep"
+    audit: "ps -fC $kubeletbin"
    tests:
      test_items:
      - flag: "--cadvisor-port"
@@ -245,7 +244,7 @@ groups:
          value: 0
        set: true
    remediation: |
-      Edit the kubelet service file $kubeletconf
+      Edit the kubelet service file $kubeletsvc
      on each worker node and set the below parameter in KUBELET_CADVISOR_ARGS variable.
      --cadvisor-port=0
      Based on your system, restart the kubelet service. For example:
@@ -255,7 +254,7 @@ groups:

  - id: 2.1.14
    text: "Ensure that the RotateKubeletClientCertificate argument is set to true"
-    audit: "ps -ef | grep $kubeletbin | grep -v grep"
+    audit: "ps -fC $kubeletbin"
    tests:
      test_items:
      - flag: "RotateKubeletClientCertificate"
@@ -264,7 +263,7 @@ groups:
          value: true
        set: true
    remediation: |
-      Edit the kubelet service file $kubeletconf
+      Edit the kubelet service file $kubeletsvc
      on each worker node and remove the --feature-
      gates=RotateKubeletClientCertificate=false argument from the
      KUBELET_CERTIFICATE_ARGS variable.
@@ -275,7 +274,7 @@ groups:

  - id: 2.1.15
    text: "Ensure that the RotateKubeletServerCertificate argument is set to true"
-    audit: "ps -ef | grep $kubeletbin | grep -v grep"
+    audit: "ps -fC $kubeletbin"
    tests:
      test_items:
      - flag: "RotateKubeletServerCertificate"
@@ -284,7 +283,7 @@ groups:
          value: true
        set: true
    remediation: |
-      Edit the kubelet service file $kubeletconf
+      Edit the kubelet service file $kubeletsvc
      on each worker node and set the below parameter in KUBELET_CERTIFICATE_ARGS variable.
      --feature-gates=RotateKubeletServerCertificate=true
      Based on your system, restart the kubelet service. For example:
@@ -298,7 +297,7 @@ groups:
    - id: 2.2.1
      text: "Ensure that the kubelet.conf file permissions are set to 644 or
      more restrictive (Scored)"
-      audit: "/bin/sh -c 'if test -e $kubeletconf; then stat -c %a $kubeletconf; fi'"
+      audit: "/bin/sh -c 'if test -e $kubeletkubeconfig; then stat -c %a $kubeletkubeconfig; fi'"
      tests:
        bin_op: or
        test_items:
@@ -320,12 +319,12 @@ groups:
      remediation: |
        Run the below command (based on the file location on your system) on the each worker
        node. For example,
-        chmod 644 $kubeletconf
+        chmod 644 $kubeletkubeconfig
      scored: true

    - id: 2.2.2
      text: "Ensure that the kubelet.conf file ownership is set to root:root (Scored)"
-      audit: "/bin/sh -c 'if test -e $kubeletconf; then stat -c %U:%G $kubeletconf; fi'"
+      audit: "/bin/sh -c 'if test -e $kubeletkubeconfig; then stat -c %U:%G $kubeletkubeconfig; fi'"
      tests:
        test_items:
          - flag: "root:root"
@@ -336,13 +335,13 @@ groups:
      remediation: |
        Run the below command (based on the file location on your system) on the each worker
        node. For example,
-        chown root:root /etc/kubernetes/kubelet.conf
+        chown root:root $kubeletkubeconfig
      scored: true

    - id: 2.2.3
      text: "Ensure that the kubelet service file permissions are set to 644 or
      more restrictive (Scored)"
-      audit: "/bin/sh -c 'if test -e $kubeletconf; then stat -c %a $kubeletconf; fi'"
+      audit: "/bin/sh -c 'if test -e $kubeletsvc; then stat -c %a $kubeletsvc; fi'"
      tests:
        bin_op: or
        test_items:
@@ -364,12 +363,12 @@ groups:
      remediation: |
        Run the below command (based on the file location on your system) on the each worker
        node. For example,
-        chmod 755 $kubeletconf
+        chmod 755 $kubeletsvc
      scored: true

    - id: 2.2.4
      text: "2.2.4 Ensure that the kubelet service file ownership is set to root:root (Scored)"
-      audit: "/bin/sh -c 'if test -e $kubeletconf; then stat -c %U:%G $kubeletconf; fi'"
+      audit: "/bin/sh -c 'if test -e $kubeletsvc; then stat -c %U:%G $kubeletsvc; fi'"
      tests:
        test_items:
        - flag: "root:root"
@@ -377,13 +376,13 @@ groups:
      remediation: |
        Run the below command (based on the file location on your system) on the each worker
        node. For example,
-        chown root:root $kubeletconf
+        chown root:root $kubeletsvc
      scored: true

    - id: 2.2.5
      text: "Ensure that the proxy kubeconfig file permissions are set to 644 or more
      restrictive (Scored)"
-      audit: "/bin/sh -c 'if test -e $proxyconf; then stat -c %a $proxyconf; fi'"
+      audit: "/bin/sh -c 'if test -e $proxykubeconfig; then stat -c %a $proxykubeconfig; fi'"
      tests:
        bin_op: or
        test_items:
@@ -405,12 +404,12 @@ groups:
      remediation: |
        Run the below command (based on the file location on your system) on the each worker
        node. For example,
-        chmod 644 $proxyconf
+        chmod 644 $proxykubeconfig
      scored: true

    - id: 2.2.6
      text: "Ensure that the proxy kubeconfig file ownership is set to root:root (Scored)"
-      audit: "/bin/sh -c 'if test -e $proxyconf; then stat -c %U:%G $proxyconf; fi'"
+      audit: "/bin/sh -c 'if test -e $proxykubeconfig; then stat -c %U:%G $proxykubeconfig; fi'"
      tests:
        test_items:
        - flag: "root:root"
@@ -418,7 +417,7 @@ groups:
      remediation: |
          Run the below command (based on the file location on your system) on the each worker
          node. For example,
-          chown root:root $proxyconf
+          chown root:root $proxykubeconfig
      scored: true

    - id: 2.2.7
--- a/cfg/config.yaml
+++ b/cfg/config.yaml
@@ -24,6 +24,7 @@ master:
    bins:
      - "kube-apiserver"
      - "hyperkube apiserver"
+      - "hyperkube kube-apiserver"
      - "apiserver"
    confs:
      - /etc/kubernetes/apiserver.conf
@@ -34,6 +35,7 @@ master:
    bins:
      - "kube-scheduler"
      - "hyperkube scheduler"
+      - "hyperkube kube-scheduler"
      - "scheduler"
    confs: 
      - /etc/kubernetes/scheduler.conf
@@ -44,6 +46,7 @@ master:
    bins:
      - "kube-controller-manager"
      - "hyperkube controller-manager"
+      - "hyperkube kube-controller-manager"
      - "controller-manager"
    confs:
      - /etc/kubernetes/controller-manager.conf
@@ -78,10 +81,9 @@ node:
    bins:
      - "hyperkube kubelet"
      - "kubelet"
-    confs:
-      - /etc/kubernetes/kubelet.conf
-      - /etc/kubernetes/kubelet 
-    defaultconf: "/etc/kubernetes/kubelet.conf"
+    defaultconf: "/var/lib/kubelet/config.yaml"
+    defaultsvc: "/etc/systemd/system/kubelet.service.d/10-kubeadm.conf"
+    defaultkubeconfig: "/etc/kubernetes/kubelet.conf"

  proxy:
    bins:
@@ -89,9 +91,9 @@ node:
      - "hyperkube proxy"
      - "proxy"
    confs:
-      - /etc/kubernetes/proxy.conf
      - /etc/kubernetes/proxy
      - /etc/kubernetes/addons/kube-proxy-daemonset.yaml
+    defaultkubeconfig: "/etc/kubernetes/proxy.conf"

 federated:
  components:
--- a/cfg/ocp-3.10/config.yaml
+++ b/cfg/ocp-3.10/config.yaml
@@ -0,0 +1,22 @@
+---
+## Controls Files.
+# These are YAML files that hold all the details for running checks.
+#
+## Uncomment to use different control file paths.
+# masterControls: ./cfg/master.yaml
+# nodeControls: ./cfg/node.yaml
+# federatedControls: ./cfg/federated.yaml
+
+master:
+  apiserver:
+    bins:
+      - hypershift openshift-kube-apiserver
+
+  etcd:
+    bins:
+      - openshift start etcd
+
+node:
+  proxy:
+    bins:
+      - openshift start network
--- a/cfg/ocp-3.10/federated.yaml
+++ b/cfg/ocp-3.10/federated.yaml
@@ -0,0 +1,113 @@
+---
+controls:
+id: 3
+text: "Federated Deployments"
+type: "federated"
+groups:
+- id: 3.1
+  text: "Federated API Server"
+  checks:
+  - id: 3.1.1
+    text: "Ensure that the --anonymous-auth argument is set to false (Scored)"
+    type: "skip"
+    scored: true
+
+  - id: 3.1.2
+    text: "Ensure that the --basic-auth-file argument is not set (Scored)"
+    type: "skip"
+    scored: true
+
+  - id: 3.1.3
+    text: "Ensure that the --insecure-allow-any-token argument is not set (Scored)"
+    type: "skip"
+    scored: true
+
+  - id: 3.1.4
+    text: "Ensure that the --insecure-bind-address argument is not set (Scored)"
+    type: "skip"
+    scored: true
+
+  - id: 3.1.5
+    text: "Ensure that the --insecure-port argument is set to 0 (Scored)"
+    type: "skip"
+    scored: true
+
+  - id: 3.1.6
+    text: "Ensure that the --secure-port argument is not set to 0 (Scored)"
+    type: "skip"
+    scored: true
+
+  - id: 3.1.7
+    text: "Ensure that the --profiling argument is set to false (Scored)"
+    type: "skip"
+    scored: true
+
+  - id: 3.1.8
+    text: "Ensure that the admission control policy is not set to AlwaysAdmit (Scored)"
+    type: "skip"
+    scored: true
+
+  - id: 3.1.9
+    text: "Ensure that the admission control policy is set to NamespaceLifecycle (Scored)"
+    type: "skip"
+    scored: true
+
+  - id: 3.1.10
+    text: "Ensure that the --audit-log-path argument is set as appropriate (Scored)"
+    type: "skip"
+    scored: true
+
+  - id: 3.1.11
+    text: "Ensure that the --audit-log-maxage argument is set to 30 or as appropriate (Scored)"
+    type: "skip"
+    scored: true
+
+  - id: 3.1.12
+    text: "Ensure that the --audit-log-maxbackup argument is set to 10 or as appropriate (Scored)"
+    type: "skip"
+    scored: true
+
+  - id: 3.1.13
+    text: "Ensure that the --audit-log-maxsize argument is set to 100 or as appropriate (Scored)"
+    type: "skip"
+    scored: true
+
+  - id: 3.1.14
+    text: "Ensure that the --authorization-mode argument is not set to AlwaysAllow (Scored)"
+    type: "skip"
+    scored: true
+
+  - id: 3.1.15
+    text: "Ensure that the --token-auth-file parameter is not set (Scored)"
+    type: "skip"
+    scored: true
+
+  - id: 3.1.16
+    text: "Ensure that the --service-account-lookup argument is set to true (Scored)"
+    type: "skip"
+    scored: true
+
+  - id: 3.1.17
+    text: "Ensure that the --service-account-key-file argument is set as appropriate (Scored)"
+    type: "skip"
+    scored: true
+
+  - id: 3.1.18
+    text: "Ensure that the --etcd-certfile and --etcd-keyfile arguments are set as appropriate (Scored)"
+    type: "skip"
+    scored: true
+
+  - id: 3.1.19
+    text: "Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate (Scored)"
+    type: "skip"
+    scored: true
+
+
+- id: 3.2
+  text: "Federation Controller Manager"
+  checks:
+  - id: 3.2.1
+    text: "Ensure that the --profiling argument is set to false (Scored)"
+    type: "skip"
+    scored: true
+
--- a/cfg/ocp-3.10/master.yaml
+++ b/cfg/ocp-3.10/master.yaml
--- a/cfg/ocp-3.10/node.yaml
+++ b/cfg/ocp-3.10/node.yaml
@@ -0,0 +1,376 @@
+---
+controls:
+id: 2
+text: "Worker Node Security Configuration"
+type: "node"
+groups:
+- id: 2.1
+  text: "Kubelet"
+  checks:
+  - id: 2.1.1
+    text: "Ensure that the --allow-privileged argument is set to false (Scored)"
+    type: "skip"
+    scored: true
+
+  - id: 2.1.2
+    text: "Ensure that the --anonymous-auth argument is set to false (Scored)"
+    type: "skip"
+    scored: true
+
+  - id: 2.1.3
+    text: "Ensure that the --authorization-mode argument is not set to AlwaysAllow (Scored)"
+    audit: "grep -A1 authorization-mode /etc/origin/node/node-config.yaml"
+    tests:
+      bin_op: or
+      test_items:
+      - flag: "authorization-mode"
+        set: false
+      - flag: "authorization-mode: Webhook"
+        compare:
+          op: has
+          value: "Webhook"
+        set: true
+    remediation: |
+      Edit the Openshift node config file /etc/origin/node/node-config.yaml and remove authorization-mode under
+      kubeletArguments in /etc/origin/node/node-config.yaml or set it to "Webhook".
+    scored: true
+
+  - id: 2.1.4
+    text: "Ensure that the --client-ca-file argument is set as appropriate (Scored)"
+    audit: "grep -A1 client-ca-file /etc/origin/node/node-config.yaml"
+    tests:
+      test_items:
+      - flag: "client-ca-file"
+        set: false
+    remediation: |
+      Edit the Openshift node config file /etc/origin/node/node-config.yaml and remove any configuration returned by the following:
+      grep -A1 client-ca-file /etc/origin/node/node-config.yaml
+
+      Reset to the OpenShift default. 
+      See https://github.com/openshift/openshift-ansible/blob/release-3.10/roles/openshift_node_group/templates/node-config.yaml.j2#L65
+      The config file does not have this defined in kubeletArgument, but in PodManifestConfig.
+    scored: true
+
+  - id: 2.1.5
+    text: "Ensure that the --read-only-port argument is set to 0 (Scored)"
+    audit: "grep -A1 read-only-port /etc/origin/node/node-config.yaml"
+    tests:
+      bin_op: or
+      test_items:
+      - flag: "read-only-port"
+        set: false
+      - flag: "read-only-port: 0"
+        compare:
+          op: has
+          value: "0"
+        set: true
+    remediation: |
+      Edit the Openshift node config file /etc/origin/node/node-config.yaml and removed so that the OpenShift default is applied.
+    scored: true
+
+  - id: 2.1.6
+    text: "Ensure that the --streaming-connection-idle-timeout argument is not set to 0 (Scored)"
+    audit: "grep -A1 streaming-connection-idle-timeout /etc/origin/node/node-config.yaml"
+    tests:
+      bin_op: or
+      test_items:
+      - flag: "streaming-connection-idle-timeout"
+        set: false
+      - flag: "0"
+        set: false
+    remediation: |
+      Edit the Openshift node config file /etc/origin/node/node-config.yaml and set the streaming-connection-timeout
+      value like the following in node-config.yaml.
+      
+      kubeletArguments:
+        streaming-connection-idle-timeout:
+           - "5m"
+    scored: true
+
+  - id: 2.1.7
+    text: "Ensure that the --protect-kernel-defaults argument is set to true (Scored)"
+    type: "skip"
+    scored: true
+
+  - id: 2.1.8
+    text: "Ensure that the --make-iptables-util-chains argument is set to true (Scored)"
+    audit: "grep -A1 make-iptables-util-chains /etc/origin/node/node-config.yaml"
+    tests:
+      bin_op: or
+      test_items:
+      - flag: "make-iptables-util-chains"
+        set: false
+      - flag: "make-iptables-util-chains: true"
+        compare:
+          op: has
+          value: "true"
+        set: true
+    remediation: |
+      Edit the Openshift node config file /etc/origin/node/node-config.yaml and reset make-iptables-util-chains to the OpenShift
+      default value of true. 
+    scored: true
+
+    id: 2.1.9
+    text: "Ensure that the --keep-terminated-pod-volumeskeep-terminated-pod-volumes argument is set to false (Scored)"
+    audit: "grep -A1 keep-terminated-pod-volumes /etc/origin/node/node-config.yaml"
+    tests:
+      test_items:
+      - flag: "keep-terminated-pod-volumes: false"
+        compare:
+          op: has
+          value: "false"
+        set: true
+    remediation: |
+      Reset to the OpenShift defaults
+    scored: true
+
+  - id: 2.1.10
+    text: "Ensure that the --hostname-override argument is not set (Scored)"
+    type: "skip"
+    scored: true
+
+  - id: 2.1.11
+    text: "Ensure that the --event-qps argument is set to 0 (Scored)"
+    audit: "grep -A1 event-qps /etc/origin/node/node-config.yaml"
+    tests:
+      bin_op: or
+      test_items:
+      - flag: "event-qps"
+        set: false
+      - flag: "event-qps: 0"
+        compare:
+          op: has
+          value: "0"
+        set: true
+    remediation: |
+      Edit the Openshift node config file /etc/origin/node/node-config.yaml set the event-qps argument to 0 in
+      the kubeletArguments section of.
+    scored: true
+
+  - id: 2.1.12
+    text: "Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate (Scored)"
+    audit: "grep -A1 cert-dir /etc/origin/node/node-config.yaml"
+    tests:
+      test_items:
+      - flag: "/etc/origin/node/certificates"
+        compare:
+          op: has
+          value: "/etc/origin/node/certificates"
+        set: true
+    remediation: |
+      Reset to the OpenShift default values.
+    scored: true
+
+  - id: 2.1.13
+    text: "Ensure that the --cadvisor-port argument is set to 0 (Scored)"
+    audit: "grep -A1 cadvisor-port /etc/origin/node/node-config.yaml"
+    tests:
+      bin_op: or
+      test_items:
+      - flag: "cadvisor-port"
+        set: false
+      - flag: "cadvisor-port: 0"
+        compare:
+          op: has
+          value: "0"
+        set: true
+    remediation: |
+      Edit the Openshift node config file /etc/origin/node/node-config.yaml and remove the cadvisor-port flag 
+      if it is set in the  kubeletArguments section.
+    scored: true
+
+  - id: 2.1.14
+    text: "Ensure that the RotateKubeletClientCertificate argument is not set to false (Scored)"
+    audit: "grep -B1 RotateKubeletClientCertificate=true /etc/origin/node/node-config.yaml"
+    tests:
+      test_items:
+      - flag: "RotateKubeletClientCertificate=true"
+        compare:
+          op: has
+          value: "true"
+        set: true
+    remediation: |
+      Edit the Openshift node config file /etc/origin/node/node-config.yaml and set RotateKubeletClientCertificate to true.
+    scored: true
+
+  - id: 2.1.15
+    text: "Ensure that the RotateKubeletServerCertificate argument is set to true (Scored)"
+    audit: "grep -B1 RotateKubeletServerCertificate=true /etc/origin/node/node-config.yaml"
+    test:
+      test_items:
+      - flag: "RotateKubeletServerCertificate=true"
+        compare:
+          op: has
+          value: "true"
+        set: true
+    remediation: |
+      Edit the Openshift node config file /etc/origin/node/node-config.yaml and set RotateKubeletServerCertificate to true.
+    scored: true
+
+
+- id: 2.2
+  text: "Configuration Files"
+  checks:
+  - id: 2.2.1
+    text: "Ensure that the kubelet.conf file permissions are set to 644 or more restrictive (Scored)"
+    audit: "stat -c %a  /etc/origin/node/node.kubeconfig"
+    tests:
+      bin_op: or
+      test_items:
+        - flag: "644"
+          compare:
+            op: eq
+            value: "644"
+          set: true
+        - flag: "640"
+          compare:
+            op: eq
+            value: "640"
+          set: true
+        - flag: "600"
+          compare:
+            op: eq
+            value: "600"
+          set: true
+    remediation: |
+      Run the below command on each worker node.
+      chmod 644 /etc/origin/node/node.kubeconfig
+    scored: true
+
+  - id: 2.2.2
+    text: "Ensure that the kubelet.conf file ownership is set to root:root (Scored)"
+    audit: "stat -c %U:%G /etc/origin/node/node.kubeconfig"
+    tests:
+      test_items:
+        - flag: "root:root"
+          compare:
+            op: eq
+            value: root:root
+          set: true
+      remediation: |
+        Run the below command on each worker node.
+        chown root:root /etc/origin/node/node.kubeconfig
+      scored: true
+
+  - id: 2.2.3
+    text: "Ensure that the kubelet service file permissions are set to 644 or more restrictive (Scored)"
+    audit: "stat -c %a /etc/systemd/system/atomic-openshift-node.service"
+    tests:
+      bin_op: or
+      test_items:
+        - flag: "644"
+          compare:
+            op: eq
+            value: "644"
+          set: true
+        - flag: "640"
+          compare:
+            op: eq
+            value: "640"
+          set: true
+        - flag: "600"
+          compare:
+            op: eq
+            value: "600"
+          set: true
+    remediation: |
+      Run the below command on each worker node.
+      chmod 644 /etc/systemd/system/atomic-openshift-node.service
+    scored: true
+
+  - id: 2.2.4
+    text: "Ensure that the kubelet service file ownership is set to root:root (Scored)"
+    audit: "stat -c %U:%G /etc/systemd/system/atomic-openshift-node.service"
+    tests:
+      test_items:
+        - flag: "root:root"
+          compare:
+            op: eq
+            value: root:root
+          set: true
+      remediation: |
+        Run the below command on each worker node.
+        chown root:root /etc/systemd/system/atomic-openshift-node.service
+      scored: true
+
+  - id: 2.2.5
+    text: "Ensure that the proxy kubeconfig file permissions are set to 644 or more restrictive (Scored)"
+    audit: "stat -c %a /etc/origin/node/node.kubeconfig"
+    tests:
+      bin_op: or
+      test_items:
+        - flag: "644"
+          compare:
+            op: eq
+            value: "644"
+          set: true
+        - flag: "640"
+          compare:
+            op: eq
+            value: "640"
+          set: true
+        - flag: "600"
+          compare:
+            op: eq
+            value: "600"
+          set: true
+    remediation: |
+      Run the below command on each worker node.
+      chmod 644 /etc/origin/node/node.kubeconfig
+    scored: true
+
+  - id: 2.2.6
+    text: "Ensure that the proxy kubeconfig file ownership is set to root:root (Scored)"
+    audit: "stat -c %U:%G /etc/origin/node/node.kubeconfig"
+    tests:
+      test_items:
+        - flag: "root:root"
+          compare:
+            op: eq
+            value: root:root
+          set: true
+      remediation: |
+        Run the below command on each worker node.
+        chown root:root /etc/origin/node/node.kubeconfig
+      scored: true
+
+  - id: 2.2.7
+    text: "Ensure that the certificate authorities file permissions are set to 644 or more restrictive (Scored)"
+    audit: "stat -c %a /etc/origin/node/client-ca.crt"
+    tests:
+      bin_op: or
+      test_items:
+        - flag: "644"
+          compare:
+            op: eq
+            value: "644"
+          set: true
+        - flag: "640"
+          compare:
+            op: eq
+            value: "640"
+          set: true
+        - flag: "600"
+          compare:
+            op: eq
+            value: "600"
+          set: true
+    remediation: |
+      Run the below command on each worker node.
+      chmod 644 /etc/origin/node/client-ca.crt
+    scored: true
+
+  - id: 2.2.8
+    text: "Ensure that the client certificate authorities file ownership is set to root:root (Scored)"
+    audit: "stat -c %U:%G /etc/origin/node/client-ca.crt"
+    tests:
+      test_items:
+        - flag: "root:root"
+          compare:
+            op: eq
+            value: root:root
+          set: true
+      remediation: |
+        Run the below command on each worker node.
+        chown root:root /etc/origin/node/client-ca.crt
+      scored: true
--- a/check/check.go
+++ b/check/check.go
@@ -71,13 +71,21 @@ type Check struct {
 	TestInfo    []string    `json:"test_info"`
 	State       `json:"status"`
 	ActualValue string `json:"actual_value"`
+	Scored      bool   `json:"scored"`
 }

 // Run executes the audit commands specified in a check and outputs
 // the results.
 func (c *Check) Run() {
-	// If check type is manual, force result to WARN.
-	if c.Type == "manual" {
+
+	// If check type is skip, force result to INFO
+	if c.Type == "skip" {
+		c.State = INFO
+		return
+	}
+
+	// If check type is manual or the check is not scored, force result to WARN
+	if c.Type == "manual" || !c.Scored {
 		c.State = WARN
 		return
 	}
--- a/check/check_test.go
+++ b/check/check_test.go
@@ -0,0 +1,30 @@
+package check
+
+import (
+	"testing"
+)
+
+func TestCheck_Run(t *testing.T) {
+	type TestCase struct {
+		check    Check
+		Expected State
+	}
+
+	testCases := []TestCase{
+		{check: Check{Type: "manual"}, Expected: WARN},
+		{check: Check{Type: "skip"}, Expected: INFO},
+		{check: Check{Type: "", Scored: false}, Expected: WARN}, // Not scored checks with no type should be marked warn
+		{check: Check{Type: "", Scored: true}, Expected: WARN},  // If there are no tests in the check, warn
+		{check: Check{Type: "manual", Scored: false}, Expected: WARN},
+		{check: Check{Type: "skip", Scored: false}, Expected: INFO},
+	}
+
+	for _, testCase := range testCases {
+
+		testCase.check.Run()
+
+		if testCase.check.State != testCase.Expected {
+			t.Errorf("test failed, expected %s, actual %s\n", testCase.Expected, testCase.check.State)
+		}
+	}
+}
--- a/check/controls.go
+++ b/check/controls.go
@@ -37,6 +37,7 @@ type Group struct {
 	Pass   int      `json:"pass"`
 	Fail   int      `json:"fail"`
 	Warn   int      `json:"warn"`
+	Info   int      `json:"info"`
 	Text   string   `json:"desc"`
 	Checks []*Check `json:"results"`
 }
@@ -46,6 +47,7 @@ type Summary struct {
 	Pass int `json:"total_pass"`
 	Fail int `json:"total_fail"`
 	Warn int `json:"total_warn"`
+	Info int `json:"total_info"`
 }

 // NewControls instantiates a new master Controls object.
@@ -74,7 +76,7 @@ func NewControls(t NodeType, in []byte) (*Controls, error) {
 // RunGroup runs all checks in a group.
 func (controls *Controls) RunGroup(gids ...string) Summary {
 	g := []*Group{}
-	controls.Summary.Pass, controls.Summary.Fail, controls.Summary.Warn = 0, 0, 0
+	controls.Summary.Pass, controls.Summary.Fail, controls.Summary.Warn, controls.Info = 0, 0, 0, 0

 	// If no groupid is passed run all group checks.
 	if len(gids) == 0 {
@@ -105,7 +107,7 @@ func (controls *Controls) RunGroup(gids ...string) Summary {
 func (controls *Controls) RunChecks(ids ...string) Summary {
 	g := []*Group{}
 	m := make(map[string]*Group)
-	controls.Summary.Pass, controls.Summary.Fail, controls.Summary.Warn = 0, 0, 0
+	controls.Summary.Pass, controls.Summary.Fail, controls.Summary.Warn, controls.Info = 0, 0, 0, 0

 	// If no groupid is passed run all group checks.
 	if len(ids) == 0 {
@@ -182,6 +184,8 @@ func summarize(controls *Controls, check *Check) {
 		controls.Summary.Fail++
 	case WARN:
 		controls.Summary.Warn++
+	case INFO:
+		controls.Summary.Info++
 	}
 }

@@ -193,5 +197,7 @@ func summarizeGroup(group *Group, check *Check) {
 		group.Fail++
 	case WARN:
 		group.Warn++
+	case INFO:
+		group.Info++
 	}
 }
--- a/check/test.go
+++ b/check/test.go
@@ -144,6 +144,12 @@ type tests struct {
 func (ts *tests) execute(s string) *testOutput {
 	finalOutput := &testOutput{}

+	// If no tests are defined return with empty finalOutput.
+	// This may be the case for checks of type: "skip".
+	if ts == nil {
+		return finalOutput
+	}
+
 	res := make([]testOutput, len(ts.TestItems))
 	if len(res) == 0 {
 		return finalOutput
--- a/cmd/common.go
+++ b/cmd/common.go
@@ -31,32 +31,8 @@ var (

 func runChecks(nodetype check.NodeType) {
 	var summary check.Summary
-	var file string
-	var err error
-	var typeConf *viper.Viper

-	switch nodetype {
-	case check.MASTER:
-		file = masterFile
-	case check.NODE:
-		file = nodeFile
-	case check.FEDERATED:
-		file = federatedFile
-	}
-
-	runningVersion := ""
-	if kubeVersion == "" {
-		runningVersion, err = getKubeVersion()
-		if err != nil {
-			exitWithError(fmt.Errorf("Version check failed: %s\nAlternatively, you can specify the version with --version", err))
-		}
-	}
-	path, err := getConfigFilePath(kubeVersion, runningVersion, file)
-	if err != nil {
-		exitWithError(fmt.Errorf("can't find %s controls file in %s: %v", nodetype, cfgDir, err))
-	}
-
-	def := filepath.Join(path, file)
+	def := loadConfig(nodetype)
 	in, err := ioutil.ReadFile(def)
 	if err != nil {
 		exitWithError(fmt.Errorf("error opening %s controls file: %v", nodetype, err))
@@ -64,31 +40,25 @@ func runChecks(nodetype check.NodeType) {

 	glog.V(1).Info(fmt.Sprintf("Using benchmark file: %s\n", def))

-	// Merge kubernetes version specific config if any.
-	viper.SetConfigFile(path + "/config.yaml")
-	err = viper.MergeInConfig()
+	// Get the set of exectuables and config files we care about on this type of node.
+	typeConf := viper.Sub(string(nodetype))
+	binmap, err := getBinaries(typeConf)
+
+	// Checks that the executables we need for the node type are running.
 	if err != nil {
-		if os.IsNotExist(err) {
-			glog.V(2).Info(fmt.Sprintf("No version-specific config.yaml file in %s", path))
-		} else {
-			exitWithError(fmt.Errorf("couldn't read config file %s: %v", path+"/config.yaml", err))
-		}
-	} else {
-		glog.V(1).Info(fmt.Sprintf("Using config file: %s\n", viper.ConfigFileUsed()))
+		exitWithError(err)
 	}

-	// Get the set of exectuables and config files we care about on this type of node. This also
-	// checks that the executables we need for the node type are running.
-	typeConf = viper.Sub(string(nodetype))
-	binmap := getBinaries(typeConf)
 	confmap := getConfigFiles(typeConf)
 	svcmap := getServiceFiles(typeConf)
+	kubeconfmap := getKubeConfigFiles(typeConf)

 	// Variable substitutions. Replace all occurrences of variables in controls files.
 	s := string(in)
 	s = makeSubstitutions(s, "bin", binmap)
 	s = makeSubstitutions(s, "conf", confmap)
 	s = makeSubstitutions(s, "svc", svcmap)
+	s = makeSubstitutions(s, "kubeconfig", kubeconfmap)

 	controls, err := check.NewControls(nodetype, []byte(s))
 	if err != nil {
@@ -108,7 +78,7 @@ func runChecks(nodetype check.NodeType) {
 	}

 	// if we successfully ran some tests and it's json format, ignore the warnings
-	if (summary.Fail > 0 || summary.Warn > 0 || summary.Pass > 0) && jsonFmt {
+	if (summary.Fail > 0 || summary.Warn > 0 || summary.Pass > 0 || summary.Info > 0) && jsonFmt {
 		out, err := controls.JSON()
 		if err != nil {
 			exitWithError(fmt.Errorf("failed to output in JSON format: %v", err))
@@ -117,7 +87,7 @@ func runChecks(nodetype check.NodeType) {
 		fmt.Println(string(out))
 	} else {
 		// if we want to store in PostgreSQL, convert to JSON and save it
-		if (summary.Fail > 0 || summary.Warn > 0 || summary.Pass > 0) && pgSQL {
+		if (summary.Fail > 0 || summary.Warn > 0 || summary.Pass > 0 || summary.Info > 0) && pgSQL {
 			out, err := controls.JSON()
 			if err != nil {
 				exitWithError(fmt.Errorf("failed to output in JSON format: %v", err))
@@ -157,7 +127,7 @@ func prettyPrint(r *check.Controls, summary check.Summary) {
 			colors[check.WARN].Printf("== Remediations ==\n")
 			for _, g := range r.Groups {
 				for _, c := range g.Checks {
-					if c.State != check.PASS {
+					if c.State == check.FAIL || c.State == check.WARN {
 						fmt.Printf("%s %s\n", c.ID, c.Remediation)
 					}
 				}
@@ -178,8 +148,63 @@ func prettyPrint(r *check.Controls, summary check.Summary) {
 		}

 		colors[res].Printf("== Summary ==\n")
-		fmt.Printf("%d checks PASS\n%d checks FAIL\n%d checks WARN\n",
-			summary.Pass, summary.Fail, summary.Warn,
+		fmt.Printf("%d checks PASS\n%d checks FAIL\n%d checks WARN\n%d checks INFO\n",
+			summary.Pass, summary.Fail, summary.Warn, summary.Info,
 		)
 	}
 }
+
+// loadConfig finds the correct config dir based on the kubernetes version,
+// merges any specific config.yaml file found with the main config
+// and returns the benchmark file to use.
+func loadConfig(nodetype check.NodeType) string {
+	var file string
+	var err error
+
+	switch nodetype {
+	case check.MASTER:
+		file = masterFile
+	case check.NODE:
+		file = nodeFile
+	case check.FEDERATED:
+		file = federatedFile
+	}
+
+	runningVersion := ""
+	if kubeVersion == "" {
+		runningVersion, err = getKubeVersion()
+		if err != nil {
+			exitWithError(fmt.Errorf("Version check failed: %s\nAlternatively, you can specify the version with --version", err))
+		}
+	}
+	path, err := getConfigFilePath(kubeVersion, runningVersion, file)
+	if err != nil {
+		exitWithError(fmt.Errorf("can't find %s controls file in %s: %v", nodetype, cfgDir, err))
+	}
+
+	// Merge kubernetes version specific config if any.
+	viper.SetConfigFile(path + "/config.yaml")
+	err = viper.MergeInConfig()
+	if err != nil {
+		if os.IsNotExist(err) {
+			glog.V(2).Info(fmt.Sprintf("No version-specific config.yaml file in %s", path))
+		} else {
+			exitWithError(fmt.Errorf("couldn't read config file %s: %v", path+"/config.yaml", err))
+		}
+	} else {
+		glog.V(1).Info(fmt.Sprintf("Using config file: %s\n", viper.ConfigFileUsed()))
+	}
+	return filepath.Join(path, file)
+}
+
+// isMaster verify if master components are running on the node.
+func isMaster() bool {
+	_ = loadConfig(check.MASTER)
+	glog.V(2).Info("Checking if the current node is running master components")
+	masterConf := viper.Sub(string(check.MASTER))
+	if _, err := getBinaries(masterConf); err != nil {
+		glog.V(2).Info(err)
+		return false
+	}
+	return true
+}
--- a/cmd/root.go
+++ b/cmd/root.go
@@ -20,6 +20,7 @@ import (
 	"os"

 	"github.com/aquasecurity/kube-bench/check"
+	"github.com/golang/glog"
 	"github.com/spf13/cobra"
 	"github.com/spf13/viper"
 )
@@ -34,8 +35,8 @@ var (
 	pgSQL              bool
 	checkList          string
 	groupList          string
-	masterFile         string
-	nodeFile           string
+	masterFile         = "master.yaml"
+	nodeFile           = "node.yaml"
 	federatedFile      string
 	noResults          bool
 	noSummary          bool
@@ -47,6 +48,14 @@ var RootCmd = &cobra.Command{
 	Use:   os.Args[0],
 	Short: "Run CIS Benchmarks checks against a Kubernetes deployment",
 	Long:  `This tool runs the CIS Kubernetes Benchmark (https://www.cisecurity.org/benchmark/kubernetes/)`,
+	Run: func(cmd *cobra.Command, args []string) {
+		if isMaster() {
+			glog.V(1).Info("== Running master checks ==\n")
+			runChecks(check.MASTER)
+		}
+		glog.V(1).Info("== Running node checks ==\n")
+		runChecks(check.NODE)
+	},
 }

 // Execute adds all child commands to the root command sets flags appropriately.
--- a/cmd/util.go
+++ b/cmd/util.go
@@ -33,20 +33,6 @@ func init() {
 	statFunc = os.Stat
 }

-func printlnWarn(msg string) {
-	fmt.Fprintf(os.Stderr, "[%s] %s\n",
-		colors[check.WARN].Sprintf("%s", check.WARN),
-		msg,
-	)
-}
-
-func sprintlnWarn(msg string) string {
-	return fmt.Sprintf("[%s] %s",
-		colors[check.WARN].Sprintf("%s", check.WARN),
-		msg,
-	)
-}
-
 func exitWithError(err error) {
 	fmt.Fprintf(os.Stderr, "\n%v\n", err)
 	os.Exit(1)
@@ -86,8 +72,9 @@ func ps(proc string) string {
 	return string(out)
 }

-// getBinaries finds which of the set of candidate executables are running
-func getBinaries(v *viper.Viper) map[string]string {
+// getBinaries finds which of the set of candidate executables are running.
+// It returns an error if one mandatory executable is not running.
+func getBinaries(v *viper.Viper) (map[string]string, error) {
 	binmap := make(map[string]string)

 	for _, component := range v.GetStringSlice("components") {
@@ -101,7 +88,7 @@ func getBinaries(v *viper.Viper) map[string]string {
 		if len(bins) > 0 {
 			bin, err := findExecutable(bins)
 			if err != nil && !optional {
-				exitWithError(fmt.Errorf("need %s executable but none of the candidates are running", component))
+				return nil, fmt.Errorf("need %s executable but none of the candidates are running", component)
 			}

 			// Default the executable name that we'll substitute to the name of the component
@@ -115,7 +102,7 @@ func getBinaries(v *viper.Viper) map[string]string {
 		}
 	}

-	return binmap
+	return binmap, nil
 }

 // getConfigFilePath locates the config files we should be using based on either the specified
@@ -233,6 +220,37 @@ func getServiceFiles(v *viper.Viper) map[string]string {
 	return svcmap
 }

+// getKubeConfigFiles finds which of the set of candidate kubeconfig files exist
+func getKubeConfigFiles(v *viper.Viper) map[string]string {
+	kubeconfigmap := make(map[string]string)
+
+	for _, component := range v.GetStringSlice("components") {
+		s := v.Sub(component)
+		if s == nil {
+			continue
+		}
+
+		// See if any of the candidate config files exist
+		kubeconfig := findConfigFile(s.GetStringSlice("kubeconfig"))
+		if kubeconfig == "" {
+			if s.IsSet("defaultkubeconfig") {
+				kubeconfig = s.GetString("defaultkubeconfig")
+				glog.V(2).Info(fmt.Sprintf("Using default kubeconfig file name '%s' for component %s", kubeconfig, component))
+			} else {
+				// Default the service file name that we'll substitute to the name of the component
+				glog.V(2).Info(fmt.Sprintf("Missing service file for %s", component))
+				kubeconfig = component
+			}
+		} else {
+			glog.V(2).Info(fmt.Sprintf("Component %s uses service file '%s'", component, kubeconfig))
+		}
+
+		kubeconfigmap[component] = kubeconfig
+	}
+
+	return kubeconfigmap
+}
+
 // verifyBin checks that the binary specified is running
 func verifyBin(bin string) bool {

@@ -303,6 +321,12 @@ func getKubeVersion() (string, error) {
 	if err != nil {
 		_, err = exec.LookPath("kubelet")
 		if err != nil {
+			// Search for the kubelet binary all over the filesystem and run the first match to get the kubernetes version
+			cmd := exec.Command("/bin/sh", "-c", "`find / -type f -executable -name kubelet 2>/dev/null | grep -m1 .` --version")
+			out, err := cmd.CombinedOutput()
+			if err == nil {
+				return getVersionFromKubeletOutput(string(out)), nil
+			}
 			return "", fmt.Errorf("need kubectl or kubelet binaries to get kubernetes version")
 		}
 		return getKubeVersionFromKubelet(), nil
@@ -336,7 +360,7 @@ func getVersionFromKubectlOutput(s string) string {
 	serverVersionRe := regexp.MustCompile(`Server Version: v(\d+.\d+)`)
 	subs := serverVersionRe.FindStringSubmatch(s)
 	if len(subs) < 2 {
-		printlnWarn(fmt.Sprintf("Unable to get kubectl version, using default version: %s", defaultKubeVersion))
+		glog.V(1).Info(fmt.Sprintf("Unable to get Kubernetes version from kubectl, using default version: %s", defaultKubeVersion))
 		return defaultKubeVersion
 	}
 	return subs[1]
@@ -346,7 +370,7 @@ func getVersionFromKubeletOutput(s string) string {
 	serverVersionRe := regexp.MustCompile(`Kubernetes v(\d+.\d+)`)
 	subs := serverVersionRe.FindStringSubmatch(s)
 	if len(subs) < 2 {
-		printlnWarn(fmt.Sprintf("Unable to get kubelet version, using default version: %s", defaultKubeVersion))
+		glog.V(1).Info(fmt.Sprintf("Unable to get Kubernetes version from kubelet, using default version: %s", defaultKubeVersion))
 		return defaultKubeVersion
 	}
 	return subs[1]
--- a/cmd/util_test.go
+++ b/cmd/util_test.go
@@ -109,38 +109,51 @@ func TestFindExecutable(t *testing.T) {

 func TestGetBinaries(t *testing.T) {
 	cases := []struct {
-		config map[string]interface{}
-		psOut  string
-		exp    map[string]string
+		config    map[string]interface{}
+		psOut     string
+		exp       map[string]string
+		expectErr bool
 	}{
 		{
-			config: map[string]interface{}{"components": []string{"apiserver"}, "apiserver": map[string]interface{}{"bins": []string{"apiserver", "kube-apiserver"}}},
-			psOut:  "kube-apiserver",
-			exp:    map[string]string{"apiserver": "kube-apiserver"},
+			config:    map[string]interface{}{"components": []string{"apiserver"}, "apiserver": map[string]interface{}{"bins": []string{"apiserver", "kube-apiserver"}}},
+			psOut:     "kube-apiserver",
+			exp:       map[string]string{"apiserver": "kube-apiserver"},
+			expectErr: false,
 		},
 		{
 			// "thing" is not in the list of components
-			config: map[string]interface{}{"components": []string{"apiserver"}, "apiserver": map[string]interface{}{"bins": []string{"apiserver", "kube-apiserver"}}, "thing": map[string]interface{}{"bins": []string{"something else", "thing"}}},
-			psOut:  "kube-apiserver thing",
-			exp:    map[string]string{"apiserver": "kube-apiserver"},
+			config:    map[string]interface{}{"components": []string{"apiserver"}, "apiserver": map[string]interface{}{"bins": []string{"apiserver", "kube-apiserver"}}, "thing": map[string]interface{}{"bins": []string{"something else", "thing"}}},
+			psOut:     "kube-apiserver thing",
+			exp:       map[string]string{"apiserver": "kube-apiserver"},
+			expectErr: false,
 		},
 		{
 			// "anotherthing" in list of components but doesn't have a defintion
-			config: map[string]interface{}{"components": []string{"apiserver", "anotherthing"}, "apiserver": map[string]interface{}{"bins": []string{"apiserver", "kube-apiserver"}}, "thing": map[string]interface{}{"bins": []string{"something else", "thing"}}},
-			psOut:  "kube-apiserver thing",
-			exp:    map[string]string{"apiserver": "kube-apiserver"},
+			config:    map[string]interface{}{"components": []string{"apiserver", "anotherthing"}, "apiserver": map[string]interface{}{"bins": []string{"apiserver", "kube-apiserver"}}, "thing": map[string]interface{}{"bins": []string{"something else", "thing"}}},
+			psOut:     "kube-apiserver thing",
+			exp:       map[string]string{"apiserver": "kube-apiserver"},
+			expectErr: false,
 		},
 		{
 			// more than one component
-			config: map[string]interface{}{"components": []string{"apiserver", "thing"}, "apiserver": map[string]interface{}{"bins": []string{"apiserver", "kube-apiserver"}}, "thing": map[string]interface{}{"bins": []string{"something else", "thing"}}},
-			psOut:  "kube-apiserver \nthing",
-			exp:    map[string]string{"apiserver": "kube-apiserver", "thing": "thing"},
+			config:    map[string]interface{}{"components": []string{"apiserver", "thing"}, "apiserver": map[string]interface{}{"bins": []string{"apiserver", "kube-apiserver"}}, "thing": map[string]interface{}{"bins": []string{"something else", "thing"}}},
+			psOut:     "kube-apiserver \nthing",
+			exp:       map[string]string{"apiserver": "kube-apiserver", "thing": "thing"},
+			expectErr: false,
 		},
 		{
 			// default binary to component name
-			config: map[string]interface{}{"components": []string{"apiserver", "thing"}, "apiserver": map[string]interface{}{"bins": []string{"apiserver", "kube-apiserver"}}, "thing": map[string]interface{}{"bins": []string{"something else", "thing"}, "optional": true}},
-			psOut:  "kube-apiserver \notherthing some params",
-			exp:    map[string]string{"apiserver": "kube-apiserver", "thing": "thing"},
+			config:    map[string]interface{}{"components": []string{"apiserver", "thing"}, "apiserver": map[string]interface{}{"bins": []string{"apiserver", "kube-apiserver"}}, "thing": map[string]interface{}{"bins": []string{"something else", "thing"}, "optional": true}},
+			psOut:     "kube-apiserver \notherthing some params",
+			exp:       map[string]string{"apiserver": "kube-apiserver", "thing": "thing"},
+			expectErr: false,
+		},
+		{
+			// missing mandatory component
+			config:    map[string]interface{}{"components": []string{"apiserver", "thing"}, "apiserver": map[string]interface{}{"bins": []string{"apiserver", "kube-apiserver"}}, "thing": map[string]interface{}{"bins": []string{"something else", "thing"}, "optional": true}},
+			psOut:     "otherthing some params",
+			exp:       map[string]string{"apiserver": "kube-apiserver", "thing": "thing"},
+			expectErr: true,
 		},
 	}

@@ -153,8 +166,12 @@ func TestGetBinaries(t *testing.T) {
 			for k, val := range c.config {
 				v.Set(k, val)
 			}
-			m := getBinaries(v)
-			if !reflect.DeepEqual(m, c.exp) {
+			m, err := getBinaries(v)
+			if c.expectErr {
+				if err == nil {
+					t.Fatal("Got nil Expected error")
+				}
+			} else if !reflect.DeepEqual(m, c.exp) {
 				t.Fatalf("Got %v\nExpected %v", m, c.exp)
 			}
 		})
--- a/hack/debug.yaml
+++ b/hack/debug.yaml
@@ -0,0 +1,46 @@
+# use this pod with: kubectl run ubuntu -it --pid=host  -- /bin/bash
+# this allows you to debug what is running on the host.
+apiVersion: v1
+kind: Pod
+metadata:
+  name: ubuntu
+spec:
+  hostPID: true
+  containers:
+  - name: ubuntu
+    image: ubuntu
+    command: [ "/bin/bash", "-c", "--" ]
+    args: [ "while true; do sleep 30; done;" ]
+    volumeMounts:
+    - name: var-lib-kubelet
+      mountPath: /var/lib/kubelet
+    - name: etc-systemd
+      mountPath: /etc/systemd
+    - name: etc-kubernetes
+      mountPath: /etc/kubernetes
+      # /usr/bin is mounted to access kubectl / kubelet, for auto-detecting the Kubernetes version. 
+      # You can omit this mount if you specify --version as part of the command.           
+    - name: usr-bin
+      mountPath: /usr/bin
+    - name: kind-bin
+      mountPath: /kind/bin
+    resources:
+      limits:
+        memory: "128Mi"
+        cpu: "500m"
+  volumes:
+  - name: var-lib-kubelet
+    hostPath:
+      path: "/var/lib/kubelet"
+  - name: etc-systemd
+    hostPath:
+      path: "/etc/systemd"
+  - name: etc-kubernetes
+    hostPath:
+      path: "/etc/kubernetes"
+  - name: usr-bin
+    hostPath:
+      path: "/usr/bin"
+  - name: kind-bin
+    hostPath:
+      path: "/kind/bin"
--- a/hack/kind.yaml
+++ b/hack/kind.yaml
@@ -0,0 +1,50 @@
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: kube-bench
+spec:
+  template:
+    metadata:
+      labels:
+        app: kube-bench
+    spec:
+      hostPID: true
+      containers:
+      - name: kube-bench
+        image: aquasec/kube-bench:${VERSION}
+        command: ["kube-bench"]
+        volumeMounts:
+        - name: var-lib-etcd
+          mountPath: /var/lib/etcd
+        - name: var-lib-kubelet
+          mountPath: /var/lib/kubelet
+        - name: etc-systemd
+          mountPath: /etc/systemd
+        - name: etc-kubernetes
+          mountPath: /etc/kubernetes
+          # /usr/bin is mounted to access kubectl / kubelet, for auto-detecting the Kubernetes version. 
+          # You can omit this mount if you specify --version as part of the command.           
+        - name: usr-bin
+          mountPath: /usr/bin
+        - name: kind-bin
+          mountPath: /kind/bin
+      restartPolicy: Never
+      volumes:
+      - name: var-lib-etcd
+        hostPath:
+          path: "/var/lib/etcd"
+      - name: var-lib-kubelet
+        hostPath:
+          path: "/var/lib/kubelet"
+      - name: etc-systemd
+        hostPath:
+          path: "/etc/systemd"
+      - name: etc-kubernetes
+        hostPath:
+          path: "/etc/kubernetes"
+      - name: usr-bin
+        hostPath:
+          path: "/usr/bin"
+      - name: kind-bin
+        hostPath:
+          path: "/kind/bin"
--- a/job.yaml
+++ b/job.yaml
@@ -0,0 +1,45 @@
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: kube-bench
+spec:
+  template:
+    metadata:
+      labels:
+        app: kube-bench
+    spec:
+      hostPID: true
+      containers:
+      - name: kube-bench
+        image: aquasec/kube-bench:latest
+        command: ["kube-bench"]
+        volumeMounts:
+        - name: var-lib-etcd
+          mountPath: /var/lib/etcd
+        - name: var-lib-kubelet
+          mountPath: /var/lib/kubelet
+        - name: etc-systemd
+          mountPath: /etc/systemd
+        - name: etc-kubernetes
+          mountPath: /etc/kubernetes
+          # /usr/bin is mounted to access kubectl / kubelet, for auto-detecting the Kubernetes version. 
+          # You can omit this mount if you specify --version as part of the command.           
+        - name: usr-bin
+          mountPath: /usr/bin
+      restartPolicy: Never
+      volumes:
+      - name: var-lib-etcd
+        hostPath:
+          path: "/var/lib/etcd"
+      - name: var-lib-kubelet
+        hostPath:
+          path: "/var/lib/kubelet"
+      - name: etc-systemd
+        hostPath:
+          path: "/etc/systemd"
+      - name: etc-kubernetes
+        hostPath:
+          path: "/etc/kubernetes"
+      - name: usr-bin
+        hostPath:
+          path: "/usr/bin"
--- a/BIN
+++ b/BIN
--- a/67
+++ b/67
@@ -1,7 +1,72 @@
 SOURCES := $(shell find . -name '*.go')
-TARGET_OS := linux
 BINARY := kube-bench
+DOCKER_REGISTRY ?= aquasec
+VERSION ?= $(shell git rev-parse --short=7 HEAD)
+IMAGE_NAME ?= $(DOCKER_REGISTRY)/$(BINARY):$(VERSION)
+TARGET_OS := linux
+BUILD_OS := linux
+uname := $(shell uname -s)
+
+ifneq ($(findstring Microsoft,$(shell uname -r)),)
+	BUILD_OS := windows
+else ifeq ($(uname),Linux)
+	BUILD_OS := linux
+else ifeq ($(uname),Darwin)
+	BUILD_OS := darwin
+endif
+
+# kind cluster name to use
+KIND_PROFILE ?= kube-bench
+KIND_CONTAINER_NAME=$(KIND_PROFILE)-control-plane
+
+build: kube-bench

 $(BINARY): $(SOURCES)
 	GOOS=$(TARGET_OS) go build -o $(BINARY) .

+# builds the current dev docker version
+build-docker:
+	docker build --build-arg BUILD_DATE=$(shell date -u +"%Y-%m-%dT%H:%M:%SZ") \
+             --build-arg VCS_REF=$(shell git rev-parse --short HEAD) \
+             -t $(IMAGE_NAME) .
+
+tests:
+	go test -race -timeout 30s -cover ./cmd ./check
+
+# creates a kind cluster to be used for development.
+HAS_KIND := $(shell command -v kind;)
+kind-test-cluster:
+ifndef HAS_KIND
+	go get -u sigs.k8s.io/kind
+endif
+	@if [ -z $$(kind get clusters | grep $(KIND_PROFILE)) ]; then\
+		echo "Could not find $(KIND_PROFILE) cluster. Creating...";\
+		kind create cluster --name $(KIND_PROFILE) --image kindest/node:v1.11.3 --wait 5m;\
+	fi
+
+# pushses the current dev version to the kind cluster.
+kind-push:
+	docker save $(IMAGE_NAME) -o kube-bench.tar.gz; \
+	docker cp kube-bench.tar.gz $(KIND_CONTAINER_NAME):/kube-bench.tar.gz; \
+	docker exec $(KIND_CONTAINER_NAME) docker load -i /kube-bench.tar.gz;
+	-rm -f kube-bench.tar.gz
+
+# runs the current version on kind using a job and follow logs
+kind-run: KUBECONFIG = "$(shell kind get kubeconfig-path --name="$(KIND_PROFILE)")"
+kind-run: ensure-stern
+	sed "s/\$${VERSION}/$(VERSION)/" ./hack/kind.yaml > ./hack/kind.test.yaml
+	-KUBECONFIG=$(KUBECONFIG) \
+		kubectl delete job kube-bench 
+	KUBECONFIG=$(KUBECONFIG) \
+		kubectl apply -f ./hack/kind.test.yaml
+	KUBECONFIG=$(KUBECONFIG) \
+		stern -l app=kube-bench --container kube-bench
+
+# ensures that stern is installed
+HAS_STERN := $(shell command -v stern;)
+ensure-stern:
+ifndef HAS_STERN
+	curl -LO https://github.com/wercker/stern/releases/download/1.10.0/stern_$(BUILD_OS)_amd64 && \
+		chmod +rx ./stern_$(BUILD_OS)_amd64 && \
+    	mv ./stern_$(BUILD_OS)_amd64 /usr/local/bin/stern
+endif
Author	SHA1	Message	Date
Liz Rice	573136a700	Merge pull request #238 from Kuqd/features/autodetect-nodetype Adds master node detection - thanks @Kuqd!	2019-03-18 18:43:13 +00:00
Liz Rice	9246be924d	Merge branch 'master' into features/autodetect-nodetype	2019-03-13 20:36:19 -07:00
Cyril Tovena	5baf81a70a	Adds master node detection and a root command that automatically detect checks to run. The root command will run node checks and if possible master checks. I've also added some Makefile targets to improve local testing and improve the documentation.	2019-03-12 19:32:05 -04:00
Liz Rice	c4c0d911d4	Merge pull request #237 from aquasecurity/openshift Update openshift executable config	2019-03-07 14:53:22 +00:00
Liz Rice	9b3628e76a	Update openshift executable config for #236	2019-03-07 11:18:06 +00:00
Liz Rice	8745df170a	Merge pull request #233 from aquasecurity/clean-ocp-configs Clean up OCP benchmark config.	2019-03-07 09:30:18 +00:00
Liz Rice	1ead9e1d71	Merge branch 'master' into clean-ocp-configs	2019-03-07 09:22:47 +00:00
Liz Rice	772d2e26b4	Merge pull request #226 from aquasecurity/add-new-cfg-version1.4 add new config files from the new CIS Kubernetes Benchmark	2019-03-06 13:35:17 +00:00
Abubakr-Sadik Nii Nai Davis	53ed68a0b2	Clean up OCP benchmark config. The OCP benchmarks uses configs for only binary component variable names. This commit cleans up the OCP config by removing all configuration except those component binaries required to run kube-bench on OCP installations and adds missing ones.	2019-03-06 12:02:58 +00:00
yoavrotems	c6102f0a1b	Fix the files Fix the start from 1.11 to 1.13 and adding changes from pull #227, and pull #228.	2019-03-06 11:26:36 +00:00
yoavrotems	e534392525	Delete node.yaml replace with the new node.yaml file	2019-03-06 13:24:14 +02:00
yoavrotems	5f09ecef44	Delete master.yaml replace with the new master.yaml file	2019-03-06 13:23:49 +02:00
yoavrotems	a7d9e06c1b	Delete config.yaml replace with the new config.yaml file	2019-03-06 13:23:18 +02:00
yoavrotems	50f22e7f13	Merge branch 'master' into add-new-cfg-version1.4	2019-03-06 11:16:36 +00:00
Liz Rice	2d4019aabe	Merge pull request #228 from aquasecurity/fix-208 Fix issues with checks for kubelet configuration files	2019-03-03 11:10:05 +00:00
Liz Rice	dd8e7ec874	Merge branch 'master' into fix-208	2019-03-03 09:45:16 +00:00
Abubakr-Sadik Nii Nai Davis	d255b49d4b	Revert 1.8 config file.	2019-03-02 17:20:46 +00:00
Liz Rice	0a58805cdb	Merge pull request #227 from aquasecurity/fix-false-detections Only find flags on the process we really want	2019-02-28 10:48:23 +08:00
Liz Rice	c18d8a2234	Merge branch 'master' into fix-false-detections	2019-02-28 10:38:41 +08:00
Abubakr-Sadik Nii Nai Davis	a88b0703d8	Add kubeconfig variable substitution for kubelet and proxy. There are checks for the kubeconfig for both kubelet and proxy which the current kube-bench implementation does not check for properly. kube-bench checks the wrong files. This PR adds support for variable substitution for all the config file types are that should be checked in the CIS benchmarks. This PR also fixes a buggy in CIS 1.3.0 check 2.2.9, which checks for ownership of the kubelet config file /var/lib/kubelet/config.yaml but recommends changing ownership of kubelet kubeconfig file /etc/kubernetes/kubelet.conf as remediation.	2019-02-27 22:15:14 +00:00
Abubakr-Sadik Nii Nai Davis	3f98c1def2	Fix wrong reference to kubelet.config in node checks. This fix applies to only checks for kubernetes versions 1.8 and 1.11. See https://github.com/aquasecurity/kube-bench/pull/208.	2019-02-27 22:14:19 +00:00
Liz Rice	d712db47a2	Only find flags on the process we really want	2019-02-28 01:33:21 +08:00
yoavrotems	82150fdc63	add new config files from the new CIS Kubernetes Benchmark there is a new update at CIS_Kubernetes_Benchmark_v1.4.0 for Kubernetes 1.13	2019-02-27 10:39:32 +00:00
Liz Rice	c824daeb15	Merge pull request #222 from nshauli/search_for_kubelet_binary_when_not_in_path search for the kubelet binary when it is not in the path	2019-02-19 16:07:20 +00:00
nshauli	e93bfc1aac	search for the kubelet binary when it is not in the path	2019-02-19 16:38:10 +02:00
Liz Rice	da09e6513a	Merge pull request #218 from yoavAqua/bugfix-log-warnings-instead-of-print Bugfix: Logging warning instead of printing	2019-02-19 13:48:30 +00:00
Liz Rice	7626dc2705	Merge branch 'master' into bugfix-log-warnings-instead-of-print	2019-02-19 13:44:23 +00:00
Yoav Hizkiahou	082e9cf7e9	Bugfix: Logging warning instead of printing Made all the warnings to be logged and not printed, so when using the json flag the output will be only in json format. fix #217	2019-02-19 14:39:55 +02:00
Liz Rice	2d4c7e8b42	Merge pull request #212 from aquasecurity/ocp-configs OCP benchmarks and configs	2019-02-18 09:31:45 +00:00
Liz Rice	cd231106cc	Improve comment Tests could easily be marked "skip" because the user doesn't want to run them in their environment, and in this common case the set of tests will be non-nil	2019-02-18 08:46:26 +00:00
Liz Rice	db962a0ad9	Fix merge of skip check	2019-02-18 08:40:57 +00:00
Abubakr-Sadik Nii Nai Davis	911e9051dc	Merge remote-tracking branch 'origin/master' into ocp-configs	2019-02-15 19:48:53 +00:00
Abubakr-Sadik Nii Nai Davis	e899e941f7	Add OCP 3.10 benchmarks.	2019-02-15 19:44:39 +00:00
Weston Steimel	42ed8628de	Only get runningVersion if --version has not been provided Signed-off-by: Weston Steimel <weston.steimel@gmail.com>	2019-02-15 19:43:13 +00:00
Liz Rice	dc8dcfbf8c	Merge pull request #211 from yoavAqua/support-skip-flag Type skip and not scored checks	2019-01-29 23:14:05 +02:00
Yoav Hizkiahou	49f745af8e	Support new check type - skip: If a check is marked with type "skip", it will be marked as Info. Support scored property: If a check is not scored and is not marked with type skip, it will be marked as Warn.	2019-01-29 19:05:12 +02:00