update the yaml according (#410 )

The update is from the new cis version 1.4.1. like been done in https://github.com/aquasecurity/kube-bench/issues/370
Fixes issue #407 (#409 )
2026-02-28 08:43:50 +00:00 · 2019-09-02 16:40:45 +01:00 · 2019-08-30 17:33:14 +01:00 · 2019-08-30 15:21:41 +01:00 · 2019-08-30 15:10:30 +01:00 · 2019-08-30 12:09:11 +01:00
33 changed files with 1729 additions and 864 deletions
--- a/.gitignore
+++ b/.gitignore
@@ -4,5 +4,6 @@ vendor
 dist
 .vscode/
 hack/kind.test.yaml
+coverage.txt

-.idea/
+.idea/
--- a/.goreleaser.yml
+++ b/.goreleaser.yml
@@ -1,8 +1,9 @@
+env:
+  - GO111MODULE=on
 builds:
  - main: main.go
    binary: kube-bench
    goos:
-      - darwin
      - linux
    goarch:
      - amd64
--- a/.travis.yml
+++ b/.travis.yml
@@ -13,21 +13,28 @@ before_install:
  - sudo apt-get -qq update
  - sudo apt-get install -y rpm
  - gem install --no-ri --no-rdoc fpm
-
-install:
-  - go get -v github.com/golang/dep/cmd/dep
-  - dep ensure -v -vendor-only
+  - go get -t -v ./...

 script:
-  - go test ./...
+  - GO111MODULE=on go test ./...
  - docker build --tag kube-bench .
  - docker run -v `pwd`:/host kube-bench install 
  - test -d cfg
  - test -f kube-bench
-
+  - make tests
+  
 after_success:
-  - test -n "$TRAVIS_TAG" && curl -sL https://git.io/goreleaser | bash
+  - bash <(curl -s https://codecov.io/bash)
+deploy:
+  - provider: script
+    skip_cleanup: true
+    script: curl -sL https://git.io/goreleaser | bash
+    on:
+      tags: true
+      condition: "$TRAVIS_OS_NAME = linux"

 env:
  global:
    secure: mb8AYZKDo6hkKN+2F9ldXcw27Yn2AfxpXvKlD8GD7NdGOI+TaiSFbE0I+qqTa/1DqcRekCQwqN7OG/17s9JDkgzUXYuYUGlVUOM4WbeJoSlzJFIOh9r9R/JddluYJohypgkE20IBHIrEHq5sY0Nn1Pl9WgSQFaVcQjxkX009AOuVjN0o5HcoXsb5hAzvHrpoSPkcSSqq7VWab60TgUttVaRlZSGwGdSYQEqk5TdO0hWHuXyxaaEPybgFIyZLLbxPS4JmMz8n3Sngetpw9Jgc+V9Fc7wKXpjvZZ33SpArG5p5ZFFu2YQOXFLZth9qtQOjduQ2gU1kHN6WjWnJ8QX2s8vmU38Tk19kd5i+mz9dvc87IdBvmTIqVYSpM6AAYa2osBGP3f97Rj2S68lTad4ecSVyHdsjz56vdE3ZH4wskswmogbKkVdvO4biPHxT6odszBxYLEJuRJyZ7ckXd52MCzqAUPrw7YUuH8N1mLIlf7V5bW5R+q4DlKw774zxnHiWrymXGvlINSrB0qxBn8Fii6ib+Pacl3PuqSumCcgIHlVjqrzIXaqcTMn2/ABZYC99mralGvwA/EgNa8CBKB5evMCEwWa5Ntvcs2I2DFcO5Q2WzN4H0YScyAzzCzK7/3hWJE/rUIJntwiSXkV3MSa1yxWSGGH8F1lcz+lzgTBm/MU=
+  matrix:
+    - GO111MODULE=on
--- a/9
+++ b/9
@@ -1,13 +1,12 @@
-FROM golang:1.9 AS build
+FROM golang:1.12 AS build
 WORKDIR /go/src/github.com/aquasecurity/kube-bench/
-ADD Gopkg.toml Gopkg.lock ./
-RUN go get -v github.com/golang/dep/cmd/dep && dep ensure -v -vendor-only
+ADD go.mod go.sum ./
 ADD main.go .
 ADD check/ check/
 ADD cmd/ cmd/
-RUN CGO_ENABLED=0 go install -a -ldflags '-w'
+RUN GO111MODULE=on CGO_ENABLED=0 go install -a -ldflags '-w'

-FROM alpine:3.7 AS run
+FROM alpine:3.10 AS run
 WORKDIR /opt/kube-bench/
 # add GNU ps for -C, -o cmd, and --no-headers support
 # https://github.com/aquasecurity/kube-bench/issues/109
--- a/Gopkg.lock
+++ b/Gopkg.lock
@@ -1,254 +0,0 @@
-# This file is autogenerated, do not edit; changes may be undone by the next 'dep ensure'.
-
-
-[[projects]]
-  digest = "1:ffe9824d294da03b391f44e1ae8281281b4afc1bdaa9588c9097785e3af10cec"
-  name = "github.com/davecgh/go-spew"
-  packages = ["spew"]
-  pruneopts = "UT"
-  revision = "8991bc29aa16c548c550c7ff78260e27b9ab7c73"
-  version = "v1.1.1"
-
-[[projects]]
-  digest = "1:938a2672d6ebbb7f7bc63eee3e4b9464c16ffcf77ec8913d3edbf32b4e3984dd"
-  name = "github.com/fatih/color"
-  packages = ["."]
-  pruneopts = "UT"
-  revision = "570b54cabe6b8eb0bc2dfce68d964677d63b5260"
-  version = "v1.5.0"
-
-[[projects]]
-  digest = "1:38c783cf85b9454cc02a1a8319239800ed0af6c1c864adf19cea0539e134adad"
-  name = "github.com/fsnotify/fsnotify"
-  packages = ["."]
-  pruneopts = "UT"
-  revision = "4da3e2cfbabc9f751898f250b49f2439785783a1"
-
-[[projects]]
-  branch = "master"
-  digest = "1:1ba1d79f2810270045c328ae5d674321db34e3aae468eb4233883b473c5c0467"
-  name = "github.com/golang/glog"
-  packages = ["."]
-  pruneopts = "UT"
-  revision = "23def4e6c14b4da8ac2ed8007337bc5eb5007998"
-
-[[projects]]
-  digest = "1:145eff5207977eb95c3649a27cdc2e467d8a1c104810bc12b6a53745a91d823a"
-  name = "github.com/hashicorp/hcl"
-  packages = [
-    ".",
-    "hcl/ast",
-    "hcl/parser",
-    "hcl/scanner",
-    "hcl/strconv",
-    "hcl/token",
-    "json/parser",
-    "json/scanner",
-    "json/token",
-  ]
-  pruneopts = "UT"
-  revision = "23c074d0eceb2b8a5bfdbb271ab780cde70f05a8"
-
-[[projects]]
-  digest = "1:870d441fe217b8e689d7949fef6e43efbc787e50f200cb1e70dbca9204a1d6be"
-  name = "github.com/inconshreveable/mousetrap"
-  packages = ["."]
-  pruneopts = "UT"
-  revision = "76626ae9c91c4f2a10f34cad8ce83ea42c93bb75"
-  version = "v1.0"
-
-[[projects]]
-  digest = "1:510a2b056950ed12b4f3ac704ee1b34fd1920cb5b26f60f98d069de89c60adb7"
-  name = "github.com/jinzhu/gorm"
-  packages = [
-    ".",
-    "dialects/postgres",
-  ]
-  pruneopts = "UT"
-  revision = "5174cc5c242a728b435ea2be8a2f7f998e15429b"
-  version = "v1.0"
-
-[[projects]]
-  digest = "1:2cf1e05311b662e68d938f6655c6c5a44ae0e6b3995e390c75fcd8224afa48df"
-  name = "github.com/jinzhu/inflection"
-  packages = ["."]
-  pruneopts = "UT"
-  revision = "1c35d901db3da928c72a72d8458480cc9ade058f"
-
-[[projects]]
-  digest = "1:38dd5cee5306173bfe78f8c401edec1e08f772551bee95a85617b4e39347e366"
-  name = "github.com/lib/pq"
-  packages = [
-    ".",
-    "hstore",
-    "oid",
-  ]
-  pruneopts = "UT"
-  revision = "83612a56d3dd153a94a629cd64925371c9adad78"
-
-[[projects]]
-  digest = "1:9cbfcfd1ec741817698b844d17b523f54682a5f7c8683b1ec62b6b6542143240"
-  name = "github.com/magiconair/properties"
-  packages = ["."]
-  pruneopts = "UT"
-  revision = "49d762b9817ba1c2e9d0c69183c2b4a8b8f1d934"
-
-[[projects]]
-  digest = "1:31fcf8f5f8f6cc36ef11182c0a0f63ba464e1a7ad9f0e92a7cf46f38bfc0adfd"
-  name = "github.com/mattn/go-colorable"
-  packages = ["."]
-  pruneopts = "UT"
-  revision = "5411d3eea5978e6cdc258b30de592b60df6aba96"
-
-[[projects]]
-  digest = "1:fa610f9fe6a93f4a75e64c83673dfff9bf1a34bbb21e6102021b6bc7850834a3"
-  name = "github.com/mattn/go-isatty"
-  packages = ["."]
-  pruneopts = "UT"
-  revision = "57fdcb988a5c543893cc61bce354a6e24ab70022"
-
-[[projects]]
-  digest = "1:56a0bd1a1f3809171d1abe0bfd389558be0cd672e858e1f831b88f806aa8764f"
-  name = "github.com/mitchellh/mapstructure"
-  packages = ["."]
-  pruneopts = "UT"
-  revision = "06020f85339e21b2478f756a78e295255ffa4d6a"
-
-[[projects]]
-  digest = "1:128af710970a788bb2348dbcdde6b86fa41f92086297f909d659b6d3affc2902"
-  name = "github.com/pelletier/go-toml"
-  packages = ["."]
-  pruneopts = "UT"
-  revision = "0131db6d737cfbbfb678f8b7d92e55e27ce46224"
-
-[[projects]]
-  digest = "1:0028cb19b2e4c3112225cd871870f2d9cf49b9b4276531f03438a88e94be86fe"
-  name = "github.com/pmezard/go-difflib"
-  packages = ["difflib"]
-  pruneopts = "UT"
-  revision = "792786c7400a136282c1664665ae0a8db921c6c2"
-  version = "v1.0.0"
-
-[[projects]]
-  digest = "1:1fccaaeae58b2a2f1af4dbf7eee92ff14f222e161d143bfd20082ef664f91216"
-  name = "github.com/spf13/afero"
-  packages = [
-    ".",
-    "mem",
-  ]
-  pruneopts = "UT"
-  revision = "57afd63c68602b63ed976de00dd066ccb3c319db"
-
-[[projects]]
-  digest = "1:9b28ee2984c69d78afe2ce52b1650ba91a6381f355ff08c1d0e53d9e66bd62fe"
-  name = "github.com/spf13/cast"
-  packages = ["."]
-  pruneopts = "UT"
-  revision = "acbeb36b902d72a7a4c18e8f3241075e7ab763e4"
-  version = "v1.1.0"
-
-[[projects]]
-  digest = "1:7ffc0983035bc7e297da3688d9fe19d60a420e9c38bef23f845c53788ed6a05e"
-  name = "github.com/spf13/cobra"
-  packages = ["."]
-  pruneopts = "UT"
-  revision = "7b2c5ac9fc04fc5efafb60700713d4fa609b777b"
-  version = "v0.0.1"
-
-[[projects]]
-  digest = "1:9f28b7e326b8cd1db556678b7ce679cf9bf888647e40922f91d9d40f451f942b"
-  name = "github.com/spf13/jwalterweatherman"
-  packages = ["."]
-  pruneopts = "UT"
-  revision = "12bd96e66386c1960ab0f74ced1362f66f552f7b"
-
-[[projects]]
-  digest = "1:772bf4d1907ccb275aaa532ec6cb0d85fc61bd05648af28551590af3ea4e2d53"
-  name = "github.com/spf13/pflag"
-  packages = ["."]
-  pruneopts = "UT"
-  revision = "4c012f6dcd9546820e378d0bdda4d8fc772cdfea"
-
-[[projects]]
-  digest = "1:f8e1a678a2571e265f4bf91a3e5e32aa6b1474a55cb0ea849750cc177b664d96"
-  name = "github.com/spf13/viper"
-  packages = ["."]
-  pruneopts = "UT"
-  revision = "25b30aa063fc18e48662b86996252eabdcf2f0c7"
-  version = "v1.0.0"
-
-[[projects]]
-  digest = "1:ac83cf90d08b63ad5f7e020ef480d319ae890c208f8524622a2f3136e2686b02"
-  name = "github.com/stretchr/objx"
-  packages = ["."]
-  pruneopts = "UT"
-  revision = "477a77ecc69700c7cdeb1fa9e129548e1c1c393c"
-  version = "v0.1.1"
-
-[[projects]]
-  digest = "1:0bcc464dabcfad5393daf87c3f8142911d0f6c52569b837e91a1c15e890265f3"
-  name = "github.com/stretchr/testify"
-  packages = [
-    "assert",
-    "mock",
-  ]
-  pruneopts = "UT"
-  revision = "ffdc059bfe9ce6a4e144ba849dbedead332c6053"
-  version = "v1.3.0"
-
-[[projects]]
-  digest = "1:c9c0ba9ea00233c41b91e441cfd490f34b129bbfebcb1858979623bd8de07f72"
-  name = "golang.org/x/sys"
-  packages = ["unix"]
-  pruneopts = "UT"
-  revision = "e24f485414aeafb646f6fca458b0bf869c0880a1"
-
-[[projects]]
-  digest = "1:8029e9743749d4be5bc9f7d42ea1659471767860f0cdc34d37c3111bd308a295"
-  name = "golang.org/x/text"
-  packages = [
-    "internal/gen",
-    "internal/triegen",
-    "internal/ucd",
-    "transform",
-    "unicode/cldr",
-    "unicode/norm",
-  ]
-  pruneopts = "UT"
-  revision = "e19ae1496984b1c655b8044a65c0300a3c878dd3"
-
-[[projects]]
-  digest = "1:cb130999076da4717267c51235d62b63228c330ad86160255cbe3276de4c9892"
-  name = "gopkg.in/yaml.v2"
-  packages = ["."]
-  pruneopts = "UT"
-  revision = "c95af922eae69f190717a0b7148960af8c55a072"
-
-[[projects]]
-  digest = "1:e8e3acc03397f71fad44385631e665c639a8d55bd187bcfa6e70b695e3705edd"
-  name = "k8s.io/client-go"
-  packages = [
-    "third_party/forked/golang/template",
-    "util/jsonpath",
-  ]
-  pruneopts = "UT"
-  revision = "e64494209f554a6723674bd494d69445fb76a1d4"
-  version = "v10.0.0"
-
-[solve-meta]
-  analyzer-name = "dep"
-  analyzer-version = 1
-  input-imports = [
-    "github.com/fatih/color",
-    "github.com/golang/glog",
-    "github.com/jinzhu/gorm",
-    "github.com/jinzhu/gorm/dialects/postgres",
-    "github.com/spf13/cobra",
-    "github.com/spf13/viper",
-    "github.com/stretchr/testify/assert",
-    "github.com/stretchr/testify/mock",
-    "gopkg.in/yaml.v2",
-    "k8s.io/client-go/util/jsonpath",
-  ]
-  solver-name = "gps-cdcl"
-  solver-version = 1
--- a/Gopkg.toml
+++ b/Gopkg.toml
@@ -1,27 +0,0 @@
-[[constraint]]
-  name = "github.com/fatih/color"
-  version = "1.5.0"
-
-[[constraint]]
-  branch = "master"
-  name = "github.com/golang/glog"
-
-[[constraint]]
-  name = "github.com/jinzhu/gorm"
-  version = "1.0.0"
-
-[[constraint]]
-  name = "github.com/spf13/cobra"
-  version = "0.0.1"
-
-[[constraint]]
-  name = "github.com/spf13/viper"
-  version = "1.0.0"
-
-[[constraint]]
-  name = "github.com/stretchr/testify"
-  version = "1.3.0"
-
-[prune]
-  go-tests = true
-  unused-packages = true
--- a/README.md
+++ b/README.md
@@ -2,7 +2,10 @@
 [![License](https://img.shields.io/badge/License-Apache%202.0-blue.svg)](https://opensource.org/licenses/Apache-2.0)
 [![Docker image](https://images.microbadger.com/badges/image/aquasec/kube-bench.svg)](https://microbadger.com/images/aquasec/kube-bench "Get your own image badge on microbadger.com")
 [![Source commit](https://images.microbadger.com/badges/commit/aquasec/kube-bench.svg)](https://microbadger.com/images/aquasec/kube-bench)
+[![Coverage Status][cov-img]][cov]

+[cov-img]: https://codecov.io/github/aquasecurity/kube-bench/branch/master/graph/badge.svg
+[cov]: https://codecov.io/github/aquasecurity/kube-bench
 <img src="images/kube-bench.png" width="200" alt="kube-bench logo">

 kube-bench is a Go application that checks whether Kubernetes is deployed securely by running the checks documented in the [CIS Kubernetes Benchmark](https://www.cisecurity.org/benchmark/kubernetes/). 
@@ -23,7 +26,7 @@ kube-bench supports the tests for Kubernetes as defined in the CIS Benchmarks 1.
 | 1.1.0| 1.7 | 1.7 |
 | 1.2.0| 1.8 | 1.8-1.10 |
 | 1.3.0| 1.11 | 1.11-1.12 |
-| 1.4.0| 1.13 | 1.13- |
+| 1.4.1| 1.13 | 1.13- |

 By default kube-bench will determine the test set to run based on the Kubernetes version running on the machine.

@@ -37,21 +40,53 @@ You can choose to
 * install the latest binaries from the [Releases page](https://github.com/aquasecurity/kube-bench/releases),
 * compile it from source.

+## Running kube-bench
+
+kube-bench automatically selects which `controls` to use based on the detected
+node type and the version of kubernetes a cluster is running. This behaviour
+can be overridden by specifying the `master` or `node` subcommand and the
+`--version` flag on the command line. 
+
+The kubernetes version can also be set with the KUBE_BENCH_VERSION environment variable.
+The value of `--version` takes precedence over the value of KUBE_BENCH_VERSION.
+
+For example:
+run kube-bench against a master with version auto-detection:
+
+```
+kube-bench master
+```
+
+or run kube-bench against a node with the node `controls` for kubernetes 
+version 1.13:
+```
+kube-bench node --version 1.13
+```
+
+`controls` for the various versions of kubernetes can be found in directories
+with same name as the kubernetes versions under `cfg/`, for example `cfg/1.13`.
+`controls` are also organized by distribution under the `cfg` directory for
+example `cfg/ocp-3.10`.
+
 ### Running inside a container

-You can avoid installing kube-bench on the host by running it inside a container using the host PID namespace and mounting the `/etc` and `/var` directories where the configuration and other files are located on the host, so that kube-bench can check their existence and permissions.
+You can avoid installing kube-bench on the host by running it inside a container using the host PID namespace and mounting the `/etc` and `/var` directories where the configuration and other files are located on the host, so that kube-bench can check their existence and permissions. 

 ```
-docker run --pid=host -v /etc:/etc:ro -v /var:/var:ro -t aquasec/kube-bench:latest [master|node]
+docker run --pid=host -v /etc:/etc:ro -v /var:/var:ro -t aquasec/kube-bench:latest [master|node] --version 1.13
 ```

-You can even use your own configs by mounting them over the default ones in `/opt/kube-bench/cfg/`
+> Note: the tests require either the kubelet or kubectl binary in the path in order to auto-detect the Kubernetes version. You can pass `-v $(which kubectl):/usr/bin/kubectl` to resolve this. You will also need to pass in kubeconfig credentials. For example:

 ```
-docker run --pid=host -v /etc:/etc:ro -v /var:/var:ro -t -v path/to/my-config.yaml:/opt/kube-bench/cfg/config.yaml aquasec/kube-bench:latest [master|node]
+docker run --pid=host -v /etc:/etc:ro -v /var:/var:ro -v $(which kubectl):/usr/bin/kubectl -v ~/.kube:/.kube -e KUBECONFIG=/.kube/config -t aquasec/kube-bench:latest [master|node] 
 ```

-> Note: the tests require either the kubelet or kubectl binary in the path in order to auto-detect the Kubernetes version. You can pass `-v $(which kubectl):/usr/bin/kubectl` to the above invocations to resolve this.
+You can use your own configs by mounting them over the default ones in `/opt/kube-bench/cfg/`
+
+```
+docker run --pid=host -v /etc:/etc:ro -v /var:/var:ro -t -v path/to/my-config.yaml:/opt/kube-bench/cfg/config.yam -v $(which kubectl):/usr/bin/kubectl -v ~/.kube:/.kube -e KUBECONFIG=/.kube/config aquasec/kube-bench:latest [master|node]
+```

 ### Running in a kubernetes cluster

@@ -129,19 +164,6 @@ go build -o kube-bench .

 kube-bench includes a set of test files for Red Hat's OpenShift hardening guide for OCP 3.10 and 3.11. To run this you will need to specify `--version ocp-3.10` when you run the `kube-bench` command (either directly or through YAML). This config version is valid for OCP 3.10 and 3.11. 

-## Configuration
-
-Kubernetes config and binary file locations and names can vary from installation to installation, so these are configurable in the `cfg/config.yaml` file.
-
-Any settings in the version-specific config file `cfg/<version>/config.yaml` take precedence over settings in the main `cfg/config.yaml` file.
-
-For each type of node (*master*, *node* or *federated*) there is a list of components, and for each component there is a set of binaries (*bins*) and config files (*confs*) that kube-bench will look for (in the order they are listed). If your installation uses a different binary name or config file location for a Kubernetes component, you can add it to `cfg/config.yaml`.
-
-* **bins** - If there is a *bins* list for a component, at least one of these binaries must be running. The tests will consider the parameters for the first binary in the list found to be running.
-* **podspecs** - From version 1.2.0 of the benchmark (tests for Kubernetes 1.8), the remediation instructions were updated to assume that the configuration for several kubernetes components is defined in a pod YAML file, and podspec settings define where to look for that configuration.
-* **confs** - If one of the listed config files is found, this will be considered for the test. Tests can continue even if no config file is found. If no file is found at any of the listed locations, and a *defaultconf* location is given for the component, the test will give remediation advice using the *defaultconf* location.
-* **unitfiles** - From version 1.2.0 of the benchmark  (tests for Kubernetes 1.8), the remediation instructions were updated to assume that kubelet configuration is defined in a service file, and this setting defines where to look for that configuration.
-
 ## Output

 There are three output states
@@ -149,37 +171,17 @@ There are three output states
 - [WARN] means this test needs further attention, for example it is a test that needs to be run manually 
 - [INFO] is informational output that needs no further action.

+## Configuration
+
+Kubernetes config and binary file locations and names can vary from installation to installation, so these are configurable in the `cfg/config.yaml` file.
+
+Any settings in the version-specific config file `cfg/<version>/config.yaml` take precedence over settings in the main `cfg/config.yaml` file.
+
+You can read more about `kube-bench` configuration in our [documentation](docs/README.md#configuration-and-variables).
+
 ## Test config YAML representation
-The tests are represented as YAML documents (installed by default into ./cfg).

-An example is as listed below:
-```
---
-controls:
-id: 1
-text: "Master Checks"
-type: "master"
-groups:
- id: 1.1
-  text: "Kube-apiserver"
-  checks:
-    - id: 1.1.1
-      text: "Ensure that the --allow-privileged argument is set (Scored)"
-      audit: "ps -ef | grep kube-apiserver | grep -v grep"
-      tests:
-      bin_op: or
-      test_items:
-      - flag: "--allow-privileged"
-        set: true
-      - flag: "--some-other-flag"
-        set: false
-      remediation: "Edit the /etc/kubernetes/config file on the master node and set the KUBE_ALLOW_PRIV parameter to '--allow-privileged=false'"
-      scored: true
-```
-
-Recommendations (called `checks` in this document) can run on Kubernetes Master, Node or Federated API Servers.
-Checks are organized into `groups` which share similar controls (things to check for) and are grouped together in the section of the CIS Kubernetes document.
-These groups are further organized under `controls` which can be of the type `master`, `node` or `federated apiserver` to reflect the various Kubernetes node types.
+The tests (or "controls") are represented as YAML documents (installed by default into ./cfg). There are different versions of these test YAML files reflecting different versions of the CIS Kubernetes Benchmark. You will find more information about the test file YAML definitions in our [documentation](docs/README.md).

 ### Omitting checks

@@ -195,44 +197,6 @@ If you decide that a recommendation is not appropriate for your environment, you

 No tests will be run for this check and the output will be marked [INFO].

-## Tests
-Tests are the items we actually look for to determine if a check is successful or not. Checks can have multiple tests, which must all be successful for the check to pass.
-
-The syntax for tests:
-```
-tests:
- flag:
-  set:
-  compare:
-    op:
-    value:
-...
-```
-
-You can also define jsonpath and yamlpath tests using the following syntax:
-
-```
-tests:
- path:
-  set:
-  compare:
-    op:
-    value:
-...
-```
-
-Tests have various `operations` which are used to compare the output of audit commands for success.
-These operations are:
-
- `eq`: tests if the flag value is equal to the compared value.
- `noteq`: tests if the flag value is unequal to the compared value.
- `gt`: tests if the flag value is greater than the compared value.
- `gte`: tests if the flag value is greater than or equal to the compared value.
- `lt`: tests if the flag value is less than the compared value.
- `lte`: tests if the flag value is less than or equal to the compared value.
- `has`: tests if the flag value contains the compared value.
- `nothave`: tests if the flag value does not contain the compared value.
-
 # Roadmap
 Going forward we plan to release updates to kube-bench to add support for new releases of the Benchmark, which in turn we can anticipate being made for each new Kubernetes release.

@@ -251,3 +215,36 @@ Next you'll have to build the kube-bench docker image using `make build-docker`,
 Finally we can use the `make kind-run` target to run the current version of kube-bench in the cluster and follow the logs of pods created. (Ctrl+C to exit)

 Everytime you want to test a change, you'll need to rebuild the docker image and push it to cluster before running it again. ( `make build-docker kind-push kind-run` )
+
+# GitHub Issues
+
+## Bugs
+
+If you think you have found a bug please follow the instructions below.
+
+- Please spend a small amount of time giving due diligence to the issue tracker. Your issue might be a duplicate.
+- Open a [new issue](https://github.com/aquasecurity/kube-bench/issues/new) if a duplicate doesn't already exist.
+- Note the version of kube-bench you are running (from `kube-bench version`) and the command line options you are using.
+- Note the version of kubernetes you are running (from `kubectl version` or `oc version` for Openshift).
+- Set `-v 10` command line option and save the log output. Please paste this into your issue.
+- Remember users might be searching for your issue in the future, so please give it a meaningful title to help others.
+
+## Features
+
+We also use the GitHub issue tracker to track feature requests. If you have an idea to make kube-bench even more awesome follow the steps below.
+
+- Open a [new issue](https://github.com/aquasecurity/kube-bench/issues/new).
+- Remember users might be searching for your issue in the future, so please give it a meaningful title to helps others.
+- Clearly define the use case, using concrete examples. For example: I type `this` and kube-bench does `that`.
+- If you would like to include a technical design for your feature please feel free to do so.
+
+## Pull Requests 
+
+We welcome pull requests! 
+
+- Your PR is more likely to be accepted if it focuses on just one change.
+- Please include a comment with the results before and after your change. 
+- Your PR is more likely to be accepted if it includes tests. (We have not historically been very strict about tests, but we would like to improve this!). 
+- You're welcome to submit a draft PR if you would like early feedback on an idea or an approach. 
+- Happy coding!
+
--- a/cfg/1.11-json/node.yaml
+++ b/cfg/1.11-json/node.yaml
@@ -10,6 +10,9 @@ groups:
  checks:
  - id: 2.1.1
    text: "Ensure that the --allow-privileged argument is set to false (Scored)"
+    # This is one of those properties that can only be set as a command line argument. 
+    # To check if the property is set as expected, we need to parse the kubelet command 
+    # instead reading the Kubelet Configuration file.
    audit: "ps -fC $kubeletbin"
    tests:
      test_items:
@@ -93,10 +96,7 @@ groups:
    text: "Ensure that the --read-only-port argument is set to 0 (Scored)"
    audit: "cat $kubeletconf"
    tests:
-      bin_op: or
      test_items:
-      - path: "{.readOnlyPort}"
-        set: false
      - path: "{.readOnlyPort}"
        compare:
          op: eq
@@ -318,8 +318,8 @@ groups:
          value: "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256"
        set: true
    remediation: |
-      If using a Kubelet config file, edit the file to set TLSCipherSuites: to TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 ,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 ,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 ,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256
-      If using executable arguments, edit the kubelet service file $kubeletconf on each worker node and set the below parameter.
+      If using a Kubelet config file, edit the file to set TLSCipherSuites: to TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256
+      If using executable arguments, edit the kubelet service file $kubeletsvc on each worker node and set the below parameter.
      --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256
    scored: false

@@ -436,6 +436,10 @@ groups:
        Run the below command (based on the file location on your system) on the each worker
        node. For example,
        chmod 644 $proxykubeconfig
+
+        Note - This test reports "FAIL" if kube-proxy has been configured
+        using a kubernetes configMap. Only under this situation, the "FAIL" can safely be ignored 
+        as the kube-proxy does not expose the kubeconfig file to the worker node.
      scored: true

    - id: 2.2.6
@@ -449,6 +453,10 @@ groups:
          Run the below command (based on the file location on your system) on the each worker
          node. For example,
          chown root:root $proxykubeconfig
+                 
+          Note - This test reports "FAIL" if kube-proxy has been configured
+          using a kubernetes configMap. Only under this situation, the "FAIL" can safely be ignored 
+          as the kube-proxy does not expose the kubeconfig file to the worker node.
      scored: true

    - id: 2.2.7
@@ -462,8 +470,14 @@ groups:

    - id: 2.2.8
      text: "Ensure that the client certificate authorities file ownership is set to root:root (Scored)"
-      audit: "/bin/sh -c 'if test -e $ca-file; then stat -c %U:%G $ca-file; fi'"
-      type: manual
+      audit: "/bin/sh -c 'if test -e $kubeletcafile; then stat -c %U:%G $kubeletcafile; fi'"
+      tests:
+        test_items:
+          - flag: "root:root"
+            compare:
+              op: eq
+              value: root:root
+            set: true
      remediation: |
        Run the following command to modify the ownership of the --client-ca-file .
        chown root:root <filename>
--- a/cfg/1.11/master.yaml
+++ b/cfg/1.11/master.yaml
@@ -153,12 +153,15 @@ groups:
    text: "Ensure that the admission control plugin AlwaysAdmit is not set (Scored)"
    audit: "ps -ef | grep $apiserverbin | grep -v grep"
    tests:
+      bin_op: or
      test_items:
      - flag: "--enable-admission-plugins"
        compare:
          op: nothave
          value: AlwaysAdmit
        set: true
+      - flag: "--enable-admission-plugins"
+        set: false
    remediation: |
      Edit the API server pod specification file $apiserverconf
      on the master node and set the --enable-admission-plugins parameter to a
@@ -438,12 +441,15 @@ groups:
    text: "Ensure that the admission control plugin ServiceAccount is set(Scored)"
    audit: "ps -ef | grep $apiserverbin | grep -v grep"
    tests:
+      bin_op: or
      test_items:
      - flag: "--enable-admission-plugins"
        compare:
          op: has
          value: "ServiceAccount"
        set: true
+      - flag: "--enable-admission-plugins"
+        set: false
    remediation: |
      Follow the documentation and create ServiceAccount objects as per your environment.
      Then, edit the API server pod specification file $apiserverconf
@@ -1232,7 +1238,6 @@ groups:
    text: "Ensure that the --peer-cert-file and --peer-key-file arguments are
    set as appropriate (Scored)"
    audit: "ps -ef | grep $etcdbin | grep -v grep"
-    type: "manual"
    tests:
      bin_op: and
      test_items:
@@ -1251,7 +1256,6 @@ groups:
  - id: 1.5.5
    text: "Ensure that the --peer-client-cert-auth argument is set to true (Scored)"
    audit: "ps -ef | grep $etcdbin | grep -v grep"
-    type: "manual"
    tests:
      test_items:
      - flag: "--peer-client-cert-auth"
@@ -1268,7 +1272,6 @@ groups:
  - id: 1.5.6
    text: "Ensure that the --peer-auto-tls argument is not set to true (Scored)"
    audit: "ps -ef | grep $etcdbin | grep -v grep"
-    type: "manual"
    tests:
      bin_op: or
      test_items:
--- a/cfg/1.11/node.yaml
+++ b/cfg/1.11/node.yaml
@@ -114,12 +114,15 @@ groups:
    text: "Ensure that the --streaming-connection-idle-timeout argument is not set to 0 (Scored)"
    audit: "ps -fC $kubeletbin"
    tests:
+      bin_op: or
      test_items:
      - flag: "--streaming-connection-idle-timeout"
        compare:
          op: noteq
          value: 0
        set: true
+      - flag: "--streaming-connection-idle-timeout"
+        set: false
    remediation: |
      If using a Kubelet config file, edit the file to set streamingConnectionIdleTimeout to a
      value other than 0.
@@ -264,12 +267,15 @@ groups:
    text: "Ensure that the --rotate-certificates argument is not set to false (Scored)"
    audit: "ps -fC $kubeletbin"
    tests:
+      bin_op: or
      test_items:
      - flag: "--rotate-certificates"
        compare:
          op: eq
          value: true
        set: true
+      - flag: "--rotate-certificates"
+        set: false
    remediation: |
      If using a Kubelet config file, edit the file to add the line rotateCertificates: true.
      If using command line arguments, edit the kubelet service file $kubeletsvc 
@@ -309,8 +315,8 @@ groups:
          value: "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256"
        set: true
    remediation: |
-      If using a Kubelet config file, edit the file to set TLSCipherSuites: to TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 ,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 ,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 ,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256
-      If using executable arguments, edit the kubelet service file $kubeletconf on each worker node and set the below parameter.
+      If using a Kubelet config file, edit the file to set TLSCipherSuites: to TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256
+      If using executable arguments, edit the kubelet service file $kubeletsvc on each worker node and set the below parameter.
      --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256
    scored: false

@@ -453,8 +459,14 @@ groups:

    - id: 2.2.8
      text: "Ensure that the client certificate authorities file ownership is set to root:root (Scored)"
-      audit: "/bin/sh -c 'if test -e $ca-file; then stat -c %U:%G $ca-file; fi'"
-      type: manual
+      audit: "/bin/sh -c 'if test -e $kubeletcafile; then stat -c %U:%G $kubeletcafile; fi'"
+      tests:
+        test_items:
+          - flag: "root:root"
+            compare:
+              op: eq
+              value: root:root
+            set: true
      remediation: |
        Run the following command to modify the ownership of the --client-ca-file .
        chown root:root <filename>
--- a/cfg/1.13-json/config.yaml
+++ b/cfg/1.13-json/config.yaml
@@ -0,0 +1,16 @@
+---
+# Config file for systems such as EKS where config is in JSON files
+# Master nodes are controlled by EKS and not user-accessible
+node:
+  kubernetes:
+    confs:
+      - "/var/lib/kubelet/kubeconfig"
+    kubeconfig:
+      - "/var/lib/kubelet/kubeconfig"
+
+  kubelet:
+    defaultsvc: "/etc/systemd/system/kubelet.service"
+    defaultkubeconfig: "/var/lib/kubelet/kubeconfig"
+
+  proxy:
+    defaultkubeconfig: "/var/lib/kubelet/kubeconfig"
--- a/cfg/1.13-json/node.yaml
+++ b/cfg/1.13-json/node.yaml
@@ -0,0 +1,504 @@
+---
+controls:
+version: 1.13
+id: 2
+text: "Worker Node Security Configuration"
+type: "node"
+groups:
+- id: 2.1
+  text: "Kubelet"
+  checks:
+  - id: 2.1.1
+    text: "Ensure that the --anonymous-auth argument is set to false (Scored)"
+    audit: "cat $kubeletconf"
+    tests:
+      test_items:
+      - path: "{.authentication.anonymous.enabled}"
+        compare:
+          op: eq
+          value: false
+        set: true
+    remediation: |
+      If using a Kubelet config file, edit the file to set authentication: anonymous: enabled to
+      false .
+      If using executable arguments, edit the kubelet service file
+      $kubeletsvc on each worker node and
+      set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable.
+      --anonymous-auth=false
+      Based on your system, restart the kubelet service. For example:
+      systemctl daemon-reload
+      systemctl restart kubelet.service
+    scored: true
+
+  - id: 2.1.2
+    text: "Ensure that the --authorization-mode argument is not set to AlwaysAllow (Scored)"
+    audit: "cat $kubeletconf"
+    tests:
+      test_items:
+      - path: "{.authorization.mode}"
+        compare:
+          op: nothave
+          value: "AlwaysAllow"
+        set: true
+    remediation: |
+      If using a Kubelet config file, edit the file to set authorization: mode to Webhook.
+      If using executable arguments, edit the kubelet service file
+      $kubeletsvc on each worker node and
+      set the below parameter in KUBELET_AUTHZ_ARGS variable.
+      --authorization-mode=Webhook
+      Based on your system, restart the kubelet service. For example:
+      systemctl daemon-reload
+      systemctl restart kubelet.service
+    scored: true
+
+  - id: 2.1.3
+    text: "Ensure that the --client-ca-file argument is set as appropriate (Scored)"
+    audit: "cat $kubeletconf"
+    tests:
+      test_items:
+      - path: "{.authentication.x509.clientCAFile}"
+        set: true
+    remediation: |
+      If using a Kubelet config file, edit the file to set authentication: x509: clientCAFile to
+      the location of the client CA file.
+      If using command line arguments, edit the kubelet service file
+      $kubeletsvc on each worker node and
+      set the below parameter in KUBELET_AUTHZ_ARGS variable.
+      --client-ca-file=<path/to/client-ca-file>
+      Based on your system, restart the kubelet service. For example:
+      systemctl daemon-reload
+      systemctl restart kubelet.service
+    scored: true
+
+  - id: 2.1.4
+    text: "Ensure that the --read-only-port argument is set to 0 (Scored)"
+    audit: "cat $kubeletconf"
+    tests:
+      test_items:
+      - path: "{.readOnlyPort}"
+        compare:
+          op: eq
+          value: 0
+        set: true
+    remediation: |
+      If using a Kubelet config file, edit the file to set readOnlyPort to 0 .
+      If using command line arguments, edit the kubelet service file
+      $kubeletsvc on each worker node and
+      set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable.
+      --read-only-port=0
+      Based on your system, restart the kubelet service. For example:
+      systemctl daemon-reload
+      systemctl restart kubelet.service
+    scored: true
+
+  - id: 2.1.5
+    text: "Ensure that the --streaming-connection-idle-timeout argument is not set to 0 (Scored)"
+    audit: "cat $kubeletconf"
+    tests:
+      bin_op: or
+      test_items:
+      - path: "{.streamingConnectionIdleTimeout}"
+        compare:
+          op: noteq
+          value: 0
+        set: true
+      - path: "{.streamingConnectionIdleTimeout}"
+        set: false
+    remediation: |
+      If using a Kubelet config file, edit the file to set streamingConnectionIdleTimeout to a
+      value other than 0.
+      If using command line arguments, edit the kubelet service file
+      $kubeletsvc on each worker node and
+      set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable.
+      --streaming-connection-idle-timeout=5m
+      Based on your system, restart the kubelet service. For example:
+      systemctl daemon-reload
+      systemctl restart kubelet.service
+    scored: true
+
+  - id: 2.1.6
+    text: "Ensure that the --protect-kernel-defaults argument is set to true (Scored)"
+    audit: "cat $kubeletconf"
+    tests:
+      test_items:
+      - path: "{.protectKernelDefaults}"
+        compare:
+          op: eq
+          value: true
+        set: true
+    remediation: |
+      If using a Kubelet config file, edit the file to set protectKernelDefaults: true .
+      If using command line arguments, edit the kubelet service file
+      $kubeletsvc on each worker node and
+      set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable.
+      --protect-kernel-defaults=true
+      Based on your system, restart the kubelet service. For example:
+      systemctl daemon-reload
+      systemctl restart kubelet.service
+    scored: true
+
+  - id: 2.1.7
+    text: "Ensure that the --make-iptables-util-chains argument is set to true (Scored)"
+    audit: "cat $kubeletconf"
+    tests:
+      bin_op: or
+      test_items:
+      - path: "{.makeIPTablesUtilChains}"
+        compare:
+          op: eq
+          value: true
+        set: true
+      - path: "{.makeIPTablesUtilChains}"
+        set: false
+    remediation: |
+      If using a Kubelet config file, edit the file to set makeIPTablesUtilChains: true .
+      If using command line arguments, edit the kubelet service file
+      $kubeletsvc on each worker node and
+      remove the --make-iptables-util-chains argument from the
+      KUBELET_SYSTEM_PODS_ARGS variable.
+      Based on your system, restart the kubelet service. For example:
+      systemctl daemon-reload
+      systemctl restart kubelet.service
+    scored: true
+
+  - id: 2.1.8
+    text: "Ensure that the --hostname-override argument is not set (Scored)"
+    # This is one of those properties that can only be set as a command line argument. 
+    # To check if the property is set as expected, we need to parse the kubelet command 
+    # instead reading the Kubelet Configuration file.
+    audit: "ps -fC $kubeletbin"
+    tests:
+      test_items:
+      - flag: "--hostname-override"
+        set: false
+    remediation: |
+      Edit the kubelet service file $kubeletsvc
+      on each worker node and remove the --hostname-override argument from the
+      KUBELET_SYSTEM_PODS_ARGS variable.
+      Based on your system, restart the kubelet service. For example:
+      systemctl daemon-reload
+      systemctl restart kubelet.service
+    scored: true
+
+  - id: 2.1.9
+    text: "Ensure that the --event-qps argument is set to 0 (Scored)"
+    audit: "cat $kubeletconf"
+    tests:
+      test_items:
+      - path: "{.eventRecordQPS}"
+        compare:
+          op: eq
+          value: 0
+        set: true
+    remediation: |
+      If using a Kubelet config file, edit the file to set eventRecordQPS: 0 .
+      If using command line arguments, edit the kubelet service file
+      $kubeletsvc on each worker node and
+      set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable.
+      --event-qps=0
+      Based on your system, restart the kubelet service. For example:
+      systemctl daemon-reload
+      systemctl restart kubelet.service
+    scored: true
+
+  - id: 2.1.10
+    text: "Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate (Scored)"
+    audit: "cat $kubeletconf"
+    tests:
+      bin_op: and
+      test_items:
+      - path: "{.tlsCertFile}"
+        set: true
+      - path: "{.tlsPrivateKeyFile}"
+        set: true
+    remediation: |
+      If using a Kubelet config file, edit the file to set tlsCertFile to the location of the certificate
+      file to use to identify this Kubelet, and tlsPrivateKeyFile to the location of the
+      corresponding private key file.
+      If using command line arguments, edit the kubelet service file
+      $kubeletsvc on each worker node and
+      set the below parameters in KUBELET_CERTIFICATE_ARGS variable.
+      --tls-cert-file=<path/to/tls-certificate-file>
+      file=<path/to/tls-key-file>
+      Based on your system, restart the kubelet service. For example:
+      systemctl daemon-reload
+      systemctl restart kubelet.service
+    scored: true
+
+  - id: 2.1.11
+    text: "[DEPRECATED] Ensure that the --cadvisor-port argument is set to 0"
+    # This is one of those properties that can only be set as a command line argument. 
+    # To check if the property is set as expected, we need to parse the kubelet command 
+    # instead reading the Kubelet Configuration file.
+    audit: "ps -fC $kubeletbin"
+    type: skip
+    tests:
+      bin_op: or
+      test_items:
+      - flag: "--cadvisor-port"
+        compare:
+          op: eq
+          value: 0
+        set: true
+      - flag: "--cadvisor-port"
+        set: false
+    remediation: |
+      Edit the kubelet service file $kubeletsvc
+      on each worker node and set the below parameter in KUBELET_CADVISOR_ARGS variable.
+      --cadvisor-port=0
+      Based on your system, restart the kubelet service. For example:
+      systemctl daemon-reload
+      systemctl restart kubelet.service
+    scored: false
+
+  - id: 2.1.12
+    text: "Ensure that the --rotate-certificates argument is not set to false (Scored)"
+    audit: "cat $kubeletconf"
+    tests:
+      test_items:
+      - path: "{.rotateCertificates}"
+        compare:
+          op: eq
+          value: true
+        set: true
+    remediation: |
+      If using a Kubelet config file, edit the file to add the line rotateCertificates: true.
+      If using command line arguments, edit the kubelet service file $kubeletsvc 
+      on each worker node and add --rotate-certificates=true argument to the KUBELET_CERTIFICATE_ARGS variable.
+      Based on your system, restart the kubelet service. For example:
+      systemctl daemon-reload
+      systemctl restart kubelet.service
+    scored: true
+
+  - id: 2.1.13
+    text: "Ensure that the RotateKubeletServerCertificate argument is set to true (Scored)"
+    audit: "cat $kubeletconf"
+    tests:
+      test_items:
+      - path: "{.featureGates.RotateKubeletServerCertificate}"
+        compare:
+          op: eq
+          value: true
+        set: true
+    remediation: |
+      Edit the kubelet service file $kubeletsvc
+      on each worker node and set the below parameter in KUBELET_CERTIFICATE_ARGS variable.
+      --feature-gates=RotateKubeletServerCertificate=true
+      Based on your system, restart the kubelet service. For example:
+      systemctl daemon-reload
+      systemctl restart kubelet.service
+    scored: true
+
+  - id: 2.1.14
+    text: "Ensure that the Kubelet only makes use of Strong Cryptographic Ciphers (Not Scored)"
+    audit: "cat $kubeletconf"
+    tests:
+      test_items:
+      - path: "{range .tlsCipherSuites[:]}{}{','}{end}"
+        compare:
+          op: valid_elements
+          value: "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256"
+        set: true
+    remediation: |
+      If using a Kubelet config file, edit the file to set TLSCipherSuites: to TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256
+      If using executable arguments, edit the kubelet service file $kubeletsvc on each worker node and set the below parameter.
+      --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256
+    scored: false
+
+- id: 2.2
+  text: "Configuration Files"
+  checks:
+    - id: 2.2.1
+      text: "Ensure that the kubelet.conf file permissions are set to 644 or
+      more restrictive (Scored)"
+      audit: "/bin/sh -c 'if test -e $kubeletkubeconfig; then stat -c %a $kubeletkubeconfig; fi'"
+      tests:
+        bin_op: or
+        test_items:
+          - flag: "644"
+            compare:
+              op: eq
+              value: "644"
+            set: true
+          - flag: "640"
+            compare:
+              op: eq
+              value: "640"
+            set: true
+          - flag: "600"
+            compare:
+              op: eq
+              value: "600"
+            set: true
+      remediation: |
+        Run the below command (based on the file location on your system) on the each worker
+        node. For example,
+        chmod 644 $kubeletkubeconfig
+      scored: true
+
+    - id: 2.2.2
+      text: "Ensure that the kubelet.conf file ownership is set to root:root (Scored)"
+      audit: "/bin/sh -c 'if test -e $kubeletkubeconfig; then stat -c %U:%G $kubeletkubeconfig; fi'"
+      tests:
+        test_items:
+          - flag: "root:root"
+            compare:
+              op: eq
+              value: root:root
+            set: true
+      remediation: |
+        Run the below command (based on the file location on your system) on the each worker
+        node. For example,
+        chown root:root $kubeletkubeconfig
+      scored: true
+
+    - id: 2.2.3
+      text: "Ensure that the kubelet service file permissions are set to 644 or
+      more restrictive (Scored)"
+      audit: "/bin/sh -c 'if test -e $kubeletsvc; then stat -c %a $kubeletsvc; fi'"
+      tests:
+        bin_op: or
+        test_items:
+        - flag: "644"
+          compare:
+            op: eq
+            value: 644
+          set: true
+        - flag: "640"
+          compare:
+            op: eq
+            value: "640"
+          set: true
+        - flag: "600"
+          compare:
+            op: eq
+            value: "600"
+          set: true
+      remediation: |
+        Run the below command (based on the file location on your system) on the each worker
+        node. For example,
+        chmod 755 $kubeletsvc
+      scored: true
+
+    - id: 2.2.4
+      text: "Ensure that the kubelet service file ownership is set to root:root (Scored)"
+      audit: "/bin/sh -c 'if test -e $kubeletsvc; then stat -c %U:%G $kubeletsvc; fi'"
+      tests:
+        test_items:
+        - flag: "root:root"
+          set: true
+      remediation: |
+        Run the below command (based on the file location on your system) on the each worker
+        node. For example,
+        chown root:root $kubeletsvc
+      scored: true
+
+    - id: 2.2.5
+      text: "Ensure that the proxy kubeconfig file permissions are set to 644 or more restrictive (Scored)"
+      audit: "/bin/sh -c 'if test -e $proxykubeconfig; then stat -c %a $proxykubeconfig; fi'"
+      tests:
+        bin_op: or
+        test_items:
+        - flag: "644"
+          compare:
+            op: eq
+            value: "644"
+          set: true
+        - flag: "640"
+          compare:
+            op: eq
+            value: "640"
+          set: true
+        - flag: "600"
+          compare:
+            op: eq
+            value: "600"
+          set: true
+      remediation: |
+        Run the below command (based on the file location on your system) on the each worker
+        node. For example,
+        chmod 644 $proxykubeconfig
+
+        Note - This test reports "FAIL" if kube-proxy has been configured
+        using a kubernetes configMap. Only under this situation, the "FAIL" can safely be ignored 
+        as the kube-proxy does not expose the kubeconfig file to the worker node.
+      scored: true
+
+    - id: 2.2.6
+      text: "Ensure that the proxy kubeconfig file ownership is set to root:root (Scored)"
+      audit: "/bin/sh -c 'if test -e $proxykubeconfig; then stat -c %U:%G $proxykubeconfig; fi'"
+      tests:
+        test_items:
+        - flag: "root:root"
+          set: true
+      remediation: |
+          Run the below command (based on the file location on your system) on the each worker
+          node. For example,
+          chown root:root $proxykubeconfig
+          
+          Note - This test reports "FAIL" if kube-proxy has been configured
+          using a kubernetes configMap. Only under this situation, the "FAIL" can safely be ignored 
+          as the kube-proxy does not expose the kubeconfig file to the worker node.
+      scored: true
+
+    - id: 2.2.7
+      text: "Ensure that the certificate authorities file permissions are set to
+      644 or more restrictive (Scored)"
+      type: manual
+      remediation: |
+        Run the following command to modify the file permissions of the --client-ca-file
+        chmod 644 <filename>
+      scored: true
+
+    - id: 2.2.8
+      text: "Ensure that the client certificate authorities file ownership is set to root:root (Scored)"
+      audit: "/bin/sh -c 'if test -e $kubeletcafile; then stat -c %U:%G $kubeletcafile; fi'"
+      tests:
+        test_items:
+          - flag: "root:root"
+            compare:
+              op: eq
+              value: root:root
+            set: true
+      remediation: |
+        Run the following command to modify the ownership of the --client-ca-file .
+        chown root:root <filename>
+      scored: true
+
+    - id: 2.2.9
+      text: "Ensure that the kubelet configuration file ownership is set to root:root (Scored)"
+      audit: "/bin/sh -c 'if test -e $kubeletconf; then stat -c %U:%G $kubeletconf; fi'"
+      tests:
+        test_items:
+        - flag: "root:root"
+          set: true
+      remediation: |
+        Run the following command (using the config file location identied in the Audit step)
+        chown root:root $kubeletconf
+      scored: true
+
+    - id: 2.2.10
+      text: "Ensure that the kubelet configuration file has permissions set to 644 or more restrictive (Scored)"
+      audit: "/bin/sh -c 'if test -e $kubeletconf; then stat -c %a $kubeletconf; fi'"
+      tests:
+        bin_op: or
+        test_items:
+        - flag: "644"
+          compare:
+            op: eq
+            value: "644"
+          set: true
+        - flag: "640"
+          compare:
+            op: eq
+            value: "640"
+          set: true
+        - flag: "600"
+          compare:
+            op: eq
+            value: "600"
+          set: true
+      remediation: |
+        Run the following command (using the config file location identied in the Audit step)
+        chmod 644 $kubeletconf
+      scored: true
--- a/cfg/1.13/master.yaml
+++ b/cfg/1.13/master.yaml
@@ -153,12 +153,15 @@ groups:
    text: "Ensure that the admission control plugin AlwaysAdmit is not set (Scored)"
    audit: "ps -ef | grep $apiserverbin | grep -v grep"
    tests:
+      bin_op: or
      test_items:
      - flag: "--enable-admission-plugins"
        compare:
          op: nothave
          value: AlwaysAdmit
        set: true
+      - flag: "--enable-admission-plugins"
+        set: false
    remediation: |
      Edit the API server pod specification file $apiserverconf
      on the master node and set the --enable-admission-plugins parameter to a
@@ -183,8 +186,9 @@ groups:
    scored: true

  - id: 1.1.12
-    text: "Ensure that the admission control plugin DenyEscalatingExec is set (Scored)"
+    text: "[DEPRECATED] Ensure that the admission control plugin DenyEscalatingExec is set (Not Scored)"
    audit: "ps -ef | grep $apiserverbin | grep -v grep"
+    type: skip
    tests:
      test_items:
      - flag: "--enable-admission-plugins"
@@ -197,10 +201,10 @@ groups:
      on the master node and set the --enable-admission-plugins parameter to a
      value that includes DenyEscalatingExec.
      --enable-admission-plugins=...,DenyEscalatingExec,...
-    scored: true
+    scored: false

  - id: 1.1.13
-    text: "Ensure that the admission control plugin SecurityContextDeny is set (Scored)"
+    text: "Ensure that the admission control plugin SecurityContextDeny is set (Not Scored)"
    audit: "ps -ef | grep $apiserverbin | grep -v grep"
    tests:
      test_items:
@@ -441,12 +445,15 @@ groups:
    text: "Ensure that the admission control plugin ServiceAccount is set(Scored)"
    audit: "ps -ef | grep $apiserverbin | grep -v grep"
    tests:
+      bin_op: or
      test_items:
      - flag: "--enable-admission-plugins"
        compare:
          op: has
          value: "ServiceAccount"
        set: true
+      - flag: "--enable-admission-plugins"
+        set: false
    remediation: |
      Follow the documentation and create ServiceAccount objects as per your environment.
      Then, edit the API server pod specification file $apiserverconf
@@ -502,7 +509,7 @@ groups:
    remediation: |
      Edit the API server pod specification file $apiserverconf
      on the master node and set the below parameter.
-      --tls-cipher- suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM _SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM _SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM _SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256
+      --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256
    scored: false

  - id: 1.1.31
@@ -556,19 +563,19 @@ groups:
    scored: true

  - id: 1.1.34
-    text: "Ensure that the --experimental-encryption-provider-config argument is
-    set as appropriate (Scored)"
+    text: "Ensure that the --encryption-provider-config argument is set as appropriate (Scored)"
    audit: "ps -ef | grep $apiserverbin | grep -v grep"
+    type: "manual"
    tests:
      test_items:
-      - flag: "--experimental-encryption-provider-config"
+      - flag: "--encryption-provider-config"
        set: true
    remediation: |
      Follow the Kubernetes documentation and configure a EncryptionConfig file.
      Then, edit the API server pod specification file $apiserverconf on the
-      master node and set the --experimental-encryption-provider-config parameter
+      master node and set the --encryption-provider-config parameter
      to the path of that file:
-      --experimental-encryption-provider-config=</path/to/EncryptionConfig/File>
+      --encryption-provider-config=</path/to/EncryptionConfig/File>
    scored: true

  - id: 1.1.35
@@ -1219,7 +1226,7 @@ groups:
    scored: true
    
  - id: 1.4.21
-    text: "Ensure that the Kubernetes PKI certificate file permissions are set to 600 or more restrictive (Scored)"
+    text: "Ensure that the Kubernetes PKI key file permissions are set to 600 or more restrictive (Scored)"
    audit: "stat -c %n\ %a /etc/kubernetes/pki/*.key"
    type: "manual"
    tests:
@@ -1292,7 +1299,6 @@ groups:
    text: "Ensure that the --peer-cert-file and --peer-key-file arguments are
    set as appropriate (Scored)"
    audit: "ps -ef | grep $etcdbin | grep -v grep"
-    type: "manual"
    tests:
      bin_op: and
      test_items:
@@ -1311,7 +1317,6 @@ groups:
  - id: 1.5.5
    text: "Ensure that the --peer-client-cert-auth argument is set to true (Scored)"
    audit: "ps -ef | grep $etcdbin | grep -v grep"
-    type: "manual"
    tests:
      test_items:
      - flag: "--peer-client-cert-auth"
@@ -1328,7 +1333,6 @@ groups:
  - id: 1.5.6
    text: "Ensure that the --peer-auto-tls argument is not set to true (Scored)"
    audit: "ps -ef | grep $etcdbin | grep -v grep"
-    type: "manual"
    tests:
      bin_op: or
      test_items:
--- a/cfg/1.13/node.yaml
+++ b/cfg/1.13/node.yaml
@@ -22,7 +22,7 @@ groups:
      If using a Kubelet config file, edit the file to set authentication: anonymous: enabled to
      false .
      If using executable arguments, edit the kubelet service file
-      $kubeletconf on each worker node and
+      $kubeletsvc on each worker node and
      set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable.
      --anonymous-auth=false
      Based on your system, restart the kubelet service. For example:
@@ -95,12 +95,15 @@ groups:
    text: "Ensure that the --streaming-connection-idle-timeout argument is not set to 0 (Scored)"
    audit: "ps -fC $kubeletbin"
    tests:
+      bin_op: or
      test_items:
      - flag: "--streaming-connection-idle-timeout"
        compare:
          op: noteq
          value: 0
        set: true
+      - flag: "--streaming-connection-idle-timeout"
+        set: false
    remediation: |
      If using a Kubelet config file, edit the file to set streamingConnectionIdleTimeout to a
      value other than 0.
@@ -220,8 +223,9 @@ groups:
    scored: true

  - id: 2.1.11
-    text: "Ensure that the --cadvisor-port argument is set to 0 (Scored)"
+    text: "[DEPRECATED] Ensure that the --cadvisor-port argument is set to 0 (Not Scored)"
    audit: "ps -fC $kubeletbin"
+    type: skip
    tests:
      bin_op: or
      test_items:
@@ -239,18 +243,21 @@ groups:
      Based on your system, restart the kubelet service. For example:
      systemctl daemon-reload
      systemctl restart kubelet.service
-    scored: true
+    scored: false

  - id: 2.1.12
    text: "Ensure that the --rotate-certificates argument is not set to false (Scored)"
    audit: "ps -fC $kubeletbin"
    tests:
+      bin_op: or
      test_items:
      - flag: "--rotate-certificates"
        compare:
          op: eq
          value: true
        set: true
+      - flag: "--rotate-certificates"
+        set: false
    remediation: |
      If using a Kubelet config file, edit the file to add the line rotateCertificates: true.
      If using command line arguments, edit the kubelet service file $kubeletsvc 
@@ -290,8 +297,8 @@ groups:
          value: "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256"
        set: true
    remediation: |
-      If using a Kubelet config file, edit the file to set TLSCipherSuites: to TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 ,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 ,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 ,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256
-      If using executable arguments, edit the kubelet service file $kubeletconf on each worker node and set the below parameter.
+      If using a Kubelet config file, edit the file to set TLSCipherSuites: to TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256
+      If using executable arguments, edit the kubelet service file $kubeletsvc on each worker node and set the below parameter.
      --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256
    scored: false

@@ -434,8 +441,14 @@ groups:

    - id: 2.2.8
      text: "Ensure that the client certificate authorities file ownership is set to root:root (Scored)"
-      audit: "/bin/sh -c 'if test -e $ca-file; then stat -c %U:%G $ca-file; fi'"
-      type: manual
+      audit: "/bin/sh -c 'if test -e $kubeletcafile; then stat -c %U:%G $kubeletcafile; fi'"
+      tests:
+        test_items:
+          - flag: "root:root"
+            compare:
+              op: eq
+              value: root:root
+            set: true
      remediation: |
        Run the following command to modify the ownership of the --client-ca-file .
        chown root:root <filename>
--- a/cfg/1.6/node.yaml
+++ b/cfg/1.6/node.yaml
@@ -83,7 +83,7 @@ groups:
        test_items:
          - flag: "--streaming-connection-idle-timeout"
            compare:
-              op: gt
+              op: noteq
              value: 0
            set: true
      remediation: "Edit the $kubeletconf file on each node and set the KUBELET_ARGS 
--- a/cfg/1.8/node.yaml
+++ b/cfg/1.8/node.yaml
@@ -430,9 +430,15 @@ groups:
      scored: true

    - id: 2.2.8
-      text: "Ensure that the client certificate authorities file ownership is set to root:root"
-      audit: "/bin/sh -c 'if test -e $ca-file; then stat -c %U:%G $ca-file; fi'"
-      type: manual
+      text: "Ensure that the client certificate authorities file ownership is set to root:root (Scored)"
+      audit: "/bin/sh -c 'if test -e $kubeletcafile; then stat -c %U:%G $kubeletcafile; fi'"
+      tests:
+        test_items:
+          - flag: "root:root"
+            compare:
+              op: eq
+              value: root:root
+            set: true
      remediation: |
        Run the following command to modify the ownership of the --client-ca-file .
        chown root:root <filename>
--- a/cfg/config.yaml
+++ b/cfg/config.yaml
@@ -1,5 +1,5 @@
 ---
-## Controls Files. 
+## Controls Files.
 # These are YAML files that hold all the details for running checks.
 #
 ## Uncomment to use different control file paths.
@@ -12,7 +12,7 @@ master:
    - apiserver
    - scheduler
    - controllermanager
-    - etcd 
+    - etcd
    - flanneld
    # kubernetes is a component to cover the config file /etc/kubernetes/config that is referred to in the benchmark
    - kubernetes
@@ -45,6 +45,7 @@ master:
  controllermanager:
    bins:
      - "kube-controller-manager"
+      - "kube-controller"
      - "hyperkube controller-manager"
      - "hyperkube kube-controller-manager"
      - "controller-manager"
@@ -77,28 +78,57 @@ node:
    - kubernetes

  kubernetes:
-    defaultconf: /etc/kubernetes/config    
+    defaultconf: "/etc/kubernetes/config"

  kubelet:
+    cafile:
+      - "/etc/kubernetes/pki/ca.crt"
+      - "/etc/kubernetes/certs/ca.crt"
+      - "/etc/kubernetes/cert/ca.pem"
+    svc: 
+      # These paths must also be included
+      #  in the 'confs' property below
+      - "/etc/systemd/system/kubelet.service.d/10-kubeadm.conf"
+      - "/etc/systemd/system/kubelet.service"
+      - "/lib/systemd/system/kubelet.service"
    bins:
      - "hyperkube kubelet"
      - "kubelet"
+    kubeconfig:
+      - "/etc/kubernetes/kubelet.conf"
+      - "/var/lib/kubelet/kubeconfig"
+      - "/etc/kubernetes/kubelet-kubeconfig"
    confs:
      - "/var/lib/kubelet/config.yaml"
      - "/etc/kubernetes/kubelet/kubelet-config.json"
      - "/home/kubernetes/kubelet-config.yaml"
+      - "/etc/default/kubelet"
+      ## Due to the fact that the kubelet might be configured
+      ## without a kubelet-config file, we use a work-around
+      ## of pointing to the systemd service file (which can also
+      ## hold kubelet configuration).
+      ## Note: The following paths must match the one under 'svc'
+      - "/etc/systemd/system/kubelet.service.d/10-kubeadm.conf"
+      - "/etc/systemd/system/kubelet.service"
+      - "/lib/systemd/system/kubelet.service"
    defaultconf: "/var/lib/kubelet/config.yaml"
    defaultsvc: "/etc/systemd/system/kubelet.service.d/10-kubeadm.conf"
    defaultkubeconfig: "/etc/kubernetes/kubelet.conf"
+    defaultcafile: "/etc/kubernetes/pki/ca.crt"

  proxy:
    bins:
      - "kube-proxy"
      - "hyperkube proxy"
+      - "hyperkube kube-proxy"
      - "proxy"
    confs:
      - /etc/kubernetes/proxy
      - /etc/kubernetes/addons/kube-proxy-daemonset.yaml
+    kubeconfig:
+      - /etc/kubernetes/kubelet-kubeconfig
+    svc:
+      - "/lib/systemd/system/kube-proxy.service"
    defaultconf: /etc/kubernetes/addons/kube-proxy-daemonset.yaml
    defaultkubeconfig: "/etc/kubernetes/proxy.conf"

--- a/cfg/ocp-3.10/federated.yaml
+++ b/cfg/ocp-3.10/federated.yaml
@@ -1,113 +0,0 @@
---
-controls:
-id: 3
-text: "Federated Deployments"
-type: "federated"
-groups:
- id: 3.1
-  text: "Federated API Server"
-  checks:
-  - id: 3.1.1
-    text: "Ensure that the --anonymous-auth argument is set to false (Scored)"
-    type: "skip"
-    scored: true
-
-  - id: 3.1.2
-    text: "Ensure that the --basic-auth-file argument is not set (Scored)"
-    type: "skip"
-    scored: true
-
-  - id: 3.1.3
-    text: "Ensure that the --insecure-allow-any-token argument is not set (Scored)"
-    type: "skip"
-    scored: true
-
-  - id: 3.1.4
-    text: "Ensure that the --insecure-bind-address argument is not set (Scored)"
-    type: "skip"
-    scored: true
-
-  - id: 3.1.5
-    text: "Ensure that the --insecure-port argument is set to 0 (Scored)"
-    type: "skip"
-    scored: true
-
-  - id: 3.1.6
-    text: "Ensure that the --secure-port argument is not set to 0 (Scored)"
-    type: "skip"
-    scored: true
-
-  - id: 3.1.7
-    text: "Ensure that the --profiling argument is set to false (Scored)"
-    type: "skip"
-    scored: true
-
-  - id: 3.1.8
-    text: "Ensure that the admission control policy is not set to AlwaysAdmit (Scored)"
-    type: "skip"
-    scored: true
-
-  - id: 3.1.9
-    text: "Ensure that the admission control policy is set to NamespaceLifecycle (Scored)"
-    type: "skip"
-    scored: true
-
-  - id: 3.1.10
-    text: "Ensure that the --audit-log-path argument is set as appropriate (Scored)"
-    type: "skip"
-    scored: true
-
-  - id: 3.1.11
-    text: "Ensure that the --audit-log-maxage argument is set to 30 or as appropriate (Scored)"
-    type: "skip"
-    scored: true
-
-  - id: 3.1.12
-    text: "Ensure that the --audit-log-maxbackup argument is set to 10 or as appropriate (Scored)"
-    type: "skip"
-    scored: true
-
-  - id: 3.1.13
-    text: "Ensure that the --audit-log-maxsize argument is set to 100 or as appropriate (Scored)"
-    type: "skip"
-    scored: true
-
-  - id: 3.1.14
-    text: "Ensure that the --authorization-mode argument is not set to AlwaysAllow (Scored)"
-    type: "skip"
-    scored: true
-
-  - id: 3.1.15
-    text: "Ensure that the --token-auth-file parameter is not set (Scored)"
-    type: "skip"
-    scored: true
-
-  - id: 3.1.16
-    text: "Ensure that the --service-account-lookup argument is set to true (Scored)"
-    type: "skip"
-    scored: true
-
-  - id: 3.1.17
-    text: "Ensure that the --service-account-key-file argument is set as appropriate (Scored)"
-    type: "skip"
-    scored: true
-
-  - id: 3.1.18
-    text: "Ensure that the --etcd-certfile and --etcd-keyfile arguments are set as appropriate (Scored)"
-    type: "skip"
-    scored: true
-
-  - id: 3.1.19
-    text: "Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate (Scored)"
-    type: "skip"
-    scored: true
-
-
- id: 3.2
-  text: "Federation Controller Manager"
-  checks:
-  - id: 3.2.1
-    text: "Ensure that the --profiling argument is set to false (Scored)"
-    type: "skip"
-    scored: true
-
--- a/cfg/ocp-3.11/federated.yaml
+++ b/cfg/ocp-3.11/federated.yaml
@@ -1,113 +0,0 @@
---
-controls:
-id: 3
-text: "Federated Deployments"
-type: "federated"
-groups:
- id: 3.1
-  text: "Federated API Server"
-  checks:
-  - id: 3.1.1
-    text: "Ensure that the --anonymous-auth argument is set to false (Scored)"
-    type: "skip"
-    scored: true
-
-  - id: 3.1.2
-    text: "Ensure that the --basic-auth-file argument is not set (Scored)"
-    type: "skip"
-    scored: true
-
-  - id: 3.1.3
-    text: "Ensure that the --insecure-allow-any-token argument is not set (Scored)"
-    type: "skip"
-    scored: true
-
-  - id: 3.1.4
-    text: "Ensure that the --insecure-bind-address argument is not set (Scored)"
-    type: "skip"
-    scored: true
-
-  - id: 3.1.5
-    text: "Ensure that the --insecure-port argument is set to 0 (Scored)"
-    type: "skip"
-    scored: true
-
-  - id: 3.1.6
-    text: "Ensure that the --secure-port argument is not set to 0 (Scored)"
-    type: "skip"
-    scored: true
-
-  - id: 3.1.7
-    text: "Ensure that the --profiling argument is set to false (Scored)"
-    type: "skip"
-    scored: true
-
-  - id: 3.1.8
-    text: "Ensure that the admission control policy is not set to AlwaysAdmit (Scored)"
-    type: "skip"
-    scored: true
-
-  - id: 3.1.9
-    text: "Ensure that the admission control policy is set to NamespaceLifecycle (Scored)"
-    type: "skip"
-    scored: true
-
-  - id: 3.1.10
-    text: "Ensure that the --audit-log-path argument is set as appropriate (Scored)"
-    type: "skip"
-    scored: true
-
-  - id: 3.1.11
-    text: "Ensure that the --audit-log-maxage argument is set to 30 or as appropriate (Scored)"
-    type: "skip"
-    scored: true
-
-  - id: 3.1.12
-    text: "Ensure that the --audit-log-maxbackup argument is set to 10 or as appropriate (Scored)"
-    type: "skip"
-    scored: true
-
-  - id: 3.1.13
-    text: "Ensure that the --audit-log-maxsize argument is set to 100 or as appropriate (Scored)"
-    type: "skip"
-    scored: true
-
-  - id: 3.1.14
-    text: "Ensure that the --authorization-mode argument is not set to AlwaysAllow (Scored)"
-    type: "skip"
-    scored: true
-
-  - id: 3.1.15
-    text: "Ensure that the --token-auth-file parameter is not set (Scored)"
-    type: "skip"
-    scored: true
-
-  - id: 3.1.16
-    text: "Ensure that the --service-account-lookup argument is set to true (Scored)"
-    type: "skip"
-    scored: true
-
-  - id: 3.1.17
-    text: "Ensure that the --service-account-key-file argument is set as appropriate (Scored)"
-    type: "skip"
-    scored: true
-
-  - id: 3.1.18
-    text: "Ensure that the --etcd-certfile and --etcd-keyfile arguments are set as appropriate (Scored)"
-    type: "skip"
-    scored: true
-
-  - id: 3.1.19
-    text: "Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate (Scored)"
-    type: "skip"
-    scored: true
-
-
- id: 3.2
-  text: "Federation Controller Manager"
-  checks:
-  - id: 3.2.1
-    text: "Ensure that the --profiling argument is set to false (Scored)"
-    type: "skip"
-    scored: true
-
--- a/check/check.go
+++ b/check/check.go
@@ -60,18 +60,18 @@ func handleError(err error, context string) (errmsg string) {
 // Check contains information about a recommendation in the
 // CIS Kubernetes 1.6+ document.
 type Check struct {
-	ID          string      `yaml:"id" json:"test_number"`
-	Text        string      `json:"test_desc"`
-	Audit       string      `json:"audit"`
-	Type        string      `json:"type"`
-	Commands    []*exec.Cmd `json:"omit"`
-	Tests       *tests      `json:"omit"`
-	Set         bool        `json:"omit"`
-	Remediation string      `json:"remediation"`
-	TestInfo    []string    `json:"test_info"`
-	State       `json:"status"`
-	ActualValue string `json:"actual_value"`
-	Scored      bool   `json:"scored"`
+	ID             string      `yaml:"id" json:"test_number"`
+	Text           string      `json:"test_desc"`
+	Audit          string      `json:"audit"`
+	Type           string      `json:"type"`
+	Commands       []*exec.Cmd `json:"omit"`
+	Tests          *tests      `json:"omit"`
+	Set            bool        `json:"omit"`
+	Remediation    string      `json:"remediation"`
+	TestInfo       []string    `json:"test_info"`
+	State          `json:"status"`
+	ActualValue    string `json:"actual_value"`
+	Scored         bool   `json:"scored"`
 	ExpectedResult string `json:"expected_result"`
 }

@@ -102,8 +102,8 @@ func (c *Check) run() State {
 		return c.State
 	}

-	// If check type is manual or the check is not scored, force result to WARN
-	if c.Type == "manual" || !c.Scored {
+	// If check type is manual force result to WARN
+	if c.Type == "manual" {
 		c.State = WARN
 		return c.State
 	}
@@ -193,7 +193,11 @@ func (c *Check) run() State {
 		if finalOutput.testResult {
 			c.State = PASS
 		} else {
-			c.State = FAIL
+			if c.Scored {
+				c.State = FAIL
+			} else {
+				c.State = WARN
+			}
 		}
 	} else {
 		errmsgs += handleError(
--- a/check/data
+++ b/check/data
@@ -297,3 +297,13 @@ groups:
              op: eq
              value: "false"
            set: true
+
+    - id: 26
+      text: "check regex op matches"
+      tests:
+        test_items:
+          - path: "{.currentMasterVersion}"
+            compare:
+              op: regex
+              value: '^1\.12.*$'
+            set: true
--- a/check/test.go
+++ b/check/test.go
@@ -37,8 +37,9 @@ import (
 type binOp string

 const (
-	and binOp = "and"
-	or        = "or"
+	and                   binOp = "and"
+	or                          = "or"
+	defaultArraySeparator       = ","
 )

 type testItem struct {
@@ -56,8 +57,8 @@ type compare struct {
 }

 type testOutput struct {
-	testResult   bool
-	actualResult string
+	testResult     bool
+	actualResult   string
 	ExpectedResult string
 }

@@ -76,36 +77,22 @@ func (t *testItem) execute(s string) *testOutput {
 	} else {
 		// Path != "" - we don't know whether it's YAML or JSON but
 		// we can just try one then the other
-		buf := new(bytes.Buffer)
 		var jsonInterface interface{}

 		if t.Path != "" {
-			err := json.Unmarshal([]byte(s), &jsonInterface)
+			err := unmarshal(s, &jsonInterface)
 			if err != nil {
-				err := yaml.Unmarshal([]byte(s), &jsonInterface)
-				if err != nil {
-					fmt.Fprintf(os.Stderr, "failed to load YAML or JSON from provided input \"%s\": %v\n", s, err)
-					return failTestItem("failed to load YAML or JSON")
-				}
+				fmt.Fprintf(os.Stderr, "failed to load YAML or JSON from provided input \"%s\": %v\n", s, err)
+				return failTestItem("failed to load YAML or JSON")
 			}
+
 		}

-		// Parse the jsonpath/yamlpath expression...
-		j := jsonpath.New("jsonpath")
-		j.AllowMissingKeys(true)
-		err := j.Parse(t.Path)
+		jsonpathResult, err := executeJSONPath(t.Path, &jsonInterface)
 		if err != nil {
 			fmt.Fprintf(os.Stderr, "unable to parse path expression \"%s\": %v\n", t.Path, err)
-			return failTestItem("unable to parse path expression")
-		}
-
-		err = j.Execute(buf, jsonInterface)
-		if err != nil {
-			fmt.Fprintf(os.Stderr, "error executing path expression \"%s\": %v\n", t.Path, err)
 			return failTestItem("error executing path expression")
 		}
-
-		jsonpathResult := fmt.Sprintf("%s", buf)
 		match = (jsonpathResult != "")
 		flagVal = jsonpathResult
 	}
@@ -136,58 +123,7 @@ func (t *testItem) execute(s string) *testOutput {
 				}
 			}

-			expectedResultPattern := ""
-			switch t.Compare.Op {
-			case "eq":
-				expectedResultPattern = "'%s' is equal to '%s'"
-				value := strings.ToLower(flagVal)
-				// Do case insensitive comparaison for booleans ...
-				if value == "false" || value == "true" {
-					result.testResult = value == t.Compare.Value
-				} else {
-					result.testResult = flagVal == t.Compare.Value
-				}
-
-			case "noteq":
-				expectedResultPattern = "'%s' is not equal to '%s'"
-				value := strings.ToLower(flagVal)
-				// Do case insensitive comparaison for booleans ...
-				if value == "false" || value == "true" {
-					result.testResult = !(value == t.Compare.Value)
-				} else {
-					result.testResult = !(flagVal == t.Compare.Value)
-				}
-
-			case "gt":
-				expectedResultPattern = "%s is greater then %s"
-				a, b := toNumeric(flagVal, t.Compare.Value)
-				result.testResult = a > b
-
-			case "gte":
-				expectedResultPattern = "%s is greater or equal to %s"
-				a, b := toNumeric(flagVal, t.Compare.Value)
-				result.testResult = a >= b
-
-			case "lt":
-				expectedResultPattern = "%s is lower then %s"
-				a, b := toNumeric(flagVal, t.Compare.Value)
-				result.testResult = a < b
-
-			case "lte":
-				expectedResultPattern = "%s is lower or equal to %s"
-				a, b := toNumeric(flagVal, t.Compare.Value)
-				result.testResult = a <= b
-
-			case "has":
-				expectedResultPattern = "'%s' has '%s'"
-				result.testResult = strings.Contains(flagVal, t.Compare.Value)
-
-			case "nothave":
-				expectedResultPattern = " '%s' not have '%s'"
-				result.testResult = !strings.Contains(flagVal, t.Compare.Value)
-			}
-
-			result.ExpectedResult = fmt.Sprintf(expectedResultPattern, t.Flag, t.Compare.Value)
+			result.ExpectedResult, result.testResult = compareOp(t.Compare.Op, flagVal, t.Compare.Value)
 		} else {
 			result.ExpectedResult = fmt.Sprintf("'%s' is present", t.Flag)
 			result.testResult = isset
@@ -200,6 +136,153 @@ func (t *testItem) execute(s string) *testOutput {
 	return result
 }

+func compareOp(tCompareOp string, flagVal string, tCompareValue string) (string, bool) {
+
+	expectedResultPattern := ""
+	testResult := false
+
+	switch tCompareOp {
+	case "eq":
+		expectedResultPattern = "'%s' is equal to '%s'"
+		value := strings.ToLower(flagVal)
+		// Do case insensitive comparaison for booleans ...
+		if value == "false" || value == "true" {
+			testResult = value == tCompareValue
+		} else {
+			testResult = flagVal == tCompareValue
+		}
+
+	case "noteq":
+		expectedResultPattern = "'%s' is not equal to '%s'"
+		value := strings.ToLower(flagVal)
+		// Do case insensitive comparaison for booleans ...
+		if value == "false" || value == "true" {
+			testResult = !(value == tCompareValue)
+		} else {
+			testResult = !(flagVal == tCompareValue)
+		}
+
+	case "gt":
+		expectedResultPattern = "%s is greater than %s"
+		a, b := toNumeric(flagVal, tCompareValue)
+		testResult = a > b
+
+	case "gte":
+		expectedResultPattern = "%s is greater or equal to %s"
+		a, b := toNumeric(flagVal, tCompareValue)
+		testResult = a >= b
+
+	case "lt":
+		expectedResultPattern = "%s is lower than %s"
+		a, b := toNumeric(flagVal, tCompareValue)
+		testResult = a < b
+
+	case "lte":
+		expectedResultPattern = "%s is lower or equal to %s"
+		a, b := toNumeric(flagVal, tCompareValue)
+		testResult = a <= b
+
+	case "has":
+		expectedResultPattern = "'%s' has '%s'"
+		testResult = strings.Contains(flagVal, tCompareValue)
+
+	case "nothave":
+		expectedResultPattern = " '%s' not have '%s'"
+		testResult = !strings.Contains(flagVal, tCompareValue)
+
+	case "regex":
+		expectedResultPattern = " '%s' matched by '%s'"
+		opRe := regexp.MustCompile(tCompareValue)
+		testResult = opRe.MatchString(flagVal)
+
+	case "valid_elements":
+		expectedResultPattern = "'%s' contains valid elements from '%s'"
+		s := splitAndRemoveLastSeparator(flagVal, defaultArraySeparator)
+		target := splitAndRemoveLastSeparator(tCompareValue, defaultArraySeparator)
+		testResult = allElementsValid(s, target)
+
+	}
+
+	if expectedResultPattern == "" {
+		return expectedResultPattern, testResult
+	}
+
+	return fmt.Sprintf(expectedResultPattern, flagVal, tCompareValue), testResult
+}
+
+func unmarshal(s string, jsonInterface *interface{}) error {
+	data := []byte(s)
+	err := json.Unmarshal(data, jsonInterface)
+	if err != nil {
+		err := yaml.Unmarshal(data, jsonInterface)
+		if err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+func executeJSONPath(path string, jsonInterface interface{}) (string, error) {
+	j := jsonpath.New("jsonpath")
+	j.AllowMissingKeys(true)
+	err := j.Parse(path)
+	if err != nil {
+		return "", err
+	}
+
+	buf := new(bytes.Buffer)
+	err = j.Execute(buf, jsonInterface)
+	if err != nil {
+		return "", err
+	}
+	jsonpathResult := fmt.Sprintf("%s", buf)
+	return jsonpathResult, nil
+}
+
+func allElementsValid(s, t []string) bool {
+	sourceEmpty := s == nil || len(s) == 0
+	targetEmpty := t == nil || len(t) == 0
+
+	if sourceEmpty && targetEmpty {
+		return true
+	}
+
+	// XOR comparison -
+	//     if either value is empty and the other is not empty,
+	//     not all elements are valid
+	if (sourceEmpty || targetEmpty) && !(sourceEmpty && targetEmpty) {
+		return false
+	}
+
+	for _, sv := range s {
+		found := false
+		for _, tv := range t {
+			if sv == tv {
+				found = true
+				break
+			}
+		}
+		if !found {
+			return false
+		}
+	}
+	return true
+}
+
+func splitAndRemoveLastSeparator(s, sep string) []string {
+	cleanS := strings.TrimRight(strings.TrimSpace(s), sep)
+	if len(cleanS) == 0 {
+		return []string{}
+	}
+
+	ts := strings.Split(cleanS, sep)
+	for i := range ts {
+		ts[i] = strings.TrimSpace(ts[i])
+	}
+
+	return ts
+}
+
 type tests struct {
 	TestItems []*testItem `yaml:"test_items"`
 	BinOp     binOp       `yaml:"bin_op"`
--- a/check/test_test.go
+++ b/check/test_test.go
@@ -152,6 +152,10 @@ func TestTestExecute(t *testing.T) {
 			controls.Groups[0].Checks[22],
 			"authentication:\n  anonymous:\n    enabled: false",
 		},
+		{
+			controls.Groups[0].Checks[26],
+			"currentMasterVersion: 1.12.7",
+		},
 	}

 	for _, c := range cases {
@@ -180,6 +184,14 @@ func TestTestExecuteExceptions(t *testing.T) {
 			controls.Groups[0].Checks[25],
 			"broken } yaml\nenabled: true",
 		},
+		{
+			controls.Groups[0].Checks[26],
+			"currentMasterVersion: 1.11",
+		},
+		{
+			controls.Groups[0].Checks[26],
+			"currentMasterVersion: ",
+		},
 	}

 	for _, c := range cases {
@@ -189,3 +201,458 @@ func TestTestExecuteExceptions(t *testing.T) {
 		}
 	}
 }
+
+func TestTestUnmarshal(t *testing.T) {
+	type kubeletConfig struct {
+		Kind       string
+		ApiVersion string
+		Address    string
+	}
+	cases := []struct {
+		content        string
+		jsonInterface  interface{}
+		expectedToFail bool
+	}{
+		{
+			`{
+			"kind": "KubeletConfiguration",
+			"apiVersion": "kubelet.config.k8s.io/v1beta1",
+			"address": "0.0.0.0"
+			}
+			`,
+			kubeletConfig{},
+			false,
+		}, {
+			`
+kind: KubeletConfiguration
+address: 0.0.0.0
+apiVersion: kubelet.config.k8s.io/v1beta1
+authentication:
+  anonymous:
+    enabled: false
+  webhook:
+    cacheTTL: 2m0s
+  enabled: true
+  x509:
+    clientCAFile: /etc/kubernetes/pki/ca.crt
+tlsCipherSuites:
+  - TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
+  - TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
+`,
+			kubeletConfig{},
+			false,
+		},
+		{
+			`
+kind: ddress: 0.0.0.0
+apiVersion: kubelet.config.k8s.io/v1beta
+`,
+			kubeletConfig{},
+			true,
+		},
+	}
+
+	for _, c := range cases {
+		err := unmarshal(c.content, &c.jsonInterface)
+		if err != nil {
+			if !c.expectedToFail {
+				t.Errorf("%s, expectedToFail:%v, got:%v\n", c.content, c.expectedToFail, err)
+			}
+		} else {
+			if c.expectedToFail {
+				t.Errorf("%s, expectedToFail:%v, got:Did not fail\n", c.content, c.expectedToFail)
+			}
+		}
+	}
+}
+
+func TestExecuteJSONPath(t *testing.T) {
+	type kubeletConfig struct {
+		Kind       string
+		ApiVersion string
+		Address    string
+	}
+	cases := []struct {
+		jsonPath       string
+		jsonInterface  kubeletConfig
+		expectedResult string
+		expectedToFail bool
+	}{
+		{
+			// JSONPath parse works, results don't match
+			"{.Kind}",
+			kubeletConfig{
+				Kind:       "KubeletConfiguration",
+				ApiVersion: "kubelet.config.k8s.io/v1beta1",
+				Address:    "127.0.0.0",
+			},
+			"blah",
+			true,
+		},
+		{
+			// JSONPath parse works, results match
+			"{.Kind}",
+			kubeletConfig{
+				Kind:       "KubeletConfiguration",
+				ApiVersion: "kubelet.config.k8s.io/v1beta1",
+				Address:    "127.0.0.0",
+			},
+			"KubeletConfiguration",
+			false,
+		},
+		{
+			// JSONPath parse fails
+			"{.ApiVersion",
+			kubeletConfig{
+				Kind:       "KubeletConfiguration",
+				ApiVersion: "kubelet.config.k8s.io/v1beta1",
+				Address:    "127.0.0.0",
+			},
+			"",
+			true,
+		},
+	}
+	for _, c := range cases {
+		result, err := executeJSONPath(c.jsonPath, c.jsonInterface)
+		if err != nil && !c.expectedToFail {
+			t.Fatalf("jsonPath:%q, expectedResult:%q got:%v\n", c.jsonPath, c.expectedResult, err)
+		}
+		if c.expectedResult != result && !c.expectedToFail {
+			t.Errorf("jsonPath:%q, expectedResult:%q got:%q\n", c.jsonPath, c.expectedResult, result)
+		}
+	}
+}
+
+func TestAllElementsValid(t *testing.T) {
+	cases := []struct {
+		source []string
+		target []string
+		valid  bool
+	}{
+		{
+			source: []string{},
+			target: []string{},
+			valid:  true,
+		},
+		{
+			source: []string{"blah"},
+			target: []string{},
+			valid:  false,
+		},
+		{
+			source: []string{},
+			target: []string{"TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256",
+				"TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305", "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384",
+				"TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305", "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384",
+				"TLS_RSA_WITH_AES_256_GCM_SHA384", "TLS_RSA_WITH_AES_128_GCM_SHA256"},
+			valid: false,
+		},
+		{
+			source: []string{"TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256"},
+			target: []string{"TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256",
+				"TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305", "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384",
+				"TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305", "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384",
+				"TLS_RSA_WITH_AES_256_GCM_SHA384", "TLS_RSA_WITH_AES_128_GCM_SHA256"},
+			valid: true,
+		},
+		{
+			source: []string{"blah"},
+			target: []string{"TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256",
+				"TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305", "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384",
+				"TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305", "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384",
+				"TLS_RSA_WITH_AES_256_GCM_SHA384", "TLS_RSA_WITH_AES_128_GCM_SHA256"},
+			valid: false,
+		},
+		{
+			source: []string{"TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "blah"},
+			target: []string{"TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256",
+				"TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305", "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384",
+				"TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305", "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384",
+				"TLS_RSA_WITH_AES_256_GCM_SHA384", "TLS_RSA_WITH_AES_128_GCM_SHA256"},
+			valid: false,
+		},
+	}
+	for _, c := range cases {
+		if !allElementsValid(c.source, c.target) && c.valid {
+			t.Errorf("Not All Elements in %q are found in %q \n", c.source, c.target)
+		}
+	}
+}
+
+func TestSplitAndRemoveLastSeparator(t *testing.T) {
+	cases := []struct {
+		source     string
+		valid      bool
+		elementCnt int
+	}{
+		{
+			source:     "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256",
+			valid:      true,
+			elementCnt: 8,
+		},
+		{
+			source:     "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,",
+			valid:      true,
+			elementCnt: 2,
+		},
+		{
+			source:     "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,",
+			valid:      true,
+			elementCnt: 2,
+		},
+		{
+			source:     "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, ",
+			valid:      true,
+			elementCnt: 2,
+		},
+		{
+			source:     " TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,",
+			valid:      true,
+			elementCnt: 2,
+		},
+	}
+
+	for _, c := range cases {
+		as := splitAndRemoveLastSeparator(c.source, defaultArraySeparator)
+		if len(as) == 0 && c.valid {
+			t.Errorf("Split did not work with %q \n", c.source)
+		}
+
+		if c.elementCnt != len(as) {
+			t.Errorf("Split did not work with %q expected: %d got: %d\n", c.source, c.elementCnt, len(as))
+		}
+
+	}
+}
+
+func TestCompareOp(t *testing.T) {
+	cases := []struct {
+		label                 string
+		op                    string
+		flagVal               string
+		compareValue          string
+		expectedResultPattern string
+		testResult            bool
+	}{
+		// Test Op not matching
+		{label: "empty - op", op: "", flagVal: "", compareValue: "", expectedResultPattern: "", testResult: false},
+		{label: "op=blah", op: "blah", flagVal: "foo", compareValue: "bar", expectedResultPattern: "", testResult: false},
+
+		// Test Op "eq"
+		{label: "op=eq, both empty", op: "eq", flagVal: "", compareValue: "", expectedResultPattern: "'' is equal to ''", testResult: true},
+
+		{label: "op=eq, true==true", op: "eq", flagVal: "true",
+			compareValue:          "true",
+			expectedResultPattern: "'true' is equal to 'true'",
+			testResult:            true},
+
+		{label: "op=eq, false==false", op: "eq", flagVal: "false",
+			compareValue:          "false",
+			expectedResultPattern: "'false' is equal to 'false'",
+			testResult:            true},
+
+		{label: "op=eq, false==true", op: "eq", flagVal: "false",
+			compareValue:          "true",
+			expectedResultPattern: "'false' is equal to 'true'",
+			testResult:            false},
+
+		{label: "op=eq, strings match", op: "eq", flagVal: "KubeletConfiguration",
+			compareValue:          "KubeletConfiguration",
+			expectedResultPattern: "'KubeletConfiguration' is equal to 'KubeletConfiguration'",
+			testResult:            true},
+
+		{label: "op=eq, flagVal=empty", op: "eq", flagVal: "",
+			compareValue:          "KubeletConfiguration",
+			expectedResultPattern: "'' is equal to 'KubeletConfiguration'",
+			testResult:            false},
+
+		{label: "op=eq, compareValue=empty", op: "eq", flagVal: "KubeletConfiguration",
+			compareValue:          "",
+			expectedResultPattern: "'KubeletConfiguration' is equal to ''",
+			testResult:            false},
+
+		// Test Op "noteq"
+		{label: "op=noteq, both empty", op: "noteq", flagVal: "",
+			compareValue: "", expectedResultPattern: "'' is not equal to ''",
+			testResult: false},
+
+		{label: "op=noteq, true!=true", op: "noteq", flagVal: "true",
+			compareValue:          "true",
+			expectedResultPattern: "'true' is not equal to 'true'",
+			testResult:            false},
+
+		{label: "op=noteq, false!=false", op: "noteq", flagVal: "false",
+			compareValue:          "false",
+			expectedResultPattern: "'false' is not equal to 'false'",
+			testResult:            false},
+
+		{label: "op=noteq, false!=true", op: "noteq", flagVal: "false",
+			compareValue:          "true",
+			expectedResultPattern: "'false' is not equal to 'true'",
+			testResult:            true},
+
+		{label: "op=noteq, strings match", op: "noteq", flagVal: "KubeletConfiguration",
+			compareValue:          "KubeletConfiguration",
+			expectedResultPattern: "'KubeletConfiguration' is not equal to 'KubeletConfiguration'",
+			testResult:            false},
+
+		{label: "op=noteq, flagVal=empty", op: "noteq", flagVal: "",
+			compareValue:          "KubeletConfiguration",
+			expectedResultPattern: "'' is not equal to 'KubeletConfiguration'",
+			testResult:            true},
+
+		{label: "op=noteq, compareValue=empty", op: "noteq", flagVal: "KubeletConfiguration",
+			compareValue:          "",
+			expectedResultPattern: "'KubeletConfiguration' is not equal to ''",
+			testResult:            true},
+
+		// Test Op "gt"
+		// TODO: test for non-numeric values.
+		//        toNumeric function currently uses os.Exit, which stops tests.
+		// {label: "op=gt, both empty", op: "gt", flagVal: "",
+		// 	compareValue: "", expectedResultPattern: "'' is greater than ''",
+		// 	testResult: true},
+		{label: "op=gt, 0 > 0", op: "gt", flagVal: "0",
+			compareValue: "0", expectedResultPattern: "0 is greater than 0",
+			testResult: false},
+		{label: "op=gt, 4 > 5", op: "gt", flagVal: "4",
+			compareValue: "5", expectedResultPattern: "4 is greater than 5",
+			testResult: false},
+		{label: "op=gt, 5 > 4", op: "gt", flagVal: "5",
+			compareValue: "4", expectedResultPattern: "5 is greater than 4",
+			testResult: true},
+		{label: "op=gt, 5 > 5", op: "gt", flagVal: "5",
+			compareValue: "5", expectedResultPattern: "5 is greater than 5",
+			testResult: false},
+
+		// Test Op "lt"
+		// TODO: test for non-numeric values.
+		//        toNumeric function currently uses os.Exit, which stops tests.
+		// {label: "op=lt, both empty", op: "lt", flagVal: "",
+		// 	compareValue: "", expectedResultPattern: "'' is lower than ''",
+		// 	testResult: true},
+		{label: "op=gt, 0 < 0", op: "lt", flagVal: "0",
+			compareValue: "0", expectedResultPattern: "0 is lower than 0",
+			testResult: false},
+		{label: "op=gt, 4 < 5", op: "lt", flagVal: "4",
+			compareValue: "5", expectedResultPattern: "4 is lower than 5",
+			testResult: true},
+		{label: "op=gt, 5 < 4", op: "lt", flagVal: "5",
+			compareValue: "4", expectedResultPattern: "5 is lower than 4",
+			testResult: false},
+		{label: "op=gt, 5 < 5", op: "lt", flagVal: "5",
+			compareValue: "5", expectedResultPattern: "5 is lower than 5",
+			testResult: false},
+
+		// Test Op "gte"
+		// TODO: test for non-numeric values.
+		//        toNumeric function currently uses os.Exit, which stops tests.
+		// {label: "op=gt, both empty", op: "gte", flagVal: "",
+		// 	compareValue: "", expectedResultPattern: "'' is greater or equal to ''",
+		// 	testResult: true},
+		{label: "op=gt, 0 >= 0", op: "gte", flagVal: "0",
+			compareValue: "0", expectedResultPattern: "0 is greater or equal to 0",
+			testResult: true},
+		{label: "op=gt, 4 >= 5", op: "gte", flagVal: "4",
+			compareValue: "5", expectedResultPattern: "4 is greater or equal to 5",
+			testResult: false},
+		{label: "op=gt, 5 >= 4", op: "gte", flagVal: "5",
+			compareValue: "4", expectedResultPattern: "5 is greater or equal to 4",
+			testResult: true},
+		{label: "op=gt, 5 >= 5", op: "gte", flagVal: "5",
+			compareValue: "5", expectedResultPattern: "5 is greater or equal to 5",
+			testResult: true},
+
+		// Test Op "lte"
+		// TODO: test for non-numeric values.
+		//        toNumeric function currently uses os.Exit, which stops tests.
+		// {label: "op=gt, both empty", op: "lte", flagVal: "",
+		// 	compareValue: "", expectedResultPattern: "'' is lower or equal to ''",
+		// 	testResult: true},
+		{label: "op=gt, 0 <= 0", op: "lte", flagVal: "0",
+			compareValue: "0", expectedResultPattern: "0 is lower or equal to 0",
+			testResult: true},
+		{label: "op=gt, 4 <= 5", op: "lte", flagVal: "4",
+			compareValue: "5", expectedResultPattern: "4 is lower or equal to 5",
+			testResult: true},
+		{label: "op=gt, 5 <= 4", op: "lte", flagVal: "5",
+			compareValue: "4", expectedResultPattern: "5 is lower or equal to 4",
+			testResult: false},
+		{label: "op=gt, 5 <= 5", op: "lte", flagVal: "5",
+			compareValue: "5", expectedResultPattern: "5 is lower or equal to 5",
+			testResult: true},
+
+		// Test Op "has"
+		{label: "op=gt, both empty", op: "has", flagVal: "",
+			compareValue: "", expectedResultPattern: "'' has ''",
+			testResult: true},
+		{label: "op=gt, flagVal=empty", op: "has", flagVal: "",
+			compareValue: "blah", expectedResultPattern: "'' has 'blah'",
+			testResult: false},
+		{label: "op=gt, compareValue=empty", op: "has", flagVal: "blah",
+			compareValue: "", expectedResultPattern: "'blah' has ''",
+			testResult: true},
+		{label: "op=gt, 'blah' has 'la'", op: "has", flagVal: "blah",
+			compareValue: "la", expectedResultPattern: "'blah' has 'la'",
+			testResult: true},
+		{label: "op=gt, 'blah' has 'LA'", op: "has", flagVal: "blah",
+			compareValue: "LA", expectedResultPattern: "'blah' has 'LA'",
+			testResult: false},
+		{label: "op=gt, 'blah' has 'lo'", op: "has", flagVal: "blah",
+			compareValue: "lo", expectedResultPattern: "'blah' has 'lo'",
+			testResult: false},
+
+		// Test Op "nothave"
+		{label: "op=gt, both empty", op: "nothave", flagVal: "",
+			compareValue: "", expectedResultPattern: " '' not have ''",
+			testResult: false},
+		{label: "op=gt, flagVal=empty", op: "nothave", flagVal: "",
+			compareValue: "blah", expectedResultPattern: " '' not have 'blah'",
+			testResult: true},
+		{label: "op=gt, compareValue=empty", op: "nothave", flagVal: "blah",
+			compareValue: "", expectedResultPattern: " 'blah' not have ''",
+			testResult: false},
+		{label: "op=gt, 'blah' not have 'la'", op: "nothave", flagVal: "blah",
+			compareValue: "la", expectedResultPattern: " 'blah' not have 'la'",
+			testResult: false},
+		{label: "op=gt, 'blah' not have 'LA'", op: "nothave", flagVal: "blah",
+			compareValue: "LA", expectedResultPattern: " 'blah' not have 'LA'",
+			testResult: true},
+		{label: "op=gt, 'blah' not have 'lo'", op: "nothave", flagVal: "blah",
+			compareValue: "lo", expectedResultPattern: " 'blah' not have 'lo'",
+			testResult: true},
+
+		// Test Op "regex"
+		{label: "op=gt, both empty", op: "regex", flagVal: "",
+			compareValue: "", expectedResultPattern: " '' matched by ''",
+			testResult: true},
+		{label: "op=gt, flagVal=empty", op: "regex", flagVal: "",
+			compareValue: "blah", expectedResultPattern: " '' matched by 'blah'",
+			testResult: false},
+
+		// Test Op "valid_elements"
+		{label: "op=valid_elements, valid_elements both empty", op: "valid_elements", flagVal: "",
+			compareValue: "", expectedResultPattern: "'' contains valid elements from ''",
+			testResult: true},
+
+		{label: "op=valid_elements, valid_elements flagVal empty", op: "valid_elements", flagVal: "",
+			compareValue: "a,b", expectedResultPattern: "'' contains valid elements from 'a,b'",
+			testResult: false},
+
+		{label: "op=valid_elements, valid_elements expectedResultPattern empty", op: "valid_elements", flagVal: "a,b",
+			compareValue: "", expectedResultPattern: "'a,b' contains valid elements from ''",
+			testResult: false},
+	}
+
+	for _, c := range cases {
+		expectedResultPattern, testResult := compareOp(c.op, c.flagVal, c.compareValue)
+
+		if expectedResultPattern != c.expectedResultPattern {
+			t.Errorf("'expectedResultPattern' did not match - label: %q op: %q expected 'expectedResultPattern':%q  got:%q\n", c.label, c.op, c.expectedResultPattern, expectedResultPattern)
+		}
+
+		if testResult != c.testResult {
+			t.Errorf("'testResult' did not match - label: %q op: %q expected 'testResult':%t  got:%t\n", c.label, c.op, c.testResult, testResult)
+		}
+	}
+}
--- a/cmd/common.go
+++ b/cmd/common.go
@@ -65,6 +65,12 @@ func NewRunFilter(opts FilterOpts) (check.Predicate, error) {
 func runChecks(nodetype check.NodeType) {
 	var summary check.Summary

+	// Verify config file was loaded into Viper during Cobra sub-command initialization.
+	if configFileError != nil {
+		colorPrint(check.FAIL, fmt.Sprintf("Failed to read config file: %v\n", configFileError))
+		os.Exit(1)
+	}
+
 	def := loadConfig(nodetype)
 	in, err := ioutil.ReadFile(def)
 	if err != nil {
@@ -82,9 +88,10 @@ func runChecks(nodetype check.NodeType) {
 		exitWithError(err)
 	}

-	confmap := getConfigFiles(typeConf)
-	svcmap := getServiceFiles(typeConf)
-	kubeconfmap := getKubeConfigFiles(typeConf)
+	confmap := getFiles(typeConf, "config")
+	svcmap := getFiles(typeConf, "service")
+	kubeconfmap := getFiles(typeConf, "kubeconfig")
+	cafilemap := getFiles(typeConf, "ca")

 	// Variable substitutions. Replace all occurrences of variables in controls files.
 	s := string(in)
@@ -92,6 +99,7 @@ func runChecks(nodetype check.NodeType) {
 	s = makeSubstitutions(s, "conf", confmap)
 	s = makeSubstitutions(s, "svc", svcmap)
 	s = makeSubstitutions(s, "kubeconfig", kubeconfmap)
+	s = makeSubstitutions(s, "cafile", cafilemap)

 	controls, err := check.NewControls(nodetype, []byte(s))
 	if err != nil {
--- a/cmd/root.go
+++ b/cmd/root.go
@@ -49,6 +49,7 @@ var (
 	filterOpts         FilterOpts
 	includeTestOutput  bool
 	outputFile         string
+	configFileError    error
 )

 // RootCmd represents the base command when called without any subcommands
@@ -74,8 +75,12 @@ func Execute() {

 	if err := RootCmd.Execute(); err != nil {
 		fmt.Println(err)
+		// flush before exit non-zero
+		glog.Flush()
 		os.Exit(-1)
 	}
+	// flush before exit
+	glog.Flush()
 }

 func init() {
@@ -125,12 +130,27 @@ func initConfig() {
 		viper.AddConfigPath(cfgDir)   // adding ./cfg as first search path
 	}

+	// Read flag values from environment variables.
+	// Precedence: Command line flags take precedence over environment variables.
 	viper.SetEnvPrefix(envVarsPrefix)
-	viper.AutomaticEnv() // read in environment variables that match
+	viper.AutomaticEnv()
+	
+	if kubeVersion == "" {
+		if env := viper.Get("version"); env != nil {
+			kubeVersion = env.(string)
+		}
+ 	}

 	// If a config file is found, read it in.
 	if err := viper.ReadInConfig(); err != nil {
-		colorPrint(check.FAIL, fmt.Sprintf("Failed to read config file: %v\n", err))
-		os.Exit(1)
+		if _, ok := err.(viper.ConfigFileNotFoundError); ok {
+			// Config file not found; ignore error for now to prevent commands
+			// which don't need the config file exiting.
+			configFileError = err
+		} else {
+			// Config file was found but another error was produced
+			colorPrint(check.FAIL, fmt.Sprintf("Failed to read config file: %v\n", err))
+			os.Exit(1)
+		}
 	}
 }
--- a/cmd/util.go
+++ b/cmd/util.go
@@ -27,6 +27,12 @@ var (

 var psFunc func(string) string
 var statFunc func(string) (os.FileInfo, error)
+var TypeMap = map[string][]string{
+	"ca": []string{"cafile", "defaultcafile"},
+	"kubeconfig": []string{"kubeconfig", "defaultkubeconfig"},
+	"service": []string{"svc", "defaultsvc"},
+	"config": []string{"confs", "defaultconf"},
+}

 func init() {
 	psFunc = ps
@@ -35,6 +41,8 @@ func init() {

 func exitWithError(err error) {
 	fmt.Fprintf(os.Stderr, "\n%v\n", err)
+	// flush before exit non-zero
+	glog.Flush()
 	os.Exit(1)
 }

@@ -66,6 +74,8 @@ func cleanIDs(list string) map[string]bool {

 // ps execs out to the ps command; it's separated into a function so we can write tests
 func ps(proc string) string {
+	// TODO: truncate proc to 15 chars
+	// See https://github.com/aquasecurity/kube-bench/issues/328#issuecomment-506813344
 	cmd := exec.Command("ps", "-C", proc, "-o", "cmd", "--no-headers")
 	out, err := cmd.Output()
 	if err != nil {
@@ -161,9 +171,11 @@ func decrementVersion(version string) string {
 	return strings.Join(split, ".")
 }

-// getConfigFiles finds which of the set of candidate config files exist
-func getConfigFiles(v *viper.Viper) map[string]string {
-	confmap := make(map[string]string)
+// getFiles finds which of the set of candidate files exist
+func getFiles(v *viper.Viper, fileType string) map[string]string {
+	filemap := make(map[string]string)
+	mainOpt := TypeMap[fileType][0]
+	defaultOpt := TypeMap[fileType][1]

 	for _, component := range v.GetStringSlice("components") {
 		s := v.Sub(component)
@@ -171,87 +183,25 @@ func getConfigFiles(v *viper.Viper) map[string]string {
 			continue
 		}

-		// See if any of the candidate config files exist
-		conf := findConfigFile(s.GetStringSlice("confs"))
-		if conf == "" {
-			if s.IsSet("defaultconf") {
-				conf = s.GetString("defaultconf")
-				glog.V(2).Info(fmt.Sprintf("Using default config file name '%s' for component %s", conf, component))
+		// See if any of the candidate files exist
+		file := findConfigFile(s.GetStringSlice(mainOpt))
+		if file == "" {
+			if s.IsSet(defaultOpt) {
+				file = s.GetString(defaultOpt)
+				glog.V(2).Info(fmt.Sprintf("Using default %s file name '%s' for component %s", fileType, file, component))
 			} else {
-				// Default the config file name that we'll substitute to the name of the component
-				glog.V(2).Info(fmt.Sprintf("Missing config file for %s", component))
-				conf = component
+				// Default the file name that we'll substitute to the name of the component
+				glog.V(2).Info(fmt.Sprintf("Missing %s file for %s", fileType, component))
+				file = component
 			}
 		} else {
-			glog.V(2).Info(fmt.Sprintf("Component %s uses config file '%s'", component, conf))
+			glog.V(2).Info(fmt.Sprintf("Component %s uses %s file '%s'", component, fileType, file))
 		}

-		confmap[component] = conf
+		filemap[component] = file
 	}

-	return confmap
-}
-
-// getServiceFiles finds which of the set of candidate service files exist
-func getServiceFiles(v *viper.Viper) map[string]string {
-	svcmap := make(map[string]string)
-
-	for _, component := range v.GetStringSlice("components") {
-		s := v.Sub(component)
-		if s == nil {
-			continue
-		}
-
-		// See if any of the candidate config files exist
-		svc := findConfigFile(s.GetStringSlice("svc"))
-		if svc == "" {
-			if s.IsSet("defaultsvc") {
-				svc = s.GetString("defaultsvc")
-				glog.V(2).Info(fmt.Sprintf("Using default service file name '%s' for component %s", svc, component))
-			} else {
-				// Default the service file name that we'll substitute to the name of the component
-				glog.V(2).Info(fmt.Sprintf("Missing service file for %s", component))
-				svc = component
-			}
-		} else {
-			glog.V(2).Info(fmt.Sprintf("Component %s uses service file '%s'", component, svc))
-		}
-
-		svcmap[component] = svc
-	}
-
-	return svcmap
-}
-
-// getKubeConfigFiles finds which of the set of candidate kubeconfig files exist
-func getKubeConfigFiles(v *viper.Viper) map[string]string {
-	kubeconfigmap := make(map[string]string)
-
-	for _, component := range v.GetStringSlice("components") {
-		s := v.Sub(component)
-		if s == nil {
-			continue
-		}
-
-		// See if any of the candidate config files exist
-		kubeconfig := findConfigFile(s.GetStringSlice("kubeconfig"))
-		if kubeconfig == "" {
-			if s.IsSet("defaultkubeconfig") {
-				kubeconfig = s.GetString("defaultkubeconfig")
-				glog.V(2).Info(fmt.Sprintf("Using default kubeconfig file name '%s' for component %s", kubeconfig, component))
-			} else {
-				// Default the service file name that we'll substitute to the name of the component
-				glog.V(2).Info(fmt.Sprintf("Missing kubeconfig file for %s", component))
-				kubeconfig = component
-			}
-		} else {
-			glog.V(2).Info(fmt.Sprintf("Component %s uses kubeconfig file '%s'", component, kubeconfig))
-		}
-
-		kubeconfigmap[component] = kubeconfig
-	}
-
-	return kubeconfigmap
+	return filemap
 }

 // verifyBin checks that the binary specified is running
--- a/cmd/util_test.go
+++ b/cmd/util_test.go
@@ -298,7 +298,7 @@ func TestGetConfigFiles(t *testing.T) {
 			e = c.statResults
 			eIndex = 0

-			m := getConfigFiles(v)
+			m := getFiles(v, "config")
 			if !reflect.DeepEqual(m, c.exp) {
 				t.Fatalf("Got %v\nExpected %v", m, c.exp)
 			}
@@ -373,7 +373,7 @@ func TestGetServiceFiles(t *testing.T) {
 			e = c.statResults
 			eIndex = 0

-			m := getServiceFiles(v)
+			m := getFiles(v, "service")
 			if !reflect.DeepEqual(m, c.exp) {
 				t.Fatalf("Got %v\nExpected %v", m, c.exp)
 			}
--- a/docs/README.md
+++ b/docs/README.md
@@ -4,30 +4,11 @@
 representation of the CIS Kubernetes Benchmark checks. There is a 
 `controls` file per kubernetes version and node type.

-kube-bench automatically selects which `controls` to use based on the detected
-node type and the version of kubernetes a cluster is running. This behaviour
-can be overridden by specifying the `master` or `node` subcommand and the
-`--version` flag on the command line.
-
-For example:
-run kube-bench against a master with version  auto-detection:
-
-```
-kube-bench master
-```
-
-or run kube-bench against a node with the node `controls` for kubernetes 
-version 1.12:
-```
-kube-bench node --version 1.12
-```
-
 `controls` for the various versions of kubernetes can be found in directories
 with same name as the kubernetes versions under `cfg/`, for example `cfg/1.12`.
 `controls` are also organized by distribution under the `cfg` directory for
 example `cfg/ocp-3.10`.

-
 ## Controls

 `controls` is a YAML document that contains checks that must be run against a 
@@ -248,6 +229,9 @@ The `op` (operations) currently supported in `kube-bench` are:
 - `lte`: tests if the keyword is less than or equal to the compared value.
 - `has`: tests if the keyword contains the compared value.
 - `nothave`: tests if the keyword does not contain the compared value.
+- `regex`: tests if the flag value matches the compared value regular expression.
+   When defining regular expressions in YAML it is generally easier to wrap them in
+   single quotes, for example `'^[abc]$'`, to avoid issues with string escaping.

 ## Configuration and Variables

@@ -291,12 +275,11 @@ Every node type has a subsection that specifies the main configurations items.
  Each component has the following entries:

 - `bins`: A list of candidate binaries for a component. `kube-bench` checks this
-   list and selects the first binary that is running on the node, if none is
-   running, `kube-bench` terminates.
+   list and selects the first binary that is running on the node.

-   If `defaultbin` is specified, `kube-bench` ignores the `bins` list (if it is
-   specified) and verifies the binary specified with `defaultbin` is running on
-   the node. `kube-bench` terminates if this binary is not running.
+   if none of the binaries in `bins` list is running, `kube-bench` checks if the
+   binary specified by `defaultbin` is running and terminates if none of the 
+   binaries in both `bins` and `defaultbin` is running.
   
   The selected binary for a component can be referenced in `controls` using a 
   variable in the form `$<component>bin`. In the example below, we reference 
@@ -311,12 +294,9 @@ Every node type has a subsection that specifies the main configurations items.
   ```
   
 - `confs`: A list of candidate configuration files for a component. `kube-bench`
-  checks this list and selects the first config fille that is found on the node,
-  if none of the config files exists `kube-bench` terminates.
-  
-  If `defaultconf`is specified for a component, `kube-bench` ignores the `confs`
-  list (if it is specified) and verifies the config specified by `defaultconf`
-  exists on the node. `kube-bench` terminates if this file does not exist.
+  checks this list and selects the first config file that is found on the node,
+  if none of the config files exists, `kube-bench` defaults conf to the value
+  of `defaultconf`.
  
  The selected config for a component can be referenced in `controls` using a
  variable in the form `$<component>conf`. In the example below we reference the 
@@ -333,11 +313,7 @@ Every node type has a subsection that specifies the main configurations items.
  
 - `svcs`:  A list of candidates unitfiles for a component. `kube-bench` checks this 
  list and selects the first unitfile that is found on the node, if none of the
-  unitfiles exists `kube-bench` terminates.
-  
-  If `defaultsvc`is specified for a component, `kube-bench` ignores the `svcs`
-  list (if it is specified) and verifies the unitfile specified by `defaultsvc`
-  exists on the node. `kube-bench` terminates if this file does not exist.
+  unitfiles exists, `kube-bench` defaults unitfile to the value of `defaultsvc`.
  
  The selected unitfile for a component can be referenced in `controls` via a
  variable in the form `$<component>svc`. In the example below, the selected 
@@ -359,11 +335,8 @@ Every node type has a subsection that specifies the main configurations items.
  
  - `kubeconfig`: A list of candidate kubeconfig files for a component. `kube-bench`
    checks this list and selects the first file that is found on the node, if none
-    of the files exists `kube-bench` terminates.
-    
-    If `defaultkubeconfig` is specified for a component, `kube-bench` ignores the
-    `kubeconfig` list (if it is specified) and verifies the kubeconfig file exists on
-    the node. `kube-bench` terminates if this file does not exist.
+    of the files exists, `kube-bench` defaults kubeconfig to the value of 
+    `defaultkubeconfig`.
    
    The selected kubeconfig for a component can be referenced in `controls` with
    a variable in the form `$<component>kubeconfig`. In the example below, the
--- a/go.mod
+++ b/go.mod
@@ -0,0 +1,33 @@
+module github.com/aquasecurity/kube-bench
+
+go 1.12
+
+require (
+	github.com/denisenkom/go-mssqldb v0.0.0-20190515213511-eb9f6a1743f3 // indirect
+	github.com/erikstmartin/go-testdb v0.0.0-20160219214506-8d10e4a1bae5 // indirect
+	github.com/fatih/color v1.5.0
+	github.com/go-sql-driver/mysql v1.4.1 // indirect
+	github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b
+	github.com/hashicorp/hcl v0.0.0-20171017181929-23c074d0eceb // indirect
+	github.com/inconshreveable/mousetrap v1.0.0 // indirect
+	github.com/jinzhu/gorm v0.0.0-20160404144928-5174cc5c242a
+	github.com/jinzhu/inflection v0.0.0-20170102125226-1c35d901db3d // indirect
+	github.com/jinzhu/now v1.0.1 // indirect
+	github.com/kr/pretty v0.1.0 // indirect
+	github.com/lib/pq v0.0.0-20171126050459-83612a56d3dd // indirect
+	github.com/magiconair/properties v0.0.0-20171031211101-49d762b9817b // indirect
+	github.com/mattn/go-colorable v0.0.0-20170210172801-5411d3eea597 // indirect
+	github.com/mattn/go-isatty v0.0.0-20170307163044-57fdcb988a5c // indirect
+	github.com/mattn/go-sqlite3 v1.10.0 // indirect
+	github.com/mitchellh/mapstructure v0.0.0-20171017171808-06020f85339e // indirect
+	github.com/pelletier/go-toml v0.0.0-20171222114548-0131db6d737c // indirect
+	github.com/spf13/afero v0.0.0-20171228125011-57afd63c6860 // indirect
+	github.com/spf13/cast v1.1.0 // indirect
+	github.com/spf13/cobra v0.0.1
+	github.com/spf13/jwalterweatherman v0.0.0-20170901151539-12bd96e66386 // indirect
+	github.com/spf13/pflag v0.0.0-20171106142849-4c012f6dcd95 // indirect
+	github.com/spf13/viper v1.0.0
+	github.com/stretchr/testify v1.3.0
+	gopkg.in/yaml.v2 v2.2.2
+	k8s.io/client-go v10.0.0+incompatible
+)
--- a/go.sum
+++ b/go.sum
@@ -0,0 +1,184 @@
+cloud.google.com/go v0.26.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
+cloud.google.com/go v0.34.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
+cloud.google.com/go v0.37.4 h1:glPeL3BQJsbF6aIIYfZizMwc5LTYz250bDMjttbBGAU=
+cloud.google.com/go v0.37.4/go.mod h1:NHPJ89PdicEuT9hdPXMROBD91xc5uRDxsMtSB16k7hw=
+github.com/BurntSushi/toml v0.3.1 h1:WXkYYl6Yr3qBf1K79EBnL4mak0OimBfB0XUf9Vl28OQ=
+github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU=
+github.com/Shopify/sarama v1.19.0/go.mod h1:FVkBWblsNy7DGZRfXLU0O9RCGt5g3g3yEuWXgklEdEo=
+github.com/Shopify/toxiproxy v2.1.4+incompatible/go.mod h1:OXgGpZ6Cli1/URJOF1DMxUHB2q5Ap20/P/eIdh4G0pI=
+github.com/alecthomas/template v0.0.0-20160405071501-a0175ee3bccc/go.mod h1:LOuyumcjzFXgccqObfd/Ljyb9UuFJ6TxHnclSeseNhc=
+github.com/alecthomas/units v0.0.0-20151022065526-2efee857e7cf/go.mod h1:ybxpYRFXyAe+OPACYpWeL0wqObRcbAqCMya13uyzqw0=
+github.com/apache/thrift v0.12.0/go.mod h1:cp2SuWMxlEZw2r+iP2GNCdIi4C1qmUzdZFSVb+bacwQ=
+github.com/aquasecurity/kube-bench v0.0.29 h1:jn0odIPAx+OArSfGGjA529PxZSS4xps6gq8LlX4h5wk=
+github.com/aquasecurity/kube-bench v0.0.29/go.mod h1:OJtT6nbmq/4tkF3sIKHO8DIZz7PVXDwYlXJusc33R3Y=
+github.com/beorn7/perks v0.0.0-20180321164747-3a771d992973/go.mod h1:Dwedo/Wpr24TaqPxmxbtue+5NUziq4I4S80YR8gNf3Q=
+github.com/client9/misspell v0.3.4/go.mod h1:qj6jICC3Q7zFZvVWo7KLAzC3yx5G7kyvSDkc90ppPyw=
+github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
+github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/denisenkom/go-mssqldb v0.0.0-20190515213511-eb9f6a1743f3 h1:tkum0XDgfR0jcVVXuTsYv/erY2NnEDqwRojbxR1rBYA=
+github.com/denisenkom/go-mssqldb v0.0.0-20190515213511-eb9f6a1743f3/go.mod h1:zAg7JM8CkOJ43xKXIj7eRO9kmWm/TW578qo+oDO6tuM=
+github.com/eapache/go-resiliency v1.1.0/go.mod h1:kFI+JgMyC7bLPUVY133qvEBtVayf5mFgVsvEsIPBvNs=
+github.com/eapache/go-xerial-snappy v0.0.0-20180814174437-776d5712da21/go.mod h1:+020luEh2TKB4/GOp8oxxtq0Daoen/Cii55CzbTV6DU=
+github.com/eapache/queue v1.1.0/go.mod h1:6eCeP0CKFpHLu8blIFXhExK/dRa7WDZfr6jVFPTqq+I=
+github.com/erikstmartin/go-testdb v0.0.0-20160219214506-8d10e4a1bae5 h1:Yzb9+7DPaBjB8zlTR87/ElzFsnQfuHnVUVqpZZIcV5Y=
+github.com/erikstmartin/go-testdb v0.0.0-20160219214506-8d10e4a1bae5/go.mod h1:a2zkGnVExMxdzMo3M0Hi/3sEU+cWnZpSni0O6/Yb/P0=
+github.com/fatih/color v1.5.0 h1:vBh+kQp8lg9XPr56u1CPrWjFXtdphMoGWVHr9/1c+A0=
+github.com/fatih/color v1.5.0/go.mod h1:Zm6kSWBoL9eyXnKyktHP6abPY2pDugNf5KwzbycvMj4=
+github.com/fsnotify/fsnotify v1.4.7 h1:IXs+QLmnXW2CcXuY+8Mzv/fWEsPGWxqefPtCP5CnV9I=
+github.com/fsnotify/fsnotify v1.4.7/go.mod h1:jwhsz4b93w/PPRr/qN1Yymfu8t87LnFCMoQvtojpjFo=
+github.com/go-kit/kit v0.8.0/go.mod h1:xBxKIO96dXMWWy0MnWVtmwkA9/13aqxPnvrjFYMA2as=
+github.com/go-logfmt/logfmt v0.3.0/go.mod h1:Qt1PoO58o5twSAckw1HlFXLmHsOX5/0LbT9GBnD5lWE=
+github.com/go-sql-driver/mysql v1.4.1 h1:g24URVg0OFbNUTx9qqY1IRZ9D9z3iPyi5zKhQZpNwpA=
+github.com/go-sql-driver/mysql v1.4.1/go.mod h1:zAC/RDZ24gD3HViQzih4MyKcchzm+sOG5ZlKdlhCg5w=
+github.com/go-stack/stack v1.8.0/go.mod h1:v0f6uXyyMGvRgIKkXu+yp6POWl0qKG85gN/melR3HDY=
+github.com/gogo/protobuf v1.1.1/go.mod h1:r8qH/GZQm5c6nD/R0oafs1akxWv10x8SbQlK7atdtwQ=
+github.com/gogo/protobuf v1.2.0/go.mod h1:r8qH/GZQm5c6nD/R0oafs1akxWv10x8SbQlK7atdtwQ=
+github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b h1:VKtxabqXZkF25pY9ekfRL6a582T4P37/31XEstQ5p58=
+github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b/go.mod h1:SBH7ygxi8pfUlaOkMMuAQtPIUF8ecWP5IEl/CR7VP2Q=
+github.com/golang/mock v1.1.1/go.mod h1:oTYuIxOrZwtPieC+H1uAHpcLFnEyAGVDL/k47Jfbm0A=
+github.com/golang/mock v1.2.0/go.mod h1:oTYuIxOrZwtPieC+H1uAHpcLFnEyAGVDL/k47Jfbm0A=
+github.com/golang/protobuf v1.2.0/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
+github.com/golang/snappy v0.0.0-20180518054509-2e65f85255db/go.mod h1:/XxbfmMg8lxefKM7IXC3fBNl/7bRcc72aCRzEWrmP2Q=
+github.com/google/btree v0.0.0-20180813153112-4030bb1f1f0c/go.mod h1:lNA+9X1NB3Zf8V7Ke586lFgjr2dZNuvo3lPJSGZ5JPQ=
+github.com/google/go-cmp v0.2.0 h1:+dTQ8DZQJz0Mb/HjFlkptS1FeQ4cWSnN941F8aEG4SQ=
+github.com/google/go-cmp v0.2.0/go.mod h1:oXzfMopK8JAjlY9xF4vHSVASa0yLyX7SntLO5aqRK0M=
+github.com/google/martian v2.1.0+incompatible/go.mod h1:9I4somxYTbIHy5NJKHRl3wXiIaQGbYVAs8BPL6v8lEs=
+github.com/google/pprof v0.0.0-20181206194817-3ea8567a2e57/go.mod h1:zfwlbNMJ+OItoe0UupaVj+oy1omPYYDuagoSzA8v9mc=
+github.com/googleapis/gax-go/v2 v2.0.4/go.mod h1:0Wqv26UfaUD9n4G6kQubkQ+KchISgw+vpHVxEJEs9eg=
+github.com/gorilla/context v1.1.1/go.mod h1:kBGZzfjB9CEq2AlWe17Uuf7NDRt0dE0s8S51q0aT7Yg=
+github.com/gorilla/mux v1.6.2/go.mod h1:1lud6UwP+6orDFRuTfBEV8e9/aOM/c4fVVCaMa2zaAs=
+github.com/hashicorp/golang-lru v0.5.0/go.mod h1:/m3WP610KZHVQ1SGc6re/UDhFvYD7pJ4Ao+sR/qLZy8=
+github.com/hashicorp/hcl v0.0.0-20171017181929-23c074d0eceb h1:1OvvPvZkn/yCQ3xBcM8y4020wdkMXPHLB4+NfoGWh4U=
+github.com/hashicorp/hcl v0.0.0-20171017181929-23c074d0eceb/go.mod h1:oZtUIOe8dh44I2q6ScRibXws4Ajl+d+nod3AaR9vL5w=
+github.com/hpcloud/tail v1.0.0/go.mod h1:ab1qPbhIpdTxEkNHXyeSf5vhxWSCs/tWer42PpOxQnU=
+github.com/inconshreveable/mousetrap v1.0.0 h1:Z8tu5sraLXCXIcARxBp/8cbvlwVa7Z1NHg9XEKhtSvM=
+github.com/inconshreveable/mousetrap v1.0.0/go.mod h1:PxqpIevigyE2G7u3NXJIT2ANytuPF1OarO4DADm73n8=
+github.com/jinzhu/gorm v0.0.0-20160404144928-5174cc5c242a h1:pfPxlCVlKqBRqHpyCxOIKhhB4ERpz02iadDpRVevLm4=
+github.com/jinzhu/gorm v0.0.0-20160404144928-5174cc5c242a/go.mod h1:Vla75njaFJ8clLU1W44h34PjIkijhjHIYnZxMqCdxqo=
+github.com/jinzhu/inflection v0.0.0-20170102125226-1c35d901db3d h1:jRQLvyVGL+iVtDElaEIDdKwpPqUIZJfzkNLV34htpEc=
+github.com/jinzhu/inflection v0.0.0-20170102125226-1c35d901db3d/go.mod h1:h+uFLlag+Qp1Va5pdKtLDYj+kHp5pxUVkryuEj+Srlc=
+github.com/jinzhu/now v1.0.1 h1:HjfetcXq097iXP0uoPCdnM4Efp5/9MsM0/M+XOTeR3M=
+github.com/jinzhu/now v1.0.1/go.mod h1:d3SSVoowX0Lcu0IBviAWJpolVfI5UJVZZ7cO71lE/z8=
+github.com/jstemmer/go-junit-report v0.0.0-20190106144839-af01ea7f8024/go.mod h1:6v2b51hI/fHJwM22ozAgKL4VKDeJcHhJFhtBdhmNjmU=
+github.com/julienschmidt/httprouter v1.2.0/go.mod h1:SYymIcj16QtmaHHD7aYtjjsJG7VTCxuUUipMqKk8s4w=
+github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck=
+github.com/konsorten/go-windows-terminal-sequences v1.0.1/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ=
+github.com/kr/logfmt v0.0.0-20140226030751-b84e30acd515/go.mod h1:+0opPa2QZZtGFBFZlji/RkVcI2GknAs/DXo4wKdlNEc=
+github.com/kr/pretty v0.1.0 h1:L/CwN0zerZDmRFUapSPitk6f+Q3+0za1rQkzVuMiMFI=
+github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo=
+github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
+github.com/kr/text v0.1.0 h1:45sCR5RtlFHMR4UwH9sdQ5TC8v0qDQCHnXt+kaKSTVE=
+github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
+github.com/lib/pq v0.0.0-20171126050459-83612a56d3dd h1:2RDaVc4/izhWyAvYxNm8c9saSyCDIxefNwOcqaH7pcU=
+github.com/lib/pq v0.0.0-20171126050459-83612a56d3dd/go.mod h1:5WUZQaWbwv1U+lTReE5YruASi9Al49XbQIvNi/34Woo=
+github.com/magiconair/properties v0.0.0-20171031211101-49d762b9817b h1:bR3tkU6ocnK5a0NsdgTMWc7sILt+BY0PceUYC6EpSqc=
+github.com/magiconair/properties v0.0.0-20171031211101-49d762b9817b/go.mod h1:PppfXfuXeibc/6YijjN8zIbojt8czPbwD3XqdrwzmxQ=
+github.com/mattn/go-colorable v0.0.0-20170210172801-5411d3eea597 h1:hGizH4aMDFFt1iOA4HNKC13lqIBoCyxIjWcAnWIy7aU=
+github.com/mattn/go-colorable v0.0.0-20170210172801-5411d3eea597/go.mod h1:9vuHe8Xs5qXnSaW/c/ABM9alt+Vo+STaOChaDxuIBZU=
+github.com/mattn/go-isatty v0.0.0-20170307163044-57fdcb988a5c h1:AHfQR/s6GNi92TOh+kfGworqDvTxj2rMsS+Hca87nck=
+github.com/mattn/go-isatty v0.0.0-20170307163044-57fdcb988a5c/go.mod h1:M+lRXTBqGeGNdLjl/ufCoiOlB5xdOkqRJdNxMWT7Zi4=
+github.com/mattn/go-sqlite3 v1.10.0 h1:jbhqpg7tQe4SupckyijYiy0mJJ/pRyHvXf7JdWK860o=
+github.com/mattn/go-sqlite3 v1.10.0/go.mod h1:FPy6KqzDD04eiIsT53CuJW3U88zkxoIYsOqkbpncsNc=
+github.com/matttproud/golang_protobuf_extensions v1.0.1/go.mod h1:D8He9yQNgCq6Z5Ld7szi9bcBfOoFv/3dc6xSMkL2PC0=
+github.com/mitchellh/mapstructure v0.0.0-20171017171808-06020f85339e h1:PtGHLB3CX3TFPcksODQMxncoeQKWwCgTg0bJ40VLJP4=
+github.com/mitchellh/mapstructure v0.0.0-20171017171808-06020f85339e/go.mod h1:FVVH3fgwuzCH5S8UJGiWEs2h04kUh9fWfEaFds41c1Y=
+github.com/mwitkow/go-conntrack v0.0.0-20161129095857-cc309e4a2223/go.mod h1:qRWi+5nqEBWmkhHvq77mSJWrCKwh8bxhgT7d/eI7P4U=
+github.com/onsi/ginkgo v1.6.0/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE=
+github.com/onsi/ginkgo v1.7.0/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE=
+github.com/onsi/gomega v1.4.3/go.mod h1:ex+gbHU/CVuBBDIJjb2X0qEXbFg53c61hWP/1CpauHY=
+github.com/openzipkin/zipkin-go v0.1.6/go.mod h1:QgAqvLzwWbR/WpD4A3cGpPtJrZXNIiJc5AZX7/PBEpw=
+github.com/pelletier/go-toml v0.0.0-20171222114548-0131db6d737c h1:38Gz4xhAnFXimzmHWtvA13DKjvKbXA8OoCpUwCsfmAk=
+github.com/pelletier/go-toml v0.0.0-20171222114548-0131db6d737c/go.mod h1:5z9KED0ma1S8pY6P1sdut58dfprrGBbd/94hg7ilaic=
+github.com/pierrec/lz4 v2.0.5+incompatible/go.mod h1:pdkljMzZIN41W+lC3N2tnIh5sFi+IEE17M5jbnwPHcY=
+github.com/pkg/errors v0.8.0/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
+github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
+github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+github.com/prometheus/client_golang v0.9.1/go.mod h1:7SWBe2y4D6OKWSNQJUaRYU/AaXPKyh/dDVn+NZz0KFw=
+github.com/prometheus/client_golang v0.9.3-0.20190127221311-3c4408c8b829/go.mod h1:p2iRAGwDERtqlqzRXnrOVns+ignqQo//hLXqYxZYVNs=
+github.com/prometheus/client_model v0.0.0-20180712105110-5c3871d89910/go.mod h1:MbSGuTsp3dbXC40dX6PRTWyKYBIrTGTE9sqQNg2J8bo=
+github.com/prometheus/client_model v0.0.0-20190115171406-56726106282f/go.mod h1:MbSGuTsp3dbXC40dX6PRTWyKYBIrTGTE9sqQNg2J8bo=
+github.com/prometheus/common v0.2.0/go.mod h1:TNfzLD0ON7rHzMJeJkieUDPYmFC7Snx/y86RQel1bk4=
+github.com/prometheus/procfs v0.0.0-20181005140218-185b4288413d/go.mod h1:c3At6R/oaqEKCNdg8wHV1ftS6bRYblBhIjjI8uT2IGk=
+github.com/prometheus/procfs v0.0.0-20190117184657-bf6a532e95b1/go.mod h1:c3At6R/oaqEKCNdg8wHV1ftS6bRYblBhIjjI8uT2IGk=
+github.com/rcrowley/go-metrics v0.0.0-20181016184325-3113b8401b8a/go.mod h1:bCqnVzQkZxMG4s8nGwiZ5l3QUCyqpo9Y+/ZMZ9VjZe4=
+github.com/sirupsen/logrus v1.2.0/go.mod h1:LxeOpSwHxABJmUn/MG1IvRgCAasNZTLOkJPxbbu5VWo=
+github.com/spf13/afero v0.0.0-20171228125011-57afd63c6860 h1:Sah2mqQfQuPUyJ+MJN2JevGfVjF80KsRLR5fcaERajg=
+github.com/spf13/afero v0.0.0-20171228125011-57afd63c6860/go.mod h1:j4pytiNVoe2o6bmDsKpLACNPDBIoEAkihy7loJ1B0CQ=
+github.com/spf13/cast v1.1.0 h1:0Rhw4d6C8J9VPu6cjZLIhZ8+aAOHcDvGeKn+cq5Aq3k=
+github.com/spf13/cast v1.1.0/go.mod h1:r2rcYCSwa1IExKTDiTfzaxqT2FNHs8hODu4LnUfgKEg=
+github.com/spf13/cobra v0.0.1 h1:zZh3X5aZbdnoj+4XkaBxKfhO4ot82icYdhhREIAXIj8=
+github.com/spf13/cobra v0.0.1/go.mod h1:1l0Ry5zgKvJasoi3XT1TypsSe7PqH0Sj9dhYf7v3XqQ=
+github.com/spf13/jwalterweatherman v0.0.0-20170901151539-12bd96e66386 h1:zBoLErXXAvWnNsu+pWkRYl6Cx1KXmIfAVsIuYkPN6aY=
+github.com/spf13/jwalterweatherman v0.0.0-20170901151539-12bd96e66386/go.mod h1:cQK4TGJAtQXfYWX+Ddv3mKDzgVb68N+wFjFa4jdeBTo=
+github.com/spf13/pflag v0.0.0-20171106142849-4c012f6dcd95 h1:fBkxrj/ArtKnC3J1DOZhn3SYiVkVRFZC574bq2Ifa/0=
+github.com/spf13/pflag v0.0.0-20171106142849-4c012f6dcd95/go.mod h1:DYY7MBk1bdzusC3SYhjObp+wFpr4gzcvqqNjLnInEg4=
+github.com/spf13/viper v1.0.0 h1:RUA/ghS2i64rlnn4ydTfblY8Og8QzcPtCcHvgMn+w/I=
+github.com/spf13/viper v1.0.0/go.mod h1:A8kyI5cUJhb8N+3pkfONlcEcZbueH6nhAm0Fq7SrnBM=
+github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
+github.com/stretchr/objx v0.1.1 h1:2vfRuCMp5sSVIDSqO8oNnWJq7mPa6KVP3iPIwFBuy8A=
+github.com/stretchr/objx v0.1.1/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
+github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
+github.com/stretchr/testify v1.3.0 h1:TivCn/peBQ7UY8ooIcPgZFpTNSz0Q2U6UrFlUfqbe0Q=
+github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
+go.opencensus.io v0.20.1/go.mod h1:6WKK9ahsWS3RSO+PY9ZHZUfv2irvY6gN279GOPZjmmk=
+golang.org/x/crypto v0.0.0-20180904163835-0709b304e793/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4=
+golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
+golang.org/x/crypto v0.0.0-20190325154230-a5d413f7728c h1:Vj5n4GlwjmQteupaxJ9+0FNOmBrHfq7vN4btdGoDZgI=
+golang.org/x/crypto v0.0.0-20190325154230-a5d413f7728c/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
+golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
+golang.org/x/lint v0.0.0-20181026193005-c67002cb31c3/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=
+golang.org/x/lint v0.0.0-20190227174305-5b3e6a55c961/go.mod h1:wehouNa3lNwaWXcvxsM5YxQ5yQlVC4a0KAMCusXpPoU=
+golang.org/x/lint v0.0.0-20190301231843-5614ed5bae6f/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=
+golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
+golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
+golang.org/x/net v0.0.0-20180906233101-161cd47e91fd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
+golang.org/x/net v0.0.0-20181114220301-adae6a3d119a/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
+golang.org/x/net v0.0.0-20190108225652-1e06a53dbb7e/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
+golang.org/x/net v0.0.0-20190125091013-d26f9f9a57f3/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
+golang.org/x/net v0.0.0-20190213061140-3a22650c66bd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
+golang.org/x/net v0.0.0-20190311183353-d8887717615a/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
+golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
+golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
+golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20181221193216-37e7f081c4d4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20190227155943-e225da77a7e6/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20180905080454-ebe1bf3edb33/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20180909124046-d0be0721c37e/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20181116152217-5ac8a444bdc5/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20181122145206-62eef0e2fa9b/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a h1:1BGLXjeY4akVXGgbC9HugT3Jv3hCI0z56oJR5vAMgBU=
+golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
+golang.org/x/text v0.3.1-0.20180807135948-17ff2d5776d2 h1:z99zHgr7hKfrUcX/KsoJk5FJfjTceCKIp96+biqP4To=
+golang.org/x/text v0.3.1-0.20180807135948-17ff2d5776d2/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
+golang.org/x/time v0.0.0-20181108054448-85acf8d2951c/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
+golang.org/x/tools v0.0.0-20180828015842-6cd1fcedba52/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
+golang.org/x/tools v0.0.0-20190114222345-bf090417da8b/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
+golang.org/x/tools v0.0.0-20190226205152-f727befe758c/go.mod h1:9Yl7xja0Znq3iFh3HoIrodX9oNMXvdceNzlUR8zjMvY=
+golang.org/x/tools v0.0.0-20190312170243-e65039ee4138/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
+google.golang.org/api v0.3.1/go.mod h1:6wY9I6uQWHQ8EM57III9mq/AjF+i8G65rmVagqKMtkk=
+google.golang.org/appengine v1.1.0/go.mod h1:EbEs0AVv82hx2wNQdGPgUI5lhzA/G0D9YwlJXL52JkM=
+google.golang.org/appengine v1.4.0 h1:/wp5JvzpHIxhs/dumFmF7BXTf3Z+dd4uXta4kVyO508=
+google.golang.org/appengine v1.4.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
+google.golang.org/genproto v0.0.0-20180817151627-c66870c02cf8/go.mod h1:JiN7NxoALGmiZfu7CAH4rXhgtRTLTxftemlI0sWmxmc=
+google.golang.org/genproto v0.0.0-20190307195333-5fe7a883aa19/go.mod h1:VzzqZJRnGkLBvHegQrXjBqPurQTc5/KpmUdxsrq26oE=
+google.golang.org/genproto v0.0.0-20190404172233-64821d5d2107/go.mod h1:VzzqZJRnGkLBvHegQrXjBqPurQTc5/KpmUdxsrq26oE=
+google.golang.org/grpc v1.17.0/go.mod h1:6QZJwpn2B+Zp71q/5VxRsJ6NXXVCE5NRUHRo+f3cWCs=
+google.golang.org/grpc v1.19.0/go.mod h1:mqu4LbDTu4XGKhr4mRzUsmM4RtVoemTSY81AxZiDr8c=
+gopkg.in/alecthomas/kingpin.v2 v2.2.6/go.mod h1:FMv+mEhP44yOT+4EoQTLFTRgOQ1FBLkstjWtayDeSgw=
+gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127 h1:qIbj1fsPNlZgppZ+VLlY7N33q108Sa+fhmuc+sWQYwY=
+gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/fsnotify.v1 v1.4.7/go.mod h1:Tz8NjZHkW78fSQdbUxIjBTcgA1z1m8ZHf0WmKUhAMys=
+gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7/go.mod h1:dt/ZhP58zS4L8KSrWDmTeBkI65Dw0HsyUHuEVlX15mw=
+gopkg.in/yaml.v2 v2.2.1/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
+gopkg.in/yaml.v2 v2.2.2 h1:ZCJp+EgiOT7lHqUV2J862kp8Qj64Jo6az82+3Td9dZw=
+gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
+honnef.co/go/tools v0.0.0-20180728063816-88497007e858/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
+honnef.co/go/tools v0.0.0-20190102054323-c2f93a96b099/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
+honnef.co/go/tools v0.0.0-20190106161140-3f1c8253044a/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
+k8s.io/client-go v10.0.0+incompatible h1:F1IqCqw7oMBzDkqlcBymRq1450wD0eNqLE9jzUrIi34=
+k8s.io/client-go v10.0.0+incompatible/go.mod h1:7vJpHMYJwNQCWgzmNV+VYUl1zCObLyodBc8nIyt8L5s=
--- a/job-iks.yaml
+++ b/job-iks.yaml
@@ -0,0 +1,33 @@
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: kube-bench
+spec:
+  template:
+    spec:
+      hostPID: true
+      containers:
+      - name: kube-bench
+        image: aquasec/kube-bench:latest
+        command: ["kube-bench", "--version", "1.13", "node"]
+        volumeMounts:
+        - name: var-lib-kubelet
+          mountPath: /var/lib/kubelet
+        - name: etc-systemd
+          mountPath: /etc/systemd
+        - name: etc-kubernetes
+          mountPath: /etc/kubernetes
+      restartPolicy: Never
+      volumes:
+      - name: var-lib-kubelet
+        hostPath:
+          path: "/var/lib/kubelet"
+      - name: etc-systemd
+        hostPath:
+          path: "/lib/systemd"
+      - name: etc-kubernetes
+        hostPath:
+          path: "/etc/kubernetes"
+      - name: usr-bin
+        hostPath:
+          path: "/usr/bin"
--- a/BIN
+++ b/BIN
--- a/2
+++ b/2
@@ -32,7 +32,7 @@ build-docker:
             -t $(IMAGE_NAME) .

 tests:
-	go test -race -timeout 30s -cover ./cmd ./check
+	GO111MODULE=on go test -v -short -race -timeout 30s -coverprofile=coverage.txt -covermode=atomic ./...

 # creates a kind cluster to be used for development.
 HAS_KIND := $(shell command -v kind;)
Author	SHA1	Message	Date
yoavrotems	ea9089bd42	update the yaml according (#410 ) The update is from the new cis version 1.4.1. like been done in https://github.com/aquasecurity/kube-bench/issues/370	2019-09-02 16:40:45 +01:00
Roberto Rojas	ec3b1076c0	Fixes issue #407 (#409 ) * fixes issue #407 * fixes issue #407	2019-08-30 17:33:14 +01:00
Roberto Rojas	13dfa15ad6	Fixes Issue #396 - Replaces $kubeletconf for $kubeletsvc (#399 ) * fixes issue #396 * reverts remediation text change * changes to 1.11-json and 1.13-json as per PR review * Tiny typo	2019-08-30 15:21:41 +01:00
Liz Rice	a2466da4b0	Correct 1.1.13 to match CIS spec (#406 ) Text should say Not Scored	2019-08-30 15:10:30 +01:00
Liz Rice	d0d4e95d93	Updated version support (#385 ) Strictly, we don't have the changes in 1.13-json but we do have them in 1.13	2019-08-30 12:09:11 +01:00
Roberto Rojas	7a53806863	fixes issue #346 by explicitly only checking read-only property (#404 )	2019-08-30 08:56:48 +01:00
yoavrotems	4b5a877f1f	Remove some tests from been manual (#398 ) * Remove some tests from been manual * Remove some tests from been manual	2019-08-29 08:54:29 +01:00
Roberto Rojas	f343d36862	hyperkube v1.15 renamed "proxy" to "kube-proxy" (#400 )	2019-08-28 16:53:48 +01:00
Roberto Rojas	3e5d02e920	fixes issue #386 (#397 ) * fixes issue #386 * Correct typo	2019-08-28 09:27:56 +01:00
Abubakr-Sadik Nii Nai Davis	92df9cb36c	Read kubernetes version from environment (#390 ) * Read kubernetes version from environment Set kubernetes version to the value of the environment variable `KUBE_BENCH_VERSION` if it is defined and the flag `--version` is not specified on the kube-bench command line. The command line flag `--version` takes precedence of the environment variable `KUBE_BENCH_VERSION` if both are defined. * Add info about KUBE_BENCH_VERSION to README	2019-08-27 09:04:11 +01:00
Abubakr-Sadik Nii Nai Davis	a3b8ba58ad	Fix error converting from string to integer (#392 ) Replace the `gt` with `eq` for string comparison of kube-bench check 2.1.6 in `cfg/1.6/node.yaml`.	2019-08-23 16:15:21 +01:00
Patrick Lieberg	0d81ef10d5	Update config.yaml to add Azure AKS file locations for kubelet (#383 ) * testing Azure config locations * "Updated default config.yaml to incorporate Azure AKS file locations for kubelet" * "Adjusted order of new lines. Removed unneeded lines."	2019-08-22 14:52:34 +01:00
Abubakr-Sadik Nii Nai Davis	3fba5f4dac	Fix version command failing because of missing config file it does not need. (#377 ) * Fix version command failing because of missing config file it does not need. * Fix typo * Remove reference to github issue in comment	2019-08-22 13:43:09 +01:00
mwwolters	787bf6ca4d	Updated check to pass if flag isn't set (#379 )	2019-08-09 18:24:20 +01:00
Liz Rice	f8b2f6c841	Correct 1.4.21 text (#356 ) 1.4.21 is about the PKI key file not the certificate	2019-08-07 17:17:21 +01:00
yoavrotems	136e9cd731	Remove federated from ocp (#381 ) * Delete federated.yaml There is no federated tests in ocp * Delete federated.yaml There are no federated tests in OCP	2019-08-07 16:52:04 +01:00
Abubakr-Sadik Nii Nai Davis	2e27d681f7	Remove duplicate documentation. (#373 ) * Remove duplicate documentation. * Add test configuration header back in main README. * Add missing regex operator in docs/README. * Fix incorrect description of configuration options bins, confs etc. * Move description of version auto-detection to main README. * Use 1.13 in examples since cfg/1.12 doesn't exist * Remove duplicate sentence about regex This sentence is now in the docs/README * Add link to the docs for test YAML definitions	2019-08-07 03:43:51 -07:00
Efrat Levitan	b8a463f051	Correction to 1.13 and 1.13-json test 2.1.5 (#380 )	2019-08-07 03:33:09 -07:00
yoavrotems	22b971a633	fixes-according-kube-cis1.4.1 (#376 ) * Update master.yaml * Update node.yaml Fix 2.1.11 - got DEPRECATED 2.1.14 changed to be a set of options, would be fixed by https://github.com/aquasecurity/kube-bench/pull/367 * Update master.yaml * Update node.yaml change 2.1.11 Title, and state to not scored	2019-08-06 06:19:29 -07:00
Roberto Rojas	0422368615	issue #369 : fixes RotateKubeletServerCertificate tests in 1.13-json (#371 )	2019-08-06 00:58:35 -07:00
mwwolters	893aa3588c	Updated check to pass if flag isn't set (#375 )	2019-07-30 10:09:24 -07:00
Roberto Rojas	937bfc7b2e	issue #344 : Adds support for array comparison. Every element in the s… (#367 ) * issue #344: Adds support for array comparison. Every element in the source array must exist in the target array. * issue #344: Fixed typo and found if condition based on code review * adds unit tests for valid_elements comparison * removes spaces from split strings	2019-07-26 11:11:59 -07:00
Roberto Rojas	dab5e92bb5	Issue #363 : Adds Unit Tests for Test Comparisons (#366 ) * issue #363: starts unit tests for Test Comparison. * issue #363: Adds tests for "eq" operation * changes test result message * issue #363: Adds tests for "noteq" operation * issue #363: Adds tests for "gt" operation * issue #363: Adds tests for "lt" operation * issue #363: Adds tests for "gte" operation * issue #363: Adds tests for "lte" operation * issue #363: Adds tests for "has" operation * issue #363: Adds tests for "nothave" operation * issue #363: Adds tests for "regex" operation	2019-07-17 10:08:11 -04:00
yoavrotems	7c97f6a490	Add codecov (#336 ) * Update .gitignore * Update .travis.yml * Update makefile * Update .travis.yml * Update .travis.yml * Update .travis.yml * Update README.md * Update README.md * Update README.md * Update makefile * Update .travis.yml	2019-07-16 14:11:51 -04:00
Roberto Rojas	86e3456f33	issue #243 : Changes condition so that score: false tests are performed (#357 ) * issue #243: Changes condition so that score: false tests are performed * issue #243: Changes comments.	2019-07-13 08:05:29 +01:00
zilard	b86dd92c91	Issue #348 : Refactor get<Thing>Files into getFiles (#359 ) * issue #348: replace everywhere get<Thing>Files with getFiles	2019-07-13 07:48:24 +01:00
Roberto Rojas	c87c5cfb51	Fixes bugs on tests 2.1.4 and 2.1.5 - 1.13-json (#365 ) * Adds bin_op to Test 2.1.4 * Adds bin_op to Test 2.1.5	2019-07-13 07:35:44 +01:00
Roberto Rojas	b649588f46	turns Go Module on (#362 )	2019-07-12 14:12:59 +01:00
Liz Rice	cb3d876ced	Remove Darwin build from go-releaser (#361 ) Should fix #360	2019-07-12 12:41:46 +01:00
Roberto Rojas	d43cdfdf01	Issue #355 : Adds Unit Tests for JSONPath Parse & Execute (#358 ) * issue #335: Adds json/yaml unmarshal Unit Tests. * issue #335: Adds jsonpath Unit Tests. * issue #335: Removes log package.	2019-07-12 07:09:27 +01:00
Roberto Rojas	3926ba3977	issue #337 : Adds comment for properties detected thru parsing command line. Fixed Audit for test 2.1.8 (#354 )	2019-07-11 17:05:24 +01:00
Roberto Rojas	d127512ab9	issue #349 : changes test 2.2.8 (#351 )	2019-07-10 15:54:09 +01:00
Roberto Rojas	336ca84998	fixes substitution variable (kubeletconf -> kubeletsvc). (#350 )	2019-07-10 14:20:14 +01:00
zilard	d8528a1ec8	issue #234 : implement test 2.2.8 (#343 ) * implement test 2.2.8 * Nit: correct indentation The indentation looked a bit wonky due to spaces vs tabs; hopefully this corrects it	2019-07-10 10:43:15 +01:00
Roberto Rojas	a0bed18054	Adds json version of config for k8s 1.13 (#342 )	2019-07-10 09:26:37 +01:00
Liz Rice	25b2c5da5a	Add comment about procps limitation (#333 )	2019-07-08 22:29:37 +01:00
Liz Rice	08097d2211	Need credentials in order to run kubectl version (#332 ) Without passing in kubeconfig credentials: ```bash $ docker run --pid=host -v /etc:/etc:ro -v /var:/var:ro -v $(which kubectl):/usr/bin/kubectl -t lizrice/kube-bench:5e6cdfd master -v 1 I0628 16:52:06.591683 6099 util.go:367] Unable to get Kubernetes version from kubectl, using default version: 1.6 I0628 16:52:06.591822 6099 common.go:74] Using benchmark file: cfg/1.6/master.yaml ... ``` As updated in the README with this fix: ```bash docker run --pid=host -v /etc:/etc:ro -v /var:/var:ro -v $(which kubectl):/usr/bin/kubectl -v ~/.kube:/.kube -e KUBECONFIG=/.kube/config -t lizrice/kube-bench:5e6cdfd master -v 1 I0628 16:53:26.784122 7224 util.go:131] No test file found for 1.14 - using tests for Kubernetes 1.13 I0628 16:53:26.784961 7224 common.go:228] Using config file: cfg/1.13/config.yaml ... ```	2019-07-08 22:22:48 +01:00
Liz Rice	9a900db021	docs: update WIP to draft (#324 )	2019-07-03 08:27:28 +01:00
patelpayal	e6e6333e6d	add glog flush to write the output to a file (#329 ) * add glog flush to write the output to a file * add glog flush before exit on error and fix code comment	2019-07-01 09:49:46 +01:00
Manuel Rüger	5e6cdfdb0e	Detect kube-controller in CMD (#326 ) If kube-controller-manager is getting detected by older versions of procps, it will only be detected if we're looking for kube-controller (15 chars) NOTE: "The command name is not the same as the command line. Previous versions of procps and the kernel truncated this command name to 15 characters. This limitation is no longer present in both. If you depended on matching only 15 characters, you may no longer get a match."	2019-06-28 16:58:23 +01:00
patelpayal	e066ec69dd	fix go.mod dependency (#330 )	2019-06-28 09:48:52 +01:00
Manuel Rüger	f7e3257e3c	Go modules / Alpine 3.10 update / Remove binary (#322 ) * Remove binary that was accidentally added `911e9051dc` * Dockerfile: Update to alpine 3.10 * Switch to go 1.12 and go modules	2019-06-26 11:58:51 +01:00
Liz Rice	086df3dda1	Merge pull request #321 from simar7/remove-extra-whitespaces cfg: remove erroneous whitespaces in yaml	2019-06-26 11:26:39 +01:00
Simarpreet Singh	dddc42f046	cfg: remove erroneous whitespaces in yaml Signed-off-by: Simarpreet Singh <simar@linux.com>	2019-06-25 07:18:46 -07:00
Liz Rice	07dfeb8e27	Merge pull request #319 from aquasecurity/contributing Add github issue creation instructions.	2019-06-25 14:51:32 +01:00
Liz Rice	0ab09a85e8	Add pull requests section Add pull requests section Include instructions for kube-bench version Other small wording changes	2019-06-25 14:44:02 +01:00
Abubakr-Sadik Nii Nai Davis	7affbc83d8	Add github issue creation instructions.	2019-06-24 20:33:24 +00:00
Liz Rice	ea7400aa4b	Merge pull request #301 from wwwil/op-regex Add regex compare op	2019-06-19 12:10:29 +02:00
Liz Rice	5e3ff51fa9	Merge branch 'master' into op-regex	2019-06-19 11:43:39 +02:00
Liz Rice	c76369fe2c	Add missing quote	2019-06-10 20:29:58 -07:00
Liz Rice	7f2e9b5231	Merge branch 'master' into op-regex	2019-06-11 04:28:03 +01:00
wwwil	7efa7b2c35	Add regex to list of compare ops	2019-06-05 15:29:40 +01:00
wwwil	83c7536c8a	Add tests for regex test op	2019-06-05 15:29:15 +01:00
wwwil	e4f0f470ee	Add regex op to test	2019-06-04 11:38:17 +01:00