Merge pull request #102 from aquasecurity/update-goreleaser

Update to nfpm as fpm is deprecated

.gitignore

@@ -1,2 +1,4 @@
 kube-bench
 *.swp
+vendor
+dist

.goreleaser.yml

@@ -0,0 +1,18 @@
+builds:
+  - main: main.go
+    binary: kube-bench
+    goos:
+      - darwin
+      - linux
+    goarch:
+      - amd64
+# Archive customization
+archive:
+  format: tar.gz
+nfpm:
+  vendor: Aqua Security
+  description: "The Kubernetes Bench for Security is a Go application that checks whether Kubernetes is deployed according to security best practices"
+  license: Apache-2.0
+  formats:
+    - deb
+    - rpm

.travis.yml

@@ -1,6 +1,25 @@
+---
 language: go
-install: 
-  - go get github.com/aquasecurity/kube-bench
+
+notifications:
+  email: false
+
+before_install:
+  - sudo apt-get -qq update
+  - sudo apt-get install -y rpm
+  - gem install --no-ri --no-rdoc fpm
+
+install:
+  - go get -v github.com/Masterminds/glide
+  - cd $GOPATH/src/github.com/Masterminds/glide && git checkout tags/v0.12.3 && go install && cd - # use a known good glide version
+  - glide install
+
 script:
   - go test ./...
-  - go build -o kube-bench .
+
+after_success:
+  - test -n "$TRAVIS_TAG" && curl -sL https://git.io/goreleaser | bash
+
+env:
+  global:
+    secure: mb8AYZKDo6hkKN+2F9ldXcw27Yn2AfxpXvKlD8GD7NdGOI+TaiSFbE0I+qqTa/1DqcRekCQwqN7OG/17s9JDkgzUXYuYUGlVUOM4WbeJoSlzJFIOh9r9R/JddluYJohypgkE20IBHIrEHq5sY0Nn1Pl9WgSQFaVcQjxkX009AOuVjN0o5HcoXsb5hAzvHrpoSPkcSSqq7VWab60TgUttVaRlZSGwGdSYQEqk5TdO0hWHuXyxaaEPybgFIyZLLbxPS4JmMz8n3Sngetpw9Jgc+V9Fc7wKXpjvZZ33SpArG5p5ZFFu2YQOXFLZth9qtQOjduQ2gU1kHN6WjWnJ8QX2s8vmU38Tk19kd5i+mz9dvc87IdBvmTIqVYSpM6AAYa2osBGP3f97Rj2S68lTad4ecSVyHdsjz56vdE3ZH4wskswmogbKkVdvO4biPHxT6odszBxYLEJuRJyZ7ckXd52MCzqAUPrw7YUuH8N1mLIlf7V5bW5R+q4DlKw774zxnHiWrymXGvlINSrB0qxBn8Fii6ib+Pacl3PuqSumCcgIHlVjqrzIXaqcTMn2/ABZYC99mralGvwA/EgNa8CBKB5evMCEwWa5Ntvcs2I2DFcO5Q2WzN4H0YScyAzzCzK7/3hWJE/rUIJntwiSXkV3MSa1yxWSGGH8F1lcz+lzgTBm/MU=

Dockerfile

@@ -1,12 +1,12 @@
-FROM golang:1.8
+FROM golang:1.9
 WORKDIR /kube-bench
 RUN go get github.com/aquasecurity/kube-bench
-RUN cp /go/bin/kube-bench /kube-bench/ && chmod +x /kube-bench/kube-bench
-RUN cp -r /go/src/github.com/aquasecurity/kube-bench/cfg cfg
 
-# When Docker Hub supports it, we would split this into a multi-stage build with the second part based on, say, alpine for size
+FROM alpine:latest
 WORKDIR /
-ADD entrypoint.sh /entrypoint.sh
+COPY --from=0 /go/bin/kube-bench /kube-bench 
+COPY --from=0 /go/src/github.com/aquasecurity/kube-bench/cfg /cfg
+COPY --from=0 /go/src/github.com/aquasecurity/kube-bench/entrypoint.sh /entrypoint.sh
 ENTRYPOINT /entrypoint.sh
 
 # Build-time metadata as defined at http://label-schema.org

README.md

@@ -11,6 +11,9 @@ Tests are configured with YAML files, making this tool easy to update as test sp
 
 ![Kubernetes Bench for Security](https://raw.githubusercontent.com/aquasecurity/kube-bench/master/images/output.png "Kubernetes Bench for Security")
 
+## CIS Kubernetes Benchmark support
+
+kube-bench supports the tests for multiple versions of Kubernetes (1.6, 1.7 and 1.8) as defined in the CIS Benchmarks 1.0.0, 1.1.0 and 1.2.0 respectively. It will determine the test set to run based on the Kubernetes version running on the machine. 
 
 ## Installation
 
@@ -20,10 +23,15 @@ You can either install kube-bench through a dedicated container, or compile it f
 Run ```docker run --rm -v `pwd`:/host aquasec/kube-bench:latest```. This will copy the kube-bench binary and configuration to you host. You can then run ```./kube-bench <master|node>```.
 
 2. Install from sources:
-If Go is installed on the target machines, you can simply clone this repository and run as follows: 
-```go get github.com/aquasecurity/kube-bench```
-```cp $GOROOT/bin/kube-bench .```
-```./kube-bench <master|node>```
+If Go is installed on the target machines, you can simply clone this repository and run as follows (assuming your [$GOPATH is set](https://github.com/golang/go/wiki/GOPATH)):
+
+```go get github.com/aquasecurity/kube-bench
+go get github.com/Masterminds/glide
+cd $GOPATH/src/github.com/aquasecurity/kube-bench
+$GOPATH/bin/glide install
+go build -o kube-bench . 
+./kube-bench <master|node>
+```
 
 ## Usage
 ```./kube-bench [command]```
@@ -39,7 +47,6 @@ Flags:
   -c, --check string          A comma-delimited list of checks to run as specified in CIS document. Example --check="1.1.1,1.1.2"
       --config string         config file (default is ./cfg/config.yaml)
   -g, --group string          Run all the checks under this comma-delimited list of groups. Example --group="1.1"
-      --installation string   Specify how kubernetes cluster was installed. Possible values are default,hyperkube,kops,kubeadm (default "default")
       --json                  Prints the results as JSON
   -v, --verbose               verbose output (default false)
 ```
@@ -50,7 +57,9 @@ Kubernetes config and binary file locations and names can vary from installation
 For each type of node (*master*, *node* or *federated*) there is a list of components, and for each component there is a set of binaries (*bins*) and config files (*confs*) that kube-bench will look for (in the order they are listed). If your installation uses a different binary name or config file location for a Kubernetes component, you can add it to `cfg/config.yaml`.  
 
 * **bins** - If there is a *bins* list for a component, at least one of these binaries must be running. The tests will consider the parameters for the first binary in the list found to be running. 
+* **podspecs** - From version 1.2.0 of the benchmark (tests for Kubernetes 1.8), the remediation instructions were updated to assume that the configuration for several kubernetes components is defined in a pod YAML file, and podspec settings define where to look for that configuration. 
 * **confs** - If one of the listed config files is found, this will be considered for the test. Tests can continue even if no config file is found. If no file is found at any of the listed locations, and a *defaultconf* location is given for the component, the test will give remediation advice using the *defaultconf* location. 
+* **unitfiles** - From version 1.2.0 of the benchmark  (tests for Kubernetes 1.8), the remediation instructions were updated to assume that kubelet configuration is defined in a service file, and this setting defines where to look for that configuration.
 
 ## Test config YAML representation
 The tests are represented as YAML documents (installed by default into ./cfg).
@@ -110,4 +119,6 @@ These operations are:
 - `nothave`: tests if the flag value does not contain the compared value.
 
 # Roadmap 
-The tests are up-to-date with the CIS Benchmark 1.1.0, which refers to Kubernetes 1.7. Going forward we should release updates to kube-bench to reflect new releases of the Benchmark, which in turn we can anticipate being made for each new Kubernetes release. 
+Going forward we plan to release updates to kube-bench to add support for new releases of the Benchmark, which in turn we can anticipate being made for each new Kubernetes release. 
+
+We welcome PRs and issue reports. 

cfg/1.6/master.yaml

@@ -731,7 +731,7 @@ groups:
       
     - id: 1.4.11
       text: "Ensure that the etcd data directory permissions are set to 700 or more restrictive (Scored)"
-      audit: "ps -ef | grep $etcdbin | grep -v grep | grep -o data-dir=.* | cut -d= -f2 | xargs stat -c %a"
+      audit: ps -ef | grep $etcdbin | grep -v grep | sed 's%.*data-dir[= ]\(\S*\)%\1%' | xargs stat -c %a
       tests:
         test_items:
         - flag: "700"
@@ -748,7 +748,7 @@ groups:
 
     - id: 1.4.12
       text: "Ensure that the etcd data directory ownership is set to etcd:etcd (Scored)"
-      audit: "ps -ef | grep $etcdbin | grep -v grep | grep -o data-dir=.* | cut -d= -f2 | xargs stat -c %U:%G"
+      audit: ps -ef | grep $etcdbin | grep -v grep | sed 's%.*data-dir[= ]\(\S*\)%\1%' | xargs stat -c %U:%G
       tests:
         test_items:
         - flag: "etcd:etcd"

cfg/1.7/master.yaml

@@ -793,7 +793,7 @@ groups:
       
     - id: 1.4.11
       text: "Ensure that the etcd data directory permissions are set to 700 or more restrictive (Scored)"
-      audit: "ps -ef | grep $etcdbin | grep -v grep | grep -o data-dir=.* | cut -d= -f2 | xargs stat -c %a"
+      audit: ps -ef | grep $etcdbin | grep -v grep | sed 's%.*data-dir[= ]\(\S*\)%\1%' | xargs stat -c %a
       tests:
         test_items:
         - flag: "700"
@@ -810,7 +810,7 @@ groups:
 
     - id: 1.4.12
       text: "Ensure that the etcd data directory ownership is set to etcd:etcd (Scored)"
-      audit: "ps -ef | grep $etcdbin | grep -v grep | grep -o data-dir=.* | cut -d= -f2 | xargs stat -c %U:%G"
+      audit: ps -ef | grep $etcdbin | grep -v grep | ed 's%.*data-dir[= ]\(\S*\)%\1%' | xargs stat -c %U:%G
       tests:
         test_items:
         - flag: "etcd:etcd"

cfg/1.8/config.yaml

@@ -0,0 +1,38 @@
+---
+## Controls Files. 
+# These are YAML files that hold all the details for running checks.
+#
+## Uncomment to use different control file paths.
+# masterControls: ./cfg/master.yaml
+# nodeControls: ./cfg/node.yaml
+# federatedControls: ./cfg/federated.yaml
+
+master:
+  apiserver:
+    defaultconf: /etc/kubernetes/manifests/kube-apiserver.yaml
+
+  scheduler:
+    confs: 
+      - /etc/kubernetes/manifests/kube-scheduler.yaml
+    defaultconf: /etc/kubernetes/manifests/kube-scheduler.yaml
+
+  controllermanager:
+    confs:
+      - /etc/kubernetes/manifests/kube-controller-manager.yaml
+    defaultconf: /etc/kubernetes/manifests/kube-controller-manager.yaml
+
+  etcd:
+    confs:
+      - /etc/kubernetes/manifests/etcd.yaml
+    defaultconf: /etc/kubernetes/manifests/etcd.yaml
+
+node:
+  kubelet:
+    confs:
+     - /etc/systemd/system/kubelet.service.d/10-kubeadm.conf
+    defaultconf: /etc/systemd/system/kubelet.service.d/10-kubeadm.conf
+  
+  proxy:
+    confs:
+      - /etc/kubernetes/addons/kube-proxy-daemonset.yaml
+    defaultconf: /etc/kubernetes/addons/kube-proxy-daemonset.yaml

cfg/1.8/federated.yaml

@@ -19,9 +19,8 @@ groups:
           value: false
         set: true
     remediation: |
-      Edit the deployment specs and set --anonymous-auth=false .
-      kubectl edit deployments federation-apiserver-deployment --
-      namespace=federation-system
+      Edit the deployment specs and set --anonymous-auth=false.
+      kubectl edit deployments federation-apiserver-deployment --namespace=federation-system
     scored: true
 
   - id: 3.1.2
@@ -33,9 +32,8 @@ groups:
         set: false
     remediation: |
       Follow the documentation and configure alternate mechanisms for authentication. Then,
-      edit the deployment specs and remove "--basic-auth-file=<filename>" .
-      kubectl edit deployments federation-apiserver-deployment --
-      namespace=federation-system
+      edit the deployment specs and remove "--basic-auth-file=<filename>".
+      kubectl edit deployments federation-apiserver-deployment --namespace=federation-system
     scored: true
 
   - id: 3.1.3
@@ -46,9 +44,8 @@ groups:
       - flag: "--insecure-allow-any-token"
         set: false
     remediation: |
-      Edit the deployment specs and remove --insecure-allow-any-token .
-      kubectl edit deployments federation-apiserver-deployment --
-      namespace=federation-system
+      Edit the deployment specs and remove --insecure-allow-any-token.
+      kubectl edit deployments federation-apiserver-deployment --namespace=federation-system
     scored: true
 
   - id: 3.1.4
@@ -59,9 +56,8 @@ groups:
       - flag: "--insecure-bind-address"
         set: false
     remediation: |
-      Edit the deployment specs and remove --insecure-bind-address .
-      kubectl edit deployments federation-apiserver-deployment --
-      namespace=federation-system
+      Edit the deployment specs and remove --insecure-bind-address.
+      kubectl edit deployments federation-apiserver-deployment --namespace=federation-system
     scored: true
 
   - id: 3.1.5
@@ -75,9 +71,8 @@ groups:
           value: 0
         set: true
     remediation: |
-      Edit the deployment specs and set --insecure-port=0 .
-      kubectl edit deployments federation-apiserver-deployment --
-      namespace=federation-system
+      Edit the deployment specs and set --insecure-port=0.
+      kubectl edit deployments federation-apiserver-deployment --namespace=federation-system
     scored: true
 
   - id: 3.1.6
@@ -95,8 +90,7 @@ groups:
         set: false
     remediation: |
       Edit the deployment specs and set the --secure-port argument to the desired port.
-      kubectl edit deployments federation-apiserver-deployment --
-      namespace=federation-system
+      kubectl edit deployments federation-apiserver-deployment --namespace=federation-system
     scored: true
 
   - id: 3.1.7
@@ -110,9 +104,8 @@ groups:
           value: false
         set: true
     remediation: |
-      Edit the deployment specs and set "--profiling=false" :
-      kubectl edit deployments federation-apiserver-deployment --
-      namespace=federation-system
+      Edit the deployment specs and set "--profiling=false":
+      kubectl edit deployments federation-apiserver-deployment --namespace=federation-system
     score: true
 
   - id: 3.1.8
@@ -128,8 +121,7 @@ groups:
     remediation: |
       Edit the deployment specs and set --admission-control argument to a value that does not
       include AlwaysAdmit .
-      kubectl edit deployments federation-apiserver-deployment --
-      namespace=federation-system
+      kubectl edit deployments federation-apiserver-deployment --namespace=federation-system
     scored: true
 
   - id: 3.1.9
@@ -144,9 +136,8 @@ groups:
         set: true
     remediation: |
       Edit the deployment specs and set --admission-control argument to a value that includes
-      NamespaceLifecycle .
-      kubectl edit deployments federation-apiserver-deployment --
-      namespace=federation-system
+      NamespaceLifecycle.
+      kubectl edit deployments federation-apiserver-deployment --namespace=federation-system
     scored: true
 
   - id: 3.1.10
@@ -172,8 +163,7 @@ groups:
         set: true
     remediation: |
       Edit the deployment specs and set --audit-log-maxage to 30 or as appropriate.
-      kubectl edit deployments federation-apiserver-deployment --
-      namespace=federation-system
+      kubectl edit deployments federation-apiserver-deployment --namespace=federation-system
     scored: true
             
   - id: 3.1.12
@@ -188,8 +178,7 @@ groups:
         set: true
     remediation: |
       Edit the deployment specs and set --audit-log-maxbackup to 10 or as appropriate.
-      kubectl edit deployments federation-apiserver-deployment --
-      namespace=federation-system
+      kubectl edit deployments federation-apiserver-deployment --namespace=federation-system
     scored: true
 
   - id: 3.1.13
@@ -204,8 +193,7 @@ groups:
         set: true
     remediation: |
       Edit the deployment specs and set --audit-log-maxsize=100 to 100 or as appropriate.
-      kubectl edit deployments federation-apiserver-deployment --
-      namespace=federation-system
+      kubectl edit deployments federation-apiserver-deployment --namespace=federation-system
     scored: true
 
   - id: 3.1.14
@@ -221,8 +209,7 @@ groups:
     remediation: |
       Edit the deployment specs and set --authorization-mode argument to a value other than
       AlwaysAllow
-      kubectl edit deployments federation-apiserver-deployment --
-      namespace=federation-system
+      kubectl edit deployments federation-apiserver-deployment --namespace=federation-system
     scored: true
 
   - id: 3.1.15
@@ -235,8 +222,7 @@ groups:
     remediation: |
       Follow the documentation and configure alternate mechanisms for authentication. Then,
       edit the deployment specs and remove the --token-auth-file=<filename> argument.
-      kubectl edit deployments federation-apiserver-deployment --
-      namespace=federation-system
+      kubectl edit deployments federation-apiserver-deployment --namespace=federation-system
     scored: true
 
   - id: 3.1.16
@@ -251,8 +237,7 @@ groups:
         set: true
     remediation: |
       Edit the deployment specs and set "--service-account-lookup=true" .
-      kubectl edit deployments federation-apiserver-deployment --
-      namespace=federation-system
+      kubectl edit deployments federation-apiserver-deployment --namespace=federation-system
     scored: true
 
   - id: 3.1.17
@@ -264,8 +249,7 @@ groups:
         set: true
     remediation: |
       Edit the deployment specs and set --service-account-key-file argument as appropriate.
-      kubectl edit deployments federation-apiserver-deployment --
-      namespace=federation-system
+      kubectl edit deployments federation-apiserver-deployment --namespace=federation-system
     scored: true
 
   - id: 3.1.18
@@ -281,11 +265,10 @@ groups:
         set: true
     remediation: |
       Follow the Kubernetes documentation and set up the TLS connection between the
-      federation apiserver and etcd. Then, edit the deployment specs and set "--etcd-
-      certfile=<path/to/client-certificate-file>" and "--etcd-
-      keyfile=<path/to/client-key-file>" arguments.
-      kubectl edit deployments federation-apiserver-deployment --
-      namespace=federation-system
+      federation apiserver and etcd. Then, edit the deployment specs and set 
+      "--etcd-certfile=<path/to/client-certificate-file>" and 
+      "--etcd-keyfile=<path/to/client-key-file>" arguments.
+      kubectl edit deployments federation-apiserver-deployment --namespace=federation-system
     scored: true
 
   - id: 3.1.19
@@ -301,10 +284,10 @@ groups:
         set: true
     remediation: |
       Follow the Kubernetes documentation and set up the TLS connection on the federation
-      apiserver. Then, edit the deployment specs and set "--tls-cert-file=<path/to/tls-
-      certificate-file>" and "--tls-private-key-file=<path/to/tls-key-file>" :
-      kubectl edit deployments federation-apiserver-deployment --
-      namespace=federation-system
+      apiserver. Then, edit the deployment specs and set 
+      "--tls-cert-file=<path/to/tls-certificate-file>" and 
+      "--tls-private-key-file=<path/to/tls-key-file>":
+      kubectl edit deployments federation-apiserver-deployment --namespace=federation-system
     scored: true
 
 - id: 3.2
@@ -321,7 +304,6 @@ groups:
           value: false
         set: true
     remediation: |
-      Edit the deployment specs and set "--profiling=false" :
-      kubectl edit deployments federation-controller-manager-deployment --
-      namespace=federation-system
+      Edit the deployment specs and set "--profiling=false":
+      kubectl edit deployments federation-controller-manager-deployment --namespace=federation-system
     scored: true

cfg/1.8/master.yaml

@@ -19,7 +19,7 @@ groups:
           value: false
         set: true
     remediation: | 
-      Edit the API server pod specification file $apiserverpodspec
+      Edit the API server pod specification file $apiserverconf
       on the master node and set the below parameter.
       --anonymous-auth=false
 
@@ -34,7 +34,7 @@ groups:
         set: false
     remediation: |
       Follow the documentation and configure alternate mechanisms for authentication. Then,
-      edit the API server pod specification file $apiserverpodspec
+      edit the API server pod specification file $apiserverconf
       on the master node and remove the --basic-auth-file=<filename>
       parameter.
     scored: true
@@ -47,7 +47,7 @@ groups:
       - flag:  "--insecure-allow-any-token"
         set: false
     remediation: |
-      Edit the API server pod specification file $apiserverpodspec
+      Edit the API server pod specification file $apiserverconf
       on the master node and remove the --insecure-allow-any-token
       parameter.
     scored: true
@@ -66,7 +66,7 @@ groups:
       - flag: "--kubelet-https"
         set: false
     remediation: |
-      Edit the API server pod specification file $apiserverpodspec
+      Edit the API server pod specification file $apiserverconf
       on the master node and remove the --kubelet-https parameter.
     scored: true
 
@@ -78,7 +78,7 @@ groups:
       - flag: "--insecure-bind-address"
         set: false
     remediation: |
-      Edit the API server pod specification file $apiserverpodspec
+      Edit the API server pod specification file $apiserverconf
       on the master node and remove the --insecure-bind-address
       parameter.
     scored: true
@@ -94,7 +94,7 @@ groups:
           value: 0
         set: true
     remediation: |
-      Edit the API server pod specification file $apiserverpodspec
+      Edit the API server pod specification file $apiserverconf
       apiserver.yaml on the master node and set the below parameter.
       --insecure-port=0
     scored: true
@@ -113,7 +113,7 @@ groups:
         - flag: "--secure-port"
           set: false
     remediation: |
-      Edit the API server pod specification file $apiserverpodspec
+      Edit the API server pod specification file $apiserverconf
       on the master node and either remove the --secure-port parameter or
       set it to a different (non-zero) desired port.
     scored: true
@@ -129,7 +129,7 @@ groups:
           value: false
         set: true
     remediation: |
-      Edit the API server pod specification file $apiserverpodspec
+      Edit the API server pod specification file $apiserverconf
       on the master node and set the below parameter.
       --profiling=false
     scored: true
@@ -145,7 +145,7 @@ groups:
           value: false
         set: true
     remediation: |
-      Edit the API server pod specification file $apiserverpodspec
+      Edit the API server pod specification file $apiserverconf
       on the master node and set the below parameter.
       --repair-malformed-updates=false
     scored: true
@@ -161,9 +161,9 @@ groups:
           value: AlwaysAdmit 
         set: true
     remediation: |
-      Edit the API server pod specification file $apiserverpodspec
+      Edit the API server pod specification file $apiserverconf
       on the master node and set the --admission-control parameter to a
-      value that does not include AlwaysAdmit .
+      value that does not include AlwaysAdmit.
     scored: true
 
   - id: 1.1.11
@@ -177,9 +177,9 @@ groups:
           value: "AlwaysPullImages"
         set: true
     remediation: |
-      Edit the API server pod specification file $apiserverpodspec
+      Edit the API server pod specification file $apiserverconf
       on the master node and set the --admission-control parameter to
-      include AlwaysPullImages .
+      include AlwaysPullImages.
       --admission-control=...,AlwaysPullImages,...
     scored: true
 
@@ -194,9 +194,9 @@ groups:
           value: "DenyEscalatingExec"
         set: true
     remediation: |
-      Edit the API server pod specification file $apiserverpodspec
+      Edit the API server pod specification file $apiserverconf
       on the master node and set the --admission-control parameter to a
-      value that includes DenyEscalatingExec .
+      value that includes DenyEscalatingExec.
       --admission-control=...,DenyEscalatingExec,...
     scored: true
 
@@ -211,9 +211,9 @@ groups:
           value: "SecurityContextDeny"
         set: true
     remediation: |
-      Edit the API server pod specification file $apiserverpodspec
+      Edit the API server pod specification file $apiserverconf
       on the master node and set the --admission-control parameter to
-      include SecurityContextDeny .
+      include SecurityContextDeny.
       --admission-control=...,SecurityContextDeny,...
     scored: true
 
@@ -228,9 +228,9 @@ groups:
           value: "NamespaceLifecycle"
         set: true
     remediation: |
-      Edit the API server pod specification file $apiserverpodspec
+      Edit the API server pod specification file $apiserverconf
       on the master node and set the --admission-control parameter to
-      include NamespaceLifecycle .
+      include NamespaceLifecycle.
       --admission-control=...,NamespaceLifecycle,...
     scored: true
 
@@ -242,7 +242,7 @@ groups:
       - flag: "--audit-log-path"
         set: true
     remediation: |
-      Edit the API server pod specification file $apiserverpodspec
+      Edit the API server pod specification file $apiserverconf
       on the master node and set the --audit-log-path parameter to a suitable
     path and file where you would like audit logs to be written, for example:
             --audit-log-path=/var/log/apiserver/audit.log
@@ -259,7 +259,7 @@ groups:
           value: 30
         set: true
     remediation: |
-      Edit the API server pod specification file $apiserverpodspec
+      Edit the API server pod specification file $apiserverconf
       on the master node and set the --audit-log-maxage parameter to 30 or
     as an appropriate number of days:
             --audit-log-maxage=30
@@ -276,7 +276,7 @@ groups:
           value: 10
         set: true
     remediation: |
-      Edit the API server pod specification file $apiserverpodspec
+      Edit the API server pod specification file $apiserverconf
       on the master node and set the --audit-log-maxbackup parameter to 10
       or to an appropriate value.
       --audit-log-maxbackup=10
@@ -293,7 +293,7 @@ groups:
           value: 100
         set: true
     remediation: |
-      Edit the API server pod specification file $apiserverpodspec
+      Edit the API server pod specification file $apiserverconf
       on the master node and set the --audit-log-maxsize parameter to an
       appropriate size in MB. For example, to set it as 100 MB:
       --audit-log-maxsize=100
@@ -310,9 +310,9 @@ groups:
           value: "AlwaysAllow"
         set: true
     remediation: |
-      Edit the API server pod specification file $apiserverpodspec
+      Edit the API server pod specification file $apiserverconf
       on the master node and set the --authorization-mode parameter to
-      values other than AlwaysAllow . One such example could be as below.
+      values other than AlwaysAllow. One such example could be as below.
       --authorization-mode=RBAC
     scored: true
 
@@ -325,7 +325,7 @@ groups:
         set: false
     remediation: |
       Follow the documentation and configure alternate mechanisms for authentication. Then,
-      edit the API server pod specification file $apiserverpodspec
+      edit the API server pod specification file $apiserverconf
       on the master node and remove the --token-auth-file=<filename>
       parameter.
     scored: true
@@ -340,7 +340,7 @@ groups:
     remediation: |
       Follow the Kubernetes documentation and setup the TLS connection between the apiserver
       and kubelets. Then, edit the API server pod specification file
-      $apiserverpodspec on the master node and set the --
+      $apiserverconf on the master node and set the --
       kubelet-certificate-authority parameter to the path to the cert file for the certificate
       authority.
       --kubelet-certificate-authority=<ca-string>
@@ -360,7 +360,7 @@ groups:
     remediation: |
       Follow the Kubernetes documentation and set up the TLS connection between the
       apiserver and kubelets. Then, edit API server pod specification file
-      $apiserverpodspec on the master node and set the
+      $apiserverconf on the master node and set the
       kubelet client certificate and key parameters as below.
       --kubelet-client-certificate=<path/to/client-certificate-file>
       --kubelet-client-key=<path/to/client-key-file>
@@ -377,7 +377,7 @@ groups:
           value: true
         set: true
     remediation: |
-      Edit the API server pod specification file $apiserverpodspec
+      Edit the API server pod specification file $apiserverconf
       on the master node and set the below parameter.
       --service-account-lookup=true
     scored: true
@@ -394,7 +394,7 @@ groups:
         set: true
     remediation: |
       Follow the documentation and create Pod Security Policy objects as per your environment.
-      Then, edit the API server pod specification file $apiserverpodspec
+      Then, edit the API server pod specification file $apiserverconf
       on the master node and set the --admission-control parameter to a
       value that includes PodSecurityPolicy :
       --admission-control=...,PodSecurityPolicy,...
@@ -410,7 +410,7 @@ groups:
       - flag: "--service-account-key-file"
         set: true
     remediation: |
-      Edit the API server pod specification file $apiserverpodspec
+      Edit the API server pod specification file $apiserverconf
       on the master node and set the --service-account-key-file parameter
       to the public key file for service accounts:
       --service-account-key-file=<filename>
@@ -430,7 +430,7 @@ groups:
     remediation: |
       Follow the Kubernetes documentation and set up the TLS connection between the
       apiserver and etcd. Then, edit the API server pod specification file
-      $apiserverpodspec on the master node and set the etcd
+      $apiserverconf on the master node and set the etcd
       certificate and key file parameters.
       --etcd-certfile=<path/to/client-certificate-file>
       --etcd-keyfile=<path/to/client-key-file>
@@ -448,9 +448,9 @@ groups:
         set: true
     remediation: |
       Follow the documentation and create ServiceAccount objects as per your environment.
-      Then, edit the API server pod specification file $apiserverpodspec
+      Then, edit the API server pod specification file $apiserverconf
       on the master node and set the --admission-control parameter to a
-      value that includes ServiceAccount .
+      value that includes ServiceAccount.
       --admission-control=...,ServiceAccount,...
     scored: true
 
@@ -467,7 +467,7 @@ groups:
         set: true
     remediation: |
       Follow the Kubernetes documentation and set up the TLS connection on the apiserver.
-      Then, edit the API server pod specification file $apiserverpodspec
+      Then, edit the API server pod specification file $apiserverconf
       on the master node and set the TLS certificate and private key file
       parameters.
       --tls-cert-file=<path/to/tls-certificate-file>
@@ -483,7 +483,7 @@ groups:
         set: true
     remediation: |
       Follow the Kubernetes documentation and set up the TLS connection on the apiserver.
-      Then, edit the API server pod specification file $apiserverpodspec
+      Then, edit the API server pod specification file $apiserverconf
       on the master node and set the client certificate authority file.
       --client-ca-file=<path/to/client-ca-file>
     scored: true
@@ -498,7 +498,7 @@ groups:
     remediation: |
       Follow the Kubernetes documentation and set up the TLS connection between the
       apiserver and etcd. Then, edit the API server pod specification file
-      $apiserverpodspec on the master node and set the etcd
+      $apiserverconf on the master node and set the etcd
       certificate authority file parameter.
       --etcd-cafile=<path/to/ca-file>
     scored: true
@@ -514,9 +514,9 @@ groups:
           value: "Node"
         set: true
     remediation: |
-      Edit the API server pod specification file $apiserverpodspec
+      Edit the API server pod specification file $apiserverconf
       on the master node and set the --authorization-mode parameter to a
-      value that includes Node .
+      value that includes Node.
       --authorization-mode=Node,RBAC
     scored: true
 
@@ -532,14 +532,14 @@ groups:
         set: true
     remediation: |
       Follow the Kubernetes documentation and configure NodeRestriction plug-in on kubelets.
-      Then, edit the API server pod specification file $apiserverpodspec
+      Then, edit the API server pod specification file $apiserverconf
       on the master node and set the --admission-control parameter to a
       value that includes NodeRestriction.
       --admission-control=...,NodeRestriction,...
     scored: true
 
   - id: 1.1.33
-    text: "1.1.34 Ensure that the --experimental-encryption-provider-config argument is
+    text: "Ensure that the --experimental-encryption-provider-config argument is
     set as appropriate (Scored)"
     audit: "ps -ef | grep $apiserverbin | grep -v grep"
     tests:
@@ -548,7 +548,7 @@ groups:
         set: true
     remediation: |
       Follow the Kubernetes documentation and configure a EncryptionConfig file. Then, edit
-      the API server pod specification file $apiserverpodspec
+      the API server pod specification file $apiserverconf
       on the master node and set the --experimental-encryption-provider-config parameter
       to the path of that file:
       --experimental-encryption-provider-config=</path/to/EncryptionConfig/File>
@@ -586,7 +586,7 @@ groups:
         set: true
     remediation: |
       Follow the Kubernetes documentation and set the desired limits in a configuration file.
-      Then, edit the API server pod specification file $apiserverpodspec
+      Then, edit the API server pod specification file $apiserverconf
       and set the below parameters.
       --admission-control=EventRateLimit
       --admission-control-config-file=<path/to/configuration/file>
@@ -598,8 +598,7 @@ groups:
     type: "manual"
     remediation: |
       Follow the Kubernetes documentation and set the desired audit policy in the
-      /etc/kubernetes/audit-policy.yaml file.
-      Then, edit the API server pod specification file $apiserverpodspec
+      /etc/kubernetes/audit-policy.yaml file. Then, edit the API server pod specification file $apiserverconf
       and set the below parameters.
       --audit-policy-file=/etc/kubernetes/audit-policy.yaml
     scored: true
@@ -609,7 +608,7 @@ groups:
     audit: "ps -ef | grep $apiserverbin | grep -v grep"
     type: "manual"
     remediation: |
-      Edit the API server pod specification file $apiserverpodspec
+      Edit the API server pod specification file $apiserverconf
       and set the below parameter as appropriate and if needed. For example,
       --request-timeout=300
     scored: true
@@ -629,7 +628,7 @@ groups:
         set: true
     remediation: |
       Remediation:
-        Edit the Scheduler pod specification file $apiserverpodspec
+        Edit the Scheduler pod specification file $schedulerconf
         file on the master node and set the below parameter.
         --profiling=false
     scored: true
@@ -645,9 +644,8 @@ groups:
         - flag: "--terminated-pod-gc-threshold"
           set: true
     remediation: |
-      Edit the Controller Manager pod specification file $apiserverpodspec
-      on the master node and set the --terminated-pod-gc-
-      threshold to an appropriate threshold, for example:
+      Edit the Controller Manager pod specification file $controllermanagerconf
+      on the master node and set the --terminated-pod-gc-threshold to an appropriate threshold, for example:
       --terminated-pod-gc-threshold=10
     scored: true
 
@@ -662,7 +660,7 @@ groups:
           value: false
         set: true
     remediation: |
-      Edit the Controller Manager pod specification file $apiserverpodspec
+      Edit the Controller Manager pod specification file $apiserverconf
       on the master node and set the below parameter.
       --profiling=false
     scored: true
@@ -678,7 +676,7 @@ groups:
           value: true
         set: true
     remediation: |
-      Edit the Controller Manager pod specification file $apiserverpodspec
+      Edit the Controller Manager pod specification file $apiserverconf
       on the master node to set the below parameter.
       --use-service-account-credentials=true
     scored: true
@@ -691,7 +689,7 @@ groups:
       - flag: "--service-account-private-key-file"
         set: true
     remediation: |
-      Edit the Controller Manager pod specification file $apiserverpodspec
+      Edit the Controller Manager pod specification file $apiserverconf
       on the master node and set the --service-account-private-
       key-file parameter to the private key file for service accounts.
       --service-account-private-key-file=<filename>
@@ -705,9 +703,9 @@ groups:
       - flag: "--root-ca-file"
         set: true
     remediation: |
-      Edit the Controller Manager pod specification file $apiserverpodspec
+      Edit the Controller Manager pod specification file $apiserverconf
       on the master node and set the --root-ca-file parameter to
-      the certificate bundle file`.
+      the certificate bundle file.
       --root-ca-file=<path/to/file>
     scored: true
 
@@ -731,7 +729,7 @@ groups:
           value: true
         set: true
     remediation: |
-      Edit the Controller Manager pod specification file $apiserverpodspec
+      Edit the Controller Manager pod specification file $apiserverconf
       controller-manager.yaml on the master node and set the --feature-gates parameter to
       include RotateKubeletServerCertificate=true.
       --feature-gates=RotateKubeletServerCertificate=true
@@ -743,7 +741,7 @@ groups:
   - id: 1.4.1
     text: "Ensure that the API server pod specification file permissions are
     set to 644 or more restrictive (Scored)"
-    audit: "/bin/sh -c 'if test -e $apiserverpodspec; then stat -c %a $apiserverpodspec; fi'"
+    audit: "/bin/sh -c 'if test -e $apiserverconf; then stat -c %a $apiserverconf; fi'"
     tests:
       bin_op: or
       test_items:
@@ -765,13 +763,13 @@ groups:
     remediation: |
       Run the below command (based on the file location on your system) on the master node.
       For example,
-      chmod 644 $apiserverpodspec
+      chmod 644 $apiserverconf
     scored: true
 
   - id: 1.4.2
     text: "Ensure that the API server pod specification file ownership is set to
     root:root (Scored)"
-    audit: "/bin/sh -c 'if test -e $apiserverpodspec; then stat -c %U:%G $apiserverpodspec; fi'"
+    audit: "/bin/sh -c 'if test -e $apiserverconf; then stat -c %U:%G $apiserverconf; fi'"
     tests:
       test_items:
       - flag: "root:root"
@@ -782,13 +780,13 @@ groups:
     remediation: |
       Run the below command (based on the file location on your system) on the master node.
       For example,
-      chown root:root $apiserverpodspec
+      chown root:root $apiserverconf
     scored: true
 
   - id: 1.4.3
     text: "Ensure that the controller manager pod specification file
     permissions are set to 644 or more restrictive (Scored)"
-    audit: "/bin/sh -c 'if test -e $controllermanagerpodspec; then stat -c %a $controllermanagerpodspec; fi'"
+    audit: "/bin/sh -c 'if test -e $controllermanagerconf; then stat -c %a $controllermanagerconf; fi'"
     tests:
       bin_op: or
       test_items:
@@ -810,13 +808,13 @@ groups:
     remediation: |
       Run the below command (based on the file location on your system) on the master node.
       For example,
-      chmod 644 $controllermanagerpodspec
+      chmod 644 $controllermanagerconf
     scored: true
 
   - id: 1.4.4
     text: "Ensure that the controller manager pod specification file
     ownership is set to root:root (Scored)"
-    audit: "/bin/sh -c 'if test -e $controllermanagerpodspec; then stat -c %U:%G $controllermanagerpodspec; fi'"
+    audit: "/bin/sh -c 'if test -e $controllermanagerconf; then stat -c %U:%G $controllermanagerconf; fi'"
     tests:
       test_items:
       - flag: "root:root"
@@ -827,13 +825,13 @@ groups:
     remediation: |
       Run the below command (based on the file location on your system) on the master node.
       For example,
-      chown root:root $controllermanagerpodspec
+      chown root:root $controllermanagerconf
     scored: true
 
   - id: 1.4.5
     text: "Ensure that the scheduler pod specification file permissions are set
     to 644 or more restrictive (Scored)"
-    audit: "/bin/sh -c 'if test -e $schedulerpodspec; then stat -c %a $schedulerpodspec; fi'"
+    audit: "/bin/sh -c 'if test -e $schedulerconf; then stat -c %a $schedulerconf; fi'"
     tests:
       bin_op: or
       test_items:
@@ -855,13 +853,13 @@ groups:
     remediation: |
       Run the below command (based on the file location on your system) on the master node.
       For example,
-      chmod 644 $schedulerpodspec
+      chmod 644 $schedulerconf
     scored: true
 
   - id: 1.4.6
     text: "Ensure that the scheduler pod specification file ownership is set to
     root:root (Scored)"
-    audit: "/bin/sh -c 'if test -e $schedulerpodspec; then stat -c %U:%G $schedulerpodspec; fi'"
+    audit: "/bin/sh -c 'if test -e $schedulerconf; then stat -c %U:%G $schedulerconf; fi'"
     tests:
       test_items:
         - flag: "root:root"
@@ -872,13 +870,13 @@ groups:
     remediation: |
       Run the below command (based on the file location on your system) on the master node.
       For example,
-      chown root:root $schedulerpodspec
+      chown root:root $schedulerconf
     scored: true
 
   - id: 1.4.7
     text: "Ensure that the etcd pod specification file permissions are set to
     644 or more restrictive (Scored)"
-    audit: "/bin/sh -c 'if test -e $etcdpodspec; then stat -c %a $etcdpodspec; fi'"
+    audit: "/bin/sh -c 'if test -e $etcdconf; then stat -c %a $etcdconf; fi'"
     tests:
       bin_op: or
       test_items:
@@ -900,13 +898,13 @@ groups:
     remediation: |
       Run the below command (based on the file location on your system) on the master node.
       For example,
-      chmod 644 $etcdpodspec
+      chmod 644 $etcdconf
     scored: true
 
   - id: 1.4.8
     text: "Ensure that the etcd pod specification file ownership is set to
     root:root (Scored)"
-    audit: "/bin/sh -c 'if test -e $etcdpodspec; then stat -c %U:%G $etcdpodspec; fi'"
+    audit: "/bin/sh -c 'if test -e $etcdconf; then stat -c %U:%G $etcdconf; fi'"
     tests:
       test_items:
       - flag: "root:root"
@@ -917,7 +915,7 @@ groups:
     remediation: |
       Run the below command (based on the file location on your system) on the master node.
       For example,
-      chown root:root $etcdpodspec
+      chown root:root $etcdconf
     scored: true
 
   - id: 1.4.9
@@ -944,7 +942,7 @@ groups:
 
   - id: 1.4.11
     text: "Ensure that the etcd data directory permissions are set to 700 or more restrictive (Scored)"
-    audit: "ps -ef | grep $etcdbin | grep -v grep | grep -o data-dir=.* | cut -d= -f2 | xargs stat -c %a"
+    audit: ps -ef | grep $etcdbin | grep -v grep | sed 's%.*data-dir[= ]\([^ ]*\).*%\1%' | xargs stat -c %a
     tests:
       test_items:
       - flag: "700"
@@ -962,7 +960,7 @@ groups:
 
   - id: 1.4.12
     text: "Ensure that the etcd data directory ownership is set to etcd:etcd (Scored)"
-    audit: "ps -ef | grep $etcdbin | grep -v grep | grep -o data-dir=.* | cut -d= -f2 | xargs stat -c %U:%G"
+    audit: ps -ef | grep $etcdbin | grep -v grep | sed 's%.*data-dir[= ]\(\S*\)%\1%' | xargs stat -c %U:%G
     tests:
       test_items:
       - flag: "etcd:etcd"
@@ -980,12 +978,23 @@ groups:
     more restrictive (Scored)"
     audit: "/bin/sh -c 'if test -e /etc/kubernetes/admin.conf; then stat -c %a /etc/kubernetes/admin.conf; fi'"
     tests:
+      bin_op: or
       test_items:
-      - flag: "644"
-        compare:
-          op: eq
-          value: "644"
-        set: true
+        - flag: "644"
+          compare:
+            op: eq
+            value: "644"
+          set: true
+        - flag: "640"
+          compare:
+            op: eq
+            value: "640"
+          set: true
+        - flag: "600"
+          compare:
+            op: eq
+            value: "600"
+          set: true 
     remediation: |
       Run the below command (based on the file location on your system) on the master node.
       For example,
@@ -1011,14 +1020,25 @@ groups:
   - id: 1.4.15
     text: "Ensure that the scheduler.conf file permissions are set to 644 or
     more restrictive (Scored)"
-    audit: "/bin/sh -c 'if test -e $schedulerconf then stat -c %a $schedulerconf; fi'"
+    audit: "/bin/sh -c 'if test -e $schedulerconf; then stat -c %a $schedulerconf; fi'"
     tests:
+      bin_op: or
       test_items:
-      - flag: "644"
-        compare:
-          op: eq
-          value: "644"
-        set: true
+        - flag: "644"
+          compare:
+            op: eq
+            value: "644"
+          set: true
+        - flag: "640"
+          compare:
+            op: eq
+            value: "640"
+          set: true
+        - flag: "600"
+          compare:
+            op: eq
+            value: "600"
+          set: true
     remediation: |
       Run the below command (based on the file location on your system) on the master node.
       For example,
@@ -1044,14 +1064,25 @@ groups:
   - id: 1.4.17
     text: "Ensure that the controller-manager.conf file permissions are set
     to 644 or more restrictive (Scored)"
-    audit: "/bin/sh -c 'if test -e $controllermanagerconf then stat -c %a $controllermanagerconf; fi'"
+    audit: "/bin/sh -c 'if test -e $controllermanagerconf; then stat -c %a $controllermanagerconf; fi'"
     tests:
+      bin_op: or
       test_items:
-      - flag: "644"
-        compare:
-          op: eq
-          value: "644"
-        set: true
+        - flag: "644"
+          compare:
+            op: eq
+            value: "644"
+          set: true
+        - flag: "640"
+          compare:
+            op: eq
+            value: "640"
+          set: true
+        - flag: "600"
+          compare:
+            op: eq
+            value: "600"
+          set: true   
     remediation: |
       Run the below command (based on the file location on your system) on the master node.
       For example,
@@ -1088,7 +1119,7 @@ groups:
         set: true
     remediation: |
       Follow the etcd service documentation and configure TLS encryption.
-      Then, edit the etcd pod specification file $etcdpodspec on the
+      Then, edit the etcd pod specification file $etcdconf on the
       master node and set the below parameters.
       --ca-file=</path/to/ca-file>
       --key-file=</path/to/key-file>
@@ -1105,7 +1136,7 @@ groups:
           value: true
         set: true
     remediation: |
-      Edit the etcd pod specification file $etcdpodspec on the master
+      Edit the etcd pod specification file $etcdconf on the master
       node and set the below parameter.
       --client-cert-auth="true"
     scored: true
@@ -1123,8 +1154,8 @@ groups:
           op: neq
           value: true
     remediation: |
-      Edit the etcd pod specification file $etcdpodspec on the master
-      node and either remove the --auto-tls parameter or set it to false .
+      Edit the etcd pod specification file $etcdconf on the master
+      node and either remove the --auto-tls parameter or set it to false.
         --auto-tls=false
     scored: true
 
@@ -1140,8 +1171,7 @@ groups:
         set: true
     remediation: |
       Follow the etcd service documentation and configure peer TLS encryption as appropriate
-      for your etcd cluster.
-      Then, edit the etcd pod specification file $etcdpodspec on the
+      for your etcd cluster. Then, edit the etcd pod specification file $etcdconf on the
       master node and set the below parameters.
       --peer-client-file=</path/to/peer-cert-file>
       --peer-key-file=</path/to/peer-key-file>
@@ -1158,7 +1188,7 @@ groups:
           value: true
         set: true
     remediation: |
-      Edit the etcd pod specification file $etcdpodspec on the master
+      Edit the etcd pod specification file $etcdconf on the master
       node and set the below parameter.
       --peer-client-cert-auth=true
     scored: true
@@ -1177,8 +1207,8 @@ groups:
           value: false
         set: true
     remediation: |
-      Edit the etcd pod specification file $etcdpodspec on the master
-      node and either remove the --peer-auto-tls parameter or set it to false .
+      Edit the etcd pod specification file $etcdconf on the master
+      node and either remove the --peer-auto-tls parameter or set it to false.
       --peer-auto-tls=false
     scored: true
 
@@ -1190,7 +1220,7 @@ groups:
       - flag: "--wal-dir"
         set: true
     remediation: |
-      Edit the etcd pod specification file $etcdpodspec on the master
+      Edit the etcd pod specification file $etcdconf on the master
       node and set the below parameter.
       --wal-dir=</path/to/log/dir>
     scored: true
@@ -1206,7 +1236,7 @@ groups:
           value: 0
         set: true
     remediation: |
-      Edit the etcd pod specification file $etcdpodspec on the master
+      Edit the etcd pod specification file $etcdconf on the master
       node and set the below parameter.
       --max-wals=0
     scored: true
@@ -1221,7 +1251,7 @@ groups:
     remediation: |
       Follow the etcd documentation and create a dedicated certificate authority setup for the
       etcd service.
-      Then, edit the etcd pod specification file $etcdpodspec on the
+      Then, edit the etcd pod specification file $etcdconf on the
       master node and set the below parameter.
       --trusted-ca-file=</path/to/ca-file>
     scored: false 

cfg/1.8/node.yaml

@@ -19,7 +19,7 @@ groups:
           value: false
         set: true
     remediation: |
-      Edit the kubelet service file $kubeletunitfile
+      Edit the kubelet service file $kubeletconf
       on each worker node and set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable.
       --allow-privileged=false
       Based on your system, restart the kubelet service. For example:
@@ -38,7 +38,7 @@ groups:
           value: false
         set: true
     remediation: |
-      Edit the kubelet service file $kubeletunitfile
+      Edit the kubelet service file $kubeletconf
       on each worker node and set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable.
       --anonymous-auth=false
       Based on your system, restart the kubelet service. For example:
@@ -57,7 +57,7 @@ groups:
           value: "AlwaysAllow"
         set: true
     remediation: |
-      Edit the kubelet service file $kubeletunitfile
+      Edit the kubelet service file $kubeletconf
       on each worker node and set the below parameter in KUBELET_AUTHZ_ARGS variable.
       --authorization-mode=Webhook
       Based on your system, restart the kubelet service. For example:
@@ -73,7 +73,7 @@ groups:
       - flag: "--client-ca-file"
         set: true 
     remediation: |
-      Edit the kubelet service file $kubeletunitfile
+      Edit the kubelet service file $kubeletconf
       on each worker node and set the below parameter in KUBELET_AUTHZ_ARGS variable.
       --client-ca-file=<path/to/client-ca-file>
       Based on your system, restart the kubelet service. For example:
@@ -92,7 +92,7 @@ groups:
           value: 0
         set: true 
     remediation: |
-      Edit the kubelet service file $kubeletunitfile
+      Edit the kubelet service file $kubeletconf
       on each worker node and set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable.
       --read-only-port=0
       Based on your system, restart the kubelet service. For example:
@@ -111,7 +111,7 @@ groups:
           value: 0
         set: true
     remediation: |
-      Edit the kubelet service file $kubeletunitfile
+      Edit the kubelet service file $kubeletconf
       on each worker node and set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable.
       --streaming-connection-idle-timeout=5m
       Based on your system, restart the kubelet service. For example:
@@ -130,7 +130,7 @@ groups:
           value: true
         set: true
     remediation: |
-      Edit the kubelet service file $kubeletunitfile
+      Edit the kubelet service file $kubeletconf
       on each worker node and set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable.
       --protect-kernel-defaults=true
       Based on your system, restart the kubelet service. For example:
@@ -150,7 +150,7 @@ groups:
           value: true
         set: true
     remediation: |
-      Edit the kubelet service file $kubeletunitfile
+      Edit the kubelet service file $kubeletconf
       on each worker node and remove the --make-iptables-util-chains argument from the
       KUBELET_SYSTEM_PODS_ARGS variable.
       Based on your system, restart the kubelet service. For example:
@@ -169,7 +169,7 @@ groups:
           value: false
         set: true
     remediation: |
-      Edit the kubelet service file $kubeletunitfile
+      Edit the kubelet service file $kubeletconf
       on each worker node and set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable.
       --keep-terminated-pod-volumes=false
       Based on your system, restart the kubelet service. For example:
@@ -185,7 +185,7 @@ groups:
       - flag: "--hostname-override"
         set: false
     remediation: |
-      Edit the kubelet service file $kubeletunitfile
+      Edit the kubelet service file $kubeletconf
       on each worker node and remove the --hostname-override argument from the
       KUBELET_SYSTEM_PODS_ARGS variable.
       Based on your system, restart the kubelet service. For example:
@@ -204,7 +204,7 @@ groups:
           value: 0
         set: true
     remediation: |
-      Edit the kubelet service file $kubeletunitfile
+      Edit the kubelet service file $kubeletconf
       on each worker node and set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable.
       --event-qps=0
       Based on your system, restart the kubelet service. For example:
@@ -245,7 +245,7 @@ groups:
           value: 0
         set: true
     remediation: |
-      Edit the kubelet service file $kubeletunitfile
+      Edit the kubelet service file $kubeletconf
       on each worker node and set the below parameter in KUBELET_CADVISOR_ARGS variable.
       --cadvisor-port=0
       Based on your system, restart the kubelet service. For example:
@@ -264,7 +264,7 @@ groups:
           value: true
         set: true
     remediation: |
-      Edit the kubelet service file $kubeletunitfile
+      Edit the kubelet service file $kubeletconf
       on each worker node and remove the --feature-
       gates=RotateKubeletClientCertificate=false argument from the
       KUBELET_CERTIFICATE_ARGS variable.
@@ -284,7 +284,7 @@ groups:
           value: true
         set: true
     remediation: |
-      Edit the kubelet service file $kubeletunitfile
+      Edit the kubelet service file $kubeletconf
       on each worker node and set the below parameter in KUBELET_CERTIFICATE_ARGS variable.
       --feature-gates=RotateKubeletServerCertificate=true
       Based on your system, restart the kubelet service. For example:
@@ -342,7 +342,7 @@ groups:
     - id: 2.2.3
       text: "Ensure that the kubelet service file permissions are set to 644 or
       more restrictive (Scored)"
-      audit: "/bin/sh -c 'if test -e $kubeletunitfile; then stat -c %a $kubeletunitfile; fi'"
+      audit: "/bin/sh -c 'if test -e $kubeletconf; then stat -c %a $kubeletconf; fi'"
       tests:
         bin_op: or
         test_items:
@@ -364,13 +364,13 @@ groups:
       remediation: |
         Run the below command (based on the file location on your system) on the each worker
         node. For example,
-        chmod 755 $kubeletunitfile
+        chmod 755 $kubeletconf
       scored: true
 
     - id: 2.2.4
       text: "Ensure that the kubelet service file permissions are set to 644 or
       more restrictive (Scored)"
-      audit: "/bin/sh -c 'if test -e $kubeletunitfile; then stat -c %U:%G $kubeletunitfile; fi'"
+      audit: "/bin/sh -c 'if test -e $kubeletconf; then stat -c %U:%G $kubeletconf; fi'"
       tests:
         test_items:
         - flag: "root:root"
@@ -378,7 +378,7 @@ groups:
       remediation: |
         Run the below command (based on the file location on your system) on the each worker
         node. For example,
-        chown root:root $kubeletunitfile
+        chown root:root $kubeletconf
       scored: true
 
     - id: 2.2.5

cfg/config.yaml

@@ -30,10 +30,6 @@ master:
       - /etc/kubernetes/apiserver
     defaultconf: /etc/kubernetes/apiserver
 
-    podspecs:
-      - /etc/kubernetes/manifests/kube-apiserver.yaml
-    defaultpodspec: /etc/kubernetes/manifests/kube-apiserver.yaml
-
   scheduler:
     bins:
       - "kube-scheduler"
@@ -44,10 +40,6 @@ master:
       - /etc/kubernetes/scheduler
     defaultconf: /etc/kubernetes/scheduler
 
-    podspecs:
-      - /etc/kubernetes/manifests/kube-scheduler.yaml
-    defaultpodspec: /etc/kubernetes/manifests/kube-scheduler.yaml
-
   controllermanager:
     bins:
       - "kube-controller-manager"
@@ -58,10 +50,6 @@ master:
       - /etc/kubernetes/controller-manager
     defaultconf: /etc/kubernetes/controller-manager
 
-    podspecs:
-      - /etc/kubernetes/manifests/kube-controller-manager.yaml
-    defaultpodspec: /etc/kubernetes/manifests/kube-controller-manager.yaml
-
   etcd:
     optional: true
     bins:
@@ -70,17 +58,12 @@ master:
       - /etc/etcd/etcd.conf
     defaultconf: /etc/etcd/etcd.conf
 
-    podspecs:
-      - /etc/kubernetes/manifests/etcd.yaml
-    defaultpodspec: /etc/kubernetes/manifests/etcd.yaml
-
   flanneld:
     optional: true
     bins:
       - flanneld
     defaultconf: /etc/sysconfig/flanneld
 
-
 node:
   components:
     - kubelet
@@ -100,10 +83,6 @@ node:
       - /etc/kubernetes/kubelet 
     defaultconf: "/etc/kubernetes/kubelet.conf"
 
-    unitfiles:
-     - /etc/systemd/system/kubelet.service.d/10-kubeadm.conf
-    defaultunitfile: /etc/systemd/system/kubelet.service.d/10-kubeadm.conf
-  
   proxy:
     bins:
       - "kube-proxy"
@@ -130,5 +109,3 @@ federated:
       - "hyperkube federation-controller-manager"
       - "kube-federation-controller-manager"
       - "federation-controller-manager"
-
-

check/check.go

@@ -60,15 +60,16 @@ func handleError(err error, context string) (errmsg string) {
 // Check contains information about a recommendation in the
 // CIS Kubernetes 1.6+ document.
 type Check struct {
-	ID          string `yaml:"id" json:"id"`
-	Text        string
+	ID          string 		`yaml:"id" json:"test_number"`
+	Text        string		`json:"test_desc"`
 	Audit       string      `json:"omit"`
 	Type        string      `json:"type"`
 	Commands    []*exec.Cmd `json:"omit"`
 	Tests       *tests      `json:"omit"`
 	Set         bool        `json:"omit"`
-	Remediation string
-	State
+	Remediation string 		`json:"-"`
+	TestInfo    []string 	`json:"test_info"`
+	State 					`json:"status"`
 }
 
 // Run executes the audit commands specified in a check and outputs

check/controls.go

@@ -23,26 +23,29 @@ import (
 
 // Controls holds all controls to check for master nodes.
 type Controls struct {
-	ID     string `yaml:"id"`
-	Version string
-	Text   string
-	Type   NodeType
-	Groups []*Group
+	ID      string `yaml:"id" json:"id"`
+	Version string	`json:"version"`
+	Text    string 	`json:"text"`
+	Type    NodeType `json:"node_type"`
+	Groups  []*Group `json:"tests"`
 	Summary
 }
 
 // Group is a collection of similar checks.
 type Group struct {
-	ID     string `yaml:"id"`
-	Text   string
-	Checks []*Check
+	ID     string   `yaml:"id" json:"section"`
+	Pass   int      `json:"pass"`
+	Fail   int      `json:"fail"`
+	Warn   int      `json:"warn"`
+	Text   string   `json:"desc"`
+	Checks []*Check `json:"results"`
 }
 
 // Summary is a summary of the results of control checks run.
 type Summary struct {
-	Pass int
-	Fail int
-	Warn int
+	Pass int   `json:"total_pass"`
+	Fail int   `json:"total_fail"`
+	Warn int   `json:"total_warn"`
 }
 
 // NewControls instantiates a new master Controls object.
@@ -84,7 +87,9 @@ func (controls *Controls) RunGroup(gids ...string) Summary {
 			if gid == group.ID {
 				for _, check := range group.Checks {
 					check.Run()
+					check.TestInfo = append(check.TestInfo, check.Remediation)
 					summarize(controls, check)
+					summarizeGroup(group, check)
 				}
 
 				g = append(g, group)
@@ -112,6 +117,7 @@ func (controls *Controls) RunChecks(ids ...string) Summary {
 			for _, id := range ids {
 				if id == check.ID {
 					check.Run()
+					check.TestInfo = append(check.TestInfo, check.Remediation)
 					summarize(controls, check)
 
 					// Check if we have already added this checks group.
@@ -178,3 +184,14 @@ func summarize(controls *Controls, check *Check) {
 		controls.Summary.Warn++
 	}
 }
+
+func summarizeGroup(group *Group, check *Check) {
+	switch check.State {
+	case PASS:
+		group.Pass++
+	case FAIL:
+		group.Fail++
+	case WARN:
+		group.Warn++
+	}
+}

cmd/common.go

@@ -17,6 +17,7 @@ package cmd
 import (
 	"fmt"
 	"io/ioutil"
+	"path/filepath"
 
 	"github.com/aquasecurity/kube-bench/check"
 	"github.com/golang/glog"
@@ -29,6 +30,7 @@ var (
 
 func runChecks(t check.NodeType) {
 	var summary check.Summary
+	var nodetype string
 	var file string
 	var err error
 	var typeConf *viper.Viper
@@ -36,47 +38,50 @@ func runChecks(t check.NodeType) {
 	switch t {
 	case check.MASTER:
 		file = masterFile
-		typeConf = viper.Sub("master")
+		nodetype = "master"
 	case check.NODE:
 		file = nodeFile
-		typeConf = viper.Sub("node")
+		nodetype = "node"
 	case check.FEDERATED:
 		file = federatedFile
-		typeConf = viper.Sub("federated")
+		nodetype = "federated"
 	}
 
+	ver := getKubeVersion()
+	switch ver {
+	case "1.9", "1.10":
+		continueWithError(nil, fmt.Sprintf("No CIS spec for %s - using tests from CIS 1.2.0 spec for Kubernetes 1.8\n", ver))
+		ver = "1.8"
+	}
+
+	path := filepath.Join(cfgDir, ver)
+	def := filepath.Join(path, file)
+
+	in, err := ioutil.ReadFile(def)
+	if err != nil {
+		exitWithError(fmt.Errorf("error opening %s controls file: %v", t, err))
+	}
+
+	// Merge kubernetes version specific config if any.
+	viper.SetConfigFile(path + "/config.yaml")
+	err = viper.MergeInConfig()
+	if err != nil {
+		continueWithError(err, fmt.Sprintf("Reading %s specific configuration file", ver))
+	}
+	typeConf = viper.Sub(nodetype)
+
 	// Get the set of exectuables and config files we care about on this type of node. This also
 	// checks that the executables we need for the node type are running.
 	binmap := getBinaries(typeConf)
-	confmap := getConfigFiles(typeConf, "conf")
-	podspecmap := getConfigFiles(typeConf, "podspec")
-	unitfilemap := getConfigFiles(typeConf, "unitfile")
-
-	switch t {
-	case check.MASTER:
-		file = masterFile
-	case check.NODE:
-		file = nodeFile
-	case check.FEDERATED:
-		file = federatedFile
-	}
-
-	ver := getKubeVersion()
-	path := fmt.Sprintf("%s/%s/%s", cfgDir, ver.Server, file)
-	in, err := ioutil.ReadFile(path)
-	if err != nil {
-		exitWithError(fmt.Errorf("error opening %s controls file: %v", t, err))
-	}
+	confmap := getConfigFiles(typeConf)
 
 	// Variable substitutions. Replace all occurrences of variables in controls files.
 	s := string(in)
 	s = makeSubstitutions(s, "bin", binmap)
 	s = makeSubstitutions(s, "conf", confmap)
-	s = makeSubstitutions(s, "podspec", podspecmap)
-	s = makeSubstitutions(s, "unitfile", unitfilemap)
 
 	glog.V(1).Info(fmt.Sprintf("Using config file: %s\n", viper.ConfigFileUsed()))
-	glog.V(1).Info(fmt.Sprintf("Using benchmark file: %s\n", path))
+	glog.V(1).Info(fmt.Sprintf("Using benchmark file: %s\n", def))
 
 	controls, err := check.NewControls(t, []byte(s))
 	if err != nil {
@@ -104,7 +109,17 @@ func runChecks(t check.NodeType) {
 
 		fmt.Println(string(out))
 	} else {
-		prettyPrint(controls, summary)
+		// if we want to store in PostgreSQL, convert to JSON and save it
+		if (summary.Fail > 0 || summary.Warn > 0 || summary.Pass > 0) && pgSQL {
+			out, err := controls.JSON()
+			if err != nil {
+				exitWithError(fmt.Errorf("failed to output in JSON format: %v", err))
+			}
+
+			savePgsql(string(out))
+		} else {
+			prettyPrint(controls, summary)
+		}
 	}
 }
 

cmd/database.go

@@ -0,0 +1,60 @@
+package cmd
+
+import (
+	"fmt"
+	"os"
+	"time"
+
+	"github.com/golang/glog"
+	"github.com/jinzhu/gorm"
+	_ "github.com/jinzhu/gorm/dialects/postgres" // database packages get blank imports
+	"github.com/spf13/viper"
+)
+
+func savePgsql(jsonInfo string) {
+	envVars := map[string]string{
+		"PGSQL_HOST":     viper.GetString("PGSQL_HOST"),
+		"PGSQL_USER":     viper.GetString("PGSQL_USER"),
+		"PGSQL_DBNAME":   viper.GetString("PGSQL_DBNAME"),
+		"PGSQL_SSLMODE":  viper.GetString("PGSQL_SSLMODE"),
+		"PGSQL_PASSWORD": viper.GetString("PGSQL_PASSWORD"),
+	}
+
+	for k, v := range envVars {
+		if v == "" {
+			exitWithError(fmt.Errorf("environment variable %s is missing", envVarsPrefix+"_"+k))
+		}
+	}
+
+	connInfo := fmt.Sprintf("host=%s user=%s dbname=%s sslmode=%s password=%s",
+		envVars["PGSQL_HOST"],
+		envVars["PGSQL_USER"],
+		envVars["PGSQL_DBNAME"],
+		envVars["PGSQL_SSLMODE"],
+		envVars["PGSQL_PASSWORD"],
+	)
+
+	hostname, err := os.Hostname()
+	if err != nil {
+		exitWithError(fmt.Errorf("received error looking up hostname: %s", err))
+	}
+
+	timestamp := time.Now()
+
+	type ScanResult struct {
+		gorm.Model
+		ScanHost string    `gorm:"type:varchar(63) not null"` // https://www.ietf.org/rfc/rfc1035.txt
+		ScanTime time.Time `gorm:"not null"`
+		ScanInfo string    `gorm:"type:jsonb not null"`
+	}
+
+	db, err := gorm.Open("postgres", connInfo)
+	defer db.Close()
+	if err != nil {
+		exitWithError(fmt.Errorf("received error connecting to database: %s", err))
+	}
+
+	db.Debug().AutoMigrate(&ScanResult{})
+	db.Save(&ScanResult{ScanHost: hostname, ScanTime: timestamp, ScanInfo: jsonInfo})
+	glog.V(2).Info(fmt.Sprintf("successfully stored result to: %s", envVars["PGSQL_HOST"]))
+}

cmd/root.go

@@ -25,15 +25,17 @@ import (
 )
 
 var (
-	cfgDir  = "./cfg"
-	cfgFile string
-
-	jsonFmt       bool
-	checkList     string
-	groupList     string
-	masterFile    string
-	nodeFile      string
-	federatedFile string
+	envVarsPrefix      = "KUBE_BENCH"
+	cfgDir             = "./cfg"
+	defaultKubeVersion = "1.6"
+	cfgFile            string
+	jsonFmt            bool
+	pgSQL              bool
+	checkList          string
+	groupList          string
+	masterFile         string
+	nodeFile           string
+	federatedFile      string
 )
 
 // RootCmd represents the base command when called without any subcommands
@@ -59,6 +61,7 @@ func init() {
 	cobra.OnInitialize(initConfig)
 
 	RootCmd.PersistentFlags().BoolVar(&jsonFmt, "json", false, "Prints the results as JSON")
+	RootCmd.PersistentFlags().BoolVar(&pgSQL, "pgsql", false, "Save the results to PostgreSQL")
 	RootCmd.PersistentFlags().StringVarP(
 		&checkList,
 		"check",
@@ -90,7 +93,7 @@ func initConfig() {
 		viper.AddConfigPath(cfgDir)   // adding ./cfg as first search path
 	}
 
-	viper.SetEnvPrefix("KUBE_BENCH")
+	viper.SetEnvPrefix(envVarsPrefix)
 	viper.AutomaticEnv() // read in environment variables that match
 
 	// If a config file is found, read it in.

cmd/util.go

@@ -119,7 +119,7 @@ func getBinaries(v *viper.Viper) map[string]string {
 // getConfigFiles finds which of the set of candidate config files exist
 // accepts a string 't' which indicates the type of config file, conf,
 // podspec or untifile.
-func getConfigFiles(v *viper.Viper, t string) map[string]string {
+func getConfigFiles(v *viper.Viper) map[string]string {
 	confmap := make(map[string]string)
 
 	for _, component := range v.GetStringSlice("components") {
@@ -129,14 +129,14 @@ func getConfigFiles(v *viper.Viper, t string) map[string]string {
 		}
 
 		// See if any of the candidate config files exist
-		conf := findConfigFile(s.GetStringSlice(t + "s"))
+		conf := findConfigFile(s.GetStringSlice("confs"))
 		if conf == "" {
-			if s.IsSet("default" + t) {
-				conf = s.GetString("default" + t)
+			if s.IsSet("defaultconf") {
+				conf = s.GetString("defaultconf")
 				glog.V(2).Info(fmt.Sprintf("Using default config file name '%s' for component %s", conf, component))
 			} else {
 				// Default the config file name that we'll substitute to the name of the component
-				printlnWarn(fmt.Sprintf("Missing config file for %s", component))
+				glog.V(2).Info(fmt.Sprintf("Missing config file for %s", component))
 				conf = component
 			}
 		} else {
@@ -196,9 +196,8 @@ func findExecutable(candidates []string) (string, error) {
 	for _, c := range candidates {
 		if verifyBin(c) {
 			return c, nil
-		} else {
-			glog.V(1).Info(fmt.Sprintf("executable '%s' not running", c))
 		}
+		glog.V(1).Info(fmt.Sprintf("executable '%s' not running", c))
 	}
 
 	return "", fmt.Errorf("no candidates running")
@@ -213,39 +212,60 @@ func multiWordReplace(s string, subname string, sub string) string {
 	return strings.Replace(s, subname, sub, -1)
 }
 
-type version struct {
-	Server string
-	Client string
-}
-
-func getKubeVersion() *version {
-	ver := new(version)
+func getKubeVersion() string {
 	// These executables might not be on the user's path.
 	_, err := exec.LookPath("kubectl")
+
 	if err != nil {
-		s := fmt.Sprintf("Kubernetes version check skipped with error %v", err)
-		continueWithError(err, sprintlnWarn(s))
-		return nil
+		_, err = exec.LookPath("kubelet")
+		if err != nil {
+			exitWithError(fmt.Errorf("Version check failed: need kubectl or kubelet binaries to get kubernetes version"))
+		}
+		return getKubeVersionFromKubelet()
 	}
 
-	cmd := exec.Command("kubectl", "version")
-	out, err := cmd.Output()
+	return getKubeVersionFromKubectl()
+}
+
+func getKubeVersionFromKubectl() string {
+	cmd := exec.Command("kubectl", "version", "--short")
+	out, err := cmd.CombinedOutput()
 	if err != nil {
-		s := fmt.Sprintf("Kubernetes version check skipped, with error getting kubectl version")
-		continueWithError(err, sprintlnWarn(s))
-		return nil
+		continueWithError(fmt.Errorf("%s", out), "")
 	}
 
-	clientVerRe := regexp.MustCompile(`Client.*Major:"(\d+)".*Minor:"(\d+)"`)
-	svrVerRe := regexp.MustCompile(`Server.*Major:"(\d+)".*Minor:"(\d+)"`)
+	return getVersionFromKubectlOutput(string(out))
+}
 
-	sub := clientVerRe.FindStringSubmatch(string(out))
-	ver.Client = sub[1] + "." + sub[2]
+func getKubeVersionFromKubelet() string {
+	cmd := exec.Command("kubelet", "--version")
+	out, err := cmd.CombinedOutput()
+	
+	if err != nil {
+		continueWithError(fmt.Errorf("%s", out), "")
+	}
 
-	sub = svrVerRe.FindStringSubmatch(string(out))
-	ver.Server = sub[1] + "." + sub[2]
+	return getVersionFromKubeletOutput(string(out))
+}
 
-	return ver
+func getVersionFromKubectlOutput(s string) string {
+	serverVersionRe := regexp.MustCompile(`Server Version: v(\d+.\d+)`)
+	subs := serverVersionRe.FindStringSubmatch(s)
+	if len(subs) < 2 {
+		printlnWarn(fmt.Sprintf("Unable to get kubectl version, using default version: %s", defaultKubeVersion))
+		return defaultKubeVersion
+	}
+	return subs[1]
+}
+
+func getVersionFromKubeletOutput(s string) string {
+	serverVersionRe := regexp.MustCompile(`Kubernetes v(\d+.\d+)`)
+	subs := serverVersionRe.FindStringSubmatch(s)
+	if len(subs) < 2 {
+		printlnWarn(fmt.Sprintf("Unable to get kubelet version, using default version: %s", defaultKubeVersion))
+		return defaultKubeVersion
+	}
+	return subs[1]
 }
 
 func makeSubstitutions(s string, ext string, m map[string]string) string {

cmd/util_test.go

@@ -17,7 +17,6 @@ package cmd
 import (
 	"os"
 	"reflect"
-	"regexp"
 	"strconv"
 	"testing"
 
@@ -182,19 +181,17 @@ func TestMultiWordReplace(t *testing.T) {
 	}
 }
 
-func TestGetKubeVersion(t *testing.T) {
-	ver := getKubeVersion()
-	if ver == nil {
-		t.Log("Expected non nil version info.")
-	} else {
-		if ok, err := regexp.MatchString(`\d+.\d+`, ver.Client); !ok && err != nil {
-			t.Logf("Expected:%v got %v\n", "n.m", ver.Client)
-		}
-
-		if ok, err := regexp.MatchString(`\d+.\d+`, ver.Server); !ok && err != nil {
-			t.Logf("Expected:%v got %v\n", "n.m", ver.Server)
-		}
+func TestKubeVersionRegex(t *testing.T) {
+	ver := getVersionFromKubectlOutput(`Client Version: v1.8.0
+		Server Version: v1.8.12
+		`)
+	if ver != "1.8" {
+		t.Fatalf("Expected 1.8 got %s", ver)
+	}
 
+	ver = getVersionFromKubectlOutput("Something completely different")
+	if ver != "1.6" {
+		t.Fatalf("Expected 1.6 got %s", ver)
 	}
 }
 
@@ -282,7 +279,7 @@ func TestGetConfigFiles(t *testing.T) {
 			e = c.statResults
 			eIndex = 0
 
-			m := getConfigFiles(v, "conf")
+			m := getConfigFiles(v)
 			if !reflect.DeepEqual(m, c.exp) {
 				t.Fatalf("Got %v\nExpected %v", m, c.exp)
 			}

entrypoint.sh

@@ -1,8 +1,8 @@
 #!/bin/sh
 if [ -d /host ]; then
   mkdir -p /host/cfg/
-  yes | cp -rf ./kube-bench/cfg/* /host/cfg/
-  yes | cp -rf ./kube-bench/kube-bench /host/
+  yes | cp -rf /cfg/* /host/cfg/
+  yes | cp -rf /kube-bench /host/
   echo "==============================================="
   echo "kube-bench is now installed on your host       "
   echo "Run ./kube-bench to perform a security check   "

glide.lock

@@ -0,0 +1,72 @@
+hash: f3cf12cf95d66d315c4aef2f3d0940770bd26267f84703e53c4928b786a91c14
+updated: 2018-01-09T12:49:41.3014329-08:00
+imports:
+- name: github.com/fatih/color
+  version: 570b54cabe6b8eb0bc2dfce68d964677d63b5260
+- name: github.com/fsnotify/fsnotify
+  version: 4da3e2cfbabc9f751898f250b49f2439785783a1
+- name: github.com/golang/glog
+  version: 23def4e6c14b4da8ac2ed8007337bc5eb5007998
+- name: github.com/hashicorp/hcl
+  version: 23c074d0eceb2b8a5bfdbb271ab780cde70f05a8
+  subpackages:
+  - hcl/ast
+  - hcl/parser
+  - hcl/scanner
+  - hcl/strconv
+  - hcl/token
+  - json/parser
+  - json/scanner
+  - json/token
+- name: github.com/inconshreveable/mousetrap
+  version: 76626ae9c91c4f2a10f34cad8ce83ea42c93bb75
+- name: github.com/jinzhu/gorm
+  version: 5174cc5c242a728b435ea2be8a2f7f998e15429b
+  subpackages:
+  - dialects/postgres
+- name: github.com/jinzhu/inflection
+  version: 1c35d901db3da928c72a72d8458480cc9ade058f
+- name: github.com/lib/pq
+  version: 83612a56d3dd153a94a629cd64925371c9adad78
+  subpackages:
+  - hstore
+  - oid
+- name: github.com/magiconair/properties
+  version: 49d762b9817ba1c2e9d0c69183c2b4a8b8f1d934
+- name: github.com/mattn/go-colorable
+  version: 5411d3eea5978e6cdc258b30de592b60df6aba96
+  repo: https://github.com/mattn/go-colorable
+- name: github.com/mattn/go-isatty
+  version: 57fdcb988a5c543893cc61bce354a6e24ab70022
+  repo: https://github.com/mattn/go-isatty
+- name: github.com/mitchellh/mapstructure
+  version: 06020f85339e21b2478f756a78e295255ffa4d6a
+- name: github.com/pelletier/go-toml
+  version: 0131db6d737cfbbfb678f8b7d92e55e27ce46224
+- name: github.com/spf13/afero
+  version: 57afd63c68602b63ed976de00dd066ccb3c319db
+  subpackages:
+  - mem
+- name: github.com/spf13/cast
+  version: acbeb36b902d72a7a4c18e8f3241075e7ab763e4
+- name: github.com/spf13/cobra
+  version: 7b2c5ac9fc04fc5efafb60700713d4fa609b777b
+- name: github.com/spf13/jwalterweatherman
+  version: 12bd96e66386c1960ab0f74ced1362f66f552f7b
+- name: github.com/spf13/pflag
+  version: 4c012f6dcd9546820e378d0bdda4d8fc772cdfea
+- name: github.com/spf13/viper
+  version: 25b30aa063fc18e48662b86996252eabdcf2f0c7
+- name: golang.org/x/sys
+  version: e24f485414aeafb646f6fca458b0bf869c0880a1
+  repo: https://go.googlesource.com/sys
+  subpackages:
+  - unix
+- name: golang.org/x/text
+  version: e19ae1496984b1c655b8044a65c0300a3c878dd3
+  subpackages:
+  - transform
+  - unicode/norm
+- name: gopkg.in/yaml.v2
+  version: c95af922eae69f190717a0b7148960af8c55a072
+testImports: []

glide.yaml

@@ -0,0 +1,14 @@
+package: github.com/aquasecurity/kube-bench
+import:
+- package: github.com/fatih/color
+  version: ^1.5.0
+- package: github.com/golang/glog
+- package: github.com/jinzhu/gorm
+  version: ^1.0.0
+  subpackages:
+  - dialects/postgres
+- package: github.com/spf13/cobra
+  version: ^0.0.1
+- package: github.com/spf13/viper
+  version: ^1.0.0
+- package: gopkg.in/yaml.v2