Merge pull request #102 from aquasecurity/update-goreleaser

Update to nfpm as fpm is deprecated

.goreleaser.yml

@@ -0,0 +1,18 @@
+builds:
+  - main: main.go
+    binary: kube-bench
+    goos:
+      - darwin
+      - linux
+    goarch:
+      - amd64
+# Archive customization
+archive:
+  format: tar.gz
+nfpm:
+  vendor: Aqua Security
+  description: "The Kubernetes Bench for Security is a Go application that checks whether Kubernetes is deployed according to security best practices"
+  license: Apache-2.0
+  formats:
+    - deb
+    - rpm

.travis.yml

@@ -1,6 +1,25 @@
+---
 language: go
-install: 
-  - go get github.com/aquasecurity/kube-bench
+
+notifications:
+  email: false
+
+before_install:
+  - sudo apt-get -qq update
+  - sudo apt-get install -y rpm
+  - gem install --no-ri --no-rdoc fpm
+
+install:
+  - go get -v github.com/Masterminds/glide
+  - cd $GOPATH/src/github.com/Masterminds/glide && git checkout tags/v0.12.3 && go install && cd - # use a known good glide version
+  - glide install
+
 script:
   - go test ./...
-  - go build -o kube-bench .
+
+after_success:
+  - test -n "$TRAVIS_TAG" && curl -sL https://git.io/goreleaser | bash
+
+env:
+  global:
+    secure: mb8AYZKDo6hkKN+2F9ldXcw27Yn2AfxpXvKlD8GD7NdGOI+TaiSFbE0I+qqTa/1DqcRekCQwqN7OG/17s9JDkgzUXYuYUGlVUOM4WbeJoSlzJFIOh9r9R/JddluYJohypgkE20IBHIrEHq5sY0Nn1Pl9WgSQFaVcQjxkX009AOuVjN0o5HcoXsb5hAzvHrpoSPkcSSqq7VWab60TgUttVaRlZSGwGdSYQEqk5TdO0hWHuXyxaaEPybgFIyZLLbxPS4JmMz8n3Sngetpw9Jgc+V9Fc7wKXpjvZZ33SpArG5p5ZFFu2YQOXFLZth9qtQOjduQ2gU1kHN6WjWnJ8QX2s8vmU38Tk19kd5i+mz9dvc87IdBvmTIqVYSpM6AAYa2osBGP3f97Rj2S68lTad4ecSVyHdsjz56vdE3ZH4wskswmogbKkVdvO4biPHxT6odszBxYLEJuRJyZ7ckXd52MCzqAUPrw7YUuH8N1mLIlf7V5bW5R+q4DlKw774zxnHiWrymXGvlINSrB0qxBn8Fii6ib+Pacl3PuqSumCcgIHlVjqrzIXaqcTMn2/ABZYC99mralGvwA/EgNa8CBKB5evMCEwWa5Ntvcs2I2DFcO5Q2WzN4H0YScyAzzCzK7/3hWJE/rUIJntwiSXkV3MSa1yxWSGGH8F1lcz+lzgTBm/MU=

Dockerfile

@@ -5,8 +5,8 @@ RUN go get github.com/aquasecurity/kube-bench
 FROM alpine:latest
 WORKDIR /
 COPY --from=0 /go/bin/kube-bench /kube-bench 
-COPY cfg cfg
-COPY entrypoint.sh /entrypoint.sh
+COPY --from=0 /go/src/github.com/aquasecurity/kube-bench/cfg /cfg
+COPY --from=0 /go/src/github.com/aquasecurity/kube-bench/entrypoint.sh /entrypoint.sh
 ENTRYPOINT /entrypoint.sh
 
 # Build-time metadata as defined at http://label-schema.org

README.md

@@ -24,12 +24,14 @@ Run ```docker run --rm -v `pwd`:/host aquasec/kube-bench:latest```. This will co
 
 2. Install from sources:
 If Go is installed on the target machines, you can simply clone this repository and run as follows (assuming your [$GOPATH is set](https://github.com/golang/go/wiki/GOPATH)):
-```go get github.com/aquasecurity/kube-bench```
-```go get github.com/Masterminds/glide```
-```cd $GOPATH/src/github.com/aquasecurity/kube-bench```
-```$GOPATH/bin/glide install```
-```go build -o kube-bench . ```
-```./kube-bench <master|node>```
+
+```go get github.com/aquasecurity/kube-bench
+go get github.com/Masterminds/glide
+cd $GOPATH/src/github.com/aquasecurity/kube-bench
+$GOPATH/bin/glide install
+go build -o kube-bench . 
+./kube-bench <master|node>
+```
 
 ## Usage
 ```./kube-bench [command]```
@@ -45,7 +47,6 @@ Flags:
   -c, --check string          A comma-delimited list of checks to run as specified in CIS document. Example --check="1.1.1,1.1.2"
       --config string         config file (default is ./cfg/config.yaml)
   -g, --group string          Run all the checks under this comma-delimited list of groups. Example --group="1.1"
-      --installation string   Specify how kubernetes cluster was installed. Possible values are default,hyperkube,kops,kubeadm (default "default")
       --json                  Prints the results as JSON
   -v, --verbose               verbose output (default false)
 ```

cfg/1.6/master.yaml

@@ -731,7 +731,7 @@ groups:
       
     - id: 1.4.11
       text: "Ensure that the etcd data directory permissions are set to 700 or more restrictive (Scored)"
-      audit: "ps -ef | grep $etcdbin | grep -v grep | grep -o data-dir=.* | cut -d= -f2 | xargs stat -c %a"
+      audit: ps -ef | grep $etcdbin | grep -v grep | sed 's%.*data-dir[= ]\(\S*\)%\1%' | xargs stat -c %a
       tests:
         test_items:
         - flag: "700"
@@ -748,7 +748,7 @@ groups:
 
     - id: 1.4.12
       text: "Ensure that the etcd data directory ownership is set to etcd:etcd (Scored)"
-      audit: "ps -ef | grep $etcdbin | grep -v grep | grep -o data-dir=.* | cut -d= -f2 | xargs stat -c %U:%G"
+      audit: ps -ef | grep $etcdbin | grep -v grep | sed 's%.*data-dir[= ]\(\S*\)%\1%' | xargs stat -c %U:%G
       tests:
         test_items:
         - flag: "etcd:etcd"

cfg/1.7/master.yaml

@@ -793,7 +793,7 @@ groups:
       
     - id: 1.4.11
       text: "Ensure that the etcd data directory permissions are set to 700 or more restrictive (Scored)"
-      audit: "ps -ef | grep $etcdbin | grep -v grep | grep -o data-dir=.* | cut -d= -f2 | xargs stat -c %a"
+      audit: ps -ef | grep $etcdbin | grep -v grep | sed 's%.*data-dir[= ]\(\S*\)%\1%' | xargs stat -c %a
       tests:
         test_items:
         - flag: "700"
@@ -810,7 +810,7 @@ groups:
 
     - id: 1.4.12
       text: "Ensure that the etcd data directory ownership is set to etcd:etcd (Scored)"
-      audit: "ps -ef | grep $etcdbin | grep -v grep | grep -o data-dir=.* | cut -d= -f2 | xargs stat -c %U:%G"
+      audit: ps -ef | grep $etcdbin | grep -v grep | ed 's%.*data-dir[= ]\(\S*\)%\1%' | xargs stat -c %U:%G
       tests:
         test_items:
         - flag: "etcd:etcd"

cfg/1.8/config.yaml

@@ -0,0 +1,38 @@
+---
+## Controls Files. 
+# These are YAML files that hold all the details for running checks.
+#
+## Uncomment to use different control file paths.
+# masterControls: ./cfg/master.yaml
+# nodeControls: ./cfg/node.yaml
+# federatedControls: ./cfg/federated.yaml
+
+master:
+  apiserver:
+    defaultconf: /etc/kubernetes/manifests/kube-apiserver.yaml
+
+  scheduler:
+    confs: 
+      - /etc/kubernetes/manifests/kube-scheduler.yaml
+    defaultconf: /etc/kubernetes/manifests/kube-scheduler.yaml
+
+  controllermanager:
+    confs:
+      - /etc/kubernetes/manifests/kube-controller-manager.yaml
+    defaultconf: /etc/kubernetes/manifests/kube-controller-manager.yaml
+
+  etcd:
+    confs:
+      - /etc/kubernetes/manifests/etcd.yaml
+    defaultconf: /etc/kubernetes/manifests/etcd.yaml
+
+node:
+  kubelet:
+    confs:
+     - /etc/systemd/system/kubelet.service.d/10-kubeadm.conf
+    defaultconf: /etc/systemd/system/kubelet.service.d/10-kubeadm.conf
+  
+  proxy:
+    confs:
+      - /etc/kubernetes/addons/kube-proxy-daemonset.yaml
+    defaultconf: /etc/kubernetes/addons/kube-proxy-daemonset.yaml

cfg/1.8/master.yaml

@@ -19,7 +19,7 @@ groups:
           value: false
         set: true
     remediation: | 
-      Edit the API server pod specification file $apiserverpodspec
+      Edit the API server pod specification file $apiserverconf
       on the master node and set the below parameter.
       --anonymous-auth=false
 
@@ -34,7 +34,7 @@ groups:
         set: false
     remediation: |
       Follow the documentation and configure alternate mechanisms for authentication. Then,
-      edit the API server pod specification file $apiserverpodspec
+      edit the API server pod specification file $apiserverconf
       on the master node and remove the --basic-auth-file=<filename>
       parameter.
     scored: true
@@ -47,7 +47,7 @@ groups:
       - flag:  "--insecure-allow-any-token"
         set: false
     remediation: |
-      Edit the API server pod specification file $apiserverpodspec
+      Edit the API server pod specification file $apiserverconf
       on the master node and remove the --insecure-allow-any-token
       parameter.
     scored: true
@@ -66,7 +66,7 @@ groups:
       - flag: "--kubelet-https"
         set: false
     remediation: |
-      Edit the API server pod specification file $apiserverpodspec
+      Edit the API server pod specification file $apiserverconf
       on the master node and remove the --kubelet-https parameter.
     scored: true
 
@@ -78,7 +78,7 @@ groups:
       - flag: "--insecure-bind-address"
         set: false
     remediation: |
-      Edit the API server pod specification file $apiserverpodspec
+      Edit the API server pod specification file $apiserverconf
       on the master node and remove the --insecure-bind-address
       parameter.
     scored: true
@@ -94,7 +94,7 @@ groups:
           value: 0
         set: true
     remediation: |
-      Edit the API server pod specification file $apiserverpodspec
+      Edit the API server pod specification file $apiserverconf
       apiserver.yaml on the master node and set the below parameter.
       --insecure-port=0
     scored: true
@@ -113,7 +113,7 @@ groups:
         - flag: "--secure-port"
           set: false
     remediation: |
-      Edit the API server pod specification file $apiserverpodspec
+      Edit the API server pod specification file $apiserverconf
       on the master node and either remove the --secure-port parameter or
       set it to a different (non-zero) desired port.
     scored: true
@@ -129,7 +129,7 @@ groups:
           value: false
         set: true
     remediation: |
-      Edit the API server pod specification file $apiserverpodspec
+      Edit the API server pod specification file $apiserverconf
       on the master node and set the below parameter.
       --profiling=false
     scored: true
@@ -145,7 +145,7 @@ groups:
           value: false
         set: true
     remediation: |
-      Edit the API server pod specification file $apiserverpodspec
+      Edit the API server pod specification file $apiserverconf
       on the master node and set the below parameter.
       --repair-malformed-updates=false
     scored: true
@@ -161,7 +161,7 @@ groups:
           value: AlwaysAdmit 
         set: true
     remediation: |
-      Edit the API server pod specification file $apiserverpodspec
+      Edit the API server pod specification file $apiserverconf
       on the master node and set the --admission-control parameter to a
       value that does not include AlwaysAdmit.
     scored: true
@@ -177,7 +177,7 @@ groups:
           value: "AlwaysPullImages"
         set: true
     remediation: |
-      Edit the API server pod specification file $apiserverpodspec
+      Edit the API server pod specification file $apiserverconf
       on the master node and set the --admission-control parameter to
       include AlwaysPullImages.
       --admission-control=...,AlwaysPullImages,...
@@ -194,7 +194,7 @@ groups:
           value: "DenyEscalatingExec"
         set: true
     remediation: |
-      Edit the API server pod specification file $apiserverpodspec
+      Edit the API server pod specification file $apiserverconf
       on the master node and set the --admission-control parameter to a
       value that includes DenyEscalatingExec.
       --admission-control=...,DenyEscalatingExec,...
@@ -211,7 +211,7 @@ groups:
           value: "SecurityContextDeny"
         set: true
     remediation: |
-      Edit the API server pod specification file $apiserverpodspec
+      Edit the API server pod specification file $apiserverconf
       on the master node and set the --admission-control parameter to
       include SecurityContextDeny.
       --admission-control=...,SecurityContextDeny,...
@@ -228,7 +228,7 @@ groups:
           value: "NamespaceLifecycle"
         set: true
     remediation: |
-      Edit the API server pod specification file $apiserverpodspec
+      Edit the API server pod specification file $apiserverconf
       on the master node and set the --admission-control parameter to
       include NamespaceLifecycle.
       --admission-control=...,NamespaceLifecycle,...
@@ -242,7 +242,7 @@ groups:
       - flag: "--audit-log-path"
         set: true
     remediation: |
-      Edit the API server pod specification file $apiserverpodspec
+      Edit the API server pod specification file $apiserverconf
       on the master node and set the --audit-log-path parameter to a suitable
     path and file where you would like audit logs to be written, for example:
             --audit-log-path=/var/log/apiserver/audit.log
@@ -259,7 +259,7 @@ groups:
           value: 30
         set: true
     remediation: |
-      Edit the API server pod specification file $apiserverpodspec
+      Edit the API server pod specification file $apiserverconf
       on the master node and set the --audit-log-maxage parameter to 30 or
     as an appropriate number of days:
             --audit-log-maxage=30
@@ -276,7 +276,7 @@ groups:
           value: 10
         set: true
     remediation: |
-      Edit the API server pod specification file $apiserverpodspec
+      Edit the API server pod specification file $apiserverconf
       on the master node and set the --audit-log-maxbackup parameter to 10
       or to an appropriate value.
       --audit-log-maxbackup=10
@@ -293,7 +293,7 @@ groups:
           value: 100
         set: true
     remediation: |
-      Edit the API server pod specification file $apiserverpodspec
+      Edit the API server pod specification file $apiserverconf
       on the master node and set the --audit-log-maxsize parameter to an
       appropriate size in MB. For example, to set it as 100 MB:
       --audit-log-maxsize=100
@@ -310,7 +310,7 @@ groups:
           value: "AlwaysAllow"
         set: true
     remediation: |
-      Edit the API server pod specification file $apiserverpodspec
+      Edit the API server pod specification file $apiserverconf
       on the master node and set the --authorization-mode parameter to
       values other than AlwaysAllow. One such example could be as below.
       --authorization-mode=RBAC
@@ -325,7 +325,7 @@ groups:
         set: false
     remediation: |
       Follow the documentation and configure alternate mechanisms for authentication. Then,
-      edit the API server pod specification file $apiserverpodspec
+      edit the API server pod specification file $apiserverconf
       on the master node and remove the --token-auth-file=<filename>
       parameter.
     scored: true
@@ -340,7 +340,7 @@ groups:
     remediation: |
       Follow the Kubernetes documentation and setup the TLS connection between the apiserver
       and kubelets. Then, edit the API server pod specification file
-      $apiserverpodspec on the master node and set the --
+      $apiserverconf on the master node and set the --
       kubelet-certificate-authority parameter to the path to the cert file for the certificate
       authority.
       --kubelet-certificate-authority=<ca-string>
@@ -360,7 +360,7 @@ groups:
     remediation: |
       Follow the Kubernetes documentation and set up the TLS connection between the
       apiserver and kubelets. Then, edit API server pod specification file
-      $apiserverpodspec on the master node and set the
+      $apiserverconf on the master node and set the
       kubelet client certificate and key parameters as below.
       --kubelet-client-certificate=<path/to/client-certificate-file>
       --kubelet-client-key=<path/to/client-key-file>
@@ -377,7 +377,7 @@ groups:
           value: true
         set: true
     remediation: |
-      Edit the API server pod specification file $apiserverpodspec
+      Edit the API server pod specification file $apiserverconf
       on the master node and set the below parameter.
       --service-account-lookup=true
     scored: true
@@ -394,7 +394,7 @@ groups:
         set: true
     remediation: |
       Follow the documentation and create Pod Security Policy objects as per your environment.
-      Then, edit the API server pod specification file $apiserverpodspec
+      Then, edit the API server pod specification file $apiserverconf
       on the master node and set the --admission-control parameter to a
       value that includes PodSecurityPolicy :
       --admission-control=...,PodSecurityPolicy,...
@@ -410,7 +410,7 @@ groups:
       - flag: "--service-account-key-file"
         set: true
     remediation: |
-      Edit the API server pod specification file $apiserverpodspec
+      Edit the API server pod specification file $apiserverconf
       on the master node and set the --service-account-key-file parameter
       to the public key file for service accounts:
       --service-account-key-file=<filename>
@@ -430,7 +430,7 @@ groups:
     remediation: |
       Follow the Kubernetes documentation and set up the TLS connection between the
       apiserver and etcd. Then, edit the API server pod specification file
-      $apiserverpodspec on the master node and set the etcd
+      $apiserverconf on the master node and set the etcd
       certificate and key file parameters.
       --etcd-certfile=<path/to/client-certificate-file>
       --etcd-keyfile=<path/to/client-key-file>
@@ -448,7 +448,7 @@ groups:
         set: true
     remediation: |
       Follow the documentation and create ServiceAccount objects as per your environment.
-      Then, edit the API server pod specification file $apiserverpodspec
+      Then, edit the API server pod specification file $apiserverconf
       on the master node and set the --admission-control parameter to a
       value that includes ServiceAccount.
       --admission-control=...,ServiceAccount,...
@@ -467,7 +467,7 @@ groups:
         set: true
     remediation: |
       Follow the Kubernetes documentation and set up the TLS connection on the apiserver.
-      Then, edit the API server pod specification file $apiserverpodspec
+      Then, edit the API server pod specification file $apiserverconf
       on the master node and set the TLS certificate and private key file
       parameters.
       --tls-cert-file=<path/to/tls-certificate-file>
@@ -483,7 +483,7 @@ groups:
         set: true
     remediation: |
       Follow the Kubernetes documentation and set up the TLS connection on the apiserver.
-      Then, edit the API server pod specification file $apiserverpodspec
+      Then, edit the API server pod specification file $apiserverconf
       on the master node and set the client certificate authority file.
       --client-ca-file=<path/to/client-ca-file>
     scored: true
@@ -498,7 +498,7 @@ groups:
     remediation: |
       Follow the Kubernetes documentation and set up the TLS connection between the
       apiserver and etcd. Then, edit the API server pod specification file
-      $apiserverpodspec on the master node and set the etcd
+      $apiserverconf on the master node and set the etcd
       certificate authority file parameter.
       --etcd-cafile=<path/to/ca-file>
     scored: true
@@ -514,7 +514,7 @@ groups:
           value: "Node"
         set: true
     remediation: |
-      Edit the API server pod specification file $apiserverpodspec
+      Edit the API server pod specification file $apiserverconf
       on the master node and set the --authorization-mode parameter to a
       value that includes Node.
       --authorization-mode=Node,RBAC
@@ -532,7 +532,7 @@ groups:
         set: true
     remediation: |
       Follow the Kubernetes documentation and configure NodeRestriction plug-in on kubelets.
-      Then, edit the API server pod specification file $apiserverpodspec
+      Then, edit the API server pod specification file $apiserverconf
       on the master node and set the --admission-control parameter to a
       value that includes NodeRestriction.
       --admission-control=...,NodeRestriction,...
@@ -548,7 +548,7 @@ groups:
         set: true
     remediation: |
       Follow the Kubernetes documentation and configure a EncryptionConfig file. Then, edit
-      the API server pod specification file $apiserverpodspec
+      the API server pod specification file $apiserverconf
       on the master node and set the --experimental-encryption-provider-config parameter
       to the path of that file:
       --experimental-encryption-provider-config=</path/to/EncryptionConfig/File>
@@ -586,7 +586,7 @@ groups:
         set: true
     remediation: |
       Follow the Kubernetes documentation and set the desired limits in a configuration file.
-      Then, edit the API server pod specification file $apiserverpodspec
+      Then, edit the API server pod specification file $apiserverconf
       and set the below parameters.
       --admission-control=EventRateLimit
       --admission-control-config-file=<path/to/configuration/file>
@@ -598,7 +598,7 @@ groups:
     type: "manual"
     remediation: |
       Follow the Kubernetes documentation and set the desired audit policy in the
-      /etc/kubernetes/audit-policy.yaml file. Then, edit the API server pod specification file $apiserverpodspec
+      /etc/kubernetes/audit-policy.yaml file. Then, edit the API server pod specification file $apiserverconf
       and set the below parameters.
       --audit-policy-file=/etc/kubernetes/audit-policy.yaml
     scored: true
@@ -608,7 +608,7 @@ groups:
     audit: "ps -ef | grep $apiserverbin | grep -v grep"
     type: "manual"
     remediation: |
-      Edit the API server pod specification file $apiserverpodspec
+      Edit the API server pod specification file $apiserverconf
       and set the below parameter as appropriate and if needed. For example,
       --request-timeout=300
     scored: true
@@ -628,7 +628,7 @@ groups:
         set: true
     remediation: |
       Remediation:
-        Edit the Scheduler pod specification file $apiserverpodspec
+        Edit the Scheduler pod specification file $schedulerconf
         file on the master node and set the below parameter.
         --profiling=false
     scored: true
@@ -644,7 +644,7 @@ groups:
         - flag: "--terminated-pod-gc-threshold"
           set: true
     remediation: |
-      Edit the Controller Manager pod specification file $apiserverpodspec
+      Edit the Controller Manager pod specification file $controllermanagerconf
       on the master node and set the --terminated-pod-gc-threshold to an appropriate threshold, for example:
       --terminated-pod-gc-threshold=10
     scored: true
@@ -660,7 +660,7 @@ groups:
           value: false
         set: true
     remediation: |
-      Edit the Controller Manager pod specification file $apiserverpodspec
+      Edit the Controller Manager pod specification file $apiserverconf
       on the master node and set the below parameter.
       --profiling=false
     scored: true
@@ -676,7 +676,7 @@ groups:
           value: true
         set: true
     remediation: |
-      Edit the Controller Manager pod specification file $apiserverpodspec
+      Edit the Controller Manager pod specification file $apiserverconf
       on the master node to set the below parameter.
       --use-service-account-credentials=true
     scored: true
@@ -689,7 +689,7 @@ groups:
       - flag: "--service-account-private-key-file"
         set: true
     remediation: |
-      Edit the Controller Manager pod specification file $apiserverpodspec
+      Edit the Controller Manager pod specification file $apiserverconf
       on the master node and set the --service-account-private-
       key-file parameter to the private key file for service accounts.
       --service-account-private-key-file=<filename>
@@ -703,7 +703,7 @@ groups:
       - flag: "--root-ca-file"
         set: true
     remediation: |
-      Edit the Controller Manager pod specification file $apiserverpodspec
+      Edit the Controller Manager pod specification file $apiserverconf
       on the master node and set the --root-ca-file parameter to
       the certificate bundle file.
       --root-ca-file=<path/to/file>
@@ -729,7 +729,7 @@ groups:
           value: true
         set: true
     remediation: |
-      Edit the Controller Manager pod specification file $apiserverpodspec
+      Edit the Controller Manager pod specification file $apiserverconf
       controller-manager.yaml on the master node and set the --feature-gates parameter to
       include RotateKubeletServerCertificate=true.
       --feature-gates=RotateKubeletServerCertificate=true
@@ -741,7 +741,7 @@ groups:
   - id: 1.4.1
     text: "Ensure that the API server pod specification file permissions are
     set to 644 or more restrictive (Scored)"
-    audit: "/bin/sh -c 'if test -e $apiserverpodspec; then stat -c %a $apiserverpodspec; fi'"
+    audit: "/bin/sh -c 'if test -e $apiserverconf; then stat -c %a $apiserverconf; fi'"
     tests:
       bin_op: or
       test_items:
@@ -763,13 +763,13 @@ groups:
     remediation: |
       Run the below command (based on the file location on your system) on the master node.
       For example,
-      chmod 644 $apiserverpodspec
+      chmod 644 $apiserverconf
     scored: true
 
   - id: 1.4.2
     text: "Ensure that the API server pod specification file ownership is set to
     root:root (Scored)"
-    audit: "/bin/sh -c 'if test -e $apiserverpodspec; then stat -c %U:%G $apiserverpodspec; fi'"
+    audit: "/bin/sh -c 'if test -e $apiserverconf; then stat -c %U:%G $apiserverconf; fi'"
     tests:
       test_items:
       - flag: "root:root"
@@ -780,13 +780,13 @@ groups:
     remediation: |
       Run the below command (based on the file location on your system) on the master node.
       For example,
-      chown root:root $apiserverpodspec
+      chown root:root $apiserverconf
     scored: true
 
   - id: 1.4.3
     text: "Ensure that the controller manager pod specification file
     permissions are set to 644 or more restrictive (Scored)"
-    audit: "/bin/sh -c 'if test -e $controllermanagerpodspec; then stat -c %a $controllermanagerpodspec; fi'"
+    audit: "/bin/sh -c 'if test -e $controllermanagerconf; then stat -c %a $controllermanagerconf; fi'"
     tests:
       bin_op: or
       test_items:
@@ -808,13 +808,13 @@ groups:
     remediation: |
       Run the below command (based on the file location on your system) on the master node.
       For example,
-      chmod 644 $controllermanagerpodspec
+      chmod 644 $controllermanagerconf
     scored: true
 
   - id: 1.4.4
     text: "Ensure that the controller manager pod specification file
     ownership is set to root:root (Scored)"
-    audit: "/bin/sh -c 'if test -e $controllermanagerpodspec; then stat -c %U:%G $controllermanagerpodspec; fi'"
+    audit: "/bin/sh -c 'if test -e $controllermanagerconf; then stat -c %U:%G $controllermanagerconf; fi'"
     tests:
       test_items:
       - flag: "root:root"
@@ -825,13 +825,13 @@ groups:
     remediation: |
       Run the below command (based on the file location on your system) on the master node.
       For example,
-      chown root:root $controllermanagerpodspec
+      chown root:root $controllermanagerconf
     scored: true
 
   - id: 1.4.5
     text: "Ensure that the scheduler pod specification file permissions are set
     to 644 or more restrictive (Scored)"
-    audit: "/bin/sh -c 'if test -e $schedulerpodspec; then stat -c %a $schedulerpodspec; fi'"
+    audit: "/bin/sh -c 'if test -e $schedulerconf; then stat -c %a $schedulerconf; fi'"
     tests:
       bin_op: or
       test_items:
@@ -853,13 +853,13 @@ groups:
     remediation: |
       Run the below command (based on the file location on your system) on the master node.
       For example,
-      chmod 644 $schedulerpodspec
+      chmod 644 $schedulerconf
     scored: true
 
   - id: 1.4.6
     text: "Ensure that the scheduler pod specification file ownership is set to
     root:root (Scored)"
-    audit: "/bin/sh -c 'if test -e $schedulerpodspec; then stat -c %U:%G $schedulerpodspec; fi'"
+    audit: "/bin/sh -c 'if test -e $schedulerconf; then stat -c %U:%G $schedulerconf; fi'"
     tests:
       test_items:
         - flag: "root:root"
@@ -870,13 +870,13 @@ groups:
     remediation: |
       Run the below command (based on the file location on your system) on the master node.
       For example,
-      chown root:root $schedulerpodspec
+      chown root:root $schedulerconf
     scored: true
 
   - id: 1.4.7
     text: "Ensure that the etcd pod specification file permissions are set to
     644 or more restrictive (Scored)"
-    audit: "/bin/sh -c 'if test -e $etcdpodspec; then stat -c %a $etcdpodspec; fi'"
+    audit: "/bin/sh -c 'if test -e $etcdconf; then stat -c %a $etcdconf; fi'"
     tests:
       bin_op: or
       test_items:
@@ -898,13 +898,13 @@ groups:
     remediation: |
       Run the below command (based on the file location on your system) on the master node.
       For example,
-      chmod 644 $etcdpodspec
+      chmod 644 $etcdconf
     scored: true
 
   - id: 1.4.8
     text: "Ensure that the etcd pod specification file ownership is set to
     root:root (Scored)"
-    audit: "/bin/sh -c 'if test -e $etcdpodspec; then stat -c %U:%G $etcdpodspec; fi'"
+    audit: "/bin/sh -c 'if test -e $etcdconf; then stat -c %U:%G $etcdconf; fi'"
     tests:
       test_items:
       - flag: "root:root"
@@ -915,7 +915,7 @@ groups:
     remediation: |
       Run the below command (based on the file location on your system) on the master node.
       For example,
-      chown root:root $etcdpodspec
+      chown root:root $etcdconf
     scored: true
 
   - id: 1.4.9
@@ -942,7 +942,7 @@ groups:
 
   - id: 1.4.11
     text: "Ensure that the etcd data directory permissions are set to 700 or more restrictive (Scored)"
-    audit: "ps -ef | grep $etcdbin | grep -v grep | grep -o data-dir=.* | cut -d= -f2 | xargs stat -c %a"
+    audit: ps -ef | grep $etcdbin | grep -v grep | sed 's%.*data-dir[= ]\([^ ]*\).*%\1%' | xargs stat -c %a
     tests:
       test_items:
       - flag: "700"
@@ -960,7 +960,7 @@ groups:
 
   - id: 1.4.12
     text: "Ensure that the etcd data directory ownership is set to etcd:etcd (Scored)"
-    audit: "ps -ef | grep $etcdbin | grep -v grep | grep -o data-dir=.* | cut -d= -f2 | xargs stat -c %U:%G"
+    audit: ps -ef | grep $etcdbin | grep -v grep | sed 's%.*data-dir[= ]\(\S*\)%\1%' | xargs stat -c %U:%G
     tests:
       test_items:
       - flag: "etcd:etcd"
@@ -978,12 +978,23 @@ groups:
     more restrictive (Scored)"
     audit: "/bin/sh -c 'if test -e /etc/kubernetes/admin.conf; then stat -c %a /etc/kubernetes/admin.conf; fi'"
     tests:
+      bin_op: or
       test_items:
-      - flag: "644"
-        compare:
-          op: eq
-          value: "644"
-        set: true
+        - flag: "644"
+          compare:
+            op: eq
+            value: "644"
+          set: true
+        - flag: "640"
+          compare:
+            op: eq
+            value: "640"
+          set: true
+        - flag: "600"
+          compare:
+            op: eq
+            value: "600"
+          set: true 
     remediation: |
       Run the below command (based on the file location on your system) on the master node.
       For example,
@@ -1009,14 +1020,25 @@ groups:
   - id: 1.4.15
     text: "Ensure that the scheduler.conf file permissions are set to 644 or
     more restrictive (Scored)"
-    audit: "/bin/sh -c 'if test -e $schedulerconf then stat -c %a $schedulerconf; fi'"
+    audit: "/bin/sh -c 'if test -e $schedulerconf; then stat -c %a $schedulerconf; fi'"
     tests:
+      bin_op: or
       test_items:
-      - flag: "644"
-        compare:
-          op: eq
-          value: "644"
-        set: true
+        - flag: "644"
+          compare:
+            op: eq
+            value: "644"
+          set: true
+        - flag: "640"
+          compare:
+            op: eq
+            value: "640"
+          set: true
+        - flag: "600"
+          compare:
+            op: eq
+            value: "600"
+          set: true
     remediation: |
       Run the below command (based on the file location on your system) on the master node.
       For example,
@@ -1042,14 +1064,25 @@ groups:
   - id: 1.4.17
     text: "Ensure that the controller-manager.conf file permissions are set
     to 644 or more restrictive (Scored)"
-    audit: "/bin/sh -c 'if test -e $controllermanagerconf then stat -c %a $controllermanagerconf; fi'"
+    audit: "/bin/sh -c 'if test -e $controllermanagerconf; then stat -c %a $controllermanagerconf; fi'"
     tests:
+      bin_op: or
       test_items:
-      - flag: "644"
-        compare:
-          op: eq
-          value: "644"
-        set: true
+        - flag: "644"
+          compare:
+            op: eq
+            value: "644"
+          set: true
+        - flag: "640"
+          compare:
+            op: eq
+            value: "640"
+          set: true
+        - flag: "600"
+          compare:
+            op: eq
+            value: "600"
+          set: true   
     remediation: |
       Run the below command (based on the file location on your system) on the master node.
       For example,
@@ -1086,7 +1119,7 @@ groups:
         set: true
     remediation: |
       Follow the etcd service documentation and configure TLS encryption.
-      Then, edit the etcd pod specification file $etcdpodspec on the
+      Then, edit the etcd pod specification file $etcdconf on the
       master node and set the below parameters.
       --ca-file=</path/to/ca-file>
       --key-file=</path/to/key-file>
@@ -1103,7 +1136,7 @@ groups:
           value: true
         set: true
     remediation: |
-      Edit the etcd pod specification file $etcdpodspec on the master
+      Edit the etcd pod specification file $etcdconf on the master
       node and set the below parameter.
       --client-cert-auth="true"
     scored: true
@@ -1121,7 +1154,7 @@ groups:
           op: neq
           value: true
     remediation: |
-      Edit the etcd pod specification file $etcdpodspec on the master
+      Edit the etcd pod specification file $etcdconf on the master
       node and either remove the --auto-tls parameter or set it to false.
         --auto-tls=false
     scored: true
@@ -1138,7 +1171,7 @@ groups:
         set: true
     remediation: |
       Follow the etcd service documentation and configure peer TLS encryption as appropriate
-      for your etcd cluster. Then, edit the etcd pod specification file $etcdpodspec on the
+      for your etcd cluster. Then, edit the etcd pod specification file $etcdconf on the
       master node and set the below parameters.
       --peer-client-file=</path/to/peer-cert-file>
       --peer-key-file=</path/to/peer-key-file>
@@ -1155,7 +1188,7 @@ groups:
           value: true
         set: true
     remediation: |
-      Edit the etcd pod specification file $etcdpodspec on the master
+      Edit the etcd pod specification file $etcdconf on the master
       node and set the below parameter.
       --peer-client-cert-auth=true
     scored: true
@@ -1174,7 +1207,7 @@ groups:
           value: false
         set: true
     remediation: |
-      Edit the etcd pod specification file $etcdpodspec on the master
+      Edit the etcd pod specification file $etcdconf on the master
       node and either remove the --peer-auto-tls parameter or set it to false.
       --peer-auto-tls=false
     scored: true
@@ -1187,7 +1220,7 @@ groups:
       - flag: "--wal-dir"
         set: true
     remediation: |
-      Edit the etcd pod specification file $etcdpodspec on the master
+      Edit the etcd pod specification file $etcdconf on the master
       node and set the below parameter.
       --wal-dir=</path/to/log/dir>
     scored: true
@@ -1203,7 +1236,7 @@ groups:
           value: 0
         set: true
     remediation: |
-      Edit the etcd pod specification file $etcdpodspec on the master
+      Edit the etcd pod specification file $etcdconf on the master
       node and set the below parameter.
       --max-wals=0
     scored: true
@@ -1218,7 +1251,7 @@ groups:
     remediation: |
       Follow the etcd documentation and create a dedicated certificate authority setup for the
       etcd service.
-      Then, edit the etcd pod specification file $etcdpodspec on the
+      Then, edit the etcd pod specification file $etcdconf on the
       master node and set the below parameter.
       --trusted-ca-file=</path/to/ca-file>
     scored: false 

cfg/1.8/node.yaml

@@ -19,7 +19,7 @@ groups:
           value: false
         set: true
     remediation: |
-      Edit the kubelet service file $kubeletunitfile
+      Edit the kubelet service file $kubeletconf
       on each worker node and set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable.
       --allow-privileged=false
       Based on your system, restart the kubelet service. For example:
@@ -38,7 +38,7 @@ groups:
           value: false
         set: true
     remediation: |
-      Edit the kubelet service file $kubeletunitfile
+      Edit the kubelet service file $kubeletconf
       on each worker node and set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable.
       --anonymous-auth=false
       Based on your system, restart the kubelet service. For example:
@@ -57,7 +57,7 @@ groups:
           value: "AlwaysAllow"
         set: true
     remediation: |
-      Edit the kubelet service file $kubeletunitfile
+      Edit the kubelet service file $kubeletconf
       on each worker node and set the below parameter in KUBELET_AUTHZ_ARGS variable.
       --authorization-mode=Webhook
       Based on your system, restart the kubelet service. For example:
@@ -73,7 +73,7 @@ groups:
       - flag: "--client-ca-file"
         set: true 
     remediation: |
-      Edit the kubelet service file $kubeletunitfile
+      Edit the kubelet service file $kubeletconf
       on each worker node and set the below parameter in KUBELET_AUTHZ_ARGS variable.
       --client-ca-file=<path/to/client-ca-file>
       Based on your system, restart the kubelet service. For example:
@@ -92,7 +92,7 @@ groups:
           value: 0
         set: true 
     remediation: |
-      Edit the kubelet service file $kubeletunitfile
+      Edit the kubelet service file $kubeletconf
       on each worker node and set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable.
       --read-only-port=0
       Based on your system, restart the kubelet service. For example:
@@ -111,7 +111,7 @@ groups:
           value: 0
         set: true
     remediation: |
-      Edit the kubelet service file $kubeletunitfile
+      Edit the kubelet service file $kubeletconf
       on each worker node and set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable.
       --streaming-connection-idle-timeout=5m
       Based on your system, restart the kubelet service. For example:
@@ -130,7 +130,7 @@ groups:
           value: true
         set: true
     remediation: |
-      Edit the kubelet service file $kubeletunitfile
+      Edit the kubelet service file $kubeletconf
       on each worker node and set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable.
       --protect-kernel-defaults=true
       Based on your system, restart the kubelet service. For example:
@@ -150,7 +150,7 @@ groups:
           value: true
         set: true
     remediation: |
-      Edit the kubelet service file $kubeletunitfile
+      Edit the kubelet service file $kubeletconf
       on each worker node and remove the --make-iptables-util-chains argument from the
       KUBELET_SYSTEM_PODS_ARGS variable.
       Based on your system, restart the kubelet service. For example:
@@ -169,7 +169,7 @@ groups:
           value: false
         set: true
     remediation: |
-      Edit the kubelet service file $kubeletunitfile
+      Edit the kubelet service file $kubeletconf
       on each worker node and set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable.
       --keep-terminated-pod-volumes=false
       Based on your system, restart the kubelet service. For example:
@@ -185,7 +185,7 @@ groups:
       - flag: "--hostname-override"
         set: false
     remediation: |
-      Edit the kubelet service file $kubeletunitfile
+      Edit the kubelet service file $kubeletconf
       on each worker node and remove the --hostname-override argument from the
       KUBELET_SYSTEM_PODS_ARGS variable.
       Based on your system, restart the kubelet service. For example:
@@ -204,7 +204,7 @@ groups:
           value: 0
         set: true
     remediation: |
-      Edit the kubelet service file $kubeletunitfile
+      Edit the kubelet service file $kubeletconf
       on each worker node and set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable.
       --event-qps=0
       Based on your system, restart the kubelet service. For example:
@@ -245,7 +245,7 @@ groups:
           value: 0
         set: true
     remediation: |
-      Edit the kubelet service file $kubeletunitfile
+      Edit the kubelet service file $kubeletconf
       on each worker node and set the below parameter in KUBELET_CADVISOR_ARGS variable.
       --cadvisor-port=0
       Based on your system, restart the kubelet service. For example:
@@ -264,7 +264,7 @@ groups:
           value: true
         set: true
     remediation: |
-      Edit the kubelet service file $kubeletunitfile
+      Edit the kubelet service file $kubeletconf
       on each worker node and remove the --feature-
       gates=RotateKubeletClientCertificate=false argument from the
       KUBELET_CERTIFICATE_ARGS variable.
@@ -284,7 +284,7 @@ groups:
           value: true
         set: true
     remediation: |
-      Edit the kubelet service file $kubeletunitfile
+      Edit the kubelet service file $kubeletconf
       on each worker node and set the below parameter in KUBELET_CERTIFICATE_ARGS variable.
       --feature-gates=RotateKubeletServerCertificate=true
       Based on your system, restart the kubelet service. For example:
@@ -342,7 +342,7 @@ groups:
     - id: 2.2.3
       text: "Ensure that the kubelet service file permissions are set to 644 or
       more restrictive (Scored)"
-      audit: "/bin/sh -c 'if test -e $kubeletunitfile; then stat -c %a $kubeletunitfile; fi'"
+      audit: "/bin/sh -c 'if test -e $kubeletconf; then stat -c %a $kubeletconf; fi'"
       tests:
         bin_op: or
         test_items:
@@ -364,13 +364,13 @@ groups:
       remediation: |
         Run the below command (based on the file location on your system) on the each worker
         node. For example,
-        chmod 755 $kubeletunitfile
+        chmod 755 $kubeletconf
       scored: true
 
     - id: 2.2.4
       text: "Ensure that the kubelet service file permissions are set to 644 or
       more restrictive (Scored)"
-      audit: "/bin/sh -c 'if test -e $kubeletunitfile; then stat -c %U:%G $kubeletunitfile; fi'"
+      audit: "/bin/sh -c 'if test -e $kubeletconf; then stat -c %U:%G $kubeletconf; fi'"
       tests:
         test_items:
         - flag: "root:root"
@@ -378,7 +378,7 @@ groups:
       remediation: |
         Run the below command (based on the file location on your system) on the each worker
         node. For example,
-        chown root:root $kubeletunitfile
+        chown root:root $kubeletconf
       scored: true
 
     - id: 2.2.5

cfg/config.yaml

@@ -30,10 +30,6 @@ master:
       - /etc/kubernetes/apiserver
     defaultconf: /etc/kubernetes/apiserver
 
-    podspecs:
-      - /etc/kubernetes/manifests/kube-apiserver.yaml
-    defaultpodspec: /etc/kubernetes/manifests/kube-apiserver.yaml
-
   scheduler:
     bins:
       - "kube-scheduler"
@@ -44,10 +40,6 @@ master:
       - /etc/kubernetes/scheduler
     defaultconf: /etc/kubernetes/scheduler
 
-    podspecs:
-      - /etc/kubernetes/manifests/kube-scheduler.yaml
-    defaultpodspec: /etc/kubernetes/manifests/kube-scheduler.yaml
-
   controllermanager:
     bins:
       - "kube-controller-manager"
@@ -58,10 +50,6 @@ master:
       - /etc/kubernetes/controller-manager
     defaultconf: /etc/kubernetes/controller-manager
 
-    podspecs:
-      - /etc/kubernetes/manifests/kube-controller-manager.yaml
-    defaultpodspec: /etc/kubernetes/manifests/kube-controller-manager.yaml
-
   etcd:
     optional: true
     bins:
@@ -70,17 +58,12 @@ master:
       - /etc/etcd/etcd.conf
     defaultconf: /etc/etcd/etcd.conf
 
-    podspecs:
-      - /etc/kubernetes/manifests/etcd.yaml
-    defaultpodspec: /etc/kubernetes/manifests/etcd.yaml
-
   flanneld:
     optional: true
     bins:
       - flanneld
     defaultconf: /etc/sysconfig/flanneld
 
-
 node:
   components:
     - kubelet
@@ -100,10 +83,6 @@ node:
       - /etc/kubernetes/kubelet 
     defaultconf: "/etc/kubernetes/kubelet.conf"
 
-    unitfiles:
-     - /etc/systemd/system/kubelet.service.d/10-kubeadm.conf
-    defaultunitfile: /etc/systemd/system/kubelet.service.d/10-kubeadm.conf
-  
   proxy:
     bins:
       - "kube-proxy"
@@ -130,5 +109,3 @@ federated:
       - "hyperkube federation-controller-manager"
       - "kube-federation-controller-manager"
       - "federation-controller-manager"
-
-

cmd/common.go

@@ -17,6 +17,7 @@ package cmd
 import (
 	"fmt"
 	"io/ioutil"
+	"path/filepath"
 
 	"github.com/aquasecurity/kube-bench/check"
 	"github.com/golang/glog"
@@ -29,6 +30,7 @@ var (
 
 func runChecks(t check.NodeType) {
 	var summary check.Summary
+	var nodetype string
 	var file string
 	var err error
 	var typeConf *viper.Viper
@@ -36,49 +38,50 @@ func runChecks(t check.NodeType) {
 	switch t {
 	case check.MASTER:
 		file = masterFile
-		typeConf = viper.Sub("master")
+		nodetype = "master"
 	case check.NODE:
 		file = nodeFile
-		typeConf = viper.Sub("node")
+		nodetype = "node"
 	case check.FEDERATED:
 		file = federatedFile
-		typeConf = viper.Sub("federated")
+		nodetype = "federated"
 	}
 
+	ver := getKubeVersion()
+	switch ver {
+	case "1.9", "1.10":
+		continueWithError(nil, fmt.Sprintf("No CIS spec for %s - using tests from CIS 1.2.0 spec for Kubernetes 1.8\n", ver))
+		ver = "1.8"
+	}
+
+	path := filepath.Join(cfgDir, ver)
+	def := filepath.Join(path, file)
+
+	in, err := ioutil.ReadFile(def)
+	if err != nil {
+		exitWithError(fmt.Errorf("error opening %s controls file: %v", t, err))
+	}
+
+	// Merge kubernetes version specific config if any.
+	viper.SetConfigFile(path + "/config.yaml")
+	err = viper.MergeInConfig()
+	if err != nil {
+		continueWithError(err, fmt.Sprintf("Reading %s specific configuration file", ver))
+	}
+	typeConf = viper.Sub(nodetype)
+
 	// Get the set of exectuables and config files we care about on this type of node. This also
 	// checks that the executables we need for the node type are running.
 	binmap := getBinaries(typeConf)
-	confmap := getConfigFiles(typeConf, "conf")
-	podspecmap := getConfigFiles(typeConf, "podspec")
-	unitfilemap := getConfigFiles(typeConf, "unitfile")
-
-	switch t {
-	case check.MASTER:
-		file = masterFile
-	case check.NODE:
-		file = nodeFile
-	case check.FEDERATED:
-		file = federatedFile
-	}
-
-	ver := getKubeVersion()
-	glog.V(1).Info(fmt.Sprintf("Running tests for Kubernetes version: %s", ver))
-
-	path := fmt.Sprintf("%s/%s/%s", cfgDir, ver, file)
-	in, err := ioutil.ReadFile(path)
-	if err != nil {
-		exitWithError(fmt.Errorf("error opening %s controls file: %v", t, err))
-	}
+	confmap := getConfigFiles(typeConf)
 
 	// Variable substitutions. Replace all occurrences of variables in controls files.
 	s := string(in)
 	s = makeSubstitutions(s, "bin", binmap)
 	s = makeSubstitutions(s, "conf", confmap)
-	s = makeSubstitutions(s, "podspec", podspecmap)
-	s = makeSubstitutions(s, "unitfile", unitfilemap)
 
 	glog.V(1).Info(fmt.Sprintf("Using config file: %s\n", viper.ConfigFileUsed()))
-	glog.V(1).Info(fmt.Sprintf("Using benchmark file: %s\n", path))
+	glog.V(1).Info(fmt.Sprintf("Using benchmark file: %s\n", def))
 
 	controls, err := check.NewControls(t, []byte(s))
 	if err != nil {
@@ -107,7 +110,7 @@ func runChecks(t check.NodeType) {
 		fmt.Println(string(out))
 	} else {
 		// if we want to store in PostgreSQL, convert to JSON and save it
-		if (summary.Fail > 0 || summary.Warn > 0 || summary.Pass > 0) && pgSql {
+		if (summary.Fail > 0 || summary.Warn > 0 || summary.Pass > 0) && pgSQL {
 			out, err := controls.JSON()
 			if err != nil {
 				exitWithError(fmt.Errorf("failed to output in JSON format: %v", err))

cmd/database.go

@@ -7,7 +7,7 @@ import (
 
 	"github.com/golang/glog"
 	"github.com/jinzhu/gorm"
-	_ "github.com/jinzhu/gorm/dialects/postgres"
+	_ "github.com/jinzhu/gorm/dialects/postgres" // database packages get blank imports
 	"github.com/spf13/viper"
 )
 

cmd/root.go

@@ -30,7 +30,7 @@ var (
 	defaultKubeVersion = "1.6"
 	cfgFile            string
 	jsonFmt            bool
-	pgSql              bool
+	pgSQL              bool
 	checkList          string
 	groupList          string
 	masterFile         string
@@ -61,7 +61,7 @@ func init() {
 	cobra.OnInitialize(initConfig)
 
 	RootCmd.PersistentFlags().BoolVar(&jsonFmt, "json", false, "Prints the results as JSON")
-	RootCmd.PersistentFlags().BoolVar(&pgSql, "pgsql", false, "Save the results to PostgreSQL")
+	RootCmd.PersistentFlags().BoolVar(&pgSQL, "pgsql", false, "Save the results to PostgreSQL")
 	RootCmd.PersistentFlags().StringVarP(
 		&checkList,
 		"check",

cmd/util.go

@@ -119,7 +119,7 @@ func getBinaries(v *viper.Viper) map[string]string {
 // getConfigFiles finds which of the set of candidate config files exist
 // accepts a string 't' which indicates the type of config file, conf,
 // podspec or untifile.
-func getConfigFiles(v *viper.Viper, t string) map[string]string {
+func getConfigFiles(v *viper.Viper) map[string]string {
 	confmap := make(map[string]string)
 
 	for _, component := range v.GetStringSlice("components") {
@@ -129,14 +129,14 @@ func getConfigFiles(v *viper.Viper, t string) map[string]string {
 		}
 
 		// See if any of the candidate config files exist
-		conf := findConfigFile(s.GetStringSlice(t + "s"))
+		conf := findConfigFile(s.GetStringSlice("confs"))
 		if conf == "" {
-			if s.IsSet("default" + t) {
-				conf = s.GetString("default" + t)
+			if s.IsSet("defaultconf") {
+				conf = s.GetString("defaultconf")
 				glog.V(2).Info(fmt.Sprintf("Using default config file name '%s' for component %s", conf, component))
 			} else {
 				// Default the config file name that we'll substitute to the name of the component
-				printlnWarn(fmt.Sprintf("Missing config file for %s", component))
+				glog.V(2).Info(fmt.Sprintf("Missing config file for %s", component))
 				conf = component
 			}
 		} else {
@@ -196,9 +196,8 @@ func findExecutable(candidates []string) (string, error) {
 	for _, c := range candidates {
 		if verifyBin(c) {
 			return c, nil
-		} else {
-			glog.V(1).Info(fmt.Sprintf("executable '%s' not running", c))
 		}
+		glog.V(1).Info(fmt.Sprintf("executable '%s' not running", c))
 	}
 
 	return "", fmt.Errorf("no candidates running")
@@ -216,10 +215,19 @@ func multiWordReplace(s string, subname string, sub string) string {
 func getKubeVersion() string {
 	// These executables might not be on the user's path.
 	_, err := exec.LookPath("kubectl")
+
 	if err != nil {
-		exitWithError(fmt.Errorf("kubernetes version check failed: %v", err))
+		_, err = exec.LookPath("kubelet")
+		if err != nil {
+			exitWithError(fmt.Errorf("Version check failed: need kubectl or kubelet binaries to get kubernetes version"))
+		}
+		return getKubeVersionFromKubelet()
 	}
 
+	return getKubeVersionFromKubectl()
+}
+
+func getKubeVersionFromKubectl() string {
 	cmd := exec.Command("kubectl", "version", "--short")
 	out, err := cmd.CombinedOutput()
 	if err != nil {
@@ -229,6 +237,17 @@ func getKubeVersion() string {
 	return getVersionFromKubectlOutput(string(out))
 }
 
+func getKubeVersionFromKubelet() string {
+	cmd := exec.Command("kubelet", "--version")
+	out, err := cmd.CombinedOutput()
+	
+	if err != nil {
+		continueWithError(fmt.Errorf("%s", out), "")
+	}
+
+	return getVersionFromKubeletOutput(string(out))
+}
+
 func getVersionFromKubectlOutput(s string) string {
 	serverVersionRe := regexp.MustCompile(`Server Version: v(\d+.\d+)`)
 	subs := serverVersionRe.FindStringSubmatch(s)
@@ -239,6 +258,16 @@ func getVersionFromKubectlOutput(s string) string {
 	return subs[1]
 }
 
+func getVersionFromKubeletOutput(s string) string {
+	serverVersionRe := regexp.MustCompile(`Kubernetes v(\d+.\d+)`)
+	subs := serverVersionRe.FindStringSubmatch(s)
+	if len(subs) < 2 {
+		printlnWarn(fmt.Sprintf("Unable to get kubelet version, using default version: %s", defaultKubeVersion))
+		return defaultKubeVersion
+	}
+	return subs[1]
+}
+
 func makeSubstitutions(s string, ext string, m map[string]string) string {
 	for k, v := range m {
 		subst := "$" + k + ext

cmd/util_test.go

@@ -279,7 +279,7 @@ func TestGetConfigFiles(t *testing.T) {
 			e = c.statResults
 			eIndex = 0
 
-			m := getConfigFiles(v, "conf")
+			m := getConfigFiles(v)
 			if !reflect.DeepEqual(m, c.exp) {
 				t.Fatalf("Got %v\nExpected %v", m, c.exp)
 			}

entrypoint.sh

@@ -1,8 +1,8 @@
 #!/bin/sh
 if [ -d /host ]; then
   mkdir -p /host/cfg/
-  yes | cp -rf ./kube-bench/cfg/* /host/cfg/
-  yes | cp -rf ./kube-bench/kube-bench /host/
+  yes | cp -rf /cfg/* /host/cfg/
+  yes | cp -rf /kube-bench /host/
   echo "==============================================="
   echo "kube-bench is now installed on your host       "
   echo "Run ./kube-bench to perform a security check   "