release: prepare v0.6.8

Signed-off-by: chenk <hen.keinan@gmail.com>

.github/workflows/build.yml

@@ -14,55 +14,56 @@ on:
       - "LICENSE"
       - "NOTICE"
 env:
+  GO_VERSION: "1.16"
   KIND_VERSION: "v0.11.1"
   KIND_IMAGE: "kindest/node:v1.21.1@sha256:69860bda5563ac81e3c0057d654b5253219618a22ec3a346306239bba8cfa1a6"
 
 jobs:
   lint:
     name: Lint
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-18.04
     steps:
-      - name: Checkout code
-        uses: actions/checkout@v6
       - name: Setup Go
-        uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v6.2.0
+        uses: actions/setup-go@v3
         with:
-          go-version-file: go.mod
+          go-version: 1.16
+      - name: Checkout code
+        uses: actions/checkout@v3
       - name: yaml-lint
         uses: ibiqlik/action-yamllint@v3
       - name: Setup golangci-lint
-        uses: golangci/golangci-lint-action@v8
+        uses: golangci/golangci-lint-action@v3
         with:
-          version: v2.5.0
-          args: --verbose --timeout 2m
+          version: latest
+          args: --verbose
   unit:
     name: Unit tests
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-18.04
     steps:
-      - name: Checkout code
-        uses: actions/checkout@v6
       - name: Setup Go
-        uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v6.2.0
+        uses: actions/setup-go@v3
         with:
-          go-version-file: go.mod
+          go-version: 1.16
+      - name: Checkout code
+        uses: actions/checkout@v3
       - name: Run unit tests
         run: make tests
       - name: Upload code coverage
-        uses: codecov/codecov-action@v5
+        uses: codecov/codecov-action@v3
         with:
           file: ./coverage.txt
   e2e:
     name: E2e tests
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-18.04
     steps:
-      - name: Checkout code
-        uses: actions/checkout@v6
       - name: Setup Go
-        uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v6.2.0
+        uses: actions/setup-go@v3
         with:
-          go-version-file: go.mod
+          go-version: 1.16
+      - name: Checkout code
+        uses: actions/checkout@v3
       - name: Setup Kubernetes cluster (KIND)
-        uses: engineerd/setup-kind@v0.6.2
+        uses: engineerd/setup-kind@v0.5.0
         with:
           version: ${{ env.KIND_VERSION }}
           image: ${{ env.KIND_IMAGE }}
@@ -82,19 +83,19 @@ jobs:
           expected_result: PASSED
   release:
     name: Release snapshot
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-18.04
     needs: [e2e, unit]
     steps:
+      - name: Setup Go
+        uses: actions/setup-go@v3
+        with:
+          go-version: 1.16
       - name: Checkout code
-        uses: actions/checkout@v6
+        uses: actions/checkout@v3
         with:
           fetch-depth: 0
-      - name: Setup Go
-        uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v6.2.0
-        with:
-          go-version-file: go.mod
       - name: Dry-run release snapshot
-        uses: goreleaser/goreleaser-action@v6
+        uses: goreleaser/goreleaser-action@v2
         with:
           distribution: goreleaser
           version: v1.7.0

.github/workflows/mkdocs-deploy.yaml

@@ -13,14 +13,14 @@ on:
 jobs:
   deploy:
     name: Deploy documentation
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-18.04
     steps:
       - name: Checkout main
-        uses: actions/checkout@v6
+        uses: actions/checkout@v3
         with:
           fetch-depth: 0
           persist-credentials: true
-      - uses: actions/setup-python@v6
+      - uses: actions/setup-python@v3
         with:
           python-version: 3.x
       - run: |

.github/workflows/publish.yml

@@ -9,51 +9,47 @@ env:
   ALIAS: aquasecurity
   DOCKERHUB_ALIAS: aquasec
   REP: kube-bench
-
 jobs:
   publish:
     name: Publish
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-18.04
     steps:
       - name: Check Out Repo
-        uses: actions/checkout@v6
+        uses: actions/checkout@v3
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
+        uses: docker/setup-qemu-action@v1
       - name: Set up Docker Buildx
         id: buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v1
       - name: Cache Docker layers
-        uses: actions/cache@v5
+        uses: actions/cache@v3
         with:
           path: /tmp/.buildx-cache
           key: ${{ runner.os }}-buildxarch-${{ github.sha }}
           restore-keys: |
             ${{ runner.os }}-buildxarch-
       - name: Login to Docker Hub
-        uses: docker/login-action@v3
+        uses: docker/login-action@v1
         with:
           username: ${{ secrets.DOCKERHUB_USER }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
       - name: Login to ECR
-        uses: docker/login-action@v3
+        uses: docker/login-action@v1
         with:
           registry: public.ecr.aws
           username: ${{ secrets.ECR_ACCESS_KEY_ID }}
           password: ${{ secrets.ECR_SECRET_ACCESS_KEY }}
       - name: Get version
         id: get_version
-        uses: crazy-max/ghaction-docker-meta@v5
+        uses: crazy-max/ghaction-docker-meta@v3
         with:
           images: ${{ env.REP }}
           tag-semver: |
             {{version}}
-      - name: Extract variables from makefile (kubectl)
-        id: extract_vars
-        run: |
-          echo "KUBECTL_VERSION=$(grep -oP '^KUBECTL_VERSION\s*\?=\s*\K.*' makefile)" >> $GITHUB_ENV
+
       - name: Build and push - Docker/ECR
         id: docker_build
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@v2
         with:
           context: .
           platforms: linux/amd64,linux/arm64,linux/ppc64le,linux/s390x
@@ -61,7 +57,6 @@ jobs:
           push: true
           build-args: |
             KUBEBENCH_VERSION=${{ steps.get_version.outputs.version }}
-            KUBECTL_VERSION=${{ env.KUBECTL_VERSION }}
           tags: |
             ${{ env.DOCKERHUB_ALIAS }}/${{ env.REP }}:${{ steps.get_version.outputs.version }}
             public.ecr.aws/${{ env.ALIAS }}/${{ env.REP }}:${{ steps.get_version.outputs.version }}
@@ -69,43 +64,5 @@ jobs:
             public.ecr.aws/${{ env.ALIAS }}/${{ env.REP }}:latest
           cache-from: type=local,src=/tmp/.buildx-cache/release
           cache-to: type=local,mode=max,dest=/tmp/.buildx-cache/release
-
-      - name: Build and push ubi image - Docker/ECR
-        id: docker_build_ubi
-        uses: docker/build-push-action@v6
-        with:
-          context: .
-          platforms: linux/amd64,linux/arm64,linux/ppc64le,linux/s390x
-          builder: ${{ steps.buildx.outputs.name }}
-          push: true
-          file: Dockerfile.ubi
-          build-args: |
-            KUBEBENCH_VERSION=${{ steps.get_version.outputs.version }}
-            KUBECTL_VERSION=${{ env.KUBECTL_VERSION }}
-          tags: |
-            ${{ env.DOCKERHUB_ALIAS }}/${{ env.REP }}:${{ steps.get_version.outputs.version }}-ubi
-            public.ecr.aws/${{ env.ALIAS }}/${{ env.REP }}:${{ steps.get_version.outputs.version }}-ubi
-          cache-from: type=local,src=/tmp/.buildx-cache/release
-          cache-to: type=local,mode=max,dest=/tmp/.buildx-cache/release
-      - name: Image digest
-        run: echo ${{ steps.docker_build.outputs.digest }}
-
-      - name: Build and push fips ubi image - Docker/ECR
-        id: docker_build_fips_ubi
-        uses: docker/build-push-action@v6
-        with:
-          context: .
-          platforms: linux/amd64,linux/arm64,linux/ppc64le,linux/s390x
-          builder: ${{ steps.buildx.outputs.name }}
-          push: true
-          file: Dockerfile.fips.ubi
-          build-args: |
-            KUBEBENCH_VERSION=${{ steps.get_version.outputs.version }}
-            KUBECTL_VERSION=${{ env.KUBECTL_VERSION }}
-          tags: |
-            ${{ env.DOCKERHUB_ALIAS }}/${{ env.REP }}:${{ steps.get_version.outputs.version }}-ubi-fips
-            public.ecr.aws/${{ env.ALIAS }}/${{ env.REP }}:${{ steps.get_version.outputs.version }}-ubi-fips
-          cache-from: type=local,src=/tmp/.buildx-cache/release
-          cache-to: type=local,mode=max,dest=/tmp/.buildx-cache/release
       - name: Image digest
         run: echo ${{ steps.docker_build.outputs.digest }}

.github/workflows/release.yml

@@ -5,26 +5,27 @@ on:
     tags:
       - "v*"
 env:
+  GO_VERSION: "1.16"
   KIND_VERSION: "v0.11.1"
   KIND_IMAGE: "kindest/node:v1.21.1@sha256:69860bda5563ac81e3c0057d654b5253219618a22ec3a346306239bba8cfa1a6"
 
 jobs:
   release:
     name: Release
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-18.04
     steps:
+      - name: Setup Go
+        uses: actions/setup-go@v3
+        with:
+          go-version: 1.16
       - name: Checkout code
-        uses: actions/checkout@v6
+        uses: actions/checkout@v3
         with:
           fetch-depth: 0
-      - name: Setup Go
-        uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v6.2.0
-        with:
-          go-version-file: go.mod
       - name: Run unit tests
         run: make tests
       - name: Setup Kubernetes cluster (KIND)
-        uses: engineerd/setup-kind@v0.6.2
+        uses: engineerd/setup-kind@v0.5.0
         with:
           version: ${{ env.KIND_VERSION }}
           image: ${{ env.KIND_IMAGE }}
@@ -43,7 +44,7 @@ jobs:
           second_file_path: integration/testdata/Expected_output.data
           expected_result: PASSED
       - name: Release
-        uses: goreleaser/goreleaser-action@v6
+        uses: goreleaser/goreleaser-action@v2
         with:
           distribution: goreleaser
           version: v1.7.0

.golangci.yaml

@@ -1,28 +1,12 @@
-version: "2"
+---
 linters:
-  default: none
+  disable-all: true
   enable:
+    - deadcode
     - gocyclo
-    - govet
-    - misspell
-  exclusions:
-    generated: lax
-    presets:
-      - comments
-      - common-false-positives
-      - legacy
-      - std-error-handling
-    paths:
-      - third_party$
-      - builtin$
-      - examples$
-formatters:
-  enable:
     - gofmt
     - goimports
-  exclusions:
-    generated: lax
-    paths:
-      - third_party$
-      - builtin$
-      - examples$
+    - govet
+    - misspell
+    - typecheck
+    - varcheck

.goreleaser.yml

@@ -2,18 +2,12 @@
 project_name: kube-bench
 env:
   - GO111MODULE=on
-  - CGO_ENABLED=0
   - KUBEBENCH_CFG=/etc/kube-bench/cfg
 builds:
-  - main: .
+  - main: main.go
     binary: kube-bench
-    tags:
-      - osusergo
-      - netgo
-      - static_build
     goos:
       - linux
-      - darwin
     goarch:
       - amd64
       - arm
@@ -24,9 +18,6 @@ builds:
       - 6
       - 7
     ldflags:
-      - "-s"
-      - "-w"
-      - "-extldflags '-static'"
       - "-X github.com/aquasecurity/kube-bench/cmd.KubeBenchVersion={{.Version}}"
       - "-X github.com/aquasecurity/kube-bench/cmd.cfgDir={{.Env.KUBEBENCH_CFG}}"
 # Archive customization

CONTRIBUTING.md

@@ -77,4 +77,3 @@ Finally, we can use the `make kind-run` target to run the current version of kub
 
 Every time you want to test a change, you'll need to rebuild the docker image and push it to cluster before running it again. ( `make build-docker kind-push kind-run` )
 
-To run the STIG tests locally execute the following: `make build-docker kind-push kind-run-stig`

Dockerfile

@@ -1,4 +1,4 @@
-FROM golang:1.26.0 AS build
+FROM golang:1.18.1 AS build
 WORKDIR /go/src/github.com/aquasecurity/kube-bench/
 COPY makefile makefile
 COPY go.mod go.sum ./
@@ -9,22 +9,11 @@ COPY internal/ internal/
 ARG KUBEBENCH_VERSION
 RUN make build && cp kube-bench /go/bin/kube-bench
 
-# Add kubectl to run policies checks
-ARG KUBECTL_VERSION TARGETARCH
-RUN wget -O /usr/local/bin/kubectl "https://dl.k8s.io/release/v${KUBECTL_VERSION}/bin/linux/${TARGETARCH}/kubectl"
-RUN wget -O kubectl.sha256 "https://dl.k8s.io/release/v${KUBECTL_VERSION}/bin/linux/${TARGETARCH}/kubectl.sha256"
-
-# Verify kubectl sha256sum
-RUN /bin/bash -c 'echo "$(<kubectl.sha256)  /usr/local/bin/kubectl" | sha256sum -c -'
-
-RUN chmod +x /usr/local/bin/kubectl
-
-FROM alpine:3.23.3 AS run
+FROM alpine:3.15.4 AS run
 WORKDIR /opt/kube-bench/
-# add GNU ps for -C, -o cmd, --no-headers support and add findutils to get GNU xargs
+# add GNU ps for -C, -o cmd, and --no-headers support
 # https://github.com/aquasecurity/kube-bench/issues/109
-# https://github.com/aquasecurity/kube-bench/issues/1656
-RUN apk --no-cache add procps findutils
+RUN apk --no-cache add procps
 
 # Upgrading apk-tools to remediate CVE-2021-36159 - https://snyk.io/vuln/SNYK-ALPINE314-APKTOOLS-1533752
 # https://github.com/aquasecurity/kube-bench/issues/943
@@ -37,37 +26,25 @@ RUN apk update && apk upgrade && apk --no-cache add openssl
 
 # Add glibc for running oc command 
 RUN wget -q -O /etc/apk/keys/sgerrand.rsa.pub https://alpine-pkgs.sgerrand.com/sgerrand.rsa.pub
-RUN apk add gcompat
+RUN wget https://github.com/sgerrand/alpine-pkg-glibc/releases/download/2.33-r0/glibc-2.33-r0.apk
+RUN apk add glibc-2.33-r0.apk
 RUN apk add jq
 
-# Add bash for running helper scripts
-RUN apk add bash
-
-ENV PATH=$PATH:/usr/local/mount-from-host/bin:/go/bin
+ENV PATH=$PATH:/usr/local/mount-from-host/bin
 
 COPY --from=build /go/bin/kube-bench /usr/local/bin/kube-bench
-COPY --from=build /usr/local/bin/kubectl /usr/local/bin/kubectl
 COPY entrypoint.sh .
 COPY cfg/ cfg/
-COPY helper_scripts/check_files_owner_in_dir.sh /go/bin/
-RUN chmod a+x /go/bin/check_files_owner_in_dir.sh
 ENTRYPOINT ["./entrypoint.sh"]
 CMD ["install"]
 
 # Build-time metadata as defined at http://label-schema.org
 ARG BUILD_DATE
 ARG VCS_REF
-ARG KUBEBENCH_VERSION
-
 LABEL org.label-schema.build-date=$BUILD_DATE \
-      org.label-schema.name="kube-bench" \
-      org.label-schema.vendor="Aqua Security Software Ltd." \
-      org.label-schema.version=$KUBEBENCH_VERSION \
-      org.label-schema.release=$KUBEBENCH_VERSION \
-      org.label-schema.summary="Aqua security server" \
-      org.label-schema.maintainer="admin@aquasec.com" \
-      org.label-schema.description="Run the CIS Kubernetes Benchmark tests" \
-      org.label-schema.url="https://github.com/aquasecurity/kube-bench" \
-      org.label-schema.vcs-ref=$VCS_REF \
-      org.label-schema.vcs-url="https://github.com/aquasecurity/kube-bench" \
-      org.label-schema.schema-version="1.0"
+    org.label-schema.name="kube-bench" \
+    org.label-schema.description="Run the CIS Kubernetes Benchmark tests" \
+    org.label-schema.url="https://github.com/aquasecurity/kube-bench" \
+    org.label-schema.vcs-ref=$VCS_REF \
+    org.label-schema.vcs-url="https://github.com/aquasecurity/kube-bench" \
+    org.label-schema.schema-version="1.0"

Dockerfile.fips.ubi

@@ -1,66 +0,0 @@
-FROM golang:1.26.0 AS build
-WORKDIR /go/src/github.com/aquasecurity/kube-bench/
-COPY makefile makefile
-COPY go.mod go.sum ./
-COPY main.go .
-COPY check/ check/
-COPY cmd/ cmd/
-COPY internal/ internal/
-ARG KUBEBENCH_VERSION
-RUN make build-fips && cp kube-bench /go/bin/kube-bench
-
-# Add kubectl to run policies checks
-ARG KUBECTL_VERSION TARGETARCH
-RUN wget -O /usr/local/bin/kubectl "https://dl.k8s.io/release/v${KUBECTL_VERSION}/bin/linux/${TARGETARCH}/kubectl"
-RUN wget -O kubectl.sha256 "https://dl.k8s.io/release/v${KUBECTL_VERSION}/bin/linux/${TARGETARCH}/kubectl.sha256"
-# Verify kubectl sha256sum
-RUN /bin/bash -c 'echo "$(<kubectl.sha256)  /usr/local/bin/kubectl" | sha256sum -c -'
-RUN chmod +x /usr/local/bin/kubectl
-
-
-# ubi8-minimal base image for build with ubi standards
-FROM registry.access.redhat.com/ubi9/ubi-minimal as run
-
-RUN microdnf install -y yum findutils openssl \
-  && yum -y update-minimal --security --sec-severity=Moderate --sec-severity=Important --sec-severity=Critical \
-  && yum update -y \
-  && yum install -y glibc \
-  && yum update -y glibc \
-  && yum install -y procps \
-  && yum update -y procps \
-  && yum install jq -y \
-  && yum clean all \
-  && microdnf remove yum || rpm -e -v yum \
-  && microdnf clean all
-
-WORKDIR /opt/kube-bench/
-
-ENV PATH=$PATH:/usr/local/mount-from-host/bin 
-
-COPY LICENSE /licenses/LICENSE
-COPY --from=build /go/bin/kube-bench /usr/local/bin/kube-bench
-COPY --from=build /usr/local/bin/kubectl /usr/local/bin/kubectl
-COPY entrypoint.sh .
-COPY cfg/ cfg/
-COPY helper_scripts/check_files_owner_in_dir.sh /go/bin
-ENTRYPOINT ["./entrypoint.sh"]
-CMD ["install"]
-
-
-# Build-time metadata as defined at http://label-schema.org
-ARG BUILD_DATE
-ARG VCS_REF
-ARG KUBEBENCH_VERSION
-
-LABEL org.label-schema.build-date=$BUILD_DATE \
-      org.label-schema.name="kube-bench" \
-      org.label-schema.vendor="Aqua Security Software Ltd." \
-      org.label-schema.version=$KUBEBENCH_VERSION \
-      org.label-schema.release=$KUBEBENCH_VERSION \
-      org.label-schema.summary="Aqua security server" \
-      org.label-schema.maintainer="admin@aquasec.com" \
-      org.label-schema.description="Run the CIS Kubernetes Benchmark tests" \
-      org.label-schema.url="https://github.com/aquasecurity/kube-bench" \
-      org.label-schema.vcs-ref=$VCS_REF \
-      org.label-schema.vcs-url="https://github.com/aquasecurity/kube-bench" \
-      org.label-schema.schema-version="1.0"

Dockerfile.ubi

@@ -1,66 +0,0 @@
-FROM golang:1.26.0 AS build
-WORKDIR /go/src/github.com/aquasecurity/kube-bench/
-COPY makefile makefile
-COPY go.mod go.sum ./
-COPY main.go .
-COPY check/ check/
-COPY cmd/ cmd/
-COPY internal/ internal/
-ARG KUBEBENCH_VERSION
-RUN make build && cp kube-bench /go/bin/kube-bench
-
-# Add kubectl to run policies checks
-ARG KUBECTL_VERSION TARGETARCH
-RUN wget -O /usr/local/bin/kubectl "https://dl.k8s.io/release/v${KUBECTL_VERSION}/bin/linux/${TARGETARCH}/kubectl"
-RUN wget -O kubectl.sha256 "https://dl.k8s.io/release/v${KUBECTL_VERSION}/bin/linux/${TARGETARCH}/kubectl.sha256"
-# Verify kubectl sha256sum
-RUN /bin/bash -c 'echo "$(<kubectl.sha256)  /usr/local/bin/kubectl" | sha256sum -c -'
-RUN chmod +x /usr/local/bin/kubectl
-
-
-# ubi8-minimal base image for build with ubi standards
-FROM registry.access.redhat.com/ubi9/ubi-minimal as run
-
-RUN microdnf install -y yum findutils openssl \
-  && yum -y update-minimal --security --sec-severity=Moderate --sec-severity=Important --sec-severity=Critical \
-  && yum update -y \
-  && yum install -y glibc \
-  && yum update -y glibc \
-  && yum install -y procps \
-  && yum update -y procps \
-  && yum install jq -y \
-  && yum clean all \
-  && microdnf remove yum || rpm -e -v yum \
-  && microdnf clean all
-
-WORKDIR /opt/kube-bench/
-
-ENV PATH=$PATH:/usr/local/mount-from-host/bin
-
-COPY LICENSE /licenses/LICENSE
-COPY --from=build /go/bin/kube-bench /usr/local/bin/kube-bench
-COPY --from=build /usr/local/bin/kubectl /usr/local/bin/kubectl
-COPY entrypoint.sh .
-COPY cfg/ cfg/
-COPY helper_scripts/check_files_owner_in_dir.sh /go/bin
-ENTRYPOINT ["./entrypoint.sh"]
-CMD ["install"]
-
-
-# Build-time metadata as defined at http://label-schema.org
-ARG BUILD_DATE
-ARG VCS_REF
-ARG KUBEBENCH_VERSION
-
-LABEL org.label-schema.build-date=$BUILD_DATE \
-      org.label-schema.description="Run the CIS Kubernetes Benchmark tests" \
-      org.label-schema.url="https://github.com/aquasecurity/kube-bench" \
-      org.label-schema.vcs-ref=$VCS_REF \
-      org.label-schema.vcs-url="https://github.com/aquasecurity/kube-bench" \
-      org.label-schema.schema-version="1.0" \
-      vendor="Aqua Security Software Ltd." \
-      maintainer="Aqua Security Software Ltd." \
-      version=$KUBEBENCH_VERSION \
-      release=$KUBEBENCH_VERSION \
-      summary="Aqua Security Kube-bench." \
-      description="Run the CIS Kubernetes Benchmark tests"

README.md

@@ -24,12 +24,7 @@ Tests are configured with YAML files, making this tool easy to update as test sp
 
 ![Kubernetes Bench for Security](/docs/images/output.png "Kubernetes Bench for Security")
 
-## CIS Scanning as part of Trivy and the Trivy Operator
-
-[Trivy](https://github.com/aquasecurity/trivy), the all in one cloud native security scanner, can be deployed as a [Kubernetes Operator](https://github.com/aquasecurity/trivy-operator) inside a cluster.
-Both, the [Trivy CLI](https://github.com/aquasecurity/trivy), and the [Trivy Operator](https://github.com/aquasecurity/trivy-operator) support CIS Kubernetes Benchmark scanning among several other features.
-
-## Quick start
+### Quick start
 
 There are multiple ways to run kube-bench.
 You can run kube-bench inside a pod, but it will need access to the host's PID namespace in order to check the running processes, as well as access to some directories on the host where config files and other files are stored.

cfg/ack-1.0/node.yaml

@@ -25,16 +25,14 @@ groups:
 
       - id: 4.1.2
         text: "Ensure that the kubelet service file ownership is set to root:root (Automated)"
-        audit: '/bin/sh -c "if test -e $kubeletsvc; then stat -c %U:%G $kubeletsvc; else echo \"File not found\"; fi"'
+        audit: '/bin/sh -c ''if test -e $kubeletsvc; then stat -c %U:%G $kubeletsvc; fi'' '
         tests:
-          bin_op: or
           test_items:
             - flag: root:root
-            - flag: "File not found"
         remediation: |
-            Run the below command (based on the file location on your system) on the each worker node.
-            For example,
-            chown root:root $kubeletsvc
+          Run the below command (based on the file location on your system) on the each worker node.
+          For example,
+          chown root:root $kubeletsvc
         scored: true
 
       - id: 4.1.3
@@ -47,6 +45,8 @@ groups:
               compare:
                 op: bitmask
                 value: "644"
+            - flag: "$proxykubeconfig"
+              set: false
         remediation: |
           Run the below command (based on the file location on your system) on the each worker node.
           For example,
@@ -60,6 +60,8 @@ groups:
           bin_op: or
           test_items:
             - flag: root:root
+            - flag: "$proxykubeconfig"
+              set: false
         remediation: |
           Run the below command (based on the file location on your system) on the each worker node.
           For example, chown root:root $proxykubeconfig
@@ -95,7 +97,7 @@ groups:
       - id: 4.1.7
         text: "Ensure that the certificate authorities file permissions are set to 644 or more restrictive (Manual)"
         audit: |
-          CAFILE=$(ps -ef | grep kubelet | grep -v apiserver | grep -- --client-ca-file= | awk -F '--client-ca-file=' '{print $2}' | awk '{print $1}' | uniq)
+          CAFILE=$(ps -ef | grep kubelet | grep -v apiserver | grep -- --client-ca-file= | awk -F '--client-ca-file=' '{print $2}' | awk '{print $1}')
           if test -z $CAFILE; then CAFILE=$kubeletcafile; fi
           if test -e $CAFILE; then stat -c permissions=%a $CAFILE; fi
         tests:
@@ -112,7 +114,7 @@ groups:
       - id: 4.1.8
         text: "Ensure that the client certificate authorities file ownership is set to root:root (Manual)"
         audit: |
-          CAFILE=$(ps -ef | grep kubelet | grep -v apiserver | grep -- --client-ca-file= | awk -F '--client-ca-file=' '{print $2}' | awk '{print $1}' | uniq)
+          CAFILE=$(ps -ef | grep kubelet | grep -v apiserver | grep -- --client-ca-file= | awk -F '--client-ca-file=' '{print $2}' | awk '{print $1}')
           if test -z $CAFILE; then CAFILE=$kubeletcafile; fi
           if test -e $CAFILE; then stat -c %U:%G $CAFILE; fi
         tests:
@@ -377,7 +379,7 @@ groups:
                 op: valid_elements
                 value: TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256
         remediation: |
-          If using a Kubelet config file, edit the file to set tlsCipherSuites: to
+          If using a Kubelet config file, edit the file to set TLSCipherSuites: to
           TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256
           or to a subset of these values.
           If using executable arguments, edit the kubelet service file

cfg/ack-1.0/policies.yaml

@@ -132,7 +132,7 @@ groups:
         type: "manual"
         remediation: |
           Review the use of capabilites in applications runnning on your cluster. Where a namespace
-          contains applications which do not require any Linux capabities to operate consider adding
+          contains applicaions which do not require any Linux capabities to operate consider adding
           a PSP which forbids the admission of containers which do not drop all capabilities.
         scored: false
 

cfg/aks-1.7/config.yaml

@@ -1,2 +0,0 @@
----
-## Version-specific settings that override the values in cfg/config.yaml

cfg/aks-1.7/controlplane.yaml

@@ -1,31 +0,0 @@
----
-controls:
-version: "aks-1.7"
-id: 2
-text: "Control Plane Configuration"
-type: "controlplane"
-groups:
-  - id: 2.1
-    text: "Logging"
-    checks:
-      - id: 2.1.1
-        text: "Enable audit Logs"
-        type: "manual"
-        remediation: |
-          Azure audit logs are enabled and managed in the Azure portal. To enable log collection for
-          the Kubernetes master components in your AKS cluster, open the Azure portal in a web
-          browser and complete the following steps:
-          1. Select the resource group for your AKS cluster, such as myResourceGroup. Don't
-             select the resource group that contains your individual AKS cluster resources, such
-             as MC_myResourceGroup_myAKSCluster_eastus.
-          2. On the left-hand side, choose Diagnostic settings.
-          3. Select your AKS cluster, such as myAKSCluster, then choose to Add diagnostic setting.
-          4. Enter a name, such as myAKSClusterLogs, then select the option to Send to Log Analytics.
-          5. Select an existing workspace or create a new one. If you create a workspace, provide
-             a workspace name, a resource group, and a location.
-          6. In the list of available logs, select the logs you wish to enable. For this example,
-             enable the kube-audit and kube-audit-admin logs. Common logs include the kube-
-             apiserver, kube-controller-manager, and kube-scheduler. You can return and change
-             the collected logs once Log Analytics workspaces are enabled.
-          7. When ready, select Save to enable collection of the selected logs.
-        scored: false

cfg/aks-1.7/managedservices.yaml

@@ -1,169 +0,0 @@
----
-controls:
-version: "aks-1.7"
-id: 5
-text: "Managed Services"
-type: "managedservices"
-groups:
-  - id: 5.1
-    text: "Image Registry and Image Scanning"
-    checks:
-      - id: 5.1.1
-        text: "Ensure Image Vulnerability Scanning using Microsoft Defender for Cloud (MDC) image scanning or a third party provider (Manual)"
-        type: "manual"
-        remediation: |
-          Enable MDC for Container Registries by running the following Azure CLI command:
-          az security pricing create --name ContainerRegistry --tier Standard
-          Alternatively, use the following command to enable image scanning for your container registry:
-          az resource update --ids /subscriptions/{subscription-id}/resourceGroups/{resource-group-name}/providers/Microsoft.ContainerRegistry/registries/{registry-name} --set properties.enabled=true
-          Replace `subscription-id`, `resource-group-name`, and `registry-name` with the correct values for your environment.
-          Please note that enabling MDC for Container Registries will incur additional costs, so be sure to review the pricing information provided in the Azure documentation before enabling it.
-        scored: false
-
-      - id: 5.1.2
-        text: "Minimize user access to Azure Container Registry (ACR) (Manual)"
-        type: "manual"
-        remediation: |
-          Azure Container Registry
-          If you use Azure Container Registry (ACR) as your container image store, you need to grant
-          permissions to the service principal for your AKS cluster to read and pull images. Currently,
-          the recommended configuration is to use the az aks create or az aks update command to
-          integrate with a registry and assign the appropriate role for the service principal. For
-          detailed steps, see Authenticate with Azure Container Registry from Azure Kubernetes
-          Service.
-          To avoid needing an Owner or Azure account administrator role, you can configure a
-          service principal manually or use an existing service principal to authenticate ACR from
-          AKS. For more information, see ACR authentication with service principals or Authenticate
-          from Kubernetes with a pull secret.
-        scored: false
-
-      - id: 5.1.3
-        text: "Minimize cluster access to read-only for Azure Container Registry (ACR) (Manual)"
-        type: "manual"
-        remediation: "No remediation"
-        scored: false
-
-      - id: 5.1.4
-        text: "Minimize Container Registries to only those approved (Manual)"
-        type: "manual"
-        remediation: |
-          If you are using **Azure Container Registry**, you can restrict access using firewall rules as described in the official documentation:
-          https://docs.microsoft.com/en-us/azure/container-registry/container-registry-firewall-access-rules
-          For other non-AKS repositories, you can use **admission controllers** or **Azure Policy** to enforce registry access restrictions.
-          Limiting or locking down egress traffic to specific container registries is also recommended. For more information, refer to:
-          https://docs.microsoft.com/en-us/azure/aks/limit-egress-traffic
-        scored: false
-
-
-  - id: 5.2
-    text: "Access and identity options for Azure Kubernetes Service (AKS)"
-    checks:
-      - id: 5.2.1
-        text: "Prefer using dedicated AKS Service Accounts (Manual)"
-        type: "manual"
-        remediation: |
-          Azure Active Directory integration
-          The security of AKS clusters can be enhanced with the integration of Azure Active Directory
-          (AD). Built on decades of enterprise identity management, Azure AD is a multi-tenant,
-          cloud-based directory, and identity management service that combines core directory
-          services, application access management, and identity protection. With Azure AD, you can
-          integrate on-premises identities into AKS clusters to provide a single source for account
-          management and security.
-          Azure Active Directory integration with AKS clusters
-          With Azure AD-integrated AKS clusters, you can grant users or groups access to Kubernetes
-          resources within a namespace or across the cluster. To obtain a kubectl configuration
-          context, a user can run the az aks get-credentials command. When a user then interacts
-          with the AKS cluster with kubectl, they're prompted to sign in with their Azure AD
-          credentials. This approach provides a single source for user account management and
-          password credentials. The user can only access the resources as defined by the cluster
-          administrator.
-          Azure AD authentication is provided to AKS clusters with OpenID Connect. OpenID Connect
-          is an identity layer built on top of the OAuth 2.0 protocol. For more information on OpenID
-          Connect, see the Open ID connect documentation. From inside of the Kubernetes cluster,
-          Webhook Token Authentication is used to verify authentication tokens. Webhook token
-          authentication is configured and managed as part of the AKS cluster.
-        scored: false
-
-
-  - id: 5.3
-    text: "Key Management Service (KMS)"
-    checks:
-      - id: 5.3.1
-        text: "Ensure Kubernetes Secrets are encrypted (Manual)"
-        type: "manual"
-        remediation: "No remediation"
-        scored: false
-
-
-  - id: 5.4
-    text: "Cluster Networking"
-    checks:
-      - id: 5.4.1
-        text: "Restrict Access to the Control Plane Endpoint (Manual)"
-        type: "manual"
-        remediation: |
-          By enabling private endpoint access to the Kubernetes API server, all communication between your nodes and the API server stays within your VPC. You can also limit the IP addresses that can access your API server from the internet, or completely disable internet access to the API server.
-          With this in mind, you can update your cluster accordingly using the AKS CLI to ensure that Private Endpoint Access is enabled.
-          If you choose to also enable Public Endpoint Access then you should also configure a list of allowable CIDR blocks, resulting in restricted access from the internet. If you specify no CIDR blocks, then the public API server endpoint is able to receive and process requests from all IP addresses by defaulting to ['0.0.0.0/0'].
-          Example:
-          az aks update --name ${CLUSTER_NAME} --resource-group ${RESOURCE_GROUP} --api-server-access-profile enablePrivateCluster=true --api-server-access-profile authorizedIpRanges=192.168.1.0/24
-        scored: false
-
-      - id: 5.4.2
-        text: "Ensure clusters are created with Private Endpoint Enabled and Public Access Disabled (Manual)"
-        type: "manual"
-        remediation: |
-          To use a private endpoint, create a new private endpoint in your virtual network, then create a link between your virtual network and a new private DNS zone.
-          You can also restrict access to the public endpoint by enabling only specific CIDR blocks to access it. For example:
-          az aks update --name ${CLUSTER_NAME} --resource-group ${RESOURCE_GROUP} --api-server-access-profile enablePublicFqdn=false
-          This command disables the public API endpoint for your AKS cluster.
-        scored: false
-
-      - id: 5.4.3
-        text: "Ensure clusters are created with Private Nodes (Manual)"
-        type: "manual"
-        remediation: |
-          To create a private cluster, use the following command:
-          az aks create \
-          --resource-group <private-cluster-resource-group> \
-          --name <private-cluster-name> \
-          --load-balancer-sku standard \
-          --enable-private-cluster \
-          --network-plugin azure \
-          --vnet-subnet-id <subnet-id> \
-          --docker-bridge-address <docker-bridge-address> \
-          --dns-service-ip <dns-service-ip> \
-          --service-cidr <service-cidr>
-          Ensure that --enable-private-cluster flag is set to enable private nodes in your cluster.
-        scored: false
-
-      - id: 5.4.4
-        text: "Ensure Network Policy is Enabled and set as appropriate (Manual)"
-        type: "manual"
-        remediation: |
-          Utilize Calico or another network policy engine to segment and isolate your traffic.
-          Enable network policies on your AKS cluster by following the Azure documentation or using the `az aks` CLI to enable the network policy add-on.
-        scored: false
-
-
-      - id: 5.4.5
-        text: "Encrypt traffic to HTTPS load balancers with TLS certificates (Manual)"
-        type: "manual"
-        remediation: "No remediation"
-        scored: false
-
-
-  - id: 5.5
-    text: "Authentication and Authorization"
-    checks:
-      - id: 5.5.1
-        text: "Manage Kubernetes RBAC users with Azure AD (Manual)"
-        type: "manual"
-        remediation: "No remediation"
-        scored: false
-
-      - id: 5.5.2
-        text: "Use Azure RBAC for Kubernetes Authorization (Manual)"
-        type: "manual"
-        remediation: "No remediation"
-        scored: false

cfg/aks-1.7/master.yaml

@@ -1,6 +0,0 @@
----
-controls:
-version: "aks-1.7"
-id: 1
-text: "Control Plane Components"
-type: "master"

cfg/aks-1.7/node.yaml

@@ -1,283 +0,0 @@
----
-controls:
-version: "aks-1.7"
-id: 3
-text: "Worker Node Security Configuration"
-type: "node"
-groups:
-  - id: 3.1
-    text: "Worker Node Configuration Files"
-    checks:
-      - id: 3.1.1
-        text: "Ensure that the kubeconfig file permissions are set to 644 or more restrictive (Automated)"
-        audit: '/bin/sh -c ''if test -e $kubeletkubeconfig; then stat -c permissions=%a $kubeletkubeconfig; fi'' '
-        tests:
-          test_items:
-            - flag: "permissions"
-              compare:
-                op: bitmask
-                value: "644"
-        remediation: |
-          Run the below command (based on the file location on your system) on the each worker node.
-          For example,
-          chmod 644 $kubeletkubeconfig
-        scored: true
-
-      - id: 3.1.2
-        text: "Ensure that the kubelet kubeconfig file ownership is set to root:root (Automated)"
-        audit: '/bin/sh -c ''if test -e $kubeletkubeconfig; then stat -c %U:%G $kubeletkubeconfig; fi'' '
-        tests:
-          test_items:
-            - flag: root:root
-        remediation: |
-          Run the below command (based on the file location on your system) on the each worker node.
-          For example,
-          chown root:root $kubeletkubeconfig
-        scored: true
-
-      - id: 3.1.3
-        text: "Ensure that the azure.json file has permissions set to 644 or more restrictive (Automated)"
-        audit: '/bin/sh -c ''if test -e /etc/kubernetes/azure.json; then stat -c permissions=%a /etc/kubernetes/azure.json; fi'' '
-        tests:
-          test_items:
-            - flag: "permissions"
-              compare:
-                op: bitmask
-                value: "644"
-        remediation: |
-          Run the following command (using the config file location identified in the Audit step)
-          chmod 644 $kubeletconf
-        scored: true
-
-      - id: 3.1.4
-        text: "Ensure that the azure.json file ownership is set to root:root (Automated)"
-        audit: '/bin/sh -c ''if test -e $kubeletconf; then stat -c %U:%G $kubeletconf; fi'' '
-        tests:
-          test_items:
-            - flag: root:root
-        remediation: |
-          Run the following command (using the config file location identified in the Audit step)
-          chown root:root $kubeletconf
-        scored: true
-
-
-  - id: 3.2
-    text: "Kubelet"
-    checks:
-      - id: 3.2.1
-        text: "Ensure that the --anonymous-auth argument is set to false (Automated)"
-        audit: "/bin/ps -fC $kubeletbin"
-        audit_config: "/bin/cat $kubeletconf"
-        tests:
-          test_items:
-            - flag: "--anonymous-auth"
-              path: '{.authentication.anonymous.enabled}'
-              compare:
-                op: eq
-                value: false
-        remediation: |
-          If using a Kubelet config file, edit the file to set authentication: anonymous: enabled to
-          false.
-          If using executable arguments, edit the kubelet service file
-          $kubeletsvc on each worker node and
-          set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable.
-          --anonymous-auth=false
-          Based on your system, restart the kubelet service. For example:
-          systemctl daemon-reload
-          systemctl restart kubelet.service
-        scored: true
-
-      - id: 3.2.2
-        text: "Ensure that the --authorization-mode argument is not set to AlwaysAllow (Automated)"
-        audit: "/bin/ps -fC $kubeletbin"
-        audit_config: "/bin/cat $kubeletconf"
-        tests:
-          test_items:
-            - flag: --authorization-mode
-              path: '{.authorization.mode}'
-              compare:
-                op: nothave
-                value: AlwaysAllow
-        remediation: |
-          If using a Kubelet config file, edit the file to set authorization: mode to Webhook. If
-          using executable arguments, edit the kubelet service file
-          $kubeletsvc on each worker node and
-          set the below parameter in KUBELET_AUTHZ_ARGS variable.
-          --authorization-mode=Webhook
-          Based on your system, restart the kubelet service. For example:
-          systemctl daemon-reload
-          systemctl restart kubelet.service
-        scored: true
-
-      - id: 3.2.3
-        text: "Ensure that the --client-ca-file argument is set as appropriate (Automated)"
-        audit: "/bin/ps -fC $kubeletbin"
-        audit_config: "/bin/cat $kubeletconf"
-        tests:
-          test_items:
-            - flag: --client-ca-file
-              path: '{.authentication.x509.clientCAFile}'
-              set: true
-        remediation: |
-          If using a Kubelet config file, edit the file to set authentication: x509: clientCAFile to
-          the location of the client CA file.
-          If using command line arguments, edit the kubelet service file
-          $kubeletsvc on each worker node and
-          set the below parameter in KUBELET_AUTHZ_ARGS variable.
-          --client-ca-file=<path/to/client-ca-file>
-          Based on your system, restart the kubelet service. For example:
-          systemctl daemon-reload
-          systemctl restart kubelet.service
-        scored: true
-
-      - id: 3.2.4
-        text: "Ensure that the --read-only-port is secured (Automated)"
-        audit: "/bin/ps -fC $kubeletbin"
-        audit_config: "/bin/cat $kubeletconf"
-        tests:
-          test_items:
-            - flag: "--read-only-port"
-              path: '{.readOnlyPort}'
-              set: true
-              compare:
-                op: eq
-                value: 0
-        remediation: |
-          If using a Kubelet config file, edit the file to set readOnlyPort to 0.
-          If using command line arguments, edit the kubelet service file
-          $kubeletsvc on each worker node and
-          set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable.
-          --read-only-port=0
-          Based on your system, restart the kubelet service. For example:
-          systemctl daemon-reload
-          systemctl restart kubelet.service
-        scored: true
-
-      - id: 3.2.5
-        text: "Ensure that the --streaming-connection-idle-timeout argument is not set to 0 (Automated)"
-        audit: "/bin/ps -fC $kubeletbin"
-        audit_config: "/bin/cat $kubeletconf"
-        tests:
-          test_items:
-            - flag: --streaming-connection-idle-timeout
-              path: '{.streamingConnectionIdleTimeout}'
-              set: true
-              compare:
-                op: noteq
-                value: 0
-            - flag: --streaming-connection-idle-timeout
-              path: '{.streamingConnectionIdleTimeout}'
-              set: false
-          bin_op: or
-        remediation: |
-          If using a Kubelet config file, edit the file to set streamingConnectionIdleTimeout to a
-          value other than 0.
-          If using command line arguments, edit the kubelet service file
-          $kubeletsvc on each worker node and
-          set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable.
-          --streaming-connection-idle-timeout=5m
-          Based on your system, restart the kubelet service. For example:
-          systemctl daemon-reload
-          systemctl restart kubelet.service
-        scored: true
-
-      - id: 3.2.6
-        text: "Ensure that the --make-iptables-util-chains argument is set to true (Automated) "
-        audit: "/bin/ps -fC $kubeletbin"
-        audit_config: "/bin/cat $kubeletconf"
-        tests:
-          test_items:
-            - flag: --make-iptables-util-chains
-              path: '{.makeIPTablesUtilChains}'
-              set: true
-              compare:
-                op: eq
-                value: true
-            - flag: --make-iptables-util-chains
-              path: '{.makeIPTablesUtilChains}'
-              set: false
-          bin_op: or
-        remediation: |
-          If using a Kubelet config file, edit the file to set makeIPTablesUtilChains: true.
-          If using command line arguments, edit the kubelet service file
-          $kubeletsvc on each worker node and
-          remove the --make-iptables-util-chains argument from the
-          KUBELET_SYSTEM_PODS_ARGS variable.
-          Based on your system, restart the kubelet service. For example:
-          systemctl daemon-reload
-          systemctl restart kubelet.service
-        scored: true
-
-
-      - id: 3.2.7
-        text: "Ensure that the --eventRecordQPS argument is set to 0 or a level which ensures appropriate event capture (Automated)"
-        audit: "/bin/ps -fC $kubeletbin"
-        audit_config: "/bin/cat $kubeletconf"
-        tests:
-          test_items:
-            - flag: --event-qps
-              path: '{.eventRecordQPS}'
-              set: true
-              compare:
-                op: eq
-                value: 0
-        remediation: |
-          If using a Kubelet config file, edit the file to set the 'eventRecordQPS' value to an appropriate level (e.g., 5).
-          If using executable arguments, check the Kubelet service file `$kubeletsvc` on each worker node, and add the following parameter to the `KUBELET_ARGS` variable:
-          --eventRecordQPS=5
-          Ensure that there is no conflicting `--eventRecordQPS` setting in the service file that overrides the config file.
-          After making the changes, restart the Kubelet service:
-          systemctl daemon-reload
-          systemctl restart kubelet.service
-          systemctl status kubelet -l
-        scored: true
-
-
-      - id: 3.2.8
-        text: "Ensure that the --rotate-certificates argument is not set to false (Automated)"
-        audit: "/bin/ps -fC $kubeletbin"
-        audit_config: "/bin/cat $kubeletconf"
-        tests:
-          test_items:
-            - flag: --rotate-certificates
-              path: '{.rotateCertificates}'
-              set: true
-              compare:
-                op: eq
-                value: true
-            - flag: --rotate-certificates
-              path: '{.rotateCertificates}'
-              set: false
-          bin_op: or
-        remediation: |
-          If modifying the Kubelet config file, edit the `kubelet-config.json` file located at `/etc/kubernetes/kubelet/kubelet-config.json` and set the following parameter to `true`:
-          "rotateCertificates": true
-          Ensure that the Kubelet service file located at `/etc/systemd/system/kubelet.service.d/10-kubelet-args.conf` does not define the `--rotate-certificates` argument as `false`, as this would override the config file.
-          If using executable arguments, add the following line to the `KUBELET_CERTIFICATE_ARGS` variable:
-          --rotate-certificates=true
-          After making the necessary changes, restart the Kubelet service:
-          systemctl daemon-reload
-          systemctl restart kubelet.service
-          systemctl status kubelet -l
-        scored: true
-
-      - id: 3.2.9
-        text: "Ensure that the RotateKubeletServerCertificate argument is set to true (Automated)"
-        audit: "/bin/ps -fC $kubeletbin"
-        audit_config: "/bin/cat $kubeletconf"
-        tests:
-          test_items:
-            - flag: RotateKubeletServerCertificate
-              path: '{.featureGates.RotateKubeletServerCertificate}'
-              set: true
-              compare:
-                op: eq
-                value: true
-        remediation: |
-          Edit the kubelet service file $kubeletsvc
-          on each worker node and set the below parameter in KUBELET_CERTIFICATE_ARGS variable.
-          --feature-gates=RotateKubeletServerCertificate=true
-          Based on your system, restart the kubelet service. For example:
-          systemctl daemon-reload
-          systemctl restart kubelet.service
-        scored: true

cfg/aks-1.7/policies.yaml

@@ -1,417 +0,0 @@
----
-controls:
-version: "aks-1.7"
-id: 4
-text: "Policies"
-type: "policies"
-groups:
-  - id: 4.1
-    text: "RBAC and Service Accounts"
-    checks:
-      - id: 4.1.1
-        text: "Ensure that the cluster-admin role is only used where required (Automated)"
-        audit: |
-          kubectl get clusterrolebindings -o json | jq -r '
-            .items[]
-            | select(.roleRef.name == "cluster-admin")
-            | .subjects[]?
-            | select(.kind != "Group" or (.name != "system:masters" and .name != "system:nodes"))
-            | "FOUND_CLUSTER_ADMIN_BINDING"
-          ' || echo "NO_CLUSTER_ADMIN_BINDINGS"
-        tests:
-          test_items:
-            - flag: "NO_CLUSTER_ADMIN_BINDINGS"
-              set: true
-              compare:
-                op: eq
-                value: "NO_CLUSTER_ADMIN_BINDINGS"
-        remediation: |
-          Identify all clusterrolebindings to the cluster-admin role using:
-
-            kubectl get clusterrolebindings --no-headers | grep cluster-admin
-
-          Review if each of them actually needs this role. If not, remove the binding:
-
-            kubectl delete clusterrolebinding <binding-name>
-
-          Where possible, assign a less privileged ClusterRole.
-        scored: true
-
-      - id: 4.1.2
-        text: "Minimize access to secrets (Automated)"
-        audit: |
-          count=$(kubectl get roles --all-namespaces -o json | jq '
-            .items[]
-            | select(.rules[]?
-              | (.resources[]? == "secrets")
-              and ((.verbs[]? == "get") or (.verbs[]? == "list") or (.verbs[]? == "watch"))
-            )' | wc -l)
-
-          if [ "$count" -gt 0 ]; then
-            echo "SECRETS_ACCESS_FOUND"
-          fi
-        tests:
-          test_items:
-            - flag: "SECRETS_ACCESS_FOUND"
-              set: false
-        remediation: |
-          Identify all roles that grant access to secrets via get/list/watch verbs.
-          Use `kubectl edit role -n <namespace> <name>` to remove these permissions.
-          Alternatively, create a new least-privileged role that excludes secret access.
-        scored: true
-
-      - id: 4.1.3
-        text: "Minimize wildcard use in Roles and ClusterRoles (Automated)"
-        audit: |
-          wildcards=$(kubectl get roles --all-namespaces -o json | jq '
-            .items[] | select(
-              .rules[]? | (.verbs[]? == "*" or .resources[]? == "*" or .apiGroups[]? == "*")
-            )' | wc -l)
-
-          wildcards_clusterroles=$(kubectl get clusterroles -o json | jq '
-            .items[] | select(
-              .rules[]? | (.verbs[]? == "*" or .resources[]? == "*" or .apiGroups[]? == "*")
-            )' | wc -l)
-
-          total=$((wildcards + wildcards_clusterroles))
-
-          if [ "$total" -gt 0 ]; then
-            echo "wildcards_present"
-          fi
-        tests:
-          test_items:
-            - flag: wildcards_present
-              set: false
-        remediation: |
-          Identify roles and clusterroles using wildcards (*) in 'verbs', 'resources', or 'apiGroups'.
-          Replace wildcards with specific values to enforce least privilege access.
-          Use `kubectl edit role -n <namespace> <name>` or `kubectl edit clusterrole <name>` to update.
-        scored: true
-
-
-      - id: 4.1.4
-        text: "Minimize access to create pods (Automated)"
-        audit: |
-          echo "🔹 Roles and ClusterRoles with 'create' access on 'pods':"
-          access=$(kubectl get roles,clusterroles -A -o json | jq '
-            [.items[] |
-              select(
-                .rules[]? |
-                (.resources[]? == "pods" and .verbs[]? == "create")
-              )
-            ] | length')
-
-          if [ "$access" -gt 0 ]; then
-            echo "pods_create_access"
-          fi
-        tests:
-          test_items:
-            - flag: pods_create_access
-              set: false
-        remediation: |
-          Review all roles and clusterroles that have "create" permission on "pods".
-
-          🔒 Where possible, remove or restrict this permission to only required service accounts.
-
-          🛠 Use:
-            - `kubectl edit role -n <namespace> <role>`
-            - `kubectl edit clusterrole <name>`
-
-          ✅ Apply least privilege principle across the cluster.
-        scored: true
-
-
-      - id: 4.1.5
-        text: "Ensure that default service accounts are not actively used (Automated)"
-        audit: |
-          echo "🔹 Default Service Accounts with automountServiceAccountToken enabled:"
-          default_sa_count=$(kubectl get serviceaccounts --all-namespaces -o json | jq '
-            [.items[] | select(.metadata.name == "default" and (.automountServiceAccountToken != false))] | length')
-          if [ "$default_sa_count" -gt 0 ]; then
-            echo "default_sa_not_auto_mounted"
-          fi
-
-          echo "\n🔹 Pods using default ServiceAccount:"
-          pods_using_default_sa=$(kubectl get pods --all-namespaces -o json | jq '
-            [.items[] | select(.spec.serviceAccountName == "default")] | length')
-          if [ "$pods_using_default_sa" -gt 0 ]; then
-            echo "default_sa_used_in_pods"
-          fi
-        tests:
-          test_items:
-            - flag: default_sa_not_auto_mounted
-              set: false
-            - flag: default_sa_used_in_pods
-              set: false
-        remediation: |
-          1. Avoid using default service accounts for workloads.
-          2. Set `automountServiceAccountToken: false` on all default SAs:
-             kubectl patch serviceaccount default -n <namespace> -p '{"automountServiceAccountToken": false}'
-          3. Use custom service accounts with only the necessary permissions.
-        scored: true
-
-
-      - id: 4.1.6
-        text: "Ensure that Service Account Tokens are only mounted where necessary (Automated)"
-        audit: |
-          echo "🔹 Pods with automountServiceAccountToken enabled:"
-          pods_with_token_mount=$(kubectl get pods --all-namespaces -o json | jq '
-            [.items[] | select(.spec.automountServiceAccountToken != false)] | length')
-
-          if [ "$pods_with_token_mount" -gt 0 ]; then
-            echo "automountServiceAccountToken"
-          fi
-        tests:
-          test_items:
-            - flag: automountServiceAccountToken
-              set: false
-        remediation: |
-          Pods that do not need access to the Kubernetes API should not mount service account tokens.
-
-          ✅ To disable token mounting in a pod definition:
-          ```yaml
-          spec:
-            automountServiceAccountToken: false
-          ```
-
-          ✅ Or patch an existing pod's spec (recommended via workload template):
-          Patch not possible for running pods — update the deployment YAML or recreate pods with updated spec.
-        scored: true
-
-
-  - id: 4.2
-    text: "Pod Security Policies"
-    checks:
-      - id: 4.2.1
-        text: "Minimize the admission of privileged containers (Automated)"
-        audit: |
-          kubectl get pods --all-namespaces -o json | \
-            jq -r 'if any(.items[]?.spec.containers[]?; .securityContext?.privileged == true) then "PRIVILEGED_FOUND" else "NO_PRIVILEGED" end'
-        tests:
-          test_items:
-            - flag: "NO_PRIVILEGED"
-              set: true
-              compare:
-                op: eq
-                value: "NO_PRIVILEGED"
-        remediation: |
-          Add a Pod Security Admission (PSA) policy to each namespace in the cluster to restrict the admission of privileged containers.
-          To enforce a restricted policy for a specific namespace, use the following command:
-          kubectl label --overwrite ns NAMESPACE pod-security.kubernetes.io/enforce=restricted
-          You can also enforce PSA for all namespaces:
-          kubectl label --overwrite ns --all pod-security.kubernetes.io/warn=baseline
-          Additionally, review the namespaces that should be excluded (e.g., `kube-system`, `gatekeeper-system`, `azure-arc`, `azure-extensions-usage-system`) and adjust your filtering if necessary.
-          To enable Pod Security Policies, refer to the detailed documentation for Kubernetes and Azure integration at:
-          https://learn.microsoft.com/en-us/azure/governance/policy/concepts/policy-for-kubernetes
-        scored: true
-
-      - id: 4.2.2
-        text: "Minimize the admission of containers wishing to share the host process ID namespace (Automated)"
-        audit: |
-          kubectl get pods --all-namespaces -o json | \
-            jq -r 'if any(.items[]?; .spec.hostPID == true) then "HOSTPID_FOUND" else "NO_HOSTPID" end'
-        tests:
-          test_items:
-            - flag: "NO_HOSTPID"
-              set: true
-              compare:
-                op: eq
-                value: "NO_HOSTPID"
-
-        remediation: |
-          Add a policy to each namespace in the cluster that restricts the admission of containers with hostPID. For namespaces that need it, ensure RBAC controls limit access to a specific service account.
-          You can label your namespaces as follows to restrict or enforce the policy:
-          kubectl label --overwrite ns NAMESPACE pod-security.kubernetes.io/enforce=restricted
-          You can also use the following to warn about policies:
-          kubectl label --overwrite ns --all pod-security.kubernetes.io/warn=baseline
-          For more information, refer to the official Kubernetes and Azure documentation on policies:
-          https://learn.microsoft.com/en-us/azure/governance/policy/concepts/policy-for-kubernetes
-        scored: true
-
-      - id: 4.2.3
-        text: "Minimize the admission of containers wishing to share the host IPC namespace (Automated)"
-        audit: |
-          kubectl get pods --all-namespaces -o json | jq -r 'if any(.items[]?; .spec.hostIPC == true) then "HOSTIPC_FOUND" else "NO_HOSTIPC" end'
-        tests:
-          test_items:
-            - flag: "NO_HOSTIPC"
-              set: true
-              compare:
-                op: eq
-                value: "NO_HOSTIPC"
-        remediation: |
-          Add policies to each namespace in the cluster which has user workloads to restrict the admission of hostIPC containers.
-          You can label your namespaces as follows to restrict or enforce the policy:
-          kubectl label --overwrite ns NAMESPACE pod-security.kubernetes.io/enforce=restricted
-          You can also use the following to warn about policies:
-          kubectl label --overwrite ns --all pod-security.kubernetes.io/warn=baseline
-          For more information, refer to the official Kubernetes and Azure documentation on policies:
-          https://learn.microsoft.com/en-us/azure/governance/policy/concepts/policy-for-kubernetes
-        scored: true
-
-      - id: 4.2.4
-        text: "Minimize the admission of containers wishing to share the host network namespace (Automated)"
-        audit: |
-          kubectl get pods --all-namespaces -o json | jq -r 'if any(.items[]?; .spec.hostNetwork == true) then "HOSTNETWORK_FOUND" else "NO_HOSTNETWORK" end'
-        tests:
-          test_items:
-            - flag: "NO_HOSTNETWORK"
-              set: true
-              compare:
-                op: eq
-                value: "NO_HOSTNETWORK"
-        remediation: |
-          Add policies to each namespace in the cluster which has user workloads to restrict the admission of hostNetwork containers.
-          You can label your namespaces as follows to restrict or enforce the policy:
-          kubectl label --overwrite ns NAMESPACE pod-security.kubernetes.io/enforce=restricted
-          You can also use the following to warn about policies:
-          kubectl label --overwrite ns --all pod-security.kubernetes.io/warn=baseline
-          For more information, refer to the official Kubernetes and Azure documentation on policies:
-          https://learn.microsoft.com/en-us/azure/governance/policy/concepts/policy-for-kubernetes
-        scored: true
-
-      - id: 4.2.5
-        text: "Minimize the admission of containers with allowPrivilegeEscalation (Automated)"
-        audit: |
-          kubectl get pods --all-namespaces -o json | \
-            jq -r 'if any(.items[]?.spec.containers[]?; .securityContext?.allowPrivilegeEscalation == true) then "ALLOWPRIVILEGEESCALTION_FOUND" else "NO_ALLOWPRIVILEGEESCALTION" end'
-        tests:
-          test_items:
-            - flag: "NO_ALLOWPRIVILEGEESCALTION"
-              set: true
-              compare:
-                op: eq
-                value: "NO_ALLOWPRIVILEGEESCALTION"
-        remediation: |
-          Add policies to each namespace in the cluster which has user workloads to restrict the admission of containers with .spec.allowPrivilegeEscalation set to true.
-          You can label your namespaces as follows to restrict or enforce the policy:
-          kubectl label --overwrite ns NAMESPACE pod-security.kubernetes.io/enforce=restricted
-          You can also use the following to warn about policies:
-          kubectl label --overwrite ns --all pod-security.kubernetes.io/warn=baseline
-          For more information, refer to the official Kubernetes and Azure documentation on policies:
-          https://learn.microsoft.com/en-us/azure/governance/policy/concepts/policy-for-kubernetes
-        scored: true
-
-
-  - id: 4.3
-    text: "Azure Policy / OPA"
-    checks: []
-
-
-  - id: 4.4
-    text: "CNI Plugin"
-    checks:
-      - id: 4.4.1
-        text: "Ensure latest CNI version is used (Manual)"
-        type: "manual"
-        remediation: |
-          Review the documentation of AWS CNI plugin, and ensure latest CNI version is used.
-        scored: false
-
-      - id: 4.4.2
-        text: "Ensure that all Namespaces have Network Policies defined (Automated)"
-        audit: |
-          ns_without_np=$(comm -23 \
-            <(kubectl get ns -o jsonpath='{.items[*].metadata.name}' | tr ' ' '\n' | sort) \
-            <(kubectl get networkpolicy --all-namespaces -o jsonpath='{.items[*].metadata.namespace}' | tr ' ' '\n' | sort))
-          if [ -z "$ns_without_np" ]; then echo "ALL_NAMESPACES_HAVE_NETWORKPOLICIES"; else echo "MISSING_NETWORKPOLICIES"; fi
-        tests:
-          test_items:
-            - flag: "ALL_NAMESPACES_HAVE_NETWORKPOLICIES"
-              set: true
-              compare:
-                op: eq
-                value: "ALL_NAMESPACES_HAVE_NETWORKPOLICIES"
-        remediation: |
-          Define at least one NetworkPolicy in each namespace to control pod-level traffic. Example:
-
-          kubectl apply -n <namespace> -f - <<EOF
-          apiVersion: networking.k8s.io/v1
-          kind: NetworkPolicy
-          metadata:
-            name: default-deny-all
-          spec:
-            podSelector: {}
-            policyTypes:
-              - Ingress
-              - Egress
-          EOF
-
-          This denies all traffic unless explicitly allowed. Review and adjust policies per namespace as needed.
-        scored: true
-
-
-  - id: 4.5
-    text: "Secrets Management"
-    checks:
-      - id: 4.5.1
-        text: "Prefer using secrets as files over secrets as environment variables (Automated)"
-        audit: |
-          output=$(kubectl get all --all-namespaces -o jsonpath='{range .items[?(@..secretKeyRef)]} {.kind} {.metadata.name} {"\n"}{end}')
-          if [ -z "$output" ]; then echo "NO_ENV_SECRET_REFERENCES"; else echo "ENV_SECRET_REFERENCES_FOUND"; fi
-        tests:
-          test_items:
-            - flag: "NO_ENV_SECRET_REFERENCES"
-              set: true
-              compare:
-                op: eq
-                value: "NO_ENV_SECRET_REFERENCES"
-        remediation: |
-          Refactor application deployments to mount secrets as files instead of passing them as environment variables.
-          Avoid using `envFrom` or `env` with `secretKeyRef` in container specs.
-        scored: true
-
-
-      - id: 4.5.2
-        text: "Consider external secret storage (Manual)"
-        type: "manual"
-        remediation: |
-          Refer to the secrets management options offered by your cloud provider or a third-party
-          secrets management solution.
-        scored: false
-
-
-  - id: 4.6
-    text: "General Policies"
-    checks:
-      - id: 4.6.1
-        text: "Create administrative boundaries between resources using namespaces (Manual)"
-        type: "manual"
-        remediation: |
-          Follow the documentation and create namespaces for objects in your deployment as you need
-          them.
-        scored: false
-
-      - id: 4.6.2
-        text: "Apply Security Context to Your Pods and Containers (Manual)"
-        type: "manual"
-        remediation: |
-          Follow the Kubernetes documentation and apply security contexts to your pods. For a
-          suggested list of security contexts, you may refer to the CIS Security Benchmark for Docker
-          Containers.
-        scored: false
-
-      - id: 4.6.3
-        text: "The default namespace should not be used (Automated)"
-        audit: |
-          output=$(kubectl get all -n default --no-headers 2>/dev/null | grep -v '^service\s\+kubernetes\s' || true)
-          if [ -z "$output" ]; then echo "DEFAULT_NAMESPACE_UNUSED"; else echo "DEFAULT_NAMESPACE_IN_USE"; fi
-        tests:
-          test_items:
-            - flag: "DEFAULT_NAMESPACE_UNUSED"
-              set: true
-              compare:
-                op: eq
-                value: "DEFAULT_NAMESPACE_UNUSED"
-        remediation: |
-          Avoid using the default namespace for user workloads.
-          - Create separate namespaces for your applications and infrastructure components.
-          - Move any user-defined resources out of the default namespace.
-
-          Example to create a namespace:
-          kubectl create namespace my-namespace
-
-          Example to move resources:
-          kubectl get deployment my-app -n default -o yaml | sed 's/namespace: default/namespace: my-namespace/' | kubectl apply -f -
-          kubectl delete deployment my-app -n default
-        scored: true

cfg/cis-1.10/config.yaml

@@ -1,2 +0,0 @@
----
-## Version-specific settings that override the values in cfg/config.yaml

cfg/cis-1.10/controlplane.yaml

@@ -1,62 +0,0 @@
----
-controls:
-version: "cis-1.10"
-id: 3
-text: "Control Plane Configuration"
-type: "controlplane"
-groups:
-  - id: 3.1
-    text: "Authentication and Authorization"
-    checks:
-      - id: 3.1.1
-        text: "Client certificate authentication should not be used for users (Manual)"
-        type: "manual"
-        remediation: |
-          Alternative mechanisms provided by Kubernetes such as the use of OIDC should be
-          implemented in place of client certificates.
-        scored: false
-
-      - id: 3.1.2
-        text: "Service account token authentication should not be used for users (Manual)"
-        type: "manual"
-        remediation: |
-          Alternative mechanisms provided by Kubernetes such as the use of OIDC should be implemented
-          in place of service account tokens.
-        scored: false
-
-      - id: 3.1.3
-        text: "Bootstrap token authentication should not be used for users (Manual)"
-        type: "manual"
-        remediation: |
-          Alternative mechanisms provided by Kubernetes such as the use of OIDC should be implemented
-          in place of bootstrap tokens.
-        scored: false
-
-  - id: 3.2
-    text: "Logging"
-    checks:
-      - id: 3.2.1
-        text: "Ensure that a minimal audit policy is created (Manual)"
-        audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep"
-        tests:
-          test_items:
-            - flag: "--audit-policy-file"
-              set: true
-        remediation: |
-          Create an audit policy file for your cluster.
-        scored: false
-
-      - id: 3.2.2
-        text: "Ensure that the audit policy covers key security concerns (Manual)"
-        type: "manual"
-        remediation: |
-          Review the audit policy provided for the cluster and ensure that it covers
-          at least the following areas,
-          - Access to Secrets managed by the cluster. Care should be taken to only
-            log Metadata for requests to Secrets, ConfigMaps, and TokenReviews, in
-            order to avoid risk of logging sensitive data.
-          - Modification of Pod and Deployment objects.
-          - Use of `pods/exec`, `pods/portforward`, `pods/proxy` and `services/proxy`.
-          For most requests, minimally logging at the Metadata level is recommended
-          (the most basic level of logging).
-        scored: false

cfg/cis-1.10/etcd.yaml

@@ -1,135 +0,0 @@
----
-controls:
-version: "cis-1.10"
-id: 2
-text: "Etcd Node Configuration"
-type: "etcd"
-groups:
-  - id: 2
-    text: "Etcd Node Configuration"
-    checks:
-      - id: 2.1
-        text: "Ensure that the --cert-file and --key-file arguments are set as appropriate (Automated)"
-        audit: "/bin/ps -ef | /bin/grep $etcdbin | /bin/grep -v grep"
-        tests:
-          bin_op: and
-          test_items:
-            - flag: "--cert-file"
-              env: "ETCD_CERT_FILE"
-            - flag: "--key-file"
-              env: "ETCD_KEY_FILE"
-        remediation: |
-          Follow the etcd service documentation and configure TLS encryption.
-          Then, edit the etcd pod specification file /etc/kubernetes/manifests/etcd.yaml
-          on the master node and set the below parameters.
-          --cert-file=</path/to/ca-file>
-          --key-file=</path/to/key-file>
-        scored: true
-
-      - id: 2.2
-        text: "Ensure that the --client-cert-auth argument is set to true (Automated)"
-        audit: "/bin/ps -ef | /bin/grep $etcdbin | /bin/grep -v grep"
-        tests:
-          test_items:
-            - flag: "--client-cert-auth"
-              env: "ETCD_CLIENT_CERT_AUTH"
-              compare:
-                op: eq
-                value: true
-        remediation: |
-          Edit the etcd pod specification file $etcdconf on the master
-          node and set the below parameter.
-          --client-cert-auth="true"
-        scored: true
-
-      - id: 2.3
-        text: "Ensure that the --auto-tls argument is not set to true (Automated)"
-        audit: "/bin/ps -ef | /bin/grep $etcdbin | /bin/grep -v grep"
-        tests:
-          bin_op: or
-          test_items:
-            - flag: "--auto-tls"
-              env: "ETCD_AUTO_TLS"
-              set: false
-            - flag: "--auto-tls"
-              env: "ETCD_AUTO_TLS"
-              compare:
-                op: eq
-                value: false
-        remediation: |
-          Edit the etcd pod specification file $etcdconf on the master
-          node and either remove the --auto-tls parameter or set it to false.
-            --auto-tls=false
-        scored: true
-
-      - id: 2.4
-        text: "Ensure that the --peer-cert-file and --peer-key-file arguments are
-        set as appropriate (Automated)"
-        audit: "/bin/ps -ef | /bin/grep $etcdbin | /bin/grep -v grep"
-        tests:
-          bin_op: and
-          test_items:
-            - flag: "--peer-cert-file"
-              env: "ETCD_PEER_CERT_FILE"
-            - flag: "--peer-key-file"
-              env: "ETCD_PEER_KEY_FILE"
-        remediation: |
-          Follow the etcd service documentation and configure peer TLS encryption as appropriate
-          for your etcd cluster.
-          Then, edit the etcd pod specification file $etcdconf on the
-          master node and set the below parameters.
-          --peer-client-file=</path/to/peer-cert-file>
-          --peer-key-file=</path/to/peer-key-file>
-        scored: true
-
-      - id: 2.5
-        text: "Ensure that the --peer-client-cert-auth argument is set to true (Automated)"
-        audit: "/bin/ps -ef | /bin/grep $etcdbin | /bin/grep -v grep"
-        tests:
-          test_items:
-            - flag: "--peer-client-cert-auth"
-              env: "ETCD_PEER_CLIENT_CERT_AUTH"
-              compare:
-                op: eq
-                value: true
-        remediation: |
-          Edit the etcd pod specification file $etcdconf on the master
-          node and set the below parameter.
-          --peer-client-cert-auth=true
-        scored: true
-
-      - id: 2.6
-        text: "Ensure that the --peer-auto-tls argument is not set to true (Automated)"
-        audit: "/bin/ps -ef | /bin/grep $etcdbin | /bin/grep -v grep"
-        tests:
-          bin_op: or
-          test_items:
-            - flag: "--peer-auto-tls"
-              env: "ETCD_PEER_AUTO_TLS"
-              set: false
-            - flag: "--peer-auto-tls"
-              env: "ETCD_PEER_AUTO_TLS"
-              compare:
-                op: eq
-                value: false
-        remediation: |
-          Edit the etcd pod specification file $etcdconf on the master
-          node and either remove the --peer-auto-tls parameter or set it to false.
-          --peer-auto-tls=false
-        scored: true
-
-      - id: 2.7
-        text: "Ensure that a unique Certificate Authority is used for etcd (Manual)"
-        audit: "/bin/ps -ef | /bin/grep $etcdbin | /bin/grep -v grep"
-        tests:
-          test_items:
-            - flag: "--trusted-ca-file"
-              env: "ETCD_TRUSTED_CA_FILE"
-        remediation: |
-          [Manual test]
-          Follow the etcd documentation and create a dedicated certificate authority setup for the
-          etcd service.
-          Then, edit the etcd pod specification file $etcdconf on the
-          master node and set the below parameter.
-          --trusted-ca-file=</path/to/ca-file>
-        scored: false

cfg/cis-1.10/master.yaml

@@ -1,917 +0,0 @@
----
-controls:
-version: "cis-1.10"
-id: 1
-text: "Control Plane Security Configuration"
-type: "master"
-groups:
-  - id: 1.1
-    text: "Control Plane Node Configuration Files"
-    checks:
-      - id: 1.1.1
-        text: "Ensure that the API server pod specification file permissions are set to 600 or more restrictive (Automated)"
-        audit: "/bin/sh -c 'if test -e $apiserverconf; then stat -c permissions=%a $apiserverconf; fi'"
-        tests:
-          test_items:
-            - flag: "permissions"
-              compare:
-                op: bitmask
-                value: "600"
-        remediation: |
-          Run the below command (based on the file location on your system) on the
-          control plane node.
-          For example, chmod 600 $apiserverconf
-        scored: true
-
-      - id: 1.1.2
-        text: "Ensure that the API server pod specification file ownership is set to root:root (Automated)"
-        audit: "/bin/sh -c 'if test -e $apiserverconf; then stat -c %U:%G $apiserverconf; fi'"
-        tests:
-          test_items:
-            - flag: "root:root"
-        remediation: |
-          Run the below command (based on the file location on your system) on the control plane node.
-          For example, chown root:root $apiserverconf
-        scored: true
-
-      - id: 1.1.3
-        text: "Ensure that the controller manager pod specification file permissions are set to 600 or more restrictive (Automated)"
-        audit: "/bin/sh -c 'if test -e $controllermanagerconf; then stat -c permissions=%a $controllermanagerconf; fi'"
-        tests:
-          test_items:
-            - flag: "permissions"
-              compare:
-                op: bitmask
-                value: "600"
-        remediation: |
-          Run the below command (based on the file location on your system) on the control plane node.
-          For example, chmod 600 $controllermanagerconf
-        scored: true
-
-      - id: 1.1.4
-        text: "Ensure that the controller manager pod specification file ownership is set to root:root (Automated)"
-        audit: "/bin/sh -c 'if test -e $controllermanagerconf; then stat -c %U:%G $controllermanagerconf; fi'"
-        tests:
-          test_items:
-            - flag: "root:root"
-        remediation: |
-          Run the below command (based on the file location on your system) on the control plane node.
-          For example, chown root:root $controllermanagerconf
-        scored: true
-
-      - id: 1.1.5
-        text: "Ensure that the scheduler pod specification file permissions are set to 600 or more restrictive (Automated)"
-        audit: "/bin/sh -c 'if test -e $schedulerconf; then stat -c permissions=%a $schedulerconf; fi'"
-        tests:
-          test_items:
-            - flag: "permissions"
-              compare:
-                op: bitmask
-                value: "600"
-        remediation: |
-          Run the below command (based on the file location on your system) on the control plane node.
-          For example, chmod 600 $schedulerconf
-        scored: true
-
-      - id: 1.1.6
-        text: "Ensure that the scheduler pod specification file ownership is set to root:root (Automated)"
-        audit: "/bin/sh -c 'if test -e $schedulerconf; then stat -c %U:%G $schedulerconf; fi'"
-        tests:
-          test_items:
-            - flag: "root:root"
-        remediation: |
-          Run the below command (based on the file location on your system) on the control plane node.
-          For example, chown root:root $schedulerconf
-        scored: true
-
-      - id: 1.1.7
-        text: "Ensure that the etcd pod specification file permissions are set to 600 or more restrictive (Automated)"
-        audit: "/bin/sh -c 'if test -e $etcdconf; then find $etcdconf -name '*etcd*' | xargs stat -c permissions=%a; fi'"
-        use_multiple_values: true
-        tests:
-          test_items:
-            - flag: "permissions"
-              compare:
-                op: bitmask
-                value: "600"
-        remediation: |
-          Run the below command (based on the file location on your system) on the control plane node.
-          For example,
-          chmod 600 $etcdconf
-        scored: true
-
-      - id: 1.1.8
-        text: "Ensure that the etcd pod specification file ownership is set to root:root (Automated)"
-        audit: "/bin/sh -c 'if test -e $etcdconf; then find $etcdconf -name '*etcd*' | xargs stat -c %U:%G; fi'"
-        use_multiple_values: true
-        tests:
-          test_items:
-            - flag: "root:root"
-        remediation: |
-          Run the below command (based on the file location on your system) on the control plane node.
-          For example,
-          chown root:root $etcdconf
-        scored: true
-
-      - id: 1.1.9
-        text: "Ensure that the Container Network Interface file permissions are set to 600 or more restrictive (Manual)"
-        audit: |
-          ps -ef | grep $kubeletbin | grep -- --cni-conf-dir | sed 's%.*cni-conf-dir[= ]\([^ ]*\).*%\1%' | xargs -I{} find {} -mindepth 1 | xargs --no-run-if-empty stat -c permissions=%a
-          find /var/lib/cni/networks -type f 2> /dev/null | xargs --no-run-if-empty stat -c permissions=%a
-        use_multiple_values: true
-        tests:
-          test_items:
-            - flag: "permissions"
-              compare:
-                op: bitmask
-                value: "600"
-        remediation: |
-          Run the below command (based on the file location on your system) on the control plane node.
-          For example, chmod 600 <path/to/cni/files>
-        scored: false
-
-      - id: 1.1.10
-        text: "Ensure that the Container Network Interface file ownership is set to root:root (Manual)"
-        audit: |
-          ps -ef | grep $kubeletbin | grep -- --cni-conf-dir | sed 's%.*cni-conf-dir[= ]\([^ ]*\).*%\1%' | xargs -I{} find {} -mindepth 1 | xargs --no-run-if-empty stat -c %U:%G
-          find /var/lib/cni/networks -type f 2> /dev/null | xargs --no-run-if-empty stat -c %U:%G
-        use_multiple_values: true
-        tests:
-          test_items:
-            - flag: "root:root"
-        remediation: |
-          Run the below command (based on the file location on your system) on the control plane node.
-          For example,
-          chown root:root <path/to/cni/files>
-        scored: false
-
-      - id: 1.1.11
-        text: "Ensure that the etcd data directory permissions are set to 700 or more restrictive (Automated)"
-        audit: |
-          DATA_DIR=''
-          for d in $(ps -ef | grep $etcdbin | grep -- --data-dir | sed 's%.*data-dir[= ]\([^ ]*\).*%\1%'); do
-            if test -d "$d"; then DATA_DIR="$d"; fi
-          done
-          if ! test -d "$DATA_DIR"; then DATA_DIR=$etcddatadir; fi
-          stat -c permissions=%a "$DATA_DIR"
-        tests:
-          test_items:
-            - flag: "permissions"
-              compare:
-                op: bitmask
-                value: "700"
-        remediation: |
-          On the etcd server node, get the etcd data directory, passed as an argument --data-dir,
-          from the command 'ps -ef | grep etcd'.
-          Run the below command (based on the etcd data directory found above). For example,
-          chmod 700 /var/lib/etcd
-        scored: true
-
-      - id: 1.1.12
-        text: "Ensure that the etcd data directory ownership is set to etcd:etcd (Automated)"
-        audit: |
-          DATA_DIR=''
-          for d in $(ps -ef | grep $etcdbin | grep -- --data-dir | sed 's%.*data-dir[= ]\([^ ]*\).*%\1%'); do
-            if test -d "$d"; then DATA_DIR="$d"; fi
-          done
-          if ! test -d "$DATA_DIR"; then DATA_DIR=$etcddatadir; fi
-          stat -c %U:%G "$DATA_DIR"
-        tests:
-          test_items:
-            - flag: "etcd:etcd"
-        remediation: |
-          On the etcd server node, get the etcd data directory, passed as an argument --data-dir,
-          from the command 'ps -ef | grep etcd'.
-          Run the below command (based on the etcd data directory found above).
-          For example, chown etcd:etcd /var/lib/etcd
-        scored: true
-
-      - id: 1.1.13
-        text: "Ensure that the default administrative credential file permissions are set to 600 (Automated)"
-        audit: |
-         for adminconf in /etc/kubernetes/admin.conf /etc/kubernetes/super-admin.conf; do if test -e $adminconf; then stat -c "permissions=%a %n" $adminconf; fi; done
-        use_multiple_values: true
-        tests:
-          test_items:
-            - flag: "permissions"
-              compare:
-                op: bitmask
-                value: "600"
-        remediation: |
-          Run the below command (based on the file location on your system) on the control plane node.
-          For example, chmod 600 /etc/kubernetes/admin.conf
-          On Kubernetes 1.29+ the super-admin.conf file should also be modified, if present.
-          For example, chmod 600 /etc/kubernetes/super-admin.conf
-        scored: true
-
-      - id: 1.1.14
-        text: "Ensure that the default administrative credential file ownership is set to root:root (Automated)"
-        audit: |
-         for adminconf in /etc/kubernetes/admin.conf /etc/kubernetes/super-admin.conf; do if test -e $adminconf; then stat -c "ownership=%U:%G %n" $adminconf; fi; done
-        use_multiple_values: true
-        tests:
-          test_items:
-            - flag: "ownership"
-              compare:
-                op: eq
-                value: "root:root"
-        remediation: |
-          Run the below command (based on the file location on your system) on the control plane node.
-          For example, chown root:root /etc/kubernetes/admin.conf
-          On Kubernetes 1.29+ the super-admin.conf file should also be modified, if present.
-          For example, chown root:root /etc/kubernetes/super-admin.conf
-        scored: true
-
-      - id: 1.1.15
-        text: "Ensure that the scheduler.conf file permissions are set to 600 or more restrictive (Automated)"
-        audit: "/bin/sh -c 'if test -e $schedulerkubeconfig; then stat -c permissions=%a $schedulerkubeconfig; fi'"
-        tests:
-          test_items:
-            - flag: "permissions"
-              compare:
-                op: bitmask
-                value: "600"
-        remediation: |
-          Run the below command (based on the file location on your system) on the control plane node.
-          For example,
-          chmod 600 $schedulerkubeconfig
-        scored: true
-
-      - id: 1.1.16
-        text: "Ensure that the scheduler.conf file ownership is set to root:root (Automated)"
-        audit: "/bin/sh -c 'if test -e $schedulerkubeconfig; then stat -c %U:%G $schedulerkubeconfig; fi'"
-        tests:
-          test_items:
-            - flag: "root:root"
-        remediation: |
-          Run the below command (based on the file location on your system) on the control plane node.
-          For example,
-          chown root:root $schedulerkubeconfig
-        scored: true
-
-      - id: 1.1.17
-        text: "Ensure that the controller-manager.conf file permissions are set to 600 or more restrictive (Automated)"
-        audit: "/bin/sh -c 'if test -e $controllermanagerkubeconfig; then stat -c permissions=%a $controllermanagerkubeconfig; fi'"
-        tests:
-          test_items:
-            - flag: "permissions"
-              compare:
-                op: bitmask
-                value: "600"
-        remediation: |
-          Run the below command (based on the file location on your system) on the control plane node.
-          For example,
-          chmod 600 $controllermanagerkubeconfig
-        scored: true
-
-      - id: 1.1.18
-        text: "Ensure that the controller-manager.conf file ownership is set to root:root (Automated)"
-        audit: "/bin/sh -c 'if test -e $controllermanagerkubeconfig; then stat -c %U:%G $controllermanagerkubeconfig; fi'"
-        tests:
-          test_items:
-            - flag: "root:root"
-        remediation: |
-          Run the below command (based on the file location on your system) on the control plane node.
-          For example,
-          chown root:root $controllermanagerkubeconfig
-        scored: true
-
-      - id: 1.1.19
-        text: "Ensure that the Kubernetes PKI directory and file ownership is set to root:root (Automated)"
-        audit: "find /etc/kubernetes/pki/ | xargs stat -c %U:%G"
-        use_multiple_values: true
-        tests:
-          test_items:
-            - flag: "root:root"
-        remediation: |
-          Run the below command (based on the file location on your system) on the control plane node.
-          For example,
-          chown -R root:root /etc/kubernetes/pki/
-        scored: true
-
-      - id: 1.1.20
-        text: "Ensure that the Kubernetes PKI certificate file permissions are set to 600 or more restrictive (Manual)"
-        audit: "find /etc/kubernetes/pki/ -name '*.crt' | xargs stat -c permissions=%a"
-        use_multiple_values: true
-        tests:
-          test_items:
-            - flag: "permissions"
-              compare:
-                op: bitmask
-                value: "600"
-        remediation: |
-          Run the below command (based on the file location on your system) on the control plane node.
-          For example,
-          chmod -R 600 /etc/kubernetes/pki/*.crt
-        scored: false
-
-      - id: 1.1.21
-        text: "Ensure that the Kubernetes PKI key file permissions are set to 600 (Manual)"
-        audit: "find /etc/kubernetes/pki/ -name '*.key' | xargs stat -c permissions=%a"
-        use_multiple_values: true
-        tests:
-          test_items:
-            - flag: "permissions"
-              compare:
-                op: bitmask
-                value: "600"
-        remediation: |
-          Run the below command (based on the file location on your system) on the control plane node.
-          For example,
-          chmod -R 600 /etc/kubernetes/pki/*.key
-        scored: false
-
-  - id: 1.2
-    text: "API Server"
-    checks:
-      - id: 1.2.1
-        text: "Ensure that the --anonymous-auth argument is set to false (Manual)"
-        audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep"
-        tests:
-          test_items:
-            - flag: "--anonymous-auth"
-              compare:
-                op: eq
-                value: false
-        remediation: |
-          Edit the API server pod specification file $apiserverconf
-          on the control plane node and set the below parameter.
-          --anonymous-auth=false
-        scored: false
-
-      - id: 1.2.2
-        text: "Ensure that the --token-auth-file parameter is not set (Automated)"
-        audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep"
-        tests:
-          test_items:
-            - flag: "--token-auth-file"
-              set: false
-        remediation: |
-          Follow the documentation and configure alternate mechanisms for authentication. Then,
-          edit the API server pod specification file $apiserverconf
-          on the control plane node and remove the --token-auth-file=<filename> parameter.
-        scored: true
-
-      - id: 1.2.3
-        text: "Ensure that the --DenyServiceExternalIPs is set (Manual)"
-        audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep"
-        tests:
-          bin_op: or
-          test_items:
-            - flag: "--enable-admission-plugins"
-              compare:
-                op: has
-                value: "DenyServiceExternalIPs"
-        remediation: |
-          Edit the API server pod specification file $apiserverconf
-          on the control plane node and add the `DenyServiceExternalIPs` plugin
-          to the enabled admission plugins, as such --enable-admission-plugin=DenyServiceExternalIPs.
-        scored: false
-
-      - id: 1.2.4
-        text: "Ensure that the --kubelet-client-certificate and --kubelet-client-key arguments are set as appropriate (Automated)"
-        audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep"
-        tests:
-          bin_op: and
-          test_items:
-            - flag: "--kubelet-client-certificate"
-            - flag: "--kubelet-client-key"
-        remediation: |
-          Follow the Kubernetes documentation and set up the TLS connection between the
-          apiserver and kubelets. Then, edit API server pod specification file
-          $apiserverconf on the control plane node and set the
-          kubelet client certificate and key parameters as below.
-          --kubelet-client-certificate=<path/to/client-certificate-file>
-          --kubelet-client-key=<path/to/client-key-file>
-        scored: true
-
-      - id: 1.2.5
-        text: "Ensure that the --kubelet-certificate-authority argument is set as appropriate (Automated)"
-        audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep"
-        tests:
-          test_items:
-            - flag: "--kubelet-certificate-authority"
-        remediation: |
-          Follow the Kubernetes documentation and setup the TLS connection between
-          the apiserver and kubelets. Then, edit the API server pod specification file
-          $apiserverconf on the control plane node and set the
-          --kubelet-certificate-authority parameter to the path to the cert file for the certificate authority.
-          --kubelet-certificate-authority=<ca-string>
-        scored: true
-
-      - id: 1.2.6
-        text: "Ensure that the --authorization-mode argument is not set to AlwaysAllow (Automated)"
-        audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep"
-        tests:
-          test_items:
-            - flag: "--authorization-mode"
-              compare:
-                op: nothave
-                value: "AlwaysAllow"
-        remediation: |
-          Edit the API server pod specification file $apiserverconf
-          on the control plane node and set the --authorization-mode parameter to values other than AlwaysAllow.
-          One such example could be as below.
-          --authorization-mode=RBAC
-        scored: true
-
-      - id: 1.2.7
-        text: "Ensure that the --authorization-mode argument includes Node (Automated)"
-        audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep"
-        tests:
-          test_items:
-            - flag: "--authorization-mode"
-              compare:
-                op: has
-                value: "Node"
-        remediation: |
-          Edit the API server pod specification file $apiserverconf
-          on the control plane node and set the --authorization-mode parameter to a value that includes Node.
-          --authorization-mode=Node,RBAC
-        scored: true
-
-      - id: 1.2.8
-        text: "Ensure that the --authorization-mode argument includes RBAC (Automated)"
-        audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep"
-        tests:
-          test_items:
-            - flag: "--authorization-mode"
-              compare:
-                op: has
-                value: "RBAC"
-        remediation: |
-          Edit the API server pod specification file $apiserverconf
-          on the control plane node and set the --authorization-mode parameter to a value that includes RBAC,
-          for example `--authorization-mode=Node,RBAC`.
-        scored: true
-
-      - id: 1.2.9
-        text: "Ensure that the admission control plugin EventRateLimit is set (Manual)"
-        audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep"
-        tests:
-          test_items:
-            - flag: "--enable-admission-plugins"
-              compare:
-                op: has
-                value: "EventRateLimit"
-        remediation: |
-          Follow the Kubernetes documentation and set the desired limits in a configuration file.
-          Then, edit the API server pod specification file $apiserverconf
-          and set the below parameters.
-          --enable-admission-plugins=...,EventRateLimit,...
-          --admission-control-config-file=<path/to/configuration/file>
-        scored: false
-
-      - id: 1.2.10
-        text: "Ensure that the admission control plugin AlwaysAdmit is not set (Automated)"
-        audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep"
-        tests:
-          bin_op: or
-          test_items:
-            - flag: "--enable-admission-plugins"
-              compare:
-                op: nothave
-                value: AlwaysAdmit
-            - flag: "--enable-admission-plugins"
-              set: false
-        remediation: |
-          Edit the API server pod specification file $apiserverconf
-          on the control plane node and either remove the --enable-admission-plugins parameter, or set it to a
-          value that does not include AlwaysAdmit.
-        scored: true
-
-      - id: 1.2.11
-        text: "Ensure that the admission control plugin AlwaysPullImages is set (Manual)"
-        audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep"
-        tests:
-          test_items:
-            - flag: "--enable-admission-plugins"
-              compare:
-                op: has
-                value: "AlwaysPullImages"
-        remediation: |
-          Edit the API server pod specification file $apiserverconf
-          on the control plane node and set the --enable-admission-plugins parameter to include
-          AlwaysPullImages.
-          --enable-admission-plugins=...,AlwaysPullImages,...
-        scored: false
-
-      - id: 1.2.12
-        text: "Ensure that the admission control plugin ServiceAccount is set (Automated)"
-        audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep"
-        tests:
-          bin_op: or
-          test_items:
-            - flag: "--disable-admission-plugins"
-              compare:
-                op: nothave
-                value: "ServiceAccount"
-            - flag: "--disable-admission-plugins"
-              set: false
-        remediation: |
-          Follow the documentation and create ServiceAccount objects as per your environment.
-          Then, edit the API server pod specification file $apiserverconf
-          on the control plane node and ensure that the --disable-admission-plugins parameter is set to a
-          value that does not include ServiceAccount.
-        scored: true
-
-      - id: 1.2.13
-        text: "Ensure that the admission control plugin NamespaceLifecycle is set (Automated)"
-        audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep"
-        tests:
-          bin_op: or
-          test_items:
-            - flag: "--disable-admission-plugins"
-              compare:
-                op: nothave
-                value: "NamespaceLifecycle"
-            - flag: "--disable-admission-plugins"
-              set: false
-        remediation: |
-          Edit the API server pod specification file $apiserverconf
-          on the control plane node and set the --disable-admission-plugins parameter to
-          ensure it does not include NamespaceLifecycle.
-        scored: true
-
-      - id: 1.2.14
-        text: "Ensure that the admission control plugin NodeRestriction is set (Automated)"
-        audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep"
-        tests:
-          test_items:
-            - flag: "--enable-admission-plugins"
-              compare:
-                op: has
-                value: "NodeRestriction"
-        remediation: |
-          Follow the Kubernetes documentation and configure NodeRestriction plug-in on kubelets.
-          Then, edit the API server pod specification file $apiserverconf
-          on the control plane node and set the --enable-admission-plugins parameter to a
-          value that includes NodeRestriction.
-          --enable-admission-plugins=...,NodeRestriction,...
-        scored: true
-
-      - id: 1.2.15
-        text: "Ensure that the --profiling argument is set to false (Automated)"
-        audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep"
-        tests:
-          test_items:
-            - flag: "--profiling"
-              compare:
-                op: eq
-                value: false
-        remediation: |
-          Edit the API server pod specification file $apiserverconf
-          on the control plane node and set the below parameter.
-          --profiling=false
-        scored: true
-
-      - id: 1.2.16
-        text: "Ensure that the --audit-log-path argument is set (Automated)"
-        audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep"
-        tests:
-          test_items:
-            - flag: "--audit-log-path"
-        remediation: |
-          Edit the API server pod specification file $apiserverconf
-          on the control plane node and set the --audit-log-path parameter to a suitable path and
-          file where you would like audit logs to be written, for example,
-          --audit-log-path=/var/log/apiserver/audit.log
-        scored: true
-
-      - id: 1.2.17
-        text: "Ensure that the --audit-log-maxage argument is set to 30 or as appropriate (Automated)"
-        audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep"
-        tests:
-          test_items:
-            - flag: "--audit-log-maxage"
-              compare:
-                op: gte
-                value: 30
-        remediation: |
-          Edit the API server pod specification file $apiserverconf
-          on the control plane node and set the --audit-log-maxage parameter to 30
-          or as an appropriate number of days, for example,
-          --audit-log-maxage=30
-        scored: true
-
-      - id: 1.2.18
-        text: "Ensure that the --audit-log-maxbackup argument is set to 10 or as appropriate (Automated)"
-        audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep"
-        tests:
-          test_items:
-            - flag: "--audit-log-maxbackup"
-              compare:
-                op: gte
-                value: 10
-        remediation: |
-          Edit the API server pod specification file $apiserverconf
-          on the control plane node and set the --audit-log-maxbackup parameter to 10 or to an appropriate
-          value. For example,
-          --audit-log-maxbackup=10
-        scored: true
-
-      - id: 1.2.19
-        text: "Ensure that the --audit-log-maxsize argument is set to 100 or as appropriate (Automated)"
-        audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep"
-        tests:
-          test_items:
-            - flag: "--audit-log-maxsize"
-              compare:
-                op: gte
-                value: 100
-        remediation: |
-          Edit the API server pod specification file $apiserverconf
-          on the control plane node and set the --audit-log-maxsize parameter to an appropriate size in MB.
-          For example, to set it as 100 MB, --audit-log-maxsize=100
-        scored: true
-
-      - id: 1.2.20
-        text: "Ensure that the --request-timeout argument is set as appropriate (Manual)"
-        audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep"
-        type: manual
-        remediation: |
-          Edit the API server pod specification file $apiserverconf
-          and set the below parameter as appropriate and if needed.
-          For example, --request-timeout=300s
-        scored: false
-
-      - id: 1.2.21
-        text: "Ensure that the --service-account-lookup argument is set to true (Automated)"
-        audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep"
-        tests:
-          bin_op: or
-          test_items:
-            - flag: "--service-account-lookup"
-              set: false
-            - flag: "--service-account-lookup"
-              compare:
-                op: eq
-                value: true
-        remediation: |
-          Edit the API server pod specification file $apiserverconf
-          on the control plane node and set the below parameter.
-          --service-account-lookup=true
-          Alternatively, you can delete the --service-account-lookup parameter from this file so
-          that the default takes effect.
-        scored: true
-
-      - id: 1.2.22
-        text: "Ensure that the --service-account-key-file argument is set as appropriate (Automated)"
-        audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep"
-        tests:
-          test_items:
-            - flag: "--service-account-key-file"
-        remediation: |
-          Edit the API server pod specification file $apiserverconf
-          on the control plane node and set the --service-account-key-file parameter
-          to the public key file for service accounts. For example,
-          --service-account-key-file=<filename>
-        scored: true
-
-      - id: 1.2.23
-        text: "Ensure that the --etcd-certfile and --etcd-keyfile arguments are set as appropriate (Automated)"
-        audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep"
-        tests:
-          bin_op: and
-          test_items:
-            - flag: "--etcd-certfile"
-            - flag: "--etcd-keyfile"
-        remediation: |
-          Follow the Kubernetes documentation and set up the TLS connection between the apiserver and etcd.
-          Then, edit the API server pod specification file $apiserverconf
-          on the control plane node and set the etcd certificate and key file parameters.
-          --etcd-certfile=<path/to/client-certificate-file>
-          --etcd-keyfile=<path/to/client-key-file>
-        scored: true
-
-      - id: 1.2.24
-        text: "Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate (Automated)"
-        audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep"
-        tests:
-          bin_op: and
-          test_items:
-            - flag: "--tls-cert-file"
-            - flag: "--tls-private-key-file"
-        remediation: |
-          Follow the Kubernetes documentation and set up the TLS connection on the apiserver.
-          Then, edit the API server pod specification file $apiserverconf
-          on the control plane node and set the TLS certificate and private key file parameters.
-          --tls-cert-file=<path/to/tls-certificate-file>
-          --tls-private-key-file=<path/to/tls-key-file>
-        scored: true
-
-      - id: 1.2.25
-        text: "Ensure that the --client-ca-file argument is set as appropriate (Automated)"
-        audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep"
-        tests:
-          test_items:
-            - flag: "--client-ca-file"
-        remediation: |
-          Follow the Kubernetes documentation and set up the TLS connection on the apiserver.
-          Then, edit the API server pod specification file $apiserverconf
-          on the control plane node and set the client certificate authority file.
-          --client-ca-file=<path/to/client-ca-file>
-        scored: true
-
-      - id: 1.2.26
-        text: "Ensure that the --etcd-cafile argument is set as appropriate (Automated)"
-        audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep"
-        tests:
-          test_items:
-            - flag: "--etcd-cafile"
-        remediation: |
-          Follow the Kubernetes documentation and set up the TLS connection between the apiserver and etcd.
-          Then, edit the API server pod specification file $apiserverconf
-          on the control plane node and set the etcd certificate authority file parameter.
-          --etcd-cafile=<path/to/ca-file>
-        scored: true
-
-      - id: 1.2.27
-        text: "Ensure that the --encryption-provider-config argument is set as appropriate (Manual)"
-        audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep"
-        tests:
-          test_items:
-            - flag: "--encryption-provider-config"
-        remediation: |
-          Follow the Kubernetes documentation and configure a EncryptionConfig file.
-          Then, edit the API server pod specification file $apiserverconf
-          on the control plane node and set the --encryption-provider-config parameter to the path of that file.
-          For example, --encryption-provider-config=</path/to/EncryptionConfig/File>
-        scored: false
-
-      - id: 1.2.28
-        text: "Ensure that encryption providers are appropriately configured (Manual)"
-        audit: |
-          ENCRYPTION_PROVIDER_CONFIG=$(ps -ef | grep $apiserverbin | grep -- --encryption-provider-config | sed 's%.*encryption-provider-config[= ]\([^ ]*\).*%\1%')
-          if test -e $ENCRYPTION_PROVIDER_CONFIG; then grep -A1 'providers:' $ENCRYPTION_PROVIDER_CONFIG | tail -n1 | grep -o "[A-Za-z]*" | sed 's/^/provider=/'; fi
-        tests:
-          test_items:
-            - flag: "provider"
-              compare:
-                op: valid_elements
-                value: "aescbc,kms,secretbox"
-        remediation: |
-          Follow the Kubernetes documentation and configure a EncryptionConfig file.
-          In this file, choose aescbc, kms or secretbox as the encryption provider.
-        scored: false
-
-      - id: 1.2.29
-        text: "Ensure that the API Server only makes use of Strong Cryptographic Ciphers (Manual)"
-        audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep"
-        tests:
-          test_items:
-            - flag: "--tls-cipher-suites"
-              compare:
-                op: valid_elements
-                value: "TLS_AES_128_GCM_SHA256,TLS_AES_256_GCM_SHA384,TLS_CHACHA20_POLY1305_SHA256,TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256"
-        remediation: |
-          Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml
-          on the control plane node and set the below parameter.
-          --tls-cipher-suites=TLS_AES_128_GCM_SHA256,TLS_AES_256_GCM_SHA384,TLS_CHACHA20_POLY1305_SHA256,
-          TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
-          TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
-          TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256,
-          TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,
-          TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256
-        scored: false
-
-  - id: 1.3
-    text: "Controller Manager"
-    checks:
-      - id: 1.3.1
-        text: "Ensure that the --terminated-pod-gc-threshold argument is set as appropriate (Manual)"
-        audit: "/bin/ps -ef | grep $controllermanagerbin | grep -v grep"
-        tests:
-          test_items:
-            - flag: "--terminated-pod-gc-threshold"
-        remediation: |
-          Edit the Controller Manager pod specification file $controllermanagerconf
-          on the control plane node and set the --terminated-pod-gc-threshold to an appropriate threshold,
-          for example, --terminated-pod-gc-threshold=10
-        scored: false
-
-      - id: 1.3.2
-        text: "Ensure that the --profiling argument is set to false (Automated)"
-        audit: "/bin/ps -ef | grep $controllermanagerbin | grep -v grep"
-        tests:
-          test_items:
-            - flag: "--profiling"
-              compare:
-                op: eq
-                value: false
-        remediation: |
-          Edit the Controller Manager pod specification file $controllermanagerconf
-          on the control plane node and set the below parameter.
-          --profiling=false
-        scored: true
-
-      - id: 1.3.3
-        text: "Ensure that the --use-service-account-credentials argument is set to true (Automated)"
-        audit: "/bin/ps -ef | grep $controllermanagerbin | grep -v grep"
-        tests:
-          test_items:
-            - flag: "--use-service-account-credentials"
-              compare:
-                op: noteq
-                value: false
-        remediation: |
-          Edit the Controller Manager pod specification file $controllermanagerconf
-          on the control plane node to set the below parameter.
-          --use-service-account-credentials=true
-        scored: true
-
-      - id: 1.3.4
-        text: "Ensure that the --service-account-private-key-file argument is set as appropriate (Automated)"
-        audit: "/bin/ps -ef | grep $controllermanagerbin | grep -v grep"
-        tests:
-          test_items:
-            - flag: "--service-account-private-key-file"
-        remediation: |
-          Edit the Controller Manager pod specification file $controllermanagerconf
-          on the control plane node and set the --service-account-private-key-file parameter
-          to the private key file for service accounts.
-          --service-account-private-key-file=<filename>
-        scored: true
-
-      - id: 1.3.5
-        text: "Ensure that the --root-ca-file argument is set as appropriate (Automated)"
-        audit: "/bin/ps -ef | grep $controllermanagerbin | grep -v grep"
-        tests:
-          test_items:
-            - flag: "--root-ca-file"
-        remediation: |
-          Edit the Controller Manager pod specification file $controllermanagerconf
-          on the control plane node and set the --root-ca-file parameter to the certificate bundle file`.
-          --root-ca-file=<path/to/file>
-        scored: true
-
-      - id: 1.3.6
-        text: "Ensure that the RotateKubeletServerCertificate argument is set to true (Automated)"
-        audit: "/bin/ps -ef | grep $controllermanagerbin | grep -v grep"
-        tests:
-          bin_op: or
-          test_items:
-            - flag: "--feature-gates"
-              compare:
-                op: nothave
-                value: "RotateKubeletServerCertificate=false"
-              set: true
-            - flag: "--feature-gates"
-              set: false
-        remediation: |
-          Edit the Controller Manager pod specification file $controllermanagerconf
-          on the control plane node and set the --feature-gates parameter to include RotateKubeletServerCertificate=true.
-          --feature-gates=RotateKubeletServerCertificate=true
-        scored: true
-
-      - id: 1.3.7
-        text: "Ensure that the --bind-address argument is set to 127.0.0.1 (Automated)"
-        audit: "/bin/ps -ef | grep $controllermanagerbin | grep -v grep"
-        tests:
-          bin_op: or
-          test_items:
-            - flag: "--bind-address"
-              compare:
-                op: eq
-                value: "127.0.0.1"
-            - flag: "--bind-address"
-              set: false
-        remediation: |
-          Edit the Controller Manager pod specification file $controllermanagerconf
-          on the control plane node and ensure the correct value for the --bind-address parameter
-        scored: true
-
-  - id: 1.4
-    text: "Scheduler"
-    checks:
-      - id: 1.4.1
-        text: "Ensure that the --profiling argument is set to false (Automated)"
-        audit: "/bin/ps -ef | grep $schedulerbin | grep -v grep"
-        tests:
-          test_items:
-            - flag: "--profiling"
-              compare:
-                op: eq
-                value: false
-        remediation: |
-          Edit the Scheduler pod specification file $schedulerconf file
-          on the control plane node and set the below parameter.
-          --profiling=false
-        scored: true
-
-      - id: 1.4.2
-        text: "Ensure that the --bind-address argument is set to 127.0.0.1 (Automated)"
-        audit: "/bin/ps -ef | grep $schedulerbin | grep -v grep"
-        tests:
-          bin_op: or
-          test_items:
-            - flag: "--bind-address"
-              compare:
-                op: eq
-                value: "127.0.0.1"
-            - flag: "--bind-address"
-              set: false
-        remediation: |
-          Edit the Scheduler pod specification file $schedulerconf
-          on the control plane node and ensure the correct value for the --bind-address parameter
-        scored: true

cfg/cis-1.10/node.yaml

@@ -1,478 +0,0 @@
----
-controls:
-version: "cis-1.10"
-id: 4
-text: "Worker Node Security Configuration"
-type: "node"
-groups:
-  - id: 4.1
-    text: "Worker Node Configuration Files"
-    checks:
-      - id: 4.1.1
-        text: "Ensure that the kubelet service file permissions are set to 600 or more restrictive (Automated)"
-        audit: '/bin/sh -c ''if test -e $kubeletsvc; then stat -c permissions=%a $kubeletsvc; fi'' '
-        tests:
-          test_items:
-            - flag: "permissions"
-              compare:
-                op: bitmask
-                value: "600"
-        remediation: |
-          Run the below command (based on the file location on your system) on the each worker node.
-          For example, chmod 600 $kubeletsvc
-        scored: true
-
-      - id: 4.1.2
-        text: "Ensure that the kubelet service file ownership is set to root:root (Automated)"
-        audit: '/bin/sh -c "if test -e $kubeletsvc; then stat -c %U:%G $kubeletsvc; else echo \"File not found\"; fi"'
-        tests:
-          bin_op: or
-          test_items:
-            - flag: root:root
-            - flag: "File not found"
-        remediation: |
-            Run the below command (based on the file location on your system) on the each worker node.
-            For example,
-            chown root:root $kubeletsvc
-        scored: true
-
-      - id: 4.1.3
-        text: "If proxy kubeconfig file exists ensure permissions are set to 600 or more restrictive (Manual)"
-        audit: '/bin/sh -c ''if test -e $proxykubeconfig; then stat -c permissions=%a $proxykubeconfig; fi'' '
-        tests:
-          bin_op: or
-          test_items:
-            - flag: "permissions"
-              set: true
-              compare:
-                op: bitmask
-                value: "600"
-        remediation: |
-          Run the below command (based on the file location on your system) on the each worker node.
-          For example,
-          chmod 600 $proxykubeconfig
-        scored: false
-
-      - id: 4.1.4
-        text: "If proxy kubeconfig file exists ensure ownership is set to root:root (Manual)"
-        audit: '/bin/sh -c ''if test -e $proxykubeconfig; then stat -c %U:%G $proxykubeconfig; fi'' '
-        tests:
-          bin_op: or
-          test_items:
-            - flag: root:root
-        remediation: |
-          Run the below command (based on the file location on your system) on the each worker node.
-          For example, chown root:root $proxykubeconfig
-        scored: false
-
-      - id: 4.1.5
-        text: "Ensure that the --kubeconfig kubelet.conf file permissions are set to 600 or more restrictive (Automated)"
-        audit: '/bin/sh -c ''if test -e $kubeletkubeconfig; then stat -c permissions=%a $kubeletkubeconfig; fi'' '
-        tests:
-          test_items:
-            - flag: "permissions"
-              compare:
-                op: bitmask
-                value: "600"
-        remediation: |
-          Run the below command (based on the file location on your system) on the each worker node.
-          For example,
-          chmod 600 $kubeletkubeconfig
-        scored: true
-
-      - id: 4.1.6
-        text: "Ensure that the --kubeconfig kubelet.conf file ownership is set to root:root (Automated)"
-        audit: '/bin/sh -c ''if test -e $kubeletkubeconfig; then stat -c %U:%G $kubeletkubeconfig; fi'' '
-        tests:
-          test_items:
-            - flag: root:root
-        remediation: |
-          Run the below command (based on the file location on your system) on the each worker node.
-          For example,
-          chown root:root $kubeletkubeconfig
-        scored: true
-
-      - id: 4.1.7
-        text: "Ensure that the certificate authorities file permissions are set to 600 or more restrictive (Manual)"
-        audit: |
-          CAFILE=$(ps -ef | grep kubelet | grep -v apiserver | grep -- --client-ca-file= | awk -F '--client-ca-file=' '{print $2}' | awk '{print $1}' | uniq)
-          if test -z $CAFILE; then CAFILE=$kubeletcafile; fi
-          if test -e $CAFILE; then stat -c permissions=%a $CAFILE; fi
-        tests:
-          test_items:
-            - flag: "permissions"
-              compare:
-                op: bitmask
-                value: "600"
-        remediation: |
-          Run the following command to modify the file permissions of the
-          --client-ca-file chmod 600 <filename>
-        scored: false
-
-      - id: 4.1.8
-        text: "Ensure that the client certificate authorities file ownership is set to root:root (Manual)"
-        audit: |
-          CAFILE=$(ps -ef | grep kubelet | grep -v apiserver | grep -- --client-ca-file= | awk -F '--client-ca-file=' '{print $2}' | awk '{print $1}' | uniq)
-          if test -z $CAFILE; then CAFILE=$kubeletcafile; fi
-          if test -e $CAFILE; then stat -c %U:%G $CAFILE; fi
-        tests:
-          test_items:
-            - flag: root:root
-              compare:
-                op: eq
-                value: root:root
-        remediation: |
-          Run the following command to modify the ownership of the --client-ca-file.
-          chown root:root <filename>
-        scored: false
-
-      - id: 4.1.9
-        text: "If the kubelet config.yaml configuration file is being used validate permissions set to 600 or more restrictive (Automated)"
-        audit: '/bin/sh -c ''if test -e $kubeletconf; then stat -c permissions=%a $kubeletconf; fi'' '
-        tests:
-          test_items:
-            - flag: "permissions"
-              compare:
-                op: bitmask
-                value: "600"
-        remediation: |
-          Run the following command (using the config file location identified in the Audit step)
-          chmod 600 $kubeletconf
-        scored: true
-
-      - id: 4.1.10
-        text: "If the kubelet config.yaml configuration file is being used validate file ownership is set to root:root (Automated)"
-        audit: '/bin/sh -c ''if test -e $kubeletconf; then stat -c %U:%G $kubeletconf; fi'' '
-        tests:
-          test_items:
-            - flag: root:root
-        remediation: |
-          Run the following command (using the config file location identified in the Audit step)
-          chown root:root $kubeletconf
-        scored: true
-
-  - id: 4.2
-    text: "Kubelet"
-    checks:
-      - id: 4.2.1
-        text: "Ensure that the --anonymous-auth argument is set to false (Automated)"
-        audit: "/bin/ps -fC $kubeletbin"
-        audit_config: "/bin/cat $kubeletconf"
-        tests:
-          test_items:
-            - flag: "--anonymous-auth"
-              path: '{.authentication.anonymous.enabled}'
-              compare:
-                op: eq
-                value: false
-        remediation: |
-          If using a Kubelet config file, edit the file to set `authentication: anonymous: enabled` to
-          `false`.
-          If using executable arguments, edit the kubelet service file
-          $kubeletsvc on each worker node and
-          set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable.
-          `--anonymous-auth=false`
-          Based on your system, restart the kubelet service. For example,
-          systemctl daemon-reload
-          systemctl restart kubelet.service
-        scored: true
-
-      - id: 4.2.2
-        text: "Ensure that the --authorization-mode argument is not set to AlwaysAllow (Automated)"
-        audit: "/bin/ps -fC $kubeletbin"
-        audit_config: "/bin/cat $kubeletconf"
-        tests:
-          test_items:
-            - flag: --authorization-mode
-              path: '{.authorization.mode}'
-              compare:
-                op: nothave
-                value: AlwaysAllow
-        remediation: |
-          If using a Kubelet config file, edit the file to set `authorization.mode` to Webhook. If
-          using executable arguments, edit the kubelet service file
-          $kubeletsvc on each worker node and
-          set the below parameter in KUBELET_AUTHZ_ARGS variable.
-          --authorization-mode=Webhook
-          Based on your system, restart the kubelet service. For example,
-          systemctl daemon-reload
-          systemctl restart kubelet.service
-        scored: true
-
-      - id: 4.2.3
-        text: "Ensure that the --client-ca-file argument is set as appropriate (Automated)"
-        audit: "/bin/ps -fC $kubeletbin"
-        audit_config: "/bin/cat $kubeletconf"
-        tests:
-          test_items:
-            - flag: --client-ca-file
-              path: '{.authentication.x509.clientCAFile}'
-        remediation: |
-          If using a Kubelet config file, edit the file to set `authentication.x509.clientCAFile` to
-          the location of the client CA file.
-          If using command line arguments, edit the kubelet service file
-          $kubeletsvc on each worker node and
-          set the below parameter in KUBELET_AUTHZ_ARGS variable.
-          --client-ca-file=<path/to/client-ca-file>
-          Based on your system, restart the kubelet service. For example,
-          systemctl daemon-reload
-          systemctl restart kubelet.service
-        scored: true
-
-      - id: 4.2.4
-        text: "Verify that the --read-only-port argument is set to 0 (Manual)"
-        audit: "/bin/ps -fC $kubeletbin"
-        audit_config: "/bin/cat $kubeletconf"
-        tests:
-          bin_op: or
-          test_items:
-            - flag: "--read-only-port"
-              path: '{.readOnlyPort}'
-              compare:
-                op: eq
-                value: 0
-            - flag: "--read-only-port"
-              path: '{.readOnlyPort}'
-              set: false
-        remediation: |
-          If using a Kubelet config file, edit the file to set `readOnlyPort` to 0.
-          If using command line arguments, edit the kubelet service file
-          $kubeletsvc on each worker node and
-          set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable.
-          --read-only-port=0
-          Based on your system, restart the kubelet service. For example,
-          systemctl daemon-reload
-          systemctl restart kubelet.service
-        scored: false
-
-      - id: 4.2.5
-        text: "Ensure that the --streaming-connection-idle-timeout argument is not set to 0 (Manual)"
-        audit: "/bin/ps -fC $kubeletbin"
-        audit_config: "/bin/cat $kubeletconf"
-        tests:
-          test_items:
-            - flag: --streaming-connection-idle-timeout
-              path: '{.streamingConnectionIdleTimeout}'
-              compare:
-                op: noteq
-                value: 0
-            - flag: --streaming-connection-idle-timeout
-              path: '{.streamingConnectionIdleTimeout}'
-              set: false
-          bin_op: or
-        remediation: |
-          If using a Kubelet config file, edit the file to set `streamingConnectionIdleTimeout` to a
-          value other than 0.
-          If using command line arguments, edit the kubelet service file
-          $kubeletsvc on each worker node and
-          set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable.
-          --streaming-connection-idle-timeout=5m
-          Based on your system, restart the kubelet service. For example,
-          systemctl daemon-reload
-          systemctl restart kubelet.service
-        scored: false
-
-      - id: 4.2.6
-        text: "Ensure that the --make-iptables-util-chains argument is set to true (Automated)"
-        audit: "/bin/ps -fC $kubeletbin"
-        audit_config: "/bin/cat $kubeletconf"
-        tests:
-          test_items:
-            - flag: --make-iptables-util-chains
-              path: '{.makeIPTablesUtilChains}'
-              compare:
-                op: eq
-                value: true
-            - flag: --make-iptables-util-chains
-              path: '{.makeIPTablesUtilChains}'
-              set: false
-          bin_op: or
-        remediation: |
-          If using a Kubelet config file, edit the file to set `makeIPTablesUtilChains` to `true`.
-          If using command line arguments, edit the kubelet service file
-          $kubeletsvc on each worker node and
-          remove the --make-iptables-util-chains argument from the
-          KUBELET_SYSTEM_PODS_ARGS variable.
-          Based on your system, restart the kubelet service. For example:
-          systemctl daemon-reload
-          systemctl restart kubelet.service
-        scored: true
-
-      - id: 4.2.7
-        text: "Ensure that the --hostname-override argument is not set (Manual)"
-        # This is one of those properties that can only be set as a command line argument.
-        # To check if the property is set as expected, we need to parse the kubelet command
-        # instead reading the Kubelet Configuration file.
-        audit: "/bin/ps -fC $kubeletbin"
-        tests:
-          test_items:
-            - flag: --hostname-override
-              set: false
-        remediation: |
-          Edit the kubelet service file $kubeletsvc
-          on each worker node and remove the --hostname-override argument from the
-          KUBELET_SYSTEM_PODS_ARGS variable.
-          Based on your system, restart the kubelet service. For example,
-          systemctl daemon-reload
-          systemctl restart kubelet.service
-        scored: false
-
-      - id: 4.2.8
-        text: "Ensure that the eventRecordQPS argument is set to a level which ensures appropriate event capture (Manual)"
-        audit: "/bin/ps -fC $kubeletbin"
-        audit_config: "/bin/cat $kubeletconf"
-        tests:
-          test_items:
-            - flag: --event-qps
-              path: '{.eventRecordQPS}'
-              compare:
-                op: gte
-                value: 0
-            - flag: --event-qps
-              path: '{.eventRecordQPS}'
-              set: false
-          bin_op: or
-        remediation: |
-          If using a Kubelet config file, edit the file to set `eventRecordQPS` to an appropriate level.
-          If using command line arguments, edit the kubelet service file
-          $kubeletsvc on each worker node and
-          set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable.
-          Based on your system, restart the kubelet service. For example,
-          systemctl daemon-reload
-          systemctl restart kubelet.service
-        scored: false
-
-      - id: 4.2.9
-        text: "Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate (Manual)"
-        audit: "/bin/ps -fC $kubeletbin"
-        audit_config: "/bin/cat $kubeletconf"
-        tests:
-          test_items:
-            - flag: --tls-cert-file
-              path: '{.tlsCertFile}'
-            - flag: --tls-private-key-file
-              path: '{.tlsPrivateKeyFile}'
-        remediation: |
-          If using a Kubelet config file, edit the file to set `tlsCertFile` to the location
-          of the certificate file to use to identify this Kubelet, and `tlsPrivateKeyFile`
-          to the location of the corresponding private key file.
-          If using command line arguments, edit the kubelet service file
-          $kubeletsvc on each worker node and
-          set the below parameters in KUBELET_CERTIFICATE_ARGS variable.
-          --tls-cert-file=<path/to/tls-certificate-file>
-          --tls-private-key-file=<path/to/tls-key-file>
-          Based on your system, restart the kubelet service. For example,
-          systemctl daemon-reload
-          systemctl restart kubelet.service
-        scored: false
-
-      - id: 4.2.10
-        text: "Ensure that the --rotate-certificates argument is not set to false (Automated)"
-        audit: "/bin/ps -fC $kubeletbin"
-        audit_config: "/bin/cat $kubeletconf"
-        tests:
-          test_items:
-            - flag: --rotate-certificates
-              path: '{.rotateCertificates}'
-              compare:
-                op: eq
-                value: true
-            - flag: --rotate-certificates
-              path: '{.rotateCertificates}'
-              set: false
-          bin_op: or
-        remediation: |
-          If using a Kubelet config file, edit the file to add the line `rotateCertificates` to `true` or
-          remove it altogether to use the default value.
-          If using command line arguments, edit the kubelet service file
-          $kubeletsvc on each worker node and
-          remove --rotate-certificates=false argument from the KUBELET_CERTIFICATE_ARGS
-          variable.
-          Based on your system, restart the kubelet service. For example,
-          systemctl daemon-reload
-          systemctl restart kubelet.service
-        scored: true
-
-      - id: 4.2.11
-        text: "Verify that the RotateKubeletServerCertificate argument is set to true (Manual)"
-        audit: "/bin/ps -fC $kubeletbin"
-        audit_config: "/bin/cat $kubeletconf"
-        tests:
-          bin_op: or
-          test_items:
-            - flag: RotateKubeletServerCertificate
-              path: '{.featureGates.RotateKubeletServerCertificate}'
-              compare:
-                op: nothave
-                value: false
-            - flag: RotateKubeletServerCertificate
-              path: '{.featureGates.RotateKubeletServerCertificate}'
-              set: false
-        remediation: |
-          Edit the kubelet service file $kubeletsvc
-          on each worker node and set the below parameter in KUBELET_CERTIFICATE_ARGS variable.
-          --feature-gates=RotateKubeletServerCertificate=true
-          Based on your system, restart the kubelet service. For example:
-          systemctl daemon-reload
-          systemctl restart kubelet.service
-        scored: false
-
-      - id: 4.2.12
-        text: "Ensure that the Kubelet only makes use of Strong Cryptographic Ciphers (Manual)"
-        audit: "/bin/ps -fC $kubeletbin"
-        audit_config: "/bin/cat $kubeletconf"
-        tests:
-          test_items:
-            - flag: --tls-cipher-suites
-              path: '{range .tlsCipherSuites[:]}{}{'',''}{end}'
-              compare:
-                op: valid_elements
-                value: TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256
-        remediation: |
-          If using a Kubelet config file, edit the file to set `tlsCipherSuites` to
-          TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256
-          or to a subset of these values.
-          If using executable arguments, edit the kubelet service file
-          $kubeletsvc on each worker node and
-          set the --tls-cipher-suites parameter as follows, or to a subset of these values.
-          --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256
-          Based on your system, restart the kubelet service. For example:
-          systemctl daemon-reload
-          systemctl restart kubelet.service
-        scored: false
-
-      - id: 4.2.13
-        text: "Ensure that a limit is set on pod PIDs (Manual)"
-        audit: "/bin/ps -fC $kubeletbin"
-        audit_config: "/bin/cat $kubeletconf"
-        tests:
-          test_items:
-            - flag: --pod-max-pids
-              path: '{.podPidsLimit}'
-        remediation: |
-          Decide on an appropriate level for this parameter and set it,
-          either via the --pod-max-pids command line parameter or the PodPidsLimit configuration file setting.
-        scored: false
-
-  - id: 4.3
-    text: "kube-proxy"
-    checks:
-      - id: 4.3.1
-        text: "Ensure that the kube-proxy metrics service is bound to localhost (Automated)"
-        audit: "/bin/ps -fC $proxybin"
-        audit_config: "/bin/sh -c 'if test -e $proxykubeconfig; then cat $proxykubeconfig; fi'"
-        tests:
-          bin_op: or
-          test_items:
-            - flag: "--metrics-bind-address"
-              path: '{.metricsBindAddress}'
-              compare:
-                op: has
-                value: "127.0.0.1"
-            - flag: "--metrics-bind-address"
-              path: '{.metricsBindAddress}'
-              set: false
-        remediation: |
-           Modify or remove any values which bind the metrics service to a non-localhost address.
-           The default value is 127.0.0.1:10249.
-        scored: true

cfg/cis-1.10/policies.yaml

@@ -1,559 +0,0 @@
----
-controls:
-version: "cis-1.10"
-id: 5
-text: "Kubernetes Policies"
-type: "policies"
-groups:
-  - id: 5.1
-    text: "RBAC and Service Accounts"
-    checks:
-      - id: 5.1.1
-        text: "Ensure that the cluster-admin role is only used where required (Automated)"
-        audit: |
-          kubectl get clusterrolebindings -o=custom-columns=NAME:.metadata.name,ROLE:.roleRef.name,SUBJECT:.subjects[*].name --no-headers | while read -r role_name role_binding subject
-          do
-            if [[ "${role_name}" != "cluster-admin" && "${role_binding}" == "cluster-admin" ]]; then
-              is_compliant="false"
-            else
-              is_compliant="true"
-            fi;
-            echo "**role_name: ${role_name} role_binding: ${role_binding} subject: ${subject} is_compliant: ${is_compliant}"
-          done
-        use_multiple_values: true
-        tests:
-          test_items:
-            - flag: "is_compliant"
-              compare:
-                op: eq
-                value: true
-        remediation: |
-          Identify all clusterrolebindings to the cluster-admin role. Check if they are used and
-          if they need this role or if they could use a role with fewer privileges.
-          Where possible, first bind users to a lower privileged role and then remove the
-          clusterrolebinding to the cluster-admin role : kubectl delete clusterrolebinding [name]
-          Condition: is_compliant is false if rolename is not cluster-admin and rolebinding is cluster-admin.
-        scored: false
-
-      - id: 5.1.2
-        text: "Minimize access to secrets (Automated)"
-        audit: "echo \"canGetListWatchSecretsAsSystemAuthenticated: $(kubectl auth can-i get,list,watch secrets --all-namespaces --as=system:authenticated)\""
-        tests:
-          test_items:
-            - flag: "canGetListWatchSecretsAsSystemAuthenticated"
-              compare:
-                op: eq
-                value: no
-        remediation: |
-          Where possible, remove get, list and watch access to Secret objects in the cluster.
-        scored: false
-
-      - id: 5.1.3
-        text: "Minimize wildcard use in Roles and ClusterRoles (Automated)"
-        audit: |
-          # Check Roles
-          kubectl get roles --all-namespaces -o custom-columns=ROLE_NAMESPACE:.metadata.namespace,ROLE_NAME:.metadata.name --no-headers | while read -r role_namespace role_name
-          do
-            role_rules=$(kubectl get role -n "${role_namespace}" "${role_name}" -o=json | jq -c '.rules')
-            if echo "${role_rules}" | grep -q "\[\"\*\"\]"; then
-              role_is_compliant="false"
-            else
-              role_is_compliant="true"
-            fi;
-            echo "**role_name: ${role_name} role_namespace: ${role_namespace} role_rules: ${role_rules} role_is_compliant: ${role_is_compliant}"
-          done
-
-          # Check ClusterRoles
-          kubectl get clusterroles -o custom-columns=CLUSTERROLE_NAME:.metadata.name --no-headers | while read -r clusterrole_name
-          do
-            clusterrole_rules=$(kubectl get clusterrole "${clusterrole_name}" -o=json | jq -c '.rules')
-            if echo "${clusterrole_rules}" | grep -q "\[\"\*\"\]"; then
-              clusterrole_is_compliant="false"
-            else
-              clusterrole_is_compliant="true"
-            fi;
-          echo "**clusterrole_name: ${clusterrole_name} clusterrole_rules: ${clusterrole_rules} clusterrole_is_compliant: ${clusterrole_is_compliant}"
-          done
-        use_multiple_values: true
-        tests:
-          bin_op: or
-          test_items:
-            - flag: "role_is_compliant"
-              compare:
-                op: eq
-                value: true
-              set: true
-            - flag: "clusterrole_is_compliant"
-              compare:
-                op: eq
-                value: true
-              set: true
-        remediation: |
-          Where possible replace any use of wildcards ["*"] in roles and clusterroles with specific
-          objects or actions.
-          Condition: role_is_compliant is false if ["*"] is found in rules.
-          Condition: clusterrole_is_compliant is false if ["*"] is found in rules.
-        scored: false
-
-      - id: 5.1.4
-        text: "Minimize access to create pods (Automated)"
-        audit: |
-          echo "canCreatePodsAsSystemAuthenticated: $(kubectl auth can-i create pods --all-namespaces --as=system:authenticated)"
-        tests:
-          test_items:
-            - flag: "canCreatePodsAsSystemAuthenticated"
-              compare:
-                op: eq
-                value: no
-        remediation: |
-          Where possible, remove create access to pod objects in the cluster.
-        scored: false
-      - id: 5.1.5
-        text: "Ensure that default service accounts are not actively used (Automated)"
-        audit: |
-          kubectl get serviceaccount --all-namespaces --field-selector metadata.name=default -o=json | jq -r '.items[] | " namespace: \(.metadata.namespace), kind: \(.kind), name: \(.metadata.name), automountServiceAccountToken: \(.automountServiceAccountToken | if . == null then "notset" else . end )"' | xargs -L 1
-        use_multiple_values: true
-        tests:
-          test_items:
-            - flag: "automountServiceAccountToken"
-              compare:
-                op: eq
-                value: false
-              set: true
-        remediation: |
-          Create explicit service accounts wherever a Kubernetes workload requires specific access
-          to the Kubernetes API server.
-          Modify the configuration of each default service account to include this value
-          `automountServiceAccountToken: false`.
-        scored: false
-
-      - id: 5.1.6
-        text: "Ensure that Service Account Tokens are only mounted where necessary (Automated)"
-        audit: |
-          kubectl get pods --all-namespaces -o custom-columns=POD_NAMESPACE:.metadata.namespace,POD_NAME:.metadata.name,POD_SERVICE_ACCOUNT:.spec.serviceAccount,POD_IS_AUTOMOUNTSERVICEACCOUNTTOKEN:.spec.automountServiceAccountToken --no-headers | while read -r pod_namespace pod_name pod_service_account pod_is_automountserviceaccounttoken
-          do
-            # Retrieve automountServiceAccountToken's value for ServiceAccount and Pod, set to notset if null or <none>.
-            svacc_is_automountserviceaccounttoken=$(kubectl get serviceaccount -n "${pod_namespace}" "${pod_service_account}" -o json | jq -r '.automountServiceAccountToken' | sed -e 's/<none>/notset/g' -e 's/null/notset/g')
-            pod_is_automountserviceaccounttoken=$(echo "${pod_is_automountserviceaccounttoken}" | sed -e 's/<none>/notset/g' -e 's/null/notset/g')
-            if [ "${svacc_is_automountserviceaccounttoken}" = "false" ] && ( [ "${pod_is_automountserviceaccounttoken}" = "false" ] || [ "${pod_is_automountserviceaccounttoken}" = "notset" ] ); then
-              is_compliant="true"
-            elif [ "${svacc_is_automountserviceaccounttoken}" = "true" ] && [ "${pod_is_automountserviceaccounttoken}" = "false" ]; then
-              is_compliant="true"
-            else
-              is_compliant="false"
-            fi
-            echo "**namespace: ${pod_namespace} pod_name: ${pod_name} service_account: ${pod_service_account} pod_is_automountserviceaccounttoken: ${pod_is_automountserviceaccounttoken} svacc_is_automountServiceAccountToken: ${svacc_is_automountserviceaccounttoken} is_compliant: ${is_compliant}"
-          done
-        use_multiple_values: true
-        tests:
-          test_items:
-            - flag: "is_compliant"
-              compare:
-                op: eq
-                value: true
-        remediation: |
-          Modify the definition of ServiceAccounts and Pods which do not need to mount service
-          account tokens to disable it, with `automountServiceAccountToken: false`.
-          If both the ServiceAccount and the Pod's .spec specify a value for automountServiceAccountToken, the Pod spec takes precedence.
-          Condition: Pod is_compliant to true when
-            - ServiceAccount is automountServiceAccountToken: false and Pod is automountServiceAccountToken: false or notset
-            - ServiceAccount is automountServiceAccountToken: true notset and Pod is automountServiceAccountToken: false
-        scored: false
-
-      - id: 5.1.7
-        text: "Avoid use of system:masters group (Manual)"
-        type: "manual"
-        remediation: |
-          Remove the system:masters group from all users in the cluster.
-        scored: false
-
-      - id: 5.1.8
-        text: "Limit use of the Bind, Impersonate and Escalate permissions in the Kubernetes cluster (Manual)"
-        type: "manual"
-        remediation: |
-          Where possible, remove the impersonate, bind and escalate rights from subjects.
-        scored: false
-
-      - id: 5.1.9
-        text: "Minimize access to create persistent volumes (Manual)"
-        type: "manual"
-        remediation: |
-          Where possible, remove create access to PersistentVolume objects in the cluster.
-        scored: false
-
-      - id: 5.1.10
-        text: "Minimize access to the proxy sub-resource of nodes (Manual)"
-        type: "manual"
-        remediation: |
-          Where possible, remove access to the proxy sub-resource of node objects.
-        scored: false
-
-      - id: 5.1.11
-        text: "Minimize access to the approval sub-resource of certificatesigningrequests objects (Manual)"
-        type: "manual"
-        remediation: |
-          Where possible, remove access to the approval sub-resource of certificatesigningrequests objects.
-        scored: false
-
-      - id: 5.1.12
-        text: "Minimize access to webhook configuration objects (Manual)"
-        type: "manual"
-        remediation: |
-          Where possible, remove access to the validatingwebhookconfigurations or mutatingwebhookconfigurations objects
-        scored: false
-
-      - id: 5.1.13
-        text: "Minimize access to the service account token creation (Manual)"
-        type: "manual"
-        remediation: |
-          Where possible, remove access to the token sub-resource of serviceaccount objects.
-        scored: false
-
-  - id: 5.2
-    text: "Pod Security Standards"
-    checks:
-      - id: 5.2.1
-        text: "Ensure that the cluster has at least one active policy control mechanism in place (Manual)"
-        type: "manual"
-        remediation: |
-          Ensure that either Pod Security Admission or an external policy control system is in place
-          for every namespace which contains user workloads.
-        scored: false
-
-      - id: 5.2.2
-        text: "Minimize the admission of privileged containers (Manual)"
-        audit: |
-          kubectl get pods --all-namespaces -o custom-columns=POD_NAME:.metadata.name,POD_NAMESPACE:.metadata.namespace --no-headers | while read -r pod_name pod_namespace
-          do
-            # Retrieve container(s) for each Pod.
-            kubectl get pod "${pod_name}" --namespace "${pod_namespace}" -o json | jq -c '.spec.containers[]' | while read -r container
-            do
-              # Retrieve container's name.
-              container_name=$(echo ${container} | jq -r '.name')
-              # Retrieve container's .securityContext.privileged value.
-              container_privileged=$(echo ${container} | jq -r '.securityContext.privileged' | sed -e 's/null/notset/g')
-              if [ "${container_privileged}" = "false" ] || [ "${container_privileged}" = "notset" ] ; then
-                echo "***pod_name: ${pod_name} container_name: ${container_name} pod_namespace: ${pod_namespace} is_container_privileged: ${container_privileged} is_compliant: true"
-              else
-                echo "***pod_name: ${pod_name} container_name: ${container_name} pod_namespace: ${pod_namespace} is_container_privileged: ${container_privileged} is_compliant: false"
-              fi
-            done
-          done
-        use_multiple_values: true
-        tests:
-          test_items:
-            - flag: "is_compliant"
-              compare:
-                op: eq
-                value: true
-        remediation: |
-          Add policies to each namespace in the cluster which has user workloads to restrict the
-          admission of privileged containers.
-          Audit: the audit list all pods' containers to retrieve their .securityContext.privileged value.
-          Condition: is_compliant is false if container's `.securityContext.privileged` is set to `true`.
-          Default: by default, there are no restrictions on the creation of privileged containers.
-        scored: false
-
-      - id: 5.2.3
-        text: "Minimize the admission of containers wishing to share the host process ID namespace (Manual)"
-        audit: |
-          kubectl get pods --all-namespaces -o custom-columns=POD_NAME:.metadata.name,POD_NAMESPACE:.metadata.namespace --no-headers | while read -r pod_name pod_namespace
-          do
-            # Retrieve spec.hostPID for each pod.
-            pod_hostpid=$(kubectl get pod "${pod_name}" --namespace "${pod_namespace}" -o jsonpath='{.spec.hostPID}' 2>/dev/null)
-            if [ -z "${pod_hostpid}" ]; then
-              pod_hostpid="false"
-              echo "***pod_name: ${pod_name} pod_namespace: ${pod_namespace} is_pod_hostpid: ${pod_hostpid} is_compliant: true"
-            else
-              echo "***pod_name: ${pod_name} pod_namespace: ${pod_namespace} is_pod_hostpid: ${pod_hostpid} is_compliant: false"
-            fi
-          done
-        use_multiple_values: true
-        tests:
-          test_items:
-            - flag: "is_compliant"
-              compare:
-                op: eq
-                value: true
-        remediation: |
-          Add policies to each namespace in the cluster which has user workloads to restrict the
-          admission of `hostPID` containers.
-          Audit: the audit retrieves each Pod' spec.hostPID.
-          Condition: is_compliant is false if Pod's spec.hostPID is set to `true`.
-          Default: by default, there are no restrictions on the creation of hostPID containers.
-        scored: false
-
-      - id: 5.2.4
-        text: "Minimize the admission of containers wishing to share the host IPC namespace (Manual)"
-        audit: |
-          kubectl get pods --all-namespaces -o custom-columns=POD_NAME:.metadata.name,POD_NAMESPACE:.metadata.namespace --no-headers | while read -r pod_name pod_namespace
-          do
-            # Retrieve spec.hostIPC for each pod.
-            pod_hostipc=$(kubectl get pod "${pod_name}" --namespace "${pod_namespace}" -o jsonpath='{.spec.hostIPC}' 2>/dev/null)
-            if [ -z "${pod_hostipc}" ]; then
-              pod_hostipc="false"
-              echo "***pod_name: ${pod_name} pod_namespace: ${pod_namespace} is_pod_hostipc: ${pod_hostipc} is_compliant: true"
-            else
-              echo "***pod_name: ${pod_name} pod_namespace: ${pod_namespace} is_pod_hostipc: ${pod_hostipc} is_compliant: false"
-            fi
-          done
-        use_multiple_values: true
-        tests:
-          test_items:
-            - flag: "is_compliant"
-              compare:
-                op: eq
-                value: true
-        remediation: |
-          Add policies to each namespace in the cluster which has user workloads to restrict the
-          admission of `hostIPC` containers.
-          Audit: the audit retrieves each Pod' spec.IPC.
-          Condition: is_compliant is false if Pod's spec.hostIPC is set to `true`.
-          Default: by default, there are no restrictions on the creation of hostIPC containers.
-        scored: false
-
-      - id: 5.2.5
-        text: "Minimize the admission of containers wishing to share the host network namespace (Manual)"
-        audit: |
-          kubectl get pods --all-namespaces -o custom-columns=POD_NAME:.metadata.name,POD_NAMESPACE:.metadata.namespace --no-headers | while read -r pod_name pod_namespace
-          do
-            # Retrieve spec.hostNetwork for each pod.
-            pod_hostnetwork=$(kubectl get pod "${pod_name}" --namespace "${pod_namespace}" -o jsonpath='{.spec.hostNetwork}' 2>/dev/null)
-            if [ -z "${pod_hostnetwork}" ]; then
-              pod_hostnetwork="false"
-              echo "***pod_name: ${pod_name} pod_namespace: ${pod_namespace} is_pod_hostnetwork: ${pod_hostnetwork} is_compliant: true"
-            else
-              echo "***pod_name: ${pod_name} pod_namespace: ${pod_namespace} is_pod_hostnetwork: ${pod_hostnetwork} is_compliant: false"
-            fi
-          done
-        use_multiple_values: true
-        tests:
-          test_items:
-            - flag: "is_compliant"
-              compare:
-                op: eq
-                value: true
-        remediation: |
-          Add policies to each namespace in the cluster which has user workloads to restrict the
-          admission of `hostNetwork` containers.
-          Audit: the audit retrieves each Pod' spec.hostNetwork.
-          Condition: is_compliant is false if Pod's spec.hostNetwork is set to `true`.
-          Default: by default, there are no restrictions on the creation of hostNetwork containers.
-        scored: false
-
-      - id: 5.2.6
-        text: "Minimize the admission of containers with allowPrivilegeEscalation (Manual)"
-        audit: |
-          kubectl get pods --all-namespaces -o custom-columns=POD_NAME:.metadata.name,POD_NAMESPACE:.metadata.namespace --no-headers | while read -r pod_name pod_namespace
-          do
-            # Retrieve container(s) for each Pod.
-            kubectl get pod "${pod_name}" --namespace "${pod_namespace}" -o json | jq -c '.spec.containers[]' | while read -r container
-            do
-              # Retrieve container's name
-              container_name=$(echo ${container} | jq -r '.name')
-              # Retrieve container's .securityContext.allowPrivilegeEscalation
-              container_allowprivesc=$(echo ${container} | jq -r '.securityContext.allowPrivilegeEscalation' | sed -e 's/null/notset/g')
-              if [ "${container_allowprivesc}" = "false" ] || [ "${container_allowprivesc}" = "notset" ]; then
-                echo "***pod_name: ${pod_name} container_name: ${container_name} pod_namespace: ${pod_namespace} is_container_allowprivesc: ${container_allowprivesc} is_compliant: true"
-              else
-                echo "***pod_name: ${pod_name} container_name: ${container_name} pod_namespace: ${pod_namespace} is_container_allowprivesc: ${container_allowprivesc} is_compliant: false"
-              fi
-            done
-          done
-        use_multiple_values: true
-        tests:
-          test_items:
-            - flag: "is_compliant"
-              compare:
-                op: eq
-                value: true
-        remediation: |
-          Add policies to each namespace in the cluster which has user workloads to restrict the
-          admission of containers with `.securityContext.allowPrivilegeEscalation` set to `true`.
-          Audit: the audit retrieves each Pod's container(s) `.securityContext.allowPrivilegeEscalation`.
-          Condition: is_compliant is false if container's `.securityContext.allowPrivilegeEscalation` is set to `true`.
-          Default: If notset, privilege escalation is allowed (default to true). However if PSP/PSA is used with a `restricted` profile,
-          privilege escalation is explicitly disallowed unless configured otherwise.
-        scored: false
-
-      - id: 5.2.7
-        text: "Minimize the admission of root containers (Manual)"
-        type: "manual"
-        remediation: |
-          Create a policy for each namespace in the cluster, ensuring that either `MustRunAsNonRoot`
-          or `MustRunAs` with the range of UIDs not including 0, is set.
-        scored: false
-
-      - id: 5.2.8
-        text: "Minimize the admission of containers with the NET_RAW capability (Manual)"
-        type: "manual"
-        remediation: |
-          Add policies to each namespace in the cluster which has user workloads to restrict the
-          admission of containers with the `NET_RAW` capability.
-        scored: false
-
-      - id: 5.2.9
-        text: "Minimize the admission of containers with added capabilities (Manual)"
-        audit: |
-          kubectl get pods --all-namespaces -o custom-columns=POD_NAME:.metadata.name,POD_NAMESPACE:.metadata.namespace --no-headers | while read -r pod_name pod_namespace
-          do
-            # Retrieve container(s) for each Pod.
-            kubectl get pod "${pod_name}" --namespace "${pod_namespace}" -o json | jq -c '.spec.containers[]' | while read -r container
-            do
-              # Retrieve container's name
-              container_name=$(echo ${container} | jq -r '.name')
-              # Retrieve container's added capabilities
-              container_caps_add=$(echo ${container} | jq -r '.securityContext.capabilities.add' | sed -e 's/null/notset/g')
-              # Set is_compliant to true by default.
-              is_compliant=true
-              caps_list=""
-              if [ "${container_caps_add}" != "notset" ]; then
-                # Loop through all caps and append caps_list, then set is_compliant to false.
-                for cap in $(echo "${container_caps_add}" | jq -r '.[]'); do
-                caps_list+="${cap},"
-                is_compliant=false
-                done
-                # Remove trailing comma for the last list member.
-                caps_list=${caps_list%,}
-              fi
-              if [ "${is_compliant}" = true ]; then
-                echo "***pod_name: ${pod_name} container_name: ${container_name} pod_namespace: ${pod_namespace} container_caps_add: ${container_caps_add} is_compliant: true"
-              else
-                echo "***pod_name: ${pod_name} container_name: ${container_name} pod_namespace: ${pod_namespace} container_caps_add: ${caps_list} is_compliant: false"
-              fi
-            done
-          done
-        use_multiple_values: true
-        tests:
-          test_items:
-            - flag: "is_compliant"
-              compare:
-                op: eq
-                value: true
-        remediation: |
-          Ensure that `allowedCapabilities` is not present in policies for the cluster unless
-          it is set to an empty array.
-          Audit: the audit retrieves each Pod's container(s) added capabilities.
-          Condition: is_compliant is false if added capabilities are added for a given container.
-          Default: Containers run with a default set of capabilities as assigned by the Container Runtime.
-        scored: false
-
-      - id: 5.2.10
-        text: "Minimize the admission of containers with capabilities assigned (Manual)"
-        type: "manual"
-        remediation: |
-          Review the use of capabilites in applications running on your cluster. Where a namespace
-          contains applications which do not require any Linux capabities to operate consider adding
-          a PSP which forbids the admission of containers which do not drop all capabilities.
-        scored: false
-
-      - id: 5.2.11
-        text: "Minimize the admission of Windows HostProcess containers (Manual)"
-        type: "manual"
-        remediation: |
-          Add policies to each namespace in the cluster which has user workloads to restrict the
-          admission of containers that have `.securityContext.windowsOptions.hostProcess` set to `true`.
-        scored: false
-
-      - id: 5.2.12
-        text: "Minimize the admission of HostPath volumes (Manual)"
-        type: "manual"
-        remediation: |
-          Add policies to each namespace in the cluster which has user workloads to restrict the
-          admission of containers with `hostPath` volumes.
-        scored: false
-
-      - id: 5.2.13
-        text: "Minimize the admission of containers which use HostPorts (Manual)"
-        type: "manual"
-        remediation: |
-          Add policies to each namespace in the cluster which has user workloads to restrict the
-          admission of containers which use `hostPort` sections.
-        scored: false
-
-  - id: 5.3
-    text: "Network Policies and CNI"
-    checks:
-      - id: 5.3.1
-        text: "Ensure that the CNI in use supports NetworkPolicies (Manual)"
-        type: "manual"
-        remediation: |
-          If the CNI plugin in use does not support network policies, consideration should be given to
-          making use of a different plugin, or finding an alternate mechanism for restricting traffic
-          in the Kubernetes cluster.
-        scored: false
-
-      - id: 5.3.2
-        text: "Ensure that all Namespaces have NetworkPolicies defined (Manual)"
-        type: "manual"
-        remediation: |
-          Follow the documentation and create NetworkPolicy objects as you need them.
-        scored: false
-
-  - id: 5.4
-    text: "Secrets Management"
-    checks:
-      - id: 5.4.1
-        text: "Prefer using Secrets as files over Secrets as environment variables (Manual)"
-        type: "manual"
-        remediation: |
-          If possible, rewrite application code to read Secrets from mounted secret files, rather than
-          from environment variables.
-        scored: false
-
-      - id: 5.4.2
-        text: "Consider external secret storage (Manual)"
-        type: "manual"
-        remediation: |
-          Refer to the Secrets management options offered by your cloud provider or a third-party
-          secrets management solution.
-        scored: false
-
-  - id: 5.5
-    text: "Extensible Admission Control"
-    checks:
-      - id: 5.5.1
-        text: "Configure Image Provenance using ImagePolicyWebhook admission controller (Manual)"
-        type: "manual"
-        remediation: |
-          Follow the Kubernetes documentation and setup image provenance.
-        scored: false
-
-  - id: 5.7
-    text: "General Policies"
-    checks:
-      - id: 5.7.1
-        text: "Create administrative boundaries between resources using namespaces (Manual)"
-        type: "manual"
-        remediation: |
-          Follow the documentation and create namespaces for objects in your deployment as you need
-          them.
-        scored: false
-
-      - id: 5.7.2
-        text: "Ensure that the seccomp profile is set to docker/default in your Pod definitions (Manual)"
-        type: "manual"
-        remediation: |
-          Use `securityContext` to enable the docker/default seccomp profile in your pod definitions.
-          An example is as below:
-            securityContext:
-              seccompProfile:
-                type: RuntimeDefault
-        scored: false
-
-      - id: 5.7.3
-        text: "Apply SecurityContext to your Pods and Containers (Manual)"
-        type: "manual"
-        remediation: |
-          Follow the Kubernetes documentation and apply SecurityContexts to your Pods. For a
-          suggested list of SecurityContexts, you may refer to the CIS Security Benchmark for Docker
-          Containers.
-        scored: false
-
-      - id: 5.7.4
-        text: "The default namespace should not be used (Manual)"
-        type: "manual"
-        remediation: |
-          Ensure that namespaces are created to allow for appropriate segregation of Kubernetes
-          resources and that all new resources are created in a specific namespace.
-        scored: false

cfg/cis-1.11/config.yaml

@@ -1,2 +0,0 @@
----
-## Version-specific settings that override the values in cfg/config.yaml

cfg/cis-1.11/controlplane.yaml

@@ -1,62 +0,0 @@
----
-controls:
-version: "cis-1.11"
-id: 3
-text: "Control Plane Configuration"
-type: "controlplane"
-groups:
-  - id: 3.1
-    text: "Authentication and Authorization"
-    checks:
-      - id: 3.1.1
-        text: "Client certificate authentication should not be used for users (Manual)"
-        type: "manual"
-        remediation: |
-          Alternative mechanisms provided by Kubernetes such as the use of OIDC should be
-          implemented in place of client certificates.
-        scored: false
-
-      - id: 3.1.2
-        text: "Service account token authentication should not be used for users (Manual)"
-        type: "manual"
-        remediation: |
-          Alternative mechanisms provided by Kubernetes such as the use of OIDC should be implemented
-          in place of service account tokens.
-        scored: false
-
-      - id: 3.1.3
-        text: "Bootstrap token authentication should not be used for users (Manual)"
-        type: "manual"
-        remediation: |
-          Alternative mechanisms provided by Kubernetes such as the use of OIDC should be implemented
-          in place of bootstrap tokens.
-        scored: false
-
-  - id: 3.2
-    text: "Logging"
-    checks:
-      - id: 3.2.1
-        text: "Ensure that a minimal audit policy is created (Manual)"
-        audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep"
-        tests:
-          test_items:
-            - flag: "--audit-policy-file"
-              set: true
-        remediation: |
-          Create an audit policy file for your cluster.
-        scored: false
-
-      - id: 3.2.2
-        text: "Ensure that the audit policy covers key security concerns (Manual)"
-        type: "manual"
-        remediation: |
-          Review the audit policy provided for the cluster and ensure that it covers
-          at least the following areas,
-          - Access to Secrets managed by the cluster. Care should be taken to only
-            log Metadata for requests to Secrets, ConfigMaps, and TokenReviews, in
-            order to avoid risk of logging sensitive data.
-          - Modification of Pod and Deployment objects.
-          - Use of `pods/exec`, `pods/portforward`, `pods/proxy` and `services/proxy`.
-          For most requests, minimally logging at the Metadata level is recommended
-          (the most basic level of logging).
-        scored: false

cfg/cis-1.11/etcd.yaml

@@ -1,135 +0,0 @@
----
-controls:
-version: "cis-1.11"
-id: 2
-text: "Etcd Node Configuration"
-type: "etcd"
-groups:
-  - id: 2
-    text: "Etcd Node Configuration"
-    checks:
-      - id: 2.1
-        text: "Ensure that the --cert-file and --key-file arguments are set as appropriate (Automated)"
-        audit: "/bin/ps -ef | /bin/grep $etcdbin | /bin/grep -v grep"
-        tests:
-          bin_op: and
-          test_items:
-            - flag: "--cert-file"
-              env: "ETCD_CERT_FILE"
-            - flag: "--key-file"
-              env: "ETCD_KEY_FILE"
-        remediation: |
-          Follow the etcd service documentation and configure TLS encryption.
-          Then, edit the etcd pod specification file /etc/kubernetes/manifests/etcd.yaml
-          on the master node and set the below parameters.
-          --cert-file=</path/to/ca-file>
-          --key-file=</path/to/key-file>
-        scored: true
-
-      - id: 2.2
-        text: "Ensure that the --client-cert-auth argument is set to true (Automated)"
-        audit: "/bin/ps -ef | /bin/grep $etcdbin | /bin/grep -v grep"
-        tests:
-          test_items:
-            - flag: "--client-cert-auth"
-              env: "ETCD_CLIENT_CERT_AUTH"
-              compare:
-                op: eq
-                value: true
-        remediation: |
-          Edit the etcd pod specification file $etcdconf on the master
-          node and set the below parameter.
-          --client-cert-auth="true"
-        scored: true
-
-      - id: 2.3
-        text: "Ensure that the --auto-tls argument is not set to true (Automated)"
-        audit: "/bin/ps -ef | /bin/grep $etcdbin | /bin/grep -v grep"
-        tests:
-          bin_op: or
-          test_items:
-            - flag: "--auto-tls"
-              env: "ETCD_AUTO_TLS"
-              set: false
-            - flag: "--auto-tls"
-              env: "ETCD_AUTO_TLS"
-              compare:
-                op: eq
-                value: false
-        remediation: |
-          Edit the etcd pod specification file $etcdconf on the master
-          node and either remove the --auto-tls parameter or set it to false.
-            --auto-tls=false
-        scored: true
-
-      - id: 2.4
-        text: "Ensure that the --peer-cert-file and --peer-key-file arguments are
-        set as appropriate (Automated)"
-        audit: "/bin/ps -ef | /bin/grep $etcdbin | /bin/grep -v grep"
-        tests:
-          bin_op: and
-          test_items:
-            - flag: "--peer-cert-file"
-              env: "ETCD_PEER_CERT_FILE"
-            - flag: "--peer-key-file"
-              env: "ETCD_PEER_KEY_FILE"
-        remediation: |
-          Follow the etcd service documentation and configure peer TLS encryption as appropriate
-          for your etcd cluster.
-          Then, edit the etcd pod specification file $etcdconf on the
-          master node and set the below parameters.
-          --peer-client-file=</path/to/peer-cert-file>
-          --peer-key-file=</path/to/peer-key-file>
-        scored: true
-
-      - id: 2.5
-        text: "Ensure that the --peer-client-cert-auth argument is set to true (Automated)"
-        audit: "/bin/ps -ef | /bin/grep $etcdbin | /bin/grep -v grep"
-        tests:
-          test_items:
-            - flag: "--peer-client-cert-auth"
-              env: "ETCD_PEER_CLIENT_CERT_AUTH"
-              compare:
-                op: eq
-                value: true
-        remediation: |
-          Edit the etcd pod specification file $etcdconf on the master
-          node and set the below parameter.
-          --peer-client-cert-auth=true
-        scored: true
-
-      - id: 2.6
-        text: "Ensure that the --peer-auto-tls argument is not set to true (Automated)"
-        audit: "/bin/ps -ef | /bin/grep $etcdbin | /bin/grep -v grep"
-        tests:
-          bin_op: or
-          test_items:
-            - flag: "--peer-auto-tls"
-              env: "ETCD_PEER_AUTO_TLS"
-              set: false
-            - flag: "--peer-auto-tls"
-              env: "ETCD_PEER_AUTO_TLS"
-              compare:
-                op: eq
-                value: false
-        remediation: |
-          Edit the etcd pod specification file $etcdconf on the master
-          node and either remove the --peer-auto-tls parameter or set it to false.
-          --peer-auto-tls=false
-        scored: true
-
-      - id: 2.7
-        text: "Ensure that a unique Certificate Authority is used for etcd (Manual)"
-        audit: "/bin/ps -ef | /bin/grep $etcdbin | /bin/grep -v grep"
-        tests:
-          test_items:
-            - flag: "--trusted-ca-file"
-              env: "ETCD_TRUSTED_CA_FILE"
-        remediation: |
-          [Manual test]
-          Follow the etcd documentation and create a dedicated certificate authority setup for the
-          etcd service.
-          Then, edit the etcd pod specification file $etcdconf on the
-          master node and set the below parameter.
-          --trusted-ca-file=</path/to/ca-file>
-        scored: false

cfg/cis-1.11/master.yaml

@@ -1,932 +0,0 @@
----
-controls:
-version: "cis-1.11"
-id: 1
-text: "Control Plane Security Configuration"
-type: "master"
-groups:
-  - id: 1.1
-    text: "Control Plane Node Configuration Files"
-    checks:
-      - id: 1.1.1
-        text: "Ensure that the API server pod specification file permissions are set to 600 or more restrictive (Automated)"
-        audit: "/bin/sh -c 'if test -e $apiserverconf; then stat -c permissions=%a $apiserverconf; fi'"
-        tests:
-          test_items:
-            - flag: "permissions"
-              compare:
-                op: bitmask
-                value: "600"
-        remediation: |
-          Run the below command (based on the file location on your system) on the
-          control plane node.
-          For example, chmod 600 $apiserverconf
-        scored: true
-
-      - id: 1.1.2
-        text: "Ensure that the API server pod specification file ownership is set to root:root (Automated)"
-        audit: "/bin/sh -c 'if test -e $apiserverconf; then stat -c %U:%G $apiserverconf; fi'"
-        tests:
-          test_items:
-            - flag: "root:root"
-        remediation: |
-          Run the below command (based on the file location on your system) on the control plane node.
-          For example, chown root:root $apiserverconf
-        scored: true
-
-      - id: 1.1.3
-        text: "Ensure that the controller manager pod specification file permissions are set to 600 or more restrictive (Automated)"
-        audit: "/bin/sh -c 'if test -e $controllermanagerconf; then stat -c permissions=%a $controllermanagerconf; fi'"
-        tests:
-          test_items:
-            - flag: "permissions"
-              compare:
-                op: bitmask
-                value: "600"
-        remediation: |
-          Run the below command (based on the file location on your system) on the control plane node.
-          For example, chmod 600 $controllermanagerconf
-        scored: true
-
-      - id: 1.1.4
-        text: "Ensure that the controller manager pod specification file ownership is set to root:root (Automated)"
-        audit: "/bin/sh -c 'if test -e $controllermanagerconf; then stat -c %U:%G $controllermanagerconf; fi'"
-        tests:
-          test_items:
-            - flag: "root:root"
-        remediation: |
-          Run the below command (based on the file location on your system) on the control plane node.
-          For example, chown root:root $controllermanagerconf
-        scored: true
-
-      - id: 1.1.5
-        text: "Ensure that the scheduler pod specification file permissions are set to 600 or more restrictive (Automated)"
-        audit: "/bin/sh -c 'if test -e $schedulerconf; then stat -c permissions=%a $schedulerconf; fi'"
-        tests:
-          test_items:
-            - flag: "permissions"
-              compare:
-                op: bitmask
-                value: "600"
-        remediation: |
-          Run the below command (based on the file location on your system) on the control plane node.
-          For example, chmod 600 $schedulerconf
-        scored: true
-
-      - id: 1.1.6
-        text: "Ensure that the scheduler pod specification file ownership is set to root:root (Automated)"
-        audit: "/bin/sh -c 'if test -e $schedulerconf; then stat -c %U:%G $schedulerconf; fi'"
-        tests:
-          test_items:
-            - flag: "root:root"
-        remediation: |
-          Run the below command (based on the file location on your system) on the control plane node.
-          For example, chown root:root $schedulerconf
-        scored: true
-
-      - id: 1.1.7
-        text: "Ensure that the etcd pod specification file permissions are set to 600 or more restrictive (Automated)"
-        audit: "/bin/sh -c 'if test -e $etcdconf; then find $etcdconf -name '*etcd*' | xargs stat -c permissions=%a; fi'"
-        use_multiple_values: true
-        tests:
-          test_items:
-            - flag: "permissions"
-              compare:
-                op: bitmask
-                value: "600"
-        remediation: |
-          Run the below command (based on the file location on your system) on the control plane node.
-          For example,
-          chmod 600 $etcdconf
-        scored: true
-
-      - id: 1.1.8
-        text: "Ensure that the etcd pod specification file ownership is set to root:root (Automated)"
-        audit: "/bin/sh -c 'if test -e $etcdconf; then find $etcdconf -name '*etcd*' | xargs stat -c %U:%G; fi'"
-        use_multiple_values: true
-        tests:
-          test_items:
-            - flag: "root:root"
-        remediation: |
-          Run the below command (based on the file location on your system) on the control plane node.
-          For example,
-          chown root:root $etcdconf
-        scored: true
-
-      - id: 1.1.9
-        text: "Ensure that the Container Network Interface file permissions are set to 600 or more restrictive (Manual)"
-        audit: |
-          ps -ef | grep $kubeletbin | grep -- --cni-conf-dir | sed 's%.*cni-conf-dir[= ]\([^ ]*\).*%\1%' | xargs -I{} find {} -mindepth 1 | xargs --no-run-if-empty stat -c permissions=%a
-          find /var/lib/cni/networks -type f 2> /dev/null | xargs --no-run-if-empty stat -c permissions=%a
-        use_multiple_values: true
-        tests:
-          test_items:
-            - flag: "permissions"
-              compare:
-                op: bitmask
-                value: "600"
-        remediation: |
-          Run the below command (based on the file location on your system) on the control plane node.
-          For example, chmod 600 <path/to/cni/files>
-        scored: false
-
-      - id: 1.1.10
-        text: "Ensure that the Container Network Interface file ownership is set to root:root (Manual)"
-        audit: |
-          ps -ef | grep $kubeletbin | grep -- --cni-conf-dir | sed 's%.*cni-conf-dir[= ]\([^ ]*\).*%\1%' | xargs -I{} find {} -mindepth 1 | xargs --no-run-if-empty stat -c %U:%G
-          find /var/lib/cni/networks -type f 2> /dev/null | xargs --no-run-if-empty stat -c %U:%G
-        use_multiple_values: true
-        tests:
-          test_items:
-            - flag: "root:root"
-        remediation: |
-          Run the below command (based on the file location on your system) on the control plane node.
-          For example,
-          chown root:root <path/to/cni/files>
-        scored: false
-
-      - id: 1.1.11
-        text: "Ensure that the etcd data directory permissions are set to 700 or more restrictive (Automated)"
-        audit: |
-          DATA_DIR=''
-          for d in $(ps -ef | grep $etcdbin | grep -- --data-dir | sed 's%.*data-dir[= ]\([^ ]*\).*%\1%'); do
-            if test -d "$d"; then DATA_DIR="$d"; fi
-          done
-          if ! test -d "$DATA_DIR"; then DATA_DIR=$etcddatadir; fi
-          stat -c permissions=%a "$DATA_DIR"
-        tests:
-          test_items:
-            - flag: "permissions"
-              compare:
-                op: bitmask
-                value: "700"
-        remediation: |
-          On the etcd server node, get the etcd data directory, passed as an argument --data-dir,
-          from the command 'ps -ef | grep etcd'.
-          Run the below command (based on the etcd data directory found above). For example,
-          chmod 700 /var/lib/etcd
-        scored: true
-
-      - id: 1.1.12
-        text: "Ensure that the etcd data directory ownership is set to etcd:etcd (Automated)"
-        audit: |
-          DATA_DIR=''
-          for d in $(ps -ef | grep $etcdbin | grep -- --data-dir | sed 's%.*data-dir[= ]\([^ ]*\).*%\1%'); do
-            if test -d "$d"; then DATA_DIR="$d"; fi
-          done
-          if ! test -d "$DATA_DIR"; then DATA_DIR=$etcddatadir; fi
-          stat -c %U:%G "$DATA_DIR"
-        tests:
-          test_items:
-            - flag: "etcd:etcd"
-        remediation: |
-          On the etcd server node, get the etcd data directory, passed as an argument --data-dir,
-          from the command 'ps -ef | grep etcd'.
-          Run the below command (based on the etcd data directory found above).
-          For example, chown etcd:etcd /var/lib/etcd
-        scored: true
-
-      - id: 1.1.13
-        text: "Ensure that the default administrative credential file permissions are set to 600 (Automated)"
-        audit: |
-         for adminconf in /etc/kubernetes/admin.conf /etc/kubernetes/super-admin.conf; do if test -e $adminconf; then stat -c "permissions=%a %n" $adminconf; fi; done
-        use_multiple_values: true
-        tests:
-          test_items:
-            - flag: "permissions"
-              compare:
-                op: bitmask
-                value: "600"
-        remediation: |
-          Run the below command (based on the file location on your system) on the control plane node.
-          For example, chmod 600 /etc/kubernetes/admin.conf
-          On Kubernetes 1.29+ the super-admin.conf file should also be modified, if present.
-          For example, chmod 600 /etc/kubernetes/super-admin.conf
-        scored: true
-
-      - id: 1.1.14
-        text: "Ensure that the default administrative credential file ownership is set to root:root (Automated)"
-        audit: |
-         for adminconf in /etc/kubernetes/admin.conf /etc/kubernetes/super-admin.conf; do if test -e $adminconf; then stat -c "ownership=%U:%G %n" $adminconf; fi; done
-        use_multiple_values: true
-        tests:
-          test_items:
-            - flag: "ownership"
-              compare:
-                op: eq
-                value: "root:root"
-        remediation: |
-          Run the below command (based on the file location on your system) on the control plane node.
-          For example, chown root:root /etc/kubernetes/admin.conf
-          On Kubernetes 1.29+ the super-admin.conf file should also be modified, if present.
-          For example, chown root:root /etc/kubernetes/super-admin.conf
-        scored: true
-
-      - id: 1.1.15
-        text: "Ensure that the scheduler.conf file permissions are set to 600 or more restrictive (Automated)"
-        audit: "/bin/sh -c 'if test -e $schedulerkubeconfig; then stat -c permissions=%a $schedulerkubeconfig; fi'"
-        tests:
-          test_items:
-            - flag: "permissions"
-              compare:
-                op: bitmask
-                value: "600"
-        remediation: |
-          Run the below command (based on the file location on your system) on the control plane node.
-          For example,
-          chmod 600 $schedulerkubeconfig
-        scored: true
-
-      - id: 1.1.16
-        text: "Ensure that the scheduler.conf file ownership is set to root:root (Automated)"
-        audit: "/bin/sh -c 'if test -e $schedulerkubeconfig; then stat -c %U:%G $schedulerkubeconfig; fi'"
-        tests:
-          test_items:
-            - flag: "root:root"
-        remediation: |
-          Run the below command (based on the file location on your system) on the control plane node.
-          For example,
-          chown root:root $schedulerkubeconfig
-        scored: true
-
-      - id: 1.1.17
-        text: "Ensure that the controller-manager.conf file permissions are set to 600 or more restrictive (Automated)"
-        audit: "/bin/sh -c 'if test -e $controllermanagerkubeconfig; then stat -c permissions=%a $controllermanagerkubeconfig; fi'"
-        tests:
-          test_items:
-            - flag: "permissions"
-              compare:
-                op: bitmask
-                value: "600"
-        remediation: |
-          Run the below command (based on the file location on your system) on the control plane node.
-          For example,
-          chmod 600 $controllermanagerkubeconfig
-        scored: true
-
-      - id: 1.1.18
-        text: "Ensure that the controller-manager.conf file ownership is set to root:root (Automated)"
-        audit: "/bin/sh -c 'if test -e $controllermanagerkubeconfig; then stat -c %U:%G $controllermanagerkubeconfig; fi'"
-        tests:
-          test_items:
-            - flag: "root:root"
-        remediation: |
-          Run the below command (based on the file location on your system) on the control plane node.
-          For example,
-          chown root:root $controllermanagerkubeconfig
-        scored: true
-
-      - id: 1.1.19
-        text: "Ensure that the Kubernetes PKI directory and file ownership is set to root:root (Automated)"
-        audit: "find /etc/kubernetes/pki/ | xargs stat -c %U:%G"
-        use_multiple_values: true
-        tests:
-          test_items:
-            - flag: "root:root"
-        remediation: |
-          Run the below command (based on the file location on your system) on the control plane node.
-          For example,
-          chown -R root:root /etc/kubernetes/pki/
-        scored: true
-
-      - id: 1.1.20
-        text: "Ensure that the Kubernetes PKI certificate file permissions are set to 644 or more restrictive (Manual)"
-        audit: "find /etc/kubernetes/pki/ -name '*.crt' | xargs stat -c permissions=%a"
-        use_multiple_values: true
-        tests:
-          test_items:
-            - flag: "permissions"
-              compare:
-                op: bitmask
-                value: "644"
-        remediation: |
-          Run the below command (based on the file location on your system) on the control plane node.
-          For example,
-          chmod -R 644 /etc/kubernetes/pki/*.crt
-        scored: false
-
-      - id: 1.1.21
-        text: "Ensure that the Kubernetes PKI key file permissions are set to 600 (Manual)"
-        audit: "find /etc/kubernetes/pki/ -name '*.key' | xargs stat -c permissions=%a"
-        use_multiple_values: true
-        tests:
-          test_items:
-            - flag: "permissions"
-              compare:
-                op: bitmask
-                value: "600"
-        remediation: |
-          Run the below command (based on the file location on your system) on the control plane node.
-          For example,
-          chmod -R 600 /etc/kubernetes/pki/*.key
-        scored: false
-
-  - id: 1.2
-    text: "API Server"
-    checks:
-      - id: 1.2.1
-        text: "Ensure that the --anonymous-auth argument is set to false (Manual)"
-        audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep"
-        tests:
-          test_items:
-            - flag: "--anonymous-auth"
-              compare:
-                op: eq
-                value: false
-        remediation: |
-          Edit the API server pod specification file $apiserverconf
-          on the control plane node and set the below parameter.
-          --anonymous-auth=false
-        scored: false
-
-      - id: 1.2.2
-        text: "Ensure that the --token-auth-file parameter is not set (Automated)"
-        audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep"
-        tests:
-          test_items:
-            - flag: "--token-auth-file"
-              set: false
-        remediation: |
-          Follow the documentation and configure alternate mechanisms for authentication. Then,
-          edit the API server pod specification file $apiserverconf
-          on the control plane node and remove the --token-auth-file=<filename> parameter.
-        scored: true
-
-      - id: 1.2.3
-        text: "Ensure that the --DenyServiceExternalIPs is set (Manual)"
-        audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep"
-        tests:
-          bin_op: or
-          test_items:
-            - flag: "--enable-admission-plugins"
-              compare:
-                op: has
-                value: "DenyServiceExternalIPs"
-        remediation: |
-          Edit the API server pod specification file $apiserverconf
-          on the control plane node and add the `DenyServiceExternalIPs` plugin
-          to the enabled admission plugins, as such --enable-admission-plugin=DenyServiceExternalIPs.
-        scored: false
-
-      - id: 1.2.4
-        text: "Ensure that the --kubelet-client-certificate and --kubelet-client-key arguments are set as appropriate (Automated)"
-        audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep"
-        tests:
-          bin_op: and
-          test_items:
-            - flag: "--kubelet-client-certificate"
-            - flag: "--kubelet-client-key"
-        remediation: |
-          Follow the Kubernetes documentation and set up the TLS connection between the
-          apiserver and kubelets. Then, edit API server pod specification file
-          $apiserverconf on the control plane node and set the
-          kubelet client certificate and key parameters as below.
-          --kubelet-client-certificate=<path/to/client-certificate-file>
-          --kubelet-client-key=<path/to/client-key-file>
-        scored: true
-
-      - id: 1.2.5
-        text: "Ensure that the --kubelet-certificate-authority argument is set as appropriate (Automated)"
-        audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep"
-        tests:
-          test_items:
-            - flag: "--kubelet-certificate-authority"
-        remediation: |
-          Follow the Kubernetes documentation and setup the TLS connection between
-          the apiserver and kubelets. Then, edit the API server pod specification file
-          $apiserverconf on the control plane node and set the
-          --kubelet-certificate-authority parameter to the path to the cert file for the certificate authority.
-          --kubelet-certificate-authority=<ca-string>
-        scored: true
-
-      - id: 1.2.6
-        text: "Ensure that the --authorization-mode argument is not set to AlwaysAllow (Automated)"
-        audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep"
-        tests:
-          test_items:
-            - flag: "--authorization-mode"
-              compare:
-                op: nothave
-                value: "AlwaysAllow"
-        remediation: |
-          Edit the API server pod specification file $apiserverconf
-          on the control plane node and set the --authorization-mode parameter to values other than AlwaysAllow.
-          One such example could be as below.
-          --authorization-mode=RBAC
-        scored: true
-
-      - id: 1.2.7
-        text: "Ensure that the --authorization-mode argument includes Node (Automated)"
-        audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep"
-        tests:
-          test_items:
-            - flag: "--authorization-mode"
-              compare:
-                op: has
-                value: "Node"
-        remediation: |
-          Edit the API server pod specification file $apiserverconf
-          on the control plane node and set the --authorization-mode parameter to a value that includes Node.
-          --authorization-mode=Node,RBAC
-        scored: true
-
-      - id: 1.2.8
-        text: "Ensure that the --authorization-mode argument includes RBAC (Automated)"
-        audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep"
-        tests:
-          test_items:
-            - flag: "--authorization-mode"
-              compare:
-                op: has
-                value: "RBAC"
-        remediation: |
-          Edit the API server pod specification file $apiserverconf
-          on the control plane node and set the --authorization-mode parameter to a value that includes RBAC,
-          for example `--authorization-mode=Node,RBAC`.
-        scored: true
-
-      - id: 1.2.9
-        text: "Ensure that the admission control plugin EventRateLimit is set (Manual)"
-        audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep"
-        tests:
-          test_items:
-            - flag: "--enable-admission-plugins"
-              compare:
-                op: has
-                value: "EventRateLimit"
-        remediation: |
-          Follow the Kubernetes documentation and set the desired limits in a configuration file.
-          Then, edit the API server pod specification file $apiserverconf
-          and set the below parameters.
-          --enable-admission-plugins=...,EventRateLimit,...
-          --admission-control-config-file=<path/to/configuration/file>
-        scored: false
-
-      - id: 1.2.10
-        text: "Ensure that the admission control plugin AlwaysAdmit is not set (Automated)"
-        audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep"
-        tests:
-          bin_op: or
-          test_items:
-            - flag: "--enable-admission-plugins"
-              compare:
-                op: nothave
-                value: AlwaysAdmit
-            - flag: "--enable-admission-plugins"
-              set: false
-        remediation: |
-          Edit the API server pod specification file $apiserverconf
-          on the control plane node and either remove the --enable-admission-plugins parameter, or set it to a
-          value that does not include AlwaysAdmit.
-        scored: true
-
-      - id: 1.2.11
-        text: "Ensure that the admission control plugin AlwaysPullImages is set (Manual)"
-        audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep"
-        tests:
-          test_items:
-            - flag: "--enable-admission-plugins"
-              compare:
-                op: has
-                value: "AlwaysPullImages"
-        remediation: |
-          Edit the API server pod specification file $apiserverconf
-          on the control plane node and set the --enable-admission-plugins parameter to include
-          AlwaysPullImages.
-          --enable-admission-plugins=...,AlwaysPullImages,...
-        scored: false
-
-      - id: 1.2.12
-        text: "Ensure that the admission control plugin ServiceAccount is set (Automated)"
-        audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep"
-        tests:
-          bin_op: or
-          test_items:
-            - flag: "--disable-admission-plugins"
-              compare:
-                op: nothave
-                value: "ServiceAccount"
-            - flag: "--disable-admission-plugins"
-              set: false
-        remediation: |
-          Follow the documentation and create ServiceAccount objects as per your environment.
-          Then, edit the API server pod specification file $apiserverconf
-          on the control plane node and ensure that the --disable-admission-plugins parameter is set to a
-          value that does not include ServiceAccount.
-        scored: true
-
-      - id: 1.2.13
-        text: "Ensure that the admission control plugin NamespaceLifecycle is set (Automated)"
-        audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep"
-        tests:
-          bin_op: or
-          test_items:
-            - flag: "--disable-admission-plugins"
-              compare:
-                op: nothave
-                value: "NamespaceLifecycle"
-            - flag: "--disable-admission-plugins"
-              set: false
-        remediation: |
-          Edit the API server pod specification file $apiserverconf
-          on the control plane node and set the --disable-admission-plugins parameter to
-          ensure it does not include NamespaceLifecycle.
-        scored: true
-
-      - id: 1.2.14
-        text: "Ensure that the admission control plugin NodeRestriction is set (Automated)"
-        audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep"
-        tests:
-          test_items:
-            - flag: "--enable-admission-plugins"
-              compare:
-                op: has
-                value: "NodeRestriction"
-        remediation: |
-          Follow the Kubernetes documentation and configure NodeRestriction plug-in on kubelets.
-          Then, edit the API server pod specification file $apiserverconf
-          on the control plane node and set the --enable-admission-plugins parameter to a
-          value that includes NodeRestriction.
-          --enable-admission-plugins=...,NodeRestriction,...
-        scored: true
-
-      - id: 1.2.15
-        text: "Ensure that the --profiling argument is set to false (Automated)"
-        audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep"
-        tests:
-          test_items:
-            - flag: "--profiling"
-              compare:
-                op: eq
-                value: false
-        remediation: |
-          Edit the API server pod specification file $apiserverconf
-          on the control plane node and set the below parameter.
-          --profiling=false
-        scored: true
-
-      - id: 1.2.16
-        text: "Ensure that the --audit-log-path argument is set (Automated)"
-        audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep"
-        tests:
-          test_items:
-            - flag: "--audit-log-path"
-        remediation: |
-          Edit the API server pod specification file $apiserverconf
-          on the control plane node and set the --audit-log-path parameter to a suitable path and
-          file where you would like audit logs to be written, for example,
-          --audit-log-path=/var/log/apiserver/audit.log
-        scored: true
-
-      - id: 1.2.17
-        text: "Ensure that the --audit-log-maxage argument is set to 30 or as appropriate (Automated)"
-        audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep"
-        tests:
-          test_items:
-            - flag: "--audit-log-maxage"
-              compare:
-                op: gte
-                value: 30
-        remediation: |
-          Edit the API server pod specification file $apiserverconf
-          on the control plane node and set the --audit-log-maxage parameter to 30
-          or as an appropriate number of days, for example,
-          --audit-log-maxage=30
-        scored: true
-
-      - id: 1.2.18
-        text: "Ensure that the --audit-log-maxbackup argument is set to 10 or as appropriate (Automated)"
-        audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep"
-        tests:
-          test_items:
-            - flag: "--audit-log-maxbackup"
-              compare:
-                op: gte
-                value: 10
-        remediation: |
-          Edit the API server pod specification file $apiserverconf
-          on the control plane node and set the --audit-log-maxbackup parameter to 10 or to an appropriate
-          value. For example,
-          --audit-log-maxbackup=10
-        scored: true
-
-      - id: 1.2.19
-        text: "Ensure that the --audit-log-maxsize argument is set to 100 or as appropriate (Automated)"
-        audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep"
-        tests:
-          test_items:
-            - flag: "--audit-log-maxsize"
-              compare:
-                op: gte
-                value: 100
-        remediation: |
-          Edit the API server pod specification file $apiserverconf
-          on the control plane node and set the --audit-log-maxsize parameter to an appropriate size in MB.
-          For example, to set it as 100 MB, --audit-log-maxsize=100
-        scored: true
-
-      - id: 1.2.20
-        text: "Ensure that the --request-timeout argument is set as appropriate (Manual)"
-        audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep"
-        type: manual
-        remediation: |
-          Edit the API server pod specification file $apiserverconf
-          and set the below parameter as appropriate and if needed.
-          For example, --request-timeout=300s
-        scored: false
-
-      - id: 1.2.21
-        text: "Ensure that the --service-account-lookup argument is set to true (Automated)"
-        audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep"
-        tests:
-          bin_op: or
-          test_items:
-            - flag: "--service-account-lookup"
-              set: false
-            - flag: "--service-account-lookup"
-              compare:
-                op: eq
-                value: true
-        remediation: |
-          Edit the API server pod specification file $apiserverconf
-          on the control plane node and set the below parameter.
-          --service-account-lookup=true
-          Alternatively, you can delete the --service-account-lookup parameter from this file so
-          that the default takes effect.
-        scored: true
-
-      - id: 1.2.22
-        text: "Ensure that the --service-account-key-file argument is set as appropriate (Automated)"
-        audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep"
-        tests:
-          test_items:
-            - flag: "--service-account-key-file"
-        remediation: |
-          Edit the API server pod specification file $apiserverconf
-          on the control plane node and set the --service-account-key-file parameter
-          to the public key file for service accounts. For example,
-          --service-account-key-file=<filename>
-        scored: true
-
-      - id: 1.2.23
-        text: "Ensure that the --etcd-certfile and --etcd-keyfile arguments are set as appropriate (Automated)"
-        audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep"
-        tests:
-          bin_op: and
-          test_items:
-            - flag: "--etcd-certfile"
-            - flag: "--etcd-keyfile"
-        remediation: |
-          Follow the Kubernetes documentation and set up the TLS connection between the apiserver and etcd.
-          Then, edit the API server pod specification file $apiserverconf
-          on the control plane node and set the etcd certificate and key file parameters.
-          --etcd-certfile=<path/to/client-certificate-file>
-          --etcd-keyfile=<path/to/client-key-file>
-        scored: true
-
-      - id: 1.2.24
-        text: "Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate (Automated)"
-        audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep"
-        tests:
-          bin_op: and
-          test_items:
-            - flag: "--tls-cert-file"
-            - flag: "--tls-private-key-file"
-        remediation: |
-          Follow the Kubernetes documentation and set up the TLS connection on the apiserver.
-          Then, edit the API server pod specification file $apiserverconf
-          on the control plane node and set the TLS certificate and private key file parameters.
-          --tls-cert-file=<path/to/tls-certificate-file>
-          --tls-private-key-file=<path/to/tls-key-file>
-        scored: true
-
-      - id: 1.2.25
-        text: "Ensure that the --client-ca-file argument is set as appropriate (Automated)"
-        audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep"
-        tests:
-          test_items:
-            - flag: "--client-ca-file"
-        remediation: |
-          Follow the Kubernetes documentation and set up the TLS connection on the apiserver.
-          Then, edit the API server pod specification file $apiserverconf
-          on the control plane node and set the client certificate authority file.
-          --client-ca-file=<path/to/client-ca-file>
-        scored: true
-
-      - id: 1.2.26
-        text: "Ensure that the --etcd-cafile argument is set as appropriate (Automated)"
-        audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep"
-        tests:
-          test_items:
-            - flag: "--etcd-cafile"
-        remediation: |
-          Follow the Kubernetes documentation and set up the TLS connection between the apiserver and etcd.
-          Then, edit the API server pod specification file $apiserverconf
-          on the control plane node and set the etcd certificate authority file parameter.
-          --etcd-cafile=<path/to/ca-file>
-        scored: true
-
-      - id: 1.2.27
-        text: "Ensure that the --encryption-provider-config argument is set as appropriate (Manual)"
-        audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep"
-        tests:
-          test_items:
-            - flag: "--encryption-provider-config"
-        remediation: |
-          Follow the Kubernetes documentation and configure a EncryptionConfig file.
-          Then, edit the API server pod specification file $apiserverconf
-          on the control plane node and set the --encryption-provider-config parameter to the path of that file.
-          For example, --encryption-provider-config=</path/to/EncryptionConfig/File>
-        scored: false
-
-      - id: 1.2.28
-        text: "Ensure that encryption providers are appropriately configured (Manual)"
-        audit: |
-          ENCRYPTION_PROVIDER_CONFIG=$(ps -ef | grep $apiserverbin | grep -- --encryption-provider-config | sed 's%.*encryption-provider-config[= ]\([^ ]*\).*%\1%')
-          if test -e $ENCRYPTION_PROVIDER_CONFIG; then grep -A1 'providers:' $ENCRYPTION_PROVIDER_CONFIG | tail -n1 | grep -o "[A-Za-z]*" | sed 's/^/provider=/'; fi
-        tests:
-          test_items:
-            - flag: "provider"
-              compare:
-                op: valid_elements
-                value: "aescbc,kms,secretbox"
-        remediation: |
-          Follow the Kubernetes documentation and configure a EncryptionConfig file.
-          In this file, choose aescbc, kms or secretbox as the encryption provider.
-        scored: false
-
-      - id: 1.2.29
-        text: "Ensure that the API Server only makes use of Strong Cryptographic Ciphers (Manual)"
-        audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep"
-        tests:
-          test_items:
-            - flag: "--tls-cipher-suites"
-              compare:
-                op: valid_elements
-                value: "TLS_AES_128_GCM_SHA256,TLS_AES_256_GCM_SHA384,TLS_CHACHA20_POLY1305_SHA256,TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256"
-        remediation: |
-          Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml
-          on the control plane node and set the below parameter.
-          --tls-cipher-suites=TLS_AES_128_GCM_SHA256,TLS_AES_256_GCM_SHA384,TLS_CHACHA20_POLY1305_SHA256,
-          TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
-          TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
-          TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256,
-          TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,
-          TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256
-        scored: false
-
-      - id: 1.2.30
-        text: "Ensure that the --service-account-extend-token-expiration parameter is set to false (Automated)"
-        audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep"
-        tests:
-          test_items:
-            - flag: "--service-account-extend-token-expiration"
-              compare:
-                op: eq
-                value: false
-        remediation: |
-          Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml on the Control Plane node and set the --service-account-extend-token-expiration parameter to false.
-          `--service-account-extend-token-expiration=false`
-          By default, this parameter is set to true.
-        scored: true
-
-  - id: 1.3
-    text: "Controller Manager"
-    checks:
-      - id: 1.3.1
-        text: "Ensure that the --terminated-pod-gc-threshold argument is set as appropriate (Manual)"
-        audit: "/bin/ps -ef | grep $controllermanagerbin | grep -v grep"
-        tests:
-          test_items:
-            - flag: "--terminated-pod-gc-threshold"
-        remediation: |
-          Edit the Controller Manager pod specification file $controllermanagerconf
-          on the control plane node and set the --terminated-pod-gc-threshold to an appropriate threshold,
-          for example, --terminated-pod-gc-threshold=10
-        scored: false
-
-      - id: 1.3.2
-        text: "Ensure that the --profiling argument is set to false (Automated)"
-        audit: "/bin/ps -ef | grep $controllermanagerbin | grep -v grep"
-        tests:
-          test_items:
-            - flag: "--profiling"
-              compare:
-                op: eq
-                value: false
-        remediation: |
-          Edit the Controller Manager pod specification file $controllermanagerconf
-          on the control plane node and set the below parameter.
-          --profiling=false
-        scored: true
-
-      - id: 1.3.3
-        text: "Ensure that the --use-service-account-credentials argument is set to true (Automated)"
-        audit: "/bin/ps -ef | grep $controllermanagerbin | grep -v grep"
-        tests:
-          test_items:
-            - flag: "--use-service-account-credentials"
-              compare:
-                op: noteq
-                value: false
-        remediation: |
-          Edit the Controller Manager pod specification file $controllermanagerconf
-          on the control plane node to set the below parameter.
-          --use-service-account-credentials=true
-        scored: true
-
-      - id: 1.3.4
-        text: "Ensure that the --service-account-private-key-file argument is set as appropriate (Automated)"
-        audit: "/bin/ps -ef | grep $controllermanagerbin | grep -v grep"
-        tests:
-          test_items:
-            - flag: "--service-account-private-key-file"
-        remediation: |
-          Edit the Controller Manager pod specification file $controllermanagerconf
-          on the control plane node and set the --service-account-private-key-file parameter
-          to the private key file for service accounts.
-          --service-account-private-key-file=<filename>
-        scored: true
-
-      - id: 1.3.5
-        text: "Ensure that the --root-ca-file argument is set as appropriate (Automated)"
-        audit: "/bin/ps -ef | grep $controllermanagerbin | grep -v grep"
-        tests:
-          test_items:
-            - flag: "--root-ca-file"
-        remediation: |
-          Edit the Controller Manager pod specification file $controllermanagerconf
-          on the control plane node and set the --root-ca-file parameter to the certificate bundle file`.
-          --root-ca-file=<path/to/file>
-        scored: true
-
-      - id: 1.3.6
-        text: "Ensure that the RotateKubeletServerCertificate argument is set to true (Automated)"
-        audit: "/bin/ps -ef | grep $controllermanagerbin | grep -v grep"
-        tests:
-          bin_op: or
-          test_items:
-            - flag: "--feature-gates"
-              compare:
-                op: nothave
-                value: "RotateKubeletServerCertificate=false"
-              set: true
-            - flag: "--feature-gates"
-              set: false
-        remediation: |
-          Edit the Controller Manager pod specification file $controllermanagerconf
-          on the control plane node and set the --feature-gates parameter to include RotateKubeletServerCertificate=true.
-          --feature-gates=RotateKubeletServerCertificate=true
-        scored: true
-
-      - id: 1.3.7
-        text: "Ensure that the --bind-address argument is set to 127.0.0.1 (Automated)"
-        audit: "/bin/ps -ef | grep $controllermanagerbin | grep -v grep"
-        tests:
-          bin_op: or
-          test_items:
-            - flag: "--bind-address"
-              compare:
-                op: eq
-                value: "127.0.0.1"
-            - flag: "--bind-address"
-              set: false
-        remediation: |
-          Edit the Controller Manager pod specification file $controllermanagerconf
-          on the control plane node and ensure the correct value for the --bind-address parameter
-        scored: true
-
-  - id: 1.4
-    text: "Scheduler"
-    checks:
-      - id: 1.4.1
-        text: "Ensure that the --profiling argument is set to false (Automated)"
-        audit: "/bin/ps -ef | grep $schedulerbin | grep -v grep"
-        tests:
-          test_items:
-            - flag: "--profiling"
-              compare:
-                op: eq
-                value: false
-        remediation: |
-          Edit the Scheduler pod specification file $schedulerconf file
-          on the control plane node and set the below parameter.
-          --profiling=false
-        scored: true
-
-      - id: 1.4.2
-        text: "Ensure that the --bind-address argument is set to 127.0.0.1 (Automated)"
-        audit: "/bin/ps -ef | grep $schedulerbin | grep -v grep"
-        tests:
-          bin_op: or
-          test_items:
-            - flag: "--bind-address"
-              compare:
-                op: eq
-                value: "127.0.0.1"
-            - flag: "--bind-address"
-              set: false
-        remediation: |
-          Edit the Scheduler pod specification file $schedulerconf
-          on the control plane node and ensure the correct value for the --bind-address parameter
-        scored: true

cfg/cis-1.11/node.yaml

@@ -1,509 +0,0 @@
----
-controls:
-version: "cis-1.11"
-id: 4
-text: "Worker Node Security Configuration"
-type: "node"
-groups:
-  - id: 4.1
-    text: "Worker Node Configuration Files"
-    checks:
-      - id: 4.1.1
-        text: "Ensure that the kubelet service file permissions are set to 600 or more restrictive (Automated)"
-        audit: '/bin/sh -c ''if test -e $kubeletsvc; then stat -c permissions=%a $kubeletsvc; fi'' '
-        tests:
-          test_items:
-            - flag: "permissions"
-              compare:
-                op: bitmask
-                value: "600"
-        remediation: |
-          Run the below command (based on the file location on your system) on the each worker node.
-          For example, chmod 600 $kubeletsvc
-        scored: true
-
-      - id: 4.1.2
-        text: "Ensure that the kubelet service file ownership is set to root:root (Automated)"
-        audit: '/bin/sh -c "if test -e $kubeletsvc; then stat -c %U:%G $kubeletsvc; else echo \"File not found\"; fi"'
-        tests:
-          bin_op: or
-          test_items:
-            - flag: root:root
-            - flag: "File not found"
-        remediation: |
-            Run the below command (based on the file location on your system) on the each worker node.
-            For example,
-            chown root:root $kubeletsvc
-        scored: true
-
-      - id: 4.1.3
-        text: "If proxy kubeconfig file exists ensure permissions are set to 600 or more restrictive (Manual)"
-        audit: '/bin/sh -c ''if test -e $proxykubeconfig; then stat -c permissions=%a $proxykubeconfig; fi'' '
-        tests:
-          bin_op: or
-          test_items:
-            - flag: "permissions"
-              set: true
-              compare:
-                op: bitmask
-                value: "600"
-        remediation: |
-          Run the below command (based on the file location on your system) on the each worker node.
-          For example,
-          chmod 600 $proxykubeconfig
-        scored: false
-
-      - id: 4.1.4
-        text: "If proxy kubeconfig file exists ensure ownership is set to root:root (Manual)"
-        audit: '/bin/sh -c ''if test -e $proxykubeconfig; then stat -c %U:%G $proxykubeconfig; fi'' '
-        tests:
-          bin_op: or
-          test_items:
-            - flag: root:root
-        remediation: |
-          Run the below command (based on the file location on your system) on the each worker node.
-          For example, chown root:root $proxykubeconfig
-        scored: false
-
-      - id: 4.1.5
-        text: "Ensure that the --kubeconfig kubelet.conf file permissions are set to 600 or more restrictive (Automated)"
-        audit: '/bin/sh -c ''if test -e $kubeletkubeconfig; then stat -c permissions=%a $kubeletkubeconfig; fi'' '
-        tests:
-          test_items:
-            - flag: "permissions"
-              compare:
-                op: bitmask
-                value: "600"
-        remediation: |
-          Run the below command (based on the file location on your system) on the each worker node.
-          For example,
-          chmod 600 $kubeletkubeconfig
-        scored: true
-
-      - id: 4.1.6
-        text: "Ensure that the --kubeconfig kubelet.conf file ownership is set to root:root (Automated)"
-        audit: '/bin/sh -c ''if test -e $kubeletkubeconfig; then stat -c %U:%G $kubeletkubeconfig; fi'' '
-        tests:
-          test_items:
-            - flag: root:root
-        remediation: |
-          Run the below command (based on the file location on your system) on the each worker node.
-          For example,
-          chown root:root $kubeletkubeconfig
-        scored: true
-
-      - id: 4.1.7
-        text: "Ensure that the certificate authorities file permissions are set to 644 or more restrictive (Manual)"
-        audit: |
-          CAFILE=$(ps -ef | grep kubelet | grep -v apiserver | grep -- --client-ca-file= | awk -F '--client-ca-file=' '{print $2}' | awk '{print $1}' | uniq)
-          if test -z $CAFILE; then CAFILE=$kubeletcafile; fi
-          if test -e $CAFILE; then stat -c permissions=%a $CAFILE; fi
-        tests:
-          test_items:
-            - flag: "permissions"
-              compare:
-                op: bitmask
-                value: "644"
-        remediation: |
-          Run the following command to modify the file permissions of the
-          --client-ca-file chmod 644 <filename>
-        scored: false
-
-      - id: 4.1.8
-        text: "Ensure that the client certificate authorities file ownership is set to root:root (Manual)"
-        audit: |
-          CAFILE=$(ps -ef | grep kubelet | grep -v apiserver | grep -- --client-ca-file= | awk -F '--client-ca-file=' '{print $2}' | awk '{print $1}' | uniq)
-          if test -z $CAFILE; then CAFILE=$kubeletcafile; fi
-          if test -e $CAFILE; then stat -c %U:%G $CAFILE; fi
-        tests:
-          test_items:
-            - flag: root:root
-              compare:
-                op: eq
-                value: root:root
-        remediation: |
-          Run the following command to modify the ownership of the --client-ca-file.
-          chown root:root <filename>
-        scored: false
-
-      - id: 4.1.9
-        text: "If the kubelet config.yaml configuration file is being used validate permissions set to 600 or more restrictive (Automated)"
-        audit: '/bin/sh -c ''if test -e $kubeletconf; then stat -c permissions=%a $kubeletconf; fi'' '
-        tests:
-          test_items:
-            - flag: "permissions"
-              compare:
-                op: bitmask
-                value: "600"
-        remediation: |
-          Run the following command (using the config file location identified in the Audit step)
-          chmod 600 $kubeletconf
-        scored: true
-
-      - id: 4.1.10
-        text: "If the kubelet config.yaml configuration file is being used validate file ownership is set to root:root (Automated)"
-        audit: '/bin/sh -c ''if test -e $kubeletconf; then stat -c %U:%G $kubeletconf; fi'' '
-        tests:
-          test_items:
-            - flag: root:root
-        remediation: |
-          Run the following command (using the config file location identified in the Audit step)
-          chown root:root $kubeletconf
-        scored: true
-
-  - id: 4.2
-    text: "Kubelet"
-    checks:
-      - id: 4.2.1
-        text: "Ensure that the --anonymous-auth argument is set to false (Automated)"
-        audit: "/bin/ps -fC $kubeletbin"
-        audit_config: "/bin/cat $kubeletconf"
-        tests:
-          test_items:
-            - flag: "--anonymous-auth"
-              path: '{.authentication.anonymous.enabled}'
-              compare:
-                op: eq
-                value: false
-        remediation: |
-          If using a Kubelet config file, edit the file to set `authentication: anonymous: enabled` to
-          `false`.
-          If using executable arguments, edit the kubelet service file
-          $kubeletsvc on each worker node and
-          set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable.
-          `--anonymous-auth=false`
-          Based on your system, restart the kubelet service. For example,
-          systemctl daemon-reload
-          systemctl restart kubelet.service
-        scored: true
-
-      - id: 4.2.2
-        text: "Ensure that the --authorization-mode argument is not set to AlwaysAllow (Automated)"
-        audit: "/bin/ps -fC $kubeletbin"
-        audit_config: "/bin/cat $kubeletconf"
-        tests:
-          test_items:
-            - flag: --authorization-mode
-              path: '{.authorization.mode}'
-              compare:
-                op: nothave
-                value: AlwaysAllow
-        remediation: |
-          If using a Kubelet config file, edit the file to set `authorization.mode` to Webhook. If
-          using executable arguments, edit the kubelet service file
-          $kubeletsvc on each worker node and
-          set the below parameter in KUBELET_AUTHZ_ARGS variable.
-          --authorization-mode=Webhook
-          Based on your system, restart the kubelet service. For example,
-          systemctl daemon-reload
-          systemctl restart kubelet.service
-        scored: true
-
-      - id: 4.2.3
-        text: "Ensure that the --client-ca-file argument is set as appropriate (Automated)"
-        audit: "/bin/ps -fC $kubeletbin"
-        audit_config: "/bin/cat $kubeletconf"
-        tests:
-          test_items:
-            - flag: --client-ca-file
-              path: '{.authentication.x509.clientCAFile}'
-        remediation: |
-          If using a Kubelet config file, edit the file to set `authentication.x509.clientCAFile` to
-          the location of the client CA file.
-          If using command line arguments, edit the kubelet service file
-          $kubeletsvc on each worker node and
-          set the below parameter in KUBELET_AUTHZ_ARGS variable.
-          --client-ca-file=<path/to/client-ca-file>
-          Based on your system, restart the kubelet service. For example,
-          systemctl daemon-reload
-          systemctl restart kubelet.service
-        scored: true
-
-      - id: 4.2.4
-        text: "Verify that if defined, the --read-only-port argument is set to 0 (Manual)"
-        audit: "/bin/ps -fC $kubeletbin"
-        audit_config: "/bin/cat $kubeletconf"
-        tests:
-          bin_op: or
-          test_items:
-            - flag: "--read-only-port"
-              path: '{.readOnlyPort}'
-              compare:
-                op: eq
-                value: 0
-            - flag: "--read-only-port"
-              path: '{.readOnlyPort}'
-              set: false
-        remediation: |
-          If using a Kubelet config file, edit the file to set `readOnlyPort` to 0.
-          If using command line arguments, edit the kubelet service file
-          $kubeletsvc on each worker node and
-          set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable.
-          --read-only-port=0
-          Based on your system, restart the kubelet service. For example,
-          systemctl daemon-reload
-          systemctl restart kubelet.service
-        scored: false
-
-      - id: 4.2.5
-        text: "Ensure that the --streaming-connection-idle-timeout argument is not set to 0 (Manual)"
-        audit: "/bin/ps -fC $kubeletbin"
-        audit_config: "/bin/cat $kubeletconf"
-        tests:
-          test_items:
-            - flag: --streaming-connection-idle-timeout
-              path: '{.streamingConnectionIdleTimeout}'
-              compare:
-                op: noteq
-                value: 0
-            - flag: --streaming-connection-idle-timeout
-              path: '{.streamingConnectionIdleTimeout}'
-              set: false
-          bin_op: or
-        remediation: |
-          If using a Kubelet config file, edit the file to set `streamingConnectionIdleTimeout` to a
-          value other than 0.
-          If using command line arguments, edit the kubelet service file
-          $kubeletsvc on each worker node and
-          set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable.
-          --streaming-connection-idle-timeout=5m
-          Based on your system, restart the kubelet service. For example,
-          systemctl daemon-reload
-          systemctl restart kubelet.service
-        scored: false
-
-      - id: 4.2.6
-        text: "Ensure that the --make-iptables-util-chains argument is set to true (Automated)"
-        audit: "/bin/ps -fC $kubeletbin"
-        audit_config: "/bin/cat $kubeletconf"
-        tests:
-          test_items:
-            - flag: --make-iptables-util-chains
-              path: '{.makeIPTablesUtilChains}'
-              compare:
-                op: eq
-                value: true
-            - flag: --make-iptables-util-chains
-              path: '{.makeIPTablesUtilChains}'
-              set: false
-          bin_op: or
-        remediation: |
-          If using a Kubelet config file, edit the file to set `makeIPTablesUtilChains` to `true`.
-          If using command line arguments, edit the kubelet service file
-          $kubeletsvc on each worker node and
-          remove the --make-iptables-util-chains argument from the
-          KUBELET_SYSTEM_PODS_ARGS variable.
-          Based on your system, restart the kubelet service. For example:
-          systemctl daemon-reload
-          systemctl restart kubelet.service
-        scored: true
-
-      - id: 4.2.7
-        text: "Ensure that the --hostname-override argument is not set (Manual)"
-        # This is one of those properties that can only be set as a command line argument.
-        # To check if the property is set as expected, we need to parse the kubelet command
-        # instead reading the Kubelet Configuration file.
-        audit: "/bin/ps -fC $kubeletbin"
-        tests:
-          test_items:
-            - flag: --hostname-override
-              set: false
-        remediation: |
-          Edit the kubelet service file $kubeletsvc
-          on each worker node and remove the --hostname-override argument from the
-          KUBELET_SYSTEM_PODS_ARGS variable.
-          Based on your system, restart the kubelet service. For example,
-          systemctl daemon-reload
-          systemctl restart kubelet.service
-        scored: false
-
-      - id: 4.2.8
-        text: "Ensure that the eventRecordQPS argument is set to a level which ensures appropriate event capture (Manual)"
-        audit: "/bin/ps -fC $kubeletbin"
-        audit_config: "/bin/cat $kubeletconf"
-        tests:
-          test_items:
-            - flag: --event-qps
-              path: '{.eventRecordQPS}'
-              compare:
-                op: gte
-                value: 0
-            - flag: --event-qps
-              path: '{.eventRecordQPS}'
-              set: false
-          bin_op: or
-        remediation: |
-          If using a Kubelet config file, edit the file to set `eventRecordQPS` to an appropriate level.
-          If using command line arguments, edit the kubelet service file
-          $kubeletsvc on each worker node and
-          set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable.
-          Based on your system, restart the kubelet service. For example,
-          systemctl daemon-reload
-          systemctl restart kubelet.service
-        scored: false
-
-      - id: 4.2.9
-        text: "Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate (Manual)"
-        audit: "/bin/ps -fC $kubeletbin"
-        audit_config: "/bin/cat $kubeletconf"
-        tests:
-          test_items:
-            - flag: --tls-cert-file
-              path: '{.tlsCertFile}'
-            - flag: --tls-private-key-file
-              path: '{.tlsPrivateKeyFile}'
-        remediation: |
-          If using a Kubelet config file, edit the file to set `tlsCertFile` to the location
-          of the certificate file to use to identify this Kubelet, and `tlsPrivateKeyFile`
-          to the location of the corresponding private key file.
-          If using command line arguments, edit the kubelet service file
-          $kubeletsvc on each worker node and
-          set the below parameters in KUBELET_CERTIFICATE_ARGS variable.
-          --tls-cert-file=<path/to/tls-certificate-file>
-          --tls-private-key-file=<path/to/tls-key-file>
-          Based on your system, restart the kubelet service. For example,
-          systemctl daemon-reload
-          systemctl restart kubelet.service
-        scored: false
-
-      - id: 4.2.10
-        text: "Ensure that the --rotate-certificates argument is not set to false (Automated)"
-        audit: "/bin/ps -fC $kubeletbin"
-        audit_config: "/bin/cat $kubeletconf"
-        tests:
-          test_items:
-            - flag: --rotate-certificates
-              path: '{.rotateCertificates}'
-              compare:
-                op: eq
-                value: true
-            - flag: --rotate-certificates
-              path: '{.rotateCertificates}'
-              set: false
-          bin_op: or
-        remediation: |
-          If using a Kubelet config file, edit the file to add the line `rotateCertificates` to `true` or
-          remove it altogether to use the default value.
-          If using command line arguments, edit the kubelet service file
-          $kubeletsvc on each worker node and
-          remove --rotate-certificates=false argument from the KUBELET_CERTIFICATE_ARGS
-          variable.
-          Based on your system, restart the kubelet service. For example,
-          systemctl daemon-reload
-          systemctl restart kubelet.service
-        scored: true
-
-      - id: 4.2.11
-        text: "Verify that the RotateKubeletServerCertificate argument is set to true (Manual)"
-        audit: "/bin/ps -fC $kubeletbin"
-        audit_config: "/bin/cat $kubeletconf"
-        tests:
-          bin_op: or
-          test_items:
-            - flag: RotateKubeletServerCertificate
-              path: '{.featureGates.RotateKubeletServerCertificate}'
-              compare:
-                op: nothave
-                value: false
-            - flag: RotateKubeletServerCertificate
-              path: '{.featureGates.RotateKubeletServerCertificate}'
-              set: false
-        remediation: |
-          Edit the kubelet service file $kubeletsvc
-          on each worker node and set the below parameter in KUBELET_CERTIFICATE_ARGS variable.
-          --feature-gates=RotateKubeletServerCertificate=true
-          Based on your system, restart the kubelet service. For example:
-          systemctl daemon-reload
-          systemctl restart kubelet.service
-        scored: false
-
-      - id: 4.2.12
-        text: "Ensure that the Kubelet only makes use of Strong Cryptographic Ciphers (Manual)"
-        audit: "/bin/ps -fC $kubeletbin"
-        audit_config: "/bin/cat $kubeletconf"
-        tests:
-          test_items:
-            - flag: --tls-cipher-suites
-              path: '{range .tlsCipherSuites[:]}{}{'',''}{end}'
-              compare:
-                op: valid_elements
-                value: TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256
-        remediation: |
-          If using a Kubelet config file, edit the file to set `tlsCipherSuites` to
-          TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256
-          or to a subset of these values.
-          If using executable arguments, edit the kubelet service file
-          $kubeletsvc on each worker node and
-          set the --tls-cipher-suites parameter as follows, or to a subset of these values.
-          --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256
-          Based on your system, restart the kubelet service. For example:
-          systemctl daemon-reload
-          systemctl restart kubelet.service
-        scored: false
-
-      - id: 4.2.13
-        text: "Ensure that a limit is set on pod PIDs (Manual)"
-        audit: "/bin/ps -fC $kubeletbin"
-        audit_config: "/bin/cat $kubeletconf"
-        tests:
-          test_items:
-            - flag: --pod-max-pids
-              path: '{.podPidsLimit}'
-        remediation: |
-          Decide on an appropriate level for this parameter and set it,
-          either via the --pod-max-pids command line parameter or the PodPidsLimit configuration file setting.
-        scored: false
-
-      - id: 4.2.14
-        text: "Ensure that the --seccomp-default parameter is set to true (Manual)"
-        audit: "/bin/ps -fC $kubeletbin"
-        audit_config: "/bin/cat $kubeletconf"
-        tests:
-          test_items:
-            - flag: --seccomp-default
-              path: '{.seccompDefault}'
-        remediation: |
-          Set the parameter, either via the --seccomp-default command line parameter or the
-          seccompDefault configuration file setting.
-          By default the seccomp profile is not enabled.
-        scored: false
-
-      - id: 4.2.15
-        text: "Ensure that the --IPAddressDeny is set to any (Manual)"
-        audit: "/bin/ps -fC $kubeletbin"
-        audit_config: "/bin/cat $kubeletconf"
-        tests:
-          test_items:
-            - flag: --IPAddressDeny
-              path: '{.IPAddressDeny}'
-        remediation: |
-         Configuring the setting IPAddressDeny=any will deny service to any IP address not specified in the complimentary setting IPAddressAllow configuration parameter (
-         IPAddressDeny=any
-         IPAddressAllow={{ kubelet_secure_addresses }}
-         *Note
-           kubelet_secure_addresses: "localhost link-local {{ kube_pods_subnets |regex_replace(',', ' ') }} {{ kube_node_addresses }} {{ loadbalancer_apiserver.address | default('')"
-         By default IPAddressDeny is not enabled.
-        scored: false
-
-  - id: 4.3
-    text: "kube-proxy"
-    checks:
-      - id: 4.3.1
-        text: "Ensure that the kube-proxy metrics service is bound to localhost (Automated)"
-        audit: "/bin/ps -fC $proxybin"
-        audit_config: "/bin/sh -c 'if test -e $proxykubeconfig; then cat $proxykubeconfig; fi'"
-        tests:
-          bin_op: or
-          test_items:
-            - flag: "--metrics-bind-address"
-              path: '{.metricsBindAddress}'
-              compare:
-                op: has
-                value: "127.0.0.1"
-            - flag: "--metrics-bind-address"
-              path: '{.metricsBindAddress}'
-              set: false
-        remediation: |
-           Modify or remove any values which bind the metrics service to a non-localhost address.
-           The default value is 127.0.0.1:10249.
-        scored: true

cfg/cis-1.11/policies.yaml

@@ -1,560 +0,0 @@
----
-controls:
-version: "cis-1.11"
-id: 5
-text: "Kubernetes Policies"
-type: "policies"
-groups:
-  - id: 5.1
-    text: "RBAC and Service Accounts"
-    checks:
-      - id: 5.1.1
-        text: "Ensure that the cluster-admin role is only used where required (Manual)"
-        audit: |
-          kubectl get clusterrolebindings -o=custom-columns=NAME:.metadata.name,ROLE:.roleRef.name,SUBJECT:.subjects[*].name --no-headers | while read -r role_name role_binding subject
-          do
-            if [[ "${role_name}" != "cluster-admin" && "${role_binding}" == "cluster-admin" ]]; then
-              is_compliant="false"
-            else
-              is_compliant="true"
-            fi;
-            echo "**role_name: ${role_name} role_binding: ${role_binding} subject: ${subject} is_compliant: ${is_compliant}"
-          done
-        use_multiple_values: true
-        tests:
-          test_items:
-            - flag: "is_compliant"
-              compare:
-                op: eq
-                value: true
-        remediation: |
-          Identify all clusterrolebindings to the cluster-admin role. Check if they are used and
-          if they need this role or if they could use a role with fewer privileges.
-          Where possible, first bind users to a lower privileged role and then remove the
-          clusterrolebinding to the cluster-admin role : kubectl delete clusterrolebinding [name]
-          Condition: is_compliant is false if rolename is not cluster-admin and rolebinding is cluster-admin.
-        scored: false
-
-      - id: 5.1.2
-        text: "Minimize access to secrets (Manual)"
-        audit: "echo \"canGetListWatchSecretsAsSystemAuthenticated: $(kubectl auth can-i get,list,watch secrets --all-namespaces --as=system:authenticated)\""
-        tests:
-          test_items:
-            - flag: "canGetListWatchSecretsAsSystemAuthenticated"
-              compare:
-                op: eq
-                value: no
-        remediation: |
-          Where possible, remove get, list and watch access to Secret objects in the cluster.
-        scored: false
-
-      - id: 5.1.3
-        text: "Minimize wildcard use in Roles and ClusterRoles (Manual)"
-        audit: |
-          # Check Roles
-          kubectl get roles --all-namespaces -o custom-columns=ROLE_NAMESPACE:.metadata.namespace,ROLE_NAME:.metadata.name --no-headers | while read -r role_namespace role_name
-          do
-            role_rules=$(kubectl get role -n "${role_namespace}" "${role_name}" -o=json | jq -c '.rules')
-            if echo "${role_rules}" | grep -q "\[\"\*\"\]"; then
-              role_is_compliant="false"
-            else
-              role_is_compliant="true"
-            fi;
-            echo "**role_name: ${role_name} role_namespace: ${role_namespace} role_rules: ${role_rules} role_is_compliant: ${role_is_compliant}"
-          done
-
-          # Check ClusterRoles
-          kubectl get clusterroles -o custom-columns=CLUSTERROLE_NAME:.metadata.name --no-headers | while read -r clusterrole_name
-          do
-            clusterrole_rules=$(kubectl get clusterrole "${clusterrole_name}" -o=json | jq -c '.rules')
-            if echo "${clusterrole_rules}" | grep -q "\[\"\*\"\]"; then
-              clusterrole_is_compliant="false"
-            else
-              clusterrole_is_compliant="true"
-            fi;
-          echo "**clusterrole_name: ${clusterrole_name} clusterrole_rules: ${clusterrole_rules} clusterrole_is_compliant: ${clusterrole_is_compliant}"
-          done
-        use_multiple_values: true
-        tests:
-          bin_op: or
-          test_items:
-            - flag: "role_is_compliant"
-              compare:
-                op: eq
-                value: true
-              set: true
-            - flag: "clusterrole_is_compliant"
-              compare:
-                op: eq
-                value: true
-              set: true
-        remediation: |
-          Where possible replace any use of wildcards ["*"] in roles and clusterroles with specific
-          objects or actions.
-          Condition: role_is_compliant is false if ["*"] is found in rules.
-          Condition: clusterrole_is_compliant is false if ["*"] is found in rules.
-        scored: false
-
-      - id: 5.1.4
-        text: "Minimize access to create pods (Manual)"
-        audit: |
-          echo "canCreatePodsAsSystemAuthenticated: $(kubectl auth can-i create pods --all-namespaces --as=system:authenticated)"
-        tests:
-          test_items:
-            - flag: "canCreatePodsAsSystemAuthenticated"
-              compare:
-                op: eq
-                value: no
-        remediation: |
-          Where possible, remove create access to pod objects in the cluster.
-        scored: false
-
-      - id: 5.1.5
-        text: "Ensure that default service accounts are not actively used (Manual)"
-        audit: |
-          kubectl get serviceaccount --all-namespaces --field-selector metadata.name=default -o=json | jq -r '.items[] | " namespace: \(.metadata.namespace), kind: \(.kind), name: \(.metadata.name), automountServiceAccountToken: \(.automountServiceAccountToken | if . == null then "notset" else . end )"' | xargs -L 1
-        use_multiple_values: true
-        tests:
-          test_items:
-            - flag: "automountServiceAccountToken"
-              compare:
-                op: eq
-                value: false
-              set: true
-        remediation: |
-          Create explicit service accounts wherever a Kubernetes workload requires specific access
-          to the Kubernetes API server.
-          Modify the configuration of each default service account to include this value
-          `automountServiceAccountToken: false`.
-        scored: false
-
-      - id: 5.1.6
-        text: "Ensure that Service Account Tokens are only mounted where necessary (Manual)"
-        audit: |
-          kubectl get pods --all-namespaces -o custom-columns=POD_NAMESPACE:.metadata.namespace,POD_NAME:.metadata.name,POD_SERVICE_ACCOUNT:.spec.serviceAccount,POD_IS_AUTOMOUNTSERVICEACCOUNTTOKEN:.spec.automountServiceAccountToken --no-headers | while read -r pod_namespace pod_name pod_service_account pod_is_automountserviceaccounttoken
-          do
-            # Retrieve automountServiceAccountToken's value for ServiceAccount and Pod, set to notset if null or <none>.
-            svacc_is_automountserviceaccounttoken=$(kubectl get serviceaccount -n "${pod_namespace}" "${pod_service_account}" -o json | jq -r '.automountServiceAccountToken' | sed -e 's/<none>/notset/g' -e 's/null/notset/g')
-            pod_is_automountserviceaccounttoken=$(echo "${pod_is_automountserviceaccounttoken}" | sed -e 's/<none>/notset/g' -e 's/null/notset/g')
-            if [ "${svacc_is_automountserviceaccounttoken}" = "false" ] && ( [ "${pod_is_automountserviceaccounttoken}" = "false" ] || [ "${pod_is_automountserviceaccounttoken}" = "notset" ] ); then
-              is_compliant="true"
-            elif [ "${svacc_is_automountserviceaccounttoken}" = "true" ] && [ "${pod_is_automountserviceaccounttoken}" = "false" ]; then
-              is_compliant="true"
-            else
-              is_compliant="false"
-            fi
-            echo "**namespace: ${pod_namespace} pod_name: ${pod_name} service_account: ${pod_service_account} pod_is_automountserviceaccounttoken: ${pod_is_automountserviceaccounttoken} svacc_is_automountServiceAccountToken: ${svacc_is_automountserviceaccounttoken} is_compliant: ${is_compliant}"
-          done
-        use_multiple_values: true
-        tests:
-          test_items:
-            - flag: "is_compliant"
-              compare:
-                op: eq
-                value: true
-        remediation: |
-          Modify the definition of ServiceAccounts and Pods which do not need to mount service
-          account tokens to disable it, with `automountServiceAccountToken: false`.
-          If both the ServiceAccount and the Pod's .spec specify a value for automountServiceAccountToken, the Pod spec takes precedence.
-          Condition: Pod is_compliant to true when
-            - ServiceAccount is automountServiceAccountToken: false and Pod is automountServiceAccountToken: false or notset
-            - ServiceAccount is automountServiceAccountToken: true notset and Pod is automountServiceAccountToken: false
-        scored: false
-
-      - id: 5.1.7
-        text: "Avoid use of system:masters group (Manual)"
-        type: "manual"
-        remediation: |
-          Remove the system:masters group from all users in the cluster.
-        scored: false
-
-      - id: 5.1.8
-        text: "Limit use of the Bind, Impersonate and Escalate permissions in the Kubernetes cluster (Manual)"
-        type: "manual"
-        remediation: |
-          Where possible, remove the impersonate, bind and escalate rights from subjects.
-        scored: false
-
-      - id: 5.1.9
-        text: "Minimize access to create persistent volumes (Manual)"
-        type: "manual"
-        remediation: |
-          Where possible, remove create access to PersistentVolume objects in the cluster.
-        scored: false
-
-      - id: 5.1.10
-        text: "Minimize access to the proxy sub-resource of nodes (Manual)"
-        type: "manual"
-        remediation: |
-          Where possible, remove access to the proxy sub-resource of node objects.
-        scored: false
-
-      - id: 5.1.11
-        text: "Minimize access to the approval sub-resource of certificatesigningrequests objects (Manual)"
-        type: "manual"
-        remediation: |
-          Where possible, remove access to the approval sub-resource of certificatesigningrequests objects.
-        scored: false
-
-      - id: 5.1.12
-        text: "Minimize access to webhook configuration objects (Manual)"
-        type: "manual"
-        remediation: |
-          Where possible, remove access to the validatingwebhookconfigurations or mutatingwebhookconfigurations objects
-        scored: false
-
-      - id: 5.1.13
-        text: "Minimize access to the service account token creation (Manual)"
-        type: "manual"
-        remediation: |
-          Where possible, remove access to the token sub-resource of serviceaccount objects.
-        scored: false
-
-  - id: 5.2
-    text: "Pod Security Standards"
-    checks:
-      - id: 5.2.1
-        text: "Ensure that the cluster has at least one active policy control mechanism in place (Manual)"
-        type: "manual"
-        remediation: |
-          Ensure that either Pod Security Admission or an external policy control system is in place
-          for every namespace which contains user workloads.
-        scored: false
-
-      - id: 5.2.2
-        text: "Minimize the admission of privileged containers (Manual)"
-        audit: |
-          kubectl get pods --all-namespaces -o custom-columns=POD_NAME:.metadata.name,POD_NAMESPACE:.metadata.namespace --no-headers | while read -r pod_name pod_namespace
-          do
-            # Retrieve container(s) for each Pod.
-            kubectl get pod "${pod_name}" --namespace "${pod_namespace}" -o json | jq -c '.spec.containers[]' | while read -r container
-            do
-              # Retrieve container's name.
-              container_name=$(echo ${container} | jq -r '.name')
-              # Retrieve container's .securityContext.privileged value.
-              container_privileged=$(echo ${container} | jq -r '.securityContext.privileged' | sed -e 's/null/notset/g')
-              if [ "${container_privileged}" = "false" ] || [ "${container_privileged}" = "notset" ] ; then
-                echo "***pod_name: ${pod_name} container_name: ${container_name} pod_namespace: ${pod_namespace} is_container_privileged: ${container_privileged} is_compliant: true"
-              else
-                echo "***pod_name: ${pod_name} container_name: ${container_name} pod_namespace: ${pod_namespace} is_container_privileged: ${container_privileged} is_compliant: false"
-              fi
-            done
-          done
-        use_multiple_values: true
-        tests:
-          test_items:
-            - flag: "is_compliant"
-              compare:
-                op: eq
-                value: true
-        remediation: |
-          Add policies to each namespace in the cluster which has user workloads to restrict the
-          admission of privileged containers.
-          Audit: the audit list all pods' containers to retrieve their .securityContext.privileged value.
-          Condition: is_compliant is false if container's `.securityContext.privileged` is set to `true`.
-          Default: by default, there are no restrictions on the creation of privileged containers.
-        scored: false
-
-      - id: 5.2.3
-        text: "Minimize the admission of containers wishing to share the host process ID namespace (Manual)"
-        audit: |
-          kubectl get pods --all-namespaces -o custom-columns=POD_NAME:.metadata.name,POD_NAMESPACE:.metadata.namespace --no-headers | while read -r pod_name pod_namespace
-          do
-            # Retrieve spec.hostPID for each pod.
-            pod_hostpid=$(kubectl get pod "${pod_name}" --namespace "${pod_namespace}" -o jsonpath='{.spec.hostPID}' 2>/dev/null)
-            if [ -z "${pod_hostpid}" ]; then
-              pod_hostpid="false"
-              echo "***pod_name: ${pod_name} pod_namespace: ${pod_namespace} is_pod_hostpid: ${pod_hostpid} is_compliant: true"
-            else
-              echo "***pod_name: ${pod_name} pod_namespace: ${pod_namespace} is_pod_hostpid: ${pod_hostpid} is_compliant: false"
-            fi
-          done
-        use_multiple_values: true
-        tests:
-          test_items:
-            - flag: "is_compliant"
-              compare:
-                op: eq
-                value: true
-        remediation: |
-          Add policies to each namespace in the cluster which has user workloads to restrict the
-          admission of `hostPID` containers.
-          Audit: the audit retrieves each Pod' spec.hostPID.
-          Condition: is_compliant is false if Pod's spec.hostPID is set to `true`.
-          Default: by default, there are no restrictions on the creation of hostPID containers.
-        scored: false
-
-      - id: 5.2.4
-        text: "Minimize the admission of containers wishing to share the host IPC namespace (Manual)"
-        audit: |
-          kubectl get pods --all-namespaces -o custom-columns=POD_NAME:.metadata.name,POD_NAMESPACE:.metadata.namespace --no-headers | while read -r pod_name pod_namespace
-          do
-            # Retrieve spec.hostIPC for each pod.
-            pod_hostipc=$(kubectl get pod "${pod_name}" --namespace "${pod_namespace}" -o jsonpath='{.spec.hostIPC}' 2>/dev/null)
-            if [ -z "${pod_hostipc}" ]; then
-              pod_hostipc="false"
-              echo "***pod_name: ${pod_name} pod_namespace: ${pod_namespace} is_pod_hostipc: ${pod_hostipc} is_compliant: true"
-            else
-              echo "***pod_name: ${pod_name} pod_namespace: ${pod_namespace} is_pod_hostipc: ${pod_hostipc} is_compliant: false"
-            fi
-          done
-        use_multiple_values: true
-        tests:
-          test_items:
-            - flag: "is_compliant"
-              compare:
-                op: eq
-                value: true
-        remediation: |
-          Add policies to each namespace in the cluster which has user workloads to restrict the
-          admission of `hostIPC` containers.
-          Audit: the audit retrieves each Pod' spec.IPC.
-          Condition: is_compliant is false if Pod's spec.hostIPC is set to `true`.
-          Default: by default, there are no restrictions on the creation of hostIPC containers.
-        scored: false
-
-      - id: 5.2.5
-        text: "Minimize the admission of containers wishing to share the host network namespace (Manual)"
-        audit: |
-          kubectl get pods --all-namespaces -o custom-columns=POD_NAME:.metadata.name,POD_NAMESPACE:.metadata.namespace --no-headers | while read -r pod_name pod_namespace
-          do
-            # Retrieve spec.hostNetwork for each pod.
-            pod_hostnetwork=$(kubectl get pod "${pod_name}" --namespace "${pod_namespace}" -o jsonpath='{.spec.hostNetwork}' 2>/dev/null)
-            if [ -z "${pod_hostnetwork}" ]; then
-              pod_hostnetwork="false"
-              echo "***pod_name: ${pod_name} pod_namespace: ${pod_namespace} is_pod_hostnetwork: ${pod_hostnetwork} is_compliant: true"
-            else
-              echo "***pod_name: ${pod_name} pod_namespace: ${pod_namespace} is_pod_hostnetwork: ${pod_hostnetwork} is_compliant: false"
-            fi
-          done
-        use_multiple_values: true
-        tests:
-          test_items:
-            - flag: "is_compliant"
-              compare:
-                op: eq
-                value: true
-        remediation: |
-          Add policies to each namespace in the cluster which has user workloads to restrict the
-          admission of `hostNetwork` containers.
-          Audit: the audit retrieves each Pod' spec.hostNetwork.
-          Condition: is_compliant is false if Pod's spec.hostNetwork is set to `true`.
-          Default: by default, there are no restrictions on the creation of hostNetwork containers.
-        scored: false
-
-      - id: 5.2.6
-        text: "Minimize the admission of containers with allowPrivilegeEscalation (Manual)"
-        audit: |
-          kubectl get pods --all-namespaces -o custom-columns=POD_NAME:.metadata.name,POD_NAMESPACE:.metadata.namespace --no-headers | while read -r pod_name pod_namespace
-          do
-            # Retrieve container(s) for each Pod.
-            kubectl get pod "${pod_name}" --namespace "${pod_namespace}" -o json | jq -c '.spec.containers[]' | while read -r container
-            do
-              # Retrieve container's name
-              container_name=$(echo ${container} | jq -r '.name')
-              # Retrieve container's .securityContext.allowPrivilegeEscalation
-              container_allowprivesc=$(echo ${container} | jq -r '.securityContext.allowPrivilegeEscalation' | sed -e 's/null/notset/g')
-              if [ "${container_allowprivesc}" = "false" ] || [ "${container_allowprivesc}" = "notset" ]; then
-                echo "***pod_name: ${pod_name} container_name: ${container_name} pod_namespace: ${pod_namespace} is_container_allowprivesc: ${container_allowprivesc} is_compliant: true"
-              else
-                echo "***pod_name: ${pod_name} container_name: ${container_name} pod_namespace: ${pod_namespace} is_container_allowprivesc: ${container_allowprivesc} is_compliant: false"
-              fi
-            done
-          done
-        use_multiple_values: true
-        tests:
-          test_items:
-            - flag: "is_compliant"
-              compare:
-                op: eq
-                value: true
-        remediation: |
-          Add policies to each namespace in the cluster which has user workloads to restrict the
-          admission of containers with `.securityContext.allowPrivilegeEscalation` set to `true`.
-          Audit: the audit retrieves each Pod's container(s) `.securityContext.allowPrivilegeEscalation`.
-          Condition: is_compliant is false if container's `.securityContext.allowPrivilegeEscalation` is set to `true`.
-          Default: If notset, privilege escalation is allowed (default to true). However if PSP/PSA is used with a `restricted` profile,
-          privilege escalation is explicitly disallowed unless configured otherwise.
-        scored: false
-
-      - id: 5.2.7
-        text: "Minimize the admission of root containers (Manual)"
-        type: "manual"
-        remediation: |
-          Create a policy for each namespace in the cluster, ensuring that either `MustRunAsNonRoot`
-          or `MustRunAs` with the range of UIDs not including 0, is set.
-        scored: false
-
-      - id: 5.2.8
-        text: "Minimize the admission of containers with the NET_RAW capability (Manual)"
-        type: "manual"
-        remediation: |
-          Add policies to each namespace in the cluster which has user workloads to restrict the
-          admission of containers with the `NET_RAW` capability.
-        scored: false
-
-      - id: 5.2.9
-        text: "Minimize the admission of containers with added capabilities (Manual)"
-        audit: |
-          kubectl get pods --all-namespaces -o custom-columns=POD_NAME:.metadata.name,POD_NAMESPACE:.metadata.namespace --no-headers | while read -r pod_name pod_namespace
-          do
-            # Retrieve container(s) for each Pod.
-            kubectl get pod "${pod_name}" --namespace "${pod_namespace}" -o json | jq -c '.spec.containers[]' | while read -r container
-            do
-              # Retrieve container's name
-              container_name=$(echo ${container} | jq -r '.name')
-              # Retrieve container's added capabilities
-              container_caps_add=$(echo ${container} | jq -r '.securityContext.capabilities.add' | sed -e 's/null/notset/g')
-              # Set is_compliant to true by default.
-              is_compliant=true
-              caps_list=""
-              if [ "${container_caps_add}" != "notset" ]; then
-                # Loop through all caps and append caps_list, then set is_compliant to false.
-                for cap in $(echo "${container_caps_add}" | jq -r '.[]'); do
-                caps_list+="${cap},"
-                is_compliant=false
-                done
-                # Remove trailing comma for the last list member.
-                caps_list=${caps_list%,}
-              fi
-              if [ "${is_compliant}" = true ]; then
-                echo "***pod_name: ${pod_name} container_name: ${container_name} pod_namespace: ${pod_namespace} container_caps_add: ${container_caps_add} is_compliant: true"
-              else
-                echo "***pod_name: ${pod_name} container_name: ${container_name} pod_namespace: ${pod_namespace} container_caps_add: ${caps_list} is_compliant: false"
-              fi
-            done
-          done
-        use_multiple_values: true
-        tests:
-          test_items:
-            - flag: "is_compliant"
-              compare:
-                op: eq
-                value: true
-        remediation: |
-          Ensure that `allowedCapabilities` is not present in policies for the cluster unless
-          it is set to an empty array.
-          Audit: the audit retrieves each Pod's container(s) added capabilities.
-          Condition: is_compliant is false if added capabilities are added for a given container.
-          Default: Containers run with a default set of capabilities as assigned by the Container Runtime.
-        scored: false
-
-      - id: 5.2.10
-        text: "Minimize the admission of containers with capabilities assigned (Manual)"
-        type: "manual"
-        remediation: |
-          Review the use of capabilites in applications running on your cluster. Where a namespace
-          contains applications which do not require any Linux capabities to operate consider adding
-          a PSP which forbids the admission of containers which do not drop all capabilities.
-        scored: false
-
-      - id: 5.2.11
-        text: "Minimize the admission of Windows HostProcess containers (Manual)"
-        type: "manual"
-        remediation: |
-          Add policies to each namespace in the cluster which has user workloads to restrict the
-          admission of containers that have `.securityContext.windowsOptions.hostProcess` set to `true`.
-        scored: false
-
-      - id: 5.2.12
-        text: "Minimize the admission of HostPath volumes (Manual)"
-        type: "manual"
-        remediation: |
-          Add policies to each namespace in the cluster which has user workloads to restrict the
-          admission of containers with `hostPath` volumes.
-        scored: false
-
-      - id: 5.2.13
-        text: "Minimize the admission of containers which use HostPorts (Manual)"
-        type: "manual"
-        remediation: |
-          Add policies to each namespace in the cluster which has user workloads to restrict the
-          admission of containers which use `hostPort` sections.
-        scored: false
-
-  - id: 5.3
-    text: "Network Policies and CNI"
-    checks:
-      - id: 5.3.1
-        text: "Ensure that the CNI in use supports NetworkPolicies (Manual)"
-        type: "manual"
-        remediation: |
-          If the CNI plugin in use does not support network policies, consideration should be given to
-          making use of a different plugin, or finding an alternate mechanism for restricting traffic
-          in the Kubernetes cluster.
-        scored: false
-
-      - id: 5.3.2
-        text: "Ensure that all Namespaces have NetworkPolicies defined (Manual)"
-        type: "manual"
-        remediation: |
-          Follow the documentation and create NetworkPolicy objects as you need them.
-        scored: false
-
-  - id: 5.4
-    text: "Secrets Management"
-    checks:
-      - id: 5.4.1
-        text: "Prefer using Secrets as files over Secrets as environment variables (Manual)"
-        type: "manual"
-        remediation: |
-          If possible, rewrite application code to read Secrets from mounted secret files, rather than
-          from environment variables.
-        scored: false
-
-      - id: 5.4.2
-        text: "Consider external secret storage (Manual)"
-        type: "manual"
-        remediation: |
-          Refer to the Secrets management options offered by your cloud provider or a third-party
-          secrets management solution.
-        scored: false
-
-  - id: 5.5
-    text: "Extensible Admission Control"
-    checks:
-      - id: 5.5.1
-        text: "Configure Image Provenance using ImagePolicyWebhook admission controller (Manual)"
-        type: "manual"
-        remediation: |
-          Follow the Kubernetes documentation and setup image provenance.
-        scored: false
-
-  - id: 5.6
-    text: "General Policies"
-    checks:
-      - id: 5.6.1
-        text: "Create administrative boundaries between resources using namespaces (Manual)"
-        type: "manual"
-        remediation: |
-          Follow the documentation and create namespaces for objects in your deployment as you need
-          them.
-        scored: false
-
-      - id: 5.6.2
-        text: "Ensure that the seccomp profile is set to docker/default in your Pod definitions (Manual)"
-        type: "manual"
-        remediation: |
-          Use `securityContext` to enable the docker/default seccomp profile in your pod definitions.
-          An example is as below:
-            securityContext:
-              seccompProfile:
-                type: RuntimeDefault
-        scored: false
-
-      - id: 5.6.3
-        text: "Apply SecurityContext to your Pods and Containers (Manual)"
-        type: "manual"
-        remediation: |
-          Follow the Kubernetes documentation and apply SecurityContexts to your Pods. For a
-          suggested list of SecurityContexts, you may refer to the CIS Security Benchmark for Docker
-          Containers.
-        scored: false
-
-      - id: 5.6.4
-        text: "The default namespace should not be used (Manual)"
-        type: "manual"
-        remediation: |
-          Ensure that namespaces are created to allow for appropriate segregation of Kubernetes
-          resources and that all new resources are created in a specific namespace.
-        scored: false

cfg/cis-1.12/config.yaml

@@ -1,2 +0,0 @@
----
-## Version-specific settings that override the values in cfg/config.yaml

cfg/cis-1.12/controlplane.yaml

@@ -1,62 +0,0 @@
----
-controls:
-version: "cis-1.12"
-id: 3
-text: "Control Plane Configuration"
-type: "controlplane"
-groups:
-  - id: 3.1
-    text: "Authentication and Authorization"
-    checks:
-      - id: 3.1.1
-        text: "Client certificate authentication should not be used for users (Manual)"
-        type: "manual"
-        remediation: |
-          Alternative mechanisms provided by Kubernetes such as the use of OIDC should be
-          implemented in place of client certificates.
-        scored: false
-
-      - id: 3.1.2
-        text: "Service account token authentication should not be used for users (Manual)"
-        type: "manual"
-        remediation: |
-          Alternative mechanisms provided by Kubernetes such as the use of OIDC should be implemented
-          in place of service account tokens.
-        scored: false
-
-      - id: 3.1.3
-        text: "Bootstrap token authentication should not be used for users (Manual)"
-        type: "manual"
-        remediation: |
-          Alternative mechanisms provided by Kubernetes such as the use of OIDC should be implemented
-          in place of bootstrap tokens.
-        scored: false
-
-  - id: 3.2
-    text: "Logging"
-    checks:
-      - id: 3.2.1
-        text: "Ensure that a minimal audit policy is created (Manual)"
-        audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep"
-        tests:
-          test_items:
-            - flag: "--audit-policy-file"
-              set: true
-        remediation: |
-          Create an audit policy file for your cluster.
-        scored: false
-
-      - id: 3.2.2
-        text: "Ensure that the audit policy covers key security concerns (Manual)"
-        type: "manual"
-        remediation: |
-          Review the audit policy provided for the cluster and ensure that it covers
-          at least the following areas,
-          - Access to Secrets managed by the cluster. Care should be taken to only
-            log Metadata for requests to Secrets, ConfigMaps, and TokenReviews, in
-            order to avoid risk of logging sensitive data.
-          - Modification of Pod and Deployment objects.
-          - Use of `pods/exec`, `pods/portforward`, `pods/proxy` and `services/proxy`.
-          For most requests, minimally logging at the Metadata level is recommended
-          (the most basic level of logging).
-        scored: false

cfg/cis-1.12/etcd.yaml

@@ -1,135 +0,0 @@
----
-controls:
-version: "cis-1.12"
-id: 2
-text: "Etcd Node Configuration"
-type: "etcd"
-groups:
-  - id: 2
-    text: "Etcd Node Configuration"
-    checks:
-      - id: 2.1
-        text: "Ensure that the --cert-file and --key-file arguments are set as appropriate (Automated)"
-        audit: "/bin/ps -ef | /bin/grep $etcdbin | /bin/grep -v grep"
-        tests:
-          bin_op: and
-          test_items:
-            - flag: "--cert-file"
-              env: "ETCD_CERT_FILE"
-            - flag: "--key-file"
-              env: "ETCD_KEY_FILE"
-        remediation: |
-          Follow the etcd service documentation and configure TLS encryption.
-          Then, edit the etcd pod specification file /etc/kubernetes/manifests/etcd.yaml
-          on the master node and set the below parameters.
-          --cert-file=</path/to/ca-file>
-          --key-file=</path/to/key-file>
-        scored: true
-
-      - id: 2.2
-        text: "Ensure that the --client-cert-auth argument is set to true (Automated)"
-        audit: "/bin/ps -ef | /bin/grep $etcdbin | /bin/grep -v grep"
-        tests:
-          test_items:
-            - flag: "--client-cert-auth"
-              env: "ETCD_CLIENT_CERT_AUTH"
-              compare:
-                op: eq
-                value: true
-        remediation: |
-          Edit the etcd pod specification file $etcdconf on the master
-          node and set the below parameter.
-          --client-cert-auth="true"
-        scored: true
-
-      - id: 2.3
-        text: "Ensure that the --auto-tls argument is not set to true (Automated)"
-        audit: "/bin/ps -ef | /bin/grep $etcdbin | /bin/grep -v grep"
-        tests:
-          bin_op: or
-          test_items:
-            - flag: "--auto-tls"
-              env: "ETCD_AUTO_TLS"
-              set: false
-            - flag: "--auto-tls"
-              env: "ETCD_AUTO_TLS"
-              compare:
-                op: eq
-                value: false
-        remediation: |
-          Edit the etcd pod specification file $etcdconf on the master
-          node and either remove the --auto-tls parameter or set it to false.
-            --auto-tls=false
-        scored: true
-
-      - id: 2.4
-        text: "Ensure that the --peer-cert-file and --peer-key-file arguments are
-        set as appropriate (Automated)"
-        audit: "/bin/ps -ef | /bin/grep $etcdbin | /bin/grep -v grep"
-        tests:
-          bin_op: and
-          test_items:
-            - flag: "--peer-cert-file"
-              env: "ETCD_PEER_CERT_FILE"
-            - flag: "--peer-key-file"
-              env: "ETCD_PEER_KEY_FILE"
-        remediation: |
-          Follow the etcd service documentation and configure peer TLS encryption as appropriate
-          for your etcd cluster.
-          Then, edit the etcd pod specification file $etcdconf on the
-          master node and set the below parameters.
-          --peer-client-file=</path/to/peer-cert-file>
-          --peer-key-file=</path/to/peer-key-file>
-        scored: true
-
-      - id: 2.5
-        text: "Ensure that the --peer-client-cert-auth argument is set to true (Automated)"
-        audit: "/bin/ps -ef | /bin/grep $etcdbin | /bin/grep -v grep"
-        tests:
-          test_items:
-            - flag: "--peer-client-cert-auth"
-              env: "ETCD_PEER_CLIENT_CERT_AUTH"
-              compare:
-                op: eq
-                value: true
-        remediation: |
-          Edit the etcd pod specification file $etcdconf on the master
-          node and set the below parameter.
-          --peer-client-cert-auth=true
-        scored: true
-
-      - id: 2.6
-        text: "Ensure that the --peer-auto-tls argument is not set to true (Automated)"
-        audit: "/bin/ps -ef | /bin/grep $etcdbin | /bin/grep -v grep"
-        tests:
-          bin_op: or
-          test_items:
-            - flag: "--peer-auto-tls"
-              env: "ETCD_PEER_AUTO_TLS"
-              set: false
-            - flag: "--peer-auto-tls"
-              env: "ETCD_PEER_AUTO_TLS"
-              compare:
-                op: eq
-                value: false
-        remediation: |
-          Edit the etcd pod specification file $etcdconf on the master
-          node and either remove the --peer-auto-tls parameter or set it to false.
-          --peer-auto-tls=false
-        scored: true
-
-      - id: 2.7
-        text: "Ensure that a unique Certificate Authority is used for etcd (Manual)"
-        audit: "/bin/ps -ef | /bin/grep $etcdbin | /bin/grep -v grep"
-        tests:
-          test_items:
-            - flag: "--trusted-ca-file"
-              env: "ETCD_TRUSTED_CA_FILE"
-        remediation: |
-          [Manual test]
-          Follow the etcd documentation and create a dedicated certificate authority setup for the
-          etcd service.
-          Then, edit the etcd pod specification file $etcdconf on the
-          master node and set the below parameter.
-          --trusted-ca-file=</path/to/ca-file>
-        scored: false

cfg/cis-1.12/master.yaml

@@ -1,930 +0,0 @@
----
-controls:
-version: "cis-1.12"
-id: 1
-text: "Control Plane Security Configuration"
-type: "master"
-groups:
-  - id: 1.1
-    text: "Control Plane Node Configuration Files"
-    checks:
-      - id: 1.1.1
-        text: "Ensure that the API server pod specification file permissions are set to 600 or more restrictive (Automated)"
-        audit: "/bin/sh -c 'if test -e $apiserverconf; then stat -c permissions=%a $apiserverconf; fi'"
-        tests:
-          test_items:
-            - flag: "permissions"
-              compare:
-                op: bitmask
-                value: "600"
-        remediation: |
-          Run the below command (based on the file location on your system) on the
-          control plane node.
-          For example, chmod 600 $apiserverconf
-        scored: true
-
-      - id: 1.1.2
-        text: "Ensure that the API server pod specification file ownership is set to root:root (Automated)"
-        audit: "/bin/sh -c 'if test -e $apiserverconf; then stat -c %U:%G $apiserverconf; fi'"
-        tests:
-          test_items:
-            - flag: "root:root"
-        remediation: |
-          Run the below command (based on the file location on your system) on the control plane node.
-          For example, chown root:root $apiserverconf
-        scored: true
-
-      - id: 1.1.3
-        text: "Ensure that the controller manager pod specification file permissions are set to 600 or more restrictive (Automated)"
-        audit: "/bin/sh -c 'if test -e $controllermanagerconf; then stat -c permissions=%a $controllermanagerconf; fi'"
-        tests:
-          test_items:
-            - flag: "permissions"
-              compare:
-                op: bitmask
-                value: "600"
-        remediation: |
-          Run the below command (based on the file location on your system) on the control plane node.
-          For example, chmod 600 $controllermanagerconf
-        scored: true
-
-      - id: 1.1.4
-        text: "Ensure that the controller manager pod specification file ownership is set to root:root (Automated)"
-        audit: "/bin/sh -c 'if test -e $controllermanagerconf; then stat -c %U:%G $controllermanagerconf; fi'"
-        tests:
-          test_items:
-            - flag: "root:root"
-        remediation: |
-          Run the below command (based on the file location on your system) on the control plane node.
-          For example, chown root:root $controllermanagerconf
-        scored: true
-
-      - id: 1.1.5
-        text: "Ensure that the scheduler pod specification file permissions are set to 600 or more restrictive (Automated)"
-        audit: "/bin/sh -c 'if test -e $schedulerconf; then stat -c permissions=%a $schedulerconf; fi'"
-        tests:
-          test_items:
-            - flag: "permissions"
-              compare:
-                op: bitmask
-                value: "600"
-        remediation: |
-          Run the below command (based on the file location on your system) on the control plane node.
-          For example, chmod 600 $schedulerconf
-        scored: true
-
-      - id: 1.1.6
-        text: "Ensure that the scheduler pod specification file ownership is set to root:root (Automated)"
-        audit: "/bin/sh -c 'if test -e $schedulerconf; then stat -c %U:%G $schedulerconf; fi'"
-        tests:
-          test_items:
-            - flag: "root:root"
-        remediation: |
-          Run the below command (based on the file location on your system) on the control plane node.
-          For example, chown root:root $schedulerconf
-        scored: true
-
-      - id: 1.1.7
-        text: "Ensure that the etcd pod specification file permissions are set to 600 or more restrictive (Automated)"
-        audit: "/bin/sh -c 'if test -e $etcdconf; then find $etcdconf -name '*etcd*' | xargs stat -c permissions=%a; fi'"
-        use_multiple_values: true
-        tests:
-          test_items:
-            - flag: "permissions"
-              compare:
-                op: bitmask
-                value: "600"
-        remediation: |
-          Run the below command (based on the file location on your system) on the control plane node.
-          For example,
-          chmod 600 $etcdconf
-        scored: true
-
-      - id: 1.1.8
-        text: "Ensure that the etcd pod specification file ownership is set to root:root (Automated)"
-        audit: "/bin/sh -c 'if test -e $etcdconf; then find $etcdconf -name '*etcd*' | xargs stat -c %U:%G; fi'"
-        use_multiple_values: true
-        tests:
-          test_items:
-            - flag: "root:root"
-        remediation: |
-          Run the below command (based on the file location on your system) on the control plane node.
-          For example,
-          chown root:root $etcdconf
-        scored: true
-
-      - id: 1.1.9
-        text: "Ensure that the Container Network Interface file permissions are set to 600 or more restrictive (Manual)"
-        audit: |
-          ps -ef | grep $kubeletbin | grep -- --cni-conf-dir | sed 's%.*cni-conf-dir[= ]\([^ ]*\).*%\1%' | xargs -I{} find {} -mindepth 1 | xargs --no-run-if-empty stat -c permissions=%a
-          find /var/lib/cni/networks -type f 2> /dev/null | xargs --no-run-if-empty stat -c permissions=%a
-        use_multiple_values: true
-        tests:
-          test_items:
-            - flag: "permissions"
-              compare:
-                op: bitmask
-                value: "600"
-        remediation: |
-          Run the below command (based on the file location on your system) on the control plane node.
-          For example, chmod 600 <path/to/cni/files>
-        scored: false
-
-      - id: 1.1.10
-        text: "Ensure that the Container Network Interface file ownership is set to root:root (Manual)"
-        audit: |
-          ps -ef | grep $kubeletbin | grep -- --cni-conf-dir | sed 's%.*cni-conf-dir[= ]\([^ ]*\).*%\1%' | xargs -I{} find {} -mindepth 1 | xargs --no-run-if-empty stat -c %U:%G
-          find /var/lib/cni/networks -type f 2> /dev/null | xargs --no-run-if-empty stat -c %U:%G
-        use_multiple_values: true
-        tests:
-          test_items:
-            - flag: "root:root"
-        remediation: |
-          Run the below command (based on the file location on your system) on the control plane node.
-          For example,
-          chown root:root <path/to/cni/files>
-        scored: false
-
-      - id: 1.1.11
-        text: "Ensure that the etcd data directory permissions are set to 700 or more restrictive (Automated)"
-        audit: |
-          DATA_DIR=''
-          for d in $(ps -ef | grep $etcdbin | grep -- --data-dir | sed 's%.*data-dir[= ]\([^ ]*\).*%\1%'); do
-            if test -d "$d"; then DATA_DIR="$d"; fi
-          done
-          if ! test -d "$DATA_DIR"; then DATA_DIR=$etcddatadir; fi
-          stat -c permissions=%a "$DATA_DIR"
-        tests:
-          test_items:
-            - flag: "permissions"
-              compare:
-                op: bitmask
-                value: "700"
-        remediation: |
-          On the etcd server node, get the etcd data directory, passed as an argument --data-dir,
-          from the command 'ps -ef | grep etcd'.
-          Run the below command (based on the etcd data directory found above). For example,
-          chmod 700 /var/lib/etcd
-        scored: true
-
-      - id: 1.1.12
-        text: "Ensure that the etcd data directory ownership is set to etcd:etcd (Automated)"
-        audit: |
-          DATA_DIR=''
-          for d in $(ps -ef | grep $etcdbin | grep -- --data-dir | sed 's%.*data-dir[= ]\([^ ]*\).*%\1%'); do
-            if test -d "$d"; then DATA_DIR="$d"; fi
-          done
-          if ! test -d "$DATA_DIR"; then DATA_DIR=$etcddatadir; fi
-          stat -c %U:%G "$DATA_DIR"
-        tests:
-          test_items:
-            - flag: "etcd:etcd"
-        remediation: |
-          On the etcd server node, get the etcd data directory, passed as an argument --data-dir,
-          from the command 'ps -ef | grep etcd'.
-          Run the below command (based on the etcd data directory found above).
-          For example, chown etcd:etcd /var/lib/etcd
-        scored: true
-
-      - id: 1.1.13
-        text: "Ensure that the default administrative credential file permissions are set to 600 (Automated)"
-        audit: |
-         for adminconf in /etc/kubernetes/admin.conf /etc/kubernetes/super-admin.conf; do if test -e $adminconf; then stat -c "permissions=%a %n" $adminconf; fi; done
-        use_multiple_values: true
-        tests:
-          test_items:
-            - flag: "permissions"
-              compare:
-                op: bitmask
-                value: "600"
-        remediation: |
-          Run the below command (based on the file location on your system) on the control plane node.
-          For example, chmod 600 /etc/kubernetes/admin.conf
-          On Kubernetes 1.29+ the super-admin.conf file should also be modified, if present.
-          For example, chmod 600 /etc/kubernetes/super-admin.conf
-        scored: true
-
-      - id: 1.1.14
-        text: "Ensure that the default administrative credential file ownership is set to root:root (Automated)"
-        audit: |
-         for adminconf in /etc/kubernetes/admin.conf /etc/kubernetes/super-admin.conf; do if test -e $adminconf; then stat -c "ownership=%U:%G %n" $adminconf; fi; done
-        use_multiple_values: true
-        tests:
-          test_items:
-            - flag: "ownership"
-              compare:
-                op: eq
-                value: "root:root"
-        remediation: |
-          Run the below command (based on the file location on your system) on the control plane node.
-          For example, chown root:root /etc/kubernetes/admin.conf
-          On Kubernetes 1.29+ the super-admin.conf file should also be modified, if present.
-          For example, chown root:root /etc/kubernetes/super-admin.conf
-        scored: true
-
-      - id: 1.1.15
-        text: "Ensure that the scheduler.conf file permissions are set to 600 or more restrictive (Automated)"
-        audit: "/bin/sh -c 'if test -e $schedulerkubeconfig; then stat -c permissions=%a $schedulerkubeconfig; fi'"
-        tests:
-          test_items:
-            - flag: "permissions"
-              compare:
-                op: bitmask
-                value: "600"
-        remediation: |
-          Run the below command (based on the file location on your system) on the control plane node.
-          For example,
-          chmod 600 $schedulerkubeconfig
-        scored: true
-
-      - id: 1.1.16
-        text: "Ensure that the scheduler.conf file ownership is set to root:root (Automated)"
-        audit: "/bin/sh -c 'if test -e $schedulerkubeconfig; then stat -c %U:%G $schedulerkubeconfig; fi'"
-        tests:
-          test_items:
-            - flag: "root:root"
-        remediation: |
-          Run the below command (based on the file location on your system) on the control plane node.
-          For example,
-          chown root:root $schedulerkubeconfig
-        scored: true
-
-      - id: 1.1.17
-        text: "Ensure that the controller-manager.conf file permissions are set to 600 or more restrictive (Automated)"
-        audit: "/bin/sh -c 'if test -e $controllermanagerkubeconfig; then stat -c permissions=%a $controllermanagerkubeconfig; fi'"
-        tests:
-          test_items:
-            - flag: "permissions"
-              compare:
-                op: bitmask
-                value: "600"
-        remediation: |
-          Run the below command (based on the file location on your system) on the control plane node.
-          For example,
-          chmod 600 $controllermanagerkubeconfig
-        scored: true
-
-      - id: 1.1.18
-        text: "Ensure that the controller-manager.conf file ownership is set to root:root (Automated)"
-        audit: "/bin/sh -c 'if test -e $controllermanagerkubeconfig; then stat -c %U:%G $controllermanagerkubeconfig; fi'"
-        tests:
-          test_items:
-            - flag: "root:root"
-        remediation: |
-          Run the below command (based on the file location on your system) on the control plane node.
-          For example,
-          chown root:root $controllermanagerkubeconfig
-        scored: true
-
-      - id: 1.1.19
-        text: "Ensure that the Kubernetes PKI directory and file ownership is set to root:root (Automated)"
-        audit: "find /etc/kubernetes/pki/ | xargs stat -c %U:%G"
-        use_multiple_values: true
-        tests:
-          test_items:
-            - flag: "root:root"
-        remediation: |
-          Run the below command (based on the file location on your system) on the control plane node.
-          For example,
-          chown -R root:root /etc/kubernetes/pki/
-        scored: true
-
-      - id: 1.1.20
-        text: "Ensure that the Kubernetes PKI certificate file permissions are set to 644 or more restrictive (Manual)"
-        audit: "find /etc/kubernetes/pki/ -name '*.crt' | xargs stat -c permissions=%a"
-        use_multiple_values: true
-        tests:
-          test_items:
-            - flag: "permissions"
-              compare:
-                op: bitmask
-                value: "644"
-        remediation: |
-          Run the below command (based on the file location on your system) on the control plane node.
-          For example,
-          chmod -R 644 /etc/kubernetes/pki/*.crt
-        scored: false
-
-      - id: 1.1.21
-        text: "Ensure that the Kubernetes PKI key file permissions are set to 600 (Manual)"
-        audit: "find /etc/kubernetes/pki/ -name '*.key' | xargs stat -c permissions=%a"
-        use_multiple_values: true
-        tests:
-          test_items:
-            - flag: "permissions"
-              compare:
-                op: bitmask
-                value: "600"
-        remediation: |
-          Run the below command (based on the file location on your system) on the control plane node.
-          For example,
-          chmod -R 600 /etc/kubernetes/pki/*.key
-        scored: false
-
-  - id: 1.2
-    text: "API Server"
-    checks:
-      - id: 1.2.1
-        text: "Ensure that the --anonymous-auth argument is set to false (Manual)"
-        audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep"
-        tests:
-          test_items:
-            - flag: "--anonymous-auth"
-              compare:
-                op: eq
-                value: false
-        remediation: |
-          Edit the API server pod specification file $apiserverconf
-          on the control plane node and set the below parameter.
-          --anonymous-auth=false
-        scored: false
-
-      - id: 1.2.2
-        text: "Ensure that the --token-auth-file parameter is not set (Automated)"
-        audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep"
-        tests:
-          test_items:
-            - flag: "--token-auth-file"
-              set: false
-        remediation: |
-          Follow the documentation and configure alternate mechanisms for authentication. Then,
-          edit the API server pod specification file $apiserverconf
-          on the control plane node and remove the --token-auth-file=<filename> parameter.
-        scored: true
-
-      - id: 1.2.3
-        text: "Ensure that the --DenyServiceExternalIPs is set (Manual)"
-        audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep"
-        tests:
-          bin_op: or
-          test_items:
-            - flag: "--enable-admission-plugins"
-              compare:
-                op: has
-                value: "DenyServiceExternalIPs"
-        remediation: |
-          Edit the API server pod specification file $apiserverconf
-          on the control plane node and add the `DenyServiceExternalIPs` plugin
-          to the enabled admission plugins, as such --enable-admission-plugin=DenyServiceExternalIPs.
-        scored: false
-
-      - id: 1.2.4
-        text: "Ensure that the --kubelet-client-certificate and --kubelet-client-key arguments are set as appropriate (Automated)"
-        audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep"
-        tests:
-          bin_op: and
-          test_items:
-            - flag: "--kubelet-client-certificate"
-            - flag: "--kubelet-client-key"
-        remediation: |
-          Follow the Kubernetes documentation and set up the TLS connection between the
-          apiserver and kubelets. Then, edit API server pod specification file
-          $apiserverconf on the control plane node and set the
-          kubelet client certificate and key parameters as below.
-          --kubelet-client-certificate=<path/to/client-certificate-file>
-          --kubelet-client-key=<path/to/client-key-file>
-        scored: true
-
-      - id: 1.2.5
-        text: "Ensure that the --kubelet-certificate-authority argument is set as appropriate (Automated)"
-        audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep"
-        tests:
-          test_items:
-            - flag: "--kubelet-certificate-authority"
-        remediation: |
-          Follow the Kubernetes documentation and setup the TLS connection between
-          the apiserver and kubelets. Then, edit the API server pod specification file
-          $apiserverconf on the control plane node and set the
-          --kubelet-certificate-authority parameter to the path to the cert file for the certificate authority.
-          --kubelet-certificate-authority=<ca-string>
-        scored: true
-
-      - id: 1.2.6
-        text: "Ensure that the --authorization-mode argument is not set to AlwaysAllow (Automated)"
-        audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep"
-        tests:
-          test_items:
-            - flag: "--authorization-mode"
-              compare:
-                op: nothave
-                value: "AlwaysAllow"
-        remediation: |
-          Edit the API server pod specification file $apiserverconf
-          on the control plane node and set the --authorization-mode parameter to values other than AlwaysAllow.
-          One such example could be as below.
-          --authorization-mode=RBAC
-        scored: true
-
-      - id: 1.2.7
-        text: "Ensure that the --authorization-mode argument includes Node (Automated)"
-        audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep"
-        tests:
-          test_items:
-            - flag: "--authorization-mode"
-              compare:
-                op: has
-                value: "Node"
-        remediation: |
-          Edit the API server pod specification file $apiserverconf
-          on the control plane node and set the --authorization-mode parameter to a value that includes Node.
-          --authorization-mode=Node,RBAC
-        scored: true
-
-      - id: 1.2.8
-        text: "Ensure that the --authorization-mode argument includes RBAC (Automated)"
-        audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep"
-        tests:
-          test_items:
-            - flag: "--authorization-mode"
-              compare:
-                op: has
-                value: "RBAC"
-        remediation: |
-          Edit the API server pod specification file $apiserverconf
-          on the control plane node and set the --authorization-mode parameter to a value that includes RBAC,
-          for example `--authorization-mode=Node,RBAC`.
-        scored: true
-
-      - id: 1.2.9
-        text: "Ensure that the admission control plugin EventRateLimit is set (Manual)"
-        audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep"
-        tests:
-          test_items:
-            - flag: "--enable-admission-plugins"
-              compare:
-                op: has
-                value: "EventRateLimit"
-        remediation: |
-          Follow the Kubernetes documentation and set the desired limits in a configuration file.
-          Then, edit the API server pod specification file $apiserverconf
-          and set the below parameters.
-          --enable-admission-plugins=...,EventRateLimit,...
-          --admission-control-config-file=<path/to/configuration/file>
-        scored: false
-
-      - id: 1.2.10
-        text: "Ensure that the admission control plugin AlwaysAdmit is not set (Automated)"
-        audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep"
-        tests:
-          bin_op: or
-          test_items:
-            - flag: "--enable-admission-plugins"
-              compare:
-                op: nothave
-                value: AlwaysAdmit
-            - flag: "--enable-admission-plugins"
-              set: false
-        remediation: |
-          Edit the API server pod specification file $apiserverconf
-          on the control plane node and either remove the --enable-admission-plugins parameter, or set it to a
-          value that does not include AlwaysAdmit.
-        scored: true
-
-      - id: 1.2.11
-        text: "Ensure that the admission control plugin AlwaysPullImages is set (Manual)"
-        audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep"
-        tests:
-          test_items:
-            - flag: "--enable-admission-plugins"
-              compare:
-                op: has
-                value: "AlwaysPullImages"
-        remediation: |
-          Edit the API server pod specification file $apiserverconf
-          on the control plane node and set the --enable-admission-plugins parameter to include
-          AlwaysPullImages.
-          --enable-admission-plugins=...,AlwaysPullImages,...
-        scored: false
-
-      - id: 1.2.12
-        text: "Ensure that the admission control plugin ServiceAccount is set (Automated)"
-        audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep"
-        tests:
-          bin_op: or
-          test_items:
-            - flag: "--disable-admission-plugins"
-              compare:
-                op: nothave
-                value: "ServiceAccount"
-            - flag: "--disable-admission-plugins"
-              set: false
-        remediation: |
-          Follow the documentation and create ServiceAccount objects as per your environment.
-          Then, edit the API server pod specification file $apiserverconf
-          on the control plane node and ensure that the --disable-admission-plugins parameter is set to a
-          value that does not include ServiceAccount.
-        scored: true
-
-      - id: 1.2.13
-        text: "Ensure that the admission control plugin NamespaceLifecycle is set (Automated)"
-        audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep"
-        tests:
-          bin_op: or
-          test_items:
-            - flag: "--disable-admission-plugins"
-              compare:
-                op: nothave
-                value: "NamespaceLifecycle"
-            - flag: "--disable-admission-plugins"
-              set: false
-        remediation: |
-          Edit the API server pod specification file $apiserverconf
-          on the control plane node and set the --disable-admission-plugins parameter to
-          ensure it does not include NamespaceLifecycle.
-        scored: true
-
-      - id: 1.2.14
-        text: "Ensure that the admission control plugin NodeRestriction is set (Automated)"
-        audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep"
-        tests:
-          test_items:
-            - flag: "--enable-admission-plugins"
-              compare:
-                op: has
-                value: "NodeRestriction"
-        remediation: |
-          Follow the Kubernetes documentation and configure NodeRestriction plug-in on kubelets.
-          Then, edit the API server pod specification file $apiserverconf
-          on the control plane node and set the --enable-admission-plugins parameter to a
-          value that includes NodeRestriction.
-          --enable-admission-plugins=...,NodeRestriction,...
-        scored: true
-
-      - id: 1.2.15
-        text: "Ensure that the --profiling argument is set to false (Automated)"
-        audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep"
-        tests:
-          test_items:
-            - flag: "--profiling"
-              compare:
-                op: eq
-                value: false
-        remediation: |
-          Edit the API server pod specification file $apiserverconf
-          on the control plane node and set the below parameter.
-          --profiling=false
-        scored: true
-
-      - id: 1.2.16
-        text: "Ensure that the --audit-log-path argument is set (Automated)"
-        audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep"
-        tests:
-          test_items:
-            - flag: "--audit-log-path"
-        remediation: |
-          Edit the API server pod specification file $apiserverconf
-          on the control plane node and set the --audit-log-path parameter to a suitable path and
-          file where you would like audit logs to be written, for example,
-          --audit-log-path=/var/log/apiserver/audit.log
-        scored: true
-
-      - id: 1.2.17
-        text: "Ensure that the --audit-log-maxage argument is set to 30 or as appropriate (Automated)"
-        audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep"
-        tests:
-          test_items:
-            - flag: "--audit-log-maxage"
-              compare:
-                op: gte
-                value: 30
-        remediation: |
-          Edit the API server pod specification file $apiserverconf
-          on the control plane node and set the --audit-log-maxage parameter to 30
-          or as an appropriate number of days, for example,
-          --audit-log-maxage=30
-        scored: true
-
-      - id: 1.2.18
-        text: "Ensure that the --audit-log-maxbackup argument is set to 10 or as appropriate (Automated)"
-        audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep"
-        tests:
-          test_items:
-            - flag: "--audit-log-maxbackup"
-              compare:
-                op: gte
-                value: 10
-        remediation: |
-          Edit the API server pod specification file $apiserverconf
-          on the control plane node and set the --audit-log-maxbackup parameter to 10 or to an appropriate
-          value. For example,
-          --audit-log-maxbackup=10
-        scored: true
-
-      - id: 1.2.19
-        text: "Ensure that the --audit-log-maxsize argument is set to 100 or as appropriate (Automated)"
-        audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep"
-        tests:
-          test_items:
-            - flag: "--audit-log-maxsize"
-              compare:
-                op: gte
-                value: 100
-        remediation: |
-          Edit the API server pod specification file $apiserverconf
-          on the control plane node and set the --audit-log-maxsize parameter to an appropriate size in MB.
-          For example, to set it as 100 MB, --audit-log-maxsize=100
-        scored: true
-
-      - id: 1.2.20
-        text: "Ensure that the --request-timeout argument is set as appropriate (Manual)"
-        audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep"
-        type: manual
-        remediation: |
-          Edit the API server pod specification file $apiserverconf
-          and set the below parameter as appropriate and if needed.
-          For example, --request-timeout=300s
-        scored: false
-
-      - id: 1.2.21
-        text: "Ensure that the --service-account-lookup argument is set to true (Automated)"
-        audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep"
-        tests:
-          bin_op: or
-          test_items:
-            - flag: "--service-account-lookup"
-              set: false
-            - flag: "--service-account-lookup"
-              compare:
-                op: eq
-                value: true
-        remediation: |
-          Edit the API server pod specification file $apiserverconf
-          on the control plane node and set the below parameter.
-          --service-account-lookup=true
-          Alternatively, you can delete the --service-account-lookup parameter from this file so
-          that the default takes effect.
-        scored: true
-
-      - id: 1.2.22
-        text: "Ensure that the --service-account-key-file argument is set as appropriate (Automated)"
-        audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep"
-        tests:
-          test_items:
-            - flag: "--service-account-key-file"
-        remediation: |
-          Edit the API server pod specification file $apiserverconf
-          on the control plane node and set the --service-account-key-file parameter
-          to the public key file for service accounts. For example,
-          --service-account-key-file=<filename>
-        scored: true
-
-      - id: 1.2.23
-        text: "Ensure that the --etcd-certfile and --etcd-keyfile arguments are set as appropriate (Automated)"
-        audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep"
-        tests:
-          bin_op: and
-          test_items:
-            - flag: "--etcd-certfile"
-            - flag: "--etcd-keyfile"
-        remediation: |
-          Follow the Kubernetes documentation and set up the TLS connection between the apiserver and etcd.
-          Then, edit the API server pod specification file $apiserverconf
-          on the control plane node and set the etcd certificate and key file parameters.
-          --etcd-certfile=<path/to/client-certificate-file>
-          --etcd-keyfile=<path/to/client-key-file>
-        scored: true
-
-      - id: 1.2.24
-        text: "Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate (Automated)"
-        audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep"
-        tests:
-          bin_op: and
-          test_items:
-            - flag: "--tls-cert-file"
-            - flag: "--tls-private-key-file"
-        remediation: |
-          Follow the Kubernetes documentation and set up the TLS connection on the apiserver.
-          Then, edit the API server pod specification file $apiserverconf
-          on the control plane node and set the TLS certificate and private key file parameters.
-          --tls-cert-file=<path/to/tls-certificate-file>
-          --tls-private-key-file=<path/to/tls-key-file>
-        scored: true
-
-      - id: 1.2.25
-        text: "Ensure that the --client-ca-file argument is set as appropriate (Automated)"
-        audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep"
-        tests:
-          test_items:
-            - flag: "--client-ca-file"
-        remediation: |
-          Follow the Kubernetes documentation and set up the TLS connection on the apiserver.
-          Then, edit the API server pod specification file $apiserverconf
-          on the control plane node and set the client certificate authority file.
-          --client-ca-file=<path/to/client-ca-file>
-        scored: true
-
-      - id: 1.2.26
-        text: "Ensure that the --etcd-cafile argument is set as appropriate (Automated)"
-        audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep"
-        tests:
-          test_items:
-            - flag: "--etcd-cafile"
-        remediation: |
-          Follow the Kubernetes documentation and set up the TLS connection between the apiserver and etcd.
-          Then, edit the API server pod specification file $apiserverconf
-          on the control plane node and set the etcd certificate authority file parameter.
-          --etcd-cafile=<path/to/ca-file>
-        scored: true
-
-      - id: 1.2.27
-        text: "Ensure that the --encryption-provider-config argument is set as appropriate (Manual)"
-        audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep"
-        tests:
-          test_items:
-            - flag: "--encryption-provider-config"
-        remediation: |
-          Follow the Kubernetes documentation and configure a EncryptionConfig file.
-          Then, edit the API server pod specification file $apiserverconf
-          on the control plane node and set the --encryption-provider-config parameter to the path of that file.
-          For example, --encryption-provider-config=</path/to/EncryptionConfig/File>
-        scored: false
-
-      - id: 1.2.28
-        text: "Ensure that encryption providers are appropriately configured (Manual)"
-        audit: |
-          ENCRYPTION_PROVIDER_CONFIG=$(ps -ef | grep $apiserverbin | grep -- --encryption-provider-config | sed 's%.*encryption-provider-config[= ]\([^ ]*\).*%\1%')
-          if test -e $ENCRYPTION_PROVIDER_CONFIG; then grep -A1 'providers:' $ENCRYPTION_PROVIDER_CONFIG | tail -n1 | grep -o "[A-Za-z]*" | sed 's/^/provider=/'; fi
-        tests:
-          test_items:
-            - flag: "provider"
-              compare:
-                op: valid_elements
-                value: "aescbc,kms,secretbox"
-        remediation: |
-          Follow the Kubernetes documentation and configure a EncryptionConfig file.
-          In this file, choose aescbc, kms or secretbox as the encryption provider.
-        scored: false
-
-      - id: 1.2.29
-        text: "Ensure that the API Server only makes use of Strong Cryptographic Ciphers (Manual)"
-        audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep"
-        tests:
-          test_items:
-            - flag: "--tls-cipher-suites"
-              compare:
-                op: valid_elements
-                value: "TLS_AES_128_GCM_SHA256,TLS_AES_256_GCM_SHA384,TLS_CHACHA20_POLY1305_SHA256,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256"
-        remediation: |
-          Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml
-          on the control plane node and set the below parameter.
-          --tls-cipher-suites=TLS_AES_128_GCM_SHA256,TLS_AES_256_GCM_SHA384,
-          TLS_CHACHA20_POLY1305_SHA256,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
-          TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
-          TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256
-        scored: false
-
-      - id: 1.2.30
-        text: "Ensure that the --service-account-extend-token-expiration parameter is set to false (Automated)"
-        audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep"
-        tests:
-          test_items:
-            - flag: "--service-account-extend-token-expiration"
-              compare:
-                op: eq
-                value: false
-        remediation: |
-          Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml on the Control Plane node and set the --service-account-extend-token-expiration parameter to false.
-          `--service-account-extend-token-expiration=false`
-          By default, this parameter is set to true.
-        scored: true
-
-  - id: 1.3
-    text: "Controller Manager"
-    checks:
-      - id: 1.3.1
-        text: "Ensure that the --terminated-pod-gc-threshold argument is set as appropriate (Manual)"
-        audit: "/bin/ps -ef | grep $controllermanagerbin | grep -v grep"
-        tests:
-          test_items:
-            - flag: "--terminated-pod-gc-threshold"
-        remediation: |
-          Edit the Controller Manager pod specification file $controllermanagerconf
-          on the control plane node and set the --terminated-pod-gc-threshold to an appropriate threshold,
-          for example, --terminated-pod-gc-threshold=10
-        scored: false
-
-      - id: 1.3.2
-        text: "Ensure that the --profiling argument is set to false (Automated)"
-        audit: "/bin/ps -ef | grep $controllermanagerbin | grep -v grep"
-        tests:
-          test_items:
-            - flag: "--profiling"
-              compare:
-                op: eq
-                value: false
-        remediation: |
-          Edit the Controller Manager pod specification file $controllermanagerconf
-          on the control plane node and set the below parameter.
-          --profiling=false
-        scored: true
-
-      - id: 1.3.3
-        text: "Ensure that the --use-service-account-credentials argument is set to true (Automated)"
-        audit: "/bin/ps -ef | grep $controllermanagerbin | grep -v grep"
-        tests:
-          test_items:
-            - flag: "--use-service-account-credentials"
-              compare:
-                op: noteq
-                value: false
-        remediation: |
-          Edit the Controller Manager pod specification file $controllermanagerconf
-          on the control plane node to set the below parameter.
-          --use-service-account-credentials=true
-        scored: true
-
-      - id: 1.3.4
-        text: "Ensure that the --service-account-private-key-file argument is set as appropriate (Automated)"
-        audit: "/bin/ps -ef | grep $controllermanagerbin | grep -v grep"
-        tests:
-          test_items:
-            - flag: "--service-account-private-key-file"
-        remediation: |
-          Edit the Controller Manager pod specification file $controllermanagerconf
-          on the control plane node and set the --service-account-private-key-file parameter
-          to the private key file for service accounts.
-          --service-account-private-key-file=<filename>
-        scored: true
-
-      - id: 1.3.5
-        text: "Ensure that the --root-ca-file argument is set as appropriate (Automated)"
-        audit: "/bin/ps -ef | grep $controllermanagerbin | grep -v grep"
-        tests:
-          test_items:
-            - flag: "--root-ca-file"
-        remediation: |
-          Edit the Controller Manager pod specification file $controllermanagerconf
-          on the control plane node and set the --root-ca-file parameter to the certificate bundle file`.
-          --root-ca-file=<path/to/file>
-        scored: true
-
-      - id: 1.3.6
-        text: "Ensure that the RotateKubeletServerCertificate argument is set to true (Automated)"
-        audit: "/bin/ps -ef | grep $controllermanagerbin | grep -v grep"
-        tests:
-          bin_op: or
-          test_items:
-            - flag: "--feature-gates"
-              compare:
-                op: nothave
-                value: "RotateKubeletServerCertificate=false"
-              set: true
-            - flag: "--feature-gates"
-              set: false
-        remediation: |
-          Edit the Controller Manager pod specification file $controllermanagerconf
-          on the control plane node and set the --feature-gates parameter to include RotateKubeletServerCertificate=true.
-          --feature-gates=RotateKubeletServerCertificate=true
-        scored: true
-
-      - id: 1.3.7
-        text: "Ensure that the --bind-address argument is set to 127.0.0.1 (Automated)"
-        audit: "/bin/ps -ef | grep $controllermanagerbin | grep -v grep"
-        tests:
-          bin_op: or
-          test_items:
-            - flag: "--bind-address"
-              compare:
-                op: eq
-                value: "127.0.0.1"
-            - flag: "--bind-address"
-              set: false
-        remediation: |
-          Edit the Controller Manager pod specification file $controllermanagerconf
-          on the control plane node and ensure the correct value for the --bind-address parameter
-        scored: true
-
-  - id: 1.4
-    text: "Scheduler"
-    checks:
-      - id: 1.4.1
-        text: "Ensure that the --profiling argument is set to false (Automated)"
-        audit: "/bin/ps -ef | grep $schedulerbin | grep -v grep"
-        tests:
-          test_items:
-            - flag: "--profiling"
-              compare:
-                op: eq
-                value: false
-        remediation: |
-          Edit the Scheduler pod specification file $schedulerconf file
-          on the control plane node and set the below parameter.
-          --profiling=false
-        scored: true
-
-      - id: 1.4.2
-        text: "Ensure that the --bind-address argument is set to 127.0.0.1 (Automated)"
-        audit: "/bin/ps -ef | grep $schedulerbin | grep -v grep"
-        tests:
-          bin_op: or
-          test_items:
-            - flag: "--bind-address"
-              compare:
-                op: eq
-                value: "127.0.0.1"
-            - flag: "--bind-address"
-              set: false
-        remediation: |
-          Edit the Scheduler pod specification file $schedulerconf
-          on the control plane node and ensure the correct value for the --bind-address parameter
-        scored: true

cfg/cis-1.12/node.yaml

@@ -1,492 +0,0 @@
----
-controls:
-version: "cis-1.12"
-id: 4
-text: "Worker Node Security Configuration"
-type: "node"
-groups:
-  - id: 4.1
-    text: "Worker Node Configuration Files"
-    checks:
-      - id: 4.1.1
-        text: "Ensure that the kubelet service file permissions are set to 600 or more restrictive (Automated)"
-        audit: '/bin/sh -c ''if test -e $kubeletsvc; then stat -c permissions=%a $kubeletsvc; fi'' '
-        tests:
-          test_items:
-            - flag: "permissions"
-              compare:
-                op: bitmask
-                value: "600"
-        remediation: |
-          Run the below command (based on the file location on your system) on the each worker node.
-          For example, chmod 600 $kubeletsvc
-        scored: true
-
-      - id: 4.1.2
-        text: "Ensure that the kubelet service file ownership is set to root:root (Automated)"
-        audit: '/bin/sh -c "if test -e $kubeletsvc; then stat -c %U:%G $kubeletsvc; else echo \"File not found\"; fi"'
-        tests:
-          bin_op: or
-          test_items:
-            - flag: root:root
-            - flag: "File not found"
-        remediation: |
-            Run the below command (based on the file location on your system) on the each worker node.
-            For example,
-            chown root:root $kubeletsvc
-        scored: true
-
-      - id: 4.1.3
-        text: "If proxy kubeconfig file exists ensure permissions are set to 600 or more restrictive (Manual)"
-        audit: '/bin/sh -c ''if test -e $proxykubeconfig; then stat -c permissions=%a $proxykubeconfig; fi'' '
-        tests:
-          bin_op: or
-          test_items:
-            - flag: "permissions"
-              set: true
-              compare:
-                op: bitmask
-                value: "600"
-        remediation: |
-          Run the below command (based on the file location on your system) on the each worker node.
-          For example,
-          chmod 600 $proxykubeconfig
-        scored: false
-
-      - id: 4.1.4
-        text: "If proxy kubeconfig file exists ensure ownership is set to root:root (Manual)"
-        audit: '/bin/sh -c ''if test -e $proxykubeconfig; then stat -c %U:%G $proxykubeconfig; fi'' '
-        tests:
-          bin_op: or
-          test_items:
-            - flag: root:root
-        remediation: |
-          Run the below command (based on the file location on your system) on the each worker node.
-          For example, chown root:root $proxykubeconfig
-        scored: false
-
-      - id: 4.1.5
-        text: "Ensure that the --kubeconfig kubelet.conf file permissions are set to 600 or more restrictive (Automated)"
-        audit: '/bin/sh -c ''if test -e $kubeletkubeconfig; then stat -c permissions=%a $kubeletkubeconfig; fi'' '
-        tests:
-          test_items:
-            - flag: "permissions"
-              compare:
-                op: bitmask
-                value: "600"
-        remediation: |
-          Run the below command (based on the file location on your system) on the each worker node.
-          For example,
-          chmod 600 $kubeletkubeconfig
-        scored: true
-
-      - id: 4.1.6
-        text: "Ensure that the --kubeconfig kubelet.conf file ownership is set to root:root (Automated)"
-        audit: '/bin/sh -c ''if test -e $kubeletkubeconfig; then stat -c %U:%G $kubeletkubeconfig; fi'' '
-        tests:
-          test_items:
-            - flag: root:root
-        remediation: |
-          Run the below command (based on the file location on your system) on the each worker node.
-          For example,
-          chown root:root $kubeletkubeconfig
-        scored: true
-
-      - id: 4.1.7
-        text: "Ensure that the certificate authorities file permissions are set to 644 or more restrictive (Manual)"
-        audit: |
-          CAFILE=$(ps -ef | grep kubelet | grep -v apiserver | grep -- --client-ca-file= | awk -F '--client-ca-file=' '{print $2}' | awk '{print $1}' | uniq)
-          if test -z $CAFILE; then CAFILE=$kubeletcafile; fi
-          if test -e $CAFILE; then stat -c permissions=%a $CAFILE; fi
-        tests:
-          test_items:
-            - flag: "permissions"
-              compare:
-                op: bitmask
-                value: "644"
-        remediation: |
-          Run the following command to modify the file permissions of the
-          --client-ca-file chmod 644 <filename>
-        scored: false
-
-      - id: 4.1.8
-        text: "Ensure that the client certificate authorities file ownership is set to root:root (Manual)"
-        audit: |
-          CAFILE=$(ps -ef | grep kubelet | grep -v apiserver | grep -- --client-ca-file= | awk -F '--client-ca-file=' '{print $2}' | awk '{print $1}' | uniq)
-          if test -z $CAFILE; then CAFILE=$kubeletcafile; fi
-          if test -e $CAFILE; then stat -c %U:%G $CAFILE; fi
-        tests:
-          test_items:
-            - flag: root:root
-              compare:
-                op: eq
-                value: root:root
-        remediation: |
-          Run the following command to modify the ownership of the --client-ca-file.
-          chown root:root <filename>
-        scored: false
-
-      - id: 4.1.9
-        text: "If the kubelet config.yaml configuration file is being used validate permissions set to 600 or more restrictive (Automated)"
-        audit: '/bin/sh -c ''if test -e $kubeletconf; then stat -c permissions=%a $kubeletconf; fi'' '
-        tests:
-          test_items:
-            - flag: "permissions"
-              compare:
-                op: bitmask
-                value: "600"
-        remediation: |
-          Run the following command (using the config file location identified in the Audit step)
-          chmod 600 $kubeletconf
-        scored: true
-
-      - id: 4.1.10
-        text: "If the kubelet config.yaml configuration file is being used validate file ownership is set to root:root (Automated)"
-        audit: '/bin/sh -c ''if test -e $kubeletconf; then stat -c %U:%G $kubeletconf; fi'' '
-        tests:
-          test_items:
-            - flag: root:root
-        remediation: |
-          Run the following command (using the config file location identified in the Audit step)
-          chown root:root $kubeletconf
-        scored: true
-
-  - id: 4.2
-    text: "Kubelet"
-    checks:
-      - id: 4.2.1
-        text: "Ensure that the --anonymous-auth argument is set to false (Automated)"
-        audit: "/bin/ps -fC $kubeletbin"
-        audit_config: "/bin/cat $kubeletconf"
-        tests:
-          test_items:
-            - flag: "--anonymous-auth"
-              path: '{.authentication.anonymous.enabled}'
-              compare:
-                op: eq
-                value: false
-        remediation: |
-          If using a Kubelet config file, edit the file to set `authentication: anonymous: enabled` to
-          `false`.
-          If using executable arguments, edit the kubelet service file
-          $kubeletsvc on each worker node and
-          set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable.
-          `--anonymous-auth=false`
-          Based on your system, restart the kubelet service. For example,
-          systemctl daemon-reload
-          systemctl restart kubelet.service
-        scored: true
-
-      - id: 4.2.2
-        text: "Ensure that the --authorization-mode argument is not set to AlwaysAllow (Automated)"
-        audit: "/bin/ps -fC $kubeletbin"
-        audit_config: "/bin/cat $kubeletconf"
-        tests:
-          test_items:
-            - flag: --authorization-mode
-              path: '{.authorization.mode}'
-              compare:
-                op: nothave
-                value: AlwaysAllow
-        remediation: |
-          If using a Kubelet config file, edit the file to set `authorization.mode` to Webhook. If
-          using executable arguments, edit the kubelet service file
-          $kubeletsvc on each worker node and
-          set the below parameter in KUBELET_AUTHZ_ARGS variable.
-          --authorization-mode=Webhook
-          Based on your system, restart the kubelet service. For example,
-          systemctl daemon-reload
-          systemctl restart kubelet.service
-        scored: true
-
-      - id: 4.2.3
-        text: "Ensure that the --client-ca-file argument is set as appropriate (Automated)"
-        audit: "/bin/ps -fC $kubeletbin"
-        audit_config: "/bin/cat $kubeletconf"
-        tests:
-          test_items:
-            - flag: --client-ca-file
-              path: '{.authentication.x509.clientCAFile}'
-        remediation: |
-          If using a Kubelet config file, edit the file to set `authentication.x509.clientCAFile` to
-          the location of the client CA file.
-          If using command line arguments, edit the kubelet service file
-          $kubeletsvc on each worker node and
-          set the below parameter in KUBELET_AUTHZ_ARGS variable.
-          --client-ca-file=<path/to/client-ca-file>
-          Based on your system, restart the kubelet service. For example,
-          systemctl daemon-reload
-          systemctl restart kubelet.service
-        scored: true
-
-      - id: 4.2.4
-        text: "Verify that if defined, the --read-only-port argument is set to 0 (Manual)"
-        audit: "/bin/ps -fC $kubeletbin"
-        audit_config: "/bin/cat $kubeletconf"
-        tests:
-          bin_op: or
-          test_items:
-            - flag: "--read-only-port"
-              path: '{.readOnlyPort}'
-              compare:
-                op: eq
-                value: 0
-            - flag: "--read-only-port"
-              path: '{.readOnlyPort}'
-              set: false
-        remediation: |
-          If using a Kubelet config file, edit the file to set `readOnlyPort` to 0.
-          If using command line arguments, edit the kubelet service file
-          $kubeletsvc on each worker node and
-          set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable.
-          --read-only-port=0
-          Based on your system, restart the kubelet service. For example,
-          systemctl daemon-reload
-          systemctl restart kubelet.service
-        scored: false
-
-      - id: 4.2.5
-        text: "Ensure that the --streaming-connection-idle-timeout argument is not set to 0 (Manual)"
-        audit: "/bin/ps -fC $kubeletbin"
-        audit_config: "/bin/cat $kubeletconf"
-        tests:
-          test_items:
-            - flag: --streaming-connection-idle-timeout
-              path: '{.streamingConnectionIdleTimeout}'
-              compare:
-                op: noteq
-                value: 0
-            - flag: --streaming-connection-idle-timeout
-              path: '{.streamingConnectionIdleTimeout}'
-              set: false
-          bin_op: or
-        remediation: |
-          If using a Kubelet config file, edit the file to set `streamingConnectionIdleTimeout` to a
-          value other than 0.
-          If using command line arguments, edit the kubelet service file
-          $kubeletsvc on each worker node and
-          set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable.
-          --streaming-connection-idle-timeout=5m
-          Based on your system, restart the kubelet service. For example,
-          systemctl daemon-reload
-          systemctl restart kubelet.service
-        scored: false
-
-      - id: 4.2.6
-        text: "Ensure that the --make-iptables-util-chains argument is set to true (Automated)"
-        audit: "/bin/ps -fC $kubeletbin"
-        audit_config: "/bin/cat $kubeletconf"
-        tests:
-          test_items:
-            - flag: --make-iptables-util-chains
-              path: '{.makeIPTablesUtilChains}'
-              compare:
-                op: eq
-                value: true
-            - flag: --make-iptables-util-chains
-              path: '{.makeIPTablesUtilChains}'
-              set: false
-          bin_op: or
-        remediation: |
-          If using a Kubelet config file, edit the file to set `makeIPTablesUtilChains` to `true`.
-          If using command line arguments, edit the kubelet service file
-          $kubeletsvc on each worker node and
-          remove the --make-iptables-util-chains argument from the
-          KUBELET_SYSTEM_PODS_ARGS variable.
-          Based on your system, restart the kubelet service. For example:
-          systemctl daemon-reload
-          systemctl restart kubelet.service
-        scored: true
-
-      - id: 4.2.7
-        text: "Ensure that the --hostname-override argument is not set (Manual)"
-        # This is one of those properties that can only be set as a command line argument.
-        # To check if the property is set as expected, we need to parse the kubelet command
-        # instead reading the Kubelet Configuration file.
-        audit: "/bin/ps -fC $kubeletbin"
-        tests:
-          test_items:
-            - flag: --hostname-override
-              set: false
-        remediation: |
-          Edit the kubelet service file $kubeletsvc
-          on each worker node and remove the --hostname-override argument from the
-          KUBELET_SYSTEM_PODS_ARGS variable.
-          Based on your system, restart the kubelet service. For example,
-          systemctl daemon-reload
-          systemctl restart kubelet.service
-        scored: false
-
-      - id: 4.2.8
-        text: "Ensure that the eventRecordQPS argument is set to a level which ensures appropriate event capture (Manual)"
-        audit: "/bin/ps -fC $kubeletbin"
-        audit_config: "/bin/cat $kubeletconf"
-        tests:
-          test_items:
-            - flag: --event-qps
-              path: '{.eventRecordQPS}'
-              compare:
-                op: gte
-                value: 0
-            - flag: --event-qps
-              path: '{.eventRecordQPS}'
-              set: false
-          bin_op: or
-        remediation: |
-          If using a Kubelet config file, edit the file to set `eventRecordQPS` to an appropriate level.
-          If using command line arguments, edit the kubelet service file
-          $kubeletsvc on each worker node and
-          set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable.
-          Based on your system, restart the kubelet service. For example,
-          systemctl daemon-reload
-          systemctl restart kubelet.service
-        scored: false
-
-      - id: 4.2.9
-        text: "Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate (Manual)"
-        audit: "/bin/ps -fC $kubeletbin"
-        audit_config: "/bin/cat $kubeletconf"
-        tests:
-          test_items:
-            - flag: --tls-cert-file
-              path: '{.tlsCertFile}'
-            - flag: --tls-private-key-file
-              path: '{.tlsPrivateKeyFile}'
-        remediation: |
-          If using a Kubelet config file, edit the file to set `tlsCertFile` to the location
-          of the certificate file to use to identify this Kubelet, and `tlsPrivateKeyFile`
-          to the location of the corresponding private key file.
-          If using command line arguments, edit the kubelet service file
-          $kubeletsvc on each worker node and
-          set the below parameters in KUBELET_CERTIFICATE_ARGS variable.
-          --tls-cert-file=<path/to/tls-certificate-file>
-          --tls-private-key-file=<path/to/tls-key-file>
-          Based on your system, restart the kubelet service. For example,
-          systemctl daemon-reload
-          systemctl restart kubelet.service
-        scored: false
-
-      - id: 4.2.10
-        text: "Ensure that the --rotate-certificates argument is not set to false (Automated)"
-        audit: "/bin/ps -fC $kubeletbin"
-        audit_config: "/bin/cat $kubeletconf"
-        tests:
-          test_items:
-            - flag: --rotate-certificates
-              path: '{.rotateCertificates}'
-              compare:
-                op: eq
-                value: true
-            - flag: --rotate-certificates
-              path: '{.rotateCertificates}'
-              set: false
-          bin_op: or
-        remediation: |
-          If using a Kubelet config file, edit the file to add the line `rotateCertificates` to `true` or
-          remove it altogether to use the default value.
-          If using command line arguments, edit the kubelet service file
-          $kubeletsvc on each worker node and
-          remove --rotate-certificates=false argument from the KUBELET_CERTIFICATE_ARGS
-          variable.
-          Based on your system, restart the kubelet service. For example,
-          systemctl daemon-reload
-          systemctl restart kubelet.service
-        scored: true
-
-      - id: 4.2.11
-        text: "Verify that the RotateKubeletServerCertificate argument is set to true (Manual)"
-        audit: "/bin/ps -fC $kubeletbin"
-        audit_config: "/bin/cat $kubeletconf"
-        tests:
-          bin_op: or
-          test_items:
-            - flag: RotateKubeletServerCertificate
-              path: '{.featureGates.RotateKubeletServerCertificate}'
-              compare:
-                op: nothave
-                value: false
-            - flag: RotateKubeletServerCertificate
-              path: '{.featureGates.RotateKubeletServerCertificate}'
-              set: false
-        remediation: |
-          Edit the kubelet service file $kubeletsvc
-          on each worker node and set the below parameter in KUBELET_CERTIFICATE_ARGS variable.
-          --feature-gates=RotateKubeletServerCertificate=true
-          Based on your system, restart the kubelet service. For example:
-          systemctl daemon-reload
-          systemctl restart kubelet.service
-        scored: false
-
-      - id: 4.2.12
-        text: "Ensure that the Kubelet only makes use of Strong Cryptographic Ciphers (Manual)"
-        audit: "/bin/ps -fC $kubeletbin"
-        audit_config: "/bin/cat $kubeletconf"
-        tests:
-          test_items:
-            - flag: --tls-cipher-suites
-              path: '{range .tlsCipherSuites[:]}{}{'',''}{end}'
-              compare:
-                op: valid_elements
-                value: TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
-        remediation: |
-          If using a Kubelet config file, edit the file to set `tlsCipherSuites` to
-          TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
-          or to a subset of these values.
-          If using executable arguments, edit the kubelet service file
-          $kubeletsvc on each worker node and
-          set the --tls-cipher-suites parameter as follows, or to a subset of these values.
-          --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
-          Based on your system, restart the kubelet service. For example:
-          systemctl daemon-reload
-          systemctl restart kubelet.service
-        scored: false
-
-      - id: 4.2.13
-        text: "Ensure that a limit is set on pod PIDs (Manual)"
-        audit: "/bin/ps -fC $kubeletbin"
-        audit_config: "/bin/cat $kubeletconf"
-        tests:
-          test_items:
-            - flag: --pod-max-pids
-              path: '{.podPidsLimit}'
-        remediation: |
-          Decide on an appropriate level for this parameter and set it,
-          either via the --pod-max-pids command line parameter or the PodPidsLimit configuration file setting.
-        scored: false
-
-      - id: 4.2.14
-        text: "Ensure that the --seccomp-default parameter is set to true (Manual)"
-        audit: "/bin/ps -fC $kubeletbin"
-        audit_config: "/bin/cat $kubeletconf"
-        tests:
-          test_items:
-            - flag: --seccomp-default
-              path: '{.seccompDefault}'
-        remediation: |
-          Set the parameter, either via the --seccomp-default command line parameter or the
-          seccompDefault configuration file setting.
-          By default the seccomp profile is not enabled.
-        scored: false
-
-  - id: 4.3
-    text: "kube-proxy"
-    checks:
-      - id: 4.3.1
-        text: "Ensure that the kube-proxy metrics service is bound to localhost (Automated)"
-        audit: "/bin/ps -fC $proxybin"
-        audit_config: "/bin/sh -c 'if test -e $proxykubeconfig; then cat $proxykubeconfig; fi'"
-        tests:
-          bin_op: or
-          test_items:
-            - flag: "--metrics-bind-address"
-              path: '{.metricsBindAddress}'
-              compare:
-                op: has
-                value: "127.0.0.1"
-            - flag: "--metrics-bind-address"
-              path: '{.metricsBindAddress}'
-              set: false
-        remediation: |
-           Modify or remove any values which bind the metrics service to a non-localhost address.
-           The default value is 127.0.0.1:10249.
-        scored: true

cfg/cis-1.12/policies.yaml

@@ -1,515 +0,0 @@
----
-controls:
-version: "cis-1.12"
-id: 5
-text: "Kubernetes Policies"
-type: "policies"
-groups:
-  - id: 5.1
-    text: "RBAC and Service Accounts"
-    checks:
-      - id: 5.1.1
-        text: "Ensure that the cluster-admin role is only used where required (Manual)"
-        audit: |
-          kubectl get clusterrolebindings -o=custom-columns=NAME:.metadata.name,ROLE:.roleRef.name,SUBJECT:.subjects[*].name --no-headers | while read -r role_name role_binding subject
-          do
-            if [[ "${role_name}" != "cluster-admin" && "${role_binding}" == "cluster-admin" ]]; then
-              is_compliant="false"
-            else
-              is_compliant="true"
-            fi;
-            echo "**role_name: ${role_name} role_binding: ${role_binding} subject: ${subject} is_compliant: ${is_compliant}"
-          done
-        use_multiple_values: true
-        tests:
-          test_items:
-            - flag: "is_compliant"
-              compare:
-                op: eq
-                value: true
-        remediation: |
-          Identify all clusterrolebindings to the cluster-admin role. Check if they are used and
-          if they need this role or if they could use a role with fewer privileges.
-          Where possible, first bind users to a lower privileged role and then remove the
-          clusterrolebinding to the cluster-admin role : kubectl delete clusterrolebinding [name]
-          Condition: is_compliant is false if rolename is not cluster-admin and rolebinding is cluster-admin.
-        scored: false
-
-      - id: 5.1.2
-        text: "Minimize access to secrets (Manual)"
-        audit: "echo \"canGetListWatchSecretsAsSystemAuthenticated: $(kubectl auth can-i get,list,watch secrets --all-namespaces --as=system:authenticated)\""
-        tests:
-          test_items:
-            - flag: "canGetListWatchSecretsAsSystemAuthenticated"
-              compare:
-                op: eq
-                value: no
-        remediation: |
-          Where possible, remove get, list and watch access to Secret objects in the cluster.
-        scored: false
-
-      - id: 5.1.3
-        text: "Minimize wildcard use in Roles and ClusterRoles (Manual)"
-        audit: |
-          # Check Roles
-          kubectl get roles --all-namespaces -o custom-columns=ROLE_NAMESPACE:.metadata.namespace,ROLE_NAME:.metadata.name --no-headers | while read -r role_namespace role_name
-          do
-            role_rules=$(kubectl get role -n "${role_namespace}" "${role_name}" -o=json | jq -c '.rules')
-            if echo "${role_rules}" | grep -q "\[\"\*\"\]"; then
-              role_is_compliant="false"
-            else
-              role_is_compliant="true"
-            fi;
-            echo "**role_name: ${role_name} role_namespace: ${role_namespace} role_rules: ${role_rules} role_is_compliant: ${role_is_compliant}"
-          done
-
-          # Check ClusterRoles
-          kubectl get clusterroles -o custom-columns=CLUSTERROLE_NAME:.metadata.name --no-headers | while read -r clusterrole_name
-          do
-            clusterrole_rules=$(kubectl get clusterrole "${clusterrole_name}" -o=json | jq -c '.rules')
-            if echo "${clusterrole_rules}" | grep -q "\[\"\*\"\]"; then
-              clusterrole_is_compliant="false"
-            else
-              clusterrole_is_compliant="true"
-            fi;
-          echo "**clusterrole_name: ${clusterrole_name} clusterrole_rules: ${clusterrole_rules} clusterrole_is_compliant: ${clusterrole_is_compliant}"
-          done
-        use_multiple_values: true
-        tests:
-          bin_op: or
-          test_items:
-            - flag: "role_is_compliant"
-              compare:
-                op: eq
-                value: true
-              set: true
-            - flag: "clusterrole_is_compliant"
-              compare:
-                op: eq
-                value: true
-              set: true
-        remediation: |
-          Where possible replace any use of wildcards ["*"] in roles and clusterroles with specific
-          objects or actions.
-          Condition: role_is_compliant is false if ["*"] is found in rules.
-          Condition: clusterrole_is_compliant is false if ["*"] is found in rules.
-        scored: false
-
-      - id: 5.1.4
-        text: "Minimize access to create pods (Manual)"
-        audit: |
-          echo "canCreatePodsAsSystemAuthenticated: $(kubectl auth can-i create pods --all-namespaces --as=system:authenticated)"
-        tests:
-          test_items:
-            - flag: "canCreatePodsAsSystemAuthenticated"
-              compare:
-                op: eq
-                value: no
-        remediation: |
-          Where possible, remove create access to pod objects in the cluster.
-        scored: false
-
-      - id: 5.1.5
-        text: "Ensure that default service accounts are not actively used (Manual)"
-        audit: |
-          kubectl get serviceaccount --all-namespaces --field-selector metadata.name=default -o=json | jq -r '.items[] | " namespace: \(.metadata.namespace), kind: \(.kind), name: \(.metadata.name), automountServiceAccountToken: \(.automountServiceAccountToken | if . == null then "notset" else . end )"' | xargs -L 1
-        use_multiple_values: true
-        tests:
-          test_items:
-            - flag: "automountServiceAccountToken"
-              compare:
-                op: eq
-                value: false
-              set: true
-        remediation: |
-          Create explicit service accounts wherever a Kubernetes workload requires specific access
-          to the Kubernetes API server.
-          Modify the configuration of each default service account to include this value
-          `automountServiceAccountToken: false`.
-        scored: false
-
-      - id: 5.1.6
-        text: "Ensure that Service Account Tokens are only mounted where necessary (Manual)"
-        audit: |
-          kubectl get pods --all-namespaces -o custom-columns=POD_NAMESPACE:.metadata.namespace,POD_NAME:.metadata.name,POD_SERVICE_ACCOUNT:.spec.serviceAccount,POD_IS_AUTOMOUNTSERVICEACCOUNTTOKEN:.spec.automountServiceAccountToken --no-headers | while read -r pod_namespace pod_name pod_service_account pod_is_automountserviceaccounttoken
-          do
-            # Retrieve automountServiceAccountToken's value for ServiceAccount and Pod, set to notset if null or <none>.
-            svacc_is_automountserviceaccounttoken=$(kubectl get serviceaccount -n "${pod_namespace}" "${pod_service_account}" -o json | jq -r '.automountServiceAccountToken' | sed -e 's/<none>/notset/g' -e 's/null/notset/g')
-            pod_is_automountserviceaccounttoken=$(echo "${pod_is_automountserviceaccounttoken}" | sed -e 's/<none>/notset/g' -e 's/null/notset/g')
-            if [ "${svacc_is_automountserviceaccounttoken}" = "false" ] && ( [ "${pod_is_automountserviceaccounttoken}" = "false" ] || [ "${pod_is_automountserviceaccounttoken}" = "notset" ] ); then
-              is_compliant="true"
-            elif [ "${svacc_is_automountserviceaccounttoken}" = "true" ] && [ "${pod_is_automountserviceaccounttoken}" = "false" ]; then
-              is_compliant="true"
-            else
-              is_compliant="false"
-            fi
-            echo "**namespace: ${pod_namespace} pod_name: ${pod_name} service_account: ${pod_service_account} pod_is_automountserviceaccounttoken: ${pod_is_automountserviceaccounttoken} svacc_is_automountServiceAccountToken: ${svacc_is_automountserviceaccounttoken} is_compliant: ${is_compliant}"
-          done
-        use_multiple_values: true
-        tests:
-          test_items:
-            - flag: "is_compliant"
-              compare:
-                op: eq
-                value: true
-        remediation: |
-          Modify the definition of ServiceAccounts and Pods which do not need to mount service
-          account tokens to disable it, with `automountServiceAccountToken: false`.
-          If both the ServiceAccount and the Pod's .spec specify a value for automountServiceAccountToken, the Pod spec takes precedence.
-          Condition: Pod is_compliant to true when
-            - ServiceAccount is automountServiceAccountToken: false and Pod is automountServiceAccountToken: false or notset
-            - ServiceAccount is automountServiceAccountToken: true notset and Pod is automountServiceAccountToken: false
-        scored: false
-
-      - id: 5.1.7
-        text: "Avoid use of system:masters group (Manual)"
-        type: "manual"
-        remediation: |
-          Remove the system:masters group from all users in the cluster.
-        scored: false
-
-      - id: 5.1.8
-        text: "Limit use of the Bind, Impersonate and Escalate permissions in the Kubernetes cluster (Manual)"
-        type: "manual"
-        remediation: |
-          Where possible, remove the impersonate, bind and escalate rights from subjects.
-        scored: false
-
-      - id: 5.1.9
-        text: "Minimize access to create persistent volumes (Manual)"
-        type: "manual"
-        remediation: |
-          Where possible, remove create access to PersistentVolume objects in the cluster.
-        scored: false
-
-      - id: 5.1.10
-        text: "Minimize access to the proxy sub-resource of nodes (Manual)"
-        type: "manual"
-        remediation: |
-          Where possible, remove access to the proxy sub-resource of node objects.
-        scored: false
-
-      - id: 5.1.11
-        text: "Minimize access to the approval sub-resource of certificatesigningrequests objects (Manual)"
-        type: "manual"
-        remediation: |
-          Where possible, remove access to the approval sub-resource of certificatesigningrequests objects.
-        scored: false
-
-      - id: 5.1.12
-        text: "Minimize access to webhook configuration objects (Manual)"
-        type: "manual"
-        remediation: |
-          Where possible, remove access to the validatingwebhookconfigurations or mutatingwebhookconfigurations objects
-        scored: false
-
-      - id: 5.1.13
-        text: "Minimize access to the service account token creation (Manual)"
-        type: "manual"
-        remediation: |
-          Where possible, remove access to the token sub-resource of serviceaccount objects.
-        scored: false
-
-  - id: 5.2
-    text: "Pod Security Standards"
-    checks:
-      - id: 5.2.1
-        text: "Ensure that the cluster has at least one active policy control mechanism in place (Manual)"
-        type: "manual"
-        remediation: |
-          Ensure that either Pod Security Admission or an external policy control system is in place
-          for every namespace which contains user workloads.
-        scored: false
-
-      - id: 5.2.2
-        text: "Minimize the admission of privileged containers (Manual)"
-        audit: |
-          kubectl get pods --all-namespaces -o custom-columns=POD_NAME:.metadata.name,POD_NAMESPACE:.metadata.namespace --no-headers | while read -r pod_name pod_namespace
-          do
-            # Retrieve container(s) for each Pod.
-            kubectl get pod "${pod_name}" --namespace "${pod_namespace}" -o json | jq -c '.spec.containers[]' | while read -r container
-            do
-              # Retrieve container's name.
-              container_name=$(echo ${container} | jq -r '.name')
-              # Retrieve container's .securityContext.privileged value.
-              container_privileged=$(echo ${container} | jq -r '.securityContext.privileged' | sed -e 's/null/notset/g')
-              if [ "${container_privileged}" = "false" ] || [ "${container_privileged}" = "notset" ] ; then
-                echo "***pod_name: ${pod_name} container_name: ${container_name} pod_namespace: ${pod_namespace} is_container_privileged: ${container_privileged} is_compliant: true"
-              else
-                echo "***pod_name: ${pod_name} container_name: ${container_name} pod_namespace: ${pod_namespace} is_container_privileged: ${container_privileged} is_compliant: false"
-              fi
-            done
-          done
-        use_multiple_values: true
-        tests:
-          test_items:
-            - flag: "is_compliant"
-              compare:
-                op: eq
-                value: true
-        remediation: |
-          Add policies to each namespace in the cluster which has user workloads to restrict the
-          admission of privileged containers.
-          Audit: the audit list all pods' containers to retrieve their .securityContext.privileged value.
-          Condition: is_compliant is false if container's `.securityContext.privileged` is set to `true`.
-          Default: by default, there are no restrictions on the creation of privileged containers.
-        scored: false
-
-      - id: 5.2.3
-        text: "Minimize the admission of containers wishing to share the host process ID namespace (Manual)"
-        audit: |
-          kubectl get pods --all-namespaces -o custom-columns=POD_NAME:.metadata.name,POD_NAMESPACE:.metadata.namespace --no-headers | while read -r pod_name pod_namespace
-          do
-            # Retrieve spec.hostPID for each pod.
-            pod_hostpid=$(kubectl get pod "${pod_name}" --namespace "${pod_namespace}" -o jsonpath='{.spec.hostPID}' 2>/dev/null)
-            if [ -z "${pod_hostpid}" ]; then
-              pod_hostpid="false"
-              echo "***pod_name: ${pod_name} pod_namespace: ${pod_namespace} is_pod_hostpid: ${pod_hostpid} is_compliant: true"
-            else
-              echo "***pod_name: ${pod_name} pod_namespace: ${pod_namespace} is_pod_hostpid: ${pod_hostpid} is_compliant: false"
-            fi
-          done
-        use_multiple_values: true
-        tests:
-          test_items:
-            - flag: "is_compliant"
-              compare:
-                op: eq
-                value: true
-        remediation: |
-          Add policies to each namespace in the cluster which has user workloads to restrict the
-          admission of `hostPID` containers.
-          Audit: the audit retrieves each Pod' spec.hostPID.
-          Condition: is_compliant is false if Pod's spec.hostPID is set to `true`.
-          Default: by default, there are no restrictions on the creation of hostPID containers.
-        scored: false
-
-      - id: 5.2.4
-        text: "Minimize the admission of containers wishing to share the host IPC namespace (Manual)"
-        audit: |
-          kubectl get pods --all-namespaces -o custom-columns=POD_NAME:.metadata.name,POD_NAMESPACE:.metadata.namespace --no-headers | while read -r pod_name pod_namespace
-          do
-            # Retrieve spec.hostIPC for each pod.
-            pod_hostipc=$(kubectl get pod "${pod_name}" --namespace "${pod_namespace}" -o jsonpath='{.spec.hostIPC}' 2>/dev/null)
-            if [ -z "${pod_hostipc}" ]; then
-              pod_hostipc="false"
-              echo "***pod_name: ${pod_name} pod_namespace: ${pod_namespace} is_pod_hostipc: ${pod_hostipc} is_compliant: true"
-            else
-              echo "***pod_name: ${pod_name} pod_namespace: ${pod_namespace} is_pod_hostipc: ${pod_hostipc} is_compliant: false"
-            fi
-          done
-        use_multiple_values: true
-        tests:
-          test_items:
-            - flag: "is_compliant"
-              compare:
-                op: eq
-                value: true
-        remediation: |
-          Add policies to each namespace in the cluster which has user workloads to restrict the
-          admission of `hostIPC` containers.
-          Audit: the audit retrieves each Pod' spec.IPC.
-          Condition: is_compliant is false if Pod's spec.hostIPC is set to `true`.
-          Default: by default, there are no restrictions on the creation of hostIPC containers.
-        scored: false
-
-      - id: 5.2.5
-        text: "Minimize the admission of containers wishing to share the host network namespace (Manual)"
-        audit: |
-          kubectl get pods --all-namespaces -o custom-columns=POD_NAME:.metadata.name,POD_NAMESPACE:.metadata.namespace --no-headers | while read -r pod_name pod_namespace
-          do
-            # Retrieve spec.hostNetwork for each pod.
-            pod_hostnetwork=$(kubectl get pod "${pod_name}" --namespace "${pod_namespace}" -o jsonpath='{.spec.hostNetwork}' 2>/dev/null)
-            if [ -z "${pod_hostnetwork}" ]; then
-              pod_hostnetwork="false"
-              echo "***pod_name: ${pod_name} pod_namespace: ${pod_namespace} is_pod_hostnetwork: ${pod_hostnetwork} is_compliant: true"
-            else
-              echo "***pod_name: ${pod_name} pod_namespace: ${pod_namespace} is_pod_hostnetwork: ${pod_hostnetwork} is_compliant: false"
-            fi
-          done
-        use_multiple_values: true
-        tests:
-          test_items:
-            - flag: "is_compliant"
-              compare:
-                op: eq
-                value: true
-        remediation: |
-          Add policies to each namespace in the cluster which has user workloads to restrict the
-          admission of `hostNetwork` containers.
-          Audit: the audit retrieves each Pod' spec.hostNetwork.
-          Condition: is_compliant is false if Pod's spec.hostNetwork is set to `true`.
-          Default: by default, there are no restrictions on the creation of hostNetwork containers.
-        scored: false
-
-      - id: 5.2.6
-        text: "Minimize the admission of containers with allowPrivilegeEscalation (Manual)"
-        audit: |
-          kubectl get pods --all-namespaces -o custom-columns=POD_NAME:.metadata.name,POD_NAMESPACE:.metadata.namespace --no-headers | while read -r pod_name pod_namespace
-          do
-            # Retrieve container(s) for each Pod.
-            kubectl get pod "${pod_name}" --namespace "${pod_namespace}" -o json | jq -c '.spec.containers[]' | while read -r container
-            do
-              # Retrieve container's name
-              container_name=$(echo ${container} | jq -r '.name')
-              # Retrieve container's .securityContext.allowPrivilegeEscalation
-              container_allowprivesc=$(echo ${container} | jq -r '.securityContext.allowPrivilegeEscalation' | sed -e 's/null/notset/g')
-              if [ "${container_allowprivesc}" = "false" ] || [ "${container_allowprivesc}" = "notset" ]; then
-                echo "***pod_name: ${pod_name} container_name: ${container_name} pod_namespace: ${pod_namespace} is_container_allowprivesc: ${container_allowprivesc} is_compliant: true"
-              else
-                echo "***pod_name: ${pod_name} container_name: ${container_name} pod_namespace: ${pod_namespace} is_container_allowprivesc: ${container_allowprivesc} is_compliant: false"
-              fi
-            done
-          done
-        use_multiple_values: true
-        tests:
-          test_items:
-            - flag: "is_compliant"
-              compare:
-                op: eq
-                value: true
-        remediation: |
-          Add policies to each namespace in the cluster which has user workloads to restrict the
-          admission of containers with `.securityContext.allowPrivilegeEscalation` set to `true`.
-          Audit: the audit retrieves each Pod's container(s) `.securityContext.allowPrivilegeEscalation`.
-          Condition: is_compliant is false if container's `.securityContext.allowPrivilegeEscalation` is set to `true`.
-          Default: If notset, privilege escalation is allowed (default to true). However if PSP/PSA is used with a `restricted` profile,
-          privilege escalation is explicitly disallowed unless configured otherwise.
-        scored: false
-
-      - id: 5.2.7
-        text: "Minimize the admission of root containers (Manual)"
-        type: "manual"
-        remediation: |
-          Create a policy for each namespace in the cluster, ensuring that either `MustRunAsNonRoot`
-          or `MustRunAs` with the range of UIDs not including 0, is set.
-        scored: false
-
-      - id: 5.2.8
-        text: "Minimize the admission of containers with the NET_RAW capability (Manual)"
-        type: "manual"
-        remediation: |
-          Add policies to each namespace in the cluster which has user workloads to restrict the
-          admission of containers with the `NET_RAW` capability.
-        scored: false
-
-      - id: 5.2.9
-        text: "Minimize the admission of containers with capabilities assigned (Manual)"
-        type: "manual"
-        remediation: |
-          Review the use of capabilities in applications running on your cluster. Where a
-          namespace contains applications which do not require any Linux capabilities to operate
-          consider adding a policy which forbids the admission of containers which do not drop all
-          capabilities.
-        scored: false
-
-      - id: 5.2.10
-        text: "Minimize the admission of Windows HostProcess containers (Manual)"
-        type: "manual"
-        remediation: |
-          Add policies to each namespace in the cluster which has user workloads to restrict the
-          admission of containers that have `.securityContext.windowsOptions.hostProcess` set to `true`.
-        scored: false
-
-      - id: 5.2.11
-        text: "Minimize the admission of HostPath volumes (Manual)"
-        type: "manual"
-        remediation: |
-          Add policies to each namespace in the cluster which has user workloads to restrict the
-          admission of containers with `hostPath` volumes.
-        scored: false
-
-      - id: 5.2.12
-        text: "Minimize the admission of containers which use HostPorts (Manual)"
-        type: "manual"
-        remediation: |
-          Add policies to each namespace in the cluster which has user workloads to restrict the
-          admission of containers which use `hostPort` sections.
-        scored: false
-
-  - id: 5.3
-    text: "Network Policies and CNI"
-    checks:
-      - id: 5.3.1
-        text: "Ensure that the CNI in use supports NetworkPolicies (Manual)"
-        type: "manual"
-        remediation: |
-          If the CNI plugin in use does not support network policies, consideration should be given to
-          making use of a different plugin, or finding an alternate mechanism for restricting traffic
-          in the Kubernetes cluster.
-        scored: false
-
-      - id: 5.3.2
-        text: "Ensure that all Namespaces have NetworkPolicies defined (Manual)"
-        type: "manual"
-        remediation: |
-          Follow the documentation and create NetworkPolicy objects as you need them.
-        scored: false
-
-  - id: 5.4
-    text: "Secrets Management"
-    checks:
-      - id: 5.4.1
-        text: "Prefer using Secrets as files over Secrets as environment variables (Manual)"
-        type: "manual"
-        remediation: |
-          If possible, rewrite application code to read Secrets from mounted secret files, rather than
-          from environment variables.
-        scored: false
-
-      - id: 5.4.2
-        text: "Consider external secret storage (Manual)"
-        type: "manual"
-        remediation: |
-          Refer to the Secrets management options offered by your cloud provider or a third-party
-          secrets management solution.
-        scored: false
-
-  - id: 5.5
-    text: "Extensible Admission Control"
-    checks:
-      - id: 5.5.1
-        text: "Configure Image Provenance using ImagePolicyWebhook admission controller (Manual)"
-        type: "manual"
-        remediation: |
-          Follow the Kubernetes documentation and setup image provenance.
-        scored: false
-
-  - id: 5.6
-    text: "General Policies"
-    checks:
-      - id: 5.6.1
-        text: "Create administrative boundaries between resources using namespaces (Manual)"
-        type: "manual"
-        remediation: |
-          Follow the documentation and create namespaces for objects in your deployment as you need
-          them.
-        scored: false
-
-      - id: 5.6.2
-        text: "Ensure that the seccomp profile is set to docker/default in your Pod definitions (Manual)"
-        type: "manual"
-        remediation: |
-          Use `securityContext` to enable the docker/default seccomp profile in your pod definitions.
-          An example is as below:
-            securityContext:
-              seccompProfile:
-                type: RuntimeDefault
-        scored: false
-
-      - id: 5.6.3
-        text: "Apply SecurityContext to your Pods and Containers (Manual)"
-        type: "manual"
-        remediation: |
-          Follow the Kubernetes documentation and apply SecurityContexts to your Pods. For a
-          suggested list of SecurityContexts, you may refer to the CIS Security Benchmark for Docker
-          Containers.
-        scored: false
-
-      - id: 5.6.4
-        text: "The default namespace should not be used (Manual)"
-        type: "manual"
-        remediation: |
-          Ensure that namespaces are created to allow for appropriate segregation of Kubernetes
-          resources and that all new resources are created in a specific namespace.
-        scored: false

cfg/cis-1.20/master.yaml

@@ -153,13 +153,7 @@ groups:
 
       - id: 1.1.11
         text: "Ensure that the etcd data directory permissions are set to 700 or more restrictive (Automated)"
-        audit: |
-          DATA_DIR=''
-          for d in $(ps -ef | grep $etcdbin | grep -- --data-dir | sed 's%.*data-dir[= ]\([^ ]*\).*%\1%'); do
-            if test -d "$d"; then DATA_DIR="$d"; fi
-          done
-          if ! test -d "$DATA_DIR"; then DATA_DIR=$etcddatadir; fi
-          stat -c permissions=%a "$DATA_DIR"
+        audit: ps -ef | grep $etcdbin | grep -- --data-dir | sed 's%.*data-dir[= ]\([^ ]*\).*%\1%' | xargs stat -c permissions=%a
         tests:
           test_items:
             - flag: "permissions"
@@ -176,13 +170,7 @@ groups:
 
       - id: 1.1.12
         text: "Ensure that the etcd data directory ownership is set to etcd:etcd (Automated)"
-        audit: |
-          DATA_DIR=''
-          for d in $(ps -ef | grep $etcdbin | grep -- --data-dir | sed 's%.*data-dir[= ]\([^ ]*\).*%\1%'); do
-            if test -d "$d"; then DATA_DIR="$d"; fi
-          done
-          if ! test -d "$DATA_DIR"; then DATA_DIR=$etcddatadir; fi
-          stat -c %U:%G "$DATA_DIR"
+        audit: ps -ef | grep $etcdbin | grep -- --data-dir | sed 's%.*data-dir[= ]\([^ ]*\).*%\1%' | xargs stat -c %U:%G
         tests:
           test_items:
             - flag: "etcd:etcd"

cfg/cis-1.20/node.yaml

@@ -25,16 +25,14 @@ groups:
 
       - id: 4.1.2
         text: "Ensure that the kubelet service file ownership is set to root:root (Automated)"
-        audit: '/bin/sh -c "if test -e $kubeletsvc; then stat -c %U:%G $kubeletsvc; else echo \"File not found\"; fi"'
+        audit: '/bin/sh -c ''if test -e $kubeletsvc; then stat -c %U:%G $kubeletsvc; fi'' '
         tests:
-          bin_op: or
           test_items:
             - flag: root:root
-            - flag: "File not found"
         remediation: |
-            Run the below command (based on the file location on your system) on the each worker node.
-            For example,
-            chown root:root $kubeletsvc
+          Run the below command (based on the file location on your system) on the each worker node.
+          For example,
+          chown root:root $kubeletsvc
         scored: true
 
       - id: 4.1.3
@@ -48,6 +46,8 @@ groups:
               compare:
                 op: bitmask
                 value: "644"
+            - flag: "$proxykubeconfig"
+              set: false
         remediation: |
           Run the below command (based on the file location on your system) on the each worker node.
           For example,
@@ -61,6 +61,8 @@ groups:
           bin_op: or
           test_items:
             - flag: root:root
+            - flag: "$proxykubeconfig"
+              set: false
         remediation: |
           Run the below command (based on the file location on your system) on the each worker node.
           For example, chown root:root $proxykubeconfig
@@ -96,7 +98,7 @@ groups:
       - id: 4.1.7
         text: "Ensure that the certificate authorities file permissions are set to 644 or more restrictive (Manual)"
         audit: |
-          CAFILE=$(ps -ef | grep kubelet | grep -v apiserver | grep -- --client-ca-file= | awk -F '--client-ca-file=' '{print $2}' | awk '{print $1}' | uniq)
+          CAFILE=$(ps -ef | grep kubelet | grep -v apiserver | grep -- --client-ca-file= | awk -F '--client-ca-file=' '{print $2}' | awk '{print $1}')
           if test -z $CAFILE; then CAFILE=$kubeletcafile; fi
           if test -e $CAFILE; then stat -c permissions=%a $CAFILE; fi
         tests:
@@ -113,7 +115,7 @@ groups:
       - id: 4.1.8
         text: "Ensure that the client certificate authorities file ownership is set to root:root (Manual)"
         audit: |
-          CAFILE=$(ps -ef | grep kubelet | grep -v apiserver | grep -- --client-ca-file= | awk -F '--client-ca-file=' '{print $2}' | awk '{print $1}' | uniq)
+          CAFILE=$(ps -ef | grep kubelet | grep -v apiserver | grep -- --client-ca-file= | awk -F '--client-ca-file=' '{print $2}' | awk '{print $1}')
           if test -z $CAFILE; then CAFILE=$kubeletcafile; fi
           if test -e $CAFILE; then stat -c %U:%G $CAFILE; fi
         tests:
@@ -386,7 +388,7 @@ groups:
         scored: false
 
       - id: 4.2.11
-        text: "Ensure that the --rotate-certificates argument is not set to false (Automated)"
+        text: "Ensure that the --rotate-certificates argument is not set to false (Manual)"
         audit: "/bin/ps -fC $kubeletbin"
         audit_config: "/bin/cat $kubeletconf"
         tests:
@@ -410,7 +412,7 @@ groups:
           Based on your system, restart the kubelet service. For example:
           systemctl daemon-reload
           systemctl restart kubelet.service
-        scored: true
+        scored: false
 
       - id: 4.2.12
         text: "Verify that the RotateKubeletServerCertificate argument is set to true (Manual)"
@@ -448,7 +450,7 @@ groups:
                 op: valid_elements
                 value: TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256
         remediation: |
-          If using a Kubelet config file, edit the file to set tlsCipherSuites: to
+          If using a Kubelet config file, edit the file to set TLSCipherSuites: to
           TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256
           or to a subset of these values.
           If using executable arguments, edit the kubelet service file

cfg/cis-1.20/policies.yaml

@@ -146,7 +146,7 @@ groups:
         type: "manual"
         remediation: |
           Review the use of capabilites in applications running on your cluster. Where a namespace
-          contains applications which do not require any Linux capabities to operate consider adding
+          contains applicaions which do not require any Linux capabities to operate consider adding
           a PSP which forbids the admission of containers which do not drop all capabilities.
         scored: false
 

cfg/cis-1.23/master.yaml

@@ -147,13 +147,7 @@ groups:
 
       - id: 1.1.11
         text: "Ensure that the etcd data directory permissions are set to 700 or more restrictive (Automated)"
-        audit: |
-          DATA_DIR=''
-          for d in $(ps -ef | grep $etcdbin | grep -- --data-dir | sed 's%.*data-dir[= ]\([^ ]*\).*%\1%'); do
-            if test -d "$d"; then DATA_DIR="$d"; fi
-          done
-          if ! test -d "$DATA_DIR"; then DATA_DIR=$etcddatadir; fi
-          stat -c permissions=%a "$DATA_DIR"
+        audit: ps -ef | grep $etcdbin | grep -- --data-dir | sed 's%.*data-dir[= ]\([^ ]*\).*%\1%' | xargs stat -c permissions=%a
         tests:
           test_items:
             - flag: "permissions"
@@ -169,13 +163,7 @@ groups:
 
       - id: 1.1.12
         text: "Ensure that the etcd data directory ownership is set to etcd:etcd (Automated)"
-        audit: |
-          DATA_DIR=''
-          for d in $(ps -ef | grep $etcdbin | grep -- --data-dir | sed 's%.*data-dir[= ]\([^ ]*\).*%\1%'); do
-            if test -d "$d"; then DATA_DIR="$d"; fi
-          done
-          if ! test -d "$DATA_DIR"; then DATA_DIR=$etcddatadir; fi
-          stat -c %U:%G "$DATA_DIR"
+        audit: ps -ef | grep $etcdbin | grep -- --data-dir | sed 's%.*data-dir[= ]\([^ ]*\).*%\1%' | xargs stat -c %U:%G
         tests:
           test_items:
             - flag: "etcd:etcd"

cfg/cis-1.23/node.yaml

@@ -24,16 +24,14 @@ groups:
 
       - id: 4.1.2
         text: "Ensure that the kubelet service file ownership is set to root:root (Automated)"
-        audit: '/bin/sh -c "if test -e $kubeletsvc; then stat -c %U:%G $kubeletsvc; else echo \"File not found\"; fi"'
+        audit: '/bin/sh -c ''if test -e $kubeletsvc; then stat -c %U:%G $kubeletsvc; fi'' '
         tests:
-          bin_op: or
           test_items:
             - flag: root:root
-            - flag: "File not found"
         remediation: |
-            Run the below command (based on the file location on your system) on the each worker node.
-            For example,
-            chown root:root $kubeletsvc
+          Run the below command (based on the file location on your system) on the each worker node.
+          For example,
+          chown root:root $kubeletsvc
         scored: true
 
       - id: 4.1.3
@@ -47,6 +45,8 @@ groups:
               compare:
                 op: bitmask
                 value: "644"
+            - flag: "$proxykubeconfig"
+              set: false
         remediation: |
           Run the below command (based on the file location on your system) on the each worker node.
           For example,
@@ -60,6 +60,8 @@ groups:
           bin_op: or
           test_items:
             - flag: root:root
+            - flag: "$proxykubeconfig"
+              set: false
         remediation: |
           Run the below command (based on the file location on your system) on the each worker node.
           For example, chown root:root $proxykubeconfig
@@ -95,7 +97,7 @@ groups:
       - id: 4.1.7
         text: "Ensure that the certificate authorities file permissions are set to 644 or more restrictive (Manual)"
         audit: |
-          CAFILE=$(ps -ef | grep kubelet | grep -v apiserver | grep -- --client-ca-file= | awk -F '--client-ca-file=' '{print $2}' | awk '{print $1}' | uniq)
+          CAFILE=$(ps -ef | grep kubelet | grep -v apiserver | grep -- --client-ca-file= | awk -F '--client-ca-file=' '{print $2}' | awk '{print $1}')
           if test -z $CAFILE; then CAFILE=$kubeletcafile; fi
           if test -e $CAFILE; then stat -c permissions=%a $CAFILE; fi
         tests:
@@ -112,7 +114,7 @@ groups:
       - id: 4.1.8
         text: "Ensure that the client certificate authorities file ownership is set to root:root (Manual)"
         audit: |
-          CAFILE=$(ps -ef | grep kubelet | grep -v apiserver | grep -- --client-ca-file= | awk -F '--client-ca-file=' '{print $2}' | awk '{print $1}' | uniq)
+          CAFILE=$(ps -ef | grep kubelet | grep -v apiserver | grep -- --client-ca-file= | awk -F '--client-ca-file=' '{print $2}' | awk '{print $1}')
           if test -z $CAFILE; then CAFILE=$kubeletcafile; fi
           if test -e $CAFILE; then stat -c %U:%G $CAFILE; fi
         tests:
@@ -447,7 +449,7 @@ groups:
                 op: valid_elements
                 value: TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256
         remediation: |
-          If using a Kubelet config file, edit the file to set `tlsCipherSuites` to
+          If using a Kubelet config file, edit the file to set `TLSCipherSuites` to
           TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256
           or to a subset of these values.
           If using executable arguments, edit the kubelet service file

cfg/cis-1.23/policies.yaml

@@ -153,7 +153,7 @@ groups:
         type: "manual"
         remediation: |
           Review the use of capabilites in applications running on your cluster. Where a namespace
-          contains applications which do not require any Linux capabities to operate consider adding
+          contains applicaions which do not require any Linux capabities to operate consider adding
           a PSP which forbids the admission of containers which do not drop all capabilities.
         scored: false
 

cfg/cis-1.24-microk8s/config.yaml

@@ -1,2 +0,0 @@
----
-## Version-specific settings that override the values in cfg/config.yaml

cfg/cis-1.24-microk8s/controlplane.yaml

@@ -1,46 +0,0 @@
----
-controls:
-version: "cis-1.24"
-id: 3
-text: "Control Plane Configuration"
-type: "controlplane"
-groups:
-  - id: 3.1
-    text: "Authentication and Authorization"
-    checks:
-      - id: 3.1.1
-        text: "Client certificate authentication should not be used for users (Manual)"
-        type: "manual"
-        remediation: |
-          Alternative mechanisms provided by Kubernetes such as the use of OIDC should be
-          implemented in place of client certificates.
-        scored: false
-
-  - id: 3.2
-    text: "Logging"
-    checks:
-      - id: 3.2.1
-        text: "Ensure that a minimal audit policy is created (Manual)"
-        audit: "cat $apiserverconf | grep -v grep"
-        tests:
-          test_items:
-            - flag: "--audit-policy-file"
-              set: true
-        remediation: |
-          Create an audit policy file for your cluster.
-        scored: false
-
-      - id: 3.2.2
-        text: "Ensure that the audit policy covers key security concerns (Manual)"
-        type: "manual"
-        remediation: |
-          Review the audit policy provided for the cluster and ensure that it covers
-          at least the following areas,
-          - Access to Secrets managed by the cluster. Care should be taken to only
-            log Metadata for requests to Secrets, ConfigMaps, and TokenReviews, in
-            order to avoid risk of logging sensitive data.
-          - Modification of Pod and Deployment objects.
-          - Use of `pods/exec`, `pods/portforward`, `pods/proxy` and `services/proxy`.
-          For most requests, minimally logging at the Metadata level is recommended
-          (the most basic level of logging).
-        scored: false

cfg/cis-1.24-microk8s/etcd.yaml

@@ -1,121 +0,0 @@
----
-controls:
-version: "cis-1.24"
-id: 2
-text: "Etcd Node Configuration"
-type: "etcd"
-groups:
-  - id: 2
-    text: "Etcd Node Configuration"
-    checks:
-      - id: 2.1
-        text: "Ensure that the --cert-file and --key-file arguments are set as appropriate (Automated)"
-        audit: "/bin/ps -ef | /bin/grep $etcdbin | /bin/grep -v grep"
-        tests:
-          bin_op: and
-          test_items:
-            - flag: "--cert-file"
-              env: "ETCD_CERT_FILE"
-            - flag: "--key-file"
-              env: "ETCD_KEY_FILE"
-        remediation: |
-          Not applicable. MicroK8s used dqlite and the communication to this service is done through a
-          local socket (/var/snap/microk8s/current/var/kubernetes/backend/kine.sock:12379) accessible
-          to users with root permissions.
-        scored: false
-
-      - id: 2.2
-        text: "Ensure that the --client-cert-auth argument is set to true (Automated)"
-        audit: "/bin/ps -ef | /bin/grep $etcdbin | /bin/grep -v grep"
-        tests:
-          test_items:
-            - flag: "--client-cert-auth"
-              env: "ETCD_CLIENT_CERT_AUTH"
-              compare:
-                op: eq
-                value: true
-        remediation: |
-          Not applicable. MicroK8s used dqlite and the communication to this service is done through a
-          local socket (/var/snap/microk8s/current/var/kubernetes/backend/kine.sock:12379) accessible
-          to users with root permissions.
-        scored: false
-
-      - id: 2.3
-        text: "Ensure that the --auto-tls argument is not set to true (Automated)"
-        audit: "/bin/ps -ef | /bin/grep $etcdbin | /bin/grep -v grep"
-        tests:
-          bin_op: or
-          test_items:
-            - flag: "--auto-tls"
-              env: "ETCD_AUTO_TLS"
-              set: false
-            - flag: "--auto-tls"
-              env: "ETCD_AUTO_TLS"
-              compare:
-                op: eq
-                value: false
-        remediation: |
-          Not applicable. MicroK8s used dqlite and the communication to this service is done through a
-          local socket (/var/snap/microk8s/current/var/kubernetes/backend/kine.sock:12379) accessible
-          to users with root permissions.
-        scored: false
-
-      - id: 2.4
-        text: "Ensure that the --peer-cert-file and --peer-key-file arguments are set as appropriate (Automated)"
-        audit: "if test -e /var/snap/microk8s/current/var/kubernetes/backend/cluster.crt && test -e /var/snap/microk8s/current/var/kubernetes/backend/cluster.key; then echo 'certs-found'; fi"
-        tests:
-          test_items:
-            - flag: "certs-found"
-        remediation: |
-          The certificate pair for dqlite and tls peer communication is
-          /var/snap/microk8s/current/var/kubernetes/backend/cluster.crt and
-          /var/snap/microk8s/current/var/kubernetes/backend/cluster.key.
-        scored: true
-
-      - id: 2.5
-        text: "Ensure that the --peer-client-cert-auth argument is set to true (Automated)"
-        audit: "/bin/cat $etcdconf | /bin/grep enable-tls || true"
-        tests:
-          bin_op: or
-          test_items:
-            - flag: "--enable-tls"
-              compare:
-                op: eq
-                value: true
-            - flag: "--enable-tls"
-              set: false
-        remediation: |
-          MicroK8s used dqlite and tls peer communication uses is TLS if the --enable-tls is set in
-          /var/snap/microk8s/current/args/k8s-dqlite, set to true by default.
-        scored: true
-
-      - id: 2.6
-        text: "Ensure that the --peer-auto-tls argument is not set to true (Automated)"
-        audit: "/bin/ps -ef | /bin/grep $etcdbin | /bin/grep -v grep"
-        tests:
-          bin_op: or
-          test_items:
-            - flag: "--peer-auto-tls"
-              env: "ETCD_PEER_AUTO_TLS"
-              set: false
-            - flag: "--peer-auto-tls"
-              env: "ETCD_PEER_AUTO_TLS"
-              compare:
-                op: eq
-                value: false
-        remediation: |
-          Not applicable. MicroK8s used dqlite and tls peer communication uses the certificates
-          created upon the snap creation.
-        scored: false
-
-      - id: 2.7
-        text: "Ensure that a unique Certificate Authority is used for etcd (Manual)"
-        audit: "/bin/ps -ef | /bin/grep $etcdbin | /bin/grep -v grep"
-        tests:
-          test_items:
-            - flag: "--trusted-ca-file"
-              env: "ETCD_TRUSTED_CA_FILE"
-        remediation: |
-          Not applicable. MicroK8s used dqlite and tls peer communication uses the certificates
-          created upon the snap creation.
-        scored: false

cfg/cis-1.24-microk8s/master.yaml

@@ -1,948 +0,0 @@
----
-controls:
-version: "cis-1.24"
-id: 1
-text: "Control Plane Security Configuration"
-type: "master"
-groups:
-  - id: 1.1
-    text: "Control Plane Node Configuration Files"
-    checks:
-      - id: 1.1.1
-        text: "Ensure that the API server pod specification file permissions are set to 644 or more restrictive (Automated)"
-        audit: "/bin/sh -c 'if test -e $apiserverconf; then stat -c permissions=%a $apiserverconf; fi'"
-        tests:
-          test_items:
-            - flag: "permissions"
-              compare:
-                op: bitmask
-                value: "644"
-        remediation: |
-          Run the below command (based on the file location on your system) on the
-          control plane node.
-          For example, chmod 644 $apiserverconf
-        scored: true
-
-      - id: 1.1.2
-        text: "Ensure that the API server pod specification file ownership is set to root:root (Automated)"
-        audit: "/bin/sh -c 'if test -e $apiserverconf; then stat -c %U:%G $apiserverconf; fi'"
-        tests:
-          test_items:
-            - flag: "root:root"
-        remediation: |
-          Run the below command (based on the file location on your system) on the control plane node.
-          For example, chown root:root $apiserverconf
-        scored: true
-
-      - id: 1.1.3
-        text: "Ensure that the controller manager pod specification file permissions are set to 600 or more restrictive (Automated)"
-        audit: "/bin/sh -c 'if test -e $controllermanagerconf; then stat -c permissions=%a $controllermanagerconf; fi'"
-        tests:
-          test_items:
-            - flag: "permissions"
-              compare:
-                op: bitmask
-                value: "600"
-        remediation: |
-          Run the below command (based on the file location on your system) on the control plane node.
-          For example, chmod 600 $controllermanagerconf
-        scored: true
-
-      - id: 1.1.4
-        text: "Ensure that the controller manager pod specification file ownership is set to root:root (Automated)"
-        audit: "/bin/sh -c 'if test -e $controllermanagerconf; then stat -c %U:%G $controllermanagerconf; fi'"
-        tests:
-          test_items:
-            - flag: "root:root"
-        remediation: |
-          Run the below command (based on the file location on your system) on the control plane node.
-          For example, chown root:root $controllermanagerconf
-        scored: true
-
-      - id: 1.1.5
-        text: "Ensure that the scheduler pod specification file permissions are set to 600 or more restrictive (Automated)"
-        audit: "/bin/sh -c 'if test -e $schedulerconf; then stat -c permissions=%a $schedulerconf; fi'"
-        tests:
-          test_items:
-            - flag: "permissions"
-              compare:
-                op: bitmask
-                value: "600"
-        remediation: |
-          Run the below command (based on the file location on your system) on the control plane node.
-          For example, chmod 600 $schedulerconf
-        scored: true
-
-      - id: 1.1.6
-        text: "Ensure that the scheduler pod specification file ownership is set to root:root (Automated)"
-        audit: "/bin/sh -c 'if test -e $schedulerconf; then stat -c %U:%G $schedulerconf; fi'"
-        tests:
-          test_items:
-            - flag: "root:root"
-        remediation: |
-          Run the below command (based on the file location on your system) on the control plane node.
-          For example, chown root:root $schedulerconf
-        scored: true
-
-      - id: 1.1.7
-        text: "Ensure that the etcd pod specification file permissions are set to 600 or more restrictive (Automated)"
-        audit: "/bin/sh -c 'if test -e $etcdconf; then stat -c permissions=%a $etcdconf; fi'"
-        use_multiple_values: true
-        tests:
-          test_items:
-            - flag: "permissions"
-              compare:
-                op: bitmask
-                value: "600"
-        remediation: |
-          Run the below command (based on the file location on your system) on the control plane node.
-          For example,
-          chmod 600 $etcdconf
-        scored: true
-
-      - id: 1.1.8
-        text: "Ensure that the etcd pod specification file ownership is set to root:root (Automated)"
-        audit: "/bin/sh -c 'if test -e $etcdconf; then stat -c %U:%G $etcdconf; fi'"
-        use_multiple_values: true
-        tests:
-          test_items:
-            - flag: "root:root"
-        remediation: |
-          Run the below command (based on the file location on your system) on the control plane node.
-          For example,
-          chown root:root $etcdconf
-        scored: true
-
-      - id: 1.1.9
-        text: "Ensure that the Container Network Interface file permissions are set to 600 or more restrictive (Manual)"
-        audit: |
-          find /var/snap/microk8s/current/args/cni-network/10-calico.conflist -type f 2> /dev/null | xargs --no-run-if-empty stat -c permissions=%a
-        use_multiple_values: true
-        tests:
-          test_items:
-            - flag: "permissions"
-              compare:
-                op: bitmask
-                value: "600"
-        remediation: |
-          Run the below command (based on the file location on your system) on the control plane node.
-          For example, chmod 600 <path/to/cni/files>
-        scored: false
-
-      - id: 1.1.10
-        text: "Ensure that the Container Network Interface file ownership is set to root:root (Manual)"
-        audit: |
-          ps -ef | grep $kubeletbin | grep -- --cni-conf-dir | sed 's%.*cni-conf-dir[= ]\([^ ]*\).*%\1%' | xargs -I{} find {} -mindepth 1 | xargs --no-run-if-empty stat -c %U:%G
-          find /var/snap/microk8s/current/args/cni-network/10-calico.conflist -type f 2> /dev/null | xargs --no-run-if-empty stat -c %U:%G
-        use_multiple_values: true
-        tests:
-          test_items:
-            - flag: "root:root"
-        remediation: |
-          Run the below command (based on the file location on your system) on the control plane node.
-          For example,
-          chown root:root <path/to/cni/files>
-        scored: false
-
-      # Etcd is not running on MicroK8s master nodes
-      - id: 1.1.11
-        text: "Ensure that the etcd data directory permissions are set to 700 or more restrictive (Automated)"
-        audit: |
-          DATA_DIR='/var/snap/microk8s/current/var/kubernetes/backend/'
-          if ! test -d "$DATA_DIR"; then DATA_DIR=$etcddatadir; fi
-          stat -c permissions=%a "$DATA_DIR"
-        tests:
-          test_items:
-            - flag: "permissions"
-              compare:
-                op: bitmask
-                value: "700"
-        remediation: |
-          On the etcd server node, get the etcd data directory, passed as an argument --data-dir,
-          from the command 'ps -ef | grep etcd'.
-          Run the below command (based on the etcd data directory found above). For example,
-          chmod 700 /var/snap/microk8s/current/var/kubernetes/backend/
-        scored: true
-
-      # Etcd is not running on MicroK8s master nodes
-      - id: 1.1.12
-        text: "Ensure that the etcd data directory ownership is set to etcd:etcd (Automated)"
-        audit: |
-          DATA_DIR='/var/snap/microk8s/current/var/kubernetes/backend/'
-          if ! test -d "$DATA_DIR"; then DATA_DIR=$etcddatadir; fi
-          stat -c %U:%G "$DATA_DIR"
-        tests:
-          test_items:
-            - flag: "root:root"
-        remediation: |
-          On the etcd server node, get the etcd data directory, passed as an argument --data-dir,
-          from the command 'ps -ef | grep etcd'.
-          Run the below command (based on the etcd data directory found above).
-          For example, chown root:root /var/snap/microk8s/current/var/kubernetes/backend/
-        scored: true
-
-      - id: 1.1.13
-        text: "Ensure that the admin.conf file permissions are set to 600 or more restrictive (Automated)"
-        audit: "/bin/sh -c 'if test -e /var/snap/microk8s/current/credentials/client.config; then stat -c permissions=%a /var/snap/microk8s/current/credentials/client.config; fi'"
-        tests:
-          test_items:
-            - flag: "permissions"
-              compare:
-                op: bitmask
-                value: "600"
-        remediation: |
-          Run the below command (based on the file location on your system) on the control plane node.
-          For example, chmod 600 /var/snap/microk8s/current/credentials/client.config
-        scored: true
-
-      - id: 1.1.14
-        text: "Ensure that the admin.conf file ownership is set to root:root (Automated)"
-        audit: "/bin/sh -c 'if test -e /var/snap/microk8s/current/credentials/client.config; then stat -c %U:%G /var/snap/microk8s/current/credentials/client.config; fi'"
-        tests:
-          test_items:
-            - flag: "root:root"
-        remediation: |
-          Run the below command (based on the file location on your system) on the control plane node.
-          For example, chown root:root /var/snap/microk8s/current/credentials/client.config
-        scored: true
-
-      - id: 1.1.15
-        text: "Ensure that the scheduler.conf file permissions are set to 600 or more restrictive (Automated)"
-        audit: "/bin/sh -c 'if test -e $schedulerkubeconfig; then stat -c permissions=%a $schedulerkubeconfig; fi'"
-        tests:
-          test_items:
-            - flag: "permissions"
-              compare:
-                op: bitmask
-                value: "600"
-        remediation: |
-          Run the below command (based on the file location on your system) on the control plane node.
-          For example,
-          chmod 600 $schedulerkubeconfig
-        scored: true
-
-      - id: 1.1.16
-        text: "Ensure that the scheduler.conf file ownership is set to root:root (Automated)"
-        audit: "/bin/sh -c 'if test -e $schedulerkubeconfig; then stat -c %U:%G $schedulerkubeconfig; fi'"
-        tests:
-          test_items:
-            - flag: "root:root"
-        remediation: |
-          Run the below command (based on the file location on your system) on the control plane node.
-          For example,
-          chown root:root $schedulerkubeconfig
-        scored: true
-
-      - id: 1.1.17
-        text: "Ensure that the controller-manager.conf file permissions are set to 600 or more restrictive (Automated)"
-        audit: "/bin/sh -c 'if test -e $controllermanagerkubeconfig; then stat -c permissions=%a $controllermanagerkubeconfig; fi'"
-        tests:
-          test_items:
-            - flag: "permissions"
-              compare:
-                op: bitmask
-                value: "600"
-        remediation: |
-          Run the below command (based on the file location on your system) on the control plane node.
-          For example,
-          chmod 600 $controllermanagerkubeconfig
-        scored: true
-
-      - id: 1.1.18
-        text: "Ensure that the controller-manager.conf file ownership is set to root:root (Automated)"
-        audit: "/bin/sh -c 'if test -e $controllermanagerkubeconfig; then stat -c %U:%G $controllermanagerkubeconfig; fi'"
-        tests:
-          test_items:
-            - flag: "root:root"
-        remediation: |
-          Run the below command (based on the file location on your system) on the control plane node.
-          For example,
-          chown root:root $controllermanagerkubeconfig
-        scored: true
-
-      - id: 1.1.19
-        text: "Ensure that the Kubernetes PKI directory and file ownership is set to root:root (Automated)"
-        audit: "find /var/snap/microk8s/current/certs/ | xargs stat -c %U:%G"
-        use_multiple_values: true
-        tests:
-          test_items:
-            - flag: "root:root"
-        remediation: |
-          Run the below command (based on the file location on your system) on the control plane node.
-          For example,
-          chown -R root:root /var/snap/microk8s/current/certs/
-        scored: true
-
-      - id: 1.1.20
-        text: "Ensure that the Kubernetes PKI certificate file permissions are set to 600 or more restrictive (Manual)"
-        audit: "find /var/snap/microk8s/current/certs/ -name '*.crt' | xargs stat -c permissions=%a"
-        use_multiple_values: true
-        tests:
-          test_items:
-            - flag: "permissions"
-              compare:
-                op: bitmask
-                value: "600"
-        remediation: |
-          Run the below command (based on the file location on your system) on the control plane node.
-          For example,
-          chmod -R 600 /var/snap/microk8s/current/certs/*.crt
-        scored: false
-
-      - id: 1.1.21
-        text: "Ensure that the Kubernetes PKI key file permissions are set to 600 (Manual)"
-        audit: "find /var/snap/microk8s/current/certs/ -name '*.key' | xargs stat -c permissions=%a"
-        use_multiple_values: true
-        tests:
-          test_items:
-            - flag: "permissions"
-              compare:
-                op: bitmask
-                value: "600"
-        remediation: |
-          Run the below command (based on the file location on your system) on the control plane node.
-          For example,
-          chmod -R 600 /var/snap/microk8s/current/certs/*.key
-        scored: false
-
-  - id: 1.2
-    text: "API Server"
-    checks:
-      - id: 1.2.1
-        text: "Ensure that the --anonymous-auth argument is set to false (Manual)"
-        audit: "cat $apiserverconf | grep -v grep"
-        tests:
-          bin_op: or
-          test_items:
-            - flag: "--anonymous-auth"
-              compare:
-                op: eq
-                value: false
-            - flag: "--anonymous-auth"
-              set: false
-        remediation: |
-          Edit the API server pod specification file $apiserverconf
-          on the control plane node and set the below parameter.
-          --anonymous-auth=false
-        scored: false
-
-      - id: 1.2.2
-        text: "Ensure that the --token-auth-file parameter is not set (Automated)"
-        audit: "cat $apiserverconf | grep -v grep"
-        tests:
-          test_items:
-            - flag: "--token-auth-file"
-              set: false
-        remediation: |
-          Follow the documentation and configure alternate mechanisms for authentication. Then,
-          edit the API server pod specification file $apiserverconf
-          on the control plane node and remove the --token-auth-file=<filename> parameter.
-        scored: true
-
-      - id: 1.2.3
-        text: "Ensure that the --DenyServiceExternalIPs is not set (Automated)"
-        audit: "cat $apiserverconf | grep -v grep"
-        tests:
-          bin_op: or
-          test_items:
-            - flag: "--enable-admission-plugins"
-              compare:
-                op: nothave
-                value: "DenyServiceExternalIPs"
-            - flag: "--enable-admission-plugins"
-              set: false
-        remediation: |
-          Edit the API server pod specification file $apiserverconf
-          on the control plane node and remove the `DenyServiceExternalIPs`
-          from enabled admission plugins.
-        scored: true
-
-      - id: 1.2.4
-        text: "Ensure that the --kubelet-client-certificate and --kubelet-client-key arguments are set as appropriate (Automated)"
-        audit: "cat $apiserverconf | grep -v grep"
-        tests:
-          bin_op: and
-          test_items:
-            - flag: "--kubelet-client-certificate"
-            - flag: "--kubelet-client-key"
-        remediation: |
-          Follow the Kubernetes documentation and set up the TLS connection between the
-          apiserver and kubelets. Then, edit API server pod specification file
-          $apiserverconf on the control plane node and set the
-          kubelet client certificate and key parameters as below.
-          --kubelet-client-certificate=<path/to/client-certificate-file>
-          --kubelet-client-key=<path/to/client-key-file>
-        scored: true
-
-      - id: 1.2.5
-        text: "Ensure that the --kubelet-certificate-authority argument is set as appropriate (Automated)"
-        audit: "cat $apiserverconf | grep -v grep"
-        tests:
-          test_items:
-            - flag: "--kubelet-certificate-authority"
-        remediation: |
-          Follow the Kubernetes documentation and setup the TLS connection between
-          the apiserver and kubelets. Then, edit the API server pod specification file
-          $apiserverconf on the control plane node and set the
-          --kubelet-certificate-authority parameter to the path to the cert file for the certificate authority.
-          --kubelet-certificate-authority=<ca-string>
-        scored: true
-
-      - id: 1.2.6
-        text: "Ensure that the --authorization-mode argument is not set to AlwaysAllow (Automated)"
-        audit: "cat $apiserverconf | grep -v grep"
-        tests:
-          test_items:
-            - flag: "--authorization-mode"
-              compare:
-                op: nothave
-                value: "AlwaysAllow"
-        remediation: |
-          Edit the API server pod specification file $apiserverconf
-          on the control plane node and set the --authorization-mode parameter to values other than AlwaysAllow.
-          One such example could be as below.
-          --authorization-mode=RBAC
-        scored: true
-
-      - id: 1.2.7
-        text: "Ensure that the --authorization-mode argument includes Node (Automated)"
-        audit: "cat $apiserverconf | grep -v grep"
-        tests:
-          test_items:
-            - flag: "--authorization-mode"
-              compare:
-                op: has
-                value: "Node"
-        remediation: |
-          Edit the API server pod specification file $apiserverconf
-          on the control plane node and set the --authorization-mode parameter to a value that includes Node.
-          --authorization-mode=Node,RBAC
-        scored: true
-
-      - id: 1.2.8
-        text: "Ensure that the --authorization-mode argument includes RBAC (Automated)"
-        audit: "cat $apiserverconf | grep -v grep"
-        tests:
-          test_items:
-            - flag: "--authorization-mode"
-              compare:
-                op: has
-                value: "RBAC"
-        remediation: |
-          Edit the API server pod specification file $apiserverconf
-          on the control plane node and set the --authorization-mode parameter to a value that includes RBAC,
-          for example `--authorization-mode=Node,RBAC`.
-        scored: true
-
-      - id: 1.2.9
-        text: "Ensure that the admission control plugin EventRateLimit is set (Manual)"
-        audit: "cat $apiserverconf | grep -v grep"
-        tests:
-          test_items:
-            - flag: "--enable-admission-plugins"
-              compare:
-                op: has
-                value: "EventRateLimit"
-        remediation: |
-          Follow the Kubernetes documentation and set the desired limits in a configuration file.
-          Then, edit the API server pod specification file $apiserverconf
-          and set the below parameters.
-          --enable-admission-plugins=...,EventRateLimit,...
-          --admission-control-config-file=<path/to/configuration/file>
-        scored: false
-
-      - id: 1.2.10
-        text: "Ensure that the admission control plugin AlwaysAdmit is not set (Automated)"
-        audit: "cat $apiserverconf | grep -v grep"
-        tests:
-          bin_op: or
-          test_items:
-            - flag: "--enable-admission-plugins"
-              compare:
-                op: nothave
-                value: AlwaysAdmit
-            - flag: "--enable-admission-plugins"
-              set: false
-        remediation: |
-          Edit the API server pod specification file $apiserverconf
-          on the control plane node and either remove the --enable-admission-plugins parameter, or set it to a
-          value that does not include AlwaysAdmit.
-        scored: true
-
-      - id: 1.2.11
-        text: "Ensure that the admission control plugin AlwaysPullImages is set (Manual)"
-        audit: "cat $apiserverconf | grep -v grep"
-        tests:
-          test_items:
-            - flag: "--enable-admission-plugins"
-              compare:
-                op: has
-                value: "AlwaysPullImages"
-        remediation: |
-          Edit the API server pod specification file $apiserverconf
-          on the control plane node and set the --enable-admission-plugins parameter to include
-          AlwaysPullImages.
-          --enable-admission-plugins=...,AlwaysPullImages,...
-        scored: false
-
-      - id: 1.2.12
-        text: "Ensure that the admission control plugin SecurityContextDeny is set if PodSecurityPolicy is not used (Manual)"
-        audit: "cat $apiserverconf | grep -v grep"
-        tests:
-          bin_op: or
-          test_items:
-            - flag: "--enable-admission-plugins"
-              compare:
-                op: has
-                value: "SecurityContextDeny"
-            - flag: "--enable-admission-plugins"
-              compare:
-                op: has
-                value: "PodSecurityPolicy"
-        remediation: |
-          Edit the API server pod specification file $apiserverconf
-          on the control plane node and set the --enable-admission-plugins parameter to include
-          SecurityContextDeny, unless PodSecurityPolicy is already in place.
-          --enable-admission-plugins=...,SecurityContextDeny,...
-        scored: false
-
-      - id: 1.2.13
-        text: "Ensure that the admission control plugin ServiceAccount is set (Automated)"
-        audit: "cat $apiserverconf | grep -v grep"
-        tests:
-          bin_op: or
-          test_items:
-            - flag: "--disable-admission-plugins"
-              compare:
-                op: nothave
-                value: "ServiceAccount"
-            - flag: "--disable-admission-plugins"
-              set: false
-        remediation: |
-          Follow the documentation and create ServiceAccount objects as per your environment.
-          Then, edit the API server pod specification file $apiserverconf
-          on the control plane node and ensure that the --disable-admission-plugins parameter is set to a
-          value that does not include ServiceAccount.
-        scored: true
-
-      - id: 1.2.14
-        text: "Ensure that the admission control plugin NamespaceLifecycle is set (Automated)"
-        audit: "cat $apiserverconf | grep -v grep"
-        tests:
-          bin_op: or
-          test_items:
-            - flag: "--disable-admission-plugins"
-              compare:
-                op: nothave
-                value: "NamespaceLifecycle"
-            - flag: "--disable-admission-plugins"
-              set: false
-        remediation: |
-          Edit the API server pod specification file $apiserverconf
-          on the control plane node and set the --disable-admission-plugins parameter to
-          ensure it does not include NamespaceLifecycle.
-        scored: true
-
-      - id: 1.2.15
-        text: "Ensure that the admission control plugin NodeRestriction is set (Automated)"
-        audit: "cat $apiserverconf | grep -v grep"
-        tests:
-          test_items:
-            - flag: "--enable-admission-plugins"
-              compare:
-                op: has
-                value: "NodeRestriction"
-        remediation: |
-          Follow the Kubernetes documentation and configure NodeRestriction plug-in on kubelets.
-          Then, edit the API server pod specification file $apiserverconf
-          on the control plane node and set the --enable-admission-plugins parameter to a
-          value that includes NodeRestriction.
-          --enable-admission-plugins=...,NodeRestriction,...
-        scored: true
-
-      - id: 1.2.16
-        text: "Ensure that the --secure-port argument is not set to 0 (Automated)"
-        audit: "cat $apiserverconf | grep -v grep"
-        tests:
-          bin_op: or
-          test_items:
-            - flag: "--secure-port"
-              compare:
-                op: gt
-                value: 0
-            - flag: "--secure-port"
-              set: false
-        remediation: |
-          Edit the API server pod specification file $apiserverconf
-          on the control plane node and either remove the --secure-port parameter or
-          set it to a different (non-zero) desired port.
-        scored: true
-
-      - id: 1.2.17
-        text: "Ensure that the --profiling argument is set to false (Automated)"
-        audit: "cat $apiserverconf | grep -v grep"
-        tests:
-          test_items:
-            - flag: "--profiling"
-              compare:
-                op: eq
-                value: false
-        remediation: |
-          Edit the API server pod specification file $apiserverconf
-          on the control plane node and set the below parameter.
-          --profiling=false
-        scored: true
-
-      - id: 1.2.18
-        text: "Ensure that the --audit-log-path argument is set (Automated)"
-        audit: "cat $apiserverconf | grep -v grep"
-        tests:
-          test_items:
-            - flag: "--audit-log-path"
-        remediation: |
-          Edit the API server pod specification file $apiserverconf
-          on the control plane node and set the --audit-log-path parameter to a suitable path and
-          file where you would like audit logs to be written, for example,
-          --audit-log-path=/var/log/apiserver/audit.log
-        scored: true
-
-      - id: 1.2.19
-        text: "Ensure that the --audit-log-maxage argument is set to 30 or as appropriate (Automated)"
-        audit: "cat $apiserverconf | grep -v grep"
-        tests:
-          test_items:
-            - flag: "--audit-log-maxage"
-              compare:
-                op: gte
-                value: 30
-        remediation: |
-          Edit the API server pod specification file $apiserverconf
-          on the control plane node and set the --audit-log-maxage parameter to 30
-          or as an appropriate number of days, for example,
-          --audit-log-maxage=30
-        scored: true
-
-      - id: 1.2.20
-        text: "Ensure that the --audit-log-maxbackup argument is set to 10 or as appropriate (Automated)"
-        audit: "cat $apiserverconf | grep -v grep"
-        tests:
-          test_items:
-            - flag: "--audit-log-maxbackup"
-              compare:
-                op: gte
-                value: 10
-        remediation: |
-          Edit the API server pod specification file $apiserverconf
-          on the control plane node and set the --audit-log-maxbackup parameter to 10 or to an appropriate
-          value. For example,
-          --audit-log-maxbackup=10
-        scored: true
-
-      - id: 1.2.21
-        text: "Ensure that the --audit-log-maxsize argument is set to 100 or as appropriate (Automated)"
-        audit: "cat $apiserverconf | grep -v grep"
-        tests:
-          test_items:
-            - flag: "--audit-log-maxsize"
-              compare:
-                op: gte
-                value: 100
-        remediation: |
-          Edit the API server pod specification file $apiserverconf
-          on the control plane node and set the --audit-log-maxsize parameter to an appropriate size in MB.
-          For example, to set it as 100 MB, --audit-log-maxsize=100
-        scored: true
-
-      - id: 1.2.22
-        text: "Ensure that the --request-timeout argument is set as appropriate (Manual)"
-        audit: "cat $apiserverconf | grep -v grep"
-        type: manual
-        remediation: |
-          Edit the API server pod specification file $apiserverconf
-          and set the below parameter as appropriate and if needed.
-          For example, --request-timeout=300s
-        scored: false
-
-      - id: 1.2.23
-        text: "Ensure that the --service-account-lookup argument is set to true (Automated)"
-        audit: "cat $apiserverconf | grep -v grep"
-        tests:
-          bin_op: or
-          test_items:
-            - flag: "--service-account-lookup"
-              set: false
-            - flag: "--service-account-lookup"
-              compare:
-                op: eq
-                value: true
-        remediation: |
-          Edit the API server pod specification file $apiserverconf
-          on the control plane node and set the below parameter.
-          --service-account-lookup=true
-          Alternatively, you can delete the --service-account-lookup parameter from this file so
-          that the default takes effect.
-        scored: true
-
-      - id: 1.2.24
-        text: "Ensure that the --service-account-key-file argument is set as appropriate (Automated)"
-        audit: "cat $apiserverconf | grep -v grep"
-        tests:
-          test_items:
-            - flag: "--service-account-key-file"
-        remediation: |
-          Edit the API server pod specification file $apiserverconf
-          on the control plane node and set the --service-account-key-file parameter
-          to the public key file for service accounts. For example,
-          --service-account-key-file=<filename>
-        scored: true
-
-      # MicroK8s does not use etcd. The API server talk to a local dqlite instance
-      - id: 1.2.25
-        text: "Ensure that the --etcd-certfile and --etcd-keyfile arguments are set as appropriate (Automated)"
-        audit: "cat $apiserverconf | grep -v grep"
-        tests:
-          bin_op: and
-          test_items:
-            - flag: "--etcd-certfile"
-            - flag: "--etcd-keyfile"
-        remediation: |
-          Follow the Kubernetes documentation and set up the TLS connection between the apiserver and etcd.
-          Then, edit the API server pod specification file $apiserverconf
-          on the control plane node and set the etcd certificate and key file parameters.
-          --etcd-certfile=<path/to/client-certificate-file>
-          --etcd-keyfile=<path/to/client-key-file>
-        scored: false
-
-      - id: 1.2.26
-        text: "Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate (Automated)"
-        audit: "cat $apiserverconf | grep -v grep"
-        tests:
-          bin_op: and
-          test_items:
-            - flag: "--tls-cert-file"
-            - flag: "--tls-private-key-file"
-        remediation: |
-          Follow the Kubernetes documentation and set up the TLS connection on the apiserver.
-          Then, edit the API server pod specification file $apiserverconf
-          on the control plane node and set the TLS certificate and private key file parameters.
-          --tls-cert-file=<path/to/tls-certificate-file>
-          --tls-private-key-file=<path/to/tls-key-file>
-        scored: true
-
-      - id: 1.2.27
-        text: "Ensure that the --client-ca-file argument is set as appropriate (Automated)"
-        audit: "cat $apiserverconf | grep -v grep"
-        tests:
-          test_items:
-            - flag: "--client-ca-file"
-        remediation: |
-          Follow the Kubernetes documentation and set up the TLS connection on the apiserver.
-          Then, edit the API server pod specification file $apiserverconf
-          on the control plane node and set the client certificate authority file.
-          --client-ca-file=<path/to/client-ca-file>
-        scored: true
-
-      - id: 1.2.28
-        text: "Ensure that the --etcd-cafile argument is set as appropriate (Automated)"
-        audit: "cat $apiserverconf | grep -v grep"
-        tests:
-          test_items:
-            - flag: "--etcd-cafile"
-        remediation: |
-          Follow the Kubernetes documentation and set up the TLS connection between the apiserver and etcd.
-          Then, edit the API server pod specification file $apiserverconf
-          on the control plane node and set the etcd certificate authority file parameter.
-          --etcd-cafile=<path/to/ca-file>
-        scored: false
-
-      - id: 1.2.29
-        text: "Ensure that the --encryption-provider-config argument is set as appropriate (Manual)"
-        audit: "cat $apiserverconf | grep -v grep"
-        tests:
-          test_items:
-            - flag: "--encryption-provider-config"
-        remediation: |
-          Follow the Kubernetes documentation and configure a EncryptionConfig file.
-          Then, edit the API server pod specification file $apiserverconf
-          on the control plane node and set the --encryption-provider-config parameter to the path of that file.
-          For example, --encryption-provider-config=</path/to/EncryptionConfig/File>
-        scored: false
-
-      - id: 1.2.30
-        text: "Ensure that encryption providers are appropriately configured (Manual)"
-        audit: |
-          ENCRYPTION_PROVIDER_CONFIG=$(cat $apiserverconf | grep -- --encryption-provider-config | sed 's%.*encryption-provider-config[= ]\([^ ]*\).*%\1%')
-          if test -e $ENCRYPTION_PROVIDER_CONFIG; then grep -A1 'providers:' $ENCRYPTION_PROVIDER_CONFIG | tail -n1 | grep -o "[A-Za-z]*" | sed 's/^/provider=/'; fi
-        tests:
-          test_items:
-            - flag: "provider"
-              compare:
-                op: valid_elements
-                value: "aescbc,kms,secretbox"
-        remediation: |
-          Follow the Kubernetes documentation and configure a EncryptionConfig file.
-          In this file, choose aescbc, kms or secretbox as the encryption provider.
-        scored: false
-
-      - id: 1.2.31
-        text: "Ensure that the API Server only makes use of Strong Cryptographic Ciphers (Manual)"
-        audit: "cat $apiserverconf | grep -v grep"
-        tests:
-          test_items:
-            - flag: "--tls-cipher-suites"
-              compare:
-                op: valid_elements
-                value: "TLS_AES_128_GCM_SHA256,TLS_AES_256_GCM_SHA384,TLS_CHACHA20_POLY1305_SHA256,TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256,TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256,TLS_RSA_WITH_3DES_EDE_CBC_SHA,TLS_RSA_WITH_AES_128_CBC_SHA,TLS_RSA_WITH_AES_128_GCM_SHA256,TLS_RSA_WITH_AES_256_CBC_SHA,TLS_RSA_WITH_AES_256_GCM_SHA384"
-        remediation: |
-          Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml
-          on the control plane node and set the below parameter.
-          --tls-cipher-suites=TLS_AES_128_GCM_SHA256,TLS_AES_256_GCM_SHA384,TLS_CHACHA20_POLY1305_SHA256,
-          TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
-          TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
-          TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256,
-          TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
-          TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,
-          TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256,TLS_RSA_WITH_3DES_EDE_CBC_SHA,TLS_RSA_WITH_AES_128_CBC_SHA,
-          TLS_RSA_WITH_AES_128_GCM_SHA256,TLS_RSA_WITH_AES_256_CBC_SHA,TLS_RSA_WITH_AES_256_GCM_SHA384
-        scored: false
-
-  - id: 1.3
-    text: "Controller Manager"
-    checks:
-      - id: 1.3.1
-        text: "Ensure that the --terminated-pod-gc-threshold argument is set as appropriate (Manual)"
-        audit: "cat $controllermanagerconf | grep -v grep"
-        tests:
-          test_items:
-            - flag: "--terminated-pod-gc-threshold"
-        remediation: |
-          Edit the Controller Manager pod specification file $controllermanagerconf
-          on the control plane node and set the --terminated-pod-gc-threshold to an appropriate threshold,
-          for example, --terminated-pod-gc-threshold=10
-        scored: false
-
-      - id: 1.3.2
-        text: "Ensure that the --profiling argument is set to false (Automated)"
-        audit: "cat $controllermanagerconf | grep -v grep"
-        tests:
-          test_items:
-            - flag: "--profiling"
-              compare:
-                op: eq
-                value: false
-        remediation: |
-          Edit the Controller Manager pod specification file $controllermanagerconf
-          on the control plane node and set the below parameter.
-          --profiling=false
-        scored: true
-
-      - id: 1.3.3
-        text: "Ensure that the --use-service-account-credentials argument is set to true (Automated)"
-        audit: "cat $controllermanagerconf | grep -v grep"
-        tests:
-          test_items:
-            - flag: "--use-service-account-credentials"
-              compare:
-                op: noteq
-                value: false
-        remediation: |
-          Edit the Controller Manager pod specification file $controllermanagerconf
-          on the control plane node to set the below parameter.
-          --use-service-account-credentials=true
-        scored: true
-
-      - id: 1.3.4
-        text: "Ensure that the --service-account-private-key-file argument is set as appropriate (Automated)"
-        audit: "cat $controllermanagerconf | grep -v grep"
-        tests:
-          test_items:
-            - flag: "--service-account-private-key-file"
-        remediation: |
-          Edit the Controller Manager pod specification file $controllermanagerconf
-          on the control plane node and set the --service-account-private-key-file parameter
-          to the private key file for service accounts.
-          --service-account-private-key-file=<filename>
-        scored: true
-
-      - id: 1.3.5
-        text: "Ensure that the --root-ca-file argument is set as appropriate (Automated)"
-        audit: "cat $controllermanagerconf | grep -v grep"
-        tests:
-          test_items:
-            - flag: "--root-ca-file"
-        remediation: |
-          Edit the Controller Manager pod specification file $controllermanagerconf
-          on the control plane node and set the --root-ca-file parameter to the certificate bundle file`.
-          --root-ca-file=<path/to/file>
-        scored: true
-
-      - id: 1.3.6
-        text: "Ensure that the RotateKubeletServerCertificate argument is set to true (Automated)"
-        audit: "cat $controllermanagerconf | grep -v grep"
-        tests:
-          bin_op: or
-          test_items:
-            - flag: "--feature-gates"
-              compare:
-                op: nothave
-                value: "RotateKubeletServerCertificate=false"
-              set: true
-            - flag: "--feature-gates"
-              set: false
-        remediation: |
-          Edit the Controller Manager pod specification file $controllermanagerconf
-          on the control plane node and set the --feature-gates parameter to include RotateKubeletServerCertificate=true.
-          --feature-gates=RotateKubeletServerCertificate=true
-        scored: true
-
-      - id: 1.3.7
-        text: "Ensure that the --bind-address argument is set to 127.0.0.1 (Automated)"
-        audit: "cat $controllermanagerconf | grep -v grep"
-        tests:
-          bin_op: or
-          test_items:
-            - flag: "--bind-address"
-              compare:
-                op: eq
-                value: "127.0.0.1"
-            - flag: "--bind-address"
-              set: false
-        remediation: |
-          Edit the Controller Manager pod specification file $controllermanagerconf
-          on the control plane node and ensure the correct value for the --bind-address parameter
-        scored: true
-
-  - id: 1.4
-    text: "Scheduler"
-    checks:
-      - id: 1.4.1
-        text: "Ensure that the --profiling argument is set to false (Automated)"
-        audit: "cat $schedulerconf | grep -v grep"
-        tests:
-          test_items:
-            - flag: "--profiling"
-              compare:
-                op: eq
-                value: false
-        remediation: |
-          Edit the Scheduler pod specification file $schedulerconf file
-          on the control plane node and set the below parameter.
-          --profiling=false
-        scored: true
-
-      - id: 1.4.2
-        text: "Ensure that the --bind-address argument is set to 127.0.0.1 (Automated)"
-        audit: "cat $schedulerconf | grep -v grep"
-        tests:
-          bin_op: or
-          test_items:
-            - flag: "--bind-address"
-              compare:
-                op: eq
-                value: "127.0.0.1"
-            - flag: "--bind-address"
-              set: false
-        remediation: |
-          Edit the Scheduler pod specification file $schedulerconf
-          on the control plane node and ensure the correct value for the --bind-address parameter
-        scored: true

cfg/cis-1.24-microk8s/node.yaml

@@ -1,458 +0,0 @@
----
-controls:
-version: "cis-1.24"
-id: 4
-text: "Worker Node Security Configuration"
-type: "node"
-groups:
-  - id: 4.1
-    text: "Worker Node Configuration Files"
-    checks:
-      - id: 4.1.1
-        text: "Ensure that the kubelet service file permissions are set to 600 or more restrictive (Automated)"
-        audit: "/bin/sh -c 'if test -e $kubeletsvc; then stat -c permissions=%a $kubeletsvc; fi' "
-        tests:
-          test_items:
-            - flag: "permissions"
-              compare:
-                op: bitmask
-                value: "600"
-        remediation: |
-          Run the below command (based on the file location on your system) on the each worker node.
-          For example, chmod 600 $kubeletsvc
-        scored: true
-
-      - id: 4.1.2
-        text: "Ensure that the kubelet service file ownership is set to root:root (Automated)"
-        audit: "/bin/sh -c 'if test -e $kubeletsvc; then stat -c %U:%G $kubeletsvc; fi' "
-        tests:
-          test_items:
-            - flag: root:root
-        remediation: |
-          Run the below command (based on the file location on your system) on the each worker node.
-          For example,
-          chown root:root $kubeletsvc
-        scored: true
-
-      - id: 4.1.3
-        text: "If proxy kubeconfig file exists ensure permissions are set to 600 or more restrictive (Manual)"
-        audit: "/bin/sh -c 'if test -e $proxykubeconfig; then stat -c permissions=%a $proxykubeconfig; fi' "
-        tests:
-          bin_op: or
-          test_items:
-            - flag: "permissions"
-              set: true
-              compare:
-                op: bitmask
-                value: "600"
-        remediation: |
-          Run the below command (based on the file location on your system) on the each worker node.
-          For example,
-          chmod 600 $proxykubeconfig
-        scored: false
-
-      - id: 4.1.4
-        text: "If proxy kubeconfig file exists ensure ownership is set to root:root (Manual)"
-        audit: "/bin/sh -c 'if test -e $proxykubeconfig; then stat -c %U:%G $proxykubeconfig; fi' "
-        tests:
-          bin_op: or
-          test_items:
-            - flag: root:root
-        remediation: |
-          Run the below command (based on the file location on your system) on the each worker node.
-          For example, chown root:root $proxykubeconfig
-        scored: false
-
-      - id: 4.1.5
-        text: "Ensure that the --kubeconfig kubelet.conf file permissions are set to 600 or more restrictive (Automated)"
-        audit: "/bin/sh -c 'if test -e $kubeletkubeconfig; then stat -c permissions=%a $kubeletkubeconfig; fi' "
-        tests:
-          test_items:
-            - flag: "permissions"
-              compare:
-                op: bitmask
-                value: "600"
-        remediation: |
-          Run the below command (based on the file location on your system) on the each worker node.
-          For example,
-          chmod 600 $kubeletkubeconfig
-        scored: true
-
-      - id: 4.1.6
-        text: "Ensure that the --kubeconfig kubelet.conf file ownership is set to root:root (Automated)"
-        audit: "/bin/sh -c 'if test -e $kubeletkubeconfig; then stat -c %U:%G $kubeletkubeconfig; fi' "
-        tests:
-          test_items:
-            - flag: root:root
-        remediation: |
-          Run the below command (based on the file location on your system) on the each worker node.
-          For example,
-          chown root:root $kubeletkubeconfig
-        scored: true
-
-      - id: 4.1.7
-        text: "Ensure that the certificate authorities file permissions are set to 600 or more restrictive (Manual)"
-        audit: |
-          CAFILE=$(ps -ef | grep kubelet | grep -v apiserver | grep -- --client-ca-file= | awk -F '--client-ca-file=' '{print $2}' | awk '{print $1}')
-          if test -z $CAFILE; then CAFILE=$kubeletcafile; fi
-          if test -e $CAFILE; then stat -c permissions=%a $CAFILE; fi
-        tests:
-          test_items:
-            - flag: "permissions"
-              compare:
-                op: bitmask
-                value: "600"
-        remediation: |
-          Run the following command to modify the file permissions of the
-          --client-ca-file chmod 600 <filename>
-        scored: false
-
-      - id: 4.1.8
-        text: "Ensure that the client certificate authorities file ownership is set to root:root (Manual)"
-        audit: |
-          CAFILE=$(ps -ef | grep kubelet | grep -v apiserver | grep -- --client-ca-file= | awk -F '--client-ca-file=' '{print $2}' | awk '{print $1}')
-          if test -z $CAFILE; then CAFILE=$kubeletcafile; fi
-          if test -e $CAFILE; then stat -c %U:%G $CAFILE; fi
-        tests:
-          test_items:
-            - flag: root:root
-              compare:
-                op: eq
-                value: root:root
-        remediation: |
-          Run the following command to modify the ownership of the --client-ca-file.
-          chown root:root <filename>
-        scored: false
-
-      - id: 4.1.9
-        text: "If the kubelet config.yaml configuration file is being used validate permissions set to 600 or more restrictive (Manual)"
-        audit: "/bin/sh -c 'if test -e $kubeletconf; then stat -c permissions=%a $kubeletconf; fi' "
-        tests:
-          test_items:
-            - flag: "permissions"
-              compare:
-                op: bitmask
-                value: "600"
-        remediation: |
-          Run the following command (using the config file location identified in the Audit step)
-          chmod 600 $kubeletconf
-        scored: false
-
-      - id: 4.1.10
-        text: "If the kubelet config.yaml configuration file is being used validate file ownership is set to root:root (Manual)"
-        audit: "/bin/sh -c 'if test -e $kubeletconf; then stat -c %U:%G $kubeletconf; fi' "
-        tests:
-          test_items:
-            - flag: root:root
-        remediation: |
-          Run the following command (using the config file location identified in the Audit step)
-          chown root:root $kubeletconf
-        scored: false
-
-  - id: 4.2
-    text: "Kubelet"
-    checks:
-      - id: 4.2.1
-        text: "Ensure that the --anonymous-auth argument is set to false (Automated)"
-        audit: "cat $kubeletconf"
-        audit_config: "/bin/cat $kubeletconf"
-        tests:
-          test_items:
-            - flag: "--anonymous-auth"
-              path: "{.authentication.anonymous.enabled}"
-              compare:
-                op: eq
-                value: false
-        remediation: |
-          If using a Kubelet config file, edit the file to set `authentication: anonymous: enabled` to
-          `false`.
-          If using executable arguments, edit the kubelet service file
-          $kubeletsvc on each worker node and
-          set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable.
-          `--anonymous-auth=false`
-          Based on your system, restart the kubelet service. For example,
-          systemctl daemon-reload
-          systemctl restart kubelet.service
-        scored: true
-
-      - id: 4.2.2
-        text: "Ensure that the --authorization-mode argument is not set to AlwaysAllow (Automated)"
-        audit: "cat $kubeletconf"
-        audit_config: "/bin/cat $kubeletconf"
-        tests:
-          test_items:
-            - flag: --authorization-mode
-              path: "{.authorization.mode}"
-              compare:
-                op: nothave
-                value: AlwaysAllow
-        remediation: |
-          If using a Kubelet config file, edit the file to set `authorization.mode` to Webhook. If
-          using executable arguments, edit the kubelet service file
-          $kubeletsvc on each worker node and
-          set the below parameter in KUBELET_AUTHZ_ARGS variable.
-          --authorization-mode=Webhook
-          Based on your system, restart the kubelet service. For example,
-          systemctl daemon-reload
-          systemctl restart kubelet.service
-        scored: true
-
-      - id: 4.2.3
-        text: "Ensure that the --client-ca-file argument is set as appropriate (Automated)"
-        audit: "cat $kubeletconf"
-        audit_config: "/bin/cat $kubeletconf"
-        tests:
-          test_items:
-            - flag: --client-ca-file
-              path: "{.authentication.x509.clientCAFile}"
-        remediation: |
-          If using a Kubelet config file, edit the file to set `authentication.x509.clientCAFile` to
-          the location of the client CA file.
-          If using command line arguments, edit the kubelet service file
-          $kubeletsvc on each worker node and
-          set the below parameter in KUBELET_AUTHZ_ARGS variable.
-          --client-ca-file=<path/to/client-ca-file>
-          Based on your system, restart the kubelet service. For example,
-          systemctl daemon-reload
-          systemctl restart kubelet.service
-        scored: true
-
-      - id: 4.2.4
-        text: "Verify that the --read-only-port argument is set to 0 (Manual)"
-        audit: "cat $kubeletconf"
-        audit_config: "/bin/cat $kubeletconf"
-        tests:
-          bin_op: or
-          test_items:
-            - flag: "--read-only-port"
-              path: "{.readOnlyPort}"
-              compare:
-                op: eq
-                value: 0
-            - flag: "--read-only-port"
-              path: "{.readOnlyPort}"
-              set: false
-        remediation: |
-          If using a Kubelet config file, edit the file to set `readOnlyPort` to 0.
-          If using command line arguments, edit the kubelet service file
-          $kubeletsvc on each worker node and
-          set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable.
-          --read-only-port=0
-          Based on your system, restart the kubelet service. For example,
-          systemctl daemon-reload
-          systemctl restart kubelet.service
-        scored: false
-
-      - id: 4.2.5
-        text: "Ensure that the --streaming-connection-idle-timeout argument is not set to 0 (Manual)"
-        audit: "cat $kubeletconf"
-        audit_config: "/bin/cat $kubeletconf"
-        tests:
-          test_items:
-            - flag: --streaming-connection-idle-timeout
-              path: "{.streamingConnectionIdleTimeout}"
-              compare:
-                op: noteq
-                value: 0
-            - flag: --streaming-connection-idle-timeout
-              path: "{.streamingConnectionIdleTimeout}"
-              set: false
-          bin_op: or
-        remediation: |
-          If using a Kubelet config file, edit the file to set `streamingConnectionIdleTimeout` to a
-          value other than 0.
-          If using command line arguments, edit the kubelet service file
-          $kubeletsvc on each worker node and
-          set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable.
-          --streaming-connection-idle-timeout=5m
-          Based on your system, restart the kubelet service. For example,
-          systemctl daemon-reload
-          systemctl restart kubelet.service
-        scored: false
-
-      - id: 4.2.6
-        text: "Ensure that the --protect-kernel-defaults argument is set to true (Automated)"
-        audit: "cat $kubeletconf"
-        audit_config: "/bin/cat $kubeletconf"
-        tests:
-          test_items:
-            - flag: --protect-kernel-defaults
-              path: "{.protectKernelDefaults}"
-              compare:
-                op: eq
-                value: true
-        remediation: |
-          If using a Kubelet config file, edit the file to set `protectKernelDefaults` to `true`.
-          If using command line arguments, edit the kubelet service file
-          $kubeletsvc on each worker node and
-          set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable.
-          --protect-kernel-defaults=true
-          Based on your system, restart the kubelet service. For example:
-          systemctl daemon-reload
-          systemctl restart kubelet.service
-        scored: true
-
-      - id: 4.2.7
-        text: "Ensure that the --make-iptables-util-chains argument is set to true (Automated)"
-        audit: "cat $kubeletconf"
-        audit_config: "/bin/cat $kubeletconf"
-        tests:
-          test_items:
-            - flag: --make-iptables-util-chains
-              path: "{.makeIPTablesUtilChains}"
-              compare:
-                op: eq
-                value: true
-            - flag: --make-iptables-util-chains
-              path: "{.makeIPTablesUtilChains}"
-              set: false
-          bin_op: or
-        remediation: |
-          If using a Kubelet config file, edit the file to set `makeIPTablesUtilChains` to `true`.
-          If using command line arguments, edit the kubelet service file
-          $kubeletsvc on each worker node and
-          remove the --make-iptables-util-chains argument from the
-          KUBELET_SYSTEM_PODS_ARGS variable.
-          Based on your system, restart the kubelet service. For example:
-          systemctl daemon-reload
-          systemctl restart kubelet.service
-        scored: true
-
-      - id: 4.2.8
-        text: "Ensure that the --hostname-override argument is not set (Manual)"
-        # This is one of those properties that can only be set as a command line argument.
-        # To check if the property is set as expected, we need to parse the kubelet command
-        # instead reading the Kubelet Configuration file.
-        audit: "cat $kubeletconf"
-        tests:
-          test_items:
-            - flag: --hostname-override
-              set: false
-        remediation: |
-          Edit the kubelet service file $kubeletsvc
-          on each worker node and remove the --hostname-override argument from the
-          KUBELET_SYSTEM_PODS_ARGS variable.
-          Based on your system, restart the kubelet service. For example,
-          systemctl daemon-reload
-          systemctl restart kubelet.service
-        scored: false
-
-      - id: 4.2.9
-        text: "Ensure that the eventRecordQPS argument is set to a level which ensures appropriate event capture (Manual)"
-        audit: "cat $kubeletconf"
-        audit_config: "/bin/cat $kubeletconf"
-        tests:
-          test_items:
-            - flag: --event-qps
-              path: "{.eventRecordQPS}"
-              compare:
-                op: eq
-                value: 0
-        remediation: |
-          If using a Kubelet config file, edit the file to set `eventRecordQPS` to an appropriate level.
-          If using command line arguments, edit the kubelet service file
-          $kubeletsvc on each worker node and
-          set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable.
-          Based on your system, restart the kubelet service. For example,
-          systemctl daemon-reload
-          systemctl restart kubelet.service
-        scored: false
-
-      - id: 4.2.10
-        text: "Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate (Manual)"
-        audit: "cat $kubeletconf"
-        audit_config: "/bin/cat $kubeletconf"
-        tests:
-          test_items:
-            - flag: --tls-cert-file
-              path: "{.tlsCertFile}"
-            - flag: --tls-private-key-file
-              path: "{.tlsPrivateKeyFile}"
-        remediation: |
-          If using a Kubelet config file, edit the file to set `tlsCertFile` to the location
-          of the certificate file to use to identify this Kubelet, and `tlsPrivateKeyFile`
-          to the location of the corresponding private key file.
-          If using command line arguments, edit the kubelet service file
-          $kubeletsvc on each worker node and
-          set the below parameters in KUBELET_CERTIFICATE_ARGS variable.
-          --tls-cert-file=<path/to/tls-certificate-file>
-          --tls-private-key-file=<path/to/tls-key-file>
-          Based on your system, restart the kubelet service. For example,
-          systemctl daemon-reload
-          systemctl restart kubelet.service
-        scored: false
-
-      - id: 4.2.11
-        text: "Ensure that the --rotate-certificates argument is not set to false (Automated)"
-        audit: "cat $kubeletconf"
-        audit_config: "/bin/cat $kubeletconf"
-        tests:
-          test_items:
-            - flag: --rotate-certificates
-              path: "{.rotateCertificates}"
-              compare:
-                op: eq
-                value: true
-            - flag: --rotate-certificates
-              path: "{.rotateCertificates}"
-              set: false
-          bin_op: or
-        remediation: |
-          If using a Kubelet config file, edit the file to add the line `rotateCertificates` to `true` or
-          remove it altogether to use the default value.
-          If using command line arguments, edit the kubelet service file
-          $kubeletsvc on each worker node and
-          remove --rotate-certificates=false argument from the KUBELET_CERTIFICATE_ARGS
-          variable.
-          Based on your system, restart the kubelet service. For example,
-          systemctl daemon-reload
-          systemctl restart kubelet.service
-        scored: true
-
-      - id: 4.2.12
-        text: "Verify that the RotateKubeletServerCertificate argument is set to true (Manual)"
-        audit: "cat $kubeletconf"
-        audit_config: "/bin/cat $kubeletconf"
-        tests:
-          bin_op: or
-          test_items:
-            - flag: RotateKubeletServerCertificate
-              path: "{.featureGates.RotateKubeletServerCertificate}"
-              compare:
-                op: nothave
-                value: false
-            - flag: RotateKubeletServerCertificate
-              path: "{.featureGates.RotateKubeletServerCertificate}"
-              set: false
-        remediation: |
-          Edit the kubelet service file $kubeletsvc
-          on each worker node and set the below parameter in KUBELET_CERTIFICATE_ARGS variable.
-          --feature-gates=RotateKubeletServerCertificate=true
-          Based on your system, restart the kubelet service. For example:
-          systemctl daemon-reload
-          systemctl restart kubelet.service
-        scored: false
-
-      - id: 4.2.13
-        text: "Ensure that the Kubelet only makes use of Strong Cryptographic Ciphers (Manual)"
-        audit: "cat $kubeletconf"
-        audit_config: "/bin/cat $kubeletconf"
-        tests:
-          test_items:
-            - flag: --tls-cipher-suites
-              path: "{range .tlsCipherSuites[:]}{}{','}{end}"
-              compare:
-                op: valid_elements
-                value: TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256
-        remediation: |
-          If using a Kubelet config file, edit the file to set `tlsCipherSuites` to
-          TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256
-          or to a subset of these values.
-          If using executable arguments, edit the kubelet service file
-          $kubeletsvc on each worker node and
-          set the --tls-cipher-suites parameter as follows, or to a subset of these values.
-          --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256
-          Based on your system, restart the kubelet service. For example:
-          systemctl daemon-reload
-          systemctl restart kubelet.service
-        scored: false

cfg/cis-1.24-microk8s/policies.yaml

@@ -1,269 +0,0 @@
----
-controls:
-version: "cis-1.24"
-id: 5
-text: "Kubernetes Policies"
-type: "policies"
-groups:
-  - id: 5.1
-    text: "RBAC and Service Accounts"
-    checks:
-      - id: 5.1.1
-        text: "Ensure that the cluster-admin role is only used where required (Manual)"
-        type: "manual"
-        remediation: |
-          Identify all clusterrolebindings to the cluster-admin role. Check if they are used and
-          if they need this role or if they could use a role with fewer privileges.
-          Where possible, first bind users to a lower privileged role and then remove the
-          clusterrolebinding to the cluster-admin role :
-          kubectl delete clusterrolebinding [name]
-        scored: false
-
-      - id: 5.1.2
-        text: "Minimize access to secrets (Manual)"
-        type: "manual"
-        remediation: |
-          Where possible, remove get, list and watch access to Secret objects in the cluster.
-        scored: false
-
-      - id: 5.1.3
-        text: "Minimize wildcard use in Roles and ClusterRoles (Manual)"
-        type: "manual"
-        remediation: |
-          Where possible replace any use of wildcards in clusterroles and roles with specific
-          objects or actions.
-        scored: false
-
-      - id: 5.1.4
-        text: "Minimize access to create pods (Manual)"
-        type: "manual"
-        remediation: |
-          Where possible, remove create access to pod objects in the cluster.
-        scored: false
-
-      - id: 5.1.5
-        text: "Ensure that default service accounts are not actively used. (Manual)"
-        type: "manual"
-        remediation: |
-          Create explicit service accounts wherever a Kubernetes workload requires specific access
-          to the Kubernetes API server.
-          Modify the configuration of each default service account to include this value
-          automountServiceAccountToken: false
-        scored: false
-
-      - id: 5.1.6
-        text: "Ensure that Service Account Tokens are only mounted where necessary (Manual)"
-        type: "manual"
-        remediation: |
-          Modify the definition of pods and service accounts which do not need to mount service
-          account tokens to disable it.
-        scored: false
-
-      - id: 5.1.7
-        text: "Avoid use of system:masters group (Manual)"
-        type: "manual"
-        remediation: |
-          Remove the system:masters group from all users in the cluster.
-        scored: false
-
-      - id: 5.1.8
-        text: "Limit use of the Bind, Impersonate and Escalate permissions in the Kubernetes cluster (Manual)"
-        type: "manual"
-        remediation: |
-          Where possible, remove the impersonate, bind and escalate rights from subjects.
-        scored: false
-
-  - id: 5.2
-    text: "Pod Security Standards"
-    checks:
-      - id: 5.2.1
-        text: "Ensure that the cluster has at least one active policy control mechanism in place (Manual)"
-        type: "manual"
-        remediation: |
-          Ensure that either Pod Security Admission or an external policy control system is in place
-          for every namespace which contains user workloads.
-        scored: false
-
-      - id: 5.2.2
-        text: "Minimize the admission of privileged containers (Manual)"
-        type: "manual"
-        remediation: |
-          Add policies to each namespace in the cluster which has user workloads to restrict the
-          admission of privileged containers.
-        scored: false
-
-      - id: 5.2.3
-        text: "Minimize the admission of containers wishing to share the host process ID namespace (Automated)"
-        type: "manual"
-        remediation: |
-          Add policies to each namespace in the cluster which has user workloads to restrict the
-          admission of `hostPID` containers.
-        scored: false
-
-      - id: 5.2.4
-        text: "Minimize the admission of containers wishing to share the host IPC namespace (Automated)"
-        type: "manual"
-        remediation: |
-          Add policies to each namespace in the cluster which has user workloads to restrict the
-          admission of `hostIPC` containers.
-        scored: false
-
-      - id: 5.2.5
-        text: "Minimize the admission of containers wishing to share the host network namespace (Automated)"
-        type: "manual"
-        remediation: |
-          Add policies to each namespace in the cluster which has user workloads to restrict the
-          admission of `hostNetwork` containers.
-        scored: false
-
-      - id: 5.2.6
-        text: "Minimize the admission of containers with allowPrivilegeEscalation (Automated)"
-        type: "manual"
-        remediation: |
-          Add policies to each namespace in the cluster which has user workloads to restrict the
-          admission of containers with `.spec.allowPrivilegeEscalation` set to `true`.
-        scored: false
-
-      - id: 5.2.7
-        text: "Minimize the admission of root containers (Automated)"
-        type: "manual"
-        remediation: |
-          Create a policy for each namespace in the cluster, ensuring that either `MustRunAsNonRoot`
-          or `MustRunAs` with the range of UIDs not including 0, is set.
-        scored: false
-
-      - id: 5.2.8
-        text: "Minimize the admission of containers with the NET_RAW capability (Automated)"
-        type: "manual"
-        remediation: |
-          Add policies to each namespace in the cluster which has user workloads to restrict the
-          admission of containers with the `NET_RAW` capability.
-        scored: false
-
-      - id: 5.2.9
-        text: "Minimize the admission of containers with added capabilities (Automated)"
-        type: "manual"
-        remediation: |
-          Ensure that `allowedCapabilities` is not present in policies for the cluster unless
-          it is set to an empty array.
-        scored: false
-
-      - id: 5.2.10
-        text: "Minimize the admission of containers with capabilities assigned (Manual)"
-        type: "manual"
-        remediation: |
-          Review the use of capabilities in applications running on your cluster. Where a namespace
-          contains applications which do not require any Linux capabities to operate consider adding
-          a PSP which forbids the admission of containers which do not drop all capabilities.
-        scored: false
-
-      - id: 5.2.11
-        text: "Minimize the admission of Windows HostProcess containers (Manual)"
-        type: "manual"
-        remediation: |
-          Add policies to each namespace in the cluster which has user workloads to restrict the
-          admission of containers that have `.securityContext.windowsOptions.hostProcess` set to `true`.
-        scored: false
-
-      - id: 5.2.12
-        text: "Minimize the admission of HostPath volumes (Manual)"
-        type: "manual"
-        remediation: |
-          Add policies to each namespace in the cluster which has user workloads to restrict the
-          admission of containers with `hostPath` volumes.
-        scored: false
-
-      - id: 5.2.13
-        text: "Minimize the admission of containers which use HostPorts (Manual)"
-        type: "manual"
-        remediation: |
-          Add policies to each namespace in the cluster which has user workloads to restrict the
-          admission of containers which use `hostPort` sections.
-        scored: false
-
-  - id: 5.3
-    text: "Network Policies and CNI"
-    checks:
-      - id: 5.3.1
-        text: "Ensure that the CNI in use supports NetworkPolicies (Manual)"
-        type: "manual"
-        remediation: |
-          If the CNI plugin in use does not support network policies, consideration should be given to
-          making use of a different plugin, or finding an alternate mechanism for restricting traffic
-          in the Kubernetes cluster.
-        scored: false
-
-      - id: 5.3.2
-        text: "Ensure that all Namespaces have NetworkPolicies defined (Manual)"
-        type: "manual"
-        remediation: |
-          Follow the documentation and create NetworkPolicy objects as you need them.
-        scored: false
-
-  - id: 5.4
-    text: "Secrets Management"
-    checks:
-      - id: 5.4.1
-        text: "Prefer using Secrets as files over Secrets as environment variables (Manual)"
-        type: "manual"
-        remediation: |
-          If possible, rewrite application code to read Secrets from mounted secret files, rather than
-          from environment variables.
-        scored: false
-
-      - id: 5.4.2
-        text: "Consider external secret storage (Manual)"
-        type: "manual"
-        remediation: |
-          Refer to the Secrets management options offered by your cloud provider or a third-party
-          secrets management solution.
-        scored: false
-
-  - id: 5.5
-    text: "Extensible Admission Control"
-    checks:
-      - id: 5.5.1
-        text: "Configure Image Provenance using ImagePolicyWebhook admission controller (Manual)"
-        type: "manual"
-        remediation: |
-          Follow the Kubernetes documentation and setup image provenance.
-        scored: false
-
-  - id: 5.7
-    text: "General Policies"
-    checks:
-      - id: 5.7.1
-        text: "Create administrative boundaries between resources using namespaces (Manual)"
-        type: "manual"
-        remediation: |
-          Follow the documentation and create namespaces for objects in your deployment as you need
-          them.
-        scored: false
-
-      - id: 5.7.2
-        text: "Ensure that the seccomp profile is set to docker/default in your Pod definitions (Manual)"
-        type: "manual"
-        remediation: |
-          Use `securityContext` to enable the docker/default seccomp profile in your pod definitions.
-          An example is as below:
-            securityContext:
-              seccompProfile:
-                type: RuntimeDefault
-        scored: false
-
-      - id: 5.7.3
-        text: "Apply SecurityContext to your Pods and Containers (Manual)"
-        type: "manual"
-        remediation: |
-          Follow the Kubernetes documentation and apply SecurityContexts to your Pods. For a
-          suggested list of SecurityContexts, you may refer to the CIS Security Benchmark for Docker
-          Containers.
-        scored: false
-
-      - id: 5.7.4
-        text: "The default namespace should not be used (Manual)"
-        type: "manual"
-        remediation: |
-          Ensure that namespaces are created to allow for appropriate segregation of Kubernetes
-          resources and that all new resources are created in a specific namespace.
-        scored: false

cfg/cis-1.24/config.yaml

@@ -1,2 +0,0 @@
----
-## Version-specific settings that override the values in cfg/config.yaml

cfg/cis-1.24/controlplane.yaml

@@ -1,46 +0,0 @@
----
-controls:
-version: "cis-1.24"
-id: 3
-text: "Control Plane Configuration"
-type: "controlplane"
-groups:
-  - id: 3.1
-    text: "Authentication and Authorization"
-    checks:
-      - id: 3.1.1
-        text: "Client certificate authentication should not be used for users (Manual)"
-        type: "manual"
-        remediation: |
-          Alternative mechanisms provided by Kubernetes such as the use of OIDC should be
-          implemented in place of client certificates.
-        scored: false
-
-  - id: 3.2
-    text: "Logging"
-    checks:
-      - id: 3.2.1
-        text: "Ensure that a minimal audit policy is created (Manual)"
-        audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep"
-        tests:
-          test_items:
-            - flag: "--audit-policy-file"
-              set: true
-        remediation: |
-          Create an audit policy file for your cluster.
-        scored: false
-
-      - id: 3.2.2
-        text: "Ensure that the audit policy covers key security concerns (Manual)"
-        type: "manual"
-        remediation: |
-          Review the audit policy provided for the cluster and ensure that it covers
-          at least the following areas,
-          - Access to Secrets managed by the cluster. Care should be taken to only
-            log Metadata for requests to Secrets, ConfigMaps, and TokenReviews, in
-            order to avoid risk of logging sensitive data.
-          - Modification of Pod and Deployment objects.
-          - Use of `pods/exec`, `pods/portforward`, `pods/proxy` and `services/proxy`.
-          For most requests, minimally logging at the Metadata level is recommended
-          (the most basic level of logging).
-        scored: false

cfg/cis-1.24/etcd.yaml

@@ -1,135 +0,0 @@
----
-controls:
-version: "cis-1.24"
-id: 2
-text: "Etcd Node Configuration"
-type: "etcd"
-groups:
-  - id: 2
-    text: "Etcd Node Configuration"
-    checks:
-      - id: 2.1
-        text: "Ensure that the --cert-file and --key-file arguments are set as appropriate (Automated)"
-        audit: "/bin/ps -ef | /bin/grep $etcdbin | /bin/grep -v grep"
-        tests:
-          bin_op: and
-          test_items:
-            - flag: "--cert-file"
-              env: "ETCD_CERT_FILE"
-            - flag: "--key-file"
-              env: "ETCD_KEY_FILE"
-        remediation: |
-          Follow the etcd service documentation and configure TLS encryption.
-          Then, edit the etcd pod specification file /etc/kubernetes/manifests/etcd.yaml
-          on the master node and set the below parameters.
-          --cert-file=</path/to/ca-file>
-          --key-file=</path/to/key-file>
-        scored: true
-
-      - id: 2.2
-        text: "Ensure that the --client-cert-auth argument is set to true (Automated)"
-        audit: "/bin/ps -ef | /bin/grep $etcdbin | /bin/grep -v grep"
-        tests:
-          test_items:
-            - flag: "--client-cert-auth"
-              env: "ETCD_CLIENT_CERT_AUTH"
-              compare:
-                op: eq
-                value: true
-        remediation: |
-          Edit the etcd pod specification file $etcdconf on the master
-          node and set the below parameter.
-          --client-cert-auth="true"
-        scored: true
-
-      - id: 2.3
-        text: "Ensure that the --auto-tls argument is not set to true (Automated)"
-        audit: "/bin/ps -ef | /bin/grep $etcdbin | /bin/grep -v grep"
-        tests:
-          bin_op: or
-          test_items:
-            - flag: "--auto-tls"
-              env: "ETCD_AUTO_TLS"
-              set: false
-            - flag: "--auto-tls"
-              env: "ETCD_AUTO_TLS"
-              compare:
-                op: eq
-                value: false
-        remediation: |
-          Edit the etcd pod specification file $etcdconf on the master
-          node and either remove the --auto-tls parameter or set it to false.
-            --auto-tls=false
-        scored: true
-
-      - id: 2.4
-        text: "Ensure that the --peer-cert-file and --peer-key-file arguments are
-        set as appropriate (Automated)"
-        audit: "/bin/ps -ef | /bin/grep $etcdbin | /bin/grep -v grep"
-        tests:
-          bin_op: and
-          test_items:
-            - flag: "--peer-cert-file"
-              env: "ETCD_PEER_CERT_FILE"
-            - flag: "--peer-key-file"
-              env: "ETCD_PEER_KEY_FILE"
-        remediation: |
-          Follow the etcd service documentation and configure peer TLS encryption as appropriate
-          for your etcd cluster.
-          Then, edit the etcd pod specification file $etcdconf on the
-          master node and set the below parameters.
-          --peer-client-file=</path/to/peer-cert-file>
-          --peer-key-file=</path/to/peer-key-file>
-        scored: true
-
-      - id: 2.5
-        text: "Ensure that the --peer-client-cert-auth argument is set to true (Automated)"
-        audit: "/bin/ps -ef | /bin/grep $etcdbin | /bin/grep -v grep"
-        tests:
-          test_items:
-            - flag: "--peer-client-cert-auth"
-              env: "ETCD_PEER_CLIENT_CERT_AUTH"
-              compare:
-                op: eq
-                value: true
-        remediation: |
-          Edit the etcd pod specification file $etcdconf on the master
-          node and set the below parameter.
-          --peer-client-cert-auth=true
-        scored: true
-
-      - id: 2.6
-        text: "Ensure that the --peer-auto-tls argument is not set to true (Automated)"
-        audit: "/bin/ps -ef | /bin/grep $etcdbin | /bin/grep -v grep"
-        tests:
-          bin_op: or
-          test_items:
-            - flag: "--peer-auto-tls"
-              env: "ETCD_PEER_AUTO_TLS"
-              set: false
-            - flag: "--peer-auto-tls"
-              env: "ETCD_PEER_AUTO_TLS"
-              compare:
-                op: eq
-                value: false
-        remediation: |
-          Edit the etcd pod specification file $etcdconf on the master
-          node and either remove the --peer-auto-tls parameter or set it to false.
-          --peer-auto-tls=false
-        scored: true
-
-      - id: 2.7
-        text: "Ensure that a unique Certificate Authority is used for etcd (Manual)"
-        audit: "/bin/ps -ef | /bin/grep $etcdbin | /bin/grep -v grep"
-        tests:
-          test_items:
-            - flag: "--trusted-ca-file"
-              env: "ETCD_TRUSTED_CA_FILE"
-        remediation: |
-          [Manual test]
-          Follow the etcd documentation and create a dedicated certificate authority setup for the
-          etcd service.
-          Then, edit the etcd pod specification file $etcdconf on the
-          master node and set the below parameter.
-          --trusted-ca-file=</path/to/ca-file>
-        scored: false

cfg/cis-1.24/master.yaml

@@ -1,943 +0,0 @@
----
-controls:
-version: "cis-1.24"
-id: 1
-text: "Control Plane Security Configuration"
-type: "master"
-groups:
-  - id: 1.1
-    text: "Control Plane Node Configuration Files"
-    checks:
-      - id: 1.1.1
-        text: "Ensure that the API server pod specification file permissions are set to 600 or more restrictive (Automated)"
-        audit: "/bin/sh -c 'if test -e $apiserverconf; then stat -c permissions=%a $apiserverconf; fi'"
-        tests:
-          test_items:
-            - flag: "permissions"
-              compare:
-                op: bitmask
-                value: "600"
-        remediation: |
-          Run the below command (based on the file location on your system) on the
-          control plane node.
-          For example, chmod 600 $apiserverconf
-        scored: true
-
-      - id: 1.1.2
-        text: "Ensure that the API server pod specification file ownership is set to root:root (Automated)"
-        audit: "/bin/sh -c 'if test -e $apiserverconf; then stat -c %U:%G $apiserverconf; fi'"
-        tests:
-          test_items:
-            - flag: "root:root"
-        remediation: |
-          Run the below command (based on the file location on your system) on the control plane node.
-          For example, chown root:root $apiserverconf
-        scored: true
-
-      - id: 1.1.3
-        text: "Ensure that the controller manager pod specification file permissions are set to 600 or more restrictive (Automated)"
-        audit: "/bin/sh -c 'if test -e $controllermanagerconf; then stat -c permissions=%a $controllermanagerconf; fi'"
-        tests:
-          test_items:
-            - flag: "permissions"
-              compare:
-                op: bitmask
-                value: "600"
-        remediation: |
-          Run the below command (based on the file location on your system) on the control plane node.
-          For example, chmod 600 $controllermanagerconf
-        scored: true
-
-      - id: 1.1.4
-        text: "Ensure that the controller manager pod specification file ownership is set to root:root (Automated)"
-        audit: "/bin/sh -c 'if test -e $controllermanagerconf; then stat -c %U:%G $controllermanagerconf; fi'"
-        tests:
-          test_items:
-            - flag: "root:root"
-        remediation: |
-          Run the below command (based on the file location on your system) on the control plane node.
-          For example, chown root:root $controllermanagerconf
-        scored: true
-
-      - id: 1.1.5
-        text: "Ensure that the scheduler pod specification file permissions are set to 600 or more restrictive (Automated)"
-        audit: "/bin/sh -c 'if test -e $schedulerconf; then stat -c permissions=%a $schedulerconf; fi'"
-        tests:
-          test_items:
-            - flag: "permissions"
-              compare:
-                op: bitmask
-                value: "600"
-        remediation: |
-          Run the below command (based on the file location on your system) on the control plane node.
-          For example, chmod 600 $schedulerconf
-        scored: true
-
-      - id: 1.1.6
-        text: "Ensure that the scheduler pod specification file ownership is set to root:root (Automated)"
-        audit: "/bin/sh -c 'if test -e $schedulerconf; then stat -c %U:%G $schedulerconf; fi'"
-        tests:
-          test_items:
-            - flag: "root:root"
-        remediation: |
-          Run the below command (based on the file location on your system) on the control plane node.
-          For example, chown root:root $schedulerconf
-        scored: true
-
-      - id: 1.1.7
-        text: "Ensure that the etcd pod specification file permissions are set to 600 or more restrictive (Automated)"
-        audit: "/bin/sh -c 'if test -e $etcdconf; then find $etcdconf -name '*etcd*' | xargs stat -c permissions=%a; fi'"
-        use_multiple_values: true
-        tests:
-          test_items:
-            - flag: "permissions"
-              compare:
-                op: bitmask
-                value: "600"
-        remediation: |
-          Run the below command (based on the file location on your system) on the control plane node.
-          For example,
-          chmod 600 $etcdconf
-        scored: true
-
-      - id: 1.1.8
-        text: "Ensure that the etcd pod specification file ownership is set to root:root (Automated)"
-        audit: "/bin/sh -c 'if test -e $etcdconf; then find $etcdconf -name '*etcd*' | xargs stat -c %U:%G; fi'"
-        use_multiple_values: true
-        tests:
-          test_items:
-            - flag: "root:root"
-        remediation: |
-          Run the below command (based on the file location on your system) on the control plane node.
-          For example,
-          chown root:root $etcdconf
-        scored: true
-
-      - id: 1.1.9
-        text: "Ensure that the Container Network Interface file permissions are set to 600 or more restrictive (Manual)"
-        audit: |
-          ps -ef | grep $kubeletbin | grep -- --cni-conf-dir | sed 's%.*cni-conf-dir[= ]\([^ ]*\).*%\1%' | xargs -I{} find {} -mindepth 1 | xargs --no-run-if-empty stat -c permissions=%a
-          find /var/lib/cni/networks -type f 2> /dev/null | xargs --no-run-if-empty stat -c permissions=%a
-        use_multiple_values: true
-        tests:
-          test_items:
-            - flag: "permissions"
-              compare:
-                op: bitmask
-                value: "600"
-        remediation: |
-          Run the below command (based on the file location on your system) on the control plane node.
-          For example, chmod 600 <path/to/cni/files>
-        scored: false
-
-      - id: 1.1.10
-        text: "Ensure that the Container Network Interface file ownership is set to root:root (Manual)"
-        audit: |
-          ps -ef | grep $kubeletbin | grep -- --cni-conf-dir | sed 's%.*cni-conf-dir[= ]\([^ ]*\).*%\1%' | xargs -I{} find {} -mindepth 1 | xargs --no-run-if-empty stat -c %U:%G
-          find /var/lib/cni/networks -type f 2> /dev/null | xargs --no-run-if-empty stat -c %U:%G
-        use_multiple_values: true
-        tests:
-          test_items:
-            - flag: "root:root"
-        remediation: |
-          Run the below command (based on the file location on your system) on the control plane node.
-          For example,
-          chown root:root <path/to/cni/files>
-        scored: false
-
-      - id: 1.1.11
-        text: "Ensure that the etcd data directory permissions are set to 700 or more restrictive (Automated)"
-        audit: |
-          DATA_DIR=''
-          for d in $(ps -ef | grep $etcdbin | grep -- --data-dir | sed 's%.*data-dir[= ]\([^ ]*\).*%\1%'); do
-            if test -d "$d"; then DATA_DIR="$d"; fi
-          done
-          if ! test -d "$DATA_DIR"; then DATA_DIR=$etcddatadir; fi
-          stat -c permissions=%a "$DATA_DIR"
-        tests:
-          test_items:
-            - flag: "permissions"
-              compare:
-                op: bitmask
-                value: "700"
-        remediation: |
-          On the etcd server node, get the etcd data directory, passed as an argument --data-dir,
-          from the command 'ps -ef | grep etcd'.
-          Run the below command (based on the etcd data directory found above). For example,
-          chmod 700 /var/lib/etcd
-        scored: true
-
-      - id: 1.1.12
-        text: "Ensure that the etcd data directory ownership is set to etcd:etcd (Automated)"
-        audit: |
-          DATA_DIR=''
-          for d in $(ps -ef | grep $etcdbin | grep -- --data-dir | sed 's%.*data-dir[= ]\([^ ]*\).*%\1%'); do
-            if test -d "$d"; then DATA_DIR="$d"; fi
-          done
-          if ! test -d "$DATA_DIR"; then DATA_DIR=$etcddatadir; fi
-          stat -c %U:%G "$DATA_DIR"
-        tests:
-          test_items:
-            - flag: "etcd:etcd"
-        remediation: |
-          On the etcd server node, get the etcd data directory, passed as an argument --data-dir,
-          from the command 'ps -ef | grep etcd'.
-          Run the below command (based on the etcd data directory found above).
-          For example, chown etcd:etcd /var/lib/etcd
-        scored: true
-
-      - id: 1.1.13
-        text: "Ensure that the admin.conf file permissions are set to 600 or more restrictive (Automated)"
-        audit: "/bin/sh -c 'if test -e /etc/kubernetes/admin.conf; then stat -c permissions=%a /etc/kubernetes/admin.conf; fi'"
-        tests:
-          test_items:
-            - flag: "permissions"
-              compare:
-                op: bitmask
-                value: "600"
-        remediation: |
-          Run the below command (based on the file location on your system) on the control plane node.
-          For example, chmod 600 /etc/kubernetes/admin.conf
-        scored: true
-
-      - id: 1.1.14
-        text: "Ensure that the admin.conf file ownership is set to root:root (Automated)"
-        audit: "/bin/sh -c 'if test -e /etc/kubernetes/admin.conf; then stat -c %U:%G /etc/kubernetes/admin.conf; fi'"
-        tests:
-          test_items:
-            - flag: "root:root"
-        remediation: |
-          Run the below command (based on the file location on your system) on the control plane node.
-          For example, chown root:root /etc/kubernetes/admin.conf
-        scored: true
-
-      - id: 1.1.15
-        text: "Ensure that the scheduler.conf file permissions are set to 600 or more restrictive (Automated)"
-        audit: "/bin/sh -c 'if test -e $schedulerkubeconfig; then stat -c permissions=%a $schedulerkubeconfig; fi'"
-        tests:
-          test_items:
-            - flag: "permissions"
-              compare:
-                op: bitmask
-                value: "600"
-        remediation: |
-          Run the below command (based on the file location on your system) on the control plane node.
-          For example,
-          chmod 600 $schedulerkubeconfig
-        scored: true
-
-      - id: 1.1.16
-        text: "Ensure that the scheduler.conf file ownership is set to root:root (Automated)"
-        audit: "/bin/sh -c 'if test -e $schedulerkubeconfig; then stat -c %U:%G $schedulerkubeconfig; fi'"
-        tests:
-          test_items:
-            - flag: "root:root"
-        remediation: |
-          Run the below command (based on the file location on your system) on the control plane node.
-          For example,
-          chown root:root $schedulerkubeconfig
-        scored: true
-
-      - id: 1.1.17
-        text: "Ensure that the controller-manager.conf file permissions are set to 600 or more restrictive (Automated)"
-        audit: "/bin/sh -c 'if test -e $controllermanagerkubeconfig; then stat -c permissions=%a $controllermanagerkubeconfig; fi'"
-        tests:
-          test_items:
-            - flag: "permissions"
-              compare:
-                op: bitmask
-                value: "600"
-        remediation: |
-          Run the below command (based on the file location on your system) on the control plane node.
-          For example,
-          chmod 600 $controllermanagerkubeconfig
-        scored: true
-
-      - id: 1.1.18
-        text: "Ensure that the controller-manager.conf file ownership is set to root:root (Automated)"
-        audit: "/bin/sh -c 'if test -e $controllermanagerkubeconfig; then stat -c %U:%G $controllermanagerkubeconfig; fi'"
-        tests:
-          test_items:
-            - flag: "root:root"
-        remediation: |
-          Run the below command (based on the file location on your system) on the control plane node.
-          For example,
-          chown root:root $controllermanagerkubeconfig
-        scored: true
-
-      - id: 1.1.19
-        text: "Ensure that the Kubernetes PKI directory and file ownership is set to root:root (Automated)"
-        audit: "find /etc/kubernetes/pki/ | xargs stat -c %U:%G"
-        use_multiple_values: true
-        tests:
-          test_items:
-            - flag: "root:root"
-        remediation: |
-          Run the below command (based on the file location on your system) on the control plane node.
-          For example,
-          chown -R root:root /etc/kubernetes/pki/
-        scored: true
-
-      - id: 1.1.20
-        text: "Ensure that the Kubernetes PKI certificate file permissions are set to 600 or more restrictive (Manual)"
-        audit: "find /etc/kubernetes/pki/ -name '*.crt' | xargs stat -c permissions=%a"
-        use_multiple_values: true
-        tests:
-          test_items:
-            - flag: "permissions"
-              compare:
-                op: bitmask
-                value: "600"
-        remediation: |
-          Run the below command (based on the file location on your system) on the control plane node.
-          For example,
-          chmod -R 600 /etc/kubernetes/pki/*.crt
-        scored: false
-
-      - id: 1.1.21
-        text: "Ensure that the Kubernetes PKI key file permissions are set to 600 (Manual)"
-        audit: "find /etc/kubernetes/pki/ -name '*.key' | xargs stat -c permissions=%a"
-        use_multiple_values: true
-        tests:
-          test_items:
-            - flag: "permissions"
-              compare:
-                op: bitmask
-                value: "600"
-        remediation: |
-          Run the below command (based on the file location on your system) on the control plane node.
-          For example,
-          chmod -R 600 /etc/kubernetes/pki/*.key
-        scored: false
-
-  - id: 1.2
-    text: "API Server"
-    checks:
-      - id: 1.2.1
-        text: "Ensure that the --anonymous-auth argument is set to false (Manual)"
-        audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep"
-        tests:
-          test_items:
-            - flag: "--anonymous-auth"
-              compare:
-                op: eq
-                value: false
-        remediation: |
-          Edit the API server pod specification file $apiserverconf
-          on the control plane node and set the below parameter.
-          --anonymous-auth=false
-        scored: false
-
-      - id: 1.2.2
-        text: "Ensure that the --token-auth-file parameter is not set (Automated)"
-        audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep"
-        tests:
-          test_items:
-            - flag: "--token-auth-file"
-              set: false
-        remediation: |
-          Follow the documentation and configure alternate mechanisms for authentication. Then,
-          edit the API server pod specification file $apiserverconf
-          on the control plane node and remove the --token-auth-file=<filename> parameter.
-        scored: true
-
-      - id: 1.2.3
-        text: "Ensure that the --DenyServiceExternalIPs is not set (Automated)"
-        audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep"
-        tests:
-          bin_op: or
-          test_items:
-            - flag: "--enable-admission-plugins"
-              compare:
-                op: nothave
-                value: "DenyServiceExternalIPs"
-            - flag: "--enable-admission-plugins"
-              set: false
-        remediation: |
-          Edit the API server pod specification file $apiserverconf
-          on the control plane node and remove the `DenyServiceExternalIPs`
-          from enabled admission plugins.
-        scored: true
-
-      - id: 1.2.4
-        text: "Ensure that the --kubelet-client-certificate and --kubelet-client-key arguments are set as appropriate (Automated)"
-        audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep"
-        tests:
-          bin_op: and
-          test_items:
-            - flag: "--kubelet-client-certificate"
-            - flag: "--kubelet-client-key"
-        remediation: |
-          Follow the Kubernetes documentation and set up the TLS connection between the
-          apiserver and kubelets. Then, edit API server pod specification file
-          $apiserverconf on the control plane node and set the
-          kubelet client certificate and key parameters as below.
-          --kubelet-client-certificate=<path/to/client-certificate-file>
-          --kubelet-client-key=<path/to/client-key-file>
-        scored: true
-
-      - id: 1.2.5
-        text: "Ensure that the --kubelet-certificate-authority argument is set as appropriate (Automated)"
-        audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep"
-        tests:
-          test_items:
-            - flag: "--kubelet-certificate-authority"
-        remediation: |
-          Follow the Kubernetes documentation and setup the TLS connection between
-          the apiserver and kubelets. Then, edit the API server pod specification file
-          $apiserverconf on the control plane node and set the
-          --kubelet-certificate-authority parameter to the path to the cert file for the certificate authority.
-          --kubelet-certificate-authority=<ca-string>
-        scored: true
-
-      - id: 1.2.6
-        text: "Ensure that the --authorization-mode argument is not set to AlwaysAllow (Automated)"
-        audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep"
-        tests:
-          test_items:
-            - flag: "--authorization-mode"
-              compare:
-                op: nothave
-                value: "AlwaysAllow"
-        remediation: |
-          Edit the API server pod specification file $apiserverconf
-          on the control plane node and set the --authorization-mode parameter to values other than AlwaysAllow.
-          One such example could be as below.
-          --authorization-mode=RBAC
-        scored: true
-
-      - id: 1.2.7
-        text: "Ensure that the --authorization-mode argument includes Node (Automated)"
-        audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep"
-        tests:
-          test_items:
-            - flag: "--authorization-mode"
-              compare:
-                op: has
-                value: "Node"
-        remediation: |
-          Edit the API server pod specification file $apiserverconf
-          on the control plane node and set the --authorization-mode parameter to a value that includes Node.
-          --authorization-mode=Node,RBAC
-        scored: true
-
-      - id: 1.2.8
-        text: "Ensure that the --authorization-mode argument includes RBAC (Automated)"
-        audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep"
-        tests:
-          test_items:
-            - flag: "--authorization-mode"
-              compare:
-                op: has
-                value: "RBAC"
-        remediation: |
-          Edit the API server pod specification file $apiserverconf
-          on the control plane node and set the --authorization-mode parameter to a value that includes RBAC,
-          for example `--authorization-mode=Node,RBAC`.
-        scored: true
-
-      - id: 1.2.9
-        text: "Ensure that the admission control plugin EventRateLimit is set (Manual)"
-        audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep"
-        tests:
-          test_items:
-            - flag: "--enable-admission-plugins"
-              compare:
-                op: has
-                value: "EventRateLimit"
-        remediation: |
-          Follow the Kubernetes documentation and set the desired limits in a configuration file.
-          Then, edit the API server pod specification file $apiserverconf
-          and set the below parameters.
-          --enable-admission-plugins=...,EventRateLimit,...
-          --admission-control-config-file=<path/to/configuration/file>
-        scored: false
-
-      - id: 1.2.10
-        text: "Ensure that the admission control plugin AlwaysAdmit is not set (Automated)"
-        audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep"
-        tests:
-          bin_op: or
-          test_items:
-            - flag: "--enable-admission-plugins"
-              compare:
-                op: nothave
-                value: AlwaysAdmit
-            - flag: "--enable-admission-plugins"
-              set: false
-        remediation: |
-          Edit the API server pod specification file $apiserverconf
-          on the control plane node and either remove the --enable-admission-plugins parameter, or set it to a
-          value that does not include AlwaysAdmit.
-        scored: true
-
-      - id: 1.2.11
-        text: "Ensure that the admission control plugin AlwaysPullImages is set (Manual)"
-        audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep"
-        tests:
-          test_items:
-            - flag: "--enable-admission-plugins"
-              compare:
-                op: has
-                value: "AlwaysPullImages"
-        remediation: |
-          Edit the API server pod specification file $apiserverconf
-          on the control plane node and set the --enable-admission-plugins parameter to include
-          AlwaysPullImages.
-          --enable-admission-plugins=...,AlwaysPullImages,...
-        scored: false
-
-      - id: 1.2.12
-        text: "Ensure that the admission control plugin SecurityContextDeny is set if PodSecurityPolicy is not used (Manual)"
-        audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep"
-        tests:
-          bin_op: or
-          test_items:
-            - flag: "--enable-admission-plugins"
-              compare:
-                op: has
-                value: "SecurityContextDeny"
-            - flag: "--enable-admission-plugins"
-              compare:
-                op: has
-                value: "PodSecurityPolicy"
-        remediation: |
-          Edit the API server pod specification file $apiserverconf
-          on the control plane node and set the --enable-admission-plugins parameter to include
-          SecurityContextDeny, unless PodSecurityPolicy is already in place.
-          --enable-admission-plugins=...,SecurityContextDeny,...
-        scored: false
-
-      - id: 1.2.13
-        text: "Ensure that the admission control plugin ServiceAccount is set (Automated)"
-        audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep"
-        tests:
-          bin_op: or
-          test_items:
-            - flag: "--disable-admission-plugins"
-              compare:
-                op: nothave
-                value: "ServiceAccount"
-            - flag: "--disable-admission-plugins"
-              set: false
-        remediation: |
-          Follow the documentation and create ServiceAccount objects as per your environment.
-          Then, edit the API server pod specification file $apiserverconf
-          on the control plane node and ensure that the --disable-admission-plugins parameter is set to a
-          value that does not include ServiceAccount.
-        scored: true
-
-      - id: 1.2.14
-        text: "Ensure that the admission control plugin NamespaceLifecycle is set (Automated)"
-        audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep"
-        tests:
-          bin_op: or
-          test_items:
-            - flag: "--disable-admission-plugins"
-              compare:
-                op: nothave
-                value: "NamespaceLifecycle"
-            - flag: "--disable-admission-plugins"
-              set: false
-        remediation: |
-          Edit the API server pod specification file $apiserverconf
-          on the control plane node and set the --disable-admission-plugins parameter to
-          ensure it does not include NamespaceLifecycle.
-        scored: true
-
-      - id: 1.2.15
-        text: "Ensure that the admission control plugin NodeRestriction is set (Automated)"
-        audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep"
-        tests:
-          test_items:
-            - flag: "--enable-admission-plugins"
-              compare:
-                op: has
-                value: "NodeRestriction"
-        remediation: |
-          Follow the Kubernetes documentation and configure NodeRestriction plug-in on kubelets.
-          Then, edit the API server pod specification file $apiserverconf
-          on the control plane node and set the --enable-admission-plugins parameter to a
-          value that includes NodeRestriction.
-          --enable-admission-plugins=...,NodeRestriction,...
-        scored: true
-
-      - id: 1.2.16
-        text: "Ensure that the --secure-port argument is not set to 0 (Automated)"
-        audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep"
-        tests:
-          bin_op: or
-          test_items:
-            - flag: "--secure-port"
-              compare:
-                op: gt
-                value: 0
-            - flag: "--secure-port"
-              set: false
-        remediation: |
-          Edit the API server pod specification file $apiserverconf
-          on the control plane node and either remove the --secure-port parameter or
-          set it to a different (non-zero) desired port.
-        scored: true
-
-      - id: 1.2.17
-        text: "Ensure that the --profiling argument is set to false (Automated)"
-        audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep"
-        tests:
-          test_items:
-            - flag: "--profiling"
-              compare:
-                op: eq
-                value: false
-        remediation: |
-          Edit the API server pod specification file $apiserverconf
-          on the control plane node and set the below parameter.
-          --profiling=false
-        scored: true
-
-      - id: 1.2.18
-        text: "Ensure that the --audit-log-path argument is set (Automated)"
-        audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep"
-        tests:
-          test_items:
-            - flag: "--audit-log-path"
-        remediation: |
-          Edit the API server pod specification file $apiserverconf
-          on the control plane node and set the --audit-log-path parameter to a suitable path and
-          file where you would like audit logs to be written, for example,
-          --audit-log-path=/var/log/apiserver/audit.log
-        scored: true
-
-      - id: 1.2.19
-        text: "Ensure that the --audit-log-maxage argument is set to 30 or as appropriate (Automated)"
-        audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep"
-        tests:
-          test_items:
-            - flag: "--audit-log-maxage"
-              compare:
-                op: gte
-                value: 30
-        remediation: |
-          Edit the API server pod specification file $apiserverconf
-          on the control plane node and set the --audit-log-maxage parameter to 30
-          or as an appropriate number of days, for example,
-          --audit-log-maxage=30
-        scored: true
-
-      - id: 1.2.20
-        text: "Ensure that the --audit-log-maxbackup argument is set to 10 or as appropriate (Automated)"
-        audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep"
-        tests:
-          test_items:
-            - flag: "--audit-log-maxbackup"
-              compare:
-                op: gte
-                value: 10
-        remediation: |
-          Edit the API server pod specification file $apiserverconf
-          on the control plane node and set the --audit-log-maxbackup parameter to 10 or to an appropriate
-          value. For example,
-          --audit-log-maxbackup=10
-        scored: true
-
-      - id: 1.2.21
-        text: "Ensure that the --audit-log-maxsize argument is set to 100 or as appropriate (Automated)"
-        audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep"
-        tests:
-          test_items:
-            - flag: "--audit-log-maxsize"
-              compare:
-                op: gte
-                value: 100
-        remediation: |
-          Edit the API server pod specification file $apiserverconf
-          on the control plane node and set the --audit-log-maxsize parameter to an appropriate size in MB.
-          For example, to set it as 100 MB, --audit-log-maxsize=100
-        scored: true
-
-      - id: 1.2.22
-        text: "Ensure that the --request-timeout argument is set as appropriate (Manual)"
-        audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep"
-        type: manual
-        remediation: |
-          Edit the API server pod specification file $apiserverconf
-          and set the below parameter as appropriate and if needed.
-          For example, --request-timeout=300s
-        scored: false
-
-      - id: 1.2.23
-        text: "Ensure that the --service-account-lookup argument is set to true (Automated)"
-        audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep"
-        tests:
-          bin_op: or
-          test_items:
-            - flag: "--service-account-lookup"
-              set: false
-            - flag: "--service-account-lookup"
-              compare:
-                op: eq
-                value: true
-        remediation: |
-          Edit the API server pod specification file $apiserverconf
-          on the control plane node and set the below parameter.
-          --service-account-lookup=true
-          Alternatively, you can delete the --service-account-lookup parameter from this file so
-          that the default takes effect.
-        scored: true
-
-      - id: 1.2.24
-        text: "Ensure that the --service-account-key-file argument is set as appropriate (Automated)"
-        audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep"
-        tests:
-          test_items:
-            - flag: "--service-account-key-file"
-        remediation: |
-          Edit the API server pod specification file $apiserverconf
-          on the control plane node and set the --service-account-key-file parameter
-          to the public key file for service accounts. For example,
-          --service-account-key-file=<filename>
-        scored: true
-
-      - id: 1.2.25
-        text: "Ensure that the --etcd-certfile and --etcd-keyfile arguments are set as appropriate (Automated)"
-        audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep"
-        tests:
-          bin_op: and
-          test_items:
-            - flag: "--etcd-certfile"
-            - flag: "--etcd-keyfile"
-        remediation: |
-          Follow the Kubernetes documentation and set up the TLS connection between the apiserver and etcd.
-          Then, edit the API server pod specification file $apiserverconf
-          on the control plane node and set the etcd certificate and key file parameters.
-          --etcd-certfile=<path/to/client-certificate-file>
-          --etcd-keyfile=<path/to/client-key-file>
-        scored: true
-
-      - id: 1.2.26
-        text: "Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate (Automated)"
-        audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep"
-        tests:
-          bin_op: and
-          test_items:
-            - flag: "--tls-cert-file"
-            - flag: "--tls-private-key-file"
-        remediation: |
-          Follow the Kubernetes documentation and set up the TLS connection on the apiserver.
-          Then, edit the API server pod specification file $apiserverconf
-          on the control plane node and set the TLS certificate and private key file parameters.
-          --tls-cert-file=<path/to/tls-certificate-file>
-          --tls-private-key-file=<path/to/tls-key-file>
-        scored: true
-
-      - id: 1.2.27
-        text: "Ensure that the --client-ca-file argument is set as appropriate (Automated)"
-        audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep"
-        tests:
-          test_items:
-            - flag: "--client-ca-file"
-        remediation: |
-          Follow the Kubernetes documentation and set up the TLS connection on the apiserver.
-          Then, edit the API server pod specification file $apiserverconf
-          on the control plane node and set the client certificate authority file.
-          --client-ca-file=<path/to/client-ca-file>
-        scored: true
-
-      - id: 1.2.28
-        text: "Ensure that the --etcd-cafile argument is set as appropriate (Automated)"
-        audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep"
-        tests:
-          test_items:
-            - flag: "--etcd-cafile"
-        remediation: |
-          Follow the Kubernetes documentation and set up the TLS connection between the apiserver and etcd.
-          Then, edit the API server pod specification file $apiserverconf
-          on the control plane node and set the etcd certificate authority file parameter.
-          --etcd-cafile=<path/to/ca-file>
-        scored: true
-
-      - id: 1.2.29
-        text: "Ensure that the --encryption-provider-config argument is set as appropriate (Manual)"
-        audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep"
-        tests:
-          test_items:
-            - flag: "--encryption-provider-config"
-        remediation: |
-          Follow the Kubernetes documentation and configure a EncryptionConfig file.
-          Then, edit the API server pod specification file $apiserverconf
-          on the control plane node and set the --encryption-provider-config parameter to the path of that file.
-          For example, --encryption-provider-config=</path/to/EncryptionConfig/File>
-        scored: false
-
-      - id: 1.2.30
-        text: "Ensure that encryption providers are appropriately configured (Manual)"
-        audit: |
-          ENCRYPTION_PROVIDER_CONFIG=$(ps -ef | grep $apiserverbin | grep -- --encryption-provider-config | sed 's%.*encryption-provider-config[= ]\([^ ]*\).*%\1%')
-          if test -e $ENCRYPTION_PROVIDER_CONFIG; then grep -A1 'providers:' $ENCRYPTION_PROVIDER_CONFIG | tail -n1 | grep -o "[A-Za-z]*" | sed 's/^/provider=/'; fi
-        tests:
-          test_items:
-            - flag: "provider"
-              compare:
-                op: valid_elements
-                value: "aescbc,kms,secretbox"
-        remediation: |
-          Follow the Kubernetes documentation and configure a EncryptionConfig file.
-          In this file, choose aescbc, kms or secretbox as the encryption provider.
-        scored: false
-
-      - id: 1.2.31
-        text: "Ensure that the API Server only makes use of Strong Cryptographic Ciphers (Manual)"
-        audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep"
-        tests:
-          test_items:
-            - flag: "--tls-cipher-suites"
-              compare:
-                op: valid_elements
-                value: "TLS_AES_128_GCM_SHA256,TLS_AES_256_GCM_SHA384,TLS_CHACHA20_POLY1305_SHA256,TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256,TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256,TLS_RSA_WITH_3DES_EDE_CBC_SHA,TLS_RSA_WITH_AES_128_CBC_SHA,TLS_RSA_WITH_AES_128_GCM_SHA256,TLS_RSA_WITH_AES_256_CBC_SHA,TLS_RSA_WITH_AES_256_GCM_SHA384"
-        remediation: |
-          Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml
-          on the control plane node and set the below parameter.
-          --tls-cipher-suites=TLS_AES_128_GCM_SHA256,TLS_AES_256_GCM_SHA384,TLS_CHACHA20_POLY1305_SHA256,
-          TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
-          TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
-          TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256,
-          TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
-          TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,
-          TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256,TLS_RSA_WITH_3DES_EDE_CBC_SHA,TLS_RSA_WITH_AES_128_CBC_SHA,
-          TLS_RSA_WITH_AES_128_GCM_SHA256,TLS_RSA_WITH_AES_256_CBC_SHA,TLS_RSA_WITH_AES_256_GCM_SHA384
-        scored: false
-
-  - id: 1.3
-    text: "Controller Manager"
-    checks:
-      - id: 1.3.1
-        text: "Ensure that the --terminated-pod-gc-threshold argument is set as appropriate (Manual)"
-        audit: "/bin/ps -ef | grep $controllermanagerbin | grep -v grep"
-        tests:
-          test_items:
-            - flag: "--terminated-pod-gc-threshold"
-        remediation: |
-          Edit the Controller Manager pod specification file $controllermanagerconf
-          on the control plane node and set the --terminated-pod-gc-threshold to an appropriate threshold,
-          for example, --terminated-pod-gc-threshold=10
-        scored: false
-
-      - id: 1.3.2
-        text: "Ensure that the --profiling argument is set to false (Automated)"
-        audit: "/bin/ps -ef | grep $controllermanagerbin | grep -v grep"
-        tests:
-          test_items:
-            - flag: "--profiling"
-              compare:
-                op: eq
-                value: false
-        remediation: |
-          Edit the Controller Manager pod specification file $controllermanagerconf
-          on the control plane node and set the below parameter.
-          --profiling=false
-        scored: true
-
-      - id: 1.3.3
-        text: "Ensure that the --use-service-account-credentials argument is set to true (Automated)"
-        audit: "/bin/ps -ef | grep $controllermanagerbin | grep -v grep"
-        tests:
-          test_items:
-            - flag: "--use-service-account-credentials"
-              compare:
-                op: noteq
-                value: false
-        remediation: |
-          Edit the Controller Manager pod specification file $controllermanagerconf
-          on the control plane node to set the below parameter.
-          --use-service-account-credentials=true
-        scored: true
-
-      - id: 1.3.4
-        text: "Ensure that the --service-account-private-key-file argument is set as appropriate (Automated)"
-        audit: "/bin/ps -ef | grep $controllermanagerbin | grep -v grep"
-        tests:
-          test_items:
-            - flag: "--service-account-private-key-file"
-        remediation: |
-          Edit the Controller Manager pod specification file $controllermanagerconf
-          on the control plane node and set the --service-account-private-key-file parameter
-          to the private key file for service accounts.
-          --service-account-private-key-file=<filename>
-        scored: true
-
-      - id: 1.3.5
-        text: "Ensure that the --root-ca-file argument is set as appropriate (Automated)"
-        audit: "/bin/ps -ef | grep $controllermanagerbin | grep -v grep"
-        tests:
-          test_items:
-            - flag: "--root-ca-file"
-        remediation: |
-          Edit the Controller Manager pod specification file $controllermanagerconf
-          on the control plane node and set the --root-ca-file parameter to the certificate bundle file`.
-          --root-ca-file=<path/to/file>
-        scored: true
-
-      - id: 1.3.6
-        text: "Ensure that the RotateKubeletServerCertificate argument is set to true (Automated)"
-        audit: "/bin/ps -ef | grep $controllermanagerbin | grep -v grep"
-        tests:
-          bin_op: or
-          test_items:
-            - flag: "--feature-gates"
-              compare:
-                op: nothave
-                value: "RotateKubeletServerCertificate=false"
-              set: true
-            - flag: "--feature-gates"
-              set: false
-        remediation: |
-          Edit the Controller Manager pod specification file $controllermanagerconf
-          on the control plane node and set the --feature-gates parameter to include RotateKubeletServerCertificate=true.
-          --feature-gates=RotateKubeletServerCertificate=true
-        scored: true
-
-      - id: 1.3.7
-        text: "Ensure that the --bind-address argument is set to 127.0.0.1 (Automated)"
-        audit: "/bin/ps -ef | grep $controllermanagerbin | grep -v grep"
-        tests:
-          test_items:
-            - flag: "--bind-address"
-              compare:
-                op: eq
-                value: "127.0.0.1"
-        remediation: |
-          Edit the Controller Manager pod specification file $controllermanagerconf
-          on the control plane node and ensure the correct value for the --bind-address parameter
-        scored: true
-
-  - id: 1.4
-    text: "Scheduler"
-    checks:
-      - id: 1.4.1
-        text: "Ensure that the --profiling argument is set to false (Automated)"
-        audit: "/bin/ps -ef | grep $schedulerbin | grep -v grep"
-        tests:
-          test_items:
-            - flag: "--profiling"
-              compare:
-                op: eq
-                value: false
-        remediation: |
-          Edit the Scheduler pod specification file $schedulerconf file
-          on the control plane node and set the below parameter.
-          --profiling=false
-        scored: true
-
-      - id: 1.4.2
-        text: "Ensure that the --bind-address argument is set to 127.0.0.1 (Automated)"
-        audit: "/bin/ps -ef | grep $schedulerbin | grep -v grep"
-        tests:
-          test_items:
-            - flag: "--bind-address"
-              compare:
-                op: eq
-                value: "127.0.0.1"
-        remediation: |
-          Edit the Scheduler pod specification file $schedulerconf
-          on the control plane node and ensure the correct value for the --bind-address parameter
-        scored: true

cfg/cis-1.24/node.yaml

@@ -1,464 +0,0 @@
----
-controls:
-version: "cis-1.24"
-id: 4
-text: "Worker Node Security Configuration"
-type: "node"
-groups:
-  - id: 4.1
-    text: "Worker Node Configuration Files"
-    checks:
-      - id: 4.1.1
-        text: "Ensure that the kubelet service file permissions are set to 600 or more restrictive (Automated)"
-        audit: '/bin/sh -c ''if test -e $kubeletsvc; then stat -c permissions=%a $kubeletsvc; fi'' '
-        tests:
-          test_items:
-            - flag: "permissions"
-              compare:
-                op: bitmask
-                value: "600"
-        remediation: |
-          Run the below command (based on the file location on your system) on the each worker node.
-          For example, chmod 600 $kubeletsvc
-        scored: true
-
-      - id: 4.1.2
-        text: "Ensure that the kubelet service file ownership is set to root:root (Automated)"
-        audit: '/bin/sh -c "if test -e $kubeletsvc; then stat -c %U:%G $kubeletsvc; else echo \"File not found\"; fi"'
-        tests:
-          bin_op: or
-          test_items:
-            - flag: root:root
-            - flag: "File not found"
-        remediation: |
-            Run the below command (based on the file location on your system) on the each worker node.
-            For example,
-            chown root:root $kubeletsvc
-        scored: true
-
-      - id: 4.1.3
-        text: "If proxy kubeconfig file exists ensure permissions are set to 600 or more restrictive (Manual)"
-        audit: '/bin/sh -c ''if test -e $proxykubeconfig; then stat -c permissions=%a $proxykubeconfig; fi'' '
-        tests:
-          bin_op: or
-          test_items:
-            - flag: "permissions"
-              set: true
-              compare:
-                op: bitmask
-                value: "600"
-        remediation: |
-          Run the below command (based on the file location on your system) on the each worker node.
-          For example,
-          chmod 600 $proxykubeconfig
-        scored: false
-
-      - id: 4.1.4
-        text: "If proxy kubeconfig file exists ensure ownership is set to root:root (Manual)"
-        audit: '/bin/sh -c ''if test -e $proxykubeconfig; then stat -c %U:%G $proxykubeconfig; fi'' '
-        tests:
-          bin_op: or
-          test_items:
-            - flag: root:root
-        remediation: |
-          Run the below command (based on the file location on your system) on the each worker node.
-          For example, chown root:root $proxykubeconfig
-        scored: false
-
-      - id: 4.1.5
-        text: "Ensure that the --kubeconfig kubelet.conf file permissions are set to 600 or more restrictive (Automated)"
-        audit: '/bin/sh -c ''if test -e $kubeletkubeconfig; then stat -c permissions=%a $kubeletkubeconfig; fi'' '
-        tests:
-          test_items:
-            - flag: "permissions"
-              compare:
-                op: bitmask
-                value: "600"
-        remediation: |
-          Run the below command (based on the file location on your system) on the each worker node.
-          For example,
-          chmod 600 $kubeletkubeconfig
-        scored: true
-
-      - id: 4.1.6
-        text: "Ensure that the --kubeconfig kubelet.conf file ownership is set to root:root (Automated)"
-        audit: '/bin/sh -c ''if test -e $kubeletkubeconfig; then stat -c %U:%G $kubeletkubeconfig; fi'' '
-        tests:
-          test_items:
-            - flag: root:root
-        remediation: |
-          Run the below command (based on the file location on your system) on the each worker node.
-          For example,
-          chown root:root $kubeletkubeconfig
-        scored: true
-
-      - id: 4.1.7
-        text: "Ensure that the certificate authorities file permissions are set to 600 or more restrictive (Manual)"
-        audit: |
-          CAFILE=$(ps -ef | grep kubelet | grep -v apiserver | grep -- --client-ca-file= | awk -F '--client-ca-file=' '{print $2}' | awk '{print $1}' | uniq)
-          if test -z $CAFILE; then CAFILE=$kubeletcafile; fi
-          if test -e $CAFILE; then stat -c permissions=%a $CAFILE; fi
-        tests:
-          test_items:
-            - flag: "permissions"
-              compare:
-                op: bitmask
-                value: "600"
-        remediation: |
-          Run the following command to modify the file permissions of the
-          --client-ca-file chmod 600 <filename>
-        scored: false
-
-      - id: 4.1.8
-        text: "Ensure that the client certificate authorities file ownership is set to root:root (Manual)"
-        audit: |
-          CAFILE=$(ps -ef | grep kubelet | grep -v apiserver | grep -- --client-ca-file= | awk -F '--client-ca-file=' '{print $2}' | awk '{print $1}' | uniq)
-          if test -z $CAFILE; then CAFILE=$kubeletcafile; fi
-          if test -e $CAFILE; then stat -c %U:%G $CAFILE; fi
-        tests:
-          test_items:
-            - flag: root:root
-              compare:
-                op: eq
-                value: root:root
-        remediation: |
-          Run the following command to modify the ownership of the --client-ca-file.
-          chown root:root <filename>
-        scored: false
-
-      - id: 4.1.9
-        text: "If the kubelet config.yaml configuration file is being used validate permissions set to 600 or more restrictive (Manual)"
-        audit: '/bin/sh -c ''if test -e $kubeletconf; then stat -c permissions=%a $kubeletconf; fi'' '
-        tests:
-          test_items:
-            - flag: "permissions"
-              compare:
-                op: bitmask
-                value: "600"
-        remediation: |
-          Run the following command (using the config file location identified in the Audit step)
-          chmod 600 $kubeletconf
-        scored: false
-
-      - id: 4.1.10
-        text: "If the kubelet config.yaml configuration file is being used validate file ownership is set to root:root (Manual)"
-        audit: '/bin/sh -c ''if test -e $kubeletconf; then stat -c %U:%G $kubeletconf; fi'' '
-        tests:
-          test_items:
-            - flag: root:root
-        remediation: |
-          Run the following command (using the config file location identified in the Audit step)
-          chown root:root $kubeletconf
-        scored: false
-
-  - id: 4.2
-    text: "Kubelet"
-    checks:
-      - id: 4.2.1
-        text: "Ensure that the --anonymous-auth argument is set to false (Automated)"
-        audit: "/bin/ps -fC $kubeletbin"
-        audit_config: "/bin/cat $kubeletconf"
-        tests:
-          test_items:
-            - flag: "--anonymous-auth"
-              path: '{.authentication.anonymous.enabled}'
-              compare:
-                op: eq
-                value: false
-        remediation: |
-          If using a Kubelet config file, edit the file to set `authentication: anonymous: enabled` to
-          `false`.
-          If using executable arguments, edit the kubelet service file
-          $kubeletsvc on each worker node and
-          set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable.
-          `--anonymous-auth=false`
-          Based on your system, restart the kubelet service. For example,
-          systemctl daemon-reload
-          systemctl restart kubelet.service
-        scored: true
-
-      - id: 4.2.2
-        text: "Ensure that the --authorization-mode argument is not set to AlwaysAllow (Automated)"
-        audit: "/bin/ps -fC $kubeletbin"
-        audit_config: "/bin/cat $kubeletconf"
-        tests:
-          test_items:
-            - flag: --authorization-mode
-              path: '{.authorization.mode}'
-              compare:
-                op: nothave
-                value: AlwaysAllow
-        remediation: |
-          If using a Kubelet config file, edit the file to set `authorization.mode` to Webhook. If
-          using executable arguments, edit the kubelet service file
-          $kubeletsvc on each worker node and
-          set the below parameter in KUBELET_AUTHZ_ARGS variable.
-          --authorization-mode=Webhook
-          Based on your system, restart the kubelet service. For example,
-          systemctl daemon-reload
-          systemctl restart kubelet.service
-        scored: true
-
-      - id: 4.2.3
-        text: "Ensure that the --client-ca-file argument is set as appropriate (Automated)"
-        audit: "/bin/ps -fC $kubeletbin"
-        audit_config: "/bin/cat $kubeletconf"
-        tests:
-          test_items:
-            - flag: --client-ca-file
-              path: '{.authentication.x509.clientCAFile}'
-        remediation: |
-          If using a Kubelet config file, edit the file to set `authentication.x509.clientCAFile` to
-          the location of the client CA file.
-          If using command line arguments, edit the kubelet service file
-          $kubeletsvc on each worker node and
-          set the below parameter in KUBELET_AUTHZ_ARGS variable.
-          --client-ca-file=<path/to/client-ca-file>
-          Based on your system, restart the kubelet service. For example,
-          systemctl daemon-reload
-          systemctl restart kubelet.service
-        scored: true
-
-      - id: 4.2.4
-        text: "Verify that the --read-only-port argument is set to 0 (Manual)"
-        audit: "/bin/ps -fC $kubeletbin"
-        audit_config: "/bin/cat $kubeletconf"
-        tests:
-          bin_op: or
-          test_items:
-            - flag: "--read-only-port"
-              path: '{.readOnlyPort}'
-              compare:
-                op: eq
-                value: 0
-            - flag: "--read-only-port"
-              path: '{.readOnlyPort}'
-              set: false
-        remediation: |
-          If using a Kubelet config file, edit the file to set `readOnlyPort` to 0.
-          If using command line arguments, edit the kubelet service file
-          $kubeletsvc on each worker node and
-          set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable.
-          --read-only-port=0
-          Based on your system, restart the kubelet service. For example,
-          systemctl daemon-reload
-          systemctl restart kubelet.service
-        scored: false
-
-      - id: 4.2.5
-        text: "Ensure that the --streaming-connection-idle-timeout argument is not set to 0 (Manual)"
-        audit: "/bin/ps -fC $kubeletbin"
-        audit_config: "/bin/cat $kubeletconf"
-        tests:
-          test_items:
-            - flag: --streaming-connection-idle-timeout
-              path: '{.streamingConnectionIdleTimeout}'
-              compare:
-                op: noteq
-                value: 0
-            - flag: --streaming-connection-idle-timeout
-              path: '{.streamingConnectionIdleTimeout}'
-              set: false
-          bin_op: or
-        remediation: |
-          If using a Kubelet config file, edit the file to set `streamingConnectionIdleTimeout` to a
-          value other than 0.
-          If using command line arguments, edit the kubelet service file
-          $kubeletsvc on each worker node and
-          set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable.
-          --streaming-connection-idle-timeout=5m
-          Based on your system, restart the kubelet service. For example,
-          systemctl daemon-reload
-          systemctl restart kubelet.service
-        scored: false
-
-      - id: 4.2.6
-        text: "Ensure that the --protect-kernel-defaults argument is set to true (Automated)"
-        audit: "/bin/ps -fC $kubeletbin"
-        audit_config: "/bin/cat $kubeletconf"
-        tests:
-          test_items:
-            - flag: --protect-kernel-defaults
-              path: '{.protectKernelDefaults}'
-              compare:
-                op: eq
-                value: true
-        remediation: |
-          If using a Kubelet config file, edit the file to set `protectKernelDefaults` to `true`.
-          If using command line arguments, edit the kubelet service file
-          $kubeletsvc on each worker node and
-          set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable.
-          --protect-kernel-defaults=true
-          Based on your system, restart the kubelet service. For example:
-          systemctl daemon-reload
-          systemctl restart kubelet.service
-        scored: true
-
-      - id: 4.2.7
-        text: "Ensure that the --make-iptables-util-chains argument is set to true (Automated)"
-        audit: "/bin/ps -fC $kubeletbin"
-        audit_config: "/bin/cat $kubeletconf"
-        tests:
-          test_items:
-            - flag: --make-iptables-util-chains
-              path: '{.makeIPTablesUtilChains}'
-              compare:
-                op: eq
-                value: true
-            - flag: --make-iptables-util-chains
-              path: '{.makeIPTablesUtilChains}'
-              set: false
-          bin_op: or
-        remediation: |
-          If using a Kubelet config file, edit the file to set `makeIPTablesUtilChains` to `true`.
-          If using command line arguments, edit the kubelet service file
-          $kubeletsvc on each worker node and
-          remove the --make-iptables-util-chains argument from the
-          KUBELET_SYSTEM_PODS_ARGS variable.
-          Based on your system, restart the kubelet service. For example:
-          systemctl daemon-reload
-          systemctl restart kubelet.service
-        scored: true
-
-      - id: 4.2.8
-        text: "Ensure that the --hostname-override argument is not set (Manual)"
-        # This is one of those properties that can only be set as a command line argument.
-        # To check if the property is set as expected, we need to parse the kubelet command
-        # instead reading the Kubelet Configuration file.
-        audit: "/bin/ps -fC $kubeletbin "
-        tests:
-          test_items:
-            - flag: --hostname-override
-              set: false
-        remediation: |
-          Edit the kubelet service file $kubeletsvc
-          on each worker node and remove the --hostname-override argument from the
-          KUBELET_SYSTEM_PODS_ARGS variable.
-          Based on your system, restart the kubelet service. For example,
-          systemctl daemon-reload
-          systemctl restart kubelet.service
-        scored: false
-
-      - id: 4.2.9
-        text: "Ensure that the eventRecordQPS argument is set to a level which ensures appropriate event capture (Manual)"
-        audit: "/bin/ps -fC $kubeletbin"
-        audit_config: "/bin/cat $kubeletconf"
-        tests:
-          test_items:
-            - flag: --event-qps
-              path: '{.eventRecordQPS}'
-              compare:
-                op: gte
-                value: 0
-            - flag: --event-qps
-              path: '{.eventRecordQPS}'
-              set: false
-          bin_op: or
-        remediation: |
-          If using a Kubelet config file, edit the file to set `eventRecordQPS` to an appropriate level.
-          If using command line arguments, edit the kubelet service file
-          $kubeletsvc on each worker node and
-          set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable.
-          Based on your system, restart the kubelet service. For example,
-          systemctl daemon-reload
-          systemctl restart kubelet.service
-        scored: false
-
-      - id: 4.2.10
-        text: "Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate (Manual)"
-        audit: "/bin/ps -fC $kubeletbin"
-        audit_config: "/bin/cat $kubeletconf"
-        tests:
-          test_items:
-            - flag: --tls-cert-file
-              path: '{.tlsCertFile}'
-            - flag: --tls-private-key-file
-              path: '{.tlsPrivateKeyFile}'
-        remediation: |
-          If using a Kubelet config file, edit the file to set `tlsCertFile` to the location
-          of the certificate file to use to identify this Kubelet, and `tlsPrivateKeyFile`
-          to the location of the corresponding private key file.
-          If using command line arguments, edit the kubelet service file
-          $kubeletsvc on each worker node and
-          set the below parameters in KUBELET_CERTIFICATE_ARGS variable.
-          --tls-cert-file=<path/to/tls-certificate-file>
-          --tls-private-key-file=<path/to/tls-key-file>
-          Based on your system, restart the kubelet service. For example,
-          systemctl daemon-reload
-          systemctl restart kubelet.service
-        scored: false
-
-      - id: 4.2.11
-        text: "Ensure that the --rotate-certificates argument is not set to false (Automated)"
-        audit: "/bin/ps -fC $kubeletbin"
-        audit_config: "/bin/cat $kubeletconf"
-        tests:
-          test_items:
-            - flag: --rotate-certificates
-              path: '{.rotateCertificates}'
-              compare:
-                op: eq
-                value: true
-            - flag: --rotate-certificates
-              path: '{.rotateCertificates}'
-              set: false
-          bin_op: or
-        remediation: |
-          If using a Kubelet config file, edit the file to add the line `rotateCertificates` to `true` or
-          remove it altogether to use the default value.
-          If using command line arguments, edit the kubelet service file
-          $kubeletsvc on each worker node and
-          remove --rotate-certificates=false argument from the KUBELET_CERTIFICATE_ARGS
-          variable.
-          Based on your system, restart the kubelet service. For example,
-          systemctl daemon-reload
-          systemctl restart kubelet.service
-        scored: true
-
-      - id: 4.2.12
-        text: "Verify that the RotateKubeletServerCertificate argument is set to true (Manual)"
-        audit: "/bin/ps -fC $kubeletbin"
-        audit_config: "/bin/cat $kubeletconf"
-        tests:
-          bin_op: or
-          test_items:
-            - flag: RotateKubeletServerCertificate
-              path: '{.featureGates.RotateKubeletServerCertificate}'
-              compare:
-                op: nothave
-                value: false
-            - flag: RotateKubeletServerCertificate
-              path: '{.featureGates.RotateKubeletServerCertificate}'
-              set: false
-        remediation: |
-          Edit the kubelet service file $kubeletsvc
-          on each worker node and set the below parameter in KUBELET_CERTIFICATE_ARGS variable.
-          --feature-gates=RotateKubeletServerCertificate=true
-          Based on your system, restart the kubelet service. For example:
-          systemctl daemon-reload
-          systemctl restart kubelet.service
-        scored: false
-
-      - id: 4.2.13
-        text: "Ensure that the Kubelet only makes use of Strong Cryptographic Ciphers (Manual)"
-        audit: "/bin/ps -fC $kubeletbin"
-        audit_config: "/bin/cat $kubeletconf"
-        tests:
-          test_items:
-            - flag: --tls-cipher-suites
-              path: '{range .tlsCipherSuites[:]}{}{'',''}{end}'
-              compare:
-                op: valid_elements
-                value: TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256
-        remediation: |
-          If using a Kubelet config file, edit the file to set `tlsCipherSuites` to
-          TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256
-          or to a subset of these values.
-          If using executable arguments, edit the kubelet service file
-          $kubeletsvc on each worker node and
-          set the --tls-cipher-suites parameter as follows, or to a subset of these values.
-          --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256
-          Based on your system, restart the kubelet service. For example:
-          systemctl daemon-reload
-          systemctl restart kubelet.service
-        scored: false

cfg/cis-1.24/policies.yaml

@@ -1,269 +0,0 @@
----
-controls:
-version: "cis-1.24"
-id: 5
-text: "Kubernetes Policies"
-type: "policies"
-groups:
-  - id: 5.1
-    text: "RBAC and Service Accounts"
-    checks:
-      - id: 5.1.1
-        text: "Ensure that the cluster-admin role is only used where required (Manual)"
-        type: "manual"
-        remediation: |
-          Identify all clusterrolebindings to the cluster-admin role. Check if they are used and
-          if they need this role or if they could use a role with fewer privileges.
-          Where possible, first bind users to a lower privileged role and then remove the
-          clusterrolebinding to the cluster-admin role :
-          kubectl delete clusterrolebinding [name]
-        scored: false
-
-      - id: 5.1.2
-        text: "Minimize access to secrets (Manual)"
-        type: "manual"
-        remediation: |
-          Where possible, remove get, list and watch access to Secret objects in the cluster.
-        scored: false
-
-      - id: 5.1.3
-        text: "Minimize wildcard use in Roles and ClusterRoles (Manual)"
-        type: "manual"
-        remediation: |
-          Where possible replace any use of wildcards in clusterroles and roles with specific
-          objects or actions.
-        scored: false
-
-      - id: 5.1.4
-        text: "Minimize access to create pods (Manual)"
-        type: "manual"
-        remediation: |
-          Where possible, remove create access to pod objects in the cluster.
-        scored: false
-
-      - id: 5.1.5
-        text: "Ensure that default service accounts are not actively used. (Manual)"
-        type: "manual"
-        remediation: |
-          Create explicit service accounts wherever a Kubernetes workload requires specific access
-          to the Kubernetes API server.
-          Modify the configuration of each default service account to include this value
-          automountServiceAccountToken: false
-        scored: false
-
-      - id: 5.1.6
-        text: "Ensure that Service Account Tokens are only mounted where necessary (Manual)"
-        type: "manual"
-        remediation: |
-          Modify the definition of pods and service accounts which do not need to mount service
-          account tokens to disable it.
-        scored: false
-
-      - id: 5.1.7
-        text: "Avoid use of system:masters group (Manual)"
-        type: "manual"
-        remediation: |
-          Remove the system:masters group from all users in the cluster.
-        scored: false
-
-      - id: 5.1.8
-        text: "Limit use of the Bind, Impersonate and Escalate permissions in the Kubernetes cluster (Manual)"
-        type: "manual"
-        remediation: |
-          Where possible, remove the impersonate, bind and escalate rights from subjects.
-        scored: false
-
-  - id: 5.2
-    text: "Pod Security Standards"
-    checks:
-      - id: 5.2.1
-        text: "Ensure that the cluster has at least one active policy control mechanism in place (Manual)"
-        type: "manual"
-        remediation: |
-          Ensure that either Pod Security Admission or an external policy control system is in place
-          for every namespace which contains user workloads.
-        scored: false
-
-      - id: 5.2.2
-        text: "Minimize the admission of privileged containers (Manual)"
-        type: "manual"
-        remediation: |
-          Add policies to each namespace in the cluster which has user workloads to restrict the
-          admission of privileged containers.
-        scored: false
-
-      - id: 5.2.3
-        text: "Minimize the admission of containers wishing to share the host process ID namespace (Automated)"
-        type: "manual"
-        remediation: |
-          Add policies to each namespace in the cluster which has user workloads to restrict the
-          admission of `hostPID` containers.
-        scored: false
-
-      - id: 5.2.4
-        text: "Minimize the admission of containers wishing to share the host IPC namespace (Automated)"
-        type: "manual"
-        remediation: |
-          Add policies to each namespace in the cluster which has user workloads to restrict the
-          admission of `hostIPC` containers.
-        scored: false
-
-      - id: 5.2.5
-        text: "Minimize the admission of containers wishing to share the host network namespace (Automated)"
-        type: "manual"
-        remediation: |
-          Add policies to each namespace in the cluster which has user workloads to restrict the
-          admission of `hostNetwork` containers.
-        scored: false
-
-      - id: 5.2.6
-        text: "Minimize the admission of containers with allowPrivilegeEscalation (Automated)"
-        type: "manual"
-        remediation: |
-          Add policies to each namespace in the cluster which has user workloads to restrict the
-          admission of containers with `.spec.allowPrivilegeEscalation` set to `true`.
-        scored: false
-
-      - id: 5.2.7
-        text: "Minimize the admission of root containers (Automated)"
-        type: "manual"
-        remediation: |
-          Create a policy for each namespace in the cluster, ensuring that either `MustRunAsNonRoot`
-          or `MustRunAs` with the range of UIDs not including 0, is set.
-        scored: false
-
-      - id: 5.2.8
-        text: "Minimize the admission of containers with the NET_RAW capability (Automated)"
-        type: "manual"
-        remediation: |
-          Add policies to each namespace in the cluster which has user workloads to restrict the
-          admission of containers with the `NET_RAW` capability.
-        scored: false
-
-      - id: 5.2.9
-        text: "Minimize the admission of containers with added capabilities (Automated)"
-        type: "manual"
-        remediation: |
-          Ensure that `allowedCapabilities` is not present in policies for the cluster unless
-          it is set to an empty array.
-        scored: false
-
-      - id: 5.2.10
-        text: "Minimize the admission of containers with capabilities assigned (Manual)"
-        type: "manual"
-        remediation: |
-          Review the use of capabilites in applications running on your cluster. Where a namespace
-          contains applications which do not require any Linux capabities to operate consider adding
-          a PSP which forbids the admission of containers which do not drop all capabilities.
-        scored: false
-
-      - id: 5.2.11
-        text: "Minimize the admission of Windows HostProcess containers (Manual)"
-        type: "manual"
-        remediation: |
-          Add policies to each namespace in the cluster which has user workloads to restrict the
-          admission of containers that have `.securityContext.windowsOptions.hostProcess` set to `true`.
-        scored: false
-
-      - id: 5.2.12
-        text: "Minimize the admission of HostPath volumes (Manual)"
-        type: "manual"
-        remediation: |
-          Add policies to each namespace in the cluster which has user workloads to restrict the
-          admission of containers with `hostPath` volumes.
-        scored: false
-
-      - id: 5.2.13
-        text: "Minimize the admission of containers which use HostPorts (Manual)"
-        type: "manual"
-        remediation: |
-          Add policies to each namespace in the cluster which has user workloads to restrict the
-          admission of containers which use `hostPort` sections.
-        scored: false
-
-  - id: 5.3
-    text: "Network Policies and CNI"
-    checks:
-      - id: 5.3.1
-        text: "Ensure that the CNI in use supports NetworkPolicies (Manual)"
-        type: "manual"
-        remediation: |
-          If the CNI plugin in use does not support network policies, consideration should be given to
-          making use of a different plugin, or finding an alternate mechanism for restricting traffic
-          in the Kubernetes cluster.
-        scored: false
-
-      - id: 5.3.2
-        text: "Ensure that all Namespaces have NetworkPolicies defined (Manual)"
-        type: "manual"
-        remediation: |
-          Follow the documentation and create NetworkPolicy objects as you need them.
-        scored: false
-
-  - id: 5.4
-    text: "Secrets Management"
-    checks:
-      - id: 5.4.1
-        text: "Prefer using Secrets as files over Secrets as environment variables (Manual)"
-        type: "manual"
-        remediation: |
-          If possible, rewrite application code to read Secrets from mounted secret files, rather than
-          from environment variables.
-        scored: false
-
-      - id: 5.4.2
-        text: "Consider external secret storage (Manual)"
-        type: "manual"
-        remediation: |
-          Refer to the Secrets management options offered by your cloud provider or a third-party
-          secrets management solution.
-        scored: false
-
-  - id: 5.5
-    text: "Extensible Admission Control"
-    checks:
-      - id: 5.5.1
-        text: "Configure Image Provenance using ImagePolicyWebhook admission controller (Manual)"
-        type: "manual"
-        remediation: |
-          Follow the Kubernetes documentation and setup image provenance.
-        scored: false
-
-  - id: 5.7
-    text: "General Policies"
-    checks:
-      - id: 5.7.1
-        text: "Create administrative boundaries between resources using namespaces (Manual)"
-        type: "manual"
-        remediation: |
-          Follow the documentation and create namespaces for objects in your deployment as you need
-          them.
-        scored: false
-
-      - id: 5.7.2
-        text: "Ensure that the seccomp profile is set to docker/default in your Pod definitions (Manual)"
-        type: "manual"
-        remediation: |
-          Use `securityContext` to enable the docker/default seccomp profile in your pod definitions.
-          An example is as below:
-            securityContext:
-              seccompProfile:
-                type: RuntimeDefault
-        scored: false
-
-      - id: 5.7.3
-        text: "Apply SecurityContext to your Pods and Containers (Manual)"
-        type: "manual"
-        remediation: |
-          Follow the Kubernetes documentation and apply SecurityContexts to your Pods. For a
-          suggested list of SecurityContexts, you may refer to the CIS Security Benchmark for Docker
-          Containers.
-        scored: false
-
-      - id: 5.7.4
-        text: "The default namespace should not be used (Manual)"
-        type: "manual"
-        remediation: |
-          Ensure that namespaces are created to allow for appropriate segregation of Kubernetes
-          resources and that all new resources are created in a specific namespace.
-        scored: false

cfg/cis-1.5/master.yaml

@@ -158,13 +158,7 @@ groups:
 
       - id: 1.1.11
         text: "Ensure that the etcd data directory permissions are set to 700 or more restrictive (Scored)"
-        audit: |
-          DATA_DIR=''
-          for d in $(ps -ef | grep $etcdbin | grep -- --data-dir | sed 's%.*data-dir[= ]\([^ ]*\).*%\1%'); do
-            if test -d "$d"; then DATA_DIR="$d"; fi
-          done
-          if ! test -d "$DATA_DIR"; then DATA_DIR=$etcddatadir; fi
-          stat -c permissions=%a "$DATA_DIR"
+        audit: ps -ef | grep $etcdbin | grep -- --data-dir | sed 's%.*data-dir[= ]\([^ ]*\).*%\1%' | xargs stat -c permissions=%a
         tests:
           test_items:
             - flag: "permissions"
@@ -182,13 +176,7 @@ groups:
 
       - id: 1.1.12
         text: "Ensure that the etcd data directory ownership is set to etcd:etcd (Scored)"
-        audit: |
-          DATA_DIR=''
-          for d in $(ps -ef | grep $etcdbin | grep -- --data-dir | sed 's%.*data-dir[= ]\([^ ]*\).*%\1%'); do
-            if test -d "$d"; then DATA_DIR="$d"; fi
-          done
-          if ! test -d "$DATA_DIR"; then DATA_DIR=$etcddatadir; fi
-          stat -c %U:%G $DATA_DIR
+        audit: ps -ef | grep $etcdbin | grep -- --data-dir | sed 's%.*data-dir[= ]\([^ ]*\).*%\1%' | xargs stat -c %U:%G
         tests:
           test_items:
             - flag: "etcd:etcd"

cfg/cis-1.5/node.yaml

@@ -25,17 +25,16 @@ groups:
         scored: true
 
       - id: 4.1.2
-        text: "Ensure that the kubelet service file ownership is set to root:root (Automated)"
-        audit: '/bin/sh -c "if test -e $kubeletsvc; then stat -c %U:%G $kubeletsvc; else echo \"File not found\"; fi"'
+        text: "Ensure that the kubelet service file ownership is set to root:root (Scored)"
+        audit: '/bin/sh -c ''if test -e $kubeletsvc; then stat -c %U:%G $kubeletsvc; fi'' '
         tests:
-          bin_op: or
           test_items:
             - flag: root:root
-            - flag: "File not found"
+              set: true
         remediation: |
-            Run the below command (based on the file location on your system) on the each worker node.
-            For example,
-            chown root:root $kubeletsvc
+          Run the below command (based on the file location on your system) on the each worker node.
+          For example,
+          chown root:root $kubeletsvc
         scored: true
 
       - id: 4.1.3
@@ -49,6 +48,8 @@ groups:
               compare:
                 op: bitmask
                 value: "644"
+            - flag: "$proxykubeconfig"
+              set: false
         remediation: |
           Run the below command (based on the file location on your system) on the each worker node.
           For example,
@@ -63,6 +64,8 @@ groups:
           test_items:
             - flag: root:root
               set: true
+            - flag: "$proxykubeconfig"
+              set: false
         remediation: |
           Run the below command (based on the file location on your system) on the each worker node.
           For example, chown root:root $proxykubeconfig
@@ -103,7 +106,7 @@ groups:
       - id: 4.1.7
         text: "Ensure that the certificate authorities file permissions are set to 644 or more restrictive (Scored)"
         audit: |
-          CAFILE=$(ps -ef | grep kubelet | grep -v apiserver | grep -- --client-ca-file= | awk -F '--client-ca-file=' '{print $2}' | awk '{print $1}' | uniq)
+          CAFILE=$(ps -ef | grep kubelet | grep -v apiserver | grep -- --client-ca-file= | awk -F '--client-ca-file=' '{print $2}' | awk '{print $1}')
           if test -z $CAFILE; then CAFILE=$kubeletcafile; fi
           if test -e $CAFILE; then stat -c permissions=%a $CAFILE; fi
         tests:
@@ -121,7 +124,7 @@ groups:
       - id: 4.1.8
         text: "Ensure that the client certificate authorities file ownership is set to root:root (Scored)"
         audit: |
-          CAFILE=$(ps -ef | grep kubelet | grep -v apiserver | grep -- --client-ca-file= | awk -F '--client-ca-file=' '{print $2}' | awk '{print $1}' | uniq)
+          CAFILE=$(ps -ef | grep kubelet | grep -v apiserver | grep -- --client-ca-file= | awk -F '--client-ca-file=' '{print $2}' | awk '{print $1}')
           if test -z $CAFILE; then CAFILE=$kubeletcafile; fi
           if test -e $CAFILE; then stat -c %U:%G $CAFILE; fi
         tests:
@@ -472,7 +475,7 @@ groups:
                 op: valid_elements
                 value: TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256
         remediation: |
-          If using a Kubelet config file, edit the file to set tlsCipherSuites: to
+          If using a Kubelet config file, edit the file to set TLSCipherSuites: to
           TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256
           or to a subset of these values.
           If using executable arguments, edit the kubelet service file

cfg/cis-1.5/policies.yaml

@@ -132,7 +132,7 @@ groups:
         type: "manual"
         remediation: |
           Review the use of capabilites in applications running on your cluster. Where a namespace
-          contains applications which do not require any Linux capabities to operate consider adding
+          contains applicaions which do not require any Linux capabities to operate consider adding
           a PSP which forbids the admission of containers which do not drop all capabilities.
         scored: false
 

cfg/cis-1.6-k3s/config.yaml

@@ -1,42 +0,0 @@
----
-## Version-specific settings that override the values in cfg/config.yaml
-
-master:
-  components:
-    - scheduler
-    - controllermanager
-    - node
-
-  scheduler:
-    kubeconfig:
-      - /var/lib/rancher/k3s/server/cred/scheduler.kubeconfig
-    defaultkubeconfig: /var/lib/rancher/k3s/server/cred/scheduler.kubeconfig
-
-  controllermanager:
-    kubeconfig:
-      - /var/lib/rancher/k3s/server/cred/cloud-controller.kubeconfig
-    defaultkubeconfig: /var/lib/rancher/k3s/server/cred/cloud-controller.kubeconfig
-
-etcd:
-  components:
-    - etcd
-  etcd:
-    confs:
-      - /var/lib/rancher/k3s/server/db/etcd/config
-    defaultconf: /var/lib/rancher/k3s/server/db/etcd/config
-
-node:
-  components:
-    - proxy
-    - kubelet
-  proxy:
-    kubeconfig:
-      - "/var/lib/rancher/k3s/agent/kubeproxy.kubeconfig"
-    defaultkubeconfig: "/var/lib/rancher/k3s/agent/kubeproxy.kubeconfig"
-  kubelet:
-    kubeconfig:
-      - "/var/lib/rancher/k3s/agent/kubelet.kubeconfig"
-    defaultkubeconfig: "/var/lib/rancher/k3s/agent/kubelet.kubeconfig"
-    cafile:
-      - "/var/lib/rancher/k3s/server/tls/server-ca.crt"
-    defaultcafile: "/var/lib/rancher/k3s/server/tls/server-ca.crt"

cfg/cis-1.6-k3s/controlplane.yaml

@@ -1,40 +0,0 @@
----
-controls:
-version: "cis-1.6-k3s"
-id: 3
-text: "Control Plane Configuration"
-type: "controlplane"
-groups:
-  - id: 3.1
-    text: "Authentication and Authorization"
-    checks:
-      - id: 3.1.1
-        text: "Client certificate authentication should not be used for users (Manual)"
-        type: "manual"
-        remediation: |
-          Alternative mechanisms provided by Kubernetes such as the use of OIDC should be
-          implemented in place of client certificates.
-        scored: false
-
-  - id: 3.2
-    text: "Logging"
-    checks:
-      - id: 3.2.1
-        text: "Ensure that a minimal audit policy is created (Automated)"
-        audit: journalctl -u k3s | grep "Running kube-apiserver" | tail -n1 | grep "audit-policy-file"
-        tests:
-          test_items:
-            - flag: "--audit-policy-file"
-              set: true
-        remediation: |
-          Create an audit policy file for your cluster and pass it to k3s.
-          e.g. --kube-apiserver-arg='audit-log-path=/var/lib/rancher/k3s/server/logs/audit-log'
-        scored: true
-
-      - id: 3.2.2
-        text: "Ensure that the audit policy covers key security concerns (Manual)"
-        type: "manual"
-        remediation: |
-          Consider modification of the audit policy in use on the cluster to include these items, at a
-          minimum.
-        scored: false

cfg/cis-1.6-k3s/etcd.yaml

@@ -1,119 +0,0 @@
----
-controls:
-version: "cis-1.6-k3s"
-id: 2
-text: "Etcd Node Configuration"
-type: "etcd"
-groups:
-  - id: 2
-    text: "Etcd Node Configuration Files"
-    checks:
-      - id: 2.1
-        text: "Ensure that the --cert-file and --key-file arguments are set as appropriate if use etcd as database (Automated)"
-        audit: grep -A 4 'client-transport-security' $etcdconf | grep -E 'cert-file|key-file'
-        tests:
-          bin_op: and
-          test_items:
-            - flag: "cert-file"
-            - flag: "key-file"
-        remediation: |
-          By default, K3s uses a config file for etcd that can be found at $etcdconf.
-          The config file contains client-transport-security: which has fields that have the peer cert and peer key files. No manual remediation needed.
-        scored: true
-
-      - id: 2.2
-        text: "Ensure that the --client-cert-auth argument is set to true (Automated)"
-        audit: grep 'client-cert-auth' $etcdconf
-        tests:
-          test_items:
-            - flag: "client-cert-auth"
-              compare:
-                op: eq
-                value: true
-        remediation: |
-          By default, K3s uses a config file for etcd that can be found at $etcdconf.
-          client-cert-auth is set to true. No manual remediation needed.
-        scored: true
-
-      - id: 2.3
-        text: "Ensure that the --auto-tls argument is not set to true (Automated)"
-        audit: grep 'auto-tls' $etcdconf | cat
-        tests:
-          bin_op: or
-          test_items:
-            - flag: "auto-tls"
-              set: false
-            - flag: "auto-tls"
-              compare:
-                op: eq
-                value: false
-        remediation: |
-          By default, K3s starts Etcd without this flag. It is set to false by default.
-        scored: true
-
-      - id: 2.4
-        text: "Ensure that the --peer-cert-file and --peer-key-file arguments are
-        set as appropriate (Automated)"
-        audit: grep -A 4 'peer-transport-security' $etcdconf | grep -E 'cert-file|key-file'
-        tests:
-          bin_op: and
-          test_items:
-            - flag: "cert-file"
-            - flag: "key-file"
-        remediation: |
-          By default, K3s starts Etcd with a config file found here, $etcdconf.
-          The config file contains peer-transport-security: which has fields that have the peer cert and peer key files.
-        scored: true
-
-      - id: 2.5
-        text: "Ensure that the --peer-client-cert-auth argument is set to true (Automated)"
-        audit: grep -A 4 'peer-transport-security' $etcdconf | grep 'client-cert-auth'
-        tests:
-          test_items:
-            - flag: "client-cert-auth"
-              compare:
-                op: eq
-                value: true
-        remediation: |
-          By default, K3s uses a config file for etcd that can be found at $etcdconf.
-          The config file contains peer-transport-security: which has client-cert-auth set to true. No manual remediation needed.
-        scored: true
-
-      - id: 2.6
-        text: "Ensure that the --peer-auto-tls argument is not set to true (Automated)"
-        audit: grep 'peer-auto-tls' $etcdconf | cat
-        tests:
-          bin_op: or
-          test_items:
-            - flag: "peer-auto-tls"
-              set: false
-            - flag: "peer-auto-tls"
-              compare:
-                op: eq
-                value: false
-        remediation: |
-          By default, K3s uses a config file for etcd that can be found at $etcdconf.
-          Within the file, it does not contain the peer-auto-tls field. No manual remediation needed.
-        scored: true
-
-      - id: 2.7
-        text: "Ensure that a unique Certificate Authority is used for etcd (Manual)"
-        audit: |
-          if [ -f "$etcdconf" ];then
-            etcd_ca=$(grep 'trusted-ca-file' $etcdconf | awk -F ":|: *" '{print $NF}');
-            apiserver_ca=$(journalctl -u k3s | grep "Running kube-apiserver" | tail -n1 | grep "trusted-ca-file" | awk -F "=" '{print $NF}')
-            if [ "$etcd_ca" == "$apiserver_ca" ]; then
-              echo 'etcd_and_apiserver_have_same_ca';
-            else
-              echo 'etcd_and_apiserver_ca_not_same1' ;
-            fi
-          else
-            echo 'etcd_and_apiserver_ca_not_same'; return ;
-          fi
-        tests:
-          test_items:
-            - flag: "etcd_and_apiserver_ca_not_same"
-        remediation: |
-          By default, K3s uses a config file for etcd that can be found at $etcdconf
-          and the trusted-ca-file parameters in it are set to unique values specific to etcd. No manual remediation needed.
-        scored: false

cfg/cis-1.6-k3s/master.yaml

@@ -1,786 +0,0 @@
----
-controls:
-version: "cis-1.6-k3s"
-id: 1
-text: "Master Node Security Configuration"
-type: "master"
-groups:
-  - id: 1.1
-    text: "Master Node Configuration Files"
-    checks:
-      - id: 1.1.1
-        text: "Ensure that the API server pod specification file permissions are set to 644 or more restrictive (Not Applicable)"
-        scored: false
-
-      - id: 1.1.2
-        text: "Ensure that the API server pod specification file ownership is set to root:root (Not Applicable)"
-        scored: false
-
-      - id: 1.1.3
-        text: "Ensure that the controller manager pod specification file permissions are set to 644 or more restrictive (Not Applicable)"
-        scored: false
-
-      - id: 1.1.4
-        text: "Ensure that the controller manager pod specification file ownership is set to root:root (Not Applicable)"
-        scored: false
-
-      - id: 1.1.5
-        text: "Ensure that the scheduler pod specification file permissions are set to 644 or more restrictive (Not Applicable)"
-        scored: false
-
-      - id: 1.1.6
-        text: "Ensure that the scheduler pod specification file ownership is set to root:root (Not Applicable)"
-        scored: false
-
-      - id: 1.1.7
-        text: "Ensure that the etcd pod specification file permissions are set to 644 or more restrictive (Not Applicable)"
-        scored: false
-
-      - id: 1.1.8
-        text: "Ensure that the etcd pod specification file ownership is set to root:root (Not Applicable)"
-        scored: false
-
-      - id: 1.1.9
-        text: "Ensure that the Container Network Interface file permissions are set to 644 or more restrictive (Not Applicable)"
-        scored: false
-
-      - id: 1.1.10
-        text: "Ensure that the Container Network Interface file ownership is set to root:root (Not Applicable)"
-        scored: false
-
-      - id: 1.1.11
-        text: "Ensure that the etcd data directory permissions are set to 700 or more restrictive if etcd is used (Automated)"
-        audit: stat -c permissions=%a /var/lib/rancher/k3s/server/db/etcd
-        tests:
-          test_items:
-            - flag: "permissions"
-              compare:
-                op: bitmask
-                value: "700"
-        remediation: |
-          On the etcd server node, get the etcd data directory, passed as an argument --data-dir,
-          from the below command:
-          journalctl -u k3s | grep 'Managed etcd' | grep -v grep
-          Run the below command (based on the etcd data directory found above). For example,
-          chmod 700 /var/lib/rancher/k3s/server/db/etcd
-        scored: true
-
-      - id: 1.1.12
-        text: "Ensure that the etcd data directory ownership is set to etcd:etcd if etcd is used (Not Applicable)"
-        scored: false
-
-      - id: 1.1.13
-        text: "Ensure that the admin.kubeconfig file permissions are set to 644 or more restrictive (Automated)"
-        audit: "/bin/sh -c 'if test -e /var/lib/rancher/k3s/server/cred/admin.kubeconfig; then stat -c permissions=%a /var/lib/rancher/k3s/server/cred/admin.kubeconfig; fi'"
-        tests:
-          test_items:
-            - flag: "permissions"
-              compare:
-                op: bitmask
-                value: "644"
-        remediation: |
-          Run the below command (based on the file location on your system) on the k3s node.
-          For example,
-          chmod 644 /var/lib/rancher/k3s/server/cred/admin.kubeconfig
-        scored: true
-
-      - id: 1.1.14
-        text: "Ensure that the admin.kubeconfig file ownership is set to root:root (Automated)"
-        audit: "/bin/sh -c 'if test -e /var/lib/rancher/k3s/server/cred/admin.kubeconfig; then stat -c %U:%G /var/lib/rancher/k3s/server/cred/admin.kubeconfig; fi'"
-        tests:
-          test_items:
-            - flag: "root:root"
-        remediation: |
-          Run the below command (based on the file location on your system) on the k3s node.
-          For example,
-          chown root:root /var/lib/rancher/k3s/server/cred/admin.kubeconfig
-        scored: true
-
-      - id: 1.1.15
-        text: "Ensure that the scheduler.kubeconfig file permissions are set to 644 or more restrictive (Automated)"
-        audit: "/bin/sh -c 'if test -e $schedulerkubeconfig; then stat -c permissions=%a $schedulerkubeconfig; fi'"
-        tests:
-          test_items:
-            - flag: "permissions"
-              compare:
-                op: bitmask
-                value: "644"
-        remediation: |
-          Run the below command (based on the file location on your system) on the k3s node.
-          For example,
-          chmod 644 $schedulerkubeconfig
-        scored: true
-
-      - id: 1.1.16
-        text: "Ensure that the scheduler.kubeconfig file ownership is set to root:root (Automated)"
-        audit: "/bin/sh -c 'if test -e $schedulerkubeconfig; then stat -c %U:%G $schedulerkubeconfig; fi'"
-        tests:
-          test_items:
-            - flag: "root:root"
-        remediation: |
-          Run the below command (based on the file location on your system) on the k3s node.
-          For example,
-          chown root:root $schedulerkubeconfig
-        scored: true
-
-      - id: 1.1.17
-        text: "Ensure that the cloud-controller.kubeconfig file permissions are set to 644 or more restrictive (Automated)"
-        audit: "/bin/sh -c 'if test -e $controllermanagerkubeconfig; then stat -c permissions=%a $controllermanagerkubeconfig; fi'"
-        tests:
-          test_items:
-            - flag: "permissions"
-              compare:
-                op: bitmask
-                value: "644"
-        remediation: |
-          Run the below command (based on the file location on your system) on the master node.
-          For example,
-          chmod 644 $controllermanagerkubeconfig
-        scored: true
-
-      - id: 1.1.18
-        text: "Ensure that the $controllermanagerkubeconfig file ownership is set to root:root (Automated)"
-        audit: "/bin/sh -c 'if test -e $controllermanagerkubeconfig; then stat -c %U:%G $controllermanagerkubeconfig; fi'"
-        tests:
-          test_items:
-            - flag: "root:root"
-        remediation: |
-          Run the below command (based on the file location on your system) on the master node.
-          For example,
-          chown root:root $controllermanagerkubeconfig
-        scored: true
-
-      - id: 1.1.19
-        text: "Ensure that the Kubernetes PKI directory and file ownership is set to root:root (Automated)"
-        audit: "stat -c %U:%G /var/lib/rancher/k3s/server/tls"
-        use_multiple_values: true
-        tests:
-          test_items:
-            - flag: "root:root"
-        remediation: |
-          Run the below command (based on the file location on your system) on the k3s node.
-          For example,
-          chown -R root:root /var/lib/rancher/k3s/server/tls
-        scored: true
-
-      - id: 1.1.20
-        text: "Ensure that the Kubernetes PKI certificate file permissions are set to 644 or more restrictive (Automated)"
-        audit: "find /var/lib/rancher/k3s/server/tls/ -name '*.crt' | xargs stat -c permissions=%a"
-        use_multiple_values: true
-        tests:
-          test_items:
-            - flag: "permissions"
-              compare:
-                op: bitmask
-                value: "644"
-        remediation: |
-          Run the below command (based on the file location on your system) on the master node.
-          For example,
-          chmod -R 644 /var/lib/rancher/k3s/server/tls/*.crt
-        scored: true
-
-      - id: 1.1.21
-        text: "Ensure that the Kubernetes PKI key file permissions are set to 600 (Automated)"
-        audit: "find /var/lib/rancher/k3s/server/tls/ -name '*.key' | xargs stat -c permissions=%a"
-        use_multiple_values: true
-        tests:
-          test_items:
-            - flag: "permissions"
-              compare:
-                op: bitmask
-                value: "600"
-        remediation: |
-          Run the below command (based on the file location on your system) on the master node.
-          For example,
-          chmod -R 600 /etc/kubernetes/pki/*.key
-        scored: true
-
-  - id: 1.2
-    text: "API Server"
-    checks:
-      - id: 1.2.1
-        text: "Ensure that the --anonymous-auth argument is set to false (Automated)"
-        audit: journalctl -u k3s | grep "Running kube-apiserver" | tail -n1 | grep "anonymous-auth"
-        tests:
-          test_items:
-            - flag: "--anonymous-auth"
-              compare:
-                op: eq
-                value: false
-        remediation: |
-          By default, K3s kube-apiserver is configured to run with --anonymous-auth=false flag and value.
-        scored: false
-
-      - id: 1.2.2
-        text: "Ensure that the --basic-auth-file argument is not set (Automated)"
-        audit: journalctl -u k3s | grep "Running kube-apiserver" | tail -n1 | grep "basic-auth-file" | cat
-        tests:
-          test_items:
-            - flag: "--basic-auth-file"
-              set: false
-        remediation: |
-          By default, K3s does not run with basic authentication enabled. No manual remediation is needed.
-        scored: true
-
-      - id: 1.2.3
-        text: "Ensure that the --token-auth-file parameter is not set (Automated)"
-        audit: journalctl -u k3s | grep "Running kube-apiserver" | tail -n1 | grep "token-auth-file" | cat
-        tests:
-          test_items:
-            - flag: "--token-auth-file"
-              set: false
-        remediation: |
-          By default, K3s does not run with basic authentication enabled. No manual remediation is needed.
-        scored: true
-
-      - id: 1.2.4
-        text: "Ensure that the --kubelet-https argument is set to true (Automated)"
-        audit: journalctl -u k3s | grep "Running kube-apiserver" | tail -n1 | grep "kubelet-https" | cat
-        tests:
-          bin_op: or
-          test_items:
-            - flag: "--kubelet-https"
-              compare:
-                op: eq
-                value: true
-            - flag: "--kubelet-https"
-              set: false
-        remediation: |
-          By default, K3s kube-apiserver doesn't run with the --kubelet-https parameter as it runs with TLS. No manual remediation is needed.
-        scored: true
-
-      - id: 1.2.5
-        text: "Ensure that the --kubelet-client-certificate and --kubelet-client-key arguments are set as appropriate (Automated)"
-        audit: journalctl -u k3s | grep "Running kube-apiserver" | tail -n1 | grep -E 'kubelet-client-certificate|kubelet-client-key'
-        tests:
-          bin_op: and
-          test_items:
-            - flag: "--kubelet-client-certificate"
-            - flag: "--kubelet-client-key"
-        remediation: |
-          By default, K3s kube-apiserver is ran with these arguments for secure communication with kubelet. No manual remediation is needed.
-        scored: true
-
-      - id: 1.2.6
-        text: "Ensure that the --kubelet-certificate-authority argument is set as appropriate (Automated)"
-        audit: journalctl -u k3s | grep "Running kube-apiserver" | tail -n1 | grep "kubelet-certificate-authority"
-        tests:
-          test_items:
-            - flag: "--kubelet-certificate-authority"
-        remediation: |
-          By default, K3s kube-apiserver is ran with this argument for secure communication with kubelet. No manual remediation is needed.
-        scored: true
-
-      - id: 1.2.7
-        text: "Ensure that the --authorization-mode argument is not set to AlwaysAllow (Automated)"
-        audit: journalctl -u k3s | grep "Running kube-apiserver" | tail -n1 | grep "authorization-mode"
-        tests:
-          test_items:
-            - flag: "--authorization-mode"
-              compare:
-                op: nothave
-                value: "AlwaysAllow"
-        remediation: |
-          By default, K3s sets Node,RBAC as the parameter to the --authorization-mode argument. No manual remediation is needed.
-        scored: true
-
-      - id: 1.2.8
-        text: "Ensure that the --authorization-mode argument includes Node (Automated)"
-        audit: journalctl -u k3s | grep "Running kube-apiserver" | tail -n1 | grep "authorization-mode"
-        tests:
-          test_items:
-            - flag: "--authorization-mode"
-              compare:
-                op: has
-                value: "Node"
-        remediation: |
-          By default, K3s sets Node,RBAC as the parameter to the --authorization-mode argument. No manual remediation is needed.
-        scored: true
-
-      - id: 1.2.9
-        text: "Ensure that the --authorization-mode argument includes RBAC (Automated)"
-        audit: journalctl -u k3s | grep "Running kube-apiserver" | tail -n1 | grep "authorization-mode"
-        tests:
-          test_items:
-            - flag: "--authorization-mode"
-              compare:
-                op: has
-                value: "RBAC"
-        remediation: |
-          By default, K3s sets Node,RBAC as the parameter to the --authorization-mode argument. No manual remediation is needed.
-        scored: true
-
-      - id: 1.2.10
-        text: "Ensure that the admission control plugin EventRateLimit is set (Manual)"
-        audit: journalctl -u k3s | grep "Running kube-apiserver" | tail -n1 | grep "enable-admission-plugins"
-        tests:
-          test_items:
-            - flag: "--enable-admission-plugins"
-              compare:
-                op: has
-                value: "EventRateLimit"
-        remediation: |
-          By default, K3s only sets NodeRestriction,PodSecurityPolicy as the parameter to the --enable-admission-plugins argument.
-          To configure this, follow the Kubernetes documentation and set the desired limits in a configuration file.
-          Then refer to K3s's documentation to see how to supply additional api server configuration via the kube-apiserver-arg parameter.
-        scored: false
-
-      - id: 1.2.11
-        text: "Ensure that the admission control plugin AlwaysAdmit is not set (Automated)"
-        audit: journalctl -u k3s | grep "Running kube-apiserver" | tail -n1 | grep "enable-admission-plugins"
-        tests:
-          bin_op: or
-          test_items:
-            - flag: "--enable-admission-plugins"
-              compare:
-                op: nothave
-                value: AlwaysAdmit
-            - flag: "--enable-admission-plugins"
-              set: false
-        remediation: |
-          By default, K3s only sets NodeRestriction,PodSecurityPolicy as the parameter to the --enable-admission-plugins argument.
-          No manual remediation needed.
-        scored: true
-
-      - id: 1.2.12
-        text: "Ensure that the admission control plugin AlwaysPullImages is set (Manual)"
-        audit: journalctl -u k3s | grep "Running kube-apiserver" | tail -n1 | grep "enable-admission-plugins"
-        tests:
-          test_items:
-            - flag: "--enable-admission-plugins"
-              compare:
-                op: has
-                value: "AlwaysPullImages"
-        remediation: |
-          By default, K3s only sets NodeRestriction,PodSecurityPolicy as the parameter to the --enable-admission-plugins argument.
-          To configure this, follow the Kubernetes documentation and set the desired limits in a configuration file.
-          Then refer to K3s's documentation to see how to supply additional api server configuration via the kube-apiserver-arg parameter.
-        scored: false
-
-      - id: 1.2.13
-        text: "Ensure that the admission control plugin SecurityContextDeny is set if PodSecurityPolicy is not used (Manual)"
-        audit: journalctl -u k3s | grep "Running kube-apiserver" | tail -n1 | grep "enable-admission-plugins"
-        tests:
-          bin_op: or
-          test_items:
-            - flag: "--enable-admission-plugins"
-              compare:
-                op: has
-                value: "SecurityContextDeny"
-            - flag: "--enable-admission-plugins"
-              compare:
-                op: has
-                value: "PodSecurityPolicy"
-        remediation: |
-          K3s would need to have the SecurityContextDeny admission plugin enabled by passing it as an argument to K3s.
-          --kube-apiserver-arg='enable-admission-plugins=SecurityContextDeny
-        scored: false
-
-      - id: 1.2.14
-        text: "Ensure that the admission control plugin ServiceAccount is set (Automated)"
-        audit: journalctl -u k3s | grep "Running kube-apiserver" | tail -n1 | grep "ServiceAccount"
-        tests:
-          bin_op: or
-          test_items:
-            - flag: "--disable-admission-plugins"
-              compare:
-                op: nothave
-                value: "ServiceAccount"
-            - flag: "--disable-admission-plugins"
-              set: false
-        remediation: |
-          By default, K3s does not use this argument.
-          If there's a desire to use this argument, follow the documentation and create ServiceAccount objects as per your environment.
-          Then refer to K3s's documentation to see how to supply additional api server configuration via the kube-apiserver-arg parameter.
-        scored: true
-
-      - id: 1.2.15
-        text: "Ensure that the admission control plugin NamespaceLifecycle is set (Automated)"
-        audit: journalctl -u k3s | grep "Running kube-apiserver" | tail -n1 | grep "disable-admission-plugins" | cat
-        tests:
-          bin_op: or
-          test_items:
-            - flag: "--disable-admission-plugins"
-              compare:
-                op: nothave
-                value: "NamespaceLifecycle"
-            - flag: "--disable-admission-plugins"
-              set: false
-        remediation: |
-          By default, K3s does not use this argument. No manual remediation needed.
-        scored: true
-
-      - id: 1.2.16
-        text: "Ensure that the admission control plugin PodSecurityPolicy is set (Automated)"
-        audit: journalctl -u k3s | grep "Running kube-apiserver" | tail -n1 | grep "enable-admission-plugins"
-        tests:
-          test_items:
-            - flag: "--enable-admission-plugins"
-              compare:
-                op: has
-                value: "PodSecurityPolicy"
-        remediation: |
-          K3s would need to have the PodSecurityPolicy admission plugin enabled by passing it as an argument to K3s.
-          --kube-apiserver-arg='enable-admission-plugins=PodSecurityPolicy.
-        scored: true
-
-      - id: 1.2.17
-        text: "Ensure that the admission control plugin NodeRestriction is set (Automated)"
-        audit: journalctl -u k3s | grep "Running kube-apiserver" | tail -n1 | grep "enable-admission-plugins"
-        tests:
-          test_items:
-            - flag: "--enable-admission-plugins"
-              compare:
-                op: has
-                value: "NodeRestriction"
-        remediation: |
-          K3s would need to have the NodeRestriction admission plugin enabled by passing it as an argument to K3s.
-          --kube-apiserver-arg='enable-admission-plugins=NodeRestriction.
-        scored: true
-
-      - id: 1.2.18
-        text: "Ensure that the --insecure-bind-address argument is not set (Automated)"
-        audit: journalctl -u k3s | grep "Running kube-apiserver" | tail -n1 | grep "enable-admission-plugins"
-        tests:
-          test_items:
-            - flag: "--insecure-bind-address"
-              set: false
-        remediation: |
-          By default, K3s explicitly excludes the use of the --insecure-bind-address parameter. No manual remediation is needed.
-        scored: true
-
-      - id: 1.2.19
-        text: "Ensure that the --insecure-port argument is set to 0 (Automated)"
-        audit: journalctl -u k3s | grep "Running kube-apiserver" | tail -n1 | grep "insecure-port"
-        tests:
-          test_items:
-            - flag: "--insecure-port"
-              compare:
-                op: eq
-                value: 0
-        remediation: |
-          By default, K3s starts the kube-apiserver process with this argument's parameter set to 0. No manual remediation is needed.
-        scored: true
-
-      - id: 1.2.20
-        text: "Ensure that the --secure-port argument is not set to 0 (Automated)"
-        audit: journalctl -u k3s | grep "Running kube-apiserver" | tail -n1 | grep "secure-port"
-        tests:
-          bin_op: or
-          test_items:
-            - flag: "--secure-port"
-              compare:
-                op: gt
-                value: 0
-            - flag: "--secure-port"
-              set: false
-        remediation: |
-          By default, K3s sets the parameter of 6444 for the --secure-port argument. No manual remediation is needed.
-        scored: true
-
-      - id: 1.2.21
-        text: "Ensure that the --profiling argument is set to false (Automated)"
-        audit: journalctl -u k3s | grep "Running kube-apiserver" | tail -n1 | grep "profiling"
-        tests:
-          test_items:
-            - flag: "--profiling"
-              compare:
-                op: eq
-                value: false
-        remediation: |
-          By default, K3s sets the --profiling flag parameter to false. No manual remediation needed.
-        scored: true
-
-      - id: 1.2.22
-        text: "Ensure that the --audit-log-path argument is set (Automated)"
-        audit: journalctl -u k3s | grep "Running kube-apiserver" | tail -n1 | grep "audit-log-path"
-        tests:
-          test_items:
-            - flag: "--audit-log-path"
-        remediation: |
-          K3s server needs to be run with the following argument, --kube-apiserver-arg='audit-log-path=/path/to/log/file'
-        scored: true
-
-      - id: 1.2.23
-        text: "Ensure that the --audit-log-maxage argument is set to 30 or as appropriate (Automated)"
-        audit: journalctl -u k3s | grep "Running kube-apiserver" | tail -n1 | grep "audit-log-maxage"
-        tests:
-          test_items:
-            - flag: "--audit-log-maxage"
-              compare:
-                op: gte
-                value: 30
-        remediation: |
-          K3s server needs to be run with the following argument, --kube-apiserver-arg='audit-log-maxage=30'
-        scored: true
-
-      - id: 1.2.24
-        text: "Ensure that the --audit-log-maxbackup argument is set to 10 or as appropriate (Automated)"
-        audit: journalctl -u k3s | grep "Running kube-apiserver" | tail -n1 | grep "audit-log-maxbackup"
-        tests:
-          test_items:
-            - flag: "--audit-log-maxbackup"
-              compare:
-                op: gte
-                value: 10
-        remediation: |
-          K3s server needs to be run with the following argument, --kube-apiserver-arg='audit-log-maxbackup=10'
-        scored: true
-
-      - id: 1.2.25
-        text: "Ensure that the --audit-log-maxsize argument is set to 100 or as appropriate (Automated)"
-        audit: journalctl -u k3s | grep "Running kube-apiserver" | tail -n1 | grep "audit-log-maxsize"
-        tests:
-          test_items:
-            - flag: "--audit-log-maxsize"
-              compare:
-                op: gte
-                value: 100
-        remediation: |
-          K3s server needs to be run with the following argument, --kube-apiserver-arg='audit-log-maxsize=100'
-        scored: true
-
-      - id: 1.2.26
-        text: "Ensure that the --request-timeout argument is set as appropriate (Automated)"
-        audit: journalctl -u k3s | grep "Running kube-apiserver" | tail -n1 | grep "request-timeout" | cat
-        tests:
-          bin_op: or
-          test_items:
-            - flag: "--request-timeout"
-              set: false
-            - flag: "--request-timeout"
-              compare:
-                op: lte
-                value: 60
-        remediation: |
-          By default, K3s does not set the --request-timeout argument. No manual remediation needed.
-        scored: true
-
-      - id: 1.2.27
-        text: "Ensure that the --service-account-lookup argument is set to true (Automated)"
-        audit: journalctl -u k3s | grep "Running kube-apiserver" | tail -n1 | grep "service-account-lookup"
-        tests:
-          bin_op: or
-          test_items:
-            - flag: "--service-account-lookup"
-              set: false
-            - flag: "--service-account-lookup"
-              compare:
-                op: eq
-                value: true
-        remediation: |
-          K3s server needs to be run with the following argument, --kube-apiserver-arg='service-account-lookup=true'
-        scored: true
-
-      - id: 1.2.28
-        text: "Ensure that the --service-account-key-file argument is set as appropriate (Automated)"
-        audit: journalctl -u k3s | grep "Running kube-apiserver" | tail -n1 | grep "service-account-key-file"
-        tests:
-          test_items:
-            - flag: "--service-account-key-file"
-        remediation: |
-          By default, K3s sets the --service-account-key-file explicitly. No manual remediation needed.
-        scored: true
-
-      - id: 1.2.29
-        text: "Ensure that the --etcd-certfile and --etcd-keyfile arguments are set as appropriate (Automated)"
-        audit: journalctl -u k3s | grep "Running kube-apiserver" | tail -n1 | grep -E 'etcd-certfile|etcd-keyfile'
-        tests:
-          bin_op: and
-          test_items:
-            - flag: "--etcd-certfile"
-            - flag: "--etcd-keyfile"
-        remediation: |
-          By default, K3s sets the --etcd-certfile and --etcd-keyfile arguments explicitly. No manual remediation needed.
-        scored: true
-
-      - id: 1.2.30
-        text: "Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate (Automated)"
-        audit: journalctl -u k3s | grep "Running kube-apiserver" | tail -n1 | grep -E 'tls-cert-file|tls-private-key-file'
-        tests:
-          bin_op: and
-          test_items:
-            - flag: "--tls-cert-file"
-            - flag: "--tls-private-key-file"
-        remediation: |
-          By default, K3s sets the --tls-cert-file and --tls-private-key-file arguments explicitly. No manual remediation needed.
-        scored: true
-
-      - id: 1.2.31
-        text: "Ensure that the --client-ca-file argument is set as appropriate (Automated)"
-        audit: journalctl -u k3s | grep "Running kube-apiserver" | tail -n1 | grep "client-ca-file"
-        tests:
-          test_items:
-            - flag: "--client-ca-file"
-        remediation: |
-          By default, K3s sets the --client-ca-file argument explicitly. No manual remediation needed.
-        scored: true
-
-      - id: 1.2.32
-        text: "Ensure that the --etcd-cafile argument is set as appropriate (Automated)"
-        audit: journalctl -u k3s | grep "Running kube-apiserver" | tail -n1 | grep -E 'etcd-cafile'
-        tests:
-          test_items:
-            - flag: "--etcd-cafile"
-        remediation: |
-          By default, K3s sets the --etcd-cafile argument explicitly. No manual remediation needed.
-        scored: true
-
-      - id: 1.2.33
-        text: "Ensure that the --encryption-provider-config argument is set as appropriate (Manual)"
-        audit: journalctl -u k3s | grep "Running kube-apiserver" | tail -n1 | grep -E "encryption-provider-config"
-        tests:
-          test_items:
-            - flag: "--encryption-provider-config"
-        remediation: |
-          K3s server needs to be ran with the follow, --kube-apiserver-arg='encryption-provider-config=/path/to/encryption_config'.
-          This can be done by running k3s with the --secrets-encryptiuon argument which will configure the encryption provider.
-        scored: false
-
-      - id: 1.2.34
-        text: "Ensure that encryption providers are appropriately configured (Manual)"
-        type: manual
-        remediation: |
-          K3s server needs to be run with the following, --secrets-encryption=true, and verify that one of the allowed encryption providers is present.
-          Run the below command on the master node.
-          grep aescbc /path/to/encryption-config.json
-          Verify that aescbc/kms/secretbox is set as the encryption provider for all the desired resources.
-        scored: true
-
-      - id: 1.2.35
-        text: "Ensure that the API Server only makes use of Strong Cryptographic Ciphers (Manual)"
-        audit: journalctl -u k3s | grep "Running kube-apiserver" | tail -n1 | grep "tls-cipher-suites"
-        tests:
-          test_items:
-            - flag: "--tls-cipher-suites"
-              compare:
-                op: valid_elements
-                value: "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256"
-        remediation: |
-          By default, K3s explicitly doesn't set this flag. No manual remediation needed.
-        scored: false
-
-  - id: 1.3
-    text: "Controller Manager"
-    checks:
-      - id: 1.3.1
-        text: "Ensure that the --terminated-pod-gc-threshold argument is set as appropriate (Manual)"
-        audit: |
-          journalctl -u k3s | grep "Running kube-controller-manager" | tail -n1 | grep "terminated-pod-gc-threshold"
-        tests:
-          test_items:
-            - flag: "--terminated-pod-gc-threshold"
-        remediation: |
-          K3s server needs to be run with the following, --kube-controller-manager-arg='terminated-pod-gc-threshold=10.
-        scored: false
-
-      - id: 1.3.2
-        text: "Ensure that the --profiling argument is set to false (Automated)"
-        audit: journalctl -u k3s | grep "Running kube-controller-manager" | tail -n1 | grep "profiling"
-        tests:
-          test_items:
-            - flag: "--profiling"
-              compare:
-                op: eq
-                value: false
-        remediation: |
-          By default, K3s sets the --profiling flag parameter to false. No manual remediation needed.
-        scored: true
-
-      - id: 1.3.3
-        text: "Ensure that the --use-service-account-credentials argument is set to true (Automated)"
-        audit: journalctl -u k3s | grep "Running kube-controller-manager" | tail -n1 | grep "use-service-account-credentials"
-        tests:
-          test_items:
-            - flag: "--use-service-account-credentials"
-              compare:
-                op: noteq
-                value: false
-        remediation: |
-          K3s server needs to be run with the following, --kube-controller-manager-arg='use-service-account-credentials=true'
-        scored: true
-
-      - id: 1.3.4
-        text: "Ensure that the --service-account-private-key-file argument is set as appropriate (Automated)"
-        audit: journalctl -u k3s | grep "Running kube-controller-manager" | tail -n1 | grep "service-account-private-key-file"
-        tests:
-          test_items:
-            - flag: "--service-account-private-key-file"
-        remediation: |
-          By default, K3s sets the --service-account-private-key-file argument with the service account key file. No manual remediation needed.
-        scored: true
-
-      - id: 1.3.5
-        text: "Ensure that the --root-ca-file argument is set as appropriate (Automated)"
-        audit: journalctl -u k3s | grep "Running kube-controller-manager" | tail -n1 | grep "root-ca-file"
-        tests:
-          test_items:
-            - flag: "--root-ca-file"
-        remediation: |
-          By default, K3s sets the --root-ca-file argument with the root ca file. No manual remediation needed.
-        scored: true
-
-      - id: 1.3.6
-        text: "Ensure that the RotateKubeletServerCertificate argument is set to true (Automated)"
-        audit: journalctl -u k3s | grep "Running kube-controller-manager" | tail -n1 | grep "RotateKubeletServerCertificate" | cat
-        tests:
-          bin_op: or
-          test_items:
-            - flag: "--feature-gates"
-              compare:
-                op: nothave
-                value: "RotateKubeletServerCertificate=false"
-              set: true
-            - flag: "--feature-gates"
-              set: false
-        remediation: |
-          By default, K3s implements its own logic for certificate generation and rotation.
-        scored: true
-
-      - id: 1.3.7
-        text: "Ensure that the --bind-address argument is set to 127.0.0.1 (Automated)"
-        audit: journalctl -u k3s | grep "Running kube-controller-manager" | tail -n1 | grep "bind-address"
-        tests:
-          bin_op: or
-          test_items:
-            - flag: "--bind-address"
-              compare:
-                op: eq
-                value: "127.0.0.1"
-            - flag: "--bind-address"
-              set: false
-        remediation: |
-          By default, K3s sets the --bind-address argument to 127.0.0.1. No manual remediation needed.
-        scored: true
-
-  - id: 1.4
-    text: "Scheduler"
-    checks:
-      - id: 1.4.1
-        text: "Ensure that the --profiling argument is set to false (Automated)"
-        audit: journalctl -u k3s | grep "Running kube-scheduler" | tail -n1 | grep "profiling"
-        tests:
-          test_items:
-            - flag: "--profiling"
-              compare:
-                op: eq
-                value: false
-        remediation: |
-          By default, K3s sets the --profiling flag parameter to false. No manual remediation needed.
-        scored: true
-
-      - id: 1.4.2
-        text: "Ensure that the --bind-address argument is set to 127.0.0.1 (Automated)"
-        audit: journalctl -u k3s | grep "Running kube-controller-manager" | tail -n1 | grep "bind-address"
-        tests:
-          bin_op: or
-          test_items:
-            - flag: "--bind-address"
-              compare:
-                op: eq
-                value: "127.0.0.1"
-            - flag: "--bind-address"
-              set: false
-        remediation: |
-          By default, K3s sets the --bind-address argument to 127.0.0.1. No manual remediation needed.
-        scored: true

cfg/cis-1.6-k3s/node.yaml

@@ -1,253 +0,0 @@
----
-controls:
-version: "cis-1.6-k3s"
-id: 4
-text: "Worker Node Security Configuration"
-type: "node"
-groups:
-  - id: 4.1
-    text: "Worker Node Configuration Files"
-    checks:
-      - id: 4.1.1
-        text: "Ensure that the kubelet service file permissions are set to 644 or more restrictive (Not Applicable)"
-        scored: false
-
-      - id: 4.1.2
-        text: "Ensure that the kubelet service file ownership is set to root:root (Not Applicable)"
-        scored: false
-
-      - id: 4.1.3
-        text: "If proxy kubeproxy.kubeconfig file exists ensure permissions are set to 644 or more restrictive (Automated)"
-        audit: stat -c %a $proxykubeconfig
-        tests:
-          bin_op: or
-          test_items:
-            - flag: "permissions"
-              set: true
-              compare:
-                op: bitmask
-                value: "644"
-            - flag: "$proxykubeconfig"
-              set: false
-        remediation: |
-          Run the below command (based on the file location on your system) on the each worker node.
-          For example,
-          chmod 644 $proxykubeconfig
-        scored: true
-
-      - id: 4.1.4
-        text: "Ensure that the proxy kubeconfig file ownership is set to root:root (Automated)"
-        audit: '/bin/sh -c ''if test -e $proxykubeconfig; then stat -c %U:%G $proxykubeconfig; fi'' '
-        tests:
-          bin_op: or
-          test_items:
-            - flag: root:root
-            - flag: "$proxykubeconfig"
-              set: false
-        remediation: |
-          Run the below command (based on the file location on your system) on the each worker node.
-          For example, chown root:root $proxykubeconfig
-        scored: true
-
-      - id: 4.1.5
-        text: "Ensure that the --kubeconfig kubelet.conf file permissions are set to 644 or more restrictive (Automated)"
-        audit: '/bin/sh -c ''if test -e $kubeletkubeconfig; then stat -c permissions=%a $kubeletkubeconfig; fi'' '
-        tests:
-          test_items:
-            - flag: "permissions"
-              compare:
-                op: bitmask
-                value: "644"
-        remediation: |
-          By default, K3s creates $kubeletkubeconfig with 644 permissions. No manual remediation needed.
-        scored: true
-
-      - id: 4.1.6
-        text: "Ensure that the --kubeconfig kubelet.conf file ownership is set to root:root (Automated)"
-        audit: '/bin/sh -c ''if test -e $kubeletkubeconfig; then stat -c %U:%G $kubeletkubeconfig; fi'' '
-        tests:
-          test_items:
-            - flag: root:root
-        remediation: |
-          By default, K3s creates $kubeletkubeconfig with root:root ownership. No manual remediation needed.
-        scored: true
-
-      - id: 4.1.7
-        text: "Ensure that the certificate authorities file permissions are set to 644 or more restrictive (Automated)"
-        audit: stat -c permissions=%a $kubeletcafile
-        tests:
-          test_items:
-            - flag: "permissions"
-              compare:
-                op: bitmask
-                value: "644"
-        remediation: |
-          By default, K3s creates $kubeletcafile with 644 permissions.
-        scored: true
-
-      - id: 4.1.8
-        text: "Ensure that the client certificate authorities file ownership is set to root:root (Automated)"
-        audit: stat -c %U:%G $kubeletcafile
-        tests:
-          test_items:
-            - flag: root:root
-              compare:
-                op: eq
-                value: root:root
-        remediation: |
-          By default, K3s creates $kubeletcafile with root:root ownership.
-        scored: true
-
-      - id: 4.1.9
-        text: "Ensure that the kubelet --config configuration file has permissions set to 644 or more restrictive (Not Applicable)"
-        scored: false
-
-      - id: 4.1.10
-        text: "Ensure that the kubelet --config configuration file ownership is set to root:root (Not Applicable)"
-        scored: false
-
-  - id: 4.2
-    text: "Kubelet"
-    checks:
-      - id: 4.2.1
-        text: "Ensure that the anonymous-auth argument is set to false (Automated)"
-        audit: journalctl -u k3s | grep "Running kube-apiserver" | tail -n1 | grep "anonymous-auth"
-        tests:
-          test_items:
-            - flag: "--anonymous-auth"
-              compare:
-                op: eq
-                value: false
-        remediation: |
-          By default, K3s starts kubelet with --anonymous-auth set to false. No manual remediation needed.
-        scored: true
-
-      - id: 4.2.2
-        text: "Ensure that the --authorization-mode argument is not set to AlwaysAllow (Automated)"
-        audit: journalctl -u k3s | grep "Running kube-apiserver" | tail -n1 | grep "authorization-mode"
-        tests:
-          test_items:
-            - flag: --authorization-mode
-              compare:
-                op: nothave
-                value: AlwaysAllow
-        remediation: |
-          K3s starts kubelet with Webhook as the value for the --authorization-mode argument. No manual remediation needed.
-        scored: true
-
-      - id: 4.2.3
-        text: "Ensure that the --client-ca-file argument is set as appropriate (Automated)"
-        audit: journalctl -u k3s | grep "Running kube-apiserver" | tail -n1 | grep "client-ca-file"
-        tests:
-          test_items:
-            - flag: --client-ca-file
-        remediation: |
-          By default, K3s starts the kubelet process with the --client-ca-file. No manual remediation needed.
-        scored: true
-
-      - id: 4.2.4
-        text: "Ensure that the --read-only-port argument is set to 0 (Automated)"
-        audit: journalctl -u k3s | grep "Running kubelet" | tail -n1 | grep "read-only-port"
-        tests:
-          bin_op: or
-          test_items:
-            - flag: "--read-only-port"
-              compare:
-                op: eq
-                value: 0
-            - flag: "--read-only-port"
-              set: false
-        remediation: |
-          By default, K3s starts the kubelet process with the --read-only-port argument set to 0.
-        scored: false
-
-      - id: 4.2.5
-        text: "Ensure that the --streaming-connection-idle-timeout argument is not set to 0 (Automated)"
-        audit: journalctl -u k3s | grep "Running kubelet" | tail -n1 | grep "streaming-connection-idle-timeout"
-        tests:
-          test_items:
-            - flag: --streaming-connection-idle-timeout
-              compare:
-                op: noteq
-                value: 0
-            - flag: --streaming-connection-idle-timeout
-              set: false
-          bin_op: or
-        remediation: |
-          By default, K3s does not set --streaming-connection-idle-timeout when starting kubelet.
-        scored: true
-
-      - id: 4.2.6
-        text: "Ensure that the --protect-kernel-defaults argument is set to true (Automated)"
-        audit: journalctl -u k3s | grep "Running kubelet" | tail -n1 | grep "protect-kernel-defaults"
-        tests:
-          test_items:
-            - flag: --protect-kernel-defaults
-              compare:
-                op: eq
-                value: true
-        remediation: |
-          K3s server needs to be started with the following, --protect-kernel-defaults=true.
-        scored: true
-
-      - id: 4.2.7
-        text: "Ensure that the --make-iptables-util-chains argument is set to true (Automated)"
-        audit: journalctl -u k3s | grep "Running kubelet" | tail -n1 | grep "make-iptables-util-chains"
-        tests:
-          test_items:
-            - flag: --make-iptables-util-chains
-              compare:
-                op: eq
-                value: true
-            - flag: --make-iptables-util-chains
-              set: false
-          bin_op: or
-        remediation: |
-          K3s server needs to be run with the following, --kube-apiserver-arg='make-iptables-util-chains=true'.
-        scored: true
-
-      - id: 4.2.8
-        text: "Ensure that the --hostname-override argument is not set (Not Applicable)"
-        scored: false
-
-      - id: 4.2.9
-        text: "Ensure that the --event-qps argument is set to 0 or a level which ensures appropriate event capture (Manual)"
-        audit: /bin/ps -fC containerd
-        tests:
-          test_items:
-            - flag: --event-qps
-              compare:
-                op: eq
-                value: 0
-        remediation: |
-          If using a Kubelet config file, edit the file to set eventRecordQPS: to an appropriate level.
-          If using command line arguments, edit the kubelet service file
-          $kubeletsvc on each worker node and
-          set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable.
-          Based on your system, restart the kubelet service. For example:
-          systemctl daemon-reload
-          systemctl restart kubelet.service
-        scored: false
-
-      - id: 4.2.10
-        text: "Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate (Manual)"
-        audit: journalctl -u k3s | grep "Running kubelet" | tail -n1 | grep -E 'tls-cert-file|tls-private-key-file'
-        tests:
-          test_items:
-            - flag: --tls-cert-file
-            - flag: --tls-private-key-file
-        remediation: |
-          By default, K3s sets the --tls-cert-file and --tls-private-key-file arguments when executing the kubelet process.
-        scored: false
-
-      - id: 4.2.11
-        text: "Ensure that the --rotate-certificates argument is not set to false (Not Applicable)"
-        scored: false
-
-      - id: 4.2.12
-        text: "Verify that the RotateKubeletServerCertificate argument is set to true (Not Applicable)"
-        scored: false
-
-      - id: 4.2.13
-        text: "Ensure that the Kubelet only makes use of Strong Cryptographic Ciphers (Not Applicable)"
-        scored: false

cfg/cis-1.6-k3s/policies.yaml

@@ -1,260 +0,0 @@
----
-controls:
-version: "cis-1.6-k3s"
-id: 5
-text: "Kubernetes Policies"
-type: "policies"
-groups:
-  - id: 5.1
-    text: "RBAC and Service Accounts"
-    checks:
-      - id: 5.1.1
-        text: "Ensure that the cluster-admin role is only used where required (Manual)"
-        type: "manual"
-        remediation: |
-          Identify all clusterrolebindings to the cluster-admin role. Check if they are used and
-          if they need this role or if they could use a role with fewer privileges.
-          Where possible, first bind users to a lower privileged role and then remove the
-          clusterrolebinding to the cluster-admin role :
-          kubectl delete clusterrolebinding [name]
-        scored: false
-
-      - id: 5.1.2
-        text: "Minimize access to secrets (Manual)"
-        type: "manual"
-        remediation: |
-          Where possible, remove get, list and watch access to secret objects in the cluster.
-        scored: false
-
-      - id: 5.1.3
-        text: "Minimize wildcard use in Roles and ClusterRoles (Manual)"
-        type: "manual"
-        remediation: |
-          Where possible replace any use of wildcards in clusterroles and roles with specific
-          objects or actions.
-          kubectl get roles --all-namespaces -o yaml
-          kubectl get clusterroles -o yaml
-        scored: false
-
-      - id: 5.1.4
-        text: "Minimize access to create pods (Manual)"
-        type: "manual"
-        remediation: |
-          Where possible, remove create access to pod objects in the cluster.
-        scored: false
-
-      - id: 5.1.5
-        text: "Ensure that default service accounts are not actively used. (Manual)"
-        type: "manual"
-        remediation: |
-          Create explicit service accounts wherever a Kubernetes workload requires specific access
-          to the Kubernetes API server.
-          Modify the configuration of each default service account to include this value
-          automountServiceAccountToken: false
-        scored: false
-
-      - id: 5.1.6
-        text: "Ensure that Service Account Tokens are only mounted where necessary (Manual)"
-        type: "manual"
-        remediation: |
-          Modify the definition of pods and service accounts which do not need to mount service
-          account tokens to disable it.
-        scored: false
-
-  - id: 5.2
-    text: "Pod Security Policies"
-    checks:
-      - id: 5.2.1
-        text: "Minimize the admission of privileged containers (Manual)"
-        type: "manual"
-        remediation: |
-          kubectl describe psp <psp_name> | grep MustRunAsNonRoot
-          An operator should apply a PodSecurityPolicy that sets the Rule value to MustRunAsNonRoot. An example of this can be found in the Hardening Guide
-          https://docs.rancher.cn/docs/k3s/security/hardening-guide/_index
-        scored: false
-
-      - id: 5.2.2
-        text: "Minimize the admission of containers wishing to share the host process ID namespace (Manual)"
-        type: "manual"
-        remediation: |
-          kubectl get psp -o json | jq .items[] | jq -r 'select((.spec.hostPID == null) or (.spec.hostPID == false))' | jq .metadata.name | wc -l | xargs -I {} echo '--count={}'
-          An operator should apply a PodSecurityPolicy that sets the hostPID value to false explicitly for the PSP it creates. An example of this can be found in the Hardening Guide.
-          https://docs.rancher.cn/docs/k3s/security/hardening-guide/_index
-        scored: false
-
-      - id: 5.2.3
-        text: "Minimize the admission of containers wishing to share the host IPC namespace (Manual)"
-        type: "manual"
-        remediation: |
-          kubectl get psp -o json | jq .items[] | jq -r 'select((.spec.hostIPC == null) or (.spec.hostIPC == false))' | jq .metadata.name | wc -l | xargs -I {} echo '--count={}'
-          An operator should apply a PodSecurityPolicy that sets the HostIPC value to false explicitly for the PSP it creates. An example of this can be found in the Hardening Guide.
-          https://docs.rancher.cn/docs/k3s/security/hardening-guide/_index
-        scored: false
-
-      - id: 5.2.4
-        text: "Minimize the admission of containers wishing to share the host network namespace (Manual)"
-        type: "manual"
-        remediation: |
-          kubectl get psp -o json | jq .items[] | jq -r 'select((.spec.hostNetwork == null) or (.spec.hostNetwork == false))' | jq .metadata.name | wc -l | xargs -I {} echo '--count={}'
-          An operator should apply a PodSecurityPolicy that sets the HostNetwork value to false explicitly for the PSP it creates. An example of this can be found in the Hardening Guide.
-          https://docs.rancher.cn/docs/k3s/security/hardening-guide/_index
-        scored: false
-
-      - id: 5.2.5
-        text: "Minimize the admission of containers with allowPrivilegeEscalation (Manual)"
-        type: "manual"
-        remediation: |
-          kubectl get psp -o json | jq .items[] | jq -r 'select((.spec.allowPrivilegeEscalation == null) or (.spec.allowPrivilegeEscalation == false))' | jq .metadata.name | wc -l | xargs -I {} echo '--count={}'
-          An operator should apply a PodSecurityPolicy that sets the allowPrivilegeEscalation value to false explicitly for the PSP it creates. An example of this can be found in the Hardening Guide.
-          https://docs.rancher.cn/docs/k3s/security/hardening-guide/_index
-        scored: false
-
-      - id: 5.2.6
-        text: "Minimize the admission of root containers (Manual)"
-        type: "manual"
-        remediation: |
-          kubectl get psp -o json | jq .items[] | jq -r 'select((.spec.allowPrivilegeEscalation == null) or (.spec.allowPrivilegeEscalation == false))' | jq .metadata.name | wc -l | xargs -I {} echo '--count={}'
-          An operator should apply a PodSecurityPolicy that sets the runAsUser.Rule value to MustRunAsNonRoot. An example of this can be found in the Hardening Guide.
-          https://docs.rancher.cn/docs/k3s/security/hardening-guide/_index
-        scored: false
-
-      - id: 5.2.7
-        text: "Minimize the admission of containers with the NET_RAW capability (Manual)"
-        type: "manual"
-        remediation: |
-          kubectl get psp <psp_name> -o json | jq .spec.requiredDropCapabilities[]
-          An operator should apply a PodSecurityPolicy that sets .spec.requiredDropCapabilities[] to a value of All. An example of this can be found in the Hardening Guide.
-          https://docs.rancher.cn/docs/k3s/security/hardening-guide/_index
-        scored: false
-
-      - id: 5.2.8
-        text: "Minimize the admission of containers with added capabilities (Manual)"
-        type: "manual"
-        remediation: |
-          kubectl get psp
-          An operator should apply a PodSecurityPolicy that sets allowedCapabilities to anything other than an empty array. An example of this can be found in the Hardening Guide.
-          https://docs.rancher.cn/docs/k3s/security/hardening-guide/_index
-        scored: false
-
-      - id: 5.2.9
-        text: "Minimize the admission of containers with capabilities assigned (Manual)"
-        type: "manual"
-        remediation: |
-          kubectl get psp
-          An operator should apply a PodSecurityPolicy that sets requiredDropCapabilities to ALL. An example of this can be found in the Hardening Guide.
-          https://docs.rancher.cn/docs/k3s/security/hardening-guide/_index
-        scored: false
-
-  - id: 5.3
-    text: "Network Policies and CNI"
-    checks:
-      - id: 5.3.1
-        text: "Ensure that the CNI in use supports Network Policies (Manual)"
-        type: "manual"
-        remediation: |
-          By default, K3s use Canal (Calico and Flannel) and fully supports network policies.
-        scored: false
-
-      - id: 5.3.2
-        text: "Ensure that all Namespaces have Network Policies defined (Manual)"
-        type: "manual"
-        remediation: |
-          Run the below command on the master node.
-          for i in kube-system kube-public default; do
-            kubectl get networkpolicies -n $i;
-          done
-          Verify that there are network policies applied to each of the namespaces.
-          An operator should apply NetworkPolcyies that prevent unneeded traffic from traversing networks unnecessarily. An example of applying a NetworkPolcy can be found in the Hardening Guide.
-          https://docs.rancher.cn/docs/k3s/security/hardening-guide/_index
-        scored: false
-
-  - id: 5.4
-    text: "Secrets Management"
-    checks:
-      - id: 5.4.1
-        text: "Prefer using secrets as files over secrets as environment variables (Manual)"
-        type: "manual"
-        remediation: |
-          Run the following command to find references to objects which use environment variables defined from secrets.
-          kubectl get all -o jsonpath='{range .items[?(@..secretKeyRef)]} {.kind} {.metadata.name} {"\n"}{end}' -A
-
-          if possible, rewrite application code to read secrets from mounted secret files, rather than
-          from environment variables.
-        scored: false
-
-      - id: 5.4.2
-        text: "Consider external secret storage (Manual)"
-        type: "manual"
-        remediation: |
-          Refer to the secrets management options offered by your cloud provider or a third-party
-          secrets management solution.
-        scored: false
-
-  - id: 5.5
-    text: "Extensible Admission Control"
-    checks:
-      - id: 5.5.1
-        text: "Configure Image Provenance using ImagePolicyWebhook admission controller (Manual)"
-        type: "manual"
-        remediation: |
-          Follow the Kubernetes documentation and setup image provenance.
-        scored: false
-
-  - id: 5.7
-    text: "General Policies"
-    checks:
-      - id: 5.7.1
-        text: "Create administrative boundaries between resources using namespaces (Manual)"
-        audit: kubectl get namespaces
-        type: "manual"
-        remediation: |
-          Ensure that these namespaces are the ones you need and are adequately administered as per your requirements.
-          Follow the documentation and create namespaces for objects in your deployment as you need
-          them.
-        scored: false
-
-      - id: 5.7.2
-        text: "Ensure that the seccomp profile is set to docker/default in your pod definitions (Manual)"
-        type: "manual"
-        remediation: |
-          Seccomp is an alpha feature currently. By default, all alpha features are disabled. So, you
-          would need to enable alpha features in the apiserver by passing "--feature-
-          gates=AllAlpha=true" argument.
-          Edit the /etc/kubernetes/apiserver file on the master node and set the KUBE_API_ARGS
-          parameter to "--feature-gates=AllAlpha=true"
-          KUBE_API_ARGS="--feature-gates=AllAlpha=true"
-          Based on your system, restart the kube-apiserver service. For example:
-          systemctl restart kube-apiserver.service
-          Use annotations to enable the docker/default seccomp profile in your pod definitions. An
-          example is as below:
-          apiVersion: v1
-          kind: Pod
-          metadata:
-            name: trustworthy-pod
-            annotations:
-              seccomp.security.alpha.kubernetes.io/pod: docker/default
-          spec:
-            containers:
-              - name: trustworthy-container
-                image: sotrustworthy:latest
-        scored: false
-
-      - id: 5.7.3
-        text: "Apply Security Context to Your Pods and Containers (Manual)"
-        type: "manual"
-        remediation: |
-          Follow the Kubernetes documentation and apply security contexts to your pods. For a
-          suggested list of security contexts, you may refer to the CIS Security Benchmark for Docker
-          Containers.
-        scored: false
-
-      - id: 5.7.4
-        text: "The default namespace should not be used (Manual)"
-        type: "manual"
-        remediation: |
-          Run the below command on the master node.
-          kubectl get all -n default
-          The only entries there should be system-managed resources such as the kubernetes service.
-          Ensure that namespaces are created to allow for appropriate segregation of Kubernetes
-          resources and that all new resources are created in a specific namespace.
-        scored: false

cfg/cis-1.6/master.yaml

@@ -153,13 +153,7 @@ groups:
 
       - id: 1.1.11
         text: "Ensure that the etcd data directory permissions are set to 700 or more restrictive (Automated)"
-        audit: |
-          DATA_DIR=''
-          for d in $(ps -ef | grep $etcdbin | grep -- --data-dir | sed 's%.*data-dir[= ]\([^ ]*\).*%\1%'); do
-            if test -d "$d"; then DATA_DIR="$d"; fi
-          done
-          if ! test -d "$DATA_DIR"; then DATA_DIR=$etcddatadir; fi
-          stat -c permissions=%a "$DATA_DIR"
+        audit: ps -ef | grep $etcdbin | grep -- --data-dir | sed 's%.*data-dir[= ]\([^ ]*\).*%\1%' | xargs stat -c permissions=%a
         tests:
           test_items:
             - flag: "permissions"
@@ -176,13 +170,7 @@ groups:
 
       - id: 1.1.12
         text: "Ensure that the etcd data directory ownership is set to etcd:etcd (Automated)"
-        audit: |
-          DATA_DIR=''
-          for d in $(ps -ef | grep $etcdbin | grep -- --data-dir | sed 's%.*data-dir[= ]\([^ ]*\).*%\1%'); do
-            if test -d "$d"; then DATA_DIR="$d"; fi
-          done
-          if ! test -d "$DATA_DIR"; then DATA_DIR=$etcddatadir; fi
-          stat -c %U:%G $DATA_DIR
+        audit: ps -ef | grep $etcdbin | grep -- --data-dir | sed 's%.*data-dir[= ]\([^ ]*\).*%\1%' | xargs stat -c %U:%G
         tests:
           test_items:
             - flag: "etcd:etcd"

cfg/cis-1.6/node.yaml

@@ -25,12 +25,10 @@ groups:
 
       - id: 4.1.2
         text: "Ensure that the kubelet service file ownership is set to root:root (Automated)"
-        audit: '/bin/sh -c "if test -e $kubeletsvc; then stat -c %U:%G $kubeletsvc; else echo \"File not found\"; fi"'
+        audit: '/bin/sh -c ''if test -e $kubeletsvc; then stat -c %U:%G $kubeletsvc; fi'' '
         tests:
-          bin_op: or
           test_items:
             - flag: root:root
-            - flag: "File not found"
         remediation: |
           Run the below command (based on the file location on your system) on the each worker node.
           For example,
@@ -100,7 +98,7 @@ groups:
       - id: 4.1.7
         text: "Ensure that the certificate authorities file permissions are set to 644 or more restrictive (Manual)"
         audit: |
-          CAFILE=$(ps -ef | grep kubelet | grep -v apiserver | grep -- --client-ca-file= | awk -F '--client-ca-file=' '{print $2}' | awk '{print $1}' | uniq)
+          CAFILE=$(ps -ef | grep kubelet | grep -v apiserver | grep -- --client-ca-file= | awk -F '--client-ca-file=' '{print $2}' | awk '{print $1}')
           if test -z $CAFILE; then CAFILE=$kubeletcafile; fi
           if test -e $CAFILE; then stat -c permissions=%a $CAFILE; fi
         tests:
@@ -117,7 +115,7 @@ groups:
       - id: 4.1.8
         text: "Ensure that the client certificate authorities file ownership is set to root:root (Manual)"
         audit: |
-          CAFILE=$(ps -ef | grep kubelet | grep -v apiserver | grep -- --client-ca-file= | awk -F '--client-ca-file=' '{print $2}' | awk '{print $1}' | uniq)
+          CAFILE=$(ps -ef | grep kubelet | grep -v apiserver | grep -- --client-ca-file= | awk -F '--client-ca-file=' '{print $2}' | awk '{print $1}')
           if test -z $CAFILE; then CAFILE=$kubeletcafile; fi
           if test -e $CAFILE; then stat -c %U:%G $CAFILE; fi
         tests:
@@ -452,7 +450,7 @@ groups:
                 op: valid_elements
                 value: TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256
         remediation: |
-          If using a Kubelet config file, edit the file to set tlsCipherSuites: to
+          If using a Kubelet config file, edit the file to set TLSCipherSuites: to
           TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256
           or to a subset of these values.
           If using executable arguments, edit the kubelet service file

cfg/cis-1.6/policies.yaml

@@ -132,7 +132,7 @@ groups:
         type: "manual"
         remediation: |
           Review the use of capabilites in applications running on your cluster. Where a namespace
-          contains applications which do not require any Linux capabities to operate consider adding
+          contains applicaions which do not require any Linux capabities to operate consider adding
           a PSP which forbids the admission of containers which do not drop all capabilities.
         scored: false
 

cfg/cis-1.7/config.yaml

@@ -1,2 +0,0 @@
----
-## Version-specific settings that override the values in cfg/config.yaml

cfg/cis-1.7/controlplane.yaml

@@ -1,60 +0,0 @@
----
-controls:
-version: "cis-1.7"
-id: 3
-text: "Control Plane Configuration"
-type: "controlplane"
-groups:
-  - id: 3.1
-    text: "Authentication and Authorization"
-    checks:
-      - id: 3.1.1
-        text: "Client certificate authentication should not be used for users (Manual)"
-        type: "manual"
-        remediation: |
-          Alternative mechanisms provided by Kubernetes such as the use of OIDC should be
-          implemented in place of client certificates.
-        scored: false
-      - id: 3.1.2
-        text: "Service account token authentication should not be used for users (Manual)"
-        type: "manual"
-        remediation: |
-          Alternative mechanisms provided by Kubernetes such as the use of OIDC should be implemented
-          in place of service account tokens.
-        scored: false
-      - id: 3.1.3
-        text: "Bootstrap token authentication should not be used for users (Manual)"
-        type: "manual"
-        remediation: |
-          Alternative mechanisms provided by Kubernetes such as the use of OIDC should be implemented
-          in place of bootstrap tokens.
-        scored: false
-
-  - id: 3.2
-    text: "Logging"
-    checks:
-      - id: 3.2.1
-        text: "Ensure that a minimal audit policy is created (Manual)"
-        audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep"
-        tests:
-          test_items:
-            - flag: "--audit-policy-file"
-              set: true
-        remediation: |
-          Create an audit policy file for your cluster.
-        scored: false
-
-      - id: 3.2.2
-        text: "Ensure that the audit policy covers key security concerns (Manual)"
-        type: "manual"
-        remediation: |
-          Review the audit policy provided for the cluster and ensure that it covers
-          at least the following areas,
-          - Access to Secrets managed by the cluster. Care should be taken to only
-            log Metadata for requests to Secrets, ConfigMaps, and TokenReviews, in
-            order to avoid risk of logging sensitive data.
-          - Modification of Pod and Deployment objects.
-          - Use of `pods/exec`, `pods/portforward`, `pods/proxy` and `services/proxy`.
-          For most requests, minimally logging at the Metadata level is recommended
-          (the most basic level of logging).
-        scored: false

cfg/cis-1.7/etcd.yaml

@@ -1,135 +0,0 @@
----
-controls:
-version: "cis-1.7"
-id: 2
-text: "Etcd Node Configuration"
-type: "etcd"
-groups:
-  - id: 2
-    text: "Etcd Node Configuration"
-    checks:
-      - id: 2.1
-        text: "Ensure that the --cert-file and --key-file arguments are set as appropriate (Automated)"
-        audit: "/bin/ps -ef | /bin/grep $etcdbin | /bin/grep -v grep"
-        tests:
-          bin_op: and
-          test_items:
-            - flag: "--cert-file"
-              env: "ETCD_CERT_FILE"
-            - flag: "--key-file"
-              env: "ETCD_KEY_FILE"
-        remediation: |
-          Follow the etcd service documentation and configure TLS encryption.
-          Then, edit the etcd pod specification file /etc/kubernetes/manifests/etcd.yaml
-          on the master node and set the below parameters.
-          --cert-file=</path/to/ca-file>
-          --key-file=</path/to/key-file>
-        scored: true
-
-      - id: 2.2
-        text: "Ensure that the --client-cert-auth argument is set to true (Automated)"
-        audit: "/bin/ps -ef | /bin/grep $etcdbin | /bin/grep -v grep"
-        tests:
-          test_items:
-            - flag: "--client-cert-auth"
-              env: "ETCD_CLIENT_CERT_AUTH"
-              compare:
-                op: eq
-                value: true
-        remediation: |
-          Edit the etcd pod specification file $etcdconf on the master
-          node and set the below parameter.
-          --client-cert-auth="true"
-        scored: true
-
-      - id: 2.3
-        text: "Ensure that the --auto-tls argument is not set to true (Automated)"
-        audit: "/bin/ps -ef | /bin/grep $etcdbin | /bin/grep -v grep"
-        tests:
-          bin_op: or
-          test_items:
-            - flag: "--auto-tls"
-              env: "ETCD_AUTO_TLS"
-              set: false
-            - flag: "--auto-tls"
-              env: "ETCD_AUTO_TLS"
-              compare:
-                op: eq
-                value: false
-        remediation: |
-          Edit the etcd pod specification file $etcdconf on the master
-          node and either remove the --auto-tls parameter or set it to false.
-            --auto-tls=false
-        scored: true
-
-      - id: 2.4
-        text: "Ensure that the --peer-cert-file and --peer-key-file arguments are
-        set as appropriate (Automated)"
-        audit: "/bin/ps -ef | /bin/grep $etcdbin | /bin/grep -v grep"
-        tests:
-          bin_op: and
-          test_items:
-            - flag: "--peer-cert-file"
-              env: "ETCD_PEER_CERT_FILE"
-            - flag: "--peer-key-file"
-              env: "ETCD_PEER_KEY_FILE"
-        remediation: |
-          Follow the etcd service documentation and configure peer TLS encryption as appropriate
-          for your etcd cluster.
-          Then, edit the etcd pod specification file $etcdconf on the
-          master node and set the below parameters.
-          --peer-client-file=</path/to/peer-cert-file>
-          --peer-key-file=</path/to/peer-key-file>
-        scored: true
-
-      - id: 2.5
-        text: "Ensure that the --peer-client-cert-auth argument is set to true (Automated)"
-        audit: "/bin/ps -ef | /bin/grep $etcdbin | /bin/grep -v grep"
-        tests:
-          test_items:
-            - flag: "--peer-client-cert-auth"
-              env: "ETCD_PEER_CLIENT_CERT_AUTH"
-              compare:
-                op: eq
-                value: true
-        remediation: |
-          Edit the etcd pod specification file $etcdconf on the master
-          node and set the below parameter.
-          --peer-client-cert-auth=true
-        scored: true
-
-      - id: 2.6
-        text: "Ensure that the --peer-auto-tls argument is not set to true (Automated)"
-        audit: "/bin/ps -ef | /bin/grep $etcdbin | /bin/grep -v grep"
-        tests:
-          bin_op: or
-          test_items:
-            - flag: "--peer-auto-tls"
-              env: "ETCD_PEER_AUTO_TLS"
-              set: false
-            - flag: "--peer-auto-tls"
-              env: "ETCD_PEER_AUTO_TLS"
-              compare:
-                op: eq
-                value: false
-        remediation: |
-          Edit the etcd pod specification file $etcdconf on the master
-          node and either remove the --peer-auto-tls parameter or set it to false.
-          --peer-auto-tls=false
-        scored: true
-
-      - id: 2.7
-        text: "Ensure that a unique Certificate Authority is used for etcd (Manual)"
-        audit: "/bin/ps -ef | /bin/grep $etcdbin | /bin/grep -v grep"
-        tests:
-          test_items:
-            - flag: "--trusted-ca-file"
-              env: "ETCD_TRUSTED_CA_FILE"
-        remediation: |
-          [Manual test]
-          Follow the etcd documentation and create a dedicated certificate authority setup for the
-          etcd service.
-          Then, edit the etcd pod specification file $etcdconf on the
-          master node and set the below parameter.
-          --trusted-ca-file=</path/to/ca-file>
-        scored: false

cfg/cis-1.7/master.yaml

@@ -1,946 +0,0 @@
----
-controls:
-version: "cis-1.7"
-id: 1
-text: "Control Plane Security Configuration"
-type: "master"
-groups:
-  - id: 1.1
-    text: "Control Plane Node Configuration Files"
-    checks:
-      - id: 1.1.1
-        text: "Ensure that the API server pod specification file permissions are set to 600 or more restrictive (Automated)"
-        audit: "/bin/sh -c 'if test -e $apiserverconf; then stat -c permissions=%a $apiserverconf; fi'"
-        tests:
-          test_items:
-            - flag: "permissions"
-              compare:
-                op: bitmask
-                value: "600"
-        remediation: |
-          Run the below command (based on the file location on your system) on the
-          control plane node.
-          For example, chmod 600 $apiserverconf
-        scored: true
-
-      - id: 1.1.2
-        text: "Ensure that the API server pod specification file ownership is set to root:root (Automated)"
-        audit: "/bin/sh -c 'if test -e $apiserverconf; then stat -c %U:%G $apiserverconf; fi'"
-        tests:
-          test_items:
-            - flag: "root:root"
-        remediation: |
-          Run the below command (based on the file location on your system) on the control plane node.
-          For example, chown root:root $apiserverconf
-        scored: true
-
-      - id: 1.1.3
-        text: "Ensure that the controller manager pod specification file permissions are set to 600 or more restrictive (Automated)"
-        audit: "/bin/sh -c 'if test -e $controllermanagerconf; then stat -c permissions=%a $controllermanagerconf; fi'"
-        tests:
-          test_items:
-            - flag: "permissions"
-              compare:
-                op: bitmask
-                value: "600"
-        remediation: |
-          Run the below command (based on the file location on your system) on the control plane node.
-          For example, chmod 600 $controllermanagerconf
-        scored: true
-
-      - id: 1.1.4
-        text: "Ensure that the controller manager pod specification file ownership is set to root:root (Automated)"
-        audit: "/bin/sh -c 'if test -e $controllermanagerconf; then stat -c %U:%G $controllermanagerconf; fi'"
-        tests:
-          test_items:
-            - flag: "root:root"
-        remediation: |
-          Run the below command (based on the file location on your system) on the control plane node.
-          For example, chown root:root $controllermanagerconf
-        scored: true
-
-      - id: 1.1.5
-        text: "Ensure that the scheduler pod specification file permissions are set to 600 or more restrictive (Automated)"
-        audit: "/bin/sh -c 'if test -e $schedulerconf; then stat -c permissions=%a $schedulerconf; fi'"
-        tests:
-          test_items:
-            - flag: "permissions"
-              compare:
-                op: bitmask
-                value: "600"
-        remediation: |
-          Run the below command (based on the file location on your system) on the control plane node.
-          For example, chmod 600 $schedulerconf
-        scored: true
-
-      - id: 1.1.6
-        text: "Ensure that the scheduler pod specification file ownership is set to root:root (Automated)"
-        audit: "/bin/sh -c 'if test -e $schedulerconf; then stat -c %U:%G $schedulerconf; fi'"
-        tests:
-          test_items:
-            - flag: "root:root"
-        remediation: |
-          Run the below command (based on the file location on your system) on the control plane node.
-          For example, chown root:root $schedulerconf
-        scored: true
-
-      - id: 1.1.7
-        text: "Ensure that the etcd pod specification file permissions are set to 600 or more restrictive (Automated)"
-        audit: "/bin/sh -c 'if test -e $etcdconf; then find $etcdconf -name '*etcd*' | xargs stat -c permissions=%a; fi'"
-        use_multiple_values: true
-        tests:
-          test_items:
-            - flag: "permissions"
-              compare:
-                op: bitmask
-                value: "600"
-        remediation: |
-          Run the below command (based on the file location on your system) on the control plane node.
-          For example,
-          chmod 600 $etcdconf
-        scored: true
-
-      - id: 1.1.8
-        text: "Ensure that the etcd pod specification file ownership is set to root:root (Automated)"
-        audit: "/bin/sh -c 'if test -e $etcdconf; then find $etcdconf -name '*etcd*' | xargs stat -c %U:%G; fi'"
-        use_multiple_values: true
-        tests:
-          test_items:
-            - flag: "root:root"
-        remediation: |
-          Run the below command (based on the file location on your system) on the control plane node.
-          For example,
-          chown root:root $etcdconf
-        scored: true
-
-      - id: 1.1.9
-        text: "Ensure that the Container Network Interface file permissions are set to 600 or more restrictive (Manual)"
-        audit: |
-          ps -ef | grep $kubeletbin | grep -- --cni-conf-dir | sed 's%.*cni-conf-dir[= ]\([^ ]*\).*%\1%' | xargs -I{} find {} -mindepth 1 | xargs --no-run-if-empty stat -c permissions=%a
-          find /var/lib/cni/networks -type f 2> /dev/null | xargs --no-run-if-empty stat -c permissions=%a
-        use_multiple_values: true
-        tests:
-          test_items:
-            - flag: "permissions"
-              compare:
-                op: bitmask
-                value: "600"
-        remediation: |
-          Run the below command (based on the file location on your system) on the control plane node.
-          For example, chmod 600 <path/to/cni/files>
-        scored: false
-
-      - id: 1.1.10
-        text: "Ensure that the Container Network Interface file ownership is set to root:root (Manual)"
-        audit: |
-          ps -ef | grep $kubeletbin | grep -- --cni-conf-dir | sed 's%.*cni-conf-dir[= ]\([^ ]*\).*%\1%' | xargs -I{} find {} -mindepth 1 | xargs --no-run-if-empty stat -c %U:%G
-          find /var/lib/cni/networks -type f 2> /dev/null | xargs --no-run-if-empty stat -c %U:%G
-        use_multiple_values: true
-        tests:
-          test_items:
-            - flag: "root:root"
-        remediation: |
-          Run the below command (based on the file location on your system) on the control plane node.
-          For example,
-          chown root:root <path/to/cni/files>
-        scored: false
-
-      - id: 1.1.11
-        text: "Ensure that the etcd data directory permissions are set to 700 or more restrictive (Automated)"
-        audit: |
-          DATA_DIR=''
-          for d in $(ps -ef | grep $etcdbin | grep -- --data-dir | sed 's%.*data-dir[= ]\([^ ]*\).*%\1%'); do
-            if test -d "$d"; then DATA_DIR="$d"; fi
-          done
-          if ! test -d "$DATA_DIR"; then DATA_DIR=$etcddatadir; fi
-          stat -c permissions=%a "$DATA_DIR"
-        tests:
-          test_items:
-            - flag: "permissions"
-              compare:
-                op: bitmask
-                value: "700"
-        remediation: |
-          On the etcd server node, get the etcd data directory, passed as an argument --data-dir,
-          from the command 'ps -ef | grep etcd'.
-          Run the below command (based on the etcd data directory found above). For example,
-          chmod 700 /var/lib/etcd
-        scored: true
-
-      - id: 1.1.12
-        text: "Ensure that the etcd data directory ownership is set to etcd:etcd (Automated)"
-        audit: |
-          DATA_DIR=''
-          for d in $(ps -ef | grep $etcdbin | grep -- --data-dir | sed 's%.*data-dir[= ]\([^ ]*\).*%\1%'); do
-            if test -d "$d"; then DATA_DIR="$d"; fi
-          done
-          if ! test -d "$DATA_DIR"; then DATA_DIR=$etcddatadir; fi
-          stat -c %U:%G "$DATA_DIR"
-        tests:
-          test_items:
-            - flag: "etcd:etcd"
-        remediation: |
-          On the etcd server node, get the etcd data directory, passed as an argument --data-dir,
-          from the command 'ps -ef | grep etcd'.
-          Run the below command (based on the etcd data directory found above).
-          For example, chown etcd:etcd /var/lib/etcd
-        scored: true
-
-      - id: 1.1.13
-        text: "Ensure that the admin.conf file permissions are set to 600 or more restrictive (Automated)"
-        audit: "/bin/sh -c 'if test -e /etc/kubernetes/admin.conf; then stat -c permissions=%a /etc/kubernetes/admin.conf; fi'"
-        tests:
-          test_items:
-            - flag: "permissions"
-              compare:
-                op: bitmask
-                value: "600"
-        remediation: |
-          Run the below command (based on the file location on your system) on the control plane node.
-          For example, chmod 600 /etc/kubernetes/admin.conf
-        scored: true
-
-      - id: 1.1.14
-        text: "Ensure that the admin.conf file ownership is set to root:root (Automated)"
-        audit: "/bin/sh -c 'if test -e /etc/kubernetes/admin.conf; then stat -c %U:%G /etc/kubernetes/admin.conf; fi'"
-        tests:
-          test_items:
-            - flag: "root:root"
-        remediation: |
-          Run the below command (based on the file location on your system) on the control plane node.
-          For example, chown root:root /etc/kubernetes/admin.conf
-        scored: true
-
-      - id: 1.1.15
-        text: "Ensure that the scheduler.conf file permissions are set to 600 or more restrictive (Automated)"
-        audit: "/bin/sh -c 'if test -e $schedulerkubeconfig; then stat -c permissions=%a $schedulerkubeconfig; fi'"
-        tests:
-          test_items:
-            - flag: "permissions"
-              compare:
-                op: bitmask
-                value: "600"
-        remediation: |
-          Run the below command (based on the file location on your system) on the control plane node.
-          For example,
-          chmod 600 $schedulerkubeconfig
-        scored: true
-
-      - id: 1.1.16
-        text: "Ensure that the scheduler.conf file ownership is set to root:root (Automated)"
-        audit: "/bin/sh -c 'if test -e $schedulerkubeconfig; then stat -c %U:%G $schedulerkubeconfig; fi'"
-        tests:
-          test_items:
-            - flag: "root:root"
-        remediation: |
-          Run the below command (based on the file location on your system) on the control plane node.
-          For example,
-          chown root:root $schedulerkubeconfig
-        scored: true
-
-      - id: 1.1.17
-        text: "Ensure that the controller-manager.conf file permissions are set to 600 or more restrictive (Automated)"
-        audit: "/bin/sh -c 'if test -e $controllermanagerkubeconfig; then stat -c permissions=%a $controllermanagerkubeconfig; fi'"
-        tests:
-          test_items:
-            - flag: "permissions"
-              compare:
-                op: bitmask
-                value: "600"
-        remediation: |
-          Run the below command (based on the file location on your system) on the control plane node.
-          For example,
-          chmod 600 $controllermanagerkubeconfig
-        scored: true
-
-      - id: 1.1.18
-        text: "Ensure that the controller-manager.conf file ownership is set to root:root (Automated)"
-        audit: "/bin/sh -c 'if test -e $controllermanagerkubeconfig; then stat -c %U:%G $controllermanagerkubeconfig; fi'"
-        tests:
-          test_items:
-            - flag: "root:root"
-        remediation: |
-          Run the below command (based on the file location on your system) on the control plane node.
-          For example,
-          chown root:root $controllermanagerkubeconfig
-        scored: true
-
-      - id: 1.1.19
-        text: "Ensure that the Kubernetes PKI directory and file ownership is set to root:root (Automated)"
-        audit: "find /etc/kubernetes/pki/ | xargs stat -c %U:%G"
-        use_multiple_values: true
-        tests:
-          test_items:
-            - flag: "root:root"
-        remediation: |
-          Run the below command (based on the file location on your system) on the control plane node.
-          For example,
-          chown -R root:root /etc/kubernetes/pki/
-        scored: true
-
-      - id: 1.1.20
-        text: "Ensure that the Kubernetes PKI certificate file permissions are set to 600 or more restrictive (Manual)"
-        audit: "find /etc/kubernetes/pki/ -name '*.crt' | xargs stat -c permissions=%a"
-        use_multiple_values: true
-        tests:
-          test_items:
-            - flag: "permissions"
-              compare:
-                op: bitmask
-                value: "600"
-        remediation: |
-          Run the below command (based on the file location on your system) on the control plane node.
-          For example,
-          chmod -R 600 /etc/kubernetes/pki/*.crt
-        scored: false
-
-      - id: 1.1.21
-        text: "Ensure that the Kubernetes PKI key file permissions are set to 600 (Manual)"
-        audit: "find /etc/kubernetes/pki/ -name '*.key' | xargs stat -c permissions=%a"
-        use_multiple_values: true
-        tests:
-          test_items:
-            - flag: "permissions"
-              compare:
-                op: bitmask
-                value: "600"
-        remediation: |
-          Run the below command (based on the file location on your system) on the control plane node.
-          For example,
-          chmod -R 600 /etc/kubernetes/pki/*.key
-        scored: false
-
-  - id: 1.2
-    text: "API Server"
-    checks:
-      - id: 1.2.1
-        text: "Ensure that the --anonymous-auth argument is set to false (Manual)"
-        audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep"
-        tests:
-          test_items:
-            - flag: "--anonymous-auth"
-              compare:
-                op: eq
-                value: false
-        remediation: |
-          Edit the API server pod specification file $apiserverconf
-          on the control plane node and set the below parameter.
-          --anonymous-auth=false
-        scored: false
-
-      - id: 1.2.2
-        text: "Ensure that the --token-auth-file parameter is not set (Automated)"
-        audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep"
-        tests:
-          test_items:
-            - flag: "--token-auth-file"
-              set: false
-        remediation: |
-          Follow the documentation and configure alternate mechanisms for authentication. Then,
-          edit the API server pod specification file $apiserverconf
-          on the control plane node and remove the --token-auth-file=<filename> parameter.
-        scored: true
-
-      - id: 1.2.3
-        text: "Ensure that the --DenyServiceExternalIPs is set (Manual)"
-        audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep"
-        tests:
-          test_items:
-            - flag: "--enable-admission-plugins"
-              compare:
-                op: has
-                value: "DenyServiceExternalIPs"
-        remediation: |
-          Edit the API server pod specification file $apiserverconf
-          on the control plane node and add the `DenyServiceExternalIPs` plugin
-          to the enabled admission plugins, as such --enable-admission-plugin=DenyServiceExternalIPs.
-        scored: false
-
-      - id: 1.2.4
-        text: "Ensure that the --kubelet-client-certificate and --kubelet-client-key arguments are set as appropriate (Automated)"
-        audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep"
-        tests:
-          bin_op: and
-          test_items:
-            - flag: "--kubelet-client-certificate"
-            - flag: "--kubelet-client-key"
-        remediation: |
-          Follow the Kubernetes documentation and set up the TLS connection between the
-          apiserver and kubelets. Then, edit API server pod specification file
-          $apiserverconf on the control plane node and set the
-          kubelet client certificate and key parameters as below.
-          --kubelet-client-certificate=<path/to/client-certificate-file>
-          --kubelet-client-key=<path/to/client-key-file>
-        scored: true
-
-      - id: 1.2.5
-        text: "Ensure that the --kubelet-certificate-authority argument is set as appropriate (Automated)"
-        audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep"
-        tests:
-          test_items:
-            - flag: "--kubelet-certificate-authority"
-        remediation: |
-          Follow the Kubernetes documentation and setup the TLS connection between
-          the apiserver and kubelets. Then, edit the API server pod specification file
-          $apiserverconf on the control plane node and set the
-          --kubelet-certificate-authority parameter to the path to the cert file for the certificate authority.
-          --kubelet-certificate-authority=<ca-string>
-        scored: true
-
-      - id: 1.2.6
-        text: "Ensure that the --authorization-mode argument is not set to AlwaysAllow (Automated)"
-        audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep"
-        tests:
-          test_items:
-            - flag: "--authorization-mode"
-              compare:
-                op: nothave
-                value: "AlwaysAllow"
-        remediation: |
-          Edit the API server pod specification file $apiserverconf
-          on the control plane node and set the --authorization-mode parameter to values other than AlwaysAllow.
-          One such example could be as below.
-          --authorization-mode=RBAC
-        scored: true
-
-      - id: 1.2.7
-        text: "Ensure that the --authorization-mode argument includes Node (Automated)"
-        audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep"
-        tests:
-          test_items:
-            - flag: "--authorization-mode"
-              compare:
-                op: has
-                value: "Node"
-        remediation: |
-          Edit the API server pod specification file $apiserverconf
-          on the control plane node and set the --authorization-mode parameter to a value that includes Node.
-          --authorization-mode=Node,RBAC
-        scored: true
-
-      - id: 1.2.8
-        text: "Ensure that the --authorization-mode argument includes RBAC (Automated)"
-        audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep"
-        tests:
-          test_items:
-            - flag: "--authorization-mode"
-              compare:
-                op: has
-                value: "RBAC"
-        remediation: |
-          Edit the API server pod specification file $apiserverconf
-          on the control plane node and set the --authorization-mode parameter to a value that includes RBAC,
-          for example `--authorization-mode=Node,RBAC`.
-        scored: true
-
-      - id: 1.2.9
-        text: "Ensure that the admission control plugin EventRateLimit is set (Manual)"
-        audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep"
-        tests:
-          test_items:
-            - flag: "--enable-admission-plugins"
-              compare:
-                op: has
-                value: "EventRateLimit"
-        remediation: |
-          Follow the Kubernetes documentation and set the desired limits in a configuration file.
-          Then, edit the API server pod specification file $apiserverconf
-          and set the below parameters.
-          --enable-admission-plugins=...,EventRateLimit,...
-          --admission-control-config-file=<path/to/configuration/file>
-        scored: false
-
-      - id: 1.2.10
-        text: "Ensure that the admission control plugin AlwaysAdmit is not set (Automated)"
-        audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep"
-        tests:
-          bin_op: or
-          test_items:
-            - flag: "--enable-admission-plugins"
-              compare:
-                op: nothave
-                value: AlwaysAdmit
-            - flag: "--enable-admission-plugins"
-              set: false
-        remediation: |
-          Edit the API server pod specification file $apiserverconf
-          on the control plane node and either remove the --enable-admission-plugins parameter, or set it to a
-          value that does not include AlwaysAdmit.
-        scored: true
-
-      - id: 1.2.11
-        text: "Ensure that the admission control plugin AlwaysPullImages is set (Manual)"
-        audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep"
-        tests:
-          test_items:
-            - flag: "--enable-admission-plugins"
-              compare:
-                op: has
-                value: "AlwaysPullImages"
-        remediation: |
-          Edit the API server pod specification file $apiserverconf
-          on the control plane node and set the --enable-admission-plugins parameter to include
-          AlwaysPullImages.
-          --enable-admission-plugins=...,AlwaysPullImages,...
-        scored: false
-
-      - id: 1.2.12
-        text: "Ensure that the admission control plugin SecurityContextDeny is set if PodSecurityPolicy is not used (Manual)"
-        audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep"
-        tests:
-          bin_op: or
-          test_items:
-            - flag: "--enable-admission-plugins"
-              compare:
-                op: has
-                value: "SecurityContextDeny"
-            - flag: "--enable-admission-plugins"
-              compare:
-                op: has
-                value: "PodSecurityPolicy"
-        remediation: |
-          Edit the API server pod specification file $apiserverconf
-          on the control plane node and set the --enable-admission-plugins parameter to include
-          SecurityContextDeny, unless PodSecurityPolicy is already in place.
-          --enable-admission-plugins=...,SecurityContextDeny,...
-        scored: false
-
-      - id: 1.2.13
-        text: "Ensure that the admission control plugin ServiceAccount is set (Automated)"
-        audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep"
-        tests:
-          bin_op: or
-          test_items:
-            - flag: "--disable-admission-plugins"
-              compare:
-                op: nothave
-                value: "ServiceAccount"
-            - flag: "--disable-admission-plugins"
-              set: false
-        remediation: |
-          Follow the documentation and create ServiceAccount objects as per your environment.
-          Then, edit the API server pod specification file $apiserverconf
-          on the control plane node and ensure that the --disable-admission-plugins parameter is set to a
-          value that does not include ServiceAccount.
-        scored: true
-
-      - id: 1.2.14
-        text: "Ensure that the admission control plugin NamespaceLifecycle is set (Automated)"
-        audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep"
-        tests:
-          bin_op: or
-          test_items:
-            - flag: "--disable-admission-plugins"
-              compare:
-                op: nothave
-                value: "NamespaceLifecycle"
-            - flag: "--disable-admission-plugins"
-              set: false
-        remediation: |
-          Edit the API server pod specification file $apiserverconf
-          on the control plane node and set the --disable-admission-plugins parameter to
-          ensure it does not include NamespaceLifecycle.
-        scored: true
-
-      - id: 1.2.15
-        text: "Ensure that the admission control plugin NodeRestriction is set (Automated)"
-        audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep"
-        tests:
-          test_items:
-            - flag: "--enable-admission-plugins"
-              compare:
-                op: has
-                value: "NodeRestriction"
-        remediation: |
-          Follow the Kubernetes documentation and configure NodeRestriction plug-in on kubelets.
-          Then, edit the API server pod specification file $apiserverconf
-          on the control plane node and set the --enable-admission-plugins parameter to a
-          value that includes NodeRestriction.
-          --enable-admission-plugins=...,NodeRestriction,...
-        scored: true
-
-      - id: 1.2.16
-        text: "Ensure that the --secure-port argument is not set to 0 - NoteThis recommendation is obsolete and will be deleted per the consensus process (Manual)"
-        audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep"
-        tests:
-          bin_op: or
-          test_items:
-            - flag: "--secure-port"
-              compare:
-                op: gt
-                value: 0
-            - flag: "--secure-port"
-              set: false
-        remediation: |
-          Edit the API server pod specification file $apiserverconf
-          on the control plane node and either remove the --secure-port parameter or
-          set it to a different (non-zero) desired port.
-        scored: false
-
-      - id: 1.2.17
-        text: "Ensure that the --profiling argument is set to false (Automated)"
-        audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep"
-        tests:
-          test_items:
-            - flag: "--profiling"
-              compare:
-                op: eq
-                value: false
-        remediation: |
-          Edit the API server pod specification file $apiserverconf
-          on the control plane node and set the below parameter.
-          --profiling=false
-        scored: true
-
-      - id: 1.2.18
-        text: "Ensure that the --audit-log-path argument is set (Automated)"
-        audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep"
-        tests:
-          test_items:
-            - flag: "--audit-log-path"
-        remediation: |
-          Edit the API server pod specification file $apiserverconf
-          on the control plane node and set the --audit-log-path parameter to a suitable path and
-          file where you would like audit logs to be written, for example,
-          --audit-log-path=/var/log/apiserver/audit.log
-        scored: true
-
-      - id: 1.2.19
-        text: "Ensure that the --audit-log-maxage argument is set to 30 or as appropriate (Automated)"
-        audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep"
-        tests:
-          test_items:
-            - flag: "--audit-log-maxage"
-              compare:
-                op: gte
-                value: 30
-        remediation: |
-          Edit the API server pod specification file $apiserverconf
-          on the control plane node and set the --audit-log-maxage parameter to 30
-          or as an appropriate number of days, for example,
-          --audit-log-maxage=30
-        scored: true
-
-      - id: 1.2.20
-        text: "Ensure that the --audit-log-maxbackup argument is set to 10 or as appropriate (Automated)"
-        audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep"
-        tests:
-          test_items:
-            - flag: "--audit-log-maxbackup"
-              compare:
-                op: gte
-                value: 10
-        remediation: |
-          Edit the API server pod specification file $apiserverconf
-          on the control plane node and set the --audit-log-maxbackup parameter to 10 or to an appropriate
-          value. For example,
-          --audit-log-maxbackup=10
-        scored: true
-
-      - id: 1.2.21
-        text: "Ensure that the --audit-log-maxsize argument is set to 100 or as appropriate (Automated)"
-        audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep"
-        tests:
-          test_items:
-            - flag: "--audit-log-maxsize"
-              compare:
-                op: gte
-                value: 100
-        remediation: |
-          Edit the API server pod specification file $apiserverconf
-          on the control plane node and set the --audit-log-maxsize parameter to an appropriate size in MB.
-          For example, to set it as 100 MB, --audit-log-maxsize=100
-        scored: true
-
-      - id: 1.2.22
-        text: "Ensure that the --request-timeout argument is set as appropriate (Manual)"
-        audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep"
-        type: manual
-        remediation: |
-          Edit the API server pod specification file $apiserverconf
-          and set the below parameter as appropriate and if needed.
-          For example, --request-timeout=300s
-        scored: false
-
-      - id: 1.2.23
-        text: "Ensure that the --service-account-lookup argument is set to true (Automated)"
-        audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep"
-        tests:
-          bin_op: or
-          test_items:
-            - flag: "--service-account-lookup"
-              set: false
-            - flag: "--service-account-lookup"
-              compare:
-                op: eq
-                value: true
-        remediation: |
-          Edit the API server pod specification file $apiserverconf
-          on the control plane node and set the below parameter.
-          --service-account-lookup=true
-          Alternatively, you can delete the --service-account-lookup parameter from this file so
-          that the default takes effect.
-        scored: true
-
-      - id: 1.2.24
-        text: "Ensure that the --service-account-key-file argument is set as appropriate (Automated)"
-        audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep"
-        tests:
-          test_items:
-            - flag: "--service-account-key-file"
-        remediation: |
-          Edit the API server pod specification file $apiserverconf
-          on the control plane node and set the --service-account-key-file parameter
-          to the public key file for service accounts. For example,
-          --service-account-key-file=<filename>
-        scored: true
-
-      - id: 1.2.25
-        text: "Ensure that the --etcd-certfile and --etcd-keyfile arguments are set as appropriate (Automated)"
-        audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep"
-        tests:
-          bin_op: and
-          test_items:
-            - flag: "--etcd-certfile"
-            - flag: "--etcd-keyfile"
-        remediation: |
-          Follow the Kubernetes documentation and set up the TLS connection between the apiserver and etcd.
-          Then, edit the API server pod specification file $apiserverconf
-          on the control plane node and set the etcd certificate and key file parameters.
-          --etcd-certfile=<path/to/client-certificate-file>
-          --etcd-keyfile=<path/to/client-key-file>
-        scored: true
-
-      - id: 1.2.26
-        text: "Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate (Automated)"
-        audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep"
-        tests:
-          bin_op: and
-          test_items:
-            - flag: "--tls-cert-file"
-            - flag: "--tls-private-key-file"
-        remediation: |
-          Follow the Kubernetes documentation and set up the TLS connection on the apiserver.
-          Then, edit the API server pod specification file $apiserverconf
-          on the control plane node and set the TLS certificate and private key file parameters.
-          --tls-cert-file=<path/to/tls-certificate-file>
-          --tls-private-key-file=<path/to/tls-key-file>
-        scored: true
-
-      - id: 1.2.27
-        text: "Ensure that the --client-ca-file argument is set as appropriate (Automated)"
-        audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep"
-        tests:
-          test_items:
-            - flag: "--client-ca-file"
-        remediation: |
-          Follow the Kubernetes documentation and set up the TLS connection on the apiserver.
-          Then, edit the API server pod specification file $apiserverconf
-          on the control plane node and set the client certificate authority file.
-          --client-ca-file=<path/to/client-ca-file>
-        scored: true
-
-      - id: 1.2.28
-        text: "Ensure that the --etcd-cafile argument is set as appropriate (Automated)"
-        audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep"
-        tests:
-          test_items:
-            - flag: "--etcd-cafile"
-        remediation: |
-          Follow the Kubernetes documentation and set up the TLS connection between the apiserver and etcd.
-          Then, edit the API server pod specification file $apiserverconf
-          on the control plane node and set the etcd certificate authority file parameter.
-          --etcd-cafile=<path/to/ca-file>
-        scored: true
-
-      - id: 1.2.29
-        text: "Ensure that the --encryption-provider-config argument is set as appropriate (Manual)"
-        audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep"
-        tests:
-          test_items:
-            - flag: "--encryption-provider-config"
-        remediation: |
-          Follow the Kubernetes documentation and configure a EncryptionConfig file.
-          Then, edit the API server pod specification file $apiserverconf
-          on the control plane node and set the --encryption-provider-config parameter to the path of that file.
-          For example, --encryption-provider-config=</path/to/EncryptionConfig/File>
-        scored: false
-
-      - id: 1.2.30
-        text: "Ensure that encryption providers are appropriately configured (Manual)"
-        audit: |
-          ENCRYPTION_PROVIDER_CONFIG=$(ps -ef | grep $apiserverbin | grep -- --encryption-provider-config | sed 's%.*encryption-provider-config[= ]\([^ ]*\).*%\1%')
-          if test -e $ENCRYPTION_PROVIDER_CONFIG; then grep -A1 'providers:' $ENCRYPTION_PROVIDER_CONFIG | tail -n1 | grep -o "[A-Za-z]*" | sed 's/^/provider=/'; fi
-        tests:
-          test_items:
-            - flag: "provider"
-              compare:
-                op: valid_elements
-                value: "aescbc,kms,secretbox"
-        remediation: |
-          Follow the Kubernetes documentation and configure a EncryptionConfig file.
-          In this file, choose aescbc, kms or secretbox as the encryption provider.
-        scored: false
-
-      - id: 1.2.31
-        text: "Ensure that the API Server only makes use of Strong Cryptographic Ciphers (Manual)"
-        audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep"
-        tests:
-          test_items:
-            - flag: "--tls-cipher-suites"
-              compare:
-                op: valid_elements
-                value: "TLS_AES_128_GCM_SHA256,TLS_AES_256_GCM_SHA384,TLS_CHACHA20_POLY1305_SHA256,TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256,TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256,TLS_RSA_WITH_3DES_EDE_CBC_SHA,TLS_RSA_WITH_AES_128_CBC_SHA,TLS_RSA_WITH_AES_128_GCM_SHA256,TLS_RSA_WITH_AES_256_CBC_SHA,TLS_RSA_WITH_AES_256_GCM_SHA384"
-        remediation: |
-          Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml
-          on the control plane node and set the below parameter.
-          --tls-cipher-suites=TLS_AES_128_GCM_SHA256,TLS_AES_256_GCM_SHA384,TLS_CHACHA20_POLY1305_SHA256,
-          TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
-          TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
-          TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256,
-          TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
-          TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,
-          TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256,TLS_RSA_WITH_3DES_EDE_CBC_SHA,TLS_RSA_WITH_AES_128_CBC_SHA,
-          TLS_RSA_WITH_AES_128_GCM_SHA256,TLS_RSA_WITH_AES_256_CBC_SHA,TLS_RSA_WITH_AES_256_GCM_SHA384
-        scored: false
-
-  - id: 1.3
-    text: "Controller Manager"
-    checks:
-      - id: 1.3.1
-        text: "Ensure that the --terminated-pod-gc-threshold argument is set as appropriate (Manual)"
-        audit: "/bin/ps -ef | grep $controllermanagerbin | grep -v grep"
-        tests:
-          test_items:
-            - flag: "--terminated-pod-gc-threshold"
-        remediation: |
-          Edit the Controller Manager pod specification file $controllermanagerconf
-          on the control plane node and set the --terminated-pod-gc-threshold to an appropriate threshold,
-          for example, --terminated-pod-gc-threshold=10
-        scored: false
-
-      - id: 1.3.2
-        text: "Ensure that the --profiling argument is set to false (Automated)"
-        audit: "/bin/ps -ef | grep $controllermanagerbin | grep -v grep"
-        tests:
-          test_items:
-            - flag: "--profiling"
-              compare:
-                op: eq
-                value: false
-        remediation: |
-          Edit the Controller Manager pod specification file $controllermanagerconf
-          on the control plane node and set the below parameter.
-          --profiling=false
-        scored: true
-
-      - id: 1.3.3
-        text: "Ensure that the --use-service-account-credentials argument is set to true (Automated)"
-        audit: "/bin/ps -ef | grep $controllermanagerbin | grep -v grep"
-        tests:
-          test_items:
-            - flag: "--use-service-account-credentials"
-              compare:
-                op: noteq
-                value: false
-        remediation: |
-          Edit the Controller Manager pod specification file $controllermanagerconf
-          on the control plane node to set the below parameter.
-          --use-service-account-credentials=true
-        scored: true
-
-      - id: 1.3.4
-        text: "Ensure that the --service-account-private-key-file argument is set as appropriate (Automated)"
-        audit: "/bin/ps -ef | grep $controllermanagerbin | grep -v grep"
-        tests:
-          test_items:
-            - flag: "--service-account-private-key-file"
-        remediation: |
-          Edit the Controller Manager pod specification file $controllermanagerconf
-          on the control plane node and set the --service-account-private-key-file parameter
-          to the private key file for service accounts.
-          --service-account-private-key-file=<filename>
-        scored: true
-
-      - id: 1.3.5
-        text: "Ensure that the --root-ca-file argument is set as appropriate (Automated)"
-        audit: "/bin/ps -ef | grep $controllermanagerbin | grep -v grep"
-        tests:
-          test_items:
-            - flag: "--root-ca-file"
-        remediation: |
-          Edit the Controller Manager pod specification file $controllermanagerconf
-          on the control plane node and set the --root-ca-file parameter to the certificate bundle file`.
-          --root-ca-file=<path/to/file>
-        scored: true
-
-      - id: 1.3.6
-        text: "Ensure that the RotateKubeletServerCertificate argument is set to true (Automated)"
-        audit: "/bin/ps -ef | grep $controllermanagerbin | grep -v grep"
-        tests:
-          bin_op: or
-          test_items:
-            - flag: "--feature-gates"
-              compare:
-                op: nothave
-                value: "RotateKubeletServerCertificate=false"
-              set: true
-            - flag: "--feature-gates"
-              set: false
-        remediation: |
-          Edit the Controller Manager pod specification file $controllermanagerconf
-          on the control plane node and set the --feature-gates parameter to include RotateKubeletServerCertificate=true.
-          --feature-gates=RotateKubeletServerCertificate=true
-        scored: true
-
-      - id: 1.3.7
-        text: "Ensure that the --bind-address argument is set to 127.0.0.1 (Automated)"
-        audit: "/bin/ps -ef | grep $controllermanagerbin | grep -v grep"
-        tests:
-          bin_op: or
-          test_items:
-            - flag: "--bind-address"
-              compare:
-                op: eq
-                value: "127.0.0.1"
-            - flag: "--bind-address"
-              set: false
-        remediation: |
-          Edit the Controller Manager pod specification file $controllermanagerconf
-          on the control plane node and ensure the correct value for the --bind-address parameter
-        scored: true
-
-  - id: 1.4
-    text: "Scheduler"
-    checks:
-      - id: 1.4.1
-        text: "Ensure that the --profiling argument is set to false (Automated)"
-        audit: "/bin/ps -ef | grep $schedulerbin | grep -v grep"
-        tests:
-          test_items:
-            - flag: "--profiling"
-              compare:
-                op: eq
-                value: false
-        remediation: |
-          Edit the Scheduler pod specification file $schedulerconf file
-          on the control plane node and set the below parameter.
-          --profiling=false
-        scored: true
-
-      - id: 1.4.2
-        text: "Ensure that the --bind-address argument is set to 127.0.0.1 (Automated)"
-        audit: "/bin/ps -ef | grep $schedulerbin | grep -v grep"
-        tests:
-          bin_op: or
-          test_items:
-            - flag: "--bind-address"
-              compare:
-                op: eq
-                value: "127.0.0.1"
-            - flag: "--bind-address"
-              set: false
-        remediation: |
-          Edit the Scheduler pod specification file $schedulerconf
-          on the control plane node and ensure the correct value for the --bind-address parameter
-        scored: true

cfg/cis-1.7/node.yaml

@@ -1,455 +0,0 @@
----
-controls:
-version: "cis-1.7"
-id: 4
-text: "Worker Node Security Configuration"
-type: "node"
-groups:
-  - id: 4.1
-    text: "Worker Node Configuration Files"
-    checks:
-      - id: 4.1.1
-        text: "Ensure that the kubelet service file permissions are set to 600 or more restrictive (Automated)"
-        audit: '/bin/sh -c ''if test -e $kubeletsvc; then stat -c permissions=%a $kubeletsvc; fi'' '
-        tests:
-          test_items:
-            - flag: "permissions"
-              compare:
-                op: bitmask
-                value: "600"
-        remediation: |
-          Run the below command (based on the file location on your system) on the each worker node.
-          For example, chmod 600 $kubeletsvc
-        scored: true
-
-      - id: 4.1.2
-        text: "Ensure that the kubelet service file ownership is set to root:root (Automated)"
-        audit: '/bin/sh -c "if test -e $kubeletsvc; then stat -c %U:%G $kubeletsvc; else echo \"File not found\"; fi"'
-        tests:
-          bin_op: or
-          test_items:
-            - flag: root:root
-            - flag: "File not found"
-        remediation: |
-            Run the below command (based on the file location on your system) on the each worker node.
-            For example,
-            chown root:root $kubeletsvc
-        scored: true
-
-      - id: 4.1.3
-        text: "If proxy kubeconfig file exists ensure permissions are set to 600 or more restrictive (Manual)"
-        audit: '/bin/sh -c ''if test -e $proxykubeconfig; then stat -c permissions=%a $proxykubeconfig; fi'' '
-        tests:
-          bin_op: or
-          test_items:
-            - flag: "permissions"
-              set: true
-              compare:
-                op: bitmask
-                value: "600"
-        remediation: |
-          Run the below command (based on the file location on your system) on the each worker node.
-          For example,
-          chmod 600 $proxykubeconfig
-        scored: false
-
-      - id: 4.1.4
-        text: "If proxy kubeconfig file exists ensure ownership is set to root:root (Manual)"
-        audit: '/bin/sh -c ''if test -e $proxykubeconfig; then stat -c %U:%G $proxykubeconfig; fi'' '
-        tests:
-          bin_op: or
-          test_items:
-            - flag: root:root
-        remediation: |
-          Run the below command (based on the file location on your system) on the each worker node.
-          For example, chown root:root $proxykubeconfig
-        scored: false
-
-      - id: 4.1.5
-        text: "Ensure that the --kubeconfig kubelet.conf file permissions are set to 600 or more restrictive (Automated)"
-        audit: '/bin/sh -c ''if test -e $kubeletkubeconfig; then stat -c permissions=%a $kubeletkubeconfig; fi'' '
-        tests:
-          test_items:
-            - flag: "permissions"
-              compare:
-                op: bitmask
-                value: "600"
-        remediation: |
-          Run the below command (based on the file location on your system) on the each worker node.
-          For example,
-          chmod 600 $kubeletkubeconfig
-        scored: true
-
-      - id: 4.1.6
-        text: "Ensure that the --kubeconfig kubelet.conf file ownership is set to root:root (Automated)"
-        audit: '/bin/sh -c ''if test -e $kubeletkubeconfig; then stat -c %U:%G $kubeletkubeconfig; fi'' '
-        tests:
-          test_items:
-            - flag: root:root
-        remediation: |
-          Run the below command (based on the file location on your system) on the each worker node.
-          For example,
-          chown root:root $kubeletkubeconfig
-        scored: true
-
-      - id: 4.1.7
-        text: "Ensure that the certificate authorities file permissions are set to 600 or more restrictive (Manual)"
-        audit: |
-          CAFILE=$(ps -ef | grep kubelet | grep -v apiserver | grep -- --client-ca-file= | awk -F '--client-ca-file=' '{print $2}' | awk '{print $1}' | uniq)
-          if test -z $CAFILE; then CAFILE=$kubeletcafile; fi
-          if test -e $CAFILE; then stat -c permissions=%a $CAFILE; fi
-        tests:
-          test_items:
-            - flag: "permissions"
-              compare:
-                op: bitmask
-                value: "600"
-        remediation: |
-          Run the following command to modify the file permissions of the
-          --client-ca-file chmod 600 <filename>
-        scored: false
-
-      - id: 4.1.8
-        text: "Ensure that the client certificate authorities file ownership is set to root:root (Manual)"
-        audit: |
-          CAFILE=$(ps -ef | grep kubelet | grep -v apiserver | grep -- --client-ca-file= | awk -F '--client-ca-file=' '{print $2}' | awk '{print $1}' | uniq)
-          if test -z $CAFILE; then CAFILE=$kubeletcafile; fi
-          if test -e $CAFILE; then stat -c %U:%G $CAFILE; fi
-        tests:
-          test_items:
-            - flag: root:root
-              compare:
-                op: eq
-                value: root:root
-        remediation: |
-          Run the following command to modify the ownership of the --client-ca-file.
-          chown root:root <filename>
-        scored: false
-
-      - id: 4.1.9
-        text: "If the kubelet config.yaml configuration file is being used validate permissions set to 600 or more restrictive (Manual)"
-        audit: '/bin/sh -c ''if test -e $kubeletconf; then stat -c permissions=%a $kubeletconf; fi'' '
-        tests:
-          test_items:
-            - flag: "permissions"
-              compare:
-                op: bitmask
-                value: "600"
-        remediation: |
-          Run the following command (using the config file location identified in the Audit step)
-          chmod 600 $kubeletconf
-        scored: false
-
-      - id: 4.1.10
-        text: "If the kubelet config.yaml configuration file is being used validate file ownership is set to root:root (Manual)"
-        audit: '/bin/sh -c ''if test -e $kubeletconf; then stat -c %U:%G $kubeletconf; fi'' '
-        tests:
-          test_items:
-            - flag: root:root
-        remediation: |
-          Run the following command (using the config file location identified in the Audit step)
-          chown root:root $kubeletconf
-        scored: false
-
-  - id: 4.2
-    text: "Kubelet"
-    checks:
-      - id: 4.2.1
-        text: "Ensure that the --anonymous-auth argument is set to false (Automated)"
-        audit: "/bin/ps -fC $kubeletbin"
-        audit_config: "/bin/cat $kubeletconf"
-        tests:
-          test_items:
-            - flag: "--anonymous-auth"
-              path: '{.authentication.anonymous.enabled}'
-              compare:
-                op: eq
-                value: false
-        remediation: |
-          If using a Kubelet config file, edit the file to set `authentication: anonymous: enabled` to
-          `false`.
-          If using executable arguments, edit the kubelet service file
-          $kubeletsvc on each worker node and
-          set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable.
-          `--anonymous-auth=false`
-          Based on your system, restart the kubelet service. For example,
-          systemctl daemon-reload
-          systemctl restart kubelet.service
-        scored: true
-
-      - id: 4.2.2
-        text: "Ensure that the --authorization-mode argument is not set to AlwaysAllow (Automated)"
-        audit: "/bin/ps -fC $kubeletbin"
-        audit_config: "/bin/cat $kubeletconf"
-        tests:
-          test_items:
-            - flag: --authorization-mode
-              path: '{.authorization.mode}'
-              compare:
-                op: nothave
-                value: AlwaysAllow
-        remediation: |
-          If using a Kubelet config file, edit the file to set `authorization.mode` to Webhook. If
-          using executable arguments, edit the kubelet service file
-          $kubeletsvc on each worker node and
-          set the below parameter in KUBELET_AUTHZ_ARGS variable.
-          --authorization-mode=Webhook
-          Based on your system, restart the kubelet service. For example,
-          systemctl daemon-reload
-          systemctl restart kubelet.service
-        scored: true
-
-      - id: 4.2.3
-        text: "Ensure that the --client-ca-file argument is set as appropriate (Automated)"
-        audit: "/bin/ps -fC $kubeletbin"
-        audit_config: "/bin/cat $kubeletconf"
-        tests:
-          test_items:
-            - flag: --client-ca-file
-              path: '{.authentication.x509.clientCAFile}'
-        remediation: |
-          If using a Kubelet config file, edit the file to set `authentication.x509.clientCAFile` to
-          the location of the client CA file.
-          If using command line arguments, edit the kubelet service file
-          $kubeletsvc on each worker node and
-          set the below parameter in KUBELET_AUTHZ_ARGS variable.
-          --client-ca-file=<path/to/client-ca-file>
-          Based on your system, restart the kubelet service. For example,
-          systemctl daemon-reload
-          systemctl restart kubelet.service
-        scored: true
-
-      - id: 4.2.4
-        text: "Verify that the --read-only-port argument is set to 0 (Manual)"
-        audit: "/bin/ps -fC $kubeletbin"
-        audit_config: "/bin/cat $kubeletconf"
-        tests:
-          bin_op: or
-          test_items:
-            - flag: "--read-only-port"
-              path: '{.readOnlyPort}'
-              compare:
-                op: eq
-                value: 0
-            - flag: "--read-only-port"
-              path: '{.readOnlyPort}'
-              set: false
-        remediation: |
-          If using a Kubelet config file, edit the file to set `readOnlyPort` to 0.
-          If using command line arguments, edit the kubelet service file
-          $kubeletsvc on each worker node and
-          set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable.
-          --read-only-port=0
-          Based on your system, restart the kubelet service. For example,
-          systemctl daemon-reload
-          systemctl restart kubelet.service
-        scored: false
-
-      - id: 4.2.5
-        text: "Ensure that the --streaming-connection-idle-timeout argument is not set to 0 (Manual)"
-        audit: "/bin/ps -fC $kubeletbin"
-        audit_config: "/bin/cat $kubeletconf"
-        tests:
-          test_items:
-            - flag: --streaming-connection-idle-timeout
-              path: '{.streamingConnectionIdleTimeout}'
-              compare:
-                op: noteq
-                value: 0
-            - flag: --streaming-connection-idle-timeout
-              path: '{.streamingConnectionIdleTimeout}'
-              set: false
-          bin_op: or
-        remediation: |
-          If using a Kubelet config file, edit the file to set `streamingConnectionIdleTimeout` to a
-          value other than 0.
-          If using command line arguments, edit the kubelet service file
-          $kubeletsvc on each worker node and
-          set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable.
-          --streaming-connection-idle-timeout=5m
-          Based on your system, restart the kubelet service. For example,
-          systemctl daemon-reload
-          systemctl restart kubelet.service
-        scored: false
-
-      - id: 4.2.6
-        text: "Ensure that the --make-iptables-util-chains argument is set to true (Automated)"
-        audit: "/bin/ps -fC $kubeletbin"
-        audit_config: "/bin/cat $kubeletconf"
-        tests:
-          test_items:
-            - flag: --make-iptables-util-chains
-              path: '{.makeIPTablesUtilChains}'
-              compare:
-                op: eq
-                value: true
-            - flag: --make-iptables-util-chains
-              path: '{.makeIPTablesUtilChains}'
-              set: false
-          bin_op: or
-        remediation: |
-          If using a Kubelet config file, edit the file to set `makeIPTablesUtilChains` to `true`.
-          If using command line arguments, edit the kubelet service file
-          $kubeletsvc on each worker node and
-          remove the --make-iptables-util-chains argument from the
-          KUBELET_SYSTEM_PODS_ARGS variable.
-          Based on your system, restart the kubelet service. For example:
-          systemctl daemon-reload
-          systemctl restart kubelet.service
-        scored: true
-
-      - id: 4.2.7
-        text: "Ensure that the --hostname-override argument is not set (Manual)"
-        # This is one of those properties that can only be set as a command line argument.
-        # To check if the property is set as expected, we need to parse the kubelet command
-        # instead reading the Kubelet Configuration file.
-        audit: "/bin/ps -fC $kubeletbin "
-        tests:
-          test_items:
-            - flag: --hostname-override
-              set: false
-        remediation: |
-          Edit the kubelet service file $kubeletsvc
-          on each worker node and remove the --hostname-override argument from the
-          KUBELET_SYSTEM_PODS_ARGS variable.
-          Based on your system, restart the kubelet service. For example,
-          systemctl daemon-reload
-          systemctl restart kubelet.service
-        scored: false
-
-      - id: 4.2.8
-        text: "Ensure that the eventRecordQPS argument is set to a level which ensures appropriate event capture (Manual)"
-        audit: "/bin/ps -fC $kubeletbin"
-        audit_config: "/bin/cat $kubeletconf"
-        tests:
-          test_items:
-            - flag: --event-qps
-              path: '{.eventRecordQPS}'
-              compare:
-                op: gte
-                value: 0
-            - flag: --event-qps
-              path: '{.eventRecordQPS}'
-              set: false
-          bin_op: or
-        remediation: |
-          If using a Kubelet config file, edit the file to set `eventRecordQPS` to an appropriate level.
-          If using command line arguments, edit the kubelet service file
-          $kubeletsvc on each worker node and
-          set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable.
-          Based on your system, restart the kubelet service. For example,
-          systemctl daemon-reload
-          systemctl restart kubelet.service
-        scored: false
-
-      - id: 4.2.9
-        text: "Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate (Manual)"
-        audit: "/bin/ps -fC $kubeletbin"
-        audit_config: "/bin/cat $kubeletconf"
-        tests:
-          test_items:
-            - flag: --tls-cert-file
-              path: '{.tlsCertFile}'
-            - flag: --tls-private-key-file
-              path: '{.tlsPrivateKeyFile}'
-        remediation: |
-          If using a Kubelet config file, edit the file to set `tlsCertFile` to the location
-          of the certificate file to use to identify this Kubelet, and `tlsPrivateKeyFile`
-          to the location of the corresponding private key file.
-          If using command line arguments, edit the kubelet service file
-          $kubeletsvc on each worker node and
-          set the below parameters in KUBELET_CERTIFICATE_ARGS variable.
-          --tls-cert-file=<path/to/tls-certificate-file>
-          --tls-private-key-file=<path/to/tls-key-file>
-          Based on your system, restart the kubelet service. For example,
-          systemctl daemon-reload
-          systemctl restart kubelet.service
-        scored: false
-
-      - id: 4.2.10
-        text: "Ensure that the --rotate-certificates argument is not set to false (Automated)"
-        audit: "/bin/ps -fC $kubeletbin"
-        audit_config: "/bin/cat $kubeletconf"
-        tests:
-          test_items:
-            - flag: --rotate-certificates
-              path: '{.rotateCertificates}'
-              compare:
-                op: eq
-                value: true
-            - flag: --rotate-certificates
-              path: '{.rotateCertificates}'
-              set: false
-          bin_op: or
-        remediation: |
-          If using a Kubelet config file, edit the file to add the line `rotateCertificates` to `true` or
-          remove it altogether to use the default value.
-          If using command line arguments, edit the kubelet service file
-          $kubeletsvc on each worker node and
-          remove --rotate-certificates=false argument from the KUBELET_CERTIFICATE_ARGS
-          variable.
-          Based on your system, restart the kubelet service. For example,
-          systemctl daemon-reload
-          systemctl restart kubelet.service
-        scored: true
-
-      - id: 4.2.11
-        text: "Verify that the RotateKubeletServerCertificate argument is set to true (Manual)"
-        audit: "/bin/ps -fC $kubeletbin"
-        audit_config: "/bin/cat $kubeletconf"
-        tests:
-          bin_op: or
-          test_items:
-            - flag: RotateKubeletServerCertificate
-              path: '{.featureGates.RotateKubeletServerCertificate}'
-              compare:
-                op: nothave
-                value: false
-            - flag: RotateKubeletServerCertificate
-              path: '{.featureGates.RotateKubeletServerCertificate}'
-              set: false
-        remediation: |
-          Edit the kubelet service file $kubeletsvc
-          on each worker node and set the below parameter in KUBELET_CERTIFICATE_ARGS variable.
-          --feature-gates=RotateKubeletServerCertificate=true
-          Based on your system, restart the kubelet service. For example:
-          systemctl daemon-reload
-          systemctl restart kubelet.service
-        scored: false
-
-      - id: 4.2.12
-        text: "Ensure that the Kubelet only makes use of Strong Cryptographic Ciphers (Manual)"
-        audit: "/bin/ps -fC $kubeletbin"
-        audit_config: "/bin/cat $kubeletconf"
-        tests:
-          test_items:
-            - flag: --tls-cipher-suites
-              path: '{range .tlsCipherSuites[:]}{}{'',''}{end}'
-              compare:
-                op: valid_elements
-                value: TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256
-        remediation: |
-          If using a Kubelet config file, edit the file to set `tlsCipherSuites` to
-          TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256
-          or to a subset of these values.
-          If using executable arguments, edit the kubelet service file
-          $kubeletsvc on each worker node and
-          set the --tls-cipher-suites parameter as follows, or to a subset of these values.
-          --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256
-          Based on your system, restart the kubelet service. For example:
-          systemctl daemon-reload
-          systemctl restart kubelet.service
-        scored: false
-
-      - id: 4.2.13
-        text: "Ensure that a limit is set on pod PIDs (Manual)"
-        audit: "/bin/ps -fC $kubeletbin"
-        audit_config: "/bin/cat $kubeletconf"
-        tests:
-          test_items:
-            - flag: --pod-max-pids
-              path: '{.podPidsLimit}'
-        remediation: |
-          Decide on an appropriate level for this parameter and set it,
-          either via the --pod-max-pids command line parameter or the PodPidsLimit configuration file setting.
-        scored: false

cfg/cis-1.7/policies.yaml

@@ -1,304 +0,0 @@
----
-controls:
-version: "cis-1.7"
-id: 5
-text: "Kubernetes Policies"
-type: "policies"
-groups:
-  - id: 5.1
-    text: "RBAC and Service Accounts"
-    checks:
-      - id: 5.1.1
-        text: "Ensure that the cluster-admin role is only used where required (Manual)"
-        type: "manual"
-        remediation: |
-          Identify all clusterrolebindings to the cluster-admin role. Check if they are used and
-          if they need this role or if they could use a role with fewer privileges.
-          Where possible, first bind users to a lower privileged role and then remove the
-          clusterrolebinding to the cluster-admin role :
-          kubectl delete clusterrolebinding [name]
-        scored: false
-
-      - id: 5.1.2
-        text: "Minimize access to secrets (Manual)"
-        type: "manual"
-        remediation: |
-          Where possible, remove get, list and watch access to Secret objects in the cluster.
-        scored: false
-
-      - id: 5.1.3
-        text: "Minimize wildcard use in Roles and ClusterRoles (Manual)"
-        type: "manual"
-        remediation: |
-          Where possible replace any use of wildcards in clusterroles and roles with specific
-          objects or actions.
-        scored: false
-
-      - id: 5.1.4
-        text: "Minimize access to create pods (Manual)"
-        type: "manual"
-        remediation: |
-          Where possible, remove create access to pod objects in the cluster.
-        scored: false
-
-      - id: 5.1.5
-        text: "Ensure that default service accounts are not actively used. (Manual)"
-        type: "manual"
-        remediation: |
-          Create explicit service accounts wherever a Kubernetes workload requires specific access
-          to the Kubernetes API server.
-          Modify the configuration of each default service account to include this value
-          automountServiceAccountToken: false
-        scored: false
-
-      - id: 5.1.6
-        text: "Ensure that Service Account Tokens are only mounted where necessary (Manual)"
-        type: "manual"
-        remediation: |
-          Modify the definition of pods and service accounts which do not need to mount service
-          account tokens to disable it.
-        scored: false
-
-      - id: 5.1.7
-        text: "Avoid use of system:masters group (Manual)"
-        type: "manual"
-        remediation: |
-          Remove the system:masters group from all users in the cluster.
-        scored: false
-
-      - id: 5.1.8
-        text: "Limit use of the Bind, Impersonate and Escalate permissions in the Kubernetes cluster (Manual)"
-        type: "manual"
-        remediation: |
-          Where possible, remove the impersonate, bind and escalate rights from subjects.
-        scored: false
-
-      - id: 5.1.9
-        text: "Minimize access to create persistent volumes (Manual)"
-        type: "manual"
-        remediation: |
-          Where possible, remove create access to PersistentVolume objects in the cluster.
-        scored: false
-
-      - id: 5.1.10
-        text: "Minimize access to the proxy sub-resource of nodes (Manual)"
-        type: "manual"
-        remediation: |
-          Where possible, remove access to the proxy sub-resource of node objects.
-        scored: false
-
-      - id: 5.1.11
-        text: "Minimize access to the approval sub-resource of certificatesigningrequests objects (Manual)"
-        type: "manual"
-        remediation: |
-          Where possible, remove access to the approval sub-resource of certificatesigningrequest objects.
-        scored: false
-
-      - id: 5.1.12
-        text: "Minimize access to webhook configuration objects (Manual)"
-        type: "manual"
-        remediation: |
-          Where possible, remove access to the validatingwebhookconfigurations or mutatingwebhookconfigurations objects
-        scored: false
-
-      - id: 5.1.13
-        text: "Minimize access to the service account token creation (Manual)"
-        type: "manual"
-        remediation: |
-          Where possible, remove access to the token sub-resource of serviceaccount objects.
-        scored: false
-
-  - id: 5.2
-    text: "Pod Security Standards"
-    checks:
-      - id: 5.2.1
-        text: "Ensure that the cluster has at least one active policy control mechanism in place (Manual)"
-        type: "manual"
-        remediation: |
-          Ensure that either Pod Security Admission or an external policy control system is in place
-          for every namespace which contains user workloads.
-        scored: false
-
-      - id: 5.2.2
-        text: "Minimize the admission of privileged containers (Manual)"
-        type: "manual"
-        remediation: |
-          Add policies to each namespace in the cluster which has user workloads to restrict the
-          admission of privileged containers.
-        scored: false
-
-      - id: 5.2.3
-        text: "Minimize the admission of containers wishing to share the host process ID namespace (Automated)"
-        type: "manual"
-        remediation: |
-          Add policies to each namespace in the cluster which has user workloads to restrict the
-          admission of `hostPID` containers.
-        scored: false
-
-      - id: 5.2.4
-        text: "Minimize the admission of containers wishing to share the host IPC namespace (Automated)"
-        type: "manual"
-        remediation: |
-          Add policies to each namespace in the cluster which has user workloads to restrict the
-          admission of `hostIPC` containers.
-        scored: false
-
-      - id: 5.2.5
-        text: "Minimize the admission of containers wishing to share the host network namespace (Automated)"
-        type: "manual"
-        remediation: |
-          Add policies to each namespace in the cluster which has user workloads to restrict the
-          admission of `hostNetwork` containers.
-        scored: false
-
-      - id: 5.2.6
-        text: "Minimize the admission of containers with allowPrivilegeEscalation (Automated)"
-        type: "manual"
-        remediation: |
-          Add policies to each namespace in the cluster which has user workloads to restrict the
-          admission of containers with `.spec.allowPrivilegeEscalation` set to `true`.
-        scored: false
-
-      - id: 5.2.7
-        text: "Minimize the admission of root containers (Automated)"
-        type: "manual"
-        remediation: |
-          Create a policy for each namespace in the cluster, ensuring that either `MustRunAsNonRoot`
-          or `MustRunAs` with the range of UIDs not including 0, is set.
-        scored: false
-
-      - id: 5.2.8
-        text: "Minimize the admission of containers with the NET_RAW capability (Automated)"
-        type: "manual"
-        remediation: |
-          Add policies to each namespace in the cluster which has user workloads to restrict the
-          admission of containers with the `NET_RAW` capability.
-        scored: false
-
-      - id: 5.2.9
-        text: "Minimize the admission of containers with added capabilities (Automated)"
-        type: "manual"
-        remediation: |
-          Ensure that `allowedCapabilities` is not present in policies for the cluster unless
-          it is set to an empty array.
-        scored: false
-
-      - id: 5.2.10
-        text: "Minimize the admission of containers with capabilities assigned (Manual)"
-        type: "manual"
-        remediation: |
-          Review the use of capabilites in applications running on your cluster. Where a namespace
-          contains applications which do not require any Linux capabities to operate consider adding
-          a PSP which forbids the admission of containers which do not drop all capabilities.
-        scored: false
-
-      - id: 5.2.11
-        text: "Minimize the admission of Windows HostProcess containers (Manual)"
-        type: "manual"
-        remediation: |
-          Add policies to each namespace in the cluster which has user workloads to restrict the
-          admission of containers that have `.securityContext.windowsOptions.hostProcess` set to `true`.
-        scored: false
-
-      - id: 5.2.12
-        text: "Minimize the admission of HostPath volumes (Manual)"
-        type: "manual"
-        remediation: |
-          Add policies to each namespace in the cluster which has user workloads to restrict the
-          admission of containers with `hostPath` volumes.
-        scored: false
-
-      - id: 5.2.13
-        text: "Minimize the admission of containers which use HostPorts (Manual)"
-        type: "manual"
-        remediation: |
-          Add policies to each namespace in the cluster which has user workloads to restrict the
-          admission of containers which use `hostPort` sections.
-        scored: false
-
-  - id: 5.3
-    text: "Network Policies and CNI"
-    checks:
-      - id: 5.3.1
-        text: "Ensure that the CNI in use supports NetworkPolicies (Manual)"
-        type: "manual"
-        remediation: |
-          If the CNI plugin in use does not support network policies, consideration should be given to
-          making use of a different plugin, or finding an alternate mechanism for restricting traffic
-          in the Kubernetes cluster.
-        scored: false
-
-      - id: 5.3.2
-        text: "Ensure that all Namespaces have NetworkPolicies defined (Manual)"
-        type: "manual"
-        remediation: |
-          Follow the documentation and create NetworkPolicy objects as you need them.
-        scored: false
-
-  - id: 5.4
-    text: "Secrets Management"
-    checks:
-      - id: 5.4.1
-        text: "Prefer using Secrets as files over Secrets as environment variables (Manual)"
-        type: "manual"
-        remediation: |
-          If possible, rewrite application code to read Secrets from mounted secret files, rather than
-          from environment variables.
-        scored: false
-
-      - id: 5.4.2
-        text: "Consider external secret storage (Manual)"
-        type: "manual"
-        remediation: |
-          Refer to the Secrets management options offered by your cloud provider or a third-party
-          secrets management solution.
-        scored: false
-
-  - id: 5.5
-    text: "Extensible Admission Control"
-    checks:
-      - id: 5.5.1
-        text: "Configure Image Provenance using ImagePolicyWebhook admission controller (Manual)"
-        type: "manual"
-        remediation: |
-          Follow the Kubernetes documentation and setup image provenance.
-        scored: false
-
-  - id: 5.7
-    text: "General Policies"
-    checks:
-      - id: 5.7.1
-        text: "Create administrative boundaries between resources using namespaces (Manual)"
-        type: "manual"
-        remediation: |
-          Follow the documentation and create namespaces for objects in your deployment as you need
-          them.
-        scored: false
-
-      - id: 5.7.2
-        text: "Ensure that the seccomp profile is set to docker/default in your Pod definitions (Manual)"
-        type: "manual"
-        remediation: |
-          Use `securityContext` to enable the docker/default seccomp profile in your pod definitions.
-          An example is as below:
-            securityContext:
-              seccompProfile:
-                type: RuntimeDefault
-        scored: false
-
-      - id: 5.7.3
-        text: "Apply SecurityContext to your Pods and Containers (Manual)"
-        type: "manual"
-        remediation: |
-          Follow the Kubernetes documentation and apply SecurityContexts to your Pods. For a
-          suggested list of SecurityContexts, you may refer to the CIS Security Benchmark for Docker
-          Containers.
-        scored: false
-
-      - id: 5.7.4
-        text: "The default namespace should not be used (Manual)"
-        type: "manual"
-        remediation: |
-          Ensure that namespaces are created to allow for appropriate segregation of Kubernetes
-          resources and that all new resources are created in a specific namespace.
-        scored: false

cfg/cis-1.8/config.yaml

@@ -1,2 +0,0 @@
----
-## Version-specific settings that override the values in cfg/config.yaml

cfg/cis-1.8/controlplane.yaml

@@ -1,60 +0,0 @@
----
-controls:
-version: "cis-1.8"
-id: 3
-text: "Control Plane Configuration"
-type: "controlplane"
-groups:
-  - id: 3.1
-    text: "Authentication and Authorization"
-    checks:
-      - id: 3.1.1
-        text: "Client certificate authentication should not be used for users (Manual)"
-        type: "manual"
-        remediation: |
-          Alternative mechanisms provided by Kubernetes such as the use of OIDC should be
-          implemented in place of client certificates.
-        scored: false
-      - id: 3.1.2
-        text: "Service account token authentication should not be used for users (Manual)"
-        type: "manual"
-        remediation: |
-          Alternative mechanisms provided by Kubernetes such as the use of OIDC should be implemented
-          in place of service account tokens.
-        scored: false
-      - id: 3.1.3
-        text: "Bootstrap token authentication should not be used for users (Manual)"
-        type: "manual"
-        remediation: |
-          Alternative mechanisms provided by Kubernetes such as the use of OIDC should be implemented
-          in place of bootstrap tokens.
-        scored: false
-
-  - id: 3.2
-    text: "Logging"
-    checks:
-      - id: 3.2.1
-        text: "Ensure that a minimal audit policy is created (Manual)"
-        audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep"
-        tests:
-          test_items:
-            - flag: "--audit-policy-file"
-              set: true
-        remediation: |
-          Create an audit policy file for your cluster.
-        scored: false
-
-      - id: 3.2.2
-        text: "Ensure that the audit policy covers key security concerns (Manual)"
-        type: "manual"
-        remediation: |
-          Review the audit policy provided for the cluster and ensure that it covers
-          at least the following areas,
-          - Access to Secrets managed by the cluster. Care should be taken to only
-            log Metadata for requests to Secrets, ConfigMaps, and TokenReviews, in
-            order to avoid risk of logging sensitive data.
-          - Modification of Pod and Deployment objects.
-          - Use of `pods/exec`, `pods/portforward`, `pods/proxy` and `services/proxy`.
-          For most requests, minimally logging at the Metadata level is recommended
-          (the most basic level of logging).
-        scored: false

cfg/cis-1.8/etcd.yaml

@@ -1,135 +0,0 @@
----
-controls:
-version: "cis-1.8"
-id: 2
-text: "Etcd Node Configuration"
-type: "etcd"
-groups:
-  - id: 2
-    text: "Etcd Node Configuration"
-    checks:
-      - id: 2.1
-        text: "Ensure that the --cert-file and --key-file arguments are set as appropriate (Automated)"
-        audit: "/bin/ps -ef | /bin/grep $etcdbin | /bin/grep -v grep"
-        tests:
-          bin_op: and
-          test_items:
-            - flag: "--cert-file"
-              env: "ETCD_CERT_FILE"
-            - flag: "--key-file"
-              env: "ETCD_KEY_FILE"
-        remediation: |
-          Follow the etcd service documentation and configure TLS encryption.
-          Then, edit the etcd pod specification file /etc/kubernetes/manifests/etcd.yaml
-          on the master node and set the below parameters.
-          --cert-file=</path/to/ca-file>
-          --key-file=</path/to/key-file>
-        scored: true
-
-      - id: 2.2
-        text: "Ensure that the --client-cert-auth argument is set to true (Automated)"
-        audit: "/bin/ps -ef | /bin/grep $etcdbin | /bin/grep -v grep"
-        tests:
-          test_items:
-            - flag: "--client-cert-auth"
-              env: "ETCD_CLIENT_CERT_AUTH"
-              compare:
-                op: eq
-                value: true
-        remediation: |
-          Edit the etcd pod specification file $etcdconf on the master
-          node and set the below parameter.
-          --client-cert-auth="true"
-        scored: true
-
-      - id: 2.3
-        text: "Ensure that the --auto-tls argument is not set to true (Automated)"
-        audit: "/bin/ps -ef | /bin/grep $etcdbin | /bin/grep -v grep"
-        tests:
-          bin_op: or
-          test_items:
-            - flag: "--auto-tls"
-              env: "ETCD_AUTO_TLS"
-              set: false
-            - flag: "--auto-tls"
-              env: "ETCD_AUTO_TLS"
-              compare:
-                op: eq
-                value: false
-        remediation: |
-          Edit the etcd pod specification file $etcdconf on the master
-          node and either remove the --auto-tls parameter or set it to false.
-            --auto-tls=false
-        scored: true
-
-      - id: 2.4
-        text: "Ensure that the --peer-cert-file and --peer-key-file arguments are
-        set as appropriate (Automated)"
-        audit: "/bin/ps -ef | /bin/grep $etcdbin | /bin/grep -v grep"
-        tests:
-          bin_op: and
-          test_items:
-            - flag: "--peer-cert-file"
-              env: "ETCD_PEER_CERT_FILE"
-            - flag: "--peer-key-file"
-              env: "ETCD_PEER_KEY_FILE"
-        remediation: |
-          Follow the etcd service documentation and configure peer TLS encryption as appropriate
-          for your etcd cluster.
-          Then, edit the etcd pod specification file $etcdconf on the
-          master node and set the below parameters.
-          --peer-client-file=</path/to/peer-cert-file>
-          --peer-key-file=</path/to/peer-key-file>
-        scored: true
-
-      - id: 2.5
-        text: "Ensure that the --peer-client-cert-auth argument is set to true (Automated)"
-        audit: "/bin/ps -ef | /bin/grep $etcdbin | /bin/grep -v grep"
-        tests:
-          test_items:
-            - flag: "--peer-client-cert-auth"
-              env: "ETCD_PEER_CLIENT_CERT_AUTH"
-              compare:
-                op: eq
-                value: true
-        remediation: |
-          Edit the etcd pod specification file $etcdconf on the master
-          node and set the below parameter.
-          --peer-client-cert-auth=true
-        scored: true
-
-      - id: 2.6
-        text: "Ensure that the --peer-auto-tls argument is not set to true (Automated)"
-        audit: "/bin/ps -ef | /bin/grep $etcdbin | /bin/grep -v grep"
-        tests:
-          bin_op: or
-          test_items:
-            - flag: "--peer-auto-tls"
-              env: "ETCD_PEER_AUTO_TLS"
-              set: false
-            - flag: "--peer-auto-tls"
-              env: "ETCD_PEER_AUTO_TLS"
-              compare:
-                op: eq
-                value: false
-        remediation: |
-          Edit the etcd pod specification file $etcdconf on the master
-          node and either remove the --peer-auto-tls parameter or set it to false.
-          --peer-auto-tls=false
-        scored: true
-
-      - id: 2.7
-        text: "Ensure that a unique Certificate Authority is used for etcd (Manual)"
-        audit: "/bin/ps -ef | /bin/grep $etcdbin | /bin/grep -v grep"
-        tests:
-          test_items:
-            - flag: "--trusted-ca-file"
-              env: "ETCD_TRUSTED_CA_FILE"
-        remediation: |
-          [Manual test]
-          Follow the etcd documentation and create a dedicated certificate authority setup for the
-          etcd service.
-          Then, edit the etcd pod specification file $etcdconf on the
-          master node and set the below parameter.
-          --trusted-ca-file=</path/to/ca-file>
-        scored: false

cfg/cis-1.8/master.yaml

@@ -1,928 +0,0 @@
----
-controls:
-version: "cis-1.8"
-id: 1
-text: "Control Plane Security Configuration"
-type: "master"
-groups:
-  - id: 1.1
-    text: "Control Plane Node Configuration Files"
-    checks:
-      - id: 1.1.1
-        text: "Ensure that the API server pod specification file permissions are set to 600 or more restrictive (Automated)"
-        audit: "/bin/sh -c 'if test -e $apiserverconf; then stat -c permissions=%a $apiserverconf; fi'"
-        tests:
-          test_items:
-            - flag: "permissions"
-              compare:
-                op: bitmask
-                value: "600"
-        remediation: |
-          Run the below command (based on the file location on your system) on the
-          control plane node.
-          For example, chmod 600 $apiserverconf
-        scored: true
-
-      - id: 1.1.2
-        text: "Ensure that the API server pod specification file ownership is set to root:root (Automated)"
-        audit: "/bin/sh -c 'if test -e $apiserverconf; then stat -c %U:%G $apiserverconf; fi'"
-        tests:
-          test_items:
-            - flag: "root:root"
-        remediation: |
-          Run the below command (based on the file location on your system) on the control plane node.
-          For example, chown root:root $apiserverconf
-        scored: true
-
-      - id: 1.1.3
-        text: "Ensure that the controller manager pod specification file permissions are set to 600 or more restrictive (Automated)"
-        audit: "/bin/sh -c 'if test -e $controllermanagerconf; then stat -c permissions=%a $controllermanagerconf; fi'"
-        tests:
-          test_items:
-            - flag: "permissions"
-              compare:
-                op: bitmask
-                value: "600"
-        remediation: |
-          Run the below command (based on the file location on your system) on the control plane node.
-          For example, chmod 600 $controllermanagerconf
-        scored: true
-
-      - id: 1.1.4
-        text: "Ensure that the controller manager pod specification file ownership is set to root:root (Automated)"
-        audit: "/bin/sh -c 'if test -e $controllermanagerconf; then stat -c %U:%G $controllermanagerconf; fi'"
-        tests:
-          test_items:
-            - flag: "root:root"
-        remediation: |
-          Run the below command (based on the file location on your system) on the control plane node.
-          For example, chown root:root $controllermanagerconf
-        scored: true
-
-      - id: 1.1.5
-        text: "Ensure that the scheduler pod specification file permissions are set to 600 or more restrictive (Automated)"
-        audit: "/bin/sh -c 'if test -e $schedulerconf; then stat -c permissions=%a $schedulerconf; fi'"
-        tests:
-          test_items:
-            - flag: "permissions"
-              compare:
-                op: bitmask
-                value: "600"
-        remediation: |
-          Run the below command (based on the file location on your system) on the control plane node.
-          For example, chmod 600 $schedulerconf
-        scored: true
-
-      - id: 1.1.6
-        text: "Ensure that the scheduler pod specification file ownership is set to root:root (Automated)"
-        audit: "/bin/sh -c 'if test -e $schedulerconf; then stat -c %U:%G $schedulerconf; fi'"
-        tests:
-          test_items:
-            - flag: "root:root"
-        remediation: |
-          Run the below command (based on the file location on your system) on the control plane node.
-          For example, chown root:root $schedulerconf
-        scored: true
-
-      - id: 1.1.7
-        text: "Ensure that the etcd pod specification file permissions are set to 600 or more restrictive (Automated)"
-        audit: "/bin/sh -c 'if test -e $etcdconf; then find $etcdconf -name '*etcd*' | xargs stat -c permissions=%a; fi'"
-        use_multiple_values: true
-        tests:
-          test_items:
-            - flag: "permissions"
-              compare:
-                op: bitmask
-                value: "600"
-        remediation: |
-          Run the below command (based on the file location on your system) on the control plane node.
-          For example,
-          chmod 600 $etcdconf
-        scored: true
-
-      - id: 1.1.8
-        text: "Ensure that the etcd pod specification file ownership is set to root:root (Automated)"
-        audit: "/bin/sh -c 'if test -e $etcdconf; then find $etcdconf -name '*etcd*' | xargs stat -c %U:%G; fi'"
-        use_multiple_values: true
-        tests:
-          test_items:
-            - flag: "root:root"
-        remediation: |
-          Run the below command (based on the file location on your system) on the control plane node.
-          For example,
-          chown root:root $etcdconf
-        scored: true
-
-      - id: 1.1.9
-        text: "Ensure that the Container Network Interface file permissions are set to 600 or more restrictive (Manual)"
-        audit: |
-          ps -ef | grep $kubeletbin | grep -- --cni-conf-dir | sed 's%.*cni-conf-dir[= ]\([^ ]*\).*%\1%' | xargs -I{} find {} -mindepth 1 | xargs --no-run-if-empty stat -c permissions=%a
-          find /var/lib/cni/networks -type f 2> /dev/null | xargs --no-run-if-empty stat -c permissions=%a
-        use_multiple_values: true
-        tests:
-          test_items:
-            - flag: "permissions"
-              compare:
-                op: bitmask
-                value: "600"
-        remediation: |
-          Run the below command (based on the file location on your system) on the control plane node.
-          For example, chmod 600 <path/to/cni/files>
-        scored: false
-
-      - id: 1.1.10
-        text: "Ensure that the Container Network Interface file ownership is set to root:root (Manual)"
-        audit: |
-          ps -ef | grep $kubeletbin | grep -- --cni-conf-dir | sed 's%.*cni-conf-dir[= ]\([^ ]*\).*%\1%' | xargs -I{} find {} -mindepth 1 | xargs --no-run-if-empty stat -c %U:%G
-          find /var/lib/cni/networks -type f 2> /dev/null | xargs --no-run-if-empty stat -c %U:%G
-        use_multiple_values: true
-        tests:
-          test_items:
-            - flag: "root:root"
-        remediation: |
-          Run the below command (based on the file location on your system) on the control plane node.
-          For example,
-          chown root:root <path/to/cni/files>
-        scored: false
-
-      - id: 1.1.11
-        text: "Ensure that the etcd data directory permissions are set to 700 or more restrictive (Automated)"
-        audit: |
-          DATA_DIR=''
-          for d in $(ps -ef | grep $etcdbin | grep -- --data-dir | sed 's%.*data-dir[= ]\([^ ]*\).*%\1%'); do
-            if test -d "$d"; then DATA_DIR="$d"; fi
-          done
-          if ! test -d "$DATA_DIR"; then DATA_DIR=$etcddatadir; fi
-          stat -c permissions=%a "$DATA_DIR"
-        tests:
-          test_items:
-            - flag: "permissions"
-              compare:
-                op: bitmask
-                value: "700"
-        remediation: |
-          On the etcd server node, get the etcd data directory, passed as an argument --data-dir,
-          from the command 'ps -ef | grep etcd'.
-          Run the below command (based on the etcd data directory found above). For example,
-          chmod 700 /var/lib/etcd
-        scored: true
-
-      - id: 1.1.12
-        text: "Ensure that the etcd data directory ownership is set to etcd:etcd (Automated)"
-        audit: |
-          DATA_DIR=''
-          for d in $(ps -ef | grep $etcdbin | grep -- --data-dir | sed 's%.*data-dir[= ]\([^ ]*\).*%\1%'); do
-            if test -d "$d"; then DATA_DIR="$d"; fi
-          done
-          if ! test -d "$DATA_DIR"; then DATA_DIR=$etcddatadir; fi
-          stat -c %U:%G "$DATA_DIR"
-        tests:
-          test_items:
-            - flag: "etcd:etcd"
-        remediation: |
-          On the etcd server node, get the etcd data directory, passed as an argument --data-dir,
-          from the command 'ps -ef | grep etcd'.
-          Run the below command (based on the etcd data directory found above).
-          For example, chown etcd:etcd /var/lib/etcd
-        scored: true
-
-      - id: 1.1.13
-        text: "Ensure that the admin.conf file permissions are set to 600 or more restrictive (Automated)"
-        audit: "/bin/sh -c 'if test -e /etc/kubernetes/admin.conf; then stat -c permissions=%a /etc/kubernetes/admin.conf; fi'"
-        tests:
-          test_items:
-            - flag: "permissions"
-              compare:
-                op: bitmask
-                value: "600"
-        remediation: |
-          Run the below command (based on the file location on your system) on the control plane node.
-          For example, chmod 600 /etc/kubernetes/admin.conf
-        scored: true
-
-      - id: 1.1.14
-        text: "Ensure that the admin.conf file ownership is set to root:root (Automated)"
-        audit: "/bin/sh -c 'if test -e /etc/kubernetes/admin.conf; then stat -c %U:%G /etc/kubernetes/admin.conf; fi'"
-        tests:
-          test_items:
-            - flag: "root:root"
-        remediation: |
-          Run the below command (based on the file location on your system) on the control plane node.
-          For example, chown root:root /etc/kubernetes/admin.conf
-        scored: true
-
-      - id: 1.1.15
-        text: "Ensure that the scheduler.conf file permissions are set to 600 or more restrictive (Automated)"
-        audit: "/bin/sh -c 'if test -e $schedulerkubeconfig; then stat -c permissions=%a $schedulerkubeconfig; fi'"
-        tests:
-          test_items:
-            - flag: "permissions"
-              compare:
-                op: bitmask
-                value: "600"
-        remediation: |
-          Run the below command (based on the file location on your system) on the control plane node.
-          For example,
-          chmod 600 $schedulerkubeconfig
-        scored: true
-
-      - id: 1.1.16
-        text: "Ensure that the scheduler.conf file ownership is set to root:root (Automated)"
-        audit: "/bin/sh -c 'if test -e $schedulerkubeconfig; then stat -c %U:%G $schedulerkubeconfig; fi'"
-        tests:
-          test_items:
-            - flag: "root:root"
-        remediation: |
-          Run the below command (based on the file location on your system) on the control plane node.
-          For example,
-          chown root:root $schedulerkubeconfig
-        scored: true
-
-      - id: 1.1.17
-        text: "Ensure that the controller-manager.conf file permissions are set to 600 or more restrictive (Automated)"
-        audit: "/bin/sh -c 'if test -e $controllermanagerkubeconfig; then stat -c permissions=%a $controllermanagerkubeconfig; fi'"
-        tests:
-          test_items:
-            - flag: "permissions"
-              compare:
-                op: bitmask
-                value: "600"
-        remediation: |
-          Run the below command (based on the file location on your system) on the control plane node.
-          For example,
-          chmod 600 $controllermanagerkubeconfig
-        scored: true
-
-      - id: 1.1.18
-        text: "Ensure that the controller-manager.conf file ownership is set to root:root (Automated)"
-        audit: "/bin/sh -c 'if test -e $controllermanagerkubeconfig; then stat -c %U:%G $controllermanagerkubeconfig; fi'"
-        tests:
-          test_items:
-            - flag: "root:root"
-        remediation: |
-          Run the below command (based on the file location on your system) on the control plane node.
-          For example,
-          chown root:root $controllermanagerkubeconfig
-        scored: true
-
-      - id: 1.1.19
-        text: "Ensure that the Kubernetes PKI directory and file ownership is set to root:root (Automated)"
-        audit: "find /etc/kubernetes/pki/ | xargs stat -c %U:%G"
-        use_multiple_values: true
-        tests:
-          test_items:
-            - flag: "root:root"
-        remediation: |
-          Run the below command (based on the file location on your system) on the control plane node.
-          For example,
-          chown -R root:root /etc/kubernetes/pki/
-        scored: true
-
-      - id: 1.1.20
-        text: "Ensure that the Kubernetes PKI certificate file permissions are set to 600 or more restrictive (Manual)"
-        audit: "find /etc/kubernetes/pki/ -name '*.crt' | xargs stat -c permissions=%a"
-        use_multiple_values: true
-        tests:
-          test_items:
-            - flag: "permissions"
-              compare:
-                op: bitmask
-                value: "600"
-        remediation: |
-          Run the below command (based on the file location on your system) on the control plane node.
-          For example,
-          chmod -R 600 /etc/kubernetes/pki/*.crt
-        scored: false
-
-      - id: 1.1.21
-        text: "Ensure that the Kubernetes PKI key file permissions are set to 600 (Manual)"
-        audit: "find /etc/kubernetes/pki/ -name '*.key' | xargs stat -c permissions=%a"
-        use_multiple_values: true
-        tests:
-          test_items:
-            - flag: "permissions"
-              compare:
-                op: bitmask
-                value: "600"
-        remediation: |
-          Run the below command (based on the file location on your system) on the control plane node.
-          For example,
-          chmod -R 600 /etc/kubernetes/pki/*.key
-        scored: false
-
-  - id: 1.2
-    text: "API Server"
-    checks:
-      - id: 1.2.1
-        text: "Ensure that the --anonymous-auth argument is set to false (Manual)"
-        audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep"
-        tests:
-          test_items:
-            - flag: "--anonymous-auth"
-              compare:
-                op: eq
-                value: false
-        remediation: |
-          Edit the API server pod specification file $apiserverconf
-          on the control plane node and set the below parameter.
-          --anonymous-auth=false
-        scored: false
-
-      - id: 1.2.2
-        text: "Ensure that the --token-auth-file parameter is not set (Automated)"
-        audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep"
-        tests:
-          test_items:
-            - flag: "--token-auth-file"
-              set: false
-        remediation: |
-          Follow the documentation and configure alternate mechanisms for authentication. Then,
-          edit the API server pod specification file $apiserverconf
-          on the control plane node and remove the --token-auth-file=<filename> parameter.
-        scored: true
-
-      - id: 1.2.3
-        text: "Ensure that the --DenyServiceExternalIPs is set (Manual)"
-        audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep"
-        tests:
-          test_items:
-            - flag: "--enable-admission-plugins"
-              compare:
-                op: has
-                value: "DenyServiceExternalIPs"
-        remediation: |
-          Edit the API server pod specification file $apiserverconf
-          on the control plane node and add the `DenyServiceExternalIPs` plugin
-          to the enabled admission plugins, as such --enable-admission-plugin=DenyServiceExternalIPs.
-        scored: false
-
-      - id: 1.2.4
-        text: "Ensure that the --kubelet-client-certificate and --kubelet-client-key arguments are set as appropriate (Automated)"
-        audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep"
-        tests:
-          bin_op: and
-          test_items:
-            - flag: "--kubelet-client-certificate"
-            - flag: "--kubelet-client-key"
-        remediation: |
-          Follow the Kubernetes documentation and set up the TLS connection between the
-          apiserver and kubelets. Then, edit API server pod specification file
-          $apiserverconf on the control plane node and set the
-          kubelet client certificate and key parameters as below.
-          --kubelet-client-certificate=<path/to/client-certificate-file>
-          --kubelet-client-key=<path/to/client-key-file>
-        scored: true
-
-      - id: 1.2.5
-        text: "Ensure that the --kubelet-certificate-authority argument is set as appropriate (Automated)"
-        audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep"
-        tests:
-          test_items:
-            - flag: "--kubelet-certificate-authority"
-        remediation: |
-          Follow the Kubernetes documentation and setup the TLS connection between
-          the apiserver and kubelets. Then, edit the API server pod specification file
-          $apiserverconf on the control plane node and set the
-          --kubelet-certificate-authority parameter to the path to the cert file for the certificate authority.
-          --kubelet-certificate-authority=<ca-string>
-        scored: true
-
-      - id: 1.2.6
-        text: "Ensure that the --authorization-mode argument is not set to AlwaysAllow (Automated)"
-        audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep"
-        tests:
-          test_items:
-            - flag: "--authorization-mode"
-              compare:
-                op: nothave
-                value: "AlwaysAllow"
-        remediation: |
-          Edit the API server pod specification file $apiserverconf
-          on the control plane node and set the --authorization-mode parameter to values other than AlwaysAllow.
-          One such example could be as below.
-          --authorization-mode=RBAC
-        scored: true
-
-      - id: 1.2.7
-        text: "Ensure that the --authorization-mode argument includes Node (Automated)"
-        audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep"
-        tests:
-          test_items:
-            - flag: "--authorization-mode"
-              compare:
-                op: has
-                value: "Node"
-        remediation: |
-          Edit the API server pod specification file $apiserverconf
-          on the control plane node and set the --authorization-mode parameter to a value that includes Node.
-          --authorization-mode=Node,RBAC
-        scored: true
-
-      - id: 1.2.8
-        text: "Ensure that the --authorization-mode argument includes RBAC (Automated)"
-        audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep"
-        tests:
-          test_items:
-            - flag: "--authorization-mode"
-              compare:
-                op: has
-                value: "RBAC"
-        remediation: |
-          Edit the API server pod specification file $apiserverconf
-          on the control plane node and set the --authorization-mode parameter to a value that includes RBAC,
-          for example `--authorization-mode=Node,RBAC`.
-        scored: true
-
-      - id: 1.2.9
-        text: "Ensure that the admission control plugin EventRateLimit is set (Manual)"
-        audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep"
-        tests:
-          test_items:
-            - flag: "--enable-admission-plugins"
-              compare:
-                op: has
-                value: "EventRateLimit"
-        remediation: |
-          Follow the Kubernetes documentation and set the desired limits in a configuration file.
-          Then, edit the API server pod specification file $apiserverconf
-          and set the below parameters.
-          --enable-admission-plugins=...,EventRateLimit,...
-          --admission-control-config-file=<path/to/configuration/file>
-        scored: false
-
-      - id: 1.2.10
-        text: "Ensure that the admission control plugin AlwaysAdmit is not set (Automated)"
-        audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep"
-        tests:
-          bin_op: or
-          test_items:
-            - flag: "--enable-admission-plugins"
-              compare:
-                op: nothave
-                value: AlwaysAdmit
-            - flag: "--enable-admission-plugins"
-              set: false
-        remediation: |
-          Edit the API server pod specification file $apiserverconf
-          on the control plane node and either remove the --enable-admission-plugins parameter, or set it to a
-          value that does not include AlwaysAdmit.
-        scored: true
-
-      - id: 1.2.11
-        text: "Ensure that the admission control plugin AlwaysPullImages is set (Manual)"
-        audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep"
-        tests:
-          test_items:
-            - flag: "--enable-admission-plugins"
-              compare:
-                op: has
-                value: "AlwaysPullImages"
-        remediation: |
-          Edit the API server pod specification file $apiserverconf
-          on the control plane node and set the --enable-admission-plugins parameter to include
-          AlwaysPullImages.
-          --enable-admission-plugins=...,AlwaysPullImages,...
-        scored: false
-
-      - id: 1.2.12
-        text: "Ensure that the admission control plugin SecurityContextDeny is set if PodSecurityPolicy is not used (Manual)"
-        audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep"
-        tests:
-          bin_op: or
-          test_items:
-            - flag: "--enable-admission-plugins"
-              compare:
-                op: has
-                value: "SecurityContextDeny"
-            - flag: "--enable-admission-plugins"
-              compare:
-                op: has
-                value: "PodSecurityPolicy"
-        remediation: |
-          Edit the API server pod specification file $apiserverconf
-          on the control plane node and set the --enable-admission-plugins parameter to include
-          SecurityContextDeny, unless PodSecurityPolicy is already in place.
-          --enable-admission-plugins=...,SecurityContextDeny,...
-        scored: false
-
-      - id: 1.2.13
-        text: "Ensure that the admission control plugin ServiceAccount is set (Automated)"
-        audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep"
-        tests:
-          bin_op: or
-          test_items:
-            - flag: "--disable-admission-plugins"
-              compare:
-                op: nothave
-                value: "ServiceAccount"
-            - flag: "--disable-admission-plugins"
-              set: false
-        remediation: |
-          Follow the documentation and create ServiceAccount objects as per your environment.
-          Then, edit the API server pod specification file $apiserverconf
-          on the control plane node and ensure that the --disable-admission-plugins parameter is set to a
-          value that does not include ServiceAccount.
-        scored: true
-
-      - id: 1.2.14
-        text: "Ensure that the admission control plugin NamespaceLifecycle is set (Automated)"
-        audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep"
-        tests:
-          bin_op: or
-          test_items:
-            - flag: "--disable-admission-plugins"
-              compare:
-                op: nothave
-                value: "NamespaceLifecycle"
-            - flag: "--disable-admission-plugins"
-              set: false
-        remediation: |
-          Edit the API server pod specification file $apiserverconf
-          on the control plane node and set the --disable-admission-plugins parameter to
-          ensure it does not include NamespaceLifecycle.
-        scored: true
-
-      - id: 1.2.15
-        text: "Ensure that the admission control plugin NodeRestriction is set (Automated)"
-        audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep"
-        tests:
-          test_items:
-            - flag: "--enable-admission-plugins"
-              compare:
-                op: has
-                value: "NodeRestriction"
-        remediation: |
-          Follow the Kubernetes documentation and configure NodeRestriction plug-in on kubelets.
-          Then, edit the API server pod specification file $apiserverconf
-          on the control plane node and set the --enable-admission-plugins parameter to a
-          value that includes NodeRestriction.
-          --enable-admission-plugins=...,NodeRestriction,...
-        scored: true
-
-      - id: 1.2.16
-        text: "Ensure that the --profiling argument is set to false (Automated)"
-        audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep"
-        tests:
-          test_items:
-            - flag: "--profiling"
-              compare:
-                op: eq
-                value: false
-        remediation: |
-          Edit the API server pod specification file $apiserverconf
-          on the control plane node and set the below parameter.
-          --profiling=false
-        scored: true
-
-      - id: 1.2.17
-        text: "Ensure that the --audit-log-path argument is set (Automated)"
-        audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep"
-        tests:
-          test_items:
-            - flag: "--audit-log-path"
-        remediation: |
-          Edit the API server pod specification file $apiserverconf
-          on the control plane node and set the --audit-log-path parameter to a suitable path and
-          file where you would like audit logs to be written, for example,
-          --audit-log-path=/var/log/apiserver/audit.log
-        scored: true
-
-      - id: 1.2.18
-        text: "Ensure that the --audit-log-maxage argument is set to 30 or as appropriate (Automated)"
-        audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep"
-        tests:
-          test_items:
-            - flag: "--audit-log-maxage"
-              compare:
-                op: gte
-                value: 30
-        remediation: |
-          Edit the API server pod specification file $apiserverconf
-          on the control plane node and set the --audit-log-maxage parameter to 30
-          or as an appropriate number of days, for example,
-          --audit-log-maxage=30
-        scored: true
-
-      - id: 1.2.19
-        text: "Ensure that the --audit-log-maxbackup argument is set to 10 or as appropriate (Automated)"
-        audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep"
-        tests:
-          test_items:
-            - flag: "--audit-log-maxbackup"
-              compare:
-                op: gte
-                value: 10
-        remediation: |
-          Edit the API server pod specification file $apiserverconf
-          on the control plane node and set the --audit-log-maxbackup parameter to 10 or to an appropriate
-          value. For example,
-          --audit-log-maxbackup=10
-        scored: true
-
-      - id: 1.2.20
-        text: "Ensure that the --audit-log-maxsize argument is set to 100 or as appropriate (Automated)"
-        audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep"
-        tests:
-          test_items:
-            - flag: "--audit-log-maxsize"
-              compare:
-                op: gte
-                value: 100
-        remediation: |
-          Edit the API server pod specification file $apiserverconf
-          on the control plane node and set the --audit-log-maxsize parameter to an appropriate size in MB.
-          For example, to set it as 100 MB, --audit-log-maxsize=100
-        scored: true
-
-      - id: 1.2.21
-        text: "Ensure that the --request-timeout argument is set as appropriate (Manual)"
-        audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep"
-        type: manual
-        remediation: |
-          Edit the API server pod specification file $apiserverconf
-          and set the below parameter as appropriate and if needed.
-          For example, --request-timeout=300s
-        scored: false
-
-      - id: 1.2.22
-        text: "Ensure that the --service-account-lookup argument is set to true (Automated)"
-        audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep"
-        tests:
-          bin_op: or
-          test_items:
-            - flag: "--service-account-lookup"
-              set: false
-            - flag: "--service-account-lookup"
-              compare:
-                op: eq
-                value: true
-        remediation: |
-          Edit the API server pod specification file $apiserverconf
-          on the control plane node and set the below parameter.
-          --service-account-lookup=true
-          Alternatively, you can delete the --service-account-lookup parameter from this file so
-          that the default takes effect.
-        scored: true
-
-      - id: 1.2.23
-        text: "Ensure that the --service-account-key-file argument is set as appropriate (Automated)"
-        audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep"
-        tests:
-          test_items:
-            - flag: "--service-account-key-file"
-        remediation: |
-          Edit the API server pod specification file $apiserverconf
-          on the control plane node and set the --service-account-key-file parameter
-          to the public key file for service accounts. For example,
-          --service-account-key-file=<filename>
-        scored: true
-
-      - id: 1.2.24
-        text: "Ensure that the --etcd-certfile and --etcd-keyfile arguments are set as appropriate (Automated)"
-        audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep"
-        tests:
-          bin_op: and
-          test_items:
-            - flag: "--etcd-certfile"
-            - flag: "--etcd-keyfile"
-        remediation: |
-          Follow the Kubernetes documentation and set up the TLS connection between the apiserver and etcd.
-          Then, edit the API server pod specification file $apiserverconf
-          on the control plane node and set the etcd certificate and key file parameters.
-          --etcd-certfile=<path/to/client-certificate-file>
-          --etcd-keyfile=<path/to/client-key-file>
-        scored: true
-
-      - id: 1.2.25
-        text: "Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate (Automated)"
-        audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep"
-        tests:
-          bin_op: and
-          test_items:
-            - flag: "--tls-cert-file"
-            - flag: "--tls-private-key-file"
-        remediation: |
-          Follow the Kubernetes documentation and set up the TLS connection on the apiserver.
-          Then, edit the API server pod specification file $apiserverconf
-          on the control plane node and set the TLS certificate and private key file parameters.
-          --tls-cert-file=<path/to/tls-certificate-file>
-          --tls-private-key-file=<path/to/tls-key-file>
-        scored: true
-
-      - id: 1.2.26
-        text: "Ensure that the --client-ca-file argument is set as appropriate (Automated)"
-        audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep"
-        tests:
-          test_items:
-            - flag: "--client-ca-file"
-        remediation: |
-          Follow the Kubernetes documentation and set up the TLS connection on the apiserver.
-          Then, edit the API server pod specification file $apiserverconf
-          on the control plane node and set the client certificate authority file.
-          --client-ca-file=<path/to/client-ca-file>
-        scored: true
-
-      - id: 1.2.27
-        text: "Ensure that the --etcd-cafile argument is set as appropriate (Automated)"
-        audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep"
-        tests:
-          test_items:
-            - flag: "--etcd-cafile"
-        remediation: |
-          Follow the Kubernetes documentation and set up the TLS connection between the apiserver and etcd.
-          Then, edit the API server pod specification file $apiserverconf
-          on the control plane node and set the etcd certificate authority file parameter.
-          --etcd-cafile=<path/to/ca-file>
-        scored: true
-
-      - id: 1.2.28
-        text: "Ensure that the --encryption-provider-config argument is set as appropriate (Manual)"
-        audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep"
-        tests:
-          test_items:
-            - flag: "--encryption-provider-config"
-        remediation: |
-          Follow the Kubernetes documentation and configure a EncryptionConfig file.
-          Then, edit the API server pod specification file $apiserverconf
-          on the control plane node and set the --encryption-provider-config parameter to the path of that file.
-          For example, --encryption-provider-config=</path/to/EncryptionConfig/File>
-        scored: false
-
-      - id: 1.2.29
-        text: "Ensure that encryption providers are appropriately configured (Manual)"
-        audit: |
-          ENCRYPTION_PROVIDER_CONFIG=$(ps -ef | grep $apiserverbin | grep -- --encryption-provider-config | sed 's%.*encryption-provider-config[= ]\([^ ]*\).*%\1%')
-          if test -e $ENCRYPTION_PROVIDER_CONFIG; then grep -A1 'providers:' $ENCRYPTION_PROVIDER_CONFIG | tail -n1 | grep -o "[A-Za-z]*" | sed 's/^/provider=/'; fi
-        tests:
-          test_items:
-            - flag: "provider"
-              compare:
-                op: valid_elements
-                value: "aescbc,kms,secretbox"
-        remediation: |
-          Follow the Kubernetes documentation and configure a EncryptionConfig file.
-          In this file, choose aescbc, kms or secretbox as the encryption provider.
-        scored: false
-
-      - id: 1.2.30
-        text: "Ensure that the API Server only makes use of Strong Cryptographic Ciphers (Manual)"
-        audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep"
-        tests:
-          test_items:
-            - flag: "--tls-cipher-suites"
-              compare:
-                op: valid_elements
-                value: "TLS_AES_128_GCM_SHA256,TLS_AES_256_GCM_SHA384,TLS_CHACHA20_POLY1305_SHA256,TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256,TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256,TLS_RSA_WITH_3DES_EDE_CBC_SHA,TLS_RSA_WITH_AES_128_CBC_SHA,TLS_RSA_WITH_AES_128_GCM_SHA256,TLS_RSA_WITH_AES_256_CBC_SHA,TLS_RSA_WITH_AES_256_GCM_SHA384"
-        remediation: |
-          Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml
-          on the control plane node and set the below parameter.
-          --tls-cipher-suites=TLS_AES_128_GCM_SHA256,TLS_AES_256_GCM_SHA384,TLS_CHACHA20_POLY1305_SHA256,
-          TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
-          TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
-          TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256,
-          TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
-          TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,
-          TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256,TLS_RSA_WITH_3DES_EDE_CBC_SHA,TLS_RSA_WITH_AES_128_CBC_SHA,
-          TLS_RSA_WITH_AES_128_GCM_SHA256,TLS_RSA_WITH_AES_256_CBC_SHA,TLS_RSA_WITH_AES_256_GCM_SHA384
-        scored: false
-
-  - id: 1.3
-    text: "Controller Manager"
-    checks:
-      - id: 1.3.1
-        text: "Ensure that the --terminated-pod-gc-threshold argument is set as appropriate (Manual)"
-        audit: "/bin/ps -ef | grep $controllermanagerbin | grep -v grep"
-        tests:
-          test_items:
-            - flag: "--terminated-pod-gc-threshold"
-        remediation: |
-          Edit the Controller Manager pod specification file $controllermanagerconf
-          on the control plane node and set the --terminated-pod-gc-threshold to an appropriate threshold,
-          for example, --terminated-pod-gc-threshold=10
-        scored: false
-
-      - id: 1.3.2
-        text: "Ensure that the --profiling argument is set to false (Automated)"
-        audit: "/bin/ps -ef | grep $controllermanagerbin | grep -v grep"
-        tests:
-          test_items:
-            - flag: "--profiling"
-              compare:
-                op: eq
-                value: false
-        remediation: |
-          Edit the Controller Manager pod specification file $controllermanagerconf
-          on the control plane node and set the below parameter.
-          --profiling=false
-        scored: true
-
-      - id: 1.3.3
-        text: "Ensure that the --use-service-account-credentials argument is set to true (Automated)"
-        audit: "/bin/ps -ef | grep $controllermanagerbin | grep -v grep"
-        tests:
-          test_items:
-            - flag: "--use-service-account-credentials"
-              compare:
-                op: noteq
-                value: false
-        remediation: |
-          Edit the Controller Manager pod specification file $controllermanagerconf
-          on the control plane node to set the below parameter.
-          --use-service-account-credentials=true
-        scored: true
-
-      - id: 1.3.4
-        text: "Ensure that the --service-account-private-key-file argument is set as appropriate (Automated)"
-        audit: "/bin/ps -ef | grep $controllermanagerbin | grep -v grep"
-        tests:
-          test_items:
-            - flag: "--service-account-private-key-file"
-        remediation: |
-          Edit the Controller Manager pod specification file $controllermanagerconf
-          on the control plane node and set the --service-account-private-key-file parameter
-          to the private key file for service accounts.
-          --service-account-private-key-file=<filename>
-        scored: true
-
-      - id: 1.3.5
-        text: "Ensure that the --root-ca-file argument is set as appropriate (Automated)"
-        audit: "/bin/ps -ef | grep $controllermanagerbin | grep -v grep"
-        tests:
-          test_items:
-            - flag: "--root-ca-file"
-        remediation: |
-          Edit the Controller Manager pod specification file $controllermanagerconf
-          on the control plane node and set the --root-ca-file parameter to the certificate bundle file`.
-          --root-ca-file=<path/to/file>
-        scored: true
-
-      - id: 1.3.6
-        text: "Ensure that the RotateKubeletServerCertificate argument is set to true (Automated)"
-        audit: "/bin/ps -ef | grep $controllermanagerbin | grep -v grep"
-        tests:
-          bin_op: or
-          test_items:
-            - flag: "--feature-gates"
-              compare:
-                op: nothave
-                value: "RotateKubeletServerCertificate=false"
-              set: true
-            - flag: "--feature-gates"
-              set: false
-        remediation: |
-          Edit the Controller Manager pod specification file $controllermanagerconf
-          on the control plane node and set the --feature-gates parameter to include RotateKubeletServerCertificate=true.
-          --feature-gates=RotateKubeletServerCertificate=true
-        scored: true
-
-      - id: 1.3.7
-        text: "Ensure that the --bind-address argument is set to 127.0.0.1 (Automated)"
-        audit: "/bin/ps -ef | grep $controllermanagerbin | grep -v grep"
-        tests:
-          bin_op: or
-          test_items:
-            - flag: "--bind-address"
-              compare:
-                op: eq
-                value: "127.0.0.1"
-            - flag: "--bind-address"
-              set: false
-        remediation: |
-          Edit the Controller Manager pod specification file $controllermanagerconf
-          on the control plane node and ensure the correct value for the --bind-address parameter
-        scored: true
-
-  - id: 1.4
-    text: "Scheduler"
-    checks:
-      - id: 1.4.1
-        text: "Ensure that the --profiling argument is set to false (Automated)"
-        audit: "/bin/ps -ef | grep $schedulerbin | grep -v grep"
-        tests:
-          test_items:
-            - flag: "--profiling"
-              compare:
-                op: eq
-                value: false
-        remediation: |
-          Edit the Scheduler pod specification file $schedulerconf file
-          on the control plane node and set the below parameter.
-          --profiling=false
-        scored: true
-
-      - id: 1.4.2
-        text: "Ensure that the --bind-address argument is set to 127.0.0.1 (Automated)"
-        audit: "/bin/ps -ef | grep $schedulerbin | grep -v grep"
-        tests:
-          bin_op: or
-          test_items:
-            - flag: "--bind-address"
-              compare:
-                op: eq
-                value: "127.0.0.1"
-            - flag: "--bind-address"
-              set: false
-        remediation: |
-          Edit the Scheduler pod specification file $schedulerconf
-          on the control plane node and ensure the correct value for the --bind-address parameter
-        scored: true

cfg/cis-1.8/node.yaml

@@ -1,455 +0,0 @@
----
-controls:
-version: "cis-1.8"
-id: 4
-text: "Worker Node Security Configuration"
-type: "node"
-groups:
-  - id: 4.1
-    text: "Worker Node Configuration Files"
-    checks:
-      - id: 4.1.1
-        text: "Ensure that the kubelet service file permissions are set to 600 or more restrictive (Automated)"
-        audit: '/bin/sh -c ''if test -e $kubeletsvc; then stat -c permissions=%a $kubeletsvc; fi'' '
-        tests:
-          test_items:
-            - flag: "permissions"
-              compare:
-                op: bitmask
-                value: "600"
-        remediation: |
-          Run the below command (based on the file location on your system) on the each worker node.
-          For example, chmod 600 $kubeletsvc
-        scored: true
-
-      - id: 4.1.2
-        text: "Ensure that the kubelet service file ownership is set to root:root (Automated)"
-        audit: '/bin/sh -c "if test -e $kubeletsvc; then stat -c %U:%G $kubeletsvc; else echo \"File not found\"; fi"'
-        tests:
-          bin_op: or
-          test_items:
-            - flag: root:root
-            - flag: "File not found"
-        remediation: |
-            Run the below command (based on the file location on your system) on the each worker node.
-            For example,
-            chown root:root $kubeletsvc
-        scored: true
-
-      - id: 4.1.3
-        text: "If proxy kubeconfig file exists ensure permissions are set to 600 or more restrictive (Manual)"
-        audit: '/bin/sh -c ''if test -e $proxykubeconfig; then stat -c permissions=%a $proxykubeconfig; fi'' '
-        tests:
-          bin_op: or
-          test_items:
-            - flag: "permissions"
-              set: true
-              compare:
-                op: bitmask
-                value: "600"
-        remediation: |
-          Run the below command (based on the file location on your system) on the each worker node.
-          For example,
-          chmod 600 $proxykubeconfig
-        scored: false
-
-      - id: 4.1.4
-        text: "If proxy kubeconfig file exists ensure ownership is set to root:root (Manual)"
-        audit: '/bin/sh -c ''if test -e $proxykubeconfig; then stat -c %U:%G $proxykubeconfig; fi'' '
-        tests:
-          bin_op: or
-          test_items:
-            - flag: root:root
-        remediation: |
-          Run the below command (based on the file location on your system) on the each worker node.
-          For example, chown root:root $proxykubeconfig
-        scored: false
-
-      - id: 4.1.5
-        text: "Ensure that the --kubeconfig kubelet.conf file permissions are set to 600 or more restrictive (Automated)"
-        audit: '/bin/sh -c ''if test -e $kubeletkubeconfig; then stat -c permissions=%a $kubeletkubeconfig; fi'' '
-        tests:
-          test_items:
-            - flag: "permissions"
-              compare:
-                op: bitmask
-                value: "600"
-        remediation: |
-          Run the below command (based on the file location on your system) on the each worker node.
-          For example,
-          chmod 600 $kubeletkubeconfig
-        scored: true
-
-      - id: 4.1.6
-        text: "Ensure that the --kubeconfig kubelet.conf file ownership is set to root:root (Automated)"
-        audit: '/bin/sh -c ''if test -e $kubeletkubeconfig; then stat -c %U:%G $kubeletkubeconfig; fi'' '
-        tests:
-          test_items:
-            - flag: root:root
-        remediation: |
-          Run the below command (based on the file location on your system) on the each worker node.
-          For example,
-          chown root:root $kubeletkubeconfig
-        scored: true
-
-      - id: 4.1.7
-        text: "Ensure that the certificate authorities file permissions are set to 600 or more restrictive (Manual)"
-        audit: |
-          CAFILE=$(ps -ef | grep kubelet | grep -v apiserver | grep -- --client-ca-file= | awk -F '--client-ca-file=' '{print $2}' | awk '{print $1}' | uniq)
-          if test -z $CAFILE; then CAFILE=$kubeletcafile; fi
-          if test -e $CAFILE; then stat -c permissions=%a $CAFILE; fi
-        tests:
-          test_items:
-            - flag: "permissions"
-              compare:
-                op: bitmask
-                value: "600"
-        remediation: |
-          Run the following command to modify the file permissions of the
-          --client-ca-file chmod 600 <filename>
-        scored: false
-
-      - id: 4.1.8
-        text: "Ensure that the client certificate authorities file ownership is set to root:root (Manual)"
-        audit: |
-          CAFILE=$(ps -ef | grep kubelet | grep -v apiserver | grep -- --client-ca-file= | awk -F '--client-ca-file=' '{print $2}' | awk '{print $1}' | uniq)
-          if test -z $CAFILE; then CAFILE=$kubeletcafile; fi
-          if test -e $CAFILE; then stat -c %U:%G $CAFILE; fi
-        tests:
-          test_items:
-            - flag: root:root
-              compare:
-                op: eq
-                value: root:root
-        remediation: |
-          Run the following command to modify the ownership of the --client-ca-file.
-          chown root:root <filename>
-        scored: false
-
-      - id: 4.1.9
-        text: "If the kubelet config.yaml configuration file is being used validate permissions set to 600 or more restrictive (Automated)"
-        audit: '/bin/sh -c ''if test -e $kubeletconf; then stat -c permissions=%a $kubeletconf; fi'' '
-        tests:
-          test_items:
-            - flag: "permissions"
-              compare:
-                op: bitmask
-                value: "600"
-        remediation: |
-          Run the following command (using the config file location identified in the Audit step)
-          chmod 600 $kubeletconf
-        scored: true
-
-      - id: 4.1.10
-        text: "If the kubelet config.yaml configuration file is being used validate file ownership is set to root:root (Automated)"
-        audit: '/bin/sh -c ''if test -e $kubeletconf; then stat -c %U:%G $kubeletconf; fi'' '
-        tests:
-          test_items:
-            - flag: root:root
-        remediation: |
-          Run the following command (using the config file location identified in the Audit step)
-          chown root:root $kubeletconf
-        scored: true
-
-  - id: 4.2
-    text: "Kubelet"
-    checks:
-      - id: 4.2.1
-        text: "Ensure that the --anonymous-auth argument is set to false (Automated)"
-        audit: "/bin/ps -fC $kubeletbin"
-        audit_config: "/bin/cat $kubeletconf"
-        tests:
-          test_items:
-            - flag: "--anonymous-auth"
-              path: '{.authentication.anonymous.enabled}'
-              compare:
-                op: eq
-                value: false
-        remediation: |
-          If using a Kubelet config file, edit the file to set `authentication: anonymous: enabled` to
-          `false`.
-          If using executable arguments, edit the kubelet service file
-          $kubeletsvc on each worker node and
-          set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable.
-          `--anonymous-auth=false`
-          Based on your system, restart the kubelet service. For example,
-          systemctl daemon-reload
-          systemctl restart kubelet.service
-        scored: true
-
-      - id: 4.2.2
-        text: "Ensure that the --authorization-mode argument is not set to AlwaysAllow (Automated)"
-        audit: "/bin/ps -fC $kubeletbin"
-        audit_config: "/bin/cat $kubeletconf"
-        tests:
-          test_items:
-            - flag: --authorization-mode
-              path: '{.authorization.mode}'
-              compare:
-                op: nothave
-                value: AlwaysAllow
-        remediation: |
-          If using a Kubelet config file, edit the file to set `authorization.mode` to Webhook. If
-          using executable arguments, edit the kubelet service file
-          $kubeletsvc on each worker node and
-          set the below parameter in KUBELET_AUTHZ_ARGS variable.
-          --authorization-mode=Webhook
-          Based on your system, restart the kubelet service. For example,
-          systemctl daemon-reload
-          systemctl restart kubelet.service
-        scored: true
-
-      - id: 4.2.3
-        text: "Ensure that the --client-ca-file argument is set as appropriate (Automated)"
-        audit: "/bin/ps -fC $kubeletbin"
-        audit_config: "/bin/cat $kubeletconf"
-        tests:
-          test_items:
-            - flag: --client-ca-file
-              path: '{.authentication.x509.clientCAFile}'
-        remediation: |
-          If using a Kubelet config file, edit the file to set `authentication.x509.clientCAFile` to
-          the location of the client CA file.
-          If using command line arguments, edit the kubelet service file
-          $kubeletsvc on each worker node and
-          set the below parameter in KUBELET_AUTHZ_ARGS variable.
-          --client-ca-file=<path/to/client-ca-file>
-          Based on your system, restart the kubelet service. For example,
-          systemctl daemon-reload
-          systemctl restart kubelet.service
-        scored: true
-
-      - id: 4.2.4
-        text: "Verify that the --read-only-port argument is set to 0 (Manual)"
-        audit: "/bin/ps -fC $kubeletbin"
-        audit_config: "/bin/cat $kubeletconf"
-        tests:
-          bin_op: or
-          test_items:
-            - flag: "--read-only-port"
-              path: '{.readOnlyPort}'
-              compare:
-                op: eq
-                value: 0
-            - flag: "--read-only-port"
-              path: '{.readOnlyPort}'
-              set: false
-        remediation: |
-          If using a Kubelet config file, edit the file to set `readOnlyPort` to 0.
-          If using command line arguments, edit the kubelet service file
-          $kubeletsvc on each worker node and
-          set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable.
-          --read-only-port=0
-          Based on your system, restart the kubelet service. For example,
-          systemctl daemon-reload
-          systemctl restart kubelet.service
-        scored: false
-
-      - id: 4.2.5
-        text: "Ensure that the --streaming-connection-idle-timeout argument is not set to 0 (Manual)"
-        audit: "/bin/ps -fC $kubeletbin"
-        audit_config: "/bin/cat $kubeletconf"
-        tests:
-          test_items:
-            - flag: --streaming-connection-idle-timeout
-              path: '{.streamingConnectionIdleTimeout}'
-              compare:
-                op: noteq
-                value: 0
-            - flag: --streaming-connection-idle-timeout
-              path: '{.streamingConnectionIdleTimeout}'
-              set: false
-          bin_op: or
-        remediation: |
-          If using a Kubelet config file, edit the file to set `streamingConnectionIdleTimeout` to a
-          value other than 0.
-          If using command line arguments, edit the kubelet service file
-          $kubeletsvc on each worker node and
-          set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable.
-          --streaming-connection-idle-timeout=5m
-          Based on your system, restart the kubelet service. For example,
-          systemctl daemon-reload
-          systemctl restart kubelet.service
-        scored: false
-
-      - id: 4.2.6
-        text: "Ensure that the --make-iptables-util-chains argument is set to true (Automated)"
-        audit: "/bin/ps -fC $kubeletbin"
-        audit_config: "/bin/cat $kubeletconf"
-        tests:
-          test_items:
-            - flag: --make-iptables-util-chains
-              path: '{.makeIPTablesUtilChains}'
-              compare:
-                op: eq
-                value: true
-            - flag: --make-iptables-util-chains
-              path: '{.makeIPTablesUtilChains}'
-              set: false
-          bin_op: or
-        remediation: |
-          If using a Kubelet config file, edit the file to set `makeIPTablesUtilChains` to `true`.
-          If using command line arguments, edit the kubelet service file
-          $kubeletsvc on each worker node and
-          remove the --make-iptables-util-chains argument from the
-          KUBELET_SYSTEM_PODS_ARGS variable.
-          Based on your system, restart the kubelet service. For example:
-          systemctl daemon-reload
-          systemctl restart kubelet.service
-        scored: true
-
-      - id: 4.2.7
-        text: "Ensure that the --hostname-override argument is not set (Manual)"
-        # This is one of those properties that can only be set as a command line argument.
-        # To check if the property is set as expected, we need to parse the kubelet command
-        # instead reading the Kubelet Configuration file.
-        audit: "/bin/ps -fC $kubeletbin "
-        tests:
-          test_items:
-            - flag: --hostname-override
-              set: false
-        remediation: |
-          Edit the kubelet service file $kubeletsvc
-          on each worker node and remove the --hostname-override argument from the
-          KUBELET_SYSTEM_PODS_ARGS variable.
-          Based on your system, restart the kubelet service. For example,
-          systemctl daemon-reload
-          systemctl restart kubelet.service
-        scored: false
-
-      - id: 4.2.8
-        text: "Ensure that the eventRecordQPS argument is set to a level which ensures appropriate event capture (Manual)"
-        audit: "/bin/ps -fC $kubeletbin"
-        audit_config: "/bin/cat $kubeletconf"
-        tests:
-          test_items:
-            - flag: --event-qps
-              path: '{.eventRecordQPS}'
-              compare:
-                op: gte
-                value: 0
-            - flag: --event-qps
-              path: '{.eventRecordQPS}'
-              set: false
-          bin_op: or
-        remediation: |
-          If using a Kubelet config file, edit the file to set `eventRecordQPS` to an appropriate level.
-          If using command line arguments, edit the kubelet service file
-          $kubeletsvc on each worker node and
-          set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable.
-          Based on your system, restart the kubelet service. For example,
-          systemctl daemon-reload
-          systemctl restart kubelet.service
-        scored: false
-
-      - id: 4.2.9
-        text: "Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate (Manual)"
-        audit: "/bin/ps -fC $kubeletbin"
-        audit_config: "/bin/cat $kubeletconf"
-        tests:
-          test_items:
-            - flag: --tls-cert-file
-              path: '{.tlsCertFile}'
-            - flag: --tls-private-key-file
-              path: '{.tlsPrivateKeyFile}'
-        remediation: |
-          If using a Kubelet config file, edit the file to set `tlsCertFile` to the location
-          of the certificate file to use to identify this Kubelet, and `tlsPrivateKeyFile`
-          to the location of the corresponding private key file.
-          If using command line arguments, edit the kubelet service file
-          $kubeletsvc on each worker node and
-          set the below parameters in KUBELET_CERTIFICATE_ARGS variable.
-          --tls-cert-file=<path/to/tls-certificate-file>
-          --tls-private-key-file=<path/to/tls-key-file>
-          Based on your system, restart the kubelet service. For example,
-          systemctl daemon-reload
-          systemctl restart kubelet.service
-        scored: false
-
-      - id: 4.2.10
-        text: "Ensure that the --rotate-certificates argument is not set to false (Automated)"
-        audit: "/bin/ps -fC $kubeletbin"
-        audit_config: "/bin/cat $kubeletconf"
-        tests:
-          test_items:
-            - flag: --rotate-certificates
-              path: '{.rotateCertificates}'
-              compare:
-                op: eq
-                value: true
-            - flag: --rotate-certificates
-              path: '{.rotateCertificates}'
-              set: false
-          bin_op: or
-        remediation: |
-          If using a Kubelet config file, edit the file to add the line `rotateCertificates` to `true` or
-          remove it altogether to use the default value.
-          If using command line arguments, edit the kubelet service file
-          $kubeletsvc on each worker node and
-          remove --rotate-certificates=false argument from the KUBELET_CERTIFICATE_ARGS
-          variable.
-          Based on your system, restart the kubelet service. For example,
-          systemctl daemon-reload
-          systemctl restart kubelet.service
-        scored: true
-
-      - id: 4.2.11
-        text: "Verify that the RotateKubeletServerCertificate argument is set to true (Manual)"
-        audit: "/bin/ps -fC $kubeletbin"
-        audit_config: "/bin/cat $kubeletconf"
-        tests:
-          bin_op: or
-          test_items:
-            - flag: RotateKubeletServerCertificate
-              path: '{.featureGates.RotateKubeletServerCertificate}'
-              compare:
-                op: nothave
-                value: false
-            - flag: RotateKubeletServerCertificate
-              path: '{.featureGates.RotateKubeletServerCertificate}'
-              set: false
-        remediation: |
-          Edit the kubelet service file $kubeletsvc
-          on each worker node and set the below parameter in KUBELET_CERTIFICATE_ARGS variable.
-          --feature-gates=RotateKubeletServerCertificate=true
-          Based on your system, restart the kubelet service. For example:
-          systemctl daemon-reload
-          systemctl restart kubelet.service
-        scored: false
-
-      - id: 4.2.12
-        text: "Ensure that the Kubelet only makes use of Strong Cryptographic Ciphers (Manual)"
-        audit: "/bin/ps -fC $kubeletbin"
-        audit_config: "/bin/cat $kubeletconf"
-        tests:
-          test_items:
-            - flag: --tls-cipher-suites
-              path: '{range .tlsCipherSuites[:]}{}{'',''}{end}'
-              compare:
-                op: valid_elements
-                value: TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256
-        remediation: |
-          If using a Kubelet config file, edit the file to set `tlsCipherSuites` to
-          TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256
-          or to a subset of these values.
-          If using executable arguments, edit the kubelet service file
-          $kubeletsvc on each worker node and
-          set the --tls-cipher-suites parameter as follows, or to a subset of these values.
-          --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256
-          Based on your system, restart the kubelet service. For example:
-          systemctl daemon-reload
-          systemctl restart kubelet.service
-        scored: false
-
-      - id: 4.2.13
-        text: "Ensure that a limit is set on pod PIDs (Manual)"
-        audit: "/bin/ps -fC $kubeletbin"
-        audit_config: "/bin/cat $kubeletconf"
-        tests:
-          test_items:
-            - flag: --pod-max-pids
-              path: '{.podPidsLimit}'
-        remediation: |
-          Decide on an appropriate level for this parameter and set it,
-          either via the --pod-max-pids command line parameter or the PodPidsLimit configuration file setting.
-        scored: false

cfg/cis-1.8/policies.yaml

@@ -1,304 +0,0 @@
----
-controls:
-version: "cis-1.8"
-id: 5
-text: "Kubernetes Policies"
-type: "policies"
-groups:
-  - id: 5.1
-    text: "RBAC and Service Accounts"
-    checks:
-      - id: 5.1.1
-        text: "Ensure that the cluster-admin role is only used where required (Manual)"
-        type: "manual"
-        remediation: |
-          Identify all clusterrolebindings to the cluster-admin role. Check if they are used and
-          if they need this role or if they could use a role with fewer privileges.
-          Where possible, first bind users to a lower privileged role and then remove the
-          clusterrolebinding to the cluster-admin role :
-          kubectl delete clusterrolebinding [name]
-        scored: false
-
-      - id: 5.1.2
-        text: "Minimize access to secrets (Manual)"
-        type: "manual"
-        remediation: |
-          Where possible, remove get, list and watch access to Secret objects in the cluster.
-        scored: false
-
-      - id: 5.1.3
-        text: "Minimize wildcard use in Roles and ClusterRoles (Manual)"
-        type: "manual"
-        remediation: |
-          Where possible replace any use of wildcards in clusterroles and roles with specific
-          objects or actions.
-        scored: false
-
-      - id: 5.1.4
-        text: "Minimize access to create pods (Manual)"
-        type: "manual"
-        remediation: |
-          Where possible, remove create access to pod objects in the cluster.
-        scored: false
-
-      - id: 5.1.5
-        text: "Ensure that default service accounts are not actively used. (Manual)"
-        type: "manual"
-        remediation: |
-          Create explicit service accounts wherever a Kubernetes workload requires specific access
-          to the Kubernetes API server.
-          Modify the configuration of each default service account to include this value
-          automountServiceAccountToken: false
-        scored: false
-
-      - id: 5.1.6
-        text: "Ensure that Service Account Tokens are only mounted where necessary (Manual)"
-        type: "manual"
-        remediation: |
-          Modify the definition of pods and service accounts which do not need to mount service
-          account tokens to disable it.
-        scored: false
-
-      - id: 5.1.7
-        text: "Avoid use of system:masters group (Manual)"
-        type: "manual"
-        remediation: |
-          Remove the system:masters group from all users in the cluster.
-        scored: false
-
-      - id: 5.1.8
-        text: "Limit use of the Bind, Impersonate and Escalate permissions in the Kubernetes cluster (Manual)"
-        type: "manual"
-        remediation: |
-          Where possible, remove the impersonate, bind and escalate rights from subjects.
-        scored: false
-
-      - id: 5.1.9
-        text: "Minimize access to create persistent volumes (Manual)"
-        type: "manual"
-        remediation: |
-          Where possible, remove create access to PersistentVolume objects in the cluster.
-        scored: false
-
-      - id: 5.1.10
-        text: "Minimize access to the proxy sub-resource of nodes (Manual)"
-        type: "manual"
-        remediation: |
-          Where possible, remove access to the proxy sub-resource of node objects.
-        scored: false
-
-      - id: 5.1.11
-        text: "Minimize access to the approval sub-resource of certificatesigningrequests objects (Manual)"
-        type: "manual"
-        remediation: |
-          Where possible, remove access to the approval sub-resource of certificatesigningrequest objects.
-        scored: false
-
-      - id: 5.1.12
-        text: "Minimize access to webhook configuration objects (Manual)"
-        type: "manual"
-        remediation: |
-          Where possible, remove access to the validatingwebhookconfigurations or mutatingwebhookconfigurations objects
-        scored: false
-
-      - id: 5.1.13
-        text: "Minimize access to the service account token creation (Manual)"
-        type: "manual"
-        remediation: |
-          Where possible, remove access to the token sub-resource of serviceaccount objects.
-        scored: false
-
-  - id: 5.2
-    text: "Pod Security Standards"
-    checks:
-      - id: 5.2.1
-        text: "Ensure that the cluster has at least one active policy control mechanism in place (Manual)"
-        type: "manual"
-        remediation: |
-          Ensure that either Pod Security Admission or an external policy control system is in place
-          for every namespace which contains user workloads.
-        scored: false
-
-      - id: 5.2.2
-        text: "Minimize the admission of privileged containers (Manual)"
-        type: "manual"
-        remediation: |
-          Add policies to each namespace in the cluster which has user workloads to restrict the
-          admission of privileged containers.
-        scored: false
-
-      - id: 5.2.3
-        text: "Minimize the admission of containers wishing to share the host process ID namespace (Automated)"
-        type: "manual"
-        remediation: |
-          Add policies to each namespace in the cluster which has user workloads to restrict the
-          admission of `hostPID` containers.
-        scored: false
-
-      - id: 5.2.4
-        text: "Minimize the admission of containers wishing to share the host IPC namespace (Automated)"
-        type: "manual"
-        remediation: |
-          Add policies to each namespace in the cluster which has user workloads to restrict the
-          admission of `hostIPC` containers.
-        scored: false
-
-      - id: 5.2.5
-        text: "Minimize the admission of containers wishing to share the host network namespace (Automated)"
-        type: "manual"
-        remediation: |
-          Add policies to each namespace in the cluster which has user workloads to restrict the
-          admission of `hostNetwork` containers.
-        scored: false
-
-      - id: 5.2.6
-        text: "Minimize the admission of containers with allowPrivilegeEscalation (Automated)"
-        type: "manual"
-        remediation: |
-          Add policies to each namespace in the cluster which has user workloads to restrict the
-          admission of containers with `.spec.allowPrivilegeEscalation` set to `true`.
-        scored: false
-
-      - id: 5.2.7
-        text: "Minimize the admission of root containers (Automated)"
-        type: "manual"
-        remediation: |
-          Create a policy for each namespace in the cluster, ensuring that either `MustRunAsNonRoot`
-          or `MustRunAs` with the range of UIDs not including 0, is set.
-        scored: false
-
-      - id: 5.2.8
-        text: "Minimize the admission of containers with the NET_RAW capability (Automated)"
-        type: "manual"
-        remediation: |
-          Add policies to each namespace in the cluster which has user workloads to restrict the
-          admission of containers with the `NET_RAW` capability.
-        scored: false
-
-      - id: 5.2.9
-        text: "Minimize the admission of containers with added capabilities (Automated)"
-        type: "manual"
-        remediation: |
-          Ensure that `allowedCapabilities` is not present in policies for the cluster unless
-          it is set to an empty array.
-        scored: false
-
-      - id: 5.2.10
-        text: "Minimize the admission of containers with capabilities assigned (Manual)"
-        type: "manual"
-        remediation: |
-          Review the use of capabilites in applications running on your cluster. Where a namespace
-          contains applications which do not require any Linux capabities to operate consider adding
-          a PSP which forbids the admission of containers which do not drop all capabilities.
-        scored: false
-
-      - id: 5.2.11
-        text: "Minimize the admission of Windows HostProcess containers (Manual)"
-        type: "manual"
-        remediation: |
-          Add policies to each namespace in the cluster which has user workloads to restrict the
-          admission of containers that have `.securityContext.windowsOptions.hostProcess` set to `true`.
-        scored: false
-
-      - id: 5.2.12
-        text: "Minimize the admission of HostPath volumes (Manual)"
-        type: "manual"
-        remediation: |
-          Add policies to each namespace in the cluster which has user workloads to restrict the
-          admission of containers with `hostPath` volumes.
-        scored: false
-
-      - id: 5.2.13
-        text: "Minimize the admission of containers which use HostPorts (Manual)"
-        type: "manual"
-        remediation: |
-          Add policies to each namespace in the cluster which has user workloads to restrict the
-          admission of containers which use `hostPort` sections.
-        scored: false
-
-  - id: 5.3
-    text: "Network Policies and CNI"
-    checks:
-      - id: 5.3.1
-        text: "Ensure that the CNI in use supports NetworkPolicies (Manual)"
-        type: "manual"
-        remediation: |
-          If the CNI plugin in use does not support network policies, consideration should be given to
-          making use of a different plugin, or finding an alternate mechanism for restricting traffic
-          in the Kubernetes cluster.
-        scored: false
-
-      - id: 5.3.2
-        text: "Ensure that all Namespaces have NetworkPolicies defined (Manual)"
-        type: "manual"
-        remediation: |
-          Follow the documentation and create NetworkPolicy objects as you need them.
-        scored: false
-
-  - id: 5.4
-    text: "Secrets Management"
-    checks:
-      - id: 5.4.1
-        text: "Prefer using Secrets as files over Secrets as environment variables (Manual)"
-        type: "manual"
-        remediation: |
-          If possible, rewrite application code to read Secrets from mounted secret files, rather than
-          from environment variables.
-        scored: false
-
-      - id: 5.4.2
-        text: "Consider external secret storage (Manual)"
-        type: "manual"
-        remediation: |
-          Refer to the Secrets management options offered by your cloud provider or a third-party
-          secrets management solution.
-        scored: false
-
-  - id: 5.5
-    text: "Extensible Admission Control"
-    checks:
-      - id: 5.5.1
-        text: "Configure Image Provenance using ImagePolicyWebhook admission controller (Manual)"
-        type: "manual"
-        remediation: |
-          Follow the Kubernetes documentation and setup image provenance.
-        scored: false
-
-  - id: 5.7
-    text: "General Policies"
-    checks:
-      - id: 5.7.1
-        text: "Create administrative boundaries between resources using namespaces (Manual)"
-        type: "manual"
-        remediation: |
-          Follow the documentation and create namespaces for objects in your deployment as you need
-          them.
-        scored: false
-
-      - id: 5.7.2
-        text: "Ensure that the seccomp profile is set to docker/default in your Pod definitions (Manual)"
-        type: "manual"
-        remediation: |
-          Use `securityContext` to enable the docker/default seccomp profile in your pod definitions.
-          An example is as below:
-            securityContext:
-              seccompProfile:
-                type: RuntimeDefault
-        scored: false
-
-      - id: 5.7.3
-        text: "Apply SecurityContext to your Pods and Containers (Manual)"
-        type: "manual"
-        remediation: |
-          Follow the Kubernetes documentation and apply SecurityContexts to your Pods. For a
-          suggested list of SecurityContexts, you may refer to the CIS Security Benchmark for Docker
-          Containers.
-        scored: false
-
-      - id: 5.7.4
-        text: "The default namespace should not be used (Manual)"
-        type: "manual"
-        remediation: |
-          Ensure that namespaces are created to allow for appropriate segregation of Kubernetes
-          resources and that all new resources are created in a specific namespace.
-        scored: false

cfg/cis-1.9/config.yaml

@@ -1,2 +0,0 @@
----
-## Version-specific settings that override the values in cfg/config.yaml

cfg/cis-1.9/controlplane.yaml

@@ -1,62 +0,0 @@
----
-controls:
-version: "cis-1.9"
-id: 3
-text: "Control Plane Configuration"
-type: "controlplane"
-groups:
-  - id: 3.1
-    text: "Authentication and Authorization"
-    checks:
-      - id: 3.1.1
-        text: "Client certificate authentication should not be used for users (Manual)"
-        type: "manual"
-        remediation: |
-          Alternative mechanisms provided by Kubernetes such as the use of OIDC should be
-          implemented in place of client certificates.
-        scored: false
-
-      - id: 3.1.2
-        text: "Service account token authentication should not be used for users (Manual)"
-        type: "manual"
-        remediation: |
-          Alternative mechanisms provided by Kubernetes such as the use of OIDC should be implemented
-          in place of service account tokens.
-        scored: false
-
-      - id: 3.1.3
-        text: "Bootstrap token authentication should not be used for users (Manual)"
-        type: "manual"
-        remediation: |
-          Alternative mechanisms provided by Kubernetes such as the use of OIDC should be implemented
-          in place of bootstrap tokens.
-        scored: false
-
-  - id: 3.2
-    text: "Logging"
-    checks:
-      - id: 3.2.1
-        text: "Ensure that a minimal audit policy is created (Manual)"
-        audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep"
-        tests:
-          test_items:
-            - flag: "--audit-policy-file"
-              set: true
-        remediation: |
-          Create an audit policy file for your cluster.
-        scored: false
-
-      - id: 3.2.2
-        text: "Ensure that the audit policy covers key security concerns (Manual)"
-        type: "manual"
-        remediation: |
-          Review the audit policy provided for the cluster and ensure that it covers
-          at least the following areas,
-          - Access to Secrets managed by the cluster. Care should be taken to only
-            log Metadata for requests to Secrets, ConfigMaps, and TokenReviews, in
-            order to avoid risk of logging sensitive data.
-          - Modification of Pod and Deployment objects.
-          - Use of `pods/exec`, `pods/portforward`, `pods/proxy` and `services/proxy`.
-          For most requests, minimally logging at the Metadata level is recommended
-          (the most basic level of logging).
-        scored: false

cfg/cis-1.9/etcd.yaml

@@ -1,135 +0,0 @@
----
-controls:
-version: "cis-1.9"
-id: 2
-text: "Etcd Node Configuration"
-type: "etcd"
-groups:
-  - id: 2
-    text: "Etcd Node Configuration"
-    checks:
-      - id: 2.1
-        text: "Ensure that the --cert-file and --key-file arguments are set as appropriate (Automated)"
-        audit: "/bin/ps -ef | /bin/grep $etcdbin | /bin/grep -v grep"
-        tests:
-          bin_op: and
-          test_items:
-            - flag: "--cert-file"
-              env: "ETCD_CERT_FILE"
-            - flag: "--key-file"
-              env: "ETCD_KEY_FILE"
-        remediation: |
-          Follow the etcd service documentation and configure TLS encryption.
-          Then, edit the etcd pod specification file /etc/kubernetes/manifests/etcd.yaml
-          on the master node and set the below parameters.
-          --cert-file=</path/to/ca-file>
-          --key-file=</path/to/key-file>
-        scored: true
-
-      - id: 2.2
-        text: "Ensure that the --client-cert-auth argument is set to true (Automated)"
-        audit: "/bin/ps -ef | /bin/grep $etcdbin | /bin/grep -v grep"
-        tests:
-          test_items:
-            - flag: "--client-cert-auth"
-              env: "ETCD_CLIENT_CERT_AUTH"
-              compare:
-                op: eq
-                value: true
-        remediation: |
-          Edit the etcd pod specification file $etcdconf on the master
-          node and set the below parameter.
-          --client-cert-auth="true"
-        scored: true
-
-      - id: 2.3
-        text: "Ensure that the --auto-tls argument is not set to true (Automated)"
-        audit: "/bin/ps -ef | /bin/grep $etcdbin | /bin/grep -v grep"
-        tests:
-          bin_op: or
-          test_items:
-            - flag: "--auto-tls"
-              env: "ETCD_AUTO_TLS"
-              set: false
-            - flag: "--auto-tls"
-              env: "ETCD_AUTO_TLS"
-              compare:
-                op: eq
-                value: false
-        remediation: |
-          Edit the etcd pod specification file $etcdconf on the master
-          node and either remove the --auto-tls parameter or set it to false.
-            --auto-tls=false
-        scored: true
-
-      - id: 2.4
-        text: "Ensure that the --peer-cert-file and --peer-key-file arguments are
-        set as appropriate (Automated)"
-        audit: "/bin/ps -ef | /bin/grep $etcdbin | /bin/grep -v grep"
-        tests:
-          bin_op: and
-          test_items:
-            - flag: "--peer-cert-file"
-              env: "ETCD_PEER_CERT_FILE"
-            - flag: "--peer-key-file"
-              env: "ETCD_PEER_KEY_FILE"
-        remediation: |
-          Follow the etcd service documentation and configure peer TLS encryption as appropriate
-          for your etcd cluster.
-          Then, edit the etcd pod specification file $etcdconf on the
-          master node and set the below parameters.
-          --peer-client-file=</path/to/peer-cert-file>
-          --peer-key-file=</path/to/peer-key-file>
-        scored: true
-
-      - id: 2.5
-        text: "Ensure that the --peer-client-cert-auth argument is set to true (Automated)"
-        audit: "/bin/ps -ef | /bin/grep $etcdbin | /bin/grep -v grep"
-        tests:
-          test_items:
-            - flag: "--peer-client-cert-auth"
-              env: "ETCD_PEER_CLIENT_CERT_AUTH"
-              compare:
-                op: eq
-                value: true
-        remediation: |
-          Edit the etcd pod specification file $etcdconf on the master
-          node and set the below parameter.
-          --peer-client-cert-auth=true
-        scored: true
-
-      - id: 2.6
-        text: "Ensure that the --peer-auto-tls argument is not set to true (Automated)"
-        audit: "/bin/ps -ef | /bin/grep $etcdbin | /bin/grep -v grep"
-        tests:
-          bin_op: or
-          test_items:
-            - flag: "--peer-auto-tls"
-              env: "ETCD_PEER_AUTO_TLS"
-              set: false
-            - flag: "--peer-auto-tls"
-              env: "ETCD_PEER_AUTO_TLS"
-              compare:
-                op: eq
-                value: false
-        remediation: |
-          Edit the etcd pod specification file $etcdconf on the master
-          node and either remove the --peer-auto-tls parameter or set it to false.
-          --peer-auto-tls=false
-        scored: true
-
-      - id: 2.7
-        text: "Ensure that a unique Certificate Authority is used for etcd (Manual)"
-        audit: "/bin/ps -ef | /bin/grep $etcdbin | /bin/grep -v grep"
-        tests:
-          test_items:
-            - flag: "--trusted-ca-file"
-              env: "ETCD_TRUSTED_CA_FILE"
-        remediation: |
-          [Manual test]
-          Follow the etcd documentation and create a dedicated certificate authority setup for the
-          etcd service.
-          Then, edit the etcd pod specification file $etcdconf on the
-          master node and set the below parameter.
-          --trusted-ca-file=</path/to/ca-file>
-        scored: false

cfg/cis-1.9/master.yaml

@@ -1,919 +0,0 @@
----
-controls:
-version: "cis-1.9"
-id: 1
-text: "Control Plane Security Configuration"
-type: "master"
-groups:
-  - id: 1.1
-    text: "Control Plane Node Configuration Files"
-    checks:
-      - id: 1.1.1
-        text: "Ensure that the API server pod specification file permissions are set to 600 or more restrictive (Automated)"
-        audit: "/bin/sh -c 'if test -e $apiserverconf; then stat -c permissions=%a $apiserverconf; fi'"
-        tests:
-          test_items:
-            - flag: "permissions"
-              compare:
-                op: bitmask
-                value: "600"
-        remediation: |
-          Run the below command (based on the file location on your system) on the
-          control plane node.
-          For example, chmod 600 $apiserverconf
-        scored: true
-
-      - id: 1.1.2
-        text: "Ensure that the API server pod specification file ownership is set to root:root (Automated)"
-        audit: "/bin/sh -c 'if test -e $apiserverconf; then stat -c %U:%G $apiserverconf; fi'"
-        tests:
-          test_items:
-            - flag: "root:root"
-        remediation: |
-          Run the below command (based on the file location on your system) on the control plane node.
-          For example, chown root:root $apiserverconf
-        scored: true
-
-      - id: 1.1.3
-        text: "Ensure that the controller manager pod specification file permissions are set to 600 or more restrictive (Automated)"
-        audit: "/bin/sh -c 'if test -e $controllermanagerconf; then stat -c permissions=%a $controllermanagerconf; fi'"
-        tests:
-          test_items:
-            - flag: "permissions"
-              compare:
-                op: bitmask
-                value: "600"
-        remediation: |
-          Run the below command (based on the file location on your system) on the control plane node.
-          For example, chmod 600 $controllermanagerconf
-        scored: true
-
-      - id: 1.1.4
-        text: "Ensure that the controller manager pod specification file ownership is set to root:root (Automated)"
-        audit: "/bin/sh -c 'if test -e $controllermanagerconf; then stat -c %U:%G $controllermanagerconf; fi'"
-        tests:
-          test_items:
-            - flag: "root:root"
-        remediation: |
-          Run the below command (based on the file location on your system) on the control plane node.
-          For example, chown root:root $controllermanagerconf
-        scored: true
-
-      - id: 1.1.5
-        text: "Ensure that the scheduler pod specification file permissions are set to 600 or more restrictive (Automated)"
-        audit: "/bin/sh -c 'if test -e $schedulerconf; then stat -c permissions=%a $schedulerconf; fi'"
-        tests:
-          test_items:
-            - flag: "permissions"
-              compare:
-                op: bitmask
-                value: "600"
-        remediation: |
-          Run the below command (based on the file location on your system) on the control plane node.
-          For example, chmod 600 $schedulerconf
-        scored: true
-
-      - id: 1.1.6
-        text: "Ensure that the scheduler pod specification file ownership is set to root:root (Automated)"
-        audit: "/bin/sh -c 'if test -e $schedulerconf; then stat -c %U:%G $schedulerconf; fi'"
-        tests:
-          test_items:
-            - flag: "root:root"
-        remediation: |
-          Run the below command (based on the file location on your system) on the control plane node.
-          For example, chown root:root $schedulerconf
-        scored: true
-
-      - id: 1.1.7
-        text: "Ensure that the etcd pod specification file permissions are set to 600 or more restrictive (Automated)"
-        audit: "/bin/sh -c 'if test -e $etcdconf; then find $etcdconf -name '*etcd*' | xargs stat -c permissions=%a; fi'"
-        use_multiple_values: true
-        tests:
-          test_items:
-            - flag: "permissions"
-              compare:
-                op: bitmask
-                value: "600"
-        remediation: |
-          Run the below command (based on the file location on your system) on the control plane node.
-          For example,
-          chmod 600 $etcdconf
-        scored: true
-
-      - id: 1.1.8
-        text: "Ensure that the etcd pod specification file ownership is set to root:root (Automated)"
-        audit: "/bin/sh -c 'if test -e $etcdconf; then find $etcdconf -name '*etcd*' | xargs stat -c %U:%G; fi'"
-        use_multiple_values: true
-        tests:
-          test_items:
-            - flag: "root:root"
-        remediation: |
-          Run the below command (based on the file location on your system) on the control plane node.
-          For example,
-          chown root:root $etcdconf
-        scored: true
-
-      - id: 1.1.9
-        text: "Ensure that the Container Network Interface file permissions are set to 600 or more restrictive (Manual)"
-        audit: |
-          ps -ef | grep $kubeletbin | grep -- --cni-conf-dir | sed 's%.*cni-conf-dir[= ]\([^ ]*\).*%\1%' | xargs -I{} find {} -mindepth 1 | xargs --no-run-if-empty stat -c permissions=%a
-          find /var/lib/cni/networks -type f 2> /dev/null | xargs --no-run-if-empty stat -c permissions=%a
-        use_multiple_values: true
-        tests:
-          test_items:
-            - flag: "permissions"
-              compare:
-                op: bitmask
-                value: "600"
-        remediation: |
-          Run the below command (based on the file location on your system) on the control plane node.
-          For example, chmod 600 <path/to/cni/files>
-        scored: false
-
-      - id: 1.1.10
-        text: "Ensure that the Container Network Interface file ownership is set to root:root (Manual)"
-        audit: |
-          ps -ef | grep $kubeletbin | grep -- --cni-conf-dir | sed 's%.*cni-conf-dir[= ]\([^ ]*\).*%\1%' | xargs -I{} find {} -mindepth 1 | xargs --no-run-if-empty stat -c %U:%G
-          find /var/lib/cni/networks -type f 2> /dev/null | xargs --no-run-if-empty stat -c %U:%G
-        use_multiple_values: true
-        tests:
-          test_items:
-            - flag: "root:root"
-        remediation: |
-          Run the below command (based on the file location on your system) on the control plane node.
-          For example,
-          chown root:root <path/to/cni/files>
-        scored: false
-
-      - id: 1.1.11
-        text: "Ensure that the etcd data directory permissions are set to 700 or more restrictive (Automated)"
-        audit: |
-          DATA_DIR=''
-          for d in $(ps -ef | grep $etcdbin | grep -- --data-dir | sed 's%.*data-dir[= ]\([^ ]*\).*%\1%'); do
-            if test -d "$d"; then DATA_DIR="$d"; fi
-          done
-          if ! test -d "$DATA_DIR"; then DATA_DIR=$etcddatadir; fi
-          stat -c permissions=%a "$DATA_DIR"
-        tests:
-          test_items:
-            - flag: "permissions"
-              compare:
-                op: bitmask
-                value: "700"
-        remediation: |
-          On the etcd server node, get the etcd data directory, passed as an argument --data-dir,
-          from the command 'ps -ef | grep etcd'.
-          Run the below command (based on the etcd data directory found above). For example,
-          chmod 700 /var/lib/etcd
-        scored: true
-
-      - id: 1.1.12
-        text: "Ensure that the etcd data directory ownership is set to etcd:etcd (Automated)"
-        audit: |
-          DATA_DIR=''
-          for d in $(ps -ef | grep $etcdbin | grep -- --data-dir | sed 's%.*data-dir[= ]\([^ ]*\).*%\1%'); do
-            if test -d "$d"; then DATA_DIR="$d"; fi
-          done
-          if ! test -d "$DATA_DIR"; then DATA_DIR=$etcddatadir; fi
-          stat -c %U:%G "$DATA_DIR"
-        tests:
-          test_items:
-            - flag: "etcd:etcd"
-        remediation: |
-          On the etcd server node, get the etcd data directory, passed as an argument --data-dir,
-          from the command 'ps -ef | grep etcd'.
-          Run the below command (based on the etcd data directory found above).
-          For example, chown etcd:etcd /var/lib/etcd
-        scored: true
-
-      - id: 1.1.13
-        text: "Ensure that the default administrative credential file permissions are set to 600 (Automated)"
-        audit: |
-         for adminconf in /etc/kubernetes/admin.conf /etc/kubernetes/super-admin.conf; do if test -e $adminconf; then stat -c "permissions=%a %n" $adminconf; fi; done
-        use_multiple_values: true
-        tests:
-          test_items:
-            - flag: "permissions"
-              compare:
-                op: bitmask
-                value: "600"
-        remediation: |
-          Run the below command (based on the file location on your system) on the control plane node.
-          For example, chmod 600 /etc/kubernetes/admin.conf
-          On Kubernetes 1.29+ the super-admin.conf file should also be modified, if present.
-          For example, chmod 600 /etc/kubernetes/super-admin.conf
-        scored: true
-
-      - id: 1.1.14
-        text: "Ensure that the default administrative credential file ownership is set to root:root (Automated)"
-        audit: |
-         for adminconf in /etc/kubernetes/admin.conf /etc/kubernetes/super-admin.conf; do if test -e $adminconf; then stat -c "ownership=%U:%G %n" $adminconf; fi; done
-        use_multiple_values: true
-        tests:
-          test_items:
-            - flag: "ownership"
-              compare:
-                op: eq
-                value: "root:root"
-        remediation: |
-          Run the below command (based on the file location on your system) on the control plane node.
-          For example, chown root:root /etc/kubernetes/admin.conf
-          On Kubernetes 1.29+ the super-admin.conf file should also be modified, if present.
-          For example, chown root:root /etc/kubernetes/super-admin.conf
-        scored: true
-
-      - id: 1.1.15
-        text: "Ensure that the scheduler.conf file permissions are set to 600 or more restrictive (Automated)"
-        audit: "/bin/sh -c 'if test -e $schedulerkubeconfig; then stat -c permissions=%a $schedulerkubeconfig; fi'"
-        tests:
-          test_items:
-            - flag: "permissions"
-              compare:
-                op: bitmask
-                value: "600"
-        remediation: |
-          Run the below command (based on the file location on your system) on the control plane node.
-          For example,
-          chmod 600 $schedulerkubeconfig
-        scored: true
-
-      - id: 1.1.16
-        text: "Ensure that the scheduler.conf file ownership is set to root:root (Automated)"
-        audit: "/bin/sh -c 'if test -e $schedulerkubeconfig; then stat -c %U:%G $schedulerkubeconfig; fi'"
-        tests:
-          test_items:
-            - flag: "root:root"
-        remediation: |
-          Run the below command (based on the file location on your system) on the control plane node.
-          For example,
-          chown root:root $schedulerkubeconfig
-        scored: true
-
-      - id: 1.1.17
-        text: "Ensure that the controller-manager.conf file permissions are set to 600 or more restrictive (Automated)"
-        audit: "/bin/sh -c 'if test -e $controllermanagerkubeconfig; then stat -c permissions=%a $controllermanagerkubeconfig; fi'"
-        tests:
-          test_items:
-            - flag: "permissions"
-              compare:
-                op: bitmask
-                value: "600"
-        remediation: |
-          Run the below command (based on the file location on your system) on the control plane node.
-          For example,
-          chmod 600 $controllermanagerkubeconfig
-        scored: true
-
-      - id: 1.1.18
-        text: "Ensure that the controller-manager.conf file ownership is set to root:root (Automated)"
-        audit: "/bin/sh -c 'if test -e $controllermanagerkubeconfig; then stat -c %U:%G $controllermanagerkubeconfig; fi'"
-        tests:
-          test_items:
-            - flag: "root:root"
-        remediation: |
-          Run the below command (based on the file location on your system) on the control plane node.
-          For example,
-          chown root:root $controllermanagerkubeconfig
-        scored: true
-
-      - id: 1.1.19
-        text: "Ensure that the Kubernetes PKI directory and file ownership is set to root:root (Automated)"
-        audit: "find /etc/kubernetes/pki/ | xargs stat -c %U:%G"
-        use_multiple_values: true
-        tests:
-          test_items:
-            - flag: "root:root"
-        remediation: |
-          Run the below command (based on the file location on your system) on the control plane node.
-          For example,
-          chown -R root:root /etc/kubernetes/pki/
-        scored: true
-
-      - id: 1.1.20
-        text: "Ensure that the Kubernetes PKI certificate file permissions are set to 600 or more restrictive (Manual)"
-        audit: "find /etc/kubernetes/pki/ -name '*.crt' | xargs stat -c permissions=%a"
-        use_multiple_values: true
-        tests:
-          test_items:
-            - flag: "permissions"
-              compare:
-                op: bitmask
-                value: "600"
-        remediation: |
-          Run the below command (based on the file location on your system) on the control plane node.
-          For example,
-          chmod -R 600 /etc/kubernetes/pki/*.crt
-        scored: false
-
-      - id: 1.1.21
-        text: "Ensure that the Kubernetes PKI key file permissions are set to 600 (Manual)"
-        audit: "find /etc/kubernetes/pki/ -name '*.key' | xargs stat -c permissions=%a"
-        use_multiple_values: true
-        tests:
-          test_items:
-            - flag: "permissions"
-              compare:
-                op: bitmask
-                value: "600"
-        remediation: |
-          Run the below command (based on the file location on your system) on the control plane node.
-          For example,
-          chmod -R 600 /etc/kubernetes/pki/*.key
-        scored: false
-
-  - id: 1.2
-    text: "API Server"
-    checks:
-      - id: 1.2.1
-        text: "Ensure that the --anonymous-auth argument is set to false (Manual)"
-        audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep"
-        tests:
-          test_items:
-            - flag: "--anonymous-auth"
-              compare:
-                op: eq
-                value: false
-        remediation: |
-          Edit the API server pod specification file $apiserverconf
-          on the control plane node and set the below parameter.
-          --anonymous-auth=false
-        scored: false
-
-      - id: 1.2.2
-        text: "Ensure that the --token-auth-file parameter is not set (Automated)"
-        audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep"
-        tests:
-          test_items:
-            - flag: "--token-auth-file"
-              set: false
-        remediation: |
-          Follow the documentation and configure alternate mechanisms for authentication. Then,
-          edit the API server pod specification file $apiserverconf
-          on the control plane node and remove the --token-auth-file=<filename> parameter.
-        scored: true
-
-      - id: 1.2.3
-        text: "Ensure that the --DenyServiceExternalIPs is set (Manual)"
-        audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep"
-        tests:
-          bin_op: or
-          test_items:
-            - flag: "--enable-admission-plugins"
-              compare:
-                op: has
-                value: "DenyServiceExternalIPs"
-        remediation: |
-          Edit the API server pod specification file $apiserverconf
-          on the control plane node and add the `DenyServiceExternalIPs` plugin
-          to the enabled admission plugins, as such --enable-admission-plugin=DenyServiceExternalIPs.
-        scored: false
-
-      - id: 1.2.4
-        text: "Ensure that the --kubelet-client-certificate and --kubelet-client-key arguments are set as appropriate (Automated)"
-        audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep"
-        tests:
-          bin_op: and
-          test_items:
-            - flag: "--kubelet-client-certificate"
-            - flag: "--kubelet-client-key"
-        remediation: |
-          Follow the Kubernetes documentation and set up the TLS connection between the
-          apiserver and kubelets. Then, edit API server pod specification file
-          $apiserverconf on the control plane node and set the
-          kubelet client certificate and key parameters as below.
-          --kubelet-client-certificate=<path/to/client-certificate-file>
-          --kubelet-client-key=<path/to/client-key-file>
-        scored: true
-
-      - id: 1.2.5
-        text: "Ensure that the --kubelet-certificate-authority argument is set as appropriate (Automated)"
-        audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep"
-        tests:
-          test_items:
-            - flag: "--kubelet-certificate-authority"
-        remediation: |
-          Follow the Kubernetes documentation and setup the TLS connection between
-          the apiserver and kubelets. Then, edit the API server pod specification file
-          $apiserverconf on the control plane node and set the
-          --kubelet-certificate-authority parameter to the path to the cert file for the certificate authority.
-          --kubelet-certificate-authority=<ca-string>
-        scored: true
-
-      - id: 1.2.6
-        text: "Ensure that the --authorization-mode argument is not set to AlwaysAllow (Automated)"
-        audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep"
-        tests:
-          test_items:
-            - flag: "--authorization-mode"
-              compare:
-                op: nothave
-                value: "AlwaysAllow"
-        remediation: |
-          Edit the API server pod specification file $apiserverconf
-          on the control plane node and set the --authorization-mode parameter to values other than AlwaysAllow.
-          One such example could be as below.
-          --authorization-mode=RBAC
-        scored: true
-
-      - id: 1.2.7
-        text: "Ensure that the --authorization-mode argument includes Node (Automated)"
-        audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep"
-        tests:
-          test_items:
-            - flag: "--authorization-mode"
-              compare:
-                op: has
-                value: "Node"
-        remediation: |
-          Edit the API server pod specification file $apiserverconf
-          on the control plane node and set the --authorization-mode parameter to a value that includes Node.
-          --authorization-mode=Node,RBAC
-        scored: true
-
-      - id: 1.2.8
-        text: "Ensure that the --authorization-mode argument includes RBAC (Automated)"
-        audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep"
-        tests:
-          test_items:
-            - flag: "--authorization-mode"
-              compare:
-                op: has
-                value: "RBAC"
-        remediation: |
-          Edit the API server pod specification file $apiserverconf
-          on the control plane node and set the --authorization-mode parameter to a value that includes RBAC,
-          for example `--authorization-mode=Node,RBAC`.
-        scored: true
-
-      - id: 1.2.9
-        text: "Ensure that the admission control plugin EventRateLimit is set (Manual)"
-        audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep"
-        tests:
-          test_items:
-            - flag: "--enable-admission-plugins"
-              compare:
-                op: has
-                value: "EventRateLimit"
-        remediation: |
-          Follow the Kubernetes documentation and set the desired limits in a configuration file.
-          Then, edit the API server pod specification file $apiserverconf
-          and set the below parameters.
-          --enable-admission-plugins=...,EventRateLimit,...
-          --admission-control-config-file=<path/to/configuration/file>
-        scored: false
-
-      - id: 1.2.10
-        text: "Ensure that the admission control plugin AlwaysAdmit is not set (Automated)"
-        audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep"
-        tests:
-          bin_op: or
-          test_items:
-            - flag: "--enable-admission-plugins"
-              compare:
-                op: nothave
-                value: AlwaysAdmit
-            - flag: "--enable-admission-plugins"
-              set: false
-        remediation: |
-          Edit the API server pod specification file $apiserverconf
-          on the control plane node and either remove the --enable-admission-plugins parameter, or set it to a
-          value that does not include AlwaysAdmit.
-        scored: true
-
-      - id: 1.2.11
-        text: "Ensure that the admission control plugin AlwaysPullImages is set (Manual)"
-        audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep"
-        tests:
-          test_items:
-            - flag: "--enable-admission-plugins"
-              compare:
-                op: has
-                value: "AlwaysPullImages"
-        remediation: |
-          Edit the API server pod specification file $apiserverconf
-          on the control plane node and set the --enable-admission-plugins parameter to include
-          AlwaysPullImages.
-          --enable-admission-plugins=...,AlwaysPullImages,...
-        scored: false
-
-      - id: 1.2.12
-        text: "Ensure that the admission control plugin ServiceAccount is set (Automated)"
-        audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep"
-        tests:
-          bin_op: or
-          test_items:
-            - flag: "--disable-admission-plugins"
-              compare:
-                op: nothave
-                value: "ServiceAccount"
-            - flag: "--disable-admission-plugins"
-              set: false
-        remediation: |
-          Follow the documentation and create ServiceAccount objects as per your environment.
-          Then, edit the API server pod specification file $apiserverconf
-          on the control plane node and ensure that the --disable-admission-plugins parameter is set to a
-          value that does not include ServiceAccount.
-        scored: true
-
-      - id: 1.2.13
-        text: "Ensure that the admission control plugin NamespaceLifecycle is set (Automated)"
-        audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep"
-        tests:
-          bin_op: or
-          test_items:
-            - flag: "--disable-admission-plugins"
-              compare:
-                op: nothave
-                value: "NamespaceLifecycle"
-            - flag: "--disable-admission-plugins"
-              set: false
-        remediation: |
-          Edit the API server pod specification file $apiserverconf
-          on the control plane node and set the --disable-admission-plugins parameter to
-          ensure it does not include NamespaceLifecycle.
-        scored: true
-
-      - id: 1.2.14
-        text: "Ensure that the admission control plugin NodeRestriction is set (Automated)"
-        audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep"
-        tests:
-          test_items:
-            - flag: "--enable-admission-plugins"
-              compare:
-                op: has
-                value: "NodeRestriction"
-        remediation: |
-          Follow the Kubernetes documentation and configure NodeRestriction plug-in on kubelets.
-          Then, edit the API server pod specification file $apiserverconf
-          on the control plane node and set the --enable-admission-plugins parameter to a
-          value that includes NodeRestriction.
-          --enable-admission-plugins=...,NodeRestriction,...
-        scored: true
-
-      - id: 1.2.15
-        text: "Ensure that the --profiling argument is set to false (Automated)"
-        audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep"
-        tests:
-          test_items:
-            - flag: "--profiling"
-              compare:
-                op: eq
-                value: false
-        remediation: |
-          Edit the API server pod specification file $apiserverconf
-          on the control plane node and set the below parameter.
-          --profiling=false
-        scored: true
-
-      - id: 1.2.16
-        text: "Ensure that the --audit-log-path argument is set (Automated)"
-        audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep"
-        tests:
-          test_items:
-            - flag: "--audit-log-path"
-        remediation: |
-          Edit the API server pod specification file $apiserverconf
-          on the control plane node and set the --audit-log-path parameter to a suitable path and
-          file where you would like audit logs to be written, for example,
-          --audit-log-path=/var/log/apiserver/audit.log
-        scored: true
-
-      - id: 1.2.17
-        text: "Ensure that the --audit-log-maxage argument is set to 30 or as appropriate (Automated)"
-        audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep"
-        tests:
-          test_items:
-            - flag: "--audit-log-maxage"
-              compare:
-                op: gte
-                value: 30
-        remediation: |
-          Edit the API server pod specification file $apiserverconf
-          on the control plane node and set the --audit-log-maxage parameter to 30
-          or as an appropriate number of days, for example,
-          --audit-log-maxage=30
-        scored: true
-
-      - id: 1.2.18
-        text: "Ensure that the --audit-log-maxbackup argument is set to 10 or as appropriate (Automated)"
-        audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep"
-        tests:
-          test_items:
-            - flag: "--audit-log-maxbackup"
-              compare:
-                op: gte
-                value: 10
-        remediation: |
-          Edit the API server pod specification file $apiserverconf
-          on the control plane node and set the --audit-log-maxbackup parameter to 10 or to an appropriate
-          value. For example,
-          --audit-log-maxbackup=10
-        scored: true
-
-      - id: 1.2.19
-        text: "Ensure that the --audit-log-maxsize argument is set to 100 or as appropriate (Automated)"
-        audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep"
-        tests:
-          test_items:
-            - flag: "--audit-log-maxsize"
-              compare:
-                op: gte
-                value: 100
-        remediation: |
-          Edit the API server pod specification file $apiserverconf
-          on the control plane node and set the --audit-log-maxsize parameter to an appropriate size in MB.
-          For example, to set it as 100 MB, --audit-log-maxsize=100
-        scored: true
-
-      - id: 1.2.20
-        text: "Ensure that the --request-timeout argument is set as appropriate (Manual)"
-        audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep"
-        type: manual
-        remediation: |
-          Edit the API server pod specification file $apiserverconf
-          and set the below parameter as appropriate and if needed.
-          For example, --request-timeout=300s
-        scored: false
-
-      - id: 1.2.21
-        text: "Ensure that the --service-account-lookup argument is set to true (Automated)"
-        audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep"
-        tests:
-          bin_op: or
-          test_items:
-            - flag: "--service-account-lookup"
-              set: false
-            - flag: "--service-account-lookup"
-              compare:
-                op: eq
-                value: true
-        remediation: |
-          Edit the API server pod specification file $apiserverconf
-          on the control plane node and set the below parameter.
-          --service-account-lookup=true
-          Alternatively, you can delete the --service-account-lookup parameter from this file so
-          that the default takes effect.
-        scored: true
-
-      - id: 1.2.22
-        text: "Ensure that the --service-account-key-file argument is set as appropriate (Automated)"
-        audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep"
-        tests:
-          test_items:
-            - flag: "--service-account-key-file"
-        remediation: |
-          Edit the API server pod specification file $apiserverconf
-          on the control plane node and set the --service-account-key-file parameter
-          to the public key file for service accounts. For example,
-          --service-account-key-file=<filename>
-        scored: true
-
-      - id: 1.2.23
-        text: "Ensure that the --etcd-certfile and --etcd-keyfile arguments are set as appropriate (Automated)"
-        audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep"
-        tests:
-          bin_op: and
-          test_items:
-            - flag: "--etcd-certfile"
-            - flag: "--etcd-keyfile"
-        remediation: |
-          Follow the Kubernetes documentation and set up the TLS connection between the apiserver and etcd.
-          Then, edit the API server pod specification file $apiserverconf
-          on the control plane node and set the etcd certificate and key file parameters.
-          --etcd-certfile=<path/to/client-certificate-file>
-          --etcd-keyfile=<path/to/client-key-file>
-        scored: true
-
-      - id: 1.2.24
-        text: "Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate (Automated)"
-        audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep"
-        tests:
-          bin_op: and
-          test_items:
-            - flag: "--tls-cert-file"
-            - flag: "--tls-private-key-file"
-        remediation: |
-          Follow the Kubernetes documentation and set up the TLS connection on the apiserver.
-          Then, edit the API server pod specification file $apiserverconf
-          on the control plane node and set the TLS certificate and private key file parameters.
-          --tls-cert-file=<path/to/tls-certificate-file>
-          --tls-private-key-file=<path/to/tls-key-file>
-        scored: true
-
-      - id: 1.2.25
-        text: "Ensure that the --client-ca-file argument is set as appropriate (Automated)"
-        audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep"
-        tests:
-          test_items:
-            - flag: "--client-ca-file"
-        remediation: |
-          Follow the Kubernetes documentation and set up the TLS connection on the apiserver.
-          Then, edit the API server pod specification file $apiserverconf
-          on the control plane node and set the client certificate authority file.
-          --client-ca-file=<path/to/client-ca-file>
-        scored: true
-
-      - id: 1.2.26
-        text: "Ensure that the --etcd-cafile argument is set as appropriate (Automated)"
-        audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep"
-        tests:
-          test_items:
-            - flag: "--etcd-cafile"
-        remediation: |
-          Follow the Kubernetes documentation and set up the TLS connection between the apiserver and etcd.
-          Then, edit the API server pod specification file $apiserverconf
-          on the control plane node and set the etcd certificate authority file parameter.
-          --etcd-cafile=<path/to/ca-file>
-        scored: true
-
-      - id: 1.2.27
-        text: "Ensure that the --encryption-provider-config argument is set as appropriate (Manual)"
-        audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep"
-        tests:
-          test_items:
-            - flag: "--encryption-provider-config"
-        remediation: |
-          Follow the Kubernetes documentation and configure a EncryptionConfig file.
-          Then, edit the API server pod specification file $apiserverconf
-          on the control plane node and set the --encryption-provider-config parameter to the path of that file.
-          For example, --encryption-provider-config=</path/to/EncryptionConfig/File>
-        scored: false
-
-      - id: 1.2.28
-        text: "Ensure that encryption providers are appropriately configured (Manual)"
-        audit: |
-          ENCRYPTION_PROVIDER_CONFIG=$(ps -ef | grep $apiserverbin | grep -- --encryption-provider-config | sed 's%.*encryption-provider-config[= ]\([^ ]*\).*%\1%')
-          if test -e $ENCRYPTION_PROVIDER_CONFIG; then grep -A1 'providers:' $ENCRYPTION_PROVIDER_CONFIG | tail -n1 | grep -o "[A-Za-z]*" | sed 's/^/provider=/'; fi
-        tests:
-          test_items:
-            - flag: "provider"
-              compare:
-                op: valid_elements
-                value: "aescbc,kms,secretbox"
-        remediation: |
-          Follow the Kubernetes documentation and configure a EncryptionConfig file.
-          In this file, choose aescbc, kms or secretbox as the encryption provider.
-        scored: false
-
-      - id: 1.2.29
-        text: "Ensure that the API Server only makes use of Strong Cryptographic Ciphers (Manual)"
-        audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep"
-        tests:
-          test_items:
-            - flag: "--tls-cipher-suites"
-              compare:
-                op: valid_elements
-                value: "TLS_AES_128_GCM_SHA256,TLS_AES_256_GCM_SHA384,TLS_CHACHA20_POLY1305_SHA256,TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256,TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256,TLS_RSA_WITH_3DES_EDE_CBC_SHA,TLS_RSA_WITH_AES_128_CBC_SHA,TLS_RSA_WITH_AES_128_GCM_SHA256,TLS_RSA_WITH_AES_256_CBC_SHA,TLS_RSA_WITH_AES_256_GCM_SHA384"
-        remediation: |
-          Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml
-          on the control plane node and set the below parameter.
-          --tls-cipher-suites=TLS_AES_128_GCM_SHA256,TLS_AES_256_GCM_SHA384,TLS_CHACHA20_POLY1305_SHA256,
-          TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
-          TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
-          TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256,
-          TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
-          TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,
-          TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256,TLS_RSA_WITH_3DES_EDE_CBC_SHA,TLS_RSA_WITH_AES_128_CBC_SHA,
-          TLS_RSA_WITH_AES_128_GCM_SHA256,TLS_RSA_WITH_AES_256_CBC_SHA,TLS_RSA_WITH_AES_256_GCM_SHA384
-        scored: false
-
-  - id: 1.3
-    text: "Controller Manager"
-    checks:
-      - id: 1.3.1
-        text: "Ensure that the --terminated-pod-gc-threshold argument is set as appropriate (Manual)"
-        audit: "/bin/ps -ef | grep $controllermanagerbin | grep -v grep"
-        tests:
-          test_items:
-            - flag: "--terminated-pod-gc-threshold"
-        remediation: |
-          Edit the Controller Manager pod specification file $controllermanagerconf
-          on the control plane node and set the --terminated-pod-gc-threshold to an appropriate threshold,
-          for example, --terminated-pod-gc-threshold=10
-        scored: false
-
-      - id: 1.3.2
-        text: "Ensure that the --profiling argument is set to false (Automated)"
-        audit: "/bin/ps -ef | grep $controllermanagerbin | grep -v grep"
-        tests:
-          test_items:
-            - flag: "--profiling"
-              compare:
-                op: eq
-                value: false
-        remediation: |
-          Edit the Controller Manager pod specification file $controllermanagerconf
-          on the control plane node and set the below parameter.
-          --profiling=false
-        scored: true
-
-      - id: 1.3.3
-        text: "Ensure that the --use-service-account-credentials argument is set to true (Automated)"
-        audit: "/bin/ps -ef | grep $controllermanagerbin | grep -v grep"
-        tests:
-          test_items:
-            - flag: "--use-service-account-credentials"
-              compare:
-                op: noteq
-                value: false
-        remediation: |
-          Edit the Controller Manager pod specification file $controllermanagerconf
-          on the control plane node to set the below parameter.
-          --use-service-account-credentials=true
-        scored: true
-
-      - id: 1.3.4
-        text: "Ensure that the --service-account-private-key-file argument is set as appropriate (Automated)"
-        audit: "/bin/ps -ef | grep $controllermanagerbin | grep -v grep"
-        tests:
-          test_items:
-            - flag: "--service-account-private-key-file"
-        remediation: |
-          Edit the Controller Manager pod specification file $controllermanagerconf
-          on the control plane node and set the --service-account-private-key-file parameter
-          to the private key file for service accounts.
-          --service-account-private-key-file=<filename>
-        scored: true
-
-      - id: 1.3.5
-        text: "Ensure that the --root-ca-file argument is set as appropriate (Automated)"
-        audit: "/bin/ps -ef | grep $controllermanagerbin | grep -v grep"
-        tests:
-          test_items:
-            - flag: "--root-ca-file"
-        remediation: |
-          Edit the Controller Manager pod specification file $controllermanagerconf
-          on the control plane node and set the --root-ca-file parameter to the certificate bundle file`.
-          --root-ca-file=<path/to/file>
-        scored: true
-
-      - id: 1.3.6
-        text: "Ensure that the RotateKubeletServerCertificate argument is set to true (Automated)"
-        audit: "/bin/ps -ef | grep $controllermanagerbin | grep -v grep"
-        tests:
-          bin_op: or
-          test_items:
-            - flag: "--feature-gates"
-              compare:
-                op: nothave
-                value: "RotateKubeletServerCertificate=false"
-              set: true
-            - flag: "--feature-gates"
-              set: false
-        remediation: |
-          Edit the Controller Manager pod specification file $controllermanagerconf
-          on the control plane node and set the --feature-gates parameter to include RotateKubeletServerCertificate=true.
-          --feature-gates=RotateKubeletServerCertificate=true
-        scored: true
-
-      - id: 1.3.7
-        text: "Ensure that the --bind-address argument is set to 127.0.0.1 (Automated)"
-        audit: "/bin/ps -ef | grep $controllermanagerbin | grep -v grep"
-        tests:
-          bin_op: or
-          test_items:
-            - flag: "--bind-address"
-              compare:
-                op: eq
-                value: "127.0.0.1"
-            - flag: "--bind-address"
-              set: false
-        remediation: |
-          Edit the Controller Manager pod specification file $controllermanagerconf
-          on the control plane node and ensure the correct value for the --bind-address parameter
-        scored: true
-
-  - id: 1.4
-    text: "Scheduler"
-    checks:
-      - id: 1.4.1
-        text: "Ensure that the --profiling argument is set to false (Automated)"
-        audit: "/bin/ps -ef | grep $schedulerbin | grep -v grep"
-        tests:
-          test_items:
-            - flag: "--profiling"
-              compare:
-                op: eq
-                value: false
-        remediation: |
-          Edit the Scheduler pod specification file $schedulerconf file
-          on the control plane node and set the below parameter.
-          --profiling=false
-        scored: true
-
-      - id: 1.4.2
-        text: "Ensure that the --bind-address argument is set to 127.0.0.1 (Automated)"
-        audit: "/bin/ps -ef | grep $schedulerbin | grep -v grep"
-        tests:
-          bin_op: or
-          test_items:
-            - flag: "--bind-address"
-              compare:
-                op: eq
-                value: "127.0.0.1"
-            - flag: "--bind-address"
-              set: false
-        remediation: |
-          Edit the Scheduler pod specification file $schedulerconf
-          on the control plane node and ensure the correct value for the --bind-address parameter
-        scored: true

cfg/cis-1.9/node.yaml

@@ -1,478 +0,0 @@
----
-controls:
-version: "cis-1.9"
-id: 4
-text: "Worker Node Security Configuration"
-type: "node"
-groups:
-  - id: 4.1
-    text: "Worker Node Configuration Files"
-    checks:
-      - id: 4.1.1
-        text: "Ensure that the kubelet service file permissions are set to 600 or more restrictive (Automated)"
-        audit: '/bin/sh -c ''if test -e $kubeletsvc; then stat -c permissions=%a $kubeletsvc; fi'' '
-        tests:
-          test_items:
-            - flag: "permissions"
-              compare:
-                op: bitmask
-                value: "600"
-        remediation: |
-          Run the below command (based on the file location on your system) on the each worker node.
-          For example, chmod 600 $kubeletsvc
-        scored: true
-
-      - id: 4.1.2
-        text: "Ensure that the kubelet service file ownership is set to root:root (Automated)"
-        audit: '/bin/sh -c "if test -e $kubeletsvc; then stat -c %U:%G $kubeletsvc; else echo \"File not found\"; fi"'
-        tests:
-          bin_op: or
-          test_items:
-            - flag: root:root
-            - flag: "File not found"
-        remediation: |
-            Run the below command (based on the file location on your system) on the each worker node.
-            For example,
-            chown root:root $kubeletsvc
-        scored: true
-
-      - id: 4.1.3
-        text: "If proxy kubeconfig file exists ensure permissions are set to 600 or more restrictive (Manual)"
-        audit: '/bin/sh -c ''if test -e $proxykubeconfig; then stat -c permissions=%a $proxykubeconfig; fi'' '
-        tests:
-          bin_op: or
-          test_items:
-            - flag: "permissions"
-              set: true
-              compare:
-                op: bitmask
-                value: "600"
-        remediation: |
-          Run the below command (based on the file location on your system) on the each worker node.
-          For example,
-          chmod 600 $proxykubeconfig
-        scored: false
-
-      - id: 4.1.4
-        text: "If proxy kubeconfig file exists ensure ownership is set to root:root (Manual)"
-        audit: '/bin/sh -c ''if test -e $proxykubeconfig; then stat -c %U:%G $proxykubeconfig; fi'' '
-        tests:
-          bin_op: or
-          test_items:
-            - flag: root:root
-        remediation: |
-          Run the below command (based on the file location on your system) on the each worker node.
-          For example, chown root:root $proxykubeconfig
-        scored: false
-
-      - id: 4.1.5
-        text: "Ensure that the --kubeconfig kubelet.conf file permissions are set to 600 or more restrictive (Automated)"
-        audit: '/bin/sh -c ''if test -e $kubeletkubeconfig; then stat -c permissions=%a $kubeletkubeconfig; fi'' '
-        tests:
-          test_items:
-            - flag: "permissions"
-              compare:
-                op: bitmask
-                value: "600"
-        remediation: |
-          Run the below command (based on the file location on your system) on the each worker node.
-          For example,
-          chmod 600 $kubeletkubeconfig
-        scored: true
-
-      - id: 4.1.6
-        text: "Ensure that the --kubeconfig kubelet.conf file ownership is set to root:root (Automated)"
-        audit: '/bin/sh -c ''if test -e $kubeletkubeconfig; then stat -c %U:%G $kubeletkubeconfig; fi'' '
-        tests:
-          test_items:
-            - flag: root:root
-        remediation: |
-          Run the below command (based on the file location on your system) on the each worker node.
-          For example,
-          chown root:root $kubeletkubeconfig
-        scored: true
-
-      - id: 4.1.7
-        text: "Ensure that the certificate authorities file permissions are set to 600 or more restrictive (Manual)"
-        audit: |
-          CAFILE=$(ps -ef | grep kubelet | grep -v apiserver | grep -- --client-ca-file= | awk -F '--client-ca-file=' '{print $2}' | awk '{print $1}' | uniq)
-          if test -z $CAFILE; then CAFILE=$kubeletcafile; fi
-          if test -e $CAFILE; then stat -c permissions=%a $CAFILE; fi
-        tests:
-          test_items:
-            - flag: "permissions"
-              compare:
-                op: bitmask
-                value: "600"
-        remediation: |
-          Run the following command to modify the file permissions of the
-          --client-ca-file chmod 600 <filename>
-        scored: false
-
-      - id: 4.1.8
-        text: "Ensure that the client certificate authorities file ownership is set to root:root (Manual)"
-        audit: |
-          CAFILE=$(ps -ef | grep kubelet | grep -v apiserver | grep -- --client-ca-file= | awk -F '--client-ca-file=' '{print $2}' | awk '{print $1}' | uniq)
-          if test -z $CAFILE; then CAFILE=$kubeletcafile; fi
-          if test -e $CAFILE; then stat -c %U:%G $CAFILE; fi
-        tests:
-          test_items:
-            - flag: root:root
-              compare:
-                op: eq
-                value: root:root
-        remediation: |
-          Run the following command to modify the ownership of the --client-ca-file.
-          chown root:root <filename>
-        scored: false
-
-      - id: 4.1.9
-        text: "If the kubelet config.yaml configuration file is being used validate permissions set to 600 or more restrictive (Automated)"
-        audit: '/bin/sh -c ''if test -e $kubeletconf; then stat -c permissions=%a $kubeletconf; fi'' '
-        tests:
-          test_items:
-            - flag: "permissions"
-              compare:
-                op: bitmask
-                value: "600"
-        remediation: |
-          Run the following command (using the config file location identified in the Audit step)
-          chmod 600 $kubeletconf
-        scored: true
-
-      - id: 4.1.10
-        text: "If the kubelet config.yaml configuration file is being used validate file ownership is set to root:root (Automated)"
-        audit: '/bin/sh -c ''if test -e $kubeletconf; then stat -c %U:%G $kubeletconf; fi'' '
-        tests:
-          test_items:
-            - flag: root:root
-        remediation: |
-          Run the following command (using the config file location identified in the Audit step)
-          chown root:root $kubeletconf
-        scored: true
-
-  - id: 4.2
-    text: "Kubelet"
-    checks:
-      - id: 4.2.1
-        text: "Ensure that the --anonymous-auth argument is set to false (Automated)"
-        audit: "/bin/ps -fC $kubeletbin"
-        audit_config: "/bin/cat $kubeletconf"
-        tests:
-          test_items:
-            - flag: "--anonymous-auth"
-              path: '{.authentication.anonymous.enabled}'
-              compare:
-                op: eq
-                value: false
-        remediation: |
-          If using a Kubelet config file, edit the file to set `authentication: anonymous: enabled` to
-          `false`.
-          If using executable arguments, edit the kubelet service file
-          $kubeletsvc on each worker node and
-          set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable.
-          `--anonymous-auth=false`
-          Based on your system, restart the kubelet service. For example,
-          systemctl daemon-reload
-          systemctl restart kubelet.service
-        scored: true
-
-      - id: 4.2.2
-        text: "Ensure that the --authorization-mode argument is not set to AlwaysAllow (Automated)"
-        audit: "/bin/ps -fC $kubeletbin"
-        audit_config: "/bin/cat $kubeletconf"
-        tests:
-          test_items:
-            - flag: --authorization-mode
-              path: '{.authorization.mode}'
-              compare:
-                op: nothave
-                value: AlwaysAllow
-        remediation: |
-          If using a Kubelet config file, edit the file to set `authorization.mode` to Webhook. If
-          using executable arguments, edit the kubelet service file
-          $kubeletsvc on each worker node and
-          set the below parameter in KUBELET_AUTHZ_ARGS variable.
-          --authorization-mode=Webhook
-          Based on your system, restart the kubelet service. For example,
-          systemctl daemon-reload
-          systemctl restart kubelet.service
-        scored: true
-
-      - id: 4.2.3
-        text: "Ensure that the --client-ca-file argument is set as appropriate (Automated)"
-        audit: "/bin/ps -fC $kubeletbin"
-        audit_config: "/bin/cat $kubeletconf"
-        tests:
-          test_items:
-            - flag: --client-ca-file
-              path: '{.authentication.x509.clientCAFile}'
-        remediation: |
-          If using a Kubelet config file, edit the file to set `authentication.x509.clientCAFile` to
-          the location of the client CA file.
-          If using command line arguments, edit the kubelet service file
-          $kubeletsvc on each worker node and
-          set the below parameter in KUBELET_AUTHZ_ARGS variable.
-          --client-ca-file=<path/to/client-ca-file>
-          Based on your system, restart the kubelet service. For example,
-          systemctl daemon-reload
-          systemctl restart kubelet.service
-        scored: true
-
-      - id: 4.2.4
-        text: "Verify that the --read-only-port argument is set to 0 (Manual)"
-        audit: "/bin/ps -fC $kubeletbin"
-        audit_config: "/bin/cat $kubeletconf"
-        tests:
-          bin_op: or
-          test_items:
-            - flag: "--read-only-port"
-              path: '{.readOnlyPort}'
-              compare:
-                op: eq
-                value: 0
-            - flag: "--read-only-port"
-              path: '{.readOnlyPort}'
-              set: false
-        remediation: |
-          If using a Kubelet config file, edit the file to set `readOnlyPort` to 0.
-          If using command line arguments, edit the kubelet service file
-          $kubeletsvc on each worker node and
-          set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable.
-          --read-only-port=0
-          Based on your system, restart the kubelet service. For example,
-          systemctl daemon-reload
-          systemctl restart kubelet.service
-        scored: false
-
-      - id: 4.2.5
-        text: "Ensure that the --streaming-connection-idle-timeout argument is not set to 0 (Manual)"
-        audit: "/bin/ps -fC $kubeletbin"
-        audit_config: "/bin/cat $kubeletconf"
-        tests:
-          test_items:
-            - flag: --streaming-connection-idle-timeout
-              path: '{.streamingConnectionIdleTimeout}'
-              compare:
-                op: noteq
-                value: 0
-            - flag: --streaming-connection-idle-timeout
-              path: '{.streamingConnectionIdleTimeout}'
-              set: false
-          bin_op: or
-        remediation: |
-          If using a Kubelet config file, edit the file to set `streamingConnectionIdleTimeout` to a
-          value other than 0.
-          If using command line arguments, edit the kubelet service file
-          $kubeletsvc on each worker node and
-          set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable.
-          --streaming-connection-idle-timeout=5m
-          Based on your system, restart the kubelet service. For example,
-          systemctl daemon-reload
-          systemctl restart kubelet.service
-        scored: false
-
-      - id: 4.2.6
-        text: "Ensure that the --make-iptables-util-chains argument is set to true (Automated)"
-        audit: "/bin/ps -fC $kubeletbin"
-        audit_config: "/bin/cat $kubeletconf"
-        tests:
-          test_items:
-            - flag: --make-iptables-util-chains
-              path: '{.makeIPTablesUtilChains}'
-              compare:
-                op: eq
-                value: true
-            - flag: --make-iptables-util-chains
-              path: '{.makeIPTablesUtilChains}'
-              set: false
-          bin_op: or
-        remediation: |
-          If using a Kubelet config file, edit the file to set `makeIPTablesUtilChains` to `true`.
-          If using command line arguments, edit the kubelet service file
-          $kubeletsvc on each worker node and
-          remove the --make-iptables-util-chains argument from the
-          KUBELET_SYSTEM_PODS_ARGS variable.
-          Based on your system, restart the kubelet service. For example:
-          systemctl daemon-reload
-          systemctl restart kubelet.service
-        scored: true
-
-      - id: 4.2.7
-        text: "Ensure that the --hostname-override argument is not set (Manual)"
-        # This is one of those properties that can only be set as a command line argument.
-        # To check if the property is set as expected, we need to parse the kubelet command
-        # instead reading the Kubelet Configuration file.
-        audit: "/bin/ps -fC $kubeletbin"
-        tests:
-          test_items:
-            - flag: --hostname-override
-              set: false
-        remediation: |
-          Edit the kubelet service file $kubeletsvc
-          on each worker node and remove the --hostname-override argument from the
-          KUBELET_SYSTEM_PODS_ARGS variable.
-          Based on your system, restart the kubelet service. For example,
-          systemctl daemon-reload
-          systemctl restart kubelet.service
-        scored: false
-
-      - id: 4.2.8
-        text: "Ensure that the eventRecordQPS argument is set to a level which ensures appropriate event capture (Manual)"
-        audit: "/bin/ps -fC $kubeletbin"
-        audit_config: "/bin/cat $kubeletconf"
-        tests:
-          test_items:
-            - flag: --event-qps
-              path: '{.eventRecordQPS}'
-              compare:
-                op: gte
-                value: 0
-            - flag: --event-qps
-              path: '{.eventRecordQPS}'
-              set: false
-          bin_op: or
-        remediation: |
-          If using a Kubelet config file, edit the file to set `eventRecordQPS` to an appropriate level.
-          If using command line arguments, edit the kubelet service file
-          $kubeletsvc on each worker node and
-          set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable.
-          Based on your system, restart the kubelet service. For example,
-          systemctl daemon-reload
-          systemctl restart kubelet.service
-        scored: false
-
-      - id: 4.2.9
-        text: "Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate (Manual)"
-        audit: "/bin/ps -fC $kubeletbin"
-        audit_config: "/bin/cat $kubeletconf"
-        tests:
-          test_items:
-            - flag: --tls-cert-file
-              path: '{.tlsCertFile}'
-            - flag: --tls-private-key-file
-              path: '{.tlsPrivateKeyFile}'
-        remediation: |
-          If using a Kubelet config file, edit the file to set `tlsCertFile` to the location
-          of the certificate file to use to identify this Kubelet, and `tlsPrivateKeyFile`
-          to the location of the corresponding private key file.
-          If using command line arguments, edit the kubelet service file
-          $kubeletsvc on each worker node and
-          set the below parameters in KUBELET_CERTIFICATE_ARGS variable.
-          --tls-cert-file=<path/to/tls-certificate-file>
-          --tls-private-key-file=<path/to/tls-key-file>
-          Based on your system, restart the kubelet service. For example,
-          systemctl daemon-reload
-          systemctl restart kubelet.service
-        scored: false
-
-      - id: 4.2.10
-        text: "Ensure that the --rotate-certificates argument is not set to false (Automated)"
-        audit: "/bin/ps -fC $kubeletbin"
-        audit_config: "/bin/cat $kubeletconf"
-        tests:
-          test_items:
-            - flag: --rotate-certificates
-              path: '{.rotateCertificates}'
-              compare:
-                op: eq
-                value: true
-            - flag: --rotate-certificates
-              path: '{.rotateCertificates}'
-              set: false
-          bin_op: or
-        remediation: |
-          If using a Kubelet config file, edit the file to add the line `rotateCertificates` to `true` or
-          remove it altogether to use the default value.
-          If using command line arguments, edit the kubelet service file
-          $kubeletsvc on each worker node and
-          remove --rotate-certificates=false argument from the KUBELET_CERTIFICATE_ARGS
-          variable.
-          Based on your system, restart the kubelet service. For example,
-          systemctl daemon-reload
-          systemctl restart kubelet.service
-        scored: true
-
-      - id: 4.2.11
-        text: "Verify that the RotateKubeletServerCertificate argument is set to true (Manual)"
-        audit: "/bin/ps -fC $kubeletbin"
-        audit_config: "/bin/cat $kubeletconf"
-        tests:
-          bin_op: or
-          test_items:
-            - flag: RotateKubeletServerCertificate
-              path: '{.featureGates.RotateKubeletServerCertificate}'
-              compare:
-                op: nothave
-                value: false
-            - flag: RotateKubeletServerCertificate
-              path: '{.featureGates.RotateKubeletServerCertificate}'
-              set: false
-        remediation: |
-          Edit the kubelet service file $kubeletsvc
-          on each worker node and set the below parameter in KUBELET_CERTIFICATE_ARGS variable.
-          --feature-gates=RotateKubeletServerCertificate=true
-          Based on your system, restart the kubelet service. For example:
-          systemctl daemon-reload
-          systemctl restart kubelet.service
-        scored: false
-
-      - id: 4.2.12
-        text: "Ensure that the Kubelet only makes use of Strong Cryptographic Ciphers (Manual)"
-        audit: "/bin/ps -fC $kubeletbin"
-        audit_config: "/bin/cat $kubeletconf"
-        tests:
-          test_items:
-            - flag: --tls-cipher-suites
-              path: '{range .tlsCipherSuites[:]}{}{'',''}{end}'
-              compare:
-                op: valid_elements
-                value: TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256
-        remediation: |
-          If using a Kubelet config file, edit the file to set `tlsCipherSuites` to
-          TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256
-          or to a subset of these values.
-          If using executable arguments, edit the kubelet service file
-          $kubeletsvc on each worker node and
-          set the --tls-cipher-suites parameter as follows, or to a subset of these values.
-          --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256
-          Based on your system, restart the kubelet service. For example:
-          systemctl daemon-reload
-          systemctl restart kubelet.service
-        scored: false
-
-      - id: 4.2.13
-        text: "Ensure that a limit is set on pod PIDs (Manual)"
-        audit: "/bin/ps -fC $kubeletbin"
-        audit_config: "/bin/cat $kubeletconf"
-        tests:
-          test_items:
-            - flag: --pod-max-pids
-              path: '{.podPidsLimit}'
-        remediation: |
-          Decide on an appropriate level for this parameter and set it,
-          either via the --pod-max-pids command line parameter or the PodPidsLimit configuration file setting.
-        scored: false
-
-  - id: 4.3
-    text: "kube-proxy"
-    checks:
-      - id: 4.3.1
-        text: "Ensure that the kube-proxy metrics service is bound to localhost (Automated)"
-        audit: "/bin/ps -fC $proxybin"
-        audit_config: "/bin/sh -c 'if test -e $proxykubeconfig; then cat $proxykubeconfig; fi'"
-        tests:
-          bin_op: or
-          test_items:
-            - flag: "--metrics-bind-address"
-              path: '{.metricsBindAddress}'
-              compare:
-                op: has
-                value: "127.0.0.1"
-            - flag: "--metrics-bind-address"
-              path: '{.metricsBindAddress}'
-              set: false
-        remediation: |
-           Modify or remove any values which bind the metrics service to a non-localhost address.
-           The default value is 127.0.0.1:10249.
-        scored: true

cfg/cis-1.9/policies.yaml

@@ -1,405 +0,0 @@
----
-controls:
-version: "cis-1.9"
-id: 5
-text: "Kubernetes Policies"
-type: "policies"
-groups:
-  - id: 5.1
-    text: "RBAC and Service Accounts"
-    checks:
-      - id: 5.1.1
-        text: "Ensure that the cluster-admin role is only used where required (Automated)"
-        audit: |
-          kubectl get clusterrolebindings -o=custom-columns=NAME:.metadata.name,ROLE:.roleRef.name,SUBJECT:.subjects[*].name --no-headers | while read -r role_name role_binding subject
-          do
-            if [[ "${role_name}" != "cluster-admin" && "${role_binding}" == "cluster-admin" ]]; then
-              is_compliant="false"
-            else
-              is_compliant="true"
-            fi;
-            echo "**role_name: ${role_name} role_binding: ${role_binding} subject: ${subject} is_compliant: ${is_compliant}"
-          done
-        use_multiple_values: true
-        tests:
-          test_items:
-            - flag: "is_compliant"
-              compare:
-                op: eq
-                value: true
-        remediation: |
-          Identify all clusterrolebindings to the cluster-admin role. Check if they are used and
-          if they need this role or if they could use a role with fewer privileges.
-          Where possible, first bind users to a lower privileged role and then remove the
-          clusterrolebinding to the cluster-admin role : kubectl delete clusterrolebinding [name]
-          Condition: is_compliant is false if rolename is not cluster-admin and rolebinding is cluster-admin.
-        scored: false
-
-      - id: 5.1.2
-        text: "Minimize access to secrets (Automated)"
-        audit: "echo \"canGetListWatchSecretsAsSystemAuthenticated: $(kubectl auth can-i get,list,watch secrets --all-namespaces --as=system:authenticated)\""
-        tests:
-          test_items:
-            - flag: "canGetListWatchSecretsAsSystemAuthenticated"
-              compare:
-                op: eq
-                value: no
-        remediation: |
-          Where possible, remove get, list and watch access to Secret objects in the cluster.
-        scored: false
-
-      - id: 5.1.3
-        text: "Minimize wildcard use in Roles and ClusterRoles (Automated)"
-        audit: |
-          # Check Roles
-          kubectl get roles --all-namespaces -o custom-columns=ROLE_NAMESPACE:.metadata.namespace,ROLE_NAME:.metadata.name --no-headers | while read -r role_namespace role_name
-          do
-            role_rules=$(kubectl get role -n "${role_namespace}" "${role_name}" -o=json | jq -c '.rules')
-            if echo "${role_rules}" | grep -q "\[\"\*\"\]"; then
-              role_is_compliant="false"
-            else
-              role_is_compliant="true"
-            fi;
-            echo "**role_name: ${role_name} role_namespace: ${role_namespace} role_rules: ${role_rules} role_is_compliant: ${role_is_compliant}"
-          done
-
-          # Check ClusterRoles
-          kubectl get clusterroles -o custom-columns=CLUSTERROLE_NAME:.metadata.name --no-headers | while read -r clusterrole_name
-          do
-            clusterrole_rules=$(kubectl get clusterrole "${clusterrole_name}" -o=json | jq -c '.rules')
-            if echo "${clusterrole_rules}" | grep -q "\[\"\*\"\]"; then
-              clusterrole_is_compliant="false"
-            else
-              clusterrole_is_compliant="true"
-            fi;
-          echo "**clusterrole_name: ${clusterrole_name} clusterrole_rules: ${clusterrole_rules} clusterrole_is_compliant: ${clusterrole_is_compliant}"
-          done
-        use_multiple_values: true
-        tests:
-          bin_op: or
-          test_items:
-            - flag: "role_is_compliant"
-              compare:
-                op: eq
-                value: true
-              set: true
-            - flag: "clusterrole_is_compliant"
-              compare:
-                op: eq
-                value: true
-              set: true
-        remediation: |
-          Where possible replace any use of wildcards ["*"] in roles and clusterroles with specific
-          objects or actions.
-          Condition: role_is_compliant is false if ["*"] is found in rules.
-          Condition: clusterrole_is_compliant is false if ["*"] is found in rules.
-        scored: false
-
-      - id: 5.1.4
-        text: "Minimize access to create pods (Automated)"
-        audit: |
-          echo "canCreatePodsAsSystemAuthenticated: $(kubectl auth can-i create pods --all-namespaces --as=system:authenticated)"
-        tests:
-          test_items:
-            - flag: "canCreatePodsAsSystemAuthenticated"
-              compare:
-                op: eq
-                value: no
-        remediation: |
-          Where possible, remove create access to pod objects in the cluster.
-        scored: false
-      - id: 5.1.5
-        text: "Ensure that default service accounts are not actively used (Automated)"
-        audit: |
-          kubectl get serviceaccount --all-namespaces --field-selector metadata.name=default -o=json | jq -r '.items[] | " namespace: \(.metadata.namespace), kind: \(.kind), name: \(.metadata.name), automountServiceAccountToken: \(.automountServiceAccountToken | if . == null then "notset" else . end )"' | xargs -L 1
-        use_multiple_values: true
-        tests:
-          test_items:
-            - flag: "automountServiceAccountToken"
-              compare:
-                op: eq
-                value: false
-              set: true
-        remediation: |
-          Create explicit service accounts wherever a Kubernetes workload requires specific access
-          to the Kubernetes API server.
-          Modify the configuration of each default service account to include this value
-          `automountServiceAccountToken: false`.
-        scored: false
-
-      - id: 5.1.6
-        text: "Ensure that Service Account Tokens are only mounted where necessary (Automated)"
-        audit: |
-          kubectl get pods --all-namespaces -o custom-columns=POD_NAMESPACE:.metadata.namespace,POD_NAME:.metadata.name,POD_SERVICE_ACCOUNT:.spec.serviceAccount,POD_IS_AUTOMOUNTSERVICEACCOUNTTOKEN:.spec.automountServiceAccountToken --no-headers | while read -r pod_namespace pod_name pod_service_account pod_is_automountserviceaccounttoken
-          do
-            # Retrieve automountServiceAccountToken's value for ServiceAccount and Pod, set to notset if null or <none>.
-            svacc_is_automountserviceaccounttoken=$(kubectl get serviceaccount -n "${pod_namespace}" "${pod_service_account}" -o json | jq -r '.automountServiceAccountToken' | sed -e 's/<none>/notset/g' -e 's/null/notset/g')
-            pod_is_automountserviceaccounttoken=$(echo "${pod_is_automountserviceaccounttoken}" | sed -e 's/<none>/notset/g' -e 's/null/notset/g')
-            if [ "${svacc_is_automountserviceaccounttoken}" = "false" ] && ( [ "${pod_is_automountserviceaccounttoken}" = "false" ] || [ "${pod_is_automountserviceaccounttoken}" = "notset" ] ); then
-              is_compliant="true"
-            elif [ "${svacc_is_automountserviceaccounttoken}" = "true" ] && [ "${pod_is_automountserviceaccounttoken}" = "false" ]; then
-              is_compliant="true"
-            else
-              is_compliant="false"
-            fi
-            echo "**namespace: ${pod_namespace} pod_name: ${pod_name} service_account: ${pod_service_account} pod_is_automountserviceaccounttoken: ${pod_is_automountserviceaccounttoken} svacc_is_automountServiceAccountToken: ${svacc_is_automountserviceaccounttoken} is_compliant: ${is_compliant}"
-          done
-        use_multiple_values: true
-        tests:
-          test_items:
-            - flag: "is_compliant"
-              compare:
-                op: eq
-                value: true
-        remediation: |
-          Modify the definition of ServiceAccounts and Pods which do not need to mount service
-          account tokens to disable it, with `automountServiceAccountToken: false`.
-          If both the ServiceAccount and the Pod's .spec specify a value for automountServiceAccountToken, the Pod spec takes precedence.
-          Condition: Pod is_compliant to true when
-            - ServiceAccount is automountServiceAccountToken: false and Pod is automountServiceAccountToken: false or notset
-            - ServiceAccount is automountServiceAccountToken: true notset and Pod is automountServiceAccountToken: false
-        scored: false
-
-      - id: 5.1.7
-        text: "Avoid use of system:masters group (Manual)"
-        type: "manual"
-        remediation: |
-          Remove the system:masters group from all users in the cluster.
-        scored: false
-
-      - id: 5.1.8
-        text: "Limit use of the Bind, Impersonate and Escalate permissions in the Kubernetes cluster (Manual)"
-        type: "manual"
-        remediation: |
-          Where possible, remove the impersonate, bind and escalate rights from subjects.
-        scored: false
-
-      - id: 5.1.9
-        text: "Minimize access to create persistent volumes (Manual)"
-        type: "manual"
-        remediation: |
-          Where possible, remove create access to PersistentVolume objects in the cluster.
-        scored: false
-
-      - id: 5.1.10
-        text: "Minimize access to the proxy sub-resource of nodes (Manual)"
-        type: "manual"
-        remediation: |
-          Where possible, remove access to the proxy sub-resource of node objects.
-        scored: false
-
-      - id: 5.1.11
-        text: "Minimize access to the approval sub-resource of certificatesigningrequests objects (Manual)"
-        type: "manual"
-        remediation: |
-          Where possible, remove access to the approval sub-resource of certificatesigningrequest objects.
-        scored: false
-
-      - id: 5.1.12
-        text: "Minimize access to webhook configuration objects (Manual)"
-        type: "manual"
-        remediation: |
-          Where possible, remove access to the validatingwebhookconfigurations or mutatingwebhookconfigurations objects
-        scored: false
-
-      - id: 5.1.13
-        text: "Minimize access to the service account token creation (Manual)"
-        type: "manual"
-        remediation: |
-          Where possible, remove access to the token sub-resource of serviceaccount objects.
-        scored: false
-
-  - id: 5.2
-    text: "Pod Security Standards"
-    checks:
-      - id: 5.2.1
-        text: "Ensure that the cluster has at least one active policy control mechanism in place (Manual)"
-        type: "manual"
-        remediation: |
-          Ensure that either Pod Security Admission or an external policy control system is in place
-          for every namespace which contains user workloads.
-        scored: false
-
-      - id: 5.2.2
-        text: "Minimize the admission of privileged containers (Manual)"
-        type: "manual"
-        remediation: |
-          Add policies to each namespace in the cluster which has user workloads to restrict the
-          admission of privileged containers.
-        scored: false
-
-      - id: 5.2.3
-        text: "Minimize the admission of containers wishing to share the host process ID namespace (Manual)"
-        type: "manual"
-        remediation: |
-          Add policies to each namespace in the cluster which has user workloads to restrict the
-          admission of `hostPID` containers.
-        scored: false
-
-      - id: 5.2.4
-        text: "Minimize the admission of containers wishing to share the host IPC namespace (Manual)"
-        type: "manual"
-        remediation: |
-          Add policies to each namespace in the cluster which has user workloads to restrict the
-          admission of `hostIPC` containers.
-        scored: false
-
-      - id: 5.2.5
-        text: "Minimize the admission of containers wishing to share the host network namespace (Manual)"
-        type: "manual"
-        remediation: |
-          Add policies to each namespace in the cluster which has user workloads to restrict the
-          admission of `hostNetwork` containers.
-        scored: false
-
-      - id: 5.2.6
-        text: "Minimize the admission of containers with allowPrivilegeEscalation (Manual)"
-        type: "manual"
-        remediation: |
-          Add policies to each namespace in the cluster which has user workloads to restrict the
-          admission of containers with `.spec.allowPrivilegeEscalation` set to `true`.
-        scored: false
-
-      - id: 5.2.7
-        text: "Minimize the admission of root containers (Manual)"
-        type: "manual"
-        remediation: |
-          Create a policy for each namespace in the cluster, ensuring that either `MustRunAsNonRoot`
-          or `MustRunAs` with the range of UIDs not including 0, is set.
-        scored: false
-
-      - id: 5.2.8
-        text: "Minimize the admission of containers with the NET_RAW capability (Manual)"
-        type: "manual"
-        remediation: |
-          Add policies to each namespace in the cluster which has user workloads to restrict the
-          admission of containers with the `NET_RAW` capability.
-        scored: false
-
-      - id: 5.2.9
-        text: "Minimize the admission of containers with added capabilities (Manual)"
-        type: "manual"
-        remediation: |
-          Ensure that `allowedCapabilities` is not present in policies for the cluster unless
-          it is set to an empty array.
-        scored: false
-
-      - id: 5.2.10
-        text: "Minimize the admission of containers with capabilities assigned (Manual)"
-        type: "manual"
-        remediation: |
-          Review the use of capabilites in applications running on your cluster. Where a namespace
-          contains applications which do not require any Linux capabities to operate consider adding
-          a PSP which forbids the admission of containers which do not drop all capabilities.
-        scored: false
-
-      - id: 5.2.11
-        text: "Minimize the admission of Windows HostProcess containers (Manual)"
-        type: "manual"
-        remediation: |
-          Add policies to each namespace in the cluster which has user workloads to restrict the
-          admission of containers that have `.securityContext.windowsOptions.hostProcess` set to `true`.
-        scored: false
-
-      - id: 5.2.12
-        text: "Minimize the admission of HostPath volumes (Manual)"
-        type: "manual"
-        remediation: |
-          Add policies to each namespace in the cluster which has user workloads to restrict the
-          admission of containers with `hostPath` volumes.
-        scored: false
-
-      - id: 5.2.13
-        text: "Minimize the admission of containers which use HostPorts (Manual)"
-        type: "manual"
-        remediation: |
-          Add policies to each namespace in the cluster which has user workloads to restrict the
-          admission of containers which use `hostPort` sections.
-        scored: false
-
-  - id: 5.3
-    text: "Network Policies and CNI"
-    checks:
-      - id: 5.3.1
-        text: "Ensure that the CNI in use supports NetworkPolicies (Manual)"
-        type: "manual"
-        remediation: |
-          If the CNI plugin in use does not support network policies, consideration should be given to
-          making use of a different plugin, or finding an alternate mechanism for restricting traffic
-          in the Kubernetes cluster.
-        scored: false
-
-      - id: 5.3.2
-        text: "Ensure that all Namespaces have NetworkPolicies defined (Manual)"
-        type: "manual"
-        remediation: |
-          Follow the documentation and create NetworkPolicy objects as you need them.
-        scored: false
-
-  - id: 5.4
-    text: "Secrets Management"
-    checks:
-      - id: 5.4.1
-        text: "Prefer using Secrets as files over Secrets as environment variables (Manual)"
-        type: "manual"
-        remediation: |
-          If possible, rewrite application code to read Secrets from mounted secret files, rather than
-          from environment variables.
-        scored: false
-
-      - id: 5.4.2
-        text: "Consider external secret storage (Manual)"
-        type: "manual"
-        remediation: |
-          Refer to the Secrets management options offered by your cloud provider or a third-party
-          secrets management solution.
-        scored: false
-
-  - id: 5.5
-    text: "Extensible Admission Control"
-    checks:
-      - id: 5.5.1
-        text: "Configure Image Provenance using ImagePolicyWebhook admission controller (Manual)"
-        type: "manual"
-        remediation: |
-          Follow the Kubernetes documentation and setup image provenance.
-        scored: false
-
-  - id: 5.7
-    text: "General Policies"
-    checks:
-      - id: 5.7.1
-        text: "Create administrative boundaries between resources using namespaces (Manual)"
-        type: "manual"
-        remediation: |
-          Follow the documentation and create namespaces for objects in your deployment as you need
-          them.
-        scored: false
-
-      - id: 5.7.2
-        text: "Ensure that the seccomp profile is set to docker/default in your Pod definitions (Manual)"
-        type: "manual"
-        remediation: |
-          Use `securityContext` to enable the docker/default seccomp profile in your pod definitions.
-          An example is as below:
-            securityContext:
-              seccompProfile:
-                type: RuntimeDefault
-        scored: false
-
-      - id: 5.7.3
-        text: "Apply SecurityContext to your Pods and Containers (Manual)"
-        type: "manual"
-        remediation: |
-          Follow the Kubernetes documentation and apply SecurityContexts to your Pods. For a
-          suggested list of SecurityContexts, you may refer to the CIS Security Benchmark for Docker
-          Containers.
-        scored: false
-
-      - id: 5.7.4
-        text: "The default namespace should not be used (Manual)"
-        type: "manual"
-        remediation: |
-          Ensure that namespaces are created to allow for appropriate segregation of Kubernetes
-          resources and that all new resources are created in a specific namespace.
-        scored: false

cfg/config.yaml

@@ -36,7 +36,6 @@ master:
       - /var/snap/microk8s/current/args/kube-apiserver
       - /etc/origin/master/master-config.yaml
       - /etc/kubernetes/manifests/talos-kube-apiserver.yaml
-      - /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml
     defaultconf: /etc/kubernetes/manifests/kube-apiserver.yaml
 
   scheduler:
@@ -54,13 +53,11 @@ master:
       - /var/snap/microk8s/current/args/kube-scheduler
       - /etc/origin/master/scheduler.json
       - /etc/kubernetes/manifests/talos-kube-scheduler.yaml
-      - /var/lib/rancher/rke2/agent/pod-manifests/kube-scheduler.yaml
     defaultconf: /etc/kubernetes/manifests/kube-scheduler.yaml
     kubeconfig:
       - /etc/kubernetes/scheduler.conf
       - /var/lib/kube-scheduler/kubeconfig
       - /var/lib/kube-scheduler/config.yaml
-      - /var/lib/rancher/rke2/server/cred/scheduler.kubeconfig
       - /system/secrets/kubernetes/kube-scheduler/kubeconfig
     defaultkubeconfig: /etc/kubernetes/scheduler.conf
 
@@ -80,12 +77,10 @@ master:
       - /var/snap/kube-controller-manager/current/args
       - /var/snap/microk8s/current/args/kube-controller-manager
       - /etc/kubernetes/manifests/talos-kube-controller-manager.yaml
-      - /var/lib/rancher/rke2/agent/pod-manifests/kube-controller-manager.yaml
     defaultconf: /etc/kubernetes/manifests/kube-controller-manager.yaml
     kubeconfig:
       - /etc/kubernetes/controller-manager.conf
       - /var/lib/kube-controller-manager/kubeconfig
-      - /var/lib/rancher/rke2/server/cred/controller.kubeconfig
       - /system/secrets/kubernetes/kube-controller-manager/kubeconfig
     defaultkubeconfig: /etc/kubernetes/controller-manager.conf
 
@@ -94,10 +89,6 @@ master:
     bins:
       - "etcd"
       - "openshift start etcd"
-    datadirs:
-      - /var/lib/etcd/default.etcd
-      - /var/lib/etcd/data.etcd
-      - /var/lib/rancher/k3s/server/db/etcd
     confs:
       - /etc/kubernetes/manifests/etcd.yaml
       - /etc/kubernetes/manifests/etcd.yml
@@ -107,13 +98,7 @@ master:
       - /var/snap/etcd/common/etcd.conf.yaml
       - /var/snap/microk8s/current/args/etcd
       - /usr/lib/systemd/system/etcd.service
-      - /var/lib/rancher/rke2/server/db/etcd/config
-      - /var/lib/rancher/k3s/server/db/etcd/config
     defaultconf: /etc/kubernetes/manifests/etcd.yaml
-    defaultdatadir: /var/lib/etcd/default.etcd
-    client_cert_file: /var/lib/rancher/rke2/server/tls/etcd/server-client.crt
-    client_key_file: /var/lib/rancher/rke2/server/tls/etcd/server-client.key
-
 
   flanneld:
     optional: true
@@ -139,14 +124,10 @@ node:
 
   kubelet:
     cafile:
-      - "/var/lib/rancher/rke2/agent/client-ca.crt"
-      - "/var/lib/rancher/rke2/server/tls/server-ca.crt"
       - "/etc/kubernetes/pki/ca.crt"
       - "/etc/kubernetes/certs/ca.crt"
       - "/etc/kubernetes/cert/ca.pem"
       - "/var/snap/microk8s/current/certs/ca.crt"
-      - "/var/lib/rancher/rke2/agent/server.crt"
-      - "/var/lib/rancher/k3s/agent/client-ca.crt"
     svc:
       # These paths must also be included
       #  in the 'confs' property below
@@ -166,18 +147,13 @@ node:
       - "/var/lib/kubelet/kubeconfig"
       - "/etc/kubernetes/kubelet-kubeconfig"
       - "/etc/kubernetes/kubelet/kubeconfig"
-      - "/etc/kubernetes/ssl/kubecfg-kube-node.yaml"
       - "/var/snap/microk8s/current/credentials/kubelet.config"
       - "/etc/kubernetes/kubeconfig-kubelet"
-      - "/var/lib/rancher/rke2/agent/kubelet.kubeconfig"
-      - "/var/lib/rancher/k3s/agent/kubelet.kubeconfig"
     confs:
       - "/etc/kubernetes/kubelet-config.yaml"
-      - "/var/lib/rancher/rke2/agent/etc/kubelet.conf.d"
       - "/var/lib/kubelet/config.yaml"
       - "/var/lib/kubelet/config.yml"
       - "/etc/kubernetes/kubelet/kubelet-config.json"
-      - "/etc/kubernetes/kubelet/config.json"
       - "/etc/kubernetes/kubelet/config"
       - "/home/kubernetes/kubelet-config.yaml"
       - "/home/kubernetes/kubelet-config.yml"
@@ -197,7 +173,6 @@ node:
       - "/etc/systemd/system/snap.kubelet.daemon.service"
       - "/etc/systemd/system/snap.microk8s.daemon-kubelet.service"
       - "/etc/kubernetes/kubelet.yaml"
-
     defaultconf: "/var/lib/kubelet/config.yaml"
     defaultsvc: "/etc/systemd/system/kubelet.service.d/10-kubeadm.conf"
     defaultkubeconfig: "/etc/kubernetes/kubelet.conf"
@@ -221,11 +196,8 @@ node:
       - "/etc/kubernetes/kubelet-kubeconfig"
       - "/etc/kubernetes/kubelet-kubeconfig.conf"
       - "/etc/kubernetes/kubelet/config"
-      - "/etc/kubernetes/ssl/kubecfg-kube-proxy.yaml"
       - "/var/lib/kubelet/kubeconfig"
       - "/var/snap/microk8s/current/credentials/proxy.config"
-      - "/var/lib/rancher/rke2/agent/kubeproxy.kubeconfig"
-      - "/var/lib/rancher/k3s/agent/kubeproxy.kubeconfig"
     svc:
       - "/lib/systemd/system/kube-proxy.service"
       - "/etc/systemd/system/snap.microk8s.daemon-proxy.service"
@@ -239,12 +211,7 @@ etcd:
   etcd:
     bins:
       - "etcd"
-    datadirs:
-      - /var/lib/etcd/default.etcd
-      - /var/lib/etcd/data.etcd
-      - /var/lib/rancher/k3s/server/db/etcd
     confs:
-      - /var/lib/rancher/rke2/server/db/etcd/config
       - /etc/kubernetes/manifests/etcd.yaml
       - /etc/kubernetes/manifests/etcd.yml
       - /etc/kubernetes/manifests/etcd.manifest
@@ -253,10 +220,7 @@ etcd:
       - /var/snap/etcd/common/etcd.conf.yaml
       - /var/snap/microk8s/current/args/etcd
       - /usr/lib/systemd/system/etcd.service
-      - /var/lib/rancher/rke2/agent/pod-manifests/etcd.yaml
-      - /var/lib/rancher/k3s/server/db/etcd/config
     defaultconf: /etc/kubernetes/manifests/etcd.yaml
-    defaultdatadir: /var/lib/etcd/default.etcd
 
 controlplane:
   components:
@@ -285,48 +249,14 @@ version_mapping:
   "1.21": "cis-1.20"
   "1.22": "cis-1.23"
   "1.23": "cis-1.23"
-  "1.24": "cis-1.24"
-  "1.25": "cis-1.7"
-  "1.26": "cis-1.8"
-  "1.27": "cis-1.9"
-  "1.28": "cis-1.10"
-  "1.29": "cis-1.11"
-  "1.30": "cis-1.11"
-  "1.31": "cis-1.11"
-  "1.32": "cis-1.12"
-  "1.33": "cis-1.12"
-  "1.34": "cis-1.12"
   "eks-1.0.1": "eks-1.0.1"
-  "eks-1.1.0": "eks-1.1.0"
-  "eks-1.2.0": "eks-1.2.0"
-  "eks-1.5.0": "eks-1.5.0"
-  "eks-1.7.0": "eks-1.7.0"
-  "eks-1.8.0": "eks-1.8.0"
   "gke-1.0": "gke-1.0"
   "gke-1.2.0": "gke-1.2.0"
-  "gke-1.6.0": "gke-1.6.0"
-  "gke-1.8.0": "gke-1.8.0"
   "ocp-3.10": "rh-0.7"
   "ocp-3.11": "rh-0.7"
   "ocp-4.0": "rh-1.0"
-  "ocp-4.11": "rh-1.4"
-  "ocp-4.13": "rh-1.8"
   "aks-1.0": "aks-1.0"
-  "aks-1.7": "aks-1.7"
   "ack-1.0": "ack-1.0"
-  "cis-1.6-k3s": "cis-1.6-k3s"
-  "cis-1.24-microk8s": "cis-1.24-microk8s"
-  "tkgi-1.2.53": "tkgi-1.2.53"
-  "k3s-cis-1.7": "k3s-cis-1.7"
-  "k3s-cis-1.23": "k3s-cis-1.23"
-  "k3s-cis-1.24": "k3s-cis-1.24"
-  "rke-cis-1.7": "rke-cis-1.7"
-  "rke-cis-1.23": "rke-cis-1.23"
-  "rke-cis-1.24": "rke-cis-1.24"
-  "rke2-cis-1.7": "rke2-cis-1.7"
-  "rke2-cis-1.8": "rke2-cis-1.8"
-  "rke2-cis-1.23": "rke2-cis-1.23"
-  "rke2-cis-1.24": "rke2-cis-1.24"
 
 target_mapping:
   "cis-1.5":
@@ -341,12 +271,6 @@ target_mapping:
     - "controlplane"
     - "etcd"
     - "policies"
-  "cis-1.6-k3s":
-    - "master"
-    - "node"
-    - "controlplane"
-    - "etcd"
-    - "policies"
   "cis-1.20":
     - "master"
     - "node"
@@ -359,54 +283,6 @@ target_mapping:
     - "controlplane"
     - "etcd"
     - "policies"
-  "cis-1.24":
-    - "master"
-    - "node"
-    - "controlplane"
-    - "etcd"
-    - "policies"
-  "cis-1.24-microk8s":
-    - "master"
-    - "etcd"
-    - "node"
-    - "controlplane"
-    - "policies"
-  "cis-1.7":
-    - "master"
-    - "node"
-    - "controlplane"
-    - "etcd"
-    - "policies"
-  "cis-1.8":
-    - "master"
-    - "node"
-    - "controlplane"
-    - "etcd"
-    - "policies"
-  "cis-1.9":
-    - "master"
-    - "node"
-    - "controlplane"
-    - "etcd"
-    - "policies"
-  "cis-1.10":
-    - "master"
-    - "node"
-    - "controlplane"
-    - "etcd"
-    - "policies"
-  "cis-1.11":
-    - "master"
-    - "node"
-    - "controlplane"
-    - "etcd"
-    - "policies"
-  "cis-1.12":
-    - "master"
-    - "node"
-    - "controlplane"
-    - "etcd"
-    - "policies"
   "gke-1.0":
     - "master"
     - "node"
@@ -420,54 +296,12 @@ target_mapping:
     - "controlplane"
     - "policies"
     - "managedservices"
-  "gke-1.6.0":
-    - "master"
-    - "node"
-    - "controlplane"
-    - "policies"
-    - "managedservices"
-  "gke-1.8.0":
-    - "master"
-    - "node"
-    - "controlplane"
-    - "policies"
-    - "managedservices"
   "eks-1.0.1":
     - "master"
     - "node"
     - "controlplane"
     - "policies"
     - "managedservices"
-  "eks-1.1.0":
-    - "master"
-    - "node"
-    - "controlplane"
-    - "policies"
-    - "managedservices"
-  "eks-1.2.0":
-    - "master"
-    - "node"
-    - "controlplane"
-    - "policies"
-    - "managedservices"
-  "eks-1.5.0":
-    - "master"
-    - "node"
-    - "controlplane"
-    - "policies"
-    - "managedservices"
-  "eks-1.7.0":
-    - "master"
-    - "node"
-    - "controlplane"
-    - "policies"
-    - "managedservices"
-  "eks-1.8.0":
-    - "master"
-    - "node"
-    - "controlplane"
-    - "policies"
-    - "managedservices"
   "rh-0.7":
     - "master"
     - "node"
@@ -477,12 +311,6 @@ target_mapping:
     - "controlplane"
     - "policies"
     - "managedservices"
-  "aks-1.7":
-    - "master"
-    - "node"
-    - "controlplane"
-    - "policies"
-    - "managedservices"
   "ack-1.0":
     - "master"
     - "node"
@@ -496,92 +324,3 @@ target_mapping:
     - "controlplane"
     - "policies"
     - "etcd"
-  "rh-1.4":
-    - "master"
-    - "node"
-    - "controlplane"
-    - "policies"
-    - "etcd"
-  "rh-1.8":
-    - "master"
-    - "node"
-    - "controlplane"
-    - "policies"
-    - "etcd"
-  "eks-stig-kubernetes-v1r6":
-    - "node"
-    - "controlplane"
-    - "policies"
-    - "managedservices"
-  "tkgi-1.2.53":
-    - "master"
-    - "etcd"
-    - "controlplane"
-    - "node"
-    - "policies"
-  "k3s-cis-1.7":
-    - "master"
-    - "etcd"
-    - "controlplane"
-    - "node"
-    - "policies"
-  "k3s-cis-1.8":
-    - "master"
-    - "etcd"
-    - "controlplane"
-    - "node"
-    - "policies"
-  "k3s-cis-1.23":
-    - "master"
-    - "etcd"
-    - "controlplane"
-    - "node"
-    - "policies"
-  "k3s-cis-1.24":
-    - "master"
-    - "etcd"
-    - "controlplane"
-    - "node"
-    - "policies"
-  "rke-cis-1.7":
-    - "master"
-    - "etcd"
-    - "controlplane"
-    - "node"
-    - "policies"
-  "rke-cis-1.23":
-    - "master"
-    - "etcd"
-    - "controlplane"
-    - "node"
-    - "policies"
-  "rke-cis-1.24":
-    - "master"
-    - "etcd"
-    - "controlplane"
-    - "node"
-    - "policies"
-  "rke2-cis-1.7":
-    - "master"
-    - "etcd"
-    - "controlplane"
-    - "node"
-    - "policies"
-  "rke2-cis-1.8":
-    - "master"
-    - "etcd"
-    - "controlplane"
-    - "node"
-    - "policies"
-  "rke2-cis-1.23":
-    - "master"
-    - "etcd"
-    - "controlplane"
-    - "node"
-    - "policies"
-  "rke2-cis-1.24":
-    - "master"
-    - "etcd"
-    - "controlplane"
-    - "node"
-    - "policies"

cfg/eks-1.1.0/config.yaml

@@ -1,9 +0,0 @@
----
-## Version-specific settings that override the values in cfg/config.yaml
-## These settings are required if you are using the --asff option to report findings to AWS Security Hub
-## AWS account number is required.
-AWS_ACCOUNT: "<AWS_ACCT_NUMBER>"
-## AWS region is required.
-AWS_REGION: "<AWS_REGION>"
-## EKS Cluster ARN is required.
-CLUSTER_ARN: "<AWS_CLUSTER_ARN>"

cfg/eks-1.1.0/controlplane.yaml

@@ -1,14 +0,0 @@
----
-controls:
-version: "eks-1.1.0"
-id: 2
-text: "Control Plane Configuration"
-type: "controlplane"
-groups:
-  - id: 2.1
-    text: "Logging"
-    checks:
-      - id: 2.1.1
-        text: "Enable audit logs (Manual)"
-        remediation: "Enable control plane logging for API Server, Audit, Authenticator, Controller Manager, and Scheduler."
-        scored: false

cfg/eks-1.1.0/managedservices.yaml

@@ -1,154 +0,0 @@
----
-controls:
-version: "eks-1.1.0"
-id: 5
-text: "Managed Services"
-type: "managedservices"
-groups:
-  - id: 5.1
-    text: "Image Registry and Image Scanning"
-    checks:
-      - id: 5.1.1
-        text: "Ensure Image Vulnerability Scanning using Amazon ECR image scanning or a third-party provider (Manual)"
-        type: "manual"
-        remediation: |
-          To utilize AWS ECR for Image scanning please follow the steps below:
-
-          To create a repository configured for scan on push (AWS CLI):
-          aws ecr create-repository --repository-name $REPO_NAME --image-scanning-configuration scanOnPush=true --region $REGION_CODE
-
-          To edit the settings of an existing repository (AWS CLI):
-          aws ecr put-image-scanning-configuration --repository-name $REPO_NAME --image-scanning-configuration scanOnPush=true --region $REGION_CODE
-
-          Use the following steps to start a manual image scan using the AWS Management Console.
-              Open the Amazon ECR console at https://console.aws.amazon.com/ecr/repositories.
-              From the navigation bar, choose the Region to create your repository in.
-              In the navigation pane, choose Repositories.
-              On the Repositories page, choose the repository that contains the image to scan.
-              On the Images page, select the image to scan and then choose Scan.
-        scored: false
-
-      - id: 5.1.2
-        text: "Minimize user access to Amazon ECR (Manual)"
-        type: "manual"
-        remediation: |
-          Before you use IAM to manage access to Amazon ECR, you should understand what IAM features
-          are available to use with Amazon ECR. To get a high-level view of how Amazon ECR and other
-          AWS services work with IAM, see AWS Services That Work with IAM in the IAM User Guide.
-        scored: false
-
-      - id: 5.1.3
-        text: "Minimize cluster access to read-only for Amazon ECR (Manual)"
-        type: "manual"
-        remediation: |
-          You can use your Amazon ECR images with Amazon EKS, but you need to satisfy the following prerequisites.
-
-          The Amazon EKS worker node IAM role (NodeInstanceRole) that you use with your worker nodes must possess
-          the following IAM policy permissions for Amazon ECR.
-
-          {
-              "Version": "2012-10-17",
-              "Statement": [
-                  {
-                      "Effect": "Allow",
-                      "Action": [
-                          "ecr:BatchCheckLayerAvailability",
-                          "ecr:BatchGetImage",
-                          "ecr:GetDownloadUrlForLayer",
-                          "ecr:GetAuthorizationToken"
-                      ],
-                      "Resource": "*"
-                  }
-              ]
-          }
-        scored: false
-
-      - id: 5.1.4
-        text: "Minimize Container Registries to only those approved (Manual)"
-        type: "manual"
-        remediation: "No remediation"
-        scored: false
-
-  - id: 5.2
-    text: "Identity and Access Management (IAM)"
-    checks:
-      - id: 5.2.1
-        text: "Prefer using dedicated Amazon EKS Service Accounts (Manual)"
-        type: "manual"
-        remediation: "No remediation"
-        scored: false
-
-  - id: 5.3
-    text: "AWS Key Management Service (KMS)"
-    checks:
-      - id: 5.3.1
-        text: "Ensure Kubernetes Secrets are encrypted using Customer Master Keys (CMKs) managed in AWS KMS (Manual)"
-        type: "manual"
-        remediation: |
-          This process can only be performed during Cluster Creation.
-
-          Enable 'Secrets Encryption' during Amazon EKS cluster creation as described
-          in the links within the 'References' section.
-        scored: false
-
-  - id: 5.4
-    text: "Cluster Networking"
-    checks:
-      - id: 5.4.1
-        text: "Restrict Access to the Control Plane Endpoint (Manual)"
-        type: "manual"
-        remediation: "No remediation"
-        scored: false
-
-      - id: 5.4.2
-        text: "Ensure clusters are created with Private Endpoint Enabled and Public Access Disabled (Manual)"
-        type: "manual"
-        remediation: "No remediation"
-        scored: false
-
-      - id: 5.4.3
-        text: "Ensure clusters are created with Private Nodes (Manual)"
-        type: "manual"
-        remediation: "No remediation"
-        scored: false
-
-      - id: 5.4.4
-        text: "Ensure Network Policy is Enabled and set as appropriate (Manual)"
-        type: "manual"
-        remediation: "No remediation"
-        scored: false
-
-      - id: 5.4.5
-        text: "Encrypt traffic to HTTPS load balancers with TLS certificates (Manual)"
-        type: "manual"
-        remediation: "No remediation"
-        scored: false
-
-
-  - id: 5.5
-    text: "Authentication and Authorization"
-    checks:
-      - id: 5.5.1
-        text: "Manage Kubernetes RBAC users with AWS IAM Authenticator for Kubernetes (Manual)"
-        type: "manual"
-        remediation: |
-          Refer to the 'Managing users or IAM roles for your cluster' in Amazon EKS documentation.
-        scored: false
-
-
-  - id: 5.6
-    text: "Other Cluster Configurations"
-    checks:
-      - id: 5.6.1
-        text: "Consider Fargate for running untrusted workloads (Manual)"
-        type: "manual"
-        remediation: |
-          Create a Fargate profile for your cluster Before you can schedule pods running on Fargate
-          in your cluster, you must define a Fargate profile that specifies which pods should use
-          Fargate when they are launched. For more information, see AWS Fargate profile.
-
-          Note: If you created your cluster with eksctl using the --fargate option, then a Fargate profile has
-          already been created for your cluster with selectors for all pods in the kube-system
-          and default namespaces. Use the following procedure to create Fargate profiles for
-          any other namespaces you would like to use with Fargate.
-        scored: false

cfg/eks-1.1.0/master.yaml

@@ -1,6 +0,0 @@
----
-controls:
-version: "eks-1.1.0"
-id: 1
-text: "Control Plane Components"
-type: "master"

cfg/eks-1.1.0/node.yaml

@@ -1,330 +0,0 @@
----
-controls:
-version: "eks-1.1.0"
-id: 3
-text: "Worker Node Security Configuration"
-type: "node"
-groups:
-  - id: 3.1
-    text: "Worker Node Configuration Files"
-    checks:
-      - id: 3.1.1
-        text: "Ensure that the kubeconfig file permissions are set to 644 or more restrictive (Manual)"
-        audit: '/bin/sh -c ''if test -e $kubeletkubeconfig; then stat -c permissions=%a $kubeletkubeconfig; fi'' '
-        tests:
-          test_items:
-            - flag: "permissions"
-              compare:
-                op: bitmask
-                value: "644"
-        remediation: |
-          Run the below command (based on the file location on your system) on the each worker node.
-          For example,
-          chmod 644 $kubeletkubeconfig
-        scored: false
-
-      - id: 3.1.2
-        text: "Ensure that the kubelet kubeconfig file ownership is set to root:root (Manual)"
-        audit: '/bin/sh -c ''if test -e $kubeletkubeconfig; then stat -c %U:%G $kubeletkubeconfig; fi'' '
-        tests:
-          test_items:
-            - flag: root:root
-        remediation: |
-          Run the below command (based on the file location on your system) on the each worker node.
-          For example,
-          chown root:root $kubeletkubeconfig
-        scored: false
-
-      - id: 3.1.3
-        text: "Ensure that the kubelet configuration file has permissions set to 644 or more restrictive (Manual)"
-        audit: '/bin/sh -c ''if test -e $kubeletconf; then stat -c permissions=%a $kubeletconf; fi'' '
-        tests:
-          test_items:
-            - flag: "permissions"
-              compare:
-                op: bitmask
-                value: "644"
-        remediation: |
-          Run the following command (using the config file location identified in the Audit step)
-          chmod 644 $kubeletconf
-        scored: false
-
-      - id: 3.1.4
-        text: "Ensure that the kubelet configuration file ownership is set to root:root (Manual)"
-        audit: '/bin/sh -c ''if test -e $kubeletconf; then stat -c %U:%G $kubeletconf; fi'' '
-        tests:
-          test_items:
-            - flag: root:root
-        remediation: |
-          Run the following command (using the config file location identified in the Audit step)
-          chown root:root $kubeletconf
-        scored: false
-
-  - id: 3.2
-    text: "Kubelet"
-    checks:
-      - id: 3.2.1
-        text: "Ensure that the --anonymous-auth argument is set to false (Automated)"
-        audit: "/bin/ps -fC $kubeletbin"
-        audit_config: "/bin/cat $kubeletconf"
-        tests:
-          test_items:
-            - flag: "--anonymous-auth"
-              path: '{.authentication.anonymous.enabled}'
-              set: true
-              compare:
-                op: eq
-                value: false
-        remediation: |
-          If using a Kubelet config file, edit the file to set authentication: anonymous: enabled to
-          false.
-          If using executable arguments, edit the kubelet service file
-          $kubeletsvc on each worker node and
-          set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable.
-          --anonymous-auth=false
-          Based on your system, restart the kubelet service. For example:
-          systemctl daemon-reload
-          systemctl restart kubelet.service
-        scored: true
-
-      - id: 3.2.2
-        text: "Ensure that the --authorization-mode argument is not set to AlwaysAllow (Automated)"
-        audit: "/bin/ps -fC $kubeletbin"
-        audit_config: "/bin/cat $kubeletconf"
-        tests:
-          test_items:
-            - flag: --authorization-mode
-              path: '{.authorization.mode}'
-              set: true
-              compare:
-                op: nothave
-                value: AlwaysAllow
-        remediation: |
-          If using a Kubelet config file, edit the file to set authorization: mode to Webhook. If
-          using executable arguments, edit the kubelet service file
-          $kubeletsvc on each worker node and
-          set the below parameter in KUBELET_AUTHZ_ARGS variable.
-          --authorization-mode=Webhook
-          Based on your system, restart the kubelet service. For example:
-          systemctl daemon-reload
-          systemctl restart kubelet.service
-        scored: true
-
-      - id: 3.2.3
-        text: "Ensure that the --client-ca-file argument is set as appropriate (Manual)"
-        audit: "/bin/ps -fC $kubeletbin"
-        audit_config: "/bin/cat $kubeletconf"
-        tests:
-          test_items:
-            - flag: --client-ca-file
-              path: '{.authentication.x509.clientCAFile}'
-              set: true
-        remediation: |
-          If using a Kubelet config file, edit the file to set authentication: x509: clientCAFile to
-          the location of the client CA file.
-          If using command line arguments, edit the kubelet service file
-          $kubeletsvc on each worker node and
-          set the below parameter in KUBELET_AUTHZ_ARGS variable.
-          --client-ca-file=<path/to/client-ca-file>
-          Based on your system, restart the kubelet service. For example:
-          systemctl daemon-reload
-          systemctl restart kubelet.service
-        scored: false
-
-      - id: 3.2.4
-        text: "Ensure that the --read-only-port argument is set to 0 (Manual)"
-        audit: "/bin/ps -fC $kubeletbin"
-        audit_config: "/bin/cat $kubeletconf"
-        tests:
-          test_items:
-            - flag: "--read-only-port"
-              path: '{.readOnlyPort}'
-              set: true
-              compare:
-                op: eq
-                value: 0
-        remediation: |
-          If using a Kubelet config file, edit the file to set readOnlyPort to 0.
-          If using command line arguments, edit the kubelet service file
-          $kubeletsvc on each worker node and
-          set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable.
-          --read-only-port=0
-          Based on your system, restart the kubelet service. For example:
-          systemctl daemon-reload
-          systemctl restart kubelet.service
-        scored: false
-
-      - id: 3.2.5
-        text: "Ensure that the --streaming-connection-idle-timeout argument is not set to 0 (Manual)"
-        audit: "/bin/ps -fC $kubeletbin"
-        audit_config: "/bin/cat $kubeletconf"
-        tests:
-          test_items:
-            - flag: --streaming-connection-idle-timeout
-              path: '{.streamingConnectionIdleTimeout}'
-              set: true
-              compare:
-                op: noteq
-                value: 0
-            - flag: --streaming-connection-idle-timeout
-              path: '{.streamingConnectionIdleTimeout}'
-              set: false
-          bin_op: or
-        remediation: |
-          If using a Kubelet config file, edit the file to set streamingConnectionIdleTimeout to a
-          value other than 0.
-          If using command line arguments, edit the kubelet service file
-          $kubeletsvc on each worker node and
-          set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable.
-          --streaming-connection-idle-timeout=5m
-          Based on your system, restart the kubelet service. For example:
-          systemctl daemon-reload
-          systemctl restart kubelet.service
-        scored: false
-
-      - id: 3.2.6
-        text: "Ensure that the --protect-kernel-defaults argument is set to true (Automated)"
-        audit: "/bin/ps -fC $kubeletbin"
-        audit_config: "/bin/cat $kubeletconf"
-        tests:
-          test_items:
-            - flag: --protect-kernel-defaults
-              path: '{.protectKernelDefaults}'
-              set: true
-              compare:
-                op: eq
-                value: true
-        remediation: |
-          If using a Kubelet config file, edit the file to set protectKernelDefaults: true.
-          If using command line arguments, edit the kubelet service file
-          $kubeletsvc on each worker node and
-          set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable.
-          --protect-kernel-defaults=true
-          Based on your system, restart the kubelet service. For example:
-          systemctl daemon-reload
-          systemctl restart kubelet.service
-        scored: true
-
-      - id: 3.2.7
-        text: "Ensure that the --make-iptables-util-chains argument is set to true (Automated) "
-        audit: "/bin/ps -fC $kubeletbin"
-        audit_config: "/bin/cat $kubeletconf"
-        tests:
-          test_items:
-            - flag: --make-iptables-util-chains
-              path: '{.makeIPTablesUtilChains}'
-              set: true
-              compare:
-                op: eq
-                value: true
-            - flag: --make-iptables-util-chains
-              path: '{.makeIPTablesUtilChains}'
-              set: false
-          bin_op: or
-        remediation: |
-          If using a Kubelet config file, edit the file to set makeIPTablesUtilChains: true.
-          If using command line arguments, edit the kubelet service file
-          $kubeletsvc on each worker node and
-          remove the --make-iptables-util-chains argument from the
-          KUBELET_SYSTEM_PODS_ARGS variable.
-          Based on your system, restart the kubelet service. For example:
-          systemctl daemon-reload
-          systemctl restart kubelet.service
-        scored: true
-
-      - id: 3.2.8
-        text: "Ensure that the --hostname-override argument is not set (Manual)"
-        # This is one of those properties that can only be set as a command line argument.
-        # To check if the property is set as expected, we need to parse the kubelet command
-        # instead reading the Kubelet Configuration file.
-        audit: "/bin/ps -fC $kubeletbin "
-        tests:
-          test_items:
-            - flag: --hostname-override
-              set: false
-        remediation: |
-          Edit the kubelet service file $kubeletsvc
-          on each worker node and remove the --hostname-override argument from the
-          KUBELET_SYSTEM_PODS_ARGS variable.
-          Based on your system, restart the kubelet service. For example:
-          systemctl daemon-reload
-          systemctl restart kubelet.service
-        scored: false
-
-      - id: 3.2.9
-        text: "Ensure that the --eventRecordQPS argument is set to 0 or a level which ensures appropriate event capture (Automated)"
-        audit: "/bin/ps -fC $kubeletbin"
-        audit_config: "/bin/cat $kubeletconf"
-        tests:
-          test_items:
-            - flag: --event-qps
-              path: '{.eventRecordQPS}'
-              set: true
-              compare:
-                op: eq
-                value: 0
-        remediation: |
-          If using a Kubelet config file, edit the file to set eventRecordQPS: to an appropriate level.
-          If using command line arguments, edit the kubelet service file
-          $kubeletsvc on each worker node and
-          set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable.
-          Based on your system, restart the kubelet service. For example:
-          systemctl daemon-reload
-          systemctl restart kubelet.service
-        scored: false
-
-      - id: 3.2.10
-        text: "Ensure that the --rotate-certificates argument is not set to false (Manual)"
-        audit: "/bin/ps -fC $kubeletbin"
-        audit_config: "/bin/cat $kubeletconf"
-        tests:
-          test_items:
-            - flag: --rotate-certificates
-              path: '{.rotateCertificates}'
-              set: true
-              compare:
-                op: eq
-                value: true
-            - flag: --rotate-certificates
-              path: '{.rotateCertificates}'
-              set: false
-          bin_op: or
-        remediation: |
-          If using a Kubelet config file, edit the file to add the line rotateCertificates: true or
-          remove it altogether to use the default value.
-          If using command line arguments, edit the kubelet service file
-          $kubeletsvc on each worker node and
-          remove --rotate-certificates=false argument from the KUBELET_CERTIFICATE_ARGS
-          variable.
-          Based on your system, restart the kubelet service. For example:
-          systemctl daemon-reload
-          systemctl restart kubelet.service
-        scored: false
-
-      - id: 3.2.11
-        text: "Ensure that the RotateKubeletServerCertificate argument is set to true (Manual)"
-        audit: "/bin/ps -fC $kubeletbin"
-        audit_config: "/bin/cat $kubeletconf"
-        tests:
-          test_items:
-            - flag: RotateKubeletServerCertificate
-              path: '{.featureGates.RotateKubeletServerCertificate}'
-              set: true
-              compare:
-                op: eq
-                value: true
-        remediation: |
-          Edit the kubelet service file $kubeletsvc
-          on each worker node and set the below parameter in KUBELET_CERTIFICATE_ARGS variable.
-          --feature-gates=RotateKubeletServerCertificate=true
-          Based on your system, restart the kubelet service. For example:
-          systemctl daemon-reload
-          systemctl restart kubelet.service
-        scored: false
-  - id: 3.3
-    text: "Container Optimized OS"
-    checks:
-      - id: 3.3.1
-        text: "Prefer using Container-Optimized OS when possible (Manual)"
-        remediation: "No remediation"
-        scored: false

cfg/eks-1.1.0/policies.yaml

@@ -1,205 +0,0 @@
----
-controls:
-version: "eks-1.1.0"
-id: 4
-text: "Policies"
-type: "policies"
-groups:
-  - id: 4.1
-    text: "RBAC and Service Accounts"
-    checks:
-      - id: 4.1.1
-        text: "Ensure that the cluster-admin role is only used where required (Manual)"
-        type: "manual"
-        remediation: |
-          Identify all clusterrolebindings to the cluster-admin role. Check if they are used and
-          if they need this role or if they could use a role with fewer privileges.
-          Where possible, first bind users to a lower privileged role and then remove the
-          clusterrolebinding to the cluster-admin role :
-          kubectl delete clusterrolebinding [name]
-        scored: false
-
-      - id: 4.1.2
-        text: "Minimize access to secrets (Manual)"
-        type: "manual"
-        remediation: |
-          Where possible, remove get, list and watch access to secret objects in the cluster.
-        scored: false
-
-      - id: 4.1.3
-        text: "Minimize wildcard use in Roles and ClusterRoles (Manual)"
-        type: "manual"
-        remediation: |
-          Where possible replace any use of wildcards in clusterroles and roles with specific
-          objects or actions.
-        scored: false
-
-      - id: 4.1.4
-        text: "Minimize access to create pods (Manual)"
-        type: "manual"
-        remediation: |
-          Where possible, remove create access to pod objects in the cluster.
-        scored: false
-
-      - id: 4.1.5
-        text: "Ensure that default service accounts are not actively used. (Manual)"
-        type: "manual"
-        remediation: |
-          Create explicit service accounts wherever a Kubernetes workload requires specific access
-          to the Kubernetes API server.
-          Modify the configuration of each default service account to include this value
-          automountServiceAccountToken: false
-        scored: false
-
-      - id: 4.1.6
-        text: "Ensure that Service Account Tokens are only mounted where necessary (Manual)"
-        type: "manual"
-        remediation: |
-          Modify the definition of pods and service accounts which do not need to mount service
-          account tokens to disable it.
-        scored: false
-
-  - id: 4.2
-    text: "Pod Security Policies"
-    checks:
-      - id: 4.2.1
-        text: "Minimize the admission of privileged containers (Automated)"
-        type: "manual"
-        remediation: |
-          Create a PSP as described in the Kubernetes documentation, ensuring that
-          the .spec.privileged field is omitted or set to false.
-        scored: false
-
-      - id: 4.2.2
-        text: "Minimize the admission of containers wishing to share the host process ID namespace (Automated)"
-        type: "manual"
-        remediation: |
-          Create a PSP as described in the Kubernetes documentation, ensuring that the
-          .spec.hostPID field is omitted or set to false.
-        scored: false
-
-      - id: 4.2.3
-        text: "Minimize the admission of containers wishing to share the host IPC namespace (Automated)"
-        type: "manual"
-        remediation: |
-          Create a PSP as described in the Kubernetes documentation, ensuring that the
-          .spec.hostIPC field is omitted or set to false.
-        scored: false
-
-      - id: 4.2.4
-        text: "Minimize the admission of containers wishing to share the host network namespace (Automated)"
-        type: "manual"
-        remediation: |
-          Create a PSP as described in the Kubernetes documentation, ensuring that the
-          .spec.hostNetwork field is omitted or set to false.
-        scored: false
-
-      - id: 4.2.5
-        text: "Minimize the admission of containers with allowPrivilegeEscalation (Automated)"
-        type: "manual"
-        remediation: |
-          Create a PSP as described in the Kubernetes documentation, ensuring that the
-          .spec.allowPrivilegeEscalation field is omitted or set to false.
-        scored: false
-
-      - id: 4.2.6
-        text: "Minimize the admission of root containers (Automated)"
-        type: "manual"
-        remediation: |
-          Create a PSP as described in the Kubernetes documentation, ensuring that the
-          .spec.runAsUser.rule is set to either MustRunAsNonRoot or MustRunAs with the range of
-          UIDs not including 0.
-        scored: false
-
-      - id: 4.2.7
-        text: "Minimize the admission of containers with the NET_RAW capability (Automated)"
-        type: "manual"
-        remediation: |
-          Create a PSP as described in the Kubernetes documentation, ensuring that the
-          .spec.requiredDropCapabilities is set to include either NET_RAW or ALL.
-        scored: false
-
-      - id: 4.2.8
-        text: "Minimize the admission of containers with added capabilities (Manual)"
-        type: "manual"
-        remediation: |
-          Ensure that allowedCapabilities is not present in PSPs for the cluster unless
-          it is set to an empty array.
-        scored: false
-
-      - id: 4.2.9
-        text: "Minimize the admission of containers with capabilities assigned (Manual)"
-        type: "manual"
-        remediation: |
-          Review the use of capabilities in applications running on your cluster. Where a namespace
-          contains applications which do not require any Linux capabities to operate consider adding
-          a PSP which forbids the admission of containers which do not drop all capabilities.
-        scored: false
-
-  - id: 4.3
-    text: "CNI Plugin"
-    checks:
-      - id: 4.3.1
-        text: "Ensure that the latest CNI version is used (Manual)"
-        type: "manual"
-        remediation: |
-          Review the documentation of AWS CNI plugin, and ensure latest CNI version is used.
-        scored: false
-
-      - id: 4.3.2
-        text: "Ensure that all Namespaces have Network Policies defined (Manual)"
-        type: "manual"
-        remediation: |
-          Follow the documentation and create NetworkPolicy objects as you need them.
-        scored: false
-
-  - id: 4.4
-    text: "Secrets Management"
-    checks:
-      - id: 4.4.1
-        text: "Prefer using secrets as files over secrets as environment variables (Manual)"
-        type: "manual"
-        remediation: |
-          If possible, rewrite application code to read secrets from mounted secret files, rather than
-          from environment variables.
-        scored: false
-
-      - id: 4.4.2
-        text: "Consider external secret storage (Manual)"
-        type: "manual"
-        remediation: |
-          Refer to the secrets management options offered by your cloud provider or a third-party
-          secrets management solution.
-        scored: false
-
-  - id: 4.5
-    text: "Extensible Admission Control"
-    checks: []
-
-  - id: 4.6
-    text: "General Policies"
-    checks:
-      - id: 4.6.1
-        text: "Create administrative boundaries between resources using namespaces (Manual)"
-        type: "manual"
-        remediation: |
-          Follow the documentation and create namespaces for objects in your deployment as you need
-          them.
-        scored: false
-
-      - id: 4.6.2
-        text: "Apply Security Context to Your Pods and Containers (Manual)"
-        type: "manual"
-        remediation: |
-          Follow the Kubernetes documentation and apply security contexts to your pods. For a
-          suggested list of security contexts, you may refer to the CIS Security Benchmark for Docker
-          Containers.
-        scored: false
-
-      - id: 4.6.3
-        text: "The default namespace should not be used (Manual)"
-        type: "manual"
-        remediation: |
-          Ensure that namespaces are created to allow for appropriate segregation of Kubernetes
-          resources and that all new resources are created in a specific namespace.
-        scored: false

cfg/eks-1.2.0/config.yaml

@@ -1,9 +0,0 @@
----
-## Version-specific settings that override the values in cfg/config.yaml
-## These settings are required if you are using the --asff option to report findings to AWS Security Hub
-## AWS account number is required.
-AWS_ACCOUNT: "<AWS_ACCT_NUMBER>"
-## AWS region is required.
-AWS_REGION: "<AWS_REGION>"
-## EKS Cluster ARN is required.
-CLUSTER_ARN: "<AWS_CLUSTER_ARN>"

cfg/eks-1.2.0/controlplane.yaml

@@ -1,14 +0,0 @@
----
-controls:
-version: "eks-1.2.0"
-id: 2
-text: "Control Plane Configuration"
-type: "controlplane"
-groups:
-  - id: 2.1
-    text: "Logging"
-    checks:
-      - id: 2.1.1
-        text: "Enable audit logs (Manual)"
-        remediation: "Enable control plane logging for API Server, Audit, Authenticator, Controller Manager, and Scheduler."
-        scored: false

cfg/eks-1.2.0/managedservices.yaml

@@ -1,154 +0,0 @@
----
-controls:
-version: "eks-1.2.0"
-id: 5
-text: "Managed Services"
-type: "managedservices"
-groups:
-  - id: 5.1
-    text: "Image Registry and Image Scanning"
-    checks:
-      - id: 5.1.1
-        text: "Ensure Image Vulnerability Scanning using Amazon ECR image scanning or a third-party provider (Manual)"
-        type: "manual"
-        remediation: |
-          To utilize AWS ECR for Image scanning please follow the steps below:
-
-          To create a repository configured for scan on push (AWS CLI):
-          aws ecr create-repository --repository-name $REPO_NAME --image-scanning-configuration scanOnPush=true --region $REGION_CODE
-
-          To edit the settings of an existing repository (AWS CLI):
-          aws ecr put-image-scanning-configuration --repository-name $REPO_NAME --image-scanning-configuration scanOnPush=true --region $REGION_CODE
-
-          Use the following steps to start a manual image scan using the AWS Management Console.
-              Open the Amazon ECR console at https://console.aws.amazon.com/ecr/repositories.
-              From the navigation bar, choose the Region to create your repository in.
-              In the navigation pane, choose Repositories.
-              On the Repositories page, choose the repository that contains the image to scan.
-              On the Images page, select the image to scan and then choose Scan.
-        scored: false
-
-      - id: 5.1.2
-        text: "Minimize user access to Amazon ECR (Manual)"
-        type: "manual"
-        remediation: |
-          Before you use IAM to manage access to Amazon ECR, you should understand what IAM features
-          are available to use with Amazon ECR. To get a high-level view of how Amazon ECR and other
-          AWS services work with IAM, see AWS Services That Work with IAM in the IAM User Guide.
-        scored: false
-
-      - id: 5.1.3
-        text: "Minimize cluster access to read-only for Amazon ECR (Manual)"
-        type: "manual"
-        remediation: |
-          You can use your Amazon ECR images with Amazon EKS, but you need to satisfy the following prerequisites.
-
-          The Amazon EKS worker node IAM role (NodeInstanceRole) that you use with your worker nodes must possess
-          the following IAM policy permissions for Amazon ECR.
-
-          {
-              "Version": "2012-10-17",
-              "Statement": [
-                  {
-                      "Effect": "Allow",
-                      "Action": [
-                          "ecr:BatchCheckLayerAvailability",
-                          "ecr:BatchGetImage",
-                          "ecr:GetDownloadUrlForLayer",
-                          "ecr:GetAuthorizationToken"
-                      ],
-                      "Resource": "*"
-                  }
-              ]
-          }
-        scored: false
-
-      - id: 5.1.4
-        text: "Minimize Container Registries to only those approved (Manual)"
-        type: "manual"
-        remediation: "No remediation"
-        scored: false
-
-  - id: 5.2
-    text: "Identity and Access Management (IAM)"
-    checks:
-      - id: 5.2.1
-        text: "Prefer using dedicated Amazon EKS Service Accounts (Manual)"
-        type: "manual"
-        remediation: "No remediation"
-        scored: false
-
-  - id: 5.3
-    text: "AWS Key Management Service (KMS)"
-    checks:
-      - id: 5.3.1
-        text: "Ensure Kubernetes Secrets are encrypted using Customer Master Keys (CMKs) managed in AWS KMS (Manual)"
-        type: "manual"
-        remediation: |
-          This process can only be performed during Cluster Creation.
-
-          Enable 'Secrets Encryption' during Amazon EKS cluster creation as described
-          in the links within the 'References' section.
-        scored: false
-
-  - id: 5.4
-    text: "Cluster Networking"
-    checks:
-      - id: 5.4.1
-        text: "Restrict Access to the Control Plane Endpoint (Manual)"
-        type: "manual"
-        remediation: "No remediation"
-        scored: false
-
-      - id: 5.4.2
-        text: "Ensure clusters are created with Private Endpoint Enabled and Public Access Disabled (Manual)"
-        type: "manual"
-        remediation: "No remediation"
-        scored: false
-
-      - id: 5.4.3
-        text: "Ensure clusters are created with Private Nodes (Manual)"
-        type: "manual"
-        remediation: "No remediation"
-        scored: false
-
-      - id: 5.4.4
-        text: "Ensure Network Policy is Enabled and set as appropriate (Manual)"
-        type: "manual"
-        remediation: "No remediation"
-        scored: false
-
-      - id: 5.4.5
-        text: "Encrypt traffic to HTTPS load balancers with TLS certificates (Manual)"
-        type: "manual"
-        remediation: "No remediation"
-        scored: false
-
-
-  - id: 5.5
-    text: "Authentication and Authorization"
-    checks:
-      - id: 5.5.1
-        text: "Manage Kubernetes RBAC users with AWS IAM Authenticator for Kubernetes (Manual)"
-        type: "manual"
-        remediation: |
-          Refer to the 'Managing users or IAM roles for your cluster' in Amazon EKS documentation.
-        scored: false
-
-
-  - id: 5.6
-    text: "Other Cluster Configurations"
-    checks:
-      - id: 5.6.1
-        text: "Consider Fargate for running untrusted workloads (Manual)"
-        type: "manual"
-        remediation: |
-          Create a Fargate profile for your cluster Before you can schedule pods running on Fargate
-          in your cluster, you must define a Fargate profile that specifies which pods should use
-          Fargate when they are launched. For more information, see AWS Fargate profile.
-
-          Note: If you created your cluster with eksctl using the --fargate option, then a Fargate profile has
-          already been created for your cluster with selectors for all pods in the kube-system
-          and default namespaces. Use the following procedure to create Fargate profiles for
-          any other namespaces you would like to use with Fargate.
-        scored: false

cfg/eks-1.2.0/master.yaml

@@ -1,6 +0,0 @@
----
-controls:
-version: "eks-1.2.0"
-id: 1
-text: "Control Plane Components"
-type: "master"

cfg/eks-1.2.0/node.yaml

@@ -1,330 +0,0 @@
----
-controls:
-version: "eks-1.2.0"
-id: 3
-text: "Worker Node Security Configuration"
-type: "node"
-groups:
-  - id: 3.1
-    text: "Worker Node Configuration Files"
-    checks:
-      - id: 3.1.1
-        text: "Ensure that the kubeconfig file permissions are set to 644 or more restrictive (Manual)"
-        audit: '/bin/sh -c ''if test -e $kubeletkubeconfig; then stat -c permissions=%a $kubeletkubeconfig; fi'' '
-        tests:
-          test_items:
-            - flag: "permissions"
-              compare:
-                op: bitmask
-                value: "644"
-        remediation: |
-          Run the below command (based on the file location on your system) on the each worker node.
-          For example,
-          chmod 644 $kubeletkubeconfig
-        scored: false
-
-      - id: 3.1.2
-        text: "Ensure that the kubelet kubeconfig file ownership is set to root:root (Manual)"
-        audit: '/bin/sh -c ''if test -e $kubeletkubeconfig; then stat -c %U:%G $kubeletkubeconfig; fi'' '
-        tests:
-          test_items:
-            - flag: root:root
-        remediation: |
-          Run the below command (based on the file location on your system) on the each worker node.
-          For example,
-          chown root:root $kubeletkubeconfig
-        scored: false
-
-      - id: 3.1.3
-        text: "Ensure that the kubelet configuration file has permissions set to 644 or more restrictive (Manual)"
-        audit: '/bin/sh -c ''if test -e $kubeletconf; then stat -c permissions=%a $kubeletconf; fi'' '
-        tests:
-          test_items:
-            - flag: "permissions"
-              compare:
-                op: bitmask
-                value: "644"
-        remediation: |
-          Run the following command (using the config file location identified in the Audit step)
-          chmod 644 $kubeletconf
-        scored: false
-
-      - id: 3.1.4
-        text: "Ensure that the kubelet configuration file ownership is set to root:root (Manual)"
-        audit: '/bin/sh -c ''if test -e $kubeletconf; then stat -c %U:%G $kubeletconf; fi'' '
-        tests:
-          test_items:
-            - flag: root:root
-        remediation: |
-          Run the following command (using the config file location identified in the Audit step)
-          chown root:root $kubeletconf
-        scored: false
-
-  - id: 3.2
-    text: "Kubelet"
-    checks:
-      - id: 3.2.1
-        text: "Ensure that the Anonymous Auth is Not Enabled (Automated)"
-        audit: "/bin/ps -fC $kubeletbin"
-        audit_config: "/bin/cat $kubeletconf"
-        tests:
-          test_items:
-            - flag: "--anonymous-auth"
-              path: '{.authentication.anonymous.enabled}'
-              set: true
-              compare:
-                op: eq
-                value: false
-        remediation: |
-          If using a Kubelet config file, edit the file to set authentication: anonymous: enabled to
-          false.
-          If using executable arguments, edit the kubelet service file
-          $kubeletsvc on each worker node and
-          set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable.
-          --anonymous-auth=false
-          Based on your system, restart the kubelet service. For example:
-          systemctl daemon-reload
-          systemctl restart kubelet.service
-        scored: true
-
-      - id: 3.2.2
-        text: "Ensure that the --authorization-mode argument is not set to AlwaysAllow (Automated)"
-        audit: "/bin/ps -fC $kubeletbin"
-        audit_config: "/bin/cat $kubeletconf"
-        tests:
-          test_items:
-            - flag: --authorization-mode
-              path: '{.authorization.mode}'
-              set: true
-              compare:
-                op: nothave
-                value: AlwaysAllow
-        remediation: |
-          If using a Kubelet config file, edit the file to set authorization: mode to Webhook. If
-          using executable arguments, edit the kubelet service file
-          $kubeletsvc on each worker node and
-          set the below parameter in KUBELET_AUTHZ_ARGS variable.
-          --authorization-mode=Webhook
-          Based on your system, restart the kubelet service. For example:
-          systemctl daemon-reload
-          systemctl restart kubelet.service
-        scored: true
-
-      - id: 3.2.3
-        text: "Ensure that a Client CA File is Configured (Manual)"
-        audit: "/bin/ps -fC $kubeletbin"
-        audit_config: "/bin/cat $kubeletconf"
-        tests:
-          test_items:
-            - flag: --client-ca-file
-              path: '{.authentication.x509.clientCAFile}'
-              set: true
-        remediation: |
-          If using a Kubelet config file, edit the file to set authentication: x509: clientCAFile to
-          the location of the client CA file.
-          If using command line arguments, edit the kubelet service file
-          $kubeletsvc on each worker node and
-          set the below parameter in KUBELET_AUTHZ_ARGS variable.
-          --client-ca-file=<path/to/client-ca-file>
-          Based on your system, restart the kubelet service. For example:
-          systemctl daemon-reload
-          systemctl restart kubelet.service
-        scored: false
-
-      - id: 3.2.4
-        text: "Ensure that the --read-only-port is disabled (Manual)"
-        audit: "/bin/ps -fC $kubeletbin"
-        audit_config: "/bin/cat $kubeletconf"
-        tests:
-          test_items:
-            - flag: "--read-only-port"
-              path: '{.readOnlyPort}'
-              set: true
-              compare:
-                op: eq
-                value: 0
-        remediation: |
-          If using a Kubelet config file, edit the file to set readOnlyPort to 0.
-          If using command line arguments, edit the kubelet service file
-          $kubeletsvc on each worker node and
-          set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable.
-          --read-only-port=0
-          Based on your system, restart the kubelet service. For example:
-          systemctl daemon-reload
-          systemctl restart kubelet.service
-        scored: false
-
-      - id: 3.2.5
-        text: "Ensure that the --streaming-connection-idle-timeout argument is not set to 0 (Automated)"
-        audit: "/bin/ps -fC $kubeletbin"
-        audit_config: "/bin/cat $kubeletconf"
-        tests:
-          test_items:
-            - flag: --streaming-connection-idle-timeout
-              path: '{.streamingConnectionIdleTimeout}'
-              set: true
-              compare:
-                op: noteq
-                value: 0
-            - flag: --streaming-connection-idle-timeout
-              path: '{.streamingConnectionIdleTimeout}'
-              set: false
-          bin_op: or
-        remediation: |
-          If using a Kubelet config file, edit the file to set streamingConnectionIdleTimeout to a
-          value other than 0.
-          If using command line arguments, edit the kubelet service file
-          $kubeletsvc on each worker node and
-          set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable.
-          --streaming-connection-idle-timeout=5m
-          Based on your system, restart the kubelet service. For example:
-          systemctl daemon-reload
-          systemctl restart kubelet.service
-        scored: true
-
-      - id: 3.2.6
-        text: "Ensure that the --protect-kernel-defaults argument is set to true (Automated)"
-        audit: "/bin/ps -fC $kubeletbin"
-        audit_config: "/bin/cat $kubeletconf"
-        tests:
-          test_items:
-            - flag: --protect-kernel-defaults
-              path: '{.protectKernelDefaults}'
-              set: true
-              compare:
-                op: eq
-                value: true
-        remediation: |
-          If using a Kubelet config file, edit the file to set protectKernelDefaults: true.
-          If using command line arguments, edit the kubelet service file
-          $kubeletsvc on each worker node and
-          set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable.
-          --protect-kernel-defaults=true
-          Based on your system, restart the kubelet service. For example:
-          systemctl daemon-reload
-          systemctl restart kubelet.service
-        scored: true
-
-      - id: 3.2.7
-        text: "Ensure that the --make-iptables-util-chains argument is set to true (Automated) "
-        audit: "/bin/ps -fC $kubeletbin"
-        audit_config: "/bin/cat $kubeletconf"
-        tests:
-          test_items:
-            - flag: --make-iptables-util-chains
-              path: '{.makeIPTablesUtilChains}'
-              set: true
-              compare:
-                op: eq
-                value: true
-            - flag: --make-iptables-util-chains
-              path: '{.makeIPTablesUtilChains}'
-              set: false
-          bin_op: or
-        remediation: |
-          If using a Kubelet config file, edit the file to set makeIPTablesUtilChains: true.
-          If using command line arguments, edit the kubelet service file
-          $kubeletsvc on each worker node and
-          remove the --make-iptables-util-chains argument from the
-          KUBELET_SYSTEM_PODS_ARGS variable.
-          Based on your system, restart the kubelet service. For example:
-          systemctl daemon-reload
-          systemctl restart kubelet.service
-        scored: true
-
-      - id: 3.2.8
-        text: "Ensure that the --hostname-override argument is not set (Manual)"
-        # This is one of those properties that can only be set as a command line argument.
-        # To check if the property is set as expected, we need to parse the kubelet command
-        # instead reading the Kubelet Configuration file.
-        audit: "/bin/ps -fC $kubeletbin "
-        tests:
-          test_items:
-            - flag: --hostname-override
-              set: false
-        remediation: |
-          Edit the kubelet service file $kubeletsvc
-          on each worker node and remove the --hostname-override argument from the
-          KUBELET_SYSTEM_PODS_ARGS variable.
-          Based on your system, restart the kubelet service. For example:
-          systemctl daemon-reload
-          systemctl restart kubelet.service
-        scored: false
-
-      - id: 3.2.9
-        text: "Ensure that the --eventRecordQPS argument is set to 0 or a level which ensures appropriate event capture (Automated)"
-        audit: "/bin/ps -fC $kubeletbin"
-        audit_config: "/bin/cat $kubeletconf"
-        tests:
-          test_items:
-            - flag: --event-qps
-              path: '{.eventRecordQPS}'
-              set: true
-              compare:
-                op: gte
-                value: 0
-        remediation: |
-          If using a Kubelet config file, edit the file to set eventRecordQPS: to an appropriate level.
-          If using command line arguments, edit the kubelet service file
-          $kubeletsvc on each worker node and
-          set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable.
-          Based on your system, restart the kubelet service. For example:
-          systemctl daemon-reload
-          systemctl restart kubelet.service
-        scored: false
-
-      - id: 3.2.10
-        text: "Ensure that the --rotate-certificates argument is not present or is set to true (Manual)"
-        audit: "/bin/ps -fC $kubeletbin"
-        audit_config: "/bin/cat $kubeletconf"
-        tests:
-          test_items:
-            - flag: --rotate-certificates
-              path: '{.rotateCertificates}'
-              set: true
-              compare:
-                op: eq
-                value: true
-            - flag: --rotate-certificates
-              path: '{.rotateCertificates}'
-              set: false
-          bin_op: or
-        remediation: |
-          If using a Kubelet config file, edit the file to add the line rotateCertificates: true or
-          remove it altogether to use the default value.
-          If using command line arguments, edit the kubelet service file
-          $kubeletsvc on each worker node and
-          remove --rotate-certificates=false argument from the KUBELET_CERTIFICATE_ARGS
-          variable.
-          Based on your system, restart the kubelet service. For example:
-          systemctl daemon-reload
-          systemctl restart kubelet.service
-        scored: false
-
-      - id: 3.2.11
-        text: "Ensure that the RotateKubeletServerCertificate argument is set to true (Manual)"
-        audit: "/bin/ps -fC $kubeletbin"
-        audit_config: "/bin/cat $kubeletconf"
-        tests:
-          test_items:
-            - flag: RotateKubeletServerCertificate
-              path: '{.featureGates.RotateKubeletServerCertificate}'
-              set: true
-              compare:
-                op: eq
-                value: true
-        remediation: |
-          Edit the kubelet service file $kubeletsvc
-          on each worker node and set the below parameter in KUBELET_CERTIFICATE_ARGS variable.
-          --feature-gates=RotateKubeletServerCertificate=true
-          Based on your system, restart the kubelet service. For example:
-          systemctl daemon-reload
-          systemctl restart kubelet.service
-        scored: false
-  - id: 3.3
-    text: "Container Optimized OS"
-    checks:
-      - id: 3.3.1
-        text: "Prefer using a container-optimized OS when possible (Manual)"
-        remediation: "No remediation"
-        scored: false

cfg/eks-1.2.0/policies.yaml

@@ -1,213 +0,0 @@
----
-controls:
-version: "eks-1.2.0"
-id: 4
-text: "Policies"
-type: "policies"
-groups:
-  - id: 4.1
-    text: "RBAC and Service Accounts"
-    checks:
-      - id: 4.1.1
-        text: "Ensure that the cluster-admin role is only used where required (Manual)"
-        type: "manual"
-        remediation: |
-          Identify all clusterrolebindings to the cluster-admin role. Check if they are used and
-          if they need this role or if they could use a role with fewer privileges.
-          Where possible, first bind users to a lower privileged role and then remove the
-          clusterrolebinding to the cluster-admin role :
-          kubectl delete clusterrolebinding [name]
-        scored: false
-
-      - id: 4.1.2
-        text: "Minimize access to secrets (Manual)"
-        type: "manual"
-        remediation: |
-          Where possible, remove get, list and watch access to secret objects in the cluster.
-        scored: false
-
-      - id: 4.1.3
-        text: "Minimize wildcard use in Roles and ClusterRoles (Manual)"
-        type: "manual"
-        remediation: |
-          Where possible replace any use of wildcards in clusterroles and roles with specific
-          objects or actions.
-        scored: false
-
-      - id: 4.1.4
-        text: "Minimize access to create pods (Manual)"
-        type: "manual"
-        remediation: |
-          Where possible, remove create access to pod objects in the cluster.
-        scored: false
-
-      - id: 4.1.5
-        text: "Ensure that default service accounts are not actively used. (Manual)"
-        type: "manual"
-        remediation: |
-          Create explicit service accounts wherever a Kubernetes workload requires specific access
-          to the Kubernetes API server.
-          Modify the configuration of each default service account to include this value
-          automountServiceAccountToken: false
-        scored: false
-
-      - id: 4.1.6
-        text: "Ensure that Service Account Tokens are only mounted where necessary (Manual)"
-        type: "manual"
-        remediation: |
-          Modify the definition of pods and service accounts which do not need to mount service
-          account tokens to disable it.
-        scored: false
-
-      - id: 4.1.7
-        text: "Avoid use of system:masters group (Manual)"
-        type: "manual"
-        remediation: |
-          Remove the system:masters group from all users in the cluster.
-        scored: false
-
-      - id: 4.1.8
-        text: "Limit use of the Bind, Impersonate and Escalate permissions in the Kubernetes cluster (Manual)"
-        type: "manual"
-        remediation: |
-          Where possible, remove the impersonate, bind and escalate rights from subjects.
-        scored: false
-
-  - id: 4.2
-    text: "Pod Security Policies"
-    checks:
-      - id: 4.2.1
-        text: "Minimize the admission of privileged containers (Automated)"
-        type: "manual"
-        remediation: |
-          Create a PSP as described in the Kubernetes documentation, ensuring that
-          the .spec.privileged field is omitted or set to false.
-        scored: false
-
-      - id: 4.2.2
-        text: "Minimize the admission of containers wishing to share the host process ID namespace (Automated)"
-        type: "manual"
-        remediation: |
-          Create a PSP as described in the Kubernetes documentation, ensuring that the
-          .spec.hostPID field is omitted or set to false.
-        scored: false
-
-      - id: 4.2.3
-        text: "Minimize the admission of containers wishing to share the host IPC namespace (Automated)"
-        type: "manual"
-        remediation: |
-          Create a PSP as described in the Kubernetes documentation, ensuring that the
-          .spec.hostIPC field is omitted or set to false.
-        scored: false
-
-      - id: 4.2.4
-        text: "Minimize the admission of containers wishing to share the host network namespace (Automated)"
-        type: "manual"
-        remediation: |
-          Create a PSP as described in the Kubernetes documentation, ensuring that the
-          .spec.hostNetwork field is omitted or set to false.
-        scored: false
-
-      - id: 4.2.5
-        text: "Minimize the admission of containers with allowPrivilegeEscalation (Automated)"
-        type: "manual"
-        remediation: |
-          Create a PSP as described in the Kubernetes documentation, ensuring that the
-          .spec.allowPrivilegeEscalation field is omitted or set to false.
-        scored: false
-
-      - id: 4.2.6
-        text: "Minimize the admission of root containers (Automated)"
-        type: "manual"
-        remediation: |
-          Create a PSP as described in the Kubernetes documentation, ensuring that the
-          .spec.runAsUser.rule is set to either MustRunAsNonRoot or MustRunAs with the range of
-          UIDs not including 0.
-        scored: false
-
-      - id: 4.2.7
-        text: "Minimize the admission of containers with added capabilities (Manual)"
-        type: "manual"
-        remediation: |
-          Ensure that allowedCapabilities is not present in PSPs for the cluster unless
-          it is set to an empty array.
-        scored: false
-
-      - id: 4.2.8
-        text: "Minimize the admission of containers with capabilities assigned (Manual)"
-        type: "manual"
-        remediation: |
-          Review the use of capabilities in applications running on your cluster. Where a namespace
-          contains applications which do not require any Linux capabities to operate consider adding
-          a PSP which forbids the admission of containers which do not drop all capabilities.
-        scored: false
-
-  - id: 4.3
-    text: "CNI Plugin"
-    checks:
-      - id: 4.3.1
-        text: "Ensure CNI plugin supports network policies (Manual)"
-        type: "manual"
-        remediation: |
-          As with RBAC policies, network policies should adhere to the policy of least privileged
-          access. Start by creating a deny all policy that restricts all inbound and outbound traffic
-          from a namespace or create a global policy using Calico.
-        scored: false
-
-      - id: 4.3.2
-        text: "Ensure that all Namespaces have Network Policies defined (Manual)"
-        type: "manual"
-        remediation: |
-          Follow the documentation and create NetworkPolicy objects as you need them.
-        scored: false
-
-  - id: 4.4
-    text: "Secrets Management"
-    checks:
-      - id: 4.4.1
-        text: "Prefer using secrets as files over secrets as environment variables (Manual)"
-        type: "manual"
-        remediation: |
-          If possible, rewrite application code to read secrets from mounted secret files, rather than
-          from environment variables.
-        scored: false
-
-      - id: 4.4.2
-        text: "Consider external secret storage (Manual)"
-        type: "manual"
-        remediation: |
-          Refer to the secrets management options offered by your cloud provider or a third-party
-          secrets management solution.
-        scored: false
-
-  - id: 4.5
-    text: "Extensible Admission Control"
-    checks: []
-
-  - id: 4.6
-    text: "General Policies"
-    checks:
-      - id: 4.6.1
-        text: "Create administrative boundaries between resources using namespaces (Manual)"
-        type: "manual"
-        remediation: |
-          Follow the documentation and create namespaces for objects in your deployment as you need
-          them.
-        scored: false
-
-      - id: 4.6.2
-        text: "Apply Security Context to Your Pods and Containers (Manual)"
-        type: "manual"
-        remediation: |
-          Follow the Kubernetes documentation and apply security contexts to your pods. For a
-          suggested list of security contexts, you may refer to the CIS Security Benchmark for Docker
-          Containers.
-        scored: false
-
-      - id: 4.6.3
-        text: "The default namespace should not be used (Manual)"
-        type: "manual"
-        remediation: |
-          Ensure that namespaces are created to allow for appropriate segregation of Kubernetes
-          resources and that all new resources are created in a specific namespace.
-        scored: false

cfg/eks-1.5.0/config.yaml

@@ -1,9 +0,0 @@
----
-## Version-specific settings that override the values in cfg/config.yaml
-## These settings are required if you are using the --asff option to report findings to AWS Security Hub
-## AWS account number is required.
-AWS_ACCOUNT: "<AWS_ACCT_NUMBER>"
-## AWS region is required.
-AWS_REGION: "<AWS_REGION>"
-## EKS Cluster ARN is required.
-CLUSTER_ARN: "<AWS_CLUSTER_ARN>"

cfg/eks-1.5.0/controlplane.yaml

@@ -1,32 +0,0 @@
----
-controls:
-version: "eks-1.5.0"
-id: 2
-text: "Control Plane Configuration"
-type: "controlplane"
-groups:
-  - id: 2.1
-    text: "Logging"
-    checks:
-      - id: 2.1.1
-        text: "Enable audit Logs (Automated)"
-        remediation: |
-          From Console:
-          1.  For each EKS Cluster in each region;
-          2.  Go to 'Amazon EKS' > 'Clusters' > '' > 'Configuration' > 'Logging'.
-          3.  Click 'Manage logging'.
-          4.  Ensure that all options are toggled to 'Enabled'.
-                API server: Enabled
-                Audit: Enabled
-                Authenticator: Enabled
-                Controller manager: Enabled
-                Scheduler: Enabled
-          5.  Click 'Save Changes'.
-
-          From CLI:
-          # For each EKS Cluster in each region;
-          aws eks update-cluster-config \
-            --region '${REGION_CODE}' \
-            --name '${CLUSTER_NAME}' \
-            --logging '{"clusterLogging":[{"types":["api","audit","authenticator","controllerManager","scheduler"],"enabled":true}]}'
-        scored: false