mirror of
https://github.com/aquasecurity/kube-bench.git
synced 2026-02-23 14:24:03 +00:00
Compare commits
29 Commits
| Author | SHA1 | Date | |
|---|---|---|---|
|
20ec5d14f2 | ||
|
3e6a41af04 | ||
|
1b5b6c2afe | ||
|
|
52ebfa5b5a | ||
|
5cf3821eb6 | ||
|
|
c7b518e76b | ||
|
122bc4b351 | ||
|
|
35cf28c140 | ||
|
2cf2876a10 | ||
|
305283f9d4 | ||
|
|
4557ca00f1 | ||
|
582ce02ce6 | ||
|
82614d9b3f | ||
|
d8234ff07c | ||
|
|
7e87c980b2 | ||
|
|
7cd6b32ebb | ||
|
71bc8f544c | ||
|
9efd942bcc | ||
|
|
60f2fb592a | ||
|
|
451721a1cf | ||
|
b403b364fe | ||
|
|
06303f6a7a | ||
|
|
70988356c8 | ||
|
|
0b07f40c9b | ||
|
d988b81540 | ||
|
237f8cf818 | ||
|
|
65fb352e0e | ||
|
|
17cd104788 | ||
|
77f66511e7 |
@@ -9,6 +9,11 @@ builds:
|
||||
- linux
|
||||
goarch:
|
||||
- amd64
|
||||
- arm
|
||||
- arm64
|
||||
goarm:
|
||||
- 6
|
||||
- 7
|
||||
ldflags:
|
||||
- "-X github.com/aquasecurity/kube-bench/cmd.KubeBenchVersion={{.Version}}"
|
||||
- "-X github.com/aquasecurity/kube-bench/cmd.cfgDir={{.Env.KUBEBENCH_CFG}}"
|
||||
@@ -16,6 +21,7 @@ builds:
|
||||
archives:
|
||||
- id: default
|
||||
format: tar.gz
|
||||
name_template: '{{ .Binary }}_{{.Version}}_{{ .Os }}_{{ .Arch }}{{ if .Arm }}v{{.Arm }}{{ end }}'
|
||||
files:
|
||||
- "cfg/**/*"
|
||||
nfpms:
|
||||
|
||||
@@ -9,7 +9,7 @@ Thank you for taking an interest in contributing to kube-bench !
|
||||
- For questions and bug reports, please include the following information:
|
||||
- version of kube-bench you are running (from kube-bench version) along with the command line options you are using.
|
||||
- version of Kubernetes you are running (from kubectl version or oc version for Openshift).
|
||||
- Verbose log output, by setting the `-v 10` command line option.
|
||||
- Verbose log output, by setting the `-v 10` and `--logtostderr` command line options.
|
||||
|
||||
## Pull Requests
|
||||
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
FROM golang:1.13 AS build
|
||||
FROM golang:1.14.0 AS build
|
||||
WORKDIR /go/src/github.com/aquasecurity/kube-bench/
|
||||
COPY go.mod go.sum ./
|
||||
COPY main.go .
|
||||
@@ -17,6 +17,8 @@ RUN apk --no-cache add procps
|
||||
# https://github.com/aquasecurity/kube-bench/issues/535
|
||||
RUN apk --no-cache add openssl
|
||||
|
||||
ENV PATH=$PATH:/usr/local/mount-from-host/bin
|
||||
|
||||
COPY --from=build /go/bin/kube-bench /usr/local/bin/kube-bench
|
||||
COPY entrypoint.sh .
|
||||
COPY cfg/ cfg/
|
||||
|
||||
57
README.md
57
README.md
@@ -10,10 +10,17 @@
|
||||
|
||||
kube-bench is a Go application that checks whether Kubernetes is deployed securely by running the checks documented in the [CIS Kubernetes Benchmark](https://www.cisecurity.org/benchmark/kubernetes/).
|
||||
|
||||
Note that it is impossible to inspect the master nodes of managed clusters, e.g. GKE, EKS and AKS, using kube-bench as one does not have access to such nodes, although it is still possible to use kube-bench to check worker node configuration in these environments.
|
||||
|
||||
Tests are configured with YAML files, making this tool easy to update as test specifications evolve.
|
||||
|
||||
### Please Note
|
||||
|
||||
1. kube-bench implements the [CIS Kubernetes Benchmark](https://www.cisecurity.org/benchmark/kubernetes/) as closely as possible. Please raise issues here if kube-bench is not correctly implementing the test as described in the Benchmark. To report issues in the Benchmark itself (for example, tests that you believe are inappropriate), please join the [CIS community](https://cisecurity.org).
|
||||
|
||||
1. There is not a one-to-one mapping between releases of Kubernetes and releases of the CIS benchmark. See [CIS Kubernetes Benchmark support](#cis-kubernetes-benchmark-support) to see which releases of Kubernetes are covered by different releases of the benchmark.
|
||||
|
||||
1. It is impossible to inspect the master nodes of managed clusters, e.g. GKE, EKS and AKS, using kube-bench as one does not have access to such nodes, although it is still possible to use kube-bench to check worker node configuration in these environments.
|
||||
|
||||
|
||||
|
||||
|
||||
Table of Contents
|
||||
@@ -43,20 +50,18 @@ Table of Contents
|
||||
|
||||
## CIS Kubernetes Benchmark support
|
||||
|
||||
kube-bench supports the tests for Kubernetes as defined in the CIS Benchmarks 1.3.0 to 1.5.0 respectively.
|
||||
kube-bench supports the tests for Kubernetes as defined in the [CIS Kubernetes Benchmarks](https://www.cisecurity.org/benchmark/kubernetes/).
|
||||
|
||||
| CIS Kubernetes Benchmark | kube-bench config | Kubernetes versions |
|
||||
|---|---|---|
|
||||
| 1.3.0| cis-1.3 | 1.11-1.12 |
|
||||
| 1.4.1| cis-1.4 | 1.13-1.14 |
|
||||
| 1.5.0 | cis-1.5 | 1.15- |
|
||||
|
||||
|
||||
By default, kube-bench will determine the test set to run based on the Kubernetes version running on the machine.
|
||||
|
||||
There is also preliminary support for Red Hat's OpenShift Hardening Guide for 3.10 and 3.11. Please note that kube-bench does not automatically detect OpenShift - see below.
|
||||
|
||||
| [1.3.0](https://workbench.cisecurity.org/benchmarks/602) | cis-1.3 | 1.11-1.12 |
|
||||
| [1.4.1](https://workbench.cisecurity.org/benchmarks/2351) | cis-1.4 | 1.13-1.14 |
|
||||
| [1.5.0](https://workbench.cisecurity.org/benchmarks/1370) | cis-1.5 | 1.15- |
|
||||
| [GKE 1.0.0](https://workbench.cisecurity.org/benchmarks/4536) | gke-1.0 | GKE |
|
||||
| [EKS 1.0.0](https://workbench.cisecurity.org/benchmarks/5190) | eks-1.0 | EKS |
|
||||
| Red Hat OpenShift hardening guide | rh-0.7 | OCP 3.10-3.11 |
|
||||
|
||||
By default, kube-bench will determine the test set to run based on the Kubernetes version running on the machine, but please note that kube-bench does not automatically detect OpenShift and GKE - see the section below on [Running kube-bench](https://github.com/aquasecurity/kube-bench#running-kube-bench).
|
||||
|
||||
## Installation
|
||||
|
||||
@@ -115,6 +120,8 @@ The following table shows the valid targets based on the CIS Benchmark version.
|
||||
| cis-1.3| master, node |
|
||||
| cis-1.4| master, node |
|
||||
| cis-1.5| master, controlplane, node, etcd, policies |
|
||||
| gke-1.0| master, controlplane, node, etcd, policies, managedservices |
|
||||
| eks-1.0| node, policies, managedservices |
|
||||
|
||||
If no targets are specified, `kube-bench` will determine the appropriate targets based on the CIS Benchmark version.
|
||||
|
||||
@@ -131,16 +138,16 @@ You can avoid installing kube-bench on the host by running it inside a container
|
||||
docker run --pid=host -v /etc:/etc:ro -v /var:/var:ro -t aquasec/kube-bench:latest [master|node] --version 1.13
|
||||
```
|
||||
|
||||
> Note: the tests require either the kubelet or kubectl binary in the path in order to auto-detect the Kubernetes version. You can pass `-v $(which kubectl):/usr/bin/kubectl` to resolve this. You will also need to pass in kubeconfig credentials. For example:
|
||||
> Note: the tests require either the kubelet or kubectl binary in the path in order to auto-detect the Kubernetes version. You can pass `-v $(which kubectl):/usr/local/mount-from-host/bin/kubectl` to resolve this. You will also need to pass in kubeconfig credentials. For example:
|
||||
|
||||
```
|
||||
docker run --pid=host -v /etc:/etc:ro -v /var:/var:ro -v $(which kubectl):/usr/bin/kubectl -v ~/.kube:/.kube -e KUBECONFIG=/.kube/config -t aquasec/kube-bench:latest [master|node]
|
||||
docker run --pid=host -v /etc:/etc:ro -v /var:/var:ro -v $(which kubectl):/usr/local/mount-from-host/bin/kubectl -v ~/.kube:/.kube -e KUBECONFIG=/.kube/config -t aquasec/kube-bench:latest [master|node]
|
||||
```
|
||||
|
||||
You can use your own configs by mounting them over the default ones in `/opt/kube-bench/cfg/`
|
||||
|
||||
```
|
||||
docker run --pid=host -v /etc:/etc:ro -v /var:/var:ro -t -v path/to/my-config.yaml:/opt/kube-bench/cfg/config.yam -v $(which kubectl):/usr/bin/kubectl -v ~/.kube:/.kube -e KUBECONFIG=/.kube/config aquasec/kube-bench:latest [master|node]
|
||||
docker run --pid=host -v /etc:/etc:ro -v /var:/var:ro -t -v path/to/my-config.yaml:/opt/kube-bench/cfg/config.yam -v $(which kubectl):/usr/local/mount-from-host/bin/kubectl -v ~/.kube:/.kube -e KUBECONFIG=/.kube/config aquasec/kube-bench:latest [master|node]
|
||||
```
|
||||
|
||||
### Running in a Kubernetes cluster
|
||||
@@ -211,7 +218,7 @@ aws ecr create-repository --repository-name k8s/kube-bench --image-tag-mutabilit
|
||||
```
|
||||
git clone https://github.com/aquasecurity/kube-bench.git
|
||||
cd kube-bench
|
||||
$(aws ecr get-login --no-include-email --region <AWS_REGION>)
|
||||
aws ecr get-login-password --region <AWS_REGION> | docker login --username <AWS_USERNAME> --password-stdin <AWS_ACCT_NUMBER>.dkr.ecr.<AWS_REGION>.amazonaws.com
|
||||
docker build -t k8s/kube-bench .
|
||||
docker tag k8s/kube-bench:latest <AWS_ACCT_NUMBER>.dkr.ecr.<AWS_REGION>.amazonaws.com/k8s/kube-bench:latest
|
||||
docker push <AWS_ACCT_NUMBER>.dkr.ecr.<AWS_REGION>.amazonaws.com/k8s/kube-bench:latest
|
||||
@@ -239,9 +246,7 @@ If Go is installed on the target machines, you can simply clone this repository
|
||||
|
||||
```shell
|
||||
go get github.com/aquasecurity/kube-bench
|
||||
go get github.com/golang/dep/cmd/dep
|
||||
cd $GOPATH/src/github.com/aquasecurity/kube-bench
|
||||
$GOPATH/bin/dep ensure -vendor-only
|
||||
go build -o kube-bench .
|
||||
|
||||
# See all supported options
|
||||
@@ -254,7 +259,7 @@ go build -o kube-bench .
|
||||
## Running on OpenShift
|
||||
|
||||
| OpenShift Hardening Guide | kube-bench config |
|
||||
|---|---|---|
|
||||
|---|---|
|
||||
| ocp-3.10| rh-0.7 |
|
||||
| ocp-3.11| rh-0.7 |
|
||||
|
||||
@@ -262,6 +267,18 @@ kube-bench includes a set of test files for Red Hat's OpenShift hardening guide
|
||||
|
||||
when you run the `kube-bench` command (either directly or through YAML).
|
||||
|
||||
### Running in an GKE cluster
|
||||
| CIS Benchmark | Targets |
|
||||
|---|---|
|
||||
| gke-1.0| master, controlplane, node, etcd, policies, managedservices |
|
||||
|
||||
kube-bench includes benchmarks for GKE. To run this you will need to specify `--benchmark gke-1.0` when you run the `kube-bench` command.
|
||||
|
||||
To run the benchmark as a job in your GKE cluster apply the included `job-gke.yaml`.
|
||||
|
||||
```
|
||||
kubectl apply -f job-gke.yaml
|
||||
```
|
||||
|
||||
## Output
|
||||
|
||||
@@ -304,7 +321,7 @@ No tests will be run for this check and the output will be marked [INFO].
|
||||
|
||||
## Roadmap
|
||||
|
||||
Going forward we plan to release updates to kube-bench to add support for new releases of the Benchmark, which in turn we can anticipate being made for each new Kubernetes release.
|
||||
Going forward we plan to release updates to kube-bench to add support for new releases of the CIS Benchmark. Note that these are not released as frequently as Kubernetes releases.
|
||||
|
||||
We welcome PRs and issue reports.
|
||||
|
||||
|
||||
@@ -637,12 +637,18 @@ groups:
|
||||
text: "Ensure that the AdvancedAuditing argument is not set to false (Scored)"
|
||||
audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep"
|
||||
tests:
|
||||
bin_op: or
|
||||
test_items:
|
||||
- flag: "--audit-policy-file"
|
||||
compare:
|
||||
op: eq
|
||||
value: "/etc/kubernetes/audit-policy.yaml"
|
||||
set: true
|
||||
- flag: "--audit-policy-file"
|
||||
compare:
|
||||
op: eq
|
||||
value: "/etc/kubernetes/audit-policy.yml"
|
||||
set: true
|
||||
remediation: |
|
||||
Follow the Kubernetes documentation and set the desired audit policy in the
|
||||
/etc/kubernetes/audit-policy.yaml file. Then, edit the API server pod specification file $apiserverconf
|
||||
@@ -838,45 +844,14 @@ groups:
|
||||
- id: 1.4.1
|
||||
text: "Ensure that the API server pod specification file permissions are
|
||||
set to 644 or more restrictive (Scored)"
|
||||
audit: "/bin/sh -c 'if test -e $apiserverconf; then stat -c %a $apiserverconf; fi'"
|
||||
audit: "/bin/sh -c 'if test -e $apiserverconf; then stat -c permissions=%a $apiserverconf; fi'"
|
||||
tests:
|
||||
bin_op: or
|
||||
test_items:
|
||||
- flag: "644"
|
||||
- flag: "permissions"
|
||||
compare:
|
||||
op: eq
|
||||
op: bitmask
|
||||
value: "644"
|
||||
set: true
|
||||
- flag: "640"
|
||||
compare:
|
||||
op: eq
|
||||
value: "640"
|
||||
set: true
|
||||
- flag: "600"
|
||||
compare:
|
||||
op: eq
|
||||
value: "600"
|
||||
set: true
|
||||
- flag: "444"
|
||||
compare:
|
||||
op: eq
|
||||
value: "444"
|
||||
set: true
|
||||
- flag: "440"
|
||||
compare:
|
||||
op: eq
|
||||
value: "440"
|
||||
set: true
|
||||
- flag: "400"
|
||||
compare:
|
||||
op: eq
|
||||
value: "400"
|
||||
set: true
|
||||
- flag: "000"
|
||||
compare:
|
||||
op: eq
|
||||
value: "000"
|
||||
set: true
|
||||
remediation: |
|
||||
Run the below command (based on the file location on your system) on the master node.
|
||||
For example,
|
||||
@@ -903,45 +878,14 @@ groups:
|
||||
- id: 1.4.3
|
||||
text: "Ensure that the controller manager pod specification file
|
||||
permissions are set to 644 or more restrictive (Scored)"
|
||||
audit: "/bin/sh -c 'if test -e $controllermanagerconf; then stat -c %a $controllermanagerconf; fi'"
|
||||
audit: "/bin/sh -c 'if test -e $controllermanagerconf; then stat -c permissions=%a $controllermanagerconf; fi'"
|
||||
tests:
|
||||
bin_op: or
|
||||
test_items:
|
||||
- flag: "644"
|
||||
- flag: "permissions"
|
||||
compare:
|
||||
op: eq
|
||||
op: bitmask
|
||||
value: "644"
|
||||
set: true
|
||||
- flag: "640"
|
||||
compare:
|
||||
op: eq
|
||||
value: "640"
|
||||
set: true
|
||||
- flag: "600"
|
||||
compare:
|
||||
op: eq
|
||||
value: "600"
|
||||
set: true
|
||||
- flag: "444"
|
||||
compare:
|
||||
op: eq
|
||||
value: "444"
|
||||
set: true
|
||||
- flag: "440"
|
||||
compare:
|
||||
op: eq
|
||||
value: "440"
|
||||
set: true
|
||||
- flag: "400"
|
||||
compare:
|
||||
op: eq
|
||||
value: "400"
|
||||
set: true
|
||||
- flag: "000"
|
||||
compare:
|
||||
op: eq
|
||||
value: "000"
|
||||
set: true
|
||||
remediation: |
|
||||
Run the below command (based on the file location on your system) on the master node.
|
||||
For example,
|
||||
@@ -968,45 +912,14 @@ groups:
|
||||
- id: 1.4.5
|
||||
text: "Ensure that the scheduler pod specification file permissions are set
|
||||
to 644 or more restrictive (Scored)"
|
||||
audit: "/bin/sh -c 'if test -e $schedulerconf; then stat -c %a $schedulerconf; fi'"
|
||||
audit: "/bin/sh -c 'if test -e $schedulerconf; then stat -c permissions=%a $schedulerconf; fi'"
|
||||
tests:
|
||||
bin_op: or
|
||||
test_items:
|
||||
- flag: "644"
|
||||
- flag: "permissions"
|
||||
compare:
|
||||
op: eq
|
||||
op: bitmask
|
||||
value: "644"
|
||||
set: true
|
||||
- flag: "640"
|
||||
compare:
|
||||
op: eq
|
||||
value: "640"
|
||||
set: true
|
||||
- flag: "600"
|
||||
compare:
|
||||
op: eq
|
||||
value: "600"
|
||||
set: true
|
||||
- flag: "444"
|
||||
compare:
|
||||
op: eq
|
||||
value: "444"
|
||||
set: true
|
||||
- flag: "440"
|
||||
compare:
|
||||
op: eq
|
||||
value: "440"
|
||||
set: true
|
||||
- flag: "400"
|
||||
compare:
|
||||
op: eq
|
||||
value: "400"
|
||||
set: true
|
||||
- flag: "000"
|
||||
compare:
|
||||
op: eq
|
||||
value: "000"
|
||||
set: true
|
||||
remediation: |
|
||||
Run the below command (based on the file location on your system) on the master node.
|
||||
For example,
|
||||
@@ -1033,45 +946,14 @@ groups:
|
||||
- id: 1.4.7
|
||||
text: "Ensure that the etcd pod specification file permissions are set to
|
||||
644 or more restrictive (Scored)"
|
||||
audit: "/bin/sh -c 'if test -e $etcdconf; then stat -c %a $etcdconf; fi'"
|
||||
audit: "/bin/sh -c 'if test -e $etcdconf; then stat -c permissions=%a $etcdconf; fi'"
|
||||
tests:
|
||||
bin_op: or
|
||||
test_items:
|
||||
- flag: "644"
|
||||
- flag: "permissions"
|
||||
compare:
|
||||
op: eq
|
||||
op: bitmask
|
||||
value: "644"
|
||||
set: true
|
||||
- flag: "640"
|
||||
compare:
|
||||
op: eq
|
||||
value: "640"
|
||||
set: true
|
||||
- flag: "600"
|
||||
compare:
|
||||
op: eq
|
||||
value: "600"
|
||||
set: true
|
||||
- flag: "444"
|
||||
compare:
|
||||
op: eq
|
||||
value: "444"
|
||||
set: true
|
||||
- flag: "440"
|
||||
compare:
|
||||
op: eq
|
||||
value: "440"
|
||||
set: true
|
||||
- flag: "400"
|
||||
compare:
|
||||
op: eq
|
||||
value: "400"
|
||||
set: true
|
||||
- flag: "000"
|
||||
compare:
|
||||
op: eq
|
||||
value: "000"
|
||||
set: true
|
||||
remediation: |
|
||||
Run the below command (based on the file location on your system) on the master node.
|
||||
For example,
|
||||
@@ -1098,7 +980,7 @@ groups:
|
||||
- id: 1.4.9
|
||||
text: "Ensure that the Container Network Interface file permissions are
|
||||
set to 644 or more restrictive (Not Scored)"
|
||||
audit: "stat -c %a <path/to/cni/files>"
|
||||
audit: "stat -c permissions=%a <path/to/cni/files>"
|
||||
type: "manual"
|
||||
remediation: |
|
||||
[Manual test]
|
||||
@@ -1121,12 +1003,12 @@ groups:
|
||||
|
||||
- id: 1.4.11
|
||||
text: "Ensure that the etcd data directory permissions are set to 700 or more restrictive (Scored)"
|
||||
audit: ps -ef | grep $etcdbin | grep -- --data-dir | sed 's%.*data-dir[= ]\([^ ]*\).*%\1%' | xargs stat -c %a
|
||||
audit: ps -ef | grep $etcdbin | grep -- --data-dir | sed 's%.*data-dir[= ]\([^ ]*\).*%\1%' | xargs stat -c permissions=%a
|
||||
tests:
|
||||
test_items:
|
||||
- flag: "700"
|
||||
- flag: "permissions"
|
||||
compare:
|
||||
op: eq
|
||||
op: bitmask
|
||||
value: "700"
|
||||
set: true
|
||||
remediation: |
|
||||
@@ -1155,45 +1037,14 @@ groups:
|
||||
- id: 1.4.13
|
||||
text: "Ensure that the admin.conf file permissions are set to 644 or
|
||||
more restrictive (Scored)"
|
||||
audit: "/bin/sh -c 'if test -e /etc/kubernetes/admin.conf; then stat -c %a /etc/kubernetes/admin.conf; fi'"
|
||||
audit: "/bin/sh -c 'if test -e /etc/kubernetes/admin.conf; then stat -c permissions=%a /etc/kubernetes/admin.conf; fi'"
|
||||
tests:
|
||||
bin_op: or
|
||||
test_items:
|
||||
- flag: "644"
|
||||
- flag: "permissions"
|
||||
compare:
|
||||
op: eq
|
||||
op: bitmask
|
||||
value: "644"
|
||||
set: true
|
||||
- flag: "640"
|
||||
compare:
|
||||
op: eq
|
||||
value: "640"
|
||||
set: true
|
||||
- flag: "600"
|
||||
compare:
|
||||
op: eq
|
||||
value: "600"
|
||||
set: true
|
||||
- flag: "444"
|
||||
compare:
|
||||
op: eq
|
||||
value: "444"
|
||||
set: true
|
||||
- flag: "440"
|
||||
compare:
|
||||
op: eq
|
||||
value: "440"
|
||||
set: true
|
||||
- flag: "400"
|
||||
compare:
|
||||
op: eq
|
||||
value: "400"
|
||||
set: true
|
||||
- flag: "000"
|
||||
compare:
|
||||
op: eq
|
||||
value: "000"
|
||||
set: true
|
||||
remediation: |
|
||||
Run the below command (based on the file location on your system) on the master node.
|
||||
For example,
|
||||
@@ -1219,45 +1070,14 @@ groups:
|
||||
- id: 1.4.15
|
||||
text: "Ensure that the scheduler.conf file permissions are set to 644 or
|
||||
more restrictive (Scored)"
|
||||
audit: "/bin/sh -c 'if test -e /etc/kubernetes/scheduler.conf; then stat -c %a /etc/kubernetes/scheduler.conf; fi'"
|
||||
audit: "/bin/sh -c 'if test -e /etc/kubernetes/scheduler.conf; then stat -c permissions=%a /etc/kubernetes/scheduler.conf; fi'"
|
||||
tests:
|
||||
bin_op: or
|
||||
test_items:
|
||||
- flag: "644"
|
||||
- flag: "permissions"
|
||||
compare:
|
||||
op: eq
|
||||
op: bitmask
|
||||
value: "644"
|
||||
set: true
|
||||
- flag: "640"
|
||||
compare:
|
||||
op: eq
|
||||
value: "640"
|
||||
set: true
|
||||
- flag: "600"
|
||||
compare:
|
||||
op: eq
|
||||
value: "600"
|
||||
set: true
|
||||
- flag: "444"
|
||||
compare:
|
||||
op: eq
|
||||
value: "444"
|
||||
set: true
|
||||
- flag: "440"
|
||||
compare:
|
||||
op: eq
|
||||
value: "440"
|
||||
set: true
|
||||
- flag: "400"
|
||||
compare:
|
||||
op: eq
|
||||
value: "400"
|
||||
set: true
|
||||
- flag: "000"
|
||||
compare:
|
||||
op: eq
|
||||
value: "000"
|
||||
set: true
|
||||
remediation: |
|
||||
Run the below command (based on the file location on your system) on the
|
||||
master node. For example, chmod 644 /etc/kubernetes/scheduler.conf
|
||||
@@ -1281,45 +1101,14 @@ groups:
|
||||
- id: 1.4.17
|
||||
text: "Ensure that the controller-manager.conf file permissions are set
|
||||
to 644 or more restrictive (Scored)"
|
||||
audit: "/bin/sh -c 'if test -e /etc/kubernetes/controller-manager.conf; then stat -c %a /etc/kubernetes/controller-manager.conf; fi'"
|
||||
audit: "/bin/sh -c 'if test -e /etc/kubernetes/controller-manager.conf; then stat -c permissions=%a /etc/kubernetes/controller-manager.conf; fi'"
|
||||
tests:
|
||||
bin_op: or
|
||||
test_items:
|
||||
- flag: "644"
|
||||
- flag: "permissions"
|
||||
compare:
|
||||
op: eq
|
||||
op: bitmask
|
||||
value: "644"
|
||||
set: true
|
||||
- flag: "640"
|
||||
compare:
|
||||
op: eq
|
||||
value: "640"
|
||||
set: true
|
||||
- flag: "600"
|
||||
compare:
|
||||
op: eq
|
||||
value: "600"
|
||||
set: true
|
||||
- flag: "444"
|
||||
compare:
|
||||
op: eq
|
||||
value: "444"
|
||||
set: true
|
||||
- flag: "440"
|
||||
compare:
|
||||
op: eq
|
||||
value: "440"
|
||||
set: true
|
||||
- flag: "400"
|
||||
compare:
|
||||
op: eq
|
||||
value: "400"
|
||||
set: true
|
||||
- flag: "000"
|
||||
compare:
|
||||
op: eq
|
||||
value: "000"
|
||||
set: true
|
||||
remediation: |
|
||||
Run the below command (based on the file location on your system) on the
|
||||
master node. For example, chmod 644 /etc/kubernetes/controller-manager.conf
|
||||
|
||||
@@ -358,45 +358,14 @@ groups:
|
||||
checks:
|
||||
- id: 2.2.1
|
||||
text: Ensure that the kubelet.conf file permissions are set to 644 or more restrictive (Scored)
|
||||
audit: '/bin/sh -c ''if test -e $kubeletkubeconfig; then stat -c %a $kubeletkubeconfig; fi'' '
|
||||
audit: '/bin/sh -c ''if test -e $kubeletkubeconfig; then stat -c permissions=%a $kubeletkubeconfig; fi'' '
|
||||
tests:
|
||||
test_items:
|
||||
- flag: "644"
|
||||
- flag: "permissions"
|
||||
compare:
|
||||
op: eq
|
||||
op: bitmask
|
||||
value: "644"
|
||||
set: true
|
||||
- flag: "640"
|
||||
compare:
|
||||
op: eq
|
||||
value: "640"
|
||||
set: true
|
||||
- flag: "600"
|
||||
compare:
|
||||
op: eq
|
||||
value: "600"
|
||||
set: true
|
||||
- flag: "444"
|
||||
compare:
|
||||
op: eq
|
||||
value: "444"
|
||||
set: true
|
||||
- flag: "440"
|
||||
compare:
|
||||
op: eq
|
||||
value: "440"
|
||||
set: true
|
||||
- flag: "400"
|
||||
compare:
|
||||
op: eq
|
||||
value: "400"
|
||||
set: true
|
||||
- flag: "000"
|
||||
compare:
|
||||
op: eq
|
||||
value: "000"
|
||||
set: true
|
||||
bin_op: or
|
||||
remediation: |
|
||||
Run the below command (based on the file location on your system) on the each worker
|
||||
node. For example,
|
||||
@@ -421,45 +390,14 @@ groups:
|
||||
|
||||
- id: 2.2.3
|
||||
text: Ensure that the kubelet service file permissions are set to 644 or more restrictive (Scored)
|
||||
audit: '/bin/sh -c ''if test -e $kubeletsvc; then stat -c %a $kubeletsvc; fi'' '
|
||||
audit: '/bin/sh -c ''if test -e $kubeletsvc; then stat -c permissions=%a $kubeletsvc; fi'' '
|
||||
tests:
|
||||
test_items:
|
||||
- flag: "644"
|
||||
- flag: "permissions"
|
||||
set: true
|
||||
compare:
|
||||
op: eq
|
||||
op: bitmask
|
||||
value: "644"
|
||||
set: true
|
||||
- flag: "640"
|
||||
compare:
|
||||
op: eq
|
||||
value: "640"
|
||||
set: true
|
||||
- flag: "600"
|
||||
compare:
|
||||
op: eq
|
||||
value: "600"
|
||||
set: true
|
||||
- flag: "444"
|
||||
compare:
|
||||
op: eq
|
||||
value: "444"
|
||||
set: true
|
||||
- flag: "440"
|
||||
compare:
|
||||
op: eq
|
||||
value: "440"
|
||||
set: true
|
||||
- flag: "400"
|
||||
compare:
|
||||
op: eq
|
||||
value: "400"
|
||||
set: true
|
||||
- flag: "000"
|
||||
compare:
|
||||
op: eq
|
||||
value: "000"
|
||||
set: true
|
||||
bin_op: or
|
||||
remediation: |
|
||||
Run the below command (based on the file location on your system) on the each worker
|
||||
node. For example,
|
||||
@@ -481,45 +419,14 @@ groups:
|
||||
|
||||
- id: 2.2.5
|
||||
text: Ensure that the proxy kubeconfig file permissions are set to 644 or more restrictive (Scored)
|
||||
audit: '/bin/sh -c ''if test -e $proxykubeconfig; then stat -c %a $proxykubeconfig; fi'' '
|
||||
audit: '/bin/sh -c ''if test -e $proxykubeconfig; then stat -c permissions=%a $proxykubeconfig; fi'' '
|
||||
tests:
|
||||
test_items:
|
||||
- flag: "644"
|
||||
- flag: "permissions"
|
||||
set: true
|
||||
compare:
|
||||
op: eq
|
||||
op: bitmask
|
||||
value: "644"
|
||||
set: true
|
||||
- flag: "640"
|
||||
compare:
|
||||
op: eq
|
||||
value: "640"
|
||||
set: true
|
||||
- flag: "600"
|
||||
compare:
|
||||
op: eq
|
||||
value: "600"
|
||||
set: true
|
||||
- flag: "444"
|
||||
compare:
|
||||
op: eq
|
||||
value: "444"
|
||||
set: true
|
||||
- flag: "440"
|
||||
compare:
|
||||
op: eq
|
||||
value: "440"
|
||||
set: true
|
||||
- flag: "400"
|
||||
compare:
|
||||
op: eq
|
||||
value: "400"
|
||||
set: true
|
||||
- flag: "000"
|
||||
compare:
|
||||
op: eq
|
||||
value: "000"
|
||||
set: true
|
||||
bin_op: or
|
||||
remediation: |
|
||||
Run the below command (based on the file location on your system) on the each worker
|
||||
node. For example,
|
||||
@@ -549,7 +456,12 @@ groups:
|
||||
|
||||
- id: 2.2.8
|
||||
text: Ensure that the client certificate authorities file ownership is set to root:root (Scored)
|
||||
audit: '/bin/sh -c ''if test -e $kubeletcafile; then stat -c %U:%G $kubeletcafile; fi'' '
|
||||
audit: |
|
||||
CAFILE=$(ps -ef | grep kubelet | grep -v apiserver | grep -- --client-ca-file= | awk -F '--client-ca-file=' '{print $2}' | awk '{print $1}')
|
||||
if [[ -z $CAFILE ]]; then
|
||||
CAFILE=$kubeletcafile
|
||||
fi
|
||||
if test -e $CAFILE; then stat -c %U:%G $CAFILE; fi
|
||||
tests:
|
||||
test_items:
|
||||
- flag: root:root
|
||||
@@ -570,52 +482,21 @@ groups:
|
||||
- flag: root:root
|
||||
set: true
|
||||
remediation: |
|
||||
Run the following command (using the config file location identied in the Audit step)
|
||||
Run the following command (using the config file location identified in the Audit step)
|
||||
chown root:root $kubeletconf
|
||||
scored: true
|
||||
|
||||
- id: 2.2.10
|
||||
text: Ensure that the kubelet configuration file has permissions set to 644 or more restrictive (Scored)
|
||||
audit: '/bin/sh -c ''if test -e $kubeletconf; then stat -c %a $kubeletconf; fi'' '
|
||||
audit: '/bin/sh -c ''if test -e $kubeletconf; then stat -c permissions=%a $kubeletconf; fi'' '
|
||||
tests:
|
||||
test_items:
|
||||
- flag: "644"
|
||||
- flag: "permissions"
|
||||
set: true
|
||||
compare:
|
||||
op: eq
|
||||
op: bitmask
|
||||
value: "644"
|
||||
set: true
|
||||
- flag: "640"
|
||||
compare:
|
||||
op: eq
|
||||
value: "640"
|
||||
set: true
|
||||
- flag: "600"
|
||||
compare:
|
||||
op: eq
|
||||
value: "600"
|
||||
set: true
|
||||
- flag: "444"
|
||||
compare:
|
||||
op: eq
|
||||
value: "444"
|
||||
set: true
|
||||
- flag: "440"
|
||||
compare:
|
||||
op: eq
|
||||
value: "440"
|
||||
set: true
|
||||
- flag: "400"
|
||||
compare:
|
||||
op: eq
|
||||
value: "400"
|
||||
set: true
|
||||
- flag: "000"
|
||||
compare:
|
||||
op: eq
|
||||
value: "000"
|
||||
set: true
|
||||
bin_op: or
|
||||
remediation: |
|
||||
Run the following command (using the config file location identied in the Audit step)
|
||||
Run the following command (using the config file location identified in the Audit step)
|
||||
chmod 644 $kubeletconf
|
||||
scored: true
|
||||
|
||||
@@ -447,12 +447,12 @@ groups:
|
||||
tests:
|
||||
bin_op: or
|
||||
test_items:
|
||||
- flag: "--enable-admission-plugins"
|
||||
- flag: "--disable-admission-plugins"
|
||||
compare:
|
||||
op: has
|
||||
op: nothave
|
||||
value: "ServiceAccount"
|
||||
set: true
|
||||
- flag: "--enable-admission-plugins"
|
||||
- flag: "--disable-admission-plugins"
|
||||
set: false
|
||||
remediation: |
|
||||
Follow the documentation and create ServiceAccount objects as per your environment.
|
||||
@@ -641,12 +641,18 @@ groups:
|
||||
text: "Ensure that the AdvancedAuditing argument is not set to false (Scored)"
|
||||
audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep"
|
||||
tests:
|
||||
bin_op: or
|
||||
test_items:
|
||||
- flag: "--audit-policy-file"
|
||||
compare:
|
||||
op: eq
|
||||
value: "/etc/kubernetes/audit-policy.yaml"
|
||||
set: true
|
||||
- flag: "--audit-policy-file"
|
||||
compare:
|
||||
op: eq
|
||||
value: "/etc/kubernetes/audit-policy.yml"
|
||||
set: true
|
||||
remediation: |
|
||||
Follow the Kubernetes documentation and set the desired audit policy in the
|
||||
/etc/kubernetes/audit-policy.yaml file. Then, edit the API server pod specification file $apiserverconf
|
||||
@@ -840,45 +846,14 @@ groups:
|
||||
- id: 1.4.1
|
||||
text: "Ensure that the API server pod specification file permissions are
|
||||
set to 644 or more restrictive (Scored)"
|
||||
audit: "/bin/sh -c 'if test -e $apiserverconf; then stat -c %a $apiserverconf; fi'"
|
||||
audit: "/bin/sh -c 'if test -e $apiserverconf; then stat -c permissions=%a $apiserverconf; fi'"
|
||||
tests:
|
||||
bin_op: or
|
||||
test_items:
|
||||
- flag: "644"
|
||||
- flag: "permissions"
|
||||
compare:
|
||||
op: eq
|
||||
op: bitmask
|
||||
value: "644"
|
||||
set: true
|
||||
- flag: "640"
|
||||
compare:
|
||||
op: eq
|
||||
value: "640"
|
||||
set: true
|
||||
- flag: "600"
|
||||
compare:
|
||||
op: eq
|
||||
value: "600"
|
||||
set: true
|
||||
- flag: "444"
|
||||
compare:
|
||||
op: eq
|
||||
value: "444"
|
||||
set: true
|
||||
- flag: "440"
|
||||
compare:
|
||||
op: eq
|
||||
value: "440"
|
||||
set: true
|
||||
- flag: "400"
|
||||
compare:
|
||||
op: eq
|
||||
value: "400"
|
||||
set: true
|
||||
- flag: "000"
|
||||
compare:
|
||||
op: eq
|
||||
value: "000"
|
||||
set: true
|
||||
remediation: |
|
||||
Run the below command (based on the file location on your system) on the master node.
|
||||
For example,
|
||||
@@ -905,45 +880,14 @@ groups:
|
||||
- id: 1.4.3
|
||||
text: "Ensure that the controller manager pod specification file
|
||||
permissions are set to 644 or more restrictive (Scored)"
|
||||
audit: "/bin/sh -c 'if test -e $controllermanagerconf; then stat -c %a $controllermanagerconf; fi'"
|
||||
audit: "/bin/sh -c 'if test -e $controllermanagerconf; then stat -c permissions=%a $controllermanagerconf; fi'"
|
||||
tests:
|
||||
bin_op: or
|
||||
test_items:
|
||||
- flag: "644"
|
||||
- flag: "permissions"
|
||||
compare:
|
||||
op: eq
|
||||
op: bitmask
|
||||
value: "644"
|
||||
set: true
|
||||
- flag: "640"
|
||||
compare:
|
||||
op: eq
|
||||
value: "640"
|
||||
set: true
|
||||
- flag: "600"
|
||||
compare:
|
||||
op: eq
|
||||
value: "600"
|
||||
set: true
|
||||
- flag: "444"
|
||||
compare:
|
||||
op: eq
|
||||
value: "444"
|
||||
set: true
|
||||
- flag: "440"
|
||||
compare:
|
||||
op: eq
|
||||
value: "440"
|
||||
set: true
|
||||
- flag: "400"
|
||||
compare:
|
||||
op: eq
|
||||
value: "400"
|
||||
set: true
|
||||
- flag: "000"
|
||||
compare:
|
||||
op: eq
|
||||
value: "000"
|
||||
set: true
|
||||
remediation: |
|
||||
Run the below command (based on the file location on your system) on the master node.
|
||||
For example,
|
||||
@@ -970,45 +914,14 @@ groups:
|
||||
- id: 1.4.5
|
||||
text: "Ensure that the scheduler pod specification file permissions are set
|
||||
to 644 or more restrictive (Scored)"
|
||||
audit: "/bin/sh -c 'if test -e $schedulerconf; then stat -c %a $schedulerconf; fi'"
|
||||
audit: "/bin/sh -c 'if test -e $schedulerconf; then stat -c permissions=%a $schedulerconf; fi'"
|
||||
tests:
|
||||
bin_op: or
|
||||
test_items:
|
||||
- flag: "644"
|
||||
- flag: "permissions"
|
||||
compare:
|
||||
op: eq
|
||||
op: bitmask
|
||||
value: "644"
|
||||
set: true
|
||||
- flag: "640"
|
||||
compare:
|
||||
op: eq
|
||||
value: "640"
|
||||
set: true
|
||||
- flag: "600"
|
||||
compare:
|
||||
op: eq
|
||||
value: "600"
|
||||
set: true
|
||||
- flag: "444"
|
||||
compare:
|
||||
op: eq
|
||||
value: "444"
|
||||
set: true
|
||||
- flag: "440"
|
||||
compare:
|
||||
op: eq
|
||||
value: "440"
|
||||
set: true
|
||||
- flag: "400"
|
||||
compare:
|
||||
op: eq
|
||||
value: "400"
|
||||
set: true
|
||||
- flag: "000"
|
||||
compare:
|
||||
op: eq
|
||||
value: "000"
|
||||
set: true
|
||||
remediation: |
|
||||
Run the below command (based on the file location on your system) on the master node.
|
||||
For example,
|
||||
@@ -1035,45 +948,14 @@ groups:
|
||||
- id: 1.4.7
|
||||
text: "Ensure that the etcd pod specification file permissions are set to
|
||||
644 or more restrictive (Scored)"
|
||||
audit: "/bin/sh -c 'if test -e $etcdconf; then stat -c %a $etcdconf; fi'"
|
||||
audit: "/bin/sh -c 'if test -e $etcdconf; then stat -c permissions=%a $etcdconf; fi'"
|
||||
tests:
|
||||
bin_op: or
|
||||
test_items:
|
||||
- flag: "644"
|
||||
- flag: "permissions"
|
||||
compare:
|
||||
op: eq
|
||||
op: bitmask
|
||||
value: "644"
|
||||
set: true
|
||||
- flag: "640"
|
||||
compare:
|
||||
op: eq
|
||||
value: "640"
|
||||
set: true
|
||||
- flag: "600"
|
||||
compare:
|
||||
op: eq
|
||||
value: "600"
|
||||
set: true
|
||||
- flag: "444"
|
||||
compare:
|
||||
op: eq
|
||||
value: "444"
|
||||
set: true
|
||||
- flag: "440"
|
||||
compare:
|
||||
op: eq
|
||||
value: "440"
|
||||
set: true
|
||||
- flag: "400"
|
||||
compare:
|
||||
op: eq
|
||||
value: "400"
|
||||
set: true
|
||||
- flag: "000"
|
||||
compare:
|
||||
op: eq
|
||||
value: "000"
|
||||
set: true
|
||||
remediation: |
|
||||
Run the below command (based on the file location on your system) on the master node.
|
||||
For example,
|
||||
@@ -1100,7 +982,7 @@ groups:
|
||||
- id: 1.4.9
|
||||
text: "Ensure that the Container Network Interface file permissions are
|
||||
set to 644 or more restrictive (Not Scored)"
|
||||
audit: "stat -c %a <path/to/cni/files>"
|
||||
audit: "stat -c permissions=%a <path/to/cni/files>"
|
||||
type: "manual"
|
||||
remediation: |
|
||||
[Manual test]
|
||||
@@ -1123,12 +1005,12 @@ groups:
|
||||
|
||||
- id: 1.4.11
|
||||
text: "Ensure that the etcd data directory permissions are set to 700 or more restrictive (Scored)"
|
||||
audit: ps -ef | grep $etcdbin | grep -- --data-dir | sed 's%.*data-dir[= ]\([^ ]*\).*%\1%' | xargs stat -c %a
|
||||
audit: ps -ef | grep $etcdbin | grep -- --data-dir | sed 's%.*data-dir[= ]\([^ ]*\).*%\1%' | xargs stat -c permissions=%a
|
||||
tests:
|
||||
test_items:
|
||||
- flag: "700"
|
||||
- flag: "permissions"
|
||||
compare:
|
||||
op: eq
|
||||
op: bitmask
|
||||
value: "700"
|
||||
set: true
|
||||
remediation: |
|
||||
@@ -1157,45 +1039,14 @@ groups:
|
||||
- id: 1.4.13
|
||||
text: "Ensure that the admin.conf file permissions are set to 644 or
|
||||
more restrictive (Scored)"
|
||||
audit: "/bin/sh -c 'if test -e /etc/kubernetes/admin.conf; then stat -c %a /etc/kubernetes/admin.conf; fi'"
|
||||
audit: "/bin/sh -c 'if test -e /etc/kubernetes/admin.conf; then stat -c permissions=%a /etc/kubernetes/admin.conf; fi'"
|
||||
tests:
|
||||
bin_op: or
|
||||
test_items:
|
||||
- flag: "644"
|
||||
- flag: "permissions"
|
||||
compare:
|
||||
op: eq
|
||||
op: bitmask
|
||||
value: "644"
|
||||
set: true
|
||||
- flag: "640"
|
||||
compare:
|
||||
op: eq
|
||||
value: "640"
|
||||
set: true
|
||||
- flag: "600"
|
||||
compare:
|
||||
op: eq
|
||||
value: "600"
|
||||
set: true
|
||||
- flag: "444"
|
||||
compare:
|
||||
op: eq
|
||||
value: "444"
|
||||
set: true
|
||||
- flag: "440"
|
||||
compare:
|
||||
op: eq
|
||||
value: "440"
|
||||
set: true
|
||||
- flag: "400"
|
||||
compare:
|
||||
op: eq
|
||||
value: "400"
|
||||
set: true
|
||||
- flag: "000"
|
||||
compare:
|
||||
op: eq
|
||||
value: "000"
|
||||
set: true
|
||||
remediation: |
|
||||
Run the below command (based on the file location on your system) on the master node.
|
||||
For example,
|
||||
@@ -1221,45 +1072,14 @@ groups:
|
||||
- id: 1.4.15
|
||||
text: "Ensure that the scheduler.conf file permissions are set to 644 or
|
||||
more restrictive (Scored)"
|
||||
audit: "/bin/sh -c 'if test -e /etc/kubernetes/scheduler.conf; then stat -c %a /etc/kubernetes/scheduler.conf; fi'"
|
||||
audit: "/bin/sh -c 'if test -e /etc/kubernetes/scheduler.conf; then stat -c permissions=%a /etc/kubernetes/scheduler.conf; fi'"
|
||||
tests:
|
||||
bin_op: or
|
||||
test_items:
|
||||
- flag: "644"
|
||||
- flag: "permissions"
|
||||
compare:
|
||||
op: eq
|
||||
op: bitmask
|
||||
value: "644"
|
||||
set: true
|
||||
- flag: "640"
|
||||
compare:
|
||||
op: eq
|
||||
value: "640"
|
||||
set: true
|
||||
- flag: "600"
|
||||
compare:
|
||||
op: eq
|
||||
value: "600"
|
||||
set: true
|
||||
- flag: "444"
|
||||
compare:
|
||||
op: eq
|
||||
value: "444"
|
||||
set: true
|
||||
- flag: "440"
|
||||
compare:
|
||||
op: eq
|
||||
value: "440"
|
||||
set: true
|
||||
- flag: "400"
|
||||
compare:
|
||||
op: eq
|
||||
value: "400"
|
||||
set: true
|
||||
- flag: "000"
|
||||
compare:
|
||||
op: eq
|
||||
value: "000"
|
||||
set: true
|
||||
remediation: |
|
||||
Run the below command (based on the file location on your system) on the
|
||||
master node. For example, chmod 644 /etc/kubernetes/scheduler.conf
|
||||
@@ -1283,45 +1103,14 @@ groups:
|
||||
- id: 1.4.17
|
||||
text: "Ensure that the controller-manager.conf file permissions are set
|
||||
to 644 or more restrictive (Scored)"
|
||||
audit: "/bin/sh -c 'if test -e /etc/kubernetes/controller-manager.conf; then stat -c %a /etc/kubernetes/controller-manager.conf; fi'"
|
||||
audit: "/bin/sh -c 'if test -e /etc/kubernetes/controller-manager.conf; then stat -c permissions=%a /etc/kubernetes/controller-manager.conf; fi'"
|
||||
tests:
|
||||
bin_op: or
|
||||
test_items:
|
||||
- flag: "644"
|
||||
- flag: "permissions"
|
||||
compare:
|
||||
op: eq
|
||||
op: bitmask
|
||||
value: "644"
|
||||
set: true
|
||||
- flag: "640"
|
||||
compare:
|
||||
op: eq
|
||||
value: "640"
|
||||
set: true
|
||||
- flag: "600"
|
||||
compare:
|
||||
op: eq
|
||||
value: "600"
|
||||
set: true
|
||||
- flag: "444"
|
||||
compare:
|
||||
op: eq
|
||||
value: "444"
|
||||
set: true
|
||||
- flag: "440"
|
||||
compare:
|
||||
op: eq
|
||||
value: "440"
|
||||
set: true
|
||||
- flag: "400"
|
||||
compare:
|
||||
op: eq
|
||||
value: "400"
|
||||
set: true
|
||||
- flag: "000"
|
||||
compare:
|
||||
op: eq
|
||||
value: "000"
|
||||
set: true
|
||||
remediation: |
|
||||
Run the below command (based on the file location on your system) on the
|
||||
master node. For example, chmod 644 /etc/kubernetes/controller-manager.conf
|
||||
@@ -1364,43 +1153,12 @@ groups:
|
||||
audit: "stat -c %n\ %a /etc/kubernetes/pki/*.crt"
|
||||
type: "manual"
|
||||
tests:
|
||||
bin_op: or
|
||||
test_items:
|
||||
- flag: "644"
|
||||
- flag: "permissions"
|
||||
compare:
|
||||
op: eq
|
||||
op: bitmask
|
||||
value: "644"
|
||||
set: true
|
||||
- flag: "640"
|
||||
compare:
|
||||
op: eq
|
||||
value: "640"
|
||||
set: true
|
||||
- flag: "600"
|
||||
compare:
|
||||
op: eq
|
||||
value: "600"
|
||||
set: true
|
||||
- flag: "444"
|
||||
compare:
|
||||
op: eq
|
||||
value: "444"
|
||||
set: true
|
||||
- flag: "440"
|
||||
compare:
|
||||
op: eq
|
||||
value: "440"
|
||||
set: true
|
||||
- flag: "400"
|
||||
compare:
|
||||
op: eq
|
||||
value: "400"
|
||||
set: true
|
||||
- flag: "000"
|
||||
compare:
|
||||
op: eq
|
||||
value: "000"
|
||||
set: true
|
||||
remediation: |
|
||||
[Manual test]
|
||||
Run the below command (based on the file location on your system) on the master node.
|
||||
@@ -1413,9 +1171,9 @@ groups:
|
||||
type: "manual"
|
||||
tests:
|
||||
test_items:
|
||||
- flag: "600"
|
||||
- flag: "permissions"
|
||||
compare:
|
||||
op: eq
|
||||
op: bitmask
|
||||
value: "600"
|
||||
set: true
|
||||
remediation: |
|
||||
|
||||
@@ -341,45 +341,14 @@ groups:
|
||||
checks:
|
||||
- id: 2.2.1
|
||||
text: Ensure that the kubelet.conf file permissions are set to 644 or more restrictive (Scored)
|
||||
audit: '/bin/sh -c ''if test -e $kubeletkubeconfig; then stat -c %a $kubeletkubeconfig; fi'' '
|
||||
audit: '/bin/sh -c ''if test -e $kubeletkubeconfig; then stat -c permissions=%a $kubeletkubeconfig; fi'' '
|
||||
tests:
|
||||
test_items:
|
||||
- flag: "644"
|
||||
- flag: "permissions"
|
||||
set: true
|
||||
compare:
|
||||
op: eq
|
||||
op: bitmask
|
||||
value: "644"
|
||||
set: true
|
||||
- flag: "640"
|
||||
compare:
|
||||
op: eq
|
||||
value: "640"
|
||||
set: true
|
||||
- flag: "600"
|
||||
compare:
|
||||
op: eq
|
||||
value: "600"
|
||||
set: true
|
||||
- flag: "444"
|
||||
compare:
|
||||
op: eq
|
||||
value: "444"
|
||||
set: true
|
||||
- flag: "440"
|
||||
compare:
|
||||
op: eq
|
||||
value: "440"
|
||||
set: true
|
||||
- flag: "400"
|
||||
compare:
|
||||
op: eq
|
||||
value: "400"
|
||||
set: true
|
||||
- flag: "000"
|
||||
compare:
|
||||
op: eq
|
||||
value: "000"
|
||||
set: true
|
||||
bin_op: or
|
||||
remediation: |
|
||||
Run the below command (based on the file location on your system) on the each worker
|
||||
node. For example,
|
||||
@@ -404,45 +373,14 @@ groups:
|
||||
|
||||
- id: 2.2.3
|
||||
text: Ensure that the kubelet service file permissions are set to 644 or more restrictive (Scored)
|
||||
audit: '/bin/sh -c ''if test -e $kubeletsvc; then stat -c %a $kubeletsvc; fi'' '
|
||||
audit: '/bin/sh -c ''if test -e $kubeletsvc; then stat -c permissions=%a $kubeletsvc; fi'' '
|
||||
tests:
|
||||
test_items:
|
||||
- flag: "644"
|
||||
- flag: "permissions"
|
||||
set: true
|
||||
compare:
|
||||
op: eq
|
||||
op: bitmask
|
||||
value: "644"
|
||||
set: true
|
||||
- flag: "640"
|
||||
compare:
|
||||
op: eq
|
||||
value: "640"
|
||||
set: true
|
||||
- flag: "600"
|
||||
compare:
|
||||
op: eq
|
||||
value: "600"
|
||||
set: true
|
||||
- flag: "444"
|
||||
compare:
|
||||
op: eq
|
||||
value: "444"
|
||||
set: true
|
||||
- flag: "440"
|
||||
compare:
|
||||
op: eq
|
||||
value: "440"
|
||||
set: true
|
||||
- flag: "400"
|
||||
compare:
|
||||
op: eq
|
||||
value: "400"
|
||||
set: true
|
||||
- flag: "000"
|
||||
compare:
|
||||
op: eq
|
||||
value: "000"
|
||||
set: true
|
||||
bin_op: or
|
||||
remediation: |
|
||||
Run the below command (based on the file location on your system) on the each worker
|
||||
node. For example,
|
||||
@@ -464,45 +402,14 @@ groups:
|
||||
|
||||
- id: 2.2.5
|
||||
text: Ensure that the proxy kubeconfig file permissions are set to 644 or more restrictive (Scored)
|
||||
audit: '/bin/sh -c ''if test -e $proxykubeconfig; then stat -c %a $proxykubeconfig; fi'' '
|
||||
audit: '/bin/sh -c ''if test -e $proxykubeconfig; then stat -c permissions=%a $proxykubeconfig; fi'' '
|
||||
tests:
|
||||
test_items:
|
||||
- flag: "644"
|
||||
- flag: "permissions"
|
||||
set: true
|
||||
compare:
|
||||
op: eq
|
||||
op: bitmask
|
||||
value: "644"
|
||||
set: true
|
||||
- flag: "640"
|
||||
compare:
|
||||
op: eq
|
||||
value: "640"
|
||||
set: true
|
||||
- flag: "600"
|
||||
compare:
|
||||
op: eq
|
||||
value: "600"
|
||||
set: true
|
||||
- flag: "444"
|
||||
compare:
|
||||
op: eq
|
||||
value: "444"
|
||||
set: true
|
||||
- flag: "440"
|
||||
compare:
|
||||
op: eq
|
||||
value: "440"
|
||||
set: true
|
||||
- flag: "400"
|
||||
compare:
|
||||
op: eq
|
||||
value: "400"
|
||||
set: true
|
||||
- flag: "000"
|
||||
compare:
|
||||
op: eq
|
||||
value: "000"
|
||||
set: true
|
||||
bin_op: or
|
||||
remediation: |
|
||||
Run the below command (based on the file location on your system) on the each worker
|
||||
node. For example,
|
||||
@@ -524,25 +431,15 @@ groups:
|
||||
|
||||
- id: 2.2.7
|
||||
text: Ensure that the certificate authorities file permissions are set to 644 or more restrictive (Scored)
|
||||
audit: "/bin/sh -c 'if test -e $kubeletcafile; then stat -c %a $kubeletcafile; fi'"
|
||||
audit: "/bin/sh -c 'if test -e $kubeletcafile; then stat -c permissions=%a $kubeletcafile; fi'"
|
||||
tests:
|
||||
bin_op: or
|
||||
test_items:
|
||||
- flag: "644"
|
||||
- flag: "permissions"
|
||||
compare:
|
||||
op: eq
|
||||
op: bitmask
|
||||
value: "644"
|
||||
set: true
|
||||
- flag: "640"
|
||||
compare:
|
||||
op: eq
|
||||
value: "640"
|
||||
set: true
|
||||
- flag: "600"
|
||||
compare:
|
||||
op: eq
|
||||
value: "600"
|
||||
set: true
|
||||
remediation: |
|
||||
Run the following command to modify the file permissions of the --client-ca-file
|
||||
chmod 644 <filename>
|
||||
@@ -550,7 +447,12 @@ groups:
|
||||
|
||||
- id: 2.2.8
|
||||
text: Ensure that the client certificate authorities file ownership is set to root:root (Scored)
|
||||
audit: '/bin/sh -c ''if test -e $kubeletcafile; then stat -c %U:%G $kubeletcafile; fi'' '
|
||||
audit: |
|
||||
CAFILE=$(ps -ef | grep kubelet | grep -v apiserver | grep -- --client-ca-file= | awk -F '--client-ca-file=' '{print $2}' | awk '{print $1}')
|
||||
if [[ -z $CAFILE ]]; then
|
||||
CAFILE=$kubeletcafile
|
||||
fi
|
||||
if test -e $CAFILE; then stat -c %U:%G $CAFILE; fi
|
||||
tests:
|
||||
test_items:
|
||||
- flag: root:root
|
||||
@@ -571,52 +473,21 @@ groups:
|
||||
- flag: root:root
|
||||
set: true
|
||||
remediation: |
|
||||
Run the following command (using the config file location identied in the Audit step)
|
||||
Run the following command (using the config file location identified in the Audit step)
|
||||
chown root:root $kubeletconf
|
||||
scored: true
|
||||
|
||||
- id: 2.2.10
|
||||
text: Ensure that the kubelet configuration file has permissions set to 644 or more restrictive (Scored)
|
||||
audit: '/bin/sh -c ''if test -e $kubeletconf; then stat -c %a $kubeletconf; fi'' '
|
||||
audit: '/bin/sh -c ''if test -e $kubeletconf; then stat -c permissions=%a $kubeletconf; fi'' '
|
||||
tests:
|
||||
test_items:
|
||||
- flag: "644"
|
||||
- flag: "permissions"
|
||||
set: true
|
||||
compare:
|
||||
op: eq
|
||||
op: bitmask
|
||||
value: "644"
|
||||
set: true
|
||||
- flag: "640"
|
||||
compare:
|
||||
op: eq
|
||||
value: "640"
|
||||
set: true
|
||||
- flag: "600"
|
||||
compare:
|
||||
op: eq
|
||||
value: "600"
|
||||
set: true
|
||||
- flag: "444"
|
||||
compare:
|
||||
op: eq
|
||||
value: "444"
|
||||
set: true
|
||||
- flag: "440"
|
||||
compare:
|
||||
op: eq
|
||||
value: "440"
|
||||
set: true
|
||||
- flag: "400"
|
||||
compare:
|
||||
op: eq
|
||||
value: "400"
|
||||
set: true
|
||||
- flag: "000"
|
||||
compare:
|
||||
op: eq
|
||||
value: "000"
|
||||
set: true
|
||||
bin_op: or
|
||||
remediation: |
|
||||
Run the following command (using the config file location identied in the Audit step)
|
||||
Run the following command (using the config file location identified in the Audit step)
|
||||
chmod 644 $kubeletconf
|
||||
scored: true
|
||||
|
||||
@@ -9,7 +9,7 @@ groups:
|
||||
text: "Authentication and Authorization"
|
||||
checks:
|
||||
- id: 3.1.1
|
||||
text: "Client certificate authentication should not be used for users (Not Scored) "
|
||||
text: "Client certificate authentication should not be used for users (Not Scored)"
|
||||
type: "manual"
|
||||
remediation: |
|
||||
Alternative mechanisms provided by Kubernetes such as the use of OIDC should be
|
||||
@@ -20,14 +20,14 @@ groups:
|
||||
text: "Logging"
|
||||
checks:
|
||||
- id: 3.2.1
|
||||
text: "Ensure that a minimal audit policy is created (Scored) "
|
||||
text: "Ensure that a minimal audit policy is created (Scored)"
|
||||
type: "manual"
|
||||
remediation: |
|
||||
Create an audit policy file for your cluster.
|
||||
scored: true
|
||||
|
||||
- id: 3.2.2
|
||||
text: "Ensure that the audit policy covers key security concerns (Not Scored) "
|
||||
text: "Ensure that the audit policy covers key security concerns (Not Scored)"
|
||||
type: "manual"
|
||||
remediation: |
|
||||
Consider modification of the audit policy in use on the cluster to include these items, at a
|
||||
|
||||
@@ -6,49 +6,18 @@ text: "Master Node Security Configuration"
|
||||
type: "master"
|
||||
groups:
|
||||
- id: 1.1
|
||||
text: "Master Node Configuration Files "
|
||||
text: "Master Node Configuration Files"
|
||||
checks:
|
||||
- id: 1.1.1
|
||||
text: "Ensure that the API server pod specification file permissions are set to 644 or more restrictive (Scored)"
|
||||
audit: "/bin/sh -c 'if test -e $apiserverconf; then stat -c %a $apiserverconf; fi'"
|
||||
audit: "/bin/sh -c 'if test -e $apiserverconf; then stat -c permissions=%a $apiserverconf; fi'"
|
||||
tests:
|
||||
bin_op: or
|
||||
test_items:
|
||||
- flag: "644"
|
||||
- flag: "permissions"
|
||||
compare:
|
||||
op: eq
|
||||
op: bitmask
|
||||
value: "644"
|
||||
set: true
|
||||
- flag: "640"
|
||||
compare:
|
||||
op: eq
|
||||
value: "640"
|
||||
set: true
|
||||
- flag: "600"
|
||||
compare:
|
||||
op: eq
|
||||
value: "600"
|
||||
set: true
|
||||
- flag: "444"
|
||||
compare:
|
||||
op: eq
|
||||
value: "444"
|
||||
set: true
|
||||
- flag: "440"
|
||||
compare:
|
||||
op: eq
|
||||
value: "440"
|
||||
set: true
|
||||
- flag: "400"
|
||||
compare:
|
||||
op: eq
|
||||
value: "400"
|
||||
set: true
|
||||
- flag: "000"
|
||||
compare:
|
||||
op: eq
|
||||
value: "000"
|
||||
set: true
|
||||
remediation: |
|
||||
Run the below command (based on the file location on your system) on the
|
||||
master node.
|
||||
@@ -73,45 +42,14 @@ groups:
|
||||
|
||||
- id: 1.1.3
|
||||
text: "Ensure that the controller manager pod specification file permissions are set to 644 or more restrictive (Scored)"
|
||||
audit: "/bin/sh -c 'if test -e $controllermanagerconf; then stat -c %a $controllermanagerconf; fi'"
|
||||
audit: "/bin/sh -c 'if test -e $controllermanagerconf; then stat -c permissions=%a $controllermanagerconf; fi'"
|
||||
tests:
|
||||
bin_op: or
|
||||
test_items:
|
||||
- flag: "644"
|
||||
- flag: "permissions"
|
||||
compare:
|
||||
op: eq
|
||||
op: bitmask
|
||||
value: "644"
|
||||
set: true
|
||||
- flag: "640"
|
||||
compare:
|
||||
op: eq
|
||||
value: "640"
|
||||
set: true
|
||||
- flag: "600"
|
||||
compare:
|
||||
op: eq
|
||||
value: "600"
|
||||
set: true
|
||||
- flag: "444"
|
||||
compare:
|
||||
op: eq
|
||||
value: "444"
|
||||
set: true
|
||||
- flag: "440"
|
||||
compare:
|
||||
op: eq
|
||||
value: "440"
|
||||
set: true
|
||||
- flag: "400"
|
||||
compare:
|
||||
op: eq
|
||||
value: "400"
|
||||
set: true
|
||||
- flag: "000"
|
||||
compare:
|
||||
op: eq
|
||||
value: "000"
|
||||
set: true
|
||||
remediation: |
|
||||
Run the below command (based on the file location on your system) on the master node.
|
||||
For example,
|
||||
@@ -136,45 +74,14 @@ groups:
|
||||
|
||||
- id: 1.1.5
|
||||
text: "Ensure that the scheduler pod specification file permissions are set to 644 or more restrictive (Scored)"
|
||||
audit: "/bin/sh -c 'if test -e $schedulerconf; then stat -c %a $schedulerconf; fi'"
|
||||
audit: "/bin/sh -c 'if test -e $schedulerconf; then stat -c permissions=%a $schedulerconf; fi'"
|
||||
tests:
|
||||
bin_op: or
|
||||
test_items:
|
||||
- flag: "644"
|
||||
- flag: "permissions"
|
||||
compare:
|
||||
op: eq
|
||||
op: bitmask
|
||||
value: "644"
|
||||
set: true
|
||||
- flag: "640"
|
||||
compare:
|
||||
op: eq
|
||||
value: "640"
|
||||
set: true
|
||||
- flag: "600"
|
||||
compare:
|
||||
op: eq
|
||||
value: "600"
|
||||
set: true
|
||||
- flag: "444"
|
||||
compare:
|
||||
op: eq
|
||||
value: "444"
|
||||
set: true
|
||||
- flag: "440"
|
||||
compare:
|
||||
op: eq
|
||||
value: "440"
|
||||
set: true
|
||||
- flag: "400"
|
||||
compare:
|
||||
op: eq
|
||||
value: "400"
|
||||
set: true
|
||||
- flag: "000"
|
||||
compare:
|
||||
op: eq
|
||||
value: "000"
|
||||
set: true
|
||||
remediation: |
|
||||
Run the below command (based on the file location on your system) on the master node.
|
||||
For example,
|
||||
@@ -199,45 +106,14 @@ groups:
|
||||
|
||||
- id: 1.1.7
|
||||
text: "Ensure that the etcd pod specification file permissions are set to 644 or more restrictive (Scored)"
|
||||
audit: "/bin/sh -c 'if test -e $etcdconf; then stat -c %a $etcdconf; fi'"
|
||||
audit: "/bin/sh -c 'if test -e $etcdconf; then stat -c permissions=%a $etcdconf; fi'"
|
||||
tests:
|
||||
bin_op: or
|
||||
test_items:
|
||||
- flag: "644"
|
||||
- flag: "permissions"
|
||||
compare:
|
||||
op: eq
|
||||
op: bitmask
|
||||
value: "644"
|
||||
set: true
|
||||
- flag: "640"
|
||||
compare:
|
||||
op: eq
|
||||
value: "640"
|
||||
set: true
|
||||
- flag: "600"
|
||||
compare:
|
||||
op: eq
|
||||
value: "600"
|
||||
set: true
|
||||
- flag: "444"
|
||||
compare:
|
||||
op: eq
|
||||
value: "444"
|
||||
set: true
|
||||
- flag: "440"
|
||||
compare:
|
||||
op: eq
|
||||
value: "440"
|
||||
set: true
|
||||
- flag: "400"
|
||||
compare:
|
||||
op: eq
|
||||
value: "400"
|
||||
set: true
|
||||
- flag: "000"
|
||||
compare:
|
||||
op: eq
|
||||
value: "000"
|
||||
set: true
|
||||
remediation: |
|
||||
Run the below command (based on the file location on your system) on the master node.
|
||||
For example,
|
||||
@@ -262,7 +138,7 @@ groups:
|
||||
|
||||
- id: 1.1.9
|
||||
text: "Ensure that the Container Network Interface file permissions are set to 644 or more restrictive (Not Scored)"
|
||||
audit: "stat -c %a <path/to/cni/files>"
|
||||
audit: "stat -c permissions=%a <path/to/cni/files>"
|
||||
type: "manual"
|
||||
remediation: |
|
||||
Run the below command (based on the file location on your system) on the master node.
|
||||
@@ -282,18 +158,19 @@ groups:
|
||||
|
||||
- id: 1.1.11
|
||||
text: "Ensure that the etcd data directory permissions are set to 700 or more restrictive (Scored)"
|
||||
audit: ps -ef | grep $etcdbin | grep -- --data-dir | sed 's%.*data-dir[= ]\([^ ]*\).*%\1%' | xargs stat -c %a
|
||||
audit: ps -ef | grep $etcdbin | grep -- --data-dir | sed 's%.*data-dir[= ]\([^ ]*\).*%\1%' | xargs stat -c permissions=%a
|
||||
tests:
|
||||
test_items:
|
||||
- flag: "700"
|
||||
- flag: "permissions"
|
||||
compare:
|
||||
op: eq
|
||||
op: bitmask
|
||||
value: "700"
|
||||
set: true
|
||||
remediation: |
|
||||
On the etcd server node, get the etcd data directory, passed as an argument --data-dir,
|
||||
from the below command:
|
||||
ps -ef | grep etcd Run the below command (based on the etcd data directory found above). For example,
|
||||
ps -ef | grep etcd
|
||||
Run the below command (based on the etcd data directory found above). For example,
|
||||
chmod 700 /var/lib/etcd
|
||||
scored: true
|
||||
|
||||
@@ -314,45 +191,14 @@ groups:
|
||||
|
||||
- id: 1.1.13
|
||||
text: "Ensure that the admin.conf file permissions are set to 644 or more restrictive (Scored)"
|
||||
audit: "/bin/sh -c 'if test -e /etc/kubernetes/admin.conf; then stat -c %a /etc/kubernetes/admin.conf; fi'"
|
||||
audit: "/bin/sh -c 'if test -e /etc/kubernetes/admin.conf; then stat -c permissions=%a /etc/kubernetes/admin.conf; fi'"
|
||||
tests:
|
||||
bin_op: or
|
||||
test_items:
|
||||
- flag: "644"
|
||||
- flag: "permissions"
|
||||
compare:
|
||||
op: eq
|
||||
op: bitmask
|
||||
value: "644"
|
||||
set: true
|
||||
- flag: "640"
|
||||
compare:
|
||||
op: eq
|
||||
value: "640"
|
||||
set: true
|
||||
- flag: "600"
|
||||
compare:
|
||||
op: eq
|
||||
value: "600"
|
||||
set: true
|
||||
- flag: "444"
|
||||
compare:
|
||||
op: eq
|
||||
value: "444"
|
||||
set: true
|
||||
- flag: "440"
|
||||
compare:
|
||||
op: eq
|
||||
value: "440"
|
||||
set: true
|
||||
- flag: "400"
|
||||
compare:
|
||||
op: eq
|
||||
value: "400"
|
||||
set: true
|
||||
- flag: "000"
|
||||
compare:
|
||||
op: eq
|
||||
value: "000"
|
||||
set: true
|
||||
remediation: |
|
||||
Run the below command (based on the file location on your system) on the master node.
|
||||
For example,
|
||||
@@ -360,7 +206,7 @@ groups:
|
||||
scored: true
|
||||
|
||||
- id: 1.1.14
|
||||
text: "Ensure that the admin.conf file ownership is set to root:root (Scored) "
|
||||
text: "Ensure that the admin.conf file ownership is set to root:root (Scored)"
|
||||
audit: "/bin/sh -c 'if test -e /etc/kubernetes/admin.conf; then stat -c %U:%G /etc/kubernetes/admin.conf; fi'"
|
||||
tests:
|
||||
test_items:
|
||||
@@ -377,45 +223,14 @@ groups:
|
||||
|
||||
- id: 1.1.15
|
||||
text: "Ensure that the scheduler.conf file permissions are set to 644 or more restrictive (Scored)"
|
||||
audit: "/bin/sh -c 'if test -e /etc/kubernetes/scheduler.conf; then stat -c %a /etc/kubernetes/scheduler.conf; fi'"
|
||||
audit: "/bin/sh -c 'if test -e /etc/kubernetes/scheduler.conf; then stat -c permissions=%a /etc/kubernetes/scheduler.conf; fi'"
|
||||
tests:
|
||||
bin_op: or
|
||||
test_items:
|
||||
- flag: "644"
|
||||
- flag: "permissions"
|
||||
compare:
|
||||
op: eq
|
||||
op: bitmask
|
||||
value: "644"
|
||||
set: true
|
||||
- flag: "640"
|
||||
compare:
|
||||
op: eq
|
||||
value: "640"
|
||||
set: true
|
||||
- flag: "600"
|
||||
compare:
|
||||
op: eq
|
||||
value: "600"
|
||||
set: true
|
||||
- flag: "444"
|
||||
compare:
|
||||
op: eq
|
||||
value: "444"
|
||||
set: true
|
||||
- flag: "440"
|
||||
compare:
|
||||
op: eq
|
||||
value: "440"
|
||||
set: true
|
||||
- flag: "400"
|
||||
compare:
|
||||
op: eq
|
||||
value: "400"
|
||||
set: true
|
||||
- flag: "000"
|
||||
compare:
|
||||
op: eq
|
||||
value: "000"
|
||||
set: true
|
||||
remediation: |
|
||||
Run the below command (based on the file location on your system) on the master node.
|
||||
For example,
|
||||
@@ -440,45 +255,14 @@ groups:
|
||||
|
||||
- id: 1.1.17
|
||||
text: "Ensure that the controller-manager.conf file permissions are set to 644 or more restrictive (Scored)"
|
||||
audit: "/bin/sh -c 'if test -e /etc/kubernetes/controller-manager.conf; then stat -c %a /etc/kubernetes/controller-manager.conf; fi'"
|
||||
audit: "/bin/sh -c 'if test -e /etc/kubernetes/controller-manager.conf; then stat -c permissions=%a /etc/kubernetes/controller-manager.conf; fi'"
|
||||
tests:
|
||||
bin_op: or
|
||||
test_items:
|
||||
- flag: "644"
|
||||
- flag: "permissions"
|
||||
compare:
|
||||
op: eq
|
||||
op: bitmask
|
||||
value: "644"
|
||||
set: true
|
||||
- flag: "640"
|
||||
compare:
|
||||
op: eq
|
||||
value: "640"
|
||||
set: true
|
||||
- flag: "600"
|
||||
compare:
|
||||
op: eq
|
||||
value: "600"
|
||||
set: true
|
||||
- flag: "444"
|
||||
compare:
|
||||
op: eq
|
||||
value: "444"
|
||||
set: true
|
||||
- flag: "440"
|
||||
compare:
|
||||
op: eq
|
||||
value: "440"
|
||||
set: true
|
||||
- flag: "400"
|
||||
compare:
|
||||
op: eq
|
||||
value: "400"
|
||||
set: true
|
||||
- flag: "000"
|
||||
compare:
|
||||
op: eq
|
||||
value: "000"
|
||||
set: true
|
||||
remediation: |
|
||||
Run the below command (based on the file location on your system) on the master node.
|
||||
For example,
|
||||
@@ -512,7 +296,7 @@ groups:
|
||||
scored: true
|
||||
|
||||
- id: 1.1.20
|
||||
text: "Ensure that the Kubernetes PKI certificate file permissions are set to 644 or more restrictive (Scored) "
|
||||
text: "Ensure that the Kubernetes PKI certificate file permissions are set to 644 or more restrictive (Scored)"
|
||||
audit: "stat -c %n\ %a /etc/kubernetes/pki/*.crt"
|
||||
type: "manual"
|
||||
remediation: |
|
||||
@@ -755,12 +539,12 @@ groups:
|
||||
tests:
|
||||
bin_op: or
|
||||
test_items:
|
||||
- flag: "--enable-admission-plugins"
|
||||
- flag: "--disable-admission-plugins"
|
||||
compare:
|
||||
op: has
|
||||
op: nothave
|
||||
value: "ServiceAccount"
|
||||
set: true
|
||||
- flag: "--enable-admission-plugins"
|
||||
- flag: "--disable-admission-plugins"
|
||||
set: false
|
||||
remediation: |
|
||||
Follow the documentation and create ServiceAccount objects as per your environment.
|
||||
@@ -854,7 +638,7 @@ groups:
|
||||
scored: true
|
||||
|
||||
- id: 1.2.20
|
||||
text: "Ensure that the --secure-port argument is not set to 0 (Scored) "
|
||||
text: "Ensure that the --secure-port argument is not set to 0 (Scored)"
|
||||
audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep"
|
||||
tests:
|
||||
bin_op: or
|
||||
@@ -1005,7 +789,7 @@ groups:
|
||||
scored: true
|
||||
|
||||
- id: 1.2.29
|
||||
text: "Ensure that the --etcd-certfile and --etcd-keyfile arguments are set as appropriate (Scored) "
|
||||
text: "Ensure that the --etcd-certfile and --etcd-keyfile arguments are set as appropriate (Scored)"
|
||||
audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep"
|
||||
tests:
|
||||
bin_op: and
|
||||
@@ -1236,7 +1020,7 @@ groups:
|
||||
scored: true
|
||||
|
||||
- id: 1.4.2
|
||||
text: "Ensure that the --bind-address argument is set to 127.0.0.1 (Scored) "
|
||||
text: "Ensure that the --bind-address argument is set to 127.0.0.1 (Scored)"
|
||||
audit: "/bin/ps -ef | grep $schedulerbin | grep -v grep"
|
||||
tests:
|
||||
bin_op: or
|
||||
|
||||
@@ -10,45 +10,14 @@ groups:
|
||||
checks:
|
||||
- id: 4.1.1
|
||||
text: "Ensure that the kubelet service file permissions are set to 644 or more restrictive (Scored)"
|
||||
audit: '/bin/sh -c ''if test -e $kubeletsvc; then stat -c %a $kubeletsvc; fi'' '
|
||||
audit: '/bin/sh -c ''if test -e $kubeletsvc; then stat -c permissions=%a $kubeletsvc; fi'' '
|
||||
tests:
|
||||
test_items:
|
||||
- flag: "644"
|
||||
- flag: "permissions"
|
||||
set: true
|
||||
compare:
|
||||
op: eq
|
||||
op: bitmask
|
||||
value: "644"
|
||||
set: true
|
||||
- flag: "640"
|
||||
compare:
|
||||
op: eq
|
||||
value: "640"
|
||||
set: true
|
||||
- flag: "600"
|
||||
compare:
|
||||
op: eq
|
||||
value: "600"
|
||||
set: true
|
||||
- flag: "444"
|
||||
compare:
|
||||
op: eq
|
||||
value: "444"
|
||||
set: true
|
||||
- flag: "440"
|
||||
compare:
|
||||
op: eq
|
||||
value: "440"
|
||||
set: true
|
||||
- flag: "400"
|
||||
compare:
|
||||
op: eq
|
||||
value: "400"
|
||||
set: true
|
||||
- flag: "000"
|
||||
compare:
|
||||
op: eq
|
||||
value: "000"
|
||||
set: true
|
||||
bin_op: or
|
||||
remediation: |
|
||||
Run the below command (based on the file location on your system) on the each worker node.
|
||||
For example,
|
||||
@@ -70,49 +39,18 @@ groups:
|
||||
|
||||
- id: 4.1.3
|
||||
text: "Ensure that the proxy kubeconfig file permissions are set to 644 or more restrictive (Scored)"
|
||||
audit: '/bin/sh -c ''if test -e $proxykubeconfig; then stat -c %a $proxykubeconfig; fi'' '
|
||||
audit: '/bin/sh -c ''if test -e $proxykubeconfig; then stat -c permissions=%a $proxykubeconfig; fi'' '
|
||||
tests:
|
||||
test_items:
|
||||
- flag: "644"
|
||||
- flag: "permissions"
|
||||
set: true
|
||||
compare:
|
||||
op: eq
|
||||
op: bitmask
|
||||
value: "644"
|
||||
set: true
|
||||
- flag: "640"
|
||||
compare:
|
||||
op: eq
|
||||
value: "640"
|
||||
set: true
|
||||
- flag: "600"
|
||||
compare:
|
||||
op: eq
|
||||
value: "600"
|
||||
set: true
|
||||
- flag: "444"
|
||||
compare:
|
||||
op: eq
|
||||
value: "444"
|
||||
set: true
|
||||
- flag: "440"
|
||||
compare:
|
||||
op: eq
|
||||
value: "440"
|
||||
set: true
|
||||
- flag: "400"
|
||||
compare:
|
||||
op: eq
|
||||
value: "400"
|
||||
set: true
|
||||
- flag: "000"
|
||||
compare:
|
||||
op: eq
|
||||
value: "000"
|
||||
set: true
|
||||
bin_op: or
|
||||
remediation: |
|
||||
Run the below command (based on the file location on your system) on the each worker node.
|
||||
For example,
|
||||
chmod 644 $proykubeconfig
|
||||
chmod 644 $proxykubeconfig
|
||||
scored: true
|
||||
|
||||
- id: 4.1.4
|
||||
@@ -129,45 +67,14 @@ groups:
|
||||
|
||||
- id: 4.1.5
|
||||
text: "Ensure that the kubelet.conf file permissions are set to 644 or more restrictive (Scored)"
|
||||
audit: '/bin/sh -c ''if test -e $kubeletkubeconfig; then stat -c %a $kubeletkubeconfig; fi'' '
|
||||
audit: '/bin/sh -c ''if test -e $kubeletkubeconfig; then stat -c permissions=%a $kubeletkubeconfig; fi'' '
|
||||
tests:
|
||||
test_items:
|
||||
- flag: "644"
|
||||
- flag: "permissions"
|
||||
set: true
|
||||
compare:
|
||||
op: eq
|
||||
op: bitmask
|
||||
value: "644"
|
||||
set: true
|
||||
- flag: "640"
|
||||
compare:
|
||||
op: eq
|
||||
value: "640"
|
||||
set: true
|
||||
- flag: "600"
|
||||
compare:
|
||||
op: eq
|
||||
value: "600"
|
||||
set: true
|
||||
- flag: "444"
|
||||
compare:
|
||||
op: eq
|
||||
value: "444"
|
||||
set: true
|
||||
- flag: "440"
|
||||
compare:
|
||||
op: eq
|
||||
value: "440"
|
||||
set: true
|
||||
- flag: "400"
|
||||
compare:
|
||||
op: eq
|
||||
value: "400"
|
||||
set: true
|
||||
- flag: "000"
|
||||
compare:
|
||||
op: eq
|
||||
value: "000"
|
||||
set: true
|
||||
bin_op: or
|
||||
remediation: |
|
||||
Run the below command (based on the file location on your system) on the each worker node.
|
||||
For example,
|
||||
@@ -200,7 +107,12 @@ groups:
|
||||
|
||||
- id: 4.1.8
|
||||
text: "Ensure that the client certificate authorities file ownership is set to root:root (Scored)"
|
||||
audit: '/bin/sh -c ''if test -e $kubeletcafile; then stat -c %U:%G $kubeletcafile; fi'' '
|
||||
audit: |
|
||||
CAFILE=$(ps -ef | grep kubelet | grep -v apiserver | grep -- --client-ca-file= | awk -F '--client-ca-file=' '{print $2}' | awk '{print $1}')
|
||||
if [[ -z $CAFILE ]]; then
|
||||
CAFILE=$kubeletcafile
|
||||
fi
|
||||
if test -e $CAFILE; then stat -c %U:%G $CAFILE; fi
|
||||
tests:
|
||||
test_items:
|
||||
- flag: root:root
|
||||
@@ -215,47 +127,16 @@ groups:
|
||||
|
||||
- id: 4.1.9
|
||||
text: "Ensure that the kubelet configuration file has permissions set to 644 or more restrictive (Scored)"
|
||||
audit: '/bin/sh -c ''if test -e $kubeletconf; then stat -c %a $kubeletconf; fi'' '
|
||||
audit: '/bin/sh -c ''if test -e $kubeletconf; then stat -c permissions=%a $kubeletconf; fi'' '
|
||||
tests:
|
||||
test_items:
|
||||
- flag: "644"
|
||||
- flag: "permissions"
|
||||
set: true
|
||||
compare:
|
||||
op: eq
|
||||
op: bitmask
|
||||
value: "644"
|
||||
- flag: "640"
|
||||
set: true
|
||||
compare:
|
||||
op: eq
|
||||
value: "640"
|
||||
- flag: "600"
|
||||
set: true
|
||||
compare:
|
||||
op: eq
|
||||
value: "600"
|
||||
- flag: "444"
|
||||
compare:
|
||||
op: eq
|
||||
value: "444"
|
||||
set: true
|
||||
- flag: "440"
|
||||
compare:
|
||||
op: eq
|
||||
value: "440"
|
||||
set: true
|
||||
- flag: "400"
|
||||
compare:
|
||||
op: eq
|
||||
value: "400"
|
||||
set: true
|
||||
- flag: "000"
|
||||
compare:
|
||||
op: eq
|
||||
value: "000"
|
||||
set: true
|
||||
bin_op: or
|
||||
remediation: |
|
||||
Run the following command (using the config file location identied in the Audit step)
|
||||
Run the following command (using the config file location identified in the Audit step)
|
||||
chmod 644 $kubeletconf
|
||||
scored: true
|
||||
|
||||
@@ -267,7 +148,7 @@ groups:
|
||||
- flag: root:root
|
||||
set: true
|
||||
remediation: |
|
||||
Run the following command (using the config file location identied in the Audit step)
|
||||
Run the following command (using the config file location identified in the Audit step)
|
||||
chown root:root $kubeletconf
|
||||
scored: true
|
||||
|
||||
@@ -417,7 +298,7 @@ groups:
|
||||
scored: true
|
||||
|
||||
- id: 4.2.7
|
||||
text: "Ensure that the --make-iptables-util-chains argument is set to true (Scored) "
|
||||
text: "Ensure that the --make-iptables-util-chains argument is set to true (Scored)"
|
||||
audit: "/bin/ps -fC $kubeletbin"
|
||||
audit_config: "/bin/cat $kubeletconf"
|
||||
tests:
|
||||
|
||||
@@ -37,7 +37,7 @@ groups:
|
||||
- id: 5.1.4
|
||||
text: "Minimize access to create pods (Not Scored)"
|
||||
type: "manual"
|
||||
Remediation: |
|
||||
remediation: |
|
||||
Where possible, remove create access to pod objects in the cluster.
|
||||
scored: false
|
||||
|
||||
@@ -128,7 +128,7 @@ groups:
|
||||
scored: false
|
||||
|
||||
- id: 5.2.9
|
||||
text: "Minimize the admission of containers with capabilities assigned (Not Scored) "
|
||||
text: "Minimize the admission of containers with capabilities assigned (Not Scored)"
|
||||
type: "manual"
|
||||
remediation: |
|
||||
Review the use of capabilites in applications runnning on your cluster. Where a namespace
|
||||
|
||||
@@ -27,8 +27,10 @@ master:
|
||||
- "apiserver"
|
||||
confs:
|
||||
- /etc/kubernetes/manifests/kube-apiserver.yaml
|
||||
- /etc/kubernetes/manifests/kube-apiserver.yml
|
||||
- /etc/kubernetes/manifests/kube-apiserver.manifest
|
||||
- /var/snap/kube-apiserver/current/args
|
||||
- /var/snap/microk8s/current/args/kube-apiserver
|
||||
defaultconf: /etc/kubernetes/manifests/kube-apiserver.yaml
|
||||
|
||||
scheduler:
|
||||
@@ -39,8 +41,10 @@ master:
|
||||
- "scheduler"
|
||||
confs:
|
||||
- /etc/kubernetes/manifests/kube-scheduler.yaml
|
||||
- /etc/kubernetes/manifests/kube-scheduler.yml
|
||||
- /etc/kubernetes/manifests/kube-scheduler.manifest
|
||||
- /var/snap/kube-scheduler/current/args
|
||||
- /var/snap/microk8s/current/args/kube-scheduler
|
||||
defaultconf: /etc/kubernetes/manifests/kube-scheduler.yaml
|
||||
|
||||
controllermanager:
|
||||
@@ -52,8 +56,10 @@ master:
|
||||
- "controller-manager"
|
||||
confs:
|
||||
- /etc/kubernetes/manifests/kube-controller-manager.yaml
|
||||
- /etc/kubernetes/manifests/kube-controller-manager.yml
|
||||
- /etc/kubernetes/manifests/kube-controller-manager.manifest
|
||||
- /var/snap/kube-controller-manager/current/args
|
||||
- /var/snap/microk8s/current/args/kube-controller-manager
|
||||
defaultconf: /etc/kubernetes/manifests/kube-controller-manager.yaml
|
||||
|
||||
etcd:
|
||||
@@ -62,9 +68,12 @@ master:
|
||||
- "etcd"
|
||||
confs:
|
||||
- /etc/kubernetes/manifests/etcd.yaml
|
||||
- /etc/kubernetes/manifests/etcd.yml
|
||||
- /etc/kubernetes/manifests/etcd.manifest
|
||||
- /etc/etcd/etcd.conf
|
||||
- /var/snap/etcd/common/etcd.conf.yml
|
||||
- /var/snap/etcd/common/etcd.conf.yaml
|
||||
- /var/snap/microk8s/current/args/etcd
|
||||
defaultconf: /etc/kubernetes/manifests/etcd.yaml
|
||||
|
||||
flanneld:
|
||||
@@ -88,6 +97,7 @@ node:
|
||||
- "/etc/kubernetes/pki/ca.crt"
|
||||
- "/etc/kubernetes/certs/ca.crt"
|
||||
- "/etc/kubernetes/cert/ca.pem"
|
||||
- "/var/snap/microk8s/current/certs/ca.crt"
|
||||
svc:
|
||||
# These paths must also be included
|
||||
# in the 'confs' property below
|
||||
@@ -95,6 +105,7 @@ node:
|
||||
- "/etc/systemd/system/kubelet.service"
|
||||
- "/lib/systemd/system/kubelet.service"
|
||||
- "/etc/systemd/system/snap.kubelet.daemon.service"
|
||||
- "/etc/systemd/system/snap.microk8s.daemon-kubelet.service"
|
||||
bins:
|
||||
- "hyperkube kubelet"
|
||||
- "kubelet"
|
||||
@@ -102,13 +113,17 @@ node:
|
||||
- "/etc/kubernetes/kubelet.conf"
|
||||
- "/var/lib/kubelet/kubeconfig"
|
||||
- "/etc/kubernetes/kubelet-kubeconfig"
|
||||
- "/var/snap/microk8s/current/credentials/kubelet.config"
|
||||
confs:
|
||||
- "/var/lib/kubelet/config.yaml"
|
||||
- "/var/lib/kubelet/config.yml"
|
||||
- "/etc/kubernetes/kubelet/kubelet-config.json"
|
||||
- "/home/kubernetes/kubelet-config.yaml"
|
||||
- "/home/kubernetes/kubelet-config.yml"
|
||||
- "/etc/default/kubelet"
|
||||
- "/var/lib/kubelet/kubeconfig"
|
||||
- "/var/snap/kubelet/current/args"
|
||||
- "/var/snap/microk8s/current/args/kubelet"
|
||||
## Due to the fact that the kubelet might be configured
|
||||
## without a kubelet-config file, we use a work-around
|
||||
## of pointing to the systemd service file (which can also
|
||||
@@ -118,6 +133,7 @@ node:
|
||||
- "/etc/systemd/system/kubelet.service"
|
||||
- "/lib/systemd/system/kubelet.service"
|
||||
- "/etc/systemd/system/snap.kubelet.daemon.service"
|
||||
- "/etc/systemd/system/snap.microk8s.daemon-kubelet.service"
|
||||
defaultconf: "/var/lib/kubelet/config.yaml"
|
||||
defaultsvc: "/etc/systemd/system/kubelet.service.d/10-kubeadm.conf"
|
||||
defaultkubeconfig: "/etc/kubernetes/kubelet.conf"
|
||||
@@ -133,12 +149,16 @@ node:
|
||||
confs:
|
||||
- /etc/kubernetes/proxy
|
||||
- /etc/kubernetes/addons/kube-proxy-daemonset.yaml
|
||||
- /etc/kubernetes/addons/kube-proxy-daemonset.yml
|
||||
- /var/snap/kube-proxy/current/args
|
||||
- /var/snap/microk8s/current/args/kube-proxy
|
||||
kubeconfig:
|
||||
- "/etc/kubernetes/kubelet-kubeconfig"
|
||||
- "/var/lib/kubelet/kubeconfig"
|
||||
- "/var/snap/microk8s/current/credentials/proxy.config"
|
||||
svc:
|
||||
- "/lib/systemd/system/kube-proxy.service"
|
||||
- "/etc/systemd/system/snap.microk8s.daemon-proxy.service"
|
||||
defaultconf: /etc/kubernetes/addons/kube-proxy-daemonset.yaml
|
||||
defaultkubeconfig: "/etc/kubernetes/proxy.conf"
|
||||
|
||||
@@ -151,9 +171,12 @@ etcd:
|
||||
- "etcd"
|
||||
confs:
|
||||
- /etc/kubernetes/manifests/etcd.yaml
|
||||
- /etc/kubernetes/manifests/etcd.yml
|
||||
- /etc/kubernetes/manifests/etcd.manifest
|
||||
- /etc/etcd/etcd.conf
|
||||
- /var/snap/etcd/common/etcd.conf.yml
|
||||
- /var/snap/etcd/common/etcd.conf.yaml
|
||||
- /var/snap/microk8s/current/args/etcd
|
||||
defaultconf: /etc/kubernetes/manifests/etcd.yaml
|
||||
|
||||
controlplane:
|
||||
@@ -162,6 +185,8 @@ controlplane:
|
||||
policies:
|
||||
components: []
|
||||
|
||||
managedservices:
|
||||
components: []
|
||||
|
||||
version_mapping:
|
||||
"1.11": "cis-1.3"
|
||||
@@ -171,5 +196,6 @@ version_mapping:
|
||||
"1.15": "cis-1.5"
|
||||
"1.16": "cis-1.5"
|
||||
"1.17": "cis-1.5"
|
||||
"gke-1.0": "gke-1.0"
|
||||
"ocp-3.10": "rh-0.7"
|
||||
"ocp-3.11": "rh-0.7"
|
||||
|
||||
2
cfg/eks-1.0/config.yaml
Normal file
2
cfg/eks-1.0/config.yaml
Normal file
@@ -0,0 +1,2 @@
|
||||
---
|
||||
## Version-specific settings that override the values in cfg/config.yaml
|
||||
14
cfg/eks-1.0/controlplane.yaml
Normal file
14
cfg/eks-1.0/controlplane.yaml
Normal file
@@ -0,0 +1,14 @@
|
||||
---
|
||||
controls:
|
||||
version: "eks-1.0"
|
||||
id: 2
|
||||
text: "Control Plane Configuration"
|
||||
type: "controlplane"
|
||||
groups:
|
||||
- id: 2.1
|
||||
text: "Logging"
|
||||
checks:
|
||||
- id: 2.1.1
|
||||
text: "Enable audit logs"
|
||||
remediation: "Enable control plane logging for API Server, Audit, Authenticator, Controller Manager, and Scheduler."
|
||||
scored: false
|
||||
104
cfg/eks-1.0/managedservices.yaml
Normal file
104
cfg/eks-1.0/managedservices.yaml
Normal file
@@ -0,0 +1,104 @@
|
||||
---
|
||||
controls:
|
||||
version: "eks-1.0"
|
||||
id: 5
|
||||
text: "Managed Services"
|
||||
type: "managedservices"
|
||||
groups:
|
||||
- id: 5.1
|
||||
text: "Image Registry and Image Scanning"
|
||||
checks:
|
||||
- id: 5.1.1
|
||||
text: "Ensure Image Vulnerability Scanning using Amazon ECR image scanning or a third-party provider (Not Scored)"
|
||||
type: "manual"
|
||||
remediation:
|
||||
scored: false
|
||||
|
||||
- id: 5.1.2
|
||||
text: "Minimize user access to Amazon ECR (Not Scored)"
|
||||
type: "manual"
|
||||
remediation:
|
||||
scored: false
|
||||
|
||||
- id: 5.1.3
|
||||
text: "Minimize cluster access to read-only for Amazon ECR (Not Scored)"
|
||||
type: "manual"
|
||||
remediation:
|
||||
scored: false
|
||||
|
||||
- id: 5.1.4
|
||||
text: "Minimize Container Registries to only those approved (Not Scored)"
|
||||
type: "manual"
|
||||
remediation:
|
||||
scored: false
|
||||
|
||||
- id: 5.2
|
||||
text: "Identity and Access Management (IAM)"
|
||||
checks:
|
||||
- id: 5.2.1
|
||||
text: "Prefer using dedicated Amazon EKS Service Accounts (Not Scored)"
|
||||
type: "manual"
|
||||
remediation:
|
||||
scored: false
|
||||
|
||||
- id: 5.3
|
||||
text: "AWS Key Management Service (AWS KMS)"
|
||||
checks:
|
||||
- id: 5.3.1
|
||||
text: "Ensure Kubernetes Secrets are encrypted using Customer Master Keys (CMKs) managed in AWS KMS (Not Scored)"
|
||||
type: "manual"
|
||||
remediation:
|
||||
scored: false
|
||||
|
||||
- id: 5.4
|
||||
text: "Cluster Networking"
|
||||
checks:
|
||||
- id: 5.4.1
|
||||
text: "Restrict Access to the Control Plane Endpoint (Not Scored)"
|
||||
type: "manual"
|
||||
remediation:
|
||||
scored: false
|
||||
|
||||
- id: 5.4.2
|
||||
text: "Ensure clusters are created with Private Endpoint Enabled and Public Access Disabled (Not Scored)"
|
||||
type: "manual"
|
||||
remediation:
|
||||
scored: false
|
||||
|
||||
- id: 5.4.3
|
||||
text: "Ensure clusters are created with Private Nodes (Not Scored)"
|
||||
type: "manual"
|
||||
remediation:
|
||||
scored: false
|
||||
|
||||
- id: 5.4.4
|
||||
text: "Ensure Network Policy is Enabled and set as appropriate (Not Scored)"
|
||||
type: "manual"
|
||||
remediation:
|
||||
scored: false
|
||||
|
||||
- id: 5.4.5
|
||||
text: "Encrypt traffic to HTTPS load balancers with TLS certificates (Not Scored)"
|
||||
type: "manual"
|
||||
remediation:
|
||||
scored: false
|
||||
|
||||
|
||||
- id: 5.5
|
||||
text: "Authentication and Authorization"
|
||||
checks:
|
||||
- id: 5.5.1
|
||||
text: "Manage Kubernetes RBAC users with AWS IAM Authenticator for Kubernetes (Not Scored)"
|
||||
type: "manual"
|
||||
remediation:
|
||||
scored: false
|
||||
|
||||
|
||||
- id: 5.6
|
||||
text: "Other Cluster Configurations"
|
||||
checks:
|
||||
- id: 5.6.1
|
||||
text: "Consider Fargate for running untrusted workloads (Not Scored)"
|
||||
type: "manual"
|
||||
remediation:
|
||||
scored: false
|
||||
6
cfg/eks-1.0/master.yaml
Normal file
6
cfg/eks-1.0/master.yaml
Normal file
@@ -0,0 +1,6 @@
|
||||
---
|
||||
controls:
|
||||
version: "eks-1.0"
|
||||
id: 1
|
||||
text: "Control Plane Components"
|
||||
type: "master"
|
||||
388
cfg/eks-1.0/node.yaml
Normal file
388
cfg/eks-1.0/node.yaml
Normal file
@@ -0,0 +1,388 @@
|
||||
---
|
||||
controls:
|
||||
version: "eks-1.0"
|
||||
id: 3
|
||||
text: "Worker Node Security Configuration"
|
||||
type: "node"
|
||||
groups:
|
||||
- id: 3.1
|
||||
text: "Worker Node Configuration Files"
|
||||
checks:
|
||||
- id: 3.1.1
|
||||
text: "Ensure that the proxy kubeconfig file permissions are set to 644 or more restrictive (Scored)"
|
||||
audit: '/bin/sh -c ''if test -e $proxykubeconfig; then stat -c %a $proxykubeconfig; fi'' '
|
||||
tests:
|
||||
test_items:
|
||||
- flag: "644"
|
||||
compare:
|
||||
op: eq
|
||||
value: "644"
|
||||
set: true
|
||||
- flag: "640"
|
||||
compare:
|
||||
op: eq
|
||||
value: "640"
|
||||
set: true
|
||||
- flag: "600"
|
||||
compare:
|
||||
op: eq
|
||||
value: "600"
|
||||
set: true
|
||||
- flag: "444"
|
||||
compare:
|
||||
op: eq
|
||||
value: "444"
|
||||
set: true
|
||||
- flag: "440"
|
||||
compare:
|
||||
op: eq
|
||||
value: "440"
|
||||
set: true
|
||||
- flag: "400"
|
||||
compare:
|
||||
op: eq
|
||||
value: "400"
|
||||
set: true
|
||||
- flag: "000"
|
||||
compare:
|
||||
op: eq
|
||||
value: "000"
|
||||
set: true
|
||||
bin_op: or
|
||||
remediation: |
|
||||
Run the below command (based on the file location on your system) on each worker node.
|
||||
For example,
|
||||
chmod 644 $proykubeconfig
|
||||
scored: true
|
||||
|
||||
- id: 3.1.2
|
||||
text: "Ensure that the proxy kubeconfig file ownership is set to root:root (Scored)"
|
||||
audit: '/bin/sh -c ''if test -e $proxykubeconfig; then stat -c %U:%G $proxykubeconfig; fi'' '
|
||||
tests:
|
||||
test_items:
|
||||
- flag: root:root
|
||||
set: true
|
||||
remediation: |
|
||||
Run the below command (based on the file location on your system) on each worker node.
|
||||
For example, chown root:root $proxykubeconfig
|
||||
scored: true
|
||||
|
||||
- id: 3.1.3
|
||||
text: "Ensure that the kubelet configuration file has permissions set to 644 or more restrictive (Scored)"
|
||||
audit: '/bin/sh -c ''if test -e $kubeletconf; then stat -c %a $kubeletconf; fi'' '
|
||||
tests:
|
||||
test_items:
|
||||
- flag: "644"
|
||||
set: true
|
||||
compare:
|
||||
op: eq
|
||||
value: "644"
|
||||
- flag: "640"
|
||||
set: true
|
||||
compare:
|
||||
op: eq
|
||||
value: "640"
|
||||
- flag: "600"
|
||||
set: true
|
||||
compare:
|
||||
op: eq
|
||||
value: "600"
|
||||
- flag: "444"
|
||||
compare:
|
||||
op: eq
|
||||
value: "444"
|
||||
set: true
|
||||
- flag: "440"
|
||||
compare:
|
||||
op: eq
|
||||
value: "440"
|
||||
set: true
|
||||
- flag: "400"
|
||||
compare:
|
||||
op: eq
|
||||
value: "400"
|
||||
set: true
|
||||
- flag: "000"
|
||||
compare:
|
||||
op: eq
|
||||
value: "000"
|
||||
set: true
|
||||
bin_op: or
|
||||
remediation: |
|
||||
Run the following command (using the config file location identied in the Audit step)
|
||||
chmod 644 $kubeletconf
|
||||
scored: true
|
||||
|
||||
- id: 3.1.4
|
||||
text: "Ensure that the kubelet configuration file ownership is set to root:root (Scored)"
|
||||
audit: '/bin/sh -c ''if test -e $kubeletconf; then stat -c %U:%G $kubeletconf; fi'' '
|
||||
tests:
|
||||
test_items:
|
||||
- flag: root:root
|
||||
set: true
|
||||
remediation: |
|
||||
Run the following command (using the config file location identied in the Audit step)
|
||||
chown root:root $kubeletconf
|
||||
scored: true
|
||||
|
||||
- id: 3.2
|
||||
text: "Kubelet"
|
||||
checks:
|
||||
- id: 3.2.1
|
||||
text: "Ensure that the --anonymous-auth argument is set to false (Scored)"
|
||||
audit: "/bin/ps -fC $kubeletbin"
|
||||
audit_config: "/bin/cat $kubeletconf"
|
||||
tests:
|
||||
test_items:
|
||||
- flag: "--anonymous-auth"
|
||||
path: '{.authentication.anonymous.enabled}'
|
||||
set: true
|
||||
compare:
|
||||
op: eq
|
||||
value: false
|
||||
remediation: |
|
||||
If using a Kubelet config file, edit the file to set authentication: anonymous: enabled to
|
||||
false.
|
||||
If using executable arguments, edit the kubelet service file
|
||||
$kubeletsvc on each worker node and
|
||||
set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable.
|
||||
--anonymous-auth=false
|
||||
Based on your system, restart the kubelet service. For example:
|
||||
systemctl daemon-reload
|
||||
systemctl restart kubelet.service
|
||||
scored: true
|
||||
|
||||
- id: 3.2.2
|
||||
text: "Ensure that the --authorization-mode argument is not set to AlwaysAllow (Scored)"
|
||||
audit: "/bin/ps -fC $kubeletbin"
|
||||
audit_config: "/bin/cat $kubeletconf"
|
||||
tests:
|
||||
test_items:
|
||||
- flag: --authorization-mode
|
||||
path: '{.authorization.mode}'
|
||||
set: true
|
||||
compare:
|
||||
op: nothave
|
||||
value: AlwaysAllow
|
||||
remediation: |
|
||||
If using a Kubelet config file, edit the file to set authorization: mode to Webhook. If
|
||||
using executable arguments, edit the kubelet service file
|
||||
$kubeletsvc on each worker node and
|
||||
set the below parameter in KUBELET_AUTHZ_ARGS variable.
|
||||
--authorization-mode=Webhook
|
||||
Based on your system, restart the kubelet service. For example:
|
||||
systemctl daemon-reload
|
||||
systemctl restart kubelet.service
|
||||
scored: true
|
||||
|
||||
- id: 3.2.3
|
||||
text: "Ensure that the --client-ca-file argument is set as appropriate (Scored)"
|
||||
audit: "/bin/ps -fC $kubeletbin"
|
||||
audit_config: "/bin/cat $kubeletconf"
|
||||
tests:
|
||||
test_items:
|
||||
- flag: --client-ca-file
|
||||
path: '{.authentication.x509.clientCAFile}'
|
||||
set: true
|
||||
remediation: |
|
||||
If using a Kubelet config file, edit the file to set authentication: x509: clientCAFile to
|
||||
the location of the client CA file.
|
||||
If using command line arguments, edit the kubelet service file
|
||||
$kubeletsvc on each worker node and
|
||||
set the below parameter in KUBELET_AUTHZ_ARGS variable.
|
||||
--client-ca-file=<path/to/client-ca-file>
|
||||
Based on your system, restart the kubelet service. For example:
|
||||
systemctl daemon-reload
|
||||
systemctl restart kubelet.service
|
||||
scored: true
|
||||
|
||||
- id: 3.2.4
|
||||
text: "Ensure that the --read-only-port argument is set to 0 (Scored)"
|
||||
audit: "/bin/ps -fC $kubeletbin"
|
||||
audit_config: "/bin/cat $kubeletconf"
|
||||
tests:
|
||||
test_items:
|
||||
- flag: "--read-only-port"
|
||||
path: '{.readOnlyPort}'
|
||||
set: true
|
||||
compare:
|
||||
op: eq
|
||||
value: 0
|
||||
remediation: |
|
||||
If using a Kubelet config file, edit the file to set readOnlyPort to 0.
|
||||
If using command line arguments, edit the kubelet service file
|
||||
$kubeletsvc on each worker node and
|
||||
set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable.
|
||||
--read-only-port=0
|
||||
Based on your system, restart the kubelet service. For example:
|
||||
systemctl daemon-reload
|
||||
systemctl restart kubelet.service
|
||||
scored: true
|
||||
|
||||
- id: 3.2.5
|
||||
text: "Ensure that the --streaming-connection-idle-timeout argument is not set to 0 (Scored)"
|
||||
audit: "/bin/ps -fC $kubeletbin"
|
||||
audit_config: "/bin/cat $kubeletconf"
|
||||
tests:
|
||||
test_items:
|
||||
- flag: --streaming-connection-idle-timeout
|
||||
path: '{.streamingConnectionIdleTimeout}'
|
||||
set: true
|
||||
compare:
|
||||
op: noteq
|
||||
value: 0
|
||||
- flag: --streaming-connection-idle-timeout
|
||||
path: '{.streamingConnectionIdleTimeout}'
|
||||
set: false
|
||||
bin_op: or
|
||||
remediation: |
|
||||
If using a Kubelet config file, edit the file to set streamingConnectionIdleTimeout to a
|
||||
value other than 0.
|
||||
If using command line arguments, edit the kubelet service file
|
||||
$kubeletsvc on each worker node and
|
||||
set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable.
|
||||
--streaming-connection-idle-timeout=5m
|
||||
Based on your system, restart the kubelet service. For example:
|
||||
systemctl daemon-reload
|
||||
systemctl restart kubelet.service
|
||||
scored: true
|
||||
|
||||
- id: 3.2.6
|
||||
text: "Ensure that the --protect-kernel-defaults argument is set to true (Scored)"
|
||||
audit: "/bin/ps -fC $kubeletbin"
|
||||
audit_config: "/bin/cat $kubeletconf"
|
||||
tests:
|
||||
test_items:
|
||||
- flag: --protect-kernel-defaults
|
||||
path: '{.protectKernelDefaults}'
|
||||
set: true
|
||||
compare:
|
||||
op: eq
|
||||
value: true
|
||||
remediation: |
|
||||
If using a Kubelet config file, edit the file to set protectKernelDefaults: true.
|
||||
If using command line arguments, edit the kubelet service file
|
||||
$kubeletsvc on each worker node and
|
||||
set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable.
|
||||
--protect-kernel-defaults=true
|
||||
Based on your system, restart the kubelet service. For example:
|
||||
systemctl daemon-reload
|
||||
systemctl restart kubelet.service
|
||||
scored: true
|
||||
|
||||
- id: 3.2.7
|
||||
text: "Ensure that the --make-iptables-util-chains argument is set to true (Scored) "
|
||||
audit: "/bin/ps -fC $kubeletbin"
|
||||
audit_config: "/bin/cat $kubeletconf"
|
||||
tests:
|
||||
test_items:
|
||||
- flag: --make-iptables-util-chains
|
||||
path: '{.makeIPTablesUtilChains}'
|
||||
set: true
|
||||
compare:
|
||||
op: eq
|
||||
value: true
|
||||
- flag: --make-iptables-util-chains
|
||||
path: '{.makeIPTablesUtilChains}'
|
||||
set: false
|
||||
bin_op: or
|
||||
remediation: |
|
||||
If using a Kubelet config file, edit the file to set makeIPTablesUtilChains: true.
|
||||
If using command line arguments, edit the kubelet service file
|
||||
$kubeletsvc on each worker node and
|
||||
remove the --make-iptables-util-chains argument from the
|
||||
KUBELET_SYSTEM_PODS_ARGS variable.
|
||||
Based on your system, restart the kubelet service. For example:
|
||||
systemctl daemon-reload
|
||||
systemctl restart kubelet.service
|
||||
scored: true
|
||||
|
||||
- id: 3.2.8
|
||||
text: "Ensure that the --hostname-override argument is not set (Scored)"
|
||||
# This is one of those properties that can only be set as a command line argument.
|
||||
# To check if the property is set as expected, we need to parse the kubelet command
|
||||
# instead reading the Kubelet Configuration file.
|
||||
audit: "/bin/ps -fC $kubeletbin "
|
||||
tests:
|
||||
test_items:
|
||||
- flag: --hostname-override
|
||||
set: false
|
||||
remediation: |
|
||||
Edit the kubelet service file $kubeletsvc
|
||||
on each worker node and remove the --hostname-override argument from the
|
||||
KUBELET_SYSTEM_PODS_ARGS variable.
|
||||
Based on your system, restart the kubelet service. For example:
|
||||
systemctl daemon-reload
|
||||
systemctl restart kubelet.service
|
||||
scored: true
|
||||
|
||||
- id: 3.2.9
|
||||
text: "Ensure that the --event-qps argument is set to 0 or a level which ensures appropriate event capture (Scored)"
|
||||
audit: "/bin/ps -fC $kubeletbin"
|
||||
audit_config: "/bin/cat $kubeletconf"
|
||||
tests:
|
||||
test_items:
|
||||
- flag: --event-qps
|
||||
path: '{.eventRecordQPS}'
|
||||
set: true
|
||||
compare:
|
||||
op: eq
|
||||
value: 0
|
||||
remediation: |
|
||||
If using a Kubelet config file, edit the file to set eventRecordQPS: to an appropriate level.
|
||||
If using command line arguments, edit the kubelet service file
|
||||
$kubeletsvc on each worker node and
|
||||
set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable.
|
||||
Based on your system, restart the kubelet service. For example:
|
||||
systemctl daemon-reload
|
||||
systemctl restart kubelet.service
|
||||
scored: false
|
||||
|
||||
- id: 3.2.10
|
||||
text: "Ensure that the --rotate-certificates argument is not set to false (Scored)"
|
||||
audit: "/bin/ps -fC $kubeletbin"
|
||||
audit_config: "/bin/cat $kubeletconf"
|
||||
tests:
|
||||
test_items:
|
||||
- flag: --rotate-certificates
|
||||
path: '{.rotateCertificates}'
|
||||
set: true
|
||||
compare:
|
||||
op: eq
|
||||
value: true
|
||||
- flag: --rotate-certificates
|
||||
path: '{.rotateCertificates}'
|
||||
set: false
|
||||
bin_op: or
|
||||
remediation: |
|
||||
If using a Kubelet config file, edit the file to add the line rotateCertificates: true or
|
||||
remove it altogether to use the default value.
|
||||
If using command line arguments, edit the kubelet service file
|
||||
$kubeletsvc on each worker node and
|
||||
remove --rotate-certificates=false argument from the KUBELET_CERTIFICATE_ARGS
|
||||
variable.
|
||||
Based on your system, restart the kubelet service. For example:
|
||||
systemctl daemon-reload
|
||||
systemctl restart kubelet.service
|
||||
scored: true
|
||||
|
||||
- id: 3.2.11
|
||||
text: "Ensure that the RotateKubeletServerCertificate argument is set to true (Scored)"
|
||||
audit: "/bin/ps -fC $kubeletbin"
|
||||
audit_config: "/bin/cat $kubeletconf"
|
||||
tests:
|
||||
test_items:
|
||||
- flag: RotateKubeletServerCertificate
|
||||
path: '{.featureGates.RotateKubeletServerCertificate}'
|
||||
set: true
|
||||
compare:
|
||||
op: eq
|
||||
value: true
|
||||
remediation: |
|
||||
Edit the kubelet service file $kubeletsvc
|
||||
on each worker node and set the below parameter in KUBELET_CERTIFICATE_ARGS variable.
|
||||
--feature-gates=RotateKubeletServerCertificate=true
|
||||
Based on your system, restart the kubelet service. For example:
|
||||
systemctl daemon-reload
|
||||
systemctl restart kubelet.service
|
||||
scored: true
|
||||
237
cfg/eks-1.0/policies.yaml
Normal file
237
cfg/eks-1.0/policies.yaml
Normal file
@@ -0,0 +1,237 @@
|
||||
---
|
||||
controls:
|
||||
version: "eks-1.0"
|
||||
id: 4
|
||||
text: "Policies"
|
||||
type: "policies"
|
||||
groups:
|
||||
- id: 4.1
|
||||
text: "RBAC and Service Accounts"
|
||||
checks:
|
||||
- id: 4.1.1
|
||||
text: "Ensure that the cluster-admin role is only used where required (Not Scored)"
|
||||
type: "manual"
|
||||
remediation: |
|
||||
Identify all clusterrolebindings to the cluster-admin role. Check if they are used and
|
||||
if they need this role or if they could use a role with fewer privileges.
|
||||
Where possible, first bind users to a lower privileged role and then remove the
|
||||
clusterrolebinding to the cluster-admin role :
|
||||
kubectl delete clusterrolebinding [name]
|
||||
scored: false
|
||||
|
||||
- id: 4.1.2
|
||||
text: "Minimize access to secrets (Not Scored)"
|
||||
type: "manual"
|
||||
remediation: |
|
||||
Where possible, remove get, list and watch access to secret objects in the cluster.
|
||||
scored: false
|
||||
|
||||
- id: 4.1.3
|
||||
text: "Minimize wildcard use in Roles and ClusterRoles (Not Scored)"
|
||||
type: "manual"
|
||||
remediation: |
|
||||
Where possible replace any use of wildcards in clusterroles and roles with specific
|
||||
objects or actions.
|
||||
scored: false
|
||||
|
||||
- id: 4.1.4
|
||||
text: "Minimize access to create pods (Not Scored)"
|
||||
type: "manual"
|
||||
Remediation: |
|
||||
Where possible, remove create access to pod objects in the cluster.
|
||||
scored: false
|
||||
|
||||
- id: 4.1.5
|
||||
text: "Ensure that default service accounts are not actively used. (Not Scored)"
|
||||
type: "manual"
|
||||
remediation: |
|
||||
Create explicit service accounts wherever a Kubernetes workload requires specific access
|
||||
to the Kubernetes API server.
|
||||
Modify the configuration of each default service account to include this value
|
||||
automountServiceAccountToken: false
|
||||
scored: false
|
||||
|
||||
- id: 4.1.6
|
||||
text: "Ensure that Service Account Tokens are only mounted where necessary (Not Scored)"
|
||||
type: "manual"
|
||||
remediation: |
|
||||
Modify the definition of pods and service accounts which do not need to mount service
|
||||
account tokens to disable it.
|
||||
scored: false
|
||||
|
||||
- id: 4.2
|
||||
text: "Pod Security Policies"
|
||||
checks:
|
||||
- id: 4.2.1
|
||||
text: "Minimize the admission of privileged containers (Not Scored)"
|
||||
type: "manual"
|
||||
remediation: |
|
||||
Create a PSP as described in the Kubernetes documentation, ensuring that
|
||||
the .spec.privileged field is omitted or set to false.
|
||||
scored: false
|
||||
|
||||
- id: 4.2.2
|
||||
text: "Minimize the admission of containers wishing to share the host process ID namespace (Not Scored)"
|
||||
type: "manual"
|
||||
remediation: |
|
||||
Create a PSP as described in the Kubernetes documentation, ensuring that the
|
||||
.spec.hostPID field is omitted or set to false.
|
||||
scored: false
|
||||
|
||||
- id: 4.2.3
|
||||
text: "Minimize the admission of containers wishing to share the host IPC namespace (Not Scored)"
|
||||
type: "manual"
|
||||
remediation: |
|
||||
Create a PSP as described in the Kubernetes documentation, ensuring that the
|
||||
.spec.hostIPC field is omitted or set to false.
|
||||
scored: false
|
||||
|
||||
- id: 4.2.4
|
||||
text: "Minimize the admission of containers wishing to share the host network namespace (Not Scored)"
|
||||
type: "manual"
|
||||
remediation: |
|
||||
Create a PSP as described in the Kubernetes documentation, ensuring that the
|
||||
.spec.hostNetwork field is omitted or set to false.
|
||||
scored: false
|
||||
|
||||
- id: 4.2.5
|
||||
text: "Minimize the admission of containers with allowPrivilegeEscalation (Not Scored)"
|
||||
type: "manual"
|
||||
remediation: |
|
||||
Create a PSP as described in the Kubernetes documentation, ensuring that the
|
||||
.spec.allowPrivilegeEscalation field is omitted or set to false.
|
||||
scored: false
|
||||
|
||||
- id: 4.2.6
|
||||
text: "Minimize the admission of root containers (Not Scored)"
|
||||
type: "manual"
|
||||
remediation: |
|
||||
Create a PSP as described in the Kubernetes documentation, ensuring that the
|
||||
.spec.runAsUser.rule is set to either MustRunAsNonRoot or MustRunAs with the range of
|
||||
UIDs not including 0.
|
||||
scored: false
|
||||
|
||||
- id: 4.2.7
|
||||
text: "Minimize the admission of containers with the NET_RAW capability (Not Scored)"
|
||||
type: "manual"
|
||||
remediation: |
|
||||
Create a PSP as described in the Kubernetes documentation, ensuring that the
|
||||
.spec.requiredDropCapabilities is set to include either NET_RAW or ALL.
|
||||
scored: false
|
||||
|
||||
- id: 4.2.8
|
||||
text: "Minimize the admission of containers with added capabilities (Not Scored)"
|
||||
type: "manual"
|
||||
remediation: |
|
||||
Ensure that allowedCapabilities is not present in PSPs for the cluster unless
|
||||
it is set to an empty array.
|
||||
scored: false
|
||||
|
||||
- id: 4.2.9
|
||||
text: "Minimize the admission of containers with capabilities assigned (Not Scored)"
|
||||
type: "manual"
|
||||
remediation: |
|
||||
Review the use of capabilites in applications runnning on your cluster. Where a namespace
|
||||
contains applications which do not require any Linux capabities to operate consider adding
|
||||
a PSP which forbids the admission of containers which do not drop all capabilities.
|
||||
scored: false
|
||||
|
||||
- id: 4.3
|
||||
text: "CNI Plugin"
|
||||
checks:
|
||||
- id: 4.3.1
|
||||
text: "Ensure that the latest CNI version is used (Not Scored)"
|
||||
type: "manual"
|
||||
remediation: |
|
||||
Review the documentation of AWS CNI plugin, and ensure latest CNI version is used.
|
||||
scored: false
|
||||
|
||||
- id: 4.3.2
|
||||
text: "Ensure that all Namespaces have Network Policies defined (Not Scored)"
|
||||
type: "manual"
|
||||
remediation: |
|
||||
Follow the documentation and create NetworkPolicy objects as you need them.
|
||||
scored: false
|
||||
|
||||
- id: 4.4
|
||||
text: "Secrets Management"
|
||||
checks:
|
||||
- id: 4.4.1
|
||||
text: "Prefer using secrets as files over secrets as environment variables (Not Scored)"
|
||||
type: "manual"
|
||||
remediation: |
|
||||
If possible, rewrite application code to read secrets from mounted secret files, rather than
|
||||
from environment variables.
|
||||
scored: false
|
||||
|
||||
- id: 4.4.2
|
||||
text: "Consider external secret storage (Not Scored)"
|
||||
type: "manual"
|
||||
remediation: |
|
||||
Refer to the secrets management options offered by your cloud provider or a third-party
|
||||
secrets management solution.
|
||||
scored: false
|
||||
|
||||
- id: 4.5
|
||||
text: "Extensible Admission Control"
|
||||
checks:
|
||||
- id: 4.5.1
|
||||
text: "Configure Image Provenance using ImagePolicyWebhook admission controller (Not Scored)"
|
||||
type: "manual"
|
||||
remediation: |
|
||||
Follow the Kubernetes documentation and setup image provenance.
|
||||
scored: false
|
||||
|
||||
- id: 4.6
|
||||
text: "General Policies"
|
||||
checks:
|
||||
- id: 4.6.1
|
||||
text: "Create administrative boundaries between resources using namespaces (Not Scored)"
|
||||
type: "manual"
|
||||
remediation: |
|
||||
Follow the documentation and create namespaces for objects in your deployment as you need
|
||||
them.
|
||||
scored: false
|
||||
|
||||
- id: 4.6.2
|
||||
text: "Ensure that the seccomp profile is set to docker/default in your pod definitions (Not Scored)"
|
||||
type: "manual"
|
||||
remediation: |
|
||||
Seccomp is an alpha feature currently. By default, all alpha features are disabled. So, you
|
||||
would need to enable alpha features in the apiserver by passing "--feature-
|
||||
gates=AllAlpha=true" argument.
|
||||
Edit the /etc/kubernetes/apiserver file on the master node and set the KUBE_API_ARGS
|
||||
parameter to "--feature-gates=AllAlpha=true"
|
||||
KUBE_API_ARGS="--feature-gates=AllAlpha=true"
|
||||
Based on your system, restart the kube-apiserver service. For example:
|
||||
systemctl restart kube-apiserver.service
|
||||
Use annotations to enable the docker/default seccomp profile in your pod definitions. An
|
||||
example is as below:
|
||||
apiVersion: v1
|
||||
kind: Pod
|
||||
metadata:
|
||||
name: trustworthy-pod
|
||||
annotations:
|
||||
seccomp.security.alpha.kubernetes.io/pod: docker/default
|
||||
spec:
|
||||
containers:
|
||||
- name: trustworthy-container
|
||||
image: sotrustworthy:latest
|
||||
scored: false
|
||||
|
||||
- id: 4.6.3
|
||||
text: "Apply Security Context to Your Pods and Containers (Not Scored)"
|
||||
type: "manual"
|
||||
remediation: |
|
||||
Follow the Kubernetes documentation and apply security contexts to your pods. For a
|
||||
suggested list of security contexts, you may refer to the CIS Security Benchmark for Docker
|
||||
Containers.
|
||||
scored: false
|
||||
|
||||
- id: 4.6.4
|
||||
text: "The default namespace should not be used (Not Scored)"
|
||||
type: "manual"
|
||||
remediation: |
|
||||
Ensure that namespaces are created to allow for appropriate segregation of Kubernetes
|
||||
resources and that all new resources are created in a specific namespace.
|
||||
scored: false
|
||||
2
cfg/gke-1.0/config.yaml
Normal file
2
cfg/gke-1.0/config.yaml
Normal file
@@ -0,0 +1,2 @@
|
||||
---
|
||||
## Version-specific settings that override the values in cfg/config.yaml
|
||||
32
cfg/gke-1.0/controlplane.yaml
Normal file
32
cfg/gke-1.0/controlplane.yaml
Normal file
@@ -0,0 +1,32 @@
|
||||
---
|
||||
controls:
|
||||
version: "gke-1.0"
|
||||
id: 3
|
||||
text: "Control Plane Configuration"
|
||||
type: "controlplane"
|
||||
groups:
|
||||
- id: 3.1
|
||||
text: "Authentication and Authorization"
|
||||
checks:
|
||||
- id: 3.1.1
|
||||
text: "Client certificate authentication should not be used for users (Not Scored)"
|
||||
type: "manual"
|
||||
remediation: |
|
||||
Alternative mechanisms provided by Kubernetes such as the use of OIDC should be
|
||||
implemented in place of client certificates.
|
||||
You can remediate the availability of client certificates in your GKE cluster. See
|
||||
Recommendation 6.8.2.
|
||||
scored: false
|
||||
|
||||
- id: 3.2
|
||||
text: "Logging"
|
||||
checks:
|
||||
- id: 3.2.1
|
||||
text: "Ensure that a minimal audit policy is created (Not Scored)"
|
||||
remediation: "This control cannot be modified in GKE."
|
||||
scored: false
|
||||
|
||||
- id: 3.2.2
|
||||
text: "Ensure that the audit policy covers key security concerns (Not Scored) "
|
||||
remediation: "This control cannot be modified in GKE."
|
||||
scored: false
|
||||
45
cfg/gke-1.0/etcd.yaml
Normal file
45
cfg/gke-1.0/etcd.yaml
Normal file
@@ -0,0 +1,45 @@
|
||||
---
|
||||
controls:
|
||||
version: "gke-1.0"
|
||||
id: 2
|
||||
text: "Etcd Node Configuration"
|
||||
type: "etcd"
|
||||
groups:
|
||||
- id: 2
|
||||
text: "Etcd Node Configuration Files"
|
||||
checks:
|
||||
- id: 2.1
|
||||
text: "Ensure that the --cert-file and --key-file arguments are set as appropriate (Not Scored)"
|
||||
remediation: "This control cannot be modified in GKE."
|
||||
scored: false
|
||||
|
||||
- id: 2.2
|
||||
text: "Ensure that the --client-cert-auth argument is set to true (Not Scored)"
|
||||
remediation: "This control cannot be modified in GKE."
|
||||
scored: false
|
||||
|
||||
- id: 2.3
|
||||
text: "Ensure that the --auto-tls argument is not set to true (Not Scored)"
|
||||
remediation: "This control cannot be modified in GKE."
|
||||
scored: false
|
||||
|
||||
- id: 2.4
|
||||
text: "Ensure that the --peer-cert-file and --peer-key-file arguments are
|
||||
set as appropriate (Not Scored)"
|
||||
remediation: "This control cannot be modified in GKE."
|
||||
scored: false
|
||||
|
||||
- id: 2.5
|
||||
text: "Ensure that the --peer-client-cert-auth argument is set to true (Not Scored)"
|
||||
remediation: "This control cannot be modified in GKE."
|
||||
scored: false
|
||||
|
||||
- id: 2.6
|
||||
text: "Ensure that the --peer-auto-tls argument is not set to true (Not Scored)"
|
||||
remediation: "This control cannot be modified in GKE."
|
||||
scored: false
|
||||
|
||||
- id: 2.7
|
||||
text: "Ensure that a unique Certificate Authority is used for etcd (Not Scored)"
|
||||
remediation: "This control cannot be modified in GKE."
|
||||
scored: false
|
||||
703
cfg/gke-1.0/managedservices.yaml
Normal file
703
cfg/gke-1.0/managedservices.yaml
Normal file
@@ -0,0 +1,703 @@
|
||||
---
|
||||
controls:
|
||||
version: "gke-1.0"
|
||||
id: 6
|
||||
text: "Managed Services"
|
||||
type: "managedservices"
|
||||
groups:
|
||||
- id: 6.1
|
||||
text: "Image Registry and Image Scanning"
|
||||
checks:
|
||||
- id: 6.1.1
|
||||
text: "Ensure Image Vulnerability Scanning using GCR Container Analysis
|
||||
or a third-party provider (Scored)"
|
||||
type: "manual"
|
||||
remediation: |
|
||||
Using Command Line:
|
||||
|
||||
gcloud services enable containerscanning.googleapis.com
|
||||
scored: true
|
||||
|
||||
- id: 6.1.2
|
||||
text: "Minimize user access to GCR (Scored)"
|
||||
type: "manual"
|
||||
remediation: |
|
||||
Using Command Line:
|
||||
To change roles at the GCR bucket level:
|
||||
Firstly, run the following if read permissions are required:
|
||||
|
||||
gsutil iam ch [TYPE]:[EMAIL-ADDRESS]:objectViewer
|
||||
gs://artifacts.[PROJECT_ID].appspot.com
|
||||
|
||||
Then remove the excessively privileged role (Storage Admin / Storage Object Admin /
|
||||
Storage Object Creator) using:
|
||||
|
||||
gsutil iam ch -d [TYPE]:[EMAIL-ADDRESS]:[ROLE]
|
||||
gs://artifacts.[PROJECT_ID].appspot.com
|
||||
|
||||
where:
|
||||
[TYPE] can be one of the following:
|
||||
o user, if the [EMAIL-ADDRESS] is a Google account
|
||||
o serviceAccount, if [EMAIL-ADDRESS] specifies a Service account
|
||||
[EMAIL-ADDRESS] can be one of the following:
|
||||
o a Google account (for example, someone@example.com)
|
||||
o a Cloud IAM service account
|
||||
To modify roles defined at the project level and subsequently inherited within the GCR
|
||||
bucket, or the Service Account User role, extract the IAM policy file, modify it accordingly
|
||||
and apply it using:
|
||||
|
||||
gcloud projects set-iam-policy [PROJECT_ID] [POLICY_FILE]
|
||||
scored: true
|
||||
|
||||
- id: 6.1.3
|
||||
text: "Minimize cluster access to read-only for GCR (Scored)"
|
||||
type: "manual"
|
||||
remediation: |
|
||||
Using Command Line:
|
||||
For an account explicitly granted to the bucket. First, add read access to the Kubernetes
|
||||
Service Account
|
||||
|
||||
gsutil iam ch [TYPE]:[EMAIL-ADDRESS]:objectViewer
|
||||
gs://artifacts.[PROJECT_ID].appspot.com
|
||||
|
||||
where:
|
||||
[TYPE] can be one of the following:
|
||||
o user, if the [EMAIL-ADDRESS] is a Google account
|
||||
o serviceAccount, if [EMAIL-ADDRESS] specifies a Service account
|
||||
[EMAIL-ADDRESS] can be one of the following:
|
||||
o a Google account (for example, someone@example.com)
|
||||
o a Cloud IAM service account
|
||||
|
||||
Then remove the excessively privileged role (Storage Admin / Storage Object Admin /
|
||||
Storage Object Creator) using:
|
||||
|
||||
gsutil iam ch -d [TYPE]:[EMAIL-ADDRESS]:[ROLE]
|
||||
gs://artifacts.[PROJECT_ID].appspot.com
|
||||
|
||||
For an account that inherits access to the GCR Bucket through Project level permissions,
|
||||
modify the Projects IAM policy file accordingly, then upload it using:
|
||||
|
||||
gcloud projects set-iam-policy [PROJECT_ID] [POLICY_FILE]
|
||||
scored: true
|
||||
|
||||
- id: 6.1.4
|
||||
text: "Minimize Container Registries to only those approved (Not Scored)"
|
||||
type: "manual"
|
||||
remediation: |
|
||||
Using Command Line:
|
||||
First, update the cluster to enable Binary Authorization:
|
||||
|
||||
gcloud container cluster update [CLUSTER_NAME] \
|
||||
--enable-binauthz
|
||||
|
||||
Create a Binary Authorization Policy using the Binary Authorization Policy Reference
|
||||
(https://cloud.google.com/binary-authorization/docs/policy-yaml-reference) for guidance.
|
||||
Import the policy file into Binary Authorization:
|
||||
|
||||
gcloud container binauthz policy import [YAML_POLICY]
|
||||
scored: false
|
||||
|
||||
- id: 6.2
|
||||
text: "Identity and Access Management (IAM)"
|
||||
checks:
|
||||
- id: 6.2.1
|
||||
text: "Ensure GKE clusters are not running using the Compute Engine
|
||||
default service account (Scored)"
|
||||
type: "manual"
|
||||
remediation: |
|
||||
Using Command Line:
|
||||
Firstly, create a minimally privileged service account:
|
||||
|
||||
gcloud iam service-accounts create [SA_NAME] \
|
||||
--display-name "GKE Node Service Account"
|
||||
export NODE_SA_EMAIL=`gcloud iam service-accounts list \
|
||||
--format='value(email)' \
|
||||
--filter='displayName:GKE Node Service Account'`
|
||||
|
||||
Grant the following roles to the service account:
|
||||
|
||||
export PROJECT_ID=`gcloud config get-value project`
|
||||
gcloud projects add-iam-policy-binding $PROJECT_ID \
|
||||
--member serviceAccount:$NODE_SA_EMAIL \
|
||||
--role roles/monitoring.metricWriter
|
||||
gcloud projects add-iam-policy-binding $PROJECT_ID \
|
||||
--member serviceAccount:$NODE_SA_EMAIL \
|
||||
--role roles/monitoring.viewer
|
||||
gcloud projects add-iam-policy-binding $PROJECT_ID \
|
||||
--member serviceAccount:$NODE_SA_EMAIL \
|
||||
--role roles/logging.logWriter
|
||||
|
||||
To create a new Node pool using the Service account, run the following command:
|
||||
|
||||
gcloud container node-pools create [NODE_POOL] \
|
||||
--service-account=[SA_NAME]@[PROJECT_ID].iam.gserviceaccount.com \
|
||||
--cluster=[CLUSTER_NAME] --zone [COMPUTE_ZONE]
|
||||
|
||||
You will need to migrate your workloads to the new Node pool, and delete Node pools that
|
||||
use the default service account to complete the remediation.
|
||||
scored: true
|
||||
|
||||
- id: 6.2.2
|
||||
text: "Prefer using dedicated GCP Service Accounts and Workload Identity (Not Scored)"
|
||||
type: "manual"
|
||||
remediation: |
|
||||
Using Command Line:
|
||||
|
||||
gcloud beta container clusters update [CLUSTER_NAME] --zone [CLUSTER_ZONE] \
|
||||
--identity-namespace=[PROJECT_ID].svc.id.goog
|
||||
|
||||
Note that existing Node pools are unaffected. New Node pools default to --workload-
|
||||
metadata-from-node=GKE_METADATA_SERVER .
|
||||
|
||||
Then, modify existing Node pools to enable GKE_METADATA_SERVER:
|
||||
|
||||
gcloud beta container node-pools update [NODEPOOL_NAME] \
|
||||
--cluster=[CLUSTER_NAME] --zone [CLUSTER_ZONE] \
|
||||
--workload-metadata-from-node=GKE_METADATA_SERVER
|
||||
|
||||
You may also need to modify workloads in order for them to use Workload Identity as
|
||||
described within https://cloud.google.com/kubernetes-engine/docs/how-to/workload-
|
||||
identity. Also consider the effects on the availability of your hosted workloads as Node
|
||||
pools are updated, it may be more appropriate to create new Node Pools.
|
||||
scored: false
|
||||
|
||||
- id: 6.3
|
||||
text: "Cloud Key Management Service (Cloud KMS)"
|
||||
checks:
|
||||
- id: 6.3.1
|
||||
text: "Ensure Kubernetes Secrets are encrypted using keys managed in Cloud KMS (Scored)"
|
||||
type: "manual"
|
||||
remediation: |
|
||||
Using Command Line:
|
||||
To create a key
|
||||
|
||||
Create a key ring:
|
||||
|
||||
gcloud kms keyrings create [RING_NAME] \
|
||||
--location [LOCATION] \
|
||||
--project [KEY_PROJECT_ID]
|
||||
|
||||
Create a key:
|
||||
|
||||
gcloud kms keys create [KEY_NAME] \
|
||||
--location [LOCATION] \
|
||||
--keyring [RING_NAME] \
|
||||
--purpose encryption \
|
||||
--project [KEY_PROJECT_ID]
|
||||
|
||||
Grant the Kubernetes Engine Service Agent service account the Cloud KMS CryptoKey
|
||||
Encrypter/Decrypter role:
|
||||
|
||||
gcloud kms keys add-iam-policy-binding [KEY_NAME] \
|
||||
--location [LOCATION] \
|
||||
--keyring [RING_NAME] \
|
||||
--member serviceAccount:[SERVICE_ACCOUNT_NAME] \
|
||||
--role roles/cloudkms.cryptoKeyEncrypterDecrypter \
|
||||
--project [KEY_PROJECT_ID]
|
||||
|
||||
To create a new cluster with Application-layer Secrets Encryption:
|
||||
|
||||
gcloud container clusters create [CLUSTER_NAME] \
|
||||
--cluster-version=latest \
|
||||
--zone [ZONE] \
|
||||
--database-encryption-key projects/[KEY_PROJECT_ID]/locations/[LOCATION]/keyRings/[RING_NAME]/cryptoKey s/[KEY_NAME] \
|
||||
--project [CLUSTER_PROJECT_ID]
|
||||
|
||||
To enable on an existing cluster:
|
||||
|
||||
gcloud container clusters update [CLUSTER_NAME] \
|
||||
--zone [ZONE] \
|
||||
--database-encryption-key projects/[KEY_PROJECT_ID]/locations/[LOCATION]/keyRings/[RING_NAME]/cryptoKey s/[KEY_NAME] \
|
||||
--project [CLUSTER_PROJECT_ID]
|
||||
scored: true
|
||||
|
||||
- id: 6.4
|
||||
text: "Node Metadata"
|
||||
checks:
|
||||
- id: 6.4.1
|
||||
text: "Ensure legacy Compute Engine instance metadata APIs are Disabled (Scored)"
|
||||
type: "manual"
|
||||
remediation: |
|
||||
Using Command Line:
|
||||
To update an existing cluster, create a new Node pool with the legacy GCE metadata
|
||||
endpoint disabled:
|
||||
|
||||
gcloud container node-pools create [POOL_NAME] \
|
||||
--metadata disable-legacy-endpoints=true \
|
||||
--cluster [CLUSTER_NAME] \
|
||||
--zone [COMPUTE_ZONE]
|
||||
|
||||
You will need to migrate workloads from any existing non-conforming Node pools, to the
|
||||
new Node pool, then delete non-conforming Node pools to complete the remediation.
|
||||
scored: true
|
||||
|
||||
- id: 6.4.2
|
||||
text: "Ensure the GKE Metadata Server is Enabled (Not Scored)"
|
||||
type: "manual"
|
||||
remediation: |
|
||||
Using Command Line:
|
||||
gcloud beta container clusters update [CLUSTER_NAME] \
|
||||
--identity-namespace=[PROJECT_ID].svc.id.goog
|
||||
Note that existing Node pools are unaffected. New Node pools default to --workload-
|
||||
metadata-from-node=GKE_METADATA_SERVER .
|
||||
|
||||
To modify an existing Node pool to enable GKE Metadata Server:
|
||||
|
||||
gcloud beta container node-pools update [NODEPOOL_NAME] \
|
||||
--cluster=[CLUSTER_NAME] \
|
||||
--workload-metadata-from-node=GKE_METADATA_SERVER
|
||||
|
||||
You may also need to modify workloads in order for them to use Workload Identity as
|
||||
described within https://cloud.google.com/kubernetes-engine/docs/how-to/workload-
|
||||
identity.
|
||||
scored: false
|
||||
|
||||
- id: 6.5
|
||||
text: "Node Configuration and Maintenance"
|
||||
checks:
|
||||
- id: 6.5.1
|
||||
text: "Ensure Container-Optimized OS (COS) is used for GKE node images (Scored)"
|
||||
type: "manual"
|
||||
remediation: |
|
||||
Using Command Line:
|
||||
To set the node image to cos for an existing cluster's Node pool:
|
||||
|
||||
gcloud container clusters upgrade [CLUSTER_NAME]\
|
||||
--image-type cos \
|
||||
--zone [COMPUTE_ZONE] --node-pool [POOL_NAME]
|
||||
scored: true
|
||||
|
||||
- id: 6.5.2
|
||||
text: "Ensure Node Auto-Repair is enabled for GKE nodes (Scored)"
|
||||
type: "manual"
|
||||
remediation: |
|
||||
Using Command Line:
|
||||
To enable node auto-repair for an existing cluster with Node pool, run the following
|
||||
command:
|
||||
|
||||
gcloud container node-pools update [POOL_NAME] \
|
||||
--cluster [CLUSTER_NAME] --zone [COMPUTE_ZONE] \
|
||||
--enable-autorepair
|
||||
scored: true
|
||||
|
||||
- id: 6.5.3
|
||||
text: "Ensure Node Auto-Upgrade is enabled for GKE nodes (Scored)"
|
||||
type: "manual"
|
||||
remediation: |
|
||||
Using Command Line:
|
||||
To enable node auto-upgrade for an existing cluster's Node pool, run the following
|
||||
command:
|
||||
|
||||
gcloud container node-pools update [NODE_POOL] \
|
||||
--cluster [CLUSTER_NAME] --zone [COMPUTE_ZONE] \
|
||||
--enable-autoupgrade
|
||||
scored: true
|
||||
|
||||
- id: 6.5.4
|
||||
text: "Automate GKE version management using Release Channels (Not Scored)"
|
||||
type: "manual"
|
||||
remediation: |
|
||||
Using Command Line:
|
||||
Create a new cluster by running the following command:
|
||||
|
||||
gcloud beta container clusters create [CLUSTER_NAME] \
|
||||
--zone [COMPUTE_ZONE] \
|
||||
--release-channel [RELEASE_CHANNEL]
|
||||
|
||||
where [RELEASE_CHANNEL] is stable or regular according to your needs.
|
||||
scored: false
|
||||
|
||||
- id: 6.5.5
|
||||
text: "Ensure Shielded GKE Nodes are Enabled (Not Scored)"
|
||||
type: "manual"
|
||||
remediation: |
|
||||
Using Command Line:
|
||||
To create a Node pool within the cluster with Integrity Monitoring enabled, run the
|
||||
following command:
|
||||
|
||||
gcloud beta container node-pools create [NODEPOOL_NAME] \
|
||||
--cluster [CLUSTER_NAME] --zone [COMPUTE_ZONE] \
|
||||
--shielded-integrity-monitoring
|
||||
|
||||
You will also need to migrate workloads from existing non-conforming Node pools to the
|
||||
newly created Node pool, then delete the non-conforming pools.
|
||||
scored: false
|
||||
|
||||
- id: 6.5.6
|
||||
text: "Ensure Shielded GKE Nodes are Enabled (Not Scored)"
|
||||
type: "manual"
|
||||
remediation: |
|
||||
Using Command Line:
|
||||
To migrate an existing cluster, you will need to specify the --enable-shielded-nodes flag
|
||||
on a cluster update command:
|
||||
|
||||
gcloud beta container clusters update [CLUSTER_NAME] \
|
||||
--zone [CLUSTER_ZONE] \
|
||||
--enable-shielded-nodes
|
||||
scored: false
|
||||
|
||||
- id: 6.5.7
|
||||
text: "Ensure Secure Boot for Shielded GKE Nodes is Enabled (Not Scored)"
|
||||
type: "manual"
|
||||
remediation: |
|
||||
Using Command Line:
|
||||
To create a Node pool within the cluster with Secure Boot enabled, run the following
|
||||
command:
|
||||
|
||||
gcloud beta container node-pools create [NODEPOOL_NAME] \
|
||||
--cluster [CLUSTER_NAME] --zone [COMPUTE_ZONE] \
|
||||
--shielded-secure-boot
|
||||
|
||||
You will also need to migrate workloads from existing non-conforming Node pools to the
|
||||
newly created Node pool, then delete the non-conforming pools.
|
||||
scored: false
|
||||
|
||||
- id: 6.6
|
||||
text: "Cluster Networking"
|
||||
checks:
|
||||
- id: 6.6.1
|
||||
text: "Enable VPC Flow Logs and Intranode Visibility (Not Scored)"
|
||||
type: "manual"
|
||||
remediation: |
|
||||
Using Command Line:
|
||||
To enable intranode visibility on an existing cluster, run the following command:
|
||||
|
||||
gcloud beta container clusters update [CLUSTER_NAME] \
|
||||
--enable-intra-node-visibility
|
||||
scored: false
|
||||
|
||||
- id: 6.6.2
|
||||
text: "Ensure use of VPC-native clusters (Scored)"
|
||||
type: "manual"
|
||||
remediation: |
|
||||
Using Command Line:
|
||||
To enable Alias IP on a new cluster, run the following command:
|
||||
|
||||
gcloud container clusters create [CLUSTER_NAME] \
|
||||
--zone [COMPUTE_ZONE] \
|
||||
--enable-ip-alias
|
||||
scored: true
|
||||
|
||||
- id: 6.6.3
|
||||
text: "Ensure Master Authorized Networks is Enabled (Scored)"
|
||||
type: "manual"
|
||||
remediation: |
|
||||
Using Command Line:
|
||||
To check Master Authorized Networks status for an existing cluster, run the following
|
||||
command;
|
||||
|
||||
gcloud container clusters describe [CLUSTER_NAME] \
|
||||
--zone [COMPUTE_ZONE] \
|
||||
--format json | jq '.masterAuthorizedNetworksConfig'
|
||||
|
||||
The output should return
|
||||
|
||||
{
|
||||
"enabled": true
|
||||
}
|
||||
|
||||
if Master Authorized Networks is enabled.
|
||||
|
||||
If Master Authorized Networks is disabled, the
|
||||
above command will return null ( { } ).
|
||||
scored: true
|
||||
|
||||
- id: 6.6.4
|
||||
text: "Ensure clusters are created with Private Endpoint Enabled and Public Access Disabled (Scored)"
|
||||
type: "manual"
|
||||
remediation: |
|
||||
Using Command Line:
|
||||
Create a cluster with a Private Endpoint enabled and Public Access disabled by including
|
||||
the --enable-private-endpoint flag within the cluster create command:
|
||||
|
||||
gcloud container clusters create [CLUSTER_NAME] \
|
||||
--enable-private-endpoint
|
||||
|
||||
Setting this flag also requires the setting of --enable-private-nodes , --enable-ip-alias
|
||||
and --master-ipv4-cidr=[MASTER_CIDR_RANGE] .
|
||||
scored: true
|
||||
|
||||
- id: 6.6.5
|
||||
text: "Ensure clusters are created with Private Nodes (Scored)"
|
||||
type: "manual"
|
||||
remediation: |
|
||||
Using Command Line:
|
||||
To create a cluster with Private Nodes enabled, include the --enable-private-nodes flag
|
||||
within the cluster create command:
|
||||
|
||||
gcloud container clusters create [CLUSTER_NAME] \
|
||||
--enable-private-nodes
|
||||
|
||||
Setting this flag also requires the setting of --enable-ip-alias and --master-ipv4-
|
||||
cidr=[MASTER_CIDR_RANGE] .
|
||||
scored: true
|
||||
|
||||
- id: 6.6.6
|
||||
text: "Consider firewalling GKE worker nodes (Not Scored)"
|
||||
type: "manual"
|
||||
remediation: |
|
||||
Using Command Line:
|
||||
Use the following command to generate firewall rules, setting the variables as appropriate.
|
||||
You may want to use the target [TAG] and [SERVICE_ACCOUNT] previously identified.
|
||||
|
||||
gcloud compute firewall-rules create FIREWALL_RULE_NAME \
|
||||
--network [NETWORK] \
|
||||
--priority [PRIORITY] \
|
||||
--direction [DIRECTION] \
|
||||
--action [ACTION] \
|
||||
--target-tags [TAG] \
|
||||
--target-service-accounts [SERVICE_ACCOUNT] \
|
||||
--source-ranges [SOURCE_CIDR-RANGE] \
|
||||
--source-tags [SOURCE_TAGS] \
|
||||
--source-service-accounts=[SOURCE_SERVICE_ACCOUNT] \
|
||||
--destination-ranges [DESTINATION_CIDR_RANGE] \
|
||||
--rules [RULES]
|
||||
scored: false
|
||||
|
||||
- id: 6.6.7
|
||||
text: "Ensure Network Policy is Enabled and set as appropriate (Not Scored)"
|
||||
type: "manual"
|
||||
remediation: |
|
||||
Using Command Line:
|
||||
To enable Network Policy for an existing cluster, firstly enable the Network Policy add-on:
|
||||
|
||||
gcloud container clusters update [CLUSTER_NAME] \
|
||||
--zone [COMPUTE_ZONE] \
|
||||
--update-addons NetworkPolicy=ENABLED
|
||||
|
||||
Then, enable Network Policy:
|
||||
|
||||
gcloud container clusters update [CLUSTER_NAME] \
|
||||
--zone [COMPUTE_ZONE] \
|
||||
--enable-network-policy
|
||||
scored: false
|
||||
|
||||
- id: 6.6.8
|
||||
text: "Ensure use of Google-managed SSL Certificates (Not Scored)"
|
||||
type: "manual"
|
||||
remediation: |
|
||||
If services of type:LoadBalancer are discovered, consider replacing the Service with an
|
||||
Ingress.
|
||||
|
||||
To configure the Ingress and use Google-managed SSL certificates, follow the instructions
|
||||
as listed at https://cloud.google.com/kubernetes-engine/docs/how-to/managed-certs.
|
||||
scored: false
|
||||
|
||||
- id: 6.7
|
||||
text: "Logging"
|
||||
checks:
|
||||
- id: 6.7.1
|
||||
text: "Ensure Stackdriver Kubernetes Logging and Monitoring is Enabled (Scored)"
|
||||
type: "manual"
|
||||
remediation: |
|
||||
Using Command Line:
|
||||
|
||||
STACKDRIVER KUBERNETES ENGINE MONITORING SUPPORT (PREFERRED):
|
||||
To enable Stackdriver Kubernetes Engine Monitoring for an existing cluster, run the
|
||||
following command:
|
||||
|
||||
gcloud container clusters update [CLUSTER_NAME] \
|
||||
--zone [COMPUTE_ZONE] \
|
||||
--enable-stackdriver-kubernetes
|
||||
|
||||
LEGACY STACKDRIVER SUPPORT:
|
||||
Both Logging and Monitoring support must be enabled.
|
||||
To enable Legacy Stackdriver Logging for an existing cluster, run the following command:
|
||||
|
||||
gcloud container clusters update [CLUSTER_NAME] --zone [COMPUTE_ZONE] \
|
||||
--logging-service logging.googleapis.com
|
||||
|
||||
To enable Legacy Stackdriver Monitoring for an existing cluster, run the following
|
||||
command:
|
||||
|
||||
gcloud container clusters update [CLUSTER_NAME] --zone [COMPUTE_ZONE] \
|
||||
--monitoring-service monitoring.googleapis.com
|
||||
scored: true
|
||||
|
||||
- id: 6.7.2
|
||||
text: "Enable Linux auditd logging (Not Scored)"
|
||||
type: "manual"
|
||||
remediation: |
|
||||
Using Command Line:
|
||||
Download the example manifests:
|
||||
|
||||
curl https://raw.githubusercontent.com/GoogleCloudPlatform/k8s-node-tools/master/os-audit/cos-auditd-logging.yaml \
|
||||
> cos-auditd-logging.yaml
|
||||
|
||||
Edit the example manifests if needed. Then, deploy them:
|
||||
|
||||
kubectl apply -f cos-auditd-logging.yaml
|
||||
|
||||
Verify that the logging Pods have started. If you defined a different Namespace in your
|
||||
manifests, replace cos-auditd with the name of the namespace you're using:
|
||||
|
||||
kubectl get pods --namespace=cos-auditd
|
||||
scored: false
|
||||
|
||||
- id: 6.8
|
||||
text: "Authentication and Authorization"
|
||||
checks:
|
||||
- id: 6.8.1
|
||||
text: "Ensure Basic Authentication using static passwords is Disabled (Scored)"
|
||||
type: "manual"
|
||||
remediation: |
|
||||
Using Command Line:
|
||||
To update an existing cluster and disable Basic Authentication by removing the static
|
||||
password:
|
||||
|
||||
gcloud container clusters update [CLUSTER_NAME] \
|
||||
--no-enable-basic-auth
|
||||
scored: true
|
||||
|
||||
- id: 6.8.2
|
||||
text: "Ensure authentication using Client Certificates is Disabled (Scored)"
|
||||
type: "manual"
|
||||
remediation: |
|
||||
Using Command Line:
|
||||
Create a new cluster without a Client Certificate:
|
||||
|
||||
gcloud container clusters create [CLUSTER_NAME] \
|
||||
--no-issue-client-certificate
|
||||
scored: true
|
||||
|
||||
- id: 6.8.3
|
||||
text: "Manage Kubernetes RBAC users with Google Groups for GKE (Not Scored)"
|
||||
type: "manual"
|
||||
remediation: |
|
||||
Using Command Line:
|
||||
Follow the G Suite Groups instructions at https://cloud.google.com/kubernetes-
|
||||
engine/docs/how-to/role-based-access-control#google-groups-for-gke.
|
||||
|
||||
Then, create a cluster with
|
||||
|
||||
gcloud beta container clusters create my-cluster \
|
||||
--security-group="gke-security-groups@[yourdomain.com]"
|
||||
|
||||
Finally create Roles, ClusterRoles, RoleBindings, and ClusterRoleBindings that
|
||||
reference your G Suite Groups.
|
||||
scored: false
|
||||
|
||||
- id: 6.8.4
|
||||
text: "Ensure Legacy Authorization (ABAC) is Disabled (Scored)"
|
||||
type: "manual"
|
||||
remediation: |
|
||||
Using Command Line:
|
||||
To disable Legacy Authorization for an existing cluster, run the following command:
|
||||
|
||||
gcloud container clusters update [CLUSTER_NAME] \
|
||||
--zone [COMPUTE_ZONE] \
|
||||
--no-enable-legacy-authorization
|
||||
scored: true
|
||||
|
||||
- id: 6.9
|
||||
text: "Storage"
|
||||
checks:
|
||||
- id: 6.9.1
|
||||
text: "Enable Customer-Managed Encryption Keys (CMEK) for GKE Persistent Disks (PD) (Not Scored)"
|
||||
type: "manual"
|
||||
remediation: |
|
||||
Using Command Line:
|
||||
FOR NODE BOOT DISKS:
|
||||
Create a new node pool using customer-managed encryption keys for the node boot disk, of
|
||||
[DISK_TYPE] either pd-standard or pd-ssd :
|
||||
|
||||
gcloud beta container node-pools create [CLUSTER_NAME] \
|
||||
--disk-type [DISK_TYPE] \
|
||||
--boot-disk-kms-key \
|
||||
projects/[KEY_PROJECT_ID]/locations/[LOCATION]/keyRings/[RING_NAME]/cryptoKeys/[KEY_NAME]
|
||||
|
||||
Create a cluster using customer-managed encryption keys for the node boot disk, of
|
||||
[DISK_TYPE] either pd-standard or pd-ssd :
|
||||
|
||||
gcloud beta container clusters create [CLUSTER_NAME] \
|
||||
--disk-type [DISK_TYPE] \
|
||||
--boot-disk-kms-key \
|
||||
projects/[KEY_PROJECT_ID]/locations/[LOCATION]/keyRings/[RING_NAME]/cryptoKeys/[KEY_NAME]
|
||||
|
||||
FOR ATTACHED DISKS:
|
||||
Follow the instructions detailed at https://cloud.google.com/kubernetes-
|
||||
engine/docs/how-to/using-cmek.
|
||||
scored: false
|
||||
|
||||
- id: 6.10
|
||||
text: "Other Cluster Configurations"
|
||||
checks:
|
||||
- id: 6.10.1
|
||||
text: "Ensure Kubernetes Web UI is Disabled (Scored)"
|
||||
type: "manual"
|
||||
remediation: |
|
||||
Using Command Line:
|
||||
To disable the Kubernetes Dashboard on an existing cluster, run the following command:
|
||||
|
||||
gcloud container clusters update [CLUSTER_NAME] \
|
||||
--zone [ZONE] \
|
||||
--update-addons=KubernetesDashboard=DISABLED
|
||||
scored: true
|
||||
|
||||
- id: 6.10.2
|
||||
text: "Ensure that Alpha clusters are not used for production workloads (Scored)"
|
||||
type: "manual"
|
||||
remediation: |
|
||||
Using Command Line:
|
||||
Upon creating a new cluster
|
||||
|
||||
gcloud container clusters create [CLUSTER_NAME] \
|
||||
--zone [COMPUTE_ZONE]
|
||||
|
||||
Do not use the --enable-kubernetes-alpha argument.
|
||||
scored: true
|
||||
|
||||
- id: 6.10.3
|
||||
text: "Ensure Pod Security Policy is Enabled and set as appropriate (Not Scored)"
|
||||
type: "manual"
|
||||
remediation: |
|
||||
Using Command Line:
|
||||
To enable Pod Security Policy for an existing cluster, run the following command:
|
||||
|
||||
gcloud beta container clusters update [CLUSTER_NAME] \
|
||||
--zone [COMPUTE_ZONE] \
|
||||
--enable-pod-security-policy
|
||||
scored: false
|
||||
|
||||
- id: 6.10.4
|
||||
text: "Consider GKE Sandbox for running untrusted workloads (Not Scored)"
|
||||
type: "manual"
|
||||
remediation: |
|
||||
Using Command Line:
|
||||
To enable GKE Sandbox on an existing cluster, a new Node pool must be created.
|
||||
|
||||
gcloud container node-pools create [NODE_POOL_NAME] \
|
||||
--zone=[COMPUTE-ZONE] \
|
||||
--cluster=[CLUSTER_NAME] \
|
||||
--image-type=cos_containerd \
|
||||
--sandbox type=gvisor
|
||||
scored: false
|
||||
|
||||
- id: 6.10.5
|
||||
text: "Ensure use of Binary Authorization (Scored)"
|
||||
type: "manual"
|
||||
remediation: |
|
||||
Using Command Line:
|
||||
Firstly, update the cluster to enable Binary Authorization:
|
||||
|
||||
gcloud container cluster update [CLUSTER_NAME] \
|
||||
--zone [COMPUTE-ZONE] \
|
||||
--enable-binauthz
|
||||
|
||||
Create a Binary Authorization Policy using the Binary Authorization Policy Reference
|
||||
(https://cloud.google.com/binary-authorization/docs/policy-yaml-reference) for
|
||||
guidance.
|
||||
|
||||
Import the policy file into Binary Authorization:
|
||||
|
||||
gcloud container binauthz policy import [YAML_POLICY]
|
||||
scored: true
|
||||
|
||||
- id: 6.10.6
|
||||
text: "Enable Cloud Security Command Center (Cloud SCC) (Not Scored)"
|
||||
type: "manual"
|
||||
remediation: |
|
||||
Using Command Line:
|
||||
Follow the instructions at https://cloud.google.com/security-command-
|
||||
center/docs/quickstart-scc-setup.
|
||||
scored: false
|
||||
348
cfg/gke-1.0/master.yaml
Normal file
348
cfg/gke-1.0/master.yaml
Normal file
@@ -0,0 +1,348 @@
|
||||
---
|
||||
controls:
|
||||
version: "gke-1.0"
|
||||
id: 1
|
||||
text: "Control Plane Components"
|
||||
type: "master"
|
||||
groups:
|
||||
- id: 1.1
|
||||
text: "Master Node Configuration Files "
|
||||
checks:
|
||||
- id: 1.1.1
|
||||
text: "Ensure that the API server pod specification file permissions are set to 644 or more restrictive (Not Scored)"
|
||||
remediation: "This control cannot be modified in GKE."
|
||||
scored: false
|
||||
|
||||
- id: 1.1.2
|
||||
text: "Ensure that the API server pod specification file ownership is set to root:root (Not Scored)"
|
||||
remediation: "This control cannot be modified in GKE."
|
||||
scored: false
|
||||
|
||||
- id: 1.1.3
|
||||
text: "Ensure that the controller manager pod specification file permissions are set to 644 or more restrictive (Not Scored)"
|
||||
remediation: "This control cannot be modified in GKE."
|
||||
scored: false
|
||||
|
||||
- id: 1.1.4
|
||||
text: "Ensure that the controller manager pod specification file ownership is set to root:root (Not Scored)"
|
||||
remediation: "This control cannot be modified in GKE."
|
||||
scored: false
|
||||
|
||||
- id: 1.1.5
|
||||
text: "Ensure that the scheduler pod specification file permissions are set to 644 or more restrictive (Not Scored)"
|
||||
remediation: "This control cannot be modified in GKE."
|
||||
scored: false
|
||||
|
||||
- id: 1.1.6
|
||||
text: "Ensure that the scheduler pod specification file ownership is set to root:root (Not Scored)"
|
||||
remediation: "This control cannot be modified in GKE."
|
||||
scored: false
|
||||
|
||||
- id: 1.1.7
|
||||
text: "Ensure that the etcd pod specification file permissions are set to 644 or more restrictive (Not Scored)"
|
||||
remediation: "This control cannot be modified in GKE."
|
||||
scored: false
|
||||
|
||||
- id: 1.1.8
|
||||
text: "Ensure that the etcd pod specification file ownership is set to root:root (Not Scored)"
|
||||
remediation: "This control cannot be modified in GKE."
|
||||
scored: false
|
||||
|
||||
- id: 1.1.9
|
||||
text: "Ensure that the Container Network Interface file permissions are set to 644 or more restrictive (Not Scored)"
|
||||
remediation: "This control cannot be modified in GKE."
|
||||
scored: false
|
||||
|
||||
- id: 1.1.10
|
||||
text: "Ensure that the Container Network Interface file ownership is set to root:root (Not Scored)"
|
||||
remediation: "This control cannot be modified in GKE."
|
||||
scored: false
|
||||
|
||||
- id: 1.1.11
|
||||
text: "Ensure that the etcd data directory permissions are set to 700 or more restrictive (Not Scored)"
|
||||
remediation: "This control cannot be modified in GKE."
|
||||
scored: false
|
||||
|
||||
- id: 1.1.12
|
||||
text: "Ensure that the etcd data directory ownership is set to etcd:etcd (Not Scored)"
|
||||
remediation: "This control cannot be modified in GKE."
|
||||
scored: false
|
||||
|
||||
- id: 1.1.13
|
||||
text: "Ensure that the admin.conf file permissions are set to 644 or more restrictive (Not Scored)"
|
||||
remediation: "This control cannot be modified in GKE."
|
||||
scored: false
|
||||
|
||||
- id: 1.1.14
|
||||
text: "Ensure that the admin.conf file ownership is set to root:root (Not Scored) "
|
||||
remediation: "This control cannot be modified in GKE."
|
||||
scored: false
|
||||
|
||||
- id: 1.1.15
|
||||
text: "Ensure that the scheduler.conf file permissions are set to 644 or more restrictive (Not Scored)"
|
||||
remediation: "This control cannot be modified in GKE."
|
||||
scored: true
|
||||
|
||||
- id: 1.1.16
|
||||
text: "Ensure that the scheduler.conf file ownership is set to root:root (Not Scored)"
|
||||
remediation: "This control cannot be modified in GKE."
|
||||
scored: false
|
||||
|
||||
- id: 1.1.17
|
||||
text: "Ensure that the controller-manager.conf file permissions are set to 644 or more restrictive (Not Scored)"
|
||||
remediation: "This control cannot be modified in GKE."
|
||||
scored: false
|
||||
|
||||
- id: 1.1.18
|
||||
text: "Ensure that the controller-manager.conf file ownership is set to root:root (Not Scored)"
|
||||
remediation: "This control cannot be modified in GKE."
|
||||
scored: false
|
||||
|
||||
- id: 1.1.19
|
||||
text: "Ensure that the Kubernetes PKI directory and file ownership is set to root:root (Not Scored)"
|
||||
remediation: "This control cannot be modified in GKE."
|
||||
scored: false
|
||||
|
||||
- id: 1.1.20
|
||||
text: "Ensure that the Kubernetes PKI certificate file permissions are set to 644 or more restrictive (Not Scored)"
|
||||
remediation: "This control cannot be modified in GKE."
|
||||
scored: false
|
||||
|
||||
- id: 1.1.21
|
||||
text: "Ensure that the Kubernetes PKI key file permissions are set to 600 (Not Scored)"
|
||||
remediation: "This control cannot be modified in GKE."
|
||||
scored: false
|
||||
|
||||
- id: 1.2
|
||||
text: "API Server"
|
||||
checks:
|
||||
- id: 1.2.1
|
||||
text: "Ensure that the --anonymous-auth argument is set to false (Not Scored)"
|
||||
remediation: "This control cannot be modified in GKE."
|
||||
scored: false
|
||||
|
||||
- id: 1.2.2
|
||||
text: "Ensure that the --basic-auth-file argument is not set (Not Scored)"
|
||||
remediation: |
|
||||
Although the use of the --basic-auth-file argument cannot be audited on GKE, you can
|
||||
remediate the use of basic authentication. See Recommendation 6.8.1.
|
||||
scored: false
|
||||
|
||||
- id: 1.2.3
|
||||
text: "Ensure that the --token-auth-file parameter is not set (Not Scored)"
|
||||
remediation: "This control cannot be modified in GKE."
|
||||
scored: false
|
||||
|
||||
- id: 1.2.4
|
||||
text: "Ensure that the --kubelet-https argument is set to true (Not Scored)"
|
||||
remediation: "This control cannot be modified in GKE."
|
||||
scored: false
|
||||
|
||||
- id: 1.2.5
|
||||
text: "Ensure that the --kubelet-client-certificate and --kubelet-client-key arguments are set as appropriate (Not Scored)"
|
||||
remediation: "This control cannot be modified in GKE."
|
||||
scored: false
|
||||
|
||||
- id: 1.2.6
|
||||
text: "Ensure that the --kubelet-certificate-authority argument is set as appropriate (Not Scored)"
|
||||
remediation: "This control cannot be modified in GKE."
|
||||
scored: false
|
||||
|
||||
- id: 1.2.7
|
||||
text: "Ensure that the --authorization-mode argument is not set to AlwaysAllow (Not Scored)"
|
||||
remediation: "This control cannot be modified in GKE."
|
||||
scored: false
|
||||
|
||||
- id: 1.2.8
|
||||
text: "Ensure that the --authorization-mode argument includes Node (Not Scored)"
|
||||
remediation: "This control cannot be modified in GKE."
|
||||
scored: false
|
||||
|
||||
- id: 1.2.9
|
||||
text: "Ensure that the --authorization-mode argument includes RBAC (Not Scored)"
|
||||
remediation: "This control cannot be modified in GKE."
|
||||
scored: false
|
||||
|
||||
- id: 1.2.10
|
||||
text: "Ensure that the admission control plugin EventRateLimit is set (Not Scored)"
|
||||
remediation: "This control cannot be modified in GKE."
|
||||
scored: false
|
||||
|
||||
- id: 1.2.11
|
||||
text: "Ensure that the admission control plugin AlwaysAdmit is not set (Not Scored)"
|
||||
remediation: "This control cannot be modified in GKE."
|
||||
scored: false
|
||||
|
||||
- id: 1.2.12
|
||||
text: "Ensure that the admission control plugin AlwaysPullImages is set (Not Scored)"
|
||||
remediation: "This control cannot be modified in GKE."
|
||||
scored: false
|
||||
|
||||
- id: 1.2.13
|
||||
text: "Ensure that the admission control plugin SecurityContextDeny is set if PodSecurityPolicy is not used (Not Scored)"
|
||||
remediation: "This control cannot be modified in GKE."
|
||||
scored: false
|
||||
|
||||
- id: 1.2.14
|
||||
text: "Ensure that the admission control plugin ServiceAccount is set (Not Scored)"
|
||||
remediation: "This control cannot be modified in GKE."
|
||||
scored: false
|
||||
|
||||
- id: 1.2.15
|
||||
text: "Ensure that the admission control plugin NamespaceLifecycle is set (Not Scored)"
|
||||
remediation: "This control cannot be modified in GKE."
|
||||
scored: false
|
||||
|
||||
- id: 1.2.16
|
||||
text: "Ensure that the admission control plugin PodSecurityPolicy is set (Not Scored)"
|
||||
remediation: |
|
||||
To verify and remediate the use of Pod Security Policy on GKE, see Recommendation 6.10.3.
|
||||
scored: false
|
||||
|
||||
- id: 1.2.17
|
||||
text: "Ensure that the admission control plugin NodeRestriction is set (Not Scored)"
|
||||
remediation: "This control cannot be modified in GKE."
|
||||
scored: false
|
||||
|
||||
- id: 1.2.18
|
||||
text: "Ensure that the --insecure-bind-address argument is not set (Not Scored)"
|
||||
remediation: "This control cannot be modified in GKE."
|
||||
scored: false
|
||||
|
||||
- id: 1.2.19
|
||||
text: "Ensure that the --insecure-port argument is set to 0 (Not Scored)"
|
||||
remediation: "This control cannot be modified in GKE."
|
||||
scored: false
|
||||
|
||||
- id: 1.2.20
|
||||
text: "Ensure that the --secure-port argument is not set to 0 (Not Scored)"
|
||||
remediation: "This control cannot be modified in GKE."
|
||||
scored: false
|
||||
|
||||
- id: 1.2.21
|
||||
text: "Ensure that the --profiling argument is set to false (Not Scored)"
|
||||
remediation: "This control cannot be modified in GKE."
|
||||
scored: false
|
||||
|
||||
- id: 1.2.22
|
||||
text: "Ensure that the --audit-log-path argument is set (Not Scored)"
|
||||
remediation: "This control cannot be modified in GKE."
|
||||
scored: false
|
||||
|
||||
- id: 1.2.23
|
||||
text: "Ensure that the --audit-log-maxage argument is set to 30 or as appropriate (Not Scored)"
|
||||
remediation: "This control cannot be modified in GKE."
|
||||
scored: false
|
||||
|
||||
- id: 1.2.24
|
||||
text: "Ensure that the --audit-log-maxbackup argument is set to 10 or as appropriate (Not Scored)"
|
||||
remediation: "This control cannot be modified in GKE."
|
||||
scored: false
|
||||
|
||||
- id: 1.2.25
|
||||
text: "Ensure that the --audit-log-maxsize argument is set to 100 or as appropriate (Not Scored)"
|
||||
remediation: "This control cannot be modified in GKE."
|
||||
scored: false
|
||||
|
||||
- id: 1.2.26
|
||||
text: "Ensure that the --request-timeout argument is set as appropriate (Not Scored)"
|
||||
remediation: "This control cannot be modified in GKE."
|
||||
scored: false
|
||||
|
||||
- id: 1.2.27
|
||||
text: "Ensure that the --service-account-lookup argument is set to true (Not Scored)"
|
||||
remediation: "This control cannot be modified in GKE."
|
||||
scored: false
|
||||
|
||||
- id: 1.2.28
|
||||
text: "Ensure that the --service-account-key-file argument is set as appropriate (Not Scored)"
|
||||
remediation: "This control cannot be modified in GKE."
|
||||
scored: false
|
||||
|
||||
- id: 1.2.29
|
||||
text: "Ensure that the --etcd-certfile and --etcd-keyfile arguments are set as appropriate (Not Scored)"
|
||||
remediation: "This control cannot be modified in GKE."
|
||||
scored: false
|
||||
|
||||
- id: 1.2.30
|
||||
text: "Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate (Not Scored)"
|
||||
remediation: "This control cannot be modified in GKE."
|
||||
scored: false
|
||||
|
||||
- id: 1.2.31
|
||||
text: "Ensure that the --client-ca-file argument is set as appropriate (Not Scored)"
|
||||
remediation: "This control cannot be modified in GKE."
|
||||
scored: false
|
||||
|
||||
- id: 1.2.32
|
||||
text: "Ensure that the --etcd-cafile argument is set as appropriate (Not Scored)"
|
||||
remediation: "This control cannot be modified in GKE."
|
||||
scored: false
|
||||
|
||||
- id: 1.2.33
|
||||
text: "Ensure that the --encryption-provider-config argument is set as appropriate (Not Scored)"
|
||||
remediation: |
|
||||
To verify and remediate the use of secret encryption on GKE, see Recommendation 6.3.1.
|
||||
scored: false
|
||||
|
||||
- id: 1.2.34
|
||||
text: "Ensure that encryption providers are appropriately configured (Not Scored)"
|
||||
remediation: |
|
||||
To verify and remediate the use of secret encryption on GKE, see Recommendation 6.3.1.
|
||||
scored: false
|
||||
|
||||
- id: 1.2.35
|
||||
text: "Ensure that the API Server only makes use of Strong Cryptographic Ciphers (Not Scored)"
|
||||
remediation: "This control cannot be modified in GKE."
|
||||
scored: false
|
||||
|
||||
- id: 1.3
|
||||
text: "Controller Manager"
|
||||
checks:
|
||||
- id: 1.3.1
|
||||
text: "Ensure that the --terminated-pod-gc-threshold argument is set as appropriate (Not Scored)"
|
||||
remediation: "This control cannot be modified in GKE."
|
||||
scored: false
|
||||
|
||||
- id: 1.3.2
|
||||
text: "Ensure that the --profiling argument is set to false (Not Scored)"
|
||||
remediation: "This control cannot be modified in GKE."
|
||||
scored: false
|
||||
|
||||
- id: 1.3.3
|
||||
text: "Ensure that the --use-service-account-credentials argument is set to true (Not Scored)"
|
||||
remediation: "This control cannot be modified in GKE."
|
||||
scored: false
|
||||
|
||||
- id: 1.3.4
|
||||
text: "Ensure that the --service-account-private-key-file argument is set as appropriate (Not Scored)"
|
||||
remediation: "This control cannot be modified in GKE."
|
||||
scored: false
|
||||
|
||||
- id: 1.3.5
|
||||
text: "Ensure that the --root-ca-file argument is set as appropriate (Not Scored)"
|
||||
remediation: "This control cannot be modified in GKE."
|
||||
scored: false
|
||||
|
||||
- id: 1.3.6
|
||||
text: "Ensure that the RotateKubeletServerCertificate argument is set to true (Not Scored)"
|
||||
remediation: "This control cannot be modified in GKE."
|
||||
scored: false
|
||||
|
||||
- id: 1.3.7
|
||||
text: "Ensure that the --bind-address argument is set to 127.0.0.1 (Not Scored)"
|
||||
remediation: "This control cannot be modified in GKE."
|
||||
scored: false
|
||||
|
||||
- id: 1.4
|
||||
text: "Scheduler"
|
||||
checks:
|
||||
- id: 1.4.1
|
||||
text: "Ensure that the --profiling argument is set to false (Not Scored)"
|
||||
remediation: "This control cannot be modified in GKE."
|
||||
scored: false
|
||||
|
||||
- id: 1.4.2
|
||||
text: "Ensure that the --bind-address argument is set to 127.0.0.1 (Not Scored) "
|
||||
remediation: "This control cannot be modified in GKE."
|
||||
scored: false
|
||||
449
cfg/gke-1.0/node.yaml
Normal file
449
cfg/gke-1.0/node.yaml
Normal file
@@ -0,0 +1,449 @@
|
||||
---
|
||||
controls:
|
||||
version: "gke-1.0"
|
||||
id: 4
|
||||
text: "Worker Node Security Configuration"
|
||||
type: "node"
|
||||
groups:
|
||||
- id: 4.1
|
||||
text: "Worker Node Configuration Files"
|
||||
checks:
|
||||
- id: 4.1.1
|
||||
text: "Ensure that the kubelet service file permissions are set to 644 or more restrictive (Not Scored)"
|
||||
remediation: "This control cannot be modified in GKE."
|
||||
scored: false
|
||||
|
||||
- id: 4.1.2
|
||||
text: "Ensure that the kubelet service file ownership is set to root:root (Not Scored)"
|
||||
remediation: "This control cannot be modified in GKE."
|
||||
scored: false
|
||||
|
||||
- id: 4.1.3
|
||||
text: "Ensure that the proxy kubeconfig file permissions are set to 644 or more restrictive (Scored)"
|
||||
audit: '/bin/sh -c ''if test -e $proxykubeconfig; then stat -c %a $proxykubeconfig; fi'' '
|
||||
tests:
|
||||
test_items:
|
||||
- flag: "644"
|
||||
compare:
|
||||
op: eq
|
||||
value: "644"
|
||||
set: true
|
||||
- flag: "640"
|
||||
compare:
|
||||
op: eq
|
||||
value: "640"
|
||||
set: true
|
||||
- flag: "600"
|
||||
compare:
|
||||
op: eq
|
||||
value: "600"
|
||||
set: true
|
||||
- flag: "444"
|
||||
compare:
|
||||
op: eq
|
||||
value: "444"
|
||||
set: true
|
||||
- flag: "440"
|
||||
compare:
|
||||
op: eq
|
||||
value: "440"
|
||||
set: true
|
||||
- flag: "400"
|
||||
compare:
|
||||
op: eq
|
||||
value: "400"
|
||||
set: true
|
||||
- flag: "000"
|
||||
compare:
|
||||
op: eq
|
||||
value: "000"
|
||||
set: true
|
||||
bin_op: or
|
||||
remediation: |
|
||||
Run the below command (based on the file location on your system) on each worker node.
|
||||
For example,
|
||||
chmod 644 $proykubeconfig
|
||||
scored: true
|
||||
|
||||
- id: 4.1.4
|
||||
text: "Ensure that the proxy kubeconfig file ownership is set to root:root (Scored)"
|
||||
audit: '/bin/sh -c ''if test -e $proxykubeconfig; then stat -c %U:%G $proxykubeconfig; fi'' '
|
||||
tests:
|
||||
test_items:
|
||||
- flag: root:root
|
||||
set: true
|
||||
remediation: |
|
||||
Run the below command (based on the file location on your system) on each worker node.
|
||||
For example, chown root:root $proxykubeconfig
|
||||
scored: true
|
||||
|
||||
- id: 4.1.5
|
||||
text: "Ensure that the kubelet.conf file permissions are set to 644 or more restrictive (Not Scored)"
|
||||
remediation: "This control cannot be modified in GKE."
|
||||
scored: false
|
||||
|
||||
- id: 4.1.6
|
||||
text: "Ensure that the kubelet.conf file ownership is set to root:root (Not Scored)"
|
||||
remediation: "This control cannot be modified in GKE."
|
||||
scored: false
|
||||
|
||||
- id: 4.1.7
|
||||
text: "Ensure that the certificate authorities file permissions are set to 644 or more restrictive (Not Scored)"
|
||||
remediation: "This control cannot be modified in GKE."
|
||||
scored: false
|
||||
|
||||
- id: 4.1.8
|
||||
text: "Ensure that the client certificate authorities file ownership is set to root:root (Not Scored)"
|
||||
remediation: "This control cannot be modified in GKE."
|
||||
scored: false
|
||||
|
||||
- id: 4.1.9
|
||||
text: "Ensure that the kubelet configuration file has permissions set to 644 or more restrictive (Scored)"
|
||||
audit: '/bin/sh -c ''if test -e $kubeletconf; then stat -c %a $kubeletconf; fi'' '
|
||||
tests:
|
||||
test_items:
|
||||
- flag: "644"
|
||||
set: true
|
||||
compare:
|
||||
op: eq
|
||||
value: "644"
|
||||
- flag: "640"
|
||||
set: true
|
||||
compare:
|
||||
op: eq
|
||||
value: "640"
|
||||
- flag: "600"
|
||||
set: true
|
||||
compare:
|
||||
op: eq
|
||||
value: "600"
|
||||
- flag: "444"
|
||||
compare:
|
||||
op: eq
|
||||
value: "444"
|
||||
set: true
|
||||
- flag: "440"
|
||||
compare:
|
||||
op: eq
|
||||
value: "440"
|
||||
set: true
|
||||
- flag: "400"
|
||||
compare:
|
||||
op: eq
|
||||
value: "400"
|
||||
set: true
|
||||
- flag: "000"
|
||||
compare:
|
||||
op: eq
|
||||
value: "000"
|
||||
set: true
|
||||
bin_op: or
|
||||
remediation: |
|
||||
Run the following command (using the config file location identified in the Audit step)
|
||||
chmod 644 $kubeletconf
|
||||
scored: true
|
||||
|
||||
- id: 4.1.10
|
||||
text: "Ensure that the kubelet configuration file ownership is set to root:root (Scored)"
|
||||
audit: '/bin/sh -c ''if test -e $kubeletconf; then stat -c %U:%G $kubeletconf; fi'' '
|
||||
tests:
|
||||
test_items:
|
||||
- flag: root:root
|
||||
set: true
|
||||
remediation: |
|
||||
Run the following command (using the config file location identified in the Audit step)
|
||||
chown root:root $kubeletconf
|
||||
scored: true
|
||||
|
||||
- id: 4.2
|
||||
text: "Kubelet"
|
||||
checks:
|
||||
- id: 4.2.1
|
||||
text: "Ensure that the --anonymous-auth argument is set to false (Scored)"
|
||||
audit: "/bin/ps -fC $kubeletbin"
|
||||
audit_config: "/bin/cat $kubeletconf"
|
||||
tests:
|
||||
test_items:
|
||||
- flag: "--anonymous-auth"
|
||||
path: '{.authentication.anonymous.enabled}'
|
||||
set: true
|
||||
compare:
|
||||
op: eq
|
||||
value: false
|
||||
remediation: |
|
||||
If using a Kubelet config file, edit the file to set authentication: anonymous: enabled to
|
||||
false.
|
||||
If using executable arguments, edit the kubelet service file
|
||||
$kubeletsvc on each worker node and
|
||||
set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable.
|
||||
--anonymous-auth=false
|
||||
Based on your system, restart the kubelet service. For example:
|
||||
systemctl daemon-reload
|
||||
systemctl restart kubelet.service
|
||||
scored: true
|
||||
|
||||
- id: 4.2.2
|
||||
text: "Ensure that the --authorization-mode argument is not set to AlwaysAllow (Scored)"
|
||||
audit: "/bin/ps -fC $kubeletbin"
|
||||
audit_config: "/bin/cat $kubeletconf"
|
||||
tests:
|
||||
test_items:
|
||||
- flag: --authorization-mode
|
||||
path: '{.authorization.mode}'
|
||||
set: true
|
||||
compare:
|
||||
op: nothave
|
||||
value: AlwaysAllow
|
||||
remediation: |
|
||||
If using a Kubelet config file, edit the file to set authorization: mode to Webhook. If
|
||||
using executable arguments, edit the kubelet service file
|
||||
$kubeletsvc on each worker node and
|
||||
set the below parameter in KUBELET_AUTHZ_ARGS variable.
|
||||
--authorization-mode=Webhook
|
||||
Based on your system, restart the kubelet service. For example:
|
||||
systemctl daemon-reload
|
||||
systemctl restart kubelet.service
|
||||
scored: true
|
||||
|
||||
- id: 4.2.3
|
||||
text: "Ensure that the --client-ca-file argument is set as appropriate (Scored)"
|
||||
audit: "/bin/ps -fC $kubeletbin"
|
||||
audit_config: "/bin/cat $kubeletconf"
|
||||
tests:
|
||||
test_items:
|
||||
- flag: --client-ca-file
|
||||
path: '{.authentication.x509.clientCAFile}'
|
||||
set: true
|
||||
remediation: |
|
||||
If using a Kubelet config file, edit the file to set authentication: x509: clientCAFile to
|
||||
the location of the client CA file.
|
||||
If using command line arguments, edit the kubelet service file
|
||||
$kubeletsvc on each worker node and
|
||||
set the below parameter in KUBELET_AUTHZ_ARGS variable.
|
||||
--client-ca-file=<path/to/client-ca-file>
|
||||
Based on your system, restart the kubelet service. For example:
|
||||
systemctl daemon-reload
|
||||
systemctl restart kubelet.service
|
||||
scored: true
|
||||
|
||||
- id: 4.2.4
|
||||
text: "Ensure that the --read-only-port argument is set to 0 (Scored)"
|
||||
audit: "/bin/ps -fC $kubeletbin"
|
||||
audit_config: "/bin/cat $kubeletconf"
|
||||
tests:
|
||||
test_items:
|
||||
- flag: "--read-only-port"
|
||||
path: '{.readOnlyPort}'
|
||||
set: true
|
||||
compare:
|
||||
op: eq
|
||||
value: 0
|
||||
remediation: |
|
||||
If using a Kubelet config file, edit the file to set readOnlyPort to 0.
|
||||
If using command line arguments, edit the kubelet service file
|
||||
$kubeletsvc on each worker node and
|
||||
set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable.
|
||||
--read-only-port=0
|
||||
Based on your system, restart the kubelet service. For example:
|
||||
systemctl daemon-reload
|
||||
systemctl restart kubelet.service
|
||||
scored: true
|
||||
|
||||
- id: 4.2.5
|
||||
text: "Ensure that the --streaming-connection-idle-timeout argument is not set to 0 (Scored)"
|
||||
audit: "/bin/ps -fC $kubeletbin"
|
||||
audit_config: "/bin/cat $kubeletconf"
|
||||
tests:
|
||||
test_items:
|
||||
- flag: --streaming-connection-idle-timeout
|
||||
path: '{.streamingConnectionIdleTimeout}'
|
||||
set: true
|
||||
compare:
|
||||
op: noteq
|
||||
value: 0
|
||||
- flag: --streaming-connection-idle-timeout
|
||||
path: '{.streamingConnectionIdleTimeout}'
|
||||
set: false
|
||||
bin_op: or
|
||||
remediation: |
|
||||
If using a Kubelet config file, edit the file to set streamingConnectionIdleTimeout to a
|
||||
value other than 0.
|
||||
If using command line arguments, edit the kubelet service file
|
||||
$kubeletsvc on each worker node and
|
||||
set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable.
|
||||
--streaming-connection-idle-timeout=5m
|
||||
Based on your system, restart the kubelet service. For example:
|
||||
systemctl daemon-reload
|
||||
systemctl restart kubelet.service
|
||||
scored: true
|
||||
|
||||
- id: 4.2.6
|
||||
text: "Ensure that the --protect-kernel-defaults argument is set to true (Scored)"
|
||||
audit: "/bin/ps -fC $kubeletbin"
|
||||
audit_config: "/bin/cat $kubeletconf"
|
||||
tests:
|
||||
test_items:
|
||||
- flag: --protect-kernel-defaults
|
||||
path: '{.protectKernelDefaults}'
|
||||
set: true
|
||||
compare:
|
||||
op: eq
|
||||
value: true
|
||||
remediation: |
|
||||
If using a Kubelet config file, edit the file to set protectKernelDefaults: true.
|
||||
If using command line arguments, edit the kubelet service file
|
||||
$kubeletsvc on each worker node and
|
||||
set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable.
|
||||
--protect-kernel-defaults=true
|
||||
Based on your system, restart the kubelet service. For example:
|
||||
systemctl daemon-reload
|
||||
systemctl restart kubelet.service
|
||||
scored: true
|
||||
|
||||
- id: 4.2.7
|
||||
text: "Ensure that the --make-iptables-util-chains argument is set to true (Scored) "
|
||||
audit: "/bin/ps -fC $kubeletbin"
|
||||
audit_config: "/bin/cat $kubeletconf"
|
||||
tests:
|
||||
test_items:
|
||||
- flag: --make-iptables-util-chains
|
||||
path: '{.makeIPTablesUtilChains}'
|
||||
set: true
|
||||
compare:
|
||||
op: eq
|
||||
value: true
|
||||
- flag: --make-iptables-util-chains
|
||||
path: '{.makeIPTablesUtilChains}'
|
||||
set: false
|
||||
bin_op: or
|
||||
remediation: |
|
||||
If using a Kubelet config file, edit the file to set makeIPTablesUtilChains: true.
|
||||
If using command line arguments, edit the kubelet service file
|
||||
$kubeletsvc on each worker node and
|
||||
remove the --make-iptables-util-chains argument from the
|
||||
KUBELET_SYSTEM_PODS_ARGS variable.
|
||||
Based on your system, restart the kubelet service. For example:
|
||||
systemctl daemon-reload
|
||||
systemctl restart kubelet.service
|
||||
scored: true
|
||||
|
||||
- id: 4.2.8
|
||||
text: "Ensure that the --hostname-override argument is not set (Scored)"
|
||||
# This is one of those properties that can only be set as a command line argument.
|
||||
# To check if the property is set as expected, we need to parse the kubelet command
|
||||
# instead reading the Kubelet Configuration file.
|
||||
audit: "/bin/ps -fC $kubeletbin "
|
||||
tests:
|
||||
test_items:
|
||||
- flag: --hostname-override
|
||||
set: false
|
||||
remediation: |
|
||||
Edit the kubelet service file $kubeletsvc
|
||||
on each worker node and remove the --hostname-override argument from the
|
||||
KUBELET_SYSTEM_PODS_ARGS variable.
|
||||
Based on your system, restart the kubelet service. For example:
|
||||
systemctl daemon-reload
|
||||
systemctl restart kubelet.service
|
||||
scored: true
|
||||
|
||||
- id: 4.2.9
|
||||
text: "Ensure that the --event-qps argument is set to 0 or a level which ensures appropriate event capture (Scored)"
|
||||
audit: "/bin/ps -fC $kubeletbin"
|
||||
audit_config: "/bin/cat $kubeletconf"
|
||||
tests:
|
||||
test_items:
|
||||
- flag: --event-qps
|
||||
path: '{.eventRecordQPS}'
|
||||
set: true
|
||||
compare:
|
||||
op: eq
|
||||
value: 0
|
||||
remediation: |
|
||||
If using a Kubelet config file, edit the file to set eventRecordQPS: to an appropriate level.
|
||||
If using command line arguments, edit the kubelet service file
|
||||
$kubeletsvc on each worker node and
|
||||
set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable.
|
||||
Based on your system, restart the kubelet service. For example:
|
||||
systemctl daemon-reload
|
||||
systemctl restart kubelet.service
|
||||
scored: true
|
||||
|
||||
- id: 4.2.10
|
||||
text: "Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate (Scored)"
|
||||
audit: "/bin/ps -fC $kubeletbin"
|
||||
audit_config: "/bin/cat $kubeletconf"
|
||||
tests:
|
||||
test_items:
|
||||
- flag: --tls-cert-file
|
||||
path: '{.tlsCertFile}'
|
||||
set: true
|
||||
- flag: --tls-private-key-file
|
||||
path: '{.tlsPrivateKeyFile}'
|
||||
set: true
|
||||
remediation: |
|
||||
If using a Kubelet config file, edit the file to set tlsCertFile to the location
|
||||
of the certificate file to use to identify this Kubelet, and tlsPrivateKeyFile
|
||||
to the location of the corresponding private key file.
|
||||
If using command line arguments, edit the kubelet service file
|
||||
$kubeletsvc on each worker node and
|
||||
set the below parameters in KUBELET_CERTIFICATE_ARGS variable.
|
||||
--tls-cert-file=<path/to/tls-certificate-file>
|
||||
--tls-private-key-file=<path/to/tls-key-file>
|
||||
Based on your system, restart the kubelet service. For example:
|
||||
systemctl daemon-reload
|
||||
systemctl restart kubelet.service
|
||||
scored: true
|
||||
|
||||
- id: 4.2.11
|
||||
text: "Ensure that the --rotate-certificates argument is not set to false (Scored)"
|
||||
audit: "/bin/ps -fC $kubeletbin"
|
||||
audit_config: "/bin/cat $kubeletconf"
|
||||
tests:
|
||||
test_items:
|
||||
- flag: --rotate-certificates
|
||||
path: '{.rotateCertificates}'
|
||||
set: true
|
||||
compare:
|
||||
op: eq
|
||||
value: true
|
||||
- flag: --rotate-certificates
|
||||
path: '{.rotateCertificates}'
|
||||
set: false
|
||||
bin_op: or
|
||||
remediation: |
|
||||
If using a Kubelet config file, edit the file to add the line rotateCertificates: true or
|
||||
remove it altogether to use the default value.
|
||||
If using command line arguments, edit the kubelet service file
|
||||
$kubeletsvc on each worker node and
|
||||
remove --rotate-certificates=false argument from the KUBELET_CERTIFICATE_ARGS
|
||||
variable.
|
||||
Based on your system, restart the kubelet service. For example:
|
||||
systemctl daemon-reload
|
||||
systemctl restart kubelet.service
|
||||
scored: true
|
||||
|
||||
- id: 4.2.12
|
||||
text: "Ensure that the RotateKubeletServerCertificate argument is set to true (Scored)"
|
||||
audit: "/bin/ps -fC $kubeletbin"
|
||||
audit_config: "/bin/cat $kubeletconf"
|
||||
tests:
|
||||
test_items:
|
||||
- flag: RotateKubeletServerCertificate
|
||||
path: '{.featureGates.RotateKubeletServerCertificate}'
|
||||
set: true
|
||||
compare:
|
||||
op: eq
|
||||
value: true
|
||||
remediation: |
|
||||
Edit the kubelet service file $kubeletsvc
|
||||
on each worker node and set the below parameter in KUBELET_CERTIFICATE_ARGS variable.
|
||||
--feature-gates=RotateKubeletServerCertificate=true
|
||||
Based on your system, restart the kubelet service. For example:
|
||||
systemctl daemon-reload
|
||||
systemctl restart kubelet.service
|
||||
scored: true
|
||||
|
||||
- id: 4.2.13
|
||||
text: "Ensure that the Kubelet only makes use of Strong Cryptographic Ciphers (Not Scored)"
|
||||
remediation: "This control cannot be modified in GKE."
|
||||
scored: false
|
||||
239
cfg/gke-1.0/policies.yaml
Normal file
239
cfg/gke-1.0/policies.yaml
Normal file
@@ -0,0 +1,239 @@
|
||||
---
|
||||
controls:
|
||||
version: "gke-1.0"
|
||||
id: 5
|
||||
text: "Kubernetes Policies"
|
||||
type: "policies"
|
||||
groups:
|
||||
- id: 5.1
|
||||
text: "RBAC and Service Accounts"
|
||||
checks:
|
||||
- id: 5.1.1
|
||||
text: "Ensure that the cluster-admin role is only used where required (Not Scored)"
|
||||
type: "manual"
|
||||
remediation: |
|
||||
Identify all clusterrolebindings to the cluster-admin role. Check if they are used and
|
||||
if they need this role or if they could use a role with fewer privileges.
|
||||
Where possible, first bind users to a lower privileged role and then remove the
|
||||
clusterrolebinding to the cluster-admin role :
|
||||
kubectl delete clusterrolebinding [name]
|
||||
scored: false
|
||||
|
||||
- id: 5.1.2
|
||||
text: "Minimize access to secrets (Not Scored)"
|
||||
type: "manual"
|
||||
remediation: |
|
||||
Where possible, remove get, list and watch access to secret objects in the cluster.
|
||||
scored: false
|
||||
|
||||
- id: 5.1.3
|
||||
text: "Minimize wildcard use in Roles and ClusterRoles (Not Scored)"
|
||||
type: "manual"
|
||||
remediation: |
|
||||
Where possible replace any use of wildcards in clusterroles and roles with specific
|
||||
objects or actions.
|
||||
scored: false
|
||||
|
||||
- id: 5.1.4
|
||||
text: "Minimize access to create pods (Not Scored)"
|
||||
type: "manual"
|
||||
Remediation: |
|
||||
Where possible, remove create access to pod objects in the cluster.
|
||||
scored: false
|
||||
|
||||
- id: 5.1.5
|
||||
text: "Ensure that default service accounts are not actively used. (Scored)"
|
||||
type: "manual"
|
||||
remediation: |
|
||||
Create explicit service accounts wherever a Kubernetes workload requires specific access
|
||||
to the Kubernetes API server.
|
||||
Modify the configuration of each default service account to include this value
|
||||
automountServiceAccountToken: false
|
||||
scored: true
|
||||
|
||||
- id: 5.1.6
|
||||
text: "Ensure that Service Account Tokens are only mounted where necessary (Not Scored)"
|
||||
type: "manual"
|
||||
remediation: |
|
||||
Modify the definition of pods and service accounts which do not need to mount service
|
||||
account tokens to disable it.
|
||||
scored: false
|
||||
|
||||
- id: 5.2
|
||||
text: "Pod Security Policies"
|
||||
checks:
|
||||
- id: 5.2.1
|
||||
text: "Minimize the admission of privileged containers (Not Scored)"
|
||||
type: "manual"
|
||||
remediation: |
|
||||
Create a PSP as described in the Kubernetes documentation, ensuring that
|
||||
the .spec.privileged field is omitted or set to false.
|
||||
scored: false
|
||||
|
||||
- id: 5.2.2
|
||||
text: "Minimize the admission of containers wishing to share the host process ID namespace (Scored)"
|
||||
type: "manual"
|
||||
remediation: |
|
||||
Create a PSP as described in the Kubernetes documentation, ensuring that the
|
||||
.spec.hostPID field is omitted or set to false.
|
||||
scored: true
|
||||
|
||||
- id: 5.2.3
|
||||
text: "Minimize the admission of containers wishing to share the host IPC namespace (Scored)"
|
||||
type: "manual"
|
||||
remediation: |
|
||||
Create a PSP as described in the Kubernetes documentation, ensuring that the
|
||||
.spec.hostIPC field is omitted or set to false.
|
||||
scored: true
|
||||
|
||||
- id: 5.2.4
|
||||
text: "Minimize the admission of containers wishing to share the host network namespace (Scored)"
|
||||
type: "manual"
|
||||
remediation: |
|
||||
Create a PSP as described in the Kubernetes documentation, ensuring that the
|
||||
.spec.hostNetwork field is omitted or set to false.
|
||||
scored: true
|
||||
|
||||
- id: 5.2.5
|
||||
text: "Minimize the admission of containers with allowPrivilegeEscalation (Scored)"
|
||||
type: "manual"
|
||||
remediation: |
|
||||
Create a PSP as described in the Kubernetes documentation, ensuring that the
|
||||
.spec.allowPrivilegeEscalation field is omitted or set to false.
|
||||
scored: true
|
||||
|
||||
- id: 5.2.6
|
||||
text: "Minimize the admission of root containers (Scored)"
|
||||
type: "manual"
|
||||
remediation: |
|
||||
Create a PSP as described in the Kubernetes documentation, ensuring that the
|
||||
.spec.runAsUser.rule is set to either MustRunAsNonRoot or MustRunAs with the range of
|
||||
UIDs not including 0.
|
||||
scored: true
|
||||
|
||||
- id: 5.2.7
|
||||
text: "Minimize the admission of containers with the NET_RAW capability (Scored)"
|
||||
type: "manual"
|
||||
remediation: |
|
||||
Create a PSP as described in the Kubernetes documentation, ensuring that the
|
||||
.spec.requiredDropCapabilities is set to include either NET_RAW or ALL.
|
||||
scored: true
|
||||
|
||||
- id: 5.2.8
|
||||
text: "Minimize the admission of containers with added capabilities (Scored)"
|
||||
type: "manual"
|
||||
remediation: |
|
||||
Ensure that allowedCapabilities is not present in PSPs for the cluster unless
|
||||
it is set to an empty array.
|
||||
scored: true
|
||||
|
||||
- id: 5.2.9
|
||||
text: "Minimize the admission of containers with capabilities assigned (Scored) "
|
||||
type: "manual"
|
||||
remediation: |
|
||||
Review the use of capabilites in applications runnning on your cluster. Where a namespace
|
||||
contains applications which do not require any Linux capabities to operate consider adding
|
||||
a PSP which forbids the admission of containers which do not drop all capabilities.
|
||||
scored: true
|
||||
|
||||
- id: 5.3
|
||||
text: "Network Policies and CNI"
|
||||
checks:
|
||||
- id: 5.3.1
|
||||
text: "Ensure that the CNI in use supports Network Policies (Not Scored)"
|
||||
type: "manual"
|
||||
remediation: |
|
||||
To use a CNI plugin with Network Policy, enable Network Policy in GKE, and the CNI plugin
|
||||
will be updated. See Recommendation 6.6.7.
|
||||
scored: false
|
||||
|
||||
- id: 5.3.2
|
||||
text: "Ensure that all Namespaces have Network Policies defined (Scored)"
|
||||
type: "manual"
|
||||
remediation: |
|
||||
Follow the documentation and create NetworkPolicy objects as you need them.
|
||||
scored: true
|
||||
|
||||
- id: 5.4
|
||||
text: "Secrets Management"
|
||||
checks:
|
||||
- id: 5.4.1
|
||||
text: "Prefer using secrets as files over secrets as environment variables (Not Scored)"
|
||||
type: "manual"
|
||||
remediation: |
|
||||
if possible, rewrite application code to read secrets from mounted secret files, rather than
|
||||
from environment variables.
|
||||
scored: false
|
||||
|
||||
- id: 5.4.2
|
||||
text: "Consider external secret storage (Not Scored)"
|
||||
type: "manual"
|
||||
remediation: |
|
||||
Refer to the secrets management options offered by your cloud provider or a third-party
|
||||
secrets management solution.
|
||||
scored: false
|
||||
|
||||
- id: 5.5
|
||||
text: "Extensible Admission Control"
|
||||
checks:
|
||||
- id: 5.5.1
|
||||
text: "Configure Image Provenance using ImagePolicyWebhook admission controller (Not Scored)"
|
||||
type: "manual"
|
||||
remediation: |
|
||||
Follow the Kubernetes documentation and setup image provenance.
|
||||
See also Recommendation 6.10.5 for GKE specifically.
|
||||
scored: false
|
||||
|
||||
- id: 5.6
|
||||
text: "General Policies"
|
||||
checks:
|
||||
- id: 5.6.1
|
||||
text: "Create administrative boundaries between resources using namespaces (Not Scored)"
|
||||
type: "manual"
|
||||
remediation: |
|
||||
Follow the documentation and create namespaces for objects in your deployment as you need
|
||||
them.
|
||||
scored: false
|
||||
|
||||
- id: 5.6.2
|
||||
text: "Ensure that the seccomp profile is set to docker/default in your pod definitions (Not Scored)"
|
||||
type: "manual"
|
||||
remediation: |
|
||||
Seccomp is an alpha feature currently. By default, all alpha features are disabled. So, you
|
||||
would need to enable alpha features in the apiserver by passing "--feature-
|
||||
gates=AllAlpha=true" argument.
|
||||
Edit the /etc/kubernetes/apiserver file on the master node and set the KUBE_API_ARGS
|
||||
parameter to "--feature-gates=AllAlpha=true"
|
||||
KUBE_API_ARGS="--feature-gates=AllAlpha=true"
|
||||
Based on your system, restart the kube-apiserver service. For example:
|
||||
systemctl restart kube-apiserver.service
|
||||
Use annotations to enable the docker/default seccomp profile in your pod definitions. An
|
||||
example is as below:
|
||||
apiVersion: v1
|
||||
kind: Pod
|
||||
metadata:
|
||||
name: trustworthy-pod
|
||||
annotations:
|
||||
seccomp.security.alpha.kubernetes.io/pod: docker/default
|
||||
spec:
|
||||
containers:
|
||||
- name: trustworthy-container
|
||||
image: sotrustworthy:latest
|
||||
scored: false
|
||||
|
||||
- id: 5.6.3
|
||||
text: "Apply Security Context to Your Pods and Containers (Not Scored)"
|
||||
type: "manual"
|
||||
remediation: |
|
||||
Follow the Kubernetes documentation and apply security contexts to your pods. For a
|
||||
suggested list of security contexts, you may refer to the CIS Security Benchmark for Docker
|
||||
Containers.
|
||||
scored: false
|
||||
|
||||
- id: 5.6.4
|
||||
text: "The default namespace should not be used (Scored)"
|
||||
type: "manual"
|
||||
remediation: |
|
||||
Ensure that namespaces are created to allow for appropriate segregation of Kubernetes
|
||||
resources and that all new resources are created in a specific namespace.
|
||||
scored: true
|
||||
@@ -29,8 +29,10 @@ node:
|
||||
- "/etc/kubernetes/kubelet-kubeconfig"
|
||||
confs:
|
||||
- "/var/lib/kubelet/config.yaml"
|
||||
- "/var/lib/kubelet/config.yml"
|
||||
- "/etc/kubernetes/kubelet/kubelet-config.json"
|
||||
- "/home/kubernetes/kubelet-config.yaml"
|
||||
- "/home/kubernetes/kubelet-config.yml"
|
||||
- "/etc/default/kubelet"
|
||||
## Due to the fact that the kubelet might be configured
|
||||
## without a kubelet-config file, we use a work-around
|
||||
|
||||
@@ -815,12 +815,12 @@ groups:
|
||||
checks:
|
||||
- id: 4.1
|
||||
text: "Verify the OpenShift default permissions for the API server pod specification file"
|
||||
audit: "stat -c %a /etc/origin/node/pods/apiserver.yaml"
|
||||
audit: "stat -c permissions=%a /etc/origin/node/pods/apiserver.yaml"
|
||||
tests:
|
||||
test_items:
|
||||
- flag: "600"
|
||||
- flag: "permissions"
|
||||
compare:
|
||||
op: eq
|
||||
op: bitmask
|
||||
value: "600"
|
||||
set: true
|
||||
remediation: |
|
||||
@@ -847,12 +847,12 @@ groups:
|
||||
|
||||
- id: 4.3
|
||||
text: "Verify the OpenShift default file permissions for the controller manager pod specification file"
|
||||
audit: "stat -c %a /etc/origin/node/pods/controller.yaml"
|
||||
audit: "stat -c permissions=%a /etc/origin/node/pods/controller.yaml"
|
||||
tests:
|
||||
test_items:
|
||||
- flag: "600"
|
||||
- flag: "permissions"
|
||||
compare:
|
||||
op: eq
|
||||
op: bitmask
|
||||
value: "600"
|
||||
set: true
|
||||
remediation: |
|
||||
@@ -879,18 +879,18 @@ groups:
|
||||
|
||||
- id: 4.5
|
||||
text: "Verify the OpenShift default permissions for the scheduler pod specification file"
|
||||
audit: "stat -c %a /etc/origin/node/pods/controller.yaml"
|
||||
audit: "stat -c permissions=%a /etc/origin/node/pods/controller.yaml"
|
||||
tests:
|
||||
test_items:
|
||||
- flag: "600"
|
||||
- flag: "permissions"
|
||||
compare:
|
||||
op: eq
|
||||
op: bitmask
|
||||
value: "600"
|
||||
set: true
|
||||
remediation: |
|
||||
Run the below command.
|
||||
|
||||
chmod 600 stat -c %a /etc/origin/node/pods/controller.yaml
|
||||
chmod 600 stat -c permissions=%a /etc/origin/node/pods/controller.yaml
|
||||
scored: true
|
||||
|
||||
- id: 4.6
|
||||
@@ -911,12 +911,12 @@ groups:
|
||||
|
||||
- id: 4.7
|
||||
text: "Verify the OpenShift default etcd pod specification file permissions"
|
||||
audit: "stat -c %a /etc/origin/node/pods/etcd.yaml"
|
||||
audit: "stat -c permissions=%a /etc/origin/node/pods/etcd.yaml"
|
||||
tests:
|
||||
test_items:
|
||||
- flag: "600"
|
||||
- flag: "permissions"
|
||||
compare:
|
||||
op: eq
|
||||
op: bitmask
|
||||
value: "600"
|
||||
set: true
|
||||
remediation: |
|
||||
@@ -943,45 +943,14 @@ groups:
|
||||
|
||||
- id: 4.9
|
||||
text: "Verify the default OpenShift Container Network Interface file permissions"
|
||||
audit: "stat -c %a /etc/origin/openvswitch/ /etc/cni/net.d/"
|
||||
audit: "stat -c permissions=%a /etc/origin/openvswitch/ /etc/cni/net.d/"
|
||||
tests:
|
||||
bin_op: or
|
||||
test_items:
|
||||
- flag: "644"
|
||||
- flag: "permissions"
|
||||
compare:
|
||||
op: eq
|
||||
op: bitmask
|
||||
value: "644"
|
||||
set: true
|
||||
- flag: "640"
|
||||
compare:
|
||||
op: eq
|
||||
value: "640"
|
||||
set: true
|
||||
- flag: "600"
|
||||
compare:
|
||||
op: eq
|
||||
value: "600"
|
||||
set: true
|
||||
- flag: "444"
|
||||
compare:
|
||||
op: eq
|
||||
value: "444"
|
||||
set: true
|
||||
- flag: "440"
|
||||
compare:
|
||||
op: eq
|
||||
value: "440"
|
||||
set: true
|
||||
- flag: "400"
|
||||
compare:
|
||||
op: eq
|
||||
value: "400"
|
||||
set: true
|
||||
- flag: "000"
|
||||
compare:
|
||||
op: eq
|
||||
value: "000"
|
||||
set: true
|
||||
remediation: |
|
||||
Run the below command.
|
||||
|
||||
@@ -1006,12 +975,12 @@ groups:
|
||||
|
||||
- id: 4.11
|
||||
text: "Verify the default OpenShift etcd data directory permissions"
|
||||
audit: "stat -c %a /var/lib/etcd"
|
||||
audit: "stat -c permissions=%a /var/lib/etcd"
|
||||
tests:
|
||||
test_items:
|
||||
- flag: "700"
|
||||
- flag: "permissions"
|
||||
compare:
|
||||
op: eq
|
||||
op: bitmask
|
||||
value: "700"
|
||||
set: true
|
||||
remediation: |
|
||||
@@ -1040,45 +1009,14 @@ groups:
|
||||
|
||||
- id: 4.13
|
||||
text: "Verify the default OpenShift admin.conf file permissions"
|
||||
audit: "stat -c %a /etc/origin/master/admin.kubeconfig"
|
||||
audit: "stat -c permissions=%a /etc/origin/master/admin.kubeconfig"
|
||||
tests:
|
||||
bin_op: or
|
||||
test_items:
|
||||
- flag: "644"
|
||||
- flag: "permissions"
|
||||
compare:
|
||||
op: eq
|
||||
op: bitmask
|
||||
value: "644"
|
||||
set: true
|
||||
- flag: "640"
|
||||
compare:
|
||||
op: eq
|
||||
value: "640"
|
||||
set: true
|
||||
- flag: "600"
|
||||
compare:
|
||||
op: eq
|
||||
value: "600"
|
||||
set: true
|
||||
- flag: "444"
|
||||
compare:
|
||||
op: eq
|
||||
value: "444"
|
||||
set: true
|
||||
- flag: "440"
|
||||
compare:
|
||||
op: eq
|
||||
value: "440"
|
||||
set: true
|
||||
- flag: "400"
|
||||
compare:
|
||||
op: eq
|
||||
value: "400"
|
||||
set: true
|
||||
- flag: "000"
|
||||
compare:
|
||||
op: eq
|
||||
value: "000"
|
||||
set: true
|
||||
remediation: |
|
||||
Run the below command.
|
||||
|
||||
@@ -1103,45 +1041,14 @@ groups:
|
||||
|
||||
- id: 4.15
|
||||
text: "Verify the default OpenShift scheduler.conf file permissions"
|
||||
audit: "stat -c %a /etc/origin/master/openshift-master.kubeconfig"
|
||||
audit: "stat -c permissions=%a /etc/origin/master/openshift-master.kubeconfig"
|
||||
tests:
|
||||
bin_op: or
|
||||
test_items:
|
||||
- flag: "644"
|
||||
- flag: "permissions"
|
||||
compare:
|
||||
op: eq
|
||||
op: bitmask
|
||||
value: "644"
|
||||
set: true
|
||||
- flag: "640"
|
||||
compare:
|
||||
op: eq
|
||||
value: "640"
|
||||
set: true
|
||||
- flag: "600"
|
||||
compare:
|
||||
op: eq
|
||||
value: "600"
|
||||
set: true
|
||||
- flag: "444"
|
||||
compare:
|
||||
op: eq
|
||||
value: "444"
|
||||
set: true
|
||||
- flag: "440"
|
||||
compare:
|
||||
op: eq
|
||||
value: "440"
|
||||
set: true
|
||||
- flag: "400"
|
||||
compare:
|
||||
op: eq
|
||||
value: "400"
|
||||
set: true
|
||||
- flag: "000"
|
||||
compare:
|
||||
op: eq
|
||||
value: "000"
|
||||
set: true
|
||||
remediation: |
|
||||
Run the below command.
|
||||
|
||||
@@ -1166,45 +1073,14 @@ groups:
|
||||
|
||||
- id: 4.17
|
||||
text: "Verify the default Openshift controller-manager.conf file permissions"
|
||||
audit: "stat -c %a /etc/origin/master/openshift-master.kubeconfig"
|
||||
audit: "stat -c permissions=%a /etc/origin/master/openshift-master.kubeconfig"
|
||||
tests:
|
||||
bin_op: or
|
||||
test_items:
|
||||
- flag: "644"
|
||||
- flag: "permissions"
|
||||
compare:
|
||||
op: eq
|
||||
op: bitmask
|
||||
value: "644"
|
||||
set: true
|
||||
- flag: "640"
|
||||
compare:
|
||||
op: eq
|
||||
value: "640"
|
||||
set: true
|
||||
- flag: "600"
|
||||
compare:
|
||||
op: eq
|
||||
value: "600"
|
||||
set: true
|
||||
- flag: "444"
|
||||
compare:
|
||||
op: eq
|
||||
value: "444"
|
||||
set: true
|
||||
- flag: "440"
|
||||
compare:
|
||||
op: eq
|
||||
value: "440"
|
||||
set: true
|
||||
- flag: "400"
|
||||
compare:
|
||||
op: eq
|
||||
value: "400"
|
||||
set: true
|
||||
- flag: "000"
|
||||
compare:
|
||||
op: eq
|
||||
value: "000"
|
||||
set: true
|
||||
remediation: |
|
||||
Run the below command.
|
||||
|
||||
|
||||
@@ -213,45 +213,14 @@ groups:
|
||||
checks:
|
||||
- id: 8.1
|
||||
text: "Verify the OpenShift default permissions for the kubelet.conf file"
|
||||
audit: "stat -c %a /etc/origin/node/node.kubeconfig"
|
||||
audit: "stat -c permissions=%a /etc/origin/node/node.kubeconfig"
|
||||
tests:
|
||||
bin_op: or
|
||||
test_items:
|
||||
- flag: "644"
|
||||
- flag: "permissions"
|
||||
compare:
|
||||
op: eq
|
||||
op: bitmask
|
||||
value: "644"
|
||||
set: true
|
||||
- flag: "640"
|
||||
compare:
|
||||
op: eq
|
||||
value: "640"
|
||||
set: true
|
||||
- flag: "600"
|
||||
compare:
|
||||
op: eq
|
||||
value: "600"
|
||||
set: true
|
||||
- flag: "444"
|
||||
compare:
|
||||
op: eq
|
||||
value: "444"
|
||||
set: true
|
||||
- flag: "440"
|
||||
compare:
|
||||
op: eq
|
||||
value: "440"
|
||||
set: true
|
||||
- flag: "400"
|
||||
compare:
|
||||
op: eq
|
||||
value: "400"
|
||||
set: true
|
||||
- flag: "000"
|
||||
compare:
|
||||
op: eq
|
||||
value: "000"
|
||||
set: true
|
||||
remediation: |
|
||||
Run the below command on each worker node.
|
||||
chmod 644 /etc/origin/node/node.kubeconfig
|
||||
@@ -274,45 +243,14 @@ groups:
|
||||
|
||||
- id: 8.3
|
||||
text: "Verify the kubelet service file permissions of 644"
|
||||
audit: "stat -c %a $nodesvc"
|
||||
audit: "stat -c permissions=%a $nodesvc"
|
||||
tests:
|
||||
bin_op: or
|
||||
test_items:
|
||||
- flag: "644"
|
||||
- flag: "permissions"
|
||||
compare:
|
||||
op: eq
|
||||
op: bitmask
|
||||
value: "644"
|
||||
set: true
|
||||
- flag: "640"
|
||||
compare:
|
||||
op: eq
|
||||
value: "640"
|
||||
set: true
|
||||
- flag: "600"
|
||||
compare:
|
||||
op: eq
|
||||
value: "600"
|
||||
set: true
|
||||
- flag: "444"
|
||||
compare:
|
||||
op: eq
|
||||
value: "444"
|
||||
set: true
|
||||
- flag: "440"
|
||||
compare:
|
||||
op: eq
|
||||
value: "440"
|
||||
set: true
|
||||
- flag: "400"
|
||||
compare:
|
||||
op: eq
|
||||
value: "400"
|
||||
set: true
|
||||
- flag: "000"
|
||||
compare:
|
||||
op: eq
|
||||
value: "000"
|
||||
set: true
|
||||
remediation: |
|
||||
Run the below command on each worker node.
|
||||
chmod 644 $nodesvc
|
||||
@@ -335,45 +273,14 @@ groups:
|
||||
|
||||
- id: 8.5
|
||||
text: "Verify the OpenShift default permissions for the proxy kubeconfig file"
|
||||
audit: "stat -c %a /etc/origin/node/node.kubeconfig"
|
||||
audit: "stat -c permissions=%a /etc/origin/node/node.kubeconfig"
|
||||
tests:
|
||||
bin_op: or
|
||||
test_items:
|
||||
- flag: "644"
|
||||
- flag: "permissions"
|
||||
compare:
|
||||
op: eq
|
||||
op: bitmask
|
||||
value: "644"
|
||||
set: true
|
||||
- flag: "640"
|
||||
compare:
|
||||
op: eq
|
||||
value: "640"
|
||||
set: true
|
||||
- flag: "600"
|
||||
compare:
|
||||
op: eq
|
||||
value: "600"
|
||||
set: true
|
||||
- flag: "444"
|
||||
compare:
|
||||
op: eq
|
||||
value: "444"
|
||||
set: true
|
||||
- flag: "440"
|
||||
compare:
|
||||
op: eq
|
||||
value: "440"
|
||||
set: true
|
||||
- flag: "400"
|
||||
compare:
|
||||
op: eq
|
||||
value: "400"
|
||||
set: true
|
||||
- flag: "000"
|
||||
compare:
|
||||
op: eq
|
||||
value: "000"
|
||||
set: true
|
||||
remediation: |
|
||||
Run the below command on each worker node.
|
||||
chmod 644 /etc/origin/node/node.kubeconfig
|
||||
@@ -396,45 +303,14 @@ groups:
|
||||
|
||||
- id: 8.7
|
||||
text: "Verify the OpenShift default permissions for the certificate authorities file."
|
||||
audit: "stat -c %a /etc/origin/node/client-ca.crt"
|
||||
audit: "stat -c permissions=%a /etc/origin/node/client-ca.crt"
|
||||
tests:
|
||||
bin_op: or
|
||||
test_items:
|
||||
- flag: "644"
|
||||
- flag: "permissions"
|
||||
compare:
|
||||
op: eq
|
||||
op: bitmask
|
||||
value: "644"
|
||||
set: true
|
||||
- flag: "640"
|
||||
compare:
|
||||
op: eq
|
||||
value: "640"
|
||||
set: true
|
||||
- flag: "600"
|
||||
compare:
|
||||
op: eq
|
||||
value: "600"
|
||||
set: true
|
||||
- flag: "444"
|
||||
compare:
|
||||
op: eq
|
||||
value: "444"
|
||||
set: true
|
||||
- flag: "440"
|
||||
compare:
|
||||
op: eq
|
||||
value: "440"
|
||||
set: true
|
||||
- flag: "400"
|
||||
compare:
|
||||
op: eq
|
||||
value: "400"
|
||||
set: true
|
||||
- flag: "000"
|
||||
compare:
|
||||
op: eq
|
||||
value: "000"
|
||||
set: true
|
||||
remediation: |
|
||||
Run the below command on each worker node.
|
||||
chmod 644 /etc/origin/node/client-ca.crt
|
||||
|
||||
180
check/check.go
180
check/check.go
@@ -17,10 +17,7 @@ package check
|
||||
import (
|
||||
"bytes"
|
||||
"fmt"
|
||||
"io"
|
||||
"os"
|
||||
"os/exec"
|
||||
"regexp"
|
||||
"strings"
|
||||
|
||||
"github.com/golang/glog"
|
||||
@@ -55,6 +52,8 @@ const (
|
||||
CONTROLPLANE NodeType = "controlplane"
|
||||
// POLICIES a node to run policies from
|
||||
POLICIES NodeType = "policies"
|
||||
// MANAGEDSERVICES a node to run managedservices from
|
||||
MANAGEDSERVICES = "managedservices"
|
||||
|
||||
// MANUAL Check Type
|
||||
MANUAL string = "manual"
|
||||
@@ -63,21 +62,20 @@ const (
|
||||
// Check contains information about a recommendation in the
|
||||
// CIS Kubernetes document.
|
||||
type Check struct {
|
||||
ID string `yaml:"id" json:"test_number"`
|
||||
Text string `json:"test_desc"`
|
||||
Audit string `json:"audit"`
|
||||
AuditConfig string `yaml:"audit_config"`
|
||||
Type string `json:"type"`
|
||||
Commands []*exec.Cmd `json:"omit"`
|
||||
ConfigCommands []*exec.Cmd `json:"omit"`
|
||||
Tests *tests `json:"omit"`
|
||||
Set bool `json:"omit"`
|
||||
Remediation string `json:"remediation"`
|
||||
TestInfo []string `json:"test_info"`
|
||||
ID string `yaml:"id" json:"test_number"`
|
||||
Text string `json:"test_desc"`
|
||||
Audit string `json:"audit"`
|
||||
AuditConfig string `yaml:"audit_config"`
|
||||
Type string `json:"type"`
|
||||
Tests *tests `json:"omit"`
|
||||
Set bool `json:"omit"`
|
||||
Remediation string `json:"remediation"`
|
||||
TestInfo []string `json:"test_info"`
|
||||
State `json:"status"`
|
||||
ActualValue string `json:"actual_value"`
|
||||
Scored bool `json:"scored"`
|
||||
ExpectedResult string `json:"expected_result"`
|
||||
Reason string `json:"reason,omitempty"`
|
||||
}
|
||||
|
||||
// Runner wraps the basic Run method.
|
||||
@@ -105,27 +103,31 @@ func (c *Check) run() State {
|
||||
// without tests return a 'WARN' to alert
|
||||
// the user that this check needs attention
|
||||
if c.Scored && len(strings.TrimSpace(c.Type)) == 0 && c.Tests == nil {
|
||||
c.Reason = "There are no tests"
|
||||
c.State = WARN
|
||||
return c.State
|
||||
}
|
||||
|
||||
// If check type is skip, force result to INFO
|
||||
if c.Type == "skip" {
|
||||
c.Reason = "Test marked as skip"
|
||||
c.State = INFO
|
||||
return c.State
|
||||
}
|
||||
|
||||
// If check type is manual force result to WARN
|
||||
if c.Type == MANUAL {
|
||||
c.Reason = "Test marked as a manual test"
|
||||
c.State = WARN
|
||||
return c.State
|
||||
}
|
||||
|
||||
lastCommand := c.Audit
|
||||
hasAuditConfig := c.ConfigCommands != nil
|
||||
hasAuditConfig := c.AuditConfig != ""
|
||||
|
||||
state, finalOutput, retErrmsgs := performTest(c.Audit, c.Commands, c.Tests)
|
||||
state, finalOutput, retErrmsgs := performTest(c.Audit, c.Tests)
|
||||
if len(state) > 0 {
|
||||
c.Reason = retErrmsgs
|
||||
c.State = state
|
||||
return c.State
|
||||
}
|
||||
@@ -159,8 +161,9 @@ func (c *Check) run() State {
|
||||
currentTests.TestItems[i] = nti
|
||||
}
|
||||
|
||||
state, finalOutput, retErrmsgs = performTest(c.AuditConfig, c.ConfigCommands, currentTests)
|
||||
state, finalOutput, retErrmsgs = performTest(c.AuditConfig, currentTests)
|
||||
if len(state) > 0 {
|
||||
c.Reason = retErrmsgs
|
||||
c.State = state
|
||||
return c.State
|
||||
}
|
||||
@@ -175,6 +178,7 @@ func (c *Check) run() State {
|
||||
if c.Scored {
|
||||
c.State = FAIL
|
||||
} else {
|
||||
c.Reason = errmsgs
|
||||
c.State = WARN
|
||||
}
|
||||
}
|
||||
@@ -191,78 +195,13 @@ func (c *Check) run() State {
|
||||
return c.State
|
||||
}
|
||||
|
||||
// textToCommand transforms an input text representation of commands to be
|
||||
// run into a slice of commands.
|
||||
// TODO: Make this more robust.
|
||||
func textToCommand(s string) []*exec.Cmd {
|
||||
glog.V(3).Infof("textToCommand: %q\n", s)
|
||||
cmds := []*exec.Cmd{}
|
||||
|
||||
cp := strings.Split(s, "|")
|
||||
|
||||
for _, v := range cp {
|
||||
v = strings.Trim(v, " ")
|
||||
|
||||
// TODO:
|
||||
// GOAL: To split input text into arguments for exec.Cmd.
|
||||
//
|
||||
// CHALLENGE: The input text may contain quoted strings that
|
||||
// must be passed as a unit to exec.Cmd.
|
||||
// eg. bash -c 'foo bar'
|
||||
// 'foo bar' must be passed as unit to exec.Cmd if not the command
|
||||
// will fail when it is executed.
|
||||
// eg. exec.Cmd("bash", "-c", "foo bar")
|
||||
//
|
||||
// PROBLEM: Current solution assumes the grouped string will always
|
||||
// be at the end of the input text.
|
||||
re := regexp.MustCompile(`^(.*)(['"].*['"])$`)
|
||||
grps := re.FindStringSubmatch(v)
|
||||
|
||||
var cs []string
|
||||
if len(grps) > 0 {
|
||||
s := strings.Trim(grps[1], " ")
|
||||
cs = strings.Split(s, " ")
|
||||
|
||||
s1 := grps[len(grps)-1]
|
||||
s1 = strings.Trim(s1, "'\"")
|
||||
|
||||
cs = append(cs, s1)
|
||||
} else {
|
||||
cs = strings.Split(v, " ")
|
||||
}
|
||||
|
||||
cmd := exec.Command(cs[0], cs[1:]...)
|
||||
cmds = append(cmds, cmd)
|
||||
}
|
||||
|
||||
return cmds
|
||||
}
|
||||
|
||||
func isShellCommand(s string) bool {
|
||||
cmd := exec.Command("/bin/sh", "-c", "command -v "+s)
|
||||
|
||||
out, err := cmd.Output()
|
||||
if err != nil {
|
||||
exitWithError(fmt.Errorf("failed to check if command: %q is valid %v", s, err))
|
||||
}
|
||||
|
||||
if strings.Contains(string(out), s) {
|
||||
return true
|
||||
}
|
||||
return false
|
||||
}
|
||||
|
||||
func performTest(audit string, commands []*exec.Cmd, tests *tests) (State, *testOutput, string) {
|
||||
func performTest(audit string, tests *tests) (State, *testOutput, string) {
|
||||
if len(strings.TrimSpace(audit)) == 0 {
|
||||
return "", failTestItem("missing command"), ""
|
||||
return "", failTestItem("missing command"), "missing audit command"
|
||||
}
|
||||
|
||||
var out bytes.Buffer
|
||||
state, retErrmsgs := runExecCommands(audit, commands, &out)
|
||||
if len(state) > 0 {
|
||||
return state, nil, ""
|
||||
}
|
||||
errmsgs := retErrmsgs
|
||||
errmsgs := runAudit(audit, &out)
|
||||
|
||||
finalOutput := tests.execute(out.String())
|
||||
if finalOutput == nil {
|
||||
@@ -272,72 +211,17 @@ func performTest(audit string, commands []*exec.Cmd, tests *tests) (State, *test
|
||||
return "", finalOutput, errmsgs
|
||||
}
|
||||
|
||||
func runExecCommands(audit string, commands []*exec.Cmd, out *bytes.Buffer) (State, string) {
|
||||
var err error
|
||||
func runAudit(audit string, out *bytes.Buffer) string {
|
||||
errmsgs := ""
|
||||
|
||||
// Check if command exists or exit with WARN.
|
||||
for _, cmd := range commands {
|
||||
if !isShellCommand(cmd.Path) {
|
||||
return WARN, errmsgs
|
||||
}
|
||||
}
|
||||
|
||||
// Run commands.
|
||||
n := len(commands)
|
||||
if n == 0 {
|
||||
// Likely a warning message.
|
||||
return WARN, errmsgs
|
||||
}
|
||||
|
||||
// Each command runs,
|
||||
// cmd0 out -> cmd1 in, cmd1 out -> cmd2 in ... cmdn out -> os.stdout
|
||||
// cmd0 err should terminate chain
|
||||
cs := commands
|
||||
|
||||
// Initialize command pipeline
|
||||
cs[n-1].Stdout = out
|
||||
i := 1
|
||||
|
||||
for i < n {
|
||||
cs[i-1].Stdout, err = cs[i].StdinPipe()
|
||||
if err != nil {
|
||||
errmsgs += fmt.Sprintf("failed to run: %s, command: %s, error: %s\n", audit, cs[i].Args, err)
|
||||
}
|
||||
i++
|
||||
}
|
||||
|
||||
// Start command pipeline
|
||||
i = 0
|
||||
for i < n {
|
||||
err := cs[i].Start()
|
||||
if err != nil {
|
||||
errmsgs += fmt.Sprintf("failed to run: %s, command: %s, error: %s\n", audit, cs[i].Args, err)
|
||||
}
|
||||
i++
|
||||
}
|
||||
|
||||
// Complete command pipeline
|
||||
i = 0
|
||||
for i < n {
|
||||
err := cs[i].Wait()
|
||||
if err != nil {
|
||||
errmsgs += fmt.Sprintf("failed to run: %s, command: %s, error: %s\n", audit, cs[i].Args, err)
|
||||
}
|
||||
|
||||
if i < n-1 {
|
||||
cs[i].Stdout.(io.Closer).Close()
|
||||
}
|
||||
i++
|
||||
cmd := exec.Command("/bin/sh")
|
||||
cmd.Stdin = strings.NewReader(audit)
|
||||
cmd.Stdout = out
|
||||
cmd.Stderr = out
|
||||
if err := cmd.Run(); err != nil {
|
||||
errmsgs += fmt.Sprintf("failed to run: %q, output: %q, error: %s\n", audit, out.String(), err)
|
||||
}
|
||||
|
||||
glog.V(3).Infof("Command %q - Output:\n\n %q\n - Error Messages:%q \n", audit, out.String(), errmsgs)
|
||||
return "", errmsgs
|
||||
}
|
||||
|
||||
func exitWithError(err error) {
|
||||
fmt.Fprintf(os.Stderr, "\n%v\n", err)
|
||||
// flush before exit non-zero
|
||||
glog.Flush()
|
||||
os.Exit(1)
|
||||
return errmsgs
|
||||
}
|
||||
|
||||
@@ -15,7 +15,8 @@
|
||||
package check
|
||||
|
||||
import (
|
||||
"os/exec"
|
||||
"bytes"
|
||||
"strings"
|
||||
"testing"
|
||||
)
|
||||
|
||||
@@ -33,8 +34,8 @@ func TestCheck_Run(t *testing.T) {
|
||||
{
|
||||
check: Check{ // Not scored checks with passing tests are marked pass
|
||||
Scored: false,
|
||||
Audit: ":", Commands: []*exec.Cmd{exec.Command("")},
|
||||
Tests: &tests{TestItems: []*testItem{&testItem{}}},
|
||||
Audit: ":",
|
||||
Tests: &tests{TestItems: []*testItem{&testItem{}}},
|
||||
},
|
||||
Expected: PASS,
|
||||
},
|
||||
@@ -44,8 +45,8 @@ func TestCheck_Run(t *testing.T) {
|
||||
{
|
||||
check: Check{ // Scored checks with passing tests are marked pass
|
||||
Scored: true,
|
||||
Audit: ":", Commands: []*exec.Cmd{exec.Command("")},
|
||||
Tests: &tests{TestItems: []*testItem{&testItem{}}},
|
||||
Audit: ":",
|
||||
Tests: &tests{TestItems: []*testItem{&testItem{}}},
|
||||
},
|
||||
Expected: PASS,
|
||||
},
|
||||
@@ -111,3 +112,66 @@ func TestCheckAuditConfig(t *testing.T) {
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
func Test_runAudit(t *testing.T) {
|
||||
type args struct {
|
||||
audit string
|
||||
out *bytes.Buffer
|
||||
output string
|
||||
}
|
||||
tests := []struct {
|
||||
name string
|
||||
args args
|
||||
errMsg string
|
||||
output string
|
||||
}{
|
||||
{
|
||||
name: "run success",
|
||||
args: args{
|
||||
audit: "echo 'hello world'",
|
||||
out: &bytes.Buffer{},
|
||||
},
|
||||
errMsg: "",
|
||||
output: "hello world\n",
|
||||
},
|
||||
{
|
||||
name: "run multiple lines script",
|
||||
args: args{
|
||||
audit: `
|
||||
hello() {
|
||||
echo "hello world"
|
||||
}
|
||||
|
||||
hello
|
||||
`,
|
||||
out: &bytes.Buffer{},
|
||||
},
|
||||
errMsg: "",
|
||||
output: "hello world\n",
|
||||
},
|
||||
{
|
||||
name: "run failed",
|
||||
args: args{
|
||||
audit: "unknown_command",
|
||||
out: &bytes.Buffer{},
|
||||
},
|
||||
errMsg: "failed to run: \"unknown_command\", output: \"/bin/sh: ",
|
||||
output: "not found\n",
|
||||
},
|
||||
}
|
||||
for _, tt := range tests {
|
||||
t.Run(tt.name, func(t *testing.T) {
|
||||
errMsg := runAudit(tt.args.audit, tt.args.out)
|
||||
if errMsg != "" && !strings.Contains(errMsg, tt.errMsg) {
|
||||
t.Errorf("runAudit() errMsg = %q, want %q", errMsg, tt.errMsg)
|
||||
}
|
||||
output := tt.args.out.String()
|
||||
if errMsg == "" && output != tt.output {
|
||||
t.Errorf("runAudit() output = %q, want %q", output, tt.output)
|
||||
}
|
||||
if errMsg != "" && !strings.Contains(output, tt.output) {
|
||||
t.Errorf("runAudit() output = %q, want %q", output, tt.output)
|
||||
}
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
@@ -70,18 +70,6 @@ func NewControls(t NodeType, in []byte) (*Controls, error) {
|
||||
return nil, fmt.Errorf("non-%s controls file specified", t)
|
||||
}
|
||||
|
||||
// Prepare audit commands
|
||||
for _, group := range c.Groups {
|
||||
for _, check := range group.Checks {
|
||||
glog.V(3).Infof("Check.ID %s", check.ID)
|
||||
check.Commands = textToCommand(check.Audit)
|
||||
if len(check.AuditConfig) > 0 {
|
||||
glog.V(3).Infof("Check.ID has audit_config %s", check.ID)
|
||||
check.ConfigCommands = textToCommand(check.AuditConfig)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
return c, nil
|
||||
}
|
||||
|
||||
|
||||
20
check/data
20
check/data
@@ -308,6 +308,26 @@ groups:
|
||||
value: '^1\.12.*$'
|
||||
set: true
|
||||
|
||||
- id: 27
|
||||
text: "check boolean flag with no value"
|
||||
tests:
|
||||
test_items:
|
||||
- flag: "--peer-client-cert-auth"
|
||||
compare:
|
||||
op: eq
|
||||
value: true
|
||||
set: true
|
||||
|
||||
- id: 28
|
||||
text: "check boolean flag with false value"
|
||||
tests:
|
||||
test_items:
|
||||
- flag: "--peer-client-cert-auth"
|
||||
compare:
|
||||
op: eq
|
||||
value: false
|
||||
set: true
|
||||
|
||||
- id: 2.1
|
||||
text: "audit and audit_config commands"
|
||||
checks:
|
||||
|
||||
@@ -23,6 +23,7 @@ import (
|
||||
"strconv"
|
||||
"strings"
|
||||
|
||||
"github.com/golang/glog"
|
||||
yaml "gopkg.in/yaml.v2"
|
||||
"k8s.io/client-go/util/jsonpath"
|
||||
)
|
||||
@@ -115,11 +116,16 @@ func (t *testItem) execute(s string) *testOutput {
|
||||
if vals[3] != "" {
|
||||
flagVal = vals[3]
|
||||
} else {
|
||||
flagVal = vals[1]
|
||||
// --bool-flag
|
||||
if strings.HasPrefix(t.Flag, "--") {
|
||||
flagVal = "true"
|
||||
} else {
|
||||
flagVal = vals[1]
|
||||
}
|
||||
}
|
||||
} else {
|
||||
fmt.Fprintf(os.Stderr, "invalid flag in testitem definition")
|
||||
os.Exit(1)
|
||||
glog.V(1).Infof(fmt.Sprintf("invalid flag in testitem definition"))
|
||||
return failTestItem("error invalid flag in testitem definition")
|
||||
}
|
||||
}
|
||||
|
||||
@@ -165,8 +171,8 @@ func compareOp(tCompareOp string, flagVal string, tCompareValue string) (string,
|
||||
case "gt", "gte", "lt", "lte":
|
||||
a, b, err := toNumeric(flagVal, tCompareValue)
|
||||
if err != nil {
|
||||
fmt.Fprintf(os.Stderr, "Not numeric value - flag: %q - compareValue: %q %v\n", flagVal, tCompareValue, err)
|
||||
os.Exit(1)
|
||||
glog.V(1).Infof(fmt.Sprintf("Not numeric value - flag: %q - compareValue: %q %v\n", flagVal, tCompareValue, err))
|
||||
return "Invalid Number(s) used for comparison", false
|
||||
}
|
||||
switch tCompareOp {
|
||||
case "gt":
|
||||
@@ -205,8 +211,20 @@ func compareOp(tCompareOp string, flagVal string, tCompareValue string) (string,
|
||||
target := splitAndRemoveLastSeparator(tCompareValue, defaultArraySeparator)
|
||||
testResult = allElementsValid(s, target)
|
||||
|
||||
case "bitmask":
|
||||
expectedResultPattern = "bitmask '%s' AND '%s'"
|
||||
requested, err := strconv.ParseInt(flagVal, 8, 64)
|
||||
if err != nil {
|
||||
glog.V(1).Infof(fmt.Sprintf("Not numeric value - flag: %q - compareValue: %q %v\n", flagVal, tCompareValue, err))
|
||||
return fmt.Sprintf("Not numeric value - flag: %s", flagVal), false
|
||||
}
|
||||
max, err := strconv.ParseInt(tCompareValue, 8, 64)
|
||||
if err != nil {
|
||||
glog.V(1).Infof(fmt.Sprintf("Not numeric value - flag: %q - compareValue: %q %v\n", flagVal, tCompareValue, err))
|
||||
return fmt.Sprintf("Not numeric value - flag: %s", tCompareValue), false
|
||||
}
|
||||
testResult = (max & requested) == requested
|
||||
}
|
||||
|
||||
if expectedResultPattern == "" {
|
||||
return expectedResultPattern, testResult
|
||||
}
|
||||
@@ -317,8 +335,9 @@ func (ts *tests) execute(s string) *testOutput {
|
||||
// If no binary operation is specified, default to AND
|
||||
switch ts.BinOp {
|
||||
default:
|
||||
fmt.Fprintf(os.Stderr, "unknown binary operator for tests %s\n", ts.BinOp)
|
||||
os.Exit(1)
|
||||
glog.V(2).Info(fmt.Sprintf("unknown binary operator for tests %s\n", ts.BinOp))
|
||||
finalOutput.actualResult = fmt.Sprintf("unknown binary operator for tests %s\n", ts.BinOp)
|
||||
return finalOutput
|
||||
case and, "":
|
||||
result = true
|
||||
for i := range res {
|
||||
|
||||
@@ -156,6 +156,30 @@ func TestTestExecute(t *testing.T) {
|
||||
controls.Groups[0].Checks[26],
|
||||
"currentMasterVersion: 1.12.7",
|
||||
},
|
||||
{
|
||||
controls.Groups[0].Checks[27],
|
||||
"--peer-client-cert-auth",
|
||||
},
|
||||
{
|
||||
controls.Groups[0].Checks[27],
|
||||
"--abc=true --peer-client-cert-auth --efg=false",
|
||||
},
|
||||
{
|
||||
controls.Groups[0].Checks[27],
|
||||
"--abc --peer-client-cert-auth --efg",
|
||||
},
|
||||
{
|
||||
controls.Groups[0].Checks[27],
|
||||
"--peer-client-cert-auth=true",
|
||||
},
|
||||
{
|
||||
controls.Groups[0].Checks[27],
|
||||
"--abc --peer-client-cert-auth=true --efg",
|
||||
},
|
||||
{
|
||||
controls.Groups[0].Checks[28],
|
||||
"--abc --peer-client-cert-auth=false --efg",
|
||||
},
|
||||
}
|
||||
|
||||
for _, c := range cases {
|
||||
@@ -507,11 +531,9 @@ func TestCompareOp(t *testing.T) {
|
||||
testResult: true},
|
||||
|
||||
// Test Op "gt"
|
||||
// TODO: test for non-numeric values.
|
||||
// toNumeric function currently uses os.Exit, which stops tests.
|
||||
// {label: "op=gt, both empty", op: "gt", flagVal: "",
|
||||
// compareValue: "", expectedResultPattern: "'' is greater than ''",
|
||||
// testResult: true},
|
||||
{label: "op=gt, both empty", op: "gt", flagVal: "",
|
||||
compareValue: "", expectedResultPattern: "Invalid Number(s) used for comparison",
|
||||
testResult: false},
|
||||
{label: "op=gt, 0 > 0", op: "gt", flagVal: "0",
|
||||
compareValue: "0", expectedResultPattern: "0 is greater than 0",
|
||||
testResult: false},
|
||||
@@ -524,109 +546,124 @@ func TestCompareOp(t *testing.T) {
|
||||
{label: "op=gt, 5 > 5", op: "gt", flagVal: "5",
|
||||
compareValue: "5", expectedResultPattern: "5 is greater than 5",
|
||||
testResult: false},
|
||||
|
||||
{label: "op=gt, Pikachu > 5", op: "gt", flagVal: "Pikachu",
|
||||
compareValue: "5", expectedResultPattern: "Invalid Number(s) used for comparison",
|
||||
testResult: false},
|
||||
{label: "op=gt, 5 > Bulbasaur", op: "gt", flagVal: "5",
|
||||
compareValue: "Bulbasaur", expectedResultPattern: "Invalid Number(s) used for comparison",
|
||||
testResult: false},
|
||||
// Test Op "lt"
|
||||
// TODO: test for non-numeric values.
|
||||
// toNumeric function currently uses os.Exit, which stops tests.
|
||||
// {label: "op=lt, both empty", op: "lt", flagVal: "",
|
||||
// compareValue: "", expectedResultPattern: "'' is lower than ''",
|
||||
// testResult: true},
|
||||
{label: "op=gt, 0 < 0", op: "lt", flagVal: "0",
|
||||
{label: "op=lt, both empty", op: "lt", flagVal: "",
|
||||
compareValue: "", expectedResultPattern: "Invalid Number(s) used for comparison",
|
||||
testResult: false},
|
||||
{label: "op=lt, 0 < 0", op: "lt", flagVal: "0",
|
||||
compareValue: "0", expectedResultPattern: "0 is lower than 0",
|
||||
testResult: false},
|
||||
{label: "op=gt, 4 < 5", op: "lt", flagVal: "4",
|
||||
{label: "op=lt, 4 < 5", op: "lt", flagVal: "4",
|
||||
compareValue: "5", expectedResultPattern: "4 is lower than 5",
|
||||
testResult: true},
|
||||
{label: "op=gt, 5 < 4", op: "lt", flagVal: "5",
|
||||
{label: "op=lt, 5 < 4", op: "lt", flagVal: "5",
|
||||
compareValue: "4", expectedResultPattern: "5 is lower than 4",
|
||||
testResult: false},
|
||||
{label: "op=gt, 5 < 5", op: "lt", flagVal: "5",
|
||||
{label: "op=lt, 5 < 5", op: "lt", flagVal: "5",
|
||||
compareValue: "5", expectedResultPattern: "5 is lower than 5",
|
||||
testResult: false},
|
||||
|
||||
{label: "op=lt, Charmander < 5", op: "lt", flagVal: "Charmander",
|
||||
compareValue: "5", expectedResultPattern: "Invalid Number(s) used for comparison",
|
||||
testResult: false},
|
||||
{label: "op=lt, 5 < Charmeleon", op: "lt", flagVal: "5",
|
||||
compareValue: "Charmeleon", expectedResultPattern: "Invalid Number(s) used for comparison",
|
||||
testResult: false},
|
||||
// Test Op "gte"
|
||||
// TODO: test for non-numeric values.
|
||||
// toNumeric function currently uses os.Exit, which stops tests.
|
||||
// {label: "op=gt, both empty", op: "gte", flagVal: "",
|
||||
// compareValue: "", expectedResultPattern: "'' is greater or equal to ''",
|
||||
// testResult: true},
|
||||
{label: "op=gt, 0 >= 0", op: "gte", flagVal: "0",
|
||||
{label: "op=gte, both empty", op: "gte", flagVal: "",
|
||||
compareValue: "", expectedResultPattern: "Invalid Number(s) used for comparison",
|
||||
testResult: false},
|
||||
{label: "op=gte, 0 >= 0", op: "gte", flagVal: "0",
|
||||
compareValue: "0", expectedResultPattern: "0 is greater or equal to 0",
|
||||
testResult: true},
|
||||
{label: "op=gt, 4 >= 5", op: "gte", flagVal: "4",
|
||||
{label: "op=gte, 4 >= 5", op: "gte", flagVal: "4",
|
||||
compareValue: "5", expectedResultPattern: "4 is greater or equal to 5",
|
||||
testResult: false},
|
||||
{label: "op=gt, 5 >= 4", op: "gte", flagVal: "5",
|
||||
{label: "op=gte, 5 >= 4", op: "gte", flagVal: "5",
|
||||
compareValue: "4", expectedResultPattern: "5 is greater or equal to 4",
|
||||
testResult: true},
|
||||
{label: "op=gt, 5 >= 5", op: "gte", flagVal: "5",
|
||||
{label: "op=gte, 5 >= 5", op: "gte", flagVal: "5",
|
||||
compareValue: "5", expectedResultPattern: "5 is greater or equal to 5",
|
||||
testResult: true},
|
||||
|
||||
{label: "op=gte, Ekans >= 5", op: "gte", flagVal: "Ekans",
|
||||
compareValue: "5", expectedResultPattern: "Invalid Number(s) used for comparison",
|
||||
testResult: false},
|
||||
{label: "op=gte, 4 >= Zubat", op: "gte", flagVal: "4",
|
||||
compareValue: "Zubat", expectedResultPattern: "Invalid Number(s) used for comparison",
|
||||
testResult: false},
|
||||
// Test Op "lte"
|
||||
// TODO: test for non-numeric values.
|
||||
// toNumeric function currently uses os.Exit, which stops tests.
|
||||
// {label: "op=gt, both empty", op: "lte", flagVal: "",
|
||||
// compareValue: "", expectedResultPattern: "'' is lower or equal to ''",
|
||||
// testResult: true},
|
||||
{label: "op=gt, 0 <= 0", op: "lte", flagVal: "0",
|
||||
{label: "op=lte, both empty", op: "lte", flagVal: "",
|
||||
compareValue: "", expectedResultPattern: "Invalid Number(s) used for comparison",
|
||||
testResult: false},
|
||||
{label: "op=lte, 0 <= 0", op: "lte", flagVal: "0",
|
||||
compareValue: "0", expectedResultPattern: "0 is lower or equal to 0",
|
||||
testResult: true},
|
||||
{label: "op=gt, 4 <= 5", op: "lte", flagVal: "4",
|
||||
{label: "op=lte, 4 <= 5", op: "lte", flagVal: "4",
|
||||
compareValue: "5", expectedResultPattern: "4 is lower or equal to 5",
|
||||
testResult: true},
|
||||
{label: "op=gt, 5 <= 4", op: "lte", flagVal: "5",
|
||||
{label: "op=lte, 5 <= 4", op: "lte", flagVal: "5",
|
||||
compareValue: "4", expectedResultPattern: "5 is lower or equal to 4",
|
||||
testResult: false},
|
||||
{label: "op=gt, 5 <= 5", op: "lte", flagVal: "5",
|
||||
{label: "op=lte, 5 <= 5", op: "lte", flagVal: "5",
|
||||
compareValue: "5", expectedResultPattern: "5 is lower or equal to 5",
|
||||
testResult: true},
|
||||
{label: "op=lte, Venomoth <= 4", op: "lte", flagVal: "Venomoth",
|
||||
compareValue: "4", expectedResultPattern: "Invalid Number(s) used for comparison",
|
||||
testResult: false},
|
||||
{label: "op=lte, 5 <= Meowth", op: "lte", flagVal: "5",
|
||||
compareValue: "Meowth", expectedResultPattern: "Invalid Number(s) used for comparison",
|
||||
testResult: false},
|
||||
|
||||
// Test Op "has"
|
||||
{label: "op=gt, both empty", op: "has", flagVal: "",
|
||||
{label: "op=has, both empty", op: "has", flagVal: "",
|
||||
compareValue: "", expectedResultPattern: "'' has ''",
|
||||
testResult: true},
|
||||
{label: "op=gt, flagVal=empty", op: "has", flagVal: "",
|
||||
{label: "op=has, flagVal=empty", op: "has", flagVal: "",
|
||||
compareValue: "blah", expectedResultPattern: "'' has 'blah'",
|
||||
testResult: false},
|
||||
{label: "op=gt, compareValue=empty", op: "has", flagVal: "blah",
|
||||
{label: "op=has, compareValue=empty", op: "has", flagVal: "blah",
|
||||
compareValue: "", expectedResultPattern: "'blah' has ''",
|
||||
testResult: true},
|
||||
{label: "op=gt, 'blah' has 'la'", op: "has", flagVal: "blah",
|
||||
{label: "op=has, 'blah' has 'la'", op: "has", flagVal: "blah",
|
||||
compareValue: "la", expectedResultPattern: "'blah' has 'la'",
|
||||
testResult: true},
|
||||
{label: "op=gt, 'blah' has 'LA'", op: "has", flagVal: "blah",
|
||||
{label: "op=has, 'blah' has 'LA'", op: "has", flagVal: "blah",
|
||||
compareValue: "LA", expectedResultPattern: "'blah' has 'LA'",
|
||||
testResult: false},
|
||||
{label: "op=gt, 'blah' has 'lo'", op: "has", flagVal: "blah",
|
||||
{label: "op=has, 'blah' has 'lo'", op: "has", flagVal: "blah",
|
||||
compareValue: "lo", expectedResultPattern: "'blah' has 'lo'",
|
||||
testResult: false},
|
||||
|
||||
// Test Op "nothave"
|
||||
{label: "op=gt, both empty", op: "nothave", flagVal: "",
|
||||
{label: "op=nothave, both empty", op: "nothave", flagVal: "",
|
||||
compareValue: "", expectedResultPattern: " '' not have ''",
|
||||
testResult: false},
|
||||
{label: "op=gt, flagVal=empty", op: "nothave", flagVal: "",
|
||||
{label: "op=nothave, flagVal=empty", op: "nothave", flagVal: "",
|
||||
compareValue: "blah", expectedResultPattern: " '' not have 'blah'",
|
||||
testResult: true},
|
||||
{label: "op=gt, compareValue=empty", op: "nothave", flagVal: "blah",
|
||||
{label: "op=nothave, compareValue=empty", op: "nothave", flagVal: "blah",
|
||||
compareValue: "", expectedResultPattern: " 'blah' not have ''",
|
||||
testResult: false},
|
||||
{label: "op=gt, 'blah' not have 'la'", op: "nothave", flagVal: "blah",
|
||||
{label: "op=nothave, 'blah' not have 'la'", op: "nothave", flagVal: "blah",
|
||||
compareValue: "la", expectedResultPattern: " 'blah' not have 'la'",
|
||||
testResult: false},
|
||||
{label: "op=gt, 'blah' not have 'LA'", op: "nothave", flagVal: "blah",
|
||||
{label: "op=nothave, 'blah' not have 'LA'", op: "nothave", flagVal: "blah",
|
||||
compareValue: "LA", expectedResultPattern: " 'blah' not have 'LA'",
|
||||
testResult: true},
|
||||
{label: "op=gt, 'blah' not have 'lo'", op: "nothave", flagVal: "blah",
|
||||
{label: "op=nothave, 'blah' not have 'lo'", op: "nothave", flagVal: "blah",
|
||||
compareValue: "lo", expectedResultPattern: " 'blah' not have 'lo'",
|
||||
testResult: true},
|
||||
|
||||
// Test Op "regex"
|
||||
{label: "op=gt, both empty", op: "regex", flagVal: "",
|
||||
{label: "op=regex, both empty", op: "regex", flagVal: "",
|
||||
compareValue: "", expectedResultPattern: " '' matched by ''",
|
||||
testResult: true},
|
||||
{label: "op=gt, flagVal=empty", op: "regex", flagVal: "",
|
||||
{label: "op=regex, flagVal=empty", op: "regex", flagVal: "",
|
||||
compareValue: "blah", expectedResultPattern: " '' matched by 'blah'",
|
||||
testResult: false},
|
||||
|
||||
@@ -642,6 +679,25 @@ func TestCompareOp(t *testing.T) {
|
||||
{label: "op=valid_elements, valid_elements expectedResultPattern empty", op: "valid_elements", flagVal: "a,b",
|
||||
compareValue: "", expectedResultPattern: "'a,b' contains valid elements from ''",
|
||||
testResult: false},
|
||||
// Test Op "bitmask"
|
||||
{label: "op=bitmask, 644 AND 640", op: "bitmask", flagVal: "640",
|
||||
compareValue: "644", expectedResultPattern: "bitmask '640' AND '644'",
|
||||
testResult: true},
|
||||
{label: "op=bitmask, 644 AND 777", op: "bitmask", flagVal: "777",
|
||||
compareValue: "644", expectedResultPattern: "bitmask '777' AND '644'",
|
||||
testResult: false},
|
||||
{label: "op=bitmask, 644 AND 444", op: "bitmask", flagVal: "444",
|
||||
compareValue: "644", expectedResultPattern: "bitmask '444' AND '644'",
|
||||
testResult: true},
|
||||
{label: "op=bitmask, 644 AND 211", op: "bitmask", flagVal: "211",
|
||||
compareValue: "644", expectedResultPattern: "bitmask '211' AND '644'",
|
||||
testResult: false},
|
||||
{label: "op=bitmask, Harry AND 211", op: "bitmask", flagVal: "Harry",
|
||||
compareValue: "644", expectedResultPattern: "Not numeric value - flag: Harry",
|
||||
testResult: false},
|
||||
{label: "op=bitmask, 644 AND Potter", op: "bitmask", flagVal: "211",
|
||||
compareValue: "Potter", expectedResultPattern: "Not numeric value - flag: Potter",
|
||||
testResult: false},
|
||||
}
|
||||
|
||||
for _, c := range cases {
|
||||
|
||||
106
cmd/common.go
106
cmd/common.go
@@ -16,10 +16,13 @@ package cmd
|
||||
|
||||
import (
|
||||
"bufio"
|
||||
"encoding/json"
|
||||
"fmt"
|
||||
"io/ioutil"
|
||||
"os"
|
||||
"path/filepath"
|
||||
"sort"
|
||||
"strconv"
|
||||
"strings"
|
||||
|
||||
"github.com/aquasecurity/kube-bench/check"
|
||||
@@ -63,8 +66,6 @@ func NewRunFilter(opts FilterOpts) (check.Predicate, error) {
|
||||
}
|
||||
|
||||
func runChecks(nodetype check.NodeType, testYamlFile string) {
|
||||
var summary check.Summary
|
||||
|
||||
// Verify config file was loaded into Viper during Cobra sub-command initialization.
|
||||
if configFileError != nil {
|
||||
colorPrint(check.FAIL, fmt.Sprintf("Failed to read config file: %v\n", configFileError))
|
||||
@@ -117,36 +118,8 @@ func runChecks(nodetype check.NodeType, testYamlFile string) {
|
||||
exitWithError(fmt.Errorf("error setting up run filter: %v", err))
|
||||
}
|
||||
|
||||
summary = controls.RunChecks(runner, filter)
|
||||
|
||||
if (summary.Fail > 0 || summary.Warn > 0 || summary.Pass > 0 || summary.Info > 0) && junitFmt {
|
||||
out, err := controls.JUnit()
|
||||
if err != nil {
|
||||
exitWithError(fmt.Errorf("failed to output in JUnit format: %v", err))
|
||||
}
|
||||
|
||||
PrintOutput(string(out), outputFile)
|
||||
// if we successfully ran some tests and it's json format, ignore the warnings
|
||||
} else if (summary.Fail > 0 || summary.Warn > 0 || summary.Pass > 0 || summary.Info > 0) && jsonFmt {
|
||||
out, err := controls.JSON()
|
||||
if err != nil {
|
||||
exitWithError(fmt.Errorf("failed to output in JSON format: %v", err))
|
||||
}
|
||||
|
||||
PrintOutput(string(out), outputFile)
|
||||
} else {
|
||||
// if we want to store in PostgreSQL, convert to JSON and save it
|
||||
if (summary.Fail > 0 || summary.Warn > 0 || summary.Pass > 0 || summary.Info > 0) && pgSQL {
|
||||
out, err := controls.JSON()
|
||||
if err != nil {
|
||||
exitWithError(fmt.Errorf("failed to output in JSON format: %v", err))
|
||||
}
|
||||
|
||||
savePgsql(string(out))
|
||||
} else {
|
||||
prettyPrint(controls, summary)
|
||||
}
|
||||
}
|
||||
controls.RunChecks(runner, filter)
|
||||
controlsCollection = append(controlsCollection, controls)
|
||||
}
|
||||
|
||||
// colorPrint outputs the state in a specific colour, along with a message string
|
||||
@@ -180,9 +153,17 @@ func prettyPrint(r *check.Controls, summary check.Summary) {
|
||||
colors[check.WARN].Printf("== Remediations ==\n")
|
||||
for _, g := range r.Groups {
|
||||
for _, c := range g.Checks {
|
||||
if c.State == check.FAIL || c.State == check.WARN {
|
||||
if c.State == check.FAIL {
|
||||
fmt.Printf("%s %s\n", c.ID, c.Remediation)
|
||||
}
|
||||
if c.State == check.WARN {
|
||||
// Print the error if test failed due to problem with the audit command
|
||||
if c.Reason != "" && c.Type != "manual" {
|
||||
fmt.Printf("%s audit test did not run: %s\n", c.ID, c.Reason)
|
||||
} else {
|
||||
fmt.Printf("%s %s\n", c.ID, c.Remediation)
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
fmt.Println()
|
||||
@@ -225,6 +206,8 @@ func loadConfig(nodetype check.NodeType) string {
|
||||
file = etcdFile
|
||||
case check.POLICIES:
|
||||
file = policiesFile
|
||||
case check.MANAGEDSERVICES:
|
||||
file = managedservicesFile
|
||||
}
|
||||
|
||||
benchmarkVersion, err := getBenchmarkVersion(kubeVersion, benchmarkVersion, viper.GetViper())
|
||||
@@ -349,6 +332,62 @@ func isThisNodeRunning(nodeType check.NodeType) bool {
|
||||
return true
|
||||
}
|
||||
|
||||
func writeOutput(controlsCollection []*check.Controls) {
|
||||
sort.Slice(controlsCollection, func(i, j int) bool {
|
||||
iid, _ := strconv.Atoi(controlsCollection[i].ID)
|
||||
jid, _ := strconv.Atoi(controlsCollection[j].ID)
|
||||
return iid < jid
|
||||
})
|
||||
if junitFmt {
|
||||
writeJunitOutput(controlsCollection)
|
||||
return
|
||||
}
|
||||
if jsonFmt {
|
||||
writeJsonOutput(controlsCollection)
|
||||
return
|
||||
}
|
||||
if pgSQL {
|
||||
writePgsqlOutput(controlsCollection)
|
||||
return
|
||||
}
|
||||
writeStdoutOutput(controlsCollection)
|
||||
}
|
||||
|
||||
func writeJsonOutput(controlsCollection []*check.Controls) {
|
||||
out, err := json.Marshal(controlsCollection)
|
||||
if err != nil {
|
||||
exitWithError(fmt.Errorf("failed to output in JSON format: %v", err))
|
||||
}
|
||||
PrintOutput(string(out), outputFile)
|
||||
}
|
||||
|
||||
func writeJunitOutput(controlsCollection []*check.Controls) {
|
||||
for _, controls := range controlsCollection {
|
||||
out, err := controls.JUnit()
|
||||
if err != nil {
|
||||
exitWithError(fmt.Errorf("failed to output in JUnit format: %v", err))
|
||||
}
|
||||
PrintOutput(string(out), outputFile)
|
||||
}
|
||||
}
|
||||
|
||||
func writePgsqlOutput(controlsCollection []*check.Controls) {
|
||||
for _, controls := range controlsCollection {
|
||||
out, err := controls.JSON()
|
||||
if err != nil {
|
||||
exitWithError(fmt.Errorf("failed to output in Postgresql format: %v", err))
|
||||
}
|
||||
savePgsql(string(out))
|
||||
}
|
||||
}
|
||||
|
||||
func writeStdoutOutput(controlsCollection []*check.Controls) {
|
||||
for _, controls := range controlsCollection {
|
||||
summary := controls.Summary
|
||||
prettyPrint(controls, summary)
|
||||
}
|
||||
}
|
||||
|
||||
func printRawOutput(output string) {
|
||||
for _, row := range strings.Split(output, "\n") {
|
||||
fmt.Println(fmt.Sprintf("\t %s", row))
|
||||
@@ -382,6 +421,7 @@ var benchmarkVersionToTargetsMap = map[string][]string{
|
||||
"cis-1.3": []string{string(check.MASTER), string(check.NODE)},
|
||||
"cis-1.4": []string{string(check.MASTER), string(check.NODE)},
|
||||
"cis-1.5": []string{string(check.MASTER), string(check.NODE), string(check.CONTROLPLANE), string(check.ETCD), string(check.POLICIES)},
|
||||
"gke-1.0": []string{string(check.MASTER), string(check.NODE), string(check.CONTROLPLANE), string(check.ETCD), string(check.POLICIES), string(check.MANAGEDSERVICES)},
|
||||
}
|
||||
|
||||
// validTargets helps determine if the targets
|
||||
|
||||
@@ -15,12 +15,15 @@
|
||||
package cmd
|
||||
|
||||
import (
|
||||
"encoding/json"
|
||||
"errors"
|
||||
"fmt"
|
||||
"io/ioutil"
|
||||
"os"
|
||||
"path"
|
||||
"path/filepath"
|
||||
"testing"
|
||||
"time"
|
||||
|
||||
"github.com/aquasecurity/kube-bench/check"
|
||||
"github.com/spf13/viper"
|
||||
@@ -210,6 +213,7 @@ func TestMapToCISVersion(t *testing.T) {
|
||||
{kubeVersion: "1.15", succeed: true, exp: "cis-1.5"},
|
||||
{kubeVersion: "1.16", succeed: true, exp: "cis-1.5"},
|
||||
{kubeVersion: "1.17", succeed: true, exp: "cis-1.5"},
|
||||
{kubeVersion: "gke-1.0", succeed: true, exp: "gke-1.0"},
|
||||
{kubeVersion: "ocp-3.10", succeed: true, exp: "rh-0.7"},
|
||||
{kubeVersion: "ocp-3.11", succeed: true, exp: "rh-0.7"},
|
||||
{kubeVersion: "unknown", succeed: false, exp: "", expErr: "unable to find a matching Benchmark Version match for kubernetes version: unknown"},
|
||||
@@ -334,6 +338,7 @@ func TestGetBenchmarkVersion(t *testing.T) {
|
||||
{n: "kubeVersion", kubeVersion: "1.11", benchmarkVersion: "", v: viperWithData, exp: "cis-1.3", callFn: withNoPath, succeed: true},
|
||||
{n: "ocpVersion310", kubeVersion: "ocp-3.10", benchmarkVersion: "", v: viperWithData, exp: "rh-0.7", callFn: withNoPath, succeed: true},
|
||||
{n: "ocpVersion311", kubeVersion: "ocp-3.11", benchmarkVersion: "", v: viperWithData, exp: "rh-0.7", callFn: withNoPath, succeed: true},
|
||||
{n: "gke10", kubeVersion: "gke-1.0", benchmarkVersion: "", v: viperWithData, exp: "gke-1.0", callFn: withNoPath, succeed: true},
|
||||
}
|
||||
for _, c := range cases {
|
||||
rv, err := c.callFn(c.kubeVersion, c.benchmarkVersion, c.v, getBenchmarkVersion)
|
||||
@@ -388,6 +393,12 @@ func TestValidTargets(t *testing.T) {
|
||||
targets: []string{"master", "node", "controlplane", "etcd", "policies"},
|
||||
expected: true,
|
||||
},
|
||||
{
|
||||
name: "gke-1.0 valid",
|
||||
benchmark: "gke-1.0",
|
||||
targets: []string{"master", "node", "controlplane", "etcd", "policies", "managedservices"},
|
||||
expected: true,
|
||||
},
|
||||
}
|
||||
|
||||
for _, c := range cases {
|
||||
@@ -467,6 +478,51 @@ func TestIsEtcd(t *testing.T) {
|
||||
}
|
||||
}
|
||||
|
||||
func TestWriteResultToJsonFile(t *testing.T) {
|
||||
defer func() {
|
||||
controlsCollection = []*check.Controls{}
|
||||
jsonFmt = false
|
||||
outputFile = ""
|
||||
}()
|
||||
var err error
|
||||
jsonFmt = true
|
||||
outputFile = path.Join(os.TempDir(), fmt.Sprintf("%d", time.Now().UnixNano()))
|
||||
|
||||
controlsCollection, err = parseControlsJsonFile("./testdata/controlsCollection.json")
|
||||
if err != nil {
|
||||
t.Error(err)
|
||||
}
|
||||
writeOutput(controlsCollection)
|
||||
|
||||
var expect []*check.Controls
|
||||
var result []*check.Controls
|
||||
result, err = parseControlsJsonFile(outputFile)
|
||||
if err != nil {
|
||||
t.Error(err)
|
||||
}
|
||||
expect, err = parseControlsJsonFile("./testdata/result.json")
|
||||
if err != nil {
|
||||
t.Error(err)
|
||||
}
|
||||
|
||||
assert.Equal(t, expect, result)
|
||||
}
|
||||
|
||||
func parseControlsJsonFile(filepath string) ([]*check.Controls, error) {
|
||||
var result []*check.Controls
|
||||
|
||||
d, err := ioutil.ReadFile(filepath)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
err = json.Unmarshal(d, &result)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
return result, nil
|
||||
}
|
||||
|
||||
func loadConfigForTest() (*viper.Viper, error) {
|
||||
viperWithData := viper.New()
|
||||
viperWithData.SetConfigFile(filepath.Join("..", cfgDir, "config.yaml"))
|
||||
|
||||
@@ -9,6 +9,7 @@ import (
|
||||
"net/http"
|
||||
"os"
|
||||
"strings"
|
||||
"time"
|
||||
|
||||
"github.com/golang/glog"
|
||||
)
|
||||
@@ -30,7 +31,7 @@ func getKubeVersionFromRESTAPI() (string, error) {
|
||||
}
|
||||
token := strings.TrimSpace(string(tb))
|
||||
|
||||
data, err := getWebData(k8sVersionURL, token, tlsCert)
|
||||
data, err := getWebDataWithRetry(k8sVersionURL, token, tlsCert)
|
||||
if err != nil {
|
||||
return "", err
|
||||
}
|
||||
@@ -42,6 +43,24 @@ func getKubeVersionFromRESTAPI() (string, error) {
|
||||
return k8sVersion, nil
|
||||
}
|
||||
|
||||
// The idea of this function is so if Kubernetes DNS is not completely seetup and the
|
||||
// Container where kube-bench is running needs time for DNS configure.
|
||||
// Basically try 10 times, waiting 1 second until either it is successful or it fails.
|
||||
func getWebDataWithRetry(k8sVersionURL, token string, cacert *tls.Certificate) (data []byte, err error) {
|
||||
tries := 0
|
||||
// We retry a few times in case the DNS service has not had time to come up
|
||||
for tries < 10 {
|
||||
data, err = getWebData(k8sVersionURL, token, cacert)
|
||||
if err == nil {
|
||||
return
|
||||
}
|
||||
tries++
|
||||
time.Sleep(1 * time.Second)
|
||||
}
|
||||
|
||||
return
|
||||
}
|
||||
|
||||
func extractVersion(data []byte) (string, error) {
|
||||
type versionResponse struct {
|
||||
Major string
|
||||
|
||||
@@ -126,7 +126,55 @@ func TestGetWebData(t *testing.T) {
|
||||
}
|
||||
|
||||
}
|
||||
func TestGetWebDataWithRetry(t *testing.T) {
|
||||
okfn := func(w http.ResponseWriter, r *http.Request) {
|
||||
_, _ = fmt.Fprintln(w, `{
|
||||
"major": "1",
|
||||
"minor": "15"}`)
|
||||
}
|
||||
errfn := func(w http.ResponseWriter, r *http.Request) {
|
||||
http.Error(w, http.StatusText(http.StatusInternalServerError),
|
||||
http.StatusInternalServerError)
|
||||
}
|
||||
token := "dummyToken"
|
||||
var tlsCert tls.Certificate
|
||||
|
||||
cases := []struct {
|
||||
fn http.HandlerFunc
|
||||
fail bool
|
||||
}{
|
||||
{
|
||||
fn: okfn,
|
||||
fail: false,
|
||||
},
|
||||
{
|
||||
fn: errfn,
|
||||
fail: true,
|
||||
},
|
||||
}
|
||||
|
||||
for id, c := range cases {
|
||||
t.Run(strconv.Itoa(id), func(t *testing.T) {
|
||||
ts := httptest.NewServer(c.fn)
|
||||
defer ts.Close()
|
||||
data, err := getWebDataWithRetry(ts.URL, token, &tlsCert)
|
||||
if !c.fail {
|
||||
if err != nil {
|
||||
t.Errorf("unexpected error: %v", err)
|
||||
}
|
||||
|
||||
if len(data) == 0 {
|
||||
t.Errorf("missing data")
|
||||
}
|
||||
} else {
|
||||
if err == nil {
|
||||
t.Errorf("Expected error")
|
||||
}
|
||||
}
|
||||
})
|
||||
}
|
||||
|
||||
}
|
||||
func TestExtractVersion(t *testing.T) {
|
||||
okJSON := []byte(`{
|
||||
"major": "1",
|
||||
|
||||
@@ -27,6 +27,7 @@ var masterCmd = &cobra.Command{
|
||||
Run: func(cmd *cobra.Command, args []string) {
|
||||
filename := loadConfig(check.MASTER)
|
||||
runChecks(check.MASTER, filename)
|
||||
writeOutput(controlsCollection)
|
||||
},
|
||||
}
|
||||
|
||||
|
||||
@@ -27,6 +27,7 @@ var nodeCmd = &cobra.Command{
|
||||
Run: func(cmd *cobra.Command, args []string) {
|
||||
filename := loadConfig(check.NODE)
|
||||
runChecks(check.NODE, filename)
|
||||
writeOutput(controlsCollection)
|
||||
},
|
||||
}
|
||||
|
||||
|
||||
52
cmd/root.go
52
cmd/root.go
@@ -33,27 +33,29 @@ type FilterOpts struct {
|
||||
}
|
||||
|
||||
var (
|
||||
envVarsPrefix = "KUBE_BENCH"
|
||||
defaultKubeVersion = "1.11"
|
||||
kubeVersion string
|
||||
benchmarkVersion string
|
||||
cfgFile string
|
||||
cfgDir = "./cfg/"
|
||||
jsonFmt bool
|
||||
junitFmt bool
|
||||
pgSQL bool
|
||||
masterFile = "master.yaml"
|
||||
nodeFile = "node.yaml"
|
||||
etcdFile = "etcd.yaml"
|
||||
controlplaneFile = "controlplane.yaml"
|
||||
policiesFile = "policies.yaml"
|
||||
noResults bool
|
||||
noSummary bool
|
||||
noRemediations bool
|
||||
filterOpts FilterOpts
|
||||
includeTestOutput bool
|
||||
outputFile string
|
||||
configFileError error
|
||||
envVarsPrefix = "KUBE_BENCH"
|
||||
defaultKubeVersion = "1.11"
|
||||
kubeVersion string
|
||||
benchmarkVersion string
|
||||
cfgFile string
|
||||
cfgDir = "./cfg/"
|
||||
jsonFmt bool
|
||||
junitFmt bool
|
||||
pgSQL bool
|
||||
masterFile = "master.yaml"
|
||||
nodeFile = "node.yaml"
|
||||
etcdFile = "etcd.yaml"
|
||||
controlplaneFile = "controlplane.yaml"
|
||||
policiesFile = "policies.yaml"
|
||||
managedservicesFile = "managedservices.yaml"
|
||||
noResults bool
|
||||
noSummary bool
|
||||
noRemediations bool
|
||||
filterOpts FilterOpts
|
||||
includeTestOutput bool
|
||||
outputFile string
|
||||
configFileError error
|
||||
controlsCollection []*check.Controls
|
||||
)
|
||||
|
||||
// RootCmd represents the base command when called without any subcommands
|
||||
@@ -96,6 +98,14 @@ var RootCmd = &cobra.Command{
|
||||
runChecks(check.POLICIES, loadConfig(check.POLICIES))
|
||||
}
|
||||
|
||||
// Managedservices is only valid for GKE 1.0 and later,
|
||||
// this a gatekeeper for previous versions.
|
||||
if validTargets(benchmarkVersion, []string{string(check.MANAGEDSERVICES)}) {
|
||||
glog.V(1).Info("== Running managed services checks ==\n")
|
||||
runChecks(check.MANAGEDSERVICES, loadConfig(check.MANAGEDSERVICES))
|
||||
}
|
||||
|
||||
writeOutput(controlsCollection)
|
||||
},
|
||||
}
|
||||
|
||||
|
||||
@@ -67,6 +67,7 @@ func run(targets []string, benchmarkVersion string) (err error) {
|
||||
runChecks(testType, yamlFile)
|
||||
}
|
||||
|
||||
writeOutput(controlsCollection)
|
||||
return nil
|
||||
}
|
||||
|
||||
|
||||
114
cmd/testdata/controlsCollection.json
vendored
Normal file
114
cmd/testdata/controlsCollection.json
vendored
Normal file
@@ -0,0 +1,114 @@
|
||||
[
|
||||
{
|
||||
"id": "2",
|
||||
"version": "1.15",
|
||||
"text": "Etcd Node Configuration",
|
||||
"node_type": "etcd",
|
||||
"tests": [
|
||||
{
|
||||
"section": "2",
|
||||
"pass": 7,
|
||||
"fail": 0,
|
||||
"warn": 0,
|
||||
"info": 0,
|
||||
"desc": "Etcd Node Configuration Files",
|
||||
"results": [
|
||||
{
|
||||
"test_number": "2.1",
|
||||
"test_desc": "Ensure that the --cert-file and --key-file arguments are set as appropriate (Scored)",
|
||||
"audit": "/bin/ps -ef | /bin/grep etcd | /bin/grep -v grep",
|
||||
"AuditConfig": "",
|
||||
"type": "",
|
||||
"remediation": "Follow the etcd service documentation and configure TLS encryption.\nThen, edit the etcd pod specification file /etc/kubernetes/manifests/etcd.yaml\non the master node and set the below parameters.\n--cert-file=</path/to/ca-file>\n--key-file=</path/to/key-file>\n",
|
||||
"test_info": [
|
||||
"Follow the etcd service documentation and configure TLS encryption.\nThen, edit the etcd pod specification file /etc/kubernetes/manifests/etcd.yaml\non the master node and set the below parameters.\n--cert-file=</path/to/ca-file>\n--key-file=</path/to/key-file>\n"
|
||||
],
|
||||
"status": "PASS",
|
||||
"actual_value": "root 3277 3218 3 Apr19 ? 03:57:52 etcd --advertise-client-urls=https://192.168.64.4:2379 --cert-file=/var/lib/minikube/certs/etcd/server.crt --client-cert-auth=true --data-dir=/var/lib/minikube/etcd --initial-advertise-peer-urls=https://192.168.64.4:2380 --initial-cluster=minikube=https://192.168.64.4:2380 --key-file=/var/lib/minikube/certs/etcd/server.key --listen-client-urls=https://127.0.0.1:2379,https://192.168.64.4:2379 --listen-metrics-urls=http://127.0.0.1:2381 --listen-peer-urls=https://192.168.64.4:2380 --name=minikube --peer-cert-file=/var/lib/minikube/certs/etcd/peer.crt --peer-client-cert-auth=true --peer-key-file=/var/lib/minikube/certs/etcd/peer.key --peer-trusted-ca-file=/var/lib/minikube/certs/etcd/ca.crt --snapshot-count=10000 --trusted-ca-file=/var/lib/minikube/certs/etcd/ca.crt\nroot 4624 4605 8 Apr21 ? 04:55:10 kube-apiserver --advertise-address=192.168.64.4 --allow-privileged=true --authorization-mode=Node,RBAC --client-ca-file=/var/lib/minikube/certs/ca.crt --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,NodeRestriction,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,PodSecurityPolicy --enable-bootstrap-token-auth=true --etcd-cafile=/var/lib/minikube/certs/etcd/ca.crt --etcd-certfile=/var/lib/minikube/certs/apiserver-etcd-client.crt --etcd-keyfile=/var/lib/minikube/certs/apiserver-etcd-client.key --etcd-servers=https://127.0.0.1:2379 --insecure-port=0 --kubelet-client-certificate=/var/lib/minikube/certs/apiserver-kubelet-client.crt --kubelet-client-key=/var/lib/minikube/certs/apiserver-kubelet-client.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --proxy-client-cert-file=/var/lib/minikube/certs/front-proxy-client.crt --proxy-client-key-file=/var/lib/minikube/certs/front-proxy-client.key --requestheader-allowed-names=front-proxy-client --requestheader-client-ca-file=/var/lib/minikube/certs/front-proxy-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=8443 --service-account-key-file=/var/lib/minikube/certs/sa.pub --service-cluster-ip-range=10.96.0.0/12 --tls-cert-file=/var/lib/minikube/certs/apiserver.crt --tls-private-key-file=/var/lib/minikube/certs/apiserver.key\n",
|
||||
"scored": true,
|
||||
"expected_result": "'--cert-file' is present AND '--key-file' is present"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"total_pass": 7,
|
||||
"total_fail": 0,
|
||||
"total_warn": 0,
|
||||
"total_info": 0
|
||||
},
|
||||
{
|
||||
"id": "3",
|
||||
"version": "1.5",
|
||||
"text": "Control Plane Configuration",
|
||||
"node_type": "controlplane",
|
||||
"tests": [
|
||||
{
|
||||
"section": "3.1",
|
||||
"pass": 0,
|
||||
"fail": 0,
|
||||
"warn": 1,
|
||||
"info": 0,
|
||||
"desc": "Authentication and Authorization",
|
||||
"results": [
|
||||
{
|
||||
"test_number": "3.1.1",
|
||||
"test_desc": "Client certificate authentication should not be used for users (Not Scored)",
|
||||
"audit": "",
|
||||
"AuditConfig": "",
|
||||
"type": "manual",
|
||||
"remediation": "Alternative mechanisms provided by Kubernetes such as the use of OIDC should be\nimplemented in place of client certificates.\n",
|
||||
"test_info": [
|
||||
"Alternative mechanisms provided by Kubernetes such as the use of OIDC should be\nimplemented in place of client certificates.\n"
|
||||
],
|
||||
"status": "WARN",
|
||||
"actual_value": "",
|
||||
"scored": false,
|
||||
"expected_result": "",
|
||||
"reason": "Test marked as a manual test"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"total_pass": 0,
|
||||
"total_fail": 0,
|
||||
"total_warn": 3,
|
||||
"total_info": 0
|
||||
},
|
||||
{
|
||||
"id": "1",
|
||||
"version": "1.5",
|
||||
"text": "Master Node Security Configuration",
|
||||
"node_type": "master",
|
||||
"tests": [
|
||||
{
|
||||
"section": "1.1",
|
||||
"pass": 15,
|
||||
"fail": 1,
|
||||
"warn": 5,
|
||||
"info": 0,
|
||||
"desc": "Master Node Configuration Files",
|
||||
"results": [
|
||||
{
|
||||
"test_number": "1.1.1",
|
||||
"test_desc": "Ensure that the API server pod specification file permissions are set to 644 or more restrictive (Scored)",
|
||||
"audit": "/bin/sh -c 'if test -e /etc/kubernetes/manifests/kube-apiserver.yaml; then stat -c permissions=%a /etc/kubernetes/manifests/kube-apiserver.yaml; fi'",
|
||||
"AuditConfig": "",
|
||||
"type": "",
|
||||
"remediation": "Run the below command (based on the file location on your system) on the\nmaster node.\nFor example, chmod 644 /etc/kubernetes/manifests/kube-apiserver.yaml\n",
|
||||
"test_info": [
|
||||
"Run the below command (based on the file location on your system) on the\nmaster node.\nFor example, chmod 644 /etc/kubernetes/manifests/kube-apiserver.yaml\n"
|
||||
],
|
||||
"status": "PASS",
|
||||
"actual_value": "permissions=600\n",
|
||||
"scored": true,
|
||||
"expected_result": "bitmask '600' AND '644'"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"total_pass": 42,
|
||||
"total_fail": 12,
|
||||
"total_warn": 11,
|
||||
"total_info": 0
|
||||
}
|
||||
]
|
||||
114
cmd/testdata/result.json
vendored
Normal file
114
cmd/testdata/result.json
vendored
Normal file
@@ -0,0 +1,114 @@
|
||||
[
|
||||
{
|
||||
"id": "1",
|
||||
"version": "1.5",
|
||||
"text": "Master Node Security Configuration",
|
||||
"node_type": "master",
|
||||
"tests": [
|
||||
{
|
||||
"section": "1.1",
|
||||
"pass": 15,
|
||||
"fail": 1,
|
||||
"warn": 5,
|
||||
"info": 0,
|
||||
"desc": "Master Node Configuration Files",
|
||||
"results": [
|
||||
{
|
||||
"test_number": "1.1.1",
|
||||
"test_desc": "Ensure that the API server pod specification file permissions are set to 644 or more restrictive (Scored)",
|
||||
"audit": "/bin/sh -c 'if test -e /etc/kubernetes/manifests/kube-apiserver.yaml; then stat -c permissions=%a /etc/kubernetes/manifests/kube-apiserver.yaml; fi'",
|
||||
"AuditConfig": "",
|
||||
"type": "",
|
||||
"remediation": "Run the below command (based on the file location on your system) on the\nmaster node.\nFor example, chmod 644 /etc/kubernetes/manifests/kube-apiserver.yaml\n",
|
||||
"test_info": [
|
||||
"Run the below command (based on the file location on your system) on the\nmaster node.\nFor example, chmod 644 /etc/kubernetes/manifests/kube-apiserver.yaml\n"
|
||||
],
|
||||
"status": "PASS",
|
||||
"actual_value": "permissions=600\n",
|
||||
"scored": true,
|
||||
"expected_result": "bitmask '600' AND '644'"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"total_pass": 42,
|
||||
"total_fail": 12,
|
||||
"total_warn": 11,
|
||||
"total_info": 0
|
||||
},
|
||||
{
|
||||
"id": "2",
|
||||
"version": "1.15",
|
||||
"text": "Etcd Node Configuration",
|
||||
"node_type": "etcd",
|
||||
"tests": [
|
||||
{
|
||||
"section": "2",
|
||||
"pass": 7,
|
||||
"fail": 0,
|
||||
"warn": 0,
|
||||
"info": 0,
|
||||
"desc": "Etcd Node Configuration Files",
|
||||
"results": [
|
||||
{
|
||||
"test_number": "2.1",
|
||||
"test_desc": "Ensure that the --cert-file and --key-file arguments are set as appropriate (Scored)",
|
||||
"audit": "/bin/ps -ef | /bin/grep etcd | /bin/grep -v grep",
|
||||
"AuditConfig": "",
|
||||
"type": "",
|
||||
"remediation": "Follow the etcd service documentation and configure TLS encryption.\nThen, edit the etcd pod specification file /etc/kubernetes/manifests/etcd.yaml\non the master node and set the below parameters.\n--cert-file=</path/to/ca-file>\n--key-file=</path/to/key-file>\n",
|
||||
"test_info": [
|
||||
"Follow the etcd service documentation and configure TLS encryption.\nThen, edit the etcd pod specification file /etc/kubernetes/manifests/etcd.yaml\non the master node and set the below parameters.\n--cert-file=</path/to/ca-file>\n--key-file=</path/to/key-file>\n"
|
||||
],
|
||||
"status": "PASS",
|
||||
"actual_value": "root 3277 3218 3 Apr19 ? 03:57:52 etcd --advertise-client-urls=https://192.168.64.4:2379 --cert-file=/var/lib/minikube/certs/etcd/server.crt --client-cert-auth=true --data-dir=/var/lib/minikube/etcd --initial-advertise-peer-urls=https://192.168.64.4:2380 --initial-cluster=minikube=https://192.168.64.4:2380 --key-file=/var/lib/minikube/certs/etcd/server.key --listen-client-urls=https://127.0.0.1:2379,https://192.168.64.4:2379 --listen-metrics-urls=http://127.0.0.1:2381 --listen-peer-urls=https://192.168.64.4:2380 --name=minikube --peer-cert-file=/var/lib/minikube/certs/etcd/peer.crt --peer-client-cert-auth=true --peer-key-file=/var/lib/minikube/certs/etcd/peer.key --peer-trusted-ca-file=/var/lib/minikube/certs/etcd/ca.crt --snapshot-count=10000 --trusted-ca-file=/var/lib/minikube/certs/etcd/ca.crt\nroot 4624 4605 8 Apr21 ? 04:55:10 kube-apiserver --advertise-address=192.168.64.4 --allow-privileged=true --authorization-mode=Node,RBAC --client-ca-file=/var/lib/minikube/certs/ca.crt --enable-admission-plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultStorageClass,DefaultTolerationSeconds,NodeRestriction,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,ResourceQuota,PodSecurityPolicy --enable-bootstrap-token-auth=true --etcd-cafile=/var/lib/minikube/certs/etcd/ca.crt --etcd-certfile=/var/lib/minikube/certs/apiserver-etcd-client.crt --etcd-keyfile=/var/lib/minikube/certs/apiserver-etcd-client.key --etcd-servers=https://127.0.0.1:2379 --insecure-port=0 --kubelet-client-certificate=/var/lib/minikube/certs/apiserver-kubelet-client.crt --kubelet-client-key=/var/lib/minikube/certs/apiserver-kubelet-client.key --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname --proxy-client-cert-file=/var/lib/minikube/certs/front-proxy-client.crt --proxy-client-key-file=/var/lib/minikube/certs/front-proxy-client.key --requestheader-allowed-names=front-proxy-client --requestheader-client-ca-file=/var/lib/minikube/certs/front-proxy-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=8443 --service-account-key-file=/var/lib/minikube/certs/sa.pub --service-cluster-ip-range=10.96.0.0/12 --tls-cert-file=/var/lib/minikube/certs/apiserver.crt --tls-private-key-file=/var/lib/minikube/certs/apiserver.key\n",
|
||||
"scored": true,
|
||||
"expected_result": "'--cert-file' is present AND '--key-file' is present"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"total_pass": 7,
|
||||
"total_fail": 0,
|
||||
"total_warn": 0,
|
||||
"total_info": 0
|
||||
},
|
||||
{
|
||||
"id": "3",
|
||||
"version": "1.5",
|
||||
"text": "Control Plane Configuration",
|
||||
"node_type": "controlplane",
|
||||
"tests": [
|
||||
{
|
||||
"section": "3.1",
|
||||
"pass": 0,
|
||||
"fail": 0,
|
||||
"warn": 1,
|
||||
"info": 0,
|
||||
"desc": "Authentication and Authorization",
|
||||
"results": [
|
||||
{
|
||||
"test_number": "3.1.1",
|
||||
"test_desc": "Client certificate authentication should not be used for users (Not Scored)",
|
||||
"audit": "",
|
||||
"AuditConfig": "",
|
||||
"type": "manual",
|
||||
"remediation": "Alternative mechanisms provided by Kubernetes such as the use of OIDC should be\nimplemented in place of client certificates.\n",
|
||||
"test_info": [
|
||||
"Alternative mechanisms provided by Kubernetes such as the use of OIDC should be\nimplemented in place of client certificates.\n"
|
||||
],
|
||||
"status": "WARN",
|
||||
"actual_value": "",
|
||||
"scored": false,
|
||||
"expected_result": "",
|
||||
"reason": "Test marked as a manual test"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"total_pass": 0,
|
||||
"total_fail": 0,
|
||||
"total_warn": 3,
|
||||
"total_info": 0
|
||||
}
|
||||
]
|
||||
@@ -276,17 +276,17 @@ func multiWordReplace(s string, subname string, sub string) string {
|
||||
const missingKubectlKubeletMessage = `
|
||||
Unable to find the programs kubectl or kubelet in the PATH.
|
||||
These programs are used to determine which version of Kubernetes is running.
|
||||
Make sure the /usr/bin directory is mapped to the container,
|
||||
Make sure the /usr/local/mount-from-host/bin directory is mapped to the container,
|
||||
either in the job.yaml file, or Docker command.
|
||||
|
||||
For job.yaml:
|
||||
...
|
||||
- name: usr-bin
|
||||
mountPath: /usr/bin
|
||||
mountPath: /usr/local/mount-from-host/bin
|
||||
...
|
||||
|
||||
For docker command:
|
||||
docker -v $(which kubectl):/usr/bin/kubectl ....
|
||||
docker -v $(which kubectl):/usr/local/mount-from-host/bin/kubectl ....
|
||||
|
||||
Alternatively, you can specify the version with --version
|
||||
kube-bench --version <VERSION> ...
|
||||
|
||||
@@ -12,6 +12,9 @@ spec:
|
||||
image: ubuntu
|
||||
command: ["/bin/bash", "-c", "--"]
|
||||
args: ["while true; do sleep 30; done;"]
|
||||
env:
|
||||
- name: PATH
|
||||
value: "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/local/mount-from-host/bin"
|
||||
volumeMounts:
|
||||
- name: var-lib-kubelet
|
||||
mountPath: /var/lib/kubelet
|
||||
@@ -19,10 +22,10 @@ spec:
|
||||
mountPath: /etc/systemd
|
||||
- name: etc-kubernetes
|
||||
mountPath: /etc/kubernetes
|
||||
# /usr/bin is mounted to access kubectl / kubelet, for auto-detecting the Kubernetes version.
|
||||
# /usr/local/mount-from-host/bin is mounted to access kubectl / kubelet, for auto-detecting the Kubernetes version.
|
||||
# You can omit this mount if you specify --version as part of the command.
|
||||
- name: usr-bin
|
||||
mountPath: /usr/bin
|
||||
mountPath: /usr/local/mount-from-host/bin
|
||||
- name: kind-bin
|
||||
mountPath: /kind/bin
|
||||
resources:
|
||||
|
||||
@@ -23,10 +23,10 @@ spec:
|
||||
mountPath: /etc/systemd
|
||||
- name: etc-kubernetes
|
||||
mountPath: /etc/kubernetes
|
||||
# /usr/bin is mounted to access kubectl / kubelet, for auto-detecting the Kubernetes version.
|
||||
# /usr/local/mount-from-host/bin is mounted to access kubectl / kubelet, for auto-detecting the Kubernetes version.
|
||||
# You can omit this mount if you specify --version as part of the command.
|
||||
- name: usr-bin
|
||||
mountPath: /usr/bin
|
||||
mountPath: /usr/local/mount-from-host/bin
|
||||
- name: kind-bin
|
||||
mountPath: /kind/bin
|
||||
restartPolicy: Never
|
||||
|
||||
@@ -16,7 +16,7 @@ import (
|
||||
var kubebenchImg = flag.String("kubebenchImg", "aquasec/kube-bench:latest", "kube-bench image used as part of this test")
|
||||
var timeout = flag.Duration("timeout", 10*time.Minute, "Test Timeout")
|
||||
|
||||
func TestRunWithKind(t *testing.T) {
|
||||
func testCheckCISWithKind(t *testing.T, testdataDir string) {
|
||||
flag.Parse()
|
||||
fmt.Printf("kube-bench Container Image: %s\n", *kubebenchImg)
|
||||
|
||||
@@ -29,20 +29,20 @@ func TestRunWithKind(t *testing.T) {
|
||||
{
|
||||
TestName: "kube-bench",
|
||||
KubebenchYAML: "../job.yaml",
|
||||
ExpectedFile: "./testdata/job.data",
|
||||
ExpectedFile: fmt.Sprintf("./testdata/%s/job.data", testdataDir),
|
||||
},
|
||||
{
|
||||
TestName: "kube-bench-node",
|
||||
KubebenchYAML: "../job-node.yaml",
|
||||
ExpectedFile: "./testdata/job-node.data",
|
||||
ExpectedFile: fmt.Sprintf("./testdata/%s/job-node.data", testdataDir),
|
||||
},
|
||||
{
|
||||
TestName: "kube-bench-master",
|
||||
KubebenchYAML: "../job-master.yaml",
|
||||
ExpectedFile: "./testdata/job-master.data",
|
||||
ExpectedFile: fmt.Sprintf("./testdata/%s/job-master.data", testdataDir),
|
||||
},
|
||||
}
|
||||
ctx, err := setupCluster("kube-bench", "./testdata/add-tls-kind-k8s114.yaml", *timeout)
|
||||
ctx, err := setupCluster("kube-bench", fmt.Sprintf("./testdata/%s/add-tls-kind.yaml", testdataDir), *timeout)
|
||||
if err != nil {
|
||||
t.Fatalf("failed to setup KIND cluster error: %v", err)
|
||||
}
|
||||
@@ -80,6 +80,18 @@ func TestRunWithKind(t *testing.T) {
|
||||
}
|
||||
}
|
||||
|
||||
func TestCheckCIS13WithKind(t *testing.T) {
|
||||
testCheckCISWithKind(t, "cis-1.3")
|
||||
}
|
||||
|
||||
func TestCheckCIS14WithKind(t *testing.T) {
|
||||
testCheckCISWithKind(t, "cis-1.4")
|
||||
}
|
||||
|
||||
func TestCheckCIS15WithKind(t *testing.T) {
|
||||
testCheckCISWithKind(t, "cis-1.5")
|
||||
}
|
||||
|
||||
// This is simple "diff" between 2 strings containing multiple lines.
|
||||
// It's not a comprehensive diff between the 2 strings.
|
||||
// It does not inditcate when lines are deleted.
|
||||
|
||||
19
integration/testdata/cis-1.3/add-tls-kind.yaml
vendored
Normal file
19
integration/testdata/cis-1.3/add-tls-kind.yaml
vendored
Normal file
@@ -0,0 +1,19 @@
|
||||
---
|
||||
apiVersion: kind.sigs.k8s.io/v1alpha3
|
||||
kind: Cluster
|
||||
networking:
|
||||
apiServerAddress: "0.0.0.0"
|
||||
|
||||
kubeadmConfigPatchesJson6902:
|
||||
- group: kubelet.config.k8s.io
|
||||
version: v1beta1
|
||||
kind: KubeletConfiguration
|
||||
patch: |
|
||||
- op: add
|
||||
path: /tlsCipherSuites
|
||||
value: ["TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256","TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256"]
|
||||
|
||||
nodes:
|
||||
# the control plane node config
|
||||
- role: control-plane
|
||||
image: "kindest/node:v1.12.10"
|
||||
336
integration/testdata/cis-1.3/job-master.data
vendored
Normal file
336
integration/testdata/cis-1.3/job-master.data
vendored
Normal file
@@ -0,0 +1,336 @@
|
||||
[INFO] 1 Master Node Security Configuration
|
||||
[INFO] 1.1 API Server
|
||||
[FAIL] 1.1.1 Ensure that the --anonymous-auth argument is set to false (Scored)
|
||||
[PASS] 1.1.2 Ensure that the --basic-auth-file argument is not set (Scored)
|
||||
[PASS] 1.1.3 Ensure that the --insecure-allow-any-token argument is not set (Scored)
|
||||
[PASS] 1.1.4 Ensure that the --kubelet-https argument is set to true (Scored)
|
||||
[PASS] 1.1.5 Ensure that the --insecure-bind-address argument is not set (Scored)
|
||||
[PASS] 1.1.6 Ensure that the --insecure-port argument is set to 0 (Scored)
|
||||
[PASS] 1.1.7 Ensure that the --secure-port argument is not set to 0 (Scored)
|
||||
[FAIL] 1.1.8 Ensure that the --profiling argument is set to false (Scored)
|
||||
[FAIL] 1.1.9 Ensure that the --repair-malformed-updates argument is set to false (Scored)
|
||||
[PASS] 1.1.10 Ensure that the admission control plugin AlwaysAdmit is not set (Scored)
|
||||
[FAIL] 1.1.11 Ensure that the admission control plugin AlwaysPullImages is set (Scored)
|
||||
[FAIL] 1.1.12 Ensure that the admission control plugin DenyEscalatingExec is set (Scored)
|
||||
[FAIL] 1.1.13 Ensure that the admission control plugin SecurityContextDeny is set (Scored)
|
||||
[PASS] 1.1.14 Ensure that the admission control plugin NamespaceLifecycle is set (Scored)
|
||||
[FAIL] 1.1.15 Ensure that the --audit-log-path argument is set as appropriate (Scored)
|
||||
[FAIL] 1.1.16 Ensure that the --audit-log-maxage argument is set to 30 or as appropriate (Scored)
|
||||
[FAIL] 1.1.17 Ensure that the --audit-log-maxbackup argument is set to 10 or as appropriate (Scored)
|
||||
[FAIL] 1.1.18 Ensure that the --audit-log-maxsize argument is set to 100 or as appropriate (Scored)
|
||||
[PASS] 1.1.19 Ensure that the --authorization-mode argument is not set to AlwaysAllow (Scored)
|
||||
[PASS] 1.1.20 Ensure that the --token-auth-file parameter is not set (Scored)
|
||||
[FAIL] 1.1.21 Ensure that the --kubelet-certificate-authority argument is set as appropriate (Scored)
|
||||
[PASS] 1.1.22 Ensure that the --kubelet-client-certificate and --kubelet-client-key arguments are set as appropriate (Scored)
|
||||
[FAIL] 1.1.23 Ensure that the --service-account-lookup argument is set to true (Scored)
|
||||
[FAIL] 1.1.24 Ensure that the admission control plugin PodSecurityPolicy is set (Scored)
|
||||
[PASS] 1.1.25 Ensure that the --service-account-key-file argument is set as appropriate (Scored)
|
||||
[PASS] 1.1.26 Ensure that the --etcd-certfile and --etcd-keyfile arguments are set as appropriate (Scored)
|
||||
[FAIL] 1.1.27 Ensure that the admission control plugin ServiceAccount is set(Scored)
|
||||
[PASS] 1.1.28 Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate (Scored)
|
||||
[PASS] 1.1.29 Ensure that the --client-ca-file argument is set as appropriate (Scored)
|
||||
[WARN] 1.1.30 Ensure that the API Server only makes use of Strong Cryptographic Ciphers (Not Scored)
|
||||
[PASS] 1.1.31 Ensure that the --etcd-cafile argument is set as appropriate (Scored)
|
||||
[PASS] 1.1.32 Ensure that the --authorization-mode argument is set to Node (Scored)
|
||||
[PASS] 1.1.33 Ensure that the admission control plugin NodeRestriction is set (Scored)
|
||||
[FAIL] 1.1.34 Ensure that the --experimental-encryption-provider-config argument is set as appropriate (Scored)
|
||||
[WARN] 1.1.35 Ensure that the encryption provider is set to aescbc (Scored)
|
||||
[FAIL] 1.1.36 Ensure that the admission control plugin EventRateLimit is set (Scored)
|
||||
[PASS] 1.1.37a Ensure that the AdvancedAuditing argument is not set to false (Scored)
|
||||
[FAIL] 1.1.37b Ensure that the AdvancedAuditing argument is not set to false (Scored)
|
||||
[PASS] 1.1.38 Ensure that the --request-timeout argument is set as appropriate (Scored)
|
||||
[WARN] 1.1.39 Ensure that the API Server only makes use of Strong Cryptographic Ciphers ( Not Scored)
|
||||
[INFO] 1.2 Scheduler
|
||||
[FAIL] 1.2.1 Ensure that the --profiling argument is set to false (Scored)
|
||||
[PASS] 1.2.2 Ensure that the --address argument is set to 127.0.0.1 (Scored)
|
||||
[INFO] 1.3 Controller Manager
|
||||
[FAIL] 1.3.1 Ensure that the --terminated-pod-gc-threshold argument is set as appropriate (Scored)
|
||||
[FAIL] 1.3.2 Ensure that the --profiling argument is set to false (Scored)
|
||||
[PASS] 1.3.3 Ensure that the --use-service-account-credentials argument is set to true (Scored)
|
||||
[PASS] 1.3.4 Ensure that the --service-account-private-key-file argument is set as appropriate (Scored)
|
||||
[PASS] 1.3.5 Ensure that the --root-ca-file argument is set as appropriate (Scored)
|
||||
[FAIL] 1.3.6 Ensure that the RotateKubeletServerCertificate argument is set to true (Scored)
|
||||
[PASS] 1.3.7 Ensure that the --address argument is set to 127.0.0.1 (Scored)
|
||||
[INFO] 1.4 Configuration Files
|
||||
[PASS] 1.4.1 Ensure that the API server pod specification file permissions are set to 644 or more restrictive (Scored)
|
||||
[PASS] 1.4.2 Ensure that the API server pod specification file ownership is set to root:root (Scored)
|
||||
[PASS] 1.4.3 Ensure that the controller manager pod specification file permissions are set to 644 or more restrictive (Scored)
|
||||
[PASS] 1.4.4 Ensure that the controller manager pod specification file ownership is set to root:root (Scored)
|
||||
[PASS] 1.4.5 Ensure that the scheduler pod specification file permissions are set to 644 or more restrictive (Scored)
|
||||
[PASS] 1.4.6 Ensure that the scheduler pod specification file ownership is set to root:root (Scored)
|
||||
[PASS] 1.4.7 Ensure that the etcd pod specification file permissions are set to 644 or more restrictive (Scored)
|
||||
[PASS] 1.4.8 Ensure that the etcd pod specification file ownership is set to root:root (Scored)
|
||||
[WARN] 1.4.9 Ensure that the Container Network Interface file permissions are set to 644 or more restrictive (Not Scored)
|
||||
[WARN] 1.4.10 Ensure that the Container Network Interface file ownership is set to root:root (Not Scored)
|
||||
[FAIL] 1.4.11 Ensure that the etcd data directory permissions are set to 700 or more restrictive (Scored)
|
||||
[FAIL] 1.4.12 Ensure that the etcd data directory ownership is set to etcd:etcd (Scored)
|
||||
[PASS] 1.4.13 Ensure that the admin.conf file permissions are set to 644 or more restrictive (Scored)
|
||||
[PASS] 1.4.14 Ensure that the admin.conf file ownership is set to root:root (Scored)
|
||||
[PASS] 1.4.15 Ensure that the scheduler.conf file permissions are set to 644 or more restrictive (Scored)
|
||||
[PASS] 1.4.16 Ensure that the scheduler.conf file ownership is set to root:root (Scored)
|
||||
[PASS] 1.4.17 Ensure that the controller-manager.conf file permissions are set to 644 or more restrictive (Scored)
|
||||
[PASS] 1.4.18 Ensure that the controller-manager.conf file ownership is set to root:root (Scored)
|
||||
[INFO] 1.5 etcd
|
||||
[PASS] 1.5.1 Ensure that the --cert-file and --key-file arguments are set as appropriate (Scored)
|
||||
[PASS] 1.5.2 Ensure that the --client-cert-auth argument is set to true (Scored)
|
||||
[PASS] 1.5.3 Ensure that the --auto-tls argument is not set to true (Scored)
|
||||
[PASS] 1.5.4 Ensure that the --peer-cert-file and --peer-key-file arguments are set as appropriate (Scored)
|
||||
[PASS] 1.5.5 Ensure that the --peer-client-cert-auth argument is set to true (Scored)
|
||||
[PASS] 1.5.6 Ensure that the --peer-auto-tls argument is not set to true (Scored)
|
||||
[WARN] 1.5.7 Ensure that a unique Certificate Authority is used for etcd (Not Scored)
|
||||
[INFO] 1.6 General Security Primitives
|
||||
[WARN] 1.6.1 Ensure that the cluster-admin role is only used where required (Not Scored)
|
||||
[WARN] 1.6.2 Create administrative boundaries between resources using namespaces (Not Scored)
|
||||
[WARN] 1.6.3 Create network segmentation using Network Policies (Not Scored)
|
||||
[WARN] 1.6.4 Ensure that the seccomp profile is set to docker/default in your pod definitions (Not Scored)
|
||||
[WARN] 1.6.5 Apply Security Context to Your Pods and Containers (Not Scored)
|
||||
[WARN] 1.6.6 Configure Image Provenance using ImagePolicyWebhook admission controller (Not Scored)
|
||||
[WARN] 1.6.7 Configure Network policies as appropriate (Not Scored)
|
||||
[WARN] 1.6.8 Place compensating controls in the form of PSP and RBAC for privileged containers usage (Not Scored)
|
||||
[INFO] 1.7 PodSecurityPolicies
|
||||
[WARN] 1.7.1 Do not admit privileged containers (Not Scored)
|
||||
[WARN] 1.7.2 Do not admit containers wishing to share the host process ID namespace (Scored)
|
||||
[WARN] 1.7.3 Do not admit containers wishing to share the host IPC namespace (Scored)
|
||||
[WARN] 1.7.4 Do not admit containers wishing to share the host network namespace (Scored)
|
||||
[WARN] 1.7.5 Do not admit containers with allowPrivilegeEscalation (Scored)
|
||||
[WARN] 1.7.6 Do not admit root containers (Not Scored)
|
||||
[WARN] 1.7.7 Do not admit containers with dangerous capabilities (Not Scored)
|
||||
|
||||
== Remediations ==
|
||||
1.1.1 Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml
|
||||
on the master node and set the below parameter.
|
||||
--anonymous-auth=false
|
||||
|
||||
1.1.8 Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml
|
||||
on the master node and set the below parameter.
|
||||
--profiling=false
|
||||
|
||||
1.1.9 Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml
|
||||
on the master node and set the below parameter.
|
||||
--repair-malformed-updates=false
|
||||
|
||||
1.1.11 Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml
|
||||
on the master node and set the --enable-admission-plugins to
|
||||
include AlwaysPullImages.
|
||||
--enable-admission-plugins=...,AlwaysPullImages,...
|
||||
|
||||
1.1.12 Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml
|
||||
on the master node and set the --enable-admission-plugins parameter to a
|
||||
value that includes DenyEscalatingExec.
|
||||
--enable-admission-plugins=...,DenyEscalatingExec,...
|
||||
|
||||
1.1.13 Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml
|
||||
on the master node and set the --enable-admission-plugins parameter to
|
||||
include SecurityContextDeny.
|
||||
--enable-admission-plugins=...,SecurityContextDeny,...
|
||||
|
||||
1.1.15 Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml
|
||||
on the master node and set the --audit-log-path parameter to a suitable
|
||||
path and file where you would like audit logs to be written, for example:
|
||||
--audit-log-path=/var/log/apiserver/audit.log
|
||||
|
||||
1.1.16 Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml
|
||||
on the master node and set the --audit-log-maxage parameter to 30 or
|
||||
as an appropriate number of days: --audit-log-maxage=30
|
||||
|
||||
1.1.17 Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml
|
||||
on the master node and set the --audit-log-maxbackup parameter to 10
|
||||
or to an appropriate value.
|
||||
--audit-log-maxbackup=10
|
||||
|
||||
1.1.18 Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml
|
||||
on the master node and set the --audit-log-maxsize parameter to an
|
||||
appropriate size in MB. For example, to set it as 100 MB:
|
||||
--audit-log-maxsize=100
|
||||
|
||||
1.1.21 Follow the Kubernetes documentation and setup the TLS connection between the
|
||||
apiserver and kubelets. Then, edit the API server pod specification file
|
||||
/etc/kubernetes/manifests/kube-apiserver.yaml on the master node and set the --kubelet-certificate-authority
|
||||
parameter to the path to the cert file for the certificate authority.
|
||||
--kubelet-certificate-authority=<ca-string>
|
||||
|
||||
1.1.23 Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml
|
||||
on the master node and set the below parameter.
|
||||
--service-account-lookup=true
|
||||
|
||||
1.1.24 Follow the documentation and create Pod Security Policy objects as per your environment.
|
||||
Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml
|
||||
on the master node and set the --enable-admission-plugins parameter to a
|
||||
value that includes PodSecurityPolicy :
|
||||
--enable-admission-plugins=...,PodSecurityPolicy,...
|
||||
Then restart the API Server.
|
||||
|
||||
1.1.27 Follow the documentation and create ServiceAccount objects as per your environment.
|
||||
Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml
|
||||
on the master node and set the --enable-admission-plugins parameter to a
|
||||
value that includes ServiceAccount.
|
||||
--enable-admission-plugins=...,ServiceAccount,...
|
||||
|
||||
1.1.30 Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml
|
||||
on the master node and set the below parameter.
|
||||
--tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256
|
||||
|
||||
1.1.34 Follow the Kubernetes documentation and configure a EncryptionConfig file.
|
||||
Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml on the
|
||||
master node and set the --experimental-encryption-provider-config parameter
|
||||
to the path of that file:
|
||||
--experimental-encryption-provider-config=</path/to/EncryptionConfig/File>
|
||||
|
||||
1.1.35 [Manual test]
|
||||
Follow the Kubernetes documentation and configure a EncryptionConfig file. In this file,
|
||||
choose aescbc as the encryption provider.
|
||||
For example,
|
||||
kind: EncryptionConfig
|
||||
apiVersion: v1
|
||||
resources:
|
||||
- resources:
|
||||
- secrets
|
||||
providers:
|
||||
- aescbc:
|
||||
keys:
|
||||
- name: key1
|
||||
secret: <32-byte base64-encoded secret>
|
||||
|
||||
1.1.36 Follow the Kubernetes documentation and set the desired limits in a
|
||||
configuration file. Then, edit the API server pod specification file
|
||||
/etc/kubernetes/manifests/kube-apiserver.yaml and set the below parameters.
|
||||
--enable-admission-plugins=...,EventRateLimit,...
|
||||
--admission-control-config-file=<path/to/configuration/file>
|
||||
|
||||
1.1.37b Follow the Kubernetes documentation and set the desired audit policy in the
|
||||
/etc/kubernetes/audit-policy.yaml file. Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml
|
||||
and set the below parameters.
|
||||
--audit-policy-file=/etc/kubernetes/audit-policy.yaml
|
||||
|
||||
1.1.39 Edit the API server pod specification file /etc/kubernetes/manifests
|
||||
kube-apiserver.yaml on the master node and set the below parameter.
|
||||
--tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256
|
||||
|
||||
1.2.1 Edit the Scheduler pod specification file /etc/kubernetes/manifests/kube-scheduler.yaml
|
||||
file on the master node and set the below parameter.
|
||||
--profiling=false
|
||||
|
||||
1.3.1 Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml
|
||||
on the master node and set the --terminated-pod-gc-threshold to an appropriate threshold, for example:
|
||||
--terminated-pod-gc-threshold=10
|
||||
|
||||
1.3.2 Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml
|
||||
on the master node and set the below parameter.
|
||||
--profiling=false
|
||||
|
||||
1.3.6 Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml
|
||||
controller-manager.yaml on the master node and set the --feature-gates parameter to
|
||||
include RotateKubeletServerCertificate=true.
|
||||
--feature-gates=RotateKubeletServerCertificate=true
|
||||
|
||||
1.4.9 [Manual test]
|
||||
Run the below command (based on the file location on your system) on the master node.
|
||||
For example,
|
||||
chmod 644 <path/to/cni/files>
|
||||
|
||||
1.4.10 [Manual test]
|
||||
Run the below command (based on the file location on your system) on the master node.
|
||||
For example,
|
||||
chown root:root <path/to/cni/files>
|
||||
|
||||
1.4.11 On the etcd server node, get the etcd data directory, passed as an argument --data-dir ,
|
||||
from the below command:
|
||||
ps -ef | grep etcd
|
||||
Run the below command (based on the etcd data directory found above). For example,
|
||||
chmod 700 /var/lib/etcd
|
||||
|
||||
1.4.12 On the etcd server node, get the etcd data directory, passed as an argument --data-dir ,
|
||||
from the below command:
|
||||
ps -ef | grep etcd
|
||||
Run the below command (based on the etcd data directory found above). For example,
|
||||
chown etcd:etcd /var/lib/etcd
|
||||
|
||||
1.5.7 [Manual test]
|
||||
Follow the etcd documentation and create a dedicated certificate authority setup for the
|
||||
etcd service.
|
||||
Then, edit the etcd pod specification file /etc/kubernetes/manifests/etcd.yaml on the
|
||||
master node and set the below parameter.
|
||||
--trusted-ca-file=</path/to/ca-file>
|
||||
|
||||
1.6.1 [Manual test]
|
||||
Remove any unneeded clusterrolebindings :
|
||||
kubectl delete clusterrolebinding [name]
|
||||
|
||||
1.6.2 [Manual test]
|
||||
Follow the documentation and create namespaces for objects in your deployment as you
|
||||
need them.
|
||||
|
||||
1.6.3 [Manual test]
|
||||
Follow the documentation and create NetworkPolicy objects as you need them.
|
||||
|
||||
1.6.4 [Manual test]
|
||||
Seccomp is an alpha feature currently. By default, all alpha features are disabled. So, you
|
||||
would need to enable alpha features in the apiserver by passing "--feature-
|
||||
gates=AllAlpha=true" argument.
|
||||
Edit the /etc/kubernetes/manifests/kube-apiserver.yaml file on the master node and set the KUBE_API_ARGS
|
||||
parameter to "--feature-gates=AllAlpha=true"
|
||||
KUBE_API_ARGS="--feature-gates=AllAlpha=true"
|
||||
Based on your system, restart the kube-apiserver service. For example:
|
||||
systemctl restart kube-apiserver.service
|
||||
Use annotations to enable the docker/default seccomp profile in your pod definitions. An
|
||||
example is as below:
|
||||
apiVersion: v1
|
||||
kind: Pod
|
||||
metadata:
|
||||
name: trustworthy-pod
|
||||
annotations:
|
||||
seccomp.security.alpha.kubernetes.io/pod: docker/default
|
||||
spec:
|
||||
containers:
|
||||
- name: trustworthy-container
|
||||
image: sotrustworthy:latest
|
||||
|
||||
1.6.5 [Manual test]
|
||||
Follow the Kubernetes documentation and apply security contexts to your pods. For a
|
||||
suggested list of security contexts, you may refer to the CIS Security Benchmark for Docker
|
||||
Containers.
|
||||
|
||||
1.6.6 [Manual test]
|
||||
Follow the Kubernetes documentation and setup image provenance.
|
||||
|
||||
1.6.7 [Manual test]
|
||||
Follow the Kubernetes documentation and setup network policies as appropriate.
|
||||
For example, you could create a "default" isolation policy for a Namespace by creating a
|
||||
NetworkPolicy that selects all pods but does not allow any traffic:
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: NetworkPolicy
|
||||
metadata:
|
||||
name: default-deny
|
||||
spec:
|
||||
podSelector:
|
||||
|
||||
1.6.8 [Manual test]
|
||||
Follow Kubernetes documentation and setup PSP and RBAC authorization for your cluster.
|
||||
|
||||
1.7.1 [Manual test]
|
||||
Create a PSP as described in the Kubernetes documentation, ensuring that the .spec.privileged field is omitted or set to false.
|
||||
|
||||
1.7.2 [Manual test]
|
||||
Create a PSP as described in the Kubernetes documentation, ensuring that the .spec.hostPID field is omitted or set to false.
|
||||
|
||||
1.7.3 [Manual test]
|
||||
Create a PSP as described in the Kubernetes documentation, ensuring that the .spec.hostIPC field is omitted or set to false.
|
||||
|
||||
1.7.4 [Manual test]
|
||||
Create a PSP as described in the Kubernetes documentation, ensuring that the .spec.hostNetwork field is omitted or set to false.
|
||||
|
||||
1.7.5 [Manual test]
|
||||
Create a PSP as described in the Kubernetes documentation, ensuring that the .spec.allowPrivilegeEscalation field is omitted or set to false.
|
||||
|
||||
1.7.6 [Manual test]
|
||||
Create a PSP as described in the Kubernetes documentation, ensuring that the .spec.runAsUser.rule is set to either MustRunAsNonRoot or MustRunAs with the range of UIDs not including 0.
|
||||
|
||||
1.7.7 [Manual test]
|
||||
Create a PSP as described in the Kubernetes documentation, ensuring that the .spec.requiredDropCapabilities is set to include either NET_RAW or ALL.
|
||||
|
||||
|
||||
== Summary ==
|
||||
45 checks PASS
|
||||
23 checks FAIL
|
||||
21 checks WARN
|
||||
0 checks INFO
|
||||
104
integration/testdata/cis-1.3/job-node.data
vendored
Normal file
104
integration/testdata/cis-1.3/job-node.data
vendored
Normal file
@@ -0,0 +1,104 @@
|
||||
[INFO] 2 Worker Node Security Configuration
|
||||
[INFO] 2.1 Kubelet
|
||||
[FAIL] 2.1.1 Ensure that the --allow-privileged argument is set to false (Scored)
|
||||
[PASS] 2.1.2 Ensure that the --anonymous-auth argument is set to false (Scored)
|
||||
[PASS] 2.1.3 Ensure that the --authorization-mode argument is not set to AlwaysAllow (Scored)
|
||||
[PASS] 2.1.4 Ensure that the --client-ca-file argument is set as appropriate (Scored)
|
||||
[FAIL] 2.1.5 Ensure that the --read-only-port argument is set to 0 (Scored)
|
||||
[PASS] 2.1.6 Ensure that the --streaming-connection-idle-timeout argument is not set to 0 (Scored)
|
||||
[FAIL] 2.1.7 Ensure that the --protect-kernel-defaults argument is set to true (Scored)
|
||||
[PASS] 2.1.8 Ensure that the --make-iptables-util-chains argument is set to true (Scored)
|
||||
[PASS] 2.1.9 Ensure that the --hostname-override argument is not set (Scored)
|
||||
[FAIL] 2.1.10 Ensure that the --event-qps argument is set to 0 (Scored)
|
||||
[FAIL] 2.1.11 Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate (Scored)
|
||||
[PASS] 2.1.12 Ensure that the --cadvisor-port argument is set to 0 (Scored)
|
||||
[PASS] 2.1.13 Ensure that the --rotate-certificates argument is not set to false (Scored)
|
||||
[FAIL] 2.1.14 Ensure that the RotateKubeletServerCertificate argument is set to true (Scored)
|
||||
[WARN] 2.1.15 Ensure that the Kubelet only makes use of Strong Cryptographic Ciphers (Not Scored)
|
||||
[INFO] 2.2 Configuration Files
|
||||
[PASS] 2.2.1 Ensure that the kubelet.conf file permissions are set to 644 or more restrictive (Scored)
|
||||
[PASS] 2.2.2 Ensure that the kubelet.conf file ownership is set to root:root (Scored)
|
||||
[PASS] 2.2.3 Ensure that the kubelet service file permissions are set to 644 or more restrictive (Scored)
|
||||
[PASS] 2.2.4 Ensure that the kubelet service file ownership is set to root:root (Scored)
|
||||
[FAIL] 2.2.5 Ensure that the proxy kubeconfig file permissions are set to 644 or more restrictive (Scored)
|
||||
[FAIL] 2.2.6 Ensure that the proxy kubeconfig file ownership is set to root:root (Scored)
|
||||
[WARN] 2.2.7 Ensure that the certificate authorities file permissions are set to 644 or more restrictive (Scored)
|
||||
[PASS] 2.2.8 Ensure that the client certificate authorities file ownership is set to root:root (Scored)
|
||||
[PASS] 2.2.9 Ensure that the kubelet configuration file ownership is set to root:root (Scored)
|
||||
[PASS] 2.2.10 Ensure that the kubelet configuration file has permissions set to 644 or more restrictive (Scored)
|
||||
|
||||
== Remediations ==
|
||||
2.1.1 Edit the kubelet service file /etc/systemd/system/kubelet.service.d/10-kubeadm.conf
|
||||
on each worker node and set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable.
|
||||
--allow-privileged=false
|
||||
Based on your system, restart the kubelet service. For example:
|
||||
systemctl daemon-reload
|
||||
systemctl restart kubelet.service
|
||||
|
||||
2.1.5 If using a Kubelet config file, edit the file to set readOnlyPort to 0 .
|
||||
If using command line arguments, edit the kubelet service file
|
||||
/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and
|
||||
set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable.
|
||||
--read-only-port=0
|
||||
Based on your system, restart the kubelet service. For example:
|
||||
systemctl daemon-reload
|
||||
systemctl restart kubelet.service
|
||||
|
||||
2.1.7 If using a Kubelet config file, edit the file to set protectKernelDefaults: true .
|
||||
If using command line arguments, edit the kubelet service file
|
||||
/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and
|
||||
set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable.
|
||||
--protect-kernel-defaults=true
|
||||
Based on your system, restart the kubelet service. For example:
|
||||
systemctl daemon-reload
|
||||
systemctl restart kubelet.service
|
||||
|
||||
2.1.10 If using a Kubelet config file, edit the file to set eventRecordQPS: 0 .
|
||||
If using command line arguments, edit the kubelet service file
|
||||
/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and
|
||||
set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable.
|
||||
--event-qps=0
|
||||
Based on your system, restart the kubelet service. For example:
|
||||
systemctl daemon-reload
|
||||
systemctl restart kubelet.service
|
||||
|
||||
2.1.11 If using a Kubelet config file, edit the file to set tlsCertFile to the location of the certificate
|
||||
file to use to identify this Kubelet, and tlsPrivateKeyFile to the location of the
|
||||
corresponding private key file.
|
||||
If using command line arguments, edit the kubelet service file
|
||||
/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and
|
||||
set the below parameters in KUBELET_CERTIFICATE_ARGS variable.
|
||||
--tls-cert-file=<path/to/tls-certificate-file>
|
||||
file=<path/to/tls-key-file>
|
||||
Based on your system, restart the kubelet service. For example:
|
||||
systemctl daemon-reload
|
||||
systemctl restart kubelet.service
|
||||
|
||||
2.1.14 Edit the kubelet service file /etc/systemd/system/kubelet.service.d/10-kubeadm.conf
|
||||
on each worker node and set the below parameter in KUBELET_CERTIFICATE_ARGS variable.
|
||||
--feature-gates=RotateKubeletServerCertificate=true
|
||||
Based on your system, restart the kubelet service. For example:
|
||||
systemctl daemon-reload
|
||||
systemctl restart kubelet.service
|
||||
|
||||
2.1.15 If using a Kubelet config file, edit the file to set TLSCipherSuites: to TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256
|
||||
If using executable arguments, edit the kubelet service file /etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and set the below parameter.
|
||||
--tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256
|
||||
|
||||
2.2.5 Run the below command (based on the file location on your system) on the each worker
|
||||
node. For example,
|
||||
chmod 644 /etc/kubernetes/proxy.conf
|
||||
|
||||
2.2.6 Run the below command (based on the file location on your system) on the each worker
|
||||
node. For example,
|
||||
chown root:root /etc/kubernetes/proxy.conf
|
||||
|
||||
2.2.7 Run the following command to modify the file permissions of the --client-ca-file
|
||||
chmod 644 <filename>
|
||||
|
||||
|
||||
== Summary ==
|
||||
15 checks PASS
|
||||
8 checks FAIL
|
||||
2 checks WARN
|
||||
0 checks INFO
|
||||
440
integration/testdata/cis-1.3/job.data
vendored
Normal file
440
integration/testdata/cis-1.3/job.data
vendored
Normal file
@@ -0,0 +1,440 @@
|
||||
[INFO] 1 Master Node Security Configuration
|
||||
[INFO] 1.1 API Server
|
||||
[FAIL] 1.1.1 Ensure that the --anonymous-auth argument is set to false (Scored)
|
||||
[PASS] 1.1.2 Ensure that the --basic-auth-file argument is not set (Scored)
|
||||
[PASS] 1.1.3 Ensure that the --insecure-allow-any-token argument is not set (Scored)
|
||||
[PASS] 1.1.4 Ensure that the --kubelet-https argument is set to true (Scored)
|
||||
[PASS] 1.1.5 Ensure that the --insecure-bind-address argument is not set (Scored)
|
||||
[PASS] 1.1.6 Ensure that the --insecure-port argument is set to 0 (Scored)
|
||||
[PASS] 1.1.7 Ensure that the --secure-port argument is not set to 0 (Scored)
|
||||
[FAIL] 1.1.8 Ensure that the --profiling argument is set to false (Scored)
|
||||
[FAIL] 1.1.9 Ensure that the --repair-malformed-updates argument is set to false (Scored)
|
||||
[PASS] 1.1.10 Ensure that the admission control plugin AlwaysAdmit is not set (Scored)
|
||||
[FAIL] 1.1.11 Ensure that the admission control plugin AlwaysPullImages is set (Scored)
|
||||
[FAIL] 1.1.12 Ensure that the admission control plugin DenyEscalatingExec is set (Scored)
|
||||
[FAIL] 1.1.13 Ensure that the admission control plugin SecurityContextDeny is set (Scored)
|
||||
[PASS] 1.1.14 Ensure that the admission control plugin NamespaceLifecycle is set (Scored)
|
||||
[FAIL] 1.1.15 Ensure that the --audit-log-path argument is set as appropriate (Scored)
|
||||
[FAIL] 1.1.16 Ensure that the --audit-log-maxage argument is set to 30 or as appropriate (Scored)
|
||||
[FAIL] 1.1.17 Ensure that the --audit-log-maxbackup argument is set to 10 or as appropriate (Scored)
|
||||
[FAIL] 1.1.18 Ensure that the --audit-log-maxsize argument is set to 100 or as appropriate (Scored)
|
||||
[PASS] 1.1.19 Ensure that the --authorization-mode argument is not set to AlwaysAllow (Scored)
|
||||
[PASS] 1.1.20 Ensure that the --token-auth-file parameter is not set (Scored)
|
||||
[FAIL] 1.1.21 Ensure that the --kubelet-certificate-authority argument is set as appropriate (Scored)
|
||||
[PASS] 1.1.22 Ensure that the --kubelet-client-certificate and --kubelet-client-key arguments are set as appropriate (Scored)
|
||||
[FAIL] 1.1.23 Ensure that the --service-account-lookup argument is set to true (Scored)
|
||||
[FAIL] 1.1.24 Ensure that the admission control plugin PodSecurityPolicy is set (Scored)
|
||||
[PASS] 1.1.25 Ensure that the --service-account-key-file argument is set as appropriate (Scored)
|
||||
[PASS] 1.1.26 Ensure that the --etcd-certfile and --etcd-keyfile arguments are set as appropriate (Scored)
|
||||
[FAIL] 1.1.27 Ensure that the admission control plugin ServiceAccount is set(Scored)
|
||||
[PASS] 1.1.28 Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate (Scored)
|
||||
[PASS] 1.1.29 Ensure that the --client-ca-file argument is set as appropriate (Scored)
|
||||
[WARN] 1.1.30 Ensure that the API Server only makes use of Strong Cryptographic Ciphers (Not Scored)
|
||||
[PASS] 1.1.31 Ensure that the --etcd-cafile argument is set as appropriate (Scored)
|
||||
[PASS] 1.1.32 Ensure that the --authorization-mode argument is set to Node (Scored)
|
||||
[PASS] 1.1.33 Ensure that the admission control plugin NodeRestriction is set (Scored)
|
||||
[FAIL] 1.1.34 Ensure that the --experimental-encryption-provider-config argument is set as appropriate (Scored)
|
||||
[WARN] 1.1.35 Ensure that the encryption provider is set to aescbc (Scored)
|
||||
[FAIL] 1.1.36 Ensure that the admission control plugin EventRateLimit is set (Scored)
|
||||
[PASS] 1.1.37a Ensure that the AdvancedAuditing argument is not set to false (Scored)
|
||||
[FAIL] 1.1.37b Ensure that the AdvancedAuditing argument is not set to false (Scored)
|
||||
[PASS] 1.1.38 Ensure that the --request-timeout argument is set as appropriate (Scored)
|
||||
[WARN] 1.1.39 Ensure that the API Server only makes use of Strong Cryptographic Ciphers ( Not Scored)
|
||||
[INFO] 1.2 Scheduler
|
||||
[FAIL] 1.2.1 Ensure that the --profiling argument is set to false (Scored)
|
||||
[PASS] 1.2.2 Ensure that the --address argument is set to 127.0.0.1 (Scored)
|
||||
[INFO] 1.3 Controller Manager
|
||||
[FAIL] 1.3.1 Ensure that the --terminated-pod-gc-threshold argument is set as appropriate (Scored)
|
||||
[FAIL] 1.3.2 Ensure that the --profiling argument is set to false (Scored)
|
||||
[PASS] 1.3.3 Ensure that the --use-service-account-credentials argument is set to true (Scored)
|
||||
[PASS] 1.3.4 Ensure that the --service-account-private-key-file argument is set as appropriate (Scored)
|
||||
[PASS] 1.3.5 Ensure that the --root-ca-file argument is set as appropriate (Scored)
|
||||
[FAIL] 1.3.6 Ensure that the RotateKubeletServerCertificate argument is set to true (Scored)
|
||||
[PASS] 1.3.7 Ensure that the --address argument is set to 127.0.0.1 (Scored)
|
||||
[INFO] 1.4 Configuration Files
|
||||
[PASS] 1.4.1 Ensure that the API server pod specification file permissions are set to 644 or more restrictive (Scored)
|
||||
[PASS] 1.4.2 Ensure that the API server pod specification file ownership is set to root:root (Scored)
|
||||
[PASS] 1.4.3 Ensure that the controller manager pod specification file permissions are set to 644 or more restrictive (Scored)
|
||||
[PASS] 1.4.4 Ensure that the controller manager pod specification file ownership is set to root:root (Scored)
|
||||
[PASS] 1.4.5 Ensure that the scheduler pod specification file permissions are set to 644 or more restrictive (Scored)
|
||||
[PASS] 1.4.6 Ensure that the scheduler pod specification file ownership is set to root:root (Scored)
|
||||
[PASS] 1.4.7 Ensure that the etcd pod specification file permissions are set to 644 or more restrictive (Scored)
|
||||
[PASS] 1.4.8 Ensure that the etcd pod specification file ownership is set to root:root (Scored)
|
||||
[WARN] 1.4.9 Ensure that the Container Network Interface file permissions are set to 644 or more restrictive (Not Scored)
|
||||
[WARN] 1.4.10 Ensure that the Container Network Interface file ownership is set to root:root (Not Scored)
|
||||
[FAIL] 1.4.11 Ensure that the etcd data directory permissions are set to 700 or more restrictive (Scored)
|
||||
[FAIL] 1.4.12 Ensure that the etcd data directory ownership is set to etcd:etcd (Scored)
|
||||
[PASS] 1.4.13 Ensure that the admin.conf file permissions are set to 644 or more restrictive (Scored)
|
||||
[PASS] 1.4.14 Ensure that the admin.conf file ownership is set to root:root (Scored)
|
||||
[PASS] 1.4.15 Ensure that the scheduler.conf file permissions are set to 644 or more restrictive (Scored)
|
||||
[PASS] 1.4.16 Ensure that the scheduler.conf file ownership is set to root:root (Scored)
|
||||
[PASS] 1.4.17 Ensure that the controller-manager.conf file permissions are set to 644 or more restrictive (Scored)
|
||||
[PASS] 1.4.18 Ensure that the controller-manager.conf file ownership is set to root:root (Scored)
|
||||
[INFO] 1.5 etcd
|
||||
[PASS] 1.5.1 Ensure that the --cert-file and --key-file arguments are set as appropriate (Scored)
|
||||
[PASS] 1.5.2 Ensure that the --client-cert-auth argument is set to true (Scored)
|
||||
[PASS] 1.5.3 Ensure that the --auto-tls argument is not set to true (Scored)
|
||||
[PASS] 1.5.4 Ensure that the --peer-cert-file and --peer-key-file arguments are set as appropriate (Scored)
|
||||
[PASS] 1.5.5 Ensure that the --peer-client-cert-auth argument is set to true (Scored)
|
||||
[PASS] 1.5.6 Ensure that the --peer-auto-tls argument is not set to true (Scored)
|
||||
[WARN] 1.5.7 Ensure that a unique Certificate Authority is used for etcd (Not Scored)
|
||||
[INFO] 1.6 General Security Primitives
|
||||
[WARN] 1.6.1 Ensure that the cluster-admin role is only used where required (Not Scored)
|
||||
[WARN] 1.6.2 Create administrative boundaries between resources using namespaces (Not Scored)
|
||||
[WARN] 1.6.3 Create network segmentation using Network Policies (Not Scored)
|
||||
[WARN] 1.6.4 Ensure that the seccomp profile is set to docker/default in your pod definitions (Not Scored)
|
||||
[WARN] 1.6.5 Apply Security Context to Your Pods and Containers (Not Scored)
|
||||
[WARN] 1.6.6 Configure Image Provenance using ImagePolicyWebhook admission controller (Not Scored)
|
||||
[WARN] 1.6.7 Configure Network policies as appropriate (Not Scored)
|
||||
[WARN] 1.6.8 Place compensating controls in the form of PSP and RBAC for privileged containers usage (Not Scored)
|
||||
[INFO] 1.7 PodSecurityPolicies
|
||||
[WARN] 1.7.1 Do not admit privileged containers (Not Scored)
|
||||
[WARN] 1.7.2 Do not admit containers wishing to share the host process ID namespace (Scored)
|
||||
[WARN] 1.7.3 Do not admit containers wishing to share the host IPC namespace (Scored)
|
||||
[WARN] 1.7.4 Do not admit containers wishing to share the host network namespace (Scored)
|
||||
[WARN] 1.7.5 Do not admit containers with allowPrivilegeEscalation (Scored)
|
||||
[WARN] 1.7.6 Do not admit root containers (Not Scored)
|
||||
[WARN] 1.7.7 Do not admit containers with dangerous capabilities (Not Scored)
|
||||
|
||||
== Remediations ==
|
||||
1.1.1 Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml
|
||||
on the master node and set the below parameter.
|
||||
--anonymous-auth=false
|
||||
|
||||
1.1.8 Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml
|
||||
on the master node and set the below parameter.
|
||||
--profiling=false
|
||||
|
||||
1.1.9 Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml
|
||||
on the master node and set the below parameter.
|
||||
--repair-malformed-updates=false
|
||||
|
||||
1.1.11 Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml
|
||||
on the master node and set the --enable-admission-plugins to
|
||||
include AlwaysPullImages.
|
||||
--enable-admission-plugins=...,AlwaysPullImages,...
|
||||
|
||||
1.1.12 Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml
|
||||
on the master node and set the --enable-admission-plugins parameter to a
|
||||
value that includes DenyEscalatingExec.
|
||||
--enable-admission-plugins=...,DenyEscalatingExec,...
|
||||
|
||||
1.1.13 Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml
|
||||
on the master node and set the --enable-admission-plugins parameter to
|
||||
include SecurityContextDeny.
|
||||
--enable-admission-plugins=...,SecurityContextDeny,...
|
||||
|
||||
1.1.15 Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml
|
||||
on the master node and set the --audit-log-path parameter to a suitable
|
||||
path and file where you would like audit logs to be written, for example:
|
||||
--audit-log-path=/var/log/apiserver/audit.log
|
||||
|
||||
1.1.16 Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml
|
||||
on the master node and set the --audit-log-maxage parameter to 30 or
|
||||
as an appropriate number of days: --audit-log-maxage=30
|
||||
|
||||
1.1.17 Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml
|
||||
on the master node and set the --audit-log-maxbackup parameter to 10
|
||||
or to an appropriate value.
|
||||
--audit-log-maxbackup=10
|
||||
|
||||
1.1.18 Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml
|
||||
on the master node and set the --audit-log-maxsize parameter to an
|
||||
appropriate size in MB. For example, to set it as 100 MB:
|
||||
--audit-log-maxsize=100
|
||||
|
||||
1.1.21 Follow the Kubernetes documentation and setup the TLS connection between the
|
||||
apiserver and kubelets. Then, edit the API server pod specification file
|
||||
/etc/kubernetes/manifests/kube-apiserver.yaml on the master node and set the --kubelet-certificate-authority
|
||||
parameter to the path to the cert file for the certificate authority.
|
||||
--kubelet-certificate-authority=<ca-string>
|
||||
|
||||
1.1.23 Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml
|
||||
on the master node and set the below parameter.
|
||||
--service-account-lookup=true
|
||||
|
||||
1.1.24 Follow the documentation and create Pod Security Policy objects as per your environment.
|
||||
Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml
|
||||
on the master node and set the --enable-admission-plugins parameter to a
|
||||
value that includes PodSecurityPolicy :
|
||||
--enable-admission-plugins=...,PodSecurityPolicy,...
|
||||
Then restart the API Server.
|
||||
|
||||
1.1.27 Follow the documentation and create ServiceAccount objects as per your environment.
|
||||
Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml
|
||||
on the master node and set the --enable-admission-plugins parameter to a
|
||||
value that includes ServiceAccount.
|
||||
--enable-admission-plugins=...,ServiceAccount,...
|
||||
|
||||
1.1.30 Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml
|
||||
on the master node and set the below parameter.
|
||||
--tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256
|
||||
|
||||
1.1.34 Follow the Kubernetes documentation and configure a EncryptionConfig file.
|
||||
Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml on the
|
||||
master node and set the --experimental-encryption-provider-config parameter
|
||||
to the path of that file:
|
||||
--experimental-encryption-provider-config=</path/to/EncryptionConfig/File>
|
||||
|
||||
1.1.35 [Manual test]
|
||||
Follow the Kubernetes documentation and configure a EncryptionConfig file. In this file,
|
||||
choose aescbc as the encryption provider.
|
||||
For example,
|
||||
kind: EncryptionConfig
|
||||
apiVersion: v1
|
||||
resources:
|
||||
- resources:
|
||||
- secrets
|
||||
providers:
|
||||
- aescbc:
|
||||
keys:
|
||||
- name: key1
|
||||
secret: <32-byte base64-encoded secret>
|
||||
|
||||
1.1.36 Follow the Kubernetes documentation and set the desired limits in a
|
||||
configuration file. Then, edit the API server pod specification file
|
||||
/etc/kubernetes/manifests/kube-apiserver.yaml and set the below parameters.
|
||||
--enable-admission-plugins=...,EventRateLimit,...
|
||||
--admission-control-config-file=<path/to/configuration/file>
|
||||
|
||||
1.1.37b Follow the Kubernetes documentation and set the desired audit policy in the
|
||||
/etc/kubernetes/audit-policy.yaml file. Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml
|
||||
and set the below parameters.
|
||||
--audit-policy-file=/etc/kubernetes/audit-policy.yaml
|
||||
|
||||
1.1.39 Edit the API server pod specification file /etc/kubernetes/manifests
|
||||
kube-apiserver.yaml on the master node and set the below parameter.
|
||||
--tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256
|
||||
|
||||
1.2.1 Edit the Scheduler pod specification file /etc/kubernetes/manifests/kube-scheduler.yaml
|
||||
file on the master node and set the below parameter.
|
||||
--profiling=false
|
||||
|
||||
1.3.1 Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml
|
||||
on the master node and set the --terminated-pod-gc-threshold to an appropriate threshold, for example:
|
||||
--terminated-pod-gc-threshold=10
|
||||
|
||||
1.3.2 Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml
|
||||
on the master node and set the below parameter.
|
||||
--profiling=false
|
||||
|
||||
1.3.6 Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml
|
||||
controller-manager.yaml on the master node and set the --feature-gates parameter to
|
||||
include RotateKubeletServerCertificate=true.
|
||||
--feature-gates=RotateKubeletServerCertificate=true
|
||||
|
||||
1.4.9 [Manual test]
|
||||
Run the below command (based on the file location on your system) on the master node.
|
||||
For example,
|
||||
chmod 644 <path/to/cni/files>
|
||||
|
||||
1.4.10 [Manual test]
|
||||
Run the below command (based on the file location on your system) on the master node.
|
||||
For example,
|
||||
chown root:root <path/to/cni/files>
|
||||
|
||||
1.4.11 On the etcd server node, get the etcd data directory, passed as an argument --data-dir ,
|
||||
from the below command:
|
||||
ps -ef | grep etcd
|
||||
Run the below command (based on the etcd data directory found above). For example,
|
||||
chmod 700 /var/lib/etcd
|
||||
|
||||
1.4.12 On the etcd server node, get the etcd data directory, passed as an argument --data-dir ,
|
||||
from the below command:
|
||||
ps -ef | grep etcd
|
||||
Run the below command (based on the etcd data directory found above). For example,
|
||||
chown etcd:etcd /var/lib/etcd
|
||||
|
||||
1.5.7 [Manual test]
|
||||
Follow the etcd documentation and create a dedicated certificate authority setup for the
|
||||
etcd service.
|
||||
Then, edit the etcd pod specification file /etc/kubernetes/manifests/etcd.yaml on the
|
||||
master node and set the below parameter.
|
||||
--trusted-ca-file=</path/to/ca-file>
|
||||
|
||||
1.6.1 [Manual test]
|
||||
Remove any unneeded clusterrolebindings :
|
||||
kubectl delete clusterrolebinding [name]
|
||||
|
||||
1.6.2 [Manual test]
|
||||
Follow the documentation and create namespaces for objects in your deployment as you
|
||||
need them.
|
||||
|
||||
1.6.3 [Manual test]
|
||||
Follow the documentation and create NetworkPolicy objects as you need them.
|
||||
|
||||
1.6.4 [Manual test]
|
||||
Seccomp is an alpha feature currently. By default, all alpha features are disabled. So, you
|
||||
would need to enable alpha features in the apiserver by passing "--feature-
|
||||
gates=AllAlpha=true" argument.
|
||||
Edit the /etc/kubernetes/manifests/kube-apiserver.yaml file on the master node and set the KUBE_API_ARGS
|
||||
parameter to "--feature-gates=AllAlpha=true"
|
||||
KUBE_API_ARGS="--feature-gates=AllAlpha=true"
|
||||
Based on your system, restart the kube-apiserver service. For example:
|
||||
systemctl restart kube-apiserver.service
|
||||
Use annotations to enable the docker/default seccomp profile in your pod definitions. An
|
||||
example is as below:
|
||||
apiVersion: v1
|
||||
kind: Pod
|
||||
metadata:
|
||||
name: trustworthy-pod
|
||||
annotations:
|
||||
seccomp.security.alpha.kubernetes.io/pod: docker/default
|
||||
spec:
|
||||
containers:
|
||||
- name: trustworthy-container
|
||||
image: sotrustworthy:latest
|
||||
|
||||
1.6.5 [Manual test]
|
||||
Follow the Kubernetes documentation and apply security contexts to your pods. For a
|
||||
suggested list of security contexts, you may refer to the CIS Security Benchmark for Docker
|
||||
Containers.
|
||||
|
||||
1.6.6 [Manual test]
|
||||
Follow the Kubernetes documentation and setup image provenance.
|
||||
|
||||
1.6.7 [Manual test]
|
||||
Follow the Kubernetes documentation and setup network policies as appropriate.
|
||||
For example, you could create a "default" isolation policy for a Namespace by creating a
|
||||
NetworkPolicy that selects all pods but does not allow any traffic:
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: NetworkPolicy
|
||||
metadata:
|
||||
name: default-deny
|
||||
spec:
|
||||
podSelector:
|
||||
|
||||
1.6.8 [Manual test]
|
||||
Follow Kubernetes documentation and setup PSP and RBAC authorization for your cluster.
|
||||
|
||||
1.7.1 [Manual test]
|
||||
Create a PSP as described in the Kubernetes documentation, ensuring that the .spec.privileged field is omitted or set to false.
|
||||
|
||||
1.7.2 [Manual test]
|
||||
Create a PSP as described in the Kubernetes documentation, ensuring that the .spec.hostPID field is omitted or set to false.
|
||||
|
||||
1.7.3 [Manual test]
|
||||
Create a PSP as described in the Kubernetes documentation, ensuring that the .spec.hostIPC field is omitted or set to false.
|
||||
|
||||
1.7.4 [Manual test]
|
||||
Create a PSP as described in the Kubernetes documentation, ensuring that the .spec.hostNetwork field is omitted or set to false.
|
||||
|
||||
1.7.5 [Manual test]
|
||||
Create a PSP as described in the Kubernetes documentation, ensuring that the .spec.allowPrivilegeEscalation field is omitted or set to false.
|
||||
|
||||
1.7.6 [Manual test]
|
||||
Create a PSP as described in the Kubernetes documentation, ensuring that the .spec.runAsUser.rule is set to either MustRunAsNonRoot or MustRunAs with the range of UIDs not including 0.
|
||||
|
||||
1.7.7 [Manual test]
|
||||
Create a PSP as described in the Kubernetes documentation, ensuring that the .spec.requiredDropCapabilities is set to include either NET_RAW or ALL.
|
||||
|
||||
|
||||
== Summary ==
|
||||
45 checks PASS
|
||||
23 checks FAIL
|
||||
21 checks WARN
|
||||
0 checks INFO
|
||||
[INFO] 2 Worker Node Security Configuration
|
||||
[INFO] 2.1 Kubelet
|
||||
[FAIL] 2.1.1 Ensure that the --allow-privileged argument is set to false (Scored)
|
||||
[PASS] 2.1.2 Ensure that the --anonymous-auth argument is set to false (Scored)
|
||||
[PASS] 2.1.3 Ensure that the --authorization-mode argument is not set to AlwaysAllow (Scored)
|
||||
[PASS] 2.1.4 Ensure that the --client-ca-file argument is set as appropriate (Scored)
|
||||
[FAIL] 2.1.5 Ensure that the --read-only-port argument is set to 0 (Scored)
|
||||
[PASS] 2.1.6 Ensure that the --streaming-connection-idle-timeout argument is not set to 0 (Scored)
|
||||
[FAIL] 2.1.7 Ensure that the --protect-kernel-defaults argument is set to true (Scored)
|
||||
[PASS] 2.1.8 Ensure that the --make-iptables-util-chains argument is set to true (Scored)
|
||||
[PASS] 2.1.9 Ensure that the --hostname-override argument is not set (Scored)
|
||||
[FAIL] 2.1.10 Ensure that the --event-qps argument is set to 0 (Scored)
|
||||
[FAIL] 2.1.11 Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate (Scored)
|
||||
[PASS] 2.1.12 Ensure that the --cadvisor-port argument is set to 0 (Scored)
|
||||
[PASS] 2.1.13 Ensure that the --rotate-certificates argument is not set to false (Scored)
|
||||
[FAIL] 2.1.14 Ensure that the RotateKubeletServerCertificate argument is set to true (Scored)
|
||||
[WARN] 2.1.15 Ensure that the Kubelet only makes use of Strong Cryptographic Ciphers (Not Scored)
|
||||
[INFO] 2.2 Configuration Files
|
||||
[PASS] 2.2.1 Ensure that the kubelet.conf file permissions are set to 644 or more restrictive (Scored)
|
||||
[PASS] 2.2.2 Ensure that the kubelet.conf file ownership is set to root:root (Scored)
|
||||
[PASS] 2.2.3 Ensure that the kubelet service file permissions are set to 644 or more restrictive (Scored)
|
||||
[PASS] 2.2.4 Ensure that the kubelet service file ownership is set to root:root (Scored)
|
||||
[FAIL] 2.2.5 Ensure that the proxy kubeconfig file permissions are set to 644 or more restrictive (Scored)
|
||||
[FAIL] 2.2.6 Ensure that the proxy kubeconfig file ownership is set to root:root (Scored)
|
||||
[WARN] 2.2.7 Ensure that the certificate authorities file permissions are set to 644 or more restrictive (Scored)
|
||||
[PASS] 2.2.8 Ensure that the client certificate authorities file ownership is set to root:root (Scored)
|
||||
[PASS] 2.2.9 Ensure that the kubelet configuration file ownership is set to root:root (Scored)
|
||||
[PASS] 2.2.10 Ensure that the kubelet configuration file has permissions set to 644 or more restrictive (Scored)
|
||||
|
||||
== Remediations ==
|
||||
2.1.1 Edit the kubelet service file /etc/systemd/system/kubelet.service.d/10-kubeadm.conf
|
||||
on each worker node and set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable.
|
||||
--allow-privileged=false
|
||||
Based on your system, restart the kubelet service. For example:
|
||||
systemctl daemon-reload
|
||||
systemctl restart kubelet.service
|
||||
|
||||
2.1.5 If using a Kubelet config file, edit the file to set readOnlyPort to 0 .
|
||||
If using command line arguments, edit the kubelet service file
|
||||
/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and
|
||||
set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable.
|
||||
--read-only-port=0
|
||||
Based on your system, restart the kubelet service. For example:
|
||||
systemctl daemon-reload
|
||||
systemctl restart kubelet.service
|
||||
|
||||
2.1.7 If using a Kubelet config file, edit the file to set protectKernelDefaults: true .
|
||||
If using command line arguments, edit the kubelet service file
|
||||
/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and
|
||||
set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable.
|
||||
--protect-kernel-defaults=true
|
||||
Based on your system, restart the kubelet service. For example:
|
||||
systemctl daemon-reload
|
||||
systemctl restart kubelet.service
|
||||
|
||||
2.1.10 If using a Kubelet config file, edit the file to set eventRecordQPS: 0 .
|
||||
If using command line arguments, edit the kubelet service file
|
||||
/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and
|
||||
set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable.
|
||||
--event-qps=0
|
||||
Based on your system, restart the kubelet service. For example:
|
||||
systemctl daemon-reload
|
||||
systemctl restart kubelet.service
|
||||
|
||||
2.1.11 If using a Kubelet config file, edit the file to set tlsCertFile to the location of the certificate
|
||||
file to use to identify this Kubelet, and tlsPrivateKeyFile to the location of the
|
||||
corresponding private key file.
|
||||
If using command line arguments, edit the kubelet service file
|
||||
/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and
|
||||
set the below parameters in KUBELET_CERTIFICATE_ARGS variable.
|
||||
--tls-cert-file=<path/to/tls-certificate-file>
|
||||
file=<path/to/tls-key-file>
|
||||
Based on your system, restart the kubelet service. For example:
|
||||
systemctl daemon-reload
|
||||
systemctl restart kubelet.service
|
||||
|
||||
2.1.14 Edit the kubelet service file /etc/systemd/system/kubelet.service.d/10-kubeadm.conf
|
||||
on each worker node and set the below parameter in KUBELET_CERTIFICATE_ARGS variable.
|
||||
--feature-gates=RotateKubeletServerCertificate=true
|
||||
Based on your system, restart the kubelet service. For example:
|
||||
systemctl daemon-reload
|
||||
systemctl restart kubelet.service
|
||||
|
||||
2.1.15 If using a Kubelet config file, edit the file to set TLSCipherSuites: to TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256
|
||||
If using executable arguments, edit the kubelet service file /etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and set the below parameter.
|
||||
--tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256
|
||||
|
||||
2.2.5 Run the below command (based on the file location on your system) on the each worker
|
||||
node. For example,
|
||||
chmod 644 /etc/kubernetes/proxy.conf
|
||||
|
||||
2.2.6 Run the below command (based on the file location on your system) on the each worker
|
||||
node. For example,
|
||||
chown root:root /etc/kubernetes/proxy.conf
|
||||
|
||||
2.2.7 Run the following command to modify the file permissions of the --client-ca-file
|
||||
chmod 644 <filename>
|
||||
|
||||
|
||||
== Summary ==
|
||||
15 checks PASS
|
||||
8 checks FAIL
|
||||
2 checks WARN
|
||||
0 checks INFO
|
||||
@@ -5,7 +5,7 @@
|
||||
[PASS] 1.1.3 Ensure that the --insecure-allow-any-token argument is not set (Not Scored)
|
||||
[PASS] 1.1.4 Ensure that the --kubelet-https argument is set to true (Scored)
|
||||
[PASS] 1.1.5 Ensure that the --insecure-bind-address argument is not set (Scored)
|
||||
[FAIL] 1.1.6 Ensure that the --insecure-port argument is set to 0 (Scored)
|
||||
[PASS] 1.1.6 Ensure that the --insecure-port argument is set to 0 (Scored)
|
||||
[PASS] 1.1.7 Ensure that the --secure-port argument is not set to 0 (Scored)
|
||||
[FAIL] 1.1.8 Ensure that the --profiling argument is set to false (Scored)
|
||||
[FAIL] 1.1.9 Ensure that the --repair-malformed-updates argument is set to false (Scored)
|
||||
@@ -18,37 +18,37 @@
|
||||
[FAIL] 1.1.16 Ensure that the --audit-log-maxage argument is set to 30 or as appropriate (Scored)
|
||||
[FAIL] 1.1.17 Ensure that the --audit-log-maxbackup argument is set to 10 or as appropriate (Scored)
|
||||
[FAIL] 1.1.18 Ensure that the --audit-log-maxsize argument is set to 100 or as appropriate (Scored)
|
||||
[FAIL] 1.1.19 Ensure that the --authorization-mode argument is not set to AlwaysAllow (Scored)
|
||||
[PASS] 1.1.19 Ensure that the --authorization-mode argument is not set to AlwaysAllow (Scored)
|
||||
[PASS] 1.1.20 Ensure that the --token-auth-file parameter is not set (Scored)
|
||||
[FAIL] 1.1.21 Ensure that the --kubelet-certificate-authority argument is set as appropriate (Scored)
|
||||
[FAIL] 1.1.22 Ensure that the --kubelet-client-certificate and --kubelet-client-key arguments are set as appropriate (Scored)
|
||||
[PASS] 1.1.22 Ensure that the --kubelet-client-certificate and --kubelet-client-key arguments are set as appropriate (Scored)
|
||||
[PASS] 1.1.23 Ensure that the --service-account-lookup argument is set to true (Scored)
|
||||
[FAIL] 1.1.24 Ensure that the admission control plugin PodSecurityPolicy is set (Scored)
|
||||
[FAIL] 1.1.25 Ensure that the --service-account-key-file argument is set as appropriate (Scored)
|
||||
[FAIL] 1.1.26 Ensure that the --etcd-certfile and --etcd-keyfile arguments are set as appropriate (Scored)
|
||||
[PASS] 1.1.25 Ensure that the --service-account-key-file argument is set as appropriate (Scored)
|
||||
[PASS] 1.1.26 Ensure that the --etcd-certfile and --etcd-keyfile arguments are set as appropriate (Scored)
|
||||
[PASS] 1.1.27 Ensure that the admission control plugin ServiceAccount is set(Scored)
|
||||
[FAIL] 1.1.28 Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate (Scored)
|
||||
[FAIL] 1.1.29 Ensure that the --client-ca-file argument is set as appropriate (Scored)
|
||||
[FAIL] 1.1.30 Ensure that the --etcd-cafile argument is set as appropriate (Scored)
|
||||
[PASS] 1.1.28 Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate (Scored)
|
||||
[PASS] 1.1.29 Ensure that the --client-ca-file argument is set as appropriate (Scored)
|
||||
[PASS] 1.1.30 Ensure that the --etcd-cafile argument is set as appropriate (Scored)
|
||||
[WARN] 1.1.31 Ensure that the API Server only makes use of Strong Cryptographic Ciphers (Not Scored)
|
||||
[FAIL] 1.1.32 Ensure that the --authorization-mode argument is set to Node (Scored)
|
||||
[FAIL] 1.1.33 Ensure that the admission control plugin NodeRestriction is set (Scored)
|
||||
[PASS] 1.1.32 Ensure that the --authorization-mode argument is set to Node (Scored)
|
||||
[PASS] 1.1.33 Ensure that the admission control plugin NodeRestriction is set (Scored)
|
||||
[FAIL] 1.1.34 Ensure that the --encryption-provider-config argument is set as appropriate (Scored)
|
||||
[WARN] 1.1.35 Ensure that the encryption provider is set to aescbc (Scored)
|
||||
[FAIL] 1.1.36 Ensure that the admission control plugin EventRateLimit is set (Scored)
|
||||
[PASS] 1.1.37a Ensure that the AdvancedAuditing argument is not set to false (Scored)
|
||||
[FAIL] 1.1.37b Ensure that the AdvancedAuditing argument is not set to false (Scored)
|
||||
[PASS] 1.1.38 Ensure that the --request-timeout argument is set as appropriate (Scored)
|
||||
[FAIL] 1.1.39 Ensure that the --authorization-mode argument includes RBAC (Scored)
|
||||
[PASS] 1.1.39 Ensure that the --authorization-mode argument includes RBAC (Scored)
|
||||
[INFO] 1.2 Scheduler
|
||||
[FAIL] 1.2.1 Ensure that the --profiling argument is set to false (Scored)
|
||||
[PASS] 1.2.2 Ensure that the --address argument is set to 127.0.0.1 (Scored)
|
||||
[INFO] 1.3 Controller Manager
|
||||
[FAIL] 1.3.1 Ensure that the --terminated-pod-gc-threshold argument is set as appropriate (Scored)
|
||||
[FAIL] 1.3.2 Ensure that the --profiling argument is set to false (Scored)
|
||||
[FAIL] 1.3.3 Ensure that the --use-service-account-credentials argument is set to true (Scored)
|
||||
[FAIL] 1.3.4 Ensure that the --service-account-private-key-file argument is set as appropriate (Scored)
|
||||
[FAIL] 1.3.5 Ensure that the --root-ca-file argument is set as appropriate (Scored)
|
||||
[PASS] 1.3.3 Ensure that the --use-service-account-credentials argument is set to true (Scored)
|
||||
[PASS] 1.3.4 Ensure that the --service-account-private-key-file argument is set as appropriate (Scored)
|
||||
[PASS] 1.3.5 Ensure that the --root-ca-file argument is set as appropriate (Scored)
|
||||
[FAIL] 1.3.6 Ensure that the RotateKubeletServerCertificate argument is set to true (Scored)
|
||||
[PASS] 1.3.7 Ensure that the --address argument is set to 127.0.0.1 (Scored)
|
||||
[INFO] 1.4 Configuration Files
|
||||
@@ -62,7 +62,7 @@
|
||||
[PASS] 1.4.8 Ensure that the etcd pod specification file ownership is set to root:root (Scored)
|
||||
[WARN] 1.4.9 Ensure that the Container Network Interface file permissions are set to 644 or more restrictive (Not Scored)
|
||||
[WARN] 1.4.10 Ensure that the Container Network Interface file ownership is set to root:root (Not Scored)
|
||||
[FAIL] 1.4.11 Ensure that the etcd data directory permissions are set to 700 or more restrictive (Scored)
|
||||
[PASS] 1.4.11 Ensure that the etcd data directory permissions are set to 700 or more restrictive (Scored)
|
||||
[FAIL] 1.4.12 Ensure that the etcd data directory ownership is set to etcd:etcd (Scored)
|
||||
[PASS] 1.4.13 Ensure that the admin.conf file permissions are set to 644 or more restrictive (Scored)
|
||||
[PASS] 1.4.14 Ensure that the admin.conf file ownership is set to root:root (Scored)
|
||||
@@ -74,11 +74,11 @@
|
||||
[WARN] 1.4.20 Ensure that the Kubernetes PKI certificate file permissions are set to 644 or more restrictive (Scored)
|
||||
[WARN] 1.4.21 Ensure that the Kubernetes PKI key file permissions are set to 600 or more restrictive (Scored)
|
||||
[INFO] 1.5 etcd
|
||||
[FAIL] 1.5.1 Ensure that the --cert-file and --key-file arguments are set as appropriate (Scored)
|
||||
[FAIL] 1.5.2 Ensure that the --client-cert-auth argument is set to true (Scored)
|
||||
[PASS] 1.5.1 Ensure that the --cert-file and --key-file arguments are set as appropriate (Scored)
|
||||
[PASS] 1.5.2 Ensure that the --client-cert-auth argument is set to true (Scored)
|
||||
[PASS] 1.5.3 Ensure that the --auto-tls argument is not set to true (Scored)
|
||||
[FAIL] 1.5.4 Ensure that the --peer-cert-file and --peer-key-file arguments are set as appropriate (Scored)
|
||||
[FAIL] 1.5.5 Ensure that the --peer-client-cert-auth argument is set to true (Scored)
|
||||
[PASS] 1.5.4 Ensure that the --peer-cert-file and --peer-key-file arguments are set as appropriate (Scored)
|
||||
[PASS] 1.5.5 Ensure that the --peer-client-cert-auth argument is set to true (Scored)
|
||||
[PASS] 1.5.6 Ensure that the --peer-auto-tls argument is not set to true (Scored)
|
||||
[WARN] 1.5.7 Ensure that a unique Certificate Authority is used for etcd (Not Scored)
|
||||
[INFO] 1.6 General Security Primitives
|
||||
@@ -104,10 +104,6 @@
|
||||
on the master node and set the below parameter.
|
||||
--anonymous-auth=false
|
||||
|
||||
1.1.6 Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml
|
||||
apiserver.yaml on the master node and set the below parameter.
|
||||
--insecure-port=0
|
||||
|
||||
1.1.8 Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml
|
||||
on the master node and set the below parameter.
|
||||
--profiling=false
|
||||
@@ -145,24 +141,12 @@ on the master node and set the --audit-log-maxsize parameter to an
|
||||
appropriate size in MB. For example, to set it as 100 MB:
|
||||
--audit-log-maxsize=100
|
||||
|
||||
1.1.19 Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml
|
||||
on the master node and set the --authorization-mode parameter to
|
||||
values other than AlwaysAllow. One such example could be as below.
|
||||
--authorization-mode=RBAC
|
||||
|
||||
1.1.21 Follow the Kubernetes documentation and setup the TLS connection between the
|
||||
apiserver and kubelets. Then, edit the API server pod specification file
|
||||
/etc/kubernetes/manifests/kube-apiserver.yaml on the master node and set the --kubelet-certificate-authority
|
||||
parameter to the path to the cert file for the certificate authority.
|
||||
--kubelet-certificate-authority=<ca-string>
|
||||
|
||||
1.1.22 Follow the Kubernetes documentation and set up the TLS connection between the
|
||||
apiserver and kubelets. Then, edit API server pod specification file
|
||||
/etc/kubernetes/manifests/kube-apiserver.yaml on the master node and set the
|
||||
kubelet client certificate and key parameters as below.
|
||||
--kubelet-client-certificate=<path/to/client-certificate-file>
|
||||
--kubelet-client-key=<path/to/client-key-file>
|
||||
|
||||
1.1.24 Follow the documentation and create Pod Security Policy objects as per your environment.
|
||||
Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml
|
||||
on the master node and set the --enable-admission-plugins parameter to a
|
||||
@@ -170,51 +154,10 @@ value that includes PodSecurityPolicy :
|
||||
--enable-admission-plugins=...,PodSecurityPolicy,...
|
||||
Then restart the API Server.
|
||||
|
||||
1.1.25 Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml
|
||||
on the master node and set the --service-account-key-file parameter
|
||||
to the public key file for service accounts:
|
||||
--service-account-key-file=<filename>
|
||||
|
||||
1.1.26 Follow the Kubernetes documentation and set up the TLS connection between the
|
||||
apiserver and etcd. Then, edit the API server pod specification file
|
||||
/etc/kubernetes/manifests/kube-apiserver.yaml on the master node and set the etcd
|
||||
certificate and key file parameters.
|
||||
--etcd-certfile=<path/to/client-certificate-file>
|
||||
--etcd-keyfile=<path/to/client-key-file>
|
||||
|
||||
1.1.28 Follow the Kubernetes documentation and set up the TLS connection on the apiserver.
|
||||
Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml
|
||||
on the master node and set the TLS certificate and private key file
|
||||
parameters.
|
||||
--tls-cert-file=<path/to/tls-certificate-file>
|
||||
--tls-private-key-file=<path/to/tls-key-file>
|
||||
|
||||
1.1.29 Follow the Kubernetes documentation and set up the TLS connection on the apiserver.
|
||||
Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml
|
||||
on the master node and set the client certificate authority file.
|
||||
--client-ca-file=<path/to/client-ca-file>
|
||||
|
||||
1.1.30 Follow the Kubernetes documentation and set up the TLS connection between the
|
||||
apiserver and etcd. Then, edit the API server pod specification file
|
||||
/etc/kubernetes/manifests/kube-apiserver.yaml on the master node and set the etcd
|
||||
certificate authority file parameter.
|
||||
--etcd-cafile=<path/to/ca-file>
|
||||
|
||||
1.1.31 Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml
|
||||
on the master node and set the below parameter.
|
||||
--tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256
|
||||
|
||||
1.1.32 Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml
|
||||
on the master node and set the --authorization-mode parameter to a
|
||||
value that includes Node.
|
||||
--authorization-mode=Node,RBAC
|
||||
|
||||
1.1.33 Follow the Kubernetes documentation and configure NodeRestriction plug-in on
|
||||
kubelets. Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml
|
||||
on the master node and set the --enable-admission-plugins parameter to a
|
||||
value that includes NodeRestriction.
|
||||
--enable-admission-plugins=...,NodeRestriction,...
|
||||
|
||||
1.1.34 [Manual test]
|
||||
Follow the Kubernetes documentation and configure a EncryptionConfig file.
|
||||
Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml on the
|
||||
@@ -248,8 +191,6 @@ configuration file. Then, edit the API server pod specification file
|
||||
and set the below parameters.
|
||||
--audit-policy-file=/etc/kubernetes/audit-policy.yaml
|
||||
|
||||
1.1.39 Edit the API server pod specification file kube-apiserver on the master node and set the --authorization-mode parameter to a value that includes RBAC, for example: --authorization-mode=Node,RBAC
|
||||
|
||||
1.2.1 Edit the Scheduler pod specification file /etc/kubernetes/manifests/kube-scheduler.yaml
|
||||
file on the master node and set the below parameter.
|
||||
--profiling=false
|
||||
@@ -262,20 +203,6 @@ on the master node and set the --terminated-pod-gc-threshold to an appropriate t
|
||||
on the master node and set the below parameter.
|
||||
--profiling=false
|
||||
|
||||
1.3.3 Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml
|
||||
on the master node to set the below parameter.
|
||||
--use-service-account-credentials=true
|
||||
|
||||
1.3.4 Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml
|
||||
on the master node and set the --service-account-private-
|
||||
key-file parameter to the private key file for service accounts.
|
||||
--service-account-private-key-file=<filename>
|
||||
|
||||
1.3.5 Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml
|
||||
on the master node and set the --root-ca-file parameter to
|
||||
the certificate bundle file.
|
||||
--root-ca-file=<path/to/file>
|
||||
|
||||
1.3.6 Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml
|
||||
controller-manager.yaml on the master node and set the --feature-gates parameter to
|
||||
include RotateKubeletServerCertificate=true.
|
||||
@@ -291,12 +218,6 @@ Run the below command (based on the file location on your system) on the master
|
||||
For example,
|
||||
chown root:root <path/to/cni/files>
|
||||
|
||||
1.4.11 On the etcd server node, get the etcd data directory, passed as an argument --data-dir ,
|
||||
from the below command:
|
||||
ps -ef | grep etcd
|
||||
Run the below command (based on the etcd data directory found above). For example,
|
||||
chmod 700 /var/lib/etcd
|
||||
|
||||
1.4.12 On the etcd server node, get the etcd data directory, passed as an argument --data-dir ,
|
||||
from the below command:
|
||||
ps -ef | grep etcd
|
||||
@@ -315,26 +236,6 @@ For example, chmod -R 644 /etc/kubernetes/pki/*.crt
|
||||
Run the below command (based on the file location on your system) on the master node.
|
||||
For example, chmod -R 600 /etc/kubernetes/pki/*.key
|
||||
|
||||
1.5.1 Follow the etcd service documentation and configure TLS encryption.
|
||||
Then, edit the etcd pod specification file /etc/kubernetes/manifests/etcd.yaml on the
|
||||
master node and set the below parameters.
|
||||
--ca-file=</path/to/ca-file>
|
||||
--key-file=</path/to/key-file>
|
||||
|
||||
1.5.2 Edit the etcd pod specification file /etc/kubernetes/manifests/etcd.yaml on the master
|
||||
node and set the below parameter.
|
||||
--client-cert-auth="true"
|
||||
|
||||
1.5.4 Follow the etcd service documentation and configure peer TLS encryption as appropriate
|
||||
for your etcd cluster. Then, edit the etcd pod specification file /etc/kubernetes/manifests/etcd.yaml on the
|
||||
master node and set the below parameters.
|
||||
--peer-client-file=</path/to/peer-cert-file>
|
||||
--peer-key-file=</path/to/peer-key-file>
|
||||
|
||||
1.5.5 Edit the etcd pod specification file /etc/kubernetes/manifests/etcd.yaml on the master
|
||||
node and set the below parameter.
|
||||
--peer-client-cert-auth=true
|
||||
|
||||
1.5.7 [Manual test]
|
||||
Follow the etcd documentation and create a dedicated certificate authority setup for the
|
||||
etcd service.
|
||||
@@ -420,7 +321,7 @@ Create a PSP as described in the Kubernetes documentation, ensuring that the .sp
|
||||
|
||||
|
||||
== Summary ==
|
||||
30 checks PASS
|
||||
36 checks FAIL
|
||||
49 checks PASS
|
||||
17 checks FAIL
|
||||
25 checks WARN
|
||||
1 checks INFO
|
||||
@@ -1,4 +1,4 @@
|
||||
[INFO] 2 Worker Node Security Configuration
|
||||
[INFO] 2 Worker Node Security Configuration
|
||||
[INFO] 2.1 Kubelet
|
||||
[PASS] 2.1.1 Ensure that the --anonymous-auth argument is set to false (Scored)
|
||||
[PASS] 2.1.2 Ensure that the --authorization-mode argument is not set to AlwaysAllow (Scored)
|
||||
@@ -86,4 +86,4 @@ chown root:root /etc/kubernetes/proxy.conf
|
||||
16 checks PASS
|
||||
7 checks FAIL
|
||||
0 checks WARN
|
||||
1 checks INFO
|
||||
1 checks INFO
|
||||
@@ -5,7 +5,7 @@
|
||||
[PASS] 1.1.3 Ensure that the --insecure-allow-any-token argument is not set (Not Scored)
|
||||
[PASS] 1.1.4 Ensure that the --kubelet-https argument is set to true (Scored)
|
||||
[PASS] 1.1.5 Ensure that the --insecure-bind-address argument is not set (Scored)
|
||||
[FAIL] 1.1.6 Ensure that the --insecure-port argument is set to 0 (Scored)
|
||||
[PASS] 1.1.6 Ensure that the --insecure-port argument is set to 0 (Scored)
|
||||
[PASS] 1.1.7 Ensure that the --secure-port argument is not set to 0 (Scored)
|
||||
[FAIL] 1.1.8 Ensure that the --profiling argument is set to false (Scored)
|
||||
[FAIL] 1.1.9 Ensure that the --repair-malformed-updates argument is set to false (Scored)
|
||||
@@ -18,37 +18,37 @@
|
||||
[FAIL] 1.1.16 Ensure that the --audit-log-maxage argument is set to 30 or as appropriate (Scored)
|
||||
[FAIL] 1.1.17 Ensure that the --audit-log-maxbackup argument is set to 10 or as appropriate (Scored)
|
||||
[FAIL] 1.1.18 Ensure that the --audit-log-maxsize argument is set to 100 or as appropriate (Scored)
|
||||
[FAIL] 1.1.19 Ensure that the --authorization-mode argument is not set to AlwaysAllow (Scored)
|
||||
[PASS] 1.1.19 Ensure that the --authorization-mode argument is not set to AlwaysAllow (Scored)
|
||||
[PASS] 1.1.20 Ensure that the --token-auth-file parameter is not set (Scored)
|
||||
[FAIL] 1.1.21 Ensure that the --kubelet-certificate-authority argument is set as appropriate (Scored)
|
||||
[FAIL] 1.1.22 Ensure that the --kubelet-client-certificate and --kubelet-client-key arguments are set as appropriate (Scored)
|
||||
[PASS] 1.1.22 Ensure that the --kubelet-client-certificate and --kubelet-client-key arguments are set as appropriate (Scored)
|
||||
[PASS] 1.1.23 Ensure that the --service-account-lookup argument is set to true (Scored)
|
||||
[FAIL] 1.1.24 Ensure that the admission control plugin PodSecurityPolicy is set (Scored)
|
||||
[FAIL] 1.1.25 Ensure that the --service-account-key-file argument is set as appropriate (Scored)
|
||||
[FAIL] 1.1.26 Ensure that the --etcd-certfile and --etcd-keyfile arguments are set as appropriate (Scored)
|
||||
[PASS] 1.1.25 Ensure that the --service-account-key-file argument is set as appropriate (Scored)
|
||||
[PASS] 1.1.26 Ensure that the --etcd-certfile and --etcd-keyfile arguments are set as appropriate (Scored)
|
||||
[PASS] 1.1.27 Ensure that the admission control plugin ServiceAccount is set(Scored)
|
||||
[FAIL] 1.1.28 Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate (Scored)
|
||||
[FAIL] 1.1.29 Ensure that the --client-ca-file argument is set as appropriate (Scored)
|
||||
[FAIL] 1.1.30 Ensure that the --etcd-cafile argument is set as appropriate (Scored)
|
||||
[PASS] 1.1.28 Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate (Scored)
|
||||
[PASS] 1.1.29 Ensure that the --client-ca-file argument is set as appropriate (Scored)
|
||||
[PASS] 1.1.30 Ensure that the --etcd-cafile argument is set as appropriate (Scored)
|
||||
[WARN] 1.1.31 Ensure that the API Server only makes use of Strong Cryptographic Ciphers (Not Scored)
|
||||
[FAIL] 1.1.32 Ensure that the --authorization-mode argument is set to Node (Scored)
|
||||
[FAIL] 1.1.33 Ensure that the admission control plugin NodeRestriction is set (Scored)
|
||||
[PASS] 1.1.32 Ensure that the --authorization-mode argument is set to Node (Scored)
|
||||
[PASS] 1.1.33 Ensure that the admission control plugin NodeRestriction is set (Scored)
|
||||
[FAIL] 1.1.34 Ensure that the --encryption-provider-config argument is set as appropriate (Scored)
|
||||
[WARN] 1.1.35 Ensure that the encryption provider is set to aescbc (Scored)
|
||||
[FAIL] 1.1.36 Ensure that the admission control plugin EventRateLimit is set (Scored)
|
||||
[PASS] 1.1.37a Ensure that the AdvancedAuditing argument is not set to false (Scored)
|
||||
[FAIL] 1.1.37b Ensure that the AdvancedAuditing argument is not set to false (Scored)
|
||||
[PASS] 1.1.38 Ensure that the --request-timeout argument is set as appropriate (Scored)
|
||||
[FAIL] 1.1.39 Ensure that the --authorization-mode argument includes RBAC (Scored)
|
||||
[PASS] 1.1.39 Ensure that the --authorization-mode argument includes RBAC (Scored)
|
||||
[INFO] 1.2 Scheduler
|
||||
[FAIL] 1.2.1 Ensure that the --profiling argument is set to false (Scored)
|
||||
[PASS] 1.2.2 Ensure that the --address argument is set to 127.0.0.1 (Scored)
|
||||
[INFO] 1.3 Controller Manager
|
||||
[FAIL] 1.3.1 Ensure that the --terminated-pod-gc-threshold argument is set as appropriate (Scored)
|
||||
[FAIL] 1.3.2 Ensure that the --profiling argument is set to false (Scored)
|
||||
[FAIL] 1.3.3 Ensure that the --use-service-account-credentials argument is set to true (Scored)
|
||||
[FAIL] 1.3.4 Ensure that the --service-account-private-key-file argument is set as appropriate (Scored)
|
||||
[FAIL] 1.3.5 Ensure that the --root-ca-file argument is set as appropriate (Scored)
|
||||
[PASS] 1.3.3 Ensure that the --use-service-account-credentials argument is set to true (Scored)
|
||||
[PASS] 1.3.4 Ensure that the --service-account-private-key-file argument is set as appropriate (Scored)
|
||||
[PASS] 1.3.5 Ensure that the --root-ca-file argument is set as appropriate (Scored)
|
||||
[FAIL] 1.3.6 Ensure that the RotateKubeletServerCertificate argument is set to true (Scored)
|
||||
[PASS] 1.3.7 Ensure that the --address argument is set to 127.0.0.1 (Scored)
|
||||
[INFO] 1.4 Configuration Files
|
||||
@@ -62,7 +62,7 @@
|
||||
[PASS] 1.4.8 Ensure that the etcd pod specification file ownership is set to root:root (Scored)
|
||||
[WARN] 1.4.9 Ensure that the Container Network Interface file permissions are set to 644 or more restrictive (Not Scored)
|
||||
[WARN] 1.4.10 Ensure that the Container Network Interface file ownership is set to root:root (Not Scored)
|
||||
[FAIL] 1.4.11 Ensure that the etcd data directory permissions are set to 700 or more restrictive (Scored)
|
||||
[PASS] 1.4.11 Ensure that the etcd data directory permissions are set to 700 or more restrictive (Scored)
|
||||
[FAIL] 1.4.12 Ensure that the etcd data directory ownership is set to etcd:etcd (Scored)
|
||||
[PASS] 1.4.13 Ensure that the admin.conf file permissions are set to 644 or more restrictive (Scored)
|
||||
[PASS] 1.4.14 Ensure that the admin.conf file ownership is set to root:root (Scored)
|
||||
@@ -74,11 +74,11 @@
|
||||
[WARN] 1.4.20 Ensure that the Kubernetes PKI certificate file permissions are set to 644 or more restrictive (Scored)
|
||||
[WARN] 1.4.21 Ensure that the Kubernetes PKI key file permissions are set to 600 or more restrictive (Scored)
|
||||
[INFO] 1.5 etcd
|
||||
[FAIL] 1.5.1 Ensure that the --cert-file and --key-file arguments are set as appropriate (Scored)
|
||||
[FAIL] 1.5.2 Ensure that the --client-cert-auth argument is set to true (Scored)
|
||||
[PASS] 1.5.1 Ensure that the --cert-file and --key-file arguments are set as appropriate (Scored)
|
||||
[PASS] 1.5.2 Ensure that the --client-cert-auth argument is set to true (Scored)
|
||||
[PASS] 1.5.3 Ensure that the --auto-tls argument is not set to true (Scored)
|
||||
[FAIL] 1.5.4 Ensure that the --peer-cert-file and --peer-key-file arguments are set as appropriate (Scored)
|
||||
[FAIL] 1.5.5 Ensure that the --peer-client-cert-auth argument is set to true (Scored)
|
||||
[PASS] 1.5.4 Ensure that the --peer-cert-file and --peer-key-file arguments are set as appropriate (Scored)
|
||||
[PASS] 1.5.5 Ensure that the --peer-client-cert-auth argument is set to true (Scored)
|
||||
[PASS] 1.5.6 Ensure that the --peer-auto-tls argument is not set to true (Scored)
|
||||
[WARN] 1.5.7 Ensure that a unique Certificate Authority is used for etcd (Not Scored)
|
||||
[INFO] 1.6 General Security Primitives
|
||||
@@ -104,10 +104,6 @@
|
||||
on the master node and set the below parameter.
|
||||
--anonymous-auth=false
|
||||
|
||||
1.1.6 Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml
|
||||
apiserver.yaml on the master node and set the below parameter.
|
||||
--insecure-port=0
|
||||
|
||||
1.1.8 Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml
|
||||
on the master node and set the below parameter.
|
||||
--profiling=false
|
||||
@@ -145,24 +141,12 @@ on the master node and set the --audit-log-maxsize parameter to an
|
||||
appropriate size in MB. For example, to set it as 100 MB:
|
||||
--audit-log-maxsize=100
|
||||
|
||||
1.1.19 Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml
|
||||
on the master node and set the --authorization-mode parameter to
|
||||
values other than AlwaysAllow. One such example could be as below.
|
||||
--authorization-mode=RBAC
|
||||
|
||||
1.1.21 Follow the Kubernetes documentation and setup the TLS connection between the
|
||||
apiserver and kubelets. Then, edit the API server pod specification file
|
||||
/etc/kubernetes/manifests/kube-apiserver.yaml on the master node and set the --kubelet-certificate-authority
|
||||
parameter to the path to the cert file for the certificate authority.
|
||||
--kubelet-certificate-authority=<ca-string>
|
||||
|
||||
1.1.22 Follow the Kubernetes documentation and set up the TLS connection between the
|
||||
apiserver and kubelets. Then, edit API server pod specification file
|
||||
/etc/kubernetes/manifests/kube-apiserver.yaml on the master node and set the
|
||||
kubelet client certificate and key parameters as below.
|
||||
--kubelet-client-certificate=<path/to/client-certificate-file>
|
||||
--kubelet-client-key=<path/to/client-key-file>
|
||||
|
||||
1.1.24 Follow the documentation and create Pod Security Policy objects as per your environment.
|
||||
Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml
|
||||
on the master node and set the --enable-admission-plugins parameter to a
|
||||
@@ -170,51 +154,10 @@ value that includes PodSecurityPolicy :
|
||||
--enable-admission-plugins=...,PodSecurityPolicy,...
|
||||
Then restart the API Server.
|
||||
|
||||
1.1.25 Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml
|
||||
on the master node and set the --service-account-key-file parameter
|
||||
to the public key file for service accounts:
|
||||
--service-account-key-file=<filename>
|
||||
|
||||
1.1.26 Follow the Kubernetes documentation and set up the TLS connection between the
|
||||
apiserver and etcd. Then, edit the API server pod specification file
|
||||
/etc/kubernetes/manifests/kube-apiserver.yaml on the master node and set the etcd
|
||||
certificate and key file parameters.
|
||||
--etcd-certfile=<path/to/client-certificate-file>
|
||||
--etcd-keyfile=<path/to/client-key-file>
|
||||
|
||||
1.1.28 Follow the Kubernetes documentation and set up the TLS connection on the apiserver.
|
||||
Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml
|
||||
on the master node and set the TLS certificate and private key file
|
||||
parameters.
|
||||
--tls-cert-file=<path/to/tls-certificate-file>
|
||||
--tls-private-key-file=<path/to/tls-key-file>
|
||||
|
||||
1.1.29 Follow the Kubernetes documentation and set up the TLS connection on the apiserver.
|
||||
Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml
|
||||
on the master node and set the client certificate authority file.
|
||||
--client-ca-file=<path/to/client-ca-file>
|
||||
|
||||
1.1.30 Follow the Kubernetes documentation and set up the TLS connection between the
|
||||
apiserver and etcd. Then, edit the API server pod specification file
|
||||
/etc/kubernetes/manifests/kube-apiserver.yaml on the master node and set the etcd
|
||||
certificate authority file parameter.
|
||||
--etcd-cafile=<path/to/ca-file>
|
||||
|
||||
1.1.31 Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml
|
||||
on the master node and set the below parameter.
|
||||
--tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256
|
||||
|
||||
1.1.32 Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml
|
||||
on the master node and set the --authorization-mode parameter to a
|
||||
value that includes Node.
|
||||
--authorization-mode=Node,RBAC
|
||||
|
||||
1.1.33 Follow the Kubernetes documentation and configure NodeRestriction plug-in on
|
||||
kubelets. Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml
|
||||
on the master node and set the --enable-admission-plugins parameter to a
|
||||
value that includes NodeRestriction.
|
||||
--enable-admission-plugins=...,NodeRestriction,...
|
||||
|
||||
1.1.34 [Manual test]
|
||||
Follow the Kubernetes documentation and configure a EncryptionConfig file.
|
||||
Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml on the
|
||||
@@ -248,8 +191,6 @@ configuration file. Then, edit the API server pod specification file
|
||||
and set the below parameters.
|
||||
--audit-policy-file=/etc/kubernetes/audit-policy.yaml
|
||||
|
||||
1.1.39 Edit the API server pod specification file kube-apiserver on the master node and set the --authorization-mode parameter to a value that includes RBAC, for example: --authorization-mode=Node,RBAC
|
||||
|
||||
1.2.1 Edit the Scheduler pod specification file /etc/kubernetes/manifests/kube-scheduler.yaml
|
||||
file on the master node and set the below parameter.
|
||||
--profiling=false
|
||||
@@ -262,20 +203,6 @@ on the master node and set the --terminated-pod-gc-threshold to an appropriate t
|
||||
on the master node and set the below parameter.
|
||||
--profiling=false
|
||||
|
||||
1.3.3 Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml
|
||||
on the master node to set the below parameter.
|
||||
--use-service-account-credentials=true
|
||||
|
||||
1.3.4 Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml
|
||||
on the master node and set the --service-account-private-
|
||||
key-file parameter to the private key file for service accounts.
|
||||
--service-account-private-key-file=<filename>
|
||||
|
||||
1.3.5 Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml
|
||||
on the master node and set the --root-ca-file parameter to
|
||||
the certificate bundle file.
|
||||
--root-ca-file=<path/to/file>
|
||||
|
||||
1.3.6 Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml
|
||||
controller-manager.yaml on the master node and set the --feature-gates parameter to
|
||||
include RotateKubeletServerCertificate=true.
|
||||
@@ -291,12 +218,6 @@ Run the below command (based on the file location on your system) on the master
|
||||
For example,
|
||||
chown root:root <path/to/cni/files>
|
||||
|
||||
1.4.11 On the etcd server node, get the etcd data directory, passed as an argument --data-dir ,
|
||||
from the below command:
|
||||
ps -ef | grep etcd
|
||||
Run the below command (based on the etcd data directory found above). For example,
|
||||
chmod 700 /var/lib/etcd
|
||||
|
||||
1.4.12 On the etcd server node, get the etcd data directory, passed as an argument --data-dir ,
|
||||
from the below command:
|
||||
ps -ef | grep etcd
|
||||
@@ -315,26 +236,6 @@ For example, chmod -R 644 /etc/kubernetes/pki/*.crt
|
||||
Run the below command (based on the file location on your system) on the master node.
|
||||
For example, chmod -R 600 /etc/kubernetes/pki/*.key
|
||||
|
||||
1.5.1 Follow the etcd service documentation and configure TLS encryption.
|
||||
Then, edit the etcd pod specification file /etc/kubernetes/manifests/etcd.yaml on the
|
||||
master node and set the below parameters.
|
||||
--ca-file=</path/to/ca-file>
|
||||
--key-file=</path/to/key-file>
|
||||
|
||||
1.5.2 Edit the etcd pod specification file /etc/kubernetes/manifests/etcd.yaml on the master
|
||||
node and set the below parameter.
|
||||
--client-cert-auth="true"
|
||||
|
||||
1.5.4 Follow the etcd service documentation and configure peer TLS encryption as appropriate
|
||||
for your etcd cluster. Then, edit the etcd pod specification file /etc/kubernetes/manifests/etcd.yaml on the
|
||||
master node and set the below parameters.
|
||||
--peer-client-file=</path/to/peer-cert-file>
|
||||
--peer-key-file=</path/to/peer-key-file>
|
||||
|
||||
1.5.5 Edit the etcd pod specification file /etc/kubernetes/manifests/etcd.yaml on the master
|
||||
node and set the below parameter.
|
||||
--peer-client-cert-auth=true
|
||||
|
||||
1.5.7 [Manual test]
|
||||
Follow the etcd documentation and create a dedicated certificate authority setup for the
|
||||
etcd service.
|
||||
@@ -420,8 +321,8 @@ Create a PSP as described in the Kubernetes documentation, ensuring that the .sp
|
||||
|
||||
|
||||
== Summary ==
|
||||
30 checks PASS
|
||||
36 checks FAIL
|
||||
49 checks PASS
|
||||
17 checks FAIL
|
||||
25 checks WARN
|
||||
1 checks INFO
|
||||
[INFO] 2 Worker Node Security Configuration
|
||||
19
integration/testdata/cis-1.5/add-tls-kind.yaml
vendored
Normal file
19
integration/testdata/cis-1.5/add-tls-kind.yaml
vendored
Normal file
@@ -0,0 +1,19 @@
|
||||
---
|
||||
apiVersion: kind.sigs.k8s.io/v1alpha3
|
||||
kind: Cluster
|
||||
networking:
|
||||
apiServerAddress: "0.0.0.0"
|
||||
|
||||
kubeadmConfigPatchesJson6902:
|
||||
- group: kubelet.config.k8s.io
|
||||
version: v1beta1
|
||||
kind: KubeletConfiguration
|
||||
patch: |
|
||||
- op: add
|
||||
path: /tlsCipherSuites
|
||||
value: ["TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256","TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256"]
|
||||
|
||||
nodes:
|
||||
# the control plane node config
|
||||
- role: control-plane
|
||||
image: "kindest/node:v1.18.0"
|
||||
188
integration/testdata/cis-1.5/job-master.data
vendored
Normal file
188
integration/testdata/cis-1.5/job-master.data
vendored
Normal file
@@ -0,0 +1,188 @@
|
||||
[INFO] 1 Master Node Security Configuration
|
||||
[INFO] 1.1 Master Node Configuration Files
|
||||
[PASS] 1.1.1 Ensure that the API server pod specification file permissions are set to 644 or more restrictive (Scored)
|
||||
[PASS] 1.1.2 Ensure that the API server pod specification file ownership is set to root:root (Scored)
|
||||
[PASS] 1.1.3 Ensure that the controller manager pod specification file permissions are set to 644 or more restrictive (Scored)
|
||||
[PASS] 1.1.4 Ensure that the controller manager pod specification file ownership is set to root:root (Scored)
|
||||
[PASS] 1.1.5 Ensure that the scheduler pod specification file permissions are set to 644 or more restrictive (Scored)
|
||||
[PASS] 1.1.6 Ensure that the scheduler pod specification file ownership is set to root:root (Scored)
|
||||
[PASS] 1.1.7 Ensure that the etcd pod specification file permissions are set to 644 or more restrictive (Scored)
|
||||
[PASS] 1.1.8 Ensure that the etcd pod specification file ownership is set to root:root (Scored)
|
||||
[WARN] 1.1.9 Ensure that the Container Network Interface file permissions are set to 644 or more restrictive (Not Scored)
|
||||
[WARN] 1.1.10 Ensure that the Container Network Interface file ownership is set to root:root (Not Scored)
|
||||
[PASS] 1.1.11 Ensure that the etcd data directory permissions are set to 700 or more restrictive (Scored)
|
||||
[FAIL] 1.1.12 Ensure that the etcd data directory ownership is set to etcd:etcd (Scored)
|
||||
[PASS] 1.1.13 Ensure that the admin.conf file permissions are set to 644 or more restrictive (Scored)
|
||||
[PASS] 1.1.14 Ensure that the admin.conf file ownership is set to root:root (Scored)
|
||||
[PASS] 1.1.15 Ensure that the scheduler.conf file permissions are set to 644 or more restrictive (Scored)
|
||||
[PASS] 1.1.16 Ensure that the scheduler.conf file ownership is set to root:root (Scored)
|
||||
[PASS] 1.1.17 Ensure that the controller-manager.conf file permissions are set to 644 or more restrictive (Scored)
|
||||
[PASS] 1.1.18 Ensure that the controller-manager.conf file ownership is set to root:root (Scored)
|
||||
[WARN] 1.1.19 Ensure that the Kubernetes PKI directory and file ownership is set to root:root (Scored)
|
||||
[WARN] 1.1.20 Ensure that the Kubernetes PKI certificate file permissions are set to 644 or more restrictive (Scored)
|
||||
[WARN] 1.1.21 Ensure that the Kubernetes PKI key file permissions are set to 600 (Scored)
|
||||
[INFO] 1.2 API Server
|
||||
[WARN] 1.2.1 Ensure that the --anonymous-auth argument is set to false (Not Scored)
|
||||
[PASS] 1.2.2 Ensure that the --basic-auth-file argument is not set (Scored)
|
||||
[PASS] 1.2.3 Ensure that the --token-auth-file parameter is not set (Scored)
|
||||
[PASS] 1.2.4 Ensure that the --kubelet-https argument is set to true (Scored)
|
||||
[PASS] 1.2.5 Ensure that the --kubelet-client-certificate and --kubelet-client-key arguments are set as appropriate (Scored)
|
||||
[FAIL] 1.2.6 Ensure that the --kubelet-certificate-authority argument is set as appropriate (Scored)
|
||||
[PASS] 1.2.7 Ensure that the --authorization-mode argument is not set to AlwaysAllow (Scored)
|
||||
[PASS] 1.2.8 Ensure that the --authorization-mode argument includes Node (Scored)
|
||||
[PASS] 1.2.9 Ensure that the --authorization-mode argument includes RBAC (Scored)
|
||||
[WARN] 1.2.10 Ensure that the admission control plugin EventRateLimit is set (Not Scored)
|
||||
[PASS] 1.2.11 Ensure that the admission control plugin AlwaysAdmit is not set (Scored)
|
||||
[WARN] 1.2.12 Ensure that the admission control plugin AlwaysPullImages is set (Not Scored)
|
||||
[WARN] 1.2.13 Ensure that the admission control plugin SecurityContextDeny is set if PodSecurityPolicy is not used (Not Scored)
|
||||
[PASS] 1.2.14 Ensure that the admission control plugin ServiceAccount is set (Scored)
|
||||
[PASS] 1.2.15 Ensure that the admission control plugin NamespaceLifecycle is set (Scored)
|
||||
[FAIL] 1.2.16 Ensure that the admission control plugin PodSecurityPolicy is set (Scored)
|
||||
[PASS] 1.2.17 Ensure that the admission control plugin NodeRestriction is set (Scored)
|
||||
[PASS] 1.2.18 Ensure that the --insecure-bind-address argument is not set (Scored)
|
||||
[PASS] 1.2.19 Ensure that the --insecure-port argument is set to 0 (Scored)
|
||||
[PASS] 1.2.20 Ensure that the --secure-port argument is not set to 0 (Scored)
|
||||
[FAIL] 1.2.21 Ensure that the --profiling argument is set to false (Scored)
|
||||
[FAIL] 1.2.22 Ensure that the --audit-log-path argument is set (Scored)
|
||||
[FAIL] 1.2.23 Ensure that the --audit-log-maxage argument is set to 30 or as appropriate (Scored)
|
||||
[FAIL] 1.2.24 Ensure that the --audit-log-maxbackup argument is set to 10 or as appropriate (Scored)
|
||||
[FAIL] 1.2.25 Ensure that the --audit-log-maxsize argument is set to 100 or as appropriate (Scored)
|
||||
[PASS] 1.2.26 Ensure that the --request-timeout argument is set as appropriate (Scored)
|
||||
[PASS] 1.2.27 Ensure that the --service-account-lookup argument is set to true (Scored)
|
||||
[PASS] 1.2.28 Ensure that the --service-account-key-file argument is set as appropriate (Scored)
|
||||
[PASS] 1.2.29 Ensure that the --etcd-certfile and --etcd-keyfile arguments are set as appropriate (Scored)
|
||||
[PASS] 1.2.30 Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate (Scored)
|
||||
[PASS] 1.2.31 Ensure that the --client-ca-file argument is set as appropriate (Scored)
|
||||
[PASS] 1.2.32 Ensure that the --etcd-cafile argument is set as appropriate (Scored)
|
||||
[FAIL] 1.2.33 Ensure that the --encryption-provider-config argument is set as appropriate (Scored)
|
||||
[WARN] 1.2.34 Ensure that encryption providers are appropriately configured (Scored)
|
||||
[WARN] 1.2.35 Ensure that the API Server only makes use of Strong Cryptographic Ciphers (Not Scored)
|
||||
[INFO] 1.3 Controller Manager
|
||||
[FAIL] 1.3.1 Ensure that the --terminated-pod-gc-threshold argument is set as appropriate (Scored)
|
||||
[FAIL] 1.3.2 Ensure that the --profiling argument is set to false (Scored)
|
||||
[PASS] 1.3.3 Ensure that the --use-service-account-credentials argument is set to true (Scored)
|
||||
[PASS] 1.3.4 Ensure that the --service-account-private-key-file argument is set as appropriate (Scored)
|
||||
[PASS] 1.3.5 Ensure that the --root-ca-file argument is set as appropriate (Scored)
|
||||
[FAIL] 1.3.6 Ensure that the RotateKubeletServerCertificate argument is set to true (Scored)
|
||||
[PASS] 1.3.7 Ensure that the --bind-address argument is set to 127.0.0.1 (Scored)
|
||||
[INFO] 1.4 Scheduler
|
||||
[FAIL] 1.4.1 Ensure that the --profiling argument is set to false (Scored)
|
||||
[PASS] 1.4.2 Ensure that the --bind-address argument is set to 127.0.0.1 (Scored)
|
||||
|
||||
== Remediations ==
|
||||
1.1.9 Run the below command (based on the file location on your system) on the master node.
|
||||
For example,
|
||||
chmod 644 <path/to/cni/files>
|
||||
|
||||
1.1.10 Run the below command (based on the file location on your system) on the master node.
|
||||
For example,
|
||||
chown root:root <path/to/cni/files>
|
||||
|
||||
1.1.12 On the etcd server node, get the etcd data directory, passed as an argument --data-dir,
|
||||
from the below command:
|
||||
ps -ef | grep etcd
|
||||
Run the below command (based on the etcd data directory found above).
|
||||
For example, chown etcd:etcd /var/lib/etcd
|
||||
|
||||
1.1.19 Run the below command (based on the file location on your system) on the master node.
|
||||
For example,
|
||||
chown -R root:root /etc/kubernetes/pki/
|
||||
|
||||
1.1.20 Run the below command (based on the file location on your system) on the master node.
|
||||
For example,
|
||||
chmod -R 644 /etc/kubernetes/pki/*.crt
|
||||
|
||||
1.1.21 Run the below command (based on the file location on your system) on the master node.
|
||||
For example,
|
||||
chmod -R 600 /etc/kubernetes/pki/*.key
|
||||
|
||||
1.2.1 Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml
|
||||
on the master node and set the below parameter.
|
||||
--anonymous-auth=false
|
||||
|
||||
1.2.6 Follow the Kubernetes documentation and setup the TLS connection between
|
||||
the apiserver and kubelets. Then, edit the API server pod specification file
|
||||
/etc/kubernetes/manifests/kube-apiserver.yaml on the master node and set the
|
||||
--kubelet-certificate-authority parameter to the path to the cert file for the certificate authority.
|
||||
--kubelet-certificate-authority=<ca-string>
|
||||
|
||||
1.2.10 Follow the Kubernetes documentation and set the desired limits in a configuration file.
|
||||
Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml
|
||||
and set the below parameters.
|
||||
--enable-admission-plugins=...,EventRateLimit,...
|
||||
--admission-control-config-file=<path/to/configuration/file>
|
||||
|
||||
1.2.12 Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml
|
||||
on the master node and set the --enable-admission-plugins parameter to include
|
||||
AlwaysPullImages.
|
||||
--enable-admission-plugins=...,AlwaysPullImages,...
|
||||
|
||||
1.2.13 Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml
|
||||
on the master node and set the --enable-admission-plugins parameter to include
|
||||
SecurityContextDeny, unless PodSecurityPolicy is already in place.
|
||||
--enable-admission-plugins=...,SecurityContextDeny,...
|
||||
|
||||
1.2.16 Follow the documentation and create Pod Security Policy objects as per your environment.
|
||||
Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml
|
||||
on the master node and set the --enable-admission-plugins parameter to a
|
||||
value that includes PodSecurityPolicy:
|
||||
--enable-admission-plugins=...,PodSecurityPolicy,...
|
||||
Then restart the API Server.
|
||||
|
||||
1.2.21 Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml
|
||||
on the master node and set the below parameter.
|
||||
--profiling=false
|
||||
|
||||
1.2.22 Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml
|
||||
on the master node and set the --audit-log-path parameter to a suitable path and
|
||||
file where you would like audit logs to be written, for example:
|
||||
--audit-log-path=/var/log/apiserver/audit.log
|
||||
|
||||
1.2.23 Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml
|
||||
on the master node and set the --audit-log-maxage parameter to 30 or as an appropriate number of days:
|
||||
--audit-log-maxage=30
|
||||
|
||||
1.2.24 Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml
|
||||
on the master node and set the --audit-log-maxbackup parameter to 10 or to an appropriate
|
||||
value.
|
||||
--audit-log-maxbackup=10
|
||||
|
||||
1.2.25 Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml
|
||||
on the master node and set the --audit-log-maxsize parameter to an appropriate size in MB.
|
||||
For example, to set it as 100 MB:
|
||||
--audit-log-maxsize=100
|
||||
|
||||
1.2.33 Follow the Kubernetes documentation and configure a EncryptionConfig file.
|
||||
Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml
|
||||
on the master node and set the --encryption-provider-config parameter to the path of that file: --encryption-provider-config=</path/to/EncryptionConfig/File>
|
||||
|
||||
1.2.34 Follow the Kubernetes documentation and configure a EncryptionConfig file.
|
||||
In this file, choose aescbc, kms or secretbox as the encryption provider.
|
||||
|
||||
1.2.35 Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml
|
||||
on the master node and set the below parameter.
|
||||
--tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256
|
||||
|
||||
1.3.1 Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml
|
||||
on the master node and set the --terminated-pod-gc-threshold to an appropriate threshold,
|
||||
for example:
|
||||
--terminated-pod-gc-threshold=10
|
||||
|
||||
1.3.2 Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml
|
||||
on the master node and set the below parameter.
|
||||
--profiling=false
|
||||
|
||||
1.3.6 Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml
|
||||
on the master node and set the --feature-gates parameter to include RotateKubeletServerCertificate=true.
|
||||
--feature-gates=RotateKubeletServerCertificate=true
|
||||
|
||||
1.4.1 Edit the Scheduler pod specification file /etc/kubernetes/manifests/kube-scheduler.yaml file
|
||||
on the master node and set the below parameter.
|
||||
--profiling=false
|
||||
|
||||
|
||||
== Summary ==
|
||||
41 checks PASS
|
||||
13 checks FAIL
|
||||
11 checks WARN
|
||||
0 checks INFO
|
||||
87
integration/testdata/cis-1.5/job-node.data
vendored
Normal file
87
integration/testdata/cis-1.5/job-node.data
vendored
Normal file
@@ -0,0 +1,87 @@
|
||||
[INFO] 4 Worker Node Security Configuration
|
||||
[INFO] 4.1 Worker Node Configuration Files
|
||||
[PASS] 4.1.1 Ensure that the kubelet service file permissions are set to 644 or more restrictive (Scored)
|
||||
[PASS] 4.1.2 Ensure that the kubelet service file ownership is set to root:root (Scored)
|
||||
[FAIL] 4.1.3 Ensure that the proxy kubeconfig file permissions are set to 644 or more restrictive (Scored)
|
||||
[FAIL] 4.1.4 Ensure that the proxy kubeconfig file ownership is set to root:root (Scored)
|
||||
[PASS] 4.1.5 Ensure that the kubelet.conf file permissions are set to 644 or more restrictive (Scored)
|
||||
[PASS] 4.1.6 Ensure that the kubelet.conf file ownership is set to root:root (Scored)
|
||||
[WARN] 4.1.7 Ensure that the certificate authorities file permissions are set to 644 or more restrictive (Scored)
|
||||
[PASS] 4.1.8 Ensure that the client certificate authorities file ownership is set to root:root (Scored)
|
||||
[PASS] 4.1.9 Ensure that the kubelet configuration file has permissions set to 644 or more restrictive (Scored)
|
||||
[PASS] 4.1.10 Ensure that the kubelet configuration file ownership is set to root:root (Scored)
|
||||
[INFO] 4.2 Kubelet
|
||||
[PASS] 4.2.1 Ensure that the --anonymous-auth argument is set to false (Scored)
|
||||
[PASS] 4.2.2 Ensure that the --authorization-mode argument is not set to AlwaysAllow (Scored)
|
||||
[PASS] 4.2.3 Ensure that the --client-ca-file argument is set as appropriate (Scored)
|
||||
[FAIL] 4.2.4 Ensure that the --read-only-port argument is set to 0 (Scored)
|
||||
[PASS] 4.2.5 Ensure that the --streaming-connection-idle-timeout argument is not set to 0 (Scored)
|
||||
[FAIL] 4.2.6 Ensure that the --protect-kernel-defaults argument is set to true (Scored)
|
||||
[PASS] 4.2.7 Ensure that the --make-iptables-util-chains argument is set to true (Scored)
|
||||
[PASS] 4.2.8 Ensure that the --hostname-override argument is not set (Not Scored)
|
||||
[WARN] 4.2.9 Ensure that the --event-qps argument is set to 0 or a level which ensures appropriate event capture (Not Scored)
|
||||
[FAIL] 4.2.10 Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate (Scored)
|
||||
[PASS] 4.2.11 Ensure that the --rotate-certificates argument is not set to false (Scored)
|
||||
[FAIL] 4.2.12 Ensure that the RotateKubeletServerCertificate argument is set to true (Scored)
|
||||
[PASS] 4.2.13 Ensure that the Kubelet only makes use of Strong Cryptographic Ciphers (Not Scored)
|
||||
|
||||
== Remediations ==
|
||||
4.1.3 Run the below command (based on the file location on your system) on the each worker node.
|
||||
For example,
|
||||
chmod 644 /etc/kubernetes/proxy.conf
|
||||
|
||||
4.1.4 Run the below command (based on the file location on your system) on the each worker node.
|
||||
For example, chown root:root /etc/kubernetes/proxy.conf
|
||||
|
||||
4.1.7 audit test did not run: There are no tests
|
||||
4.2.4 If using a Kubelet config file, edit the file to set readOnlyPort to 0.
|
||||
If using command line arguments, edit the kubelet service file
|
||||
/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and
|
||||
set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable.
|
||||
--read-only-port=0
|
||||
Based on your system, restart the kubelet service. For example:
|
||||
systemctl daemon-reload
|
||||
systemctl restart kubelet.service
|
||||
|
||||
4.2.6 If using a Kubelet config file, edit the file to set protectKernelDefaults: true.
|
||||
If using command line arguments, edit the kubelet service file
|
||||
/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and
|
||||
set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable.
|
||||
--protect-kernel-defaults=true
|
||||
Based on your system, restart the kubelet service. For example:
|
||||
systemctl daemon-reload
|
||||
systemctl restart kubelet.service
|
||||
|
||||
4.2.9 If using a Kubelet config file, edit the file to set eventRecordQPS: to an appropriate level.
|
||||
If using command line arguments, edit the kubelet service file
|
||||
/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and
|
||||
set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable.
|
||||
Based on your system, restart the kubelet service. For example:
|
||||
systemctl daemon-reload
|
||||
systemctl restart kubelet.service
|
||||
|
||||
4.2.10 If using a Kubelet config file, edit the file to set tlsCertFile to the location
|
||||
of the certificate file to use to identify this Kubelet, and tlsPrivateKeyFile
|
||||
to the location of the corresponding private key file.
|
||||
If using command line arguments, edit the kubelet service file
|
||||
/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and
|
||||
set the below parameters in KUBELET_CERTIFICATE_ARGS variable.
|
||||
--tls-cert-file=<path/to/tls-certificate-file>
|
||||
--tls-private-key-file=<path/to/tls-key-file>
|
||||
Based on your system, restart the kubelet service. For example:
|
||||
systemctl daemon-reload
|
||||
systemctl restart kubelet.service
|
||||
|
||||
4.2.12 Edit the kubelet service file /etc/systemd/system/kubelet.service.d/10-kubeadm.conf
|
||||
on each worker node and set the below parameter in KUBELET_CERTIFICATE_ARGS variable.
|
||||
--feature-gates=RotateKubeletServerCertificate=true
|
||||
Based on your system, restart the kubelet service. For example:
|
||||
systemctl daemon-reload
|
||||
systemctl restart kubelet.service
|
||||
|
||||
|
||||
== Summary ==
|
||||
15 checks PASS
|
||||
6 checks FAIL
|
||||
2 checks WARN
|
||||
0 checks INFO
|
||||
446
integration/testdata/cis-1.5/job.data
vendored
Normal file
446
integration/testdata/cis-1.5/job.data
vendored
Normal file
@@ -0,0 +1,446 @@
|
||||
[INFO] 1 Master Node Security Configuration
|
||||
[INFO] 1.1 Master Node Configuration Files
|
||||
[PASS] 1.1.1 Ensure that the API server pod specification file permissions are set to 644 or more restrictive (Scored)
|
||||
[PASS] 1.1.2 Ensure that the API server pod specification file ownership is set to root:root (Scored)
|
||||
[PASS] 1.1.3 Ensure that the controller manager pod specification file permissions are set to 644 or more restrictive (Scored)
|
||||
[PASS] 1.1.4 Ensure that the controller manager pod specification file ownership is set to root:root (Scored)
|
||||
[PASS] 1.1.5 Ensure that the scheduler pod specification file permissions are set to 644 or more restrictive (Scored)
|
||||
[PASS] 1.1.6 Ensure that the scheduler pod specification file ownership is set to root:root (Scored)
|
||||
[PASS] 1.1.7 Ensure that the etcd pod specification file permissions are set to 644 or more restrictive (Scored)
|
||||
[PASS] 1.1.8 Ensure that the etcd pod specification file ownership is set to root:root (Scored)
|
||||
[WARN] 1.1.9 Ensure that the Container Network Interface file permissions are set to 644 or more restrictive (Not Scored)
|
||||
[WARN] 1.1.10 Ensure that the Container Network Interface file ownership is set to root:root (Not Scored)
|
||||
[PASS] 1.1.11 Ensure that the etcd data directory permissions are set to 700 or more restrictive (Scored)
|
||||
[FAIL] 1.1.12 Ensure that the etcd data directory ownership is set to etcd:etcd (Scored)
|
||||
[PASS] 1.1.13 Ensure that the admin.conf file permissions are set to 644 or more restrictive (Scored)
|
||||
[PASS] 1.1.14 Ensure that the admin.conf file ownership is set to root:root (Scored)
|
||||
[PASS] 1.1.15 Ensure that the scheduler.conf file permissions are set to 644 or more restrictive (Scored)
|
||||
[PASS] 1.1.16 Ensure that the scheduler.conf file ownership is set to root:root (Scored)
|
||||
[PASS] 1.1.17 Ensure that the controller-manager.conf file permissions are set to 644 or more restrictive (Scored)
|
||||
[PASS] 1.1.18 Ensure that the controller-manager.conf file ownership is set to root:root (Scored)
|
||||
[WARN] 1.1.19 Ensure that the Kubernetes PKI directory and file ownership is set to root:root (Scored)
|
||||
[WARN] 1.1.20 Ensure that the Kubernetes PKI certificate file permissions are set to 644 or more restrictive (Scored)
|
||||
[WARN] 1.1.21 Ensure that the Kubernetes PKI key file permissions are set to 600 (Scored)
|
||||
[INFO] 1.2 API Server
|
||||
[WARN] 1.2.1 Ensure that the --anonymous-auth argument is set to false (Not Scored)
|
||||
[PASS] 1.2.2 Ensure that the --basic-auth-file argument is not set (Scored)
|
||||
[PASS] 1.2.3 Ensure that the --token-auth-file parameter is not set (Scored)
|
||||
[PASS] 1.2.4 Ensure that the --kubelet-https argument is set to true (Scored)
|
||||
[PASS] 1.2.5 Ensure that the --kubelet-client-certificate and --kubelet-client-key arguments are set as appropriate (Scored)
|
||||
[FAIL] 1.2.6 Ensure that the --kubelet-certificate-authority argument is set as appropriate (Scored)
|
||||
[PASS] 1.2.7 Ensure that the --authorization-mode argument is not set to AlwaysAllow (Scored)
|
||||
[PASS] 1.2.8 Ensure that the --authorization-mode argument includes Node (Scored)
|
||||
[PASS] 1.2.9 Ensure that the --authorization-mode argument includes RBAC (Scored)
|
||||
[WARN] 1.2.10 Ensure that the admission control plugin EventRateLimit is set (Not Scored)
|
||||
[PASS] 1.2.11 Ensure that the admission control plugin AlwaysAdmit is not set (Scored)
|
||||
[WARN] 1.2.12 Ensure that the admission control plugin AlwaysPullImages is set (Not Scored)
|
||||
[WARN] 1.2.13 Ensure that the admission control plugin SecurityContextDeny is set if PodSecurityPolicy is not used (Not Scored)
|
||||
[PASS] 1.2.14 Ensure that the admission control plugin ServiceAccount is set (Scored)
|
||||
[PASS] 1.2.15 Ensure that the admission control plugin NamespaceLifecycle is set (Scored)
|
||||
[FAIL] 1.2.16 Ensure that the admission control plugin PodSecurityPolicy is set (Scored)
|
||||
[PASS] 1.2.17 Ensure that the admission control plugin NodeRestriction is set (Scored)
|
||||
[PASS] 1.2.18 Ensure that the --insecure-bind-address argument is not set (Scored)
|
||||
[PASS] 1.2.19 Ensure that the --insecure-port argument is set to 0 (Scored)
|
||||
[PASS] 1.2.20 Ensure that the --secure-port argument is not set to 0 (Scored)
|
||||
[FAIL] 1.2.21 Ensure that the --profiling argument is set to false (Scored)
|
||||
[FAIL] 1.2.22 Ensure that the --audit-log-path argument is set (Scored)
|
||||
[FAIL] 1.2.23 Ensure that the --audit-log-maxage argument is set to 30 or as appropriate (Scored)
|
||||
[FAIL] 1.2.24 Ensure that the --audit-log-maxbackup argument is set to 10 or as appropriate (Scored)
|
||||
[FAIL] 1.2.25 Ensure that the --audit-log-maxsize argument is set to 100 or as appropriate (Scored)
|
||||
[PASS] 1.2.26 Ensure that the --request-timeout argument is set as appropriate (Scored)
|
||||
[PASS] 1.2.27 Ensure that the --service-account-lookup argument is set to true (Scored)
|
||||
[PASS] 1.2.28 Ensure that the --service-account-key-file argument is set as appropriate (Scored)
|
||||
[PASS] 1.2.29 Ensure that the --etcd-certfile and --etcd-keyfile arguments are set as appropriate (Scored)
|
||||
[PASS] 1.2.30 Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate (Scored)
|
||||
[PASS] 1.2.31 Ensure that the --client-ca-file argument is set as appropriate (Scored)
|
||||
[PASS] 1.2.32 Ensure that the --etcd-cafile argument is set as appropriate (Scored)
|
||||
[FAIL] 1.2.33 Ensure that the --encryption-provider-config argument is set as appropriate (Scored)
|
||||
[WARN] 1.2.34 Ensure that encryption providers are appropriately configured (Scored)
|
||||
[WARN] 1.2.35 Ensure that the API Server only makes use of Strong Cryptographic Ciphers (Not Scored)
|
||||
[INFO] 1.3 Controller Manager
|
||||
[FAIL] 1.3.1 Ensure that the --terminated-pod-gc-threshold argument is set as appropriate (Scored)
|
||||
[FAIL] 1.3.2 Ensure that the --profiling argument is set to false (Scored)
|
||||
[PASS] 1.3.3 Ensure that the --use-service-account-credentials argument is set to true (Scored)
|
||||
[PASS] 1.3.4 Ensure that the --service-account-private-key-file argument is set as appropriate (Scored)
|
||||
[PASS] 1.3.5 Ensure that the --root-ca-file argument is set as appropriate (Scored)
|
||||
[FAIL] 1.3.6 Ensure that the RotateKubeletServerCertificate argument is set to true (Scored)
|
||||
[PASS] 1.3.7 Ensure that the --bind-address argument is set to 127.0.0.1 (Scored)
|
||||
[INFO] 1.4 Scheduler
|
||||
[FAIL] 1.4.1 Ensure that the --profiling argument is set to false (Scored)
|
||||
[PASS] 1.4.2 Ensure that the --bind-address argument is set to 127.0.0.1 (Scored)
|
||||
|
||||
== Remediations ==
|
||||
1.1.9 Run the below command (based on the file location on your system) on the master node.
|
||||
For example,
|
||||
chmod 644 <path/to/cni/files>
|
||||
|
||||
1.1.10 Run the below command (based on the file location on your system) on the master node.
|
||||
For example,
|
||||
chown root:root <path/to/cni/files>
|
||||
|
||||
1.1.12 On the etcd server node, get the etcd data directory, passed as an argument --data-dir,
|
||||
from the below command:
|
||||
ps -ef | grep etcd
|
||||
Run the below command (based on the etcd data directory found above).
|
||||
For example, chown etcd:etcd /var/lib/etcd
|
||||
|
||||
1.1.19 Run the below command (based on the file location on your system) on the master node.
|
||||
For example,
|
||||
chown -R root:root /etc/kubernetes/pki/
|
||||
|
||||
1.1.20 Run the below command (based on the file location on your system) on the master node.
|
||||
For example,
|
||||
chmod -R 644 /etc/kubernetes/pki/*.crt
|
||||
|
||||
1.1.21 Run the below command (based on the file location on your system) on the master node.
|
||||
For example,
|
||||
chmod -R 600 /etc/kubernetes/pki/*.key
|
||||
|
||||
1.2.1 Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml
|
||||
on the master node and set the below parameter.
|
||||
--anonymous-auth=false
|
||||
|
||||
1.2.6 Follow the Kubernetes documentation and setup the TLS connection between
|
||||
the apiserver and kubelets. Then, edit the API server pod specification file
|
||||
/etc/kubernetes/manifests/kube-apiserver.yaml on the master node and set the
|
||||
--kubelet-certificate-authority parameter to the path to the cert file for the certificate authority.
|
||||
--kubelet-certificate-authority=<ca-string>
|
||||
|
||||
1.2.10 Follow the Kubernetes documentation and set the desired limits in a configuration file.
|
||||
Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml
|
||||
and set the below parameters.
|
||||
--enable-admission-plugins=...,EventRateLimit,...
|
||||
--admission-control-config-file=<path/to/configuration/file>
|
||||
|
||||
1.2.12 Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml
|
||||
on the master node and set the --enable-admission-plugins parameter to include
|
||||
AlwaysPullImages.
|
||||
--enable-admission-plugins=...,AlwaysPullImages,...
|
||||
|
||||
1.2.13 Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml
|
||||
on the master node and set the --enable-admission-plugins parameter to include
|
||||
SecurityContextDeny, unless PodSecurityPolicy is already in place.
|
||||
--enable-admission-plugins=...,SecurityContextDeny,...
|
||||
|
||||
1.2.16 Follow the documentation and create Pod Security Policy objects as per your environment.
|
||||
Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml
|
||||
on the master node and set the --enable-admission-plugins parameter to a
|
||||
value that includes PodSecurityPolicy:
|
||||
--enable-admission-plugins=...,PodSecurityPolicy,...
|
||||
Then restart the API Server.
|
||||
|
||||
1.2.21 Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml
|
||||
on the master node and set the below parameter.
|
||||
--profiling=false
|
||||
|
||||
1.2.22 Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml
|
||||
on the master node and set the --audit-log-path parameter to a suitable path and
|
||||
file where you would like audit logs to be written, for example:
|
||||
--audit-log-path=/var/log/apiserver/audit.log
|
||||
|
||||
1.2.23 Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml
|
||||
on the master node and set the --audit-log-maxage parameter to 30 or as an appropriate number of days:
|
||||
--audit-log-maxage=30
|
||||
|
||||
1.2.24 Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml
|
||||
on the master node and set the --audit-log-maxbackup parameter to 10 or to an appropriate
|
||||
value.
|
||||
--audit-log-maxbackup=10
|
||||
|
||||
1.2.25 Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml
|
||||
on the master node and set the --audit-log-maxsize parameter to an appropriate size in MB.
|
||||
For example, to set it as 100 MB:
|
||||
--audit-log-maxsize=100
|
||||
|
||||
1.2.33 Follow the Kubernetes documentation and configure a EncryptionConfig file.
|
||||
Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml
|
||||
on the master node and set the --encryption-provider-config parameter to the path of that file: --encryption-provider-config=</path/to/EncryptionConfig/File>
|
||||
|
||||
1.2.34 Follow the Kubernetes documentation and configure a EncryptionConfig file.
|
||||
In this file, choose aescbc, kms or secretbox as the encryption provider.
|
||||
|
||||
1.2.35 Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml
|
||||
on the master node and set the below parameter.
|
||||
--tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256
|
||||
|
||||
1.3.1 Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml
|
||||
on the master node and set the --terminated-pod-gc-threshold to an appropriate threshold,
|
||||
for example:
|
||||
--terminated-pod-gc-threshold=10
|
||||
|
||||
1.3.2 Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml
|
||||
on the master node and set the below parameter.
|
||||
--profiling=false
|
||||
|
||||
1.3.6 Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml
|
||||
on the master node and set the --feature-gates parameter to include RotateKubeletServerCertificate=true.
|
||||
--feature-gates=RotateKubeletServerCertificate=true
|
||||
|
||||
1.4.1 Edit the Scheduler pod specification file /etc/kubernetes/manifests/kube-scheduler.yaml file
|
||||
on the master node and set the below parameter.
|
||||
--profiling=false
|
||||
|
||||
|
||||
== Summary ==
|
||||
41 checks PASS
|
||||
13 checks FAIL
|
||||
11 checks WARN
|
||||
0 checks INFO
|
||||
[INFO] 2 Etcd Node Configuration
|
||||
[INFO] 2 Etcd Node Configuration Files
|
||||
[PASS] 2.1 Ensure that the --cert-file and --key-file arguments are set as appropriate (Scored)
|
||||
[PASS] 2.2 Ensure that the --client-cert-auth argument is set to true (Scored)
|
||||
[PASS] 2.3 Ensure that the --auto-tls argument is not set to true (Scored)
|
||||
[PASS] 2.4 Ensure that the --peer-cert-file and --peer-key-file arguments are set as appropriate (Scored)
|
||||
[PASS] 2.5 Ensure that the --peer-client-cert-auth argument is set to true (Scored)
|
||||
[PASS] 2.6 Ensure that the --peer-auto-tls argument is not set to true (Scored)
|
||||
[PASS] 2.7 Ensure that a unique Certificate Authority is used for etcd (Not Scored)
|
||||
|
||||
== Summary ==
|
||||
7 checks PASS
|
||||
0 checks FAIL
|
||||
0 checks WARN
|
||||
0 checks INFO
|
||||
[INFO] 3 Control Plane Configuration
|
||||
[INFO] 3.1 Authentication and Authorization
|
||||
[WARN] 3.1.1 Client certificate authentication should not be used for users (Not Scored)
|
||||
[INFO] 3.2 Logging
|
||||
[WARN] 3.2.1 Ensure that a minimal audit policy is created (Scored)
|
||||
[WARN] 3.2.2 Ensure that the audit policy covers key security concerns (Not Scored)
|
||||
|
||||
== Remediations ==
|
||||
3.1.1 Alternative mechanisms provided by Kubernetes such as the use of OIDC should be
|
||||
implemented in place of client certificates.
|
||||
|
||||
3.2.1 Create an audit policy file for your cluster.
|
||||
|
||||
3.2.2 Consider modification of the audit policy in use on the cluster to include these items, at a
|
||||
minimum.
|
||||
|
||||
|
||||
== Summary ==
|
||||
0 checks PASS
|
||||
0 checks FAIL
|
||||
3 checks WARN
|
||||
0 checks INFO
|
||||
[INFO] 4 Worker Node Security Configuration
|
||||
[INFO] 4.1 Worker Node Configuration Files
|
||||
[PASS] 4.1.1 Ensure that the kubelet service file permissions are set to 644 or more restrictive (Scored)
|
||||
[PASS] 4.1.2 Ensure that the kubelet service file ownership is set to root:root (Scored)
|
||||
[FAIL] 4.1.3 Ensure that the proxy kubeconfig file permissions are set to 644 or more restrictive (Scored)
|
||||
[FAIL] 4.1.4 Ensure that the proxy kubeconfig file ownership is set to root:root (Scored)
|
||||
[PASS] 4.1.5 Ensure that the kubelet.conf file permissions are set to 644 or more restrictive (Scored)
|
||||
[PASS] 4.1.6 Ensure that the kubelet.conf file ownership is set to root:root (Scored)
|
||||
[WARN] 4.1.7 Ensure that the certificate authorities file permissions are set to 644 or more restrictive (Scored)
|
||||
[PASS] 4.1.8 Ensure that the client certificate authorities file ownership is set to root:root (Scored)
|
||||
[PASS] 4.1.9 Ensure that the kubelet configuration file has permissions set to 644 or more restrictive (Scored)
|
||||
[PASS] 4.1.10 Ensure that the kubelet configuration file ownership is set to root:root (Scored)
|
||||
[INFO] 4.2 Kubelet
|
||||
[PASS] 4.2.1 Ensure that the --anonymous-auth argument is set to false (Scored)
|
||||
[PASS] 4.2.2 Ensure that the --authorization-mode argument is not set to AlwaysAllow (Scored)
|
||||
[PASS] 4.2.3 Ensure that the --client-ca-file argument is set as appropriate (Scored)
|
||||
[FAIL] 4.2.4 Ensure that the --read-only-port argument is set to 0 (Scored)
|
||||
[PASS] 4.2.5 Ensure that the --streaming-connection-idle-timeout argument is not set to 0 (Scored)
|
||||
[FAIL] 4.2.6 Ensure that the --protect-kernel-defaults argument is set to true (Scored)
|
||||
[PASS] 4.2.7 Ensure that the --make-iptables-util-chains argument is set to true (Scored)
|
||||
[PASS] 4.2.8 Ensure that the --hostname-override argument is not set (Not Scored)
|
||||
[WARN] 4.2.9 Ensure that the --event-qps argument is set to 0 or a level which ensures appropriate event capture (Not Scored)
|
||||
[FAIL] 4.2.10 Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate (Scored)
|
||||
[PASS] 4.2.11 Ensure that the --rotate-certificates argument is not set to false (Scored)
|
||||
[FAIL] 4.2.12 Ensure that the RotateKubeletServerCertificate argument is set to true (Scored)
|
||||
[PASS] 4.2.13 Ensure that the Kubelet only makes use of Strong Cryptographic Ciphers (Not Scored)
|
||||
|
||||
== Remediations ==
|
||||
4.1.3 Run the below command (based on the file location on your system) on the each worker node.
|
||||
For example,
|
||||
chmod 644 /etc/kubernetes/proxy.conf
|
||||
|
||||
4.1.4 Run the below command (based on the file location on your system) on the each worker node.
|
||||
For example, chown root:root /etc/kubernetes/proxy.conf
|
||||
|
||||
4.1.7 audit test did not run: There are no tests
|
||||
4.2.4 If using a Kubelet config file, edit the file to set readOnlyPort to 0.
|
||||
If using command line arguments, edit the kubelet service file
|
||||
/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and
|
||||
set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable.
|
||||
--read-only-port=0
|
||||
Based on your system, restart the kubelet service. For example:
|
||||
systemctl daemon-reload
|
||||
systemctl restart kubelet.service
|
||||
|
||||
4.2.6 If using a Kubelet config file, edit the file to set protectKernelDefaults: true.
|
||||
If using command line arguments, edit the kubelet service file
|
||||
/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and
|
||||
set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable.
|
||||
--protect-kernel-defaults=true
|
||||
Based on your system, restart the kubelet service. For example:
|
||||
systemctl daemon-reload
|
||||
systemctl restart kubelet.service
|
||||
|
||||
4.2.9 If using a Kubelet config file, edit the file to set eventRecordQPS: to an appropriate level.
|
||||
If using command line arguments, edit the kubelet service file
|
||||
/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and
|
||||
set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable.
|
||||
Based on your system, restart the kubelet service. For example:
|
||||
systemctl daemon-reload
|
||||
systemctl restart kubelet.service
|
||||
|
||||
4.2.10 If using a Kubelet config file, edit the file to set tlsCertFile to the location
|
||||
of the certificate file to use to identify this Kubelet, and tlsPrivateKeyFile
|
||||
to the location of the corresponding private key file.
|
||||
If using command line arguments, edit the kubelet service file
|
||||
/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and
|
||||
set the below parameters in KUBELET_CERTIFICATE_ARGS variable.
|
||||
--tls-cert-file=<path/to/tls-certificate-file>
|
||||
--tls-private-key-file=<path/to/tls-key-file>
|
||||
Based on your system, restart the kubelet service. For example:
|
||||
systemctl daemon-reload
|
||||
systemctl restart kubelet.service
|
||||
|
||||
4.2.12 Edit the kubelet service file /etc/systemd/system/kubelet.service.d/10-kubeadm.conf
|
||||
on each worker node and set the below parameter in KUBELET_CERTIFICATE_ARGS variable.
|
||||
--feature-gates=RotateKubeletServerCertificate=true
|
||||
Based on your system, restart the kubelet service. For example:
|
||||
systemctl daemon-reload
|
||||
systemctl restart kubelet.service
|
||||
|
||||
|
||||
== Summary ==
|
||||
15 checks PASS
|
||||
6 checks FAIL
|
||||
2 checks WARN
|
||||
0 checks INFO
|
||||
[INFO] 5 Kubernetes Policies
|
||||
[INFO] 5.1 RBAC and Service Accounts
|
||||
[WARN] 5.1.1 Ensure that the cluster-admin role is only used where required (Not Scored)
|
||||
[WARN] 5.1.2 Minimize access to secrets (Not Scored)
|
||||
[WARN] 5.1.3 Minimize wildcard use in Roles and ClusterRoles (Not Scored)
|
||||
[WARN] 5.1.4 Minimize access to create pods (Not Scored)
|
||||
[WARN] 5.1.5 Ensure that default service accounts are not actively used. (Scored)
|
||||
[WARN] 5.1.6 Ensure that Service Account Tokens are only mounted where necessary (Not Scored)
|
||||
[INFO] 5.2 Pod Security Policies
|
||||
[WARN] 5.2.1 Minimize the admission of privileged containers (Not Scored)
|
||||
[WARN] 5.2.2 Minimize the admission of containers wishing to share the host process ID namespace (Scored)
|
||||
[WARN] 5.2.3 Minimize the admission of containers wishing to share the host IPC namespace (Scored)
|
||||
[WARN] 5.2.4 Minimize the admission of containers wishing to share the host network namespace (Scored)
|
||||
[WARN] 5.2.5 Minimize the admission of containers with allowPrivilegeEscalation (Scored)
|
||||
[WARN] 5.2.6 Minimize the admission of root containers (Not Scored)
|
||||
[WARN] 5.2.7 Minimize the admission of containers with the NET_RAW capability (Not Scored)
|
||||
[WARN] 5.2.8 Minimize the admission of containers with added capabilities (Not Scored)
|
||||
[WARN] 5.2.9 Minimize the admission of containers with capabilities assigned (Not Scored)
|
||||
[INFO] 5.3 Network Policies and CNI
|
||||
[WARN] 5.3.1 Ensure that the CNI in use supports Network Policies (Not Scored)
|
||||
[WARN] 5.3.2 Ensure that all Namespaces have Network Policies defined (Scored)
|
||||
[INFO] 5.4 Secrets Management
|
||||
[WARN] 5.4.1 Prefer using secrets as files over secrets as environment variables (Not Scored)
|
||||
[WARN] 5.4.2 Consider external secret storage (Not Scored)
|
||||
[INFO] 5.5 Extensible Admission Control
|
||||
[WARN] 5.5.1 Configure Image Provenance using ImagePolicyWebhook admission controller (Not Scored)
|
||||
[INFO] 5.6 General Policies
|
||||
[WARN] 5.6.1 Create administrative boundaries between resources using namespaces (Not Scored)
|
||||
[WARN] 5.6.2 Ensure that the seccomp profile is set to docker/default in your pod definitions (Not Scored)
|
||||
[WARN] 5.6.3 Apply Security Context to Your Pods and Containers (Not Scored)
|
||||
[WARN] 5.6.4 The default namespace should not be used (Scored)
|
||||
|
||||
== Remediations ==
|
||||
5.1.1 Identify all clusterrolebindings to the cluster-admin role. Check if they are used and
|
||||
if they need this role or if they could use a role with fewer privileges.
|
||||
Where possible, first bind users to a lower privileged role and then remove the
|
||||
clusterrolebinding to the cluster-admin role :
|
||||
kubectl delete clusterrolebinding [name]
|
||||
|
||||
5.1.2 Where possible, remove get, list and watch access to secret objects in the cluster.
|
||||
|
||||
5.1.3 Where possible replace any use of wildcards in clusterroles and roles with specific
|
||||
objects or actions.
|
||||
|
||||
5.1.4 Where possible, remove create access to pod objects in the cluster.
|
||||
|
||||
5.1.5 Create explicit service accounts wherever a Kubernetes workload requires specific access
|
||||
to the Kubernetes API server.
|
||||
Modify the configuration of each default service account to include this value
|
||||
automountServiceAccountToken: false
|
||||
|
||||
5.1.6 Modify the definition of pods and service accounts which do not need to mount service
|
||||
account tokens to disable it.
|
||||
|
||||
5.2.1 Create a PSP as described in the Kubernetes documentation, ensuring that
|
||||
the .spec.privileged field is omitted or set to false.
|
||||
|
||||
5.2.2 Create a PSP as described in the Kubernetes documentation, ensuring that the
|
||||
.spec.hostPID field is omitted or set to false.
|
||||
|
||||
5.2.3 Create a PSP as described in the Kubernetes documentation, ensuring that the
|
||||
.spec.hostIPC field is omitted or set to false.
|
||||
|
||||
5.2.4 Create a PSP as described in the Kubernetes documentation, ensuring that the
|
||||
.spec.hostNetwork field is omitted or set to false.
|
||||
|
||||
5.2.5 Create a PSP as described in the Kubernetes documentation, ensuring that the
|
||||
.spec.allowPrivilegeEscalation field is omitted or set to false.
|
||||
|
||||
5.2.6 Create a PSP as described in the Kubernetes documentation, ensuring that the
|
||||
.spec.runAsUser.rule is set to either MustRunAsNonRoot or MustRunAs with the range of
|
||||
UIDs not including 0.
|
||||
|
||||
5.2.7 Create a PSP as described in the Kubernetes documentation, ensuring that the
|
||||
.spec.requiredDropCapabilities is set to include either NET_RAW or ALL.
|
||||
|
||||
5.2.8 Ensure that allowedCapabilities is not present in PSPs for the cluster unless
|
||||
it is set to an empty array.
|
||||
|
||||
5.2.9 Review the use of capabilites in applications runnning on your cluster. Where a namespace
|
||||
contains applicaions which do not require any Linux capabities to operate consider adding
|
||||
a PSP which forbids the admission of containers which do not drop all capabilities.
|
||||
|
||||
5.3.1 If the CNI plugin in use does not support network policies, consideration should be given to
|
||||
making use of a different plugin, or finding an alternate mechanism for restricting traffic
|
||||
in the Kubernetes cluster.
|
||||
|
||||
5.3.2 Follow the documentation and create NetworkPolicy objects as you need them.
|
||||
|
||||
5.4.1 if possible, rewrite application code to read secrets from mounted secret files, rather than
|
||||
from environment variables.
|
||||
|
||||
5.4.2 Refer to the secrets management options offered by your cloud provider or a third-party
|
||||
secrets management solution.
|
||||
|
||||
5.5.1 Follow the Kubernetes documentation and setup image provenance.
|
||||
|
||||
5.6.1 Follow the documentation and create namespaces for objects in your deployment as you need
|
||||
them.
|
||||
|
||||
5.6.2 Seccomp is an alpha feature currently. By default, all alpha features are disabled. So, you
|
||||
would need to enable alpha features in the apiserver by passing "--feature-
|
||||
gates=AllAlpha=true" argument.
|
||||
Edit the /etc/kubernetes/apiserver file on the master node and set the KUBE_API_ARGS
|
||||
parameter to "--feature-gates=AllAlpha=true"
|
||||
KUBE_API_ARGS="--feature-gates=AllAlpha=true"
|
||||
Based on your system, restart the kube-apiserver service. For example:
|
||||
systemctl restart kube-apiserver.service
|
||||
Use annotations to enable the docker/default seccomp profile in your pod definitions. An
|
||||
example is as below:
|
||||
apiVersion: v1
|
||||
kind: Pod
|
||||
metadata:
|
||||
name: trustworthy-pod
|
||||
annotations:
|
||||
seccomp.security.alpha.kubernetes.io/pod: docker/default
|
||||
spec:
|
||||
containers:
|
||||
- name: trustworthy-container
|
||||
image: sotrustworthy:latest
|
||||
|
||||
5.6.3 Follow the Kubernetes documentation and apply security contexts to your pods. For a
|
||||
suggested list of security contexts, you may refer to the CIS Security Benchmark for Docker
|
||||
Containers.
|
||||
|
||||
5.6.4 Ensure that namespaces are created to allow for appropriate segregation of Kubernetes
|
||||
resources and that all new resources are created in a specific namespace.
|
||||
|
||||
|
||||
== Summary ==
|
||||
0 checks PASS
|
||||
0 checks FAIL
|
||||
24 checks WARN
|
||||
0 checks INFO
|
||||
@@ -11,14 +11,17 @@ spec:
|
||||
- name: kube-bench
|
||||
# Push the image to your ECR and then refer to it here
|
||||
image: <ID.dkr.ecr.region.amazonaws.com/aquasec/kube-bench:ref>
|
||||
command: ["kube-bench", "--version", "1.11"]
|
||||
command: ["kube-bench", "node", "--benchmark", "eks-1.0"]
|
||||
volumeMounts:
|
||||
- name: var-lib-kubelet
|
||||
mountPath: /var/lib/kubelet
|
||||
readOnly: true
|
||||
- name: etc-systemd
|
||||
mountPath: /etc/systemd
|
||||
readOnly: true
|
||||
- name: etc-kubernetes
|
||||
mountPath: /etc/kubernetes
|
||||
readOnly: true
|
||||
restartPolicy: Never
|
||||
volumes:
|
||||
- name: var-lib-kubelet
|
||||
|
||||
31
job-gke.yaml
Normal file
31
job-gke.yaml
Normal file
@@ -0,0 +1,31 @@
|
||||
---
|
||||
apiVersion: batch/v1
|
||||
kind: Job
|
||||
metadata:
|
||||
name: kube-bench
|
||||
spec:
|
||||
template:
|
||||
spec:
|
||||
hostPID: true
|
||||
containers:
|
||||
- name: kube-bench
|
||||
image: aquasec/kube-bench:latest
|
||||
command: ["kube-bench", "--benchmark", "gke-1.0", "run", "--targets", "node,policies,managedservices"]
|
||||
volumeMounts:
|
||||
- name: var-lib-kubelet
|
||||
mountPath: /var/lib/kubelet
|
||||
- name: etc-systemd
|
||||
mountPath: /etc/systemd
|
||||
- name: etc-kubernetes
|
||||
mountPath: /etc/kubernetes
|
||||
restartPolicy: Never
|
||||
volumes:
|
||||
- name: var-lib-kubelet
|
||||
hostPath:
|
||||
path: "/var/lib/kubelet"
|
||||
- name: etc-systemd
|
||||
hostPath:
|
||||
path: "/etc/systemd"
|
||||
- name: etc-kubernetes
|
||||
hostPath:
|
||||
path: "/etc/kubernetes"
|
||||
@@ -14,10 +14,13 @@ spec:
|
||||
volumeMounts:
|
||||
- name: var-lib-kubelet
|
||||
mountPath: /var/lib/kubelet
|
||||
readOnly: true
|
||||
- name: etc-systemd
|
||||
mountPath: /etc/systemd
|
||||
readOnly: true
|
||||
- name: etc-kubernetes
|
||||
mountPath: /etc/kubernetes
|
||||
readOnly: true
|
||||
restartPolicy: Never
|
||||
volumes:
|
||||
- name: var-lib-kubelet
|
||||
|
||||
@@ -20,12 +20,15 @@ spec:
|
||||
volumeMounts:
|
||||
- name: var-lib-etcd
|
||||
mountPath: /var/lib/etcd
|
||||
readOnly: true
|
||||
- name: etc-kubernetes
|
||||
mountPath: /etc/kubernetes
|
||||
# /usr/bin is mounted to access kubectl / kubelet, for auto-detecting the Kubernetes version.
|
||||
readOnly: true
|
||||
# /usr/local/mount-from-host/bin is mounted to access kubectl / kubelet, for auto-detecting the Kubernetes version.
|
||||
# You can omit this mount if you specify --version as part of the command.
|
||||
- name: usr-bin
|
||||
mountPath: /usr/bin
|
||||
mountPath: /usr/local/mount-from-host/bin
|
||||
readOnly: true
|
||||
restartPolicy: Never
|
||||
volumes:
|
||||
- name: var-lib-etcd
|
||||
|
||||
@@ -14,14 +14,18 @@ spec:
|
||||
volumeMounts:
|
||||
- name: var-lib-kubelet
|
||||
mountPath: /var/lib/kubelet
|
||||
readOnly: true
|
||||
- name: etc-systemd
|
||||
mountPath: /etc/systemd
|
||||
readOnly: true
|
||||
- name: etc-kubernetes
|
||||
mountPath: /etc/kubernetes
|
||||
# /usr/bin is mounted to access kubectl / kubelet, for auto-detecting the Kubernetes version.
|
||||
readOnly: true
|
||||
# /usr/local/mount-from-host/bin is mounted to access kubectl / kubelet, for auto-detecting the Kubernetes version.
|
||||
# You can omit this mount if you specify --version as part of the command.
|
||||
- name: usr-bin
|
||||
mountPath: /usr/bin
|
||||
mountPath: /usr/local/mount-from-host/bin
|
||||
readOnly: true
|
||||
restartPolicy: Never
|
||||
volumes:
|
||||
- name: var-lib-kubelet
|
||||
|
||||
9
job.yaml
9
job.yaml
@@ -17,16 +17,21 @@ spec:
|
||||
volumeMounts:
|
||||
- name: var-lib-etcd
|
||||
mountPath: /var/lib/etcd
|
||||
readOnly: true
|
||||
- name: var-lib-kubelet
|
||||
mountPath: /var/lib/kubelet
|
||||
readOnly: true
|
||||
- name: etc-systemd
|
||||
mountPath: /etc/systemd
|
||||
readOnly: true
|
||||
- name: etc-kubernetes
|
||||
mountPath: /etc/kubernetes
|
||||
# /usr/bin is mounted to access kubectl / kubelet, for auto-detecting the Kubernetes version.
|
||||
readOnly: true
|
||||
# /usr/local/mount-from-host/bin is mounted to access kubectl / kubelet, for auto-detecting the Kubernetes version.
|
||||
# You can omit this mount if you specify --version as part of the command.
|
||||
- name: usr-bin
|
||||
mountPath: /usr/bin
|
||||
mountPath: /usr/local/mount-from-host/bin
|
||||
readOnly: true
|
||||
restartPolicy: Never
|
||||
volumes:
|
||||
- name: var-lib-etcd
|
||||
|
||||
2
makefile
2
makefile
@@ -36,7 +36,7 @@ tests:
|
||||
GO111MODULE=on go test -v -short -race -timeout 30s -coverprofile=coverage.txt -covermode=atomic ./...
|
||||
|
||||
integration-tests: build-docker
|
||||
GO111MODULE=on go test ./integration/... -v -tags integration -timeout 600s -args -kubebenchImg=$(IMAGE_NAME)
|
||||
GO111MODULE=on go test ./integration/... -v -tags integration -timeout 1200s -args -kubebenchImg=$(IMAGE_NAME)
|
||||
|
||||
# creates a kind cluster to be used for development.
|
||||
HAS_KIND := $(shell command -v kind;)
|
||||
|
||||
Reference in New Issue
Block a user