mirror of
https://github.com/aquasecurity/kube-bench.git
synced 2026-02-23 22:34:07 +00:00
Compare commits
13 Commits
| Author | SHA1 | Date | |
|---|---|---|---|
|
71bc8f544c | ||
|
9efd942bcc | ||
|
60f2fb592a | ||
|
451721a1cf | ||
|
b403b364fe | ||
|
|
06303f6a7a | ||
|
70988356c8 | ||
|
|
0b07f40c9b | ||
|
d988b81540 | ||
|
237f8cf818 | ||
|
|
65fb352e0e | ||
|
|
17cd104788 | ||
|
77f66511e7 |
@@ -1,4 +1,4 @@
|
||||
FROM golang:1.13 AS build
|
||||
FROM golang:1.14.0 AS build
|
||||
WORKDIR /go/src/github.com/aquasecurity/kube-bench/
|
||||
COPY go.mod go.sum ./
|
||||
COPY main.go .
|
||||
@@ -17,6 +17,8 @@ RUN apk --no-cache add procps
|
||||
# https://github.com/aquasecurity/kube-bench/issues/535
|
||||
RUN apk --no-cache add openssl
|
||||
|
||||
ENV PATH=$PATH:/usr/local/mount-from-host/bin
|
||||
|
||||
COPY --from=build /go/bin/kube-bench /usr/local/bin/kube-bench
|
||||
COPY entrypoint.sh .
|
||||
COPY cfg/ cfg/
|
||||
|
||||
36
README.md
36
README.md
@@ -43,20 +43,17 @@ Table of Contents
|
||||
|
||||
## CIS Kubernetes Benchmark support
|
||||
|
||||
kube-bench supports the tests for Kubernetes as defined in the CIS Benchmarks 1.3.0 to 1.5.0 respectively.
|
||||
kube-bench supports the tests for Kubernetes as defined in the [CIS Kubernetes Benchmarks](https://www.cisecurity.org/benchmark/kubernetes/).
|
||||
|
||||
| CIS Kubernetes Benchmark | kube-bench config | Kubernetes versions |
|
||||
|---|---|---|
|
||||
| 1.3.0| cis-1.3 | 1.11-1.12 |
|
||||
| 1.4.1| cis-1.4 | 1.13-1.14 |
|
||||
| 1.5.0 | cis-1.5 | 1.15- |
|
||||
|
||||
|
||||
By default, kube-bench will determine the test set to run based on the Kubernetes version running on the machine.
|
||||
|
||||
There is also preliminary support for Red Hat's OpenShift Hardening Guide for 3.10 and 3.11. Please note that kube-bench does not automatically detect OpenShift - see below.
|
||||
|
||||
| [1.3.0](https://workbench.cisecurity.org/benchmarks/602) | cis-1.3 | 1.11-1.12 |
|
||||
| [1.4.1](https://workbench.cisecurity.org/benchmarks/2351) | cis-1.4 | 1.13-1.14 |
|
||||
| [1.5.0](https://workbench.cisecurity.org/benchmarks/1370) | cis-1.5 | 1.15- |
|
||||
| [GKE 1.0.0](https://workbench.cisecurity.org/benchmarks/4536) | gke-1.0 | GKE |
|
||||
| Red Hat OpenShift hardening guide | rh-0.7 | OCP 3.10-3.11 |
|
||||
|
||||
By default, kube-bench will determine the test set to run based on the Kubernetes version running on the machine, but please note that kube-bench does not automatically detect OpenShift and GKE - see the section below on [Running kube-bench](https://github.com/aquasecurity/kube-bench#running-kube-bench).
|
||||
|
||||
## Installation
|
||||
|
||||
@@ -115,6 +112,7 @@ The following table shows the valid targets based on the CIS Benchmark version.
|
||||
| cis-1.3| master, node |
|
||||
| cis-1.4| master, node |
|
||||
| cis-1.5| master, controlplane, node, etcd, policies |
|
||||
| gke-1.0| master, controlplane, node, etcd, policies, managedservices |
|
||||
|
||||
If no targets are specified, `kube-bench` will determine the appropriate targets based on the CIS Benchmark version.
|
||||
|
||||
@@ -131,16 +129,16 @@ You can avoid installing kube-bench on the host by running it inside a container
|
||||
docker run --pid=host -v /etc:/etc:ro -v /var:/var:ro -t aquasec/kube-bench:latest [master|node] --version 1.13
|
||||
```
|
||||
|
||||
> Note: the tests require either the kubelet or kubectl binary in the path in order to auto-detect the Kubernetes version. You can pass `-v $(which kubectl):/usr/bin/kubectl` to resolve this. You will also need to pass in kubeconfig credentials. For example:
|
||||
> Note: the tests require either the kubelet or kubectl binary in the path in order to auto-detect the Kubernetes version. You can pass `-v $(which kubectl):/usr/local/mount-from-host/bin/kubectl` to resolve this. You will also need to pass in kubeconfig credentials. For example:
|
||||
|
||||
```
|
||||
docker run --pid=host -v /etc:/etc:ro -v /var:/var:ro -v $(which kubectl):/usr/bin/kubectl -v ~/.kube:/.kube -e KUBECONFIG=/.kube/config -t aquasec/kube-bench:latest [master|node]
|
||||
docker run --pid=host -v /etc:/etc:ro -v /var:/var:ro -v $(which kubectl):/usr/local/mount-from-host/bin/kubectl -v ~/.kube:/.kube -e KUBECONFIG=/.kube/config -t aquasec/kube-bench:latest [master|node]
|
||||
```
|
||||
|
||||
You can use your own configs by mounting them over the default ones in `/opt/kube-bench/cfg/`
|
||||
|
||||
```
|
||||
docker run --pid=host -v /etc:/etc:ro -v /var:/var:ro -t -v path/to/my-config.yaml:/opt/kube-bench/cfg/config.yam -v $(which kubectl):/usr/bin/kubectl -v ~/.kube:/.kube -e KUBECONFIG=/.kube/config aquasec/kube-bench:latest [master|node]
|
||||
docker run --pid=host -v /etc:/etc:ro -v /var:/var:ro -t -v path/to/my-config.yaml:/opt/kube-bench/cfg/config.yam -v $(which kubectl):/usr/local/mount-from-host/bin/kubectl -v ~/.kube:/.kube -e KUBECONFIG=/.kube/config aquasec/kube-bench:latest [master|node]
|
||||
```
|
||||
|
||||
### Running in a Kubernetes cluster
|
||||
@@ -262,6 +260,18 @@ kube-bench includes a set of test files for Red Hat's OpenShift hardening guide
|
||||
|
||||
when you run the `kube-bench` command (either directly or through YAML).
|
||||
|
||||
### Running in an GKE cluster
|
||||
| CIS Benchmark | Targets |
|
||||
|---|---|
|
||||
| gke-1.0| master, controlplane, node, etcd, policies, managedservices |
|
||||
|
||||
kube-bench includes benchmarks for GKE. To run this you will need to specify `--benchmark gke-1.0` when you run the `kube-bench` command.
|
||||
|
||||
To run the benchmark as a job in your GKE cluster apply the included `job-gke.yaml`.
|
||||
|
||||
```
|
||||
kubectl apply -f job-gke.yaml
|
||||
```
|
||||
|
||||
## Output
|
||||
|
||||
|
||||
@@ -637,12 +637,18 @@ groups:
|
||||
text: "Ensure that the AdvancedAuditing argument is not set to false (Scored)"
|
||||
audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep"
|
||||
tests:
|
||||
bin_op: or
|
||||
test_items:
|
||||
- flag: "--audit-policy-file"
|
||||
compare:
|
||||
op: eq
|
||||
value: "/etc/kubernetes/audit-policy.yaml"
|
||||
set: true
|
||||
- flag: "--audit-policy-file"
|
||||
compare:
|
||||
op: eq
|
||||
value: "/etc/kubernetes/audit-policy.yml"
|
||||
set: true
|
||||
remediation: |
|
||||
Follow the Kubernetes documentation and set the desired audit policy in the
|
||||
/etc/kubernetes/audit-policy.yaml file. Then, edit the API server pod specification file $apiserverconf
|
||||
@@ -838,45 +844,14 @@ groups:
|
||||
- id: 1.4.1
|
||||
text: "Ensure that the API server pod specification file permissions are
|
||||
set to 644 or more restrictive (Scored)"
|
||||
audit: "/bin/sh -c 'if test -e $apiserverconf; then stat -c %a $apiserverconf; fi'"
|
||||
audit: "/bin/sh -c 'if test -e $apiserverconf; then stat -c permissions=%a $apiserverconf; fi'"
|
||||
tests:
|
||||
bin_op: or
|
||||
test_items:
|
||||
- flag: "644"
|
||||
- flag: "permissions"
|
||||
compare:
|
||||
op: eq
|
||||
op: bitmask
|
||||
value: "644"
|
||||
set: true
|
||||
- flag: "640"
|
||||
compare:
|
||||
op: eq
|
||||
value: "640"
|
||||
set: true
|
||||
- flag: "600"
|
||||
compare:
|
||||
op: eq
|
||||
value: "600"
|
||||
set: true
|
||||
- flag: "444"
|
||||
compare:
|
||||
op: eq
|
||||
value: "444"
|
||||
set: true
|
||||
- flag: "440"
|
||||
compare:
|
||||
op: eq
|
||||
value: "440"
|
||||
set: true
|
||||
- flag: "400"
|
||||
compare:
|
||||
op: eq
|
||||
value: "400"
|
||||
set: true
|
||||
- flag: "000"
|
||||
compare:
|
||||
op: eq
|
||||
value: "000"
|
||||
set: true
|
||||
remediation: |
|
||||
Run the below command (based on the file location on your system) on the master node.
|
||||
For example,
|
||||
@@ -903,45 +878,14 @@ groups:
|
||||
- id: 1.4.3
|
||||
text: "Ensure that the controller manager pod specification file
|
||||
permissions are set to 644 or more restrictive (Scored)"
|
||||
audit: "/bin/sh -c 'if test -e $controllermanagerconf; then stat -c %a $controllermanagerconf; fi'"
|
||||
audit: "/bin/sh -c 'if test -e $controllermanagerconf; then stat -c permissions=%a $controllermanagerconf; fi'"
|
||||
tests:
|
||||
bin_op: or
|
||||
test_items:
|
||||
- flag: "644"
|
||||
- flag: "permissions"
|
||||
compare:
|
||||
op: eq
|
||||
op: bitmask
|
||||
value: "644"
|
||||
set: true
|
||||
- flag: "640"
|
||||
compare:
|
||||
op: eq
|
||||
value: "640"
|
||||
set: true
|
||||
- flag: "600"
|
||||
compare:
|
||||
op: eq
|
||||
value: "600"
|
||||
set: true
|
||||
- flag: "444"
|
||||
compare:
|
||||
op: eq
|
||||
value: "444"
|
||||
set: true
|
||||
- flag: "440"
|
||||
compare:
|
||||
op: eq
|
||||
value: "440"
|
||||
set: true
|
||||
- flag: "400"
|
||||
compare:
|
||||
op: eq
|
||||
value: "400"
|
||||
set: true
|
||||
- flag: "000"
|
||||
compare:
|
||||
op: eq
|
||||
value: "000"
|
||||
set: true
|
||||
remediation: |
|
||||
Run the below command (based on the file location on your system) on the master node.
|
||||
For example,
|
||||
@@ -968,45 +912,14 @@ groups:
|
||||
- id: 1.4.5
|
||||
text: "Ensure that the scheduler pod specification file permissions are set
|
||||
to 644 or more restrictive (Scored)"
|
||||
audit: "/bin/sh -c 'if test -e $schedulerconf; then stat -c %a $schedulerconf; fi'"
|
||||
audit: "/bin/sh -c 'if test -e $schedulerconf; then stat -c permissions=%a $schedulerconf; fi'"
|
||||
tests:
|
||||
bin_op: or
|
||||
test_items:
|
||||
- flag: "644"
|
||||
- flag: "permissions"
|
||||
compare:
|
||||
op: eq
|
||||
op: bitmask
|
||||
value: "644"
|
||||
set: true
|
||||
- flag: "640"
|
||||
compare:
|
||||
op: eq
|
||||
value: "640"
|
||||
set: true
|
||||
- flag: "600"
|
||||
compare:
|
||||
op: eq
|
||||
value: "600"
|
||||
set: true
|
||||
- flag: "444"
|
||||
compare:
|
||||
op: eq
|
||||
value: "444"
|
||||
set: true
|
||||
- flag: "440"
|
||||
compare:
|
||||
op: eq
|
||||
value: "440"
|
||||
set: true
|
||||
- flag: "400"
|
||||
compare:
|
||||
op: eq
|
||||
value: "400"
|
||||
set: true
|
||||
- flag: "000"
|
||||
compare:
|
||||
op: eq
|
||||
value: "000"
|
||||
set: true
|
||||
remediation: |
|
||||
Run the below command (based on the file location on your system) on the master node.
|
||||
For example,
|
||||
@@ -1033,45 +946,14 @@ groups:
|
||||
- id: 1.4.7
|
||||
text: "Ensure that the etcd pod specification file permissions are set to
|
||||
644 or more restrictive (Scored)"
|
||||
audit: "/bin/sh -c 'if test -e $etcdconf; then stat -c %a $etcdconf; fi'"
|
||||
audit: "/bin/sh -c 'if test -e $etcdconf; then stat -c permissions=%a $etcdconf; fi'"
|
||||
tests:
|
||||
bin_op: or
|
||||
test_items:
|
||||
- flag: "644"
|
||||
- flag: "permissions"
|
||||
compare:
|
||||
op: eq
|
||||
op: bitmask
|
||||
value: "644"
|
||||
set: true
|
||||
- flag: "640"
|
||||
compare:
|
||||
op: eq
|
||||
value: "640"
|
||||
set: true
|
||||
- flag: "600"
|
||||
compare:
|
||||
op: eq
|
||||
value: "600"
|
||||
set: true
|
||||
- flag: "444"
|
||||
compare:
|
||||
op: eq
|
||||
value: "444"
|
||||
set: true
|
||||
- flag: "440"
|
||||
compare:
|
||||
op: eq
|
||||
value: "440"
|
||||
set: true
|
||||
- flag: "400"
|
||||
compare:
|
||||
op: eq
|
||||
value: "400"
|
||||
set: true
|
||||
- flag: "000"
|
||||
compare:
|
||||
op: eq
|
||||
value: "000"
|
||||
set: true
|
||||
remediation: |
|
||||
Run the below command (based on the file location on your system) on the master node.
|
||||
For example,
|
||||
@@ -1098,7 +980,7 @@ groups:
|
||||
- id: 1.4.9
|
||||
text: "Ensure that the Container Network Interface file permissions are
|
||||
set to 644 or more restrictive (Not Scored)"
|
||||
audit: "stat -c %a <path/to/cni/files>"
|
||||
audit: "stat -c permissions=%a <path/to/cni/files>"
|
||||
type: "manual"
|
||||
remediation: |
|
||||
[Manual test]
|
||||
@@ -1121,12 +1003,12 @@ groups:
|
||||
|
||||
- id: 1.4.11
|
||||
text: "Ensure that the etcd data directory permissions are set to 700 or more restrictive (Scored)"
|
||||
audit: ps -ef | grep $etcdbin | grep -- --data-dir | sed 's%.*data-dir[= ]\([^ ]*\).*%\1%' | xargs stat -c %a
|
||||
audit: ps -ef | grep $etcdbin | grep -- --data-dir | sed 's%.*data-dir[= ]\([^ ]*\).*%\1%' | xargs stat -c permissions=%a
|
||||
tests:
|
||||
test_items:
|
||||
- flag: "700"
|
||||
- flag: "permissions"
|
||||
compare:
|
||||
op: eq
|
||||
op: bitmask
|
||||
value: "700"
|
||||
set: true
|
||||
remediation: |
|
||||
@@ -1155,45 +1037,14 @@ groups:
|
||||
- id: 1.4.13
|
||||
text: "Ensure that the admin.conf file permissions are set to 644 or
|
||||
more restrictive (Scored)"
|
||||
audit: "/bin/sh -c 'if test -e /etc/kubernetes/admin.conf; then stat -c %a /etc/kubernetes/admin.conf; fi'"
|
||||
audit: "/bin/sh -c 'if test -e /etc/kubernetes/admin.conf; then stat -c permissions=%a /etc/kubernetes/admin.conf; fi'"
|
||||
tests:
|
||||
bin_op: or
|
||||
test_items:
|
||||
- flag: "644"
|
||||
- flag: "permissions"
|
||||
compare:
|
||||
op: eq
|
||||
op: bitmask
|
||||
value: "644"
|
||||
set: true
|
||||
- flag: "640"
|
||||
compare:
|
||||
op: eq
|
||||
value: "640"
|
||||
set: true
|
||||
- flag: "600"
|
||||
compare:
|
||||
op: eq
|
||||
value: "600"
|
||||
set: true
|
||||
- flag: "444"
|
||||
compare:
|
||||
op: eq
|
||||
value: "444"
|
||||
set: true
|
||||
- flag: "440"
|
||||
compare:
|
||||
op: eq
|
||||
value: "440"
|
||||
set: true
|
||||
- flag: "400"
|
||||
compare:
|
||||
op: eq
|
||||
value: "400"
|
||||
set: true
|
||||
- flag: "000"
|
||||
compare:
|
||||
op: eq
|
||||
value: "000"
|
||||
set: true
|
||||
remediation: |
|
||||
Run the below command (based on the file location on your system) on the master node.
|
||||
For example,
|
||||
@@ -1219,45 +1070,14 @@ groups:
|
||||
- id: 1.4.15
|
||||
text: "Ensure that the scheduler.conf file permissions are set to 644 or
|
||||
more restrictive (Scored)"
|
||||
audit: "/bin/sh -c 'if test -e /etc/kubernetes/scheduler.conf; then stat -c %a /etc/kubernetes/scheduler.conf; fi'"
|
||||
audit: "/bin/sh -c 'if test -e /etc/kubernetes/scheduler.conf; then stat -c permissions=%a /etc/kubernetes/scheduler.conf; fi'"
|
||||
tests:
|
||||
bin_op: or
|
||||
test_items:
|
||||
- flag: "644"
|
||||
- flag: "permissions"
|
||||
compare:
|
||||
op: eq
|
||||
op: bitmask
|
||||
value: "644"
|
||||
set: true
|
||||
- flag: "640"
|
||||
compare:
|
||||
op: eq
|
||||
value: "640"
|
||||
set: true
|
||||
- flag: "600"
|
||||
compare:
|
||||
op: eq
|
||||
value: "600"
|
||||
set: true
|
||||
- flag: "444"
|
||||
compare:
|
||||
op: eq
|
||||
value: "444"
|
||||
set: true
|
||||
- flag: "440"
|
||||
compare:
|
||||
op: eq
|
||||
value: "440"
|
||||
set: true
|
||||
- flag: "400"
|
||||
compare:
|
||||
op: eq
|
||||
value: "400"
|
||||
set: true
|
||||
- flag: "000"
|
||||
compare:
|
||||
op: eq
|
||||
value: "000"
|
||||
set: true
|
||||
remediation: |
|
||||
Run the below command (based on the file location on your system) on the
|
||||
master node. For example, chmod 644 /etc/kubernetes/scheduler.conf
|
||||
@@ -1281,45 +1101,14 @@ groups:
|
||||
- id: 1.4.17
|
||||
text: "Ensure that the controller-manager.conf file permissions are set
|
||||
to 644 or more restrictive (Scored)"
|
||||
audit: "/bin/sh -c 'if test -e /etc/kubernetes/controller-manager.conf; then stat -c %a /etc/kubernetes/controller-manager.conf; fi'"
|
||||
audit: "/bin/sh -c 'if test -e /etc/kubernetes/controller-manager.conf; then stat -c permissions=%a /etc/kubernetes/controller-manager.conf; fi'"
|
||||
tests:
|
||||
bin_op: or
|
||||
test_items:
|
||||
- flag: "644"
|
||||
- flag: "permissions"
|
||||
compare:
|
||||
op: eq
|
||||
op: bitmask
|
||||
value: "644"
|
||||
set: true
|
||||
- flag: "640"
|
||||
compare:
|
||||
op: eq
|
||||
value: "640"
|
||||
set: true
|
||||
- flag: "600"
|
||||
compare:
|
||||
op: eq
|
||||
value: "600"
|
||||
set: true
|
||||
- flag: "444"
|
||||
compare:
|
||||
op: eq
|
||||
value: "444"
|
||||
set: true
|
||||
- flag: "440"
|
||||
compare:
|
||||
op: eq
|
||||
value: "440"
|
||||
set: true
|
||||
- flag: "400"
|
||||
compare:
|
||||
op: eq
|
||||
value: "400"
|
||||
set: true
|
||||
- flag: "000"
|
||||
compare:
|
||||
op: eq
|
||||
value: "000"
|
||||
set: true
|
||||
remediation: |
|
||||
Run the below command (based on the file location on your system) on the
|
||||
master node. For example, chmod 644 /etc/kubernetes/controller-manager.conf
|
||||
|
||||
@@ -358,45 +358,14 @@ groups:
|
||||
checks:
|
||||
- id: 2.2.1
|
||||
text: Ensure that the kubelet.conf file permissions are set to 644 or more restrictive (Scored)
|
||||
audit: '/bin/sh -c ''if test -e $kubeletkubeconfig; then stat -c %a $kubeletkubeconfig; fi'' '
|
||||
audit: '/bin/sh -c ''if test -e $kubeletkubeconfig; then stat -c permissions=%a $kubeletkubeconfig; fi'' '
|
||||
tests:
|
||||
test_items:
|
||||
- flag: "644"
|
||||
- flag: "permissions"
|
||||
compare:
|
||||
op: eq
|
||||
op: bitmask
|
||||
value: "644"
|
||||
set: true
|
||||
- flag: "640"
|
||||
compare:
|
||||
op: eq
|
||||
value: "640"
|
||||
set: true
|
||||
- flag: "600"
|
||||
compare:
|
||||
op: eq
|
||||
value: "600"
|
||||
set: true
|
||||
- flag: "444"
|
||||
compare:
|
||||
op: eq
|
||||
value: "444"
|
||||
set: true
|
||||
- flag: "440"
|
||||
compare:
|
||||
op: eq
|
||||
value: "440"
|
||||
set: true
|
||||
- flag: "400"
|
||||
compare:
|
||||
op: eq
|
||||
value: "400"
|
||||
set: true
|
||||
- flag: "000"
|
||||
compare:
|
||||
op: eq
|
||||
value: "000"
|
||||
set: true
|
||||
bin_op: or
|
||||
remediation: |
|
||||
Run the below command (based on the file location on your system) on the each worker
|
||||
node. For example,
|
||||
@@ -421,45 +390,14 @@ groups:
|
||||
|
||||
- id: 2.2.3
|
||||
text: Ensure that the kubelet service file permissions are set to 644 or more restrictive (Scored)
|
||||
audit: '/bin/sh -c ''if test -e $kubeletsvc; then stat -c %a $kubeletsvc; fi'' '
|
||||
audit: '/bin/sh -c ''if test -e $kubeletsvc; then stat -c permissions=%a $kubeletsvc; fi'' '
|
||||
tests:
|
||||
test_items:
|
||||
- flag: "644"
|
||||
- flag: "permissions"
|
||||
set: true
|
||||
compare:
|
||||
op: eq
|
||||
op: bitmask
|
||||
value: "644"
|
||||
set: true
|
||||
- flag: "640"
|
||||
compare:
|
||||
op: eq
|
||||
value: "640"
|
||||
set: true
|
||||
- flag: "600"
|
||||
compare:
|
||||
op: eq
|
||||
value: "600"
|
||||
set: true
|
||||
- flag: "444"
|
||||
compare:
|
||||
op: eq
|
||||
value: "444"
|
||||
set: true
|
||||
- flag: "440"
|
||||
compare:
|
||||
op: eq
|
||||
value: "440"
|
||||
set: true
|
||||
- flag: "400"
|
||||
compare:
|
||||
op: eq
|
||||
value: "400"
|
||||
set: true
|
||||
- flag: "000"
|
||||
compare:
|
||||
op: eq
|
||||
value: "000"
|
||||
set: true
|
||||
bin_op: or
|
||||
remediation: |
|
||||
Run the below command (based on the file location on your system) on the each worker
|
||||
node. For example,
|
||||
@@ -481,45 +419,14 @@ groups:
|
||||
|
||||
- id: 2.2.5
|
||||
text: Ensure that the proxy kubeconfig file permissions are set to 644 or more restrictive (Scored)
|
||||
audit: '/bin/sh -c ''if test -e $proxykubeconfig; then stat -c %a $proxykubeconfig; fi'' '
|
||||
audit: '/bin/sh -c ''if test -e $proxykubeconfig; then stat -c permissions=%a $proxykubeconfig; fi'' '
|
||||
tests:
|
||||
test_items:
|
||||
- flag: "644"
|
||||
- flag: "permissions"
|
||||
set: true
|
||||
compare:
|
||||
op: eq
|
||||
op: bitmask
|
||||
value: "644"
|
||||
set: true
|
||||
- flag: "640"
|
||||
compare:
|
||||
op: eq
|
||||
value: "640"
|
||||
set: true
|
||||
- flag: "600"
|
||||
compare:
|
||||
op: eq
|
||||
value: "600"
|
||||
set: true
|
||||
- flag: "444"
|
||||
compare:
|
||||
op: eq
|
||||
value: "444"
|
||||
set: true
|
||||
- flag: "440"
|
||||
compare:
|
||||
op: eq
|
||||
value: "440"
|
||||
set: true
|
||||
- flag: "400"
|
||||
compare:
|
||||
op: eq
|
||||
value: "400"
|
||||
set: true
|
||||
- flag: "000"
|
||||
compare:
|
||||
op: eq
|
||||
value: "000"
|
||||
set: true
|
||||
bin_op: or
|
||||
remediation: |
|
||||
Run the below command (based on the file location on your system) on the each worker
|
||||
node. For example,
|
||||
@@ -576,45 +483,14 @@ groups:
|
||||
|
||||
- id: 2.2.10
|
||||
text: Ensure that the kubelet configuration file has permissions set to 644 or more restrictive (Scored)
|
||||
audit: '/bin/sh -c ''if test -e $kubeletconf; then stat -c %a $kubeletconf; fi'' '
|
||||
audit: '/bin/sh -c ''if test -e $kubeletconf; then stat -c permissions=%a $kubeletconf; fi'' '
|
||||
tests:
|
||||
test_items:
|
||||
- flag: "644"
|
||||
- flag: "permissions"
|
||||
set: true
|
||||
compare:
|
||||
op: eq
|
||||
op: bitmask
|
||||
value: "644"
|
||||
set: true
|
||||
- flag: "640"
|
||||
compare:
|
||||
op: eq
|
||||
value: "640"
|
||||
set: true
|
||||
- flag: "600"
|
||||
compare:
|
||||
op: eq
|
||||
value: "600"
|
||||
set: true
|
||||
- flag: "444"
|
||||
compare:
|
||||
op: eq
|
||||
value: "444"
|
||||
set: true
|
||||
- flag: "440"
|
||||
compare:
|
||||
op: eq
|
||||
value: "440"
|
||||
set: true
|
||||
- flag: "400"
|
||||
compare:
|
||||
op: eq
|
||||
value: "400"
|
||||
set: true
|
||||
- flag: "000"
|
||||
compare:
|
||||
op: eq
|
||||
value: "000"
|
||||
set: true
|
||||
bin_op: or
|
||||
remediation: |
|
||||
Run the following command (using the config file location identied in the Audit step)
|
||||
chmod 644 $kubeletconf
|
||||
|
||||
@@ -447,12 +447,12 @@ groups:
|
||||
tests:
|
||||
bin_op: or
|
||||
test_items:
|
||||
- flag: "--enable-admission-plugins"
|
||||
- flag: "--disable-admission-plugins"
|
||||
compare:
|
||||
op: has
|
||||
op: nothave
|
||||
value: "ServiceAccount"
|
||||
set: true
|
||||
- flag: "--enable-admission-plugins"
|
||||
- flag: "--disable-admission-plugins"
|
||||
set: false
|
||||
remediation: |
|
||||
Follow the documentation and create ServiceAccount objects as per your environment.
|
||||
@@ -641,12 +641,18 @@ groups:
|
||||
text: "Ensure that the AdvancedAuditing argument is not set to false (Scored)"
|
||||
audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep"
|
||||
tests:
|
||||
bin_op: or
|
||||
test_items:
|
||||
- flag: "--audit-policy-file"
|
||||
compare:
|
||||
op: eq
|
||||
value: "/etc/kubernetes/audit-policy.yaml"
|
||||
set: true
|
||||
- flag: "--audit-policy-file"
|
||||
compare:
|
||||
op: eq
|
||||
value: "/etc/kubernetes/audit-policy.yml"
|
||||
set: true
|
||||
remediation: |
|
||||
Follow the Kubernetes documentation and set the desired audit policy in the
|
||||
/etc/kubernetes/audit-policy.yaml file. Then, edit the API server pod specification file $apiserverconf
|
||||
@@ -840,45 +846,14 @@ groups:
|
||||
- id: 1.4.1
|
||||
text: "Ensure that the API server pod specification file permissions are
|
||||
set to 644 or more restrictive (Scored)"
|
||||
audit: "/bin/sh -c 'if test -e $apiserverconf; then stat -c %a $apiserverconf; fi'"
|
||||
audit: "/bin/sh -c 'if test -e $apiserverconf; then stat -c permissions=%a $apiserverconf; fi'"
|
||||
tests:
|
||||
bin_op: or
|
||||
test_items:
|
||||
- flag: "644"
|
||||
- flag: "permissions"
|
||||
compare:
|
||||
op: eq
|
||||
op: bitmask
|
||||
value: "644"
|
||||
set: true
|
||||
- flag: "640"
|
||||
compare:
|
||||
op: eq
|
||||
value: "640"
|
||||
set: true
|
||||
- flag: "600"
|
||||
compare:
|
||||
op: eq
|
||||
value: "600"
|
||||
set: true
|
||||
- flag: "444"
|
||||
compare:
|
||||
op: eq
|
||||
value: "444"
|
||||
set: true
|
||||
- flag: "440"
|
||||
compare:
|
||||
op: eq
|
||||
value: "440"
|
||||
set: true
|
||||
- flag: "400"
|
||||
compare:
|
||||
op: eq
|
||||
value: "400"
|
||||
set: true
|
||||
- flag: "000"
|
||||
compare:
|
||||
op: eq
|
||||
value: "000"
|
||||
set: true
|
||||
remediation: |
|
||||
Run the below command (based on the file location on your system) on the master node.
|
||||
For example,
|
||||
@@ -905,45 +880,14 @@ groups:
|
||||
- id: 1.4.3
|
||||
text: "Ensure that the controller manager pod specification file
|
||||
permissions are set to 644 or more restrictive (Scored)"
|
||||
audit: "/bin/sh -c 'if test -e $controllermanagerconf; then stat -c %a $controllermanagerconf; fi'"
|
||||
audit: "/bin/sh -c 'if test -e $controllermanagerconf; then stat -c permissions=%a $controllermanagerconf; fi'"
|
||||
tests:
|
||||
bin_op: or
|
||||
test_items:
|
||||
- flag: "644"
|
||||
- flag: "permissions"
|
||||
compare:
|
||||
op: eq
|
||||
op: bitmask
|
||||
value: "644"
|
||||
set: true
|
||||
- flag: "640"
|
||||
compare:
|
||||
op: eq
|
||||
value: "640"
|
||||
set: true
|
||||
- flag: "600"
|
||||
compare:
|
||||
op: eq
|
||||
value: "600"
|
||||
set: true
|
||||
- flag: "444"
|
||||
compare:
|
||||
op: eq
|
||||
value: "444"
|
||||
set: true
|
||||
- flag: "440"
|
||||
compare:
|
||||
op: eq
|
||||
value: "440"
|
||||
set: true
|
||||
- flag: "400"
|
||||
compare:
|
||||
op: eq
|
||||
value: "400"
|
||||
set: true
|
||||
- flag: "000"
|
||||
compare:
|
||||
op: eq
|
||||
value: "000"
|
||||
set: true
|
||||
remediation: |
|
||||
Run the below command (based on the file location on your system) on the master node.
|
||||
For example,
|
||||
@@ -970,45 +914,14 @@ groups:
|
||||
- id: 1.4.5
|
||||
text: "Ensure that the scheduler pod specification file permissions are set
|
||||
to 644 or more restrictive (Scored)"
|
||||
audit: "/bin/sh -c 'if test -e $schedulerconf; then stat -c %a $schedulerconf; fi'"
|
||||
audit: "/bin/sh -c 'if test -e $schedulerconf; then stat -c permissions=%a $schedulerconf; fi'"
|
||||
tests:
|
||||
bin_op: or
|
||||
test_items:
|
||||
- flag: "644"
|
||||
- flag: "permissions"
|
||||
compare:
|
||||
op: eq
|
||||
op: bitmask
|
||||
value: "644"
|
||||
set: true
|
||||
- flag: "640"
|
||||
compare:
|
||||
op: eq
|
||||
value: "640"
|
||||
set: true
|
||||
- flag: "600"
|
||||
compare:
|
||||
op: eq
|
||||
value: "600"
|
||||
set: true
|
||||
- flag: "444"
|
||||
compare:
|
||||
op: eq
|
||||
value: "444"
|
||||
set: true
|
||||
- flag: "440"
|
||||
compare:
|
||||
op: eq
|
||||
value: "440"
|
||||
set: true
|
||||
- flag: "400"
|
||||
compare:
|
||||
op: eq
|
||||
value: "400"
|
||||
set: true
|
||||
- flag: "000"
|
||||
compare:
|
||||
op: eq
|
||||
value: "000"
|
||||
set: true
|
||||
remediation: |
|
||||
Run the below command (based on the file location on your system) on the master node.
|
||||
For example,
|
||||
@@ -1035,45 +948,14 @@ groups:
|
||||
- id: 1.4.7
|
||||
text: "Ensure that the etcd pod specification file permissions are set to
|
||||
644 or more restrictive (Scored)"
|
||||
audit: "/bin/sh -c 'if test -e $etcdconf; then stat -c %a $etcdconf; fi'"
|
||||
audit: "/bin/sh -c 'if test -e $etcdconf; then stat -c permissions=%a $etcdconf; fi'"
|
||||
tests:
|
||||
bin_op: or
|
||||
test_items:
|
||||
- flag: "644"
|
||||
- flag: "permissions"
|
||||
compare:
|
||||
op: eq
|
||||
op: bitmask
|
||||
value: "644"
|
||||
set: true
|
||||
- flag: "640"
|
||||
compare:
|
||||
op: eq
|
||||
value: "640"
|
||||
set: true
|
||||
- flag: "600"
|
||||
compare:
|
||||
op: eq
|
||||
value: "600"
|
||||
set: true
|
||||
- flag: "444"
|
||||
compare:
|
||||
op: eq
|
||||
value: "444"
|
||||
set: true
|
||||
- flag: "440"
|
||||
compare:
|
||||
op: eq
|
||||
value: "440"
|
||||
set: true
|
||||
- flag: "400"
|
||||
compare:
|
||||
op: eq
|
||||
value: "400"
|
||||
set: true
|
||||
- flag: "000"
|
||||
compare:
|
||||
op: eq
|
||||
value: "000"
|
||||
set: true
|
||||
remediation: |
|
||||
Run the below command (based on the file location on your system) on the master node.
|
||||
For example,
|
||||
@@ -1100,7 +982,7 @@ groups:
|
||||
- id: 1.4.9
|
||||
text: "Ensure that the Container Network Interface file permissions are
|
||||
set to 644 or more restrictive (Not Scored)"
|
||||
audit: "stat -c %a <path/to/cni/files>"
|
||||
audit: "stat -c permissions=%a <path/to/cni/files>"
|
||||
type: "manual"
|
||||
remediation: |
|
||||
[Manual test]
|
||||
@@ -1123,12 +1005,12 @@ groups:
|
||||
|
||||
- id: 1.4.11
|
||||
text: "Ensure that the etcd data directory permissions are set to 700 or more restrictive (Scored)"
|
||||
audit: ps -ef | grep $etcdbin | grep -- --data-dir | sed 's%.*data-dir[= ]\([^ ]*\).*%\1%' | xargs stat -c %a
|
||||
audit: ps -ef | grep $etcdbin | grep -- --data-dir | sed 's%.*data-dir[= ]\([^ ]*\).*%\1%' | xargs stat -c permissions=%a
|
||||
tests:
|
||||
test_items:
|
||||
- flag: "700"
|
||||
- flag: "permissions"
|
||||
compare:
|
||||
op: eq
|
||||
op: bitmask
|
||||
value: "700"
|
||||
set: true
|
||||
remediation: |
|
||||
@@ -1157,45 +1039,14 @@ groups:
|
||||
- id: 1.4.13
|
||||
text: "Ensure that the admin.conf file permissions are set to 644 or
|
||||
more restrictive (Scored)"
|
||||
audit: "/bin/sh -c 'if test -e /etc/kubernetes/admin.conf; then stat -c %a /etc/kubernetes/admin.conf; fi'"
|
||||
audit: "/bin/sh -c 'if test -e /etc/kubernetes/admin.conf; then stat -c permissions=%a /etc/kubernetes/admin.conf; fi'"
|
||||
tests:
|
||||
bin_op: or
|
||||
test_items:
|
||||
- flag: "644"
|
||||
- flag: "permissions"
|
||||
compare:
|
||||
op: eq
|
||||
op: bitmask
|
||||
value: "644"
|
||||
set: true
|
||||
- flag: "640"
|
||||
compare:
|
||||
op: eq
|
||||
value: "640"
|
||||
set: true
|
||||
- flag: "600"
|
||||
compare:
|
||||
op: eq
|
||||
value: "600"
|
||||
set: true
|
||||
- flag: "444"
|
||||
compare:
|
||||
op: eq
|
||||
value: "444"
|
||||
set: true
|
||||
- flag: "440"
|
||||
compare:
|
||||
op: eq
|
||||
value: "440"
|
||||
set: true
|
||||
- flag: "400"
|
||||
compare:
|
||||
op: eq
|
||||
value: "400"
|
||||
set: true
|
||||
- flag: "000"
|
||||
compare:
|
||||
op: eq
|
||||
value: "000"
|
||||
set: true
|
||||
remediation: |
|
||||
Run the below command (based on the file location on your system) on the master node.
|
||||
For example,
|
||||
@@ -1221,45 +1072,14 @@ groups:
|
||||
- id: 1.4.15
|
||||
text: "Ensure that the scheduler.conf file permissions are set to 644 or
|
||||
more restrictive (Scored)"
|
||||
audit: "/bin/sh -c 'if test -e /etc/kubernetes/scheduler.conf; then stat -c %a /etc/kubernetes/scheduler.conf; fi'"
|
||||
audit: "/bin/sh -c 'if test -e /etc/kubernetes/scheduler.conf; then stat -c permissions=%a /etc/kubernetes/scheduler.conf; fi'"
|
||||
tests:
|
||||
bin_op: or
|
||||
test_items:
|
||||
- flag: "644"
|
||||
- flag: "permissions"
|
||||
compare:
|
||||
op: eq
|
||||
op: bitmask
|
||||
value: "644"
|
||||
set: true
|
||||
- flag: "640"
|
||||
compare:
|
||||
op: eq
|
||||
value: "640"
|
||||
set: true
|
||||
- flag: "600"
|
||||
compare:
|
||||
op: eq
|
||||
value: "600"
|
||||
set: true
|
||||
- flag: "444"
|
||||
compare:
|
||||
op: eq
|
||||
value: "444"
|
||||
set: true
|
||||
- flag: "440"
|
||||
compare:
|
||||
op: eq
|
||||
value: "440"
|
||||
set: true
|
||||
- flag: "400"
|
||||
compare:
|
||||
op: eq
|
||||
value: "400"
|
||||
set: true
|
||||
- flag: "000"
|
||||
compare:
|
||||
op: eq
|
||||
value: "000"
|
||||
set: true
|
||||
remediation: |
|
||||
Run the below command (based on the file location on your system) on the
|
||||
master node. For example, chmod 644 /etc/kubernetes/scheduler.conf
|
||||
@@ -1283,45 +1103,14 @@ groups:
|
||||
- id: 1.4.17
|
||||
text: "Ensure that the controller-manager.conf file permissions are set
|
||||
to 644 or more restrictive (Scored)"
|
||||
audit: "/bin/sh -c 'if test -e /etc/kubernetes/controller-manager.conf; then stat -c %a /etc/kubernetes/controller-manager.conf; fi'"
|
||||
audit: "/bin/sh -c 'if test -e /etc/kubernetes/controller-manager.conf; then stat -c permissions=%a /etc/kubernetes/controller-manager.conf; fi'"
|
||||
tests:
|
||||
bin_op: or
|
||||
test_items:
|
||||
- flag: "644"
|
||||
- flag: "permissions"
|
||||
compare:
|
||||
op: eq
|
||||
op: bitmask
|
||||
value: "644"
|
||||
set: true
|
||||
- flag: "640"
|
||||
compare:
|
||||
op: eq
|
||||
value: "640"
|
||||
set: true
|
||||
- flag: "600"
|
||||
compare:
|
||||
op: eq
|
||||
value: "600"
|
||||
set: true
|
||||
- flag: "444"
|
||||
compare:
|
||||
op: eq
|
||||
value: "444"
|
||||
set: true
|
||||
- flag: "440"
|
||||
compare:
|
||||
op: eq
|
||||
value: "440"
|
||||
set: true
|
||||
- flag: "400"
|
||||
compare:
|
||||
op: eq
|
||||
value: "400"
|
||||
set: true
|
||||
- flag: "000"
|
||||
compare:
|
||||
op: eq
|
||||
value: "000"
|
||||
set: true
|
||||
remediation: |
|
||||
Run the below command (based on the file location on your system) on the
|
||||
master node. For example, chmod 644 /etc/kubernetes/controller-manager.conf
|
||||
@@ -1364,43 +1153,12 @@ groups:
|
||||
audit: "stat -c %n\ %a /etc/kubernetes/pki/*.crt"
|
||||
type: "manual"
|
||||
tests:
|
||||
bin_op: or
|
||||
test_items:
|
||||
- flag: "644"
|
||||
- flag: "permissions"
|
||||
compare:
|
||||
op: eq
|
||||
op: bitmask
|
||||
value: "644"
|
||||
set: true
|
||||
- flag: "640"
|
||||
compare:
|
||||
op: eq
|
||||
value: "640"
|
||||
set: true
|
||||
- flag: "600"
|
||||
compare:
|
||||
op: eq
|
||||
value: "600"
|
||||
set: true
|
||||
- flag: "444"
|
||||
compare:
|
||||
op: eq
|
||||
value: "444"
|
||||
set: true
|
||||
- flag: "440"
|
||||
compare:
|
||||
op: eq
|
||||
value: "440"
|
||||
set: true
|
||||
- flag: "400"
|
||||
compare:
|
||||
op: eq
|
||||
value: "400"
|
||||
set: true
|
||||
- flag: "000"
|
||||
compare:
|
||||
op: eq
|
||||
value: "000"
|
||||
set: true
|
||||
remediation: |
|
||||
[Manual test]
|
||||
Run the below command (based on the file location on your system) on the master node.
|
||||
@@ -1413,9 +1171,9 @@ groups:
|
||||
type: "manual"
|
||||
tests:
|
||||
test_items:
|
||||
- flag: "600"
|
||||
- flag: "permissions"
|
||||
compare:
|
||||
op: eq
|
||||
op: bitmask
|
||||
value: "600"
|
||||
set: true
|
||||
remediation: |
|
||||
|
||||
@@ -341,45 +341,14 @@ groups:
|
||||
checks:
|
||||
- id: 2.2.1
|
||||
text: Ensure that the kubelet.conf file permissions are set to 644 or more restrictive (Scored)
|
||||
audit: '/bin/sh -c ''if test -e $kubeletkubeconfig; then stat -c %a $kubeletkubeconfig; fi'' '
|
||||
audit: '/bin/sh -c ''if test -e $kubeletkubeconfig; then stat -c permissions=%a $kubeletkubeconfig; fi'' '
|
||||
tests:
|
||||
test_items:
|
||||
- flag: "644"
|
||||
- flag: "permissions"
|
||||
set: true
|
||||
compare:
|
||||
op: eq
|
||||
op: bitmask
|
||||
value: "644"
|
||||
set: true
|
||||
- flag: "640"
|
||||
compare:
|
||||
op: eq
|
||||
value: "640"
|
||||
set: true
|
||||
- flag: "600"
|
||||
compare:
|
||||
op: eq
|
||||
value: "600"
|
||||
set: true
|
||||
- flag: "444"
|
||||
compare:
|
||||
op: eq
|
||||
value: "444"
|
||||
set: true
|
||||
- flag: "440"
|
||||
compare:
|
||||
op: eq
|
||||
value: "440"
|
||||
set: true
|
||||
- flag: "400"
|
||||
compare:
|
||||
op: eq
|
||||
value: "400"
|
||||
set: true
|
||||
- flag: "000"
|
||||
compare:
|
||||
op: eq
|
||||
value: "000"
|
||||
set: true
|
||||
bin_op: or
|
||||
remediation: |
|
||||
Run the below command (based on the file location on your system) on the each worker
|
||||
node. For example,
|
||||
@@ -404,45 +373,14 @@ groups:
|
||||
|
||||
- id: 2.2.3
|
||||
text: Ensure that the kubelet service file permissions are set to 644 or more restrictive (Scored)
|
||||
audit: '/bin/sh -c ''if test -e $kubeletsvc; then stat -c %a $kubeletsvc; fi'' '
|
||||
audit: '/bin/sh -c ''if test -e $kubeletsvc; then stat -c permissions=%a $kubeletsvc; fi'' '
|
||||
tests:
|
||||
test_items:
|
||||
- flag: "644"
|
||||
- flag: "permissions"
|
||||
set: true
|
||||
compare:
|
||||
op: eq
|
||||
op: bitmask
|
||||
value: "644"
|
||||
set: true
|
||||
- flag: "640"
|
||||
compare:
|
||||
op: eq
|
||||
value: "640"
|
||||
set: true
|
||||
- flag: "600"
|
||||
compare:
|
||||
op: eq
|
||||
value: "600"
|
||||
set: true
|
||||
- flag: "444"
|
||||
compare:
|
||||
op: eq
|
||||
value: "444"
|
||||
set: true
|
||||
- flag: "440"
|
||||
compare:
|
||||
op: eq
|
||||
value: "440"
|
||||
set: true
|
||||
- flag: "400"
|
||||
compare:
|
||||
op: eq
|
||||
value: "400"
|
||||
set: true
|
||||
- flag: "000"
|
||||
compare:
|
||||
op: eq
|
||||
value: "000"
|
||||
set: true
|
||||
bin_op: or
|
||||
remediation: |
|
||||
Run the below command (based on the file location on your system) on the each worker
|
||||
node. For example,
|
||||
@@ -464,45 +402,14 @@ groups:
|
||||
|
||||
- id: 2.2.5
|
||||
text: Ensure that the proxy kubeconfig file permissions are set to 644 or more restrictive (Scored)
|
||||
audit: '/bin/sh -c ''if test -e $proxykubeconfig; then stat -c %a $proxykubeconfig; fi'' '
|
||||
audit: '/bin/sh -c ''if test -e $proxykubeconfig; then stat -c permissions=%a $proxykubeconfig; fi'' '
|
||||
tests:
|
||||
test_items:
|
||||
- flag: "644"
|
||||
- flag: "permissions"
|
||||
set: true
|
||||
compare:
|
||||
op: eq
|
||||
op: bitmask
|
||||
value: "644"
|
||||
set: true
|
||||
- flag: "640"
|
||||
compare:
|
||||
op: eq
|
||||
value: "640"
|
||||
set: true
|
||||
- flag: "600"
|
||||
compare:
|
||||
op: eq
|
||||
value: "600"
|
||||
set: true
|
||||
- flag: "444"
|
||||
compare:
|
||||
op: eq
|
||||
value: "444"
|
||||
set: true
|
||||
- flag: "440"
|
||||
compare:
|
||||
op: eq
|
||||
value: "440"
|
||||
set: true
|
||||
- flag: "400"
|
||||
compare:
|
||||
op: eq
|
||||
value: "400"
|
||||
set: true
|
||||
- flag: "000"
|
||||
compare:
|
||||
op: eq
|
||||
value: "000"
|
||||
set: true
|
||||
bin_op: or
|
||||
remediation: |
|
||||
Run the below command (based on the file location on your system) on the each worker
|
||||
node. For example,
|
||||
@@ -524,25 +431,15 @@ groups:
|
||||
|
||||
- id: 2.2.7
|
||||
text: Ensure that the certificate authorities file permissions are set to 644 or more restrictive (Scored)
|
||||
audit: "/bin/sh -c 'if test -e $kubeletcafile; then stat -c %a $kubeletcafile; fi'"
|
||||
audit: "/bin/sh -c 'if test -e $kubeletcafile; then stat -c permissions=%a $kubeletcafile; fi'"
|
||||
tests:
|
||||
bin_op: or
|
||||
test_items:
|
||||
- flag: "644"
|
||||
- flag: "permissions"
|
||||
compare:
|
||||
op: eq
|
||||
op: bitmask
|
||||
value: "644"
|
||||
set: true
|
||||
- flag: "640"
|
||||
compare:
|
||||
op: eq
|
||||
value: "640"
|
||||
set: true
|
||||
- flag: "600"
|
||||
compare:
|
||||
op: eq
|
||||
value: "600"
|
||||
set: true
|
||||
remediation: |
|
||||
Run the following command to modify the file permissions of the --client-ca-file
|
||||
chmod 644 <filename>
|
||||
@@ -577,45 +474,14 @@ groups:
|
||||
|
||||
- id: 2.2.10
|
||||
text: Ensure that the kubelet configuration file has permissions set to 644 or more restrictive (Scored)
|
||||
audit: '/bin/sh -c ''if test -e $kubeletconf; then stat -c %a $kubeletconf; fi'' '
|
||||
audit: '/bin/sh -c ''if test -e $kubeletconf; then stat -c permissions=%a $kubeletconf; fi'' '
|
||||
tests:
|
||||
test_items:
|
||||
- flag: "644"
|
||||
- flag: "permissions"
|
||||
set: true
|
||||
compare:
|
||||
op: eq
|
||||
op: bitmask
|
||||
value: "644"
|
||||
set: true
|
||||
- flag: "640"
|
||||
compare:
|
||||
op: eq
|
||||
value: "640"
|
||||
set: true
|
||||
- flag: "600"
|
||||
compare:
|
||||
op: eq
|
||||
value: "600"
|
||||
set: true
|
||||
- flag: "444"
|
||||
compare:
|
||||
op: eq
|
||||
value: "444"
|
||||
set: true
|
||||
- flag: "440"
|
||||
compare:
|
||||
op: eq
|
||||
value: "440"
|
||||
set: true
|
||||
- flag: "400"
|
||||
compare:
|
||||
op: eq
|
||||
value: "400"
|
||||
set: true
|
||||
- flag: "000"
|
||||
compare:
|
||||
op: eq
|
||||
value: "000"
|
||||
set: true
|
||||
bin_op: or
|
||||
remediation: |
|
||||
Run the following command (using the config file location identied in the Audit step)
|
||||
chmod 644 $kubeletconf
|
||||
|
||||
@@ -10,45 +10,14 @@ groups:
|
||||
checks:
|
||||
- id: 1.1.1
|
||||
text: "Ensure that the API server pod specification file permissions are set to 644 or more restrictive (Scored)"
|
||||
audit: "/bin/sh -c 'if test -e $apiserverconf; then stat -c %a $apiserverconf; fi'"
|
||||
audit: "/bin/sh -c 'if test -e $apiserverconf; then stat -c permissions=%a $apiserverconf; fi'"
|
||||
tests:
|
||||
bin_op: or
|
||||
test_items:
|
||||
- flag: "644"
|
||||
- flag: "permissions"
|
||||
compare:
|
||||
op: eq
|
||||
op: bitmask
|
||||
value: "644"
|
||||
set: true
|
||||
- flag: "640"
|
||||
compare:
|
||||
op: eq
|
||||
value: "640"
|
||||
set: true
|
||||
- flag: "600"
|
||||
compare:
|
||||
op: eq
|
||||
value: "600"
|
||||
set: true
|
||||
- flag: "444"
|
||||
compare:
|
||||
op: eq
|
||||
value: "444"
|
||||
set: true
|
||||
- flag: "440"
|
||||
compare:
|
||||
op: eq
|
||||
value: "440"
|
||||
set: true
|
||||
- flag: "400"
|
||||
compare:
|
||||
op: eq
|
||||
value: "400"
|
||||
set: true
|
||||
- flag: "000"
|
||||
compare:
|
||||
op: eq
|
||||
value: "000"
|
||||
set: true
|
||||
remediation: |
|
||||
Run the below command (based on the file location on your system) on the
|
||||
master node.
|
||||
@@ -73,45 +42,14 @@ groups:
|
||||
|
||||
- id: 1.1.3
|
||||
text: "Ensure that the controller manager pod specification file permissions are set to 644 or more restrictive (Scored)"
|
||||
audit: "/bin/sh -c 'if test -e $controllermanagerconf; then stat -c %a $controllermanagerconf; fi'"
|
||||
audit: "/bin/sh -c 'if test -e $controllermanagerconf; then stat -c permissions=%a $controllermanagerconf; fi'"
|
||||
tests:
|
||||
bin_op: or
|
||||
test_items:
|
||||
- flag: "644"
|
||||
- flag: "permissions"
|
||||
compare:
|
||||
op: eq
|
||||
op: bitmask
|
||||
value: "644"
|
||||
set: true
|
||||
- flag: "640"
|
||||
compare:
|
||||
op: eq
|
||||
value: "640"
|
||||
set: true
|
||||
- flag: "600"
|
||||
compare:
|
||||
op: eq
|
||||
value: "600"
|
||||
set: true
|
||||
- flag: "444"
|
||||
compare:
|
||||
op: eq
|
||||
value: "444"
|
||||
set: true
|
||||
- flag: "440"
|
||||
compare:
|
||||
op: eq
|
||||
value: "440"
|
||||
set: true
|
||||
- flag: "400"
|
||||
compare:
|
||||
op: eq
|
||||
value: "400"
|
||||
set: true
|
||||
- flag: "000"
|
||||
compare:
|
||||
op: eq
|
||||
value: "000"
|
||||
set: true
|
||||
remediation: |
|
||||
Run the below command (based on the file location on your system) on the master node.
|
||||
For example,
|
||||
@@ -136,45 +74,14 @@ groups:
|
||||
|
||||
- id: 1.1.5
|
||||
text: "Ensure that the scheduler pod specification file permissions are set to 644 or more restrictive (Scored)"
|
||||
audit: "/bin/sh -c 'if test -e $schedulerconf; then stat -c %a $schedulerconf; fi'"
|
||||
audit: "/bin/sh -c 'if test -e $schedulerconf; then stat -c permissions=%a $schedulerconf; fi'"
|
||||
tests:
|
||||
bin_op: or
|
||||
test_items:
|
||||
- flag: "644"
|
||||
- flag: "permissions"
|
||||
compare:
|
||||
op: eq
|
||||
op: bitmask
|
||||
value: "644"
|
||||
set: true
|
||||
- flag: "640"
|
||||
compare:
|
||||
op: eq
|
||||
value: "640"
|
||||
set: true
|
||||
- flag: "600"
|
||||
compare:
|
||||
op: eq
|
||||
value: "600"
|
||||
set: true
|
||||
- flag: "444"
|
||||
compare:
|
||||
op: eq
|
||||
value: "444"
|
||||
set: true
|
||||
- flag: "440"
|
||||
compare:
|
||||
op: eq
|
||||
value: "440"
|
||||
set: true
|
||||
- flag: "400"
|
||||
compare:
|
||||
op: eq
|
||||
value: "400"
|
||||
set: true
|
||||
- flag: "000"
|
||||
compare:
|
||||
op: eq
|
||||
value: "000"
|
||||
set: true
|
||||
remediation: |
|
||||
Run the below command (based on the file location on your system) on the master node.
|
||||
For example,
|
||||
@@ -199,45 +106,14 @@ groups:
|
||||
|
||||
- id: 1.1.7
|
||||
text: "Ensure that the etcd pod specification file permissions are set to 644 or more restrictive (Scored)"
|
||||
audit: "/bin/sh -c 'if test -e $etcdconf; then stat -c %a $etcdconf; fi'"
|
||||
audit: "/bin/sh -c 'if test -e $etcdconf; then stat -c permissions=%a $etcdconf; fi'"
|
||||
tests:
|
||||
bin_op: or
|
||||
test_items:
|
||||
- flag: "644"
|
||||
- flag: "permissions"
|
||||
compare:
|
||||
op: eq
|
||||
op: bitmask
|
||||
value: "644"
|
||||
set: true
|
||||
- flag: "640"
|
||||
compare:
|
||||
op: eq
|
||||
value: "640"
|
||||
set: true
|
||||
- flag: "600"
|
||||
compare:
|
||||
op: eq
|
||||
value: "600"
|
||||
set: true
|
||||
- flag: "444"
|
||||
compare:
|
||||
op: eq
|
||||
value: "444"
|
||||
set: true
|
||||
- flag: "440"
|
||||
compare:
|
||||
op: eq
|
||||
value: "440"
|
||||
set: true
|
||||
- flag: "400"
|
||||
compare:
|
||||
op: eq
|
||||
value: "400"
|
||||
set: true
|
||||
- flag: "000"
|
||||
compare:
|
||||
op: eq
|
||||
value: "000"
|
||||
set: true
|
||||
remediation: |
|
||||
Run the below command (based on the file location on your system) on the master node.
|
||||
For example,
|
||||
@@ -262,7 +138,7 @@ groups:
|
||||
|
||||
- id: 1.1.9
|
||||
text: "Ensure that the Container Network Interface file permissions are set to 644 or more restrictive (Not Scored)"
|
||||
audit: "stat -c %a <path/to/cni/files>"
|
||||
audit: "stat -c permissions=%a <path/to/cni/files>"
|
||||
type: "manual"
|
||||
remediation: |
|
||||
Run the below command (based on the file location on your system) on the master node.
|
||||
@@ -282,12 +158,12 @@ groups:
|
||||
|
||||
- id: 1.1.11
|
||||
text: "Ensure that the etcd data directory permissions are set to 700 or more restrictive (Scored)"
|
||||
audit: ps -ef | grep $etcdbin | grep -- --data-dir | sed 's%.*data-dir[= ]\([^ ]*\).*%\1%' | xargs stat -c %a
|
||||
audit: ps -ef | grep $etcdbin | grep -- --data-dir | sed 's%.*data-dir[= ]\([^ ]*\).*%\1%' | xargs stat -c permissions=%a
|
||||
tests:
|
||||
test_items:
|
||||
- flag: "700"
|
||||
- flag: "permissions"
|
||||
compare:
|
||||
op: eq
|
||||
op: bitmask
|
||||
value: "700"
|
||||
set: true
|
||||
remediation: |
|
||||
@@ -314,45 +190,14 @@ groups:
|
||||
|
||||
- id: 1.1.13
|
||||
text: "Ensure that the admin.conf file permissions are set to 644 or more restrictive (Scored)"
|
||||
audit: "/bin/sh -c 'if test -e /etc/kubernetes/admin.conf; then stat -c %a /etc/kubernetes/admin.conf; fi'"
|
||||
audit: "/bin/sh -c 'if test -e /etc/kubernetes/admin.conf; then stat -c permissions=%a /etc/kubernetes/admin.conf; fi'"
|
||||
tests:
|
||||
bin_op: or
|
||||
test_items:
|
||||
- flag: "644"
|
||||
- flag: "permissions"
|
||||
compare:
|
||||
op: eq
|
||||
op: bitmask
|
||||
value: "644"
|
||||
set: true
|
||||
- flag: "640"
|
||||
compare:
|
||||
op: eq
|
||||
value: "640"
|
||||
set: true
|
||||
- flag: "600"
|
||||
compare:
|
||||
op: eq
|
||||
value: "600"
|
||||
set: true
|
||||
- flag: "444"
|
||||
compare:
|
||||
op: eq
|
||||
value: "444"
|
||||
set: true
|
||||
- flag: "440"
|
||||
compare:
|
||||
op: eq
|
||||
value: "440"
|
||||
set: true
|
||||
- flag: "400"
|
||||
compare:
|
||||
op: eq
|
||||
value: "400"
|
||||
set: true
|
||||
- flag: "000"
|
||||
compare:
|
||||
op: eq
|
||||
value: "000"
|
||||
set: true
|
||||
remediation: |
|
||||
Run the below command (based on the file location on your system) on the master node.
|
||||
For example,
|
||||
@@ -377,45 +222,14 @@ groups:
|
||||
|
||||
- id: 1.1.15
|
||||
text: "Ensure that the scheduler.conf file permissions are set to 644 or more restrictive (Scored)"
|
||||
audit: "/bin/sh -c 'if test -e /etc/kubernetes/scheduler.conf; then stat -c %a /etc/kubernetes/scheduler.conf; fi'"
|
||||
audit: "/bin/sh -c 'if test -e /etc/kubernetes/scheduler.conf; then stat -c permissions=%a /etc/kubernetes/scheduler.conf; fi'"
|
||||
tests:
|
||||
bin_op: or
|
||||
test_items:
|
||||
- flag: "644"
|
||||
- flag: "permissions"
|
||||
compare:
|
||||
op: eq
|
||||
op: bitmask
|
||||
value: "644"
|
||||
set: true
|
||||
- flag: "640"
|
||||
compare:
|
||||
op: eq
|
||||
value: "640"
|
||||
set: true
|
||||
- flag: "600"
|
||||
compare:
|
||||
op: eq
|
||||
value: "600"
|
||||
set: true
|
||||
- flag: "444"
|
||||
compare:
|
||||
op: eq
|
||||
value: "444"
|
||||
set: true
|
||||
- flag: "440"
|
||||
compare:
|
||||
op: eq
|
||||
value: "440"
|
||||
set: true
|
||||
- flag: "400"
|
||||
compare:
|
||||
op: eq
|
||||
value: "400"
|
||||
set: true
|
||||
- flag: "000"
|
||||
compare:
|
||||
op: eq
|
||||
value: "000"
|
||||
set: true
|
||||
remediation: |
|
||||
Run the below command (based on the file location on your system) on the master node.
|
||||
For example,
|
||||
@@ -440,45 +254,14 @@ groups:
|
||||
|
||||
- id: 1.1.17
|
||||
text: "Ensure that the controller-manager.conf file permissions are set to 644 or more restrictive (Scored)"
|
||||
audit: "/bin/sh -c 'if test -e /etc/kubernetes/controller-manager.conf; then stat -c %a /etc/kubernetes/controller-manager.conf; fi'"
|
||||
audit: "/bin/sh -c 'if test -e /etc/kubernetes/controller-manager.conf; then stat -c permissions=%a /etc/kubernetes/controller-manager.conf; fi'"
|
||||
tests:
|
||||
bin_op: or
|
||||
test_items:
|
||||
- flag: "644"
|
||||
- flag: "permissions"
|
||||
compare:
|
||||
op: eq
|
||||
op: bitmask
|
||||
value: "644"
|
||||
set: true
|
||||
- flag: "640"
|
||||
compare:
|
||||
op: eq
|
||||
value: "640"
|
||||
set: true
|
||||
- flag: "600"
|
||||
compare:
|
||||
op: eq
|
||||
value: "600"
|
||||
set: true
|
||||
- flag: "444"
|
||||
compare:
|
||||
op: eq
|
||||
value: "444"
|
||||
set: true
|
||||
- flag: "440"
|
||||
compare:
|
||||
op: eq
|
||||
value: "440"
|
||||
set: true
|
||||
- flag: "400"
|
||||
compare:
|
||||
op: eq
|
||||
value: "400"
|
||||
set: true
|
||||
- flag: "000"
|
||||
compare:
|
||||
op: eq
|
||||
value: "000"
|
||||
set: true
|
||||
remediation: |
|
||||
Run the below command (based on the file location on your system) on the master node.
|
||||
For example,
|
||||
@@ -755,12 +538,12 @@ groups:
|
||||
tests:
|
||||
bin_op: or
|
||||
test_items:
|
||||
- flag: "--enable-admission-plugins"
|
||||
- flag: "--disable-admission-plugins"
|
||||
compare:
|
||||
op: has
|
||||
op: nothave
|
||||
value: "ServiceAccount"
|
||||
set: true
|
||||
- flag: "--enable-admission-plugins"
|
||||
- flag: "--disable-admission-plugins"
|
||||
set: false
|
||||
remediation: |
|
||||
Follow the documentation and create ServiceAccount objects as per your environment.
|
||||
|
||||
@@ -10,45 +10,14 @@ groups:
|
||||
checks:
|
||||
- id: 4.1.1
|
||||
text: "Ensure that the kubelet service file permissions are set to 644 or more restrictive (Scored)"
|
||||
audit: '/bin/sh -c ''if test -e $kubeletsvc; then stat -c %a $kubeletsvc; fi'' '
|
||||
audit: '/bin/sh -c ''if test -e $kubeletsvc; then stat -c permissions=%a $kubeletsvc; fi'' '
|
||||
tests:
|
||||
test_items:
|
||||
- flag: "644"
|
||||
- flag: "permissions"
|
||||
set: true
|
||||
compare:
|
||||
op: eq
|
||||
op: bitmask
|
||||
value: "644"
|
||||
set: true
|
||||
- flag: "640"
|
||||
compare:
|
||||
op: eq
|
||||
value: "640"
|
||||
set: true
|
||||
- flag: "600"
|
||||
compare:
|
||||
op: eq
|
||||
value: "600"
|
||||
set: true
|
||||
- flag: "444"
|
||||
compare:
|
||||
op: eq
|
||||
value: "444"
|
||||
set: true
|
||||
- flag: "440"
|
||||
compare:
|
||||
op: eq
|
||||
value: "440"
|
||||
set: true
|
||||
- flag: "400"
|
||||
compare:
|
||||
op: eq
|
||||
value: "400"
|
||||
set: true
|
||||
- flag: "000"
|
||||
compare:
|
||||
op: eq
|
||||
value: "000"
|
||||
set: true
|
||||
bin_op: or
|
||||
remediation: |
|
||||
Run the below command (based on the file location on your system) on the each worker node.
|
||||
For example,
|
||||
@@ -70,49 +39,18 @@ groups:
|
||||
|
||||
- id: 4.1.3
|
||||
text: "Ensure that the proxy kubeconfig file permissions are set to 644 or more restrictive (Scored)"
|
||||
audit: '/bin/sh -c ''if test -e $proxykubeconfig; then stat -c %a $proxykubeconfig; fi'' '
|
||||
audit: '/bin/sh -c ''if test -e $proxykubeconfig; then stat -c permissions=%a $proxykubeconfig; fi'' '
|
||||
tests:
|
||||
test_items:
|
||||
- flag: "644"
|
||||
- flag: "permissions"
|
||||
set: true
|
||||
compare:
|
||||
op: eq
|
||||
op: bitmask
|
||||
value: "644"
|
||||
set: true
|
||||
- flag: "640"
|
||||
compare:
|
||||
op: eq
|
||||
value: "640"
|
||||
set: true
|
||||
- flag: "600"
|
||||
compare:
|
||||
op: eq
|
||||
value: "600"
|
||||
set: true
|
||||
- flag: "444"
|
||||
compare:
|
||||
op: eq
|
||||
value: "444"
|
||||
set: true
|
||||
- flag: "440"
|
||||
compare:
|
||||
op: eq
|
||||
value: "440"
|
||||
set: true
|
||||
- flag: "400"
|
||||
compare:
|
||||
op: eq
|
||||
value: "400"
|
||||
set: true
|
||||
- flag: "000"
|
||||
compare:
|
||||
op: eq
|
||||
value: "000"
|
||||
set: true
|
||||
bin_op: or
|
||||
remediation: |
|
||||
Run the below command (based on the file location on your system) on the each worker node.
|
||||
For example,
|
||||
chmod 644 $proykubeconfig
|
||||
chmod 644 $proxykubeconfig
|
||||
scored: true
|
||||
|
||||
- id: 4.1.4
|
||||
@@ -129,45 +67,14 @@ groups:
|
||||
|
||||
- id: 4.1.5
|
||||
text: "Ensure that the kubelet.conf file permissions are set to 644 or more restrictive (Scored)"
|
||||
audit: '/bin/sh -c ''if test -e $kubeletkubeconfig; then stat -c %a $kubeletkubeconfig; fi'' '
|
||||
audit: '/bin/sh -c ''if test -e $kubeletkubeconfig; then stat -c permissions=%a $kubeletkubeconfig; fi'' '
|
||||
tests:
|
||||
test_items:
|
||||
- flag: "644"
|
||||
- flag: "permissions"
|
||||
set: true
|
||||
compare:
|
||||
op: eq
|
||||
op: bitmask
|
||||
value: "644"
|
||||
set: true
|
||||
- flag: "640"
|
||||
compare:
|
||||
op: eq
|
||||
value: "640"
|
||||
set: true
|
||||
- flag: "600"
|
||||
compare:
|
||||
op: eq
|
||||
value: "600"
|
||||
set: true
|
||||
- flag: "444"
|
||||
compare:
|
||||
op: eq
|
||||
value: "444"
|
||||
set: true
|
||||
- flag: "440"
|
||||
compare:
|
||||
op: eq
|
||||
value: "440"
|
||||
set: true
|
||||
- flag: "400"
|
||||
compare:
|
||||
op: eq
|
||||
value: "400"
|
||||
set: true
|
||||
- flag: "000"
|
||||
compare:
|
||||
op: eq
|
||||
value: "000"
|
||||
set: true
|
||||
bin_op: or
|
||||
remediation: |
|
||||
Run the below command (based on the file location on your system) on the each worker node.
|
||||
For example,
|
||||
@@ -215,45 +122,14 @@ groups:
|
||||
|
||||
- id: 4.1.9
|
||||
text: "Ensure that the kubelet configuration file has permissions set to 644 or more restrictive (Scored)"
|
||||
audit: '/bin/sh -c ''if test -e $kubeletconf; then stat -c %a $kubeletconf; fi'' '
|
||||
audit: '/bin/sh -c ''if test -e $kubeletconf; then stat -c permissions=%a $kubeletconf; fi'' '
|
||||
tests:
|
||||
test_items:
|
||||
- flag: "644"
|
||||
- flag: "permissions"
|
||||
set: true
|
||||
compare:
|
||||
op: eq
|
||||
op: bitmask
|
||||
value: "644"
|
||||
- flag: "640"
|
||||
set: true
|
||||
compare:
|
||||
op: eq
|
||||
value: "640"
|
||||
- flag: "600"
|
||||
set: true
|
||||
compare:
|
||||
op: eq
|
||||
value: "600"
|
||||
- flag: "444"
|
||||
compare:
|
||||
op: eq
|
||||
value: "444"
|
||||
set: true
|
||||
- flag: "440"
|
||||
compare:
|
||||
op: eq
|
||||
value: "440"
|
||||
set: true
|
||||
- flag: "400"
|
||||
compare:
|
||||
op: eq
|
||||
value: "400"
|
||||
set: true
|
||||
- flag: "000"
|
||||
compare:
|
||||
op: eq
|
||||
value: "000"
|
||||
set: true
|
||||
bin_op: or
|
||||
remediation: |
|
||||
Run the following command (using the config file location identied in the Audit step)
|
||||
chmod 644 $kubeletconf
|
||||
|
||||
@@ -27,8 +27,10 @@ master:
|
||||
- "apiserver"
|
||||
confs:
|
||||
- /etc/kubernetes/manifests/kube-apiserver.yaml
|
||||
- /etc/kubernetes/manifests/kube-apiserver.yml
|
||||
- /etc/kubernetes/manifests/kube-apiserver.manifest
|
||||
- /var/snap/kube-apiserver/current/args
|
||||
- /var/snap/microk8s/current/args/kube-apiserver
|
||||
defaultconf: /etc/kubernetes/manifests/kube-apiserver.yaml
|
||||
|
||||
scheduler:
|
||||
@@ -39,8 +41,10 @@ master:
|
||||
- "scheduler"
|
||||
confs:
|
||||
- /etc/kubernetes/manifests/kube-scheduler.yaml
|
||||
- /etc/kubernetes/manifests/kube-scheduler.yml
|
||||
- /etc/kubernetes/manifests/kube-scheduler.manifest
|
||||
- /var/snap/kube-scheduler/current/args
|
||||
- /var/snap/microk8s/current/args/kube-scheduler
|
||||
defaultconf: /etc/kubernetes/manifests/kube-scheduler.yaml
|
||||
|
||||
controllermanager:
|
||||
@@ -52,8 +56,10 @@ master:
|
||||
- "controller-manager"
|
||||
confs:
|
||||
- /etc/kubernetes/manifests/kube-controller-manager.yaml
|
||||
- /etc/kubernetes/manifests/kube-controller-manager.yml
|
||||
- /etc/kubernetes/manifests/kube-controller-manager.manifest
|
||||
- /var/snap/kube-controller-manager/current/args
|
||||
- /var/snap/microk8s/current/args/kube-controller-manager
|
||||
defaultconf: /etc/kubernetes/manifests/kube-controller-manager.yaml
|
||||
|
||||
etcd:
|
||||
@@ -62,9 +68,12 @@ master:
|
||||
- "etcd"
|
||||
confs:
|
||||
- /etc/kubernetes/manifests/etcd.yaml
|
||||
- /etc/kubernetes/manifests/etcd.yml
|
||||
- /etc/kubernetes/manifests/etcd.manifest
|
||||
- /etc/etcd/etcd.conf
|
||||
- /var/snap/etcd/common/etcd.conf.yml
|
||||
- /var/snap/etcd/common/etcd.conf.yaml
|
||||
- /var/snap/microk8s/current/args/etcd
|
||||
defaultconf: /etc/kubernetes/manifests/etcd.yaml
|
||||
|
||||
flanneld:
|
||||
@@ -88,6 +97,7 @@ node:
|
||||
- "/etc/kubernetes/pki/ca.crt"
|
||||
- "/etc/kubernetes/certs/ca.crt"
|
||||
- "/etc/kubernetes/cert/ca.pem"
|
||||
- "/var/snap/microk8s/current/certs/ca.crt"
|
||||
svc:
|
||||
# These paths must also be included
|
||||
# in the 'confs' property below
|
||||
@@ -95,6 +105,7 @@ node:
|
||||
- "/etc/systemd/system/kubelet.service"
|
||||
- "/lib/systemd/system/kubelet.service"
|
||||
- "/etc/systemd/system/snap.kubelet.daemon.service"
|
||||
- "/etc/systemd/system/snap.microk8s.daemon-kubelet.service"
|
||||
bins:
|
||||
- "hyperkube kubelet"
|
||||
- "kubelet"
|
||||
@@ -102,13 +113,17 @@ node:
|
||||
- "/etc/kubernetes/kubelet.conf"
|
||||
- "/var/lib/kubelet/kubeconfig"
|
||||
- "/etc/kubernetes/kubelet-kubeconfig"
|
||||
- "/var/snap/microk8s/current/credentials/kubelet.config"
|
||||
confs:
|
||||
- "/var/lib/kubelet/config.yaml"
|
||||
- "/var/lib/kubelet/config.yml"
|
||||
- "/etc/kubernetes/kubelet/kubelet-config.json"
|
||||
- "/home/kubernetes/kubelet-config.yaml"
|
||||
- "/home/kubernetes/kubelet-config.yml"
|
||||
- "/etc/default/kubelet"
|
||||
- "/var/lib/kubelet/kubeconfig"
|
||||
- "/var/snap/kubelet/current/args"
|
||||
- "/var/snap/microk8s/current/args/kubelet"
|
||||
## Due to the fact that the kubelet might be configured
|
||||
## without a kubelet-config file, we use a work-around
|
||||
## of pointing to the systemd service file (which can also
|
||||
@@ -118,6 +133,7 @@ node:
|
||||
- "/etc/systemd/system/kubelet.service"
|
||||
- "/lib/systemd/system/kubelet.service"
|
||||
- "/etc/systemd/system/snap.kubelet.daemon.service"
|
||||
- "/etc/systemd/system/snap.microk8s.daemon-kubelet.service"
|
||||
defaultconf: "/var/lib/kubelet/config.yaml"
|
||||
defaultsvc: "/etc/systemd/system/kubelet.service.d/10-kubeadm.conf"
|
||||
defaultkubeconfig: "/etc/kubernetes/kubelet.conf"
|
||||
@@ -133,12 +149,16 @@ node:
|
||||
confs:
|
||||
- /etc/kubernetes/proxy
|
||||
- /etc/kubernetes/addons/kube-proxy-daemonset.yaml
|
||||
- /etc/kubernetes/addons/kube-proxy-daemonset.yml
|
||||
- /var/snap/kube-proxy/current/args
|
||||
- /var/snap/microk8s/current/args/kube-proxy
|
||||
kubeconfig:
|
||||
- "/etc/kubernetes/kubelet-kubeconfig"
|
||||
- "/var/lib/kubelet/kubeconfig"
|
||||
- "/var/snap/microk8s/current/credentials/proxy.config"
|
||||
svc:
|
||||
- "/lib/systemd/system/kube-proxy.service"
|
||||
- "/etc/systemd/system/snap.microk8s.daemon-proxy.service"
|
||||
defaultconf: /etc/kubernetes/addons/kube-proxy-daemonset.yaml
|
||||
defaultkubeconfig: "/etc/kubernetes/proxy.conf"
|
||||
|
||||
@@ -151,9 +171,12 @@ etcd:
|
||||
- "etcd"
|
||||
confs:
|
||||
- /etc/kubernetes/manifests/etcd.yaml
|
||||
- /etc/kubernetes/manifests/etcd.yml
|
||||
- /etc/kubernetes/manifests/etcd.manifest
|
||||
- /etc/etcd/etcd.conf
|
||||
- /var/snap/etcd/common/etcd.conf.yml
|
||||
- /var/snap/etcd/common/etcd.conf.yaml
|
||||
- /var/snap/microk8s/current/args/etcd
|
||||
defaultconf: /etc/kubernetes/manifests/etcd.yaml
|
||||
|
||||
controlplane:
|
||||
@@ -162,6 +185,8 @@ controlplane:
|
||||
policies:
|
||||
components: []
|
||||
|
||||
managedservices:
|
||||
components: []
|
||||
|
||||
version_mapping:
|
||||
"1.11": "cis-1.3"
|
||||
@@ -171,5 +196,6 @@ version_mapping:
|
||||
"1.15": "cis-1.5"
|
||||
"1.16": "cis-1.5"
|
||||
"1.17": "cis-1.5"
|
||||
"gke-1.0": "gke-1.0"
|
||||
"ocp-3.10": "rh-0.7"
|
||||
"ocp-3.11": "rh-0.7"
|
||||
|
||||
2
cfg/gke-1.0/config.yaml
Normal file
2
cfg/gke-1.0/config.yaml
Normal file
@@ -0,0 +1,2 @@
|
||||
---
|
||||
## Version-specific settings that override the values in cfg/config.yaml
|
||||
32
cfg/gke-1.0/controlplane.yaml
Normal file
32
cfg/gke-1.0/controlplane.yaml
Normal file
@@ -0,0 +1,32 @@
|
||||
---
|
||||
controls:
|
||||
version: "gke-1.0"
|
||||
id: 3
|
||||
text: "Control Plane Configuration"
|
||||
type: "controlplane"
|
||||
groups:
|
||||
- id: 3.1
|
||||
text: "Authentication and Authorization"
|
||||
checks:
|
||||
- id: 3.1.1
|
||||
text: "Client certificate authentication should not be used for users (Not Scored)"
|
||||
type: "manual"
|
||||
remediation: |
|
||||
Alternative mechanisms provided by Kubernetes such as the use of OIDC should be
|
||||
implemented in place of client certificates.
|
||||
You can remediate the availability of client certificates in your GKE cluster. See
|
||||
Recommendation 6.8.2.
|
||||
scored: false
|
||||
|
||||
- id: 3.2
|
||||
text: "Logging"
|
||||
checks:
|
||||
- id: 3.2.1
|
||||
text: "Ensure that a minimal audit policy is created (Not Scored)"
|
||||
remediation: "This control cannot be modified in GKE."
|
||||
scored: false
|
||||
|
||||
- id: 3.2.2
|
||||
text: "Ensure that the audit policy covers key security concerns (Not Scored) "
|
||||
remediation: "This control cannot be modified in GKE."
|
||||
scored: false
|
||||
45
cfg/gke-1.0/etcd.yaml
Normal file
45
cfg/gke-1.0/etcd.yaml
Normal file
@@ -0,0 +1,45 @@
|
||||
---
|
||||
controls:
|
||||
version: "gke-1.0"
|
||||
id: 2
|
||||
text: "Etcd Node Configuration"
|
||||
type: "etcd"
|
||||
groups:
|
||||
- id: 2
|
||||
text: "Etcd Node Configuration Files"
|
||||
checks:
|
||||
- id: 2.1
|
||||
text: "Ensure that the --cert-file and --key-file arguments are set as appropriate (Not Scored)"
|
||||
remediation: "This control cannot be modified in GKE."
|
||||
scored: false
|
||||
|
||||
- id: 2.2
|
||||
text: "Ensure that the --client-cert-auth argument is set to true (Not Scored)"
|
||||
remediation: "This control cannot be modified in GKE."
|
||||
scored: false
|
||||
|
||||
- id: 2.3
|
||||
text: "Ensure that the --auto-tls argument is not set to true (Not Scored)"
|
||||
remediation: "This control cannot be modified in GKE."
|
||||
scored: false
|
||||
|
||||
- id: 2.4
|
||||
text: "Ensure that the --peer-cert-file and --peer-key-file arguments are
|
||||
set as appropriate (Not Scored)"
|
||||
remediation: "This control cannot be modified in GKE."
|
||||
scored: false
|
||||
|
||||
- id: 2.5
|
||||
text: "Ensure that the --peer-client-cert-auth argument is set to true (Not Scored)"
|
||||
remediation: "This control cannot be modified in GKE."
|
||||
scored: false
|
||||
|
||||
- id: 2.6
|
||||
text: "Ensure that the --peer-auto-tls argument is not set to true (Not Scored)"
|
||||
remediation: "This control cannot be modified in GKE."
|
||||
scored: false
|
||||
|
||||
- id: 2.7
|
||||
text: "Ensure that a unique Certificate Authority is used for etcd (Not Scored)"
|
||||
remediation: "This control cannot be modified in GKE."
|
||||
scored: false
|
||||
703
cfg/gke-1.0/managedservices.yaml
Normal file
703
cfg/gke-1.0/managedservices.yaml
Normal file
@@ -0,0 +1,703 @@
|
||||
---
|
||||
controls:
|
||||
version: "gke-1.0"
|
||||
id: 6
|
||||
text: "Managed Services"
|
||||
type: "managedservices"
|
||||
groups:
|
||||
- id: 6.1
|
||||
text: "Image Registry and Image Scanning"
|
||||
checks:
|
||||
- id: 6.1.1
|
||||
text: "Ensure Image Vulnerability Scanning using GCR Container Analysis
|
||||
or a third-party provider (Scored)"
|
||||
type: "manual"
|
||||
remediation: |
|
||||
Using Command Line:
|
||||
|
||||
gcloud services enable containerscanning.googleapis.com
|
||||
scored: true
|
||||
|
||||
- id: 6.1.2
|
||||
text: "Minimize user access to GCR (Scored)"
|
||||
type: "manual"
|
||||
remediation: |
|
||||
Using Command Line:
|
||||
To change roles at the GCR bucket level:
|
||||
Firstly, run the following if read permissions are required:
|
||||
|
||||
gsutil iam ch [TYPE]:[EMAIL-ADDRESS]:objectViewer
|
||||
gs://artifacts.[PROJECT_ID].appspot.com
|
||||
|
||||
Then remove the excessively privileged role (Storage Admin / Storage Object Admin /
|
||||
Storage Object Creator) using:
|
||||
|
||||
gsutil iam ch -d [TYPE]:[EMAIL-ADDRESS]:[ROLE]
|
||||
gs://artifacts.[PROJECT_ID].appspot.com
|
||||
|
||||
where:
|
||||
[TYPE] can be one of the following:
|
||||
o user, if the [EMAIL-ADDRESS] is a Google account
|
||||
o serviceAccount, if [EMAIL-ADDRESS] specifies a Service account
|
||||
[EMAIL-ADDRESS] can be one of the following:
|
||||
o a Google account (for example, someone@example.com)
|
||||
o a Cloud IAM service account
|
||||
To modify roles defined at the project level and subsequently inherited within the GCR
|
||||
bucket, or the Service Account User role, extract the IAM policy file, modify it accordingly
|
||||
and apply it using:
|
||||
|
||||
gcloud projects set-iam-policy [PROJECT_ID] [POLICY_FILE]
|
||||
scored: true
|
||||
|
||||
- id: 6.1.3
|
||||
text: "Minimize cluster access to read-only for GCR (Scored)"
|
||||
type: "manual"
|
||||
remediation: |
|
||||
Using Command Line:
|
||||
For an account explicitly granted to the bucket. First, add read access to the Kubernetes
|
||||
Service Account
|
||||
|
||||
gsutil iam ch [TYPE]:[EMAIL-ADDRESS]:objectViewer
|
||||
gs://artifacts.[PROJECT_ID].appspot.com
|
||||
|
||||
where:
|
||||
[TYPE] can be one of the following:
|
||||
o user, if the [EMAIL-ADDRESS] is a Google account
|
||||
o serviceAccount, if [EMAIL-ADDRESS] specifies a Service account
|
||||
[EMAIL-ADDRESS] can be one of the following:
|
||||
o a Google account (for example, someone@example.com)
|
||||
o a Cloud IAM service account
|
||||
|
||||
Then remove the excessively privileged role (Storage Admin / Storage Object Admin /
|
||||
Storage Object Creator) using:
|
||||
|
||||
gsutil iam ch -d [TYPE]:[EMAIL-ADDRESS]:[ROLE]
|
||||
gs://artifacts.[PROJECT_ID].appspot.com
|
||||
|
||||
For an account that inherits access to the GCR Bucket through Project level permissions,
|
||||
modify the Projects IAM policy file accordingly, then upload it using:
|
||||
|
||||
gcloud projects set-iam-policy [PROJECT_ID] [POLICY_FILE]
|
||||
scored: true
|
||||
|
||||
- id: 6.1.4
|
||||
text: "Minimize Container Registries to only those approved (Not Scored)"
|
||||
type: "manual"
|
||||
remediation: |
|
||||
Using Command Line:
|
||||
First, update the cluster to enable Binary Authorization:
|
||||
|
||||
gcloud container cluster update [CLUSTER_NAME] \
|
||||
--enable-binauthz
|
||||
|
||||
Create a Binary Authorization Policy using the Binary Authorization Policy Reference
|
||||
(https://cloud.google.com/binary-authorization/docs/policy-yaml-reference) for guidance.
|
||||
Import the policy file into Binary Authorization:
|
||||
|
||||
gcloud container binauthz policy import [YAML_POLICY]
|
||||
scored: false
|
||||
|
||||
- id: 6.2
|
||||
text: "Identity and Access Management (IAM)"
|
||||
checks:
|
||||
- id: 6.2.1
|
||||
text: "Ensure GKE clusters are not running using the Compute Engine
|
||||
default service account (Scored)"
|
||||
type: "manual"
|
||||
remediation: |
|
||||
Using Command Line:
|
||||
Firstly, create a minimally privileged service account:
|
||||
|
||||
gcloud iam service-accounts create [SA_NAME] \
|
||||
--display-name "GKE Node Service Account"
|
||||
export NODE_SA_EMAIL=`gcloud iam service-accounts list \
|
||||
--format='value(email)' \
|
||||
--filter='displayName:GKE Node Service Account'`
|
||||
|
||||
Grant the following roles to the service account:
|
||||
|
||||
export PROJECT_ID=`gcloud config get-value project`
|
||||
gcloud projects add-iam-policy-binding $PROJECT_ID \
|
||||
--member serviceAccount:$NODE_SA_EMAIL \
|
||||
--role roles/monitoring.metricWriter
|
||||
gcloud projects add-iam-policy-binding $PROJECT_ID \
|
||||
--member serviceAccount:$NODE_SA_EMAIL \
|
||||
--role roles/monitoring.viewer
|
||||
gcloud projects add-iam-policy-binding $PROJECT_ID \
|
||||
--member serviceAccount:$NODE_SA_EMAIL \
|
||||
--role roles/logging.logWriter
|
||||
|
||||
To create a new Node pool using the Service account, run the following command:
|
||||
|
||||
gcloud container node-pools create [NODE_POOL] \
|
||||
--service-account=[SA_NAME]@[PROJECT_ID].iam.gserviceaccount.com \
|
||||
--cluster=[CLUSTER_NAME] --zone [COMPUTE_ZONE]
|
||||
|
||||
You will need to migrate your workloads to the new Node pool, and delete Node pools that
|
||||
use the default service account to complete the remediation.
|
||||
scored: true
|
||||
|
||||
- id: 6.2.2
|
||||
text: "Prefer using dedicated GCP Service Accounts and Workload Identity (Not Scored)"
|
||||
type: "manual"
|
||||
remediation: |
|
||||
Using Command Line:
|
||||
|
||||
gcloud beta container clusters update [CLUSTER_NAME] --zone [CLUSTER_ZONE] \
|
||||
--identity-namespace=[PROJECT_ID].svc.id.goog
|
||||
|
||||
Note that existing Node pools are unaffected. New Node pools default to --workload-
|
||||
metadata-from-node=GKE_METADATA_SERVER .
|
||||
|
||||
Then, modify existing Node pools to enable GKE_METADATA_SERVER:
|
||||
|
||||
gcloud beta container node-pools update [NODEPOOL_NAME] \
|
||||
--cluster=[CLUSTER_NAME] --zone [CLUSTER_ZONE] \
|
||||
--workload-metadata-from-node=GKE_METADATA_SERVER
|
||||
|
||||
You may also need to modify workloads in order for them to use Workload Identity as
|
||||
described within https://cloud.google.com/kubernetes-engine/docs/how-to/workload-
|
||||
identity. Also consider the effects on the availability of your hosted workloads as Node
|
||||
pools are updated, it may be more appropriate to create new Node Pools.
|
||||
scored: false
|
||||
|
||||
- id: 6.3
|
||||
text: "Cloud Key Management Service (Cloud KMS)"
|
||||
checks:
|
||||
- id: 6.3.1
|
||||
text: "Ensure Kubernetes Secrets are encrypted using keys managed in Cloud KMS (Scored)"
|
||||
type: "manual"
|
||||
remediation: |
|
||||
Using Command Line:
|
||||
To create a key
|
||||
|
||||
Create a key ring:
|
||||
|
||||
gcloud kms keyrings create [RING_NAME] \
|
||||
--location [LOCATION] \
|
||||
--project [KEY_PROJECT_ID]
|
||||
|
||||
Create a key:
|
||||
|
||||
gcloud kms keys create [KEY_NAME] \
|
||||
--location [LOCATION] \
|
||||
--keyring [RING_NAME] \
|
||||
--purpose encryption \
|
||||
--project [KEY_PROJECT_ID]
|
||||
|
||||
Grant the Kubernetes Engine Service Agent service account the Cloud KMS CryptoKey
|
||||
Encrypter/Decrypter role:
|
||||
|
||||
gcloud kms keys add-iam-policy-binding [KEY_NAME] \
|
||||
--location [LOCATION] \
|
||||
--keyring [RING_NAME] \
|
||||
--member serviceAccount:[SERVICE_ACCOUNT_NAME] \
|
||||
--role roles/cloudkms.cryptoKeyEncrypterDecrypter \
|
||||
--project [KEY_PROJECT_ID]
|
||||
|
||||
To create a new cluster with Application-layer Secrets Encryption:
|
||||
|
||||
gcloud container clusters create [CLUSTER_NAME] \
|
||||
--cluster-version=latest \
|
||||
--zone [ZONE] \
|
||||
--database-encryption-key projects/[KEY_PROJECT_ID]/locations/[LOCATION]/keyRings/[RING_NAME]/cryptoKey s/[KEY_NAME] \
|
||||
--project [CLUSTER_PROJECT_ID]
|
||||
|
||||
To enable on an existing cluster:
|
||||
|
||||
gcloud container clusters update [CLUSTER_NAME] \
|
||||
--zone [ZONE] \
|
||||
--database-encryption-key projects/[KEY_PROJECT_ID]/locations/[LOCATION]/keyRings/[RING_NAME]/cryptoKey s/[KEY_NAME] \
|
||||
--project [CLUSTER_PROJECT_ID]
|
||||
scored: true
|
||||
|
||||
- id: 6.4
|
||||
text: "Node Metadata"
|
||||
checks:
|
||||
- id: 6.4.1
|
||||
text: "Ensure legacy Compute Engine instance metadata APIs are Disabled (Scored)"
|
||||
type: "manual"
|
||||
remediation: |
|
||||
Using Command Line:
|
||||
To update an existing cluster, create a new Node pool with the legacy GCE metadata
|
||||
endpoint disabled:
|
||||
|
||||
gcloud container node-pools create [POOL_NAME] \
|
||||
--metadata disable-legacy-endpoints=true \
|
||||
--cluster [CLUSTER_NAME] \
|
||||
--zone [COMPUTE_ZONE]
|
||||
|
||||
You will need to migrate workloads from any existing non-conforming Node pools, to the
|
||||
new Node pool, then delete non-conforming Node pools to complete the remediation.
|
||||
scored: true
|
||||
|
||||
- id: 6.4.2
|
||||
text: "Ensure the GKE Metadata Server is Enabled (Not Scored)"
|
||||
type: "manual"
|
||||
remediation: |
|
||||
Using Command Line:
|
||||
gcloud beta container clusters update [CLUSTER_NAME] \
|
||||
--identity-namespace=[PROJECT_ID].svc.id.goog
|
||||
Note that existing Node pools are unaffected. New Node pools default to --workload-
|
||||
metadata-from-node=GKE_METADATA_SERVER .
|
||||
|
||||
To modify an existing Node pool to enable GKE Metadata Server:
|
||||
|
||||
gcloud beta container node-pools update [NODEPOOL_NAME] \
|
||||
--cluster=[CLUSTER_NAME] \
|
||||
--workload-metadata-from-node=GKE_METADATA_SERVER
|
||||
|
||||
You may also need to modify workloads in order for them to use Workload Identity as
|
||||
described within https://cloud.google.com/kubernetes-engine/docs/how-to/workload-
|
||||
identity.
|
||||
scored: false
|
||||
|
||||
- id: 6.5
|
||||
text: "Node Configuration and Maintenance"
|
||||
checks:
|
||||
- id: 6.5.1
|
||||
text: "Ensure Container-Optimized OS (COS) is used for GKE node images (Scored)"
|
||||
type: "manual"
|
||||
remediation: |
|
||||
Using Command Line:
|
||||
To set the node image to cos for an existing cluster's Node pool:
|
||||
|
||||
gcloud container clusters upgrade [CLUSTER_NAME]\
|
||||
--image-type cos \
|
||||
--zone [COMPUTE_ZONE] --node-pool [POOL_NAME]
|
||||
scored: true
|
||||
|
||||
- id: 6.5.2
|
||||
text: "Ensure Node Auto-Repair is enabled for GKE nodes (Scored)"
|
||||
type: "manual"
|
||||
remediation: |
|
||||
Using Command Line:
|
||||
To enable node auto-repair for an existing cluster with Node pool, run the following
|
||||
command:
|
||||
|
||||
gcloud container node-pools update [POOL_NAME] \
|
||||
--cluster [CLUSTER_NAME] --zone [COMPUTE_ZONE] \
|
||||
--enable-autorepair
|
||||
scored: true
|
||||
|
||||
- id: 6.5.3
|
||||
text: "Ensure Node Auto-Upgrade is enabled for GKE nodes (Scored)"
|
||||
type: "manual"
|
||||
remediation: |
|
||||
Using Command Line:
|
||||
To enable node auto-upgrade for an existing cluster's Node pool, run the following
|
||||
command:
|
||||
|
||||
gcloud container node-pools update [NODE_POOL] \
|
||||
--cluster [CLUSTER_NAME] --zone [COMPUTE_ZONE] \
|
||||
--enable-autoupgrade
|
||||
scored: true
|
||||
|
||||
- id: 6.5.4
|
||||
text: "Automate GKE version management using Release Channels (Not Scored)"
|
||||
type: "manual"
|
||||
remediation: |
|
||||
Using Command Line:
|
||||
Create a new cluster by running the following command:
|
||||
|
||||
gcloud beta container clusters create [CLUSTER_NAME] \
|
||||
--zone [COMPUTE_ZONE] \
|
||||
--release-channel [RELEASE_CHANNEL]
|
||||
|
||||
where [RELEASE_CHANNEL] is stable or regular according to your needs.
|
||||
scored: false
|
||||
|
||||
- id: 6.5.5
|
||||
text: "Ensure Shielded GKE Nodes are Enabled (Not Scored)"
|
||||
type: "manual"
|
||||
remediation: |
|
||||
Using Command Line:
|
||||
To create a Node pool within the cluster with Integrity Monitoring enabled, run the
|
||||
following command:
|
||||
|
||||
gcloud beta container node-pools create [NODEPOOL_NAME] \
|
||||
--cluster [CLUSTER_NAME] --zone [COMPUTE_ZONE] \
|
||||
--shielded-integrity-monitoring
|
||||
|
||||
You will also need to migrate workloads from existing non-conforming Node pools to the
|
||||
newly created Node pool, then delete the non-conforming pools.
|
||||
scored: false
|
||||
|
||||
- id: 6.5.6
|
||||
text: "Ensure Shielded GKE Nodes are Enabled (Not Scored)"
|
||||
type: "manual"
|
||||
remediation: |
|
||||
Using Command Line:
|
||||
To migrate an existing cluster, you will need to specify the --enable-shielded-nodes flag
|
||||
on a cluster update command:
|
||||
|
||||
gcloud beta container clusters update [CLUSTER_NAME] \
|
||||
--zone [CLUSTER_ZONE] \
|
||||
--enable-shielded-nodes
|
||||
scored: false
|
||||
|
||||
- id: 6.5.7
|
||||
text: "Ensure Secure Boot for Shielded GKE Nodes is Enabled (Not Scored)"
|
||||
type: "manual"
|
||||
remediation: |
|
||||
Using Command Line:
|
||||
To create a Node pool within the cluster with Secure Boot enabled, run the following
|
||||
command:
|
||||
|
||||
gcloud beta container node-pools create [NODEPOOL_NAME] \
|
||||
--cluster [CLUSTER_NAME] --zone [COMPUTE_ZONE] \
|
||||
--shielded-secure-boot
|
||||
|
||||
You will also need to migrate workloads from existing non-conforming Node pools to the
|
||||
newly created Node pool, then delete the non-conforming pools.
|
||||
scored: false
|
||||
|
||||
- id: 6.6
|
||||
text: "Cluster Networking"
|
||||
checks:
|
||||
- id: 6.6.1
|
||||
text: "Enable VPC Flow Logs and Intranode Visibility (Not Scored)"
|
||||
type: "manual"
|
||||
remediation: |
|
||||
Using Command Line:
|
||||
To enable intranode visibility on an existing cluster, run the following command:
|
||||
|
||||
gcloud beta container clusters update [CLUSTER_NAME] \
|
||||
--enable-intra-node-visibility
|
||||
scored: false
|
||||
|
||||
- id: 6.6.2
|
||||
text: "Ensure use of VPC-native clusters (Scored)"
|
||||
type: "manual"
|
||||
remediation: |
|
||||
Using Command Line:
|
||||
To enable Alias IP on a new cluster, run the following command:
|
||||
|
||||
gcloud container clusters create [CLUSTER_NAME] \
|
||||
--zone [COMPUTE_ZONE] \
|
||||
--enable-ip-alias
|
||||
scored: true
|
||||
|
||||
- id: 6.6.3
|
||||
text: "Ensure Master Authorized Networks is Enabled (Scored)"
|
||||
type: "manual"
|
||||
remediation: |
|
||||
Using Command Line:
|
||||
To check Master Authorized Networks status for an existing cluster, run the following
|
||||
command;
|
||||
|
||||
gcloud container clusters describe [CLUSTER_NAME] \
|
||||
--zone [COMPUTE_ZONE] \
|
||||
--format json | jq '.masterAuthorizedNetworksConfig'
|
||||
|
||||
The output should return
|
||||
|
||||
{
|
||||
"enabled": true
|
||||
}
|
||||
|
||||
if Master Authorized Networks is enabled.
|
||||
|
||||
If Master Authorized Networks is disabled, the
|
||||
above command will return null ( { } ).
|
||||
scored: true
|
||||
|
||||
- id: 6.6.4
|
||||
text: "Ensure clusters are created with Private Endpoint Enabled and Public Access Disabled (Scored)"
|
||||
type: "manual"
|
||||
remediation: |
|
||||
Using Command Line:
|
||||
Create a cluster with a Private Endpoint enabled and Public Access disabled by including
|
||||
the --enable-private-endpoint flag within the cluster create command:
|
||||
|
||||
gcloud container clusters create [CLUSTER_NAME] \
|
||||
--enable-private-endpoint
|
||||
|
||||
Setting this flag also requires the setting of --enable-private-nodes , --enable-ip-alias
|
||||
and --master-ipv4-cidr=[MASTER_CIDR_RANGE] .
|
||||
scored: true
|
||||
|
||||
- id: 6.6.5
|
||||
text: "Ensure clusters are created with Private Nodes (Scored)"
|
||||
type: "manual"
|
||||
remediation: |
|
||||
Using Command Line:
|
||||
To create a cluster with Private Nodes enabled, include the --enable-private-nodes flag
|
||||
within the cluster create command:
|
||||
|
||||
gcloud container clusters create [CLUSTER_NAME] \
|
||||
--enable-private-nodes
|
||||
|
||||
Setting this flag also requires the setting of --enable-ip-alias and --master-ipv4-
|
||||
cidr=[MASTER_CIDR_RANGE] .
|
||||
scored: true
|
||||
|
||||
- id: 6.6.6
|
||||
text: "Consider firewalling GKE worker nodes (Not Scored)"
|
||||
type: "manual"
|
||||
remediation: |
|
||||
Using Command Line:
|
||||
Use the following command to generate firewall rules, setting the variables as appropriate.
|
||||
You may want to use the target [TAG] and [SERVICE_ACCOUNT] previously identified.
|
||||
|
||||
gcloud compute firewall-rules create FIREWALL_RULE_NAME \
|
||||
--network [NETWORK] \
|
||||
--priority [PRIORITY] \
|
||||
--direction [DIRECTION] \
|
||||
--action [ACTION] \
|
||||
--target-tags [TAG] \
|
||||
--target-service-accounts [SERVICE_ACCOUNT] \
|
||||
--source-ranges [SOURCE_CIDR-RANGE] \
|
||||
--source-tags [SOURCE_TAGS] \
|
||||
--source-service-accounts=[SOURCE_SERVICE_ACCOUNT] \
|
||||
--destination-ranges [DESTINATION_CIDR_RANGE] \
|
||||
--rules [RULES]
|
||||
scored: false
|
||||
|
||||
- id: 6.6.7
|
||||
text: "Ensure Network Policy is Enabled and set as appropriate (Not Scored)"
|
||||
type: "manual"
|
||||
remediation: |
|
||||
Using Command Line:
|
||||
To enable Network Policy for an existing cluster, firstly enable the Network Policy add-on:
|
||||
|
||||
gcloud container clusters update [CLUSTER_NAME] \
|
||||
--zone [COMPUTE_ZONE] \
|
||||
--update-addons NetworkPolicy=ENABLED
|
||||
|
||||
Then, enable Network Policy:
|
||||
|
||||
gcloud container clusters update [CLUSTER_NAME] \
|
||||
--zone [COMPUTE_ZONE] \
|
||||
--enable-network-policy
|
||||
scored: false
|
||||
|
||||
- id: 6.6.8
|
||||
text: "Ensure use of Google-managed SSL Certificates (Not Scored)"
|
||||
type: "manual"
|
||||
remediation: |
|
||||
If services of type:LoadBalancer are discovered, consider replacing the Service with an
|
||||
Ingress.
|
||||
|
||||
To configure the Ingress and use Google-managed SSL certificates, follow the instructions
|
||||
as listed at https://cloud.google.com/kubernetes-engine/docs/how-to/managed-certs.
|
||||
scored: false
|
||||
|
||||
- id: 6.7
|
||||
text: "Logging"
|
||||
checks:
|
||||
- id: 6.7.1
|
||||
text: "Ensure Stackdriver Kubernetes Logging and Monitoring is Enabled (Scored)"
|
||||
type: "manual"
|
||||
remediation: |
|
||||
Using Command Line:
|
||||
|
||||
STACKDRIVER KUBERNETES ENGINE MONITORING SUPPORT (PREFERRED):
|
||||
To enable Stackdriver Kubernetes Engine Monitoring for an existing cluster, run the
|
||||
following command:
|
||||
|
||||
gcloud container clusters update [CLUSTER_NAME] \
|
||||
--zone [COMPUTE_ZONE] \
|
||||
--enable-stackdriver-kubernetes
|
||||
|
||||
LEGACY STACKDRIVER SUPPORT:
|
||||
Both Logging and Monitoring support must be enabled.
|
||||
To enable Legacy Stackdriver Logging for an existing cluster, run the following command:
|
||||
|
||||
gcloud container clusters update [CLUSTER_NAME] --zone [COMPUTE_ZONE] \
|
||||
--logging-service logging.googleapis.com
|
||||
|
||||
To enable Legacy Stackdriver Monitoring for an existing cluster, run the following
|
||||
command:
|
||||
|
||||
gcloud container clusters update [CLUSTER_NAME] --zone [COMPUTE_ZONE] \
|
||||
--monitoring-service monitoring.googleapis.com
|
||||
scored: true
|
||||
|
||||
- id: 6.7.2
|
||||
text: "Enable Linux auditd logging (Not Scored)"
|
||||
type: "manual"
|
||||
remediation: |
|
||||
Using Command Line:
|
||||
Download the example manifests:
|
||||
|
||||
curl https://raw.githubusercontent.com/GoogleCloudPlatform/k8s-node-tools/master/os-audit/cos-auditd-logging.yaml \
|
||||
> cos-auditd-logging.yaml
|
||||
|
||||
Edit the example manifests if needed. Then, deploy them:
|
||||
|
||||
kubectl apply -f cos-auditd-logging.yaml
|
||||
|
||||
Verify that the logging Pods have started. If you defined a different Namespace in your
|
||||
manifests, replace cos-auditd with the name of the namespace you're using:
|
||||
|
||||
kubectl get pods --namespace=cos-auditd
|
||||
scored: false
|
||||
|
||||
- id: 6.8
|
||||
text: "Authentication and Authorization"
|
||||
checks:
|
||||
- id: 6.8.1
|
||||
text: "Ensure Basic Authentication using static passwords is Disabled (Scored)"
|
||||
type: "manual"
|
||||
remediation: |
|
||||
Using Command Line:
|
||||
To update an existing cluster and disable Basic Authentication by removing the static
|
||||
password:
|
||||
|
||||
gcloud container clusters update [CLUSTER_NAME] \
|
||||
--no-enable-basic-auth
|
||||
scored: true
|
||||
|
||||
- id: 6.8.2
|
||||
text: "Ensure authentication using Client Certificates is Disabled (Scored)"
|
||||
type: "manual"
|
||||
remediation: |
|
||||
Using Command Line:
|
||||
Create a new cluster without a Client Certificate:
|
||||
|
||||
gcloud container clusters create [CLUSTER_NAME] \
|
||||
--no-issue-client-certificate
|
||||
scored: true
|
||||
|
||||
- id: 6.8.3
|
||||
text: "Manage Kubernetes RBAC users with Google Groups for GKE (Not Scored)"
|
||||
type: "manual"
|
||||
remediation: |
|
||||
Using Command Line:
|
||||
Follow the G Suite Groups instructions at https://cloud.google.com/kubernetes-
|
||||
engine/docs/how-to/role-based-access-control#google-groups-for-gke.
|
||||
|
||||
Then, create a cluster with
|
||||
|
||||
gcloud beta container clusters create my-cluster \
|
||||
--security-group="gke-security-groups@[yourdomain.com]"
|
||||
|
||||
Finally create Roles, ClusterRoles, RoleBindings, and ClusterRoleBindings that
|
||||
reference your G Suite Groups.
|
||||
scored: false
|
||||
|
||||
- id: 6.8.4
|
||||
text: "Ensure Legacy Authorization (ABAC) is Disabled (Scored)"
|
||||
type: "manual"
|
||||
remediation: |
|
||||
Using Command Line:
|
||||
To disable Legacy Authorization for an existing cluster, run the following command:
|
||||
|
||||
gcloud container clusters update [CLUSTER_NAME] \
|
||||
--zone [COMPUTE_ZONE] \
|
||||
--no-enable-legacy-authorization
|
||||
scored: true
|
||||
|
||||
- id: 6.9
|
||||
text: "Storage"
|
||||
checks:
|
||||
- id: 6.9.1
|
||||
text: "Enable Customer-Managed Encryption Keys (CMEK) for GKE Persistent Disks (PD) (Not Scored)"
|
||||
type: "manual"
|
||||
remediation: |
|
||||
Using Command Line:
|
||||
FOR NODE BOOT DISKS:
|
||||
Create a new node pool using customer-managed encryption keys for the node boot disk, of
|
||||
[DISK_TYPE] either pd-standard or pd-ssd :
|
||||
|
||||
gcloud beta container node-pools create [CLUSTER_NAME] \
|
||||
--disk-type [DISK_TYPE] \
|
||||
--boot-disk-kms-key \
|
||||
projects/[KEY_PROJECT_ID]/locations/[LOCATION]/keyRings/[RING_NAME]/cryptoKeys/[KEY_NAME]
|
||||
|
||||
Create a cluster using customer-managed encryption keys for the node boot disk, of
|
||||
[DISK_TYPE] either pd-standard or pd-ssd :
|
||||
|
||||
gcloud beta container clusters create [CLUSTER_NAME] \
|
||||
--disk-type [DISK_TYPE] \
|
||||
--boot-disk-kms-key \
|
||||
projects/[KEY_PROJECT_ID]/locations/[LOCATION]/keyRings/[RING_NAME]/cryptoKeys/[KEY_NAME]
|
||||
|
||||
FOR ATTACHED DISKS:
|
||||
Follow the instructions detailed at https://cloud.google.com/kubernetes-
|
||||
engine/docs/how-to/using-cmek.
|
||||
scored: false
|
||||
|
||||
- id: 6.10
|
||||
text: "Other Cluster Configurations"
|
||||
checks:
|
||||
- id: 6.10.1
|
||||
text: "Ensure Kubernetes Web UI is Disabled (Scored)"
|
||||
type: "manual"
|
||||
remediation: |
|
||||
Using Command Line:
|
||||
To disable the Kubernetes Dashboard on an existing cluster, run the following command:
|
||||
|
||||
gcloud container clusters update [CLUSTER_NAME] \
|
||||
--zone [ZONE] \
|
||||
--update-addons=KubernetesDashboard=DISABLED
|
||||
scored: true
|
||||
|
||||
- id: 6.10.2
|
||||
text: "Ensure that Alpha clusters are not used for production workloads (Scored)"
|
||||
type: "manual"
|
||||
remediation: |
|
||||
Using Command Line:
|
||||
Upon creating a new cluster
|
||||
|
||||
gcloud container clusters create [CLUSTER_NAME] \
|
||||
--zone [COMPUTE_ZONE]
|
||||
|
||||
Do not use the --enable-kubernetes-alpha argument.
|
||||
scored: true
|
||||
|
||||
- id: 6.10.3
|
||||
text: "Ensure Pod Security Policy is Enabled and set as appropriate (Not Scored)"
|
||||
type: "manual"
|
||||
remediation: |
|
||||
Using Command Line:
|
||||
To enable Pod Security Policy for an existing cluster, run the following command:
|
||||
|
||||
gcloud beta container clusters update [CLUSTER_NAME] \
|
||||
--zone [COMPUTE_ZONE] \
|
||||
--enable-pod-security-policy
|
||||
scored: false
|
||||
|
||||
- id: 6.10.4
|
||||
text: "Consider GKE Sandbox for running untrusted workloads (Not Scored)"
|
||||
type: "manual"
|
||||
remediation: |
|
||||
Using Command Line:
|
||||
To enable GKE Sandbox on an existing cluster, a new Node pool must be created.
|
||||
|
||||
gcloud container node-pools create [NODE_POOL_NAME] \
|
||||
--zone=[COMPUTE-ZONE] \
|
||||
--cluster=[CLUSTER_NAME] \
|
||||
--image-type=cos_containerd \
|
||||
--sandbox type=gvisor
|
||||
scored: false
|
||||
|
||||
- id: 6.10.5
|
||||
text: "Ensure use of Binary Authorization (Scored)"
|
||||
type: "manual"
|
||||
remediation: |
|
||||
Using Command Line:
|
||||
Firstly, update the cluster to enable Binary Authorization:
|
||||
|
||||
gcloud container cluster update [CLUSTER_NAME] \
|
||||
--zone [COMPUTE-ZONE] \
|
||||
--enable-binauthz
|
||||
|
||||
Create a Binary Authorization Policy using the Binary Authorization Policy Reference
|
||||
(https://cloud.google.com/binary-authorization/docs/policy-yaml-reference) for
|
||||
guidance.
|
||||
|
||||
Import the policy file into Binary Authorization:
|
||||
|
||||
gcloud container binauthz policy import [YAML_POLICY]
|
||||
scored: true
|
||||
|
||||
- id: 6.10.6
|
||||
text: "Enable Cloud Security Command Center (Cloud SCC) (Not Scored)"
|
||||
type: "manual"
|
||||
remediation: |
|
||||
Using Command Line:
|
||||
Follow the instructions at https://cloud.google.com/security-command-
|
||||
center/docs/quickstart-scc-setup.
|
||||
scored: false
|
||||
348
cfg/gke-1.0/master.yaml
Normal file
348
cfg/gke-1.0/master.yaml
Normal file
@@ -0,0 +1,348 @@
|
||||
---
|
||||
controls:
|
||||
version: "gke-1.0"
|
||||
id: 1
|
||||
text: "Control Plane Components"
|
||||
type: "master"
|
||||
groups:
|
||||
- id: 1.1
|
||||
text: "Master Node Configuration Files "
|
||||
checks:
|
||||
- id: 1.1.1
|
||||
text: "Ensure that the API server pod specification file permissions are set to 644 or more restrictive (Not Scored)"
|
||||
remediation: "This control cannot be modified in GKE."
|
||||
scored: false
|
||||
|
||||
- id: 1.1.2
|
||||
text: "Ensure that the API server pod specification file ownership is set to root:root (Not Scored)"
|
||||
remediation: "This control cannot be modified in GKE."
|
||||
scored: false
|
||||
|
||||
- id: 1.1.3
|
||||
text: "Ensure that the controller manager pod specification file permissions are set to 644 or more restrictive (Not Scored)"
|
||||
remediation: "This control cannot be modified in GKE."
|
||||
scored: false
|
||||
|
||||
- id: 1.1.4
|
||||
text: "Ensure that the controller manager pod specification file ownership is set to root:root (Not Scored)"
|
||||
remediation: "This control cannot be modified in GKE."
|
||||
scored: false
|
||||
|
||||
- id: 1.1.5
|
||||
text: "Ensure that the scheduler pod specification file permissions are set to 644 or more restrictive (Not Scored)"
|
||||
remediation: "This control cannot be modified in GKE."
|
||||
scored: false
|
||||
|
||||
- id: 1.1.6
|
||||
text: "Ensure that the scheduler pod specification file ownership is set to root:root (Not Scored)"
|
||||
remediation: "This control cannot be modified in GKE."
|
||||
scored: false
|
||||
|
||||
- id: 1.1.7
|
||||
text: "Ensure that the etcd pod specification file permissions are set to 644 or more restrictive (Not Scored)"
|
||||
remediation: "This control cannot be modified in GKE."
|
||||
scored: false
|
||||
|
||||
- id: 1.1.8
|
||||
text: "Ensure that the etcd pod specification file ownership is set to root:root (Not Scored)"
|
||||
remediation: "This control cannot be modified in GKE."
|
||||
scored: false
|
||||
|
||||
- id: 1.1.9
|
||||
text: "Ensure that the Container Network Interface file permissions are set to 644 or more restrictive (Not Scored)"
|
||||
remediation: "This control cannot be modified in GKE."
|
||||
scored: false
|
||||
|
||||
- id: 1.1.10
|
||||
text: "Ensure that the Container Network Interface file ownership is set to root:root (Not Scored)"
|
||||
remediation: "This control cannot be modified in GKE."
|
||||
scored: false
|
||||
|
||||
- id: 1.1.11
|
||||
text: "Ensure that the etcd data directory permissions are set to 700 or more restrictive (Not Scored)"
|
||||
remediation: "This control cannot be modified in GKE."
|
||||
scored: false
|
||||
|
||||
- id: 1.1.12
|
||||
text: "Ensure that the etcd data directory ownership is set to etcd:etcd (Not Scored)"
|
||||
remediation: "This control cannot be modified in GKE."
|
||||
scored: false
|
||||
|
||||
- id: 1.1.13
|
||||
text: "Ensure that the admin.conf file permissions are set to 644 or more restrictive (Not Scored)"
|
||||
remediation: "This control cannot be modified in GKE."
|
||||
scored: false
|
||||
|
||||
- id: 1.1.14
|
||||
text: "Ensure that the admin.conf file ownership is set to root:root (Not Scored) "
|
||||
remediation: "This control cannot be modified in GKE."
|
||||
scored: false
|
||||
|
||||
- id: 1.1.15
|
||||
text: "Ensure that the scheduler.conf file permissions are set to 644 or more restrictive (Not Scored)"
|
||||
remediation: "This control cannot be modified in GKE."
|
||||
scored: true
|
||||
|
||||
- id: 1.1.16
|
||||
text: "Ensure that the scheduler.conf file ownership is set to root:root (Not Scored)"
|
||||
remediation: "This control cannot be modified in GKE."
|
||||
scored: false
|
||||
|
||||
- id: 1.1.17
|
||||
text: "Ensure that the controller-manager.conf file permissions are set to 644 or more restrictive (Not Scored)"
|
||||
remediation: "This control cannot be modified in GKE."
|
||||
scored: false
|
||||
|
||||
- id: 1.1.18
|
||||
text: "Ensure that the controller-manager.conf file ownership is set to root:root (Not Scored)"
|
||||
remediation: "This control cannot be modified in GKE."
|
||||
scored: false
|
||||
|
||||
- id: 1.1.19
|
||||
text: "Ensure that the Kubernetes PKI directory and file ownership is set to root:root (Not Scored)"
|
||||
remediation: "This control cannot be modified in GKE."
|
||||
scored: false
|
||||
|
||||
- id: 1.1.20
|
||||
text: "Ensure that the Kubernetes PKI certificate file permissions are set to 644 or more restrictive (Not Scored)"
|
||||
remediation: "This control cannot be modified in GKE."
|
||||
scored: false
|
||||
|
||||
- id: 1.1.21
|
||||
text: "Ensure that the Kubernetes PKI key file permissions are set to 600 (Not Scored)"
|
||||
remediation: "This control cannot be modified in GKE."
|
||||
scored: false
|
||||
|
||||
- id: 1.2
|
||||
text: "API Server"
|
||||
checks:
|
||||
- id: 1.2.1
|
||||
text: "Ensure that the --anonymous-auth argument is set to false (Not Scored)"
|
||||
remediation: "This control cannot be modified in GKE."
|
||||
scored: false
|
||||
|
||||
- id: 1.2.2
|
||||
text: "Ensure that the --basic-auth-file argument is not set (Not Scored)"
|
||||
remediation: |
|
||||
Although the use of the --basic-auth-file argument cannot be audited on GKE, you can
|
||||
remediate the use of basic authentication. See Recommendation 6.8.1.
|
||||
scored: false
|
||||
|
||||
- id: 1.2.3
|
||||
text: "Ensure that the --token-auth-file parameter is not set (Not Scored)"
|
||||
remediation: "This control cannot be modified in GKE."
|
||||
scored: false
|
||||
|
||||
- id: 1.2.4
|
||||
text: "Ensure that the --kubelet-https argument is set to true (Not Scored)"
|
||||
remediation: "This control cannot be modified in GKE."
|
||||
scored: false
|
||||
|
||||
- id: 1.2.5
|
||||
text: "Ensure that the --kubelet-client-certificate and --kubelet-client-key arguments are set as appropriate (Not Scored)"
|
||||
remediation: "This control cannot be modified in GKE."
|
||||
scored: false
|
||||
|
||||
- id: 1.2.6
|
||||
text: "Ensure that the --kubelet-certificate-authority argument is set as appropriate (Not Scored)"
|
||||
remediation: "This control cannot be modified in GKE."
|
||||
scored: false
|
||||
|
||||
- id: 1.2.7
|
||||
text: "Ensure that the --authorization-mode argument is not set to AlwaysAllow (Not Scored)"
|
||||
remediation: "This control cannot be modified in GKE."
|
||||
scored: false
|
||||
|
||||
- id: 1.2.8
|
||||
text: "Ensure that the --authorization-mode argument includes Node (Not Scored)"
|
||||
remediation: "This control cannot be modified in GKE."
|
||||
scored: false
|
||||
|
||||
- id: 1.2.9
|
||||
text: "Ensure that the --authorization-mode argument includes RBAC (Not Scored)"
|
||||
remediation: "This control cannot be modified in GKE."
|
||||
scored: false
|
||||
|
||||
- id: 1.2.10
|
||||
text: "Ensure that the admission control plugin EventRateLimit is set (Not Scored)"
|
||||
remediation: "This control cannot be modified in GKE."
|
||||
scored: false
|
||||
|
||||
- id: 1.2.11
|
||||
text: "Ensure that the admission control plugin AlwaysAdmit is not set (Not Scored)"
|
||||
remediation: "This control cannot be modified in GKE."
|
||||
scored: false
|
||||
|
||||
- id: 1.2.12
|
||||
text: "Ensure that the admission control plugin AlwaysPullImages is set (Not Scored)"
|
||||
remediation: "This control cannot be modified in GKE."
|
||||
scored: false
|
||||
|
||||
- id: 1.2.13
|
||||
text: "Ensure that the admission control plugin SecurityContextDeny is set if PodSecurityPolicy is not used (Not Scored)"
|
||||
remediation: "This control cannot be modified in GKE."
|
||||
scored: false
|
||||
|
||||
- id: 1.2.14
|
||||
text: "Ensure that the admission control plugin ServiceAccount is set (Not Scored)"
|
||||
remediation: "This control cannot be modified in GKE."
|
||||
scored: false
|
||||
|
||||
- id: 1.2.15
|
||||
text: "Ensure that the admission control plugin NamespaceLifecycle is set (Not Scored)"
|
||||
remediation: "This control cannot be modified in GKE."
|
||||
scored: false
|
||||
|
||||
- id: 1.2.16
|
||||
text: "Ensure that the admission control plugin PodSecurityPolicy is set (Not Scored)"
|
||||
remediation: |
|
||||
To verify and remediate the use of Pod Security Policy on GKE, see Recommendation 6.10.3.
|
||||
scored: false
|
||||
|
||||
- id: 1.2.17
|
||||
text: "Ensure that the admission control plugin NodeRestriction is set (Not Scored)"
|
||||
remediation: "This control cannot be modified in GKE."
|
||||
scored: false
|
||||
|
||||
- id: 1.2.18
|
||||
text: "Ensure that the --insecure-bind-address argument is not set (Not Scored)"
|
||||
remediation: "This control cannot be modified in GKE."
|
||||
scored: false
|
||||
|
||||
- id: 1.2.19
|
||||
text: "Ensure that the --insecure-port argument is set to 0 (Not Scored)"
|
||||
remediation: "This control cannot be modified in GKE."
|
||||
scored: false
|
||||
|
||||
- id: 1.2.20
|
||||
text: "Ensure that the --secure-port argument is not set to 0 (Not Scored)"
|
||||
remediation: "This control cannot be modified in GKE."
|
||||
scored: false
|
||||
|
||||
- id: 1.2.21
|
||||
text: "Ensure that the --profiling argument is set to false (Not Scored)"
|
||||
remediation: "This control cannot be modified in GKE."
|
||||
scored: false
|
||||
|
||||
- id: 1.2.22
|
||||
text: "Ensure that the --audit-log-path argument is set (Not Scored)"
|
||||
remediation: "This control cannot be modified in GKE."
|
||||
scored: false
|
||||
|
||||
- id: 1.2.23
|
||||
text: "Ensure that the --audit-log-maxage argument is set to 30 or as appropriate (Not Scored)"
|
||||
remediation: "This control cannot be modified in GKE."
|
||||
scored: false
|
||||
|
||||
- id: 1.2.24
|
||||
text: "Ensure that the --audit-log-maxbackup argument is set to 10 or as appropriate (Not Scored)"
|
||||
remediation: "This control cannot be modified in GKE."
|
||||
scored: false
|
||||
|
||||
- id: 1.2.25
|
||||
text: "Ensure that the --audit-log-maxsize argument is set to 100 or as appropriate (Not Scored)"
|
||||
remediation: "This control cannot be modified in GKE."
|
||||
scored: false
|
||||
|
||||
- id: 1.2.26
|
||||
text: "Ensure that the --request-timeout argument is set as appropriate (Not Scored)"
|
||||
remediation: "This control cannot be modified in GKE."
|
||||
scored: false
|
||||
|
||||
- id: 1.2.27
|
||||
text: "Ensure that the --service-account-lookup argument is set to true (Not Scored)"
|
||||
remediation: "This control cannot be modified in GKE."
|
||||
scored: false
|
||||
|
||||
- id: 1.2.28
|
||||
text: "Ensure that the --service-account-key-file argument is set as appropriate (Not Scored)"
|
||||
remediation: "This control cannot be modified in GKE."
|
||||
scored: false
|
||||
|
||||
- id: 1.2.29
|
||||
text: "Ensure that the --etcd-certfile and --etcd-keyfile arguments are set as appropriate (Not Scored)"
|
||||
remediation: "This control cannot be modified in GKE."
|
||||
scored: false
|
||||
|
||||
- id: 1.2.30
|
||||
text: "Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate (Not Scored)"
|
||||
remediation: "This control cannot be modified in GKE."
|
||||
scored: false
|
||||
|
||||
- id: 1.2.31
|
||||
text: "Ensure that the --client-ca-file argument is set as appropriate (Not Scored)"
|
||||
remediation: "This control cannot be modified in GKE."
|
||||
scored: false
|
||||
|
||||
- id: 1.2.32
|
||||
text: "Ensure that the --etcd-cafile argument is set as appropriate (Not Scored)"
|
||||
remediation: "This control cannot be modified in GKE."
|
||||
scored: false
|
||||
|
||||
- id: 1.2.33
|
||||
text: "Ensure that the --encryption-provider-config argument is set as appropriate (Not Scored)"
|
||||
remediation: |
|
||||
To verify and remediate the use of secret encryption on GKE, see Recommendation 6.3.1.
|
||||
scored: false
|
||||
|
||||
- id: 1.2.34
|
||||
text: "Ensure that encryption providers are appropriately configured (Not Scored)"
|
||||
remediation: |
|
||||
To verify and remediate the use of secret encryption on GKE, see Recommendation 6.3.1.
|
||||
scored: false
|
||||
|
||||
- id: 1.2.35
|
||||
text: "Ensure that the API Server only makes use of Strong Cryptographic Ciphers (Not Scored)"
|
||||
remediation: "This control cannot be modified in GKE."
|
||||
scored: false
|
||||
|
||||
- id: 1.3
|
||||
text: "Controller Manager"
|
||||
checks:
|
||||
- id: 1.3.1
|
||||
text: "Ensure that the --terminated-pod-gc-threshold argument is set as appropriate (Not Scored)"
|
||||
remediation: "This control cannot be modified in GKE."
|
||||
scored: false
|
||||
|
||||
- id: 1.3.2
|
||||
text: "Ensure that the --profiling argument is set to false (Not Scored)"
|
||||
remediation: "This control cannot be modified in GKE."
|
||||
scored: false
|
||||
|
||||
- id: 1.3.3
|
||||
text: "Ensure that the --use-service-account-credentials argument is set to true (Not Scored)"
|
||||
remediation: "This control cannot be modified in GKE."
|
||||
scored: false
|
||||
|
||||
- id: 1.3.4
|
||||
text: "Ensure that the --service-account-private-key-file argument is set as appropriate (Not Scored)"
|
||||
remediation: "This control cannot be modified in GKE."
|
||||
scored: false
|
||||
|
||||
- id: 1.3.5
|
||||
text: "Ensure that the --root-ca-file argument is set as appropriate (Not Scored)"
|
||||
remediation: "This control cannot be modified in GKE."
|
||||
scored: false
|
||||
|
||||
- id: 1.3.6
|
||||
text: "Ensure that the RotateKubeletServerCertificate argument is set to true (Not Scored)"
|
||||
remediation: "This control cannot be modified in GKE."
|
||||
scored: false
|
||||
|
||||
- id: 1.3.7
|
||||
text: "Ensure that the --bind-address argument is set to 127.0.0.1 (Not Scored)"
|
||||
remediation: "This control cannot be modified in GKE."
|
||||
scored: false
|
||||
|
||||
- id: 1.4
|
||||
text: "Scheduler"
|
||||
checks:
|
||||
- id: 1.4.1
|
||||
text: "Ensure that the --profiling argument is set to false (Not Scored)"
|
||||
remediation: "This control cannot be modified in GKE."
|
||||
scored: false
|
||||
|
||||
- id: 1.4.2
|
||||
text: "Ensure that the --bind-address argument is set to 127.0.0.1 (Not Scored) "
|
||||
remediation: "This control cannot be modified in GKE."
|
||||
scored: false
|
||||
449
cfg/gke-1.0/node.yaml
Normal file
449
cfg/gke-1.0/node.yaml
Normal file
@@ -0,0 +1,449 @@
|
||||
---
|
||||
controls:
|
||||
version: "gke-1.0"
|
||||
id: 4
|
||||
text: "Worker Node Security Configuration"
|
||||
type: "node"
|
||||
groups:
|
||||
- id: 4.1
|
||||
text: "Worker Node Configuration Files"
|
||||
checks:
|
||||
- id: 4.1.1
|
||||
text: "Ensure that the kubelet service file permissions are set to 644 or more restrictive (Not Scored)"
|
||||
remediation: "This control cannot be modified in GKE."
|
||||
scored: false
|
||||
|
||||
- id: 4.1.2
|
||||
text: "Ensure that the kubelet service file ownership is set to root:root (Not Scored)"
|
||||
remediation: "This control cannot be modified in GKE."
|
||||
scored: false
|
||||
|
||||
- id: 4.1.3
|
||||
text: "Ensure that the proxy kubeconfig file permissions are set to 644 or more restrictive (Scored)"
|
||||
audit: '/bin/sh -c ''if test -e $proxykubeconfig; then stat -c %a $proxykubeconfig; fi'' '
|
||||
tests:
|
||||
test_items:
|
||||
- flag: "644"
|
||||
compare:
|
||||
op: eq
|
||||
value: "644"
|
||||
set: true
|
||||
- flag: "640"
|
||||
compare:
|
||||
op: eq
|
||||
value: "640"
|
||||
set: true
|
||||
- flag: "600"
|
||||
compare:
|
||||
op: eq
|
||||
value: "600"
|
||||
set: true
|
||||
- flag: "444"
|
||||
compare:
|
||||
op: eq
|
||||
value: "444"
|
||||
set: true
|
||||
- flag: "440"
|
||||
compare:
|
||||
op: eq
|
||||
value: "440"
|
||||
set: true
|
||||
- flag: "400"
|
||||
compare:
|
||||
op: eq
|
||||
value: "400"
|
||||
set: true
|
||||
- flag: "000"
|
||||
compare:
|
||||
op: eq
|
||||
value: "000"
|
||||
set: true
|
||||
bin_op: or
|
||||
remediation: |
|
||||
Run the below command (based on the file location on your system) on each worker node.
|
||||
For example,
|
||||
chmod 644 $proykubeconfig
|
||||
scored: true
|
||||
|
||||
- id: 4.1.4
|
||||
text: "Ensure that the proxy kubeconfig file ownership is set to root:root (Scored)"
|
||||
audit: '/bin/sh -c ''if test -e $proxykubeconfig; then stat -c %U:%G $proxykubeconfig; fi'' '
|
||||
tests:
|
||||
test_items:
|
||||
- flag: root:root
|
||||
set: true
|
||||
remediation: |
|
||||
Run the below command (based on the file location on your system) on each worker node.
|
||||
For example, chown root:root $proxykubeconfig
|
||||
scored: true
|
||||
|
||||
- id: 4.1.5
|
||||
text: "Ensure that the kubelet.conf file permissions are set to 644 or more restrictive (Not Scored)"
|
||||
remediation: "This control cannot be modified in GKE."
|
||||
scored: false
|
||||
|
||||
- id: 4.1.6
|
||||
text: "Ensure that the kubelet.conf file ownership is set to root:root (Not Scored)"
|
||||
remediation: "This control cannot be modified in GKE."
|
||||
scored: false
|
||||
|
||||
- id: 4.1.7
|
||||
text: "Ensure that the certificate authorities file permissions are set to 644 or more restrictive (Not Scored)"
|
||||
remediation: "This control cannot be modified in GKE."
|
||||
scored: false
|
||||
|
||||
- id: 4.1.8
|
||||
text: "Ensure that the client certificate authorities file ownership is set to root:root (Not Scored)"
|
||||
remediation: "This control cannot be modified in GKE."
|
||||
scored: false
|
||||
|
||||
- id: 4.1.9
|
||||
text: "Ensure that the kubelet configuration file has permissions set to 644 or more restrictive (Scored)"
|
||||
audit: '/bin/sh -c ''if test -e $kubeletconf; then stat -c %a $kubeletconf; fi'' '
|
||||
tests:
|
||||
test_items:
|
||||
- flag: "644"
|
||||
set: true
|
||||
compare:
|
||||
op: eq
|
||||
value: "644"
|
||||
- flag: "640"
|
||||
set: true
|
||||
compare:
|
||||
op: eq
|
||||
value: "640"
|
||||
- flag: "600"
|
||||
set: true
|
||||
compare:
|
||||
op: eq
|
||||
value: "600"
|
||||
- flag: "444"
|
||||
compare:
|
||||
op: eq
|
||||
value: "444"
|
||||
set: true
|
||||
- flag: "440"
|
||||
compare:
|
||||
op: eq
|
||||
value: "440"
|
||||
set: true
|
||||
- flag: "400"
|
||||
compare:
|
||||
op: eq
|
||||
value: "400"
|
||||
set: true
|
||||
- flag: "000"
|
||||
compare:
|
||||
op: eq
|
||||
value: "000"
|
||||
set: true
|
||||
bin_op: or
|
||||
remediation: |
|
||||
Run the following command (using the config file location identied in the Audit step)
|
||||
chmod 644 $kubeletconf
|
||||
scored: true
|
||||
|
||||
- id: 4.1.10
|
||||
text: "Ensure that the kubelet configuration file ownership is set to root:root (Scored)"
|
||||
audit: '/bin/sh -c ''if test -e $kubeletconf; then stat -c %U:%G $kubeletconf; fi'' '
|
||||
tests:
|
||||
test_items:
|
||||
- flag: root:root
|
||||
set: true
|
||||
remediation: |
|
||||
Run the following command (using the config file location identied in the Audit step)
|
||||
chown root:root $kubeletconf
|
||||
scored: true
|
||||
|
||||
- id: 4.2
|
||||
text: "Kubelet"
|
||||
checks:
|
||||
- id: 4.2.1
|
||||
text: "Ensure that the --anonymous-auth argument is set to false (Scored)"
|
||||
audit: "/bin/ps -fC $kubeletbin"
|
||||
audit_config: "/bin/cat $kubeletconf"
|
||||
tests:
|
||||
test_items:
|
||||
- flag: "--anonymous-auth"
|
||||
path: '{.authentication.anonymous.enabled}'
|
||||
set: true
|
||||
compare:
|
||||
op: eq
|
||||
value: false
|
||||
remediation: |
|
||||
If using a Kubelet config file, edit the file to set authentication: anonymous: enabled to
|
||||
false.
|
||||
If using executable arguments, edit the kubelet service file
|
||||
$kubeletsvc on each worker node and
|
||||
set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable.
|
||||
--anonymous-auth=false
|
||||
Based on your system, restart the kubelet service. For example:
|
||||
systemctl daemon-reload
|
||||
systemctl restart kubelet.service
|
||||
scored: true
|
||||
|
||||
- id: 4.2.2
|
||||
text: "Ensure that the --authorization-mode argument is not set to AlwaysAllow (Scored)"
|
||||
audit: "/bin/ps -fC $kubeletbin"
|
||||
audit_config: "/bin/cat $kubeletconf"
|
||||
tests:
|
||||
test_items:
|
||||
- flag: --authorization-mode
|
||||
path: '{.authorization.mode}'
|
||||
set: true
|
||||
compare:
|
||||
op: nothave
|
||||
value: AlwaysAllow
|
||||
remediation: |
|
||||
If using a Kubelet config file, edit the file to set authorization: mode to Webhook. If
|
||||
using executable arguments, edit the kubelet service file
|
||||
$kubeletsvc on each worker node and
|
||||
set the below parameter in KUBELET_AUTHZ_ARGS variable.
|
||||
--authorization-mode=Webhook
|
||||
Based on your system, restart the kubelet service. For example:
|
||||
systemctl daemon-reload
|
||||
systemctl restart kubelet.service
|
||||
scored: true
|
||||
|
||||
- id: 4.2.3
|
||||
text: "Ensure that the --client-ca-file argument is set as appropriate (Scored)"
|
||||
audit: "/bin/ps -fC $kubeletbin"
|
||||
audit_config: "/bin/cat $kubeletconf"
|
||||
tests:
|
||||
test_items:
|
||||
- flag: --client-ca-file
|
||||
path: '{.authentication.x509.clientCAFile}'
|
||||
set: true
|
||||
remediation: |
|
||||
If using a Kubelet config file, edit the file to set authentication: x509: clientCAFile to
|
||||
the location of the client CA file.
|
||||
If using command line arguments, edit the kubelet service file
|
||||
$kubeletsvc on each worker node and
|
||||
set the below parameter in KUBELET_AUTHZ_ARGS variable.
|
||||
--client-ca-file=<path/to/client-ca-file>
|
||||
Based on your system, restart the kubelet service. For example:
|
||||
systemctl daemon-reload
|
||||
systemctl restart kubelet.service
|
||||
scored: true
|
||||
|
||||
- id: 4.2.4
|
||||
text: "Ensure that the --read-only-port argument is set to 0 (Scored)"
|
||||
audit: "/bin/ps -fC $kubeletbin"
|
||||
audit_config: "/bin/cat $kubeletconf"
|
||||
tests:
|
||||
test_items:
|
||||
- flag: "--read-only-port"
|
||||
path: '{.readOnlyPort}'
|
||||
set: true
|
||||
compare:
|
||||
op: eq
|
||||
value: 0
|
||||
remediation: |
|
||||
If using a Kubelet config file, edit the file to set readOnlyPort to 0.
|
||||
If using command line arguments, edit the kubelet service file
|
||||
$kubeletsvc on each worker node and
|
||||
set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable.
|
||||
--read-only-port=0
|
||||
Based on your system, restart the kubelet service. For example:
|
||||
systemctl daemon-reload
|
||||
systemctl restart kubelet.service
|
||||
scored: true
|
||||
|
||||
- id: 4.2.5
|
||||
text: "Ensure that the --streaming-connection-idle-timeout argument is not set to 0 (Scored)"
|
||||
audit: "/bin/ps -fC $kubeletbin"
|
||||
audit_config: "/bin/cat $kubeletconf"
|
||||
tests:
|
||||
test_items:
|
||||
- flag: --streaming-connection-idle-timeout
|
||||
path: '{.streamingConnectionIdleTimeout}'
|
||||
set: true
|
||||
compare:
|
||||
op: noteq
|
||||
value: 0
|
||||
- flag: --streaming-connection-idle-timeout
|
||||
path: '{.streamingConnectionIdleTimeout}'
|
||||
set: false
|
||||
bin_op: or
|
||||
remediation: |
|
||||
If using a Kubelet config file, edit the file to set streamingConnectionIdleTimeout to a
|
||||
value other than 0.
|
||||
If using command line arguments, edit the kubelet service file
|
||||
$kubeletsvc on each worker node and
|
||||
set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable.
|
||||
--streaming-connection-idle-timeout=5m
|
||||
Based on your system, restart the kubelet service. For example:
|
||||
systemctl daemon-reload
|
||||
systemctl restart kubelet.service
|
||||
scored: true
|
||||
|
||||
- id: 4.2.6
|
||||
text: "Ensure that the --protect-kernel-defaults argument is set to true (Scored)"
|
||||
audit: "/bin/ps -fC $kubeletbin"
|
||||
audit_config: "/bin/cat $kubeletconf"
|
||||
tests:
|
||||
test_items:
|
||||
- flag: --protect-kernel-defaults
|
||||
path: '{.protectKernelDefaults}'
|
||||
set: true
|
||||
compare:
|
||||
op: eq
|
||||
value: true
|
||||
remediation: |
|
||||
If using a Kubelet config file, edit the file to set protectKernelDefaults: true.
|
||||
If using command line arguments, edit the kubelet service file
|
||||
$kubeletsvc on each worker node and
|
||||
set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable.
|
||||
--protect-kernel-defaults=true
|
||||
Based on your system, restart the kubelet service. For example:
|
||||
systemctl daemon-reload
|
||||
systemctl restart kubelet.service
|
||||
scored: true
|
||||
|
||||
- id: 4.2.7
|
||||
text: "Ensure that the --make-iptables-util-chains argument is set to true (Scored) "
|
||||
audit: "/bin/ps -fC $kubeletbin"
|
||||
audit_config: "/bin/cat $kubeletconf"
|
||||
tests:
|
||||
test_items:
|
||||
- flag: --make-iptables-util-chains
|
||||
path: '{.makeIPTablesUtilChains}'
|
||||
set: true
|
||||
compare:
|
||||
op: eq
|
||||
value: true
|
||||
- flag: --make-iptables-util-chains
|
||||
path: '{.makeIPTablesUtilChains}'
|
||||
set: false
|
||||
bin_op: or
|
||||
remediation: |
|
||||
If using a Kubelet config file, edit the file to set makeIPTablesUtilChains: true.
|
||||
If using command line arguments, edit the kubelet service file
|
||||
$kubeletsvc on each worker node and
|
||||
remove the --make-iptables-util-chains argument from the
|
||||
KUBELET_SYSTEM_PODS_ARGS variable.
|
||||
Based on your system, restart the kubelet service. For example:
|
||||
systemctl daemon-reload
|
||||
systemctl restart kubelet.service
|
||||
scored: true
|
||||
|
||||
- id: 4.2.8
|
||||
text: "Ensure that the --hostname-override argument is not set (Scored)"
|
||||
# This is one of those properties that can only be set as a command line argument.
|
||||
# To check if the property is set as expected, we need to parse the kubelet command
|
||||
# instead reading the Kubelet Configuration file.
|
||||
audit: "/bin/ps -fC $kubeletbin "
|
||||
tests:
|
||||
test_items:
|
||||
- flag: --hostname-override
|
||||
set: false
|
||||
remediation: |
|
||||
Edit the kubelet service file $kubeletsvc
|
||||
on each worker node and remove the --hostname-override argument from the
|
||||
KUBELET_SYSTEM_PODS_ARGS variable.
|
||||
Based on your system, restart the kubelet service. For example:
|
||||
systemctl daemon-reload
|
||||
systemctl restart kubelet.service
|
||||
scored: true
|
||||
|
||||
- id: 4.2.9
|
||||
text: "Ensure that the --event-qps argument is set to 0 or a level which ensures appropriate event capture (Scored)"
|
||||
audit: "/bin/ps -fC $kubeletbin"
|
||||
audit_config: "/bin/cat $kubeletconf"
|
||||
tests:
|
||||
test_items:
|
||||
- flag: --event-qps
|
||||
path: '{.eventRecordQPS}'
|
||||
set: true
|
||||
compare:
|
||||
op: eq
|
||||
value: 0
|
||||
remediation: |
|
||||
If using a Kubelet config file, edit the file to set eventRecordQPS: to an appropriate level.
|
||||
If using command line arguments, edit the kubelet service file
|
||||
$kubeletsvc on each worker node and
|
||||
set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable.
|
||||
Based on your system, restart the kubelet service. For example:
|
||||
systemctl daemon-reload
|
||||
systemctl restart kubelet.service
|
||||
scored: true
|
||||
|
||||
- id: 4.2.10
|
||||
text: "Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate (Scored)"
|
||||
audit: "/bin/ps -fC $kubeletbin"
|
||||
audit_config: "/bin/cat $kubeletconf"
|
||||
tests:
|
||||
test_items:
|
||||
- flag: --tls-cert-file
|
||||
path: '{.tlsCertFile}'
|
||||
set: true
|
||||
- flag: --tls-private-key-file
|
||||
path: '{.tlsPrivateKeyFile}'
|
||||
set: true
|
||||
remediation: |
|
||||
If using a Kubelet config file, edit the file to set tlsCertFile to the location
|
||||
of the certificate file to use to identify this Kubelet, and tlsPrivateKeyFile
|
||||
to the location of the corresponding private key file.
|
||||
If using command line arguments, edit the kubelet service file
|
||||
$kubeletsvc on each worker node and
|
||||
set the below parameters in KUBELET_CERTIFICATE_ARGS variable.
|
||||
--tls-cert-file=<path/to/tls-certificate-file>
|
||||
--tls-private-key-file=<path/to/tls-key-file>
|
||||
Based on your system, restart the kubelet service. For example:
|
||||
systemctl daemon-reload
|
||||
systemctl restart kubelet.service
|
||||
scored: true
|
||||
|
||||
- id: 4.2.11
|
||||
text: "Ensure that the --rotate-certificates argument is not set to false (Scored)"
|
||||
audit: "/bin/ps -fC $kubeletbin"
|
||||
audit_config: "/bin/cat $kubeletconf"
|
||||
tests:
|
||||
test_items:
|
||||
- flag: --rotate-certificates
|
||||
path: '{.rotateCertificates}'
|
||||
set: true
|
||||
compare:
|
||||
op: eq
|
||||
value: true
|
||||
- flag: --rotate-certificates
|
||||
path: '{.rotateCertificates}'
|
||||
set: false
|
||||
bin_op: or
|
||||
remediation: |
|
||||
If using a Kubelet config file, edit the file to add the line rotateCertificates: true or
|
||||
remove it altogether to use the default value.
|
||||
If using command line arguments, edit the kubelet service file
|
||||
$kubeletsvc on each worker node and
|
||||
remove --rotate-certificates=false argument from the KUBELET_CERTIFICATE_ARGS
|
||||
variable.
|
||||
Based on your system, restart the kubelet service. For example:
|
||||
systemctl daemon-reload
|
||||
systemctl restart kubelet.service
|
||||
scored: true
|
||||
|
||||
- id: 4.2.12
|
||||
text: "Ensure that the RotateKubeletServerCertificate argument is set to true (Scored)"
|
||||
audit: "/bin/ps -fC $kubeletbin"
|
||||
audit_config: "/bin/cat $kubeletconf"
|
||||
tests:
|
||||
test_items:
|
||||
- flag: RotateKubeletServerCertificate
|
||||
path: '{.featureGates.RotateKubeletServerCertificate}'
|
||||
set: true
|
||||
compare:
|
||||
op: eq
|
||||
value: true
|
||||
remediation: |
|
||||
Edit the kubelet service file $kubeletsvc
|
||||
on each worker node and set the below parameter in KUBELET_CERTIFICATE_ARGS variable.
|
||||
--feature-gates=RotateKubeletServerCertificate=true
|
||||
Based on your system, restart the kubelet service. For example:
|
||||
systemctl daemon-reload
|
||||
systemctl restart kubelet.service
|
||||
scored: true
|
||||
|
||||
- id: 4.2.13
|
||||
text: "Ensure that the Kubelet only makes use of Strong Cryptographic Ciphers (Not Scored)"
|
||||
remediation: "This control cannot be modified in GKE."
|
||||
scored: false
|
||||
239
cfg/gke-1.0/policies.yaml
Normal file
239
cfg/gke-1.0/policies.yaml
Normal file
@@ -0,0 +1,239 @@
|
||||
---
|
||||
controls:
|
||||
version: "gke-1.0"
|
||||
id: 5
|
||||
text: "Kubernetes Policies"
|
||||
type: "policies"
|
||||
groups:
|
||||
- id: 5.1
|
||||
text: "RBAC and Service Accounts"
|
||||
checks:
|
||||
- id: 5.1.1
|
||||
text: "Ensure that the cluster-admin role is only used where required (Not Scored)"
|
||||
type: "manual"
|
||||
remediation: |
|
||||
Identify all clusterrolebindings to the cluster-admin role. Check if they are used and
|
||||
if they need this role or if they could use a role with fewer privileges.
|
||||
Where possible, first bind users to a lower privileged role and then remove the
|
||||
clusterrolebinding to the cluster-admin role :
|
||||
kubectl delete clusterrolebinding [name]
|
||||
scored: false
|
||||
|
||||
- id: 5.1.2
|
||||
text: "Minimize access to secrets (Not Scored)"
|
||||
type: "manual"
|
||||
remediation: |
|
||||
Where possible, remove get, list and watch access to secret objects in the cluster.
|
||||
scored: false
|
||||
|
||||
- id: 5.1.3
|
||||
text: "Minimize wildcard use in Roles and ClusterRoles (Not Scored)"
|
||||
type: "manual"
|
||||
remediation: |
|
||||
Where possible replace any use of wildcards in clusterroles and roles with specific
|
||||
objects or actions.
|
||||
scored: false
|
||||
|
||||
- id: 5.1.4
|
||||
text: "Minimize access to create pods (Not Scored)"
|
||||
type: "manual"
|
||||
Remediation: |
|
||||
Where possible, remove create access to pod objects in the cluster.
|
||||
scored: false
|
||||
|
||||
- id: 5.1.5
|
||||
text: "Ensure that default service accounts are not actively used. (Scored)"
|
||||
type: "manual"
|
||||
remediation: |
|
||||
Create explicit service accounts wherever a Kubernetes workload requires specific access
|
||||
to the Kubernetes API server.
|
||||
Modify the configuration of each default service account to include this value
|
||||
automountServiceAccountToken: false
|
||||
scored: true
|
||||
|
||||
- id: 5.1.6
|
||||
text: "Ensure that Service Account Tokens are only mounted where necessary (Not Scored)"
|
||||
type: "manual"
|
||||
remediation: |
|
||||
Modify the definition of pods and service accounts which do not need to mount service
|
||||
account tokens to disable it.
|
||||
scored: false
|
||||
|
||||
- id: 5.2
|
||||
text: "Pod Security Policies"
|
||||
checks:
|
||||
- id: 5.2.1
|
||||
text: "Minimize the admission of privileged containers (Not Scored)"
|
||||
type: "manual"
|
||||
remediation: |
|
||||
Create a PSP as described in the Kubernetes documentation, ensuring that
|
||||
the .spec.privileged field is omitted or set to false.
|
||||
scored: false
|
||||
|
||||
- id: 5.2.2
|
||||
text: "Minimize the admission of containers wishing to share the host process ID namespace (Scored)"
|
||||
type: "manual"
|
||||
remediation: |
|
||||
Create a PSP as described in the Kubernetes documentation, ensuring that the
|
||||
.spec.hostPID field is omitted or set to false.
|
||||
scored: true
|
||||
|
||||
- id: 5.2.3
|
||||
text: "Minimize the admission of containers wishing to share the host IPC namespace (Scored)"
|
||||
type: "manual"
|
||||
remediation: |
|
||||
Create a PSP as described in the Kubernetes documentation, ensuring that the
|
||||
.spec.hostIPC field is omitted or set to false.
|
||||
scored: true
|
||||
|
||||
- id: 5.2.4
|
||||
text: "Minimize the admission of containers wishing to share the host network namespace (Scored)"
|
||||
type: "manual"
|
||||
remediation: |
|
||||
Create a PSP as described in the Kubernetes documentation, ensuring that the
|
||||
.spec.hostNetwork field is omitted or set to false.
|
||||
scored: true
|
||||
|
||||
- id: 5.2.5
|
||||
text: "Minimize the admission of containers with allowPrivilegeEscalation (Scored)"
|
||||
type: "manual"
|
||||
remediation: |
|
||||
Create a PSP as described in the Kubernetes documentation, ensuring that the
|
||||
.spec.allowPrivilegeEscalation field is omitted or set to false.
|
||||
scored: true
|
||||
|
||||
- id: 5.2.6
|
||||
text: "Minimize the admission of root containers (Scored)"
|
||||
type: "manual"
|
||||
remediation: |
|
||||
Create a PSP as described in the Kubernetes documentation, ensuring that the
|
||||
.spec.runAsUser.rule is set to either MustRunAsNonRoot or MustRunAs with the range of
|
||||
UIDs not including 0.
|
||||
scored: true
|
||||
|
||||
- id: 5.2.7
|
||||
text: "Minimize the admission of containers with the NET_RAW capability (Scored)"
|
||||
type: "manual"
|
||||
remediation: |
|
||||
Create a PSP as described in the Kubernetes documentation, ensuring that the
|
||||
.spec.requiredDropCapabilities is set to include either NET_RAW or ALL.
|
||||
scored: true
|
||||
|
||||
- id: 5.2.8
|
||||
text: "Minimize the admission of containers with added capabilities (Scored)"
|
||||
type: "manual"
|
||||
remediation: |
|
||||
Ensure that allowedCapabilities is not present in PSPs for the cluster unless
|
||||
it is set to an empty array.
|
||||
scored: true
|
||||
|
||||
- id: 5.2.9
|
||||
text: "Minimize the admission of containers with capabilities assigned (Scored) "
|
||||
type: "manual"
|
||||
remediation: |
|
||||
Review the use of capabilites in applications runnning on your cluster. Where a namespace
|
||||
contains applicaions which do not require any Linux capabities to operate consider adding
|
||||
a PSP which forbids the admission of containers which do not drop all capabilities.
|
||||
scored: true
|
||||
|
||||
- id: 5.3
|
||||
text: "Network Policies and CNI"
|
||||
checks:
|
||||
- id: 5.3.1
|
||||
text: "Ensure that the CNI in use supports Network Policies (Not Scored)"
|
||||
type: "manual"
|
||||
remediation: |
|
||||
To use a CNI plugin with Network Policy, enable Network Policy in GKE, and the CNI plugin
|
||||
will be updated. See Recommendation 6.6.7.
|
||||
scored: false
|
||||
|
||||
- id: 5.3.2
|
||||
text: "Ensure that all Namespaces have Network Policies defined (Scored)"
|
||||
type: "manual"
|
||||
remediation: |
|
||||
Follow the documentation and create NetworkPolicy objects as you need them.
|
||||
scored: true
|
||||
|
||||
- id: 5.4
|
||||
text: "Secrets Management"
|
||||
checks:
|
||||
- id: 5.4.1
|
||||
text: "Prefer using secrets as files over secrets as environment variables (Not Scored)"
|
||||
type: "manual"
|
||||
remediation: |
|
||||
if possible, rewrite application code to read secrets from mounted secret files, rather than
|
||||
from environment variables.
|
||||
scored: false
|
||||
|
||||
- id: 5.4.2
|
||||
text: "Consider external secret storage (Not Scored)"
|
||||
type: "manual"
|
||||
remediation: |
|
||||
Refer to the secrets management options offered by your cloud provider or a third-party
|
||||
secrets management solution.
|
||||
scored: false
|
||||
|
||||
- id: 5.5
|
||||
text: "Extensible Admission Control"
|
||||
checks:
|
||||
- id: 5.5.1
|
||||
text: "Configure Image Provenance using ImagePolicyWebhook admission controller (Not Scored)"
|
||||
type: "manual"
|
||||
remediation: |
|
||||
Follow the Kubernetes documentation and setup image provenance.
|
||||
See also Recommendation 6.10.5 for GKE specifically.
|
||||
scored: false
|
||||
|
||||
- id: 5.6
|
||||
text: "General Policies"
|
||||
checks:
|
||||
- id: 5.6.1
|
||||
text: "Create administrative boundaries between resources using namespaces (Not Scored)"
|
||||
type: "manual"
|
||||
remediation: |
|
||||
Follow the documentation and create namespaces for objects in your deployment as you need
|
||||
them.
|
||||
scored: false
|
||||
|
||||
- id: 5.6.2
|
||||
text: "Ensure that the seccomp profile is set to docker/default in your pod definitions (Not Scored)"
|
||||
type: "manual"
|
||||
remediation: |
|
||||
Seccomp is an alpha feature currently. By default, all alpha features are disabled. So, you
|
||||
would need to enable alpha features in the apiserver by passing "--feature-
|
||||
gates=AllAlpha=true" argument.
|
||||
Edit the /etc/kubernetes/apiserver file on the master node and set the KUBE_API_ARGS
|
||||
parameter to "--feature-gates=AllAlpha=true"
|
||||
KUBE_API_ARGS="--feature-gates=AllAlpha=true"
|
||||
Based on your system, restart the kube-apiserver service. For example:
|
||||
systemctl restart kube-apiserver.service
|
||||
Use annotations to enable the docker/default seccomp profile in your pod definitions. An
|
||||
example is as below:
|
||||
apiVersion: v1
|
||||
kind: Pod
|
||||
metadata:
|
||||
name: trustworthy-pod
|
||||
annotations:
|
||||
seccomp.security.alpha.kubernetes.io/pod: docker/default
|
||||
spec:
|
||||
containers:
|
||||
- name: trustworthy-container
|
||||
image: sotrustworthy:latest
|
||||
scored: false
|
||||
|
||||
- id: 5.6.3
|
||||
text: "Apply Security Context to Your Pods and Containers (Not Scored)"
|
||||
type: "manual"
|
||||
remediation: |
|
||||
Follow the Kubernetes documentation and apply security contexts to your pods. For a
|
||||
suggested list of security contexts, you may refer to the CIS Security Benchmark for Docker
|
||||
Containers.
|
||||
scored: false
|
||||
|
||||
- id: 5.6.4
|
||||
text: "The default namespace should not be used (Scored)"
|
||||
type: "manual"
|
||||
remediation: |
|
||||
Ensure that namespaces are created to allow for appropriate segregation of Kubernetes
|
||||
resources and that all new resources are created in a specific namespace.
|
||||
scored: true
|
||||
@@ -29,8 +29,10 @@ node:
|
||||
- "/etc/kubernetes/kubelet-kubeconfig"
|
||||
confs:
|
||||
- "/var/lib/kubelet/config.yaml"
|
||||
- "/var/lib/kubelet/config.yml"
|
||||
- "/etc/kubernetes/kubelet/kubelet-config.json"
|
||||
- "/home/kubernetes/kubelet-config.yaml"
|
||||
- "/home/kubernetes/kubelet-config.yml"
|
||||
- "/etc/default/kubelet"
|
||||
## Due to the fact that the kubelet might be configured
|
||||
## without a kubelet-config file, we use a work-around
|
||||
|
||||
@@ -815,12 +815,12 @@ groups:
|
||||
checks:
|
||||
- id: 4.1
|
||||
text: "Verify the OpenShift default permissions for the API server pod specification file"
|
||||
audit: "stat -c %a /etc/origin/node/pods/apiserver.yaml"
|
||||
audit: "stat -c permissions=%a /etc/origin/node/pods/apiserver.yaml"
|
||||
tests:
|
||||
test_items:
|
||||
- flag: "600"
|
||||
- flag: "permissions"
|
||||
compare:
|
||||
op: eq
|
||||
op: bitmask
|
||||
value: "600"
|
||||
set: true
|
||||
remediation: |
|
||||
@@ -847,12 +847,12 @@ groups:
|
||||
|
||||
- id: 4.3
|
||||
text: "Verify the OpenShift default file permissions for the controller manager pod specification file"
|
||||
audit: "stat -c %a /etc/origin/node/pods/controller.yaml"
|
||||
audit: "stat -c permissions=%a /etc/origin/node/pods/controller.yaml"
|
||||
tests:
|
||||
test_items:
|
||||
- flag: "600"
|
||||
- flag: "permissions"
|
||||
compare:
|
||||
op: eq
|
||||
op: bitmask
|
||||
value: "600"
|
||||
set: true
|
||||
remediation: |
|
||||
@@ -879,18 +879,18 @@ groups:
|
||||
|
||||
- id: 4.5
|
||||
text: "Verify the OpenShift default permissions for the scheduler pod specification file"
|
||||
audit: "stat -c %a /etc/origin/node/pods/controller.yaml"
|
||||
audit: "stat -c permissions=%a /etc/origin/node/pods/controller.yaml"
|
||||
tests:
|
||||
test_items:
|
||||
- flag: "600"
|
||||
- flag: "permissions"
|
||||
compare:
|
||||
op: eq
|
||||
op: bitmask
|
||||
value: "600"
|
||||
set: true
|
||||
remediation: |
|
||||
Run the below command.
|
||||
|
||||
chmod 600 stat -c %a /etc/origin/node/pods/controller.yaml
|
||||
chmod 600 stat -c permissions=%a /etc/origin/node/pods/controller.yaml
|
||||
scored: true
|
||||
|
||||
- id: 4.6
|
||||
@@ -911,12 +911,12 @@ groups:
|
||||
|
||||
- id: 4.7
|
||||
text: "Verify the OpenShift default etcd pod specification file permissions"
|
||||
audit: "stat -c %a /etc/origin/node/pods/etcd.yaml"
|
||||
audit: "stat -c permissions=%a /etc/origin/node/pods/etcd.yaml"
|
||||
tests:
|
||||
test_items:
|
||||
- flag: "600"
|
||||
- flag: "permissions"
|
||||
compare:
|
||||
op: eq
|
||||
op: bitmask
|
||||
value: "600"
|
||||
set: true
|
||||
remediation: |
|
||||
@@ -943,45 +943,14 @@ groups:
|
||||
|
||||
- id: 4.9
|
||||
text: "Verify the default OpenShift Container Network Interface file permissions"
|
||||
audit: "stat -c %a /etc/origin/openvswitch/ /etc/cni/net.d/"
|
||||
audit: "stat -c permissions=%a /etc/origin/openvswitch/ /etc/cni/net.d/"
|
||||
tests:
|
||||
bin_op: or
|
||||
test_items:
|
||||
- flag: "644"
|
||||
- flag: "permissions"
|
||||
compare:
|
||||
op: eq
|
||||
op: bitmask
|
||||
value: "644"
|
||||
set: true
|
||||
- flag: "640"
|
||||
compare:
|
||||
op: eq
|
||||
value: "640"
|
||||
set: true
|
||||
- flag: "600"
|
||||
compare:
|
||||
op: eq
|
||||
value: "600"
|
||||
set: true
|
||||
- flag: "444"
|
||||
compare:
|
||||
op: eq
|
||||
value: "444"
|
||||
set: true
|
||||
- flag: "440"
|
||||
compare:
|
||||
op: eq
|
||||
value: "440"
|
||||
set: true
|
||||
- flag: "400"
|
||||
compare:
|
||||
op: eq
|
||||
value: "400"
|
||||
set: true
|
||||
- flag: "000"
|
||||
compare:
|
||||
op: eq
|
||||
value: "000"
|
||||
set: true
|
||||
remediation: |
|
||||
Run the below command.
|
||||
|
||||
@@ -1006,12 +975,12 @@ groups:
|
||||
|
||||
- id: 4.11
|
||||
text: "Verify the default OpenShift etcd data directory permissions"
|
||||
audit: "stat -c %a /var/lib/etcd"
|
||||
audit: "stat -c permissions=%a /var/lib/etcd"
|
||||
tests:
|
||||
test_items:
|
||||
- flag: "700"
|
||||
- flag: "permissions"
|
||||
compare:
|
||||
op: eq
|
||||
op: bitmask
|
||||
value: "700"
|
||||
set: true
|
||||
remediation: |
|
||||
@@ -1040,45 +1009,14 @@ groups:
|
||||
|
||||
- id: 4.13
|
||||
text: "Verify the default OpenShift admin.conf file permissions"
|
||||
audit: "stat -c %a /etc/origin/master/admin.kubeconfig"
|
||||
audit: "stat -c permissions=%a /etc/origin/master/admin.kubeconfig"
|
||||
tests:
|
||||
bin_op: or
|
||||
test_items:
|
||||
- flag: "644"
|
||||
- flag: "permissions"
|
||||
compare:
|
||||
op: eq
|
||||
op: bitmask
|
||||
value: "644"
|
||||
set: true
|
||||
- flag: "640"
|
||||
compare:
|
||||
op: eq
|
||||
value: "640"
|
||||
set: true
|
||||
- flag: "600"
|
||||
compare:
|
||||
op: eq
|
||||
value: "600"
|
||||
set: true
|
||||
- flag: "444"
|
||||
compare:
|
||||
op: eq
|
||||
value: "444"
|
||||
set: true
|
||||
- flag: "440"
|
||||
compare:
|
||||
op: eq
|
||||
value: "440"
|
||||
set: true
|
||||
- flag: "400"
|
||||
compare:
|
||||
op: eq
|
||||
value: "400"
|
||||
set: true
|
||||
- flag: "000"
|
||||
compare:
|
||||
op: eq
|
||||
value: "000"
|
||||
set: true
|
||||
remediation: |
|
||||
Run the below command.
|
||||
|
||||
@@ -1103,45 +1041,14 @@ groups:
|
||||
|
||||
- id: 4.15
|
||||
text: "Verify the default OpenShift scheduler.conf file permissions"
|
||||
audit: "stat -c %a /etc/origin/master/openshift-master.kubeconfig"
|
||||
audit: "stat -c permissions=%a /etc/origin/master/openshift-master.kubeconfig"
|
||||
tests:
|
||||
bin_op: or
|
||||
test_items:
|
||||
- flag: "644"
|
||||
- flag: "permissions"
|
||||
compare:
|
||||
op: eq
|
||||
op: bitmask
|
||||
value: "644"
|
||||
set: true
|
||||
- flag: "640"
|
||||
compare:
|
||||
op: eq
|
||||
value: "640"
|
||||
set: true
|
||||
- flag: "600"
|
||||
compare:
|
||||
op: eq
|
||||
value: "600"
|
||||
set: true
|
||||
- flag: "444"
|
||||
compare:
|
||||
op: eq
|
||||
value: "444"
|
||||
set: true
|
||||
- flag: "440"
|
||||
compare:
|
||||
op: eq
|
||||
value: "440"
|
||||
set: true
|
||||
- flag: "400"
|
||||
compare:
|
||||
op: eq
|
||||
value: "400"
|
||||
set: true
|
||||
- flag: "000"
|
||||
compare:
|
||||
op: eq
|
||||
value: "000"
|
||||
set: true
|
||||
remediation: |
|
||||
Run the below command.
|
||||
|
||||
@@ -1166,45 +1073,14 @@ groups:
|
||||
|
||||
- id: 4.17
|
||||
text: "Verify the default Openshift controller-manager.conf file permissions"
|
||||
audit: "stat -c %a /etc/origin/master/openshift-master.kubeconfig"
|
||||
audit: "stat -c permissions=%a /etc/origin/master/openshift-master.kubeconfig"
|
||||
tests:
|
||||
bin_op: or
|
||||
test_items:
|
||||
- flag: "644"
|
||||
- flag: "permissions"
|
||||
compare:
|
||||
op: eq
|
||||
op: bitmask
|
||||
value: "644"
|
||||
set: true
|
||||
- flag: "640"
|
||||
compare:
|
||||
op: eq
|
||||
value: "640"
|
||||
set: true
|
||||
- flag: "600"
|
||||
compare:
|
||||
op: eq
|
||||
value: "600"
|
||||
set: true
|
||||
- flag: "444"
|
||||
compare:
|
||||
op: eq
|
||||
value: "444"
|
||||
set: true
|
||||
- flag: "440"
|
||||
compare:
|
||||
op: eq
|
||||
value: "440"
|
||||
set: true
|
||||
- flag: "400"
|
||||
compare:
|
||||
op: eq
|
||||
value: "400"
|
||||
set: true
|
||||
- flag: "000"
|
||||
compare:
|
||||
op: eq
|
||||
value: "000"
|
||||
set: true
|
||||
remediation: |
|
||||
Run the below command.
|
||||
|
||||
|
||||
@@ -213,45 +213,14 @@ groups:
|
||||
checks:
|
||||
- id: 8.1
|
||||
text: "Verify the OpenShift default permissions for the kubelet.conf file"
|
||||
audit: "stat -c %a /etc/origin/node/node.kubeconfig"
|
||||
audit: "stat -c permissions=%a /etc/origin/node/node.kubeconfig"
|
||||
tests:
|
||||
bin_op: or
|
||||
test_items:
|
||||
- flag: "644"
|
||||
- flag: "permissions"
|
||||
compare:
|
||||
op: eq
|
||||
op: bitmask
|
||||
value: "644"
|
||||
set: true
|
||||
- flag: "640"
|
||||
compare:
|
||||
op: eq
|
||||
value: "640"
|
||||
set: true
|
||||
- flag: "600"
|
||||
compare:
|
||||
op: eq
|
||||
value: "600"
|
||||
set: true
|
||||
- flag: "444"
|
||||
compare:
|
||||
op: eq
|
||||
value: "444"
|
||||
set: true
|
||||
- flag: "440"
|
||||
compare:
|
||||
op: eq
|
||||
value: "440"
|
||||
set: true
|
||||
- flag: "400"
|
||||
compare:
|
||||
op: eq
|
||||
value: "400"
|
||||
set: true
|
||||
- flag: "000"
|
||||
compare:
|
||||
op: eq
|
||||
value: "000"
|
||||
set: true
|
||||
remediation: |
|
||||
Run the below command on each worker node.
|
||||
chmod 644 /etc/origin/node/node.kubeconfig
|
||||
@@ -274,45 +243,14 @@ groups:
|
||||
|
||||
- id: 8.3
|
||||
text: "Verify the kubelet service file permissions of 644"
|
||||
audit: "stat -c %a $nodesvc"
|
||||
audit: "stat -c permissions=%a $nodesvc"
|
||||
tests:
|
||||
bin_op: or
|
||||
test_items:
|
||||
- flag: "644"
|
||||
- flag: "permissions"
|
||||
compare:
|
||||
op: eq
|
||||
op: bitmask
|
||||
value: "644"
|
||||
set: true
|
||||
- flag: "640"
|
||||
compare:
|
||||
op: eq
|
||||
value: "640"
|
||||
set: true
|
||||
- flag: "600"
|
||||
compare:
|
||||
op: eq
|
||||
value: "600"
|
||||
set: true
|
||||
- flag: "444"
|
||||
compare:
|
||||
op: eq
|
||||
value: "444"
|
||||
set: true
|
||||
- flag: "440"
|
||||
compare:
|
||||
op: eq
|
||||
value: "440"
|
||||
set: true
|
||||
- flag: "400"
|
||||
compare:
|
||||
op: eq
|
||||
value: "400"
|
||||
set: true
|
||||
- flag: "000"
|
||||
compare:
|
||||
op: eq
|
||||
value: "000"
|
||||
set: true
|
||||
remediation: |
|
||||
Run the below command on each worker node.
|
||||
chmod 644 $nodesvc
|
||||
@@ -335,45 +273,14 @@ groups:
|
||||
|
||||
- id: 8.5
|
||||
text: "Verify the OpenShift default permissions for the proxy kubeconfig file"
|
||||
audit: "stat -c %a /etc/origin/node/node.kubeconfig"
|
||||
audit: "stat -c permissions=%a /etc/origin/node/node.kubeconfig"
|
||||
tests:
|
||||
bin_op: or
|
||||
test_items:
|
||||
- flag: "644"
|
||||
- flag: "permissions"
|
||||
compare:
|
||||
op: eq
|
||||
op: bitmask
|
||||
value: "644"
|
||||
set: true
|
||||
- flag: "640"
|
||||
compare:
|
||||
op: eq
|
||||
value: "640"
|
||||
set: true
|
||||
- flag: "600"
|
||||
compare:
|
||||
op: eq
|
||||
value: "600"
|
||||
set: true
|
||||
- flag: "444"
|
||||
compare:
|
||||
op: eq
|
||||
value: "444"
|
||||
set: true
|
||||
- flag: "440"
|
||||
compare:
|
||||
op: eq
|
||||
value: "440"
|
||||
set: true
|
||||
- flag: "400"
|
||||
compare:
|
||||
op: eq
|
||||
value: "400"
|
||||
set: true
|
||||
- flag: "000"
|
||||
compare:
|
||||
op: eq
|
||||
value: "000"
|
||||
set: true
|
||||
remediation: |
|
||||
Run the below command on each worker node.
|
||||
chmod 644 /etc/origin/node/node.kubeconfig
|
||||
@@ -396,45 +303,14 @@ groups:
|
||||
|
||||
- id: 8.7
|
||||
text: "Verify the OpenShift default permissions for the certificate authorities file."
|
||||
audit: "stat -c %a /etc/origin/node/client-ca.crt"
|
||||
audit: "stat -c permissions=%a /etc/origin/node/client-ca.crt"
|
||||
tests:
|
||||
bin_op: or
|
||||
test_items:
|
||||
- flag: "644"
|
||||
- flag: "permissions"
|
||||
compare:
|
||||
op: eq
|
||||
op: bitmask
|
||||
value: "644"
|
||||
set: true
|
||||
- flag: "640"
|
||||
compare:
|
||||
op: eq
|
||||
value: "640"
|
||||
set: true
|
||||
- flag: "600"
|
||||
compare:
|
||||
op: eq
|
||||
value: "600"
|
||||
set: true
|
||||
- flag: "444"
|
||||
compare:
|
||||
op: eq
|
||||
value: "444"
|
||||
set: true
|
||||
- flag: "440"
|
||||
compare:
|
||||
op: eq
|
||||
value: "440"
|
||||
set: true
|
||||
- flag: "400"
|
||||
compare:
|
||||
op: eq
|
||||
value: "400"
|
||||
set: true
|
||||
- flag: "000"
|
||||
compare:
|
||||
op: eq
|
||||
value: "000"
|
||||
set: true
|
||||
remediation: |
|
||||
Run the below command on each worker node.
|
||||
chmod 644 /etc/origin/node/client-ca.crt
|
||||
|
||||
@@ -55,6 +55,8 @@ const (
|
||||
CONTROLPLANE NodeType = "controlplane"
|
||||
// POLICIES a node to run policies from
|
||||
POLICIES NodeType = "policies"
|
||||
// MANAGEDSERVICES a node to run managedservices from
|
||||
MANAGEDSERVICES = "managedservices"
|
||||
|
||||
// MANUAL Check Type
|
||||
MANUAL string = "manual"
|
||||
@@ -78,6 +80,7 @@ type Check struct {
|
||||
ActualValue string `json:"actual_value"`
|
||||
Scored bool `json:"scored"`
|
||||
ExpectedResult string `json:"expected_result"`
|
||||
Reason string `json:"reason,omitempty"`
|
||||
}
|
||||
|
||||
// Runner wraps the basic Run method.
|
||||
@@ -105,18 +108,21 @@ func (c *Check) run() State {
|
||||
// without tests return a 'WARN' to alert
|
||||
// the user that this check needs attention
|
||||
if c.Scored && len(strings.TrimSpace(c.Type)) == 0 && c.Tests == nil {
|
||||
c.Reason = "There are no tests"
|
||||
c.State = WARN
|
||||
return c.State
|
||||
}
|
||||
|
||||
// If check type is skip, force result to INFO
|
||||
if c.Type == "skip" {
|
||||
c.Reason = "Test marked as skip"
|
||||
c.State = INFO
|
||||
return c.State
|
||||
}
|
||||
|
||||
// If check type is manual force result to WARN
|
||||
if c.Type == MANUAL {
|
||||
c.Reason = "Test marked as a manual test"
|
||||
c.State = WARN
|
||||
return c.State
|
||||
}
|
||||
@@ -126,6 +132,7 @@ func (c *Check) run() State {
|
||||
|
||||
state, finalOutput, retErrmsgs := performTest(c.Audit, c.Commands, c.Tests)
|
||||
if len(state) > 0 {
|
||||
c.Reason = retErrmsgs
|
||||
c.State = state
|
||||
return c.State
|
||||
}
|
||||
@@ -161,6 +168,7 @@ func (c *Check) run() State {
|
||||
|
||||
state, finalOutput, retErrmsgs = performTest(c.AuditConfig, c.ConfigCommands, currentTests)
|
||||
if len(state) > 0 {
|
||||
c.Reason = retErrmsgs
|
||||
c.State = state
|
||||
return c.State
|
||||
}
|
||||
@@ -175,6 +183,7 @@ func (c *Check) run() State {
|
||||
if c.Scored {
|
||||
c.State = FAIL
|
||||
} else {
|
||||
c.Reason = errmsgs
|
||||
c.State = WARN
|
||||
}
|
||||
}
|
||||
@@ -254,13 +263,13 @@ func isShellCommand(s string) bool {
|
||||
|
||||
func performTest(audit string, commands []*exec.Cmd, tests *tests) (State, *testOutput, string) {
|
||||
if len(strings.TrimSpace(audit)) == 0 {
|
||||
return "", failTestItem("missing command"), ""
|
||||
return "", failTestItem("missing command"), "missing audit command"
|
||||
}
|
||||
|
||||
var out bytes.Buffer
|
||||
state, retErrmsgs := runExecCommands(audit, commands, &out)
|
||||
if len(state) > 0 {
|
||||
return state, nil, ""
|
||||
return state, nil, retErrmsgs
|
||||
}
|
||||
errmsgs := retErrmsgs
|
||||
|
||||
@@ -279,6 +288,7 @@ func runExecCommands(audit string, commands []*exec.Cmd, out *bytes.Buffer) (Sta
|
||||
// Check if command exists or exit with WARN.
|
||||
for _, cmd := range commands {
|
||||
if !isShellCommand(cmd.Path) {
|
||||
errmsgs += fmt.Sprintf("Command '%s' not found\n", cmd.Path)
|
||||
return WARN, errmsgs
|
||||
}
|
||||
}
|
||||
|
||||
20
check/data
20
check/data
@@ -308,6 +308,26 @@ groups:
|
||||
value: '^1\.12.*$'
|
||||
set: true
|
||||
|
||||
- id: 27
|
||||
text: "check boolean flag with no value"
|
||||
tests:
|
||||
test_items:
|
||||
- flag: "--peer-client-cert-auth"
|
||||
compare:
|
||||
op: eq
|
||||
value: true
|
||||
set: true
|
||||
|
||||
- id: 28
|
||||
text: "check boolean flag with false value"
|
||||
tests:
|
||||
test_items:
|
||||
- flag: "--peer-client-cert-auth"
|
||||
compare:
|
||||
op: eq
|
||||
value: false
|
||||
set: true
|
||||
|
||||
- id: 2.1
|
||||
text: "audit and audit_config commands"
|
||||
checks:
|
||||
|
||||
@@ -115,7 +115,12 @@ func (t *testItem) execute(s string) *testOutput {
|
||||
if vals[3] != "" {
|
||||
flagVal = vals[3]
|
||||
} else {
|
||||
flagVal = vals[1]
|
||||
// --bool-flag
|
||||
if strings.HasPrefix(t.Flag, "--") {
|
||||
flagVal = "true"
|
||||
} else {
|
||||
flagVal = vals[1]
|
||||
}
|
||||
}
|
||||
} else {
|
||||
fmt.Fprintf(os.Stderr, "invalid flag in testitem definition")
|
||||
@@ -205,8 +210,16 @@ func compareOp(tCompareOp string, flagVal string, tCompareValue string) (string,
|
||||
target := splitAndRemoveLastSeparator(tCompareValue, defaultArraySeparator)
|
||||
testResult = allElementsValid(s, target)
|
||||
|
||||
case "bitmask":
|
||||
expectedResultPattern = "bitmask '%s' AND '%s'"
|
||||
requested, err := strconv.ParseInt(flagVal, 8, 64)
|
||||
max, err := strconv.ParseInt(tCompareValue, 8, 64)
|
||||
if err != nil {
|
||||
fmt.Fprintf(os.Stderr, "Not numeric value - flag: %q - compareValue: %q %v\n", flagVal, tCompareValue, err)
|
||||
os.Exit(1)
|
||||
}
|
||||
testResult = (max & requested) == requested
|
||||
}
|
||||
|
||||
if expectedResultPattern == "" {
|
||||
return expectedResultPattern, testResult
|
||||
}
|
||||
|
||||
@@ -156,6 +156,30 @@ func TestTestExecute(t *testing.T) {
|
||||
controls.Groups[0].Checks[26],
|
||||
"currentMasterVersion: 1.12.7",
|
||||
},
|
||||
{
|
||||
controls.Groups[0].Checks[27],
|
||||
"--peer-client-cert-auth",
|
||||
},
|
||||
{
|
||||
controls.Groups[0].Checks[27],
|
||||
"--abc=true --peer-client-cert-auth --efg=false",
|
||||
},
|
||||
{
|
||||
controls.Groups[0].Checks[27],
|
||||
"--abc --peer-client-cert-auth --efg",
|
||||
},
|
||||
{
|
||||
controls.Groups[0].Checks[27],
|
||||
"--peer-client-cert-auth=true",
|
||||
},
|
||||
{
|
||||
controls.Groups[0].Checks[27],
|
||||
"--abc --peer-client-cert-auth=true --efg",
|
||||
},
|
||||
{
|
||||
controls.Groups[0].Checks[28],
|
||||
"--abc --peer-client-cert-auth=false --efg",
|
||||
},
|
||||
}
|
||||
|
||||
for _, c := range cases {
|
||||
@@ -642,6 +666,19 @@ func TestCompareOp(t *testing.T) {
|
||||
{label: "op=valid_elements, valid_elements expectedResultPattern empty", op: "valid_elements", flagVal: "a,b",
|
||||
compareValue: "", expectedResultPattern: "'a,b' contains valid elements from ''",
|
||||
testResult: false},
|
||||
// Test Op "bitmask"
|
||||
{label: "op=bitmask, 644 AND 640", op: "bitmask", flagVal: "640",
|
||||
compareValue: "644", expectedResultPattern: "bitmask '640' AND '644'",
|
||||
testResult: true},
|
||||
{label: "op=bitmask, 644 AND 777", op: "bitmask", flagVal: "777",
|
||||
compareValue: "644", expectedResultPattern: "bitmask '777' AND '644'",
|
||||
testResult: false},
|
||||
{label: "op=bitmask, 644 AND 444", op: "bitmask", flagVal: "444",
|
||||
compareValue: "644", expectedResultPattern: "bitmask '444' AND '644'",
|
||||
testResult: true},
|
||||
{label: "op=bitmask, 644 AND 211", op: "bitmask", flagVal: "211",
|
||||
compareValue: "644", expectedResultPattern: "bitmask '211' AND '644'",
|
||||
testResult: false},
|
||||
}
|
||||
|
||||
for _, c := range cases {
|
||||
|
||||
@@ -180,9 +180,17 @@ func prettyPrint(r *check.Controls, summary check.Summary) {
|
||||
colors[check.WARN].Printf("== Remediations ==\n")
|
||||
for _, g := range r.Groups {
|
||||
for _, c := range g.Checks {
|
||||
if c.State == check.FAIL || c.State == check.WARN {
|
||||
if c.State == check.FAIL {
|
||||
fmt.Printf("%s %s\n", c.ID, c.Remediation)
|
||||
}
|
||||
if c.State == check.WARN {
|
||||
// Print the error if test failed due to problem with the audit command
|
||||
if c.Reason != "" && c.Type != "manual"{
|
||||
fmt.Printf("%s audit test did not run: %s\n", c.ID, c.Reason)
|
||||
} else {
|
||||
fmt.Printf("%s %s\n", c.ID, c.Remediation)
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
fmt.Println()
|
||||
@@ -225,6 +233,8 @@ func loadConfig(nodetype check.NodeType) string {
|
||||
file = etcdFile
|
||||
case check.POLICIES:
|
||||
file = policiesFile
|
||||
case check.MANAGEDSERVICES:
|
||||
file = managedservicesFile
|
||||
}
|
||||
|
||||
benchmarkVersion, err := getBenchmarkVersion(kubeVersion, benchmarkVersion, viper.GetViper())
|
||||
@@ -382,6 +392,7 @@ var benchmarkVersionToTargetsMap = map[string][]string{
|
||||
"cis-1.3": []string{string(check.MASTER), string(check.NODE)},
|
||||
"cis-1.4": []string{string(check.MASTER), string(check.NODE)},
|
||||
"cis-1.5": []string{string(check.MASTER), string(check.NODE), string(check.CONTROLPLANE), string(check.ETCD), string(check.POLICIES)},
|
||||
"gke-1.0": []string{string(check.MASTER), string(check.NODE), string(check.CONTROLPLANE), string(check.ETCD), string(check.POLICIES), string(check.MANAGEDSERVICES)},
|
||||
}
|
||||
|
||||
// validTargets helps determine if the targets
|
||||
|
||||
@@ -210,6 +210,7 @@ func TestMapToCISVersion(t *testing.T) {
|
||||
{kubeVersion: "1.15", succeed: true, exp: "cis-1.5"},
|
||||
{kubeVersion: "1.16", succeed: true, exp: "cis-1.5"},
|
||||
{kubeVersion: "1.17", succeed: true, exp: "cis-1.5"},
|
||||
{kubeVersion: "gke-1.0", succeed: true, exp: "gke-1.0"},
|
||||
{kubeVersion: "ocp-3.10", succeed: true, exp: "rh-0.7"},
|
||||
{kubeVersion: "ocp-3.11", succeed: true, exp: "rh-0.7"},
|
||||
{kubeVersion: "unknown", succeed: false, exp: "", expErr: "unable to find a matching Benchmark Version match for kubernetes version: unknown"},
|
||||
@@ -334,6 +335,7 @@ func TestGetBenchmarkVersion(t *testing.T) {
|
||||
{n: "kubeVersion", kubeVersion: "1.11", benchmarkVersion: "", v: viperWithData, exp: "cis-1.3", callFn: withNoPath, succeed: true},
|
||||
{n: "ocpVersion310", kubeVersion: "ocp-3.10", benchmarkVersion: "", v: viperWithData, exp: "rh-0.7", callFn: withNoPath, succeed: true},
|
||||
{n: "ocpVersion311", kubeVersion: "ocp-3.11", benchmarkVersion: "", v: viperWithData, exp: "rh-0.7", callFn: withNoPath, succeed: true},
|
||||
{n: "gke10", kubeVersion: "gke-1.0", benchmarkVersion: "", v: viperWithData, exp: "gke-1.0", callFn: withNoPath, succeed: true},
|
||||
}
|
||||
for _, c := range cases {
|
||||
rv, err := c.callFn(c.kubeVersion, c.benchmarkVersion, c.v, getBenchmarkVersion)
|
||||
@@ -388,6 +390,12 @@ func TestValidTargets(t *testing.T) {
|
||||
targets: []string{"master", "node", "controlplane", "etcd", "policies"},
|
||||
expected: true,
|
||||
},
|
||||
{
|
||||
name: "gke-1.0 valid",
|
||||
benchmark: "gke-1.0",
|
||||
targets: []string{"master", "node", "controlplane", "etcd", "policies", "managedservices"},
|
||||
expected: true,
|
||||
},
|
||||
}
|
||||
|
||||
for _, c := range cases {
|
||||
|
||||
@@ -9,6 +9,7 @@ import (
|
||||
"net/http"
|
||||
"os"
|
||||
"strings"
|
||||
"time"
|
||||
|
||||
"github.com/golang/glog"
|
||||
)
|
||||
@@ -30,7 +31,7 @@ func getKubeVersionFromRESTAPI() (string, error) {
|
||||
}
|
||||
token := strings.TrimSpace(string(tb))
|
||||
|
||||
data, err := getWebData(k8sVersionURL, token, tlsCert)
|
||||
data, err := getWebDataWithRetry(k8sVersionURL, token, tlsCert)
|
||||
if err != nil {
|
||||
return "", err
|
||||
}
|
||||
@@ -42,6 +43,24 @@ func getKubeVersionFromRESTAPI() (string, error) {
|
||||
return k8sVersion, nil
|
||||
}
|
||||
|
||||
// The idea of this function is so if Kubernetes DNS is not completely seetup and the
|
||||
// Container where kube-bench is running needs time for DNS configure.
|
||||
// Basically try 10 times, waiting 1 second until either it is successful or it fails.
|
||||
func getWebDataWithRetry(k8sVersionURL, token string, cacert *tls.Certificate) (data []byte, err error) {
|
||||
tries := 0
|
||||
// We retry a few times in case the DNS service has not had time to come up
|
||||
for tries < 10 {
|
||||
data, err = getWebData(k8sVersionURL, token, cacert)
|
||||
if err == nil {
|
||||
return
|
||||
}
|
||||
tries++
|
||||
time.Sleep(1 * time.Second)
|
||||
}
|
||||
|
||||
return
|
||||
}
|
||||
|
||||
func extractVersion(data []byte) (string, error) {
|
||||
type versionResponse struct {
|
||||
Major string
|
||||
|
||||
@@ -126,7 +126,55 @@ func TestGetWebData(t *testing.T) {
|
||||
}
|
||||
|
||||
}
|
||||
func TestGetWebDataWithRetry(t *testing.T) {
|
||||
okfn := func(w http.ResponseWriter, r *http.Request) {
|
||||
_, _ = fmt.Fprintln(w, `{
|
||||
"major": "1",
|
||||
"minor": "15"}`)
|
||||
}
|
||||
errfn := func(w http.ResponseWriter, r *http.Request) {
|
||||
http.Error(w, http.StatusText(http.StatusInternalServerError),
|
||||
http.StatusInternalServerError)
|
||||
}
|
||||
token := "dummyToken"
|
||||
var tlsCert tls.Certificate
|
||||
|
||||
cases := []struct {
|
||||
fn http.HandlerFunc
|
||||
fail bool
|
||||
}{
|
||||
{
|
||||
fn: okfn,
|
||||
fail: false,
|
||||
},
|
||||
{
|
||||
fn: errfn,
|
||||
fail: true,
|
||||
},
|
||||
}
|
||||
|
||||
for id, c := range cases {
|
||||
t.Run(strconv.Itoa(id), func(t *testing.T) {
|
||||
ts := httptest.NewServer(c.fn)
|
||||
defer ts.Close()
|
||||
data, err := getWebDataWithRetry(ts.URL, token, &tlsCert)
|
||||
if !c.fail {
|
||||
if err != nil {
|
||||
t.Errorf("unexpected error: %v", err)
|
||||
}
|
||||
|
||||
if len(data) == 0 {
|
||||
t.Errorf("missing data")
|
||||
}
|
||||
} else {
|
||||
if err == nil {
|
||||
t.Errorf("Expected error")
|
||||
}
|
||||
}
|
||||
})
|
||||
}
|
||||
|
||||
}
|
||||
func TestExtractVersion(t *testing.T) {
|
||||
okJSON := []byte(`{
|
||||
"major": "1",
|
||||
|
||||
50
cmd/root.go
50
cmd/root.go
@@ -33,27 +33,28 @@ type FilterOpts struct {
|
||||
}
|
||||
|
||||
var (
|
||||
envVarsPrefix = "KUBE_BENCH"
|
||||
defaultKubeVersion = "1.11"
|
||||
kubeVersion string
|
||||
benchmarkVersion string
|
||||
cfgFile string
|
||||
cfgDir = "./cfg/"
|
||||
jsonFmt bool
|
||||
junitFmt bool
|
||||
pgSQL bool
|
||||
masterFile = "master.yaml"
|
||||
nodeFile = "node.yaml"
|
||||
etcdFile = "etcd.yaml"
|
||||
controlplaneFile = "controlplane.yaml"
|
||||
policiesFile = "policies.yaml"
|
||||
noResults bool
|
||||
noSummary bool
|
||||
noRemediations bool
|
||||
filterOpts FilterOpts
|
||||
includeTestOutput bool
|
||||
outputFile string
|
||||
configFileError error
|
||||
envVarsPrefix = "KUBE_BENCH"
|
||||
defaultKubeVersion = "1.11"
|
||||
kubeVersion string
|
||||
benchmarkVersion string
|
||||
cfgFile string
|
||||
cfgDir = "./cfg/"
|
||||
jsonFmt bool
|
||||
junitFmt bool
|
||||
pgSQL bool
|
||||
masterFile = "master.yaml"
|
||||
nodeFile = "node.yaml"
|
||||
etcdFile = "etcd.yaml"
|
||||
controlplaneFile = "controlplane.yaml"
|
||||
policiesFile = "policies.yaml"
|
||||
managedservicesFile = "managedservices.yaml"
|
||||
noResults bool
|
||||
noSummary bool
|
||||
noRemediations bool
|
||||
filterOpts FilterOpts
|
||||
includeTestOutput bool
|
||||
outputFile string
|
||||
configFileError error
|
||||
)
|
||||
|
||||
// RootCmd represents the base command when called without any subcommands
|
||||
@@ -96,6 +97,13 @@ var RootCmd = &cobra.Command{
|
||||
runChecks(check.POLICIES, loadConfig(check.POLICIES))
|
||||
}
|
||||
|
||||
// Managedservices is only valid for GKE 1.0 and later,
|
||||
// this a gatekeeper for previous versions.
|
||||
if validTargets(benchmarkVersion, []string{string(check.MANAGEDSERVICES)}) {
|
||||
glog.V(1).Info("== Running managed services checks ==\n")
|
||||
runChecks(check.MANAGEDSERVICES, loadConfig(check.MANAGEDSERVICES))
|
||||
}
|
||||
|
||||
},
|
||||
}
|
||||
|
||||
|
||||
@@ -276,17 +276,17 @@ func multiWordReplace(s string, subname string, sub string) string {
|
||||
const missingKubectlKubeletMessage = `
|
||||
Unable to find the programs kubectl or kubelet in the PATH.
|
||||
These programs are used to determine which version of Kubernetes is running.
|
||||
Make sure the /usr/bin directory is mapped to the container,
|
||||
Make sure the /usr/local/mount-from-host/bin directory is mapped to the container,
|
||||
either in the job.yaml file, or Docker command.
|
||||
|
||||
For job.yaml:
|
||||
...
|
||||
- name: usr-bin
|
||||
mountPath: /usr/bin
|
||||
mountPath: /usr/local/mount-from-host/bin
|
||||
...
|
||||
|
||||
For docker command:
|
||||
docker -v $(which kubectl):/usr/bin/kubectl ....
|
||||
docker -v $(which kubectl):/usr/local/mount-from-host/bin/kubectl ....
|
||||
|
||||
Alternatively, you can specify the version with --version
|
||||
kube-bench --version <VERSION> ...
|
||||
|
||||
@@ -12,6 +12,9 @@ spec:
|
||||
image: ubuntu
|
||||
command: ["/bin/bash", "-c", "--"]
|
||||
args: ["while true; do sleep 30; done;"]
|
||||
env:
|
||||
- name: PATH
|
||||
value: "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/local/mount-from-host/bin"
|
||||
volumeMounts:
|
||||
- name: var-lib-kubelet
|
||||
mountPath: /var/lib/kubelet
|
||||
@@ -19,10 +22,10 @@ spec:
|
||||
mountPath: /etc/systemd
|
||||
- name: etc-kubernetes
|
||||
mountPath: /etc/kubernetes
|
||||
# /usr/bin is mounted to access kubectl / kubelet, for auto-detecting the Kubernetes version.
|
||||
# /usr/local/mount-from-host/bin is mounted to access kubectl / kubelet, for auto-detecting the Kubernetes version.
|
||||
# You can omit this mount if you specify --version as part of the command.
|
||||
- name: usr-bin
|
||||
mountPath: /usr/bin
|
||||
mountPath: /usr/local/mount-from-host/bin
|
||||
- name: kind-bin
|
||||
mountPath: /kind/bin
|
||||
resources:
|
||||
|
||||
@@ -23,10 +23,10 @@ spec:
|
||||
mountPath: /etc/systemd
|
||||
- name: etc-kubernetes
|
||||
mountPath: /etc/kubernetes
|
||||
# /usr/bin is mounted to access kubectl / kubelet, for auto-detecting the Kubernetes version.
|
||||
# /usr/local/mount-from-host/bin is mounted to access kubectl / kubelet, for auto-detecting the Kubernetes version.
|
||||
# You can omit this mount if you specify --version as part of the command.
|
||||
- name: usr-bin
|
||||
mountPath: /usr/bin
|
||||
mountPath: /usr/local/mount-from-host/bin
|
||||
- name: kind-bin
|
||||
mountPath: /kind/bin
|
||||
restartPolicy: Never
|
||||
|
||||
141
integration/testdata/job-master.data
vendored
141
integration/testdata/job-master.data
vendored
@@ -5,7 +5,7 @@
|
||||
[PASS] 1.1.3 Ensure that the --insecure-allow-any-token argument is not set (Not Scored)
|
||||
[PASS] 1.1.4 Ensure that the --kubelet-https argument is set to true (Scored)
|
||||
[PASS] 1.1.5 Ensure that the --insecure-bind-address argument is not set (Scored)
|
||||
[FAIL] 1.1.6 Ensure that the --insecure-port argument is set to 0 (Scored)
|
||||
[PASS] 1.1.6 Ensure that the --insecure-port argument is set to 0 (Scored)
|
||||
[PASS] 1.1.7 Ensure that the --secure-port argument is not set to 0 (Scored)
|
||||
[FAIL] 1.1.8 Ensure that the --profiling argument is set to false (Scored)
|
||||
[FAIL] 1.1.9 Ensure that the --repair-malformed-updates argument is set to false (Scored)
|
||||
@@ -18,37 +18,37 @@
|
||||
[FAIL] 1.1.16 Ensure that the --audit-log-maxage argument is set to 30 or as appropriate (Scored)
|
||||
[FAIL] 1.1.17 Ensure that the --audit-log-maxbackup argument is set to 10 or as appropriate (Scored)
|
||||
[FAIL] 1.1.18 Ensure that the --audit-log-maxsize argument is set to 100 or as appropriate (Scored)
|
||||
[FAIL] 1.1.19 Ensure that the --authorization-mode argument is not set to AlwaysAllow (Scored)
|
||||
[PASS] 1.1.19 Ensure that the --authorization-mode argument is not set to AlwaysAllow (Scored)
|
||||
[PASS] 1.1.20 Ensure that the --token-auth-file parameter is not set (Scored)
|
||||
[FAIL] 1.1.21 Ensure that the --kubelet-certificate-authority argument is set as appropriate (Scored)
|
||||
[FAIL] 1.1.22 Ensure that the --kubelet-client-certificate and --kubelet-client-key arguments are set as appropriate (Scored)
|
||||
[PASS] 1.1.22 Ensure that the --kubelet-client-certificate and --kubelet-client-key arguments are set as appropriate (Scored)
|
||||
[PASS] 1.1.23 Ensure that the --service-account-lookup argument is set to true (Scored)
|
||||
[FAIL] 1.1.24 Ensure that the admission control plugin PodSecurityPolicy is set (Scored)
|
||||
[FAIL] 1.1.25 Ensure that the --service-account-key-file argument is set as appropriate (Scored)
|
||||
[FAIL] 1.1.26 Ensure that the --etcd-certfile and --etcd-keyfile arguments are set as appropriate (Scored)
|
||||
[PASS] 1.1.25 Ensure that the --service-account-key-file argument is set as appropriate (Scored)
|
||||
[PASS] 1.1.26 Ensure that the --etcd-certfile and --etcd-keyfile arguments are set as appropriate (Scored)
|
||||
[PASS] 1.1.27 Ensure that the admission control plugin ServiceAccount is set(Scored)
|
||||
[FAIL] 1.1.28 Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate (Scored)
|
||||
[FAIL] 1.1.29 Ensure that the --client-ca-file argument is set as appropriate (Scored)
|
||||
[FAIL] 1.1.30 Ensure that the --etcd-cafile argument is set as appropriate (Scored)
|
||||
[PASS] 1.1.28 Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate (Scored)
|
||||
[PASS] 1.1.29 Ensure that the --client-ca-file argument is set as appropriate (Scored)
|
||||
[PASS] 1.1.30 Ensure that the --etcd-cafile argument is set as appropriate (Scored)
|
||||
[WARN] 1.1.31 Ensure that the API Server only makes use of Strong Cryptographic Ciphers (Not Scored)
|
||||
[FAIL] 1.1.32 Ensure that the --authorization-mode argument is set to Node (Scored)
|
||||
[FAIL] 1.1.33 Ensure that the admission control plugin NodeRestriction is set (Scored)
|
||||
[PASS] 1.1.32 Ensure that the --authorization-mode argument is set to Node (Scored)
|
||||
[PASS] 1.1.33 Ensure that the admission control plugin NodeRestriction is set (Scored)
|
||||
[FAIL] 1.1.34 Ensure that the --encryption-provider-config argument is set as appropriate (Scored)
|
||||
[WARN] 1.1.35 Ensure that the encryption provider is set to aescbc (Scored)
|
||||
[FAIL] 1.1.36 Ensure that the admission control plugin EventRateLimit is set (Scored)
|
||||
[PASS] 1.1.37a Ensure that the AdvancedAuditing argument is not set to false (Scored)
|
||||
[FAIL] 1.1.37b Ensure that the AdvancedAuditing argument is not set to false (Scored)
|
||||
[PASS] 1.1.38 Ensure that the --request-timeout argument is set as appropriate (Scored)
|
||||
[FAIL] 1.1.39 Ensure that the --authorization-mode argument includes RBAC (Scored)
|
||||
[PASS] 1.1.39 Ensure that the --authorization-mode argument includes RBAC (Scored)
|
||||
[INFO] 1.2 Scheduler
|
||||
[FAIL] 1.2.1 Ensure that the --profiling argument is set to false (Scored)
|
||||
[PASS] 1.2.2 Ensure that the --address argument is set to 127.0.0.1 (Scored)
|
||||
[INFO] 1.3 Controller Manager
|
||||
[FAIL] 1.3.1 Ensure that the --terminated-pod-gc-threshold argument is set as appropriate (Scored)
|
||||
[FAIL] 1.3.2 Ensure that the --profiling argument is set to false (Scored)
|
||||
[FAIL] 1.3.3 Ensure that the --use-service-account-credentials argument is set to true (Scored)
|
||||
[FAIL] 1.3.4 Ensure that the --service-account-private-key-file argument is set as appropriate (Scored)
|
||||
[FAIL] 1.3.5 Ensure that the --root-ca-file argument is set as appropriate (Scored)
|
||||
[PASS] 1.3.3 Ensure that the --use-service-account-credentials argument is set to true (Scored)
|
||||
[PASS] 1.3.4 Ensure that the --service-account-private-key-file argument is set as appropriate (Scored)
|
||||
[PASS] 1.3.5 Ensure that the --root-ca-file argument is set as appropriate (Scored)
|
||||
[FAIL] 1.3.6 Ensure that the RotateKubeletServerCertificate argument is set to true (Scored)
|
||||
[PASS] 1.3.7 Ensure that the --address argument is set to 127.0.0.1 (Scored)
|
||||
[INFO] 1.4 Configuration Files
|
||||
@@ -62,7 +62,7 @@
|
||||
[PASS] 1.4.8 Ensure that the etcd pod specification file ownership is set to root:root (Scored)
|
||||
[WARN] 1.4.9 Ensure that the Container Network Interface file permissions are set to 644 or more restrictive (Not Scored)
|
||||
[WARN] 1.4.10 Ensure that the Container Network Interface file ownership is set to root:root (Not Scored)
|
||||
[FAIL] 1.4.11 Ensure that the etcd data directory permissions are set to 700 or more restrictive (Scored)
|
||||
[PASS] 1.4.11 Ensure that the etcd data directory permissions are set to 700 or more restrictive (Scored)
|
||||
[FAIL] 1.4.12 Ensure that the etcd data directory ownership is set to etcd:etcd (Scored)
|
||||
[PASS] 1.4.13 Ensure that the admin.conf file permissions are set to 644 or more restrictive (Scored)
|
||||
[PASS] 1.4.14 Ensure that the admin.conf file ownership is set to root:root (Scored)
|
||||
@@ -74,11 +74,11 @@
|
||||
[WARN] 1.4.20 Ensure that the Kubernetes PKI certificate file permissions are set to 644 or more restrictive (Scored)
|
||||
[WARN] 1.4.21 Ensure that the Kubernetes PKI key file permissions are set to 600 or more restrictive (Scored)
|
||||
[INFO] 1.5 etcd
|
||||
[FAIL] 1.5.1 Ensure that the --cert-file and --key-file arguments are set as appropriate (Scored)
|
||||
[FAIL] 1.5.2 Ensure that the --client-cert-auth argument is set to true (Scored)
|
||||
[PASS] 1.5.1 Ensure that the --cert-file and --key-file arguments are set as appropriate (Scored)
|
||||
[PASS] 1.5.2 Ensure that the --client-cert-auth argument is set to true (Scored)
|
||||
[PASS] 1.5.3 Ensure that the --auto-tls argument is not set to true (Scored)
|
||||
[FAIL] 1.5.4 Ensure that the --peer-cert-file and --peer-key-file arguments are set as appropriate (Scored)
|
||||
[FAIL] 1.5.5 Ensure that the --peer-client-cert-auth argument is set to true (Scored)
|
||||
[PASS] 1.5.4 Ensure that the --peer-cert-file and --peer-key-file arguments are set as appropriate (Scored)
|
||||
[PASS] 1.5.5 Ensure that the --peer-client-cert-auth argument is set to true (Scored)
|
||||
[PASS] 1.5.6 Ensure that the --peer-auto-tls argument is not set to true (Scored)
|
||||
[WARN] 1.5.7 Ensure that a unique Certificate Authority is used for etcd (Not Scored)
|
||||
[INFO] 1.6 General Security Primitives
|
||||
@@ -104,10 +104,6 @@
|
||||
on the master node and set the below parameter.
|
||||
--anonymous-auth=false
|
||||
|
||||
1.1.6 Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml
|
||||
apiserver.yaml on the master node and set the below parameter.
|
||||
--insecure-port=0
|
||||
|
||||
1.1.8 Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml
|
||||
on the master node and set the below parameter.
|
||||
--profiling=false
|
||||
@@ -145,24 +141,12 @@ on the master node and set the --audit-log-maxsize parameter to an
|
||||
appropriate size in MB. For example, to set it as 100 MB:
|
||||
--audit-log-maxsize=100
|
||||
|
||||
1.1.19 Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml
|
||||
on the master node and set the --authorization-mode parameter to
|
||||
values other than AlwaysAllow. One such example could be as below.
|
||||
--authorization-mode=RBAC
|
||||
|
||||
1.1.21 Follow the Kubernetes documentation and setup the TLS connection between the
|
||||
apiserver and kubelets. Then, edit the API server pod specification file
|
||||
/etc/kubernetes/manifests/kube-apiserver.yaml on the master node and set the --kubelet-certificate-authority
|
||||
parameter to the path to the cert file for the certificate authority.
|
||||
--kubelet-certificate-authority=<ca-string>
|
||||
|
||||
1.1.22 Follow the Kubernetes documentation and set up the TLS connection between the
|
||||
apiserver and kubelets. Then, edit API server pod specification file
|
||||
/etc/kubernetes/manifests/kube-apiserver.yaml on the master node and set the
|
||||
kubelet client certificate and key parameters as below.
|
||||
--kubelet-client-certificate=<path/to/client-certificate-file>
|
||||
--kubelet-client-key=<path/to/client-key-file>
|
||||
|
||||
1.1.24 Follow the documentation and create Pod Security Policy objects as per your environment.
|
||||
Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml
|
||||
on the master node and set the --enable-admission-plugins parameter to a
|
||||
@@ -170,51 +154,10 @@ value that includes PodSecurityPolicy :
|
||||
--enable-admission-plugins=...,PodSecurityPolicy,...
|
||||
Then restart the API Server.
|
||||
|
||||
1.1.25 Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml
|
||||
on the master node and set the --service-account-key-file parameter
|
||||
to the public key file for service accounts:
|
||||
--service-account-key-file=<filename>
|
||||
|
||||
1.1.26 Follow the Kubernetes documentation and set up the TLS connection between the
|
||||
apiserver and etcd. Then, edit the API server pod specification file
|
||||
/etc/kubernetes/manifests/kube-apiserver.yaml on the master node and set the etcd
|
||||
certificate and key file parameters.
|
||||
--etcd-certfile=<path/to/client-certificate-file>
|
||||
--etcd-keyfile=<path/to/client-key-file>
|
||||
|
||||
1.1.28 Follow the Kubernetes documentation and set up the TLS connection on the apiserver.
|
||||
Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml
|
||||
on the master node and set the TLS certificate and private key file
|
||||
parameters.
|
||||
--tls-cert-file=<path/to/tls-certificate-file>
|
||||
--tls-private-key-file=<path/to/tls-key-file>
|
||||
|
||||
1.1.29 Follow the Kubernetes documentation and set up the TLS connection on the apiserver.
|
||||
Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml
|
||||
on the master node and set the client certificate authority file.
|
||||
--client-ca-file=<path/to/client-ca-file>
|
||||
|
||||
1.1.30 Follow the Kubernetes documentation and set up the TLS connection between the
|
||||
apiserver and etcd. Then, edit the API server pod specification file
|
||||
/etc/kubernetes/manifests/kube-apiserver.yaml on the master node and set the etcd
|
||||
certificate authority file parameter.
|
||||
--etcd-cafile=<path/to/ca-file>
|
||||
|
||||
1.1.31 Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml
|
||||
on the master node and set the below parameter.
|
||||
--tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256
|
||||
|
||||
1.1.32 Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml
|
||||
on the master node and set the --authorization-mode parameter to a
|
||||
value that includes Node.
|
||||
--authorization-mode=Node,RBAC
|
||||
|
||||
1.1.33 Follow the Kubernetes documentation and configure NodeRestriction plug-in on
|
||||
kubelets. Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml
|
||||
on the master node and set the --enable-admission-plugins parameter to a
|
||||
value that includes NodeRestriction.
|
||||
--enable-admission-plugins=...,NodeRestriction,...
|
||||
|
||||
1.1.34 [Manual test]
|
||||
Follow the Kubernetes documentation and configure a EncryptionConfig file.
|
||||
Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml on the
|
||||
@@ -248,8 +191,6 @@ configuration file. Then, edit the API server pod specification file
|
||||
and set the below parameters.
|
||||
--audit-policy-file=/etc/kubernetes/audit-policy.yaml
|
||||
|
||||
1.1.39 Edit the API server pod specification file kube-apiserver on the master node and set the --authorization-mode parameter to a value that includes RBAC, for example: --authorization-mode=Node,RBAC
|
||||
|
||||
1.2.1 Edit the Scheduler pod specification file /etc/kubernetes/manifests/kube-scheduler.yaml
|
||||
file on the master node and set the below parameter.
|
||||
--profiling=false
|
||||
@@ -262,20 +203,6 @@ on the master node and set the --terminated-pod-gc-threshold to an appropriate t
|
||||
on the master node and set the below parameter.
|
||||
--profiling=false
|
||||
|
||||
1.3.3 Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml
|
||||
on the master node to set the below parameter.
|
||||
--use-service-account-credentials=true
|
||||
|
||||
1.3.4 Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml
|
||||
on the master node and set the --service-account-private-
|
||||
key-file parameter to the private key file for service accounts.
|
||||
--service-account-private-key-file=<filename>
|
||||
|
||||
1.3.5 Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml
|
||||
on the master node and set the --root-ca-file parameter to
|
||||
the certificate bundle file.
|
||||
--root-ca-file=<path/to/file>
|
||||
|
||||
1.3.6 Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml
|
||||
controller-manager.yaml on the master node and set the --feature-gates parameter to
|
||||
include RotateKubeletServerCertificate=true.
|
||||
@@ -291,12 +218,6 @@ Run the below command (based on the file location on your system) on the master
|
||||
For example,
|
||||
chown root:root <path/to/cni/files>
|
||||
|
||||
1.4.11 On the etcd server node, get the etcd data directory, passed as an argument --data-dir ,
|
||||
from the below command:
|
||||
ps -ef | grep etcd
|
||||
Run the below command (based on the etcd data directory found above). For example,
|
||||
chmod 700 /var/lib/etcd
|
||||
|
||||
1.4.12 On the etcd server node, get the etcd data directory, passed as an argument --data-dir ,
|
||||
from the below command:
|
||||
ps -ef | grep etcd
|
||||
@@ -315,26 +236,6 @@ For example, chmod -R 644 /etc/kubernetes/pki/*.crt
|
||||
Run the below command (based on the file location on your system) on the master node.
|
||||
For example, chmod -R 600 /etc/kubernetes/pki/*.key
|
||||
|
||||
1.5.1 Follow the etcd service documentation and configure TLS encryption.
|
||||
Then, edit the etcd pod specification file /etc/kubernetes/manifests/etcd.yaml on the
|
||||
master node and set the below parameters.
|
||||
--ca-file=</path/to/ca-file>
|
||||
--key-file=</path/to/key-file>
|
||||
|
||||
1.5.2 Edit the etcd pod specification file /etc/kubernetes/manifests/etcd.yaml on the master
|
||||
node and set the below parameter.
|
||||
--client-cert-auth="true"
|
||||
|
||||
1.5.4 Follow the etcd service documentation and configure peer TLS encryption as appropriate
|
||||
for your etcd cluster. Then, edit the etcd pod specification file /etc/kubernetes/manifests/etcd.yaml on the
|
||||
master node and set the below parameters.
|
||||
--peer-client-file=</path/to/peer-cert-file>
|
||||
--peer-key-file=</path/to/peer-key-file>
|
||||
|
||||
1.5.5 Edit the etcd pod specification file /etc/kubernetes/manifests/etcd.yaml on the master
|
||||
node and set the below parameter.
|
||||
--peer-client-cert-auth=true
|
||||
|
||||
1.5.7 [Manual test]
|
||||
Follow the etcd documentation and create a dedicated certificate authority setup for the
|
||||
etcd service.
|
||||
@@ -420,7 +321,7 @@ Create a PSP as described in the Kubernetes documentation, ensuring that the .sp
|
||||
|
||||
|
||||
== Summary ==
|
||||
30 checks PASS
|
||||
36 checks FAIL
|
||||
49 checks PASS
|
||||
17 checks FAIL
|
||||
25 checks WARN
|
||||
1 checks INFO
|
||||
4
integration/testdata/job-node.data
vendored
4
integration/testdata/job-node.data
vendored
@@ -1,4 +1,4 @@
|
||||
[INFO] 2 Worker Node Security Configuration
|
||||
[INFO] 2 Worker Node Security Configuration
|
||||
[INFO] 2.1 Kubelet
|
||||
[PASS] 2.1.1 Ensure that the --anonymous-auth argument is set to false (Scored)
|
||||
[PASS] 2.1.2 Ensure that the --authorization-mode argument is not set to AlwaysAllow (Scored)
|
||||
@@ -86,4 +86,4 @@ chown root:root /etc/kubernetes/proxy.conf
|
||||
16 checks PASS
|
||||
7 checks FAIL
|
||||
0 checks WARN
|
||||
1 checks INFO
|
||||
1 checks INFO
|
||||
|
||||
141
integration/testdata/job.data
vendored
141
integration/testdata/job.data
vendored
@@ -5,7 +5,7 @@
|
||||
[PASS] 1.1.3 Ensure that the --insecure-allow-any-token argument is not set (Not Scored)
|
||||
[PASS] 1.1.4 Ensure that the --kubelet-https argument is set to true (Scored)
|
||||
[PASS] 1.1.5 Ensure that the --insecure-bind-address argument is not set (Scored)
|
||||
[FAIL] 1.1.6 Ensure that the --insecure-port argument is set to 0 (Scored)
|
||||
[PASS] 1.1.6 Ensure that the --insecure-port argument is set to 0 (Scored)
|
||||
[PASS] 1.1.7 Ensure that the --secure-port argument is not set to 0 (Scored)
|
||||
[FAIL] 1.1.8 Ensure that the --profiling argument is set to false (Scored)
|
||||
[FAIL] 1.1.9 Ensure that the --repair-malformed-updates argument is set to false (Scored)
|
||||
@@ -18,37 +18,37 @@
|
||||
[FAIL] 1.1.16 Ensure that the --audit-log-maxage argument is set to 30 or as appropriate (Scored)
|
||||
[FAIL] 1.1.17 Ensure that the --audit-log-maxbackup argument is set to 10 or as appropriate (Scored)
|
||||
[FAIL] 1.1.18 Ensure that the --audit-log-maxsize argument is set to 100 or as appropriate (Scored)
|
||||
[FAIL] 1.1.19 Ensure that the --authorization-mode argument is not set to AlwaysAllow (Scored)
|
||||
[PASS] 1.1.19 Ensure that the --authorization-mode argument is not set to AlwaysAllow (Scored)
|
||||
[PASS] 1.1.20 Ensure that the --token-auth-file parameter is not set (Scored)
|
||||
[FAIL] 1.1.21 Ensure that the --kubelet-certificate-authority argument is set as appropriate (Scored)
|
||||
[FAIL] 1.1.22 Ensure that the --kubelet-client-certificate and --kubelet-client-key arguments are set as appropriate (Scored)
|
||||
[PASS] 1.1.22 Ensure that the --kubelet-client-certificate and --kubelet-client-key arguments are set as appropriate (Scored)
|
||||
[PASS] 1.1.23 Ensure that the --service-account-lookup argument is set to true (Scored)
|
||||
[FAIL] 1.1.24 Ensure that the admission control plugin PodSecurityPolicy is set (Scored)
|
||||
[FAIL] 1.1.25 Ensure that the --service-account-key-file argument is set as appropriate (Scored)
|
||||
[FAIL] 1.1.26 Ensure that the --etcd-certfile and --etcd-keyfile arguments are set as appropriate (Scored)
|
||||
[PASS] 1.1.25 Ensure that the --service-account-key-file argument is set as appropriate (Scored)
|
||||
[PASS] 1.1.26 Ensure that the --etcd-certfile and --etcd-keyfile arguments are set as appropriate (Scored)
|
||||
[PASS] 1.1.27 Ensure that the admission control plugin ServiceAccount is set(Scored)
|
||||
[FAIL] 1.1.28 Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate (Scored)
|
||||
[FAIL] 1.1.29 Ensure that the --client-ca-file argument is set as appropriate (Scored)
|
||||
[FAIL] 1.1.30 Ensure that the --etcd-cafile argument is set as appropriate (Scored)
|
||||
[PASS] 1.1.28 Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate (Scored)
|
||||
[PASS] 1.1.29 Ensure that the --client-ca-file argument is set as appropriate (Scored)
|
||||
[PASS] 1.1.30 Ensure that the --etcd-cafile argument is set as appropriate (Scored)
|
||||
[WARN] 1.1.31 Ensure that the API Server only makes use of Strong Cryptographic Ciphers (Not Scored)
|
||||
[FAIL] 1.1.32 Ensure that the --authorization-mode argument is set to Node (Scored)
|
||||
[FAIL] 1.1.33 Ensure that the admission control plugin NodeRestriction is set (Scored)
|
||||
[PASS] 1.1.32 Ensure that the --authorization-mode argument is set to Node (Scored)
|
||||
[PASS] 1.1.33 Ensure that the admission control plugin NodeRestriction is set (Scored)
|
||||
[FAIL] 1.1.34 Ensure that the --encryption-provider-config argument is set as appropriate (Scored)
|
||||
[WARN] 1.1.35 Ensure that the encryption provider is set to aescbc (Scored)
|
||||
[FAIL] 1.1.36 Ensure that the admission control plugin EventRateLimit is set (Scored)
|
||||
[PASS] 1.1.37a Ensure that the AdvancedAuditing argument is not set to false (Scored)
|
||||
[FAIL] 1.1.37b Ensure that the AdvancedAuditing argument is not set to false (Scored)
|
||||
[PASS] 1.1.38 Ensure that the --request-timeout argument is set as appropriate (Scored)
|
||||
[FAIL] 1.1.39 Ensure that the --authorization-mode argument includes RBAC (Scored)
|
||||
[PASS] 1.1.39 Ensure that the --authorization-mode argument includes RBAC (Scored)
|
||||
[INFO] 1.2 Scheduler
|
||||
[FAIL] 1.2.1 Ensure that the --profiling argument is set to false (Scored)
|
||||
[PASS] 1.2.2 Ensure that the --address argument is set to 127.0.0.1 (Scored)
|
||||
[INFO] 1.3 Controller Manager
|
||||
[FAIL] 1.3.1 Ensure that the --terminated-pod-gc-threshold argument is set as appropriate (Scored)
|
||||
[FAIL] 1.3.2 Ensure that the --profiling argument is set to false (Scored)
|
||||
[FAIL] 1.3.3 Ensure that the --use-service-account-credentials argument is set to true (Scored)
|
||||
[FAIL] 1.3.4 Ensure that the --service-account-private-key-file argument is set as appropriate (Scored)
|
||||
[FAIL] 1.3.5 Ensure that the --root-ca-file argument is set as appropriate (Scored)
|
||||
[PASS] 1.3.3 Ensure that the --use-service-account-credentials argument is set to true (Scored)
|
||||
[PASS] 1.3.4 Ensure that the --service-account-private-key-file argument is set as appropriate (Scored)
|
||||
[PASS] 1.3.5 Ensure that the --root-ca-file argument is set as appropriate (Scored)
|
||||
[FAIL] 1.3.6 Ensure that the RotateKubeletServerCertificate argument is set to true (Scored)
|
||||
[PASS] 1.3.7 Ensure that the --address argument is set to 127.0.0.1 (Scored)
|
||||
[INFO] 1.4 Configuration Files
|
||||
@@ -62,7 +62,7 @@
|
||||
[PASS] 1.4.8 Ensure that the etcd pod specification file ownership is set to root:root (Scored)
|
||||
[WARN] 1.4.9 Ensure that the Container Network Interface file permissions are set to 644 or more restrictive (Not Scored)
|
||||
[WARN] 1.4.10 Ensure that the Container Network Interface file ownership is set to root:root (Not Scored)
|
||||
[FAIL] 1.4.11 Ensure that the etcd data directory permissions are set to 700 or more restrictive (Scored)
|
||||
[PASS] 1.4.11 Ensure that the etcd data directory permissions are set to 700 or more restrictive (Scored)
|
||||
[FAIL] 1.4.12 Ensure that the etcd data directory ownership is set to etcd:etcd (Scored)
|
||||
[PASS] 1.4.13 Ensure that the admin.conf file permissions are set to 644 or more restrictive (Scored)
|
||||
[PASS] 1.4.14 Ensure that the admin.conf file ownership is set to root:root (Scored)
|
||||
@@ -74,11 +74,11 @@
|
||||
[WARN] 1.4.20 Ensure that the Kubernetes PKI certificate file permissions are set to 644 or more restrictive (Scored)
|
||||
[WARN] 1.4.21 Ensure that the Kubernetes PKI key file permissions are set to 600 or more restrictive (Scored)
|
||||
[INFO] 1.5 etcd
|
||||
[FAIL] 1.5.1 Ensure that the --cert-file and --key-file arguments are set as appropriate (Scored)
|
||||
[FAIL] 1.5.2 Ensure that the --client-cert-auth argument is set to true (Scored)
|
||||
[PASS] 1.5.1 Ensure that the --cert-file and --key-file arguments are set as appropriate (Scored)
|
||||
[PASS] 1.5.2 Ensure that the --client-cert-auth argument is set to true (Scored)
|
||||
[PASS] 1.5.3 Ensure that the --auto-tls argument is not set to true (Scored)
|
||||
[FAIL] 1.5.4 Ensure that the --peer-cert-file and --peer-key-file arguments are set as appropriate (Scored)
|
||||
[FAIL] 1.5.5 Ensure that the --peer-client-cert-auth argument is set to true (Scored)
|
||||
[PASS] 1.5.4 Ensure that the --peer-cert-file and --peer-key-file arguments are set as appropriate (Scored)
|
||||
[PASS] 1.5.5 Ensure that the --peer-client-cert-auth argument is set to true (Scored)
|
||||
[PASS] 1.5.6 Ensure that the --peer-auto-tls argument is not set to true (Scored)
|
||||
[WARN] 1.5.7 Ensure that a unique Certificate Authority is used for etcd (Not Scored)
|
||||
[INFO] 1.6 General Security Primitives
|
||||
@@ -104,10 +104,6 @@
|
||||
on the master node and set the below parameter.
|
||||
--anonymous-auth=false
|
||||
|
||||
1.1.6 Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml
|
||||
apiserver.yaml on the master node and set the below parameter.
|
||||
--insecure-port=0
|
||||
|
||||
1.1.8 Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml
|
||||
on the master node and set the below parameter.
|
||||
--profiling=false
|
||||
@@ -145,24 +141,12 @@ on the master node and set the --audit-log-maxsize parameter to an
|
||||
appropriate size in MB. For example, to set it as 100 MB:
|
||||
--audit-log-maxsize=100
|
||||
|
||||
1.1.19 Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml
|
||||
on the master node and set the --authorization-mode parameter to
|
||||
values other than AlwaysAllow. One such example could be as below.
|
||||
--authorization-mode=RBAC
|
||||
|
||||
1.1.21 Follow the Kubernetes documentation and setup the TLS connection between the
|
||||
apiserver and kubelets. Then, edit the API server pod specification file
|
||||
/etc/kubernetes/manifests/kube-apiserver.yaml on the master node and set the --kubelet-certificate-authority
|
||||
parameter to the path to the cert file for the certificate authority.
|
||||
--kubelet-certificate-authority=<ca-string>
|
||||
|
||||
1.1.22 Follow the Kubernetes documentation and set up the TLS connection between the
|
||||
apiserver and kubelets. Then, edit API server pod specification file
|
||||
/etc/kubernetes/manifests/kube-apiserver.yaml on the master node and set the
|
||||
kubelet client certificate and key parameters as below.
|
||||
--kubelet-client-certificate=<path/to/client-certificate-file>
|
||||
--kubelet-client-key=<path/to/client-key-file>
|
||||
|
||||
1.1.24 Follow the documentation and create Pod Security Policy objects as per your environment.
|
||||
Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml
|
||||
on the master node and set the --enable-admission-plugins parameter to a
|
||||
@@ -170,51 +154,10 @@ value that includes PodSecurityPolicy :
|
||||
--enable-admission-plugins=...,PodSecurityPolicy,...
|
||||
Then restart the API Server.
|
||||
|
||||
1.1.25 Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml
|
||||
on the master node and set the --service-account-key-file parameter
|
||||
to the public key file for service accounts:
|
||||
--service-account-key-file=<filename>
|
||||
|
||||
1.1.26 Follow the Kubernetes documentation and set up the TLS connection between the
|
||||
apiserver and etcd. Then, edit the API server pod specification file
|
||||
/etc/kubernetes/manifests/kube-apiserver.yaml on the master node and set the etcd
|
||||
certificate and key file parameters.
|
||||
--etcd-certfile=<path/to/client-certificate-file>
|
||||
--etcd-keyfile=<path/to/client-key-file>
|
||||
|
||||
1.1.28 Follow the Kubernetes documentation and set up the TLS connection on the apiserver.
|
||||
Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml
|
||||
on the master node and set the TLS certificate and private key file
|
||||
parameters.
|
||||
--tls-cert-file=<path/to/tls-certificate-file>
|
||||
--tls-private-key-file=<path/to/tls-key-file>
|
||||
|
||||
1.1.29 Follow the Kubernetes documentation and set up the TLS connection on the apiserver.
|
||||
Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml
|
||||
on the master node and set the client certificate authority file.
|
||||
--client-ca-file=<path/to/client-ca-file>
|
||||
|
||||
1.1.30 Follow the Kubernetes documentation and set up the TLS connection between the
|
||||
apiserver and etcd. Then, edit the API server pod specification file
|
||||
/etc/kubernetes/manifests/kube-apiserver.yaml on the master node and set the etcd
|
||||
certificate authority file parameter.
|
||||
--etcd-cafile=<path/to/ca-file>
|
||||
|
||||
1.1.31 Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml
|
||||
on the master node and set the below parameter.
|
||||
--tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256
|
||||
|
||||
1.1.32 Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml
|
||||
on the master node and set the --authorization-mode parameter to a
|
||||
value that includes Node.
|
||||
--authorization-mode=Node,RBAC
|
||||
|
||||
1.1.33 Follow the Kubernetes documentation and configure NodeRestriction plug-in on
|
||||
kubelets. Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml
|
||||
on the master node and set the --enable-admission-plugins parameter to a
|
||||
value that includes NodeRestriction.
|
||||
--enable-admission-plugins=...,NodeRestriction,...
|
||||
|
||||
1.1.34 [Manual test]
|
||||
Follow the Kubernetes documentation and configure a EncryptionConfig file.
|
||||
Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml on the
|
||||
@@ -248,8 +191,6 @@ configuration file. Then, edit the API server pod specification file
|
||||
and set the below parameters.
|
||||
--audit-policy-file=/etc/kubernetes/audit-policy.yaml
|
||||
|
||||
1.1.39 Edit the API server pod specification file kube-apiserver on the master node and set the --authorization-mode parameter to a value that includes RBAC, for example: --authorization-mode=Node,RBAC
|
||||
|
||||
1.2.1 Edit the Scheduler pod specification file /etc/kubernetes/manifests/kube-scheduler.yaml
|
||||
file on the master node and set the below parameter.
|
||||
--profiling=false
|
||||
@@ -262,20 +203,6 @@ on the master node and set the --terminated-pod-gc-threshold to an appropriate t
|
||||
on the master node and set the below parameter.
|
||||
--profiling=false
|
||||
|
||||
1.3.3 Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml
|
||||
on the master node to set the below parameter.
|
||||
--use-service-account-credentials=true
|
||||
|
||||
1.3.4 Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml
|
||||
on the master node and set the --service-account-private-
|
||||
key-file parameter to the private key file for service accounts.
|
||||
--service-account-private-key-file=<filename>
|
||||
|
||||
1.3.5 Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml
|
||||
on the master node and set the --root-ca-file parameter to
|
||||
the certificate bundle file.
|
||||
--root-ca-file=<path/to/file>
|
||||
|
||||
1.3.6 Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml
|
||||
controller-manager.yaml on the master node and set the --feature-gates parameter to
|
||||
include RotateKubeletServerCertificate=true.
|
||||
@@ -291,12 +218,6 @@ Run the below command (based on the file location on your system) on the master
|
||||
For example,
|
||||
chown root:root <path/to/cni/files>
|
||||
|
||||
1.4.11 On the etcd server node, get the etcd data directory, passed as an argument --data-dir ,
|
||||
from the below command:
|
||||
ps -ef | grep etcd
|
||||
Run the below command (based on the etcd data directory found above). For example,
|
||||
chmod 700 /var/lib/etcd
|
||||
|
||||
1.4.12 On the etcd server node, get the etcd data directory, passed as an argument --data-dir ,
|
||||
from the below command:
|
||||
ps -ef | grep etcd
|
||||
@@ -315,26 +236,6 @@ For example, chmod -R 644 /etc/kubernetes/pki/*.crt
|
||||
Run the below command (based on the file location on your system) on the master node.
|
||||
For example, chmod -R 600 /etc/kubernetes/pki/*.key
|
||||
|
||||
1.5.1 Follow the etcd service documentation and configure TLS encryption.
|
||||
Then, edit the etcd pod specification file /etc/kubernetes/manifests/etcd.yaml on the
|
||||
master node and set the below parameters.
|
||||
--ca-file=</path/to/ca-file>
|
||||
--key-file=</path/to/key-file>
|
||||
|
||||
1.5.2 Edit the etcd pod specification file /etc/kubernetes/manifests/etcd.yaml on the master
|
||||
node and set the below parameter.
|
||||
--client-cert-auth="true"
|
||||
|
||||
1.5.4 Follow the etcd service documentation and configure peer TLS encryption as appropriate
|
||||
for your etcd cluster. Then, edit the etcd pod specification file /etc/kubernetes/manifests/etcd.yaml on the
|
||||
master node and set the below parameters.
|
||||
--peer-client-file=</path/to/peer-cert-file>
|
||||
--peer-key-file=</path/to/peer-key-file>
|
||||
|
||||
1.5.5 Edit the etcd pod specification file /etc/kubernetes/manifests/etcd.yaml on the master
|
||||
node and set the below parameter.
|
||||
--peer-client-cert-auth=true
|
||||
|
||||
1.5.7 [Manual test]
|
||||
Follow the etcd documentation and create a dedicated certificate authority setup for the
|
||||
etcd service.
|
||||
@@ -420,8 +321,8 @@ Create a PSP as described in the Kubernetes documentation, ensuring that the .sp
|
||||
|
||||
|
||||
== Summary ==
|
||||
30 checks PASS
|
||||
36 checks FAIL
|
||||
49 checks PASS
|
||||
17 checks FAIL
|
||||
25 checks WARN
|
||||
1 checks INFO
|
||||
[INFO] 2 Worker Node Security Configuration
|
||||
|
||||
@@ -15,10 +15,13 @@ spec:
|
||||
volumeMounts:
|
||||
- name: var-lib-kubelet
|
||||
mountPath: /var/lib/kubelet
|
||||
readOnly: true
|
||||
- name: etc-systemd
|
||||
mountPath: /etc/systemd
|
||||
readOnly: true
|
||||
- name: etc-kubernetes
|
||||
mountPath: /etc/kubernetes
|
||||
readOnly: true
|
||||
restartPolicy: Never
|
||||
volumes:
|
||||
- name: var-lib-kubelet
|
||||
|
||||
31
job-gke.yaml
Normal file
31
job-gke.yaml
Normal file
@@ -0,0 +1,31 @@
|
||||
---
|
||||
apiVersion: batch/v1
|
||||
kind: Job
|
||||
metadata:
|
||||
name: kube-bench
|
||||
spec:
|
||||
template:
|
||||
spec:
|
||||
hostPID: true
|
||||
containers:
|
||||
- name: kube-bench
|
||||
image: aquasec/kube-bench:latest
|
||||
command: ["kube-bench", "--benchmark", "gke-1.0", "run", "--targets", "node,policies,managedservices"]
|
||||
volumeMounts:
|
||||
- name: var-lib-kubelet
|
||||
mountPath: /var/lib/kubelet
|
||||
- name: etc-systemd
|
||||
mountPath: /etc/systemd
|
||||
- name: etc-kubernetes
|
||||
mountPath: /etc/kubernetes
|
||||
restartPolicy: Never
|
||||
volumes:
|
||||
- name: var-lib-kubelet
|
||||
hostPath:
|
||||
path: "/var/lib/kubelet"
|
||||
- name: etc-systemd
|
||||
hostPath:
|
||||
path: "/etc/systemd"
|
||||
- name: etc-kubernetes
|
||||
hostPath:
|
||||
path: "/etc/kubernetes"
|
||||
@@ -14,10 +14,13 @@ spec:
|
||||
volumeMounts:
|
||||
- name: var-lib-kubelet
|
||||
mountPath: /var/lib/kubelet
|
||||
readOnly: true
|
||||
- name: etc-systemd
|
||||
mountPath: /etc/systemd
|
||||
readOnly: true
|
||||
- name: etc-kubernetes
|
||||
mountPath: /etc/kubernetes
|
||||
readOnly: true
|
||||
restartPolicy: Never
|
||||
volumes:
|
||||
- name: var-lib-kubelet
|
||||
|
||||
@@ -20,12 +20,15 @@ spec:
|
||||
volumeMounts:
|
||||
- name: var-lib-etcd
|
||||
mountPath: /var/lib/etcd
|
||||
readOnly: true
|
||||
- name: etc-kubernetes
|
||||
mountPath: /etc/kubernetes
|
||||
# /usr/bin is mounted to access kubectl / kubelet, for auto-detecting the Kubernetes version.
|
||||
readOnly: true
|
||||
# /usr/local/mount-from-host/bin is mounted to access kubectl / kubelet, for auto-detecting the Kubernetes version.
|
||||
# You can omit this mount if you specify --version as part of the command.
|
||||
- name: usr-bin
|
||||
mountPath: /usr/bin
|
||||
mountPath: /usr/local/mount-from-host/bin
|
||||
readOnly: true
|
||||
restartPolicy: Never
|
||||
volumes:
|
||||
- name: var-lib-etcd
|
||||
|
||||
@@ -14,14 +14,18 @@ spec:
|
||||
volumeMounts:
|
||||
- name: var-lib-kubelet
|
||||
mountPath: /var/lib/kubelet
|
||||
readOnly: true
|
||||
- name: etc-systemd
|
||||
mountPath: /etc/systemd
|
||||
readOnly: true
|
||||
- name: etc-kubernetes
|
||||
mountPath: /etc/kubernetes
|
||||
# /usr/bin is mounted to access kubectl / kubelet, for auto-detecting the Kubernetes version.
|
||||
readOnly: true
|
||||
# /usr/local/mount-from-host/bin is mounted to access kubectl / kubelet, for auto-detecting the Kubernetes version.
|
||||
# You can omit this mount if you specify --version as part of the command.
|
||||
- name: usr-bin
|
||||
mountPath: /usr/bin
|
||||
mountPath: /usr/local/mount-from-host/bin
|
||||
readOnly: true
|
||||
restartPolicy: Never
|
||||
volumes:
|
||||
- name: var-lib-kubelet
|
||||
|
||||
9
job.yaml
9
job.yaml
@@ -17,16 +17,21 @@ spec:
|
||||
volumeMounts:
|
||||
- name: var-lib-etcd
|
||||
mountPath: /var/lib/etcd
|
||||
readOnly: true
|
||||
- name: var-lib-kubelet
|
||||
mountPath: /var/lib/kubelet
|
||||
readOnly: true
|
||||
- name: etc-systemd
|
||||
mountPath: /etc/systemd
|
||||
readOnly: true
|
||||
- name: etc-kubernetes
|
||||
mountPath: /etc/kubernetes
|
||||
# /usr/bin is mounted to access kubectl / kubelet, for auto-detecting the Kubernetes version.
|
||||
readOnly: true
|
||||
# /usr/local/mount-from-host/bin is mounted to access kubectl / kubelet, for auto-detecting the Kubernetes version.
|
||||
# You can omit this mount if you specify --version as part of the command.
|
||||
- name: usr-bin
|
||||
mountPath: /usr/bin
|
||||
mountPath: /usr/local/mount-from-host/bin
|
||||
readOnly: true
|
||||
restartPolicy: Never
|
||||
volumes:
|
||||
- name: var-lib-etcd
|
||||
|
||||
Reference in New Issue
Block a user