kube-bench/cfg/config.yaml

---
## Controls Files.
# These are YAML files that hold all the details for running checks.
#
## Uncomment to use different control file paths.
# masterControls: ./cfg/master.yaml
# nodeControls: ./cfg/node.yaml

master:
  components:
    - apiserver
    - scheduler
    - controllermanager
    - etcd
    - flanneld
    # kubernetes is a component to cover the config file /etc/kubernetes/config that is referred to in the benchmark
    - kubernetes

  kubernetes:
    defaultconf: /etc/kubernetes/config

  apiserver:
    bins:
      - "kube-apiserver"
      - "hyperkube apiserver"
      - "hyperkube kube-apiserver"
      - "apiserver"
    confs:
      - /etc/kubernetes/manifests/kube-apiserver.yaml
      - /etc/kubernetes/manifests/kube-apiserver.manifest
      - /var/snap/kube-apiserver/current/args
    defaultconf: /etc/kubernetes/manifests/kube-apiserver.yaml

  scheduler:
    bins:
      - "kube-scheduler"
      - "hyperkube scheduler"
      - "hyperkube kube-scheduler"
      - "scheduler"
    confs:
      - /etc/kubernetes/manifests/kube-scheduler.yaml
      - /etc/kubernetes/manifests/kube-scheduler.manifest
      - /var/snap/kube-scheduler/current/args
    defaultconf: /etc/kubernetes/manifests/kube-scheduler.yaml

  controllermanager:
    bins:
      - "kube-controller-manager"
      - "kube-controller"
      - "hyperkube controller-manager"
      - "hyperkube kube-controller-manager"
      - "controller-manager"
    confs:
      - /etc/kubernetes/manifests/kube-controller-manager.yaml
      - /etc/kubernetes/manifests/kube-controller-manager.manifest
      - /var/snap/kube-controller-manager/current/args
    defaultconf: /etc/kubernetes/manifests/kube-controller-manager.yaml

  etcd:
    optional: true
    bins:
      - "etcd"
    confs:
      - /etc/kubernetes/manifests/etcd.yaml
      - /etc/kubernetes/manifests/etcd.manifest
      - /etc/etcd/etcd.conf
      - /var/snap/etcd/common/etcd.conf.yml
    defaultconf: /etc/kubernetes/manifests/etcd.yaml

  flanneld:
    optional: true
    bins:
      - flanneld
    defaultconf: /etc/sysconfig/flanneld

node:
  components:
    - kubelet
    - proxy
    # kubernetes is a component to cover the config file /etc/kubernetes/config that is referred to in the benchmark
    - kubernetes

  kubernetes:
    defaultconf: "/etc/kubernetes/config"

  kubelet:
    cafile:
      - "/etc/kubernetes/pki/ca.crt"
      - "/etc/kubernetes/certs/ca.crt"
      - "/etc/kubernetes/cert/ca.pem"
    svc: 
      # These paths must also be included
      #  in the 'confs' property below
      - "/etc/systemd/system/kubelet.service.d/10-kubeadm.conf"
      - "/etc/systemd/system/kubelet.service"
      - "/lib/systemd/system/kubelet.service"
      - "/etc/systemd/system/snap.kubelet.daemon.service"
    bins:
      - "hyperkube kubelet"
      - "kubelet"
    kubeconfig:
      - "/etc/kubernetes/kubelet.conf"
      - "/var/lib/kubelet/kubeconfig"
      - "/etc/kubernetes/kubelet-kubeconfig"
    confs:
      - "/var/lib/kubelet/config.yaml"
      - "/etc/kubernetes/kubelet/kubelet-config.json"
      - "/home/kubernetes/kubelet-config.yaml"
      - "/etc/default/kubelet"
      - "/var/lib/kubelet/kubeconfig"
      - "/var/snap/kubelet/current/args"
      ## Due to the fact that the kubelet might be configured
      ## without a kubelet-config file, we use a work-around
      ## of pointing to the systemd service file (which can also
      ## hold kubelet configuration).
      ## Note: The following paths must match the one under 'svc'
      - "/etc/systemd/system/kubelet.service.d/10-kubeadm.conf"
      - "/etc/systemd/system/kubelet.service"
      - "/lib/systemd/system/kubelet.service"
      - "/etc/systemd/system/snap.kubelet.daemon.service"
    defaultconf: "/var/lib/kubelet/config.yaml"
    defaultsvc: "/etc/systemd/system/kubelet.service.d/10-kubeadm.conf"
    defaultkubeconfig: "/etc/kubernetes/kubelet.conf"
    defaultcafile: "/etc/kubernetes/pki/ca.crt"

  proxy:
    optional: true
    bins:
      - "kube-proxy"
      - "hyperkube proxy"
      - "hyperkube kube-proxy"
      - "proxy"
    confs:
      - /etc/kubernetes/proxy
      - /etc/kubernetes/addons/kube-proxy-daemonset.yaml
      - /var/snap/kube-proxy/current/args
    kubeconfig:
      - "/etc/kubernetes/kubelet-kubeconfig"
      - "/var/lib/kubelet/kubeconfig"
    svc:
      - "/lib/systemd/system/kube-proxy.service"
    defaultconf: /etc/kubernetes/addons/kube-proxy-daemonset.yaml
    defaultkubeconfig: "/etc/kubernetes/proxy.conf"

version_mapping:
  "1.11": "cis-1.3"
  "1.12": "cis-1.3"
  "1.13": "cis-1.4"
  "1.14": "cis-1.4"
  "1.15": "cis-1.4"
  "ocp-3.10": "rh-0.7"
  "ocp-3.11": "rh-0.7"
Initial commit 2017-05-26 09:25:29 +00:00			`---`
Update config.yaml to add Azure AKS file locations for kubelet (#383) * testing Azure config locations * "Updated default config.yaml to incorporate Azure AKS file locations for kubelet" * "Adjusted order of new lines. Removed unneeded lines." 2019-08-22 13:52:34 +00:00			`## Controls Files.`
Initial commit 2017-05-26 09:25:29 +00:00			`# These are YAML files that hold all the details for running checks.`
			`#`
			`## Uncomment to use different control file paths.`
No need to run install.sh. Simply clone the project, compile the go app and run ./cis_kubernetes 2017-06-19 21:03:46 +00:00			`# masterControls: ./cfg/master.yaml`
			`# nodeControls: ./cfg/node.yaml`
Initial commit 2017-05-26 09:25:29 +00:00
Update the config file 2017-08-30 17:36:00 +00:00			`master:`
Reorder YAML to make a bit more sense. Allow for optional components, and a config file that we don’t think exists. 2017-08-31 13:45:16 +00:00			`components:`
			`- apiserver`
			`- scheduler`
			`- controllermanager`
Update config.yaml to add Azure AKS file locations for kubelet (#383) * testing Azure config locations * "Updated default config.yaml to incorporate Azure AKS file locations for kubelet" * "Adjusted order of new lines. Removed unneeded lines." 2019-08-22 13:52:34 +00:00			`- etcd`
Reorder YAML to make a bit more sense. Allow for optional components, and a config file that we don’t think exists. 2017-08-31 13:45:16 +00:00			`- flanneld`
Corrections to config file substitutions. Use “kubernetes” as a fake component name so we can more easily substitute “kubernetesconf” 2017-08-31 16:39:40 +00:00			`# kubernetes is a component to cover the config file /etc/kubernetes/config that is referred to in the benchmark`
Reorder YAML to make a bit more sense. Allow for optional components, and a config file that we don’t think exists. 2017-08-31 13:45:16 +00:00			`- kubernetes`

			`kubernetes:`
			`defaultconf: /etc/kubernetes/config`

			`apiserver:`
			`bins:`
Update the config file 2017-08-30 17:36:00 +00:00			`- "kube-apiserver"`
			`- "hyperkube apiserver"`
Update openshift executable config for #236 2019-03-07 11:18:06 +00:00			`- "hyperkube kube-apiserver"`
Update the config file 2017-08-30 17:36:00 +00:00			`- "apiserver"`
Reorder YAML to make a bit more sense. Allow for optional components, and a config file that we don’t think exists. 2017-08-31 13:45:16 +00:00			`confs:`
Config file improvements Correct defaults in main config.yaml file Remove unnecessary overrides in version-specific config.yaml 2019-05-17 13:21:42 +00:00			`- /etc/kubernetes/manifests/kube-apiserver.yaml`
			`- /etc/kubernetes/manifests/kube-apiserver.manifest`
add snap component paths to default config (#414) 2019-10-26 00:19:56 +00:00			`- /var/snap/kube-apiserver/current/args`
Config file improvements Correct defaults in main config.yaml file Remove unnecessary overrides in version-specific config.yaml 2019-05-17 13:21:42 +00:00			`defaultconf: /etc/kubernetes/manifests/kube-apiserver.yaml`
Reorder YAML to make a bit more sense. Allow for optional components, and a config file that we don’t think exists. 2017-08-31 13:45:16 +00:00
			`scheduler:`
			`bins:`
Update the config file 2017-08-30 17:36:00 +00:00			`- "kube-scheduler"`
			`- "hyperkube scheduler"`
Update openshift executable config for #236 2019-03-07 11:18:06 +00:00			`- "hyperkube kube-scheduler"`
Update the config file 2017-08-30 17:36:00 +00:00			`- "scheduler"`
Config file improvements Correct defaults in main config.yaml file Remove unnecessary overrides in version-specific config.yaml 2019-05-17 13:21:42 +00:00			`confs:`
			`- /etc/kubernetes/manifests/kube-scheduler.yaml`
			`- /etc/kubernetes/manifests/kube-scheduler.manifest`
add snap component paths to default config (#414) 2019-10-26 00:19:56 +00:00			`- /var/snap/kube-scheduler/current/args`
Config file improvements Correct defaults in main config.yaml file Remove unnecessary overrides in version-specific config.yaml 2019-05-17 13:21:42 +00:00			`defaultconf: /etc/kubernetes/manifests/kube-scheduler.yaml`
Reorder YAML to make a bit more sense. Allow for optional components, and a config file that we don’t think exists. 2017-08-31 13:45:16 +00:00
			`controllermanager:`
			`bins:`
Update the config file 2017-08-30 17:36:00 +00:00			`- "kube-controller-manager"`
Detect kube-controller in CMD (#326) If kube-controller-manager is getting detected by older versions of procps, it will only be detected if we're looking for kube-controller (15 chars) NOTE: "The command name is not the same as the command line. Previous versions of procps and the kernel truncated this command name to 15 characters. This limitation is no longer present in both. If you depended on matching only 15 characters, you may no longer get a match." 2019-06-28 15:58:23 +00:00			`- "kube-controller"`
Update the config file 2017-08-30 17:36:00 +00:00			`- "hyperkube controller-manager"`
Update openshift executable config for #236 2019-03-07 11:18:06 +00:00			`- "hyperkube kube-controller-manager"`
Update the config file 2017-08-30 17:36:00 +00:00			`- "controller-manager"`
Reorder YAML to make a bit more sense. Allow for optional components, and a config file that we don’t think exists. 2017-08-31 13:45:16 +00:00			`confs:`
Config file improvements Correct defaults in main config.yaml file Remove unnecessary overrides in version-specific config.yaml 2019-05-17 13:21:42 +00:00			`- /etc/kubernetes/manifests/kube-controller-manager.yaml`
			`- /etc/kubernetes/manifests/kube-controller-manager.manifest`
add snap component paths to default config (#414) 2019-10-26 00:19:56 +00:00			`- /var/snap/kube-controller-manager/current/args`
Config file improvements Correct defaults in main config.yaml file Remove unnecessary overrides in version-specific config.yaml 2019-05-17 13:21:42 +00:00			`defaultconf: /etc/kubernetes/manifests/kube-controller-manager.yaml`
Reorder YAML to make a bit more sense. Allow for optional components, and a config file that we don’t think exists. 2017-08-31 13:45:16 +00:00
			`etcd:`
			`optional: true`
			`bins:`
			`- "etcd"`
			`confs:`
Config file improvements Correct defaults in main config.yaml file Remove unnecessary overrides in version-specific config.yaml 2019-05-17 13:21:42 +00:00			`- /etc/kubernetes/manifests/etcd.yaml`
			`- /etc/kubernetes/manifests/etcd.manifest`
Update the config file 2017-08-30 17:36:00 +00:00			`- /etc/etcd/etcd.conf`
add snap component paths to default config (#414) 2019-10-26 00:19:56 +00:00			`- /var/snap/etcd/common/etcd.conf.yml`
Config file improvements Correct defaults in main config.yaml file Remove unnecessary overrides in version-specific config.yaml 2019-05-17 13:21:42 +00:00			`defaultconf: /etc/kubernetes/manifests/etcd.yaml`
Reorder YAML to make a bit more sense. Allow for optional components, and a config file that we don’t think exists. 2017-08-31 13:45:16 +00:00
			`flanneld:`
			`optional: true`
			`bins:`
			`- flanneld`
			`defaultconf: /etc/sysconfig/flanneld`

Update the config file 2017-08-30 17:36:00 +00:00			`node:`
Reorder YAML to make a bit more sense. Allow for optional components, and a config file that we don’t think exists. 2017-08-31 13:45:16 +00:00			`components:`
			`- kubelet`
			`- proxy`
Corrections to config file substitutions. Use “kubernetes” as a fake component name so we can more easily substitute “kubernetesconf” 2017-08-31 16:39:40 +00:00			`# kubernetes is a component to cover the config file /etc/kubernetes/config that is referred to in the benchmark`
			`- kubernetes`

			`kubernetes:`
Update config.yaml to add Azure AKS file locations for kubelet (#383) * testing Azure config locations * "Updated default config.yaml to incorporate Azure AKS file locations for kubelet" * "Adjusted order of new lines. Removed unneeded lines." 2019-08-22 13:52:34 +00:00			`defaultconf: "/etc/kubernetes/config"`
Reorder YAML to make a bit more sense. Allow for optional components, and a config file that we don’t think exists. 2017-08-31 13:45:16 +00:00
			`kubelet:`
issue #234: implement test 2.2.8 (#343) * implement test 2.2.8 * Nit: correct indentation The indentation looked a bit wonky due to spaces vs tabs; hopefully this corrects it 2019-07-10 09:43:15 +00:00			`cafile:`
			`- "/etc/kubernetes/pki/ca.crt"`
Update config.yaml to add Azure AKS file locations for kubelet (#383) * testing Azure config locations * "Updated default config.yaml to incorporate Azure AKS file locations for kubelet" * "Adjusted order of new lines. Removed unneeded lines." 2019-08-22 13:52:34 +00:00			`- "/etc/kubernetes/certs/ca.crt"`
fixes issue #386 (#397) * fixes issue #386 * Correct typo 2019-08-28 08:27:56 +00:00			`- "/etc/kubernetes/cert/ca.pem"`
			`svc:`
			`# These paths must also be included`
			`# in the 'confs' property below`
Update config.yaml to add Azure AKS file locations for kubelet (#383) * testing Azure config locations * "Updated default config.yaml to incorporate Azure AKS file locations for kubelet" * "Adjusted order of new lines. Removed unneeded lines." 2019-08-22 13:52:34 +00:00			`- "/etc/systemd/system/kubelet.service.d/10-kubeadm.conf"`
			`- "/etc/systemd/system/kubelet.service"`
fixes issue #386 (#397) * fixes issue #386 * Correct typo 2019-08-28 08:27:56 +00:00			`- "/lib/systemd/system/kubelet.service"`
add snap component paths to default config (#414) 2019-10-26 00:19:56 +00:00			`- "/etc/systemd/system/snap.kubelet.daemon.service"`
Reorder YAML to make a bit more sense. Allow for optional components, and a config file that we don’t think exists. 2017-08-31 13:45:16 +00:00			`bins:`
Update the config file 2017-08-30 17:36:00 +00:00			`- "hyperkube kubelet"`
			`- "kubelet"`
Update config.yaml to add Azure AKS file locations for kubelet (#383) * testing Azure config locations * "Updated default config.yaml to incorporate Azure AKS file locations for kubelet" * "Adjusted order of new lines. Removed unneeded lines." 2019-08-22 13:52:34 +00:00			`kubeconfig:`
			`- "/etc/kubernetes/kubelet.conf"`
			`- "/var/lib/kubelet/kubeconfig"`
fixes issue #386 (#397) * fixes issue #386 * Correct typo 2019-08-28 08:27:56 +00:00			`- "/etc/kubernetes/kubelet-kubeconfig"`
Moving more config into master config file 2019-05-13 17:20:57 +00:00			`confs:`
			`- "/var/lib/kubelet/config.yaml"`
			`- "/etc/kubernetes/kubelet/kubelet-config.json"`
added another kubelet config file to paths, in the main config yaml file. default location for gke cluster 2019-06-04 14:14:43 +00:00			`- "/home/kubernetes/kubelet-config.yaml"`
Update config.yaml to add Azure AKS file locations for kubelet (#383) * testing Azure config locations * "Updated default config.yaml to incorporate Azure AKS file locations for kubelet" * "Adjusted order of new lines. Removed unneeded lines." 2019-08-22 13:52:34 +00:00			`- "/etc/default/kubelet"`
Issue #353: Merges JSON and Exec Params files (#426) * starts fixes #353 * new approach to minize duplications * applied merged yaml files for v1.11 and v1.13 * yaml files json/params merged * fixes to remove double quotes from numbers and booleans * fixed bug * fixed certificate check * removed -json files * changes based on PR review * Update check/check_test.go Yay more tests! Co-Authored-By: Liz Rice <liz@lizrice.com> * changes as PR review * fixed bug when scored check is missing tests * attempt to improve the code * fixed list breaks * removes handleError function * Update check/check.go Accepting suggested log level. Co-Authored-By: Liz Rice <liz@lizrice.com> 2019-10-14 14:37:10 +00:00			`- "/var/lib/kubelet/kubeconfig"`
add snap component paths to default config (#414) 2019-10-26 00:19:56 +00:00			`- "/var/snap/kubelet/current/args"`
fixes issue #386 (#397) * fixes issue #386 * Correct typo 2019-08-28 08:27:56 +00:00			`## Due to the fact that the kubelet might be configured`
			`## without a kubelet-config file, we use a work-around`
			`## of pointing to the systemd service file (which can also`
			`## hold kubelet configuration).`
			`## Note: The following paths must match the one under 'svc'`
			`- "/etc/systemd/system/kubelet.service.d/10-kubeadm.conf"`
			`- "/etc/systemd/system/kubelet.service"`
			`- "/lib/systemd/system/kubelet.service"`
add snap component paths to default config (#414) 2019-10-26 00:19:56 +00:00			`- "/etc/systemd/system/snap.kubelet.daemon.service"`
Add kubeconfig variable substitution for kubelet and proxy. There are checks for the kubeconfig for both kubelet and proxy which the current kube-bench implementation does not check for properly. kube-bench checks the wrong files. This PR adds support for variable substitution for all the config file types are that should be checked in the CIS benchmarks. This PR also fixes a buggy in CIS 1.3.0 check 2.2.9, which checks for ownership of the kubelet config file /var/lib/kubelet/config.yaml but recommends changing ownership of kubelet kubeconfig file /etc/kubernetes/kubelet.conf as remediation. 2019-02-27 22:08:57 +00:00			`defaultconf: "/var/lib/kubelet/config.yaml"`
Fix wrong reference to kubelet.config in node checks. This fix applies to only checks for kubernetes versions 1.8 and 1.11. See https://github.com/aquasecurity/kube-bench/pull/208. 2019-02-27 21:28:02 +00:00			`defaultsvc: "/etc/systemd/system/kubelet.service.d/10-kubeadm.conf"`
Add kubeconfig variable substitution for kubelet and proxy. There are checks for the kubeconfig for both kubelet and proxy which the current kube-bench implementation does not check for properly. kube-bench checks the wrong files. This PR adds support for variable substitution for all the config file types are that should be checked in the CIS benchmarks. This PR also fixes a buggy in CIS 1.3.0 check 2.2.9, which checks for ownership of the kubelet config file /var/lib/kubelet/config.yaml but recommends changing ownership of kubelet kubeconfig file /etc/kubernetes/kubelet.conf as remediation. 2019-02-27 22:08:57 +00:00			`defaultkubeconfig: "/etc/kubernetes/kubelet.conf"`
issue #234: implement test 2.2.8 (#343) * implement test 2.2.8 * Nit: correct indentation The indentation looked a bit wonky due to spaces vs tabs; hopefully this corrects it 2019-07-10 09:43:15 +00:00			`defaultcafile: "/etc/kubernetes/pki/ca.crt"`
Add function to get unit files for kubernetes components. 2017-10-15 12:39:29 +00:00
Reorder YAML to make a bit more sense. Allow for optional components, and a config file that we don’t think exists. 2017-08-31 13:45:16 +00:00			`proxy:`
cfg: Make proxy checks optional (#436) Signed-off-by: Simarpreet Singh <simar@linux.com> 2019-10-08 10:53:39 +00:00			`optional: true`
Reorder YAML to make a bit more sense. Allow for optional components, and a config file that we don’t think exists. 2017-08-31 13:45:16 +00:00			`bins:`
Update the config file 2017-08-30 17:36:00 +00:00			`- "kube-proxy"`
			`- "hyperkube proxy"`
hyperkube v1.15 renamed "proxy" to "kube-proxy" (#400) 2019-08-28 15:53:48 +00:00			`- "hyperkube kube-proxy"`
Update the config file 2017-08-30 17:36:00 +00:00			`- "proxy"`
Reorder YAML to make a bit more sense. Allow for optional components, and a config file that we don’t think exists. 2017-08-31 13:45:16 +00:00			`confs:`
Update the config file 2017-08-30 17:36:00 +00:00			`- /etc/kubernetes/proxy`
			`- /etc/kubernetes/addons/kube-proxy-daemonset.yaml`
add snap component paths to default config (#414) 2019-10-26 00:19:56 +00:00			`- /var/snap/kube-proxy/current/args`
fixes issue #386 (#397) * fixes issue #386 * Correct typo 2019-08-28 08:27:56 +00:00			`kubeconfig:`
Issue #421: Merges PR #422 with master (#523) * Add kubeconfig location of kube-proxy for AKS * Add job for AKS node * Automate ca file permission check * removed job-aks.yaml as other PRs added needed features * fixed integration test due to merge changes 2019-11-27 15:30:29 +00:00			`- "/etc/kubernetes/kubelet-kubeconfig"`
			`- "/var/lib/kubelet/kubeconfig"`
fixes issue #386 (#397) * fixes issue #386 * Correct typo 2019-08-28 08:27:56 +00:00			`svc:`
			`- "/lib/systemd/system/kube-proxy.service"`
Moving more config into master config file 2019-05-13 17:20:57 +00:00			`defaultconf: /etc/kubernetes/addons/kube-proxy-daemonset.yaml`
Fixes Issue 269 - Numbering to use CIS Versions (#511) * starting benchmark flag * Revert "starting benchmark flag" This reverts commit 58fc948626cb2f99a4f26e9cef3675b4d0938176. * fixes issue #269 * add more unit tests * fix bug * Update cmd/common.go Co-Authored-By: Liz Rice <liz@lizrice.com> * fixes as per PR review * fixes as per PR review * adds more tests * fixed tests * changes as per PR Review * changes as per PR Review * updated README * Update README.md Co-Authored-By: Liz Rice <liz@lizrice.com> * Update README.md Co-Authored-By: Liz Rice <liz@lizrice.com> * Update README.md Co-Authored-By: Liz Rice <liz@lizrice.com> * Update README.md Co-Authored-By: Liz Rice <liz@lizrice.com> * changes are per PR review 2019-11-05 21:31:27 +00:00			`defaultkubeconfig: "/etc/kubernetes/proxy.conf"`

			`version_mapping:`
			`"1.11": "cis-1.3"`
			`"1.12": "cis-1.3"`
			`"1.13": "cis-1.4"`
			`"1.14": "cis-1.4"`
			`"1.15": "cis-1.4"`
			`"ocp-3.10": "rh-0.7"`
			`"ocp-3.11": "rh-0.7"`