1
0
mirror of https://github.com/aquasecurity/kube-bench.git synced 2024-12-05 22:38:22 +00:00
kube-bench/cfg/tkgi-1.2.53/controlplane.yaml

68 lines
4.2 KiB
YAML
Raw Normal View History

---
controls:
version: "tkgi-1.2.53"
id: 3
text: "Control Plane Configuration"
type: "controlplane"
groups:
- id: 3.1
text: "Authentication and Authorization"
checks:
- id: 3.1.1
text: "Client certificate authentication should not be used for users"
audit: ps -ef | grep kube-apiserver | grep -- "--oidc-issuer-url="
type: "manual"
remediation: |
Alternative mechanisms provided by Kubernetes such as the use of OIDC should be
implemented in place of client certificates.
Exception
This setting is site-specific. It can be set in the "Configure created clusters to use UAA as the OIDC provider."
section of the "UAA"
scored: false
- id: 3.2
text: "Logging"
checks:
- id: 3.2.1
text: "Ensure that a minimal audit policy is created"
audit: ps -ef | grep kube-apiserver | grep -v tini | grep -- "--audit-policy-file="
tests:
test_items:
- flag: "--audit-policy-file"
remediation: |
Create an audit policy file for your cluster.
scored: true
- id: 3.2.2
text: "Ensure that the audit policy covers key security concerns"
audit: |
diff /var/vcap/jobs/kube-apiserver/config/audit_policy.yml \ <(echo "--- apiVersion: audit.k8s.io/v1beta1 kind:
Policy rules: - level: None resources: - group: '' resources: - endpoints - services - services/status users: -
system:kube-proxy verbs: - watch - level: None resources: - group: '' resources: - nodes - nodes/status users: -
kubelet verbs: - get - level: None resources: - group: '' resources: - nodes - nodes/status userGroups: -
system:nodes verbs: - get - level: None namespaces: - kube-system resources: - group: '' resources: -
endpoints users: - system:kube-controller-manager - system:kube-scheduler - system:serviceaccount:kube-
system:endpoint-controller verbs: - get - update - level: None resources: - group: '' resources: - namespaces -
namespaces/status - namespaces/finalize users: - system:apiserver verbs: - get - level: None resources: -
group: metrics.k8s.io users: - system:kube-controller-manager verbs: - get - list - level: None
nonResourceURLs: - \"/healthz*\" - \"/version\" - \"/swagger*\" - level: None resources: - group: '' resources: -
events - level: Request omitStages: - RequestReceived resources: - group: '' resources: - nodes/status -
pods/status userGroups: - system:nodes verbs: - update - patch - level: Request omitStages: -
RequestReceived users: - system:serviceaccount:kube-system:namespace-controller verbs: - deletecollection -
level: Metadata omitStages: - RequestReceived resources: - group: '' resources: - secrets - configmaps - group:
authentication.k8s.io resources: - tokenreviews - level: Request omitStages: - RequestReceived resources: -
group: '' - group: admissionregistration.k8s.io - group: apiextensions.k8s.io - group: apiregistration.k8s.io -
group: apps - group: authentication.k8s.io - group: authorization.k8s.io - group: autoscaling - group: batch -
group: certificates.k8s.io - group: extensions - group: metrics.k8s.io - group: networking.k8s.io - group: policy -
group: rbac.authorization.k8s.io - group: settings.k8s.io - group: storage.k8s.io verbs: - get - list - watch - level:
RequestResponse omitStages: - RequestReceived resources: - group: '' - group: admissionregistration.k8s.io -
group: apiextensions.k8s.io - group: apiregistration.k8s.io - group: apps - group: authentication.k8s.io - group:
authorization.k8s.io - group: autoscaling - group: batch - group: certificates.k8s.io - group: extensions - group:
metrics.k8s.io - group: networking.k8s.io - group: policy - group: rbac.authorization.k8s.io - group:
settings.k8s.io - group: storage.k8s.io - level: Metadata omitStages: - RequestReceived ")
type: "manual"
remediation: |
Consider modification of the audit policy in use on the cluster to include these items, at a
minimum.
scored: false