arno/kube-bench
1
0
Fork 0
mirror of https://github.com/aquasecurity/kube-bench.git synced 2024-11-25 01:18:12 +00:00
Code Issues Releases Wiki Activity
8207532d16
kube-bench/integration/testdata/cis-1.5/job-node.data

71 lines
4.2 KiB
Plaintext
Raw Normal View History

Add integration tests for cis 1.3 and cis 1.5 (#609) * Remove unnecessary whitespaces * Fix a typo * Add integration tests for cis 1.3 and cis 1.5 * Change the timeout of integration tests from 600s to 1200s * Avoid repeated codes
2020-05-20 17:30:52 +00:00
[INFO] 4 Worker Node Security Configuration
[INFO] 4.1 Worker Node Configuration Files
[PASS] 4.1.1 Ensure that the kubelet service file permissions are set to 644 or more restrictive (Scored)
[PASS] 4.1.2 Ensure that the kubelet service file ownership is set to root:root (Scored)
Improve Proxykubeconfig tests (#708) * Changes for 1.5 * Update cis-1.3 through 1.6 to also work with configmaps. * Switch on if proxykubeconfig is set, instead of setting a variable in the script. * permissons -> proxykubeconfig for 2.2.5/4.1.3 to keep these tests locked with 2.2.6/4.1.4 * Updating test output? Maybe? * Copy integration test output files into docker image? * Make entrypoint move integration folder to host, print 1.5 node info. * Change the order of tests in travis to load files before testing. * Return tests to place Those tests comes first since there is more likely to fail with them and then the test will fail "faster" which will save time * Remove copy integration When running in a container we don't need to test, only when build and running in Travis to make sure everything is working fine. * Add $ mark before proxykubeconfig If not having $ before the parameter then it won't get substituted * Add $ mark before proxykubeconfig If not having $ before the parameter then it won't get substituted * Remove test relate lines We don't test while running, only integration testing when building and unit testing * Add spaces * Change 4.1.3 4.1.4 Those tests now should pass. * Change tests 4.1.3 and 4.1.4 Those tests now should PASS * Update job.data with more accurate counts. Thanks to @yoavrotems for getting the project this far! * Thanks for linting, yamllint! Co-authored-by: Yoav Rotem <yoavrotems97@gmail.com>
2020-10-07 18:53:34 +00:00
[PASS] 4.1.3 Ensure that the proxy kubeconfig file permissions are set to 644 or more restrictive (Scored)
[PASS] 4.1.4 Ensure that the proxy kubeconfig file ownership is set to root:root (Scored)
Add integration tests for cis 1.3 and cis 1.5 (#609) * Remove unnecessary whitespaces * Fix a typo * Add integration tests for cis 1.3 and cis 1.5 * Change the timeout of integration tests from 600s to 1200s * Avoid repeated codes
2020-05-20 17:30:52 +00:00
[PASS] 4.1.5 Ensure that the kubelet.conf file permissions are set to 644 or more restrictive (Scored)
[PASS] 4.1.6 Ensure that the kubelet.conf file ownership is set to root:root (Scored)
4.1.7 of cis-1.5 should not be marked as manual (#640) * 4.1.7 of cis-1.5 should not be marked as manual * Making the test posix compliant like #643
2020-07-21 14:32:13 +00:00
[PASS] 4.1.7 Ensure that the certificate authorities file permissions are set to 644 or more restrictive (Scored)
Add integration tests for cis 1.3 and cis 1.5 (#609) * Remove unnecessary whitespaces * Fix a typo * Add integration tests for cis 1.3 and cis 1.5 * Change the timeout of integration tests from 600s to 1200s * Avoid repeated codes
2020-05-20 17:30:52 +00:00
[PASS] 4.1.8 Ensure that the client certificate authorities file ownership is set to root:root (Scored)
[PASS] 4.1.9 Ensure that the kubelet configuration file has permissions set to 644 or more restrictive (Scored)
[PASS] 4.1.10 Ensure that the kubelet configuration file ownership is set to root:root (Scored)
[INFO] 4.2 Kubelet
Support CIS v1.5.1 (#673)
2020-08-12 18:57:51 +00:00
[PASS] 4.2.1 Ensure that the anonymous-auth argument is set to false (Scored)
Add integration tests for cis 1.3 and cis 1.5 (#609) * Remove unnecessary whitespaces * Fix a typo * Add integration tests for cis 1.3 and cis 1.5 * Change the timeout of integration tests from 600s to 1200s * Avoid repeated codes
2020-05-20 17:30:52 +00:00
[PASS] 4.2.2 Ensure that the --authorization-mode argument is not set to AlwaysAllow (Scored)
[PASS] 4.2.3 Ensure that the --client-ca-file argument is set as appropriate (Scored)
Better handling of parameters and config audits (#674) * read-only-port defaults are correct * Tests that should catch good read-only-port * Rework checks & tests * Linting on issue template YAML * More explicit test for 4.2.4
2020-08-12 13:32:42 +00:00
[PASS] 4.2.4 Ensure that the --read-only-port argument is set to 0 (Scored)
Add integration tests for cis 1.3 and cis 1.5 (#609) * Remove unnecessary whitespaces * Fix a typo * Add integration tests for cis 1.3 and cis 1.5 * Change the timeout of integration tests from 600s to 1200s * Avoid repeated codes
2020-05-20 17:30:52 +00:00
[PASS] 4.2.5 Ensure that the --streaming-connection-idle-timeout argument is not set to 0 (Scored)
[FAIL] 4.2.6 Ensure that the --protect-kernel-defaults argument is set to true (Scored)
[PASS] 4.2.7 Ensure that the --make-iptables-util-chains argument is set to true (Scored)
[PASS] 4.2.8 Ensure that the --hostname-override argument is not set (Not Scored)
[WARN] 4.2.9 Ensure that the --event-qps argument is set to 0 or a level which ensures appropriate event capture (Not Scored)
[FAIL] 4.2.10 Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate (Scored)
[PASS] 4.2.11 Ensure that the --rotate-certificates argument is not set to false (Scored)
[FAIL] 4.2.12 Ensure that the RotateKubeletServerCertificate argument is set to true (Scored)
[PASS] 4.2.13 Ensure that the Kubelet only makes use of Strong Cryptographic Ciphers (Not Scored)
== Remediations ==
4.2.6 If using a Kubelet config file, edit the file to set protectKernelDefaults: true.
If using command line arguments, edit the kubelet service file
/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and
set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable.
--protect-kernel-defaults=true
Based on your system, restart the kubelet service. For example:
systemctl daemon-reload
systemctl restart kubelet.service
4.2.9 If using a Kubelet config file, edit the file to set eventRecordQPS: to an appropriate level.
If using command line arguments, edit the kubelet service file
/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and
set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable.
Based on your system, restart the kubelet service. For example:
systemctl daemon-reload
systemctl restart kubelet.service
4.2.10 If using a Kubelet config file, edit the file to set tlsCertFile to the location
of the certificate file to use to identify this Kubelet, and tlsPrivateKeyFile
to the location of the corresponding private key file.
If using command line arguments, edit the kubelet service file
/etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and
set the below parameters in KUBELET_CERTIFICATE_ARGS variable.
--tls-cert-file=<path/to/tls-certificate-file>
--tls-private-key-file=<path/to/tls-key-file>
Based on your system, restart the kubelet service. For example:
systemctl daemon-reload
systemctl restart kubelet.service
4.2.12 Edit the kubelet service file /etc/systemd/system/kubelet.service.d/10-kubeadm.conf
on each worker node and set the below parameter in KUBELET_CERTIFICATE_ARGS variable.
--feature-gates=RotateKubeletServerCertificate=true
Based on your system, restart the kubelet service. For example:
systemctl daemon-reload
systemctl restart kubelet.service
== Summary ==
Improve Proxykubeconfig tests (#708) * Changes for 1.5 * Update cis-1.3 through 1.6 to also work with configmaps. * Switch on if proxykubeconfig is set, instead of setting a variable in the script. * permissons -> proxykubeconfig for 2.2.5/4.1.3 to keep these tests locked with 2.2.6/4.1.4 * Updating test output? Maybe? * Copy integration test output files into docker image? * Make entrypoint move integration folder to host, print 1.5 node info. * Change the order of tests in travis to load files before testing. * Return tests to place Those tests comes first since there is more likely to fail with them and then the test will fail "faster" which will save time * Remove copy integration When running in a container we don't need to test, only when build and running in Travis to make sure everything is working fine. * Add $ mark before proxykubeconfig If not having $ before the parameter then it won't get substituted * Add $ mark before proxykubeconfig If not having $ before the parameter then it won't get substituted * Remove test relate lines We don't test while running, only integration testing when building and unit testing * Add spaces * Change 4.1.3 4.1.4 Those tests now should pass. * Change tests 4.1.3 and 4.1.4 Those tests now should PASS * Update job.data with more accurate counts. Thanks to @yoavrotems for getting the project this far! * Thanks for linting, yamllint! Co-authored-by: Yoav Rotem <yoavrotems97@gmail.com>
2020-10-07 18:53:34 +00:00
19 checks PASS
3 checks FAIL
4.1.7 of cis-1.5 should not be marked as manual (#640) * 4.1.7 of cis-1.5 should not be marked as manual * Making the test posix compliant like #643
2020-07-21 14:32:13 +00:00
1 checks WARN
Add integration tests for cis 1.3 and cis 1.5 (#609) * Remove unnecessary whitespaces * Fix a typo * Add integration tests for cis 1.3 and cis 1.5 * Change the timeout of integration tests from 600s to 1200s * Avoid repeated codes
2020-05-20 17:30:52 +00:00
0 checks INFO
Reference in New Issue Copy Permalink