arno/kube-bench
1
0
Fork 0
mirror of https://github.com/aquasecurity/kube-bench.git synced 2024-12-24 15:38:06 +00:00
Code Issues Releases Wiki Activity
cf305eed74
kube-bench/cfg/config.yaml

241 lines
6.8 KiB
YAML
Raw Normal View History

Initial commit
2017-05-26 09:25:29 +00:00
---
Update config.yaml to add Azure AKS file locations for kubelet (#383) * testing Azure config locations * "Updated default config.yaml to incorporate Azure AKS file locations for kubelet" * "Adjusted order of new lines. Removed unneeded lines."
2019-08-22 13:52:34 +00:00
## Controls Files.
Initial commit
2017-05-26 09:25:29 +00:00
# These are YAML files that hold all the details for running checks.
#
## Uncomment to use different control file paths.
No need to run install.sh. Simply clone the project, compile the go app and run ./cis_kubernetes
2017-06-19 21:03:46 +00:00
# masterControls: ./cfg/master.yaml
# nodeControls: ./cfg/node.yaml
Initial commit
2017-05-26 09:25:29 +00:00
Update the config file
2017-08-30 17:36:00 +00:00
master:
Reorder YAML to make a bit more sense. Allow for optional components, and a config file that we don’t think exists.
2017-08-31 13:45:16 +00:00
components:
- apiserver
- scheduler
- controllermanager
Update config.yaml to add Azure AKS file locations for kubelet (#383) * testing Azure config locations * "Updated default config.yaml to incorporate Azure AKS file locations for kubelet" * "Adjusted order of new lines. Removed unneeded lines."
2019-08-22 13:52:34 +00:00
- etcd
Reorder YAML to make a bit more sense. Allow for optional components, and a config file that we don’t think exists.
2017-08-31 13:45:16 +00:00
- flanneld
Corrections to config file substitutions. Use “kubernetes” as a fake component name so we can more easily substitute “kubernetesconf”
2017-08-31 16:39:40 +00:00
# kubernetes is a component to cover the config file /etc/kubernetes/config that is referred to in the benchmark
Reorder YAML to make a bit more sense. Allow for optional components, and a config file that we don’t think exists.
2017-08-31 13:45:16 +00:00
- kubernetes
kubernetes:
defaultconf: /etc/kubernetes/config
apiserver:
bins:
Update the config file
2017-08-30 17:36:00 +00:00
- "kube-apiserver"
- "hyperkube apiserver"
Update openshift executable config for #236
2019-03-07 11:18:06 +00:00
- "hyperkube kube-apiserver"
Update the config file
2017-08-30 17:36:00 +00:00
- "apiserver"
Reorder YAML to make a bit more sense. Allow for optional components, and a config file that we don’t think exists.
2017-08-31 13:45:16 +00:00
confs:
Config file improvements Correct defaults in main config.yaml file Remove unnecessary overrides in version-specific config.yaml
2019-05-17 13:21:42 +00:00
- /etc/kubernetes/manifests/kube-apiserver.yaml
Support config files which use .yml file extension (#586) Co-authored-by: Roberto Rojas <robertojrojas@gmail.com>
2020-03-03 17:03:21 +00:00
- /etc/kubernetes/manifests/kube-apiserver.yml
Config file improvements Correct defaults in main config.yaml file Remove unnecessary overrides in version-specific config.yaml
2019-05-17 13:21:42 +00:00
- /etc/kubernetes/manifests/kube-apiserver.manifest
add snap component paths to default config (#414)
2019-10-26 00:19:56 +00:00
- /var/snap/kube-apiserver/current/args
Add config paths for microk8s (#556) * Add config paths for microk8s * Fix order for kube-proxy conf path and fix yaml linting issue Co-authored-by: Mathis Kretz <mathis@bespinian.io> Co-authored-by: Liz Rice <liz@lizrice.com>
2020-03-16 12:37:32 +00:00
- /var/snap/microk8s/current/args/kube-apiserver
Config file improvements Correct defaults in main config.yaml file Remove unnecessary overrides in version-specific config.yaml
2019-05-17 13:21:42 +00:00
defaultconf: /etc/kubernetes/manifests/kube-apiserver.yaml
Reorder YAML to make a bit more sense. Allow for optional components, and a config file that we don’t think exists.
2017-08-31 13:45:16 +00:00
scheduler:
bins:
Update the config file
2017-08-30 17:36:00 +00:00
- "kube-scheduler"
- "hyperkube scheduler"
Update openshift executable config for #236
2019-03-07 11:18:06 +00:00
- "hyperkube kube-scheduler"
Update the config file
2017-08-30 17:36:00 +00:00
- "scheduler"
Config file improvements Correct defaults in main config.yaml file Remove unnecessary overrides in version-specific config.yaml
2019-05-17 13:21:42 +00:00
confs:
- /etc/kubernetes/manifests/kube-scheduler.yaml
Support config files which use .yml file extension (#586) Co-authored-by: Roberto Rojas <robertojrojas@gmail.com>
2020-03-03 17:03:21 +00:00
- /etc/kubernetes/manifests/kube-scheduler.yml
Config file improvements Correct defaults in main config.yaml file Remove unnecessary overrides in version-specific config.yaml
2019-05-17 13:21:42 +00:00
- /etc/kubernetes/manifests/kube-scheduler.manifest
add snap component paths to default config (#414)
2019-10-26 00:19:56 +00:00
- /var/snap/kube-scheduler/current/args
Add config paths for microk8s (#556) * Add config paths for microk8s * Fix order for kube-proxy conf path and fix yaml linting issue Co-authored-by: Mathis Kretz <mathis@bespinian.io> Co-authored-by: Liz Rice <liz@lizrice.com>
2020-03-16 12:37:32 +00:00
- /var/snap/microk8s/current/args/kube-scheduler
Config file improvements Correct defaults in main config.yaml file Remove unnecessary overrides in version-specific config.yaml
2019-05-17 13:21:42 +00:00
defaultconf: /etc/kubernetes/manifests/kube-scheduler.yaml
Reorder YAML to make a bit more sense. Allow for optional components, and a config file that we don’t think exists.
2017-08-31 13:45:16 +00:00
controllermanager:
bins:
Update the config file
2017-08-30 17:36:00 +00:00
- "kube-controller-manager"
Detect kube-controller in CMD (#326) If kube-controller-manager is getting detected by older versions of procps, it will only be detected if we're looking for kube-controller (15 chars) NOTE: "The command name is not the same as the command line. Previous versions of procps and the kernel truncated this command name to 15 characters. This limitation is no longer present in both. If you depended on matching only 15 characters, you may no longer get a match."
2019-06-28 15:58:23 +00:00
- "kube-controller"
Update the config file
2017-08-30 17:36:00 +00:00
- "hyperkube controller-manager"
Update openshift executable config for #236
2019-03-07 11:18:06 +00:00
- "hyperkube kube-controller-manager"
Update the config file
2017-08-30 17:36:00 +00:00
- "controller-manager"
Reorder YAML to make a bit more sense. Allow for optional components, and a config file that we don’t think exists.
2017-08-31 13:45:16 +00:00
confs:
Config file improvements Correct defaults in main config.yaml file Remove unnecessary overrides in version-specific config.yaml
2019-05-17 13:21:42 +00:00
- /etc/kubernetes/manifests/kube-controller-manager.yaml
Support config files which use .yml file extension (#586) Co-authored-by: Roberto Rojas <robertojrojas@gmail.com>
2020-03-03 17:03:21 +00:00
- /etc/kubernetes/manifests/kube-controller-manager.yml
Config file improvements Correct defaults in main config.yaml file Remove unnecessary overrides in version-specific config.yaml
2019-05-17 13:21:42 +00:00
- /etc/kubernetes/manifests/kube-controller-manager.manifest
add snap component paths to default config (#414)
2019-10-26 00:19:56 +00:00
- /var/snap/kube-controller-manager/current/args
Add config paths for microk8s (#556) * Add config paths for microk8s * Fix order for kube-proxy conf path and fix yaml linting issue Co-authored-by: Mathis Kretz <mathis@bespinian.io> Co-authored-by: Liz Rice <liz@lizrice.com>
2020-03-16 12:37:32 +00:00
- /var/snap/microk8s/current/args/kube-controller-manager
Config file improvements Correct defaults in main config.yaml file Remove unnecessary overrides in version-specific config.yaml
2019-05-17 13:21:42 +00:00
defaultconf: /etc/kubernetes/manifests/kube-controller-manager.yaml
Reorder YAML to make a bit more sense. Allow for optional components, and a config file that we don’t think exists.
2017-08-31 13:45:16 +00:00
etcd:
optional: true
bins:
- "etcd"
confs:
Config file improvements Correct defaults in main config.yaml file Remove unnecessary overrides in version-specific config.yaml
2019-05-17 13:21:42 +00:00
- /etc/kubernetes/manifests/etcd.yaml
Support config files which use .yml file extension (#586) Co-authored-by: Roberto Rojas <robertojrojas@gmail.com>
2020-03-03 17:03:21 +00:00
- /etc/kubernetes/manifests/etcd.yml
Config file improvements Correct defaults in main config.yaml file Remove unnecessary overrides in version-specific config.yaml
2019-05-17 13:21:42 +00:00
- /etc/kubernetes/manifests/etcd.manifest
Update the config file
2017-08-30 17:36:00 +00:00
- /etc/etcd/etcd.conf
add snap component paths to default config (#414)
2019-10-26 00:19:56 +00:00
- /var/snap/etcd/common/etcd.conf.yml
Support config files which use .yml file extension (#586) Co-authored-by: Roberto Rojas <robertojrojas@gmail.com>
2020-03-03 17:03:21 +00:00
- /var/snap/etcd/common/etcd.conf.yaml
Add config paths for microk8s (#556) * Add config paths for microk8s * Fix order for kube-proxy conf path and fix yaml linting issue Co-authored-by: Mathis Kretz <mathis@bespinian.io> Co-authored-by: Liz Rice <liz@lizrice.com>
2020-03-16 12:37:32 +00:00
- /var/snap/microk8s/current/args/etcd
Config file improvements Correct defaults in main config.yaml file Remove unnecessary overrides in version-specific config.yaml
2019-05-17 13:21:42 +00:00
defaultconf: /etc/kubernetes/manifests/etcd.yaml
Reorder YAML to make a bit more sense. Allow for optional components, and a config file that we don’t think exists.
2017-08-31 13:45:16 +00:00
flanneld:
optional: true
bins:
- flanneld
defaultconf: /etc/sysconfig/flanneld
Update the config file
2017-08-30 17:36:00 +00:00
node:
Reorder YAML to make a bit more sense. Allow for optional components, and a config file that we don’t think exists.
2017-08-31 13:45:16 +00:00
components:
- kubelet
- proxy
Corrections to config file substitutions. Use “kubernetes” as a fake component name so we can more easily substitute “kubernetesconf”
2017-08-31 16:39:40 +00:00
# kubernetes is a component to cover the config file /etc/kubernetes/config that is referred to in the benchmark
- kubernetes
kubernetes:
Update config.yaml to add Azure AKS file locations for kubelet (#383) * testing Azure config locations * "Updated default config.yaml to incorporate Azure AKS file locations for kubelet" * "Adjusted order of new lines. Removed unneeded lines."
2019-08-22 13:52:34 +00:00
defaultconf: "/etc/kubernetes/config"
Reorder YAML to make a bit more sense. Allow for optional components, and a config file that we don’t think exists.
2017-08-31 13:45:16 +00:00
kubelet:
issue #234: implement test 2.2.8 (#343) * implement test 2.2.8 * Nit: correct indentation The indentation looked a bit wonky due to spaces vs tabs; hopefully this corrects it
2019-07-10 09:43:15 +00:00
cafile:
- "/etc/kubernetes/pki/ca.crt"
Update config.yaml to add Azure AKS file locations for kubelet (#383) * testing Azure config locations * "Updated default config.yaml to incorporate Azure AKS file locations for kubelet" * "Adjusted order of new lines. Removed unneeded lines."
2019-08-22 13:52:34 +00:00
- "/etc/kubernetes/certs/ca.crt"
fixes issue #386 (#397) * fixes issue #386 * Correct typo
2019-08-28 08:27:56 +00:00
- "/etc/kubernetes/cert/ca.pem"
Add config paths for microk8s (#556) * Add config paths for microk8s * Fix order for kube-proxy conf path and fix yaml linting issue Co-authored-by: Mathis Kretz <mathis@bespinian.io> Co-authored-by: Liz Rice <liz@lizrice.com>
2020-03-16 12:37:32 +00:00
- "/var/snap/microk8s/current/certs/ca.crt"
Support Linting YAML as part of Travis CI build (#554) * add yamllint command to travis CI installs and runs a linter across the YAML in the project to ensure consistency in the written YAML. this uses yamllint and the default yamllint config with "truthy" and "line-length" disabled. * run dos2unix on CRLF files * YAMLLINT: remove trailing spaces * YAMLLint: add YAML document start * YAMLLint: too many spaces around bracket * YAMLLint: fix indentation * YAMLLint: remove duplicate key * YAMLLint: newline at end of file * YAMLLint: Too few spaces after comma * YAMLLint: too many spaces after colon
2020-01-06 09:18:25 +00:00
svc:
fixes issue #386 (#397) * fixes issue #386 * Correct typo
2019-08-28 08:27:56 +00:00
# These paths must also be included
# in the 'confs' property below
Update config.yaml to add Azure AKS file locations for kubelet (#383) * testing Azure config locations * "Updated default config.yaml to incorporate Azure AKS file locations for kubelet" * "Adjusted order of new lines. Removed unneeded lines."
2019-08-22 13:52:34 +00:00
- "/etc/systemd/system/kubelet.service.d/10-kubeadm.conf"
- "/etc/systemd/system/kubelet.service"
fixes issue #386 (#397) * fixes issue #386 * Correct typo
2019-08-28 08:27:56 +00:00
- "/lib/systemd/system/kubelet.service"
add snap component paths to default config (#414)
2019-10-26 00:19:56 +00:00
- "/etc/systemd/system/snap.kubelet.daemon.service"
Add config paths for microk8s (#556) * Add config paths for microk8s * Fix order for kube-proxy conf path and fix yaml linting issue Co-authored-by: Mathis Kretz <mathis@bespinian.io> Co-authored-by: Liz Rice <liz@lizrice.com>
2020-03-16 12:37:32 +00:00
- "/etc/systemd/system/snap.microk8s.daemon-kubelet.service"
Reorder YAML to make a bit more sense. Allow for optional components, and a config file that we don’t think exists.
2017-08-31 13:45:16 +00:00
bins:
Update the config file
2017-08-30 17:36:00 +00:00
- "hyperkube kubelet"
- "kubelet"
Update config.yaml to add Azure AKS file locations for kubelet (#383) * testing Azure config locations * "Updated default config.yaml to incorporate Azure AKS file locations for kubelet" * "Adjusted order of new lines. Removed unneeded lines."
2019-08-22 13:52:34 +00:00
kubeconfig:
- "/etc/kubernetes/kubelet.conf"
- "/var/lib/kubelet/kubeconfig"
fixes issue #386 (#397) * fixes issue #386 * Correct typo
2019-08-28 08:27:56 +00:00
- "/etc/kubernetes/kubelet-kubeconfig"
Add config paths for microk8s (#556) * Add config paths for microk8s * Fix order for kube-proxy conf path and fix yaml linting issue Co-authored-by: Mathis Kretz <mathis@bespinian.io> Co-authored-by: Liz Rice <liz@lizrice.com>
2020-03-16 12:37:32 +00:00
- "/var/snap/microk8s/current/credentials/kubelet.config"
Moving more config into master config file
2019-05-13 17:20:57 +00:00
confs:
- "/var/lib/kubelet/config.yaml"
Support config files which use .yml file extension (#586) Co-authored-by: Roberto Rojas <robertojrojas@gmail.com>
2020-03-03 17:03:21 +00:00
- "/var/lib/kubelet/config.yml"
Moving more config into master config file
2019-05-13 17:20:57 +00:00
- "/etc/kubernetes/kubelet/kubelet-config.json"
added another kubelet config file to paths, in the main config yaml file. default location for gke cluster
2019-06-04 14:14:43 +00:00
- "/home/kubernetes/kubelet-config.yaml"
Support config files which use .yml file extension (#586) Co-authored-by: Roberto Rojas <robertojrojas@gmail.com>
2020-03-03 17:03:21 +00:00
- "/home/kubernetes/kubelet-config.yml"
Update config.yaml to add Azure AKS file locations for kubelet (#383) * testing Azure config locations * "Updated default config.yaml to incorporate Azure AKS file locations for kubelet" * "Adjusted order of new lines. Removed unneeded lines."
2019-08-22 13:52:34 +00:00
- "/etc/default/kubelet"
Issue #353: Merges JSON and Exec Params files (#426) * starts fixes #353 * new approach to minize duplications * applied merged yaml files for v1.11 and v1.13 * yaml files json/params merged * fixes to remove double quotes from numbers and booleans * fixed bug * fixed certificate check * removed -json files * changes based on PR review * Update check/check_test.go Yay more tests! Co-Authored-By: Liz Rice <liz@lizrice.com> * changes as PR review * fixed bug when scored check is missing tests * attempt to improve the code * fixed list breaks * removes handleError function * Update check/check.go Accepting suggested log level. Co-Authored-By: Liz Rice <liz@lizrice.com>
2019-10-14 14:37:10 +00:00
- "/var/lib/kubelet/kubeconfig"
add snap component paths to default config (#414)
2019-10-26 00:19:56 +00:00
- "/var/snap/kubelet/current/args"
Add config paths for microk8s (#556) * Add config paths for microk8s * Fix order for kube-proxy conf path and fix yaml linting issue Co-authored-by: Mathis Kretz <mathis@bespinian.io> Co-authored-by: Liz Rice <liz@lizrice.com>
2020-03-16 12:37:32 +00:00
- "/var/snap/microk8s/current/args/kubelet"
fixes issue #386 (#397) * fixes issue #386 * Correct typo
2019-08-28 08:27:56 +00:00
## Due to the fact that the kubelet might be configured
## without a kubelet-config file, we use a work-around
## of pointing to the systemd service file (which can also
## hold kubelet configuration).
## Note: The following paths must match the one under 'svc'
- "/etc/systemd/system/kubelet.service.d/10-kubeadm.conf"
- "/etc/systemd/system/kubelet.service"
- "/lib/systemd/system/kubelet.service"
add snap component paths to default config (#414)
2019-10-26 00:19:56 +00:00
- "/etc/systemd/system/snap.kubelet.daemon.service"
Add config paths for microk8s (#556) * Add config paths for microk8s * Fix order for kube-proxy conf path and fix yaml linting issue Co-authored-by: Mathis Kretz <mathis@bespinian.io> Co-authored-by: Liz Rice <liz@lizrice.com>
2020-03-16 12:37:32 +00:00
- "/etc/systemd/system/snap.microk8s.daemon-kubelet.service"
Add kubeconfig variable substitution for kubelet and proxy. There are checks for the kubeconfig for both kubelet and proxy which the current kube-bench implementation does not check for properly. kube-bench checks the wrong files. This PR adds support for variable substitution for all the config file types are that should be checked in the CIS benchmarks. This PR also fixes a buggy in CIS 1.3.0 check 2.2.9, which checks for ownership of the kubelet config file /var/lib/kubelet/config.yaml but recommends changing ownership of kubelet kubeconfig file /etc/kubernetes/kubelet.conf as remediation.
2019-02-27 22:08:57 +00:00
defaultconf: "/var/lib/kubelet/config.yaml"
Fix wrong reference to kubelet.config in node checks. This fix applies to only checks for kubernetes versions 1.8 and 1.11. See https://github.com/aquasecurity/kube-bench/pull/208.
2019-02-27 21:28:02 +00:00
defaultsvc: "/etc/systemd/system/kubelet.service.d/10-kubeadm.conf"
Add kubeconfig variable substitution for kubelet and proxy. There are checks for the kubeconfig for both kubelet and proxy which the current kube-bench implementation does not check for properly. kube-bench checks the wrong files. This PR adds support for variable substitution for all the config file types are that should be checked in the CIS benchmarks. This PR also fixes a buggy in CIS 1.3.0 check 2.2.9, which checks for ownership of the kubelet config file /var/lib/kubelet/config.yaml but recommends changing ownership of kubelet kubeconfig file /etc/kubernetes/kubelet.conf as remediation.
2019-02-27 22:08:57 +00:00
defaultkubeconfig: "/etc/kubernetes/kubelet.conf"
issue #234: implement test 2.2.8 (#343) * implement test 2.2.8 * Nit: correct indentation The indentation looked a bit wonky due to spaces vs tabs; hopefully this corrects it
2019-07-10 09:43:15 +00:00
defaultcafile: "/etc/kubernetes/pki/ca.crt"
Add function to get unit files for kubernetes components.
2017-10-15 12:39:29 +00:00
Reorder YAML to make a bit more sense. Allow for optional components, and a config file that we don’t think exists.
2017-08-31 13:45:16 +00:00
proxy:
cfg: Make proxy checks optional (#436) Signed-off-by: Simarpreet Singh <simar@linux.com>
2019-10-08 10:53:39 +00:00
optional: true
Reorder YAML to make a bit more sense. Allow for optional components, and a config file that we don’t think exists.
2017-08-31 13:45:16 +00:00
bins:
Update the config file
2017-08-30 17:36:00 +00:00
- "kube-proxy"
- "hyperkube proxy"
hyperkube v1.15 renamed "proxy" to "kube-proxy" (#400)
2019-08-28 15:53:48 +00:00
- "hyperkube kube-proxy"
Update the config file
2017-08-30 17:36:00 +00:00
- "proxy"
Reorder YAML to make a bit more sense. Allow for optional components, and a config file that we don’t think exists.
2017-08-31 13:45:16 +00:00
confs:
Update the config file
2017-08-30 17:36:00 +00:00
- /etc/kubernetes/proxy
- /etc/kubernetes/addons/kube-proxy-daemonset.yaml
Support config files which use .yml file extension (#586) Co-authored-by: Roberto Rojas <robertojrojas@gmail.com>
2020-03-03 17:03:21 +00:00
- /etc/kubernetes/addons/kube-proxy-daemonset.yml
add snap component paths to default config (#414)
2019-10-26 00:19:56 +00:00
- /var/snap/kube-proxy/current/args
Add config paths for microk8s (#556) * Add config paths for microk8s * Fix order for kube-proxy conf path and fix yaml linting issue Co-authored-by: Mathis Kretz <mathis@bespinian.io> Co-authored-by: Liz Rice <liz@lizrice.com>
2020-03-16 12:37:32 +00:00
- /var/snap/microk8s/current/args/kube-proxy
fixes issue #386 (#397) * fixes issue #386 * Correct typo
2019-08-28 08:27:56 +00:00
kubeconfig:
Issue #421: Merges PR #422 with master (#523) * Add kubeconfig location of kube-proxy for AKS * Add job for AKS node * Automate ca file permission check * removed job-aks.yaml as other PRs added needed features * fixed integration test due to merge changes
2019-11-27 15:30:29 +00:00
- "/etc/kubernetes/kubelet-kubeconfig"
- "/var/lib/kubelet/kubeconfig"
Add config paths for microk8s (#556) * Add config paths for microk8s * Fix order for kube-proxy conf path and fix yaml linting issue Co-authored-by: Mathis Kretz <mathis@bespinian.io> Co-authored-by: Liz Rice <liz@lizrice.com>
2020-03-16 12:37:32 +00:00
- "/var/snap/microk8s/current/credentials/proxy.config"
fixes issue #386 (#397) * fixes issue #386 * Correct typo
2019-08-28 08:27:56 +00:00
svc:
- "/lib/systemd/system/kube-proxy.service"
Add config paths for microk8s (#556) * Add config paths for microk8s * Fix order for kube-proxy conf path and fix yaml linting issue Co-authored-by: Mathis Kretz <mathis@bespinian.io> Co-authored-by: Liz Rice <liz@lizrice.com>
2020-03-16 12:37:32 +00:00
- "/etc/systemd/system/snap.microk8s.daemon-proxy.service"
Moving more config into master config file
2019-05-13 17:20:57 +00:00
defaultconf: /etc/kubernetes/addons/kube-proxy-daemonset.yaml
Fixes Issue 269 - Numbering to use CIS Versions (#511) * starting benchmark flag * Revert "starting benchmark flag" This reverts commit 58fc948626cb2f99a4f26e9cef3675b4d0938176. * fixes issue #269 * add more unit tests * fix bug * Update cmd/common.go Co-Authored-By: Liz Rice <liz@lizrice.com> * fixes as per PR review * fixes as per PR review * adds more tests * fixed tests * changes as per PR Review * changes as per PR Review * updated README * Update README.md Co-Authored-By: Liz Rice <liz@lizrice.com> * Update README.md Co-Authored-By: Liz Rice <liz@lizrice.com> * Update README.md Co-Authored-By: Liz Rice <liz@lizrice.com> * Update README.md Co-Authored-By: Liz Rice <liz@lizrice.com> * changes are per PR review
2019-11-05 21:31:27 +00:00
defaultkubeconfig: "/etc/kubernetes/proxy.conf"
Fixes Issue #494 - add tests for CIS 1.5 (#530) * Initial commit. * Add master and node config. * Add section 5 of CIS 1.5.1. * Split sections into section files * Fix YAML issues. * adds target translation * adds target translation * adds cis-1.5 mapping * fixed tests * fixes are per PR * fixed intergration test * integration kind test file to appropriate ks8 version * fixed etcd text * fixed README * fixed text * etcd: fixed grep path * etcd: fixes * fixed error message bug * Update README.md Co-Authored-By: Liz Rice <liz@lizrice.com> * Update README.md Co-Authored-By: Liz Rice <liz@lizrice.com> * fixes as per PR review
2019-12-05 20:55:44 +00:00
etcd:
components:
- etcd
Support Linting YAML as part of Travis CI build (#554) * add yamllint command to travis CI installs and runs a linter across the YAML in the project to ensure consistency in the written YAML. this uses yamllint and the default yamllint config with "truthy" and "line-length" disabled. * run dos2unix on CRLF files * YAMLLINT: remove trailing spaces * YAMLLint: add YAML document start * YAMLLint: too many spaces around bracket * YAMLLint: fix indentation * YAMLLint: remove duplicate key * YAMLLint: newline at end of file * YAMLLint: Too few spaces after comma * YAMLLint: too many spaces after colon
2020-01-06 09:18:25 +00:00
Fixes Issue #494 - add tests for CIS 1.5 (#530) * Initial commit. * Add master and node config. * Add section 5 of CIS 1.5.1. * Split sections into section files * Fix YAML issues. * adds target translation * adds target translation * adds cis-1.5 mapping * fixed tests * fixes are per PR * fixed intergration test * integration kind test file to appropriate ks8 version * fixed etcd text * fixed README * fixed text * etcd: fixed grep path * etcd: fixes * fixed error message bug * Update README.md Co-Authored-By: Liz Rice <liz@lizrice.com> * Update README.md Co-Authored-By: Liz Rice <liz@lizrice.com> * fixes as per PR review
2019-12-05 20:55:44 +00:00
etcd:
bins:
- "etcd"
confs:
- /etc/kubernetes/manifests/etcd.yaml
Support config files which use .yml file extension (#586) Co-authored-by: Roberto Rojas <robertojrojas@gmail.com>
2020-03-03 17:03:21 +00:00
- /etc/kubernetes/manifests/etcd.yml
Fixes Issue #494 - add tests for CIS 1.5 (#530) * Initial commit. * Add master and node config. * Add section 5 of CIS 1.5.1. * Split sections into section files * Fix YAML issues. * adds target translation * adds target translation * adds cis-1.5 mapping * fixed tests * fixes are per PR * fixed intergration test * integration kind test file to appropriate ks8 version * fixed etcd text * fixed README * fixed text * etcd: fixed grep path * etcd: fixes * fixed error message bug * Update README.md Co-Authored-By: Liz Rice <liz@lizrice.com> * Update README.md Co-Authored-By: Liz Rice <liz@lizrice.com> * fixes as per PR review
2019-12-05 20:55:44 +00:00
- /etc/kubernetes/manifests/etcd.manifest
- /etc/etcd/etcd.conf
- /var/snap/etcd/common/etcd.conf.yml
Support config files which use .yml file extension (#586) Co-authored-by: Roberto Rojas <robertojrojas@gmail.com>
2020-03-03 17:03:21 +00:00
- /var/snap/etcd/common/etcd.conf.yaml
Add config paths for microk8s (#556) * Add config paths for microk8s * Fix order for kube-proxy conf path and fix yaml linting issue Co-authored-by: Mathis Kretz <mathis@bespinian.io> Co-authored-by: Liz Rice <liz@lizrice.com>
2020-03-16 12:37:32 +00:00
- /var/snap/microk8s/current/args/etcd
Fixes Issue #494 - add tests for CIS 1.5 (#530) * Initial commit. * Add master and node config. * Add section 5 of CIS 1.5.1. * Split sections into section files * Fix YAML issues. * adds target translation * adds target translation * adds cis-1.5 mapping * fixed tests * fixes are per PR * fixed intergration test * integration kind test file to appropriate ks8 version * fixed etcd text * fixed README * fixed text * etcd: fixed grep path * etcd: fixes * fixed error message bug * Update README.md Co-Authored-By: Liz Rice <liz@lizrice.com> * Update README.md Co-Authored-By: Liz Rice <liz@lizrice.com> * fixes as per PR review
2019-12-05 20:55:44 +00:00
defaultconf: /etc/kubernetes/manifests/etcd.yaml
controlplane:
components: []
policies:
components: []
CIS GKE 1.0.0 benchmark (#570) * Add initial commit for CIS GKE 1.0 benchmark * Update README with GKE instructions * Fix YAML linter issues * Set GKE benchmark k8s version to gke-1.0 * Add tests for gke-1.0 Co-authored-by: Roberto Rojas <robertojrojas@gmail.com>
2020-03-03 14:51:48 +00:00
managedservices:
components: []
Fixes Issue #494 - add tests for CIS 1.5 (#530) * Initial commit. * Add master and node config. * Add section 5 of CIS 1.5.1. * Split sections into section files * Fix YAML issues. * adds target translation * adds target translation * adds cis-1.5 mapping * fixed tests * fixes are per PR * fixed intergration test * integration kind test file to appropriate ks8 version * fixed etcd text * fixed README * fixed text * etcd: fixed grep path * etcd: fixes * fixed error message bug * Update README.md Co-Authored-By: Liz Rice <liz@lizrice.com> * Update README.md Co-Authored-By: Liz Rice <liz@lizrice.com> * fixes as per PR review
2019-12-05 20:55:44 +00:00
Fixes Issue 269 - Numbering to use CIS Versions (#511) * starting benchmark flag * Revert "starting benchmark flag" This reverts commit 58fc948626cb2f99a4f26e9cef3675b4d0938176. * fixes issue #269 * add more unit tests * fix bug * Update cmd/common.go Co-Authored-By: Liz Rice <liz@lizrice.com> * fixes as per PR review * fixes as per PR review * adds more tests * fixed tests * changes as per PR Review * changes as per PR Review * updated README * Update README.md Co-Authored-By: Liz Rice <liz@lizrice.com> * Update README.md Co-Authored-By: Liz Rice <liz@lizrice.com> * Update README.md Co-Authored-By: Liz Rice <liz@lizrice.com> * Update README.md Co-Authored-By: Liz Rice <liz@lizrice.com> * changes are per PR review
2019-11-05 21:31:27 +00:00
version_mapping:
"1.11": "cis-1.3"
"1.12": "cis-1.3"
"1.13": "cis-1.4"
"1.14": "cis-1.4"
Fixes Issue #494 - add tests for CIS 1.5 (#530) * Initial commit. * Add master and node config. * Add section 5 of CIS 1.5.1. * Split sections into section files * Fix YAML issues. * adds target translation * adds target translation * adds cis-1.5 mapping * fixed tests * fixes are per PR * fixed intergration test * integration kind test file to appropriate ks8 version * fixed etcd text * fixed README * fixed text * etcd: fixed grep path * etcd: fixes * fixed error message bug * Update README.md Co-Authored-By: Liz Rice <liz@lizrice.com> * Update README.md Co-Authored-By: Liz Rice <liz@lizrice.com> * fixes as per PR review
2019-12-05 20:55:44 +00:00
"1.15": "cis-1.5"
Add cis 1.6 (#678) * Add new cis version yamls Add new cis version yamls * Add new cis version yamls * Add cis-1.6 to versions table * support version mapping cis-1.6 * support version mapping cis-1.6 * Update controlplane.yaml * Update etcd.yaml * Update node.yaml * Update policies.yaml * Create job.data * Create job-node.data * Create job-master.data * Create add-tls-kind.yaml * Change node version to 1.15.0 * Add tests for cis-1.6 * Delete node_only.yaml * Change tests 1.1.19-1.1.21 Change 1.1.19-1.1.21 because failing tests * Update job.data * Update job-master.data * Update job-master.data * Update job.data * fix 1.2.35 remediation tabs instead of spaces * Update job-master.data * Remove extra space * Update job.data * Create node_only.yaml * Add tests for cis-1.6 Add tests for cis-1.6 and change some from 1,5 to 1.6 * Fix typo * Add mapping for cis-1.6 * Remove extra space in 1.2.35 remediation * Update job.data * Update job-master.data * Fix type 1.2.35 * Remove trailing spaces * Remove trailing spaces * Remove trailing spaces * Remove trailing spaces * Add version 1.19 kubernetes support * Add version 1.19 kubernetes support * Add version 1.19 kubernetes support
2020-09-17 15:54:43 +00:00
"1.16": "cis-1.6"
"1.17": "cis-1.6"
"1.18": "cis-1.6"
"1.19": "cis-1.6"
Add mappings for eks-1.0 and Kubernetes 1.18 (#654) Allows user to specify either `--version` or `--benchmark-version` as `eks-1.0` Allows user to specify (or auto-detect K8s version 1.18) and get the CIS 1.5 benchmark
2020-08-03 19:38:37 +00:00
"eks-1.0": "eks-1.0"
CIS GKE 1.0.0 benchmark (#570) * Add initial commit for CIS GKE 1.0 benchmark * Update README with GKE instructions * Fix YAML linter issues * Set GKE benchmark k8s version to gke-1.0 * Add tests for gke-1.0 Co-authored-by: Roberto Rojas <robertojrojas@gmail.com>
2020-03-03 14:51:48 +00:00
"gke-1.0": "gke-1.0"
Fixes Issue 269 - Numbering to use CIS Versions (#511) * starting benchmark flag * Revert "starting benchmark flag" This reverts commit 58fc948626cb2f99a4f26e9cef3675b4d0938176. * fixes issue #269 * add more unit tests * fix bug * Update cmd/common.go Co-Authored-By: Liz Rice <liz@lizrice.com> * fixes as per PR review * fixes as per PR review * adds more tests * fixed tests * changes as per PR Review * changes as per PR Review * updated README * Update README.md Co-Authored-By: Liz Rice <liz@lizrice.com> * Update README.md Co-Authored-By: Liz Rice <liz@lizrice.com> * Update README.md Co-Authored-By: Liz Rice <liz@lizrice.com> * Update README.md Co-Authored-By: Liz Rice <liz@lizrice.com> * changes are per PR review
2019-11-05 21:31:27 +00:00
"ocp-3.10": "rh-0.7"
Openshift configs (#526) * Adds openshift to autodetect node type * detect okd node units
2019-12-09 14:07:44 +00:00
"ocp-3.11": "rh-0.7"
move target mapping to config.yaml - updated version (#682) * move target mapping to config.yaml * Update config.yaml * Update common.go * Add support for eks-1.0 Add also eks-1.0 to map * chore: merge correction * Move file only used for testing * Tidier logs * Add target mapping for GKE and EKS * fingers cross this finishes target mapping Co-authored-by: Murali Paluru <leodotcloud@gmail.com> Co-authored-by: Roberto Rojas <robertojrojas@gmail.com> Co-authored-by: yoavrotems <yoavrotems97@gmail.com>
2020-08-30 07:16:21 +00:00
target_mapping:
"cis-1.3":
- "master"
- "node"
"cis-1.4":
- "master"
- "node"
"cis-1.5":
- "master"
- "node"
- "controlplane"
- "etcd"
- "policies"
Add cis 1.6 (#678) * Add new cis version yamls Add new cis version yamls * Add new cis version yamls * Add cis-1.6 to versions table * support version mapping cis-1.6 * support version mapping cis-1.6 * Update controlplane.yaml * Update etcd.yaml * Update node.yaml * Update policies.yaml * Create job.data * Create job-node.data * Create job-master.data * Create add-tls-kind.yaml * Change node version to 1.15.0 * Add tests for cis-1.6 * Delete node_only.yaml * Change tests 1.1.19-1.1.21 Change 1.1.19-1.1.21 because failing tests * Update job.data * Update job-master.data * Update job-master.data * Update job.data * fix 1.2.35 remediation tabs instead of spaces * Update job-master.data * Remove extra space * Update job.data * Create node_only.yaml * Add tests for cis-1.6 Add tests for cis-1.6 and change some from 1,5 to 1.6 * Fix typo * Add mapping for cis-1.6 * Remove extra space in 1.2.35 remediation * Update job.data * Update job-master.data * Fix type 1.2.35 * Remove trailing spaces * Remove trailing spaces * Remove trailing spaces * Remove trailing spaces * Add version 1.19 kubernetes support * Add version 1.19 kubernetes support * Add version 1.19 kubernetes support
2020-09-17 15:54:43 +00:00
"cis-1.6":
- "master"
- "node"
- "controlplane"
- "etcd"
- "policies"
move target mapping to config.yaml - updated version (#682) * move target mapping to config.yaml * Update config.yaml * Update common.go * Add support for eks-1.0 Add also eks-1.0 to map * chore: merge correction * Move file only used for testing * Tidier logs * Add target mapping for GKE and EKS * fingers cross this finishes target mapping Co-authored-by: Murali Paluru <leodotcloud@gmail.com> Co-authored-by: Roberto Rojas <robertojrojas@gmail.com> Co-authored-by: yoavrotems <yoavrotems97@gmail.com>
2020-08-30 07:16:21 +00:00
"gke-1.0":
- "master"
- "node"
- "controlplane"
- "etcd"
- "policies"
- "managedservices"
"eks-1.0":
- "master"
- "node"
- "controlplane"
- "policies"
- "managedservices"
"rh-0.7":
- "master"
- "node"
Reference in New Issue Copy Permalink