arno/kube-bench
1
0
Fork 0
mirror of https://github.com/aquasecurity/kube-bench.git synced 2024-12-02 04:48:14 +00:00
Code Issues Releases Wiki Activity
dab5e92bb5
kube-bench/cfg/config.yaml

125 lines
3.3 KiB
YAML
Raw Normal View History

Initial commit
2017-05-26 09:25:29 +00:00
---
## Controls Files.
# These are YAML files that hold all the details for running checks.
#
## Uncomment to use different control file paths.
No need to run install.sh. Simply clone the project, compile the go app and run ./cis_kubernetes
2017-06-19 21:03:46 +00:00
# masterControls: ./cfg/master.yaml
# nodeControls: ./cfg/node.yaml
# federatedControls: ./cfg/federated.yaml
Initial commit
2017-05-26 09:25:29 +00:00
Update the config file
2017-08-30 17:36:00 +00:00
master:
Reorder YAML to make a bit more sense. Allow for optional components, and a config file that we don’t think exists.
2017-08-31 13:45:16 +00:00
components:
- apiserver
- scheduler
- controllermanager
- etcd
- flanneld
Corrections to config file substitutions. Use “kubernetes” as a fake component name so we can more easily substitute “kubernetesconf”
2017-08-31 16:39:40 +00:00
# kubernetes is a component to cover the config file /etc/kubernetes/config that is referred to in the benchmark
Reorder YAML to make a bit more sense. Allow for optional components, and a config file that we don’t think exists.
2017-08-31 13:45:16 +00:00
- kubernetes
kubernetes:
defaultconf: /etc/kubernetes/config
apiserver:
bins:
Update the config file
2017-08-30 17:36:00 +00:00
- "kube-apiserver"
- "hyperkube apiserver"
Update openshift executable config for #236
2019-03-07 11:18:06 +00:00
- "hyperkube kube-apiserver"
Update the config file
2017-08-30 17:36:00 +00:00
- "apiserver"
Reorder YAML to make a bit more sense. Allow for optional components, and a config file that we don’t think exists.
2017-08-31 13:45:16 +00:00
confs:
Config file improvements Correct defaults in main config.yaml file Remove unnecessary overrides in version-specific config.yaml
2019-05-17 13:21:42 +00:00
- /etc/kubernetes/manifests/kube-apiserver.yaml
- /etc/kubernetes/manifests/kube-apiserver.manifest
defaultconf: /etc/kubernetes/manifests/kube-apiserver.yaml
Reorder YAML to make a bit more sense. Allow for optional components, and a config file that we don’t think exists.
2017-08-31 13:45:16 +00:00
scheduler:
bins:
Update the config file
2017-08-30 17:36:00 +00:00
- "kube-scheduler"
- "hyperkube scheduler"
Update openshift executable config for #236
2019-03-07 11:18:06 +00:00
- "hyperkube kube-scheduler"
Update the config file
2017-08-30 17:36:00 +00:00
- "scheduler"
Config file improvements Correct defaults in main config.yaml file Remove unnecessary overrides in version-specific config.yaml
2019-05-17 13:21:42 +00:00
confs:
- /etc/kubernetes/manifests/kube-scheduler.yaml
- /etc/kubernetes/manifests/kube-scheduler.manifest
defaultconf: /etc/kubernetes/manifests/kube-scheduler.yaml
Reorder YAML to make a bit more sense. Allow for optional components, and a config file that we don’t think exists.
2017-08-31 13:45:16 +00:00
controllermanager:
bins:
Update the config file
2017-08-30 17:36:00 +00:00
- "kube-controller-manager"
Detect kube-controller in CMD (#326) If kube-controller-manager is getting detected by older versions of procps, it will only be detected if we're looking for kube-controller (15 chars) NOTE: "The command name is not the same as the command line. Previous versions of procps and the kernel truncated this command name to 15 characters. This limitation is no longer present in both. If you depended on matching only 15 characters, you may no longer get a match."
2019-06-28 15:58:23 +00:00
- "kube-controller"
Update the config file
2017-08-30 17:36:00 +00:00
- "hyperkube controller-manager"
Update openshift executable config for #236
2019-03-07 11:18:06 +00:00
- "hyperkube kube-controller-manager"
Update the config file
2017-08-30 17:36:00 +00:00
- "controller-manager"
Reorder YAML to make a bit more sense. Allow for optional components, and a config file that we don’t think exists.
2017-08-31 13:45:16 +00:00
confs:
Config file improvements Correct defaults in main config.yaml file Remove unnecessary overrides in version-specific config.yaml
2019-05-17 13:21:42 +00:00
- /etc/kubernetes/manifests/kube-controller-manager.yaml
- /etc/kubernetes/manifests/kube-controller-manager.manifest
defaultconf: /etc/kubernetes/manifests/kube-controller-manager.yaml
Reorder YAML to make a bit more sense. Allow for optional components, and a config file that we don’t think exists.
2017-08-31 13:45:16 +00:00
etcd:
optional: true
bins:
- "etcd"
confs:
Config file improvements Correct defaults in main config.yaml file Remove unnecessary overrides in version-specific config.yaml
2019-05-17 13:21:42 +00:00
- /etc/kubernetes/manifests/etcd.yaml
- /etc/kubernetes/manifests/etcd.manifest
Update the config file
2017-08-30 17:36:00 +00:00
- /etc/etcd/etcd.conf
Config file improvements Correct defaults in main config.yaml file Remove unnecessary overrides in version-specific config.yaml
2019-05-17 13:21:42 +00:00
defaultconf: /etc/kubernetes/manifests/etcd.yaml
Reorder YAML to make a bit more sense. Allow for optional components, and a config file that we don’t think exists.
2017-08-31 13:45:16 +00:00
flanneld:
optional: true
bins:
- flanneld
defaultconf: /etc/sysconfig/flanneld
Update the config file
2017-08-30 17:36:00 +00:00
node:
Reorder YAML to make a bit more sense. Allow for optional components, and a config file that we don’t think exists.
2017-08-31 13:45:16 +00:00
components:
- kubelet
- proxy
Corrections to config file substitutions. Use “kubernetes” as a fake component name so we can more easily substitute “kubernetesconf”
2017-08-31 16:39:40 +00:00
# kubernetes is a component to cover the config file /etc/kubernetes/config that is referred to in the benchmark
- kubernetes
kubernetes:
defaultconf: /etc/kubernetes/config
Reorder YAML to make a bit more sense. Allow for optional components, and a config file that we don’t think exists.
2017-08-31 13:45:16 +00:00
kubelet:
issue #234: implement test 2.2.8 (#343) * implement test 2.2.8 * Nit: correct indentation The indentation looked a bit wonky due to spaces vs tabs; hopefully this corrects it
2019-07-10 09:43:15 +00:00
cafile:
- "/etc/kubernetes/pki/ca.crt"
Reorder YAML to make a bit more sense. Allow for optional components, and a config file that we don’t think exists.
2017-08-31 13:45:16 +00:00
bins:
Update the config file
2017-08-30 17:36:00 +00:00
- "hyperkube kubelet"
- "kubelet"
Moving more config into master config file
2019-05-13 17:20:57 +00:00
confs:
- "/var/lib/kubelet/config.yaml"
- "/etc/kubernetes/kubelet/kubelet-config.json"
added another kubelet config file to paths, in the main config yaml file. default location for gke cluster
2019-06-04 14:14:43 +00:00
- "/home/kubernetes/kubelet-config.yaml"
Add kubeconfig variable substitution for kubelet and proxy. There are checks for the kubeconfig for both kubelet and proxy which the current kube-bench implementation does not check for properly. kube-bench checks the wrong files. This PR adds support for variable substitution for all the config file types are that should be checked in the CIS benchmarks. This PR also fixes a buggy in CIS 1.3.0 check 2.2.9, which checks for ownership of the kubelet config file /var/lib/kubelet/config.yaml but recommends changing ownership of kubelet kubeconfig file /etc/kubernetes/kubelet.conf as remediation.
2019-02-27 22:08:57 +00:00
defaultconf: "/var/lib/kubelet/config.yaml"
Fix wrong reference to kubelet.config in node checks. This fix applies to only checks for kubernetes versions 1.8 and 1.11. See https://github.com/aquasecurity/kube-bench/pull/208.
2019-02-27 21:28:02 +00:00
defaultsvc: "/etc/systemd/system/kubelet.service.d/10-kubeadm.conf"
Add kubeconfig variable substitution for kubelet and proxy. There are checks for the kubeconfig for both kubelet and proxy which the current kube-bench implementation does not check for properly. kube-bench checks the wrong files. This PR adds support for variable substitution for all the config file types are that should be checked in the CIS benchmarks. This PR also fixes a buggy in CIS 1.3.0 check 2.2.9, which checks for ownership of the kubelet config file /var/lib/kubelet/config.yaml but recommends changing ownership of kubelet kubeconfig file /etc/kubernetes/kubelet.conf as remediation.
2019-02-27 22:08:57 +00:00
defaultkubeconfig: "/etc/kubernetes/kubelet.conf"
issue #234: implement test 2.2.8 (#343) * implement test 2.2.8 * Nit: correct indentation The indentation looked a bit wonky due to spaces vs tabs; hopefully this corrects it
2019-07-10 09:43:15 +00:00
defaultcafile: "/etc/kubernetes/pki/ca.crt"
Add function to get unit files for kubernetes components.
2017-10-15 12:39:29 +00:00
Reorder YAML to make a bit more sense. Allow for optional components, and a config file that we don’t think exists.
2017-08-31 13:45:16 +00:00
proxy:
bins:
Update the config file
2017-08-30 17:36:00 +00:00
- "kube-proxy"
- "hyperkube proxy"
- "proxy"
Reorder YAML to make a bit more sense. Allow for optional components, and a config file that we don’t think exists.
2017-08-31 13:45:16 +00:00
confs:
Update the config file
2017-08-30 17:36:00 +00:00
- /etc/kubernetes/proxy
- /etc/kubernetes/addons/kube-proxy-daemonset.yaml
Moving more config into master config file
2019-05-13 17:20:57 +00:00
defaultconf: /etc/kubernetes/addons/kube-proxy-daemonset.yaml
Add kubeconfig variable substitution for kubelet and proxy. There are checks for the kubeconfig for both kubelet and proxy which the current kube-bench implementation does not check for properly. kube-bench checks the wrong files. This PR adds support for variable substitution for all the config file types are that should be checked in the CIS benchmarks. This PR also fixes a buggy in CIS 1.3.0 check 2.2.9, which checks for ownership of the kubelet config file /var/lib/kubelet/config.yaml but recommends changing ownership of kubelet kubeconfig file /etc/kubernetes/kubelet.conf as remediation.
2019-02-27 22:08:57 +00:00
defaultkubeconfig: "/etc/kubernetes/proxy.conf"
Move kubernetes binaries and config paths to kube-bench config.
2017-07-13 00:24:09 +00:00
Update the config file
2017-08-30 17:36:00 +00:00
federated:
Reorder YAML to make a bit more sense. Allow for optional components, and a config file that we don’t think exists.
2017-08-31 13:45:16 +00:00
components:
- fedapiserver
- fedcontrollermanager
fedapiserver:
bins:
Update the config file
2017-08-30 17:36:00 +00:00
- "hyperkube federation-apiserver"
- "kube-federation-apiserver"
- "federation-apiserver"
Reorder YAML to make a bit more sense. Allow for optional components, and a config file that we don’t think exists.
2017-08-31 13:45:16 +00:00
fedcontrollermanager:
bins:
Update the config file
2017-08-30 17:36:00 +00:00
- "hyperkube federation-controller-manager"
- "kube-federation-controller-manager"
- "federation-controller-manager"
Reference in New Issue Copy Permalink