kube-bench/cfg/config.yaml

---
## Controls Files. 
# These are YAML files that hold all the details for running checks.
#
## Uncomment to use different control file paths.
# masterControls: ./cfg/master.yaml
# nodeControls: ./cfg/node.yaml
# federatedControls: ./cfg/federated.yaml

master:
  components:
    - apiserver
    - scheduler
    - controllermanager
    - etcd 
    - flanneld
    # kubernetes is a component to cover the config file /etc/kubernetes/config that is referred to in the benchmark
    - kubernetes

  kubernetes:
    defaultconf: /etc/kubernetes/config

  apiserver:
    bins:
      - "kube-apiserver"
      - "hyperkube apiserver"
      - "hyperkube kube-apiserver"
      - "apiserver"
    confs:
      - /etc/kubernetes/apiserver.conf
      - /etc/kubernetes/apiserver
    defaultconf: /etc/kubernetes/apiserver

  scheduler:
    bins:
      - "kube-scheduler"
      - "hyperkube scheduler"
      - "hyperkube kube-scheduler"
      - "scheduler"
    confs: 
      - /etc/kubernetes/scheduler.conf
      - /etc/kubernetes/scheduler
    defaultconf: /etc/kubernetes/scheduler

  controllermanager:
    bins:
      - "kube-controller-manager"
      - "hyperkube controller-manager"
      - "hyperkube kube-controller-manager"
      - "controller-manager"
    confs:
      - /etc/kubernetes/controller-manager.conf
      - /etc/kubernetes/controller-manager
    defaultconf: /etc/kubernetes/controller-manager

  etcd:
    optional: true
    bins:
      - "etcd"
    confs:
      - /etc/etcd/etcd.conf
    defaultconf: /etc/etcd/etcd.conf

  flanneld:
    optional: true
    bins:
      - flanneld
    defaultconf: /etc/sysconfig/flanneld

node:
  components:
    - kubelet
    - proxy
    # kubernetes is a component to cover the config file /etc/kubernetes/config that is referred to in the benchmark
    - kubernetes

  kubernetes:
    defaultconf: /etc/kubernetes/config    

  kubelet:
    bins:
      - "hyperkube kubelet"
      - "kubelet"
    defaultconf: "/var/lib/kubelet/config.yaml"
    defaultsvc: "/etc/systemd/system/kubelet.service.d/10-kubeadm.conf"
    defaultkubeconfig: "/etc/kubernetes/kubelet.conf"

  proxy:
    bins:
      - "kube-proxy"
      - "hyperkube proxy"
      - "proxy"
    confs:
      - /etc/kubernetes/proxy
      - /etc/kubernetes/addons/kube-proxy-daemonset.yaml
    defaultkubeconfig: "/etc/kubernetes/proxy.conf"

federated:
  components:
    - fedapiserver
    - fedcontrollermanager

  fedapiserver:
    bins:
      - "hyperkube federation-apiserver"
      - "kube-federation-apiserver"
      - "federation-apiserver"

  fedcontrollermanager:
    bins:
      - "hyperkube federation-controller-manager"
      - "kube-federation-controller-manager"
      - "federation-controller-manager"
Initial commit 2017-05-26 09:25:29 +00:00			`---`
			`## Controls Files.`
			`# These are YAML files that hold all the details for running checks.`
			`#`
			`## Uncomment to use different control file paths.`
No need to run install.sh. Simply clone the project, compile the go app and run ./cis_kubernetes 2017-06-19 21:03:46 +00:00			`# masterControls: ./cfg/master.yaml`
			`# nodeControls: ./cfg/node.yaml`
			`# federatedControls: ./cfg/federated.yaml`
Initial commit 2017-05-26 09:25:29 +00:00
Update the config file 2017-08-30 17:36:00 +00:00			`master:`
Reorder YAML to make a bit more sense. Allow for optional components, and a config file that we don’t think exists. 2017-08-31 13:45:16 +00:00			`components:`
			`- apiserver`
			`- scheduler`
			`- controllermanager`
			`- etcd`
			`- flanneld`
Corrections to config file substitutions. Use “kubernetes” as a fake component name so we can more easily substitute “kubernetesconf” 2017-08-31 16:39:40 +00:00			`# kubernetes is a component to cover the config file /etc/kubernetes/config that is referred to in the benchmark`
Reorder YAML to make a bit more sense. Allow for optional components, and a config file that we don’t think exists. 2017-08-31 13:45:16 +00:00			`- kubernetes`

			`kubernetes:`
			`defaultconf: /etc/kubernetes/config`

			`apiserver:`
			`bins:`
Update the config file 2017-08-30 17:36:00 +00:00			`- "kube-apiserver"`
			`- "hyperkube apiserver"`
Update openshift executable config for #236 2019-03-07 11:18:06 +00:00			`- "hyperkube kube-apiserver"`
Update the config file 2017-08-30 17:36:00 +00:00			`- "apiserver"`
Reorder YAML to make a bit more sense. Allow for optional components, and a config file that we don’t think exists. 2017-08-31 13:45:16 +00:00			`confs:`
			`- /etc/kubernetes/apiserver.conf`
			`- /etc/kubernetes/apiserver`
			`defaultconf: /etc/kubernetes/apiserver`

			`scheduler:`
			`bins:`
Update the config file 2017-08-30 17:36:00 +00:00			`- "kube-scheduler"`
			`- "hyperkube scheduler"`
Update openshift executable config for #236 2019-03-07 11:18:06 +00:00			`- "hyperkube kube-scheduler"`
Update the config file 2017-08-30 17:36:00 +00:00			`- "scheduler"`
Reorder YAML to make a bit more sense. Allow for optional components, and a config file that we don’t think exists. 2017-08-31 13:45:16 +00:00			`confs:`
			`- /etc/kubernetes/scheduler.conf`
			`- /etc/kubernetes/scheduler`
			`defaultconf: /etc/kubernetes/scheduler`

			`controllermanager:`
			`bins:`
Update the config file 2017-08-30 17:36:00 +00:00			`- "kube-controller-manager"`
			`- "hyperkube controller-manager"`
Update openshift executable config for #236 2019-03-07 11:18:06 +00:00			`- "hyperkube kube-controller-manager"`
Update the config file 2017-08-30 17:36:00 +00:00			`- "controller-manager"`
Reorder YAML to make a bit more sense. Allow for optional components, and a config file that we don’t think exists. 2017-08-31 13:45:16 +00:00			`confs:`
Update the config file 2017-08-30 17:36:00 +00:00			`- /etc/kubernetes/controller-manager.conf`
			`- /etc/kubernetes/controller-manager`
Reorder YAML to make a bit more sense. Allow for optional components, and a config file that we don’t think exists. 2017-08-31 13:45:16 +00:00			`defaultconf: /etc/kubernetes/controller-manager`

			`etcd:`
			`optional: true`
			`bins:`
			`- "etcd"`
			`confs:`
Update the config file 2017-08-30 17:36:00 +00:00			`- /etc/etcd/etcd.conf`
Reorder YAML to make a bit more sense. Allow for optional components, and a config file that we don’t think exists. 2017-08-31 13:45:16 +00:00			`defaultconf: /etc/etcd/etcd.conf`

			`flanneld:`
			`optional: true`
			`bins:`
			`- flanneld`
			`defaultconf: /etc/sysconfig/flanneld`

Update the config file 2017-08-30 17:36:00 +00:00			`node:`
Reorder YAML to make a bit more sense. Allow for optional components, and a config file that we don’t think exists. 2017-08-31 13:45:16 +00:00			`components:`
			`- kubelet`
			`- proxy`
Corrections to config file substitutions. Use “kubernetes” as a fake component name so we can more easily substitute “kubernetesconf” 2017-08-31 16:39:40 +00:00			`# kubernetes is a component to cover the config file /etc/kubernetes/config that is referred to in the benchmark`
			`- kubernetes`

			`kubernetes:`
			`defaultconf: /etc/kubernetes/config`
Reorder YAML to make a bit more sense. Allow for optional components, and a config file that we don’t think exists. 2017-08-31 13:45:16 +00:00
			`kubelet:`
			`bins:`
Update the config file 2017-08-30 17:36:00 +00:00			`- "hyperkube kubelet"`
			`- "kubelet"`
Add kubeconfig variable substitution for kubelet and proxy. There are checks for the kubeconfig for both kubelet and proxy which the current kube-bench implementation does not check for properly. kube-bench checks the wrong files. This PR adds support for variable substitution for all the config file types are that should be checked in the CIS benchmarks. This PR also fixes a buggy in CIS 1.3.0 check 2.2.9, which checks for ownership of the kubelet config file /var/lib/kubelet/config.yaml but recommends changing ownership of kubelet kubeconfig file /etc/kubernetes/kubelet.conf as remediation. 2019-02-27 22:08:57 +00:00			`defaultconf: "/var/lib/kubelet/config.yaml"`
Fix wrong reference to kubelet.config in node checks. This fix applies to only checks for kubernetes versions 1.8 and 1.11. See https://github.com/aquasecurity/kube-bench/pull/208. 2019-02-27 21:28:02 +00:00			`defaultsvc: "/etc/systemd/system/kubelet.service.d/10-kubeadm.conf"`
Add kubeconfig variable substitution for kubelet and proxy. There are checks for the kubeconfig for both kubelet and proxy which the current kube-bench implementation does not check for properly. kube-bench checks the wrong files. This PR adds support for variable substitution for all the config file types are that should be checked in the CIS benchmarks. This PR also fixes a buggy in CIS 1.3.0 check 2.2.9, which checks for ownership of the kubelet config file /var/lib/kubelet/config.yaml but recommends changing ownership of kubelet kubeconfig file /etc/kubernetes/kubelet.conf as remediation. 2019-02-27 22:08:57 +00:00			`defaultkubeconfig: "/etc/kubernetes/kubelet.conf"`
Add function to get unit files for kubernetes components. 2017-10-15 12:39:29 +00:00
Reorder YAML to make a bit more sense. Allow for optional components, and a config file that we don’t think exists. 2017-08-31 13:45:16 +00:00			`proxy:`
			`bins:`
Update the config file 2017-08-30 17:36:00 +00:00			`- "kube-proxy"`
			`- "hyperkube proxy"`
			`- "proxy"`
Reorder YAML to make a bit more sense. Allow for optional components, and a config file that we don’t think exists. 2017-08-31 13:45:16 +00:00			`confs:`
Update the config file 2017-08-30 17:36:00 +00:00			`- /etc/kubernetes/proxy`
			`- /etc/kubernetes/addons/kube-proxy-daemonset.yaml`
Add kubeconfig variable substitution for kubelet and proxy. There are checks for the kubeconfig for both kubelet and proxy which the current kube-bench implementation does not check for properly. kube-bench checks the wrong files. This PR adds support for variable substitution for all the config file types are that should be checked in the CIS benchmarks. This PR also fixes a buggy in CIS 1.3.0 check 2.2.9, which checks for ownership of the kubelet config file /var/lib/kubelet/config.yaml but recommends changing ownership of kubelet kubeconfig file /etc/kubernetes/kubelet.conf as remediation. 2019-02-27 22:08:57 +00:00			`defaultkubeconfig: "/etc/kubernetes/proxy.conf"`
Move kubernetes binaries and config paths to kube-bench config. 2017-07-13 00:24:09 +00:00
Update the config file 2017-08-30 17:36:00 +00:00			`federated:`
Reorder YAML to make a bit more sense. Allow for optional components, and a config file that we don’t think exists. 2017-08-31 13:45:16 +00:00			`components:`
			`- fedapiserver`
			`- fedcontrollermanager`

			`fedapiserver:`
			`bins:`
Update the config file 2017-08-30 17:36:00 +00:00			`- "hyperkube federation-apiserver"`
			`- "kube-federation-apiserver"`
			`- "federation-apiserver"`
Reorder YAML to make a bit more sense. Allow for optional components, and a config file that we don’t think exists. 2017-08-31 13:45:16 +00:00
			`fedcontrollermanager:`
			`bins:`
Update the config file 2017-08-30 17:36:00 +00:00			`- "hyperkube federation-controller-manager"`
			`- "kube-federation-controller-manager"`
			`- "federation-controller-manager"`