arno/kube-bench
1
0
Fork 0
mirror of https://github.com/aquasecurity/kube-bench.git synced 2024-12-19 05:08:07 +00:00
Code Issues Releases Wiki Activity
e534392525
kube-bench/cfg/config.yaml

111 lines
2.6 KiB
YAML
Raw Normal View History

Initial commit
2017-05-26 09:25:29 +00:00
---
## Controls Files.
# These are YAML files that hold all the details for running checks.
#
## Uncomment to use different control file paths.
No need to run install.sh. Simply clone the project, compile the go app and run ./cis_kubernetes
2017-06-19 21:03:46 +00:00
# masterControls: ./cfg/master.yaml
# nodeControls: ./cfg/node.yaml
# federatedControls: ./cfg/federated.yaml
Initial commit
2017-05-26 09:25:29 +00:00
Update the config file
2017-08-30 17:36:00 +00:00
master:
Reorder YAML to make a bit more sense. Allow for optional components, and a config file that we don’t think exists.
2017-08-31 13:45:16 +00:00
components:
- apiserver
- scheduler
- controllermanager
- etcd
- flanneld
Corrections to config file substitutions. Use “kubernetes” as a fake component name so we can more easily substitute “kubernetesconf”
2017-08-31 16:39:40 +00:00
# kubernetes is a component to cover the config file /etc/kubernetes/config that is referred to in the benchmark
Reorder YAML to make a bit more sense. Allow for optional components, and a config file that we don’t think exists.
2017-08-31 13:45:16 +00:00
- kubernetes
kubernetes:
defaultconf: /etc/kubernetes/config
apiserver:
bins:
Update the config file
2017-08-30 17:36:00 +00:00
- "kube-apiserver"
- "hyperkube apiserver"
- "apiserver"
Reorder YAML to make a bit more sense. Allow for optional components, and a config file that we don’t think exists.
2017-08-31 13:45:16 +00:00
confs:
- /etc/kubernetes/apiserver.conf
- /etc/kubernetes/apiserver
defaultconf: /etc/kubernetes/apiserver
scheduler:
bins:
Update the config file
2017-08-30 17:36:00 +00:00
- "kube-scheduler"
- "hyperkube scheduler"
- "scheduler"
Reorder YAML to make a bit more sense. Allow for optional components, and a config file that we don’t think exists.
2017-08-31 13:45:16 +00:00
confs:
- /etc/kubernetes/scheduler.conf
- /etc/kubernetes/scheduler
defaultconf: /etc/kubernetes/scheduler
controllermanager:
bins:
Update the config file
2017-08-30 17:36:00 +00:00
- "kube-controller-manager"
- "hyperkube controller-manager"
- "controller-manager"
Reorder YAML to make a bit more sense. Allow for optional components, and a config file that we don’t think exists.
2017-08-31 13:45:16 +00:00
confs:
Update the config file
2017-08-30 17:36:00 +00:00
- /etc/kubernetes/controller-manager.conf
- /etc/kubernetes/controller-manager
Reorder YAML to make a bit more sense. Allow for optional components, and a config file that we don’t think exists.
2017-08-31 13:45:16 +00:00
defaultconf: /etc/kubernetes/controller-manager
etcd:
optional: true
bins:
- "etcd"
confs:
Update the config file
2017-08-30 17:36:00 +00:00
- /etc/etcd/etcd.conf
Reorder YAML to make a bit more sense. Allow for optional components, and a config file that we don’t think exists.
2017-08-31 13:45:16 +00:00
defaultconf: /etc/etcd/etcd.conf
flanneld:
optional: true
bins:
- flanneld
defaultconf: /etc/sysconfig/flanneld
Update the config file
2017-08-30 17:36:00 +00:00
node:
Reorder YAML to make a bit more sense. Allow for optional components, and a config file that we don’t think exists.
2017-08-31 13:45:16 +00:00
components:
- kubelet
- proxy
Corrections to config file substitutions. Use “kubernetes” as a fake component name so we can more easily substitute “kubernetesconf”
2017-08-31 16:39:40 +00:00
# kubernetes is a component to cover the config file /etc/kubernetes/config that is referred to in the benchmark
- kubernetes
kubernetes:
defaultconf: /etc/kubernetes/config
Reorder YAML to make a bit more sense. Allow for optional components, and a config file that we don’t think exists.
2017-08-31 13:45:16 +00:00
kubelet:
bins:
Update the config file
2017-08-30 17:36:00 +00:00
- "hyperkube kubelet"
- "kubelet"
Add kubeconfig variable substitution for kubelet and proxy. There are checks for the kubeconfig for both kubelet and proxy which the current kube-bench implementation does not check for properly. kube-bench checks the wrong files. This PR adds support for variable substitution for all the config file types are that should be checked in the CIS benchmarks. This PR also fixes a buggy in CIS 1.3.0 check 2.2.9, which checks for ownership of the kubelet config file /var/lib/kubelet/config.yaml but recommends changing ownership of kubelet kubeconfig file /etc/kubernetes/kubelet.conf as remediation.
2019-02-27 22:08:57 +00:00
defaultconf: "/var/lib/kubelet/config.yaml"
Fix wrong reference to kubelet.config in node checks. This fix applies to only checks for kubernetes versions 1.8 and 1.11. See https://github.com/aquasecurity/kube-bench/pull/208.
2019-02-27 21:28:02 +00:00
defaultsvc: "/etc/systemd/system/kubelet.service.d/10-kubeadm.conf"
Add kubeconfig variable substitution for kubelet and proxy. There are checks for the kubeconfig for both kubelet and proxy which the current kube-bench implementation does not check for properly. kube-bench checks the wrong files. This PR adds support for variable substitution for all the config file types are that should be checked in the CIS benchmarks. This PR also fixes a buggy in CIS 1.3.0 check 2.2.9, which checks for ownership of the kubelet config file /var/lib/kubelet/config.yaml but recommends changing ownership of kubelet kubeconfig file /etc/kubernetes/kubelet.conf as remediation.
2019-02-27 22:08:57 +00:00
defaultkubeconfig: "/etc/kubernetes/kubelet.conf"
Add function to get unit files for kubernetes components.
2017-10-15 12:39:29 +00:00
Reorder YAML to make a bit more sense. Allow for optional components, and a config file that we don’t think exists.
2017-08-31 13:45:16 +00:00
proxy:
bins:
Update the config file
2017-08-30 17:36:00 +00:00
- "kube-proxy"
- "hyperkube proxy"
- "proxy"
Reorder YAML to make a bit more sense. Allow for optional components, and a config file that we don’t think exists.
2017-08-31 13:45:16 +00:00
confs:
Update the config file
2017-08-30 17:36:00 +00:00
- /etc/kubernetes/proxy
- /etc/kubernetes/addons/kube-proxy-daemonset.yaml
Add kubeconfig variable substitution for kubelet and proxy. There are checks for the kubeconfig for both kubelet and proxy which the current kube-bench implementation does not check for properly. kube-bench checks the wrong files. This PR adds support for variable substitution for all the config file types are that should be checked in the CIS benchmarks. This PR also fixes a buggy in CIS 1.3.0 check 2.2.9, which checks for ownership of the kubelet config file /var/lib/kubelet/config.yaml but recommends changing ownership of kubelet kubeconfig file /etc/kubernetes/kubelet.conf as remediation.
2019-02-27 22:08:57 +00:00
defaultkubeconfig: "/etc/kubernetes/proxy.conf"
Move kubernetes binaries and config paths to kube-bench config.
2017-07-13 00:24:09 +00:00
Update the config file
2017-08-30 17:36:00 +00:00
federated:
Reorder YAML to make a bit more sense. Allow for optional components, and a config file that we don’t think exists.
2017-08-31 13:45:16 +00:00
components:
- fedapiserver
- fedcontrollermanager
fedapiserver:
bins:
Update the config file
2017-08-30 17:36:00 +00:00
- "hyperkube federation-apiserver"
- "kube-federation-apiserver"
- "federation-apiserver"
Reorder YAML to make a bit more sense. Allow for optional components, and a config file that we don’t think exists.
2017-08-31 13:45:16 +00:00
fedcontrollermanager:
bins:
Update the config file
2017-08-30 17:36:00 +00:00
- "hyperkube federation-controller-manager"
- "kube-federation-controller-manager"
- "federation-controller-manager"
Reference in New Issue Copy Permalink