kube-bench/cfg/config.yaml

---
## Controls Files.
# These are YAML files that hold all the details for running checks.
#
## Uncomment to use different control file paths.
# masterControls: ./cfg/master.yaml
# nodeControls: ./cfg/node.yaml

master:
  components:
    - apiserver
    - scheduler
    - controllermanager
    - etcd
    - flanneld
    # kubernetes is a component to cover the config file /etc/kubernetes/config that is referred to in the benchmark
    - kubernetes
    - kubelet

  kubernetes:
    defaultconf: /etc/kubernetes/config

  apiserver:
    bins:
      - "kube-apiserver"
      - "hyperkube apiserver"
      - "hyperkube kube-apiserver"
      - "apiserver"
      - "openshift start master api"
      - "hypershift openshift-kube-apiserver"
    confs:
      - /etc/kubernetes/manifests/kube-apiserver.yaml
      - /etc/kubernetes/manifests/kube-apiserver.yml
      - /etc/kubernetes/manifests/kube-apiserver.manifest
      - /var/snap/kube-apiserver/current/args
      - /var/snap/microk8s/current/args/kube-apiserver
      - /etc/origin/master/master-config.yaml
      - /etc/kubernetes/manifests/talos-kube-apiserver.yaml
    defaultconf: /etc/kubernetes/manifests/kube-apiserver.yaml

  scheduler:
    bins:
      - "kube-scheduler"
      - "hyperkube scheduler"
      - "hyperkube kube-scheduler"
      - "scheduler"
      - "openshift start master controllers"
    confs:
      - /etc/kubernetes/manifests/kube-scheduler.yaml
      - /etc/kubernetes/manifests/kube-scheduler.yml
      - /etc/kubernetes/manifests/kube-scheduler.manifest
      - /var/snap/kube-scheduler/current/args
      - /var/snap/microk8s/current/args/kube-scheduler
      - /etc/origin/master/scheduler.json
      - /etc/kubernetes/manifests/talos-kube-scheduler.yaml
    defaultconf: /etc/kubernetes/manifests/kube-scheduler.yaml
    kubeconfig:
      - /etc/kubernetes/scheduler.conf
      - /var/lib/kube-scheduler/kubeconfig
      - /var/lib/kube-scheduler/config.yaml
      - /system/secrets/kubernetes/kube-scheduler/kubeconfig
    defaultkubeconfig: /etc/kubernetes/scheduler.conf

  controllermanager:
    bins:
      - "kube-controller-manager"
      - "kube-controller"
      - "hyperkube controller-manager"
      - "hyperkube kube-controller-manager"
      - "controller-manager"
      - "openshift start master controllers"
      - "hypershift openshift-controller-manager"
    confs:
      - /etc/kubernetes/manifests/kube-controller-manager.yaml
      - /etc/kubernetes/manifests/kube-controller-manager.yml
      - /etc/kubernetes/manifests/kube-controller-manager.manifest
      - /var/snap/kube-controller-manager/current/args
      - /var/snap/microk8s/current/args/kube-controller-manager
      - /etc/kubernetes/manifests/talos-kube-controller-manager.yaml
    defaultconf: /etc/kubernetes/manifests/kube-controller-manager.yaml
    kubeconfig:
      - /etc/kubernetes/controller-manager.conf
      - /var/lib/kube-controller-manager/kubeconfig
      - /system/secrets/kubernetes/kube-controller-manager/kubeconfig
    defaultkubeconfig: /etc/kubernetes/controller-manager.conf

  etcd:
    optional: true
    bins:
      - "etcd"
      - "openshift start etcd"
    confs:
      - /etc/kubernetes/manifests/etcd.yaml
      - /etc/kubernetes/manifests/etcd.yml
      - /etc/kubernetes/manifests/etcd.manifest
      - /etc/etcd/etcd.conf
      - /var/snap/etcd/common/etcd.conf.yml
      - /var/snap/etcd/common/etcd.conf.yaml
      - /var/snap/microk8s/current/args/etcd
      - /usr/lib/systemd/system/etcd.service
    defaultconf: /etc/kubernetes/manifests/etcd.yaml

  flanneld:
    optional: true
    bins:
      - flanneld
    defaultconf: /etc/sysconfig/flanneld

  kubelet:
    optional: true
    bins:
      - "hyperkube kubelet"
      - "kubelet"

node:
  components:
    - kubelet
    - proxy
    # kubernetes is a component to cover the config file /etc/kubernetes/config that is referred to in the benchmark
    - kubernetes

  kubernetes:
    defaultconf: "/etc/kubernetes/config"

  kubelet:
    cafile:
      - "/etc/kubernetes/pki/ca.crt"
      - "/etc/kubernetes/certs/ca.crt"
      - "/etc/kubernetes/cert/ca.pem"
      - "/var/snap/microk8s/current/certs/ca.crt"
    svc:
      # These paths must also be included
      #  in the 'confs' property below
      - "/etc/systemd/system/kubelet.service.d/10-kubeadm.conf"
      - "/etc/systemd/system/kubelet.service"
      - "/lib/systemd/system/kubelet.service"
      - "/etc/systemd/system/snap.kubelet.daemon.service"
      - "/etc/systemd/system/snap.microk8s.daemon-kubelet.service"
      - "/etc/systemd/system/atomic-openshift-node.service"
      - "/etc/systemd/system/origin-node.service"
    bins:
      - "hyperkube kubelet"
      - "kubelet"
    kubeconfig:
      - "/etc/kubernetes/kubelet.conf"
      - "/var/lib/kubelet/kubeconfig"
      - "/etc/kubernetes/kubelet-kubeconfig"
      - "/etc/kubernetes/kubelet/kubeconfig"
      - "/var/snap/microk8s/current/credentials/kubelet.config"
      - "/etc/kubernetes/kubeconfig-kubelet"
    confs:
      - "/etc/kubernetes/kubelet-config.yaml"
      - "/var/lib/kubelet/config.yaml"
      - "/var/lib/kubelet/config.yml"
      - "/etc/kubernetes/kubelet/kubelet-config.json"
      - "/etc/kubernetes/kubelet/config"
      - "/home/kubernetes/kubelet-config.yaml"
      - "/home/kubernetes/kubelet-config.yml"
      - "/etc/default/kubeletconfig.json"
      - "/etc/default/kubelet"
      - "/var/lib/kubelet/kubeconfig"
      - "/var/snap/kubelet/current/args"
      - "/var/snap/microk8s/current/args/kubelet"
      ## Due to the fact that the kubelet might be configured
      ## without a kubelet-config file, we use a work-around
      ## of pointing to the systemd service file (which can also
      ## hold kubelet configuration).
      ## Note: The following paths must match the one under 'svc'
      - "/etc/systemd/system/kubelet.service.d/10-kubeadm.conf"
      - "/etc/systemd/system/kubelet.service"
      - "/lib/systemd/system/kubelet.service"
      - "/etc/systemd/system/snap.kubelet.daemon.service"
      - "/etc/systemd/system/snap.microk8s.daemon-kubelet.service"
      - "/etc/kubernetes/kubelet.yaml"
    defaultconf: "/var/lib/kubelet/config.yaml"
    defaultsvc: "/etc/systemd/system/kubelet.service.d/10-kubeadm.conf"
    defaultkubeconfig: "/etc/kubernetes/kubelet.conf"
    defaultcafile: "/etc/kubernetes/pki/ca.crt"

  proxy:
    optional: true
    bins:
      - "kube-proxy"
      - "hyperkube proxy"
      - "hyperkube kube-proxy"
      - "proxy"
      - "openshift start network"
    confs:
      - /etc/kubernetes/proxy
      - /etc/kubernetes/addons/kube-proxy-daemonset.yaml
      - /etc/kubernetes/addons/kube-proxy-daemonset.yml
      - /var/snap/kube-proxy/current/args
      - /var/snap/microk8s/current/args/kube-proxy
    kubeconfig:
      - "/etc/kubernetes/kubelet-kubeconfig"
      - "/etc/kubernetes/kubelet/config"
      - "/var/lib/kubelet/kubeconfig"
      - "/var/snap/microk8s/current/credentials/proxy.config"
    svc:
      - "/lib/systemd/system/kube-proxy.service"
      - "/etc/systemd/system/snap.microk8s.daemon-proxy.service"
    defaultconf: /etc/kubernetes/addons/kube-proxy-daemonset.yaml
    defaultkubeconfig: "/etc/kubernetes/proxy.conf"

etcd:
  components:
    - etcd

  etcd:
    bins:
      - "etcd"
    confs:
      - /etc/kubernetes/manifests/etcd.yaml
      - /etc/kubernetes/manifests/etcd.yml
      - /etc/kubernetes/manifests/etcd.manifest
      - /etc/etcd/etcd.conf
      - /var/snap/etcd/common/etcd.conf.yml
      - /var/snap/etcd/common/etcd.conf.yaml
      - /var/snap/microk8s/current/args/etcd
      - /usr/lib/systemd/system/etcd.service
    defaultconf: /etc/kubernetes/manifests/etcd.yaml

controlplane:
  components:
    - apiserver

  apiserver:
    bins:
      - "kube-apiserver"
      - "hyperkube apiserver"
      - "hyperkube kube-apiserver"
      - "apiserver"

policies:
  components: []

managedservices:
  components: []

version_mapping:
  "1.15": "cis-1.5"
  "1.16": "cis-1.6"
  "1.17": "cis-1.6"
  "1.18": "cis-1.6"
  "1.19": "cis-1.20"
  "1.20": "cis-1.20"
  "eks-1.0": "eks-1.0"
  "gke-1.0": "gke-1.0"
  "ocp-3.10": "rh-0.7"
  "ocp-3.11": "rh-0.7"
  "ocp-4.0": "rh-1.0"
  "aks-1.0": "aks-1.0"
  "ack-1.0": "ack-1.0"

target_mapping:
  "cis-1.5":
    - "master"
    - "node"
    - "controlplane"
    - "etcd"
    - "policies"
  "cis-1.6":
    - "master"
    - "node"
    - "controlplane"
    - "etcd"
    - "policies"
  "cis-1.20":
    - "master"
    - "node"
    - "controlplane"
    - "etcd"
    - "policies"
  "gke-1.0":
    - "master"
    - "node"
    - "controlplane"
    - "etcd"
    - "policies"
    - "managedservices"
  "eks-1.0":
    - "master"
    - "node"
    - "controlplane"
    - "policies"
    - "managedservices"
  "rh-0.7":
    - "master"
    - "node"
  "aks-1.0":
    - "master"
    - "node"
    - "controlplane"
    - "policies"
    - "managedservices"
  "ack-1.0":
    - "master"
    - "node"
    - "controlplane"
    - "etcd"
    - "policies"
    - "managedservices"
  "rh-1.0":
    - "master"
    - "node"
    - "controlplane"
    - "policies"
    - "etcd"