diff --git a/cfg/1.8/master.yaml b/cfg/1.8/master.yaml
index a306eef..92918a9 100644
--- a/cfg/1.8/master.yaml
+++ b/cfg/1.8/master.yaml
@@ -1,6 +1,6 @@
 ---
 controls:
-version: 1.7
+version: 1.8
 id: 1
 text: "Master Node Security Configuration"
 type: "master"
@@ -8,600 +8,835 @@ groups:
 - id: 1.1
   text: "API Server"
   checks:
-    - id: 1.1.1
-      text: "Ensure that the --allow-privileged argument is set to false (Scored)"
-      audit: "ps -ef | grep $apiserverbin | grep -v grep"
-      tests:
-        test_items:
-        - flag: "allow-privileged"
+  - id: 1.1.1
+    text: "Ensure that the --anonymous-auth argument is set to false (Scored)"
+    audit: "ps -ef | grep $apiserverbin | grep -v grep"
+    tests:
+      test_items:
+      - flag: "--anonymous-auth"
+        compare:
+          op: eq
+          value: false
+        set: true
+    remediation: | 
+      Edit the API server pod specification file $apiserverpodspec
+      on the master node and set the below parameter.
+      --anonymous-auth=false
+
+    scored: true
+
+  - id: 1.1.2
+    text: "Ensure that the --basic-auth-file argument is not set (Scored)"
+    audit: "ps -ef | grep $apiserverbin | grep -v grep"
+    tests:
+      test_items:
+      - flag: "--basic-auth-file"
+        set: false
+    remediation: |
+      Follow the documentation and configure alternate mechanisms for authentication. Then,
+      edit the API server pod specification file $apiserverpodspec
+      on the master node and remove the --basic-auth-file=<filename>
+      parameter.
+    scored: true
+
+  - id: 1.1.3
+    text: "Ensure that the --insecure-allow-any-token argument is not set (Scored)"
+    audit: "ps -ef | grep $apiserverbin | grep -v grep"
+    tests:
+      test_items:
+      - flag:  "--insecure-allow-any-token"
+        set: false
+    remediation: |
+      Edit the API server pod specification file $apiserverpodspec
+      on the master node and remove the --insecure-allow-any-token
+      parameter.
+    scored: true
+
+  - id: 1.1.4
+    text: "Ensure that the --kubelet-https argument is set to true (Scored)"
+    audit: "ps -ef | grep $apiserverbin | grep -v grep"
+    tests: 
+      bin_op: or
+      test_items:
+      - flag: "--kubelet-https"
+        compare:
+          op: eq
+          value: true
+        set: true
+      - flag: "--kubelet-https"
+        set: false
+    remediation: |
+      Edit the API server pod specification file $apiserverpodspec
+      on the master node and remove the --kubelet-https parameter.
+    scored: true
+
+  - id: 1.1.5
+    text: "Ensure that the --insecure-bind-address argument is not set (Scored)"
+    audit: "ps -ef | grep $apiserverbin | grep -v grep"
+    tests:
+      test_items:
+      - flag: "--insecure-bind-address"
+        set: false
+    remediation: |
+      Edit the API server pod specification file $apiserverpodspec
+      on the master node and remove the --insecure-bind-address
+      parameter.
+    scored: true
+
+  - id: 1.1.6
+    text: "Ensure that the --insecure-port argument is set to 0 (Scored)"
+    audit: "ps -ef | grep $apiserverbin | grep -v grep"
+    tests:
+      test_items:
+      - flag: "--insecure-port"
+        compare:
+          op: eq
+          value: 0
+        set: true
+    remediation: |
+      Edit the API server pod specification file $apiserverpodspec
+      apiserver.yaml on the master node and set the below parameter.
+      --insecure-port=0
+    scored: true
+
+  - id: 1.1.7
+    text: "Ensure that the --secure-port argument is not set to 0 (Scored)"
+    audit: "ps -ef | grep $apiserverbin | grep -v grep"
+    tests: 
+      bin_op: or
+      test_items:
+        - flag:  "--secure-port"
           compare:
-            op: eq
-            value: false
-          set: true
-      remediation: "Edit the $apiserverconf file on the master node and set 
-              the KUBE_ALLOW_PRIV parameter to \"--allow-privileged=false\""
-      scored: true
-
-    - id: 1.1.2
-      text: "Ensure that the --anonymous-auth argument is set to false (Scored)"
-      audit: "ps -ef | grep $apiserverbin | grep -v grep"
-      tests:
-        test_items:
-        - flag: "--anonymous-auth"
-          compare:
-            op: eq
-            value: false
-          set: true
-      remediation: "Edit the $apiserverconf file on the master node and set 
-              the KUBE_API_ARGS parameter to \"--anonymous-auth=false\""
-      scored: true
-
-    - id: 1.1.3
-      text: "Ensure that the --basic-auth-file argument is not set (Scored)"
-      audit: "ps -ef | grep $apiserverbin | grep -v grep"
-      tests:
-        test_items:
-        - flag: "--basic-auth-file"
-          set: false
-      remediation: "Follow the documentation and configure alternate mechanisms for 
-              authentication. Then, edit the $apiserverconf file on the master 
-              node and remove the \"--basic-auth-file=<filename>\" argument from the 
-              KUBE_API_ARGS parameter."
-      scored: true
-
-    - id: 1.1.4
-      text: "Ensure that the --insecure-allow-any-token argument is not set (Scored)"
-      audit: "ps -ef | grep $apiserverbin | grep -v grep"
-      tests:
-        test_items:
-        - flag:  "--insecure-allow-any-token"
-          set: false
-      remediation: "Edit the $apiserverconf file on the master node and remove 
-              the --insecure-allow-any-token argument from the KUBE_API_ARGS parameter."
-      scored: true
-
-    - id: 1.1.5
-      text: "Ensure that the --kubelet-https argument is set to true (Scored)"
-      audit: "ps -ef | grep $apiserverbin | grep -v grep"
-      tests: 
-        bin_op: or
-        test_items:
-        - flag: "--kubelet-https"
-          compare:
-            op: eq
-            value: true
-          set: true
-        - flag: "--kubelet-https"
-          set: false
-      remediation: "Edit the $apiserverconf file on the master node and remove 
-              the --kubelet-https argument from the KUBE_API_ARGS parameter."
-      scored: true
-
-    - id: 1.1.6
-      text: "Ensure that the --insecure-bind-address argument is not set (Scored)"
-      audit: "ps -ef | grep $apiserverbin | grep -v grep"
-      tests:
-        test_items:
-        - flag: "--insecure-bind-address"
-          set: false
-      remediation: "Edit the $apiserverconf file on the master node and remove 
-              the --insecure-bind-address argument from the KUBE_API_ADDRESS parameter."
-      scored: true
-
-    - id: 1.1.7
-      text: "Ensure that the --insecure-port argument is set to 0 (Scored)"
-      audit: "ps -ef | grep $apiserverbin | grep -v grep"
-      tests:
-        test_items:
-        - flag: "--insecure-port"
-          compare:
-            op: eq
+            op: gt
             value: 0
           set: true
-      remediation: "Edit the $apiserverconf file on the master node and set
-              --insecure-port=0 in the KUBE_API_PORT parameter."
-      scored: true
-
-    - id: 1.1.8
-      text: "Ensure that the --secure-port argument is not set to 0 (Scored)"
-      audit: "ps -ef | grep $apiserverbin | grep -v grep"
-      tests: 
-        bin_op: or
-        test_items:
-          - flag:  "--secure-port"
-            compare:
-              op: gt
-              value: 0
-            set: true
-          - flag: "--secure-port"
-            set: false
-      remediation: "Edit the $apiserverconf file on the master node and either 
-              remove the --secure-port argument from the KUBE_API_ARGS parameter or set 
-              it to a different desired port."
-      scored: true
-
-    - id: 1.1.9
-      text: "Ensure that the --profiling argument is set to false (Scored)"
-      audit: "ps -ef | grep $apiserverbin | grep -v grep"
-      tests:
-        test_items:
-        - flag: "--profiling"
-          compare:
-            op: eq
-            value: false
-          set: true
-      remediation: "Edit the $apiserverconf file on the master node and set the 
-              KUBE_API_ARGS parameter to \"--profiling=false\""
-      scored: true
-
-    - id: 1.1.10
-      text: "Ensure that the --repair-malformed-updates argument is set to false (Scored)"
-      audit: "ps -ef | grep $apiserverbin | grep -v grep"
-      tests:
-        test_items:
-        - flag: "--repair-malformed-updates"
-          compare:
-            op: eq
-            value: false
-          set: true
-      remediation: "Edit the $apiserverconf file on the master node and set the 
-              KUBE_API_ARGS parameter to \"--repair-malformed-updates=false\""
-      scored: true
-
-    - id: 1.1.11
-      text: "Ensure that the admission control policy is not set to AlwaysAdmit (Scored)"
-      audit: "ps -ef | grep $apiserverbin | grep -v grep"
-      tests:
-        test_items:
-        - flag: "--admission-control"
-          compare:
-            op: nothave
-            value: AlwaysAdmit 
-          set: true
-      remediation: "Edit the $apiserverconf file on the master node and set the 
-              KUBE_ADMISSION_CONTROL parameter to a value that does not include AlwaysAdmit"
-      scored: true
- 
-    - id: 1.1.12
-      text: "Ensure that the admission control policy is set to AlwaysPullImages (Scored)"
-      audit: "ps -ef | grep $apiserverbin | grep -v grep"
-      tests:
-        test_items:
-        - flag: "--admission-control"
-          compare:
-            op: has
-            value: "AlwaysPullImages"
-          set: true
-      remediation: "Edit the $apiserverconf file on the master node and set the 
-              KUBE_ADMISSION_CONTROL parameter to \"--admission-control=...,AlwaysPullImages,...\""
-      scored: true
- 
-    - id: 1.1.13
-      text: "Ensure that the admission control policy is set to DenyEscalatingExec (Scored)"
-      audit: "ps -ef | grep $apiserverbin | grep -v grep"
-      tests:
-        test_items:
-        - flag: "--admission-control"
-          compare:
-            op: has
-            value: "DenyEscalatingExec"
-          set: true
-      remediation: "Edit the $apiserverconf file on the master node and set the 
-              KUBE_ADMISSION_CONTROL parameter to \"--admission-control=...,DenyEscalatingExec,...\""
-      scored: true
-
-    - id: 1.1.14
-      text: "Ensure that the admission control policy is set to SecurityContextDeny (Scored)"
-      audit: "ps -ef | grep $apiserverbin | grep -v grep"
-      tests:
-        test_items:
-        - flag: "--admission-control"
-          compare:
-            op: has
-            value: "SecurityContextDeny"
-          set: true
-      remediation: "Edit the $apiserverconf file on the master node and set the 
-              KUBE_ADMISSION_CONTROL parameter to \"--admission-control=...,SecurityContextDeny,...\""
-      scored: true
-
-    - id: 1.1.15
-      text: "Ensure that the admission control policy is set to NamespaceLifecycle (Scored)"
-      audit: "ps -ef | grep $apiserverbin | grep -v grep"
-      tests:
-        test_items:
-        - flag: "admission-control"
-          compare:
-            op: has
-            value: "NamespaceLifecycle"
-          set: true
-      remediation: "Edit the $apiserverconf file on the master node and set the 
-              KUBE_ADMISSION_CONTROL parameter to \"--admission-control=NamespaceLifecycle,...\""
-      scored: true
-
-    - id: 1.1.16
-      text: "Ensure that the --audit-log-path argument is set as appropriate (Scored)"
-      audit: "ps -ef | grep $apiserverbin | grep -v grep"
-      tests:
-        test_items:
-        - flag: "--audit-log-path"
-          set: true
-      remediation: "Edit the $apiserverconf file on the master node and set the 
-              KUBE_API_ARGS parameter to \"--audit-log-path=<filename>\""
-      scored: true
-
-    - id: 1.1.17
-      text: "Ensure that the --audit-log-maxage argument is set to 30 or as appropriate (Scored)"
-      audit: "ps -ef | grep $apiserverbin | grep -v grep"
-      tests:
-        test_items:
-        - flag: "--audit-log-maxage"
-          compare:
-            op: gte
-            value: 30
-          set: true
-      remediation: "Edit the $apiserverconf file on the master node and set the 
-              KUBE_API_ARGS parameter to \"--audit-log-maxage=30\""
-      scored: true
-
-    - id: 1.1.18
-      text: "Ensure that the --audit-log-maxbackup argument is set to 10 or as appropriate (Scored)"
-      audit: "ps -ef | grep $apiserverbin | grep -v grep"
-      tests:
-        test_items:
-        - flag: "--audit-log-maxbackup"
-          compare:
-            op: gte
-            value: 10
-          set: true
-      remediation: "Edit the $apiserverconf file on the master node and set the 
-              KUBE_API_ARGS parameter to \"--audit-log-maxbackup=10\""
-      scored: true
-
-    - id: 1.1.19
-      text: "Ensure that the --audit-log-maxsize argument is set to 100 or as appropriate (Scored)"
-      audit: "ps -ef | grep $apiserverbin | grep -v grep"
-      tests:
-        test_items:
-        - flag: "--audit-log-maxsize"
-          compare:
-            op: gte
-            value: 100
-          set: true
-      remediation: "Edit the $apiserverconf file on the master node and set the 
-              KUBE_API_ARGS parameter to \"--audit-log-maxsize=100\""
-      scored: true
-
-    - id: 1.1.20
-      text: "Ensure that the --authorization-mode argument is not set to AlwaysAllow (Scored)"
-      audit: "ps -ef | grep $apiserverbin | grep -v grep"
-      tests:
-        test_items:
-        - flag: "--authorization-mode"
-          compare:
-            op: nothave
-            value: "AlwaysAllow"
-          set: true
-      remediation: "Edit the $apiserverconf file on the master node and set the 
-              KUBE_API_ARGS parameter to values other than \"--authorization-mode=AlwaysAllow\""
-      scored: true
-
-    - id: 1.1.21
-      text: "Ensure that the --token-auth-file parameter is not set (Scored)"
-      audit: "ps -ef | grep $apiserverbin | grep -v grep"
-      tests:
-        test_items:
-        - flag: "--token-auth-file"
+        - flag: "--secure-port"
           set: false
-      remediation: "Follow the documentation and configure alternate mechanisms for authentication. 
-              Then, edit the $apiserverconf file on the master node and remove the 
-              \"--tokenauth-file=<filename>\" argument from the KUBE_API_ARGS parameter."
-      scored: true
- 
-    - id: 1.1.22
-      text: "Ensure that the --kubelet-certificate-authority argument is set as appropriate (Scored)"
-      audit: "ps -ef | grep $apiserverbin | grep -v grep"
-      tests:
-        test_items:
-        - flag: "--kubelet-certificate-authority"
-          set: true
-      remediation: "Follow the Kubernetes documentation and setup the TLS connection between 
-              the apiserver and kubelets. Then, edit the $apiserverconf file on the 
-              master node and set the KUBE_API_ARGS parameter to 
-              \"--kubelet-certificate-authority=<ca-string>\""
-      scored: true
+    remediation: |
+      Edit the API server pod specification file $apiserverpodspec
+      on the master node and either remove the --secure-port parameter or
+      set it to a different (non-zero) desired port.
+    scored: true
 
-    - id: 1.1.23
-      text: "Ensure that the --kubelet-client-certificate and --kubelet-client-key arguments are set as appropriate (Scored)"
-      audit: "ps -ef | grep $apiserverbin | grep -v grep"
-      tests:
-        bin_op: and
-        test_items:
-        - flag: "--kubelet-client-certificate"
-          set: true
-        - flag: "--kubelet-client-key"
-          set: true
-      remediation: "Follow the Kubernetes documentation and set up the TLS connection between the apiserver 
-              and kubelets. Then, edit the $apiserverconf file on the master node and set the 
-              KUBE_API_ARGS parameter to \"--kubelet-clientcertificate=<path/to/client-certificate-file>\" 
-              and \"--kubelet-clientkey=<path/to/client-key-file>\""
-      scored: true
+  - id: 1.1.8
+    text: "Ensure that the --profiling argument is set to false (Scored)"
+    audit: "ps -ef | grep $apiserverbin | grep -v grep"
+    tests:
+      test_items:
+      - flag: "--profiling"
+        compare:
+          op: eq
+          value: false
+        set: true
+    remediation: |
+      Edit the API server pod specification file $apiserverpodspec
+      on the master node and set the below parameter.
+      --profiling=false
+    scored: true
 
-    - id: 1.1.24
-      text: "Ensure that the --service-account-lookup argument is set to true (Scored)"
-      audit: "ps -ef | grep $apiserverbin | grep -v grep"
-      tests:
-        test_items:
-        - flag: "--service-account-lookup"
-          compare:
-            op: eq
-            value: true
-          set: true
-      remediation: "Edit the $apiserverconf file on the master node and set the KUBE_API_ARGS parameter 
-              to \"--service-account-lookup=true\""
-      scored: true
- 
-    - id: 1.1.25
-      text: "Ensure that the admission control policy is set to PodSecurityPolicy (Scored)"
-      audit: "ps -ef | grep $apiserverbin | grep -v grep"
-      tests:
-        test_items:
-        - flag: "--admission-control"
-          compare:
-            op: has
-            value: "PodSecurityPolicy"
-          set: true
-      remediation: "Follow the documentation and create Pod Security Policy objects as per your environment. 
-              Then, edit the $apiserverconf file on the master node and set the KUBE_ADMISSION_CONTROL 
-              parameter to \"--admission-control=...,PodSecurityPolicy,...\""
-      scored: true
+  - id: 1.1.9
+    text: "Ensure that the --repair-malformed-updates argument is set to false (Scored)"
+    audit: "ps -ef | grep $apiserverbin | grep -v grep"
+    tests:
+      test_items:
+      - flag: "--repair-malformed-updates"
+        compare:
+          op: eq
+          value: false
+        set: true
+    remediation: |
+      Edit the API server pod specification file $apiserverpodspec
+      on the master node and set the below parameter.
+      --repair-malformed-updates=false
+    scored: true
 
-    - id: 1.1.26
-      text: "Ensure that the --service-account-key-file argument is set as appropriate (Scored)"
-      audit: "ps -ef | grep $apiserverbin | grep -v grep"
-      tests:
-        test_items:
-        - flag: "--service-account-key-file"
-          set: true
-      remediation: "Edit the $apiserverconf file on the master node and set the KUBE_API_ARGS 
-              parameter to \"--service-account-key-file=<filename>\""
-      scored: true
+  - id: 1.1.10
+    text: "Ensure that the admission control policy is not set to AlwaysAdmit (Scored)"
+    audit: "ps -ef | grep $apiserverbin | grep -v grep"
+    tests:
+      test_items:
+      - flag: "--admission-control"
+        compare:
+          op: nothave
+          value: AlwaysAdmit 
+        set: true
+    remediation: |
+      Edit the API server pod specification file $apiserverpodspec
+      on the master node and set the --admission-control parameter to a
+      value that does not include AlwaysAdmit .
+    scored: true
 
-    - id: 1.1.27
-      text: "Ensure that the --etcd-certfile and --etcd-keyfile arguments are set as appropriate (Scored"
-      audit: "ps -ef | grep $apiserverbin | grep -v grep"
-      tests:
-        bin_op: and
-        test_items:
-        - flag: "--etcd-certfile"
-          set: true
-        - flag: "--etcd-keyfile"
-          set: true
-      remediation: "Follow the Kubernetes documentation and set up the TLS connection between the apiserver 
-              and etcd. Then, edit the $apiserverconf file on the master node and set the 
-              KUBE_API_ARGS parameter to include \"--etcd-certfile=<path/to/clientcertificate-file>\" 
-              and \"--etcd-keyfile=<path/to/client-key-file>\""
-      scored: true
- 
-    - id: 1.1.28
-      text: "Ensure that the admission control policy is set to ServiceAccount (Scored)"
-      audit: "ps -ef | grep $apiserverbin | grep -v grep"
-      tests:
-        test_items:
-        - flag: "--admission-control"
-          compare:
-            op: has
-            value: "ServiceAccount"
-          set: true
-      remediation: "Follow the documentation and create ServiceAccount objects as per your environment. 
-              Then, edit the $apiserverconf file on the master node and set the 
-              KUBE_ADMISSION_CONTROL parameter to \"--admissioncontrol=...,ServiceAccount,...\""
-      scored: true
+  - id: 1.1.11
+    text: "Ensure that the admission control policy is set to AlwaysPullImages (Scored)"
+    audit: "ps -ef | grep $apiserverbin | grep -v grep"
+    tests:
+      test_items:
+      - flag: "--admission-control"
+        compare:
+          op: has
+          value: "AlwaysPullImages"
+        set: true
+    remediation: |
+      Edit the API server pod specification file $apiserverpodspec
+      on the master node and set the --admission-control parameter to
+      include AlwaysPullImages .
+      --admission-control=...,AlwaysPullImages,...
+    scored: true
 
-    - id: 1.1.29
-      text: "Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate (Scored)"
-      audit: "ps -ef | grep $apiserverbin | grep -v grep"
-      tests:
-        bin_op: and
-        test_items:
-        - flag: "--tls-cert-file"
-          set: true
-        - flag: "--tls-private-key-file"
-          set: true
-      remediation: "Follow the Kubernetes documentation and set up the TLS connection on the apiserver. 
-              Then, edit the $apiserverconf file on the master node and set the KUBE_API_ARGS parameter to 
-              include \"--tls-cert-file=<path/to/tls-certificatefile>\" and 
-              \"--tls-private-key-file=<path/to/tls-key-file>\""
-      scored: true
+  - id: 1.1.12
+    text: "Ensure that the admission control policy is set to DenyEscalatingExec (Scored)"
+    audit: "ps -ef | grep $apiserverbin | grep -v grep"
+    tests:
+      test_items:
+      - flag: "--admission-control"
+        compare:
+          op: has
+          value: "DenyEscalatingExec"
+        set: true
+    remediation: |
+      Edit the API server pod specification file $apiserverpodspec
+      on the master node and set the --admission-control parameter to a
+      value that includes DenyEscalatingExec .
+      --admission-control=...,DenyEscalatingExec,...
+    scored: true
 
-    - id: 1.1.30
-      text: "Ensure that the --client-ca-file argument is set as appropriate (Scored)"
-      audit: "ps -ef | grep $apiserverbin | grep -v grep"
-      tests:
-        test_items:
-        - flag: "--client-ca-file"
-          set: true
-      remediation: "Follow the Kubernetes documentation and set up the TLS connection on the apiserver. 
-              Then, edit the $apiserverconf file on the master node and set the 
-              KUBE_API_ARGS parameter to include \"--client-ca-file=<path/to/client-ca-file>\""
-      scored: true
+  - id: 1.1.13
+    text: "Ensure that the admission control policy is set to SecurityContextDeny (Scored)"
+    audit: "ps -ef | grep $apiserverbin | grep -v grep"
+    tests:
+      test_items:
+      - flag: "--admission-control"
+        compare:
+          op: has
+          value: "SecurityContextDeny"
+        set: true
+    remediation: |
+      Edit the API server pod specification file $apiserverpodspec
+      on the master node and set the --admission-control parameter to
+      include SecurityContextDeny .
+      --admission-control=...,SecurityContextDeny,...
+    scored: true
 
-    - id: 1.1.31
-      text: "Ensure that the --etcd-cafile argument is set as appropriate (Scored)"
-      audit: "ps -ef | grep $apiserverbin | grep -v grep"
-      tests:
-        test_items:
-        - flag: "--etcd-cafile"
-          set: true
-      remediation: "Follow the Kubernetes documentation and set up the TLS connection between the apiserver 
-              and etcd. Then, edit the $apiserverconf file on the master node and set the 
-              KUBE_API_ARGS parameter to include \"--etcd-cafile=<path/to/ca-file>\""
-      scored: true
+  - id: 1.1.14
+    text: "Ensure that the admission control policy is set to NamespaceLifecycle (Scored)"
+    audit: "ps -ef | grep $apiserverbin | grep -v grep"
+    tests:
+      test_items:
+      - flag: "admission-control"
+        compare:
+          op: has
+          value: "NamespaceLifecycle"
+        set: true
+    remediation: |
+      Edit the API server pod specification file $apiserverpodspec
+      on the master node and set the --admission-control parameter to
+      include NamespaceLifecycle .
+      --admission-control=...,NamespaceLifecycle,...
+    scored: true
 
-    - id: 1.1.32
-      text: "Ensure that the --authorization-mode argument is set to Node (Scored)"
-      audit: "ps -ef | grep $apiserverbin | grep -v grep"
-      tests:
-        test_items:
-        - flag: "--authorization-mode"
-          compare:
-            op: has
-            value: "Node"
-          set: true
-      remediation: "Edit the /etc/kubernetes/apiserver file on the master node and set the KUBE_API_ARGS
-              parameter to a value to include --authorization-mode=Node. One such example could be
-              as below:\n
-              KUBE_API_ARGS=\"--authorization-mode=Node,RBAC\""
-      scored: true
+  - id: 1.1.15
+    text: "Ensure that the --audit-log-path argument is set as appropriate (Scored)"
+    audit: "ps -ef | grep $apiserverbin | grep -v grep"
+    tests:
+      test_items:
+      - flag: "--audit-log-path"
+        set: true
+    remediation: |
+      Edit the API server pod specification file $apiserverpodspec
+      on the master node and set the --audit-log-path parameter to a suitable
+    path and file where you would like audit logs to be written, for example:
+            --audit-log-path=/var/log/apiserver/audit.log
+    scored: true
 
-    - id: 1.1.33
-      text: "Ensure that the admission control policy is set to NodeRestriction (Scored)"
-      audit: "ps -ef | grep $apiserverbin | grep -v grep"
-      tests:
-        test_items:
-        - flag: "--admission-control"
-          compare:
-            op: has
-            value: "NodeRestriction"
-          set: true
-      remediation: "Follow the Kubernetes documentation and configure NodeRestriction plug-in on kubelets.
-              Then, edit the /etc/kubernetes/apiserver file on the master node and set the
-              KUBE_ADMISSION_CONTROL parameter to \"--admissioncontrol=...,NodeRestriction,...\""
-      scored: true
+  - id: 1.1.16
+    text: "Ensure that the --audit-log-maxage argument is set to 30 or as appropriate (Scored)"
+    audit: "ps -ef | grep $apiserverbin | grep -v grep"
+    tests:
+      test_items:
+      - flag: "--audit-log-maxage"
+        compare:
+          op: gte
+          value: 30
+        set: true
+    remediation: |
+      Edit the API server pod specification file $apiserverpodspec
+      on the master node and set the --audit-log-maxage parameter to 30 or
+    as an appropriate number of days:
+            --audit-log-maxage=30
+    scored: true
 
-    - id: 1.1.34
-      text: "1.1.34 Ensure that the --experimental-encryption-provider-config argument is set as appropriate (Scored)"
-      audit: "ps -ef | grep $apiserverbin | grep -v grep"
-      tests:
-        test_items:
-        - flag: "--experimental-encryption-provider-config"
-          set: true
-      remediation: "Follow the Kubernetes documentation and configure a EncryptionConfig file. Then, edit
-              the /etc/kubernetes/apiserver file on the master node and set the KUBE_API_ARGS
-              parameter to \"--experimental-encryption-provider-config=</path/to/EncryptionConfig/File>\""
-      scored: true
+  - id: 1.1.17
+    text: "Ensure that the --audit-log-maxbackup argument is set to 10 or as appropriate (Scored)"
+    audit: "ps -ef | grep $apiserverbin | grep -v grep"
+    tests:
+      test_items:
+      - flag: "--audit-log-maxbackup"
+        compare:
+          op: gte
+          value: 10
+        set: true
+    remediation: |
+      Edit the API server pod specification file $apiserverpodspec
+      on the master node and set the --audit-log-maxbackup parameter to 10
+      or to an appropriate value.
+      --audit-log-maxbackup=10
+    scored: true
 
-    - id: 1.1.35
-      text: "Ensure that the encryption provider is set to aescbc (Scored)"
-      audit: "ps -ef | grep $apiserverbin | grep -v grep"
-      type: "manual"
-      remediation: "Follow the Kubernetes documentation and configure a EncryptionConfig file. In this file,
-              choose aescbc as the encryption provider"
-      scored: true
+  - id: 1.1.18
+    text: "Ensure that the --audit-log-maxsize argument is set to 100 or as appropriate (Scored)"
+    audit: "ps -ef | grep $apiserverbin | grep -v grep"
+    tests:
+      test_items:
+      - flag: "--audit-log-maxsize"
+        compare:
+          op: gte
+          value: 100
+        set: true
+    remediation: |
+      Edit the API server pod specification file $apiserverpodspec
+      on the master node and set the --audit-log-maxsize parameter to an
+      appropriate size in MB. For example, to set it as 100 MB:
+      --audit-log-maxsize=100
+    scored: true
+
+  - id: 1.1.19
+    text: "Ensure that the --authorization-mode argument is not set to AlwaysAllow (Scored)"
+    audit: "ps -ef | grep $apiserverbin | grep -v grep"
+    tests:
+      test_items:
+      - flag: "--authorization-mode"
+        compare:
+          op: nothave
+          value: "AlwaysAllow"
+        set: true
+    remediation: |
+      Edit the API server pod specification file $apiserverpodspec
+      on the master node and set the --authorization-mode parameter to
+      values other than AlwaysAllow . One such example could be as below.
+      --authorization-mode=RBAC
+    scored: true
+
+  - id: 1.1.20
+    text: "Ensure that the --token-auth-file parameter is not set (Scored)"
+    audit: "ps -ef | grep $apiserverbin | grep -v grep"
+    tests:
+      test_items:
+      - flag: "--token-auth-file"
+        set: false
+    remediation: |
+      Follow the documentation and configure alternate mechanisms for authentication. Then,
+      edit the API server pod specification file $apiserverpodspec
+      on the master node and remove the --token-auth-file=<filename>
+      parameter.
+    scored: true
+
+  - id: 1.1.21
+    text: "Ensure that the --kubelet-certificate-authority argument is set as appropriate (Scored)"
+    audit: "ps -ef | grep $apiserverbin | grep -v grep"
+    tests:
+      test_items:
+      - flag: "--kubelet-certificate-authority"
+        set: true
+    remediation: |
+      Follow the Kubernetes documentation and setup the TLS connection between the apiserver
+      and kubelets. Then, edit the API server pod specification file
+      $apiserverpodspec on the master node and set the --
+      kubelet-certificate-authority parameter to the path to the cert file for the certificate
+      authority.
+      --kubelet-certificate-authority=<ca-string>
+    scored: true
+
+  - id: 1.1.22
+    text: "Ensure that the --kubelet-client-certificate and --kubelet-client-key arguments are
+      set as appropriate (Scored)"
+    audit: "ps -ef | grep $apiserverbin | grep -v grep"
+    tests:
+      bin_op: and
+      test_items:
+      - flag: "--kubelet-client-certificate"
+        set: true
+      - flag: "--kubelet-client-key"
+        set: true
+    remediation: |
+      Follow the Kubernetes documentation and set up the TLS connection between the
+      apiserver and kubelets. Then, edit API server pod specification file
+      $apiserverpodspec on the master node and set the
+      kubelet client certificate and key parameters as below.
+      --kubelet-client-certificate=<path/to/client-certificate-file>
+      --kubelet-client-key=<path/to/client-key-file>
+    scored: true
+
+  - id: 1.1.23
+    text: "Ensure that the --service-account-lookup argument is set to true (Scored)"
+    audit: "ps -ef | grep $apiserverbin | grep -v grep"
+    tests:
+      test_items:
+      - flag: "--service-account-lookup"
+        compare:
+          op: eq
+          value: true
+        set: true
+    remediation: |
+      Edit the API server pod specification file $apiserverpodspec
+      on the master node and set the below parameter.
+      --service-account-lookup=true
+    scored: true
+
+  - id: 1.1.24
+    text: "Ensure that the admission control policy is set to PodSecurityPolicy (Scored)"
+    audit: "ps -ef | grep $apiserverbin | grep -v grep"
+    tests:
+      test_items:
+      - flag: "--admission-control"
+        compare:
+          op: has
+          value: "PodSecurityPolicy"
+        set: true
+    remediation: |
+      Follow the documentation and create Pod Security Policy objects as per your environment.
+      Then, edit the API server pod specification file $apiserverpodspec
+      on the master node and set the --admission-control parameter to a
+      value that includes PodSecurityPolicy :
+      --admission-control=...,PodSecurityPolicy,...
+
+      Then restart the API Server.
+    scored: true
+
+  - id: 1.1.25
+    text: "Ensure that the --service-account-key-file argument is set as appropriate (Scored)"
+    audit: "ps -ef | grep $apiserverbin | grep -v grep"
+    tests:
+      test_items:
+      - flag: "--service-account-key-file"
+        set: true
+    remediation: |
+      Edit the API server pod specification file $apiserverpodspec
+      on the master node and set the --service-account-key-file parameter
+      to the public key file for service accounts:
+      --service-account-key-file=<filename>
+    scored: true
+
+  - id: 1.1.26
+    text: "Ensure that the --etcd-certfile and --etcd-keyfile arguments are set as 
+      appropriate (Scored"
+    audit: "ps -ef | grep $apiserverbin | grep -v grep"
+    tests:
+      bin_op: and
+      test_items:
+      - flag: "--etcd-certfile"
+        set: true
+      - flag: "--etcd-keyfile"
+        set: true
+    remediation: |
+      Follow the Kubernetes documentation and set up the TLS connection between the
+      apiserver and etcd. Then, edit the API server pod specification file
+      $apiserverpodspec on the master node and set the etcd
+      certificate and key file parameters.
+      --etcd-certfile=<path/to/client-certificate-file>
+      --etcd-keyfile=<path/to/client-key-file>
+    scored: true
+
+  - id: 1.1.27
+    text: "Ensure that the admission control policy is set to ServiceAccount (Scored)"
+    audit: "ps -ef | grep $apiserverbin | grep -v grep"
+    tests:
+      test_items:
+      - flag: "--admission-control"
+        compare:
+          op: has
+          value: "ServiceAccount"
+        set: true
+    remediation: |
+      Follow the documentation and create ServiceAccount objects as per your environment.
+      Then, edit the API server pod specification file $apiserverpodspec
+      on the master node and set the --admission-control parameter to a
+      value that includes ServiceAccount .
+      --admission-control=...,ServiceAccount,...
+    scored: true
+
+  - id: 1.1.28
+    text: "Ensure that the --tls-cert-file and --tls-private-key-file arguments are set
+    as appropriate (Scored)"
+    audit: "ps -ef | grep $apiserverbin | grep -v grep"
+    tests:
+      bin_op: and
+      test_items:
+      - flag: "--tls-cert-file"
+        set: true
+      - flag: "--tls-private-key-file"
+        set: true
+    remediation: |
+      Follow the Kubernetes documentation and set up the TLS connection on the apiserver.
+      Then, edit the API server pod specification file $apiserverpodspec
+      on the master node and set the TLS certificate and private key file
+      parameters.
+      --tls-cert-file=<path/to/tls-certificate-file>
+      --tls-private-key-file=<path/to/tls-key-file>
+    scored: true
+
+  - id: 1.1.29
+    text: "Ensure that the --client-ca-file argument is set as appropriate (Scored)"
+    audit: "ps -ef | grep $apiserverbin | grep -v grep"
+    tests:
+      test_items:
+      - flag: "--client-ca-file"
+        set: true
+    remediation: |
+      Follow the Kubernetes documentation and set up the TLS connection on the apiserver.
+      Then, edit the API server pod specification file $apiserverpodspec
+      on the master node and set the client certificate authority file.
+      --client-ca-file=<path/to/client-ca-file>
+    scored: true
+
+  - id: 1.1.30
+    text: "Ensure that the --etcd-cafile argument is set as appropriate (Scored)"
+    audit: "ps -ef | grep $apiserverbin | grep -v grep"
+    tests:
+      test_items:
+      - flag: "--etcd-cafile"
+        set: true
+    remediation: |
+      Follow the Kubernetes documentation and set up the TLS connection between the
+      apiserver and etcd. Then, edit the API server pod specification file
+      $apiserverpodspec on the master node and set the etcd
+      certificate authority file parameter.
+      --etcd-cafile=<path/to/ca-file>
+    scored: true
+
+  - id: 1.1.31
+    text: "Ensure that the --authorization-mode argument is set to Node (Scored)"
+    audit: "ps -ef | grep $apiserverbin | grep -v grep"
+    tests:
+      test_items:
+      - flag: "--authorization-mode"
+        compare:
+          op: has
+          value: "Node"
+        set: true
+    remediation: |
+      Edit the API server pod specification file $apiserverpodspec
+      on the master node and set the --authorization-mode parameter to a
+      value that includes Node .
+      --authorization-mode=Node,RBAC
+    scored: true
+
+  - id: 1.1.32
+    text: "Ensure that the admission control policy is set to NodeRestriction (Scored)"
+    audit: "ps -ef | grep $apiserverbin | grep -v grep"
+    tests:
+      test_items:
+      - flag: "--admission-control"
+        compare:
+          op: has
+          value: "NodeRestriction"
+        set: true
+    remediation: |
+      Follow the Kubernetes documentation and configure NodeRestriction plug-in on kubelets.
+      Then, edit the API server pod specification file $apiserverpodspec
+      on the master node and set the --admission-control parameter to a
+      value that includes NodeRestriction.
+      --admission-control=...,NodeRestriction,...
+    scored: true
+
+  - id: 1.1.33
+    text: "1.1.34 Ensure that the --experimental-encryption-provider-config argument is
+    set as appropriate (Scored)"
+    audit: "ps -ef | grep $apiserverbin | grep -v grep"
+    tests:
+      test_items:
+      - flag: "--experimental-encryption-provider-config"
+        set: true
+    remediation: |
+      Follow the Kubernetes documentation and configure a EncryptionConfig file. Then, edit
+      the API server pod specification file $apiserverpodspec
+      on the master node and set the --experimental-encryption-provider-config parameter
+      to the path of that file:
+      --experimental-encryption-provider-config=</path/to/EncryptionConfig/File>
+    scored: true
+
+  - id: 1.1.34
+    text: "Ensure that the encryption provider is set to aescbc (Scored)"
+    audit: "ps -ef | grep $apiserverbin | grep -v grep"
+    type: "manual"
+    remediation: |
+      Follow the Kubernetes documentation and configure a EncryptionConfig file. In this file,
+      choose aescbc as the encryption provider.
+      For example,
+      kind: EncryptionConfig
+      apiVersion: v1
+      resources:
+        - resources:
+          - secrets
+            providers:
+            - aescbc:
+                keys:
+                - name: key1
+                  secret: <32-byte base64-encoded secret>
+    scored: true
+
+  - id: 1.1.35
+    text: "Ensure that the admission control policy is set to EventRateLimit (Scored)"
+    audit: "ps -ef | grep $apiserverbin | grep -v grep"
+    tests:
+      test_items:
+      - flag: "--admission-control"
+        compare:
+          op: has
+          value: "EventRateLimit"
+        set: true
+    remediation: |
+      Follow the Kubernetes documentation and set the desired limits in a configuration file.
+      Then, edit the API server pod specification file $apiserverpodspec
+      and set the below parameters.
+      --admission-control=EventRateLimit
+      --admission-control-config-file=<path/to/configuration/file>
+    scored: true
+
+  - id: 1.1.36
+    text: "Ensure that the AdvancedAuditing argument is not set to false (Scored)"
+    audit: "ps -ef | grep $apiserverbin | grep -v grep"
+    type: "manual"
+    remediation: |
+      Follow the Kubernetes documentation and set the desired audit policy in the
+      /etc/kubernetes/audit-policy.yaml file.
+      Then, edit the API server pod specification file $apiserverpodspec
+      and set the below parameters.
+      --audit-policy-file=/etc/kubernetes/audit-policy.yaml
+    scored: true
+
+  - id: 1.1.37
+    text: "Ensure that the --request-timeout argument is set as appropriate (Scored)"
+    audit: "ps -ef | grep $apiserverbin | grep -v grep"
+    type: "manual"
+    remediation: |
+      Edit the API server pod specification file $apiserverpodspec
+      and set the below parameter as appropriate and if needed. For example,
+      --request-timeout=300
+    scored: true
 
 - id: 1.2
   text: "Scheduler"
   checks:
-    - id: 1.2.1
-      text: "Ensure that the --profiling argument is set to false (Scored)"
-      audit: "ps -ef | grep $schedulerbin | grep -v grep"
-      tests:
-        test_items:
-        - flag: "--profiling"
-          compare:
-            op: eq
-            value: false
-          set: true
-      remediation: "Edit the $schedulerconf file on the master node and set the KUBE_SCHEDULER_ARGS 
-              parameter to \"--profiling=false\""
-      scored: true
+  - id: 1.2.1
+    text: "Ensure that the --profiling argument is set to false (Scored)"
+    audit: "ps -ef | grep $schedulerbin | grep -v grep"
+    tests:
+      test_items:
+      - flag: "--profiling"
+        compare:
+          op: eq
+          value: false
+        set: true
+    remediation: |
+      Remediation:
+        Edit the Scheduler pod specification file $apiserverpodspec
+        file on the master node and set the below parameter.
+        --profiling=false
+    scored: true
 
 - id: 1.3
   text: "Controller Manager"
   checks:
-    - id: 1.3.1
-      text: "Ensure that the --terminated-pod-gc-threshold argument is set as appropriate (Scored)"
-      audit: "ps -ef | grep $controllermanagerbin | grep -v grep"
-      tests:
-        test_items:
-          - flag: "--terminated-pod-gc-threshold"
-            set: true
-      remediation: "Edit the $controllermanagerconf file on the master node and set the 
-              KUBE_CONTROLLER_MANAGER_ARGS parameter to \"--terminated-pod-gcthreshold=<appropriate-number>\""
-      scored: true
- 
-    - id: 1.3.2
-      text: "Ensure that the --profiling argument is set to false (Scored)"
-      audit: "ps -ef | grep $controllermanagerbin | grep -v grep"
-      tests:
-        test_items:
-        - flag: "--profiling"
-          compare:
-            op: eq
-            value: false
+  - id: 1.3.1
+    text: "Ensure that the --terminated-pod-gc-threshold argument is set as appropriate (Scored)"
+    audit: "ps -ef | grep $controllermanagerbin | grep -v grep"
+    tests:
+      test_items:
+        - flag: "--terminated-pod-gc-threshold"
           set: true
-      remediation: "Edit the $controllermanagerconf file on the master node and set the 
-              KUBE_CONTROLLER_MANAGER_ARGS parameter to \"--profiling=false\""
-      scored: true
- 
-    - id: 1.3.3
-      text: "Ensure that the --use-service-account-credentials argument is set"
-      audit: "ps -ef | grep $controllermanagerbin | grep -v grep"
-      tests:
-        test_items:
-        - flag: "--use-service-account-credentials"
-          compare:
-            op: eq
-            value: true
-          set: true
-      remediation: "Edit the $controllermanagerconf file on the master node and set the 
-              KUBE_CONTROLLER_MANAGER_ARGS parameter to --use-service-account-credentials=true"
-      scored: true
+    remediation: |
+      Edit the Controller Manager pod specification file $apiserverpodspec
+      on the master node and set the --terminated-pod-gc-
+      threshold to an appropriate threshold, for example:
+      --terminated-pod-gc-threshold=10
+    scored: true
 
-    - id: 1.3.4
-      text: "Ensure that the --service-account-private-key-file argument is set as appropriate (Scored)"
-      audit: "ps -ef | grep $controllermanagerbin | grep -v grep"
-      tests:
-        test_items:
-        - flag: "--service-account-private-key-file"
-          set: true
-      remediation: "Edit the $controllermanagerconf file on the master node and set the 
-              KUBE_CONTROLLER_MANAGER_ARGS parameter to --service-account-private-keyfile=<filename>"
-      scored: true
+  - id: 1.3.2
+    text: "Ensure that the --profiling argument is set to false (Scored)"
+    audit: "ps -ef | grep $controllermanagerbin | grep -v grep"
+    tests:
+      test_items:
+      - flag: "--profiling"
+        compare:
+          op: eq
+          value: false
+        set: true
+    remediation: |
+      Edit the Controller Manager pod specification file $apiserverpodspec
+      on the master node and set the below parameter.
+      --profiling=false
+    scored: true
 
-    - id: 1.3.5
-      text: "Ensure that the --root-ca-file argument is set as appropriate (Scored)"
-      audit: "ps -ef | grep $controllermanagerbin | grep -v grep"
-      tests:
-        test_items:
-        - flag: "--root-ca-file"
-          set: true
-      remediation: "Edit the $controllermanagerconf file on the master node and set the 
-              KUBE_CONTROLLER_MANAGER_ARGS parameter to include --root-ca-file=<file>"
-      scored: true
+  - id: 1.3.3
+    text: "Ensure that the --use-service-account-credentials argument is set"
+    audit: "ps -ef | grep $controllermanagerbin | grep -v grep"
+    tests:
+      test_items:
+      - flag: "--use-service-account-credentials"
+        compare:
+          op: eq
+          value: true
+        set: true
+    remediation: |
+      Edit the Controller Manager pod specification file $apiserverpodspec
+      on the master node to set the below parameter.
+      --use-service-account-credentials=true
+    scored: true
 
-    - id: 1.3.6
-      text: "Apply Security Context to Your Pods and Containers (Not Scored)"
-      type: "manual"
-      remediation: "Edit the /etc/kubernetes/controller-manager file on the master node and set the
-              KUBE_CONTROLLER_MANAGER_ARGS parameter to a value to include 
-              \"--feature-gates=RotateKubeletServerCertificate=true\""
-      scored: false
+  - id: 1.3.4
+    text: "Ensure that the --service-account-private-key-file argument is set as appropriate (Scored)"
+    audit: "ps -ef | grep $controllermanagerbin | grep -v grep"
+    tests:
+      test_items:
+      - flag: "--service-account-private-key-file"
+        set: true
+    remediation: |
+      Edit the Controller Manager pod specification file $apiserverpodspec
+      on the master node and set the --service-account-private-
+      key-file parameter to the private key file for service accounts.
+      --service-account-private-key-file=<filename>
+    scored: true
+
+  - id: 1.3.5
+    text: "Ensure that the --root-ca-file argument is set as appropriate (Scored)"
+    audit: "ps -ef | grep $controllermanagerbin | grep -v grep"
+    tests:
+      test_items:
+      - flag: "--root-ca-file"
+        set: true
+    remediation: |
+      Edit the Controller Manager pod specification file $apiserverpodspec
+      on the master node and set the --root-ca-file parameter to
+      the certificate bundle file`.
+      --root-ca-file=<path/to/file>
+    scored: true
+
+  - id: 1.3.6
+    text: "Apply Security Context to Your Pods and Containers (Not Scored)"
+    type: "manual"
+    remediation: |
+      Follow the Kubernetes documentation and apply security contexts to your pods. For a
+      suggested list of security contexts, you may refer to the CIS Security Benchmark for Docker
+      Containers.
+    scored: false
+
+  - id: 1.3.7
+    text: " Ensure that the RotateKubeletServerCertificate argument is set to true (Scored)"
+    audit: "ps -ef | grep $controllermanagerbin | grep -v grep"
+    tests:
+      test_items:
+      - flag: "RotateKubeletServerCertificate"
+        compare:
+          op: eq
+          value: true
+        set: true
+    remediation: |
+      Edit the Controller Manager pod specification file $apiserverpodspec
+      controller-manager.yaml on the master node and set the --feature-gates parameter to
+      include RotateKubeletServerCertificate=true.
+      --feature-gates=RotateKubeletServerCertificate=true
+    scored: true
 
-    - id: 1.3.7
-      text: " Ensure that the RotateKubeletServerCertificate argument is set to true (Scored)"
-      audit: "ps -ef | grep $controllermanagerbin | grep -v grep"
-      tests:
-        test_items:
-        - flag: "RotateKubeletServerCertificate"
-          compare:
-            op: eq
-            value: true
-          set: true
-      remediation: "Edit the /etc/kubernetes/controller-manager file on the master node and set the
-              KUBE_CONTROLLER_MANAGER_ARGS parameter to a value to include 
-              \"--feature-gates=RotateKubeletServerCertificate=true\""
-      scored: true
- 
 - id: 1.4
-  text: "Configure Files"
+  text: "Configuration Files"
   checks:
-    - id: 1.4.1
-      text: "Ensure that the apiserver file permissions are set to 644 or more restrictive (Scored)"
-      # audit: "/bin/bash -c 'if test -e $apiserverconf; then stat -c %a $apiserverconf; fi'"
-      audit: "/bin/sh -c 'if test -e $apiserverconf; then stat -c %a $apiserverconf; fi'"
-      tests:
-        bin_op: or
-        test_items:
+  - id: 1.4.1
+    text: "Ensure that the API server pod specification file permissions are
+    set to 644 or more restrictive (Scored)"
+    audit: "/bin/sh -c 'if test -e $apiserverpodspec; then stat -c %a $apiserverpodspec; fi'"
+    tests:
+      bin_op: or
+      test_items:
+      - flag: "644"
+        compare:
+          op: eq
+          value: "644"
+        set: true
+      - flag: "640"
+        compare:
+          op: eq
+          value: "640"
+        set: true
+      - flag: "600"
+        compare:
+          op: eq
+          value: "600"
+        set: true
+    remediation: |
+      Run the below command (based on the file location on your system) on the master node.
+      For example,
+      chmod 644 $apiserverpodspec
+    scored: true
+
+  - id: 1.4.2
+    text: "Ensure that the API server pod specification file ownership is set to
+    root:root (Scored)"
+    audit: "/bin/sh -c 'if test -e $apiserverpodspec; then stat -c %U:%G $apiserverpodspec; fi'"
+    tests:
+      test_items:
+      - flag: "root:root"
+        compare:
+          op: eq
+          value: "root:root"
+        set: true
+    remediation: |
+      Run the below command (based on the file location on your system) on the master node.
+      For example,
+      chown root:root $apiserverpodspec
+    scored: true
+
+  - id: 1.4.3
+    text: "Ensure that the controller manager pod specification file
+    permissions are set to 644 or more restrictive (Scored)"
+    audit: "/bin/sh -c 'if test -e $controllermanagerpodspec; then stat -c %a $controllermanagerpodspec; fi'"
+    tests:
+      bin_op: or
+      test_items:
+      - flag: "644"
+        compare:
+          op: eq
+          value: "644"
+        set: true
+      - flag: "640"
+        compare:
+          op: eq
+          value: "640"
+        set: true
+      - flag: "600"
+        compare:
+          op: eq
+          value: "600"
+        set: true
+    remediation: |
+      Run the below command (based on the file location on your system) on the master node.
+      For example,
+      chmod 644 $controllermanagerpodspec
+    scored: true
+
+  - id: 1.4.4
+    text: "Ensure that the controller manager pod specification file
+    ownership is set to root:root (Scored)"
+    audit: "/bin/sh -c 'if test -e $controllermanagerpodspec; then stat -c %U:%G $controllermanagerpodspec; fi'"
+    tests:
+      test_items:
+      - flag: "root:root"
+        compare:
+          op: eq
+          value: "root:root"
+        set: true
+    remediation: |
+      Run the below command (based on the file location on your system) on the master node.
+      For example,
+      chown root:root $controllermanagerpodspec
+    scored: true
+
+  - id: 1.4.5
+    text: "Ensure that the scheduler pod specification file permissions are set
+    to 644 or more restrictive (Scored)"
+    audit: "/bin/sh -c 'if test -e $schedulerpodspec; then stat -c %a $schedulerpodspec; fi'"
+    tests:
+      bin_op: or
+      test_items:
         - flag: "644"
           compare:
             op: eq
@@ -617,30 +852,36 @@ groups:
             op: eq
             value: "600"
           set: true
-      remediation: "Run the below command (based on the file location on your system) on the master node. 
-              \nFor example, chmod 644 $apiserverconf"
-      scored: true
+    remediation: |
+      Run the below command (based on the file location on your system) on the master node.
+      For example,
+      chmod 644 $schedulerpodspec
+    scored: true
 
-    - id: 1.4.2
-      text: "Ensure that the apiserver file ownership is set to root:root (Scored)"
-      audit: "/bin/sh -c 'if test -e $apiserverconf; then stat -c %U:%G $apiserverconf; fi'"
-      tests:
-        test_items:
+  - id: 1.4.6
+    text: "Ensure that the scheduler pod specification file ownership is set to
+    root:root (Scored)"
+    audit: "/bin/sh -c 'if test -e $schedulerpodspec; then stat -c %U:%G $schedulerpodspec; fi'"
+    tests:
+      test_items:
         - flag: "root:root"
           compare:
             op: eq
             value: "root:root"
           set: true
-      remediation: "Run the below command (based on the file location on your system) on the master node. 
-              \nFor example, chown root:root $apiserverconf"
-      scored: true
+    remediation: |
+      Run the below command (based on the file location on your system) on the master node.
+      For example,
+      chown root:root $schedulerpodspec
+    scored: true
 
-    - id: 1.4.3
-      text: "Ensure that the config file permissions are set to 644 or more restrictive (Scored)"
-      audit: "/bin/sh -c 'if test -e $kubernetesconf; then stat -c %a $kubernetesconf; fi'"
-      tests:
-        bin_op: or
-        test_items:
+  - id: 1.4.7
+    text: "Ensure that the etcd pod specification file permissions are set to
+    644 or more restrictive (Scored)"
+    audit: "/bin/sh -c 'if test -e $etcdpodspec; then stat -c %a $etcdpodspec; fi'"
+    tests:
+      bin_op: or
+      test_items:
         - flag: "644"
           compare:
             op: eq
@@ -656,373 +897,432 @@ groups:
             op: eq
             value: "600"
           set: true
-      remediation: "Run the below command (based on the file location on your system) on the master node. 
-              \nFor example, chmod 644 $kubernetesconf"
-      scored: true
+    remediation: |
+      Run the below command (based on the file location on your system) on the master node.
+      For example,
+      chmod 644 $etcdpodspec
+    scored: true
 
-    - id: 1.4.4
-      text: "Ensure that the config file ownership is set to root:root (Scored)"
-      audit: "/bin/sh -c 'if test -e $kubernetesconf; then stat -c %U:%G $kubernetesconf; fi'"
-      tests:
-        test_items:
-        - flag: "root:root"
-          compare:
-            op: eq
-            value: "root:root"
-          set: true
-      remediation: "Run the below command (based on the file location on your system) on the master node. 
-              \nFor example, chown root:root $kubernetesconf"
-      scored: true
+  - id: 1.4.8
+    text: "Ensure that the etcd pod specification file ownership is set to
+    root:root (Scored)"
+    audit: "/bin/sh -c 'if test -e $etcdpodspec; then stat -c %U:%G $etcdpodspec; fi'"
+    tests:
+      test_items:
+      - flag: "root:root"
+        compare:
+          op: eq
+          value: "root:root"
+        set: true
+    remediation: |
+      Run the below command (based on the file location on your system) on the master node.
+      For example,
+      chown root:root $etcdpodspec
+    scored: true
 
-    - id: 1.4.5
-      text: "Ensure that the scheduler file permissions are set to 644 or more restrictive (Scored)"
-      audit: "/bin/sh -c 'if test -e $schedulerconf; then stat -c %a $schedulerconf; fi'"
-      tests:
-        bin_op: or
-        test_items:
-          - flag: "644"
-            compare:
-              op: eq
-              value: "644"
-            set: true
-          - flag: "640"
-            compare:
-              op: eq
-              value: "640"
-            set: true
-          - flag: "600"
-            compare:
-              op: eq
-              value: "600"
-            set: true
-      remediation: "Run the below command (based on the file location on your system) on the master node. 
-              \nFor example, chmod 644 $schedulerconf"
-      scored: true
+  - id: 1.4.9
+    text: "Ensure that the Container Network Interface file permissions are
+    set to 644 or more restrictive (Not Scored)"
+    audit: "stat -c %a <path/to/cni/files>"
+    type: manual
+    remediation: |
+      Run the below command (based on the file location on your system) on the master node.
+      For example,
+      chmod 644 <path/to/cni/files>
+    scored: true
 
-    - id: 1.4.6
-      text: "Ensure that the scheduler file ownership is set to root:root (Scored)"
-      audit: "/bin/sh -c 'if test -e $schedulerconf; then stat -c %U:%G $schedulerconf; fi'"
-      tests:
-        test_items:
-          - flag: "root:root"
-            compare:
-              op: eq
-              value: "root:root"
-            set: true
-      remediation: "Run the below command (based on the file location on your system) on the master node. 
-              \nFor example, chown root:root $schedulerconf"
-      scored: true
+  - id: 1.4.10
+    text: "Ensure that the Container Network Interface file ownership is set
+    to root:root (Not Scored)"
+    audit: "stat -c %U:%G <path/to/cni/files>"
+    type: manual
+    remediation: |
+      Run the below command (based on the file location on your system) on the master node.
+      For example,
+      chown root:root <path/to/cni/files>
+    scored: true
 
-    - id: 1.4.7
-      text: "Ensure that the etcd.conf file permissions are set to 644 or more restrictive (Scored)"
-      audit: "/bin/sh -c 'if test -e $etcdconf; then stat -c %a $etcdconf; fi'"
-      tests:
-        bin_op: or
-        test_items:
-          - flag: "644"
-            compare:
-              op: eq
-              value: "644"
-            set: true
-          - flag: "640"
-            compare:
-              op: eq
-              value: "640"
-            set: true
-          - flag: "600"
-            compare:
-              op: eq
-              value: "600"
-            set: true
-      remediation: "Run the below command (based on the file location on your system) on the master node. 
-              \nFor example, chmod 644 $etcdconf"
-      scored: true
+  - id: 1.4.11
+    text: "Ensure that the etcd data directory permissions are set to 700 or more restrictive (Scored)"
+    audit: "ps -ef | grep $etcdbin | grep -v grep | grep -o data-dir=.* | cut -d= -f2 | xargs stat -c %a"
+    tests:
+      test_items:
+      - flag: "700"
+        compare:
+          op: eq
+          value: "700"
+        set: true
+    remediation: |
+      On the etcd server node, get the etcd data directory, passed as an argument --data-dir ,
+      from the below command:
+      ps -ef | grep $etcdbin
+      Run the below command (based on the etcd data directory found above). For example,
+      chmod 700 /var/lib/etcd
+    scored: true
 
-    - id: 1.4.8
-      text: "Ensure that the etcd.conf file ownership is set to root:root (Scored)"
-      audit: "/bin/sh -c 'if test -e $etcdconf; then stat -c %U:%G $etcdconf; fi'"
-      tests:
-        test_items:
-        - flag: "root:root"
-          compare:
-            op: eq
-            value: "root:root"
-          set: true
-      remediation: "Run the below command (based on the file location on your system) on the master node. 
-              \nFor example, chown root:root $etcdconf"
-      scored: true
+  - id: 1.4.12
+    text: "Ensure that the etcd data directory ownership is set to etcd:etcd (Scored)"
+    audit: "ps -ef | grep $etcdbin | grep -v grep | grep -o data-dir=.* | cut -d= -f2 | xargs stat -c %U:%G"
+    tests:
+      test_items:
+      - flag: "etcd:etcd"
+        set: true
+    remediation: |
+      On the etcd server node, get the etcd data directory, passed as an argument --data-dir ,
+      from the below command:
+      ps -ef | grep $etcdbin
+      Run the below command (based on the etcd data directory found above). For example,
+      chown etcd:etcd /var/lib/etcd
+    scored: true
 
-    - id: 1.4.9
-      text: "Ensure that the flanneld file permissions are set to 644 or more restrictive (Scored)"
-      audit: "/bin/sh -c 'if test -e $flanneldconf; then stat -c %a $flanneldconf; fi'"
-      tests:
-        bin_op: or
-        test_items:
-        - flag: "644"
-          compare:
-            op: eq
-            value: "644"
-          set: true
-        - flag: "640"
-          compare:
-            op: eq
-            value: "640"
-          set: true
-        - flag: "600"
-          compare:
-            op: eq
-            value: "600"
-          set: true
-      remediation: "Run the below command (based on the file location on your system) on the master node. 
-              \nFor example, chmod 644 $flanneldconf"
-      scored: true
+  - id: 1.4.13
+    text: "Ensure that the admin.conf file permissions are set to 644 or
+    more restrictive (Scored)"
+    audit: "/bin/sh -c 'if test -e /etc/kubernetes/admin.conf; then stat -c %a /etc/kubernetes/admin.conf; fi'"
+    tests:
+      test_items:
+      - flag: "644"
+        compare:
+          op: eq
+          value: "644"
+        set: true
+    remediation: |
+      Run the below command (based on the file location on your system) on the master node.
+      For example,
+      chmod 644 /etc/kubernetes/admin.conf
+    scored: true
 
-    - id: 1.4.10
-      text: "Ensure that the flanneld file ownership is set to root:root (Scored)"
-      audit: "/bin/sh -c 'if test -e $flanneldconf; then stat -c %U:%G $flanneldconf; fi'"
-      tests:
-        test_items:
-        - flag: "root:root"
-          compare:
-            op: eq
-            value: "root:root"
-          set: true
-      remediation: "Run the below command (based on the file location on your system) on the master node. 
-              \nFor example, chown root:root $flanneldconf"
-      scored: true
-      
-    - id: 1.4.11
-      text: "Ensure that the etcd data directory permissions are set to 700 or more restrictive (Scored)"
-      audit: "ps -ef | grep $etcdbin | grep -v grep | grep -o data-dir=.* | cut -d= -f2 | xargs stat -c %a"
-      tests:
-        test_items:
-        - flag: "700"
-          compare:
-            op: eq
-            value: "700"
-          set: true
-      remediation: "On the etcd server node, get the etcd data directory, passed as an argument --data-dir ,
-              from the below command:\n
-              ps -ef | grep $etcdbin\n
-              Run the below command (based on the etcd data directory found above). For example,\n
-              chmod 700 /var/lib/etcd/default.etcd"
-      scored: true
+  - id: 1.4.14
+    text: "Ensure that the admin.conf file ownership is set to root:root (Scored)"
+    audit: "/bin/sh -c 'if test -e /etc/kubernetes/admin.conf; then stat -c %U:%G /etc/kubernetes/admin.conf; fi'"
+    tests:
+      test_items:
+      - flag: "root:root"
+        compare:
+          op: eq
+          value: "root:root"
+        set: true
+    remediation: |
+      Run the below command (based on the file location on your system) on the master node.
+      For example,
+      chown root:root /etc/kubernetes/admin.conf
+    scored: true
 
-    - id: 1.4.12
-      text: "Ensure that the etcd data directory ownership is set to etcd:etcd (Scored)"
-      audit: "ps -ef | grep $etcdbin | grep -v grep | grep -o data-dir=.* | cut -d= -f2 | xargs stat -c %U:%G"
-      tests:
-        test_items:
-        - flag: "etcd:etcd"
-          set: true
-      remediation: "On the etcd server node, get the etcd data directory, passed as an argument --data-dir ,
-              from the below command:\n
-                      ps -ef | grep etcd\n
-              Run the below command (based on the etcd data directory found above). For example,\n
-                      chown etcd:etcd /var/lib/etcd/default.etcd"
-      scored: true
+  - id: 1.4.15
+    text: "Ensure that the scheduler.conf file permissions are set to 644 or
+    more restrictive (Scored)"
+    audit: "/bin/sh -c 'if test -e $schedulerconf then stat -c %a $schedulerconf; fi'"
+    tests:
+      test_items:
+      - flag: "644"
+        compare:
+          op: eq
+          value: "644"
+        set: true
+    remediation: |
+      Run the below command (based on the file location on your system) on the master node.
+      For example,
+      chmod 644 $schedulerconf
+    scored: true
+
+  - id: 1.4.16
+    text: "Ensure that the scheduler.conf file ownership is set to root:root (Scored)"
+    audit: "/bin/sh -c 'if test -e $schedulerconf; then stat -c %U:%G $schedulerconf; fi'"
+    tests:
+      test_items:
+      - flag: "root:root"
+        compare:
+          op: eq
+          value: "root:root"
+        set: true
+    remediation: |
+      Run the below command (based on the file location on your system) on the master node.
+      For example,
+      chown root:root $schedulerconf
+    scored: true
+
+  - id: 1.4.17
+    text: "Ensure that the controller-manager.conf file permissions are set
+    to 644 or more restrictive (Scored)"
+    audit: "/bin/sh -c 'if test -e $controllermanagerconf then stat -c %a $controllermanagerconf; fi'"
+    tests:
+      test_items:
+      - flag: "644"
+        compare:
+          op: eq
+          value: "644"
+        set: true
+    remediation: |
+      Run the below command (based on the file location on your system) on the master node.
+      For example,
+      chmod 644 $controllermanagerconf
+    scored: true
+
+  - id: 1.4.18
+    text: "Ensure that the controller-manager.conf file ownership is set to root:root (Scored)"
+    audit: "/bin/sh -c 'if test -e $controllermanagerconf; then stat -c %U:%G $controllermanagerconf; fi'"
+    tests:
+      test_items:
+      - flag: "root:root"
+        compare:
+          op: eq
+          value: "root:root"
+        set: true
+    remediation: |
+      Run the below command (based on the file location on your system) on the master node.
+      For example,
+      chown root:root $controllermanagerconf
+    scored: true
 
 - id: 1.5
   text: "etcd"
   checks:
-    - id: 1.5.1
-      text: "Ensure that the --cert-file and --key-file arguments are set as appropriate (Scored)"
-      audit: "ps -ef | grep $etcdbin | grep -v grep"
-      tests:
-        test_items:
-          - flag: "--cert-file"
-            set: true
-          - flag:  "--key-file"
-            set: true
-      remediation: "Follow the etcd service documentation and configure TLS encryption."
-      scored: true
+  - id: 1.5.1
+    text: "Ensure that the --cert-file and --key-file arguments are set as appropriate (Scored)"
+    audit: "ps -ef | grep $etcdbin | grep -v grep"
+    tests:
+      test_items:
+      - flag: "--cert-file"
+        set: true
+      - flag:  "--key-file"
+        set: true
+    remediation: |
+      Follow the etcd service documentation and configure TLS encryption.
+      Then, edit the etcd pod specification file $etcdpodspec on the
+      master node and set the below parameters.
+      --ca-file=</path/to/ca-file>
+      --key-file=</path/to/key-file>
+    scored: true
 
-    - id: 1.5.2
-      text: "Ensure that the --client-cert-auth argument is set to true (Scored)"
-      audit: "ps -ef | grep $etcdbin | grep -v grep"
-      tests:
-        test_items:
-          - flag: "--client-cert-auth"
-            compare:
-              op: eq
-              value: true
-            set: true
-      remediation: "Edit the etcd envrironment file (for example, $etcdconf) on the 
-              etcd server node and set the ETCD_CLIENT_CERT_AUTH parameter to \"true\". 
-              Edit the etcd startup file (for example, /etc/systemd/system/multiuser.target.wants/etcd.service) 
-              and configure the startup parameter for --clientcert-auth and set it to \"${ETCD_CLIENT_CERT_AUTH}\""
-      scored: true
+  - id: 1.5.2
+    text: "Ensure that the --client-cert-auth argument is set to true (Scored)"
+    audit: "ps -ef | grep $etcdbin | grep -v grep"
+    tests:
+      test_items:
+      - flag: "--client-cert-auth"
+        compare:
+          op: eq
+          value: true
+        set: true
+    remediation: |
+      Edit the etcd pod specification file $etcdpodspec on the master
+      node and set the below parameter.
+      --client-cert-auth="true"
+    scored: true
 
-    - id: 1.5.3
-      text: "Ensure that the --auto-tls argument is not set to true (Scored)"
-      audit: "ps -ef | grep $etcdbin | grep -v grep"
-      tests:
-        bin_op: or
-        test_items:
-          - flag: "--auto-tls"
-            set: false
-          - flag: "--auto-tls"
-            compare:
-              op: neq
-              value: true
-      remediation: "Edit the etcd environment file (for example, $etcdconf) on the etcd server 
-              node and comment out the ETCD_AUTO_TLS parameter. Edit the etcd startup file (for example, 
-              /etc/systemd/system/multiuser.target.wants/etcd.service) and remove the startup parameter 
-              for --auto-tls."
-      scored: true
+  - id: 1.5.3
+    text: "Ensure that the --auto-tls argument is not set to true (Scored)"
+    audit: "ps -ef | grep $etcdbin | grep -v grep"
+    tests:
+      bin_op: or
+      test_items:
+      - flag: "--auto-tls"
+        set: false
+      - flag: "--auto-tls"
+        compare:
+          op: neq
+          value: true
+    remediation: |
+      Edit the etcd pod specification file $etcdpodspec on the master
+      node and either remove the --auto-tls parameter or set it to false .
+        --auto-tls=false
+    scored: true
 
-    - id: 1.5.4
-      text: "Ensure that the --peer-cert-file and --peer-key-file arguments are set as appropriate (Scored)"
-      audit: "ps -ef | grep $etcdbin | grep -v grep"
-      tests:
-        test_items:
-          - flag: "--peer-cert-file"
-            set: true
-          - flag: "--peer-key-file"
-            set: true
-      remediation: "Note: This recommendation is applicable only for etcd clusters. If you are using only 
-              one etcd server in your environment then this recommendation is not applicable. 
-              Follow the etcd service documentation and configure peer TLS encryption as appropriate for 
-              your etcd cluster."
-      scored: true
+  - id: 1.5.4
+    text: "Ensure that the --peer-cert-file and --peer-key-file arguments are set
+    as appropriate (Scored)"
+    audit: "ps -ef | grep $etcdbin | grep -v grep"
+    tests:
+      test_items:
+      - flag: "--peer-cert-file"
+        set: true
+      - flag: "--peer-key-file"
+        set: true
+    remediation: |
+      Follow the etcd service documentation and configure peer TLS encryption as appropriate
+      for your etcd cluster.
+      Then, edit the etcd pod specification file $etcdpodspec on the
+      master node and set the below parameters.
+      --peer-client-file=</path/to/peer-cert-file>
+      --peer-key-file=</path/to/peer-key-file>
+    scored: true
 
-    - id: 1.5.5
-      text: "Ensure that the --peer-client-cert-auth argument is set to true (Scored)"
-      audit: "ps -ef | grep $etcdbin | grep -v grep"
-      tests:
-        test_items:
-          - flag: "--peer-client-cert-auth"
-            compare:
-              op: eq
-              value: true
-            set: true
-      remediation: "Note: This recommendation is applicable only for etcd clusters. If you are using only 
-              one etcd server in your environment then this recommendation is not applicable.
-              Edit the etcd environment file (for example, $etcdconf) on the etcd server node 
-              and set the ETCD_PEER_CLIENT_CERT_AUTH parameter to \"true\". Edit the etcd startup file 
-              (for example, /etc/systemd/system/multiuser.target.wants/etcd.service) and configure the 
-              startup parameter for --peer-client-cert-auth and set it to \"${ETCD_PEER_CLIENT_CERT_AUTH}\""
-      scored: true
+  - id: 1.5.5
+    text: "Ensure that the --peer-client-cert-auth argument is set to true (Scored)"
+    audit: "ps -ef | grep $etcdbin | grep -v grep"
+    tests:
+      test_items:
+      - flag: "--peer-client-cert-auth"
+        compare:
+          op: eq
+          value: true
+        set: true
+    remediation: |
+      Edit the etcd pod specification file $etcdpodspec on the master
+      node and set the below parameter.
+      --peer-client-cert-auth=true
+    scored: true
 
-    - id: 1.5.6
-      text: "Ensure that the --peer-auto-tls argument is not set to true (Scored)"
-      audit: "ps -ef | grep $etcdbin | grep -v grep"
-      tests:
-        bin_op: or
-        test_items:
-          - flag: "--peer-auto-tls"
-            set: false
-          - flag: "--peer-auto-tls"
-            compare:
-              op: eq
-              value: false
-            set: true
-      remediation: "Note: This recommendation is applicable only for etcd clusters. 
-              If you are using only one etcd server in your environment then this recommendation is 
-              not applicable. Edit the etcd environment file (for example, $etcdconf) 
-              on the etcd server node and comment out the ETCD_PEER_AUTO_TLS parameter. 
-              Edit the etcd startup file (for example, /etc/systemd/system/multiuser.target.wants/etcd.service) 
-              and remove the startup parameter for --peer-auto-tls."
-      scored: true
+  - id: 1.5.6
+    text: "Ensure that the --peer-auto-tls argument is not set to true (Scored)"
+    audit: "ps -ef | grep $etcdbin | grep -v grep"
+    tests:
+      bin_op: or
+      test_items:
+      - flag: "--peer-auto-tls"
+        set: false
+      - flag: "--peer-auto-tls"
+        compare:
+          op: eq
+          value: false
+        set: true
+    remediation: |
+      Edit the etcd pod specification file $etcdpodspec on the master
+      node and either remove the --peer-auto-tls parameter or set it to false .
+      --peer-auto-tls=false
+    scored: true
 
-    - id: 1.5.7
-      text: "Ensure that the --wal-dir argument is set as appropriate (Scored)"
-      audit: "ps -ef | grep $etcdbin | grep -v grep"
-      tests:
-        test_items:
-          - flag: "--wal-dir"
-            set: true
-      remediation: "Edit the etcd environment file (for example, $etcdconf) on the etcd server node 
-              and set the ETCD_WAL_DIR parameter as appropriate. Edit the etcd startup file (for example, 
-              /etc/systemd/system/multiuser.target.wants/etcd.service) and configure the startup parameter for 
-              --wal-dir and set it to \"${ETCD_WAL_DIR}\""
-      scored: true
+  - id: 1.5.7
+    text: "Ensure that the --wal-dir argument is set as appropriate (Scored)"
+    audit: "ps -ef | grep $etcdbin | grep -v grep"
+    tests:
+      test_items:
+      - flag: "--wal-dir"
+        set: true
+    remediation: |
+      Edit the etcd pod specification file $etcdpodspec on the master
+      node and set the below parameter.
+      --wal-dir=</path/to/log/dir>
+    scored: true
 
-    - id: 1.5.8
-      text: "Ensure that the --max-wals argument is set to 0 (Scored)"
-      audit: "ps -ef | grep $etcdbin | grep -v grep"
-      tests:
-        test_items:
-          - flag: "--max-wals"
-            compare:
-              op: eq
-              value: 0
-            set: true
-      remediation: "Edit the etcd environment file (for example, $etcdconf) on the etcd server node 
-              and set the ETCD_MAX_WALS parameter to 0. Edit the etcd startup file (for example, 
-              /etc/systemd/system/multiuser.target.wants/etcd.service) and configure the startup parameter 
-              for --max-wals and set it to \"${ETCD_MAX_WALS}\"."
-      scored: true
+  - id: 1.5.8
+    text: "Ensure that the --max-wals argument is set to 0 (Scored)"
+    audit: "ps -ef | grep $etcdbin | grep -v grep"
+    tests:
+      test_items:
+      - flag: "--max-wals"
+        compare:
+          op: eq
+          value: 0
+        set: true
+    remediation: |
+      Edit the etcd pod specification file $etcdpodspec on the master
+      node and set the below parameter.
+      --max-wals=0
+    scored: true
 
-    - id: 1.5.9
-      text: "Ensure that a unique Certificate Authority is used for etcd (Not Scored)"
-      audit: "ps -ef | grep $etcdbin | grep -v grep"
-      tests:
-        test_items:
-          - flag: "--trusted-ca-file"
-            set: true
-      remediation: "Follow the etcd documentation and create a dedicated certificate authority setup for the 
-              etcd service."
-      scored: false 
+  - id: 1.5.9
+    text: "Ensure that a unique Certificate Authority is used for etcd (Not Scored)"
+    audit: "ps -ef | grep $etcdbin | grep -v grep"
+    tests:
+      test_items:
+      - flag: "--trusted-ca-file"
+        set: true
+    remediation: |
+      Follow the etcd documentation and create a dedicated certificate authority setup for the
+      etcd service.
+      Then, edit the etcd pod specification file $etcdpodspec on the
+      master node and set the below parameter.
+      --trusted-ca-file=</path/to/ca-file>
+    scored: false 
 
 - id: 1.6
   text: "General Security Primitives"
   checks:
-    - id: 1.6.1
-      text: "Ensure that the cluster-admin role is only used where required (Not Scored)"
-      type: "manual"
-      remediation: "Remove any unneeded clusterrolebindings: kubectl delete clusterrolebinding [name]"
-      scored: false
+  - id: 1.6.1
+    text: "Ensure that the cluster-admin role is only used where required (Not Scored)"
+    type: "manual"
+    remediation: |
+      Remove any unneeded clusterrolebindings :
+      kubectl delete clusterrolebinding [name]
+    scored: false
 
-    - id: 1.6.2
-      text: "Create Pod Security Policies for your cluster (Not Scored)"
-      type: "manual"
-      remediation: "Follow the documentation and create and enforce Pod Security Policies for your cluster.
-              Additionally, you could refer the \"CIS Security Benchmark for Docker\" and follow the
-              suggested Pod Security Policies for your environment."
-      scored: false
+  - id: 1.6.2
+    text: "Create Pod Security Policies for your cluster (Not Scored)"
+    type: "manual"
+    remediation: |
+      Follow the documentation and create and enforce Pod Security Policies for your cluster.
+      Additionally, you could refer the "CIS Security Benchmark for Docker" and follow the
+      suggested Pod Security Policies for your environment.
+    scored: false
 
-    - id: 1.6.3
-      text: "Create administrative boundaries between resources using namespaces (Not Scored)"
-      type: "manual"
-      remediation: "Follow the documentation and create namespaces for objects in your deployment as you
-              need them."
-      scored: false
+  - id: 1.6.3
+    text: "Create administrative boundaries between resources using namespaces (Not Scored)"
+    type: "manual"
+    remediation: |
+      Follow the documentation and create namespaces for objects in your deployment as you
+      need them.
+    scored: false
 
-    - id: 1.6.4
-      text: "Create network segmentation using Network Policies (Not Scored)"
-      type: "manual"
-      remediation: "Follow the documentation and create NetworkPolicy objects as you need them."
-      scored: false
+  - id: 1.6.4
+    text: "Create network segmentation using Network Policies (Not Scored)"
+    type: "manual"
+    remediation: |
+      Follow the documentation and create NetworkPolicy objects as you need them.
+    scored: false
 
-    - id: 1.6.5
-      text: "Ensure that the seccomp profile is set to docker/default in your pod definitions (Not Scored)"
-      type: "manual"
-      remediation: "Seccomp is an alpha feature currently. By default, all alpha features are disabled. So, you
-              would need to enable alpha features in the apiserver by passing \"--feature-
-              gates=AllAlpha=true\" argument.\n
-              Edit the $apiserverconf file on the master node and set the KUBE_API_ARGS
-              parameter to \"--feature-gates=AllAlpha=true\"
-              KUBE_API_ARGS=\"--feature-gates=AllAlpha=true\""
-      scored: false
+  - id: 1.6.5
+    text: "Ensure that the seccomp profile is set to docker/default in your pod 
+    definitions (Not Scored)"
+    type: "manual"
+    remediation: |
+      Seccomp is an alpha feature currently. By default, all alpha features are disabled. So, you
+      would need to enable alpha features in the apiserver by passing "--feature-
+      gates=AllAlpha=true" argument.
+      Edit the $apiserverconf file on the master node and set the KUBE_API_ARGS
+      parameter to "--feature-gates=AllAlpha=true"
+      KUBE_API_ARGS="--feature-gates=AllAlpha=true"
+      Based on your system, restart the kube-apiserver service. For example:
+      systemctl restart kube-apiserver.service
+      Use annotations to enable the docker/default seccomp profile in your pod definitions. An
+      example is as below:
+      apiVersion: v1
+      kind: Pod
+      metadata:
+        name: trustworthy-pod
+        annotations:
+          seccomp.security.alpha.kubernetes.io/pod: docker/default
+      spec:
+        containers:
+          - name: trustworthy-container
+            image: sotrustworthy:latest
+    scored: false
 
-    - id: 1.6.6
-      text: "Apply Security Context to Your Pods and Containers (Not Scored)"
-      type: "manual"
-      remediation: "Follow the Kubernetes documentation and apply security contexts to your pods. For a
-              suggested list of security contexts, you may refer to the CIS Security Benchmark for Docker
-              Containers."
-      scored: false
+  - id: 1.6.6
+    text: "Apply Security Context to Your Pods and Containers (Not Scored)"
+    type: "manual"
+    remediation: |
+      Follow the Kubernetes documentation and apply security contexts to your pods. For a
+      suggested list of security contexts, you may refer to the CIS Security Benchmark for Docker
+      Containers.
+    scored: false
 
-    - id: 1.6.7
-      text: "Configure Image Provenance using ImagePolicyWebhook admission controller (Not Scored)"
-      type: "manual"
-      remediation: "Follow the Kubernetes documentation and setup image provenance."
-      scored: false
+  - id: 1.6.7
+    text: "Configure Image Provenance using ImagePolicyWebhook admission controller (Not Scored)"
+    type: "manual"
+    remediation: |
+      Follow the Kubernetes documentation and setup image provenance.
+    scored: false
 
-    - id: 1.6.8
-      text: "Configure Network policies as appropriate (Not Scored)"
-      type: "manual"
-      remediation: "Follow the Kubernetes documentation and setup network policies as appropriate."
-      scored: false
+  - id: 1.6.8
+    text: "Configure Network policies as appropriate (Not Scored)"
+    type: "manual"
+    remediation: |
+      Follow the Kubernetes documentation and setup network policies as appropriate.
+      For example, you could create a "default" isolation policy for a Namespace by creating a
+      NetworkPolicy that selects all pods but does not allow any traffic:
+      apiVersion: networking.k8s.io/v1
+      kind: NetworkPolicy
+      metadata:
+        name: default-deny
+      spec:
+        podSelector:
+    scored: false
 
+  - id: 1.6.9
+    text: "Place compensating controls in the form of PSP and RBAC for
+    privileged containers usage (Not Scored)"
+    type: "manual"
+    remediation: |
+      Follow Kubernetes documentation and setup PSP and RBAC authorization for your cluster.
+    scored: false