mirror of
https://github.com/aquasecurity/kube-bench.git
synced 2024-11-26 01:49:28 +00:00
Merge branch 'master' into master
This commit is contained in:
Liz Rice
GitHub
commit
1faeb55b67
@ -5,7 +5,7 @@
|
||||
|
||||
# kube-bench
|
||||
|
||||
The Kubernetes Bench for Security is a Go application that checks whether Kubernetes is deployed securely by running the checks documented in the CIS Kubernetes 1.6 Benchmark v1.0.0.
|
||||
The Kubernetes Bench for Security is a Go application that checks whether Kubernetes is deployed securely by running the checks documented in the CIS Kubernetes Benchmark.
|
||||
|
||||
Tests are configured with YAML files, making this tool easy to update as test specifications evolve.
|
||||
|
||||
|
||||
327
cfg/1.8/federated.yaml
Normal file
327
cfg/1.8/federated.yaml
Normal file
@ -0,0 +1,327 @@
|
||||
---
|
||||
controls:
|
||||
version: 1.8
|
||||
id: 3
|
||||
text: "Federated Deployments"
|
||||
type: "federated"
|
||||
groups:
|
||||
- id: 3.1
|
||||
text: "Federation API Server"
|
||||
checks:
|
||||
- id: 3.1.1
|
||||
text: "Ensure that the --anonymous-auth argument is set to false (Scored)"
|
||||
audit: "ps -ef | grep $fedapiserverbin | grep -v grep"
|
||||
tests:
|
||||
test_items:
|
||||
- flag: "--anonymous-auth"
|
||||
compare:
|
||||
op: eq
|
||||
value: false
|
||||
set: true
|
||||
remediation: |
|
||||
Edit the deployment specs and set --anonymous-auth=false .
|
||||
kubectl edit deployments federation-apiserver-deployment --
|
||||
namespace=federation-system
|
||||
scored: true
|
||||
|
||||
- id: 3.1.2
|
||||
text: "Ensure that the --basic-auth-file argument is not set (Scored)"
|
||||
audit: "ps -ef | grep $fedapiserverbin | grep -v grep"
|
||||
tests:
|
||||
test_items:
|
||||
- flag: "--basic-auth-file"
|
||||
set: false
|
||||
remediation: |
|
||||
Follow the documentation and configure alternate mechanisms for authentication. Then,
|
||||
edit the deployment specs and remove "--basic-auth-file=<filename>" .
|
||||
kubectl edit deployments federation-apiserver-deployment --
|
||||
namespace=federation-system
|
||||
scored: true
|
||||
|
||||
- id: 3.1.3
|
||||
text: "Ensure that the --insecure-allow-any-token argument is not set (Scored)"
|
||||
audit: "ps -ef | grep $fedapiserverbin | grep -v grep"
|
||||
tests:
|
||||
test_items:
|
||||
- flag: "--insecure-allow-any-token"
|
||||
set: false
|
||||
remediation: |
|
||||
Edit the deployment specs and remove --insecure-allow-any-token .
|
||||
kubectl edit deployments federation-apiserver-deployment --
|
||||
namespace=federation-system
|
||||
scored: true
|
||||
|
||||
- id: 3.1.4
|
||||
text: "Ensure that the --insecure-bind-address argument is not set (Scored)"
|
||||
audit: "ps -ef | grep $fedapiserverbin | grep -v grep"
|
||||
tests:
|
||||
test_items:
|
||||
- flag: "--insecure-bind-address"
|
||||
set: false
|
||||
remediation: |
|
||||
Edit the deployment specs and remove --insecure-bind-address .
|
||||
kubectl edit deployments federation-apiserver-deployment --
|
||||
namespace=federation-system
|
||||
scored: true
|
||||
|
||||
- id: 3.1.5
|
||||
text: "Ensure that the --insecure-port argument is set to 0 (Scored)"
|
||||
audit: "ps -ef | grep $fedapiserverbin | grep -v grep"
|
||||
tests:
|
||||
test_items:
|
||||
- flag: "--insecure-port"
|
||||
compare:
|
||||
op: eq
|
||||
value: 0
|
||||
set: true
|
||||
remediation: |
|
||||
Edit the deployment specs and set --insecure-port=0 .
|
||||
kubectl edit deployments federation-apiserver-deployment --
|
||||
namespace=federation-system
|
||||
scored: true
|
||||
|
||||
- id: 3.1.6
|
||||
text: "Ensure that the --secure-port argument is not set to 0 (Scored)"
|
||||
audit: "ps -ef | grep $fedapiserverbin | grep -v grep"
|
||||
tests:
|
||||
bin_op: or
|
||||
test_items:
|
||||
- flag: "--secure-port"
|
||||
compare:
|
||||
op: gt
|
||||
value: 0
|
||||
set: true
|
||||
- flag: "--secure-port"
|
||||
set: false
|
||||
remediation: |
|
||||
Edit the deployment specs and set the --secure-port argument to the desired port.
|
||||
kubectl edit deployments federation-apiserver-deployment --
|
||||
namespace=federation-system
|
||||
scored: true
|
||||
|
||||
- id: 3.1.7
|
||||
text: "Ensure that the --profiling argument is set to false (Scored)"
|
||||
audit: "ps -ef | grep $fedapiserverbin | grep -v grep"
|
||||
tests:
|
||||
test_items:
|
||||
- flag: "--profiling"
|
||||
compare:
|
||||
op: eq
|
||||
value: false
|
||||
set: true
|
||||
remediation: |
|
||||
Edit the deployment specs and set "--profiling=false" :
|
||||
kubectl edit deployments federation-apiserver-deployment --
|
||||
namespace=federation-system
|
||||
score: true
|
||||
|
||||
- id: 3.1.8
|
||||
text: "Ensure that the admission control policy is not set to AlwaysAdmit (Scored)"
|
||||
audit: "ps -ef | grep $fedapiserverbin | grep -v grep"
|
||||
tests:
|
||||
test_items:
|
||||
- flag: "--admission-control"
|
||||
compare:
|
||||
op: nothave
|
||||
value: AlwaysAdmit
|
||||
set: true
|
||||
remediation: |
|
||||
Edit the deployment specs and set --admission-control argument to a value that does not
|
||||
include AlwaysAdmit .
|
||||
kubectl edit deployments federation-apiserver-deployment --
|
||||
namespace=federation-system
|
||||
scored: true
|
||||
|
||||
- id: 3.1.9
|
||||
text: "Ensure that the admission control policy is set to NamespaceLifecycle (Scored)"
|
||||
audit: "ps -ef | grep $fedapiserverbin | grep -v grep"
|
||||
tests:
|
||||
test_items:
|
||||
- flag: "admission-control"
|
||||
compare:
|
||||
op: has
|
||||
value: "NamespaceLifecycle"
|
||||
set: true
|
||||
remediation: |
|
||||
Edit the deployment specs and set --admission-control argument to a value that includes
|
||||
NamespaceLifecycle .
|
||||
kubectl edit deployments federation-apiserver-deployment --
|
||||
namespace=federation-system
|
||||
scored: true
|
||||
|
||||
- id: 3.1.10
|
||||
text: "Ensure that the --audit-log-path argument is set as appropriate (Scored)"
|
||||
audit: "ps -ef | grep $fedapiserverbin | grep -v grep"
|
||||
tests:
|
||||
test_items:
|
||||
- flag: "--audit-log-path"
|
||||
set: true
|
||||
remediation: "Edit the deployment specs and set --audit-log-path argument as appropriate.\n
|
||||
kubectl edit deployments federation-apiserver-deployment --namespace=federation-system"
|
||||
scored: true
|
||||
|
||||
- id: 3.1.11
|
||||
text: "Ensure that the --audit-log-maxage argument is set to 30 or as appropriate (Scored)"
|
||||
audit: "ps -ef | grep $fedapiserverbin | grep -v grep"
|
||||
tests:
|
||||
test_items:
|
||||
- flag: "--audit-log-maxage"
|
||||
compare:
|
||||
op: gte
|
||||
value: 30
|
||||
set: true
|
||||
remediation: |
|
||||
Edit the deployment specs and set --audit-log-maxage to 30 or as appropriate.
|
||||
kubectl edit deployments federation-apiserver-deployment --
|
||||
namespace=federation-system
|
||||
scored: true
|
||||
|
||||
- id: 3.1.12
|
||||
text: "Ensure that the --audit-log-maxbackup argument is set to 10 or as appropriate (Scored)"
|
||||
audit: "ps -ef | grep $fedapiserverbin | grep -v grep"
|
||||
tests:
|
||||
test_items:
|
||||
- flag: "--audit-log-maxbackup"
|
||||
compare:
|
||||
op: gte
|
||||
value: 10
|
||||
set: true
|
||||
remediation: |
|
||||
Edit the deployment specs and set --audit-log-maxbackup to 10 or as appropriate.
|
||||
kubectl edit deployments federation-apiserver-deployment --
|
||||
namespace=federation-system
|
||||
scored: true
|
||||
|
||||
- id: 3.1.13
|
||||
text: "Ensure that the --audit-log-maxsize argument is set to 100 or as appropriate (Scored)"
|
||||
audit: "ps -ef | grep $fedapiserverbin | grep -v grep"
|
||||
tests:
|
||||
test_items:
|
||||
- flag: "--audit-log-maxsize"
|
||||
compare:
|
||||
op: gte
|
||||
value: 100
|
||||
set: true
|
||||
remediation: |
|
||||
Edit the deployment specs and set --audit-log-maxsize=100 to 100 or as appropriate.
|
||||
kubectl edit deployments federation-apiserver-deployment --
|
||||
namespace=federation-system
|
||||
scored: true
|
||||
|
||||
- id: 3.1.14
|
||||
text: "Ensure that the --authorization-mode argument is not set to AlwaysAllow (Scored)"
|
||||
audit: "ps -ef | grep $fedapiserverbin | grep -v grep"
|
||||
tests:
|
||||
test_items:
|
||||
- flag: "--authorization-mode"
|
||||
compare:
|
||||
op: nothave
|
||||
value: "AlwaysAllow"
|
||||
set: true
|
||||
remediation: |
|
||||
Edit the deployment specs and set --authorization-mode argument to a value other than
|
||||
AlwaysAllow
|
||||
kubectl edit deployments federation-apiserver-deployment --
|
||||
namespace=federation-system
|
||||
scored: true
|
||||
|
||||
- id: 3.1.15
|
||||
text: "Ensure that the --token-auth-file parameter is not set (Scored)"
|
||||
audit: "ps -ef | grep $fedapiserverbin | grep -v grep"
|
||||
tests:
|
||||
test_items:
|
||||
- flag: "--token-auth-file"
|
||||
set: false
|
||||
remediation: |
|
||||
Follow the documentation and configure alternate mechanisms for authentication. Then,
|
||||
edit the deployment specs and remove the --token-auth-file=<filename> argument.
|
||||
kubectl edit deployments federation-apiserver-deployment --
|
||||
namespace=federation-system
|
||||
scored: true
|
||||
|
||||
- id: 3.1.16
|
||||
text: "Ensure that the --service-account-lookup argument is set to true (Scored)"
|
||||
audit: "ps -ef | grep $fedapiserverbin | grep -v grep"
|
||||
tests:
|
||||
test_items:
|
||||
- flag: "--service-account-lookup"
|
||||
compare:
|
||||
op: eq
|
||||
value: true
|
||||
set: true
|
||||
remediation: |
|
||||
Edit the deployment specs and set "--service-account-lookup=true" .
|
||||
kubectl edit deployments federation-apiserver-deployment --
|
||||
namespace=federation-system
|
||||
scored: true
|
||||
|
||||
- id: 3.1.17
|
||||
text: "Ensure that the --service-account-key-file argument is set as appropriate (Scored)"
|
||||
audit: "ps -ef | grep $fedapiserverbin | grep -v grep"
|
||||
tests:
|
||||
test_items:
|
||||
- flag: "--service-account-key-file"
|
||||
set: true
|
||||
remediation: |
|
||||
Edit the deployment specs and set --service-account-key-file argument as appropriate.
|
||||
kubectl edit deployments federation-apiserver-deployment --
|
||||
namespace=federation-system
|
||||
scored: true
|
||||
|
||||
- id: 3.1.18
|
||||
text: "Ensure that the --etcd-certfile and --etcd-keyfile arguments are set as
|
||||
appropriate (Scored)"
|
||||
audit: "ps -ef | grep $fedapiserverbin | grep -v grep"
|
||||
tests:
|
||||
bin_op: and
|
||||
test_items:
|
||||
- flag: "--etcd-certfile"
|
||||
set: true
|
||||
- flag: "--etcd-keyfile"
|
||||
set: true
|
||||
remediation: |
|
||||
Follow the Kubernetes documentation and set up the TLS connection between the
|
||||
federation apiserver and etcd. Then, edit the deployment specs and set "--etcd-
|
||||
certfile=<path/to/client-certificate-file>" and "--etcd-
|
||||
keyfile=<path/to/client-key-file>" arguments.
|
||||
kubectl edit deployments federation-apiserver-deployment --
|
||||
namespace=federation-system
|
||||
scored: true
|
||||
|
||||
- id: 3.1.19
|
||||
text: "Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as
|
||||
appropriate (Scored)"
|
||||
audit: "ps -ef | grep $fedapiserverbin | grep -v grep"
|
||||
tests:
|
||||
bin_op: and
|
||||
test_items:
|
||||
- flag: "--tls-cert-file"
|
||||
set: true
|
||||
- flag: "--tls-private-key-file"
|
||||
set: true
|
||||
remediation: |
|
||||
Follow the Kubernetes documentation and set up the TLS connection on the federation
|
||||
apiserver. Then, edit the deployment specs and set "--tls-cert-file=<path/to/tls-
|
||||
certificate-file>" and "--tls-private-key-file=<path/to/tls-key-file>" :
|
||||
kubectl edit deployments federation-apiserver-deployment --
|
||||
namespace=federation-system
|
||||
scored: true
|
||||
|
||||
- id: 3.2
|
||||
text: "Federation Controller Manager"
|
||||
checks:
|
||||
- id: 3.2.1
|
||||
text: "Ensure that the --profiling argument is set to false (Scored)"
|
||||
audit: "ps -ef | grep $fedcontrollermanagerbin | grep -v grep"
|
||||
tests:
|
||||
test_items:
|
||||
- flag: "--profiling"
|
||||
compare:
|
||||
op: eq
|
||||
value: false
|
||||
set: true
|
||||
remediation: |
|
||||
Edit the deployment specs and set "--profiling=false" :
|
||||
kubectl edit deployments federation-controller-manager-deployment --
|
||||
namespace=federation-system
|
||||
scored: true
|
||||
1328
cfg/1.8/master.yaml
Normal file
1328
cfg/1.8/master.yaml
Normal file
File diff suppressed because it is too large
Load Diff
440
cfg/1.8/node.yaml
Normal file
440
cfg/1.8/node.yaml
Normal file
@ -0,0 +1,440 @@
|
||||
---
|
||||
controls:
|
||||
version: 1.8
|
||||
id: 2
|
||||
text: "Worker Node Security Configuration"
|
||||
type: "node"
|
||||
groups:
|
||||
- id: 2.1
|
||||
text: "Kubelet"
|
||||
checks:
|
||||
- id: 2.1.1
|
||||
text: "Ensure that the --allow-privileged argument is set to false (Scored)"
|
||||
audit: "ps -ef | grep $kubeletbin | grep -v grep"
|
||||
tests:
|
||||
test_items:
|
||||
- flag: "--allow-privileged"
|
||||
compare:
|
||||
op: eq
|
||||
value: false
|
||||
set: true
|
||||
remediation: |
|
||||
Edit the kubelet service file $kubeletunitfile
|
||||
on each worker node and set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable.
|
||||
--allow-privileged=false
|
||||
Based on your system, restart the kubelet service. For example:
|
||||
systemctl daemon-reload
|
||||
systemctl restart kubelet.service
|
||||
scored: true
|
||||
|
||||
- id: 2.1.2
|
||||
text: "Ensure that the --anonymous-auth argument is set to false (Scored)"
|
||||
audit: "ps -ef | grep $kubeletbin | grep -v grep"
|
||||
tests:
|
||||
test_items:
|
||||
- flag: "--anonymous-auth"
|
||||
compare:
|
||||
op: eq
|
||||
value: false
|
||||
set: true
|
||||
remediation: |
|
||||
Edit the kubelet service file $kubeletunitfile
|
||||
on each worker node and set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable.
|
||||
--anonymous-auth=false
|
||||
Based on your system, restart the kubelet service. For example:
|
||||
systemctl daemon-reload
|
||||
systemctl restart kubelet.service
|
||||
scored: true
|
||||
|
||||
- id: 2.1.3
|
||||
text: "Ensure that the --authorization-mode argument is not set to AlwaysAllow (Scored)"
|
||||
audit: "ps -ef | grep $kubeletbin | grep -v grep"
|
||||
tests:
|
||||
test_items:
|
||||
- flag: "--authorization-mode"
|
||||
compare:
|
||||
op: nothave
|
||||
value: "AlwaysAllow"
|
||||
set: true
|
||||
remediation: |
|
||||
Edit the kubelet service file $kubeletunitfile
|
||||
on each worker node and set the below parameter in KUBELET_AUTHZ_ARGS variable.
|
||||
--authorization-mode=Webhook
|
||||
Based on your system, restart the kubelet service. For example:
|
||||
systemctl daemon-reload
|
||||
systemctl restart kubelet.service
|
||||
scored: true
|
||||
|
||||
- id: 2.1.4
|
||||
text: "Ensure that the --client-ca-file argument is set as appropriate (Scored)"
|
||||
audit: "ps -ef | grep $kubeletbin | grep -v grep"
|
||||
tests:
|
||||
test_items:
|
||||
- flag: "--client-ca-file"
|
||||
set: true
|
||||
remediation: |
|
||||
Edit the kubelet service file $kubeletunitfile
|
||||
on each worker node and set the below parameter in KUBELET_AUTHZ_ARGS variable.
|
||||
--client-ca-file=<path/to/client-ca-file>
|
||||
Based on your system, restart the kubelet service. For example:
|
||||
systemctl daemon-reload
|
||||
systemctl restart kubelet.service
|
||||
scored: true
|
||||
|
||||
- id: 2.1.5
|
||||
text: "Ensure that the --read-only-port argument is set to 0 (Scored)"
|
||||
audit: "ps -ef | grep $kubeletbin | grep -v grep"
|
||||
tests:
|
||||
test_items:
|
||||
- flag: "--read-only-port"
|
||||
compare:
|
||||
op: eq
|
||||
value: 0
|
||||
set: true
|
||||
remediation: |
|
||||
Edit the kubelet service file $kubeletunitfile
|
||||
on each worker node and set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable.
|
||||
--read-only-port=0
|
||||
Based on your system, restart the kubelet service. For example:
|
||||
systemctl daemon-reload
|
||||
systemctl restart kubelet.service
|
||||
scored: true
|
||||
|
||||
- id: 2.1.6
|
||||
text: "Ensure that the --streaming-connection-idle-timeout argument is not set to 0 (Scored)"
|
||||
audit: "ps -ef | grep $kubeletbin | grep -v grep"
|
||||
tests:
|
||||
test_items:
|
||||
- flag: "--streaming-connection-idle-timeout"
|
||||
compare:
|
||||
op: noteq
|
||||
value: 0
|
||||
set: true
|
||||
remediation: |
|
||||
Edit the kubelet service file $kubeletunitfile
|
||||
on each worker node and set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable.
|
||||
--streaming-connection-idle-timeout=5m
|
||||
Based on your system, restart the kubelet service. For example:
|
||||
systemctl daemon-reload
|
||||
systemctl restart kubelet.service
|
||||
scored: true
|
||||
|
||||
- id: 2.1.7
|
||||
text: "Ensure that the --protect-kernel-defaults argument is set to true (Scored)"
|
||||
audit: "ps -ef | grep $kubeletbin | grep -v grep"
|
||||
tests:
|
||||
test_items:
|
||||
- flag: "--protect-kernel-defaults"
|
||||
compare:
|
||||
op: eq
|
||||
value: true
|
||||
set: true
|
||||
remediation: |
|
||||
Edit the kubelet service file $kubeletunitfile
|
||||
on each worker node and set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable.
|
||||
--protect-kernel-defaults=true
|
||||
Based on your system, restart the kubelet service. For example:
|
||||
systemctl daemon-reload
|
||||
systemctl restart kubelet.service
|
||||
scored: true
|
||||
|
||||
- id: 2.1.8
|
||||
text: "Ensure that the --make-iptables-util-chains argument is set to true (Scored)"
|
||||
audit: "ps -ef | grep $kubeletbin | grep -v grep"
|
||||
tests:
|
||||
bin_op: or
|
||||
test_items:
|
||||
- flag: "--make-iptables-util-chains"
|
||||
compare:
|
||||
op: eq
|
||||
value: true
|
||||
set: true
|
||||
remediation: |
|
||||
Edit the kubelet service file $kubeletunitfile
|
||||
on each worker node and remove the --make-iptables-util-chains argument from the
|
||||
KUBELET_SYSTEM_PODS_ARGS variable.
|
||||
Based on your system, restart the kubelet service. For example:
|
||||
systemctl daemon-reload
|
||||
systemctl restart kubelet.service
|
||||
scored: true
|
||||
|
||||
- id: 2.1.9
|
||||
text: "Ensure that the --keep-terminated-pod-volumes argument is set to false (Scored)"
|
||||
audit: "ps -ef | grep $kubeletbin | grep -v grep"
|
||||
tests:
|
||||
test_items:
|
||||
- flag: "--keep-terminated-pod-volumes"
|
||||
compare:
|
||||
op: eq
|
||||
value: false
|
||||
set: true
|
||||
remediation: |
|
||||
Edit the kubelet service file $kubeletunitfile
|
||||
on each worker node and set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable.
|
||||
--keep-terminated-pod-volumes=false
|
||||
Based on your system, restart the kubelet service. For example:
|
||||
systemctl daemon-reload
|
||||
systemctl restart kubelet.service
|
||||
scored: true
|
||||
|
||||
- id: 2.1.10
|
||||
text: "Ensure that the --hostname-override argument is not set (Scored)"
|
||||
audit: "ps -ef | grep $kubeletbin | grep -v grep"
|
||||
tests:
|
||||
test_items:
|
||||
- flag: "--hostname-override"
|
||||
set: false
|
||||
remediation: |
|
||||
Edit the kubelet service file $kubeletunitfile
|
||||
on each worker node and remove the --hostname-override argument from the
|
||||
KUBELET_SYSTEM_PODS_ARGS variable.
|
||||
Based on your system, restart the kubelet service. For example:
|
||||
systemctl daemon-reload
|
||||
systemctl restart kubelet.service
|
||||
scored: true
|
||||
|
||||
- id: 2.1.11
|
||||
text: "Ensure that the --event-qps argument is set to 0 (Scored)"
|
||||
audit: "ps -ef | grep $kubeletbin | grep -v grep"
|
||||
tests:
|
||||
test_items:
|
||||
- flag: "--event-qps"
|
||||
compare:
|
||||
op: eq
|
||||
value: 0
|
||||
set: true
|
||||
remediation: |
|
||||
Edit the kubelet service file $kubeletunitfile
|
||||
on each worker node and set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable.
|
||||
--event-qps=0
|
||||
Based on your system, restart the kubelet service. For example:
|
||||
systemctl daemon-reload
|
||||
systemctl restart kubelet.service
|
||||
scored: true
|
||||
|
||||
- id: 2.1.12
|
||||
text: "Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate (Scored)"
|
||||
audit: "ps -ef | grep $kubeletbin | grep -v grep"
|
||||
tests:
|
||||
test_items:
|
||||
- flag: "--tls-cert-file"
|
||||
set: true
|
||||
- flag: "--tls-private-key-file"
|
||||
set: true
|
||||
remediation: |
|
||||
Follow the Kubernetes documentation and set up the TLS connection on the Kubelet.
|
||||
Then edit the kubelet service file /etc/systemd/system/kubelet.service.d/10-
|
||||
kubeadm.conf on each worker node and set the below parameters in
|
||||
KUBELET_CERTIFICATE_ARGS variable.
|
||||
--tls-cert-file=<path/to/tls-certificate-file>
|
||||
file=<path/to/tls-key-file>
|
||||
--tls-private-key-
|
||||
Based on your system, restart the kubelet service. For example:
|
||||
systemctl daemon-reload
|
||||
systemctl restart kubelet.service
|
||||
scored: true
|
||||
|
||||
- id: 2.1.13
|
||||
text: "Ensure that the --cadvisor-port argument is set to 0 (Scored)"
|
||||
audit: "ps -ef | grep $kubeletbin | grep -v grep"
|
||||
tests:
|
||||
test_items:
|
||||
- flag: "--cadvisor-port"
|
||||
compare:
|
||||
op: eq
|
||||
value: 0
|
||||
set: true
|
||||
remediation: |
|
||||
Edit the kubelet service file $kubeletunitfile
|
||||
on each worker node and set the below parameter in KUBELET_CADVISOR_ARGS variable.
|
||||
--cadvisor-port=0
|
||||
Based on your system, restart the kubelet service. For example:
|
||||
systemctl daemon-reload
|
||||
systemctl restart kubelet.service
|
||||
scored: true
|
||||
|
||||
- id: 2.1.14
|
||||
text: "Ensure that the RotateKubeletClientCertificate argument is set to true"
|
||||
audit: "ps -ef | grep $kubeletbin | grep -v grep"
|
||||
tests:
|
||||
test_items:
|
||||
- flag: "RotateKubeletClientCertificate"
|
||||
compare:
|
||||
op: eq
|
||||
value: true
|
||||
set: true
|
||||
remediation: |
|
||||
Edit the kubelet service file $kubeletunitfile
|
||||
on each worker node and remove the --feature-
|
||||
gates=RotateKubeletClientCertificate=false argument from the
|
||||
KUBELET_CERTIFICATE_ARGS variable.
|
||||
Based on your system, restart the kubelet service. For example:
|
||||
systemctl daemon-reload
|
||||
systemctl restart kubelet.service
|
||||
scored: true
|
||||
|
||||
- id: 2.1.15
|
||||
text: "Ensure that the RotateKubeletServerCertificate argument is set to true"
|
||||
audit: "ps -ef | grep $kubeletbin | grep -v grep"
|
||||
tests:
|
||||
test_items:
|
||||
- flag: "RotateKubeletServerCertificate"
|
||||
compare:
|
||||
op: eq
|
||||
value: true
|
||||
set: true
|
||||
remediation: |
|
||||
Edit the kubelet service file $kubeletunitfile
|
||||
on each worker node and set the below parameter in KUBELET_CERTIFICATE_ARGS variable.
|
||||
--feature-gates=RotateKubeletServerCertificate=true
|
||||
Based on your system, restart the kubelet service. For example:
|
||||
systemctl daemon-reload
|
||||
systemctl restart kubelet.service
|
||||
scored: true
|
||||
|
||||
- id: 2.2
|
||||
text: "Configuration Files"
|
||||
checks:
|
||||
- id: 2.2.1
|
||||
text: "Ensure that the kubelet.conf file permissions are set to 644 or
|
||||
more restrictive (Scored)"
|
||||
audit: "/bin/sh -c 'if test -e $kubeletconf; then stat -c %a $kubeletconf; fi'"
|
||||
tests:
|
||||
bin_op: or
|
||||
test_items:
|
||||
- flag: "644"
|
||||
compare:
|
||||
op: eq
|
||||
value: "644"
|
||||
set: true
|
||||
- flag: "640"
|
||||
compare:
|
||||
op: eq
|
||||
value: "640"
|
||||
set: true
|
||||
- flag: "600"
|
||||
compare:
|
||||
op: eq
|
||||
value: "600"
|
||||
set: true
|
||||
remediation: |
|
||||
Run the below command (based on the file location on your system) on the each worker
|
||||
node. For example,
|
||||
chmod 644 $kubeletconf
|
||||
scored: true
|
||||
|
||||
- id: 2.2.2
|
||||
text: "Ensure that the kubelet.conf file ownership is set to root:root (Scored)"
|
||||
audit: "/bin/sh -c 'if test -e $kubeletconf; then stat -c %U:%G $kubeletconf; fi'"
|
||||
tests:
|
||||
test_items:
|
||||
- flag: "root:root"
|
||||
compare:
|
||||
op: eq
|
||||
value: root:root
|
||||
set: true
|
||||
remediation: |
|
||||
Run the below command (based on the file location on your system) on the each worker
|
||||
node. For example,
|
||||
chown root:root /etc/kubernetes/kubelet.conf
|
||||
scored: true
|
||||
|
||||
- id: 2.2.3
|
||||
text: "Ensure that the kubelet service file permissions are set to 644 or
|
||||
more restrictive (Scored)"
|
||||
audit: "/bin/sh -c 'if test -e $kubeletunitfile; then stat -c %a $kubeletunitfile; fi'"
|
||||
tests:
|
||||
bin_op: or
|
||||
test_items:
|
||||
- flag: "644"
|
||||
compare:
|
||||
op: eq
|
||||
value: 644
|
||||
set: true
|
||||
- flag: "640"
|
||||
compare:
|
||||
op: eq
|
||||
value: "640"
|
||||
set: true
|
||||
- flag: "600"
|
||||
compare:
|
||||
op: eq
|
||||
value: "600"
|
||||
set: true
|
||||
remediation: |
|
||||
Run the below command (based on the file location on your system) on the each worker
|
||||
node. For example,
|
||||
chmod 755 $kubeletunitfile
|
||||
scored: true
|
||||
|
||||
- id: 2.2.4
|
||||
text: "Ensure that the kubelet service file permissions are set to 644 or
|
||||
more restrictive (Scored)"
|
||||
audit: "/bin/sh -c 'if test -e $kubeletunitfile; then stat -c %U:%G $kubeletunitfile; fi'"
|
||||
tests:
|
||||
test_items:
|
||||
- flag: "root:root"
|
||||
set: true
|
||||
remediation: |
|
||||
Run the below command (based on the file location on your system) on the each worker
|
||||
node. For example,
|
||||
chown root:root $kubeletunitfile
|
||||
scored: true
|
||||
|
||||
- id: 2.2.5
|
||||
text: "Ensure that the proxy kubeconfig file permissions are set to 644 or more
|
||||
restrictive (Scored)"
|
||||
audit: "/bin/sh -c 'if test -e $proxyconf; then stat -c %a $proxyconf; fi'"
|
||||
tests:
|
||||
bin_op: or
|
||||
test_items:
|
||||
- flag: "644"
|
||||
compare:
|
||||
op: eq
|
||||
value: "644"
|
||||
set: true
|
||||
- flag: "640"
|
||||
compare:
|
||||
op: eq
|
||||
value: "640"
|
||||
set: true
|
||||
- flag: "600"
|
||||
compare:
|
||||
op: eq
|
||||
value: "600"
|
||||
set: true
|
||||
remediation: |
|
||||
Run the below command (based on the file location on your system) on the each worker
|
||||
node. For example,
|
||||
chmod 644 $proxyconf
|
||||
scored: true
|
||||
|
||||
- id: 2.2.6
|
||||
text: "Ensure that the proxy kubeconfig file ownership is set to root:root (Scored)"
|
||||
tests:
|
||||
test_items:
|
||||
- flag: "root:root"
|
||||
set: true
|
||||
remediation: |
|
||||
Run the below command (based on the file location on your system) on the each worker
|
||||
node. For example,
|
||||
chown root:root $proxyconf
|
||||
scored: true
|
||||
|
||||
- id: 2.2.7
|
||||
text: "Ensure that the certificate authorities file permissions are set to
|
||||
644 or more restrictive (Scored)"
|
||||
type: manual
|
||||
remediation: |
|
||||
Run the following command to modify the file permissions of the --client-ca-file
|
||||
chmod 644 <filename>
|
||||
scored: true
|
||||
|
||||
- id: 2.2.8
|
||||
text: "Ensure that the client certificate authorities file ownership is set to root:root"
|
||||
audit: "/bin/sh -c 'if test -e $ca-file; then stat -c %U:%G $ca-file; fi'"
|
||||
type: manual
|
||||
remediation: |
|
||||
Run the following command to modify the ownership of the --client-ca-file .
|
||||
chown root:root <filename>
|
||||
scored: true
|
||||
@ -26,42 +26,54 @@ master:
|
||||
- "hyperkube apiserver"
|
||||
- "apiserver"
|
||||
confs:
|
||||
- /etc/kubernetes/manifests/kube-apiserver.yaml
|
||||
- /etc/kubernetes/apiserver.conf
|
||||
- /etc/kubernetes/apiserver
|
||||
defaultconf: /etc/kubernetes/apiserver
|
||||
|
||||
podspecs:
|
||||
- /etc/kubernetes/manifests/kube-apiserver.yaml
|
||||
defaultpodspec: /etc/kubernetes/manifests/kube-apiserver.yaml
|
||||
|
||||
scheduler:
|
||||
bins:
|
||||
- "kube-scheduler"
|
||||
- "hyperkube scheduler"
|
||||
- "scheduler"
|
||||
confs:
|
||||
- /etc/kubernetes/manifests/kube-scheduler.yaml
|
||||
- /etc/kubernetes/scheduler.conf
|
||||
- /etc/kubernetes/scheduler
|
||||
defaultconf: /etc/kubernetes/scheduler
|
||||
|
||||
podspecs:
|
||||
- /etc/kubernetes/manifests/kube-scheduler.yaml
|
||||
defaultpodspec: /etc/kubernetes/manifests/kube-scheduler.yaml
|
||||
|
||||
controllermanager:
|
||||
bins:
|
||||
- "kube-controller-manager"
|
||||
- "hyperkube controller-manager"
|
||||
- "controller-manager"
|
||||
confs:
|
||||
- /etc/kubernetes/manifests/kube-controller-manager.yaml
|
||||
- /etc/kubernetes/controller-manager.conf
|
||||
- /etc/kubernetes/controller-manager
|
||||
defaultconf: /etc/kubernetes/controller-manager
|
||||
|
||||
podspecs:
|
||||
- /etc/kubernetes/manifests/kube-controller-manager.yaml
|
||||
defaultpodspec: /etc/kubernetes/manifests/kube-controller-manager.yaml
|
||||
|
||||
etcd:
|
||||
optional: true
|
||||
bins:
|
||||
- "etcd"
|
||||
confs:
|
||||
- /etc/kubernetes/manifests/etcd.yaml
|
||||
- /etc/etcd/etcd.conf
|
||||
defaultconf: /etc/etcd/etcd.conf
|
||||
|
||||
podspecs:
|
||||
- /etc/kubernetes/manifests/etcd.yaml
|
||||
defaultpodspec: /etc/kubernetes/manifests/etcd.yaml
|
||||
|
||||
flanneld:
|
||||
optional: true
|
||||
bins:
|
||||
@ -88,6 +100,10 @@ node:
|
||||
- /etc/kubernetes/kubelet
|
||||
defaultconf: "/etc/kubernetes/kubelet.conf"
|
||||
|
||||
unitfiles:
|
||||
- /etc/systemd/system/kubelet.service.d/10-kubeadm.conf
|
||||
defaultunitfile: /etc/systemd/system/kubelet.service.d/10-kubeadm.conf
|
||||
|
||||
proxy:
|
||||
bins:
|
||||
- "kube-proxy"
|
||||
|
||||
@ -29,24 +29,6 @@ import (
|
||||
)
|
||||
|
||||
var (
|
||||
apiserverBin string
|
||||
apiserverConf string
|
||||
schedulerBin string
|
||||
schedulerConf string
|
||||
controllerManagerBin string
|
||||
controllerManagerConf string
|
||||
config string
|
||||
etcdBin string
|
||||
etcdConf string
|
||||
flanneldBin string
|
||||
flanneldConf string
|
||||
kubeletBin string
|
||||
kubeletConf string
|
||||
proxyBin string
|
||||
proxyConf string
|
||||
fedApiserverBin string
|
||||
fedControllerManagerBin string
|
||||
|
||||
errmsgs string
|
||||
)
|
||||
|
||||
@ -71,7 +53,9 @@ func runChecks(t check.NodeType) {
|
||||
// Get the set of exectuables and config files we care about on this type of node. This also
|
||||
// checks that the executables we need for the node type are running.
|
||||
binmap := getBinaries(typeConf)
|
||||
confmap := getConfigFiles(typeConf)
|
||||
confmap := getConfigFiles(typeConf, "conf")
|
||||
podspecmap := getConfigFiles(typeConf, "podspec")
|
||||
unitfilemap := getConfigFiles(typeConf, "unitfile")
|
||||
|
||||
switch t {
|
||||
case check.MASTER:
|
||||
@ -93,6 +77,8 @@ func runChecks(t check.NodeType) {
|
||||
s := string(in)
|
||||
s = makeSubstitutions(s, "bin", binmap)
|
||||
s = makeSubstitutions(s, "conf", confmap)
|
||||
s = makeSubstitutions(s, "podspec", podspecmap)
|
||||
s = makeSubstitutions(s, "unitfile", unitfilemap)
|
||||
|
||||
glog.V(1).Info(fmt.Sprintf("Using config file: %s\n", viper.ConfigFileUsed()))
|
||||
glog.V(1).Info(fmt.Sprintf("Using benchmark file: %s\n", path))
|
||||
|
||||
10
cmd/util.go
10
cmd/util.go
@ -117,7 +117,9 @@ func getBinaries(v *viper.Viper) map[string]string {
|
||||
}
|
||||
|
||||
// getConfigFiles finds which of the set of candidate config files exist
|
||||
func getConfigFiles(v *viper.Viper) map[string]string {
|
||||
// accepts a string 't' which indicates the type of config file, conf,
|
||||
// podspec or untifile.
|
||||
func getConfigFiles(v *viper.Viper, t string) map[string]string {
|
||||
confmap := make(map[string]string)
|
||||
|
||||
for _, component := range v.GetStringSlice("components") {
|
||||
@ -127,10 +129,10 @@ func getConfigFiles(v *viper.Viper) map[string]string {
|
||||
}
|
||||
|
||||
// See if any of the candidate config files exist
|
||||
conf := findConfigFile(s.GetStringSlice("confs"))
|
||||
conf := findConfigFile(s.GetStringSlice(t + "s"))
|
||||
if conf == "" {
|
||||
if s.IsSet("defaultconf") {
|
||||
conf = s.GetString("defaultconf")
|
||||
if s.IsSet("default" + t) {
|
||||
conf = s.GetString("default" + t)
|
||||
glog.V(2).Info(fmt.Sprintf("Using default config file name '%s' for component %s", conf, component))
|
||||
} else {
|
||||
// Default the config file name that we'll substitute to the name of the component
|
||||
|
||||
@ -282,7 +282,7 @@ func TestGetConfigFiles(t *testing.T) {
|
||||
e = c.statResults
|
||||
eIndex = 0
|
||||
|
||||
m := getConfigFiles(v)
|
||||
m := getConfigFiles(v, "conf")
|
||||
if !reflect.DeepEqual(m, c.exp) {
|
||||
t.Fatalf("Got %v\nExpected %v", m, c.exp)
|
||||
}
|
||||
|
||||
Loading…
Reference in New Issue
Block a user