arno/kube-bench
1
0
Fork 0
mirror of https://github.com/aquasecurity/kube-bench.git synced 2025-08-02 11:58:28 +00:00
Code Issues Releases Wiki Activity

fix test cases

Browse Source
This commit is contained in:
LaibaBareera 2025-06-17 12:28:59 +05:00
parent dbe7ed14cc
commit 365dc40eea
1 changed files with 6 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
cfg/aks-1.7/policies.yaml
View File

@ -12,9 +12,9 @@ groups:
text: "Ensure that the cluster-admin role is only used where required (Automated)" text: "Ensure that the cluster-admin role is only used where required (Automated)"
audit: | audit: |
kubectl get clusterrolebindings -o json | jq -r ' kubectl get clusterrolebindings -o json | jq -r '
.items[] .items[]
| select(.roleRef.name == "cluster-admin") | select(.roleRef.name == "cluster-admin")
| .subjects[]? | .subjects[]?
| select(.kind != "Group" or (.name != "system:masters" and .name != "system:nodes")) | select(.kind != "Group" or (.name != "system:masters" and .name != "system:nodes"))
| "FOUND_CLUSTER_ADMIN_BINDING" | "FOUND_CLUSTER_ADMIN_BINDING"
' || echo "NO_CLUSTER_ADMIN_BINDINGS" ' || echo "NO_CLUSTER_ADMIN_BINDINGS"
@ -41,9 +41,9 @@ groups:
text: "Minimize access to secrets (Automated)" text: "Minimize access to secrets (Automated)"
audit: | audit: |
count=$(kubectl get roles --all-namespaces -o json | jq ' count=$(kubectl get roles --all-namespaces -o json | jq '
.items[] .items[]
| select(.rules[]? | select(.rules[]?
| (.resources[]? == "secrets") | (.resources[]? == "secrets")
and ((.verbs[]? == "get") or (.verbs[]? == "list") or (.verbs[]? == "watch")) and ((.verbs[]? == "get") or (.verbs[]? == "list") or (.verbs[]? == "watch"))
)' | wc -l) )' | wc -l)
@ -341,7 +341,6 @@ groups:
scored: true scored: true
- id: 4.5 - id: 4.5
text: "Secrets Management" text: "Secrets Management"
checks: checks:
@ -416,4 +415,3 @@ groups:
kubectl get deployment my-app -n default -o yaml | sed 's/namespace: default/namespace: my-namespace/' | kubectl apply -f - kubectl get deployment my-app -n default -o yaml | sed 's/namespace: default/namespace: my-namespace/' | kubectl apply -f -
kubectl delete deployment my-app -n default kubectl delete deployment my-app -n default
scored: true scored: true