diff --git a/cfg/cis-1.3/master.yaml b/cfg/cis-1.3/master.yaml index b17e5c3..eae6295 100644 --- a/cfg/cis-1.3/master.yaml +++ b/cfg/cis-1.3/master.yaml @@ -637,12 +637,18 @@ groups: text: "Ensure that the AdvancedAuditing argument is not set to false (Scored)" audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep" tests: + bin_op: or test_items: - flag: "--audit-policy-file" compare: op: eq value: "/etc/kubernetes/audit-policy.yaml" set: true + - flag: "--audit-policy-file" + compare: + op: eq + value: "/etc/kubernetes/audit-policy.yml" + set: true remediation: | Follow the Kubernetes documentation and set the desired audit policy in the /etc/kubernetes/audit-policy.yaml file. Then, edit the API server pod specification file $apiserverconf diff --git a/cfg/cis-1.4/master.yaml b/cfg/cis-1.4/master.yaml index 8c030f7..c229917 100644 --- a/cfg/cis-1.4/master.yaml +++ b/cfg/cis-1.4/master.yaml @@ -641,12 +641,18 @@ groups: text: "Ensure that the AdvancedAuditing argument is not set to false (Scored)" audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep" tests: + bin_op: or test_items: - flag: "--audit-policy-file" compare: op: eq value: "/etc/kubernetes/audit-policy.yaml" set: true + - flag: "--audit-policy-file" + compare: + op: eq + value: "/etc/kubernetes/audit-policy.yml" + set: true remediation: | Follow the Kubernetes documentation and set the desired audit policy in the /etc/kubernetes/audit-policy.yaml file. Then, edit the API server pod specification file $apiserverconf diff --git a/cfg/config.yaml b/cfg/config.yaml index d9ba159..2240bd8 100644 --- a/cfg/config.yaml +++ b/cfg/config.yaml @@ -27,6 +27,7 @@ master: - "apiserver" confs: - /etc/kubernetes/manifests/kube-apiserver.yaml + - /etc/kubernetes/manifests/kube-apiserver.yml - /etc/kubernetes/manifests/kube-apiserver.manifest - /var/snap/kube-apiserver/current/args defaultconf: /etc/kubernetes/manifests/kube-apiserver.yaml @@ -39,6 +40,7 @@ master: - "scheduler" confs: - /etc/kubernetes/manifests/kube-scheduler.yaml + - /etc/kubernetes/manifests/kube-scheduler.yml - /etc/kubernetes/manifests/kube-scheduler.manifest - /var/snap/kube-scheduler/current/args defaultconf: /etc/kubernetes/manifests/kube-scheduler.yaml @@ -52,6 +54,7 @@ master: - "controller-manager" confs: - /etc/kubernetes/manifests/kube-controller-manager.yaml + - /etc/kubernetes/manifests/kube-controller-manager.yml - /etc/kubernetes/manifests/kube-controller-manager.manifest - /var/snap/kube-controller-manager/current/args defaultconf: /etc/kubernetes/manifests/kube-controller-manager.yaml @@ -62,9 +65,11 @@ master: - "etcd" confs: - /etc/kubernetes/manifests/etcd.yaml + - /etc/kubernetes/manifests/etcd.yml - /etc/kubernetes/manifests/etcd.manifest - /etc/etcd/etcd.conf - /var/snap/etcd/common/etcd.conf.yml + - /var/snap/etcd/common/etcd.conf.yaml defaultconf: /etc/kubernetes/manifests/etcd.yaml flanneld: @@ -104,8 +109,10 @@ node: - "/etc/kubernetes/kubelet-kubeconfig" confs: - "/var/lib/kubelet/config.yaml" + - "/var/lib/kubelet/config.yml" - "/etc/kubernetes/kubelet/kubelet-config.json" - "/home/kubernetes/kubelet-config.yaml" + - "/home/kubernetes/kubelet-config.yml" - "/etc/default/kubelet" - "/var/lib/kubelet/kubeconfig" - "/var/snap/kubelet/current/args" @@ -133,6 +140,7 @@ node: confs: - /etc/kubernetes/proxy - /etc/kubernetes/addons/kube-proxy-daemonset.yaml + - /etc/kubernetes/addons/kube-proxy-daemonset.yml - /var/snap/kube-proxy/current/args kubeconfig: - "/etc/kubernetes/kubelet-kubeconfig" @@ -151,9 +159,11 @@ etcd: - "etcd" confs: - /etc/kubernetes/manifests/etcd.yaml + - /etc/kubernetes/manifests/etcd.yml - /etc/kubernetes/manifests/etcd.manifest - /etc/etcd/etcd.conf - /var/snap/etcd/common/etcd.conf.yml + - /var/snap/etcd/common/etcd.conf.yaml defaultconf: /etc/kubernetes/manifests/etcd.yaml controlplane: diff --git a/cfg/node_only.yaml b/cfg/node_only.yaml index d4bcba9..31b6ba8 100644 --- a/cfg/node_only.yaml +++ b/cfg/node_only.yaml @@ -29,8 +29,10 @@ node: - "/etc/kubernetes/kubelet-kubeconfig" confs: - "/var/lib/kubelet/config.yaml" + - "/var/lib/kubelet/config.yml" - "/etc/kubernetes/kubelet/kubelet-config.json" - "/home/kubernetes/kubelet-config.yaml" + - "/home/kubernetes/kubelet-config.yml" - "/etc/default/kubelet" ## Due to the fact that the kubelet might be configured ## without a kubelet-config file, we use a work-around