Liz Rice
5 years ago
committed by
GitHub
commit
7626dc2705
@ -0,0 +1,35 @@
|
||||
---
|
||||
## Controls Files.
|
||||
# These are YAML files that hold all the details for running checks.
|
||||
#
|
||||
## Uncomment to use different control file paths.
|
||||
# masterControls: ./cfg/master.yaml
|
||||
# nodeControls: ./cfg/node.yaml
|
||||
# federatedControls: ./cfg/federated.yaml
|
||||
|
||||
master:
|
||||
apiserver:
|
||||
bins:
|
||||
- openshift start master api
|
||||
defaultconf: /etc/origin/master/master-config.yaml
|
||||
|
||||
scheduler:
|
||||
bins:
|
||||
- openshift start master controllers
|
||||
defaultconf: /etc/origin/master/master-config.yaml
|
||||
|
||||
controllermanager:
|
||||
bins:
|
||||
- openshift start master controllers
|
||||
defaultconf: /etc/origin/master/master-config.yaml
|
||||
|
||||
etcd:
|
||||
defaultconf: /etc/kubernetes/manifests/etcd.yaml
|
||||
|
||||
node:
|
||||
kubelet:
|
||||
defaultconf: /etc/kubernetes/kubelet.conf
|
||||
defaultsvc: /etc/systemd/system/kubelet.service.d/10-kubeadm.conf
|
||||
|
||||
proxy:
|
||||
defaultconf: /etc/kubernetes/addons/kube-proxy-daemonset.yaml
|
||||
@ -0,0 +1,113 @@
|
||||
---
|
||||
controls:
|
||||
id: 3
|
||||
text: "Federated Deployments"
|
||||
type: "federated"
|
||||
groups:
|
||||
- id: 3.1
|
||||
text: "Federated API Server"
|
||||
checks:
|
||||
- id: 3.1.1
|
||||
text: "Ensure that the --anonymous-auth argument is set to false (Scored)"
|
||||
type: "skip"
|
||||
scored: true
|
||||
|
||||
- id: 3.1.2
|
||||
text: "Ensure that the --basic-auth-file argument is not set (Scored)"
|
||||
type: "skip"
|
||||
scored: true
|
||||
|
||||
- id: 3.1.3
|
||||
text: "Ensure that the --insecure-allow-any-token argument is not set (Scored)"
|
||||
type: "skip"
|
||||
scored: true
|
||||
|
||||
- id: 3.1.4
|
||||
text: "Ensure that the --insecure-bind-address argument is not set (Scored)"
|
||||
type: "skip"
|
||||
scored: true
|
||||
|
||||
- id: 3.1.5
|
||||
text: "Ensure that the --insecure-port argument is set to 0 (Scored)"
|
||||
type: "skip"
|
||||
scored: true
|
||||
|
||||
- id: 3.1.6
|
||||
text: "Ensure that the --secure-port argument is not set to 0 (Scored)"
|
||||
type: "skip"
|
||||
scored: true
|
||||
|
||||
- id: 3.1.7
|
||||
text: "Ensure that the --profiling argument is set to false (Scored)"
|
||||
type: "skip"
|
||||
scored: true
|
||||
|
||||
- id: 3.1.8
|
||||
text: "Ensure that the admission control policy is not set to AlwaysAdmit (Scored)"
|
||||
type: "skip"
|
||||
scored: true
|
||||
|
||||
- id: 3.1.9
|
||||
text: "Ensure that the admission control policy is set to NamespaceLifecycle (Scored)"
|
||||
type: "skip"
|
||||
scored: true
|
||||
|
||||
- id: 3.1.10
|
||||
text: "Ensure that the --audit-log-path argument is set as appropriate (Scored)"
|
||||
type: "skip"
|
||||
scored: true
|
||||
|
||||
- id: 3.1.11
|
||||
text: "Ensure that the --audit-log-maxage argument is set to 30 or as appropriate (Scored)"
|
||||
type: "skip"
|
||||
scored: true
|
||||
|
||||
- id: 3.1.12
|
||||
text: "Ensure that the --audit-log-maxbackup argument is set to 10 or as appropriate (Scored)"
|
||||
type: "skip"
|
||||
scored: true
|
||||
|
||||
- id: 3.1.13
|
||||
text: "Ensure that the --audit-log-maxsize argument is set to 100 or as appropriate (Scored)"
|
||||
type: "skip"
|
||||
scored: true
|
||||
|
||||
- id: 3.1.14
|
||||
text: "Ensure that the --authorization-mode argument is not set to AlwaysAllow (Scored)"
|
||||
type: "skip"
|
||||
scored: true
|
||||
|
||||
- id: 3.1.15
|
||||
text: "Ensure that the --token-auth-file parameter is not set (Scored)"
|
||||
type: "skip"
|
||||
scored: true
|
||||
|
||||
- id: 3.1.16
|
||||
text: "Ensure that the --service-account-lookup argument is set to true (Scored)"
|
||||
type: "skip"
|
||||
scored: true
|
||||
|
||||
- id: 3.1.17
|
||||
text: "Ensure that the --service-account-key-file argument is set as appropriate (Scored)"
|
||||
type: "skip"
|
||||
scored: true
|
||||
|
||||
- id: 3.1.18
|
||||
text: "Ensure that the --etcd-certfile and --etcd-keyfile arguments are set as appropriate (Scored)"
|
||||
type: "skip"
|
||||
scored: true
|
||||
|
||||
- id: 3.1.19
|
||||
text: "Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate (Scored)"
|
||||
type: "skip"
|
||||
scored: true
|
||||
|
||||
|
||||
- id: 3.2
|
||||
text: "Federation Controller Manager"
|
||||
checks:
|
||||
- id: 3.2.1
|
||||
text: "Ensure that the --profiling argument is set to false (Scored)"
|
||||
type: "skip"
|
||||
scored: true
|
||||
|
||||
File diff suppressed because it is too large
Load Diff
@ -0,0 +1,30 @@
|
||||
package check
|
||||
|
||||
import (
|
||||
"testing"
|
||||
)
|
||||
|
||||
func TestCheck_Run(t *testing.T) {
|
||||
type TestCase struct {
|
||||
check Check
|
||||
Expected State
|
||||
}
|
||||
|
||||
testCases := []TestCase{
|
||||
{check: Check{Type: "manual"}, Expected: WARN},
|
||||
{check: Check{Type: "skip"}, Expected: INFO},
|
||||
{check: Check{Type: "", Scored: false}, Expected: WARN}, // Not scored checks with no type should be marked warn
|
||||
{check: Check{Type: "", Scored: true}, Expected: WARN}, // If there are no tests in the check, warn
|
||||
{check: Check{Type: "manual", Scored: false}, Expected: WARN},
|
||||
{check: Check{Type: "skip", Scored: false}, Expected: INFO},
|
||||
}
|
||||
|
||||
for _, testCase := range testCases {
|
||||
|
||||
testCase.check.Run()
|
||||
|
||||
if testCase.check.State != testCase.Expected {
|
||||
t.Errorf("test failed, expected %s, actual %s\n", testCase.Expected, testCase.check.State)
|
||||
}
|
||||
}
|
||||
}
|
||||
Loading…
Reference in new issue