commit
7626dc2705
@ -0,0 +1,35 @@
|
|||||||
|
---
|
||||||
|
## Controls Files.
|
||||||
|
# These are YAML files that hold all the details for running checks.
|
||||||
|
#
|
||||||
|
## Uncomment to use different control file paths.
|
||||||
|
# masterControls: ./cfg/master.yaml
|
||||||
|
# nodeControls: ./cfg/node.yaml
|
||||||
|
# federatedControls: ./cfg/federated.yaml
|
||||||
|
|
||||||
|
master:
|
||||||
|
apiserver:
|
||||||
|
bins:
|
||||||
|
- openshift start master api
|
||||||
|
defaultconf: /etc/origin/master/master-config.yaml
|
||||||
|
|
||||||
|
scheduler:
|
||||||
|
bins:
|
||||||
|
- openshift start master controllers
|
||||||
|
defaultconf: /etc/origin/master/master-config.yaml
|
||||||
|
|
||||||
|
controllermanager:
|
||||||
|
bins:
|
||||||
|
- openshift start master controllers
|
||||||
|
defaultconf: /etc/origin/master/master-config.yaml
|
||||||
|
|
||||||
|
etcd:
|
||||||
|
defaultconf: /etc/kubernetes/manifests/etcd.yaml
|
||||||
|
|
||||||
|
node:
|
||||||
|
kubelet:
|
||||||
|
defaultconf: /etc/kubernetes/kubelet.conf
|
||||||
|
defaultsvc: /etc/systemd/system/kubelet.service.d/10-kubeadm.conf
|
||||||
|
|
||||||
|
proxy:
|
||||||
|
defaultconf: /etc/kubernetes/addons/kube-proxy-daemonset.yaml
|
@ -0,0 +1,113 @@
|
|||||||
|
---
|
||||||
|
controls:
|
||||||
|
id: 3
|
||||||
|
text: "Federated Deployments"
|
||||||
|
type: "federated"
|
||||||
|
groups:
|
||||||
|
- id: 3.1
|
||||||
|
text: "Federated API Server"
|
||||||
|
checks:
|
||||||
|
- id: 3.1.1
|
||||||
|
text: "Ensure that the --anonymous-auth argument is set to false (Scored)"
|
||||||
|
type: "skip"
|
||||||
|
scored: true
|
||||||
|
|
||||||
|
- id: 3.1.2
|
||||||
|
text: "Ensure that the --basic-auth-file argument is not set (Scored)"
|
||||||
|
type: "skip"
|
||||||
|
scored: true
|
||||||
|
|
||||||
|
- id: 3.1.3
|
||||||
|
text: "Ensure that the --insecure-allow-any-token argument is not set (Scored)"
|
||||||
|
type: "skip"
|
||||||
|
scored: true
|
||||||
|
|
||||||
|
- id: 3.1.4
|
||||||
|
text: "Ensure that the --insecure-bind-address argument is not set (Scored)"
|
||||||
|
type: "skip"
|
||||||
|
scored: true
|
||||||
|
|
||||||
|
- id: 3.1.5
|
||||||
|
text: "Ensure that the --insecure-port argument is set to 0 (Scored)"
|
||||||
|
type: "skip"
|
||||||
|
scored: true
|
||||||
|
|
||||||
|
- id: 3.1.6
|
||||||
|
text: "Ensure that the --secure-port argument is not set to 0 (Scored)"
|
||||||
|
type: "skip"
|
||||||
|
scored: true
|
||||||
|
|
||||||
|
- id: 3.1.7
|
||||||
|
text: "Ensure that the --profiling argument is set to false (Scored)"
|
||||||
|
type: "skip"
|
||||||
|
scored: true
|
||||||
|
|
||||||
|
- id: 3.1.8
|
||||||
|
text: "Ensure that the admission control policy is not set to AlwaysAdmit (Scored)"
|
||||||
|
type: "skip"
|
||||||
|
scored: true
|
||||||
|
|
||||||
|
- id: 3.1.9
|
||||||
|
text: "Ensure that the admission control policy is set to NamespaceLifecycle (Scored)"
|
||||||
|
type: "skip"
|
||||||
|
scored: true
|
||||||
|
|
||||||
|
- id: 3.1.10
|
||||||
|
text: "Ensure that the --audit-log-path argument is set as appropriate (Scored)"
|
||||||
|
type: "skip"
|
||||||
|
scored: true
|
||||||
|
|
||||||
|
- id: 3.1.11
|
||||||
|
text: "Ensure that the --audit-log-maxage argument is set to 30 or as appropriate (Scored)"
|
||||||
|
type: "skip"
|
||||||
|
scored: true
|
||||||
|
|
||||||
|
- id: 3.1.12
|
||||||
|
text: "Ensure that the --audit-log-maxbackup argument is set to 10 or as appropriate (Scored)"
|
||||||
|
type: "skip"
|
||||||
|
scored: true
|
||||||
|
|
||||||
|
- id: 3.1.13
|
||||||
|
text: "Ensure that the --audit-log-maxsize argument is set to 100 or as appropriate (Scored)"
|
||||||
|
type: "skip"
|
||||||
|
scored: true
|
||||||
|
|
||||||
|
- id: 3.1.14
|
||||||
|
text: "Ensure that the --authorization-mode argument is not set to AlwaysAllow (Scored)"
|
||||||
|
type: "skip"
|
||||||
|
scored: true
|
||||||
|
|
||||||
|
- id: 3.1.15
|
||||||
|
text: "Ensure that the --token-auth-file parameter is not set (Scored)"
|
||||||
|
type: "skip"
|
||||||
|
scored: true
|
||||||
|
|
||||||
|
- id: 3.1.16
|
||||||
|
text: "Ensure that the --service-account-lookup argument is set to true (Scored)"
|
||||||
|
type: "skip"
|
||||||
|
scored: true
|
||||||
|
|
||||||
|
- id: 3.1.17
|
||||||
|
text: "Ensure that the --service-account-key-file argument is set as appropriate (Scored)"
|
||||||
|
type: "skip"
|
||||||
|
scored: true
|
||||||
|
|
||||||
|
- id: 3.1.18
|
||||||
|
text: "Ensure that the --etcd-certfile and --etcd-keyfile arguments are set as appropriate (Scored)"
|
||||||
|
type: "skip"
|
||||||
|
scored: true
|
||||||
|
|
||||||
|
- id: 3.1.19
|
||||||
|
text: "Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate (Scored)"
|
||||||
|
type: "skip"
|
||||||
|
scored: true
|
||||||
|
|
||||||
|
|
||||||
|
- id: 3.2
|
||||||
|
text: "Federation Controller Manager"
|
||||||
|
checks:
|
||||||
|
- id: 3.2.1
|
||||||
|
text: "Ensure that the --profiling argument is set to false (Scored)"
|
||||||
|
type: "skip"
|
||||||
|
scored: true
|
||||||
|
|
File diff suppressed because it is too large
Load Diff
@ -0,0 +1,30 @@
|
|||||||
|
package check
|
||||||
|
|
||||||
|
import (
|
||||||
|
"testing"
|
||||||
|
)
|
||||||
|
|
||||||
|
func TestCheck_Run(t *testing.T) {
|
||||||
|
type TestCase struct {
|
||||||
|
check Check
|
||||||
|
Expected State
|
||||||
|
}
|
||||||
|
|
||||||
|
testCases := []TestCase{
|
||||||
|
{check: Check{Type: "manual"}, Expected: WARN},
|
||||||
|
{check: Check{Type: "skip"}, Expected: INFO},
|
||||||
|
{check: Check{Type: "", Scored: false}, Expected: WARN}, // Not scored checks with no type should be marked warn
|
||||||
|
{check: Check{Type: "", Scored: true}, Expected: WARN}, // If there are no tests in the check, warn
|
||||||
|
{check: Check{Type: "manual", Scored: false}, Expected: WARN},
|
||||||
|
{check: Check{Type: "skip", Scored: false}, Expected: INFO},
|
||||||
|
}
|
||||||
|
|
||||||
|
for _, testCase := range testCases {
|
||||||
|
|
||||||
|
testCase.check.Run()
|
||||||
|
|
||||||
|
if testCase.check.State != testCase.Expected {
|
||||||
|
t.Errorf("test failed, expected %s, actual %s\n", testCase.Expected, testCase.check.State)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
Loading…
Reference in new issue