retire cis 1.3 and 1.4 (#693)

README.md

@@ -56,9 +56,7 @@ kube-bench supports the tests for Kubernetes as defined in the [CIS Kubernetes B
 
 | CIS Kubernetes Benchmark | kube-bench config | Kubernetes versions |
 |---|---|---|
-| [1.3.0](https://workbench.cisecurity.org/benchmarks/602) | cis-1.3 | 1.11-1.12 |
+| [1.5.1](https://workbench.cisecurity.org/benchmarks/4892) | cis-1.5 | 1.15- |
-| [1.4.1](https://workbench.cisecurity.org/benchmarks/2351) | cis-1.4 | 1.13-1.14 |
-| [1.5.1](https://workbench.cisecurity.org/benchmarks/4892) | cis-1.5 | 1.15 |
 | [1.6.0](https://workbench.cisecurity.org/benchmarks/4834) | cis-1.6 | 1.16- |
 | [GKE 1.0.0](https://workbench.cisecurity.org/benchmarks/4536) | gke-1.0 | GKE |
 | [EKS 1.0.0](https://workbench.cisecurity.org/benchmarks/5190) | eks-1.0 | EKS |
@@ -99,18 +97,18 @@ Or run kube-bench against a worker node using the tests for Kubernetes version 1
 kube-bench node --version 1.13
 ```
 
-`kube-bench` will map the `--version` to the corresponding CIS Benchmark version as indicated by the mapping table above. For example, if you specify `--version 1.13`, this is mapped to CIS Benchmark version `cis-1.14`.
+`kube-bench` will map the `--version` to the corresponding CIS Benchmark version as indicated by the mapping table above. For example, if you specify `--version 1.15`, this is mapped to CIS Benchmark version `cis-1.15`.
 
 Alternatively, you can specify `--benchmark` to run a specific CIS Benchmark version:
 
 ```
-kube-bench node --benchmark cis-1.4
+kube-bench node --benchmark cis-1.5
 ```
 
 If you want to target specific CIS Benchmark `target` (i.e master, node, etcd, etc...)
 you can use the `run --targets` subcommand.
 ```
-kube-bench --benchmark cis-1.4 run --targets master,node
+kube-bench --benchmark cis-1.5 run --targets master,node
 ```
 or
 ```
@@ -120,8 +118,6 @@ kube-bench --benchmark cis-1.5 run --targets master,node,etcd,policies
 The following table shows the valid targets based on the CIS Benchmark version.
 | CIS Benchmark | Targets |
 |---|---|
-| cis-1.3| master, node |
-| cis-1.4| master, node |
 | cis-1.5| master, controlplane, node, etcd, policies |
 | cis-1.6| master, controlplane, node, etcd, policies |
 | gke-1.0| master, controlplane, node, etcd, policies, managedservices |
@@ -130,7 +126,7 @@ The following table shows the valid targets based on the CIS Benchmark version.
 If no targets are specified, `kube-bench` will determine the appropriate targets based on the CIS Benchmark version.
 
 `controls` for the various versions of CIS Benchmark can be found in directories
-with same name as the CIS Benchmark versions under `cfg/`, for example `cfg/cis-1.4`.
+with same name as the CIS Benchmark versions under `cfg/`, for example `cfg/cis-1.5`.
 
 **Note:**  **`It is an error to specify both --version and --benchmark flags together`**
 

cfg/cis-1.3/config.yaml

@@ -1,2 +0,0 @@
----
-## Version-specific settings that override the values in cfg/config.yaml

cfg/cis-1.3/node.yaml

@@ -1,500 +0,0 @@
----
-controls:
-version: "1.11"
-id: "2"
-text: Worker Node Security Configuration
-type: "node"
-groups:
-  - id: "2.1"
-    text: Kubelet
-    checks:
-      - id: 2.1.1
-        text: Ensure that the --allow-privileged argument is set to false (Scored)
-        audit: "/bin/ps -fC $kubeletbin "
-        tests:
-          test_items:
-            - flag: --allow-privileged
-              set: true
-              compare:
-                op: eq
-                value: false
-        remediation: |
-          Edit the kubelet service file $kubeletsvc
-          on each worker node and set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable.
-          --allow-privileged=false
-          Based on your system, restart the kubelet service. For example:
-          systemctl daemon-reload
-          systemctl restart kubelet.service
-        scored: true
-
-      - id: 2.1.2
-        text: Ensure that the --anonymous-auth argument is set to false (Scored)
-        audit: "/bin/ps -fC $kubeletbin"
-        audit_config: "/bin/cat $kubeletconf"
-        tests:
-          test_items:
-            - flag: --anonymous-auth
-              path: '{.authentication.anonymous.enabled}'
-              set: true
-              compare:
-                op: eq
-                value: false
-        remediation: |
-          If using a Kubelet config file, edit the file to set authentication: anonymous: enabled to
-          false .
-          If using executable arguments, edit the kubelet service file
-          $kubeletsvc on each worker node and
-          set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable.
-          --anonymous-auth=false
-          Based on your system, restart the kubelet service. For example:
-          systemctl daemon-reload
-          systemctl restart kubelet.service
-        scored: true
-
-      - id: 2.1.3
-        text: Ensure that the --authorization-mode argument is not set to AlwaysAllow (Scored)
-        audit: "/bin/ps -fC $kubeletbin"
-        audit_config: "/bin/cat $kubeletconf"
-        tests:
-          test_items:
-            - flag: --authorization-mode
-              path: '{.authorization.mode}'
-              set: true
-              compare:
-                op: nothave
-                value: AlwaysAllow
-        remediation: |
-          If using a Kubelet config file, edit the file to set authorization: mode to Webhook.
-          If using executable arguments, edit the kubelet service file
-          $kubeletsvc on each worker node and
-          set the below parameter in KUBELET_AUTHZ_ARGS variable.
-          --authorization-mode=Webhook
-          Based on your system, restart the kubelet service. For example:
-          systemctl daemon-reload
-          systemctl restart kubelet.service
-        scored: true
-
-      - id: 2.1.4
-        text: Ensure that the --client-ca-file argument is set as appropriate (Scored)
-        audit: "/bin/ps -fC $kubeletbin"
-        audit_config: "/bin/cat $kubeletconf"
-        tests:
-          test_items:
-            - flag: --client-ca-file
-              path: '{.authentication.x509.clientCAFile}'
-              set: true
-        remediation: |
-          If using a Kubelet config file, edit the file to set authentication: x509: clientCAFile to
-          the location of the client CA file.
-          If using command line arguments, edit the kubelet service file
-          $kubeletsvc on each worker node and
-          set the below parameter in KUBELET_AUTHZ_ARGS variable.
-          --client-ca-file=<path/to/client-ca-file>
-          Based on your system, restart the kubelet service. For example:
-          systemctl daemon-reload
-          systemctl restart kubelet.service
-        scored: true
-
-      - id: 2.1.5
-        text: Ensure that the --read-only-port argument is set to 0 (Scored)
-        audit: "/bin/ps -fC $kubeletbin"
-        audit_config: "/bin/cat $kubeletconf"
-        tests:
-          test_items:
-            - flag: --read-only-port
-              path: '{.readOnlyPort}'
-              set: true
-              compare:
-                op: eq
-                value: 0
-        remediation: |
-          If using a Kubelet config file, edit the file to set readOnlyPort to 0 .
-          If using command line arguments, edit the kubelet service file
-          $kubeletsvc on each worker node and
-          set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable.
-          --read-only-port=0
-          Based on your system, restart the kubelet service. For example:
-          systemctl daemon-reload
-          systemctl restart kubelet.service
-        scored: true
-
-      - id: 2.1.6
-        text: Ensure that the --streaming-connection-idle-timeout argument is not set to 0 (Scored)
-        audit: "/bin/ps -fC $kubeletbin"
-        audit_config: "/bin/cat $kubeletconf"
-        tests:
-          test_items:
-            - flag: --streaming-connection-idle-timeout
-              path: '{.streamingConnectionIdleTimeout}'
-              set: true
-              compare:
-                op: noteq
-                value: 0
-            - flag: --streaming-connection-idle-timeout
-              path: '{.streamingConnectionIdleTimeout}'
-              set: false
-          bin_op: or
-        remediation: |
-          If using a Kubelet config file, edit the file to set streamingConnectionIdleTimeout to a
-          value other than 0.
-          If using command line arguments, edit the kubelet service file
-          $kubeletsvc on each worker node and
-          set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable.
-          --streaming-connection-idle-timeout=5m
-          Based on your system, restart the kubelet service. For example:
-          systemctl daemon-reload
-          systemctl restart kubelet.service
-        scored: true
-
-      - id: 2.1.7
-        text: Ensure that the --protect-kernel-defaults argument is set to true (Scored)
-        audit: "/bin/ps -fC $kubeletbin"
-        audit_config: "/bin/cat $kubeletconf"
-        tests:
-          test_items:
-            - flag: --protect-kernel-defaults
-              path: '{.protectKernelDefaults}'
-              set: true
-              compare:
-                op: eq
-                value: true
-        remediation: |
-          If using a Kubelet config file, edit the file to set protectKernelDefaults: true .
-          If using command line arguments, edit the kubelet service file
-          $kubeletsvc on each worker node and
-          set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable.
-          --protect-kernel-defaults=true
-          Based on your system, restart the kubelet service. For example:
-          systemctl daemon-reload
-          systemctl restart kubelet.service
-        scored: true
-
-      - id: 2.1.8
-        text: Ensure that the --make-iptables-util-chains argument is set to true (Scored)
-        audit: "/bin/ps -fC $kubeletbin"
-        audit_config: "/bin/cat $kubeletconf"
-        tests:
-          test_items:
-            - flag: --make-iptables-util-chains
-              path: '{.makeIPTablesUtilChains}'
-              set: true
-              compare:
-                op: eq
-                value: true
-            - flag: --make-iptables-util-chains
-              path: '{.makeIPTablesUtilChains}'
-              set: false
-          bin_op: or
-        remediation: |
-          If using a Kubelet config file, edit the file to set makeIPTablesUtilChains: true .
-          If using command line arguments, edit the kubelet service file
-          $kubeletsvc on each worker node and
-          remove the --make-iptables-util-chains argument from the
-          KUBELET_SYSTEM_PODS_ARGS variable.
-          Based on your system, restart the kubelet service. For example:
-          systemctl daemon-reload
-          systemctl restart kubelet.service
-        scored: true
-
-      - id: 2.1.9
-        text: Ensure that the --hostname-override argument is not set (Scored)
-        audit: "/bin/ps -fC $kubeletbin"
-        audit_config: "/bin/cat $kubeletconf"
-        tests:
-          test_items:
-            - flag: --hostname-override
-              path: '{.hostnameOverride}'
-              set: false
-        remediation: |
-          Edit the kubelet service file $kubeletsvc
-          on each worker node and remove the --hostname-override argument from the
-          KUBELET_SYSTEM_PODS_ARGS variable.
-          Based on your system, restart the kubelet service. For example:
-          systemctl daemon-reload
-          systemctl restart kubelet.service
-        scored: true
-
-      - id: 2.1.10
-        text: Ensure that the --event-qps argument is set to 0 (Scored)
-        audit: "/bin/ps -fC $kubeletbin"
-        audit_config: "/bin/cat $kubeletconf"
-        tests:
-          test_items:
-            - flag: --event-qps
-              path: '{.eventRecordQPS}'
-              set: true
-              compare:
-                op: eq
-                value: 0
-        remediation: |
-          If using a Kubelet config file, edit the file to set eventRecordQPS: 0 .
-          If using command line arguments, edit the kubelet service file
-          $kubeletsvc on each worker node and
-          set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable.
-          --event-qps=0
-          Based on your system, restart the kubelet service. For example:
-          systemctl daemon-reload
-          systemctl restart kubelet.service
-        scored: true
-
-      - id: 2.1.11
-        text: Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate (Scored)
-        audit: "/bin/ps -fC $kubeletbin"
-        audit_config: "/bin/cat $kubeletconf"
-        tests:
-          test_items:
-            - flag: --tls-cert-file
-              path: '{.tlsCertFile}'
-              set: true
-            - flag: --tls-private-key-file
-              path: '{.tlsPrivateKeyFile}'
-              set: true
-          bin_op: and
-        remediation: |
-          If using a Kubelet config file, edit the file to set tlsCertFile to the location of the certificate
-          file to use to identify this Kubelet, and tlsPrivateKeyFile to the location of the
-          corresponding private key file.
-          If using command line arguments, edit the kubelet service file
-          $kubeletsvc on each worker node and
-          set the below parameters in KUBELET_CERTIFICATE_ARGS variable.
-          --tls-cert-file=<path/to/tls-certificate-file>
-          file=<path/to/tls-key-file>
-          Based on your system, restart the kubelet service. For example:
-          systemctl daemon-reload
-          systemctl restart kubelet.service
-        scored: true
-
-      - id: 2.1.12
-        text: Ensure that the --cadvisor-port argument is set to 0 (Scored)
-        audit: "/bin/ps -fC $kubeletbin"
-        audit_config: "/bin/cat $kubeletconf"
-        tests:
-          test_items:
-            - flag: --cadvisor-port
-              path: '{.cadvisorPort}'
-              set: true
-              compare:
-                op: eq
-                value: 0
-            - flag: --cadvisor-port
-              path: '{.cadvisorPort}'
-              set: false
-          bin_op: or
-        remediation: |
-          Edit the kubelet service file $kubeletsvc
-          on each worker node and set the below parameter in KUBELET_CADVISOR_ARGS variable.
-          --cadvisor-port=0
-          Based on your system, restart the kubelet service. For example:
-          systemctl daemon-reload
-          systemctl restart kubelet.service
-        scored: true
-
-      - id: 2.1.13
-        text: Ensure that the --rotate-certificates argument is not set to false (Scored)
-        audit: "/bin/ps -fC $kubeletbin"
-        audit_config: "/bin/cat $kubeletconf"
-        tests:
-          test_items:
-            - flag: --rotate-certificates
-              path: '{.rotateCertificates}'
-              set: true
-              compare:
-                op: eq
-                value: true
-            - flag: --rotate-certificates
-              path: '{.rotateCertificates}'
-              set: false
-          bin_op: or
-        remediation: |
-          If using a Kubelet config file, edit the file to add the line rotateCertificates: true.
-          If using command line arguments, edit the kubelet service file $kubeletsvc
-          on each worker node and add --rotate-certificates=true argument to the KUBELET_CERTIFICATE_ARGS variable.
-          Based on your system, restart the kubelet service. For example:
-          systemctl daemon-reload
-          systemctl restart kubelet.service
-        scored: true
-
-      - id: 2.1.14
-        text: Ensure that the RotateKubeletServerCertificate argument is set to true (Scored)
-        audit: "/bin/ps -fC $kubeletbin"
-        audit_config: "/bin/cat $kubeletconf"
-        tests:
-          test_items:
-            - flag: RotateKubeletServerCertificate
-              path: '{.featureGates.RotateKubeletServerCertificate}'
-              set: true
-              compare:
-                op: eq
-                value: true
-        remediation: |
-          Edit the kubelet service file $kubeletsvc
-          on each worker node and set the below parameter in KUBELET_CERTIFICATE_ARGS variable.
-          --feature-gates=RotateKubeletServerCertificate=true
-          Based on your system, restart the kubelet service. For example:
-          systemctl daemon-reload
-          systemctl restart kubelet.service
-        scored: true
-
-      - id: 2.1.15
-        text: Ensure that the Kubelet only makes use of Strong Cryptographic Ciphers (Not Scored)
-        audit: "/bin/ps -fC $kubeletbin"
-        audit_config: "/bin/cat $kubeletconf"
-        tests:
-          test_items:
-            - flag: --tls-cipher-suites
-              path: '{.tlsCipherSuites}'
-              set: true
-              compare:
-                op: valid_elements
-                value: TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256
-        remediation: |
-          If using a Kubelet config file, edit the file to set TLSCipherSuites: to TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256
-          If using executable arguments, edit the kubelet service file $kubeletsvc on each worker node and set the below parameter.
-          --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256
-        scored: false
-
-  - id: "2.2"
-    text: Configuration Files
-    checks:
-      - id: 2.2.1
-        text: Ensure that the kubelet.conf file permissions are set to 644 or more restrictive (Scored)
-        audit: '/bin/sh -c ''if test -e $kubeletkubeconfig; then stat -c permissions=%a $kubeletkubeconfig; fi'' '
-        tests:
-          test_items:
-            - flag: "permissions"
-              compare:
-                op: bitmask
-                value: "644"
-              set: true
-        remediation: |
-          Run the below command (based on the file location on your system) on the each worker
-          node. For example,
-          chmod 644 $kubeletkubeconfig
-        scored: true
-
-      - id: 2.2.2
-        text: Ensure that the kubelet.conf file ownership is set to root:root (Scored)
-        audit: '/bin/sh -c ''if test -e $kubeletkubeconfig; then stat -c %U:%G $kubeletkubeconfig; fi'' '
-        tests:
-          test_items:
-            - flag: root:root
-              set: true
-              compare:
-                op: eq
-                value: root:root
-        remediation: |
-          Run the below command (based on the file location on your system) on the each worker
-          node. For example,
-          chown root:root $kubeletkubeconfig
-        scored: true
-
-      - id: 2.2.3
-        text: Ensure that the kubelet service file permissions are set to 644 or more restrictive (Scored)
-        audit: '/bin/sh -c ''if test -e $kubeletsvc; then stat -c permissions=%a $kubeletsvc; fi'' '
-        tests:
-          test_items:
-            - flag: "permissions"
-              set: true
-              compare:
-                op: bitmask
-                value: "644"
-        remediation: |
-          Run the below command (based on the file location on your system) on the each worker
-          node. For example,
-          chmod 644 $kubeletsvc
-        scored: true
-
-      - id: 2.2.4
-        text: Ensure that the kubelet service file ownership is set to root:root (Scored)
-        audit: '/bin/sh -c ''if test -e $kubeletsvc; then stat -c %U:%G $kubeletsvc; fi'' '
-        tests:
-          test_items:
-            - flag: root:root
-              set: true
-        remediation: |
-          Run the below command (based on the file location on your system) on the each worker
-          node. For example,
-          chown root:root $kubeletsvc
-        scored: true
-
-      - id: 2.2.5
-        text: Ensure that the proxy kubeconfig file permissions are set to 644 or more restrictive (Scored)
-        audit: '/bin/sh -c ''if test -e $proxykubeconfig; then stat -c permissions=%a $proxykubeconfig; fi'' '
-        tests:
-          test_items:
-            - flag: "permissions"
-              set: true
-              compare:
-                op: bitmask
-                value: "644"
-        remediation: |
-          Run the below command (based on the file location on your system) on the each worker
-          node. For example,
-          chmod 644 $proxykubeconfig
-        scored: true
-
-      - id: 2.2.6
-        text: Ensure that the proxy kubeconfig file ownership is set to root:root (Scored)
-        audit: '/bin/sh -c ''if test -e $proxykubeconfig; then stat -c %U:%G $proxykubeconfig; fi'' '
-        tests:
-          test_items:
-            - flag: root:root
-              set: true
-        remediation: |
-          Run the below command (based on the file location on your system) on the each worker
-          node. For example,
-          chown root:root $proxykubeconfig
-        scored: true
-
-      - id: 2.2.7
-        text: Ensure that the certificate authorities file permissions are set to 644 or more restrictive (Scored)
-        type: manual
-        remediation: |
-          Run the following command to modify the file permissions of the --client-ca-file
-          chmod 644 <filename>
-        scored: true
-
-      - id: 2.2.8
-        text: Ensure that the client certificate authorities file ownership is set to root:root (Scored)
-        audit: |
-          CAFILE=$(ps -ef | grep kubelet | grep -v apiserver | grep -- --client-ca-file= | awk -F '--client-ca-file=' '{print $2}' | awk '{print $1}')
-          if test -z $CAFILE; then CAFILE=$kubeletcafile; fi
-          if test -e $CAFILE; then stat -c %U:%G $CAFILE; fi
-        tests:
-          test_items:
-            - flag: root:root
-              set: true
-              compare:
-                op: eq
-                value: root:root
-        remediation: |
-          Run the following command to modify the ownership of the --client-ca-file .
-          chown root:root <filename>
-        scored: true
-
-      - id: 2.2.9
-        text: Ensure that the kubelet configuration file ownership is set to root:root (Scored)
-        audit: '/bin/sh -c ''if test -e $kubeletconf; then stat -c %U:%G $kubeletconf; fi'' '
-        tests:
-          test_items:
-            - flag: root:root
-              set: true
-        remediation: |
-          Run the following command (using the config file location identified in the Audit step)
-          chown root:root $kubeletconf
-        scored: true
-
-      - id: 2.2.10
-        text: Ensure that the kubelet configuration file has permissions set to 644 or more restrictive (Scored)
-        audit: '/bin/sh -c ''if test -e $kubeletconf; then stat -c permissions=%a $kubeletconf; fi'' '
-        tests:
-          test_items:
-            - flag: "permissions"
-              set: true
-              compare:
-                op: bitmask
-                value: "644"
-        remediation: |
-          Run the following command (using the config file location identified in the Audit step)
-          chmod 644 $kubeletconf
-        scored: true

cfg/cis-1.4/config.yaml

@@ -1,2 +0,0 @@
----
-## Version-specific settings that override the values in cfg/config.yaml

cfg/cis-1.4/node.yaml

@@ -1,491 +0,0 @@
----
-controls:
-version: "1.13"
-id: "2"
-text: Worker Node Security Configuration
-type: "node"
-groups:
-  - id: "2.1"
-    text: Kubelet
-    checks:
-      - id: 2.1.1
-        text: Ensure that the --anonymous-auth argument is set to false (Scored)
-        audit: "/bin/ps -fC $kubeletbin"
-        audit_config: "/bin/cat $kubeletconf"
-        tests:
-          test_items:
-            - flag: "--anonymous-auth"
-              path: '{.authentication.anonymous.enabled}'
-              set: true
-              compare:
-                op: eq
-                value: false
-        remediation: |
-          If using a Kubelet config file, edit the file to set authentication: anonymous: enabled to
-          false .
-          If using executable arguments, edit the kubelet service file
-          $kubeletsvc on each worker node and
-          set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable.
-          --anonymous-auth=false
-          Based on your system, restart the kubelet service. For example:
-          systemctl daemon-reload
-          systemctl restart kubelet.service
-        scored: true
-
-      - id: 2.1.2
-        text: Ensure that the --authorization-mode argument is not set to AlwaysAllow (Scored)
-        audit: "/bin/ps -fC $kubeletbin"
-        audit_config: "/bin/cat $kubeletconf"
-        tests:
-          test_items:
-            - flag: --authorization-mode
-              path: '{.authorization.mode}'
-              set: true
-              compare:
-                op: nothave
-                value: AlwaysAllow
-        remediation: |
-          If using a Kubelet config file, edit the file to set authorization: mode to Webhook.
-          If using executable arguments, edit the kubelet service file
-          $kubeletsvc on each worker node and
-          set the below parameter in KUBELET_AUTHZ_ARGS variable.
-          --authorization-mode=Webhook
-          Based on your system, restart the kubelet service. For example:
-          systemctl daemon-reload
-          systemctl restart kubelet.service
-        scored: true
-
-      - id: 2.1.3
-        text: Ensure that the --client-ca-file argument is set as appropriate (Scored)
-        audit: "/bin/ps -fC $kubeletbin"
-        audit_config: "/bin/cat $kubeletconf"
-        tests:
-          test_items:
-            - flag: --client-ca-file
-              path: '{.authentication.x509.clientCAFile}'
-              set: true
-        remediation: |
-          If using a Kubelet config file, edit the file to set authentication: x509: clientCAFile to
-          the location of the client CA file.
-          If using command line arguments, edit the kubelet service file
-          $kubeletsvc on each worker node and
-          set the below parameter in KUBELET_AUTHZ_ARGS variable.
-          --client-ca-file=<path/to/client-ca-file>
-          Based on your system, restart the kubelet service. For example:
-          systemctl daemon-reload
-          systemctl restart kubelet.service
-        scored: true
-
-      - id: 2.1.4
-        text: Ensure that the --read-only-port argument is set to 0 (Scored)
-        audit: "/bin/ps -fC $kubeletbin"
-        audit_config: "/bin/cat $kubeletconf"
-        tests:
-          test_items:
-            - flag: "--read-only-port"
-              path: '{.readOnlyPort}'
-              set: true
-              compare:
-                op: eq
-                value: 0
-        remediation: |
-          If using a Kubelet config file, edit the file to set readOnlyPort to 0 .
-          If using command line arguments, edit the kubelet service file
-          $kubeletsvc on each worker node and
-          set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable.
-          --read-only-port=0
-          Based on your system, restart the kubelet service. For example:
-          systemctl daemon-reload
-          systemctl restart kubelet.service
-        scored: true
-
-      - id: 2.1.5
-        text: Ensure that the --streaming-connection-idle-timeout argument is not set to 0 (Scored)
-        audit: "/bin/ps -fC $kubeletbin"
-        audit_config: "/bin/cat $kubeletconf"
-        tests:
-          test_items:
-            - flag: --streaming-connection-idle-timeout
-              path: '{.streamingConnectionIdleTimeout}'
-              set: true
-              compare:
-                op: noteq
-                value: 0
-            - flag: --streaming-connection-idle-timeout
-              path: '{.streamingConnectionIdleTimeout}'
-              set: false
-          bin_op: or
-        remediation: |
-          If using a Kubelet config file, edit the file to set streamingConnectionIdleTimeout to a
-          value other than 0.
-          If using command line arguments, edit the kubelet service file
-          $kubeletsvc on each worker node and
-          set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable.
-          --streaming-connection-idle-timeout=5m
-          Based on your system, restart the kubelet service. For example:
-          systemctl daemon-reload
-          systemctl restart kubelet.service
-        scored: true
-
-      - id: 2.1.6
-        text: Ensure that the --protect-kernel-defaults argument is set to true (Scored)
-        audit: "/bin/ps -fC $kubeletbin"
-        audit_config: "/bin/cat $kubeletconf"
-        tests:
-          test_items:
-            - flag: --protect-kernel-defaults
-              path: '{.protectKernelDefaults}'
-              set: true
-              compare:
-                op: eq
-                value: true
-        remediation: |
-          If using a Kubelet config file, edit the file to set protectKernelDefaults: true .
-          If using command line arguments, edit the kubelet service file
-          $kubeletsvc on each worker node and
-          set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable.
-          --protect-kernel-defaults=true
-          Based on your system, restart the kubelet service. For example:
-          systemctl daemon-reload
-          systemctl restart kubelet.service
-        scored: true
-
-      - id: 2.1.7
-        text: Ensure that the --make-iptables-util-chains argument is set to true (Scored)
-        audit: "/bin/ps -fC $kubeletbin"
-        audit_config: "/bin/cat $kubeletconf"
-        tests:
-          test_items:
-            - flag: --make-iptables-util-chains
-              path: '{.makeIPTablesUtilChains}'
-              set: true
-              compare:
-                op: eq
-                value: true
-            - flag: --make-iptables-util-chains
-              path: '{.makeIPTablesUtilChains}'
-              set: false
-          bin_op: or
-        remediation: |
-          If using a Kubelet config file, edit the file to set makeIPTablesUtilChains: true .
-          If using command line arguments, edit the kubelet service file
-          $kubeletsvc on each worker node and
-          remove the --make-iptables-util-chains argument from the
-          KUBELET_SYSTEM_PODS_ARGS variable.
-          Based on your system, restart the kubelet service. For example:
-          systemctl daemon-reload
-          systemctl restart kubelet.service
-        scored: true
-
-      - id: 2.1.8
-        text: Ensure that the --hostname-override argument is not set (Scored)
-        # This is one of those properties that can only be set as a command line argument.
-        # To check if the property is set as expected, we need to parse the kubelet command
-        # instead reading the Kubelet Configuration file.
-        audit: "/bin/ps -fC $kubeletbin "
-        tests:
-          test_items:
-            - flag: --hostname-override
-              set: false
-        remediation: |
-          Edit the kubelet service file $kubeletsvc
-          on each worker node and remove the --hostname-override argument from the
-          KUBELET_SYSTEM_PODS_ARGS variable.
-          Based on your system, restart the kubelet service. For example:
-          systemctl daemon-reload
-          systemctl restart kubelet.service
-        scored: true
-
-      - id: 2.1.9
-        text: Ensure that the --event-qps argument is set to 0 (Scored)
-        audit: "/bin/ps -fC $kubeletbin"
-        audit_config: "/bin/cat $kubeletconf"
-        tests:
-          test_items:
-            - flag: --event-qps
-              path: '{.eventRecordQPS}'
-              set: true
-              compare:
-                op: eq
-                value: 0
-        remediation: |
-          If using a Kubelet config file, edit the file to set eventRecordQPS: 0 .
-          If using command line arguments, edit the kubelet service file
-          $kubeletsvc on each worker node and
-          set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable.
-          --event-qps=0
-          Based on your system, restart the kubelet service. For example:
-          systemctl daemon-reload
-          systemctl restart kubelet.service
-        scored: true
-
-      - id: 2.1.10
-        text: Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate (Scored)
-        audit: "/bin/ps -fC $kubeletbin"
-        audit_config: "/bin/cat $kubeletconf"
-        tests:
-          test_items:
-            - flag: --tls-cert-file
-              path: '{.tlsCertFile}'
-              set: true
-            - flag: --tls-private-key-file
-              path: '{.tlsPrivateKeyFile}'
-              set: true
-          bin_op: and
-        remediation: |
-          If using a Kubelet config file, edit the file to set tlsCertFile to the location of the certificate
-          file to use to identify this Kubelet, and tlsPrivateKeyFile to the location of the
-          corresponding private key file.
-          If using command line arguments, edit the kubelet service file
-          $kubeletsvc on each worker node and
-          set the below parameters in KUBELET_CERTIFICATE_ARGS variable.
-          --tls-cert-file=<path/to/tls-certificate-file>
-          file=<path/to/tls-key-file>
-          Based on your system, restart the kubelet service. For example:
-          systemctl daemon-reload
-          systemctl restart kubelet.service
-        scored: true
-
-      - id: 2.1.11
-        text: '[DEPRECATED] Ensure that the --cadvisor-port argument is set to 0'
-        # This is one of those properties that can only be set as a command line argument.
-        # To check if the property is set as expected, we need to parse the kubelet command
-        # instead reading the Kubelet Configuration file.
-        audit: "/bin/ps -fC $kubeletbin "
-        type: skip
-        tests:
-          test_items:
-            - flag: --cadvisor-port
-              set: true
-              compare:
-                op: eq
-                value: 0
-            - flag: --cadvisor-port
-              set: false
-          bin_op: or
-        remediation: |
-          Edit the kubelet service file $kubeletsvc
-          on each worker node and set the below parameter in KUBELET_CADVISOR_ARGS variable.
-          --cadvisor-port=0
-          Based on your system, restart the kubelet service. For example:
-          systemctl daemon-reload
-          systemctl restart kubelet.service
-        scored: false
-
-      - id: 2.1.12
-        text: Ensure that the --rotate-certificates argument is not set to false (Scored)
-        audit: "/bin/ps -fC $kubeletbin"
-        audit_config: "/bin/cat $kubeletconf"
-        tests:
-          test_items:
-            - flag: --rotate-certificates
-              path: '{.rotateCertificates}'
-              set: true
-              compare:
-                op: eq
-                value: true
-            - flag: --rotate-certificates
-              path: '{.rotateCertificates}'
-              set: false
-          bin_op: or
-        remediation: |
-          If using a Kubelet config file, edit the file to add the line rotateCertificates: true.
-          If using command line arguments, edit the kubelet service file $kubeletsvc
-          on each worker node and add --rotate-certificates=true argument to the KUBELET_CERTIFICATE_ARGS variable.
-          Based on your system, restart the kubelet service. For example:
-          systemctl daemon-reload
-          systemctl restart kubelet.service
-        scored: true
-
-      - id: 2.1.13
-        text: Ensure that the RotateKubeletServerCertificate argument is set to true (Scored)
-        audit: "/bin/ps -fC $kubeletbin"
-        audit_config: "/bin/cat $kubeletconf"
-        tests:
-          test_items:
-            - flag: RotateKubeletServerCertificate
-              path: '{.featureGates.RotateKubeletServerCertificate}'
-              set: true
-              compare:
-                op: eq
-                value: true
-        remediation: |
-          Edit the kubelet service file $kubeletsvc
-          on each worker node and set the below parameter in KUBELET_CERTIFICATE_ARGS variable.
-          --feature-gates=RotateKubeletServerCertificate=true
-          Based on your system, restart the kubelet service. For example:
-          systemctl daemon-reload
-          systemctl restart kubelet.service
-        scored: true
-
-      - id: 2.1.14
-        text: Ensure that the Kubelet only makes use of Strong Cryptographic Ciphers (Not Scored)
-        audit: "/bin/ps -fC $kubeletbin"
-        audit_config: "/bin/cat $kubeletconf"
-        tests:
-          test_items:
-            - flag: --tls-cipher-suites
-              path: '{range .tlsCipherSuites[:]}{}{'',''}{end}'
-              set: true
-              compare:
-                op: valid_elements
-                value: TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256
-        remediation: |
-          If using a Kubelet config file, edit the file to set TLSCipherSuites: to TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256
-          If using executable arguments, edit the kubelet service file $kubeletsvc on each worker node and set the below parameter.
-          --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256
-        scored: false
-
-  - id: "2.2"
-    text: Configuration Files
-    checks:
-      - id: 2.2.1
-        text: Ensure that the kubelet.conf file permissions are set to 644 or more restrictive (Scored)
-        audit: '/bin/sh -c ''if test -e $kubeletkubeconfig; then stat -c permissions=%a $kubeletkubeconfig; fi'' '
-        tests:
-          test_items:
-            - flag: "permissions"
-              set: true
-              compare:
-                op: bitmask
-                value: "644"
-        remediation: |
-          Run the below command (based on the file location on your system) on the each worker
-          node. For example,
-          chmod 644 $kubeletkubeconfig
-        scored: true
-
-      - id: 2.2.2
-        text: Ensure that the kubelet.conf file ownership is set to root:root (Scored)
-        audit: '/bin/sh -c ''if test -e $kubeletkubeconfig; then stat -c %U:%G $kubeletkubeconfig; fi'' '
-        tests:
-          test_items:
-            - flag: root:root
-              set: true
-              compare:
-                op: eq
-                value: root:root
-        remediation: |
-          Run the below command (based on the file location on your system) on the each worker
-          node. For example,
-          chown root:root $kubeletkubeconfig
-        scored: true
-
-      - id: 2.2.3
-        text: Ensure that the kubelet service file permissions are set to 644 or more restrictive (Scored)
-        audit: '/bin/sh -c ''if test -e $kubeletsvc; then stat -c permissions=%a $kubeletsvc; fi'' '
-        tests:
-          test_items:
-            - flag: "permissions"
-              set: true
-              compare:
-                op: bitmask
-                value: "644"
-        remediation: |
-          Run the below command (based on the file location on your system) on the each worker
-          node. For example,
-          chmod 644 $kubeletsvc
-        scored: true
-
-      - id: 2.2.4
-        text: Ensure that the kubelet service file ownership is set to root:root (Scored)
-        audit: '/bin/sh -c ''if test -e $kubeletsvc; then stat -c %U:%G $kubeletsvc; fi'' '
-        tests:
-          test_items:
-            - flag: root:root
-              set: true
-        remediation: |
-          Run the below command (based on the file location on your system) on the each worker
-          node. For example,
-          chown root:root $kubeletsvc
-        scored: true
-
-      - id: 2.2.5
-        text: Ensure that the proxy kubeconfig file permissions are set to 644 or more restrictive (Scored)
-        audit: '/bin/sh -c ''if test -e $proxykubeconfig; then stat -c permissions=%a $proxykubeconfig; fi'' '
-        tests:
-          test_items:
-            - flag: "permissions"
-              set: true
-              compare:
-                op: bitmask
-                value: "644"
-        remediation: |
-          Run the below command (based on the file location on your system) on the each worker
-          node. For example,
-          chmod 644 $proxykubeconfig
-        scored: true
-
-      - id: 2.2.6
-        text: Ensure that the proxy kubeconfig file ownership is set to root:root (Scored)
-        audit: '/bin/sh -c ''if test -e $proxykubeconfig; then stat -c %U:%G $proxykubeconfig; fi'' '
-        tests:
-          test_items:
-            - flag: root:root
-              set: true
-        remediation: |
-          Run the below command (based on the file location on your system) on the each worker
-          node. For example,
-          chown root:root $proxykubeconfig
-        scored: true
-
-      - id: 2.2.7
-        text: Ensure that the certificate authorities file permissions are set to 644 or more restrictive (Scored)
-        audit: "/bin/sh -c 'if test -e $kubeletcafile; then stat -c permissions=%a $kubeletcafile; fi'"
-        tests:
-          bin_op: or
-          test_items:
-            - flag: "permissions"
-              compare:
-                op: bitmask
-                value: "644"
-              set: true
-        remediation: |
-          Run the following command to modify the file permissions of the --client-ca-file
-          chmod 644 <filename>
-        scored: true
-
-      - id: 2.2.8
-        text: Ensure that the client certificate authorities file ownership is set to root:root (Scored)
-        audit: |
-          CAFILE=$(ps -ef | grep kubelet | grep -v apiserver | grep -- --client-ca-file= | awk -F '--client-ca-file=' '{print $2}' | awk '{print $1}')
-          if test -z $CAFILE; then CAFILE=$kubeletcafile; fi
-          if test -e $CAFILE; then stat -c %U:%G $CAFILE; fi
-        tests:
-          test_items:
-            - flag: root:root
-              set: true
-              compare:
-                op: eq
-                value: root:root
-        remediation: |
-          Run the following command to modify the ownership of the --client-ca-file .
-          chown root:root <filename>
-        scored: true
-
-      - id: 2.2.9
-        text: Ensure that the kubelet configuration file ownership is set to root:root (Scored)
-        audit: '/bin/sh -c ''if test -e $kubeletconf; then stat -c %U:%G $kubeletconf; fi'' '
-        tests:
-          test_items:
-            - flag: root:root
-              set: true
-        remediation: |
-          Run the following command (using the config file location identified in the Audit step)
-          chown root:root $kubeletconf
-        scored: true
-
-      - id: 2.2.10
-        text: Ensure that the kubelet configuration file has permissions set to 644 or more restrictive (Scored)
-        audit: '/bin/sh -c ''if test -e $kubeletconf; then stat -c permissions=%a $kubeletconf; fi'' '
-        tests:
-          test_items:
-            - flag: "permissions"
-              set: true
-              compare:
-                op: bitmask
-                value: "644"
-        remediation: |
-          Run the following command (using the config file location identified in the Audit step)
-          chmod 644 $kubeletconf
-        scored: true

cfg/config.yaml

@@ -189,10 +189,6 @@ managedservices:
   components: []
 
 version_mapping:
-  "1.11": "cis-1.3"
-  "1.12": "cis-1.3"
-  "1.13": "cis-1.4"
-  "1.14": "cis-1.4"
   "1.15": "cis-1.5"
   "1.16": "cis-1.6"
   "1.17": "cis-1.6"
@@ -204,12 +200,6 @@ version_mapping:
   "ocp-3.11": "rh-0.7"
 
 target_mapping:
-  "cis-1.3":
-    - "master"
-    - "node"
-  "cis-1.4":
-    - "master"
-    - "node"
   "cis-1.5":
     - "master"
     - "node"

cmd/common_test.go

@@ -206,10 +206,10 @@ func TestMapToCISVersion(t *testing.T) {
 		expErr      string
 	}{
 		{kubeVersion: "1.9", succeed: false, exp: "", expErr: "unable to find a matching Benchmark Version match for kubernetes version: 1.9"},
-		{kubeVersion: "1.11", succeed: true, exp: "cis-1.3"},
+		{kubeVersion: "1.11", succeed: false, exp: "", expErr: "unable to find a matching Benchmark Version match for kubernetes version: 1.11"},
-		{kubeVersion: "1.12", succeed: true, exp: "cis-1.3"},
+		{kubeVersion: "1.12", succeed: false, exp: "", expErr: "unable to find a matching Benchmark Version match for kubernetes version: 1.12"},
-		{kubeVersion: "1.13", succeed: true, exp: "cis-1.4"},
+		{kubeVersion: "1.13", succeed: false, exp: "", expErr: "unable to find a matching Benchmark Version match for kubernetes version: 1.13"},
-		{kubeVersion: "1.14", succeed: true, exp: "cis-1.4"},
+		{kubeVersion: "1.14", succeed: false, exp: "", expErr: "unable to find a matching Benchmark Version match for kubernetes version: 1.14"},
 		{kubeVersion: "1.15", succeed: true, exp: "cis-1.5"},
 		{kubeVersion: "1.16", succeed: true, exp: "cis-1.6"},
 		{kubeVersion: "1.17", succeed: true, exp: "cis-1.6"},
@@ -303,7 +303,7 @@ func TestGetBenchmarkVersion(t *testing.T) {
 
 	withFakeKubectl := func(kubeVersion, benchmarkVersion string, v *viper.Viper, fn getBenchmarkVersionFnToTest) (string, error) {
 		execCode := `#!/bin/sh
-		echo "Server Version: v1.13.10"
+		echo "Server Version: v1.15.10"
 		`
 		restore, err := fakeExecutableInPath("kubectl", execCode)
 		if err != nil {
@@ -336,8 +336,8 @@ func TestGetBenchmarkVersion(t *testing.T) {
 	}{
 		{n: "both versions", kubeVersion: "1.11", benchmarkVersion: "cis-1.3", exp: "cis-1.3", callFn: withNoPath, v: viper.New(), succeed: false},
 		{n: "no version-missing-kubectl", kubeVersion: "", benchmarkVersion: "", v: viperWithData, exp: "", callFn: withNoPath, succeed: false},
-		{n: "no version-fakeKubectl", kubeVersion: "", benchmarkVersion: "", v: viperWithData, exp: "cis-1.4", callFn: withFakeKubectl, succeed: true},
+		{n: "no version-fakeKubectl", kubeVersion: "", benchmarkVersion: "", v: viperWithData, exp: "cis-1.5", callFn: withFakeKubectl, succeed: true},
-		{n: "kubeVersion", kubeVersion: "1.11", benchmarkVersion: "", v: viperWithData, exp: "cis-1.3", callFn: withNoPath, succeed: true},
+		{n: "kubeVersion", kubeVersion: "1.15", benchmarkVersion: "", v: viperWithData, exp: "cis-1.5", callFn: withNoPath, succeed: true},
 		{n: "ocpVersion310", kubeVersion: "ocp-3.10", benchmarkVersion: "", v: viperWithData, exp: "rh-0.7", callFn: withNoPath, succeed: true},
 		{n: "ocpVersion311", kubeVersion: "ocp-3.11", benchmarkVersion: "", v: viperWithData, exp: "rh-0.7", callFn: withNoPath, succeed: true},
 		{n: "gke10", kubeVersion: "gke-1.0", benchmarkVersion: "", v: viperWithData, exp: "gke-1.0", callFn: withNoPath, succeed: true},
@@ -375,18 +375,6 @@ func TestValidTargets(t *testing.T) {
 		targets   []string
 		expected  bool
 	}{
-		{
-			name:      "cis-1.3 no etcd",
-			benchmark: "cis-1.3",
-			targets:   []string{"master", "etcd"},
-			expected:  false,
-		},
-		{
-			name:      "cis-1.4 valid",
-			benchmark: "cis-1.4",
-			targets:   []string{"master", "node"},
-			expected:  true,
-		},
 		{
 			name:      "cis-1.5 no dummy",
 			benchmark: "cis-1.5",

hack/node_only.yaml

@@ -64,10 +64,6 @@ node:
     defaultkubeconfig: "/etc/kubernetes/proxy.conf"
 
 version_mapping:
-  "1.11": "cis-1.3"
-  "1.12": "cis-1.3"
-  "1.13": "cis-1.4"
-  "1.14": "cis-1.4"
   "1.15": "cis-1.5"
   "1.16": "cis-1.6"
   "1.17": "cis-1.6"

integration/integration_test.go

@@ -80,14 +80,6 @@ func testCheckCISWithKind(t *testing.T, testdataDir string) {
 	}
 }
 
-func TestCheckCIS13WithKind(t *testing.T) {
-	testCheckCISWithKind(t, "cis-1.3")
-}
-
-func TestCheckCIS14WithKind(t *testing.T) {
-	testCheckCISWithKind(t, "cis-1.4")
-}
-
 func TestCheckCIS15WithKind(t *testing.T) {
 	testCheckCISWithKind(t, "cis-1.5")
 }