arno/kube-bench
1
0
Fork 0
mirror of https://github.com/aquasecurity/kube-bench.git synced 2024-12-19 05:08:07 +00:00
Code Issues Releases Wiki Activity

Update 1.8 node definition.

Browse Source
This commit is contained in:
Abubakr-Sadik Nii Nai Davis 2017-10-15 00:08:58 +00:00
parent 04f21d1887
commit 82e325f96e
1 changed files with 368 additions and 298 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

660
cfg/1.8/node.yaml
View File

@ -1,6 +1,6 @@
--- ---
controls: controls:
version: 1.7 version: 1.8
id: 2 id: 2
text: "Worker Node Security Configuration" text: "Worker Node Security Configuration"
type: "node" type: "node"
@ -8,260 +8,296 @@ groups:
- id: 2.1 - id: 2.1
text: "Kubelet" text: "Kubelet"
checks: checks:
- id: 2.1.1 - id: 2.1.1
text: "Ensure that the --allow-privileged argument is set to false (Scored)" text: "Ensure that the --allow-privileged argument is set to false (Scored)"
audit: "ps -ef | grep $kubeletbin | grep -v grep" audit: "ps -ef | grep $kubeletbin | grep -v grep"
tests: tests:
test_items: test_items:
- flag: "--allow-privileged" - flag: "--allow-privileged"
compare: compare:
op: eq op: eq
value: false value: false
set: true set: true
remediation: "Edit the $kubeletconf file on each node and set the KUBE_ALLOW_PRIV remediation: |
parameter to \"--allow-privileged=false\"" Edit the kubelet service file $kubeletunitfile
scored: true on each worker node and set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable.
--allow-privileged=false
Based on your system, restart the kubelet service. For example:
systemctl daemon-reload
systemctl restart kubelet.service
scored: true
- id: 2.1.2 - id: 2.1.2
text: "Ensure that the --anonymous-auth argument is set to false (Scored)" text: "Ensure that the --anonymous-auth argument is set to false (Scored)"
audit: "ps -ef | grep $kubeletbin | grep -v grep" audit: "ps -ef | grep $kubeletbin | grep -v grep"
tests: tests:
test_items: test_items:
- flag: "--anonymous-auth" - flag: "--anonymous-auth"
compare: compare:
op: eq op: eq
value: false value: false
set: true set: true
remediation: "Edit the $kubeletconf file on the master node and set the remediation: |
KUBELET_ARGS parameter to \"--anonymous-auth=false\"" Edit the kubelet service file $kubeletunitfile
scored: true on each worker node and set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable.
--anonymous-auth=false
Based on your system, restart the kubelet service. For example:
systemctl daemon-reload
systemctl restart kubelet.service
scored: true
- id: 2.1.3 - id: 2.1.3
text: "Ensure that the --authorization-mode argument is not set to AlwaysAllow (Scored)" text: "Ensure that the --authorization-mode argument is not set to AlwaysAllow (Scored)"
audit: "ps -ef | grep $kubeletbin | grep -v grep" audit: "ps -ef | grep $kubeletbin | grep -v grep"
tests: tests:
test_items: test_items:
- flag: "--authorization-mode" - flag: "--authorization-mode"
compare: compare:
op: nothave op: nothave
value: "AlwaysAllow" value: "AlwaysAllow"
set: true set: true
remediation: "Edit the $kubeletconf file on each node and set the remediation: |
KUBELET_ARGS parameter to \"--authorization-mode=Webhook\"" Edit the kubelet service file $kubeletunitfile
scored: true on each worker node and set the below parameter in KUBELET_AUTHZ_ARGS variable.
--authorization-mode=Webhook
Based on your system, restart the kubelet service. For example:
systemctl daemon-reload
systemctl restart kubelet.service
scored: true
- id: 2.1.4 - id: 2.1.4
text: "Ensure that the --client-ca-file argument is set as appropriate (Scored)" text: "Ensure that the --client-ca-file argument is set as appropriate (Scored)"
audit: "ps -ef | grep $kubeletbin | grep -v grep" audit: "ps -ef | grep $kubeletbin | grep -v grep"
tests: tests:
test_items: test_items:
- flag: "--client-ca-file" - flag: "--client-ca-file"
set: true set: true
remediation: "Follow the Kubernetes documentation and setup the TLS connection between remediation: |
the apiserver and kubelets. Then, edit the $kubeletconf file on each node Edit the kubelet service file $kubeletunitfile
and set the KUBELET_ARGS parameter to \"--client-ca-file=<path/to/client-ca-file>\"" on each worker node and set the below parameter in KUBELET_AUTHZ_ARGS variable.
scored: true --client-ca-file=<path/to/client-ca-file>
Based on your system, restart the kubelet service. For example:
systemctl daemon-reload
systemctl restart kubelet.service
scored: true
- id: 2.1.5 - id: 2.1.5
text: "Ensure that the --read-only-port argument is set to 0 (Scored)" text: "Ensure that the --read-only-port argument is set to 0 (Scored)"
audit: "ps -ef | grep $kubeletbin | grep -v grep" audit: "ps -ef | grep $kubeletbin | grep -v grep"
tests: tests:
test_items: test_items:
- flag: "--read-only-port" - flag: "--read-only-port"
compare: compare:
op: eq op: eq
value: 0 value: 0
set: true set: true
remediation: "Edit the $kubeletconf file on each node and set the KUBELET_ARGS remediation: |
parameter to \"--read-only-port=0\"" Edit the kubelet service file $kubeletunitfile
scored: true on each worker node and set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable.
--read-only-port=0
Based on your system, restart the kubelet service. For example:
systemctl daemon-reload
systemctl restart kubelet.service
scored: true
- id: 2.1.6 - id: 2.1.6
text: "Ensure that the --streaming-connection-idle-timeout argument is not set to 0 (Scored)" text: "Ensure that the --streaming-connection-idle-timeout argument is not set to 0 (Scored)"
audit: "ps -ef | grep $kubeletbin | grep -v grep" audit: "ps -ef | grep $kubeletbin | grep -v grep"
tests: tests:
bin_op: or test_items:
test_items: - flag: "--streaming-connection-idle-timeout"
- flag: "--streaming-connection-idle-timeout" compare:
compare: op: noteq
op: noteq value: 0
value: 0 set: true
set: true remediation: |
remediation: "Edit the $kubeletconf file on each node and set the KUBELET_ARGS Edit the kubelet service file $kubeletunitfile
parameter to \"--streaming-connection-idle-timeout=<appropriate-timeout-value>\"" on each worker node and set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable.
scored: true --streaming-connection-idle-timeout=5m
Based on your system, restart the kubelet service. For example:
systemctl daemon-reload
systemctl restart kubelet.service
scored: true
- id: 2.1.7 - id: 2.1.7
text: "Ensure that the --protect-kernel-defaults argument is set to true (Scored)" text: "Ensure that the --protect-kernel-defaults argument is set to true (Scored)"
audit: "ps -ef | grep $kubeletbin | grep -v grep" audit: "ps -ef | grep $kubeletbin | grep -v grep"
tests: tests:
test_items: test_items:
- flag: "--protect-kernel-defaults" - flag: "--protect-kernel-defaults"
compare: compare:
op: eq op: eq
value: true value: true
set: true set: true
remediation: "Edit the $kubeletconf file on each node and set the KUBELET_ARGS remediation: |
parameter to \"--protect-kernel-defaults=true\"" Edit the kubelet service file $kubeletunitfile
scored: true on each worker node and set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable.
--protect-kernel-defaults=true
Based on your system, restart the kubelet service. For example:
systemctl daemon-reload
systemctl restart kubelet.service
scored: true
- id: 2.1.8 - id: 2.1.8
text: "Ensure that the --make-iptables-util-chains argument is set to true (Scored)" text: "Ensure that the --make-iptables-util-chains argument is set to true (Scored)"
audit: "ps -ef | grep $kubeletbin | grep -v grep" audit: "ps -ef | grep $kubeletbin | grep -v grep"
tests: tests:
bin_op: or bin_op: or
test_items: test_items:
- flag: "--make-iptables-util-chains" - flag: "--make-iptables-util-chains"
compare: compare:
op: eq op: eq
value: true value: true
set: true set: true
- flag: "--make-iptables-util-chains" remediation: |
set: false Edit the kubelet service file $kubeletunitfile
remediation: "Edit the $kubeletconf file on each node and remove the on each worker node and remove the --make-iptables-util-chains argument from the
--make-iptables-util-chains argument from the KUBELET_ARGS parameter." KUBELET_SYSTEM_PODS_ARGS variable.
scored: true Based on your system, restart the kubelet service. For example:
systemctl daemon-reload
systemctl restart kubelet.service
scored: true
- id: 2.1.9 - id: 2.1.9
text: "Ensure that the --keep-terminated-pod-volumes argument is set to false (Scored)" text: "Ensure that the --keep-terminated-pod-volumes argument is set to false (Scored)"
audit: "ps -ef | grep $kubeletbin | grep -v grep" audit: "ps -ef | grep $kubeletbin | grep -v grep"
tests: tests:
test_items: test_items:
- flag: "--keep-terminated-pod-volumes" - flag: "--keep-terminated-pod-volumes"
compare: compare:
op: eq op: eq
value: false value: false
set: true set: true
remediation: "Edit the $kubeletconf file on each node and set the KUBELET_ARGS remediation: |
parameter to \"--keep-terminated-pod-volumes=false\"" Edit the kubelet service file $kubeletunitfile
scored: true on each worker node and set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable.
--keep-terminated-pod-volumes=false
Based on your system, restart the kubelet service. For example:
systemctl daemon-reload
systemctl restart kubelet.service
scored: true
- id: 2.1.10 - id: 2.1.10
text: "Ensure that the --hostname-override argument is not set (Scored)" text: "Ensure that the --hostname-override argument is not set (Scored)"
audit: "ps -ef | grep $kubeletbin | grep -v grep" audit: "ps -ef | grep $kubeletbin | grep -v grep"
tests: tests:
test_items: test_items:
- flag: "--hostname-override" - flag: "--hostname-override"
set: false set: false
remediation: "Edit the $kubeletconf file on each node and set the KUBELET_HOSTNAME remediation: |
parameter to \"\"" Edit the kubelet service file $kubeletunitfile
scored: true on each worker node and remove the --hostname-override argument from the
KUBELET_SYSTEM_PODS_ARGS variable.
Based on your system, restart the kubelet service. For example:
systemctl daemon-reload
systemctl restart kubelet.service
scored: true
- id: 2.1.11 - id: 2.1.11
text: "Ensure that the --event-qps argument is set to 0 (Scored)" text: "Ensure that the --event-qps argument is set to 0 (Scored)"
audit: "ps -ef | grep $kubeletbin | grep -v grep" audit: "ps -ef | grep $kubeletbin | grep -v grep"
tests: tests:
test_items: test_items:
- flag: "--event-qps" - flag: "--event-qps"
compare: compare:
op: eq op: eq
value: 0 value: 0
set: true set: true
remediation: "Edit the $kubeletconf file on each node and set the KUBELET_ARGS remediation: |
parameter to \"--event-qps=0\"" Edit the kubelet service file $kubeletunitfile
scored: true on each worker node and set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable.
--event-qps=0
Based on your system, restart the kubelet service. For example:
systemctl daemon-reload
systemctl restart kubelet.service
scored: true
- id: 2.1.12 - id: 2.1.12
text: "Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate (Scored)" text: "Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate (Scored)"
audit: "ps -ef | grep $kubeletbin | grep -v grep" audit: "ps -ef | grep $kubeletbin | grep -v grep"
tests: tests:
test_items: test_items:
- flag: "--tls-cert-file" - flag: "--tls-cert-file"
set: true set: true
- flag: "--tls-private-key-file" - flag: "--tls-private-key-file"
set: true set: true
remediation: "Follow the Kubernetes documentation and set up the TLS connection on the Kubelet. remediation: |
Then, edit the $kubeletconf file on the master node and set the KUBELET_ARGS Follow the Kubernetes documentation and set up the TLS connection on the Kubelet.
parameter to include \"--tls-cert-file=<path/to/tls-certificate-file>\" and Then edit the kubelet service file /etc/systemd/system/kubelet.service.d/10-
\"--tls-private-key-file=<path/to/tls-key-file>\"" kubeadm.conf on each worker node and set the below parameters in
scored: true KUBELET_CERTIFICATE_ARGS variable.
--tls-cert-file=<path/to/tls-certificate-file>
file=<path/to/tls-key-file>
--tls-private-key-
Based on your system, restart the kubelet service. For example:
systemctl daemon-reload
systemctl restart kubelet.service
scored: true
- id: 2.1.13 - id: 2.1.13
text: "Ensure that the --cadvisor-port argument is set to 0 (Scored)" text: "Ensure that the --cadvisor-port argument is set to 0 (Scored)"
audit: "ps -ef | grep $kubeletbin | grep -v grep" audit: "ps -ef | grep $kubeletbin | grep -v grep"
tests: tests:
test_items: test_items:
- flag: "--cadvisor-port" - flag: "--cadvisor-port"
compare: compare:
op: eq op: eq
value: 0 value: 0
set: true set: true
remediation: "Edit the $kubeletconf file on each node and set the KUBELET_ARGS parameter remediation: |
to \"--cadvisor-port=0\"" Edit the kubelet service file $kubeletunitfile
scored: true on each worker node and set the below parameter in KUBELET_CADVISOR_ARGS variable.
--cadvisor-port=0
Based on your system, restart the kubelet service. For example:
systemctl daemon-reload
systemctl restart kubelet.service
scored: true
- id: 2.1.14 - id: 2.1.14
text: "Ensure that the RotateKubeletClientCertificate argument is set to true" text: "Ensure that the RotateKubeletClientCertificate argument is set to true"
audit: "ps -ef | grep $kubeletbin | grep -v grep" audit: "ps -ef | grep $kubeletbin | grep -v grep"
tests: tests:
test_items: test_items:
- flag: "RotateKubeletClientCertificate" - flag: "RotateKubeletClientCertificate"
compare: compare:
op: eq op: eq
value: true value: true
set: true set: true
remediation: "Edit the $kubeletconf file on each node and set the KUBELET_ARGS parameter remediation: |
to a value to include \"--feature-gates=RotateKubeletClientCertificate=true\"." Edit the kubelet service file $kubeletunitfile
scored: true on each worker node and remove the --feature-
gates=RotateKubeletClientCertificate=false argument from the
KUBELET_CERTIFICATE_ARGS variable.
Based on your system, restart the kubelet service. For example:
systemctl daemon-reload
systemctl restart kubelet.service
scored: true
- id: 2.1.15 - id: 2.1.15
text: "Ensure that the RotateKubeletServerCertificate argument is set to true" text: "Ensure that the RotateKubeletServerCertificate argument is set to true"
audit: "ps -ef | grep $kubeletbin | grep -v grep" audit: "ps -ef | grep $kubeletbin | grep -v grep"
tests: tests:
test_items: test_items:
- flag: "RotateKubeletServerCertificate" - flag: "RotateKubeletServerCertificate"
compare: compare:
op: eq op: eq
value: true value: true
set: true set: true
remediation: "Edit the $kubeletconf file on each node and set the KUBELET_ARGS parameter remediation: |
to a value to include \"--feature-gates=RotateKubeletServerCertificate=true\"." Edit the kubelet service file $kubeletunitfile
scored: true on each worker node and set the below parameter in KUBELET_CERTIFICATE_ARGS variable.
--feature-gates=RotateKubeletServerCertificate=true
Based on your system, restart the kubelet service. For example:
systemctl daemon-reload
systemctl restart kubelet.service
scored: true
- id: 2.2 - id: 2.2
text: "Configuration Files" text: "Configuration Files"
checks: checks:
- id: 2.2.1 - id: 2.2.1
text: "Ensure that the config file permissions are set to 644 or more restrictive (Scored)" text: "Ensure that the kubelet.conf file permissions are set to 644 or
audit: "/bin/sh -c 'if test -e $kubernetesconf; then stat -c %a $kubernetesconf; fi'" more restrictive (Scored)"
tests:
bin_op: or
test_items:
- flag: "644"
compare:
op: eq
value: "644"
set: true
- flag: "640"
compare:
op: eq
value: "640"
set: true
- flag: "600"
compare:
op: eq
value: "600"
set: true
remediation: "Run the below command (based on the file location on your system) on the each worker node.
\nFor example, chmod 644 $kubernetesconf"
scored: true
- id: 2.2.2
text: "Ensure that the config file ownership is set to root:root (Scored)"
audit: "/bin/sh -c 'if test -e $kubernetesconf; then stat -c %U:%G $kubernetesconf; fi'"
tests:
test_items:
- flag: "root:root"
compare:
op: eq
value: root:root
set: true
remediation: "Run the below command (based on the file location on your system) on the each worker node.
\nFor example, chown root:root $kubernetesconf"
scored: true
- id: 2.2.3
text: "Ensure that the kubelet file permissions are set to 644 or more restrictive (Scored)"
audit: "/bin/sh -c 'if test -e $kubeletconf; then stat -c %a $kubeletconf; fi'" audit: "/bin/sh -c 'if test -e $kubeletconf; then stat -c %a $kubeletconf; fi'"
tests: tests:
bin_op: or bin_op: or
@ -269,7 +305,7 @@ groups:
- flag: "644" - flag: "644"
compare: compare:
op: eq op: eq
value: 644 value: "644"
set: true set: true
- flag: "640" - flag: "640"
compare: compare:
@ -281,90 +317,124 @@ groups:
op: eq op: eq
value: "600" value: "600"
set: true set: true
remediation: "Run the below command (based on the file location on your system) on the each worker node. remediation: |
\nFor example, chmod 644 $kubeletconf" Run the below command (based on the file location on your system) on the each worker
node. For example,
chmod 644 $kubeletconf
scored: true scored: true
- id: 2.2.4 - id: 2.2.2
text: "Ensure that the kubelet file ownership is set to root:root (Scored)" text: "Ensure that the kubelet.conf file ownership is set to root:root (Scored)"
audit: "/bin/sh -c 'if test -e $kubeletconf; then stat -c %U:%G $kubeletconf; fi'" audit: "/bin/sh -c 'if test -e $kubeletconf; then stat -c %U:%G $kubeletconf; fi'"
tests: tests:
test_items: test_items:
- flag: "root:root" - flag: "root:root"
compare:
op: eq
value: root:root
set: true set: true
remediation: "Run the below command (based on the file location on your system) on the each worker node. remediation: |
\nFor example, chown root:root $kubeletconf" Run the below command (based on the file location on your system) on the each worker
node. For example,
chown root:root /etc/kubernetes/kubelet.conf
scored: true
- id: 2.2.3
text: "Ensure that the kubelet service file permissions are set to 644 or
more restrictive (Scored)"
audit: "/bin/sh -c 'if test -e $kubeletunitfile; then stat -c %a $kubeletunitfile; fi'"
tests:
bin_op: or
test_items:
- flag: "644"
compare:
op: eq
value: 644
set: true
- flag: "640"
compare:
op: eq
value: "640"
set: true
- flag: "600"
compare:
op: eq
value: "600"
set: true
remediation: |
Run the below command (based on the file location on your system) on the each worker
node. For example,
chmod 755 $kubeletunitfile
scored: true
- id: 2.2.4
text: "Ensure that the kubelet service file permissions are set to 644 or
more restrictive (Scored)"
audit: "/bin/sh -c 'if test -e $kubeletunitfile; then stat -c %U:%G $kubeletunitfile; fi'"
tests:
test_items:
- flag: "root:root"
set: true
remediation: |
Run the below command (based on the file location on your system) on the each worker
node. For example,
chown root:root $kubeletunitfile
scored: true scored: true
- id: 2.2.5 - id: 2.2.5
text: "Ensure that the proxy file permissions are set to 644 or more restrictive (Scored)" text: "Ensure that the proxy kubeconfig file permissions are set to 644 or more
restrictive (Scored)"
audit: "/bin/sh -c 'if test -e $proxyconf; then stat -c %a $proxyconf; fi'" audit: "/bin/sh -c 'if test -e $proxyconf; then stat -c %a $proxyconf; fi'"
tests: tests:
bin_op: or bin_op: or
test_items: test_items:
- flag: "644" - flag: "644"
compare: compare:
op: eq op: eq
value: "644" value: "644"
set: true set: true
- flag: "640" - flag: "640"
compare: compare:
op: eq op: eq
value: "640" value: "640"
set: true set: true
- flag: "600" - flag: "600"
compare: compare:
op: eq op: eq
value: "600" value: "600"
set: true set: true
remediation: "Run the below command (based on the file location on your system) on the each worker node. remediation: |
\nFor example, chmod 644 $proxyconf" Run the below command (based on the file location on your system) on the each worker
node. For example,
chmod 644 $proxyconf
scored: true scored: true
- id: 2.2.6 - id: 2.2.6
text: "Ensure that the proxy file ownership is set to root:root (Scored)" text: "Ensure that the proxy kubeconfig file ownership is set to root:root (Scored)"
audit: "/bin/sh -c 'if test -e $proxyconf; then stat -c %U:%G $proxyconf; fi'"
tests: tests:
test_items: test_items:
- flag: "root:root" - flag: "root:root"
set: true set: true
remediation: "Run the below command (based on the file location on your system) on the each worker node. remediation: |
\nFor example, chown root:root $proxyconf" Run the below command (based on the file location on your system) on the each worker
node. For example,
chown root:root $proxyconf
scored: true scored: true
- id: 2.2.7 - id: 2.2.7
text: "Ensure that the certificate authorities file permissions are set to text: "Ensure that the certificate authorities file permissions are set to
644 or more restrictive (Scored)" 644 or more restrictive (Scored)"
audit: "/bin/sh -c 'if test -e $ca-file; then stat -c %a $ca-file; fi'" type: manual
tests: remediation: |
bin_op: or Run the following command to modify the file permissions of the --client-ca-file
test_items: chmod 644 <filename>
- flag: "644"
compare:
op: eq
value: "644"
set: true
- flag: "640"
compare:
op: eq
value: "640"
set: true
- flag: "600"
compare:
op: eq
value: "600"
set: true
remediation: "Run the following command to modify the file permissions of the --client-ca-file
\nchmod 644 <filename>"
scored: true scored: true
- id: 2.2.8 - id: 2.2.8
text: "Ensure that the client certificate authorities file ownership is set to root:root" text: "Ensure that the client certificate authorities file ownership is set to root:root"
audit: "/bin/sh -c 'if test -e $ca-file; then stat -c %U:%G $ca-file; fi'" audit: "/bin/sh -c 'if test -e $ca-file; then stat -c %U:%G $ca-file; fi'"
tests: type: manual
test_items: remediation: |
- flag: "notexist:notexist" Run the following command to modify the ownership of the --client-ca-file .
set: true chown root:root <filename>
remediation: "Run the following command to modify the ownership of the --client-ca-file.
\nchown root:root <filename>"
scored: true scored: true