From a85e5a77592a77c172339a67ce4e0f9e1f0bb3f3 Mon Sep 17 00:00:00 2001 From: yoavrotems Date: Mon, 25 Mar 2019 14:33:52 +0200 Subject: [PATCH 1/5] Update master.yaml Fix title of 1.4.21 from 644 to 600 according to cis benchmark --- cfg/1.13/master.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/cfg/1.13/master.yaml b/cfg/1.13/master.yaml index 9518b35..fff2a72 100644 --- a/cfg/1.13/master.yaml +++ b/cfg/1.13/master.yaml @@ -1213,7 +1213,7 @@ groups: scored: true - id: 1.4.21 - text: "Ensure that the Kubernetes PKI certificate file permissions are set to 644 or more restrictive (Scored)" + text: "Ensure that the Kubernetes PKI certificate file permissions are set to 600 or more restrictive (Scored)" audit: "stat -c %n\ %a /etc/kubernetes/pki/*.key" type: "manual" tests: From d059196b71560a57529af0bc1c02ba912e6b72c9 Mon Sep 17 00:00:00 2001 From: yoavrotems Date: Mon, 25 Mar 2019 14:41:06 +0200 Subject: [PATCH 2/5] Update master.yaml Fix 1.1.23 to check *if* --service-account-lookup argument is set and if so then if it's equal to true --- cfg/1.13/master.yaml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/cfg/1.13/master.yaml b/cfg/1.13/master.yaml index 9518b35..38f2195 100644 --- a/cfg/1.13/master.yaml +++ b/cfg/1.13/master.yaml @@ -366,7 +366,10 @@ groups: text: "Ensure that the --service-account-lookup argument is set to true (Scored)" audit: "ps -ef | grep $apiserverbin | grep -v grep" tests: + bin_op: or test_items: + - flag: "--service-account-lookup" + set: false - flag: "--service-account-lookup" compare: op: eq From 488f5221effc5c0fd2b565581e6a33140f27b3e0 Mon Sep 17 00:00:00 2001 From: Liz Rice Date: Tue, 26 Mar 2019 10:37:17 +0000 Subject: [PATCH 3/5] Document output states Also describe how tests can be omitted by editing the YAML --- README.md | 23 ++++++++++++++++++++++- 1 file changed, 22 insertions(+), 1 deletion(-) diff --git a/README.md b/README.md index 1bfe745..d4b7e4f 100644 --- a/README.md +++ b/README.md @@ -114,6 +114,13 @@ For each type of node (*master*, *node* or *federated*) there is a list of compo * **confs** - If one of the listed config files is found, this will be considered for the test. Tests can continue even if no config file is found. If no file is found at any of the listed locations, and a *defaultconf* location is given for the component, the test will give remediation advice using the *defaultconf* location. * **unitfiles** - From version 1.2.0 of the benchmark (tests for Kubernetes 1.8), the remediation instructions were updated to assume that kubelet configuration is defined in a service file, and this setting defines where to look for that configuration. +## Output + +There are three output states +- [PASS] and [FAIL] indicate that a test was run successfully, and it either passed or failed +- [WARN] means this test needs further attention, for example it is a test that needs to be run manually +- [INFO] is informational output that needs no further action. + ## Test config YAML representation The tests are represented as YAML documents (installed by default into ./cfg). @@ -146,6 +153,20 @@ Recommendations (called `checks` in this document) can run on Kubernetes Master, Checks are organized into `groups` which share similar controls (things to check for) and are grouped together in the section of the CIS Kubernetes document. These groups are further organized under `controls` which can be of the type `master`, `node` or `federated apiserver` to reflect the various Kubernetes node types. +### Omitting checks + +If you decide that a recommendation is not appropriate for your environment, you can choose to omit it by editing the test YAML file to give it the check type `skip` as in this example: + +```yaml + checks: + - id: 2.1.1 + text: "Ensure that the --allow-privileged argument is set to false (Scored)" + type: "skip" + scored: true +``` + +No tests will be run for this check and the output will be marked [INFO]. + ## Tests Tests are the items we actually look for to determine if a check is successful or not. Checks can have multiple tests, which must all be successful for the check to pass. @@ -188,4 +209,4 @@ Next you'll have to build the kube-bench docker image using `make build-docker`, Finally we can use the `make kind-run` target to run the current version of kube-bench in the cluster and follow the logs of pods created. (Ctrl+C to exit) -Everytime you want to test a change, you'll need to rebuild the docker image and push it to cluster before running it again. ( `make build-docker kind-push kind-run` ) \ No newline at end of file +Everytime you want to test a change, you'll need to rebuild the docker image and push it to cluster before running it again. ( `make build-docker kind-push kind-run` ) From df556c2f42e78c463f100cce4e965b32bfb9ed77 Mon Sep 17 00:00:00 2001 From: Liz Rice Date: Wed, 27 Mar 2019 14:21:22 +0000 Subject: [PATCH 4/5] Add CIS & Kubernetes version mapping to README --- README.md | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index 1bfe745..2d9b0da 100644 --- a/README.md +++ b/README.md @@ -13,7 +13,17 @@ Tests are configured with YAML files, making this tool easy to update as test sp ## CIS Kubernetes Benchmark support -kube-bench supports the tests for multiple versions of Kubernetes (1.6, 1.7, 1.8, and 1.11) as defined in the CIS Benchmarks 1.0.0, 1.1.0, 1.2.0, and 1.3.0 respectively. It will determine the test set to run based on the Kubernetes version running on the machine. +kube-bench supports the tests for Kubernetes as defined in the CIS Benchmarks 1.0.0 to 1.4.0 respectively. + +| CIS Kubernetes Benchmark | kube-bench config | Kubernetes versions | +|---|---|---| +| 1.0.0| 1.6 | 1.6 | +| 1.1.0| 1.7 | 1.7 | +| 1.2.0| 1.8 | 1.8-1.10 | +| 1.3.0| 1.11 | 1.11-1.12 | +| 1.4.0| 1.13 | 1.13- | + +By default kube-bench will determine the test set to run based on the Kubernetes version running on the machine. ## Installation @@ -188,4 +198,4 @@ Next you'll have to build the kube-bench docker image using `make build-docker`, Finally we can use the `make kind-run` target to run the current version of kube-bench in the cluster and follow the logs of pods created. (Ctrl+C to exit) -Everytime you want to test a change, you'll need to rebuild the docker image and push it to cluster before running it again. ( `make build-docker kind-push kind-run` ) \ No newline at end of file +Everytime you want to test a change, you'll need to rebuild the docker image and push it to cluster before running it again. ( `make build-docker kind-push kind-run` ) From 4b8a7ffbe1034c630c9fc194bf434f30f07b2b7e Mon Sep 17 00:00:00 2001 From: Abubakr-Sadik Nii Nai Davis Date: Wed, 10 Apr 2019 22:47:26 +0000 Subject: [PATCH 5/5] Add ":" as a valid flag-value separator for tests This is useful for checking values in YAML (possibly JSON) kubernetes config files. --- check/check.go | 2 ++ check/data | 9 +++++++++ check/test.go | 2 +- check/test_test.go | 10 ++++++++++ 4 files changed, 22 insertions(+), 1 deletion(-) diff --git a/check/check.go b/check/check.go index 0813858..4ace74b 100644 --- a/check/check.go +++ b/check/check.go @@ -166,6 +166,8 @@ func (c *Check) Run() { i++ } + glog.V(3).Info(out.String()) + finalOutput := c.Tests.execute(out.String()) if finalOutput != nil { c.ActualValue = finalOutput.actualResult diff --git a/check/data b/check/data index 88bdc85..cfc65ca 100644 --- a/check/data +++ b/check/data @@ -158,3 +158,12 @@ groups: set: true + - id: 14 + text: "check that flag some-arg is set to some-val with ':' separator" + tests: + test_items: + - flag: "some-arg" + compare: + op: eq + value: some-val + set: true diff --git a/check/test.go b/check/test.go index 7a74634..9289b0a 100644 --- a/check/test.go +++ b/check/test.go @@ -68,7 +68,7 @@ func (t *testItem) execute(s string) *testOutput { // --flag // somevalue //pttn := `(` + t.Flag + `)(=)*([^\s,]*) *` - pttn := `(` + t.Flag + `)(=)*([^\s]*) *` + pttn := `(` + t.Flag + `)(=|: *)*([^\s]*) *` flagRe := regexp.MustCompile(pttn) vals := flagRe.FindStringSubmatch(s) diff --git a/check/test_test.go b/check/test_test.go index 4b96e07..72e4f46 100644 --- a/check/test_test.go +++ b/check/test_test.go @@ -110,6 +110,16 @@ func TestTestExecute(t *testing.T) { controls.Groups[0].Checks[13], "2:45 ../kubernetes/kube-apiserver --option --admission-control=Something ---audit-log-maxage=40", }, + { + // check for ':' as argument-value separator, with space between arg and val + controls.Groups[0].Checks[14], + "2:45 kube-apiserver some-arg: some-val --admission-control=Something ---audit-log-maxage=40", + }, + { + // check for ':' as argument-value separator, with no space between arg and val + controls.Groups[0].Checks[14], + "2:45 kube-apiserver some-arg:some-val --admission-control=Something ---audit-log-maxage=40", + }, } for _, c := range cases {