diff --git a/cfg/1.11/master.yaml b/cfg/1.11/master.yaml index b592295..02ebd47 100644 --- a/cfg/1.11/master.yaml +++ b/cfg/1.11/master.yaml @@ -613,7 +613,7 @@ groups: --admission-control-config-file= scored: true - - id: 1.1.37 + - id: 1.1.37a text: "Ensure that the AdvancedAuditing argument is not set to false (Scored)" audit: "ps -ef | grep $apiserverbin | grep -v grep" tests: @@ -633,6 +633,23 @@ groups: --audit-policy-file=/etc/kubernetes/audit-policy.yaml scored: true + - id: 1.1.37b + text: "Ensure that the AdvancedAuditing argument is not set to false (Scored)" + audit: "ps -ef | grep $apiserverbin | grep -v grep" + tests: + test_items: + - flag: "--audit-policy-file" + compare: + op: eq + value: "/etc/kubernetes/audit-policy.yaml" + set: true + remediation: | + Follow the Kubernetes documentation and set the desired audit policy in the + /etc/kubernetes/audit-policy.yaml file. Then, edit the API server pod specification file $apiserverconf + and set the below parameters. + --audit-policy-file=/etc/kubernetes/audit-policy.yaml + scored: true + - id: 1.1.38 text: "Ensure that the --request-timeout argument is set as appropriate (Scored)" audit: "ps -ef | grep $apiserverbin | grep -v grep" diff --git a/cfg/1.13/master.yaml b/cfg/1.13/master.yaml index 3402aa8..57fc20d 100644 --- a/cfg/1.13/master.yaml +++ b/cfg/1.13/master.yaml @@ -618,7 +618,7 @@ groups: --admission-control-config-file= scored: true - - id: 1.1.37 + - id: 1.1.37a text: "Ensure that the AdvancedAuditing argument is not set to false (Scored)" audit: "ps -ef | grep $apiserverbin | grep -v grep" tests: @@ -638,6 +638,23 @@ groups: --audit-policy-file=/etc/kubernetes/audit-policy.yaml scored: true + - id: 1.1.37b + text: "Ensure that the AdvancedAuditing argument is not set to false (Scored)" + audit: "ps -ef | grep $apiserverbin | grep -v grep" + tests: + test_items: + - flag: "--audit-policy-file" + compare: + op: eq + value: "/etc/kubernetes/audit-policy.yaml" + set: true + remediation: | + Follow the Kubernetes documentation and set the desired audit policy in the + /etc/kubernetes/audit-policy.yaml file. Then, edit the API server pod specification file $apiserverconf + and set the below parameters. + --audit-policy-file=/etc/kubernetes/audit-policy.yaml + scored: true + - id: 1.1.38 text: "Ensure that the --request-timeout argument is set as appropriate (Scored)" audit: "ps -ef | grep $apiserverbin | grep -v grep"