Fix to empty grep and other cis-1.6-k3s checks (#1352)

* Fix to empty grep and other k3s checks

Signed-off-by: Derek Nola <derek.nola@suse.com>

* Lint fix

Signed-off-by: Derek Nola <derek.nola@suse.com>

Signed-off-by: Derek Nola <derek.nola@suse.com>

cfg/cis-1.6-k3s/etcd.yaml

@@ -10,17 +10,15 @@ groups:
     checks:
       - id: 2.1
         text: "Ensure that the --cert-file and --key-file arguments are set as appropriate if use etcd as database (Automated)"
-        audit: grep -E 'cert-file|key-file' $etcdconf
+        audit: grep -A 4 'client-transport-security' $etcdconf | grep -E 'cert-file|key-file'
         tests:
           bin_op: and
           test_items:
-            - flag: "--cert-file"
+            - flag: "cert-file"
-              env: "ETCD_CERT_FILE"
+            - flag: "key-file"
-            - flag: "--key-file"
-              env: "ETCD_KEY_FILE"
         remediation: |
           By default, K3s uses a config file for etcd that can be found at $etcdconf.
-          Server and peer cert and key files are specified. No manual remediation needed.
+          The config file contains client-transport-security: which has fields that have the peer cert and peer key files. No manual remediation needed.
         scored: true
 
       - id: 2.2
@@ -28,8 +26,7 @@ groups:
         audit: grep 'client-cert-auth' $etcdconf
         tests:
           test_items:
-            - flag: "--client-cert-auth"
+            - flag: "client-cert-auth"
-              env: "ETCD_CLIENT_CERT_AUTH"
               compare:
                 op: eq
                 value: true
@@ -40,15 +37,13 @@ groups:
 
       - id: 2.3
         text: "Ensure that the --auto-tls argument is not set to true (Automated)"
-        audit: grep 'auto-tls' $etcdconf
+        audit: grep 'auto-tls' $etcdconf | cat
         tests:
           bin_op: or
           test_items:
-            - flag: "--auto-tls"
+            - flag: "auto-tls"
-              env: "ETCD_AUTO_TLS"
               set: false
-            - flag: "--auto-tls"
+            - flag: "auto-tls"
-              env: "ETCD_AUTO_TLS"
               compare:
                 op: eq
                 value: false
@@ -59,14 +54,12 @@ groups:
       - id: 2.4
         text: "Ensure that the --peer-cert-file and --peer-key-file arguments are
         set as appropriate (Automated)"
-        audit: grep -A 5 'peer-transport-security' $etcdconf | grep -E 'cert-file|key-file'
+        audit: grep -A 4 'peer-transport-security' $etcdconf | grep -E 'cert-file|key-file'
         tests:
           bin_op: and
           test_items:
-            - flag: "--peer-cert-file"
+            - flag: "cert-file"
-              env: "ETCD_PEER_CERT_FILE"
+            - flag: "key-file"
-            - flag: "--peer-key-file"
-              env: "ETCD_PEER_KEY_FILE"
         remediation: |
           By default, K3s starts Etcd with a config file found here, $etcdconf.
           The config file contains peer-transport-security: which has fields that have the peer cert and peer key files.
@@ -74,30 +67,27 @@ groups:
 
       - id: 2.5
         text: "Ensure that the --peer-client-cert-auth argument is set to true (Automated)"
-        audit: grep 'client-cert-auth' $etcdconf
+        audit: grep -A 4 'peer-transport-security' $etcdconf | grep 'client-cert-auth'
         tests:
           test_items:
-            - flag: "--peer-client-cert-auth"
+            - flag: "client-cert-auth"
-              env: "ETCD_PEER_CLIENT_CERT_AUTH"
               compare:
                 op: eq
                 value: true
         remediation: |
           By default, K3s uses a config file for etcd that can be found at $etcdconf.
-          Within the file, the client-cert-auth field is set. No manual remediation needed.
+          The config file contains peer-transport-security: which has client-cert-auth set to true. No manual remediation needed.
         scored: true
 
       - id: 2.6
         text: "Ensure that the --peer-auto-tls argument is not set to true (Automated)"
-        audit: grep 'peer-auto-tls' $etcdconf
+        audit: grep 'peer-auto-tls' $etcdconf | cat
         tests:
           bin_op: or
           test_items:
-            - flag: "--peer-auto-tls"
+            - flag: "peer-auto-tls"
-              env: "ETCD_PEER_AUTO_TLS"
               set: false
-            - flag: "--peer-auto-tls"
+            - flag: "peer-auto-tls"
-              env: "ETCD_PEER_AUTO_TLS"
               compare:
                 op: eq
                 value: false

cfg/cis-1.6-k3s/master.yaml

@@ -213,7 +213,7 @@ groups:
 
       - id: 1.2.2
         text: "Ensure that the --basic-auth-file argument is not set (Automated)"
-        audit: journalctl -u k3s | grep "Running kube-apiserver" | tail -n1 | grep "basic-auth-file"
+        audit: journalctl -u k3s | grep "Running kube-apiserver" | tail -n1 | grep "basic-auth-file" | cat
         tests:
           test_items:
             - flag: "--basic-auth-file"
@@ -224,7 +224,7 @@ groups:
 
       - id: 1.2.3
         text: "Ensure that the --token-auth-file parameter is not set (Automated)"
-        audit: journalctl -u k3s | grep "Running kube-apiserver" | tail -n1 | grep "token-auth-file"
+        audit: journalctl -u k3s | grep "Running kube-apiserver" | tail -n1 | grep "token-auth-file" | cat
         tests:
           test_items:
             - flag: "--token-auth-file"
@@ -235,7 +235,7 @@ groups:
 
       - id: 1.2.4
         text: "Ensure that the --kubelet-https argument is set to true (Automated)"
-        audit: journalctl -u k3s | grep "Running kube-apiserver" | tail -n1 | grep "token-auth-file"
+        audit: journalctl -u k3s | grep "Running kube-apiserver" | tail -n1 | grep "kubelet-https" | cat
         tests:
           bin_op: or
           test_items:
@@ -396,7 +396,7 @@ groups:
 
       - id: 1.2.15
         text: "Ensure that the admission control plugin NamespaceLifecycle is set (Automated)"
-        audit: journalctl -u k3s | grep "Running kube-apiserver" | tail -n1 | grep "disable-admission-plugins"
+        audit: journalctl -u k3s | grep "Running kube-apiserver" | tail -n1 | grep "disable-admission-plugins" | cat
         tests:
           bin_op: or
           test_items:
@@ -542,9 +542,12 @@ groups:
 
       - id: 1.2.26
         text: "Ensure that the --request-timeout argument is set as appropriate (Automated)"
-        audit: journalctl -u k3s | grep "Running kube-apiserver" | tail -n1 | grep "request-timeout"
+        audit: journalctl -u k3s | grep "Running kube-apiserver" | tail -n1 | grep "request-timeout" | cat
         tests:
+          bin_op: or
           test_items:
+            - flag: "--request-timeout"
+              set: false
             - flag: "--request-timeout"
               compare:
                 op: lte
@@ -719,7 +722,7 @@ groups:
 
       - id: 1.3.6
         text: "Ensure that the RotateKubeletServerCertificate argument is set to true (Automated)"
-        audit: journalctl -u k3s | grep "Running kube-controller-manager" | tail -n1 | grep "RotateKubeletServerCertificate"
+        audit: journalctl -u k3s | grep "Running kube-controller-manager" | tail -n1 | grep "RotateKubeletServerCertificate" | cat
         tests:
           bin_op: or
           test_items: