arno/kube-bench
1
0
Fork 0
mirror of https://github.com/aquasecurity/kube-bench.git synced 2024-11-29 03:18:27 +00:00
Code Issues Releases Wiki Activity

cis-1.24: fix tests of 1.1.1 and 4.2.9 were wrong (#1423)

Browse Source 
fixes #1410
fixes #1421
This commit is contained in:
Huang Huang 2023-05-21 16:39:51 +08:00 committed by GitHub
parent 6de03bbd7d
commit e41755ba90
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 8 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
cfg/cis-1.24/master.yaml
View File

@ -9,18 +9,18 @@ groups:
text: "Control Plane Node Configuration Files" text: "Control Plane Node Configuration Files"
checks: checks:
- id: 1.1.1 - id: 1.1.1
text: "Ensure that the API server pod specification file permissions are set to 644 or more restrictive (Automated)" text: "Ensure that the API server pod specification file permissions are set to 600 or more restrictive (Automated)"
audit: "/bin/sh -c 'if test -e $apiserverconf; then stat -c permissions=%a $apiserverconf; fi'" audit: "/bin/sh -c 'if test -e $apiserverconf; then stat -c permissions=%a $apiserverconf; fi'"
tests: tests:
test_items: test_items:
- flag: "permissions" - flag: "permissions"
compare: compare:
op: bitmask op: bitmask
value: "644" value: "600"
remediation: | remediation: |
Run the below command (based on the file location on your system) on the Run the below command (based on the file location on your system) on the
control plane node. control plane node.
For example, chmod 644 $apiserverconf For example, chmod 600 $apiserverconf
scored: true scored: true
- id: 1.1.2 - id: 1.1.2

6
cfg/cis-1.24/node.yaml
View File

@ -350,8 +350,12 @@ groups:
- flag: --event-qps - flag: --event-qps
path: '{.eventRecordQPS}' path: '{.eventRecordQPS}'
compare: compare:
op: eq op: gte
value: 0 value: 0
- flag: --event-qps
path: '{.eventRecordQPS}'
set: false
bin_op: or
remediation: | remediation: |
If using a Kubelet config file, edit the file to set `eventRecordQPS` to an appropriate level. If using a Kubelet config file, edit the file to set `eventRecordQPS` to an appropriate level.
If using command line arguments, edit the kubelet service file If using command line arguments, edit the kubelet service file