arno/kube-bench
1
0
Fork 0
mirror of https://github.com/aquasecurity/kube-bench.git synced 2025-02-16 17:42:05 +00:00
Code Issues Releases Wiki Activity

Add fixes in node and etcd TCs

Browse Source
This commit is contained in:
Deepanshu Bhatia 2024-09-18 23:00:53 +05:30 committed by Md Safiyat Reza
parent 1ae58e3e97
commit ff650d04fd
2 changed files with 7 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
cfg/rh-1.6/etcd.yaml
View File

@ -28,7 +28,8 @@ groups:
- flag: "file"
compare:
op: regex
value: '\/etc\/kubernetes\/static-pod-certs\/secrets\/etcd-all-serving\/etcd-serving-.*\.(?:crt|key)'
# some systems have certs in directory '/etc/kubernetes/static-pod-certs/secrets/etcd-all-certs'
value: \/etc\/kubernetes\/static-pod-certs\/secrets\/etcd-all-(?:serving|certs)\/etcd-serving-.*\.(?:crt|key)
remediation: |
OpenShift does not use the etcd-certfile or etcd-keyfile flags.
Certificates for etcd are managed by the etcd cluster operator.
@ -103,7 +104,8 @@ groups:
- flag: "file"
compare:
op: regex
value: '\/etc\/kubernetes\/static-pod-certs\/secrets\/etcd-all-peer\/etcd-peer-.*\.(?:crt|key)'
# some systems have certs in directory '/etc/kubernetes/static-pod-certs/secrets/etcd-all-certs'
value: '\/etc\/kubernetes\/static-pod-certs\/secrets\/etcd-all-(?:peer|certs)\/etcd-peer-.*\.(?:crt|key)'
remediation: |
None. This configuration is managed by the etcd operator.
scored: false

7
cfg/rh-1.6/node.yaml
View File

@ -349,15 +349,14 @@ groups:
echo RotateKubeletServerCertificate=$(oc get --raw /api/v1/nodes/$NODE_NAME/proxy/configz | jq '.kubeletconfig.featureGates.RotateKubeletServerCertificate' 2> /dev/null)
# Verify the rotateCertificates argument is set to true
echo rotateCertificates=$(oc get --raw /api/v1/nodes/$NODE_NAME/proxy/configz | jq -r '.kubeletconfig.rotateCertificates' 2> /dev/null)
use_multiple_values: true
tests:
bin_op: or
bin_op: and
test_items:
- flag: rotateCertificates
- flag: RotateKubeletServerCertificate
compare:
op: eq
value: true
- flag: RotateKubeletServerCertificate
- flag: rotateCertificates
compare:
op: eq
value: true