arno/kube-bench
1
0
Fork 0
mirror of https://github.com/aquasecurity/kube-bench.git synced 2025-02-21 12:02:30 +00:00
Code Issues Releases Wiki Activity

Add fixes in node and etcd TCs

Browse Source
This commit is contained in:
Deepanshu Bhatia 2024-09-18 23:00:53 +05:30 committed by Md Safiyat Reza
parent 1ae58e3e97
commit ff650d04fd
2 changed files with 7 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
cfg/rh-1.6/etcd.yaml
View File

@ -28,7 +28,8 @@ groups:
- flag: "file" - flag: "file"
compare: compare:
op: regex op: regex
value: '\/etc\/kubernetes\/static-pod-certs\/secrets\/etcd-all-serving\/etcd-serving-.*\.(?:crt|key)' # some systems have certs in directory '/etc/kubernetes/static-pod-certs/secrets/etcd-all-certs'
value: \/etc\/kubernetes\/static-pod-certs\/secrets\/etcd-all-(?:serving|certs)\/etcd-serving-.*\.(?:crt|key)
remediation: | remediation: |
OpenShift does not use the etcd-certfile or etcd-keyfile flags. OpenShift does not use the etcd-certfile or etcd-keyfile flags.
Certificates for etcd are managed by the etcd cluster operator. Certificates for etcd are managed by the etcd cluster operator.
@ -103,7 +104,8 @@ groups:
- flag: "file" - flag: "file"
compare: compare:
op: regex op: regex
value: '\/etc\/kubernetes\/static-pod-certs\/secrets\/etcd-all-peer\/etcd-peer-.*\.(?:crt|key)' # some systems have certs in directory '/etc/kubernetes/static-pod-certs/secrets/etcd-all-certs'
value: '\/etc\/kubernetes\/static-pod-certs\/secrets\/etcd-all-(?:peer|certs)\/etcd-peer-.*\.(?:crt|key)'
remediation: | remediation: |
None. This configuration is managed by the etcd operator. None. This configuration is managed by the etcd operator.
scored: false scored: false

7
cfg/rh-1.6/node.yaml
View File

@ -349,15 +349,14 @@ groups:
echo RotateKubeletServerCertificate=$(oc get --raw /api/v1/nodes/$NODE_NAME/proxy/configz | jq '.kubeletconfig.featureGates.RotateKubeletServerCertificate' 2> /dev/null) echo RotateKubeletServerCertificate=$(oc get --raw /api/v1/nodes/$NODE_NAME/proxy/configz | jq '.kubeletconfig.featureGates.RotateKubeletServerCertificate' 2> /dev/null)
# Verify the rotateCertificates argument is set to true # Verify the rotateCertificates argument is set to true
echo rotateCertificates=$(oc get --raw /api/v1/nodes/$NODE_NAME/proxy/configz | jq -r '.kubeletconfig.rotateCertificates' 2> /dev/null) echo rotateCertificates=$(oc get --raw /api/v1/nodes/$NODE_NAME/proxy/configz | jq -r '.kubeletconfig.rotateCertificates' 2> /dev/null)
use_multiple_values: true
tests: tests:
bin_op: or bin_op: and
test_items: test_items:
- flag: rotateCertificates - flag: RotateKubeletServerCertificate
compare: compare:
op: eq op: eq
value: true value: true
- flag: RotateKubeletServerCertificate - flag: rotateCertificates
compare: compare:
op: eq op: eq
value: true value: true