b1ce0a9a75
Merge branch 'master' into yoavrotems-patch-2
5 years ago
d059196b71
Update master.yaml
...
Fix 1.1.23 to check *if* --service-account-lookup argument is set and if so then if it's equal to true
5 years ago
a85e5a7759
Update master.yaml
...
Fix title of 1.4.21 from 644 to 600 according to cis benchmark
5 years ago
9b3628e76a
Update openshift executable config for #236
5 years ago
1ead9e1d71
Merge branch 'master' into clean-ocp-configs
5 years ago
53ed68a0b2
Clean up OCP benchmark config.
...
The OCP benchmarks uses configs for only binary component variable names.
This commit cleans up the OCP config by removing all configuration
except those component binaries required to run kube-bench on OCP
installations and adds missing ones.
5 years ago
c6102f0a1b
Fix the files
...
Fix the start from 1.11 to 1.13 and adding changes from pull #227 , and pull #228 .
5 years ago
e534392525
Delete node.yaml
...
replace with the new node.yaml file
5 years ago
5f09ecef44
Delete master.yaml
...
replace with the new master.yaml file
5 years ago
a7d9e06c1b
Delete config.yaml
...
replace with the new config.yaml file
5 years ago
50f22e7f13
Merge branch 'master' into add-new-cfg-version1.4
5 years ago
dd8e7ec874
Merge branch 'master' into fix-208
5 years ago
d255b49d4b
Revert 1.8 config file.
5 years ago
a88b0703d8
Add kubeconfig variable substitution for kubelet and proxy.
...
There are checks for the kubeconfig for both kubelet and proxy which
the current kube-bench implementation does not check for properly.
kube-bench checks the wrong files.
This PR adds support for variable substitution for all the config file
types are that should be checked in the CIS benchmarks.
This PR also fixes a buggy in CIS 1.3.0 check 2.2.9, which checks for
ownership of the kubelet config file /var/lib/kubelet/config.yaml but
recommends changing ownership of kubelet kubeconfig file
/etc/kubernetes/kubelet.conf as remediation.
5 years ago
3f98c1def2
Fix wrong reference to kubelet.config in node checks.
...
This fix applies to only checks for kubernetes versions 1.8 and 1.11.
See https://github.com/aquasecurity/kube-bench/pull/208 .
5 years ago
d712db47a2
Only find flags on the process we really want
5 years ago
82150fdc63
add new config files from the new CIS Kubernetes Benchmark
...
there is a new update at CIS_Kubernetes_Benchmark_v1.4.0 for Kubernetes 1.13
5 years ago
e899e941f7
Add OCP 3.10 benchmarks.
5 years ago
791fbba9e7
Changed 1.1.14 to not fail when flag is not set
...
Added another test item that checks whether --disable-admission-plugins is not set and an "or" bin_op.
This causes check 1.1.14 to be successful when the flag is not set, while still failing when the flag is set and includes the value NamespaceLifecycle
5 years ago
2d721ed4ad
Merge branch 'master' into rm-space-tls-cipher
5 years ago
ffe7ffb3d3
Type: trailing whitespace for rule text
5 years ago
fd120d0adf
Remove spaces in remediation command for tls-cipher-suites
...
Makes it easier to copy-paste the remediation. Matches the other occurences
of tls-cipher-suites in the configuration.
5 years ago
26e28b8897
Merge branch 'master' into master
5 years ago
e81b785bf8
Added missing "=" to master.yaml
...
In the remediation of 1.1.11 the flag --enable-admission-plugins was missing a =
5 years ago
645d23e1ec
fixing typos 2.1.15
6 years ago
6e80b6477a
Merge branch 'master' into fix-2.1.8
6 years ago
0a5358665e
By default --make-iptables-util-chain is true, so PASS if this flag is not set.
6 years ago
4f40a11e84
Change binary op from and to or.
6 years ago
c0f56e966a
Fix check 1.1.37.
6 years ago
e083c8f0a3
Fixes https://github.com/aquasecurity/kube-bench/issues/170
...
Correcting the logic of 1.1.14 for Kubernetes 1.11.
6 years ago
48489637c5
Merge branch 'master' into fix-1.3.7
6 years ago
9988503223
Fixing 1.3.7 on 1.11 master.
...
With multiple test items operator defaults to "and". In case of 1.3.7
the tests check whether --address flag is either set to 127.0.0.1 or not
set at all. Those conditions cannot be met at the same time.
6 years ago
5f254de415
Fixing checks 2.2.9 and 2.2.10 on 1.11 nodes.
...
Path to kubelet configuration was accidentally prefixed with a dollar
symbol (probably as a result of copying some other test that used
variable name).
After removing the dollar sign from paths both checks pass on conforming
deployment.
6 years ago
97623aea05
Update kubernetes node benchmark to check kubelet systemd unitfile.
...
Also clean up the config file for 1.11 a bit.
6 years ago
b1369832bc
A few corrections to node tests. ( #2 )
...
* Add a few corrections.
* Add a few corrections to node test file.
6 years ago
934b4aef96
Add a few corrections. ( #1 )
6 years ago
e85de9e8af
fix simple errors
6 years ago
b3a115963b
adding 1.11 config and node checks
6 years ago
ba5ec8d4be
adding 1.11 master configuration
6 years ago
c44e0db97b
Inlcude .manifest extension config files for kops & kubespray
6 years ago
024b7ed396
Merge branch 'master' into master
6 years ago
2073e08363
update 2.2.4 rules
6 years ago
db096c9f51
Rule node 2.2.4 is not correct
6 years ago
d736d10f90
fix sed string for 1.4.12
6 years ago
50a3725ff2
Merge branch 'master' into master
6 years ago
468f5fac6e
changes for 1.4.11 and 1.4.2
...
added tests: for 1.4.11 and removed grep -v grep for both
6 years ago
182e9b5e01
Addition of missing audit field in 2.2.6 node item
6 years ago
e4100a4435
fixed grep string for 1.4.11 and 1.4.22
...
check 1.4.11 and 1.4.22 FAIL even when permissions is correct.
6 years ago
b10b2bd22e
Merge branch 'master' into fix-typo
6 years ago
aa9da13226
Fix a bunch of typos.
6 years ago
Liz Rice