1
0
mirror of https://github.com/aquasecurity/kube-bench.git synced 2024-12-04 22:08:22 +00:00
Commit Graph

24 Commits

Author SHA1 Message Date
jdesouza
e75cd6bbc8
Updated KUBECTL_VERSION to 1.31.0 for fixing vulnerabilities (#1690)
* Bumped Go to 1.22.7 for fixing Critical/High vulberabilities

* Bumped Go to 1.22.7 for fixing Critical/High vulberabilities

* Bumped kubectl version for fixing vulnerabilities

* Fixed kubectl version

* Update go.mod
2024-10-03 22:43:01 +06:00
Andy Pitcher
7027b6b2ec
Add CIS kubernetes CIS-1.9 for k8s v1.27 - v1.29 (#1617)
* Create cis-1.9 yamls and Update info
      - policies.yaml
          - 5.1.1 to 5.1.6 were adapted from Manual to Automated
          - 5.1.3 got broken down into 5.1.3.1 and 5.1.3.2
          - 5.1.6 got broken down into 5.1.6.1 and 5.1.6.2
          - version was set to cis-1.9
       - node.yaml master.yaml controlplane.yaml etcd.yaml
          - version was set to cis-1.9

* Adapt master.yaml
    - Expand 1.1.13/1.1.14 checks by adding super-admin.conf to the permission and ownership verification
    - Remove 1.2.12 Ensure that the admission control plugin SecurityContextDeny is set if PodSecurityPolicy is not used (Manual)
    - Adjust numbering from 1.2.12 to 1.2.29

* Adjust policies.yaml
   - Check 5.2.3 to 5.2.9 Title Automated to Manual

* Append node.yaml
   - Create 4.3 kube-config group
   - Create 4.3.1 Ensure that the kube-proxy metrics service is bound to localhost (Automated)

* Adjust policies 5.1.3 and 5.1.6

   - Merge 5.1.3.1 and 5.1.3.2 into 5.1.3 (use role_is_compliant and clusterrole_is_compliant)
   - Remove 5.1.6.1 and promote 5.1.6.2 to 5.1.6 since it natively covered 5.1.6.1 artifacts

* Add kubectl dependency and update publish
   - Download kubectl (build stage) based on version and architecture
   - Add binary checksum verification
   - Use go env GOARCH for ARCH
2024-06-26 15:53:57 +03:00
Devendra Turkar
b29ed6b6ed
chore: add fips compliant images (#1473)
For fips complaince we need to generate fips compliant images.
As part of this change, we will create new kube-bench image which will be fips compliant. Image name follows this tag pattern <version>-ubi-fips
2023-07-24 10:02:19 +03:00
Devendra Turkar
96c6b385ef
chore: publish ubi based image (#1412)
* chore: publish ubi based image

- added publish step to publish ubi image
- updated base image for alpine based dockerfile

* chore: update pipeline image to ubuntu-latest
2023-04-05 13:02:36 +03:00
Chris Renzo
a34047c105
Adding eks-stig-kubernetes-v1r6 (#1266)
* Adding eks-stig-kubernetes-v1r6

* Fixing lint errors

* Reformatting texts

* Removing pinned docker tag

* Updating Expected Stig Output

Co-authored-by: EC2 Default User <ec2-user@ip-10-0-44-222.ec2.internal>
2022-09-14 17:40:48 +03:00
skuethe
db385c7d09
chore: add s390x arch (#1097)
Signed-off-by: skuethe <56306041+skuethe@users.noreply.github.com>

Co-authored-by: Huang Huang <mozillazg101@gmail.com>
2022-02-23 09:07:51 +02:00
manasiprabhavalkar
c0349f0ca8
Adding support for new cpu architecture (ppc64le) (#1078)
* Update makefile

Support ppc64le (IBM Power) architecture

* Update .goreleaser.yml

Added support for ppc64le cpu arch

* Update publish.yml

Added support for ppc64le cpu arch

Co-authored-by: Yoav Rotem <yoavrotems97@gmail.com>
2022-01-29 13:48:28 +02:00
Huang Huang
beaad3bab2
Support arm64 architecture (#1036)
* Support arm64 architecture

* remove .github/workflows/test_docker.yml

Co-authored-by: Yoav Rotem <yoavrotems97@gmail.com>
2021-11-08 14:06:44 +02:00
Huang Huang
bfd67496d9
fix integration test not testing latest code and can't run test on local (#1011) 2021-10-03 11:43:43 +03:00
Yoav Rotem
25ba9e2fad
New integration testing (#947)
* Fix Junit missing testsuites 

Fix issue https://github.com/aquasecurity/kube-bench/issues/883 but also bug with overriding output when --outputfile is effective and only write the last controls

* test new integration

* Update build.yml

* add wait for job to be ready

* Update build.yml

* Update build.yml

* Update build.yml

* test

* Update job.yaml

* Add wait

* test for logs

* Update job.yaml

* Create Expected_output.data

* Update build.yml

* Update build.yml

* remove empty line

* Add new line at the end

* add ---

* Delete docker.go

* Delete integration.go

* Delete integration_test.go

* Delete integration/testdata/cis-1.20 directory

* Delete integration/testdata/cis-1.6 directory

* Update integration testing

* Remove integration tests

Removed integration testing to github action

* Update build.yml
2021-08-03 17:10:50 +03:00
Oleksandr Slynko
58bea9c89b
Fix go vet issues (#720)
* Fix go vet issues

* to omit the property from JSON parsing one should use "-". "omit" in
that case would use omit tag
* The error was not reachable in the tests, so I moved it to the place
where it make sense for me (but maybe it was just unnecessary)

* Run all go vet linters in CI

* This return breaks the test
2020-10-09 15:56:22 +01:00
Liz Rice
d6de4f7c3c
Multi-arch build (#690)
* multi-arch build and other makefile tidies

* docker login in travis
2020-09-14 09:26:29 +03:00
Danny Sauer
4e43c9a9a2
Update makefile to create kubeconfig (#685)
Per https://github.com/kubernetes-sigs/cluster-api/issues/1796, the
`kind get kubeconfig-path` command no longer works.  Update makefile
to create kube-bench local kubeconfig and use that.
2020-09-02 15:28:30 +01:00
Liz Rice
01c77b2315
chore: improve test clarity (#675)
* read-only-port defaults are correct

* Tests that should catch good read-only-port

* Rework checks & tests

* Linting on issue template YAML

* More explicit test for 4.2.4

* Remove verbosity for ease of reading results

* Use subtests

* Tidy more test cases
2020-08-13 11:01:30 +03:00
Huang Huang
35cf28c140
Add integration tests for cis 1.3 and cis 1.5 (#609)
* Remove unnecessary whitespaces

* Fix a typo

* Add integration tests for cis 1.3 and cis 1.5

* Change the timeout of integration tests from 600s to 1200s

* Avoid repeated codes
2020-05-20 18:30:52 +01:00
Roberto Rojas
47c5661034
Fixes issue #439: Adds integration testing using KIND (#520)
* Fixes issue #439: Adds integration testing using KIND

* try integration tests

* started using ticker and timeouts

* trying built container image

* adds load image into KIND

* adds comparison

* fixes as per PR review
2019-11-16 09:39:47 -05:00
John Schnake
2657c2f96f Use newer kind load docker-image command (#459)
Updates the logic for `kind-push` in the makefile to use
the new, simple command provided by kind.

Fixes #458
2019-10-23 12:15:02 -07:00
Roberto Rojas
91dfeb7577
passes KUBEBENCH_VERSION down to Dockerfile (#428) 2019-10-12 18:53:17 -04:00
yoavrotems
27261d1d32 Change Kind version (#411)
Something with the old version was crashing. now using the most recent one 1.15.3 is working.
2019-09-03 13:42:07 +01:00
yoavrotems
7c97f6a490 Add codecov (#336)
* Update .gitignore

* Update .travis.yml

* Update makefile

* Update .travis.yml

* Update .travis.yml

* Update .travis.yml

* Update README.md

* Update README.md

* Update README.md

* Update makefile

* Update .travis.yml
2019-07-16 14:11:51 -04:00
Simarpreet Singh
3b7438e2f2
kube-bench: add version subcommand
Signed-off-by: Simarpreet Singh <simar@linux.com>
2019-06-12 01:41:09 -07:00
Cyril Tovena
5baf81a70a Adds master node detection and a root command that automatically detect checks to run.
The root command will run node checks and if possible master checks.
I've also added some Makefile targets to improve local testing and improve the documentation.
2019-03-12 19:32:05 -04:00
Liz Rice
f123db14a9 Update import names and makefile for name change 2017-06-20 09:38:15 +01:00
Liz Rice
26cc77ec1d Get the tests working on deployments where file names may be different or not in path (#1)
* Replace the default help text

* Readme file, including the test config format documentation

* Typo

* Warn if config files / executables aren't found

* Ignore original name of executable (as per current README)

* Update tests to avoid failing on stat of a non-existant file

* Add a makefile for ease of build
2017-06-19 23:17:19 +03:00