306e1960af
Add flags to further filter CIS checks to run
5 years ago
9246be924d
Merge branch 'master' into features/autodetect-nodetype
5 years ago
5baf81a70a
Adds master node detection and a root command that automatically detect checks to run.
...
The root command will run node checks and if possible master checks.
I've also added some Makefile targets to improve local testing and improve the documentation.
5 years ago
a88b0703d8
Add kubeconfig variable substitution for kubelet and proxy.
...
There are checks for the kubeconfig for both kubelet and proxy which
the current kube-bench implementation does not check for properly.
kube-bench checks the wrong files.
This PR adds support for variable substitution for all the config file
types are that should be checked in the CIS benchmarks.
This PR also fixes a buggy in CIS 1.3.0 check 2.2.9, which checks for
ownership of the kubelet config file /var/lib/kubelet/config.yaml but
recommends changing ownership of kubelet kubeconfig file
/etc/kubernetes/kubelet.conf as remediation.
5 years ago
e93bfc1aac
search for the kubelet binary when it is not in the path
5 years ago
082e9cf7e9
Bugfix: Logging warning instead of printing
...
Made all the warnings to be logged and not printed, so when using the json flag the output will be only in json format.
fix #217
5 years ago
ed21839464
Add getServiceFiles function.
...
The CIS benchmark check for node checks 2 config files for kubelet:
- kubelet config file (kubelet.conf)
- kubelet systemd unitfile (10-kubeadm.conf)
The getServiceFiles function gets candidates for kubelet systemd
unitfile and returns valid untifiles.
6 years ago
ccc2b6c9ae
Shouldn't need kubelet or kubectl if version specified
6 years ago
344d2bfd24
Utility for getting the right config file for the Kubernetes version
6 years ago
ecd14ed682
File substitutions should be a detailed log
6 years ago
39d94df81b
Add tip about the `--version` flag to error output
...
If people are trying to use the Docker image to check their cluster, there's a
big likelyhood of them hitting the error message saying that either `kubectl`
or `kubelet` need to be found in order for `kube-bench` to be able to determine
the Kubernetes version in use.
This adds a tip that the version can be specified manually with the `--version`
flag which is a lot easier than having to make a new Docker image with the
right version of `kubelet`/`kubectl` in order for `kube-bench` to work.
6 years ago
d6c16f7563
Try to use kubelet when kubectl is unavailable
6 years ago
58b6358a02
Merge branch 'master' into u/jaxxstorm/golint
6 years ago
94a1f3c41f
Lint all code for golint tests
6 years ago
53eb720952
Merge branch 'master' into unnecessary-warning
7 years ago
04f044e3b9
Add support for merging general and kubernetes version specific config files.
...
This change unifies all config files, podspecs and unitfiles under
a single component configuration key; `config`.
7 years ago
730871f330
Fix kubeVersion regex tests
7 years ago
c93c94b3f6
Fix version check regexp.
7 years ago
c60c459bc4
Fix bug causing kubectl version to always return default version.
7 years ago
42a1068964
Add default version if version check fails.
7 years ago
f90dd925b8
Exit kube-bench if we can't get valid kubernetes server version and
...
improve error messages.
7 years ago
31b5910a7f
Remove unnecessary warnings about missing config files.
7 years ago
3dcc38d5c8
Fix issue with util test.
7 years ago
cec1d9d6b3
Combine config reading functions into single function.
7 years ago
e227934c88
Add function to get unit files for kubernetes components.
7 years ago
6ce0c5bf60
Add function to get pod specs for kubernetes components.
7 years ago
88a003090f
Delete verifyKubeVersion support functions.
7 years ago
d9e1eee2cd
Merge remote-tracking branch 'origin/master' into support for multiple
...
Kubernetes versions.
7 years ago
56fa20103a
Add function to retrieve Kubernetes server version.
...
The server version is used to load the correct benchmark check
to run against the Kubernetes cluster.
7 years ago
8380ad1ef3
Better detection of running executables
7 years ago
a3197f8efe
Reorder YAML to make a bit more sense. Allow for optional components, and a config file that we don’t think exists.
7 years ago
e4b905e360
Log when there’s no substitution
7 years ago
6a5a62b278
Autodetect the binaries and config files from a set of options
7 years ago
f5cef922cc
Functions and tests for finding binaries and config files
7 years ago
7600dd9dd6
Make the ps / fakeps function global so we don’t have to pass it around so much
7 years ago
0bc00e0036
Slightly more robust looking for running executables
7 years ago
9114e139cf
Function to find which of a set of executables is running
7 years ago
6b9f117f87
Allow for multiple words in executable names
7 years ago
34f8b8e980
Simplify verifying binaries and config files
7 years ago
86d49b1b1a
We don’t care whether the binaries are in our path or not, just whether they are running
7 years ago
96c469669c
Use kubectl to check the kubernetes version
7 years ago
7bb66dd2da
Rename warning printing functions.
...
printlnWarn: prints warning with a newline.
sprintWarn: returns an optionally contextualized warning string.
7 years ago
82c92e0078
Change function name to be clearer about the fact it returns a string.
7 years ago
f88de572f6
Improve error handling.
7 years ago
f589fd58e1
Add few modifications.
7 years ago
609c4ff01c
Move kubernetes binaries and config paths to kube-bench config.
7 years ago
Daniel Pacak