Simarpreet Singh
3b7438e2f2
kube-bench: add version subcommand
...
Signed-off-by: Simarpreet Singh <simar@linux.com>
5 years ago
nshauli
e64f61fa7f
Add --outputfile flag for writing json results to output file ( #295 )
5 years ago
Liz Rice
a8c69b57e8
Merge branch 'master' into config-improvements
5 years ago
Liz Rice
e33e44b676
Correct debug messages
5 years ago
Yoav Hizkiahou
3aa28c4c32
Printing the actual test result of failed tests - when a flag is raised
...
fix #110
5 years ago
Liz Rice
aebd35a5ab
Update copyright date
5 years ago
Daniel Pacak
5fb133cd02
Adjust the semantics of scored and unscored flags
5 years ago
Daniel Pacak
306e1960af
Add flags to further filter CIS checks to run
5 years ago
Liz Rice
de623220e1
No need to load config just to check if components are running.
...
This also allows for there to be no master.yaml file, for environments where such a thing doesn’t need to exist
6 years ago
Liz Rice
596dae03d9
Don't assume master if 0 master binaries specified
6 years ago
Liz Rice
9246be924d
Merge branch 'master' into features/autodetect-nodetype
6 years ago
Cyril Tovena
5baf81a70a
Adds master node detection and a root command that automatically detect checks to run.
...
The root command will run node checks and if possible master checks.
I've also added some Makefile targets to improve local testing and improve the documentation.
6 years ago
Abubakr-Sadik Nii Nai Davis
a88b0703d8
Add kubeconfig variable substitution for kubelet and proxy.
...
There are checks for the kubeconfig for both kubelet and proxy which
the current kube-bench implementation does not check for properly.
kube-bench checks the wrong files.
This PR adds support for variable substitution for all the config file
types are that should be checked in the CIS benchmarks.
This PR also fixes a buggy in CIS 1.3.0 check 2.2.9, which checks for
ownership of the kubelet config file /var/lib/kubelet/config.yaml but
recommends changing ownership of kubelet kubeconfig file
/etc/kubernetes/kubelet.conf as remediation.
6 years ago
nshauli
e93bfc1aac
search for the kubelet binary when it is not in the path
6 years ago
Liz Rice
7626dc2705
Merge branch 'master' into bugfix-log-warnings-instead-of-print
6 years ago
Yoav Hizkiahou
082e9cf7e9
Bugfix: Logging warning instead of printing
...
Made all the warnings to be logged and not printed, so when using the json flag the output will be only in json format.
fix #217
6 years ago
Abubakr-Sadik Nii Nai Davis
911e9051dc
Merge remote-tracking branch 'origin/master' into ocp-configs
6 years ago
Abubakr-Sadik Nii Nai Davis
e899e941f7
Add OCP 3.10 benchmarks.
6 years ago
Weston Steimel
42ed8628de
Only get runningVersion if --version has not been provided
...
Signed-off-by: Weston Steimel <weston.steimel@gmail.com>
6 years ago
Yoav Hizkiahou
49f745af8e
Support new check type - skip:
...
If a check is marked with type "skip", it will be marked as Info.
Support scored property:
If a check is not scored and is not marked with type skip, it will be marked as Warn.
6 years ago
Weston Steimel
42f4152058
Only get runningVersion if --version has not been provided
...
Signed-off-by: Weston Steimel <weston.steimel@gmail.com>
6 years ago
Abubakr-Sadik Nii Nai Davis
ed21839464
Add getServiceFiles function.
...
The CIS benchmark check for node checks 2 config files for kubelet:
- kubelet config file (kubelet.conf)
- kubelet systemd unitfile (10-kubeadm.conf)
The getServiceFiles function gets candidates for kubelet systemd
unitfile and returns valid untifiles.
6 years ago
bvwells
cc43fcbb7e
Add link to CIS kubernetes benchmark
6 years ago
Liz Rice
ccc2b6c9ae
Shouldn't need kubelet or kubectl if version specified
6 years ago
Liz Rice
9d0141871a
Use new utility function for finding correct config files.
...
Improve order of message output
Remove unnecessary local variable
6 years ago
Liz Rice
344d2bfd24
Utility for getting the right config file for the Kubernetes version
6 years ago
Liz Rice
ecd14ed682
File substitutions should be a detailed log
6 years ago
Liz Rice
223ac14642
Don't override version specified on command line
6 years ago
Abubakr-Sadik Nii Nai Davis
6d237607fb
Fix typo in help text.
6 years ago
Abubakr-Sadik Nii Nai Davis
5da707b8d6
Remove CIS benchmark version in tool title.
...
it has grown stale and is dependent on k8s version we are checking.
6 years ago
Jeppe Fihl-Pearson
39d94df81b
Add tip about the `--version` flag to error output
...
If people are trying to use the Docker image to check their cluster, there's a
big likelyhood of them hitting the error message saying that either `kubectl`
or `kubelet` need to be found in order for `kube-bench` to be able to determine
the Kubernetes version in use.
This adds a tip that the version can be specified manually with the `--version`
flag which is a lot easier than having to make a new Docker image with the
right version of `kubelet`/`kubectl` in order for `kube-bench` to work.
6 years ago
Liz Rice
0b4872104d
Merge branch 'master' into feature/issue-107
7 years ago
Will Medlar
9469b1c124
Allow kubernetes version and config directory to be specified ( resolves #107 )
7 years ago
Abubakr-Sadik Nii Nai Davis
ade064006e
Add extra output manipulation flags, --noremediations, --nosummary and
...
--noresults.
These flags disable printing sections of the final output of kube-bench.
7 years ago
Liz Rice
728cb0765f
Use 1.8 tests for k8s 1.9 and 1.10
7 years ago
Philippe ALEXANDRE
f091c8adea
Remove the old lines of fmt.Sprintf in cmd/common.go
7 years ago
Philippe ALEXANDRE
d6c16f7563
Try to use kubelet when kubectl is unavailable
7 years ago
Philippe ALEXANDRE
c86d0ff81b
Replace fmt.Sprintf by filepath.Join
7 years ago
Liz Rice
58b6358a02
Merge branch 'master' into u/jaxxstorm/golint
7 years ago
Lee Briggs
94a1f3c41f
Lint all code for golint tests
7 years ago
Abubakr-Sadik Nii Nai Davis
64aaef7997
Fixed expected return for getKubeVersion.
7 years ago
Abubakr-Sadik Nii Nai Davis
53eb720952
Merge branch 'master' into unnecessary-warning
7 years ago
Abubakr-Sadik Nii Nai Davis
04f044e3b9
Add support for merging general and kubernetes version specific config files.
...
This change unifies all config files, podspecs and unitfiles under
a single component configuration key; `config`.
7 years ago
Liz Rice
97485419e2
Can't run kubectl on Travis so I don't know how this test ever worked
7 years ago
Liz Rice
730871f330
Fix kubeVersion regex tests
7 years ago
Abubakr-Sadik Nii Nai Davis
c93c94b3f6
Fix version check regexp.
7 years ago
Abubakr-Sadik Nii Nai Davis
c60c459bc4
Fix bug causing kubectl version to always return default version.
7 years ago
Abubakr-Sadik Nii Nai Davis
42a1068964
Add default version if version check fails.
7 years ago
Abubakr-Sadik Nii Nai Davis
f90dd925b8
Exit kube-bench if we can't get valid kubernetes server version and
...
improve error messages.
7 years ago
Abubakr-Sadik Nii Nai Davis
31b5910a7f
Remove unnecessary warnings about missing config files.
7 years ago