456d9b62e2
Default log output to stderr ( #696 )
4 years ago
772839fc92
move target mapping to config.yaml - updated version ( #682 )
...
* move target mapping to config.yaml
* Update config.yaml
* Update common.go
* Add support for eks-1.0
Add also eks-1.0 to map
* chore: merge correction
* Move file only used for testing
* Tidier logs
* Add target mapping for GKE and EKS
* fingers cross this finishes target mapping
Co-authored-by: Murali Paluru <leodotcloud@gmail.com>
Co-authored-by: Roberto Rojas <robertojrojas@gmail.com>
Co-authored-by: yoavrotems <yoavrotems97@gmail.com>
4 years ago
a6161aa868
Warn if kubectl can't autodetect the version ( #656 )
...
* Add warning if lacking kubeconfig for auto-detect
* Only run getbenchmarkVersion once
* Remove call to continueWithError
4 years ago
b0d175bf5c
Update default Kubernetes to 1.18 ( #657 )
...
* Update default Kubernetes to 1.18
* Add missing mapping
* Show pod logs on failure
4 years ago
52ebfa5b5a
Fix invalid JSON output ( #629 )
...
* Fix invalid JSON output
Fixes #622
* Apply suggestions from code review
Co-authored-by: Liz Rice <liz@lizrice.com>
* Add tests
Co-authored-by: Liz Rice <liz@lizrice.com>
4 years ago
d988b81540
CIS GKE 1.0.0 benchmark ( #570 )
...
* Add initial commit for CIS GKE 1.0 benchmark
* Update README with GKE instructions
* Fix YAML linter issues
* Set GKE benchmark k8s version to gke-1.0
* Add tests for gke-1.0
Co-authored-by: Roberto Rojas <robertojrojas@gmail.com>
4 years ago
b677c86868
remove always true for logtostderr ( #548 )
...
* remove always true for logtostderr
* update README for log collection instructions
Co-authored-by: Liz Rice <liz@lizrice.com>
4 years ago
13193d75b0
Fixes Issue #535 ( #537 )
...
* isEtcd should not run on openshift 3.10/3.11
* adds openssl
* fixed tests
* fixes bugs
* adds isEtcd tests
4 years ago
62af68f3f5
fixes issue #536 ( #540 )
4 years ago
af976e6f50
Fixes Issue #494 - add tests for CIS 1.5 ( #530 )
...
* Initial commit.
* Add master and node config.
* Add section 5 of CIS 1.5.1.
* Split sections into section files
* Fix YAML issues.
* adds target translation
* adds target translation
* adds cis-1.5 mapping
* fixed tests
* fixes are per PR
* fixed intergration test
* integration kind test file to appropriate ks8 version
* fixed etcd text
* fixed README
* fixed text
* etcd: fixed grep path
* etcd: fixes
* fixed error message bug
* Update README.md
Co-Authored-By: Liz Rice <liz@lizrice.com>
* Update README.md
Co-Authored-By: Liz Rice <liz@lizrice.com>
* fixes as per PR review
5 years ago
f2caa1f0ec
Add run subcommand ( #529 )
...
* test: fix TestGetConfigFilePath
This test wasn't correctly creating the test file due to the wrong directory permissions on the temp file. This wasn't detected due to a lack of error checking.
Also, the code was only checking for file not exist rather than lack of permission to read file (or any other error).
The combination of these two things means the test wasn't checking what it thought it was checking, and passed more by luck than judgment.
* add getYamlFilesFromDir
* add getTestYamlFiles and test
* docs: Update master / node help text
* return path + filename from getYamlFilesFromDir
* subcommand run to run specific section files
5 years ago
6ffd382711
Add option to output in JUnit format ( #516 )
...
If running these checks in a CI system it may be beneficial
to output in a more standardized format such as JUnit for
parsing by other tools in a consistent manner.
Fixes #460
Signed-off-by: John Schnake <jschnake@vmware.com>
5 years ago
7ca438b618
Fixes Issue 269 - Numbering to use CIS Versions ( #511 )
...
* starting benchmark flag
* Revert "starting benchmark flag"
This reverts commit 58fc948626#269
* add more unit tests
* fix bug
* Update cmd/common.go
Co-Authored-By: Liz Rice <liz@lizrice.com>
* fixes as per PR review
* fixes as per PR review
* adds more tests
* fixed tests
* changes as per PR Review
* changes as per PR Review
* updated README
* Update README.md
Co-Authored-By: Liz Rice <liz@lizrice.com>
* Update README.md
Co-Authored-By: Liz Rice <liz@lizrice.com>
* Update README.md
Co-Authored-By: Liz Rice <liz@lizrice.com>
* Update README.md
Co-Authored-By: Liz Rice <liz@lizrice.com>
* changes are per PR review
5 years ago
a6ee61fd08
Fixes issue #289 : removed versions prior to 1.11 ( #429 )
...
* removed version prior to 1.11
* removed references to kubernetes versions prior to 1.11
5 years ago
c22f81610d
removes federated ( #431 )
5 years ago
92df9cb36c
Read kubernetes version from environment ( #390 )
...
* Read kubernetes version from environment
Set kubernetes version to the value of the environment variable `KUBE_BENCH_VERSION` if it is defined and the flag `--version` is not specified on the kube-bench command line.
The command line flag `--version` takes precedence of the environment variable `KUBE_BENCH_VERSION` if both are defined.
* Add info about KUBE_BENCH_VERSION to README
5 years ago
3fba5f4dac
Fix version command failing because of missing config file it does not need. ( #377 )
...
* Fix version command failing because of missing config file it does
not need.
* Fix typo
* Remove reference to github issue in comment
5 years ago
e6e6333e6d
add glog flush to write the output to a file ( #329 )
...
* add glog flush to write the output to a file
* add glog flush before exit on error and fix code comment
5 years ago
e64f61fa7f
Add --outputfile flag for writing json results to output file ( #295 )
5 years ago
3aa28c4c32
Printing the actual test result of failed tests - when a flag is raised
...
fix #110
5 years ago
5fb133cd02
Adjust the semantics of scored and unscored flags
5 years ago
306e1960af
Add flags to further filter CIS checks to run
5 years ago
5baf81a70a
Adds master node detection and a root command that automatically detect checks to run.
...
The root command will run node checks and if possible master checks.
I've also added some Makefile targets to improve local testing and improve the documentation.
5 years ago
cc43fcbb7e
Add link to CIS kubernetes benchmark
6 years ago
6d237607fb
Fix typo in help text.
6 years ago
5da707b8d6
Remove CIS benchmark version in tool title.
...
it has grown stale and is dependent on k8s version we are checking.
6 years ago
0b4872104d
Merge branch 'master' into feature/issue-107
6 years ago
9469b1c124
Allow kubernetes version and config directory to be specified ( resolves #107 )
6 years ago
ade064006e
Add extra output manipulation flags, --noremediations, --nosummary and
...
--noresults.
These flags disable printing sections of the final output of kube-bench.
6 years ago
94a1f3c41f
Lint all code for golint tests
6 years ago
42a1068964
Add default version if version check fails.
7 years ago
d79a2a5478
added support for saving scan results to pgsql
7 years ago
c4be4a1240
Remove installation flag and some other unused variables
7 years ago
f88de572f6
Improve error handling.
7 years ago
3d395994b0
Change environment variable prefix.
7 years ago
609c4ff01c
Move kubernetes binaries and config paths to kube-bench config.
7 years ago
2ee99eca64
Add support for various installation modes, hyperkube, kubeadm and kops.
...
Issue #17 .
7 years ago
bd53529387
Fix issue #16 about supporting verbosity.
7 years ago
d0d9900b29
Resolve issue #7 wait: error running audit command exit status 1.
...
This is caused by a command in the audit pipeline (for example
ps -ef | grep kube-apiserver) failing. The causes of this failure
in my testing is usually a missing config file.
Extensive refactor and correction in verification code to check for
config files and binaries.
Replace joncalhoun/pipes with implementation using exec.Cmds so errors
are visible and can be handled when audit pipeline commands fail.
Change some audit commands
from: ps -ef | grep <cmd> | grep -v
to: ps -C <something> -o comm,args --no-headers
which is simpler to work with.
7 years ago
07750ea43a
Don't output message about config file if output format is JSON
7 years ago
f6509b804e
Typo
7 years ago
0d6d3a03ef
Allow config file to be specified on the command line
7 years ago
96364e3f29
Error if the config file can’t be found
7 years ago
432651e85f
Added test 1.4.11 ( #8 )
7 years ago
c3d67e0fee
Use colorPrint for config file info too
7 years ago
dcd416a521
Executable name changes
...
Updates to travis file, readme and help text
7 years ago
55fd838191
No need to run install.sh.
...
Simply clone the project, compile the go app and run ./cis_kubernetes
7 years ago
26cc77ec1d
Get the tests working on deployments where file names may be different or not in path ( #1 )
...
* Replace the default help text
* Readme file, including the test config format documentation
* Typo
* Warn if config files / executables aren't found
* Ignore original name of executable (as per current README)
* Update tests to avoid failing on stat of a non-existant file
* Add a makefile for ease of build
7 years ago
154a140f74
Initial commit
7 years ago
Huang Huang