arno/kube-bench
1
0
Fork 0
mirror of https://github.com/aquasecurity/kube-bench.git synced 2024-12-22 22:58:07 +00:00
Code Issues Releases Wiki Activity
974 Commits 6 Branches 84 Tags 158 MiB
c17b4dd2ba
Commit Graph

974 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Huang Huang
2d548597ae
Support CIS v1.5.1 (#673) 2020-08-12 21:57:51 +03:00
Liz Rice
07f3c40dc7
Better handling of parameters and config audits (#674) 
* read-only-port defaults are correct

* Tests that should catch good read-only-port

* Rework checks & tests

* Linting on issue template YAML

* More explicit test for 4.2.4
 2020-08-12 14:32:42 +01:00
Huang Huang
5d138f6388
Fix YAML Linting issue (#672) 2020-08-12 09:14:45 +01:00
yoavrotems
10f4e6c691
Refactor testitem-set (#668) 
* set: default true

Refactor testitem-set to be default true

* fix typo

Co-authored-by: Liz Rice <liz@lizrice.com>

Co-authored-by: Liz Rice <liz@lizrice.com>
 2020-08-10 17:12:41 +03:00
Liz Rice
68c8764ea8
Create bug_report.md 2020-08-10 15:09:03 +01:00
Liz Rice
56770b14c6
Ideas and questions go to Discussions 2020-08-10 15:05:47 +01:00
yoavrotems
4b9453bb83
Refactor: remove ContinueWithError (#630) 
* Update util.go

Remove Continue with error function

* Update cmd/util.go

Co-authored-by: Liz Rice <liz@lizrice.com>

* Update util.go

* Update util.go

Remove unnecessary ')'

* Update util.go

removed fmt.Fprintf(os.Stderr, "%s: %s", cmd.Args, err) since it wasn't suppose to print.

* Update util.go

* Update .travis.yml

option --no-ri and --no-doc are deprecated we have to use --no-document instead.
https://github.com/rubygems/heroku-buildpack-bundler2/pull/1#issuecomment-451654992

Co-authored-by: Liz Rice <liz@lizrice.com>
 2020-08-10 10:12:57 +01:00
Huang Huang
6684979741
Add tests for 1.1.19、1.1.20 and 1.1.21 of cis-1.5 (#641) 
* Add tests for 1.1.19、1.1.20 and 1.1.21 of cis-1.5

* Avoid division by 0

* Use bitmask instead of lte

* Change to use multiple values via `use_multiple_values: true`

* Use find in 1.1.20 and 1.1.21
 2020-08-09 23:44:42 +03:00
Liz Rice
a6161aa868
Warn if kubectl can't autodetect the version (#656) 
* Add warning if lacking kubeconfig for auto-detect

* Only run getbenchmarkVersion once

* Remove call to continueWithError
 2020-08-04 18:04:02 +03:00
Liz Rice
b0d175bf5c
Update default Kubernetes to 1.18 (#657) 
* Update default Kubernetes to 1.18

* Add missing mapping

* Show pod logs on failure
 2020-08-04 16:40:12 +03:00
Liz Rice
e69b2fe549
Add mappings for eks-1.0 and Kubernetes 1.18 (#654) 
Allows user to specify either `--version` or `--benchmark-version` as `eks-1.0`
Allows user to specify (or auto-detect K8s version 1.18) and get the CIS 1.5 benchmark
 2020-08-03 22:38:37 +03:00
Huang Huang
5ff32e55eb
Check PodSecurityPolicy when test 1.2.13 of cis-1.5 (#651) 2020-08-03 10:38:22 +03:00
Huang Huang
db109daf43
Support multiple values flag when check the audit output (#652) 2020-08-03 10:31:54 +03:00
Matthieu ANTOINE
ea4eaa6fd5
Fix supported targets for EKS benchmark (#648) 
* Fix supported targets for EKS benchmark

* docs: heading at wrong level in README

* docs: remove duplicate TOC heading

* Fix invalid argument for gem install

Co-authored-by: Liz Rice <liz@lizrice.com>
 2020-07-29 14:40:59 +01:00
Kevin W Monroe
2a325bd60d
make the kubelet cafile test posix compliant (#643) 2020-07-21 17:43:39 +03:00
Huang Huang
66692951c8
4.1.7 of cis-1.5 should not be marked as manual (#640) 
* 4.1.7 of cis-1.5 should not be marked as manual

* Making the test posix compliant like #643
 2020-07-21 17:32:13 +03:00
Manuel Rüger
50a9dca720
Dockerfile: Update to alpine-3.12 (#645) 
https://alpinelinux.org/posts/Alpine-3.12.0-released.html
 2020-07-21 12:09:41 +03:00
Liz Rice
4e00954485
docs: add Troubleshooting (#638) 
* docs: add Troubleshooting

Adding basic instructions for running with debug logs

* docs: remember --logtostderr

* docs: note about cfg requirement

Note that installing a binary release is not sufficient - you also need the config and test files
Fixes #613
 2020-07-15 14:41:35 +01:00
Paavan
20ec5d14f2
added eks-1.0 cfg and modified job-eks.yaml for node checks (#639) 
* added eks-1.0 cfg and modified job-eks.yaml for node checks

* fixed yamllint errors and README updates
 2020-07-10 16:14:41 +01:00
Huang Huang
3e6a41af04
Try to search the right ca file of kubelet (#633) 2020-07-08 10:22:49 +03:00
yoavrotems
1b5b6c2afe
Remove os.exit When not needed (#631) 
* Update test.go

* Update test_test.go
 2020-06-28 17:29:55 +03:00
Huang Huang
52ebfa5b5a
Fix invalid JSON output (#629) 
* Fix invalid JSON output

Fixes #622

* Apply suggestions from code review

Co-authored-by: Liz Rice <liz@lizrice.com>

* Add tests

Co-authored-by: Liz Rice <liz@lizrice.com>
 2020-06-24 10:13:10 +01:00
Manuel Rüger
5cf3821eb6
.goreleaser: Create binaries for arm/arm64 (#628) 
Signed-off-by: Manuel Rüger <manuel@rueg.eu>
 2020-06-23 10:02:31 -07:00
Huang Huang
c7b518e76b
Run audit as shell script instead of as single line command (#610) 
* Run audit as shell script instead of as single line command

* Rename runExecCommands to runAudit

* Fix tests

Co-authored-by: Liz Rice <liz@lizrice.com>
 2020-06-22 10:45:31 +03:00
Andrew Horton
122bc4b351
Fix misspelling - identied / identified (#626) 2020-06-17 15:08:20 +01:00
Huang Huang
35cf28c140
Add integration tests for cis 1.3 and cis 1.5 (#609) 
* Remove unnecessary whitespaces

* Fix a typo

* Add integration tests for cis 1.3 and cis 1.5

* Change the timeout of integration tests from 600s to 1200s

* Avoid repeated codes
 2020-05-20 18:30:52 +01:00
Neha Viswanathan
2cf2876a10
Update Running in an EKS cluster documentation (#621) 
Co-authored-by: Neha Viswanathan <nviswanathan@axway.com>
Co-authored-by: Liz Rice <liz@lizrice.com>
 2020-05-15 09:53:24 +01:00
Craig Jellick
305283f9d4
Fix OpenShift table layout (#612) 
Co-authored-by: Liz Rice <liz@lizrice.com>
 2020-05-14 18:04:14 +01:00
Huang Huang
4557ca00f1
Fix a typo in 1.1.11 of cis-1.5 (#605) 
Co-authored-by: Liz Rice <liz@lizrice.com>
 2020-05-14 17:44:43 +01:00
Paul McCarthy
582ce02ce6
Removed references to dep from README.md (#607) 
Looks like this project now uses Go modules so `dep` steps are not needed.

Co-authored-by: Liz Rice <liz@lizrice.com>
 2020-05-14 17:34:47 +01:00
Gábor Lipták
82614d9b3f
Correct typo (#616) 
Co-authored-by: Liz Rice <liz@lizrice.com>
 2020-05-14 17:25:47 +01:00
Liz Rice
d8234ff07c
docs: update params for logging to screen (#618) 
We're now following the normal behaviour of glog, which means specifying --logtostderr to get the output written to screen. See https://godoc.org/github.com/golang/glog
 2020-05-11 10:18:30 +01:00
Liz Rice
7e87c980b2
docs: CIS benchmarks are not frequent (#617) 
Correct misleading comment about anticipated CIS benchmarks for every Kubernetes release - bad assumption!
 2020-05-06 14:42:40 +01:00
Liz Rice
7cd6b32ebb
docs: notes in README for common misunderstandings (#602) 
Added a Please Note section to document common misunderstandings that often lead to incorrect issue filings
 2020-04-07 14:04:42 +01:00
Daniel Sutton
71bc8f544c
bumped to gloang 1.14.0 (#594) 
Signed-off-by: Daniel Sutton <daniel@ducksecops.uk>

Co-authored-by: Liz Rice <liz@lizrice.com>
 2020-03-16 13:18:27 +00:00
Mathis Kretz
9efd942bcc
Add config paths for microk8s (#556) 
* Add config paths for microk8s

* Fix order for kube-proxy conf path and fix yaml linting issue

Co-authored-by: Mathis Kretz <mathis@bespinian.io>
Co-authored-by: Liz Rice <liz@lizrice.com>
 2020-03-16 12:37:32 +00:00
yoavrotems
60f2fb592a
Add option to do bitmask (#565) 
* Add option to do bitwise and between two value in order to compare permissions

* Update test.go

Removed self debug note

* Update test_test.go

FIx typo

* Update test.go

* Update test.go

Switched between max and requested value, because accidentally assigned them oppositely  and remove old function relate to octal base

* Update test_test.go

* Update test_test.go
 2020-03-16 12:25:46 +00:00
Liz Rice
451721a1cf
Add GKE into list of support tests (#597) 
Also adds links to the Kubernetes benchmarks

Fixes #596
 2020-03-11 17:48:07 +02:00
Roberto Rojas
b403b364fe
Get Kubernetes Version: Adds Retry Logic (#593) 
* Closes #551

* Closes #551

* Update cmd/kubernetes_version.go

Co-Authored-By: Liz Rice <liz@lizrice.com>

* Closes #551

Co-authored-by: Liz Rice <liz@lizrice.com>
 2020-03-05 10:34:44 -05:00
Liz Rice
06303f6a7a
Add warn reason (#547) 
* Update check.go

Added new warn_reason value which gives a brief explanation about why the not scored tests failed

* Update common.go

Changed when a not scored test fails because it has a wrong syntax audit command or just running something that can't be run the print the failure. but if the test just fails because it doesn't line up with the cis hardening recommendations then print the remediation text.

* Update check/check.go

fix typo

Co-Authored-By: Liz Rice <liz@lizrice.com>

* Update check.go

* Update common.go

* Update check.go

added back os.Exit(1) to  exitWithError

* Update job-master.data

Change some tests output to fit warn reason. (No change to the summary)

* Update job-node.data

Changed some tests output to fit warn reason. (No change to the summary)

* Update job.data

Change some tests output to fit warn reason. (No change to the summary)

* Update common.go

Keep to old way to print manual test output

Co-authored-by: Liz Rice <liz@lizrice.com>
Co-authored-by: Roberto Rojas <robertojrojas@gmail.com>
 2020-03-05 12:20:26 +00:00
Huang Huang
70988356c8
Support config files which use .yml file extension (#586) 
Co-authored-by: Roberto Rojas <robertojrojas@gmail.com>
 2020-03-03 12:03:21 -05:00
Huang Huang
0b07f40c9b
Support parse boolean flag with no value (#579) 
* Support parse boolean flag with no value

* Add test for parse boolean flag with false value

Co-authored-by: Roberto Rojas <robertojrojas@gmail.com>
 2020-03-03 11:54:38 -05:00
Abubakr-Sadik Nii Nai Davis
d988b81540
CIS GKE 1.0.0 benchmark (#570) 
* Add initial commit for CIS GKE 1.0 benchmark

* Update README with GKE instructions

* Fix YAML linter issues

* Set GKE benchmark k8s version to gke-1.0

* Add tests for gke-1.0

Co-authored-by: Roberto Rojas <robertojrojas@gmail.com>
 2020-03-03 09:51:48 -05:00
Thorsten Schifferdecker
237f8cf818
fix small typo (#592) 
proykubeconfig -> proxykubeconfig
 2020-03-02 16:35:01 +00:00
Huang Huang
65fb352e0e
Change to checking --disable-admission-plugins for cis-1.4-1.1.27 and cis-1.5-1.2.14 (#584) 
Fixes #582
 2020-02-18 09:37:50 -05:00
Huang Huang
17cd104788
Fixes issue #574: change the PATH in container (#577) 
* Fixes issue #574: change the PATH in container

And change to use `/usr/local/mount-from-host/bin` as mount path.
Fixes #574

* Fix integration tests
 2020-02-12 12:18:44 -05:00
Nick Smith
77f66511e7 Set all host-mounted volumes to be read-only. (#569) 
By setting all host-mounted volumes to be read-only we reduce the likelihood
any host filesystem is modified by running kube-bench.
 2020-01-28 10:45:31 -05:00
LukasAuerbeck
037bb14729 added 444, 440, 400 and 000 file permission checks for all benchmarks (#563) 
Co-authored-by: Liz Rice <liz@lizrice.com>
 2020-01-22 14:40:01 +00:00
mustafa-rean
89f8e454ba Resolved bug in master.yml for cis-1.5 for the apiserverbin variable name (#567) 
Co-authored-by: Liz Rice <liz@lizrice.com>
 2020-01-22 14:00:23 +00:00
Roberto Rojas
813dc6ef47
Integration Tests: Adds generateDiff Function (#561) 
* Adds Diff function: Fixes #559

* changes as per PR review
 2020-01-21 10:36:04 -05:00