588d75d20d
Merge pull request #251 from aquasecurity/version-mapping
...
Add CIS & Kubernetes version mapping to README
6 years ago
4b8a7ffbe1
Add ":" as a valid flag-value separator for tests
...
This is useful for checking values in YAML (possibly JSON) kubernetes config files.
6 years ago
651b72f7d1
Merge branch 'master' into document-output
6 years ago
0c40532e76
Merge branch 'master' into version-mapping
6 years ago
54502c5f75
Merge pull request #247 from aquasecurity/yoavrotems-patch-2
...
Update master.yaml
6 years ago
df556c2f42
Add CIS & Kubernetes version mapping to README
6 years ago
488f5221ef
Document output states
...
Also describe how tests can be omitted by editing the YAML
6 years ago
b1ce0a9a75
Merge branch 'master' into yoavrotems-patch-2
6 years ago
0f86bfc060
Merge pull request #246 from aquasecurity/yoavrotems-patch-1
...
Update master.yaml
6 years ago
d059196b71
Update master.yaml
...
Fix 1.1.23 to check *if* --service-account-lookup argument is set and if so then if it's equal to true
6 years ago
a85e5a7759
Update master.yaml
...
Fix title of 1.4.21 from 644 to 600 according to cis benchmark
6 years ago
abfc38d672
Update documentation after review
6 years ago
4d3144ca21
Support JSON and YAML configuration
...
Support new configuration options besides --flags:
- JSON file through `jsonpath`
- YAML file through `yamlpath`
These new options are fully backwards-compatible with the existing
tests.
Added a new profile, 1.11-json, that expects a JSON kubelet
configuration file and scores accordingly. This profile is compatible
with EKS.
6 years ago
573136a700
Merge pull request #238 from Kuqd/features/autodetect-nodetype
...
Adds master node detection - thanks @Kuqd!
6 years ago
9246be924d
Merge branch 'master' into features/autodetect-nodetype
6 years ago
5baf81a70a
Adds master node detection and a root command that automatically detect checks to run.
...
The root command will run node checks and if possible master checks.
I've also added some Makefile targets to improve local testing and improve the documentation.
6 years ago
c4c0d911d4
Merge pull request #237 from aquasecurity/openshift
...
Update openshift executable config
6 years ago
9b3628e76a
Update openshift executable config for #236
6 years ago
8745df170a
Merge pull request #233 from aquasecurity/clean-ocp-configs
...
Clean up OCP benchmark config.
6 years ago
1ead9e1d71
Merge branch 'master' into clean-ocp-configs
6 years ago
772d2e26b4
Merge pull request #226 from aquasecurity/add-new-cfg-version1.4
...
add new config files from the new CIS Kubernetes Benchmark
6 years ago
53ed68a0b2
Clean up OCP benchmark config.
...
The OCP benchmarks uses configs for only binary component variable names.
This commit cleans up the OCP config by removing all configuration
except those component binaries required to run kube-bench on OCP
installations and adds missing ones.
6 years ago
c6102f0a1b
Fix the files
...
Fix the start from 1.11 to 1.13 and adding changes from pull #227 , and pull #228 .
6 years ago
e534392525
Delete node.yaml
...
replace with the new node.yaml file
6 years ago
5f09ecef44
Delete master.yaml
...
replace with the new master.yaml file
6 years ago
a7d9e06c1b
Delete config.yaml
...
replace with the new config.yaml file
6 years ago
50f22e7f13
Merge branch 'master' into add-new-cfg-version1.4
6 years ago
2d4019aabe
Merge pull request #228 from aquasecurity/fix-208
...
Fix issues with checks for kubelet configuration files
6 years ago
dd8e7ec874
Merge branch 'master' into fix-208
6 years ago
d255b49d4b
Revert 1.8 config file.
6 years ago
0a58805cdb
Merge pull request #227 from aquasecurity/fix-false-detections
...
Only find flags on the process we really want
6 years ago
c18d8a2234
Merge branch 'master' into fix-false-detections
6 years ago
a88b0703d8
Add kubeconfig variable substitution for kubelet and proxy.
...
There are checks for the kubeconfig for both kubelet and proxy which
the current kube-bench implementation does not check for properly.
kube-bench checks the wrong files.
This PR adds support for variable substitution for all the config file
types are that should be checked in the CIS benchmarks.
This PR also fixes a buggy in CIS 1.3.0 check 2.2.9, which checks for
ownership of the kubelet config file /var/lib/kubelet/config.yaml but
recommends changing ownership of kubelet kubeconfig file
/etc/kubernetes/kubelet.conf as remediation.
6 years ago
3f98c1def2
Fix wrong reference to kubelet.config in node checks.
...
This fix applies to only checks for kubernetes versions 1.8 and 1.11.
See https://github.com/aquasecurity/kube-bench/pull/208 .
6 years ago
d712db47a2
Only find flags on the process we really want
6 years ago
82150fdc63
add new config files from the new CIS Kubernetes Benchmark
...
there is a new update at CIS_Kubernetes_Benchmark_v1.4.0 for Kubernetes 1.13
6 years ago
c824daeb15
Merge pull request #222 from nshauli/search_for_kubelet_binary_when_not_in_path
...
search for the kubelet binary when it is not in the path
6 years ago
e93bfc1aac
search for the kubelet binary when it is not in the path
6 years ago
da09e6513a
Merge pull request #218 from yoavAqua/bugfix-log-warnings-instead-of-print
...
Bugfix: Logging warning instead of printing
6 years ago
7626dc2705
Merge branch 'master' into bugfix-log-warnings-instead-of-print
6 years ago
082e9cf7e9
Bugfix: Logging warning instead of printing
...
Made all the warnings to be logged and not printed, so when using the json flag the output will be only in json format.
fix #217
6 years ago
2d4c7e8b42
Merge pull request #212 from aquasecurity/ocp-configs
...
OCP benchmarks and configs
6 years ago
cd231106cc
Improve comment
...
Tests could easily be marked "skip" because the user doesn't want to run them in their environment, and in this common case the set of tests will be non-nil
6 years ago
db962a0ad9
Fix merge of skip check
6 years ago
911e9051dc
Merge remote-tracking branch 'origin/master' into ocp-configs
6 years ago
e899e941f7
Add OCP 3.10 benchmarks.
6 years ago
42ed8628de
Only get runningVersion if --version has not been provided
...
Signed-off-by: Weston Steimel <weston.steimel@gmail.com>
6 years ago
dc8dcfbf8c
Merge pull request #211 from yoavAqua/support-skip-flag
...
Type skip and not scored checks
6 years ago
49f745af8e
Support new check type - skip:
...
If a check is marked with type "skip", it will be marked as Info.
Support scored property:
If a check is not scored and is not marked with type skip, it will be marked as Warn.
6 years ago
ba437d500a
Merge pull request #206 from westonsteimel/no_runningversion_if_version_set
...
Only get runningVersion if --version has not been provided
6 years ago
Liz Rice