Liz Rice
c4c0d911d4
Merge pull request #237 from aquasecurity/openshift
...
Update openshift executable config
6 years ago
Liz Rice
9b3628e76a
Update openshift executable config for #236
6 years ago
Liz Rice
8745df170a
Merge pull request #233 from aquasecurity/clean-ocp-configs
...
Clean up OCP benchmark config.
6 years ago
Liz Rice
1ead9e1d71
Merge branch 'master' into clean-ocp-configs
6 years ago
Liz Rice
772d2e26b4
Merge pull request #226 from aquasecurity/add-new-cfg-version1.4
...
add new config files from the new CIS Kubernetes Benchmark
6 years ago
Abubakr-Sadik Nii Nai Davis
53ed68a0b2
Clean up OCP benchmark config.
...
The OCP benchmarks uses configs for only binary component variable names.
This commit cleans up the OCP config by removing all configuration
except those component binaries required to run kube-bench on OCP
installations and adds missing ones.
6 years ago
yoavrotems
c6102f0a1b
Fix the files
...
Fix the start from 1.11 to 1.13 and adding changes from pull #227 , and pull #228 .
6 years ago
yoavrotems
e534392525
Delete node.yaml
...
replace with the new node.yaml file
6 years ago
yoavrotems
5f09ecef44
Delete master.yaml
...
replace with the new master.yaml file
6 years ago
yoavrotems
a7d9e06c1b
Delete config.yaml
...
replace with the new config.yaml file
6 years ago
yoavrotems
50f22e7f13
Merge branch 'master' into add-new-cfg-version1.4
6 years ago
Liz Rice
2d4019aabe
Merge pull request #228 from aquasecurity/fix-208
...
Fix issues with checks for kubelet configuration files
6 years ago
Liz Rice
dd8e7ec874
Merge branch 'master' into fix-208
6 years ago
Abubakr-Sadik Nii Nai Davis
d255b49d4b
Revert 1.8 config file.
6 years ago
Liz Rice
0a58805cdb
Merge pull request #227 from aquasecurity/fix-false-detections
...
Only find flags on the process we really want
6 years ago
Liz Rice
c18d8a2234
Merge branch 'master' into fix-false-detections
6 years ago
Abubakr-Sadik Nii Nai Davis
a88b0703d8
Add kubeconfig variable substitution for kubelet and proxy.
...
There are checks for the kubeconfig for both kubelet and proxy which
the current kube-bench implementation does not check for properly.
kube-bench checks the wrong files.
This PR adds support for variable substitution for all the config file
types are that should be checked in the CIS benchmarks.
This PR also fixes a buggy in CIS 1.3.0 check 2.2.9, which checks for
ownership of the kubelet config file /var/lib/kubelet/config.yaml but
recommends changing ownership of kubelet kubeconfig file
/etc/kubernetes/kubelet.conf as remediation.
6 years ago
Abubakr-Sadik Nii Nai Davis
3f98c1def2
Fix wrong reference to kubelet.config in node checks.
...
This fix applies to only checks for kubernetes versions 1.8 and 1.11.
See https://github.com/aquasecurity/kube-bench/pull/208 .
6 years ago
Liz Rice
d712db47a2
Only find flags on the process we really want
6 years ago
yoavrotems
82150fdc63
add new config files from the new CIS Kubernetes Benchmark
...
there is a new update at CIS_Kubernetes_Benchmark_v1.4.0 for Kubernetes 1.13
6 years ago
Liz Rice
c824daeb15
Merge pull request #222 from nshauli/search_for_kubelet_binary_when_not_in_path
...
search for the kubelet binary when it is not in the path
6 years ago
nshauli
e93bfc1aac
search for the kubelet binary when it is not in the path
6 years ago
Liz Rice
da09e6513a
Merge pull request #218 from yoavAqua/bugfix-log-warnings-instead-of-print
...
Bugfix: Logging warning instead of printing
6 years ago
Liz Rice
7626dc2705
Merge branch 'master' into bugfix-log-warnings-instead-of-print
6 years ago
Yoav Hizkiahou
082e9cf7e9
Bugfix: Logging warning instead of printing
...
Made all the warnings to be logged and not printed, so when using the json flag the output will be only in json format.
fix #217
6 years ago
Liz Rice
2d4c7e8b42
Merge pull request #212 from aquasecurity/ocp-configs
...
OCP benchmarks and configs
6 years ago
Liz Rice
cd231106cc
Improve comment
...
Tests could easily be marked "skip" because the user doesn't want to run them in their environment, and in this common case the set of tests will be non-nil
6 years ago
Liz Rice
db962a0ad9
Fix merge of skip check
6 years ago
Abubakr-Sadik Nii Nai Davis
911e9051dc
Merge remote-tracking branch 'origin/master' into ocp-configs
6 years ago
Abubakr-Sadik Nii Nai Davis
e899e941f7
Add OCP 3.10 benchmarks.
6 years ago
Weston Steimel
42ed8628de
Only get runningVersion if --version has not been provided
...
Signed-off-by: Weston Steimel <weston.steimel@gmail.com>
6 years ago
Liz Rice
dc8dcfbf8c
Merge pull request #211 from yoavAqua/support-skip-flag
...
Type skip and not scored checks
6 years ago
Yoav Hizkiahou
49f745af8e
Support new check type - skip:
...
If a check is marked with type "skip", it will be marked as Info.
Support scored property:
If a check is not scored and is not marked with type skip, it will be marked as Warn.
6 years ago
Liz Rice
ba437d500a
Merge pull request #206 from westonsteimel/no_runningversion_if_version_set
...
Only get runningVersion if --version has not been provided
6 years ago
Weston Steimel
42f4152058
Only get runningVersion if --version has not been provided
...
Signed-off-by: Weston Steimel <weston.steimel@gmail.com>
6 years ago
Liz Rice
8dabb7dc37
Merge pull request #201 from aquasecurity/yam-comment
...
Comment why we mount /usr/bin
6 years ago
Liz Rice
f2062e81a1
Comment why /usr/bin is mounted
6 years ago
Liz Rice
528bcfbffe
Update job-node.yaml
6 years ago
Liz Rice
3422b9102f
Add comment for why /usr/bin is mounted
6 years ago
Liz Rice
86b126ad2b
Create NOTICE ( #199 )
...
* Create NOTICE
* Update NOTICE
6 years ago
Liz Rice
827945f7fb
Merge pull request #200 from spuder/patch-1
...
warn osx limitation
6 years ago
Liz Rice
79427e185e
Merge branch 'master' into patch-1
6 years ago
Liz Rice
6b9ceae9d4
True for Windows too
6 years ago
Liz Rice
fbd6eb8ff5
Merge pull request #198 from aquasecurity/mount-volumes
...
For #197 - create job YAML files that mount host volumes as needed
6 years ago
Spencer Owen
2a9a02f25b
warn osx limitation
6 years ago
Liz Rice
8021610e46
For #197 - create job YAML files that mount host volumes as needed
6 years ago
Liz Rice
2eef3e8ad2
Merge pull request #193 from maxbischoff/patch-1
...
Changed 1.1.14 to not fail when flag is not set
6 years ago
Maximilian Bischoff
791fbba9e7
Changed 1.1.14 to not fail when flag is not set
...
Added another test item that checks whether --disable-admission-plugins is not set and an "or" bin_op.
This causes check 1.1.14 to be successful when the flag is not set, while still failing when the flag is set and includes the value NamespaceLifecycle
6 years ago
Liz Rice
f6cab11357
Merge pull request #187 from martinmosegaard/doc-kubectl-host-pid
...
Document limitation of running with kubectl
6 years ago
Liz Rice
9f2899027e
Merge branch 'master' into doc-kubectl-host-pid
6 years ago