mirror of
https://github.com/aquasecurity/kube-bench.git
synced 2024-12-24 07:28:06 +00:00
5e6cdfdb0e
If kube-controller-manager is getting detected by older versions of
procps, it will only be detected if we're looking for kube-controller
(15 chars)
NOTE: "The command name is not the same as the command line. Previous versions of
procps and the kernel truncated this command name to 15
characters. This limitation is no longer present in both. If
you depended on matching only 15 characters, you may no longer
get a match."
122 lines
3.2 KiB
YAML
122 lines
3.2 KiB
YAML
---
|
|
## Controls Files.
|
|
# These are YAML files that hold all the details for running checks.
|
|
#
|
|
## Uncomment to use different control file paths.
|
|
# masterControls: ./cfg/master.yaml
|
|
# nodeControls: ./cfg/node.yaml
|
|
# federatedControls: ./cfg/federated.yaml
|
|
|
|
master:
|
|
components:
|
|
- apiserver
|
|
- scheduler
|
|
- controllermanager
|
|
- etcd
|
|
- flanneld
|
|
# kubernetes is a component to cover the config file /etc/kubernetes/config that is referred to in the benchmark
|
|
- kubernetes
|
|
|
|
kubernetes:
|
|
defaultconf: /etc/kubernetes/config
|
|
|
|
apiserver:
|
|
bins:
|
|
- "kube-apiserver"
|
|
- "hyperkube apiserver"
|
|
- "hyperkube kube-apiserver"
|
|
- "apiserver"
|
|
confs:
|
|
- /etc/kubernetes/manifests/kube-apiserver.yaml
|
|
- /etc/kubernetes/manifests/kube-apiserver.manifest
|
|
defaultconf: /etc/kubernetes/manifests/kube-apiserver.yaml
|
|
|
|
scheduler:
|
|
bins:
|
|
- "kube-scheduler"
|
|
- "hyperkube scheduler"
|
|
- "hyperkube kube-scheduler"
|
|
- "scheduler"
|
|
confs:
|
|
- /etc/kubernetes/manifests/kube-scheduler.yaml
|
|
- /etc/kubernetes/manifests/kube-scheduler.manifest
|
|
defaultconf: /etc/kubernetes/manifests/kube-scheduler.yaml
|
|
|
|
controllermanager:
|
|
bins:
|
|
- "kube-controller-manager"
|
|
- "kube-controller"
|
|
- "hyperkube controller-manager"
|
|
- "hyperkube kube-controller-manager"
|
|
- "controller-manager"
|
|
confs:
|
|
- /etc/kubernetes/manifests/kube-controller-manager.yaml
|
|
- /etc/kubernetes/manifests/kube-controller-manager.manifest
|
|
defaultconf: /etc/kubernetes/manifests/kube-controller-manager.yaml
|
|
|
|
etcd:
|
|
optional: true
|
|
bins:
|
|
- "etcd"
|
|
confs:
|
|
- /etc/kubernetes/manifests/etcd.yaml
|
|
- /etc/kubernetes/manifests/etcd.manifest
|
|
- /etc/etcd/etcd.conf
|
|
defaultconf: /etc/kubernetes/manifests/etcd.yaml
|
|
|
|
flanneld:
|
|
optional: true
|
|
bins:
|
|
- flanneld
|
|
defaultconf: /etc/sysconfig/flanneld
|
|
|
|
node:
|
|
components:
|
|
- kubelet
|
|
- proxy
|
|
# kubernetes is a component to cover the config file /etc/kubernetes/config that is referred to in the benchmark
|
|
- kubernetes
|
|
|
|
kubernetes:
|
|
defaultconf: /etc/kubernetes/config
|
|
|
|
kubelet:
|
|
bins:
|
|
- "hyperkube kubelet"
|
|
- "kubelet"
|
|
confs:
|
|
- "/var/lib/kubelet/config.yaml"
|
|
- "/etc/kubernetes/kubelet/kubelet-config.json"
|
|
- "/home/kubernetes/kubelet-config.yaml"
|
|
defaultconf: "/var/lib/kubelet/config.yaml"
|
|
defaultsvc: "/etc/systemd/system/kubelet.service.d/10-kubeadm.conf"
|
|
defaultkubeconfig: "/etc/kubernetes/kubelet.conf"
|
|
|
|
proxy:
|
|
bins:
|
|
- "kube-proxy"
|
|
- "hyperkube proxy"
|
|
- "proxy"
|
|
confs:
|
|
- /etc/kubernetes/proxy
|
|
- /etc/kubernetes/addons/kube-proxy-daemonset.yaml
|
|
defaultconf: /etc/kubernetes/addons/kube-proxy-daemonset.yaml
|
|
defaultkubeconfig: "/etc/kubernetes/proxy.conf"
|
|
|
|
federated:
|
|
components:
|
|
- fedapiserver
|
|
- fedcontrollermanager
|
|
|
|
fedapiserver:
|
|
bins:
|
|
- "hyperkube federation-apiserver"
|
|
- "kube-federation-apiserver"
|
|
- "federation-apiserver"
|
|
|
|
fedcontrollermanager:
|
|
bins:
|
|
- "hyperkube federation-controller-manager"
|
|
- "kube-federation-controller-manager"
|
|
- "federation-controller-manager"
|