Skip to content

Commit af976e6

Browse files
robertojrojasrobertojrojas
authored
Fixes Issue aquasecurity#494 - add tests for CIS 1.5 (aquasecurity#530)
* Initial commit. * Add master and node config. * Add section 5 of CIS 1.5.1. * Split sections into section files * Fix YAML issues. * adds target translation * adds target translation * adds cis-1.5 mapping * fixed tests * fixes are per PR * fixed intergration test * integration kind test file to appropriate ks8 version * fixed etcd text * fixed README * fixed text * etcd: fixed grep path * etcd: fixes * fixed error message bug * Update README.md Co-Authored-By: Liz Rice <liz@lizrice.com> * Update README.md Co-Authored-By: Liz Rice <liz@lizrice.com> * fixes as per PR review
1 parent 7015f4b commit af976e6

File tree

17 files changed

+2300
-45
lines changed

17 files changed

+2300
-45
lines changed

‎README.md

Lines changed: 22 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -42,12 +42,13 @@ Table of Contents
4242

4343
## CIS Kubernetes Benchmark support
4444

45-
kube-bench supports the tests for Kubernetes as defined in the CIS Benchmarks 1.3.0 to 1.4.1 respectively.
45+
kube-bench supports the tests for Kubernetes as defined in the CIS Benchmarks 1.3.0 to 1.5.0 respectively.
4646

4747
| CIS Kubernetes Benchmark | kube-bench config | Kubernetes versions |
4848
|---|---|---|
4949
| 1.3.0| cis-1.3 | 1.11-1.12 |
50-
| 1.4.1| cis-1.4 | 1.13- |
50+
| 1.4.1| cis-1.4 | 1.13-1.14 |
51+
| 1.5.0 | cis-1.5 | 1.15- |
5152

5253

5354
By default, kube-bench will determine the test set to run based on the Kubernetes version running on the machine.
@@ -97,6 +98,25 @@ Alternatively, you can specify `--benchmark` to run a specific CIS Benchmark ver
9798
kube-bench node --benchmark cis-1.4
9899
```
99100

101+
If you want to target specific CIS Benchmark `target` (i.e master, node, etcd, etc...)
102+
you can use the `run --targets` subcommand.
103+
```
104+
kube-bench --benchmark cis-1.4 run --targets master,node
105+
```
106+
or
107+
```
108+
kube-bench --benchmark cis-1.5 run --targets master,node,etcd,policies
109+
```
110+
111+
The following table shows the valid targets based on the CIS Benchmark version.
112+
| CIS Benchmark | Targets |
113+
|---|---|
114+
| cis-1.3| master, node |
115+
| cis-1.4| master, node |
116+
| cis-1.5| master, controlplane, node, etcd, policies |
117+
118+
If no targets are specified, `kube-bench` will determine the appropriate targets based on the CIS Benchmark version.
119+
100120
`controls` for the various versions of CIS Benchmark can be found in directories
101121
with same name as the CIS Benchmark versions under `cfg/`, for example `cfg/cis-1.4`.
102122

‎cfg/cis-1.5/config.yaml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
---
2+
## Version-specific settings that override the values in cfg/config.yaml

‎cfg/cis-1.5/controlplane.yaml

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
---
2+
controls:
3+
version: 1.5
4+
id: 3
5+
text: "Control Plane Configuration"
6+
type: "controlplane"
7+
groups:
8+
- id: 3.1
9+
text: "Authentication and Authorization"
10+
checks:
11+
- id: 3.1.1
12+
text: "Client certificate authentication should not be used for users (Not Scored) "
13+
type: "manual"
14+
remediation: |
15+
Alternative mechanisms provided by Kubernetes such as the use of OIDC should be
16+
implemented in place of client certificates.
17+
scored: false
18+
19+
- id: 3.2
20+
text: "Logging"
21+
checks:
22+
- id: 3.2.1
23+
text: "Ensure that a minimal audit policy is created (Scored) "
24+
type: "manual"
25+
remediation: |
26+
Create an audit policy file for your cluster.
27+
scored: true
28+
29+
- id: 3.2.2
30+
text: "Ensure that the audit policy covers key security concerns (Not Scored) "
31+
type: "manual"
32+
remediation: |
33+
Consider modification of the audit policy in use on the cluster to include these items, at a
34+
minimum.
35+
scored: false

‎cfg/cis-1.5/etcd.yaml

Lines changed: 131 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,131 @@
1+
---
2+
controls:
3+
version: 1.15
4+
id: 2
5+
text: "Etcd Node Configuration"
6+
type: "etcd"
7+
groups:
8+
- id: 2
9+
text: "Etcd Node Configuration Files"
10+
checks:
11+
- id: 2.1
12+
text: "Ensure that the --cert-file and --key-file arguments are set as appropriate (Scored)"
13+
audit: "/bin/ps -ef | /bin/grep $etcdbin | /bin/grep -v grep"
14+
tests:
15+
bin_op: and
16+
test_items:
17+
- flag: "--cert-file"
18+
set: true
19+
- flag: "--key-file"
20+
set: true
21+
remediation: |
22+
Follow the etcd service documentation and configure TLS encryption.
23+
Then, edit the etcd pod specification file /etc/kubernetes/manifests/etcd.yaml
24+
on the master node and set the below parameters.
25+
--cert-file=</path/to/ca-file>
26+
--key-file=</path/to/key-file>
27+
scored: true
28+
29+
- id: 2.2
30+
text: "Ensure that the --client-cert-auth argument is set to true (Scored)"
31+
audit: "/bin/ps -ef | /bin/grep $etcdbin | /bin/grep -v grep"
32+
tests:
33+
test_items:
34+
- flag: "--client-cert-auth"
35+
compare:
36+
op: eq
37+
value: true
38+
set: true
39+
remediation: |
40+
Edit the etcd pod specification file $etcdconf on the master
41+
node and set the below parameter.
42+
--client-cert-auth="true"
43+
scored: true
44+
45+
- id: 2.3
46+
text: "Ensure that the --auto-tls argument is not set to true (Scored)"
47+
audit: "/bin/ps -ef | /bin/grep $etcdbin | /bin/grep -v grep"
48+
tests:
49+
bin_op: or
50+
test_items:
51+
- flag: "--auto-tls"
52+
set: false
53+
- flag: "--auto-tls"
54+
compare:
55+
op: eq
56+
value: false
57+
remediation: |
58+
Edit the etcd pod specification file $etcdconf on the master
59+
node and either remove the --auto-tls parameter or set it to false.
60+
--auto-tls=false
61+
scored: true
62+
63+
- id: 2.4
64+
text: "Ensure that the --peer-cert-file and --peer-key-file arguments are
65+
set as appropriate (Scored)"
66+
audit: "/bin/ps -ef | /bin/grep $etcdbin | /bin/grep -v grep"
67+
tests:
68+
bin_op: and
69+
test_items:
70+
- flag: "--peer-cert-file"
71+
set: true
72+
- flag: "--peer-key-file"
73+
set: true
74+
remediation: |
75+
Follow the etcd service documentation and configure peer TLS encryption as appropriate
76+
for your etcd cluster. Then, edit the etcd pod specification file $etcdconf on the
77+
master node and set the below parameters.
78+
--peer-client-file=</path/to/peer-cert-file>
79+
--peer-key-file=</path/to/peer-key-file>
80+
scored: true
81+
82+
- id: 2.5
83+
text: "Ensure that the --peer-client-cert-auth argument is set to true (Scored)"
84+
audit: "/bin/ps -ef | /bin/grep $etcdbin | /bin/grep -v grep"
85+
tests:
86+
test_items:
87+
- flag: "--peer-client-cert-auth"
88+
compare:
89+
op: eq
90+
value: true
91+
set: true
92+
remediation: |
93+
Edit the etcd pod specification file $etcdconf on the master
94+
node and set the below parameter.
95+
--peer-client-cert-auth=true
96+
scored: true
97+
98+
- id: 2.6
99+
text: "Ensure that the --peer-auto-tls argument is not set to true (Scored)"
100+
audit: "/bin/ps -ef | /bin/grep $etcdbin | /bin/grep -v grep"
101+
tests:
102+
bin_op: or
103+
test_items:
104+
- flag: "--peer-auto-tls"
105+
set: false
106+
- flag: "--peer-auto-tls"
107+
compare:
108+
op: eq
109+
value: false
110+
set: true
111+
remediation: |
112+
Edit the etcd pod specification file $etcdconf on the master
113+
node and either remove the --peer-auto-tls parameter or set it to false.
114+
--peer-auto-tls=false
115+
scored: true
116+
117+
- id: 2.7
118+
text: "Ensure that a unique Certificate Authority is used for etcd (Not Scored)"
119+
audit: "/bin/ps -ef | /bin/grep $etcdbin | /bin/grep -v grep"
120+
tests:
121+
test_items:
122+
- flag: "--trusted-ca-file"
123+
set: true
124+
remediation: |
125+
[Manual test]
126+
Follow the etcd documentation and create a dedicated certificate authority setup for the
127+
etcd service.
128+
Then, edit the etcd pod specification file $etcdconf on the
129+
master node and set the below parameter.
130+
--trusted-ca-file=</path/to/ca-file>
131+
scored: false

0 commit comments

Comments
 (0)