Skip to content

Commit b62e327

Browse files
deebhatiadeebhatia
committed
Merge branch 'upstream-main' into cis-openshift-1-6
2 parents c8d2de5 + fcfb537 commit b62e327

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

43 files changed

+3428
-203
lines changed

‎.github/workflows/build.yml

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,7 @@ on:
1414
- "LICENSE"
1515
- "NOTICE"
1616
env:
17-
GO_VERSION: "1.22.7"
17+
GO_VERSION: "1.23.4"
1818
KIND_VERSION: "v0.11.1"
1919
KIND_IMAGE: "kindest/node:v1.21.1@sha256:69860bda5563ac81e3c0057d654b5253219618a22ec3a346306239bba8cfa1a6"
2020

@@ -34,8 +34,8 @@ jobs:
3434
- name: Setup golangci-lint
3535
uses: golangci/golangci-lint-action@v6
3636
with:
37-
version: v1.57.2
38-
args: --verbose
37+
version: v1.61
38+
args: --verbose --timeout 2m
3939
unit:
4040
name: Unit tests
4141
runs-on: ubuntu-latest
@@ -49,7 +49,7 @@ jobs:
4949
- name: Run unit tests
5050
run: make tests
5151
- name: Upload code coverage
52-
uses: codecov/codecov-action@v4
52+
uses: codecov/codecov-action@v5
5353
with:
5454
file: ./coverage.txt
5555
e2e:

‎.golangci.yaml

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,11 +2,9 @@
22
linters:
33
disable-all: true
44
enable:
5-
- deadcode
65
- gocyclo
76
- gofmt
87
- goimports
98
- govet
109
- misspell
1110
- typecheck
12-
- varcheck

‎.goreleaser.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ env:
55
- CGO_ENABLED=0
66
- KUBEBENCH_CFG=/etc/kube-bench/cfg
77
builds:
8-
- main: main.go
8+
- main: .
99
binary: kube-bench
1010
tags:
1111
- osusergo

‎Dockerfile

Lines changed: 23 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
FROM golang:1.23.2 AS build
1+
FROM golang:1.23.4 AS build
22
WORKDIR /go/src/github.com/aquasecurity/kube-bench/
33
COPY makefile makefile
44
COPY go.mod go.sum ./
@@ -13,11 +13,13 @@ RUN make build && cp kube-bench /go/bin/kube-bench
1313
ARG KUBECTL_VERSION TARGETARCH
1414
RUN wget -O /usr/local/bin/kubectl "https://dl.k8s.io/release/v${KUBECTL_VERSION}/bin/linux/${TARGETARCH}/kubectl"
1515
RUN wget -O kubectl.sha256 "https://dl.k8s.io/release/v${KUBECTL_VERSION}/bin/linux/${TARGETARCH}/kubectl.sha256"
16+
1617
# Verify kubectl sha256sum
1718
RUN /bin/bash -c 'echo "$(<kubectl.sha256) /usr/local/bin/kubectl" | sha256sum -c -'
19+
1820
RUN chmod +x /usr/local/bin/kubectl
1921

20-
FROM alpine:3.20.3 AS run
22+
FROM alpine:3.21.2 AS run
2123
WORKDIR /opt/kube-bench/
2224
# add GNU ps for -C, -o cmd, --no-headers support and add findutils to get GNU xargs
2325
# https://github.com/aquasecurity/kube-bench/issues/109
@@ -38,22 +40,34 @@ RUN wget -q -O /etc/apk/keys/sgerrand.rsa.pub https://alpine-pkgs.sgerrand.com/s
3840
RUN apk add gcompat
3941
RUN apk add jq
4042

41-
ENV PATH=$PATH:/usr/local/mount-from-host/bin
43+
# Add bash for running helper scripts
44+
RUN apk add bash
45+
46+
ENV PATH=$PATH:/usr/local/mount-from-host/bin:/go/bin
4247

4348
COPY --from=build /go/bin/kube-bench /usr/local/bin/kube-bench
4449
COPY --from=build /usr/local/bin/kubectl /usr/local/bin/kubectl
4550
COPY entrypoint.sh .
4651
COPY cfg/ cfg/
52+
COPY helper_scripts/check_files_owner_in_dir.sh /go/bin/
53+
RUN chmod a+x /go/bin/check_files_owner_in_dir.sh
4754
ENTRYPOINT ["./entrypoint.sh"]
4855
CMD ["install"]
4956

5057
# Build-time metadata as defined at http://label-schema.org
5158
ARG BUILD_DATE
5259
ARG VCS_REF
60+
ARG KUBEBENCH_VERSION
61+
5362
LABEL org.label-schema.build-date=$BUILD_DATE \
54-
org.label-schema.name="kube-bench" \
55-
org.label-schema.description="Run the CIS Kubernetes Benchmark tests" \
56-
org.label-schema.url="https://github.com/aquasecurity/kube-bench" \
57-
org.label-schema.vcs-ref=$VCS_REF \
58-
org.label-schema.vcs-url="https://github.com/aquasecurity/kube-bench" \
59-
org.label-schema.schema-version="1.0"
63+
org.label-schema.name="kube-bench" \
64+
org.label-schema.vendor="Aqua Security Software Ltd." \
65+
org.label-schema.version=$KUBEBENCH_VERSION \
66+
org.label-schema.release=$KUBEBENCH_VERSION \
67+
org.label-schema.summary="Aqua security server" \
68+
org.label-schema.maintainer="admin@aquasec.com" \
69+
org.label-schema.description="Run the CIS Kubernetes Benchmark tests" \
70+
org.label-schema.url="https://github.com/aquasecurity/kube-bench" \
71+
org.label-schema.vcs-ref=$VCS_REF \
72+
org.label-schema.vcs-url="https://github.com/aquasecurity/kube-bench" \
73+
org.label-schema.schema-version="1.0"

‎Dockerfile.fips.ubi

Lines changed: 15 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
FROM golang:1.23.2 AS build
1+
FROM golang:1.23.4 AS build
22
WORKDIR /go/src/github.com/aquasecurity/kube-bench/
33
COPY makefile makefile
44
COPY go.mod go.sum ./
@@ -42,17 +42,25 @@ COPY --from=build /go/bin/kube-bench /usr/local/bin/kube-bench
4242
COPY --from=build /usr/local/bin/kubectl /usr/local/bin/kubectl
4343
COPY entrypoint.sh .
4444
COPY cfg/ cfg/
45+
COPY helper_scripts/check_files_owner_in_dir.sh /go/bin
4546
ENTRYPOINT ["./entrypoint.sh"]
4647
CMD ["install"]
4748

4849

4950
# Build-time metadata as defined at http://label-schema.org
5051
ARG BUILD_DATE
5152
ARG VCS_REF
53+
ARG KUBEBENCH_VERSION
54+
5255
LABEL org.label-schema.build-date=$BUILD_DATE \
53-
org.label-schema.name="kube-bench" \
54-
org.label-schema.description="Run the CIS Kubernetes Benchmark tests" \
55-
org.label-schema.url="https://github.com/aquasecurity/kube-bench" \
56-
org.label-schema.vcs-ref=$VCS_REF \
57-
org.label-schema.vcs-url="https://github.com/aquasecurity/kube-bench" \
58-
org.label-schema.schema-version="1.0"
56+
org.label-schema.name="kube-bench" \
57+
org.label-schema.vendor="Aqua Security Software Ltd." \
58+
org.label-schema.version=$KUBEBENCH_VERSION \
59+
org.label-schema.release=$KUBEBENCH_VERSION \
60+
org.label-schema.summary="Aqua security server" \
61+
org.label-schema.maintainer="admin@aquasec.com" \
62+
org.label-schema.description="Run the CIS Kubernetes Benchmark tests" \
63+
org.label-schema.url="https://github.com/aquasecurity/kube-bench" \
64+
org.label-schema.vcs-ref=$VCS_REF \
65+
org.label-schema.vcs-url="https://github.com/aquasecurity/kube-bench" \
66+
org.label-schema.schema-version="1.0"

‎Dockerfile.ubi

Lines changed: 15 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
FROM golang:1.23.2 AS build
1+
FROM golang:1.23.4 AS build
22
WORKDIR /go/src/github.com/aquasecurity/kube-bench/
33
COPY makefile makefile
44
COPY go.mod go.sum ./
@@ -42,17 +42,25 @@ COPY --from=build /go/bin/kube-bench /usr/local/bin/kube-bench
4242
COPY --from=build /usr/local/bin/kubectl /usr/local/bin/kubectl
4343
COPY entrypoint.sh .
4444
COPY cfg/ cfg/
45+
COPY helper_scripts/check_files_owner_in_dir.sh /go/bin
4546
ENTRYPOINT ["./entrypoint.sh"]
4647
CMD ["install"]
4748

4849

4950
# Build-time metadata as defined at http://label-schema.org
5051
ARG BUILD_DATE
5152
ARG VCS_REF
53+
ARG KUBEBENCH_VERSION
54+
5255
LABEL org.label-schema.build-date=$BUILD_DATE \
53-
org.label-schema.name="kube-bench" \
54-
org.label-schema.description="Run the CIS Kubernetes Benchmark tests" \
55-
org.label-schema.url="https://github.com/aquasecurity/kube-bench" \
56-
org.label-schema.vcs-ref=$VCS_REF \
57-
org.label-schema.vcs-url="https://github.com/aquasecurity/kube-bench" \
58-
org.label-schema.schema-version="1.0"
56+
org.label-schema.name="kube-bench" \
57+
org.label-schema.vendor="Aqua Security Software Ltd." \
58+
org.label-schema.version=$KUBEBENCH_VERSION \
59+
org.label-schema.release=$KUBEBENCH_VERSION \
60+
org.label-schema.summary="Aqua security server" \
61+
org.label-schema.maintainer="admin@aquasec.com" \
62+
org.label-schema.description="Run the CIS Kubernetes Benchmark tests" \
63+
org.label-schema.url="https://github.com/aquasecurity/kube-bench" \
64+
org.label-schema.vcs-ref=$VCS_REF \
65+
org.label-schema.vcs-url="https://github.com/aquasecurity/kube-bench" \
66+
org.label-schema.schema-version="1.0"

‎cfg/cis-1.10/config.yaml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
---
2+
## Version-specific settings that override the values in cfg/config.yaml

‎cfg/cis-1.10/controlplane.yaml

Lines changed: 62 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,62 @@
1+
---
2+
controls:
3+
version: "cis-1.10"
4+
id: 3
5+
text: "Control Plane Configuration"
6+
type: "controlplane"
7+
groups:
8+
- id: 3.1
9+
text: "Authentication and Authorization"
10+
checks:
11+
- id: 3.1.1
12+
text: "Client certificate authentication should not be used for users (Manual)"
13+
type: "manual"
14+
remediation: |
15+
Alternative mechanisms provided by Kubernetes such as the use of OIDC should be
16+
implemented in place of client certificates.
17+
scored: false
18+
19+
- id: 3.1.2
20+
text: "Service account token authentication should not be used for users (Manual)"
21+
type: "manual"
22+
remediation: |
23+
Alternative mechanisms provided by Kubernetes such as the use of OIDC should be implemented
24+
in place of service account tokens.
25+
scored: false
26+
27+
- id: 3.1.3
28+
text: "Bootstrap token authentication should not be used for users (Manual)"
29+
type: "manual"
30+
remediation: |
31+
Alternative mechanisms provided by Kubernetes such as the use of OIDC should be implemented
32+
in place of bootstrap tokens.
33+
scored: false
34+
35+
- id: 3.2
36+
text: "Logging"
37+
checks:
38+
- id: 3.2.1
39+
text: "Ensure that a minimal audit policy is created (Manual)"
40+
audit: "/bin/ps -ef | grep $apiserverbin | grep -v grep"
41+
tests:
42+
test_items:
43+
- flag: "--audit-policy-file"
44+
set: true
45+
remediation: |
46+
Create an audit policy file for your cluster.
47+
scored: false
48+
49+
- id: 3.2.2
50+
text: "Ensure that the audit policy covers key security concerns (Manual)"
51+
type: "manual"
52+
remediation: |
53+
Review the audit policy provided for the cluster and ensure that it covers
54+
at least the following areas,
55+
- Access to Secrets managed by the cluster. Care should be taken to only
56+
log Metadata for requests to Secrets, ConfigMaps, and TokenReviews, in
57+
order to avoid risk of logging sensitive data.
58+
- Modification of Pod and Deployment objects.
59+
- Use of `pods/exec`, `pods/portforward`, `pods/proxy` and `services/proxy`.
60+
For most requests, minimally logging at the Metadata level is recommended
61+
(the most basic level of logging).
62+
scored: false

‎cfg/cis-1.10/etcd.yaml

Lines changed: 135 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,135 @@
1+
---
2+
controls:
3+
version: "cis-1.10"
4+
id: 2
5+
text: "Etcd Node Configuration"
6+
type: "etcd"
7+
groups:
8+
- id: 2
9+
text: "Etcd Node Configuration"
10+
checks:
11+
- id: 2.1
12+
text: "Ensure that the --cert-file and --key-file arguments are set as appropriate (Automated)"
13+
audit: "/bin/ps -ef | /bin/grep $etcdbin | /bin/grep -v grep"
14+
tests:
15+
bin_op: and
16+
test_items:
17+
- flag: "--cert-file"
18+
env: "ETCD_CERT_FILE"
19+
- flag: "--key-file"
20+
env: "ETCD_KEY_FILE"
21+
remediation: |
22+
Follow the etcd service documentation and configure TLS encryption.
23+
Then, edit the etcd pod specification file /etc/kubernetes/manifests/etcd.yaml
24+
on the master node and set the below parameters.
25+
--cert-file=</path/to/ca-file>
26+
--key-file=</path/to/key-file>
27+
scored: true
28+
29+
- id: 2.2
30+
text: "Ensure that the --client-cert-auth argument is set to true (Automated)"
31+
audit: "/bin/ps -ef | /bin/grep $etcdbin | /bin/grep -v grep"
32+
tests:
33+
test_items:
34+
- flag: "--client-cert-auth"
35+
env: "ETCD_CLIENT_CERT_AUTH"
36+
compare:
37+
op: eq
38+
value: true
39+
remediation: |
40+
Edit the etcd pod specification file $etcdconf on the master
41+
node and set the below parameter.
42+
--client-cert-auth="true"
43+
scored: true
44+
45+
- id: 2.3
46+
text: "Ensure that the --auto-tls argument is not set to true (Automated)"
47+
audit: "/bin/ps -ef | /bin/grep $etcdbin | /bin/grep -v grep"
48+
tests:
49+
bin_op: or
50+
test_items:
51+
- flag: "--auto-tls"
52+
env: "ETCD_AUTO_TLS"
53+
set: false
54+
- flag: "--auto-tls"
55+
env: "ETCD_AUTO_TLS"
56+
compare:
57+
op: eq
58+
value: false
59+
remediation: |
60+
Edit the etcd pod specification file $etcdconf on the master
61+
node and either remove the --auto-tls parameter or set it to false.
62+
--auto-tls=false
63+
scored: true
64+
65+
- id: 2.4
66+
text: "Ensure that the --peer-cert-file and --peer-key-file arguments are
67+
set as appropriate (Automated)"
68+
audit: "/bin/ps -ef | /bin/grep $etcdbin | /bin/grep -v grep"
69+
tests:
70+
bin_op: and
71+
test_items:
72+
- flag: "--peer-cert-file"
73+
env: "ETCD_PEER_CERT_FILE"
74+
- flag: "--peer-key-file"
75+
env: "ETCD_PEER_KEY_FILE"
76+
remediation: |
77+
Follow the etcd service documentation and configure peer TLS encryption as appropriate
78+
for your etcd cluster.
79+
Then, edit the etcd pod specification file $etcdconf on the
80+
master node and set the below parameters.
81+
--peer-client-file=</path/to/peer-cert-file>
82+
--peer-key-file=</path/to/peer-key-file>
83+
scored: true
84+
85+
- id: 2.5
86+
text: "Ensure that the --peer-client-cert-auth argument is set to true (Automated)"
87+
audit: "/bin/ps -ef | /bin/grep $etcdbin | /bin/grep -v grep"
88+
tests:
89+
test_items:
90+
- flag: "--peer-client-cert-auth"
91+
env: "ETCD_PEER_CLIENT_CERT_AUTH"
92+
compare:
93+
op: eq
94+
value: true
95+
remediation: |
96+
Edit the etcd pod specification file $etcdconf on the master
97+
node and set the below parameter.
98+
--peer-client-cert-auth=true
99+
scored: true
100+
101+
- id: 2.6
102+
text: "Ensure that the --peer-auto-tls argument is not set to true (Automated)"
103+
audit: "/bin/ps -ef | /bin/grep $etcdbin | /bin/grep -v grep"
104+
tests:
105+
bin_op: or
106+
test_items:
107+
- flag: "--peer-auto-tls"
108+
env: "ETCD_PEER_AUTO_TLS"
109+
set: false
110+
- flag: "--peer-auto-tls"
111+
env: "ETCD_PEER_AUTO_TLS"
112+
compare:
113+
op: eq
114+
value: false
115+
remediation: |
116+
Edit the etcd pod specification file $etcdconf on the master
117+
node and either remove the --peer-auto-tls parameter or set it to false.
118+
--peer-auto-tls=false
119+
scored: true
120+
121+
- id: 2.7
122+
text: "Ensure that a unique Certificate Authority is used for etcd (Manual)"
123+
audit: "/bin/ps -ef | /bin/grep $etcdbin | /bin/grep -v grep"
124+
tests:
125+
test_items:
126+
- flag: "--trusted-ca-file"
127+
env: "ETCD_TRUSTED_CA_FILE"
128+
remediation: |
129+
[Manual test]
130+
Follow the etcd documentation and create a dedicated certificate authority setup for the
131+
etcd service.
132+
Then, edit the etcd pod specification file $etcdconf on the
133+
master node and set the below parameter.
134+
--trusted-ca-file=</path/to/ca-file>
135+
scored: false

0 commit comments

Comments
 (0)