Completed upto lesson 35
This commit is contained in:
Mosiur Rahman
50
lab/lesson-33-answer.yaml
Normal file
50
lab/lesson-33-answer.yaml
Normal file
@@ -0,0 +1,50 @@
|
||||
apiVersion: v1
|
||||
kind: Namespace
|
||||
metadata:
|
||||
name: context-lab
|
||||
---
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: report-api
|
||||
namespace: context-lab
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app: report-api
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: report-api
|
||||
spec:
|
||||
securityContext:
|
||||
seccompProfile:
|
||||
type: RuntimeDefault
|
||||
runAsNonRoot: true
|
||||
runAsUser: 1000
|
||||
runAsGroup: 1000
|
||||
volumes:
|
||||
- name: log-exporter-vol
|
||||
emptyDir: {}
|
||||
containers:
|
||||
- name: api
|
||||
image: nginxinc/nginx-unprivileged:1.27-alpine
|
||||
ports:
|
||||
- containerPort: 8080
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
readOnlyRootFilesystem: true
|
||||
capabilities:
|
||||
drop: ["ALL"]
|
||||
- name: log-exporter
|
||||
image: busybox:1.37
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
capabilities:
|
||||
drop: ["ALL"]
|
||||
readOnlyRootFilesystem: true
|
||||
command: ["sh", "-c", "while true; do date >> /var/cache/exporter/events.log; sleep 30; done"]
|
||||
volumeMounts:
|
||||
- name: log-exporter-vol
|
||||
mountPath: /var/cache/exporter
|
||||
28
lab/lesson-33-fixture.yaml
Normal file
28
lab/lesson-33-fixture.yaml
Normal file
@@ -0,0 +1,28 @@
|
||||
apiVersion: v1
|
||||
kind: Namespace
|
||||
metadata:
|
||||
name: context-lab
|
||||
---
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: report-api
|
||||
namespace: context-lab
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app: report-api
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: report-api
|
||||
spec:
|
||||
containers:
|
||||
- name: api
|
||||
image: nginxinc/nginx-unprivileged:1.27-alpine
|
||||
ports:
|
||||
- containerPort: 8080
|
||||
- name: log-exporter
|
||||
image: busybox:1.37
|
||||
command: ["sh", "-c", "while true; do date >> /var/cache/exporter/events.log; sleep 30; done"]
|
||||
106
lab/lesson-34-answer.yaml
Normal file
106
lab/lesson-34-answer.yaml
Normal file
@@ -0,0 +1,106 @@
|
||||
---
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: orders-api
|
||||
namespace: orders-prod
|
||||
spec:
|
||||
replicas: 2
|
||||
selector:
|
||||
matchLabels:
|
||||
app: orders-api
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: orders-api
|
||||
tier: backend
|
||||
spec:
|
||||
automountServiceAccountToken: false
|
||||
serviceAccountName: orders-api
|
||||
securityContext:
|
||||
runAsNonRoot: true
|
||||
runAsUser: 10001
|
||||
runAsGroup: 10001
|
||||
fsGroup: 10001
|
||||
seccompProfile:
|
||||
type: RuntimeDefault
|
||||
volumes:
|
||||
- name: orders
|
||||
emptyDir: {}
|
||||
- name: srv
|
||||
emptyDir: {}
|
||||
containers:
|
||||
- name: api
|
||||
image: busybox:1.37
|
||||
volumeMounts:
|
||||
- name: orders
|
||||
mountPath: /var/log/orders
|
||||
- name: srv
|
||||
mountPath: /srv
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
readOnlyRootFilesystem: true
|
||||
capabilities:
|
||||
drop: ["ALL"]
|
||||
command: ["sh", "-c", "mkdir -p /srv; echo ready > /srv/index.html; httpd -f -p 8080 -h /srv"]
|
||||
ports:
|
||||
- name: http
|
||||
containerPort: 8080
|
||||
- name: audit-writer
|
||||
image: busybox:1.37
|
||||
command: ["sh", "-c", "while true; do date >> /var/log/orders/audit.log; sleep 20; done"]
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
readOnlyRootFilesystem: true
|
||||
capabilities:
|
||||
drop: ["ALL"]
|
||||
volumeMounts:
|
||||
- name: orders
|
||||
mountPath: /var/log/orders
|
||||
---
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: NetworkPolicy
|
||||
metadata:
|
||||
name: orders-api-boundary
|
||||
namespace: orders-prod
|
||||
spec:
|
||||
podSelector:
|
||||
matchLabels:
|
||||
app: orders-api
|
||||
policyTypes:
|
||||
- Ingress
|
||||
- Egress
|
||||
ingress:
|
||||
- from:
|
||||
- namespaceSelector:
|
||||
matchLabels:
|
||||
kubernetes.io/metadata.name: edge
|
||||
podSelector:
|
||||
matchLabels:
|
||||
app: edge-gateway
|
||||
ports:
|
||||
- protocol: TCP
|
||||
port: 8080
|
||||
egress:
|
||||
- to:
|
||||
- namespaceSelector:
|
||||
matchLabels:
|
||||
kubernetes.io/metadata.name: data
|
||||
podSelector:
|
||||
matchLabels:
|
||||
app: orders-db
|
||||
ports:
|
||||
- protocol: TCP
|
||||
port: 5432
|
||||
- to:
|
||||
- namespaceSelector:
|
||||
matchLabels:
|
||||
kubernetes.io/metadata.name: kube-system
|
||||
podSelector:
|
||||
matchLabels:
|
||||
k8s-app: kube-dns
|
||||
ports:
|
||||
- protocol: TCP
|
||||
port: 53
|
||||
- protocol: UDP
|
||||
port: 53
|
||||
82
lab/lesson-34-fixture.yaml
Normal file
82
lab/lesson-34-fixture.yaml
Normal file
@@ -0,0 +1,82 @@
|
||||
apiVersion: v1
|
||||
kind: Namespace
|
||||
metadata:
|
||||
name: orders-prod
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Namespace
|
||||
metadata:
|
||||
name: edge
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Namespace
|
||||
metadata:
|
||||
name: data
|
||||
---
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: orders-api
|
||||
namespace: orders-prod
|
||||
spec:
|
||||
replicas: 2
|
||||
selector:
|
||||
matchLabels:
|
||||
app: orders-api
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: orders-api
|
||||
tier: backend
|
||||
spec:
|
||||
serviceAccountName: orders-api
|
||||
containers:
|
||||
- name: api
|
||||
image: busybox:1.37
|
||||
command: ["sh", "-c", "mkdir -p /srv; echo ready > /srv/index.html; httpd -f -p 8080 -h /srv"]
|
||||
ports:
|
||||
- name: http
|
||||
containerPort: 8080
|
||||
- name: audit-writer
|
||||
image: busybox:1.37
|
||||
command: ["sh", "-c", "while true; do date >> /var/log/orders/audit.log; sleep 20; done"]
|
||||
---
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: edge-gateway
|
||||
namespace: edge
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app: edge-gateway
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: edge-gateway
|
||||
spec:
|
||||
containers:
|
||||
- name: gateway
|
||||
image: busybox:1.37
|
||||
command: ["sleep", "1d"]
|
||||
---
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: orders-db
|
||||
namespace: data
|
||||
spec:
|
||||
replicas: 1
|
||||
selector:
|
||||
matchLabels:
|
||||
app: orders-db
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: orders-db
|
||||
spec:
|
||||
containers:
|
||||
- name: database
|
||||
image: busybox:1.37
|
||||
command: ["sleep", "1d"]
|
||||
26
lab/lesson-35-audit-policy.yaml
Normal file
26
lab/lesson-35-audit-policy.yaml
Normal file
@@ -0,0 +1,26 @@
|
||||
apiVersion: audit.k8s.io/v1 # This is required.
|
||||
kind: Policy
|
||||
omitStages:
|
||||
- "RequestReceived"
|
||||
rules:
|
||||
- level: RequestResponse
|
||||
namespaces: ["payments","orders-prod"]
|
||||
resources:
|
||||
- group: ""
|
||||
resources: ["secrets"]
|
||||
|
||||
|
||||
- level: Metadata
|
||||
verbs: ["create","update","patch","delete","deletecollection"]
|
||||
resources:
|
||||
- group: "rbac.authorization.k8s.io"
|
||||
resources: ["roles","rolebindings","clusterroles","clusterrolebindings"]
|
||||
|
||||
- level: Request
|
||||
resources:
|
||||
- group: ""
|
||||
resources: ["pods/exec"]
|
||||
|
||||
- level: Metadata
|
||||
omitStages:
|
||||
- "RequestReceived"
|
||||
57
lab/lesson-35-kube-apiserver-answer.yaml
Normal file
57
lab/lesson-35-kube-apiserver-answer.yaml
Normal file
@@ -0,0 +1,57 @@
|
||||
apiVersion: v1
|
||||
kind: Pod
|
||||
metadata:
|
||||
name: kube-apiserver
|
||||
namespace: kube-system
|
||||
labels:
|
||||
component: kube-apiserver
|
||||
tier: control-plane
|
||||
spec:
|
||||
hostNetwork: true
|
||||
priorityClassName: system-node-critical
|
||||
containers:
|
||||
- name: kube-apiserver
|
||||
image: registry.k8s.io/kube-apiserver:v1.34.1
|
||||
command:
|
||||
- kube-apiserver
|
||||
- --anonymous-auth=false
|
||||
- --authorization-mode=Node,RBAC
|
||||
- --profiling=false
|
||||
- --service-account-lookup=true
|
||||
- --enable-admission-plugins=NamespaceLifecycle,ServiceAccount,NodeRestriction
|
||||
- --audit-policy-file=/etc/kubernetes/audit-policy.yaml
|
||||
- --audit-log-path=/var/log/kubernetes/audit/audit.log
|
||||
- --audit-log-maxage=14
|
||||
- --audit-log-maxbackup=10
|
||||
- --audit-log-maxsize=100
|
||||
- --etcd-servers=https://127.0.0.1:2379
|
||||
- --service-cluster-ip-range=10.96.0.0/12
|
||||
- --client-ca-file=/etc/kubernetes/pki/ca.crt
|
||||
- --tls-cert-file=/etc/kubernetes/pki/apiserver.crt
|
||||
- --tls-private-key-file=/etc/kubernetes/pki/apiserver.key
|
||||
- --service-account-issuer=https://kubernetes.default.svc.cluster.local
|
||||
- --service-account-key-file=/etc/kubernetes/pki/sa.pub
|
||||
- --service-account-signing-key-file=/etc/kubernetes/pki/sa.key
|
||||
- --allow-privileged=true
|
||||
volumeMounts:
|
||||
- name: k8s-certs
|
||||
mountPath: /etc/kubernetes/pki
|
||||
readOnly: true
|
||||
- name: audit-config
|
||||
mountPath: /etc/kubernetes/audit-policy.yaml
|
||||
readOnly: true
|
||||
- name: audit-log
|
||||
mountPath: /var/log/kubernetes/audit
|
||||
volumes:
|
||||
- name: k8s-certs
|
||||
hostPath:
|
||||
path: /etc/kubernetes/pki
|
||||
type: DirectoryOrCreate
|
||||
- name: audit-config
|
||||
hostPath:
|
||||
path: /etc/kubernetes/audit-policy.yaml
|
||||
type: File
|
||||
- name: audit-log
|
||||
hostPath:
|
||||
path: /var/log/kubernetes/audit
|
||||
type: DirectoryOrCreate
|
||||
40
lab/lesson-35-kube-apiserver-insecure.yaml
Normal file
40
lab/lesson-35-kube-apiserver-insecure.yaml
Normal file
@@ -0,0 +1,40 @@
|
||||
apiVersion: v1
|
||||
kind: Pod
|
||||
metadata:
|
||||
name: kube-apiserver
|
||||
namespace: kube-system
|
||||
labels:
|
||||
component: kube-apiserver
|
||||
tier: control-plane
|
||||
spec:
|
||||
hostNetwork: true
|
||||
priorityClassName: system-node-critical
|
||||
containers:
|
||||
- name: kube-apiserver
|
||||
image: registry.k8s.io/kube-apiserver:v1.34.1
|
||||
command:
|
||||
- kube-apiserver
|
||||
- --anonymous-auth=true
|
||||
- --authorization-mode=AlwaysAllow
|
||||
- --profiling=true
|
||||
- --service-account-lookup=false
|
||||
- --enable-admission-plugins=NamespaceLifecycle,ServiceAccount
|
||||
- --audit-log-path=-
|
||||
- --etcd-servers=https://127.0.0.1:2379
|
||||
- --service-cluster-ip-range=10.96.0.0/12
|
||||
- --client-ca-file=/etc/kubernetes/pki/ca.crt
|
||||
- --tls-cert-file=/etc/kubernetes/pki/apiserver.crt
|
||||
- --tls-private-key-file=/etc/kubernetes/pki/apiserver.key
|
||||
- --service-account-issuer=https://kubernetes.default.svc.cluster.local
|
||||
- --service-account-key-file=/etc/kubernetes/pki/sa.pub
|
||||
- --service-account-signing-key-file=/etc/kubernetes/pki/sa.key
|
||||
- --allow-privileged=true
|
||||
volumeMounts:
|
||||
- name: k8s-certs
|
||||
mountPath: /etc/kubernetes/pki
|
||||
readOnly: true
|
||||
volumes:
|
||||
- name: k8s-certs
|
||||
hostPath:
|
||||
path: /etc/kubernetes/pki
|
||||
type: DirectoryOrCreate
|
||||
32
lab/lesson-36-coredns.yaml
Normal file
32
lab/lesson-36-coredns.yaml
Normal file
@@ -0,0 +1,32 @@
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: coredns
|
||||
namespace: kube-system
|
||||
spec:
|
||||
replicas: 2
|
||||
selector:
|
||||
matchLabels:
|
||||
k8s-app: kube-dns
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
k8s-app: kube-dns
|
||||
spec:
|
||||
serviceAccountName: coredns
|
||||
automountServiceAccountToken: true
|
||||
containers:
|
||||
- name: coredns
|
||||
image: registry.k8s.io/coredns/coredns:v1.12.1
|
||||
args: ["-conf", "/etc/coredns/Corefile"]
|
||||
securityContext:
|
||||
runAsUser: 0
|
||||
allowPrivilegeEscalation: true
|
||||
readOnlyRootFilesystem: false
|
||||
ports:
|
||||
- name: dns
|
||||
containerPort: 53
|
||||
protocol: UDP
|
||||
- name: dns-tcp
|
||||
containerPort: 53
|
||||
protocol: TCP
|
||||
31
lab/lesson-36-etcd.yaml
Normal file
31
lab/lesson-36-etcd.yaml
Normal file
@@ -0,0 +1,31 @@
|
||||
apiVersion: v1
|
||||
kind: Pod
|
||||
metadata:
|
||||
name: etcd
|
||||
namespace: kube-system
|
||||
spec:
|
||||
hostNetwork: true
|
||||
containers:
|
||||
- name: etcd
|
||||
image: registry.k8s.io/etcd:3.6.4-0
|
||||
command:
|
||||
- etcd
|
||||
- --listen-client-urls=https://127.0.0.1:2379,https://10.0.0.10:2379
|
||||
- --client-cert-auth=false
|
||||
- --trusted-ca-file=/etc/kubernetes/pki/etcd/ca.crt
|
||||
- --cert-file=/etc/kubernetes/pki/etcd/server.crt
|
||||
- --key-file=/etc/kubernetes/pki/etcd/server.key
|
||||
- --auto-tls=true
|
||||
- --peer-client-cert-auth=true
|
||||
- --peer-trusted-ca-file=/etc/kubernetes/pki/etcd/ca.crt
|
||||
- --peer-cert-file=/etc/kubernetes/pki/etcd/peer.crt
|
||||
- --peer-key-file=/etc/kubernetes/pki/etcd/peer.key
|
||||
volumeMounts:
|
||||
- name: etcd-certs
|
||||
mountPath: /etc/kubernetes/pki/etcd
|
||||
readOnly: true
|
||||
volumes:
|
||||
- name: etcd-certs
|
||||
hostPath:
|
||||
path: /etc/kubernetes/pki/etcd
|
||||
type: DirectoryOrCreate
|
||||
202
lab/lesson-36-kube-bench.json
Normal file
202
lab/lesson-36-kube-bench.json
Normal file
@@ -0,0 +1,202 @@
|
||||
{
|
||||
"Controls": [
|
||||
{
|
||||
"id": "1",
|
||||
"version": "cis-1.11",
|
||||
"detected_version": "v1.34.1",
|
||||
"text": "Control Plane Security Configuration",
|
||||
"node_type": "master",
|
||||
"tests": [
|
||||
{
|
||||
"section": "1.2",
|
||||
"type": "controlplane",
|
||||
"pass": 1,
|
||||
"fail": 2,
|
||||
"warn": 1,
|
||||
"info": 0,
|
||||
"desc": "API Server",
|
||||
"results": [
|
||||
{
|
||||
"test_number": "1.2.1",
|
||||
"test_desc": "Ensure that the --anonymous-auth argument is set to false (Automated)",
|
||||
"audit": "Inspect the kube-apiserver process arguments",
|
||||
"type": "Automated",
|
||||
"remediation": "Set --anonymous-auth=false in the kube-apiserver static Pod manifest.",
|
||||
"test_info": [],
|
||||
"status": "FAIL",
|
||||
"actual_value": "--anonymous-auth=true",
|
||||
"scored": true,
|
||||
"expected_result": "false"
|
||||
},
|
||||
{
|
||||
"test_number": "1.2.7",
|
||||
"test_desc": "Ensure that the --authorization-mode argument includes Node and RBAC (Automated)",
|
||||
"audit": "Inspect the kube-apiserver process arguments",
|
||||
"type": "Automated",
|
||||
"remediation": "Set --authorization-mode=Node,RBAC.",
|
||||
"test_info": [],
|
||||
"status": "FAIL",
|
||||
"actual_value": "--authorization-mode=AlwaysAllow",
|
||||
"scored": true,
|
||||
"expected_result": "Node,RBAC"
|
||||
},
|
||||
{
|
||||
"test_number": "1.2.21",
|
||||
"test_desc": "Ensure that the --service-account-lookup argument is set to true (Automated)",
|
||||
"audit": "Inspect the kube-apiserver process arguments",
|
||||
"type": "Automated",
|
||||
"remediation": "Set --service-account-lookup=true.",
|
||||
"test_info": [],
|
||||
"status": "PASS",
|
||||
"actual_value": "--service-account-lookup=true",
|
||||
"scored": true,
|
||||
"expected_result": "true"
|
||||
},
|
||||
{
|
||||
"test_number": "1.2.22",
|
||||
"test_desc": "Ensure that the audit log path is configured (Manual)",
|
||||
"audit": "Review the audit backend path and persistence mounts",
|
||||
"type": "Manual",
|
||||
"remediation": "Configure a persistent audit log file and verify its host mount.",
|
||||
"test_info": ["A non-empty flag alone does not prove persistence."],
|
||||
"status": "WARN",
|
||||
"actual_value": "--audit-log-path=-",
|
||||
"scored": false,
|
||||
"expected_result": "persistent file path"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"id": "2",
|
||||
"version": "cis-1.11",
|
||||
"detected_version": "v1.34.1",
|
||||
"text": "etcd Node Configuration",
|
||||
"node_type": "etcd",
|
||||
"tests": [
|
||||
{
|
||||
"section": "2",
|
||||
"type": "etcd",
|
||||
"pass": 1,
|
||||
"fail": 2,
|
||||
"warn": 0,
|
||||
"info": 0,
|
||||
"desc": "etcd",
|
||||
"results": [
|
||||
{
|
||||
"test_number": "2.2",
|
||||
"test_desc": "Ensure that the --client-cert-auth argument is set to true (Automated)",
|
||||
"audit": "Inspect the etcd process arguments",
|
||||
"type": "Automated",
|
||||
"remediation": "Set --client-cert-auth=true and configure --trusted-ca-file.",
|
||||
"test_info": [],
|
||||
"status": "FAIL",
|
||||
"actual_value": "--client-cert-auth=false",
|
||||
"scored": true,
|
||||
"expected_result": "true"
|
||||
},
|
||||
{
|
||||
"test_number": "2.3",
|
||||
"test_desc": "Ensure that the --auto-tls argument is not set to true (Automated)",
|
||||
"audit": "Inspect the etcd process arguments",
|
||||
"type": "Automated",
|
||||
"remediation": "Set --auto-tls=false and use trusted certificate files.",
|
||||
"test_info": [],
|
||||
"status": "FAIL",
|
||||
"actual_value": "--auto-tls=true",
|
||||
"scored": true,
|
||||
"expected_result": "false"
|
||||
},
|
||||
{
|
||||
"test_number": "2.4",
|
||||
"test_desc": "Ensure that the --peer-client-cert-auth argument is set to true (Automated)",
|
||||
"audit": "Inspect the etcd process arguments",
|
||||
"type": "Automated",
|
||||
"remediation": "Set --peer-client-cert-auth=true.",
|
||||
"test_info": [],
|
||||
"status": "PASS",
|
||||
"actual_value": "--peer-client-cert-auth=true",
|
||||
"scored": true,
|
||||
"expected_result": "true"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"id": "4",
|
||||
"version": "cis-1.11",
|
||||
"detected_version": "v1.34.1",
|
||||
"text": "Worker Node Security Configuration",
|
||||
"node_type": "node",
|
||||
"tests": [
|
||||
{
|
||||
"section": "4.2",
|
||||
"type": "node",
|
||||
"pass": 1,
|
||||
"fail": 3,
|
||||
"warn": 0,
|
||||
"info": 0,
|
||||
"desc": "Kubelet",
|
||||
"results": [
|
||||
{
|
||||
"test_number": "4.2.1",
|
||||
"test_desc": "Ensure that anonymous authentication is disabled (Automated)",
|
||||
"audit": "Inspect KubeletConfiguration authentication.anonymous.enabled",
|
||||
"type": "Automated",
|
||||
"remediation": "Set authentication.anonymous.enabled=false.",
|
||||
"test_info": [],
|
||||
"status": "FAIL",
|
||||
"actual_value": "enabled: true",
|
||||
"scored": true,
|
||||
"expected_result": "false"
|
||||
},
|
||||
{
|
||||
"test_number": "4.2.2",
|
||||
"test_desc": "Ensure that webhook authentication is enabled (Automated)",
|
||||
"audit": "Inspect KubeletConfiguration authentication.webhook.enabled",
|
||||
"type": "Automated",
|
||||
"remediation": "Set authentication.webhook.enabled=true.",
|
||||
"test_info": [],
|
||||
"status": "FAIL",
|
||||
"actual_value": "enabled: false",
|
||||
"scored": true,
|
||||
"expected_result": "true"
|
||||
},
|
||||
{
|
||||
"test_number": "4.2.3",
|
||||
"test_desc": "Ensure that the authorization mode is Webhook (Automated)",
|
||||
"audit": "Inspect KubeletConfiguration authorization.mode",
|
||||
"type": "Automated",
|
||||
"remediation": "Set authorization.mode=Webhook.",
|
||||
"test_info": [],
|
||||
"status": "FAIL",
|
||||
"actual_value": "mode: AlwaysAllow",
|
||||
"scored": true,
|
||||
"expected_result": "Webhook"
|
||||
},
|
||||
{
|
||||
"test_number": "4.2.4",
|
||||
"test_desc": "Ensure that the read-only port is disabled (Automated)",
|
||||
"audit": "Inspect KubeletConfiguration readOnlyPort",
|
||||
"type": "Automated",
|
||||
"remediation": "Set readOnlyPort=0.",
|
||||
"test_info": [],
|
||||
"status": "PASS",
|
||||
"actual_value": "readOnlyPort: 0",
|
||||
"scored": true,
|
||||
"expected_result": "0"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"Totals": {
|
||||
"total_pass": 3,
|
||||
"total_fail": 7,
|
||||
"total_warn": 1,
|
||||
"total_info": 0
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user