{
  "Controls": [
    {
      "id": "1",
      "version": "cis-1.11",
      "detected_version": "v1.34.1",
      "text": "Control Plane Security Configuration",
      "node_type": "master",
      "tests": [
        {
          "section": "1.2",
          "type": "controlplane",
          "pass": 1,
          "fail": 2,
          "warn": 1,
          "info": 0,
          "desc": "API Server",
          "results": [
            {
              "test_number": "1.2.1",
              "test_desc": "Ensure that the --anonymous-auth argument is set to false (Automated)",
              "audit": "Inspect the kube-apiserver process arguments",
              "type": "Automated",
              "remediation": "Set --anonymous-auth=false in the kube-apiserver static Pod manifest.",
              "test_info": [],
              "status": "FAIL",
              "actual_value": "--anonymous-auth=true",
              "scored": true,
              "expected_result": "false"
            },
            {
              "test_number": "1.2.7",
              "test_desc": "Ensure that the --authorization-mode argument includes Node and RBAC (Automated)",
              "audit": "Inspect the kube-apiserver process arguments",
              "type": "Automated",
              "remediation": "Set --authorization-mode=Node,RBAC.",
              "test_info": [],
              "status": "FAIL",
              "actual_value": "--authorization-mode=AlwaysAllow",
              "scored": true,
              "expected_result": "Node,RBAC"
            },
            {
              "test_number": "1.2.21",
              "test_desc": "Ensure that the --service-account-lookup argument is set to true (Automated)",
              "audit": "Inspect the kube-apiserver process arguments",
              "type": "Automated",
              "remediation": "Set --service-account-lookup=true.",
              "test_info": [],
              "status": "PASS",
              "actual_value": "--service-account-lookup=true",
              "scored": true,
              "expected_result": "true"
            },
            {
              "test_number": "1.2.22",
              "test_desc": "Ensure that the audit log path is configured (Manual)",
              "audit": "Review the audit backend path and persistence mounts",
              "type": "Manual",
              "remediation": "Configure a persistent audit log file and verify its host mount.",
              "test_info": ["A non-empty flag alone does not prove persistence."],
              "status": "WARN",
              "actual_value": "--audit-log-path=-",
              "scored": false,
              "expected_result": "persistent file path"
            }
          ]
        }
      ]
    },
    {
      "id": "2",
      "version": "cis-1.11",
      "detected_version": "v1.34.1",
      "text": "etcd Node Configuration",
      "node_type": "etcd",
      "tests": [
        {
          "section": "2",
          "type": "etcd",
          "pass": 1,
          "fail": 2,
          "warn": 0,
          "info": 0,
          "desc": "etcd",
          "results": [
            {
              "test_number": "2.2",
              "test_desc": "Ensure that the --client-cert-auth argument is set to true (Automated)",
              "audit": "Inspect the etcd process arguments",
              "type": "Automated",
              "remediation": "Set --client-cert-auth=true and configure --trusted-ca-file.",
              "test_info": [],
              "status": "FAIL",
              "actual_value": "--client-cert-auth=false",
              "scored": true,
              "expected_result": "true"
            },
            {
              "test_number": "2.3",
              "test_desc": "Ensure that the --auto-tls argument is not set to true (Automated)",
              "audit": "Inspect the etcd process arguments",
              "type": "Automated",
              "remediation": "Set --auto-tls=false and use trusted certificate files.",
              "test_info": [],
              "status": "FAIL",
              "actual_value": "--auto-tls=true",
              "scored": true,
              "expected_result": "false"
            },
            {
              "test_number": "2.4",
              "test_desc": "Ensure that the --peer-client-cert-auth argument is set to true (Automated)",
              "audit": "Inspect the etcd process arguments",
              "type": "Automated",
              "remediation": "Set --peer-client-cert-auth=true.",
              "test_info": [],
              "status": "PASS",
              "actual_value": "--peer-client-cert-auth=true",
              "scored": true,
              "expected_result": "true"
            }
          ]
        }
      ]
    },
    {
      "id": "4",
      "version": "cis-1.11",
      "detected_version": "v1.34.1",
      "text": "Worker Node Security Configuration",
      "node_type": "node",
      "tests": [
        {
          "section": "4.2",
          "type": "node",
          "pass": 1,
          "fail": 3,
          "warn": 0,
          "info": 0,
          "desc": "Kubelet",
          "results": [
            {
              "test_number": "4.2.1",
              "test_desc": "Ensure that anonymous authentication is disabled (Automated)",
              "audit": "Inspect KubeletConfiguration authentication.anonymous.enabled",
              "type": "Automated",
              "remediation": "Set authentication.anonymous.enabled=false.",
              "test_info": [],
              "status": "FAIL",
              "actual_value": "enabled: true",
              "scored": true,
              "expected_result": "false"
            },
            {
              "test_number": "4.2.2",
              "test_desc": "Ensure that webhook authentication is enabled (Automated)",
              "audit": "Inspect KubeletConfiguration authentication.webhook.enabled",
              "type": "Automated",
              "remediation": "Set authentication.webhook.enabled=true.",
              "test_info": [],
              "status": "FAIL",
              "actual_value": "enabled: false",
              "scored": true,
              "expected_result": "true"
            },
            {
              "test_number": "4.2.3",
              "test_desc": "Ensure that the authorization mode is Webhook (Automated)",
              "audit": "Inspect KubeletConfiguration authorization.mode",
              "type": "Automated",
              "remediation": "Set authorization.mode=Webhook.",
              "test_info": [],
              "status": "FAIL",
              "actual_value": "mode: AlwaysAllow",
              "scored": true,
              "expected_result": "Webhook"
            },
            {
              "test_number": "4.2.4",
              "test_desc": "Ensure that the read-only port is disabled (Automated)",
              "audit": "Inspect KubeletConfiguration readOnlyPort",
              "type": "Automated",
              "remediation": "Set readOnlyPort=0.",
              "test_info": [],
              "status": "PASS",
              "actual_value": "readOnlyPort: 0",
              "scored": true,
              "expected_result": "0"
            }
          ]
        }
      ]
    }
  ],
  "Totals": {
    "total_pass": 3,
    "total_fail": 7,
    "total_warn": 1,
    "total_info": 0
  }
}