203 lines
7.2 KiB
JSON
203 lines
7.2 KiB
JSON
{
|
|
"Controls": [
|
|
{
|
|
"id": "1",
|
|
"version": "cis-1.11",
|
|
"detected_version": "v1.34.1",
|
|
"text": "Control Plane Security Configuration",
|
|
"node_type": "master",
|
|
"tests": [
|
|
{
|
|
"section": "1.2",
|
|
"type": "controlplane",
|
|
"pass": 1,
|
|
"fail": 2,
|
|
"warn": 1,
|
|
"info": 0,
|
|
"desc": "API Server",
|
|
"results": [
|
|
{
|
|
"test_number": "1.2.1",
|
|
"test_desc": "Ensure that the --anonymous-auth argument is set to false (Automated)",
|
|
"audit": "Inspect the kube-apiserver process arguments",
|
|
"type": "Automated",
|
|
"remediation": "Set --anonymous-auth=false in the kube-apiserver static Pod manifest.",
|
|
"test_info": [],
|
|
"status": "FAIL",
|
|
"actual_value": "--anonymous-auth=true",
|
|
"scored": true,
|
|
"expected_result": "false"
|
|
},
|
|
{
|
|
"test_number": "1.2.7",
|
|
"test_desc": "Ensure that the --authorization-mode argument includes Node and RBAC (Automated)",
|
|
"audit": "Inspect the kube-apiserver process arguments",
|
|
"type": "Automated",
|
|
"remediation": "Set --authorization-mode=Node,RBAC.",
|
|
"test_info": [],
|
|
"status": "FAIL",
|
|
"actual_value": "--authorization-mode=AlwaysAllow",
|
|
"scored": true,
|
|
"expected_result": "Node,RBAC"
|
|
},
|
|
{
|
|
"test_number": "1.2.21",
|
|
"test_desc": "Ensure that the --service-account-lookup argument is set to true (Automated)",
|
|
"audit": "Inspect the kube-apiserver process arguments",
|
|
"type": "Automated",
|
|
"remediation": "Set --service-account-lookup=true.",
|
|
"test_info": [],
|
|
"status": "PASS",
|
|
"actual_value": "--service-account-lookup=true",
|
|
"scored": true,
|
|
"expected_result": "true"
|
|
},
|
|
{
|
|
"test_number": "1.2.22",
|
|
"test_desc": "Ensure that the audit log path is configured (Manual)",
|
|
"audit": "Review the audit backend path and persistence mounts",
|
|
"type": "Manual",
|
|
"remediation": "Configure a persistent audit log file and verify its host mount.",
|
|
"test_info": ["A non-empty flag alone does not prove persistence."],
|
|
"status": "WARN",
|
|
"actual_value": "--audit-log-path=-",
|
|
"scored": false,
|
|
"expected_result": "persistent file path"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"id": "2",
|
|
"version": "cis-1.11",
|
|
"detected_version": "v1.34.1",
|
|
"text": "etcd Node Configuration",
|
|
"node_type": "etcd",
|
|
"tests": [
|
|
{
|
|
"section": "2",
|
|
"type": "etcd",
|
|
"pass": 1,
|
|
"fail": 2,
|
|
"warn": 0,
|
|
"info": 0,
|
|
"desc": "etcd",
|
|
"results": [
|
|
{
|
|
"test_number": "2.2",
|
|
"test_desc": "Ensure that the --client-cert-auth argument is set to true (Automated)",
|
|
"audit": "Inspect the etcd process arguments",
|
|
"type": "Automated",
|
|
"remediation": "Set --client-cert-auth=true and configure --trusted-ca-file.",
|
|
"test_info": [],
|
|
"status": "FAIL",
|
|
"actual_value": "--client-cert-auth=false",
|
|
"scored": true,
|
|
"expected_result": "true"
|
|
},
|
|
{
|
|
"test_number": "2.3",
|
|
"test_desc": "Ensure that the --auto-tls argument is not set to true (Automated)",
|
|
"audit": "Inspect the etcd process arguments",
|
|
"type": "Automated",
|
|
"remediation": "Set --auto-tls=false and use trusted certificate files.",
|
|
"test_info": [],
|
|
"status": "FAIL",
|
|
"actual_value": "--auto-tls=true",
|
|
"scored": true,
|
|
"expected_result": "false"
|
|
},
|
|
{
|
|
"test_number": "2.4",
|
|
"test_desc": "Ensure that the --peer-client-cert-auth argument is set to true (Automated)",
|
|
"audit": "Inspect the etcd process arguments",
|
|
"type": "Automated",
|
|
"remediation": "Set --peer-client-cert-auth=true.",
|
|
"test_info": [],
|
|
"status": "PASS",
|
|
"actual_value": "--peer-client-cert-auth=true",
|
|
"scored": true,
|
|
"expected_result": "true"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"id": "4",
|
|
"version": "cis-1.11",
|
|
"detected_version": "v1.34.1",
|
|
"text": "Worker Node Security Configuration",
|
|
"node_type": "node",
|
|
"tests": [
|
|
{
|
|
"section": "4.2",
|
|
"type": "node",
|
|
"pass": 1,
|
|
"fail": 3,
|
|
"warn": 0,
|
|
"info": 0,
|
|
"desc": "Kubelet",
|
|
"results": [
|
|
{
|
|
"test_number": "4.2.1",
|
|
"test_desc": "Ensure that anonymous authentication is disabled (Automated)",
|
|
"audit": "Inspect KubeletConfiguration authentication.anonymous.enabled",
|
|
"type": "Automated",
|
|
"remediation": "Set authentication.anonymous.enabled=false.",
|
|
"test_info": [],
|
|
"status": "FAIL",
|
|
"actual_value": "enabled: true",
|
|
"scored": true,
|
|
"expected_result": "false"
|
|
},
|
|
{
|
|
"test_number": "4.2.2",
|
|
"test_desc": "Ensure that webhook authentication is enabled (Automated)",
|
|
"audit": "Inspect KubeletConfiguration authentication.webhook.enabled",
|
|
"type": "Automated",
|
|
"remediation": "Set authentication.webhook.enabled=true.",
|
|
"test_info": [],
|
|
"status": "FAIL",
|
|
"actual_value": "enabled: false",
|
|
"scored": true,
|
|
"expected_result": "true"
|
|
},
|
|
{
|
|
"test_number": "4.2.3",
|
|
"test_desc": "Ensure that the authorization mode is Webhook (Automated)",
|
|
"audit": "Inspect KubeletConfiguration authorization.mode",
|
|
"type": "Automated",
|
|
"remediation": "Set authorization.mode=Webhook.",
|
|
"test_info": [],
|
|
"status": "FAIL",
|
|
"actual_value": "mode: AlwaysAllow",
|
|
"scored": true,
|
|
"expected_result": "Webhook"
|
|
},
|
|
{
|
|
"test_number": "4.2.4",
|
|
"test_desc": "Ensure that the read-only port is disabled (Automated)",
|
|
"audit": "Inspect KubeletConfiguration readOnlyPort",
|
|
"type": "Automated",
|
|
"remediation": "Set readOnlyPort=0.",
|
|
"test_info": [],
|
|
"status": "PASS",
|
|
"actual_value": "readOnlyPort: 0",
|
|
"scored": true,
|
|
"expected_result": "0"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"Totals": {
|
|
"total_pass": 3,
|
|
"total_fail": 7,
|
|
"total_warn": 1,
|
|
"total_info": 0
|
|
}
|
|
}
|