feat: support node-collector commands and node info

Signed-off-by: chenk <[email protected]>
aquasecurity · May 30, 2024 · 2c09386 · 2c09386
1 parent d25663b
commit 2c09386
Show file tree

Hide file tree

Showing 46 changed files with 91 additions and 1 deletion.
diff --git a/checks/kubernetes/cisbenchmarks/apiserver/admin_conf_ownership.rego b/checks/kubernetes/cisbenchmarks/apiserver/admin_conf_ownership.rego
@@ -15,6 +15,8 @@
 #   input:
 #     selector:
 #     - type: kubernetes
+#		subtypes:
+#         - kind: nodeInfo
 package builtin.kubernetes.KCV0061
 
 import data.lib.kubernetes

diff --git a/checks/kubernetes/cisbenchmarks/apiserver/admin_conf_permission.rego b/checks/kubernetes/cisbenchmarks/apiserver/admin_conf_permission.rego
@@ -15,6 +15,8 @@
 #   input:
 #     selector:
 #     - type: kubernetes
+#		subtypes:
+#         - kind: nodeInfo
 package builtin.kubernetes.KCV0060
 
 import data.lib.kubernetes

diff --git a/checks/kubernetes/cisbenchmarks/apiserver/kubernetes_pki_cert_permission.rego b/checks/kubernetes/cisbenchmarks/apiserver/kubernetes_pki_cert_permission.rego
@@ -15,6 +15,8 @@
 #   input:
 #     selector:
 #     - type: kubernetes
+#		subtypes:
+#         - kind: nodeInfo
 package builtin.kubernetes.KCV0068
 
 import data.lib.kubernetes

diff --git a/checks/kubernetes/cisbenchmarks/apiserver/kubernetes_pki_directory_ownership.rego b/checks/kubernetes/cisbenchmarks/apiserver/kubernetes_pki_directory_ownership.rego
@@ -15,6 +15,8 @@
 #   input:
 #     selector:
 #     - type: kubernetes
+#		subtypes:
+#         - kind: nodeInfo
 package builtin.kubernetes.KCV0066
 
 import data.lib.kubernetes

diff --git a/checks/kubernetes/cisbenchmarks/apiserver/kubernetes_pki_key_permission.rego b/checks/kubernetes/cisbenchmarks/apiserver/kubernetes_pki_key_permission.rego
@@ -15,6 +15,8 @@
 #   input:
 #     selector:
 #     - type: kubernetes
+#		subtypes:
+#         - kind: nodeInfo
 package builtin.kubernetes.KCV0067
 
 import data.lib.kubernetes

diff --git a/checks/kubernetes/cisbenchmarks/apiserver/pod_spec_ownership.rego b/checks/kubernetes/cisbenchmarks/apiserver/pod_spec_ownership.rego
@@ -15,6 +15,8 @@
 #   input:
 #     selector:
 #     - type: kubernetes
+#		subtypes:
+#         - kind: nodeInfo
 package builtin.kubernetes.KCV0049
 
 import data.lib.kubernetes

diff --git a/checks/kubernetes/cisbenchmarks/apiserver/pod_spec_permission.rego b/checks/kubernetes/cisbenchmarks/apiserver/pod_spec_permission.rego
@@ -15,6 +15,8 @@
 #   input:
 #     selector:
 #     - type: kubernetes
+#		subtypes:
+#         - kind: nodeInfo
 package builtin.kubernetes.KCV0048
 
 import data.lib.kubernetes

diff --git a/checks/kubernetes/cisbenchmarks/cni/pod_spec_ownership.rego b/checks/kubernetes/cisbenchmarks/cni/pod_spec_ownership.rego
@@ -15,6 +15,8 @@
 #   input:
 #     selector:
 #     - type: kubernetes
+#		subtypes:
+#         - kind: nodeInfo
 package builtin.kubernetes.KCV0057
 
 import data.lib.kubernetes

diff --git a/checks/kubernetes/cisbenchmarks/cni/pod_spec_permission.rego b/checks/kubernetes/cisbenchmarks/cni/pod_spec_permission.rego
@@ -15,6 +15,8 @@
 #   input:
 #     selector:
 #     - type: kubernetes
+#		subtypes:
+#         - kind: nodeInfo
 package builtin.kubernetes.KCV0056
 
 import data.lib.kubernetes

diff --git a/checks/kubernetes/cisbenchmarks/controllermamager/controller_manager_conf_ownership.rego b/checks/kubernetes/cisbenchmarks/controllermamager/controller_manager_conf_ownership.rego
@@ -15,6 +15,8 @@
 #   input:
 #     selector:
 #     - type: kubernetes
+#		subtypes:
+#         - kind: nodeInfo
 package builtin.kubernetes.KCV0065
 
 import data.lib.kubernetes

diff --git a/checks/kubernetes/cisbenchmarks/controllermamager/controller_manager_conf_permission.rego b/checks/kubernetes/cisbenchmarks/controllermamager/controller_manager_conf_permission.rego
@@ -15,6 +15,8 @@
 #   input:
 #     selector:
 #     - type: kubernetes
+#		subtypes:
+#         - kind: nodeInfo
 package builtin.kubernetes.KCV0064
 
 import data.lib.kubernetes

diff --git a/checks/kubernetes/cisbenchmarks/controllermamager/pod_spec_ownership.rego b/checks/kubernetes/cisbenchmarks/controllermamager/pod_spec_ownership.rego
@@ -15,6 +15,8 @@
 #   input:
 #     selector:
 #     - type: kubernetes
+#		subtypes:
+#         - kind: nodeInfo
 package builtin.kubernetes.KCV0051
 
 import data.lib.kubernetes

diff --git a/checks/kubernetes/cisbenchmarks/controllermamager/pod_spec_permission.rego b/checks/kubernetes/cisbenchmarks/controllermamager/pod_spec_permission.rego
@@ -15,6 +15,8 @@
 #   input:
 #     selector:
 #     - type: kubernetes
+#		subtypes:
+#         - kind: nodeInfo
 package builtin.kubernetes.KCV0050
 
 import data.lib.kubernetes

diff --git a/checks/kubernetes/cisbenchmarks/etcd/data_directory_ownership.rego b/checks/kubernetes/cisbenchmarks/etcd/data_directory_ownership.rego
@@ -15,6 +15,8 @@
 #   input:
 #     selector:
 #     - type: kubernetes
+#		subtypes:
+#         - kind: nodeInfo
 package builtin.kubernetes.KCV0059
 
 import data.lib.kubernetes

diff --git a/checks/kubernetes/cisbenchmarks/etcd/data_directory_permission.rego b/checks/kubernetes/cisbenchmarks/etcd/data_directory_permission.rego
@@ -15,6 +15,8 @@
 #   input:
 #     selector:
 #     - type: kubernetes
+#		subtypes:
+#         - kind: nodeInfo
 package builtin.kubernetes.KCV0058
 
 import data.lib.kubernetes

diff --git a/checks/kubernetes/cisbenchmarks/etcd/pod_spec_ownership.rego b/checks/kubernetes/cisbenchmarks/etcd/pod_spec_ownership.rego
@@ -15,6 +15,8 @@
 #   input:
 #     selector:
 #     - type: kubernetes
+#		subtypes:
+#         - kind: nodeInfo
 package builtin.kubernetes.KCV0055
 
 import data.lib.kubernetes

diff --git a/checks/kubernetes/cisbenchmarks/etcd/pod_spec_permission.rego b/checks/kubernetes/cisbenchmarks/etcd/pod_spec_permission.rego
@@ -15,6 +15,8 @@
 #   input:
 #     selector:
 #     - type: kubernetes
+#		subtypes:
+#         - kind: nodeInfo
 package builtin.kubernetes.KCV0054
 
 import data.lib.kubernetes

diff --git a/checks/kubernetes/cisbenchmarks/kubelet/certificate_authorities_file_ownership.rego b/checks/kubernetes/cisbenchmarks/kubelet/certificate_authorities_file_ownership.rego
@@ -15,6 +15,8 @@
 #   input:
 #     selector:
 #     - type: kubernetes
+#		subtypes:
+#         - kind: nodeInfo
 package builtin.kubernetes.KCV0076
 
 import data.lib.kubernetes

diff --git a/checks/kubernetes/cisbenchmarks/kubelet/certificate_authorities_file_permission.rego b/checks/kubernetes/cisbenchmarks/kubelet/certificate_authorities_file_permission.rego
@@ -15,6 +15,8 @@
 #   input:
 #     selector:
 #     - type: kubernetes
+#		subtypes:
+#         - kind: nodeInfo
 package builtin.kubernetes.KCV0075
 
 import data.lib.kubernetes

diff --git a/checks/kubernetes/cisbenchmarks/kubelet/kubelet_anonymous_auth_argument.rego b/checks/kubernetes/cisbenchmarks/kubelet/kubelet_anonymous_auth_argument.rego
@@ -15,6 +15,8 @@
 #   input:
 #     selector:
 #     - type: kubernetes
+#		subtypes:
+#         - kind: nodeInfo
 package builtin.kubernetes.KCV0079
 
 import data.lib.kubernetes

diff --git a/checks/kubernetes/cisbenchmarks/kubelet/kubelet_authorization_mode_argument.rego b/checks/kubernetes/cisbenchmarks/kubelet/kubelet_authorization_mode_argument.rego
@@ -15,6 +15,8 @@
 #   input:
 #     selector:
 #     - type: kubernetes
+#		subtypes:
+#         - kind: nodeInfo
 package builtin.kubernetes.KCV0080
 
 import data.lib.kubernetes

diff --git a/checks/kubernetes/cisbenchmarks/kubelet/kubelet_client_ca_file_argument.rego b/checks/kubernetes/cisbenchmarks/kubelet/kubelet_client_ca_file_argument.rego
@@ -15,6 +15,8 @@
 #   input:
 #     selector:
 #     - type: kubernetes
+#		subtypes:
+#         - kind: nodeInfo
 package builtin.kubernetes.KCV0081
 
 import data.lib.kubernetes

diff --git a/checks/kubernetes/cisbenchmarks/kubelet/kubelet_config_file_ownership.rego b/checks/kubernetes/cisbenchmarks/kubelet/kubelet_config_file_ownership.rego
@@ -15,6 +15,8 @@
 #   input:
 #     selector:
 #     - type: kubernetes
+#		subtypes:
+#         - kind: nodeInfo
 package builtin.kubernetes.KCV0074
 
 import data.lib.kubernetes

diff --git a/checks/kubernetes/cisbenchmarks/kubelet/kubelet_config_file_permission.rego b/checks/kubernetes/cisbenchmarks/kubelet/kubelet_config_file_permission.rego
@@ -15,6 +15,8 @@
 #   input:
 #     selector:
 #     - type: kubernetes
+#		subtypes:
+#         - kind: nodeInfo
 package builtin.kubernetes.KCV0073
 
 import data.lib.kubernetes

diff --git a/checks/kubernetes/cisbenchmarks/kubelet/kubelet_config_yaml_ownership.rego b/checks/kubernetes/cisbenchmarks/kubelet/kubelet_config_yaml_ownership.rego
@@ -15,6 +15,8 @@
 #   input:
 #     selector:
 #     - type: kubernetes
+#		subtypes:
+#         - kind: nodeInfo
 package builtin.kubernetes.KCV0078
 
 import data.lib.kubernetes

diff --git a/checks/kubernetes/cisbenchmarks/kubelet/kubelet_config_yaml_permission.rego b/checks/kubernetes/cisbenchmarks/kubelet/kubelet_config_yaml_permission.rego
@@ -15,6 +15,8 @@
 #   input:
 #     selector:
 #     - type: kubernetes
+#		subtypes:
+#         - kind: nodeInfo
 package builtin.kubernetes.KCV0077
 
 import data.lib.kubernetes

diff --git a/checks/kubernetes/cisbenchmarks/kubelet/kubelet_event_qps.rego b/checks/kubernetes/cisbenchmarks/kubelet/kubelet_event_qps.rego
@@ -15,6 +15,8 @@
 #   input:
 #     selector:
 #     - type: kubernetes
+#		subtypes:
+#         - kind: nodeInfo
 package builtin.kubernetes.KCV0087
 
 import data.lib.kubernetes

diff --git a/checks/kubernetes/cisbenchmarks/kubelet/kubelet_hostname_override.rego b/checks/kubernetes/cisbenchmarks/kubelet/kubelet_hostname_override.rego
@@ -15,6 +15,8 @@
 #   input:
 #     selector:
 #     - type: kubernetes
+#		subtypes:
+#         - kind: nodeInfo
 package builtin.kubernetes.KCV0086
 
 import data.lib.kubernetes

diff --git a/checks/kubernetes/cisbenchmarks/kubelet/kubelet_make_iptables_util_chains.rego b/checks/kubernetes/cisbenchmarks/kubelet/kubelet_make_iptables_util_chains.rego
@@ -15,6 +15,8 @@
 #   input:
 #     selector:
 #     - type: kubernetes
+#		subtypes:
+#         - kind: nodeInfo
 package builtin.kubernetes.KCV0084
 
 import data.lib.kubernetes

diff --git a/checks/kubernetes/cisbenchmarks/kubelet/kubelet_only_use_strong_cryptographic.rego b/checks/kubernetes/cisbenchmarks/kubelet/kubelet_only_use_strong_cryptographic.rego
@@ -15,6 +15,8 @@
 #   input:
 #     selector:
 #     - type: kubernetes
+#		subtypes:
+#         - kind: nodeInfo
 package builtin.kubernetes.KCV0092
 
 import data.lib.kubernetes

diff --git a/checks/kubernetes/cisbenchmarks/kubelet/kubelet_protect_kernel_defaults.rego b/checks/kubernetes/cisbenchmarks/kubelet/kubelet_protect_kernel_defaults.rego
@@ -15,6 +15,8 @@
 #   input:
 #     selector:
 #     - type: kubernetes
+#		subtypes:
+#         - kind: nodeInfo
 package builtin.kubernetes.KCV0083
 
 import data.lib.kubernetes

diff --git a/checks/kubernetes/cisbenchmarks/kubelet/kubelet_read_only_port_argument.rego b/checks/kubernetes/cisbenchmarks/kubelet/kubelet_read_only_port_argument.rego
@@ -15,6 +15,8 @@
 #   input:
 #     selector:
 #     - type: kubernetes
+#		subtypes:
+#         - kind: nodeInfo
 package builtin.kubernetes.KCV0082
 
 import data.lib.kubernetes

diff --git a/checks/kubernetes/cisbenchmarks/kubelet/kubelet_rotate_certificates.rego b/checks/kubernetes/cisbenchmarks/kubelet/kubelet_rotate_certificates.rego
@@ -15,6 +15,8 @@
 #   input:
 #     selector:
 #     - type: kubernetes
+#		subtypes:
+#         - kind: nodeInfo
 package builtin.kubernetes.KCV0090
 
 import data.lib.kubernetes

diff --git a/checks/kubernetes/cisbenchmarks/kubelet/kubelet_rotate_kubelet_server_certificate.rego b/checks/kubernetes/cisbenchmarks/kubelet/kubelet_rotate_kubelet_server_certificate.rego
@@ -15,6 +15,8 @@
 #   input:
 #     selector:
 #     - type: kubernetes
+#		subtypes:
+#         - kind: nodeInfo
 package builtin.kubernetes.KCV0091
 
 import data.lib.kubernetes

diff --git a/checks/kubernetes/cisbenchmarks/kubelet/kubelet_streaming_connection_argument.rego b/checks/kubernetes/cisbenchmarks/kubelet/kubelet_streaming_connection_argument.rego
@@ -15,6 +15,8 @@
 #   input:
 #     selector:
 #     - type: kubernetes
+#		subtypes:
+#         - kind: nodeInfo
 package builtin.kubernetes.KCV0085
 
 import data.lib.kubernetes

diff --git a/checks/kubernetes/cisbenchmarks/kubelet/kubelet_tls_cert_file.rego b/checks/kubernetes/cisbenchmarks/kubelet/kubelet_tls_cert_file.rego
@@ -15,6 +15,8 @@
 #   input:
 #     selector:
 #     - type: kubernetes
+#		subtypes:
+#         - kind: nodeInfo
 package builtin.kubernetes.KCV0088
 
 import data.lib.kubernetes

diff --git a/checks/kubernetes/cisbenchmarks/kubelet/kubelet_tls_key_file.rego b/checks/kubernetes/cisbenchmarks/kubelet/kubelet_tls_key_file.rego
@@ -15,6 +15,8 @@
 #   input:
 #     selector:
 #     - type: kubernetes
+#		subtypes:
+#         - kind: nodeInfo
 package builtin.kubernetes.KCV0089
 
 import data.lib.kubernetes

diff --git a/checks/kubernetes/cisbenchmarks/kubelet/kublet_service_file_ownership.rego b/checks/kubernetes/cisbenchmarks/kubelet/kublet_service_file_ownership.rego
@@ -15,6 +15,8 @@
 #   input:
 #     selector:
 #     - type: kubernetes
+#		subtypes:
+#         - kind: nodeInfo
 package builtin.kubernetes.KCV0070
 
 import data.lib.kubernetes

diff --git a/checks/kubernetes/cisbenchmarks/kubelet/kublet_service_file_permission.rego b/checks/kubernetes/cisbenchmarks/kubelet/kublet_service_file_permission.rego
@@ -15,6 +15,8 @@
 #   input:
 #     selector:
 #     - type: kubernetes
+#		subtypes:
+#         - kind: nodeInfo
 package builtin.kubernetes.KCV0069
 
 import data.lib.kubernetes

diff --git a/checks/kubernetes/cisbenchmarks/kubelet/proxy_kube_config_file_ownership.rego b/checks/kubernetes/cisbenchmarks/kubelet/proxy_kube_config_file_ownership.rego
@@ -15,6 +15,8 @@
 #   input:
 #     selector:
 #     - type: kubernetes
+#		subtypes:
+#         - kind: nodeInfo
 package builtin.kubernetes.KCV0072
 
 import data.lib.kubernetes

diff --git a/checks/kubernetes/cisbenchmarks/kubelet/proxy_kube_config_file_permission.rego b/checks/kubernetes/cisbenchmarks/kubelet/proxy_kube_config_file_permission.rego
@@ -15,6 +15,8 @@
 #   input:
 #     selector:
 #     - type: kubernetes
+#		subtypes:
+#         - kind: nodeInfo
 package builtin.kubernetes.KCV0071
 
 import data.lib.kubernetes

diff --git a/checks/kubernetes/cisbenchmarks/scheduler/pod_spec_ownership.rego b/checks/kubernetes/cisbenchmarks/scheduler/pod_spec_ownership.rego
@@ -15,6 +15,8 @@
 #   input:
 #     selector:
 #     - type: kubernetes
+#		subtypes:
+#         - kind: nodeInfo
 package builtin.kubernetes.KCV0053
 
 import data.lib.kubernetes

diff --git a/checks/kubernetes/cisbenchmarks/scheduler/pod_spec_permission.rego b/checks/kubernetes/cisbenchmarks/scheduler/pod_spec_permission.rego
@@ -15,6 +15,8 @@
 #   input:
 #     selector:
 #     - type: kubernetes
+#		subtypes:
+#         - kind: nodeInfo
 package builtin.kubernetes.KCV0052
 
 import data.lib.kubernetes

diff --git a/checks/kubernetes/cisbenchmarks/scheduler/scheduler_conf_ownership.rego b/checks/kubernetes/cisbenchmarks/scheduler/scheduler_conf_ownership.rego
@@ -15,6 +15,8 @@
 #   input:
 #     selector:
 #     - type: kubernetes
+#		subtypes:
+#         - kind: nodeInfo
 package builtin.kubernetes.KCV0063
 
 import data.lib.kubernetes