feat: rke2 cis spec support

Signed-off-by: chenk <[email protected]>
aquasecurity · Jun 13, 2024 · 924ddef · 924ddef
1 parent f13fa71
commit 924ddef
Show file tree

Hide file tree

Showing 46 changed files with 91 additions and 5 deletions.
diff --git a/commands/kubernetes/adminConfFileOwnership.yaml b/commands/kubernetes/adminConfFileOwnership.yaml
@@ -6,3 +6,4 @@
   audit: stat -c %U:%G /etc/kubernetes/admin.conf
   platforms:
     - k8s
+    - rke2
diff --git a/commands/kubernetes/adminConfFilePermissions.yaml b/commands/kubernetes/adminConfFilePermissions.yaml
@@ -6,3 +6,4 @@
   audit: stat -c %a /etc/kubernetes/admin.conf
   platforms:
     - k8s
+    - rke2
diff --git a/commands/kubernetes/certificateAuthoritiesFileOwnership.yaml b/commands/kubernetes/certificateAuthoritiesFileOwnership.yaml
@@ -8,3 +8,4 @@
     /dev/null
   platforms:
     - k8s
+    - rke2
diff --git a/commands/kubernetes/certificateAuthoritiesFilePermissions.yaml b/commands/kubernetes/certificateAuthoritiesFilePermissions.yaml
@@ -8,3 +8,4 @@
     /dev/null
   platforms:
     - k8s
+    - rke2
diff --git a/commands/kubernetes/containerNetworkInterfaceFileOwnership.yaml b/commands/kubernetes/containerNetworkInterfaceFileOwnership.yaml
@@ -6,3 +6,5 @@
   audit: stat -c %U:%G /*/cni/*
   platforms:
     - k8s
+    - rke2
+
diff --git a/commands/kubernetes/containerNetworkInterfaceFilePermissions.yaml b/commands/kubernetes/containerNetworkInterfaceFilePermissions.yaml
@@ -6,3 +6,4 @@
   audit: stat -c %a /*/cni/*
   platforms:
     - k8s
+    - rke2
diff --git a/commands/kubernetes/controllerManagerConfFileOwnership.yaml b/commands/kubernetes/controllerManagerConfFileOwnership.yaml
@@ -6,3 +6,4 @@
   audit: stat -c %U:%G $controllermanager.kubeconfig
   platforms:
     - k8s
+    - rke2
diff --git a/commands/kubernetes/controllerManagerConfFilePermissions.yaml b/commands/kubernetes/controllerManagerConfFilePermissions.yaml
@@ -6,3 +6,4 @@
   audit: stat -c %a $controllermanager.kubeconfig
   platforms:
     - k8s
+    - rke2
diff --git a/commands/kubernetes/etcdDataDirectoryOwnershipRancher.yaml b/commands/kubernetes/etcdDataDirectoryOwnershipRancher.yaml
@@ -0,0 +1,8 @@
+---
+- id: CMD-0046
+  key: etcdDataDirectoryOwnership
+  title: Etcd data directory Ownership
+  nodeType: master
+  audit: stat -c %U:%G /node/var/lib/etcd
+  platforms:
+    - rke2
diff --git a/commands/kubernetes/etcdDataDirectoryPermissionsRancher.yaml b/commands/kubernetes/etcdDataDirectoryPermissionsRancher.yaml
@@ -0,0 +1,8 @@
+---
+- id: CMD-0047
+  key: etcdDataDirectoryPermissions
+  title: Etcd data directory permissions
+  nodeType: master
+  audit: stat -c %a /node/var/lib/etcd
+  platforms:
+    - rke2
diff --git a/commands/kubernetes/kubeAPIServerSpecFileOwnership.yaml b/commands/kubernetes/kubeAPIServerSpecFileOwnership.yaml
@@ -6,3 +6,4 @@
   audit: stat -c %U:%G $apiserver.confs
   platforms:
     - k8s
+    - rke2
diff --git a/commands/kubernetes/kubeAPIServerSpecFilePermission.yaml b/commands/kubernetes/kubeAPIServerSpecFilePermission.yaml
@@ -6,4 +6,5 @@
   audit: stat -c %a $apiserver.confs
   platforms:
     - k8s
+    - rke2
 
diff --git a/commands/kubernetes/kubeControllerManagerSpecFileOwnership.yaml b/commands/kubernetes/kubeControllerManagerSpecFileOwnership.yaml
@@ -6,3 +6,4 @@
   audit: stat -c %U:%G $controllermanager.confs
   platforms:
     - k8s
+    - rke2
diff --git a/commands/kubernetes/kubeControllerManagerSpecFilePermission.yaml b/commands/kubernetes/kubeControllerManagerSpecFilePermission.yaml
@@ -6,3 +6,4 @@
   audit: stat -c %a $controllermanager.confs
   platforms:
     - k8s
+    - rke2
diff --git a/commands/kubernetes/kubeEtcdSpecFileOwnership.yaml b/commands/kubernetes/kubeEtcdSpecFileOwnership.yaml
@@ -6,3 +6,4 @@
   audit: stat -c %U:%G $etcd.confs
   platforms:
     - k8s
+    - rke2
diff --git a/commands/kubernetes/kubeEtcdSpecFilePermission.yaml b/commands/kubernetes/kubeEtcdSpecFilePermission.yaml
@@ -6,3 +6,4 @@
   audit: stat -c %a $etcd.confs
   platforms:
     - k8s
+    - rke2
diff --git a/commands/kubernetes/kubePKIDirectoryFileOwnershipRancher.yaml b/commands/kubernetes/kubePKIDirectoryFileOwnershipRancher.yaml
@@ -0,0 +1,9 @@
+---
+- id: CMD-0048
+  key: kubePKIDirectoryFileOwnership
+  title: Kubernetes PKI directory and file ownership
+  nodeType: master
+  audit: stat -c %U:%G $(ls -R /node/etc/kubernetes/ssl | awk
+    '/:$/&&f{s=$0;f=0}/:$/&&!f{sub(/:$/,"");s=$0;f=1;next}NF&&f{print s"/"$0 }')
+  platforms:
+    - rke2
diff --git a/commands/kubernetes/kubePKIKeyFilePermissionsRancher.yaml b/commands/kubernetes/kubePKIKeyFilePermissionsRancher.yaml
@@ -0,0 +1,10 @@
+---
+- id: CMD-0050
+  key: kubePKIKeyFilePermissions
+  title: Kubernetes PKI certificate file permissions
+  nodeType: master
+  audit: stat -c %a $(ls -aR /node/etc/kubernetes/ssl | awk
+    '/:$/&&f{s=$0;f=0}/:$/&&!f{sub(/:$/,"");s=$0;f=1;next}NF&&f{print s"/"$0}' |
+    grep \.key$)
+  platforms:
+    - rke
diff --git a/commands/kubernetes/kubeSchedulerSpecFileOwnership.yaml b/commands/kubernetes/kubeSchedulerSpecFileOwnership.yaml
@@ -6,3 +6,4 @@
   audit: stat -c %U:%G $scheduler.confs
   platforms:
     - k8s
+    - rke2
diff --git a/commands/kubernetes/kubeSchedulerSpecFilePermission.yaml b/commands/kubernetes/kubeSchedulerSpecFilePermission.yaml
@@ -6,3 +6,4 @@
   audit: stat -c %a $scheduler.confs
   platforms:
     - k8s
+    - rke2
diff --git a/commands/kubernetes/kubeconfigFileExistsOwnership.yaml b/commands/kubernetes/kubeconfigFileExistsOwnership.yaml
@@ -8,3 +8,4 @@
     2>/dev/null` || echo $output
   platforms:
     - k8s
+    - rke2
diff --git a/commands/kubernetes/kubeconfigFileExistsPermissions.yaml b/commands/kubernetes/kubeconfigFileExistsPermissions.yaml
@@ -8,3 +8,4 @@
     2>/dev/null` || echo $output
   platforms:
     - k8s
+    - rke2
diff --git a/commands/kubernetes/kubeletAnonymousAuthArgumentSet.yaml b/commands/kubernetes/kubeletAnonymousAuthArgumentSet.yaml
@@ -8,3 +8,4 @@
   platforms:
     - k8s
     - eks
+    - rke2
diff --git a/commands/kubernetes/kubeletAuthorizationModeArgumentSet.yaml b/commands/kubernetes/kubeletAuthorizationModeArgumentSet.yaml
@@ -7,3 +7,4 @@
     --authorization-mode=[^"]\S*' | awk -F "=" '{print $2}' |awk 'FNR <= 1'
   platforms:
     - k8s
+    - rke2
diff --git a/commands/kubernetes/kubeletClientCaFileArgumentSet.yaml b/commands/kubernetes/kubeletClientCaFileArgumentSet.yaml
@@ -8,3 +8,4 @@
   platforms:
     - k8s
     - eks
+    - rke2
diff --git a/commands/kubernetes/kubeletConfFileOwnership.yaml b/commands/kubernetes/kubeletConfFileOwnership.yaml
@@ -6,3 +6,4 @@
   audit: stat -c %U:%G $kubelet.kubeconfig
   platforms:
     - k8s
+    - rke2
diff --git a/commands/kubernetes/kubeletConfFilePermissions.yaml b/commands/kubernetes/kubeletConfFilePermissions.yaml
@@ -6,3 +6,4 @@
   audit: stat -c %a $kubelet.kubeconfig
   platforms:
     - k8s
+    - rke2
diff --git a/commands/kubernetes/kubeletConfigYamlConfigurationFileOwnership.yaml b/commands/kubernetes/kubeletConfigYamlConfigurationFileOwnership.yaml
@@ -7,3 +7,4 @@
   platforms:
     - k8s
     - eks
+    - rke2
diff --git a/commands/kubernetes/kubeletConfigYamlConfigurationFilePermission.yaml b/commands/kubernetes/kubeletConfigYamlConfigurationFilePermission.yaml
@@ -7,3 +7,4 @@
   platforms:
     - k8s
     - eks
+    - rke2
diff --git a/commands/kubernetes/kubeletEventQpsArgumentSet.yaml b/commands/kubernetes/kubeletEventQpsArgumentSet.yaml
@@ -7,3 +7,4 @@
     --event-qps=[^"]\S*' | awk -F "=" '{print $2}' |awk 'FNR <= 1'
   platforms:
     - k8s
+    - rke2
diff --git a/commands/kubernetes/kubeletHostnameOverrideArgumentSet.yaml b/commands/kubernetes/kubeletHostnameOverrideArgumentSet.yaml
@@ -7,3 +7,4 @@
     --hostname-override=[^"]\S*' | awk -F "=" '{print $2}' |awk 'FNR <= 1'
   platforms:
     - k8s
+    - rke2
diff --git a/commands/kubernetes/kubeletMakeIptablesUtilChainsArgumentSet.yaml b/commands/kubernetes/kubeletMakeIptablesUtilChainsArgumentSet.yaml
@@ -9,3 +9,4 @@
   platforms:
     - k8s
     - eks
+    - rke2
diff --git a/commands/kubernetes/kubeletOnlyUseStrongCryptographic.yaml b/commands/kubernetes/kubeletOnlyUseStrongCryptographic.yaml
@@ -7,3 +7,4 @@
     'TLSCipherSuites=[^"]\S*' | awk -F "=" '{print $2}' |awk 'FNR <= 1'
   platforms:
     - k8s
+    - rke2
diff --git a/commands/kubernetes/kubeletProtectKernelDefaultsArgumentSet.yaml b/commands/kubernetes/kubeletProtectKernelDefaultsArgumentSet.yaml
@@ -8,3 +8,4 @@
     1'
   platforms:
     - k8s
+    - rke2
diff --git a/commands/kubernetes/kubeletReadOnlyPortArgumentSet.yaml b/commands/kubernetes/kubeletReadOnlyPortArgumentSet.yaml
@@ -8,3 +8,4 @@
   platforms:
     - k8s
     - eks
+    - rke2
diff --git a/commands/kubernetes/kubeletRotateCertificatesArgumentSet.yaml b/commands/kubernetes/kubeletRotateCertificatesArgumentSet.yaml
@@ -8,3 +8,4 @@
   platforms:
     - k8s
     - eks
+    - rke2
diff --git a/commands/kubernetes/kubeletRotateKubeletServerCertificateArgumentSet.yaml b/commands/kubernetes/kubeletRotateKubeletServerCertificateArgumentSet.yaml
@@ -9,3 +9,4 @@
   platforms:
     - k8s
     - eks
+    - rke2
diff --git a/commands/kubernetes/kubeletServiceFileOwnership.yaml b/commands/kubernetes/kubeletServiceFileOwnership.yaml
@@ -7,3 +7,4 @@
   platforms:
     - k8s
     - eks
+    - rke2
diff --git a/commands/kubernetes/kubeletServiceFilePermissions.yaml b/commands/kubernetes/kubeletServiceFilePermissions.yaml
@@ -6,3 +6,4 @@
   audit: stat -c %a $kubelet.svc
   platforms:
     - k8s
+    - rke2
diff --git a/commands/kubernetes/kubeletStreamingConnectionIdleTimeoutArgumentSet.yaml b/commands/kubernetes/kubeletStreamingConnectionIdleTimeoutArgumentSet.yaml
@@ -9,3 +9,4 @@
   platforms:
     - k8s
     - eks
+    - rke2
diff --git a/commands/kubernetes/kubeletTlsCertFileTlsArgumentSet.yaml b/commands/kubernetes/kubeletTlsCertFileTlsArgumentSet.yaml
@@ -7,3 +7,4 @@
     --tls-cert-file=[^"]\S*' | awk -F "=" '{print $2}' |awk 'FNR <= 1'
   platforms:
     - k8s
+    - rke2
diff --git a/commands/kubernetes/kubeletTlsPrivateKeyFileArgumentSet.yaml b/commands/kubernetes/kubeletTlsPrivateKeyFileArgumentSet.yaml
@@ -7,3 +7,4 @@
     --tls-private-key-file=[^"]\S*' | awk -F "=" '{print $2}' |awk 'FNR <= 1'
   platforms:
     - k8s
+    - rke2
diff --git a/commands/kubernetes/kubernetesPKICertificateFilePermissionsRancher.yaml b/commands/kubernetes/kubernetesPKICertificateFilePermissionsRancher.yaml
@@ -0,0 +1,10 @@
+---
+- id: CMD-0049
+  key: kubernetesPKICertificateFilePermissions
+  title: Kubernetes PKI certificate file permissions
+  nodeType: master
+  audit: stat -c %a $(ls -aR /node/etc/kubernetes/ssl |
+    awk'/:$/&&f{s=$0;f=0}/:$/&&!f{sub(/:$/,"");s=$0;f=1;next}NF&&f{print
+    s"/"$0}' | grep \.crt$)
+  platforms:
+    - rke2
diff --git a/commands/kubernetes/schedulerConfFileOwnership.yaml b/commands/kubernetes/schedulerConfFileOwnership.yaml
@@ -6,3 +6,4 @@
   audit: stat -c %U:%G $scheduler.kubeconfig
   platforms:
     - k8s
+    - rke2
diff --git a/commands/kubernetes/schedulerConfFilePermissions.yaml b/commands/kubernetes/schedulerConfFilePermissions.yaml
@@ -6,3 +6,4 @@
   audit: stat -c %a $scheduler.kubeconfig
   platforms:
     - k8s
+    - rke2
diff --git a/specs/compliance/rke2-cis-1.24.yaml b/specs/compliance/rke2-cis-1.24.yaml
@@ -114,15 +114,15 @@ spec:
       checks:
         - id: AVD-KCV-0058
       commands:
-        - id: CMD-0011
+        - id: CMD-0047
       severity: HIGH
     - id: 1.1.12
       name: Ensure that the etcd data directory ownership is set to etcd:etcd
       description: Ensure that the etcd data directory ownership is set to etcd:etcd
       checks:
         - id: AVD-KCV-0059
       commands:
-        - id: CMD-0012
+        - id: CMD-0046
       severity: LOW
     - id: 1.1.13
       name: Ensure that the admin.conf file permissions are set to 600
@@ -185,7 +185,7 @@ spec:
       checks:
         - id: AVD-KCV-0066
       commands:
-        - id: CMD-0019
+        - id: CMD-0048
       severity: CRITICAL
     - id: 1.1.20
       name: Ensure that the Kubernetes PKI certificate file permissions are set to 600
@@ -195,15 +195,15 @@ spec:
       checks:
         - id: AVD-KCV-0068
       commands:
-        - id: CMD-0020
+        - id: CMD-0049
       severity: CRITICAL
     - id: 1.1.21
       name: Ensure that the Kubernetes PKI key file permissions are set to 600
       description: Ensure that Kubernetes PKI key files have permissions of 600
       checks:
         - id: AVD-KCV-0067
       commands:
-        - id: CMD-0021
+        - id: CMD-0050
       severity: CRITICAL
     - id: 1.2.1
       name: Ensure that the --anonymous-auth argument is set to false