feat: rke2 cis spec support

commands/kubernetes/adminConfFileOwnership.yaml

@@ -6,3 +6,4 @@
   audit: stat -c %U:%G /etc/kubernetes/admin.conf
   platforms:
     - k8s
+    - rke2

commands/kubernetes/adminConfFilePermissions.yaml

@@ -6,3 +6,4 @@
   audit: stat -c %a /etc/kubernetes/admin.conf
   platforms:
     - k8s
+    - rke2

commands/kubernetes/certificateAuthoritiesFileOwnership.yaml

@@ -8,3 +8,4 @@
     /dev/null
   platforms:
     - k8s
+    - rke2

commands/kubernetes/certificateAuthoritiesFilePermissions.yaml

@@ -8,3 +8,4 @@
     /dev/null
   platforms:
     - k8s
+    - rke2

commands/kubernetes/containerNetworkInterfaceFileOwnership.yaml

@@ -6,3 +6,5 @@
   audit: stat -c %U:%G /*/cni/*
   platforms:
     - k8s
+    - rke2
+

commands/kubernetes/containerNetworkInterfaceFilePermissions.yaml

@@ -6,3 +6,4 @@
   audit: stat -c %a /*/cni/*
   platforms:
     - k8s
+    - rke2

commands/kubernetes/controllerManagerConfFileOwnership.yaml

@@ -6,3 +6,4 @@
   audit: stat -c %U:%G $controllermanager.kubeconfig
   platforms:
     - k8s
+    - rke2

commands/kubernetes/controllerManagerConfFilePermissions.yaml

@@ -6,3 +6,4 @@
   audit: stat -c %a $controllermanager.kubeconfig
   platforms:
     - k8s
+    - rke2

commands/kubernetes/etcdDataDirectoryOwnershipRancher.yaml

@@ -0,0 +1,8 @@
+---
+- id: CMD-0046
+  key: etcdDataDirectoryOwnership
+  title: Etcd data directory Ownership
+  nodeType: master
+  audit: stat -c %U:%G /node/var/lib/etcd
+  platforms:
+    - rke2

commands/kubernetes/etcdDataDirectoryPermissionsRancher.yaml

@@ -0,0 +1,8 @@
+---
+- id: CMD-0047
+  key: etcdDataDirectoryPermissions
+  title: Etcd data directory permissions
+  nodeType: master
+  audit: stat -c %a /node/var/lib/etcd
+  platforms:
+    - rke2

commands/kubernetes/kubeAPIServerSpecFileOwnership.yaml

@@ -6,3 +6,4 @@
   audit: stat -c %U:%G $apiserver.confs
   platforms:
     - k8s
+    - rke2

commands/kubernetes/kubeAPIServerSpecFilePermission.yaml

@@ -6,4 +6,5 @@
   audit: stat -c %a $apiserver.confs
   platforms:
     - k8s
+    - rke2
 

commands/kubernetes/kubeControllerManagerSpecFileOwnership.yaml

@@ -6,3 +6,4 @@
   audit: stat -c %U:%G $controllermanager.confs
   platforms:
     - k8s
+    - rke2

commands/kubernetes/kubeControllerManagerSpecFilePermission.yaml

@@ -6,3 +6,4 @@
   audit: stat -c %a $controllermanager.confs
   platforms:
     - k8s
+    - rke2

commands/kubernetes/kubeEtcdSpecFileOwnership.yaml

@@ -6,3 +6,4 @@
   audit: stat -c %U:%G $etcd.confs
   platforms:
     - k8s
+    - rke2

commands/kubernetes/kubeEtcdSpecFilePermission.yaml

@@ -6,3 +6,4 @@
   audit: stat -c %a $etcd.confs
   platforms:
     - k8s
+    - rke2

commands/kubernetes/kubePKIDirectoryFileOwnershipRancher.yaml

@@ -0,0 +1,9 @@
+---
+- id: CMD-0048
+  key: kubePKIDirectoryFileOwnership
+  title: Kubernetes PKI directory and file ownership
+  nodeType: master
+  audit: stat -c %U:%G $(ls -R /node/etc/kubernetes/ssl | awk
+    '/:$/&&f{s=$0;f=0}/:$/&&!f{sub(/:$/,"");s=$0;f=1;next}NF&&f{print s"/"$0 }')
+  platforms:
+    - rke2

commands/kubernetes/kubePKIKeyFilePermissionsRancher.yaml

@@ -0,0 +1,10 @@
+---
+- id: CMD-0050
+  key: kubePKIKeyFilePermissions
+  title: Kubernetes PKI certificate file permissions
+  nodeType: master
+  audit: stat -c %a $(ls -aR /node/etc/kubernetes/ssl | awk
+    '/:$/&&f{s=$0;f=0}/:$/&&!f{sub(/:$/,"");s=$0;f=1;next}NF&&f{print s"/"$0}' |
+    grep \.key$)
+  platforms:
+    - rke

commands/kubernetes/kubeSchedulerSpecFileOwnership.yaml

@@ -6,3 +6,4 @@
   audit: stat -c %U:%G $scheduler.confs
   platforms:
     - k8s
+    - rke2

commands/kubernetes/kubeSchedulerSpecFilePermission.yaml

@@ -6,3 +6,4 @@
   audit: stat -c %a $scheduler.confs
   platforms:
     - k8s
+    - rke2

commands/kubernetes/kubeconfigFileExistsOwnership.yaml

@@ -8,3 +8,4 @@
     2>/dev/null` || echo $output
   platforms:
     - k8s
+    - rke2

commands/kubernetes/kubeconfigFileExistsPermissions.yaml

@@ -8,3 +8,4 @@
     2>/dev/null` || echo $output
   platforms:
     - k8s
+    - rke2

commands/kubernetes/kubeletAnonymousAuthArgumentSet.yaml

@@ -8,3 +8,4 @@
   platforms:
     - k8s
     - eks
+    - rke2

commands/kubernetes/kubeletAuthorizationModeArgumentSet.yaml

@@ -7,3 +7,4 @@
     --authorization-mode=[^"]\S*' | awk -F "=" '{print $2}' |awk 'FNR <= 1'
   platforms:
     - k8s
+    - rke2

commands/kubernetes/kubeletClientCaFileArgumentSet.yaml

@@ -8,3 +8,4 @@
   platforms:
     - k8s
     - eks
+    - rke2

commands/kubernetes/kubeletConfFileOwnership.yaml

@@ -6,3 +6,4 @@
   audit: stat -c %U:%G $kubelet.kubeconfig
   platforms:
     - k8s
+    - rke2

commands/kubernetes/kubeletConfFilePermissions.yaml

@@ -6,3 +6,4 @@
   audit: stat -c %a $kubelet.kubeconfig
   platforms:
     - k8s
+    - rke2

commands/kubernetes/kubeletConfigYamlConfigurationFileOwnership.yaml

@@ -7,3 +7,4 @@
   platforms:
     - k8s
     - eks
+    - rke2

commands/kubernetes/kubeletConfigYamlConfigurationFilePermission.yaml

@@ -7,3 +7,4 @@
   platforms:
     - k8s
     - eks
+    - rke2

commands/kubernetes/kubeletEventQpsArgumentSet.yaml

@@ -7,3 +7,4 @@
     --event-qps=[^"]\S*' | awk -F "=" '{print $2}' |awk 'FNR <= 1'
   platforms:
     - k8s
+    - rke2

commands/kubernetes/kubeletHostnameOverrideArgumentSet.yaml

@@ -7,3 +7,4 @@
     --hostname-override=[^"]\S*' | awk -F "=" '{print $2}' |awk 'FNR <= 1'
   platforms:
     - k8s
+    - rke2

commands/kubernetes/kubeletMakeIptablesUtilChainsArgumentSet.yaml

@@ -9,3 +9,4 @@
   platforms:
     - k8s
     - eks
+    - rke2

commands/kubernetes/kubeletOnlyUseStrongCryptographic.yaml

@@ -7,3 +7,4 @@
     'TLSCipherSuites=[^"]\S*' | awk -F "=" '{print $2}' |awk 'FNR <= 1'
   platforms:
     - k8s
+    - rke2

commands/kubernetes/kubeletProtectKernelDefaultsArgumentSet.yaml

@@ -8,3 +8,4 @@
     1'
   platforms:
     - k8s
+    - rke2

commands/kubernetes/kubeletReadOnlyPortArgumentSet.yaml

@@ -8,3 +8,4 @@
   platforms:
     - k8s
     - eks
+    - rke2

commands/kubernetes/kubeletRotateCertificatesArgumentSet.yaml

@@ -8,3 +8,4 @@
   platforms:
     - k8s
     - eks
+    - rke2

commands/kubernetes/kubeletRotateKubeletServerCertificateArgumentSet.yaml

@@ -9,3 +9,4 @@
   platforms:
     - k8s
     - eks
+    - rke2

commands/kubernetes/kubeletServiceFileOwnership.yaml

@@ -7,3 +7,4 @@
   platforms:
     - k8s
     - eks
+    - rke2

commands/kubernetes/kubeletServiceFilePermissions.yaml

@@ -6,3 +6,4 @@
   audit: stat -c %a $kubelet.svc
   platforms:
     - k8s
+    - rke2

commands/kubernetes/kubeletStreamingConnectionIdleTimeoutArgumentSet.yaml

@@ -9,3 +9,4 @@
   platforms:
     - k8s
     - eks
+    - rke2

commands/kubernetes/kubeletTlsCertFileTlsArgumentSet.yaml

@@ -7,3 +7,4 @@
     --tls-cert-file=[^"]\S*' | awk -F "=" '{print $2}' |awk 'FNR <= 1'
   platforms:
     - k8s
+    - rke2

commands/kubernetes/kubeletTlsPrivateKeyFileArgumentSet.yaml

@@ -7,3 +7,4 @@
     --tls-private-key-file=[^"]\S*' | awk -F "=" '{print $2}' |awk 'FNR <= 1'
   platforms:
     - k8s
+    - rke2

commands/kubernetes/kubernetesPKICertificateFilePermissionsRancher.yaml

@@ -0,0 +1,10 @@
+---
+- id: CMD-0049
+  key: kubernetesPKICertificateFilePermissions
+  title: Kubernetes PKI certificate file permissions
+  nodeType: master
+  audit: stat -c %a $(ls -aR /node/etc/kubernetes/ssl |
+    awk'/:$/&&f{s=$0;f=0}/:$/&&!f{sub(/:$/,"");s=$0;f=1;next}NF&&f{print
+    s"/"$0}' | grep \.crt$)
+  platforms:
+    - rke2

commands/kubernetes/schedulerConfFileOwnership.yaml

@@ -6,3 +6,4 @@
   audit: stat -c %U:%G $scheduler.kubeconfig
   platforms:
     - k8s
+    - rke2

commands/kubernetes/schedulerConfFilePermissions.yaml

@@ -6,3 +6,4 @@
   audit: stat -c %a $scheduler.kubeconfig
   platforms:
     - k8s
+    - rke2