Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add CIS benchmark checks for generating a Kubernetes compliance report #3239

Merged
merged 23 commits into from
Sep 5, 2023
Merged

Add CIS benchmark checks for generating a Kubernetes compliance report #3239

merged 23 commits into from
Sep 5, 2023

Commits on Sep 5, 2023

  1. bloodhound: Add base Kubernetes checker binary 

    This adds a multicall binary to be used as the common entry point for
all Kubernetes CIS benchmark checks.

Signed-off-by: Sean McGinnis <[email protected]>
    @stmcginnis
    stmcginnis committed Sep 5, 2023
    2 Configuration menu
    Copy the full SHA
    76b8b54 View commit details
    Browse the repository at this point in the history

  2. bloodhound: Add Kubernetes 4.1.1 check 

    This adds the 4.1.1 check to verify the kubelet service file has
restrictive permissions.

Signed-off-by: Sean McGinnis <[email protected]>
    @stmcginnis
    stmcginnis committed Sep 5, 2023
    Configuration menu
    Copy the full SHA
    d54fe47 View commit details
    Browse the repository at this point in the history

  3. bloodhound: Add Kubernetes 4.1.2 check 

    This adds the 4.1.2 check to make sure the kubelet service file
ownership is root:root.

Signed-off-by: Sean McGinnis <[email protected]>
    @stmcginnis
    stmcginnis committed Sep 5, 2023
    Configuration menu
    Copy the full SHA
    efad077 View commit details
    Browse the repository at this point in the history

  4. bloodhound: Add Kubernetes 4.1.5 check 

    This adds the 4.1.5 check to ensure the kubelet.conf file has
restrictive permissions.

Signed-off-by: Sean McGinnis <[email protected]>
    @stmcginnis
    stmcginnis committed Sep 5, 2023
    Configuration menu
    Copy the full SHA
    a23d4f9 View commit details
    Browse the repository at this point in the history

  5. bloodhound: Add Kubernetes 4.1.6 check 

    This adds the 4.1.6 check to verify kubelet.conf is owned by root:root.

Signed-off-by: Sean McGinnis <[email protected]>
    @stmcginnis
    stmcginnis committed Sep 5, 2023
    Configuration menu
    Copy the full SHA
    40c2285 View commit details
    Browse the repository at this point in the history

  6. bloodhound: Add Kubernetes 4.1.7 check 

    This adds the 4.1.7 check to verify the kubelet CA file has restrictive
permissions.

Signed-off-by: Sean McGinnis <[email protected]>
    @stmcginnis
    stmcginnis committed Sep 5, 2023
    Configuration menu
    Copy the full SHA
    ebe394c View commit details
    Browse the repository at this point in the history

  7. bloodhound: Add Kubernetes 4.1.8 check 

    This adds check 4.1.8 to verify the kubelet CA file is owned by
root:root.

Signed-off-by: Sean McGinnis <[email protected]>
    @stmcginnis
    stmcginnis committed Sep 5, 2023
    Configuration menu
    Copy the full SHA
    f767fca View commit details
    Browse the repository at this point in the history

  8. bloodhound: Add Kubernetes 4.1.9 check 

    This adds the 4.1.9 check to verify the kubelet configuration file has
restrictive permissions.

Signed-off-by: Sean McGinnis <[email protected]>
    @stmcginnis
    stmcginnis committed Sep 5, 2023
    Configuration menu
    Copy the full SHA
    a6ae3a0 View commit details
    Browse the repository at this point in the history

  9. bloodhound: Add Kubernetes 4.1.10 check 

    This adds check 4.1.10 to verify the kubelet config file is owned by
root:root.

Signed-off-by: Sean McGinnis <[email protected]>
    @stmcginnis
    stmcginnis committed Sep 5, 2023
    Configuration menu
    Copy the full SHA
    7b950ef View commit details
    Browse the repository at this point in the history

  10. bloodhound: Add Kubernetes 4.2.1 check 

    This adds check 4.2.1 to verify anonymous auth is not enabled.

Signed-off-by: Sean McGinnis <[email protected]>
    @stmcginnis
    stmcginnis committed Sep 5, 2023
    Configuration menu
    Copy the full SHA
    dc59983 View commit details
    Browse the repository at this point in the history

  11. bloodhound: Add Kubernetes 4.2.2 check 

    This adds check 4.2.2 to verify authorization mode is not set to
AlwaysAllow.

Signed-off-by: Sean McGinnis <[email protected]>
    @stmcginnis
    stmcginnis committed Sep 5, 2023
    Configuration menu
    Copy the full SHA
    f5c4107 View commit details
    Browse the repository at this point in the history

  12. bloodhound: Add Kubernetes 4.2.3 check 

    This adds check 4.2.3 to verify clientCAFile is configured and points to
an actual file.

Signed-off-by: Sean McGinnis <[email protected]>
    @stmcginnis
    stmcginnis committed Sep 5, 2023
    Configuration menu
    Copy the full SHA
    409a6cd View commit details
    Browse the repository at this point in the history

  13. bloodhound: Add Kubernetes 4.2.4 check 

    This adds the 4.2.4 to verify the readOnlyPort is not set to 0.

Signed-off-by: Sean McGinnis <[email protected]>
    @stmcginnis
    stmcginnis committed Sep 5, 2023
    Configuration menu
    Copy the full SHA
    124420b View commit details
    Browse the repository at this point in the history

  14. bloodhound: Add Kubernetes 4.2.5 check 

    This adds check 4.2.5 to verify streamingConnectionIdleTimeout is not
set to 0.

Signed-off-by: Sean McGinnis <[email protected]>
    @stmcginnis
    stmcginnis committed Sep 5, 2023
    Configuration menu
    Copy the full SHA
    d897d7b View commit details
    Browse the repository at this point in the history

  15. bloodhound: Add Kubernetes 4.2.6 check 

    This adds check 4.2.6 to verify makeIPTablesUtilChains is true.

Signed-off-by: Sean McGinnis <[email protected]>
    @stmcginnis
    stmcginnis committed Sep 5, 2023
    Configuration menu
    Copy the full SHA
    13fb801 View commit details
    Browse the repository at this point in the history

  16. bloodhound: Add Kubernetes 4.2.9 check 

    This adds the check to make sure the server TLS certificates are
configured correctly.

Signed-off-by: Sean McGinnis <[email protected]>
    @stmcginnis
    stmcginnis committed Sep 5, 2023
    Configuration menu
    Copy the full SHA
    8591741 View commit details
    Browse the repository at this point in the history

  17. bloodhound: Add Kubernetes 4.2.10 check 

    This adds check 4.2.10 to verify rotateCertificates is not disabled.

Signed-off-by: Sean McGinnis <[email protected]>
    @stmcginnis
    stmcginnis committed Sep 5, 2023
    Configuration menu
    Copy the full SHA
    32ccf06 View commit details
    Browse the repository at this point in the history

  18. bloodhound: Add Kubernetes 4.2.11 check 

    This adds check 4.2.11 to verify RotateKubeletServerCertificate is not
disabled.

Signed-off-by: Sean McGinnis <[email protected]>
    @stmcginnis
    stmcginnis committed Sep 5, 2023
    Configuration menu
    Copy the full SHA
    3aecece View commit details
    Browse the repository at this point in the history

  19. bloodhound: Add Kubernetes 4.2.12 check 

    This adds check 4.2.12 to check that kubelet is only configured to use
secure cryptographic ciphers.

Signed-off-by: Sean McGinnis <[email protected]>
    @stmcginnis
    stmcginnis committed Sep 5, 2023
    Configuration menu
    Copy the full SHA
    f2eb742 View commit details
    Browse the repository at this point in the history

  20. bloodhound: Add Kubernetes 4.2.13 check 

    This adds verification that podPidsLimit is configured to restrict the
maximum number of PIDs allowed per-pod.

Signed-off-by: Sean McGinnis <[email protected]>
    @stmcginnis
    stmcginnis committed Sep 5, 2023
    Configuration menu
    Copy the full SHA
    2d48b3a View commit details
    Browse the repository at this point in the history

  21. bloodhound: Skip K8s 4.2.10 as not applicable 

    This changes the 4.2.10 check to be a manual test response. This check
does not apply to EKS or EKS-D since external IAM auth is used.

This leaves the validation logic in place as we may want to use it in
the future. For not EKS-related use cases, it may make sense to enable
configuration of certificate rotation. If/when that is done, this check
can be reenabled and updated to validate under the proper conditions.

Signed-off-by: Sean McGinnis <[email protected]>
    @stmcginnis
    stmcginnis committed Sep 5, 2023
    Configuration menu
    Copy the full SHA
    a0f46eb View commit details
    Browse the repository at this point in the history

  22. apiserver: Add support for Kuberenetes CIS report 

    This adds handling for a "type" parameter to be passed along to the
`/report/cis` endpoint to control what type of CIS report to generate.
The default type is the Bottlerocket CIS benchmark report, with
"kubernetes" being the only recognized other option.

Signed-off-by: Sean McGinnis <[email protected]>
    @stmcginnis
    stmcginnis committed Sep 5, 2023
    Configuration menu
    Copy the full SHA
    c2ca030 View commit details
    Browse the repository at this point in the history

  23. apiclient: Add report cis-k8s command 

    This adds the `cis-k8s` report subcommand to access the Kubernetes CIS
report. It uses the standard CIS arguments of `-l` for level and `-f`
for format.

Signed-off-by: Sean McGinnis <[email protected]>
    @stmcginnis
    stmcginnis committed Sep 5, 2023
    Configuration menu
    Copy the full SHA
    8767ea0 View commit details
    Browse the repository at this point in the history