Remove flag:proxykubeconfig from test_items in node.yaml for 4.1.3 an…

…d 4.1.4 (cis-1.24 & cis-1.7)
rancher · Aug 29, 2023 · 70227bd · 70227bd
1 parent 011ad94
commit 70227bd
Show file tree

Hide file tree

Showing 14 changed files with 7 additions and 63 deletions.
diff --git a/package/cfg/cis-1.24/node.yaml b/package/cfg/cis-1.24/node.yaml
@@ -45,8 +45,6 @@ groups:
               compare:
                 op: bitmask
                 value: "600"
-            - flag: "$proxykubeconfig"
-              set: false
         remediation: |
           Run the below command (based on the file location on your system) on the each worker node.
           For example,
@@ -60,8 +58,6 @@ groups:
           bin_op: or
           test_items:
             - flag: root:root
-            - flag: "$proxykubeconfig"
-              set: false
         remediation: |
           Run the below command (based on the file location on your system) on the each worker node.
           For example, chown root:root $proxykubeconfig
@@ -453,4 +449,4 @@ groups:
           Based on your system, restart the kubelet service. For example:
           systemctl daemon-reload
           systemctl restart kubelet.service
-        scored: false
+        scored: false
diff --git a/package/cfg/cis-1.7/node.yaml b/package/cfg/cis-1.7/node.yaml
@@ -45,8 +45,6 @@ groups:
               compare:
                 op: bitmask
                 value: "600"
-            - flag: "$proxykubeconfig"
-              set: false
         remediation: |
           Run the below command (based on the file location on your system) on the each worker node.
           For example,
@@ -60,8 +58,6 @@ groups:
           bin_op: or
           test_items:
             - flag: root:root
-            - flag: "$proxykubeconfig"
-              set: false
         remediation: |
           Run the below command (based on the file location on your system) on the each worker node.
           For example, chown root:root $proxykubeconfig

diff --git a/package/cfg/k3s-cis-1.24-hardened/node.yaml b/package/cfg/k3s-cis-1.24-hardened/node.yaml
@@ -47,8 +47,6 @@ groups:
               compare:
                 op: bitmask
                 value: "600"
-            - flag: "$proxykubeconfig"
-              set: false
         remediation: |
           Run the below command (based on the file location on your system) on the each worker node.
           For example,
@@ -62,8 +60,6 @@ groups:
           bin_op: or
           test_items:
             - flag: root:root
-            - flag: "$proxykubeconfig"
-              set: false
         remediation: |
           Run the below command (based on the file location on your system) on the each worker node.
           For example, chown root:root $proxykubeconfig
@@ -461,4 +457,4 @@ groups:
           Based on your system, restart the kubelet service. For example:
           systemctl daemon-reload
           systemctl restart kubelet.service
-        scored: false
+        scored: false
diff --git a/package/cfg/k3s-cis-1.24-permissive/node.yaml b/package/cfg/k3s-cis-1.24-permissive/node.yaml
@@ -47,8 +47,6 @@ groups:
               compare:
                 op: bitmask
                 value: "600"
-            - flag: "$proxykubeconfig"
-              set: false
         remediation: |
           Run the below command (based on the file location on your system) on the each worker node.
           For example,
@@ -62,8 +60,6 @@ groups:
           bin_op: or
           test_items:
             - flag: root:root
-            - flag: "$proxykubeconfig"
-              set: false
         remediation: |
           Run the below command (based on the file location on your system) on the each worker node.
           For example, chown root:root $proxykubeconfig
@@ -463,4 +459,4 @@ groups:
           Based on your system, restart the kubelet service. For example:
           systemctl daemon-reload
           systemctl restart kubelet.service
-        scored: false
+        scored: false
diff --git a/package/cfg/k3s-cis-1.7-hardened/node.yaml b/package/cfg/k3s-cis-1.7-hardened/node.yaml
@@ -49,8 +49,6 @@ groups:
               compare:
                 op: bitmask
                 value: "600"
-            - flag: "$proxykubeconfig"
-              set: false
         remediation: |
           Run the below command (based on the file location on your system) on the each worker node.
           For example,
@@ -64,8 +62,6 @@ groups:
           bin_op: or
           test_items:
             - flag: root:root
-            - flag: "$proxykubeconfig"
-              set: false
         remediation: |
           Run the below command (based on the file location on your system) on the each worker node.
           For example, chown root:root $proxykubeconfig

diff --git a/package/cfg/k3s-cis-1.7-permissive/node.yaml b/package/cfg/k3s-cis-1.7-permissive/node.yaml
@@ -49,8 +49,6 @@ groups:
               compare:
                 op: bitmask
                 value: "600"
-            - flag: "$proxykubeconfig"
-              set: false
         remediation: |
           Run the below command (based on the file location on your system) on the each worker node.
           For example,
@@ -64,8 +62,6 @@ groups:
           bin_op: or
           test_items:
             - flag: root:root
-            - flag: "$proxykubeconfig"
-              set: false
         remediation: |
           Run the below command (based on the file location on your system) on the each worker node.
           For example, chown root:root $proxykubeconfig

diff --git a/package/cfg/rke-cis-1.24-hardened/node.yaml b/package/cfg/rke-cis-1.24-hardened/node.yaml
@@ -46,8 +46,6 @@ groups:
               compare:
                 op: bitmask
                 value: "644"
-            - flag: "$proxykubeconfig"
-              set: false
         remediation: |
           Run the below command (based on the file location on your system) on the each worker node.
           For example,
@@ -61,8 +59,6 @@ groups:
           bin_op: or
           test_items:
             - flag: root:root
-            - flag: "$proxykubeconfig"
-              set: false
         remediation: |
           Run the below command (based on the file location on your system) on the each worker node.
           For example, chown root:root $proxykubeconfig
@@ -474,4 +470,4 @@ groups:
           Based on your system, restart the kubelet service. For example:
           systemctl daemon-reload
           systemctl restart kubelet.service
-        scored: true
+        scored: true
diff --git a/package/cfg/rke-cis-1.24-permissive/node.yaml b/package/cfg/rke-cis-1.24-permissive/node.yaml
@@ -47,8 +47,6 @@ groups:
               compare:
                 op: bitmask
                 value: "600"
-            - flag: "$proxykubeconfig"
-              set: false
         remediation: |
           Run the below command (based on the file location on your system) on the each worker node.
           For example,
@@ -62,8 +60,6 @@ groups:
           bin_op: or
           test_items:
             - flag: root:root
-            - flag: "$proxykubeconfig"
-              set: false
         remediation: |
           Run the below command (based on the file location on your system) on the each worker node.
           For example, chown root:root $proxykubeconfig
@@ -465,4 +461,4 @@ groups:
           Based on your system, restart the kubelet service. For example:
           systemctl daemon-reload
           systemctl restart kubelet.service
-        scored: true
+        scored: true
diff --git a/package/cfg/rke-cis-1.7-hardened/node.yaml b/package/cfg/rke-cis-1.7-hardened/node.yaml
@@ -51,8 +51,6 @@ groups:
               compare:
                 op: bitmask
                 value: "600"
-            - flag: "$proxykubeconfig"
-              set: false
         remediation: |
           Run the below command (based on the file location on your system) on the each worker node.
           For example,
@@ -66,8 +64,6 @@ groups:
           bin_op: or
           test_items:
             - flag: root:root
-            - flag: "$proxykubeconfig"
-              set: false
         remediation: |
           Run the below command (based on the file location on your system) on the each worker node.
           For example, chown root:root $proxykubeconfig

diff --git a/package/cfg/rke-cis-1.7-permissive/node.yaml b/package/cfg/rke-cis-1.7-permissive/node.yaml
@@ -51,8 +51,6 @@ groups:
               compare:
                 op: bitmask
                 value: "600"
-            - flag: "$proxykubeconfig"
-              set: false
         remediation: |
           Run the below command (based on the file location on your system) on the each worker node.
           For example,
@@ -66,8 +64,6 @@ groups:
           bin_op: or
           test_items:
             - flag: root:root
-            - flag: "$proxykubeconfig"
-              set: false
         remediation: |
           Run the below command (based on the file location on your system) on the each worker node.
           For example, chown root:root $proxykubeconfig

diff --git a/package/cfg/rke2-cis-1.24-hardened/node.yaml b/package/cfg/rke2-cis-1.24-hardened/node.yaml
@@ -49,8 +49,6 @@ groups:
               compare:
                 op: bitmask
                 value: "600"
-            - flag: "$proxykubeconfig"
-              set: false
         remediation: |
           Run the below command (based on the file location on your system) on the each worker node.
           For example,
@@ -64,8 +62,6 @@ groups:
           bin_op: or
           test_items:
             - flag: root:root
-            - flag: "$proxykubeconfig"
-              set: false
         remediation: |
           Run the below command (based on the file location on your system) on the each worker node.
           For example, chown root:root $proxykubeconfig
@@ -472,4 +468,4 @@ groups:
           Based on your system, restart the kubelet service. For example:
           systemctl daemon-reload
           systemctl restart kubelet.service
-        scored: false
+        scored: false
diff --git a/package/cfg/rke2-cis-1.24-permissive/node.yaml b/package/cfg/rke2-cis-1.24-permissive/node.yaml
@@ -48,8 +48,6 @@ groups:
               compare:
                 op: bitmask
                 value: "600"
-            - flag: "$proxykubeconfig"
-              set: false
         remediation: |
           Run the below command (based on the file location on your system) on the each worker node.
           For example,
@@ -63,8 +61,6 @@ groups:
           bin_op: or
           test_items:
             - flag: root:root
-            - flag: "$proxykubeconfig"
-              set: false
         remediation: |
           Run the below command (based on the file location on your system) on the each worker node.
           For example, chown root:root $proxykubeconfig
@@ -470,4 +466,4 @@ groups:
           Based on your system, restart the kubelet service. For example:
           systemctl daemon-reload
           systemctl restart kubelet.service
-        scored: false
+        scored: false
diff --git a/package/cfg/rke2-cis-1.7-hardened/node.yaml b/package/cfg/rke2-cis-1.7-hardened/node.yaml
@@ -49,8 +49,6 @@ groups:
               compare:
                 op: bitmask
                 value: "600"
-            - flag: "$proxykubeconfig"
-              set: false
         remediation: |
           Run the below command (based on the file location on your system) on the each worker node.
           For example,
@@ -64,8 +62,6 @@ groups:
           bin_op: or
           test_items:
             - flag: root:root
-            - flag: "$proxykubeconfig"
-              set: false
         remediation: |
           Run the below command (based on the file location on your system) on the each worker node.
           For example, chown root:root $proxykubeconfig

diff --git a/package/cfg/rke2-cis-1.7-permissive/node.yaml b/package/cfg/rke2-cis-1.7-permissive/node.yaml
@@ -49,8 +49,6 @@ groups:
               compare:
                 op: bitmask
                 value: "600"
-            - flag: "$proxykubeconfig"
-              set: false
         remediation: |
           Run the below command (based on the file location on your system) on the each worker node.
           For example,
@@ -64,8 +62,6 @@ groups:
           bin_op: or
           test_items:
             - flag: root:root
-            - flag: "$proxykubeconfig"
-              set: false
         remediation: |
           Run the below command (based on the file location on your system) on the each worker node.
           For example, chown root:root $proxykubeconfig