forked from bottlerocket-os/bottlerocket
-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
bloodhound: Add base Kubernetes checker binary
This adds a multicall binary to be used as the common entry point for all Kubernetes CIS benchmark checks. Signed-off-by: Sean McGinnis <[email protected]>
- Loading branch information
1 parent
2108507
commit 76b8b54
Showing
4 changed files
with
81 additions
and
1 deletion.
There are no files selected for viewing
File renamed without changes.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,5 @@ | ||
| { | ||
| "name": "CIS Kubernetes Benchmark (Worker Node)", | ||
| "version": "v1.7.1", | ||
| "url": "https://www.cisecurity.org/benchmark/kubernetes" | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,54 @@ | ||
| use bloodhound::results::*; | ||
| use std::env; | ||
| use std::path::Path; | ||
|
|
||
| fn main() { | ||
| let args: Vec<String> = env::args().collect(); | ||
| let cmd_name = Path::new(&args[0]) | ||
| .file_name() | ||
| .unwrap_or_default() | ||
| .to_str() | ||
| .unwrap_or_default(); | ||
|
|
||
| let checker: Box<dyn Checker> = match cmd_name { | ||
| "k8s04010300" => Box::new(ManualChecker { | ||
| name: cmd_name.to_string(), | ||
| title: "If proxy kubeconfig file exists ensure permissions are set to 644 or more restrictive".to_string(), | ||
| id: "4.1.3".to_string(), | ||
| level: 1, | ||
| }), | ||
| "k8s04010400" => Box::new(ManualChecker { | ||
| name: cmd_name.to_string(), | ||
| title: "If proxy kubeconfig file exists ensure ownership is set to root:root".to_string(), | ||
| id: "4.1.4".to_string(), | ||
| level: 1, | ||
| }), | ||
| "k8s04020700" => Box::new(ManualChecker { | ||
| name: cmd_name.to_string(), | ||
| title: "Ensure that the --hostname-override argument is not set (not valid for Bottlerocket)".to_string(), | ||
| id: "4.2.7".to_string(), | ||
| level: 1, | ||
| }), | ||
| "k8s04020800" => Box::new(ManualChecker { | ||
| name: cmd_name.to_string(), | ||
| title: "Ensure that the eventRecordQPS argument is set to a level which ensures appropriate event capture".to_string(), | ||
| id: "4.2.8".to_string(), | ||
| level: 2, | ||
| }), | ||
| &_ => { | ||
| eprintln!("Command {} is not supported.", cmd_name); | ||
| return; | ||
| } | ||
| }; | ||
|
|
||
| // Check if the metadata subcommand is being called | ||
| let get_metadata = env::args().nth(1).unwrap_or_default() == "metadata"; | ||
|
|
||
| if get_metadata { | ||
| let metadata = checker.metadata(); | ||
| println!("{}", metadata); | ||
| } else { | ||
| let result = checker.execute(); | ||
| println!("{}", result); | ||
| } | ||
| } |