feat(controllermanager): add checks for Kubernetes Controller Manager (#3291)

prowler/providers/kubernetes/services/controllermanager/controllermanager_bind_address/controllermanager_bind_address.metadata.json

@@ -0,0 +1,36 @@
+{
+  "Provider": "kubernetes",
+  "CheckID": "controllermanager_bind_address",
+  "CheckTitle": "Ensure that the --bind-address argument is set to 127.0.0.1",
+  "CheckType": [
+    "Security",
+    "Configuration"
+  ],
+  "ServiceName": "controller-manager",
+  "SubServiceName": "Bind Address Configuration",
+  "ResourceIdTemplate": "",
+  "Severity": "medium",
+  "ResourceType": "KubernetesControllerManager",
+  "Description": "This check verifies that the Kubernetes Controller Manager is bound to the loopback address (127.0.0.1) to minimize the cluster's attack surface. Binding to the loopback address ensures that the Controller Manager API service is not exposed to unauthorized network access.",
+  "Risk": "Binding the Controller Manager to a non-loopback address exposes sensitive health and metrics information without authentication or encryption.",
+  "RelatedUrl": "https://kubernetes.io/docs/reference/command-line-tools-reference/kube-controller-manager/",
+  "Remediation": {
+    "Code": {
+      "CLI": "Edit the controller-manager manifest to set --bind-address to 127.0.0.1.",
+      "NativeIaC": "",
+      "Other": "",
+      "Terraform": ""
+    },
+    "Recommendation": {
+      "Text": "Bind the Controller Manager to the loopback address for enhanced security.",
+      "Url": "https://kubernetes.io/docs/reference/command-line-tools-reference/kube-controller-manager/"
+    }
+  },
+  "Categories": [
+    "Network Security",
+    "Configuration Management"
+  ],
+  "DependsOn": [],
+  "RelatedTo": [],
+  "Notes": "Check for the --address argument as well, as it might be used instead of --bind-address in certain Kubernetes versions."
+}

prowler/providers/kubernetes/services/controllermanager/controllermanager_bind_address/controllermanager_bind_address.py

@@ -0,0 +1,25 @@
+from prowler.lib.check.models import Check, Check_Report_Kubernetes
+from prowler.providers.kubernetes.services.controllermanager.controllermanager_client import (
+    controllermanager_client,
+)
+
+
+class controllermanager_bind_address(Check):
+    def execute(self) -> Check_Report_Kubernetes:
+        findings = []
+        for pod in controllermanager_client.controllermanager_pods:
+            report = Check_Report_Kubernetes(self.metadata())
+            report.namespace = pod.namespace
+            report.resource_name = pod.name
+            report.resource_id = pod.uid
+            report.status = "PASS"
+            report.status_extended = f"Controller Manager is bound to the loopback address in pod {pod.name}."
+            for container in pod.containers.values():
+                if "--bind-address=127.0.0.1" not in str(
+                    container.command
+                ) and "--address=127.0.0.1" not in str(container.command):
+                    report.status = "FAIL"
+                    report.status_extended = f"Controller Manager is not bound to the loopback address in pod {pod.name}."
+                    break
+            findings.append(report)
+        return findings

prowler/providers/kubernetes/services/controllermanager/controllermanager_disable_profiling/controllermanager_disable_profiling.metadata.json

@@ -0,0 +1,35 @@
+{
+  "Provider": "kubernetes",
+  "CheckID": "controller_manager_disable_profiling",
+  "CheckTitle": "Ensure that the --profiling argument is set to false",
+  "CheckType": [
+    "Security",
+    "Configuration"
+  ],
+  "ServiceName": "controller-manager",
+  "SubServiceName": "Profiling Configuration",
+  "ResourceIdTemplate": "",
+  "Severity": "medium",
+  "ResourceType": "KubernetesControllerManager",
+  "Description": "This check ensures that profiling is disabled in the Kubernetes Controller Manager, reducing the potential attack surface.",
+  "Risk": "Enabling profiling can expose detailed system and program information, which could be exploited if accessed by unauthorized users.",
+  "RelatedUrl": "https://kubernetes.io/docs/reference/command-line-tools-reference/kube-controller-manager/",
+  "Remediation": {
+    "Code": {
+      "CLI": "Edit the controller-manager manifest to set the --profiling argument to false.",
+      "NativeIaC": "",
+      "Other": "",
+      "Terraform": ""
+    },
+    "Recommendation": {
+      "Text": "Disable profiling in the Kubernetes Controller Manager for enhanced security.",
+      "Url": "https://kubernetes.io/docs/reference/command-line-tools-reference/kube-controller-manager/#options"
+    }
+  },
+  "Categories": [
+    "Security Best Practices"
+  ],
+  "DependsOn": [],
+  "RelatedTo": [],
+  "Notes": "Profiling should be turned off unless it is explicitly required for troubleshooting performance issues."
+}

prowler/providers/kubernetes/services/controllermanager/controllermanager_disable_profiling/controllermanager_disable_profiling.py

@@ -0,0 +1,27 @@
+from prowler.lib.check.models import Check, Check_Report_Kubernetes
+from prowler.providers.kubernetes.services.controllermanager.controllermanager_client import (
+    controllermanager_client,
+)
+
+
+class controllermanager_disable_profiling(Check):
+    def execute(self) -> Check_Report_Kubernetes:
+        findings = []
+        for pod in controllermanager_client.controllermanager_pods:
+            report = Check_Report_Kubernetes(self.metadata())
+            report.namespace = pod.namespace
+            report.resource_name = pod.name
+            report.resource_id = pod.uid
+            report.status = "PASS"
+            report.status_extended = (
+                f"Controller Manager does not have profiling enabled in pod {pod.name}."
+            )
+            for container in pod.containers.values():
+                if "--profiling=false" not in str(container.command):
+                    report.status = "FAIL"
+                    report.status_extended = (
+                        f"Controller Manager has profiling enabled in pod {pod.name}."
+                    )
+                    break
+            findings.append(report)
+        return findings

prowler/providers/kubernetes/services/controllermanager/controllermanager_root_ca_file_set/controllermanager_root_ca_file_set.metadata.json

@@ -0,0 +1,36 @@
+{
+  "Provider": "kubernetes",
+  "CheckID": "controllermanager_root_ca_file_set",
+  "CheckTitle": "Ensure that the --root-ca-file argument is set as appropriate",
+  "CheckType": [
+    "Security",
+    "Configuration"
+  ],
+  "ServiceName": "controller-manager",
+  "SubServiceName": "Root CA File Configuration",
+  "ResourceIdTemplate": "",
+  "Severity": "medium",
+  "ResourceType": "KubernetesControllerManager",
+  "Description": "This check verifies that the Kubernetes Controller Manager is configured with the --root-ca-file argument set to a certificate bundle file, allowing pods to verify the API server's serving certificate.",
+  "Risk": "Not setting the root CA file can expose pods to man-in-the-middle attacks due to unverified TLS connections to the API server.",
+  "RelatedUrl": "https://kubernetes.io/docs/setup/best-practices/certificates/",
+  "Remediation": {
+    "Code": {
+      "CLI": "Edit the controller-manager manifest to set the --root-ca-file argument to the appropriate certificate bundle file.",
+      "NativeIaC": "",
+      "Other": "",
+      "Terraform": ""
+    },
+    "Recommendation": {
+      "Text": "Configure the Controller Manager with a root CA file to enhance security for pods communicating with the API server.",
+      "Url": "https://kubernetes.io/docs/setup/best-practices/certificates/#certificate-paths"
+    }
+  },
+  "Categories": [
+    "Data Security",
+    "Network Security"
+  ],
+  "DependsOn": [],
+  "RelatedTo": [],
+  "Notes": "Ensure that the certificate bundle file is properly maintained and updated as needed."
+}

prowler/providers/kubernetes/services/controllermanager/controllermanager_root_ca_file_set/controllermanager_root_ca_file_set.py

@@ -0,0 +1,23 @@
+from prowler.lib.check.models import Check, Check_Report_Kubernetes
+from prowler.providers.kubernetes.services.controllermanager.controllermanager_client import (
+    controllermanager_client,
+)
+
+
+class controllermanager_root_ca_file_set(Check):
+    def execute(self) -> Check_Report_Kubernetes:
+        findings = []
+        for pod in controllermanager_client.controllermanager_pods:
+            report = Check_Report_Kubernetes(self.metadata())
+            report.namespace = pod.namespace
+            report.resource_name = pod.name
+            report.resource_id = pod.uid
+            report.status = "PASS"
+            report.status_extended = f"Controller Manager does not have the root CA file set in pod {pod.name}."
+            for container in pod.containers.values():
+                if "--root-ca-file=" not in str(container.command):
+                    report.status = "FAIL"
+                    report.status_extended = f"Controller Manager has the root CA file set in pod {pod.name}."
+                    break
+            findings.append(report)
+        return findings

prowler/providers/kubernetes/services/controllermanager/controllermanager_rotate_kubelet_server_cert/controllermanager_rotate_kubelet_server_cert.metadata.json

@@ -0,0 +1,36 @@
+{
+  "Provider": "kubernetes",
+  "CheckID": "controllermanager_rotate_kubelet_server_cert",
+  "CheckTitle": "Ensure that the RotateKubeletServerCertificate argument is set to true",
+  "CheckType": [
+    "Security",
+    "Configuration"
+  ],
+  "ServiceName": "controller-manager",
+  "SubServiceName": "Kubelet Server Certificate Rotation",
+  "ResourceIdTemplate": "",
+  "Severity": "medium",
+  "ResourceType": "KubernetesControllerManager",
+  "Description": "This check ensures that the Kubernetes Controller Manager is configured with the RotateKubeletServerCertificate argument set to true, enabling automated rotation of kubelet server certificates.",
+  "Risk": "Not enabling kubelet server certificate rotation could lead to downtime due to expired certificates.",
+  "RelatedUrl": "https://kubernetes.io/docs/tasks/tls/certificate-rotation/",
+  "Remediation": {
+    "Code": {
+      "CLI": "Edit the controller-manager manifest to include RotateKubeletServerCertificate=true in the --feature-gates parameter.",
+      "NativeIaC": "",
+      "Other": "",
+      "Terraform": ""
+    },
+    "Recommendation": {
+      "Text": "Enable kubelet server certificate rotation in the Controller Manager for automated certificate management.",
+      "Url": "https://kubernetes.io/docs/tasks/tls/certificate-rotation/#understanding-the-certificate-rotation-configuration"
+    }
+  },
+  "Categories": [
+    "Data Security",
+    "Configuration Management"
+  ],
+  "DependsOn": [],
+  "RelatedTo": [],
+  "Notes": "Ensure that your cluster setup supports kubelet server certificate rotation."
+}

prowler/providers/kubernetes/services/controllermanager/controllermanager_rotate_kubelet_server_cert/controllermanager_rotate_kubelet_server_cert.py

@@ -0,0 +1,32 @@
+from prowler.lib.check.models import Check, Check_Report_Kubernetes
+from prowler.providers.kubernetes.services.controllermanager.controllermanager_client import (
+    controllermanager_client,
+)
+
+
+class controllermanager_rotate_kubelet_server_cert(Check):
+    def execute(self) -> Check_Report_Kubernetes:
+        findings = []
+        for pod in controllermanager_client.controllermanager_pods:
+            report = Check_Report_Kubernetes(self.metadata())
+            report.namespace = pod.namespace
+            report.resource_name = pod.name
+            report.resource_id = pod.uid
+            report.status = "PASS"
+            report.status_extended = f"Controller Manager has RotateKubeletServerCertificate set to true in pod {pod.name}."
+            kubelete_server_cert = True
+            for container in pod.containers.values():
+                kubelete_server_cert = True
+                for command in container.command:
+                    if command.startswith("--feature-gates"):
+                        if "RotateKubeletServerCertificate=true" not in (
+                            command.split("=")[1]
+                        ):
+                            kubelete_server_cert = False
+                if not kubelete_server_cert:
+                    break
+            if not kubelete_server_cert:
+                report.status = "FAIL"
+                report.status_extended = f"Controller Manager does not have RotateKubeletServerCertificate set to true in pod {pod.name}."
+            findings.append(report)
+        return findings

prowler/providers/kubernetes/services/controllermanager/controllermanager_service_account_credentials/controllermanager_service_account_credentials.metadata.json

@@ -0,0 +1,36 @@
+{
+  "Provider": "kubernetes",
+  "CheckID": "controllermanager_service_account_credentials",
+  "CheckTitle": "Ensure that the --use-service-account-credentials argument is set to true",
+  "CheckType": [
+    "Security",
+    "Configuration"
+  ],
+  "ServiceName": "controller-manager",
+  "SubServiceName": "Service Account Credentials",
+  "ResourceIdTemplate": "",
+  "Severity": "medium",
+  "ResourceType": "KubernetesControllerManager",
+  "Description": "This check verifies that the Kubernetes Controller Manager is configured to use individual service account credentials for each controller, enhancing the security and role separation within the Kubernetes system.",
+  "Risk": "Not using individual service account credentials can lead to overly broad permissions and potential security risks.",
+  "RelatedUrl": "https://kubernetes.io/docs/reference/command-line-tools-reference/kube-controller-manager/",
+  "Remediation": {
+    "Code": {
+      "CLI": "Edit the controller-manager manifest to set the --use-service-account-credentials argument to true.",
+      "NativeIaC": "",
+      "Other": "",
+      "Terraform": ""
+    },
+    "Recommendation": {
+      "Text": "Configure the Controller Manager to use individual service account credentials for enhanced security and role separation.",
+      "Url": "https://kubernetes.io/docs/reference/command-line-tools-reference/kube-controller-manager/#options"
+    }
+  },
+  "Categories": [
+    "Security Best Practices",
+    "Access Control"
+  ],
+  "DependsOn": [],
+  "RelatedTo": [],
+  "Notes": "Ensure that appropriate roles and permissions are set for each service account when enabling this feature."
+}

prowler/providers/kubernetes/services/controllermanager/controllermanager_service_account_credentials/controllermanager_service_account_credentials.py

@@ -0,0 +1,25 @@
+from prowler.lib.check.models import Check, Check_Report_Kubernetes
+from prowler.providers.kubernetes.services.controllermanager.controllermanager_client import (
+    controllermanager_client,
+)
+
+
+class controllermanager_service_account_credentials(Check):
+    def execute(self) -> Check_Report_Kubernetes:
+        findings = []
+        for pod in controllermanager_client.controllermanager_pods:
+            report = Check_Report_Kubernetes(self.metadata())
+            report.namespace = pod.namespace
+            report.resource_name = pod.name
+            report.resource_id = pod.uid
+            report.status = "PASS"
+            report.status_extended = f"Controller Manager is not using service account credentials in pod {pod.name}."
+            for container in pod.containers.values():
+                if "--use-service-account-credentials=true" not in str(
+                    container.command
+                ):
+                    report.status = "FAIL"
+                    report.status_extended = f"Controller Manager is using service account credentials in pod {pod.name}."
+                    break
+            findings.append(report)
+        return findings

prowler/providers/kubernetes/services/controllermanager/controllermanager_service_account_private_key_file/controllermanager_service_account_private_key_file.metadata.json

@@ -0,0 +1,36 @@
+{
+  "Provider": "kubernetes",
+  "CheckID": "controllermanager_service_account_private_key_file",
+  "CheckTitle": "Ensure that the --service-account-private-key-file argument is set as appropriate",
+  "CheckType": [
+    "Security",
+    "Configuration"
+  ],
+  "ServiceName": "controller-manager",
+  "SubServiceName": "Service Account Private Key File Configuration",
+  "ResourceIdTemplate": "",
+  "Severity": "medium",
+  "ResourceType": "KubernetesControllerManager",
+  "Description": "This check ensures that the Kubernetes Controller Manager is configured with the --service-account-private-key-file argument set to the private key file for service accounts.",
+  "Risk": "Not setting a private key file for service accounts can hinder the ability to securely rotate service account tokens.",
+  "RelatedUrl": "https://kubernetes.io/docs/reference/access-authn-authz/service-accounts-admin/",
+  "Remediation": {
+    "Code": {
+      "CLI": "Edit the controller-manager manifest to set the --service-account-private-key-file argument to the appropriate private key file.",
+      "NativeIaC": "",
+      "Other": "",
+      "Terraform": ""
+    },
+    "Recommendation": {
+      "Text": "Configure the Controller Manager with a private key file for service accounts to maintain security and enable token rotation.",
+      "Url": "https://kubernetes.io/docs/reference/access-authn-authz/service-accounts-admin/#token-controller"
+    }
+  },
+  "Categories": [
+    "Data Security",
+    "Configuration Management"
+  ],
+  "DependsOn": [],
+  "RelatedTo": [],
+  "Notes": "Ensure the private key file is securely maintained and periodically rotated as per the organization's policy."
+}

prowler/providers/kubernetes/services/controllermanager/controllermanager_service_account_private_key_file/controllermanager_service_account_private_key_file.py

@@ -0,0 +1,23 @@
+from prowler.lib.check.models import Check, Check_Report_Kubernetes
+from prowler.providers.kubernetes.services.controllermanager.controllermanager_client import (
+    controllermanager_client,
+)
+
+
+class controllermanager_service_account_private_key_file(Check):
+    def execute(self) -> Check_Report_Kubernetes:
+        findings = []
+        for pod in controllermanager_client.controllermanager_pods:
+            report = Check_Report_Kubernetes(self.metadata())
+            report.namespace = pod.namespace
+            report.resource_name = pod.name
+            report.resource_id = pod.uid
+            report.status = "PASS"
+            report.status_extended = f"Controller Manager does not have the service account private key file set in pod {pod.name}."
+            for container in pod.containers.values():
+                if "--service-account-private-key-file=" not in str(container.command):
+                    report.status = "FAIL"
+                    report.status_extended = f"Controller Manager has the service account private key file set in pod {pod.name}."
+                    break
+            findings.append(report)
+        return findings